@lunora/advisor 1.0.0-alpha.3 → 1.0.0-alpha.30

package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs

@@ -0,0 +1,39 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const VIA_LABELS = {
+  "headers-append": "a `headers.append(...)` call",
+  "headers-ctor": "a `new Headers({...})` initializer",
+  "headers-set": "a `headers.set(...)` call",
+  "response-init": "a `Response` init `headers` object"
+};
+const httpActionResponseHeaderInjection = {
+  categories: ["SECURITY"],
+  description: "An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "http_action_response_header_injection",
+  remediation: "Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",
+  run: (context) => {
+    if (context.httpHeaderWrites === void 0) {
+      return [];
+    }
+    return context.httpHeaderWrites.map((row) => {
+      const header = row.headerName === "" ? "a response header" : `the \`${row.headerName}\` response header`;
+      return emit(httpActionResponseHeaderInjection, {
+        cacheKey: `http_action_response_header_injection:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.exportName}\` (${row.file}:${row.line.toString()}) writes ${header} from raw request input via ${VIA_LABELS[row.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          headerName: row.headerName,
+          line: row.line,
+          via: row.via
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Response header written from unsanitized request input"
+};
+
+export { httpActionResponseHeaderInjection as default };

package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const identityUndeclaredClaimTrusted = {
+  categories: ["SECURITY"],
+  description: "An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "identity_undeclared_claim_trusted",
+  remediation: "Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",
+  run: (context) => {
+    if (context.identityClaimReads === void 0) {
+      return [];
+    }
+    return context.identityClaimReads.filter((row) => !row.declared).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      return emit(identityUndeclaredClaimTrusted, {
+        cacheKey: `identity_undeclared_claim_trusted:${row.file}:${row.line.toString()}:${row.key}`,
+        detail: `\`${row.key}\` in ${location} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,
+        metadata: {
+          exportName: row.exportName,
+          file: row.file,
+          key: row.key,
+          line: row.line
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Authorization trusts an undeclared identity claim"
+};
+
+export { identityUndeclaredClaimTrusted as default };

package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const imagesUrlSourceFromUserInput = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `images_url_source_from_user_input:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",
+  detail: (access) => `\`buildImageDeliveryUrl\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.imageDeliveryUrlAccesses,
+  level: "WARN",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line };
+  },
+  name: "images_url_source_from_user_input",
+  remediation: "Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",
+  title: "Image delivery URL built from unscoped user input"
+});
+
+export { imagesUrlSourceFromUserInput as default };

package/dist/packem_shared/{indexReferencesUnknownField-DH0_dbUY.mjs → indexReferencesUnknownField-BSWNngxX.mjs}

@@ -1,5 +1,5 @@
 import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
+import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
 
 const indexReferencesUnknownField = {
   categories: ["SCHEMA"],

package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const insertManyUnsafeUserData = {
+  categories: ["SECURITY"],
+  description: "A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "insert_many_unsafe_user_data",
+  remediation: "Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    return context.procedureProtections.filter((procedure) => procedure.usesInsertManyUnsafe && procedure.visibility === "public").map(
+      (procedure) => emit(insertManyUnsafeUserData, {
+        cacheKey: `insert_many_unsafe_user_data:${procedure.file}:${procedure.exportName}`,
+        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,
+        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
+      })
+    );
+  },
+  source: "static",
+  title: "Public procedure uses insertManyUnsafe (bypasses validators and triggers)"
+};
+
+export { insertManyUnsafeUserData as default };

package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs

@@ -0,0 +1,19 @@
+import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
+
+const kvUnscopedUserKeyIdor = makeArgumentDerivedSinkLint({
+  cacheKey: (access) => `kv_unscoped_user_key_idor:${access.file}:${access.line.toString()}`,
+  categories: ["SECURITY"],
+  description: "A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",
+  detail: (access) => `\`ctx.kv.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,
+  facing: "EXTERNAL",
+  getAccesses: (context) => context.kvKeyAccesses,
+  level: "ERROR",
+  metadata: (access) => {
+    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
+  },
+  name: "kv_unscoped_user_key_idor",
+  remediation: `Prefix every \`ctx.kv\` key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:\${args.id}\`) so a caller can only address their own entries. Never pass request input straight to \`ctx.kv.get\`/\`put\`/\`delete\`.`,
+  title: "Possible IDOR from arg-derived unscoped KV key"
+});
+
+export { kvUnscopedUserKeyIdor as default };

package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs

@@ -0,0 +1,28 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mailInboundDispatchWithoutVerify = {
+  categories: ["SECURITY"],
+  description: "`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "mail_inbound_dispatch_without_verify",
+  remediation: "Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "createInboundEmailHandler" && call.analyzable && !call.presentKeys.includes("verify")).map(
+      (call) => emit(mailInboundDispatchWithoutVerify, {
+        // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+        cacheKey: `mail_inbound_dispatch_without_verify:${call.file}:${call.line.toString()}`,
+        detail: `\`createInboundEmailHandler({...})\` in ${call.file}:${call.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Inbound email handler without a verify hook"
+};
+
+export { mailInboundDispatchWithoutVerify as default };

package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mailRecipientFromRequestInput = {
+  categories: ["SECURITY"],
+  description: "A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mail_recipient_from_request_input",
+  remediation: "Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",
+  run: (context) => {
+    if (context.mailRecipientAccesses === void 0) {
+      return [];
+    }
+    return context.mailRecipientAccesses.map(
+      (access) => emit(mailRecipientFromRequestInput, {
+        cacheKey: `mail_recipient_from_request_input:${access.file}:${access.line.toString()}`,
+        detail: `\`ctx.mail.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,
+        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Mail recipient derived from request input"
+};
+
+export { mailRecipientFromRequestInput as default };

package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const PII_COLUMN_RE = /address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u;
+const isPiiColumn = (column) => PII_COLUMN_RE.test(column.replaceAll(/[^a-z0-9]/giu, "").toLowerCase());
+const maskWeakHashStrategyOnPii = {
+  categories: ["SECURITY"],
+  description: 'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mask_weak_hash_strategy_on_pii",
+  remediation: 'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',
+  run: (context) => {
+    if (context.maskStrategies === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const strategy of context.maskStrategies) {
+      if (strategy.strategy !== "hash" || !isPiiColumn(strategy.column)) {
+        continue;
+      }
+      findings.push(
+        emit(maskWeakHashStrategyOnPii, {
+          cacheKey: `mask_weak_hash_strategy_on_pii:${strategy.file}:${strategy.line.toString()}`,
+          detail: `\`${strategy.exportName}\` in ${strategy.file} masks \`${strategy.table === "" ? strategy.column : `${strategy.table}.${strategy.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,
+          metadata: { column: strategy.column, exportName: strategy.exportName, file: strategy.file, table: strategy.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: 'Weak "hash" mask strategy on a PII column'
+};
+
+export { maskWeakHashStrategyOnPii as default };

package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs

@@ -0,0 +1,76 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const maskedTablesOf = (context) => {
+  const tables = /* @__PURE__ */ new Set();
+  for (const procedure of context.maskProcedures ?? []) {
+    for (const { table } of procedure.maskColumns) {
+      if (table !== "") {
+        tables.add(table);
+      }
+    }
+  }
+  for (const strategy of context.maskStrategies ?? []) {
+    if (strategy.table !== "") {
+      tables.add(strategy.table);
+    }
+  }
+  return tables;
+};
+const relationTargetsOf = (context) => {
+  const targets = /* @__PURE__ */ new Map();
+  for (const table of context.schema.tables) {
+    for (const relation of table.relations) {
+      targets.set(`${table.name} ${relation.name}`, relation.table);
+    }
+  }
+  return targets;
+};
+const maskedRelationLeakViaWith = {
+  categories: ["SECURITY"],
+  description: "A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "masked_relation_leak_via_with",
+  remediation: "Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",
+  run: (context) => {
+    if (context.relationLoads === void 0) {
+      return [];
+    }
+    const maskedTables = maskedTablesOf(context);
+    if (maskedTables.size === 0) {
+      return [];
+    }
+    const relationTargets = relationTargetsOf(context);
+    const findings = [];
+    for (const row of context.relationLoads) {
+      if (row.visibility !== "public" || row.parentTable === "") {
+        continue;
+      }
+      for (const relation of row.relations) {
+        const target = relationTargets.get(`${row.parentTable} ${relation}`);
+        if (target === void 0 || !maskedTables.has(target)) {
+          continue;
+        }
+        findings.push(
+          emit(maskedRelationLeakViaWith, {
+            cacheKey: `masked_relation_leak_via_with:${row.file}:${row.line.toString()}:${row.parentTable}:${relation}`,
+            detail: `The public read in \`${row.exportName}\` (${row.file}:${row.line.toString()}) hydrates relation \`${relation}\` (masked table \`${target}\`) via \`with\` on \`${row.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${target}\`'s masked columns are returned in the clear.`,
+            metadata: {
+              exportName: row.exportName,
+              file: row.file,
+              line: row.line,
+              parentTable: row.parentTable,
+              relation,
+              relationTable: target
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Masked table surfaced unmasked through a with-relation on a public read"
+};
+
+export { maskedRelationLeakViaWith as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const mutatorFullRowReplace = {
+  categories: ["SCHEMA"],
+  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "mutator_full_row_replace",
+  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
+  run: (context) => {
+    if (context.mutatorWrites === void 0) {
+      return [];
+    }
+    return context.mutatorWrites.map(
+      (write) => emit(mutatorFullRowReplace, {
+        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
+        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
+        metadata: { exportName: write.exportName, file: write.file, line: write.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
+};
+
+export { mutatorFullRowReplace as default };

package/dist/packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs

@@ -0,0 +1,50 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const SINK_LABELS = {
+  delete: "deletes the row",
+  get: "reads the row",
+  patch: "patches the row"
+};
+const normalizeIdUsedAsAuthorization = {
+  categories: ["SECURITY"],
+  description: "A `.public()` `query`/`mutation` gates a `ctx.db.get`/`patch`/`delete` on a null-checked `ctx.db.normalizeId(table, id)` result with no ownership predicate and no RLS. `normalizeId` validates id *shape* only — it never reads the database — so a non-null result proves the id is well-formed, never that the caller owns the row (an IDOR).",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "normalize_id_used_as_authorization",
+  remediation: 'Don\'t treat a non-null `normalizeId` result as authorization — it only validates id shape. After loading the row, compare its ownership column (`userId`/`ownerId`/…) against the server-trusted identity (`ctx.auth.userId`), or protect the procedure with `.use(rls(...))` / put the schema in `.rls("required")` mode so the row policy runs on every access.',
+  run: (context) => {
+    if (context.normalizeIdAuthorizations === void 0) {
+      return [];
+    }
+    const rlsRequired = context.schema.rlsMode === "required";
+    const rlsOptOutTables = new Set(context.schema.tables.filter((table) => table.isPublic).map((table) => table.name));
+    const findings = [];
+    for (const row of context.normalizeIdAuthorizations) {
+      if (row.visibility !== "public" || row.usesRls || row.mentionsOwnership) {
+        continue;
+      }
+      if (rlsRequired && (row.table === "" || !rlsOptOutTables.has(row.table))) {
+        continue;
+      }
+      const target = row.table === "" ? "the row" : `the \`${row.table}\` row`;
+      findings.push(
+        emit(normalizeIdUsedAsAuthorization, {
+          cacheKey: `normalize_id_used_as_authorization:${row.file}:${row.line.toString()}`,
+          detail: `Public procedure \`${row.exportName}\` (${row.file}:${row.line.toString()}) gates access on \`ctx.db.normalizeId(...)\` and then ${SINK_LABELS[row.sinkMethod]} — but \`normalizeId\` only validates id shape, it never reads the database or checks ownership. Any caller supplying a well-formed id of ${target} reaches it (IDOR). Compare the loaded row's ownership column against \`ctx.auth\`, or cover the procedure with \`.use(rls(...))\`.`,
+          metadata: {
+            exportName: row.exportName,
+            file: row.file,
+            line: row.line,
+            sinkMethod: row.sinkMethod,
+            table: row.table
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "normalizeId result used as authorization (validates id shape, not ownership)"
+};
+
+export { normalizeIdUsedAsAuthorization as default };

package/dist/packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs

@@ -0,0 +1,51 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { P as PII_FIELD_NAMES } from './helpers-BySnKhVB.mjs';
+
+const outputProjectionMissingOnPublicRead = {
+  categories: ["SECURITY"],
+  description: "A `.public()` `query` returns raw table rows (no `.output(...)` projection, no `.use(mask(...))`) from a table carrying PII-named columns (`email`, `phone`, `ssn`, …). Every column ships to the caller, and a column added to the table later leaks by default.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "output_projection_missing_on_public_read",
+  remediation: "Add an explicit return projection to the public query — `.output(v.object({ … }))` listing only the fields a client needs — or apply a `.use(mask(...))` policy to the PII columns. This makes the exposed shape intentional and stops a newly-added column from leaking through this query by default.",
+  run: (context) => {
+    if (context.rawRowReturns === void 0) {
+      return [];
+    }
+    const piiColumnsByTable = /* @__PURE__ */ new Map();
+    for (const table of context.schema.tables) {
+      const piiColumns = table.fields.filter((field) => PII_FIELD_NAMES.has(field));
+      if (piiColumns.length > 0) {
+        piiColumnsByTable.set(table.name, piiColumns);
+      }
+    }
+    const findings = [];
+    for (const row of context.rawRowReturns) {
+      if (row.visibility !== "public" || row.usesOutput || row.usesMask || row.table === "") {
+        continue;
+      }
+      const piiColumns = piiColumnsByTable.get(row.table);
+      if (piiColumns === void 0) {
+        continue;
+      }
+      findings.push(
+        emit(outputProjectionMissingOnPublicRead, {
+          cacheKey: `output_projection_missing_on_public_read:${row.file}:${row.line.toString()}`,
+          detail: `Public query \`${row.exportName}\` (${row.file}:${row.line.toString()}) returns raw \`${row.table}\` rows with no \`.output(...)\` projection — shipping PII column(s) ${piiColumns.join(", ")} to every caller, and any column added to \`${row.table}\` later leaks by default. Project the return with \`.output(v.object({ … }))\` or mask the PII columns.`,
+          metadata: {
+            columns: piiColumns,
+            exportName: row.exportName,
+            file: row.file,
+            line: row.line,
+            table: row.table
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public query returns raw rows with PII and no output projection"
+};
+
+export { outputProjectionMissingOnPublicRead as default };

package/dist/packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const ownerFieldFromArgsNotAuth = {
+  categories: ["SECURITY"],
+  description: "A `ctx.db` write sets an ownership/identity column (`userId`, `ownerId`, `tenantId`, …) from the handler's `args`. The caller controls who the row belongs to, so any caller can write rows owned by another user or tenant — an act-as-any-user / cross-tenant IDOR.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "owner_field_from_args_not_auth",
+  remediation: "Stamp the ownership column from the server-trusted identity (`ctx.auth.userId` / `ctx.identity`), never from request input. Drop the field from the accepted `args` so a caller cannot supply it.",
+  run: (context) => {
+    if (context.ownerFieldWrites === void 0) {
+      return [];
+    }
+    return context.ownerFieldWrites.map(
+      (write) => emit(ownerFieldFromArgsNotAuth, {
+        cacheKey: `owner_field_from_args_not_auth:${write.file}:${write.line.toString()}:${write.field}`,
+        detail: `\`${write.method}\` in \`${write.exportName}\` (${write.file}:${write.line.toString()}) sets the ownership field \`${write.field}\` from \`args\` instead of the server-trusted identity — any caller can write rows owned by another user/tenant (IDOR). Stamp \`${write.field}\` from \`ctx.auth\`/\`ctx.identity\`, never from request input.`,
+        metadata: { exportName: write.exportName, field: write.field, file: write.file, line: write.line, method: write.method }
+      })
+    );
+  },
+  source: "static",
+  title: "Ownership field written from args, not server identity"
+};
+
+export { ownerFieldFromArgsNotAuth as default };

package/dist/packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const paymentCreateWithoutAuthorize = {
+  categories: ["SECURITY"],
+  description: "`createPayment({...})` was constructed without an `authorize` callback, so its access-control gate never runs — any caller that reaches a payment reference id can drive a charge, refund, or subscription change against it (a broken-access-control / IDOR risk on money movement).",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "payment_create_without_authorize",
+  remediation: "Pass an `authorize(referenceId)` callback to `createPayment({...})` that verifies the current caller (via `ctx.auth`) owns the payment/subscription reference before the operation runs. Prefer the `ctx.payments` accessor, which is authorization-scoped by default.",
+  run: (context) => {
+    if (context.configCalls === void 0) {
+      return [];
+    }
+    return context.configCalls.filter((call) => call.callee === "createPayment" && call.analyzable && !call.presentKeys.includes("authorize")).map(
+      (call) => emit(paymentCreateWithoutAuthorize, {
+        cacheKey: `payment_create_without_authorize:${call.file}:${call.line.toString()}`,
+        detail: `\`createPayment({...})\` in ${call.file}:${call.line.toString()} has no \`authorize\` callback — its access-control gate never runs, so any caller reaching the payment reference can move money against it. Add an \`authorize(referenceId)\` gate that checks \`ctx.auth\` ownership before the operation.`,
+        metadata: { callee: call.callee, file: call.file, line: call.line }
+      })
+    );
+  },
+  source: "static",
+  title: "createPayment without an authorize gate"
+};
+
+export { paymentCreateWithoutAuthorize as default };

package/dist/packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const WIDE_TOLERANCE_THRESHOLD_SECONDS = 60 * 60;
+const paymentWebhookWideTolerance = {
+  categories: ["SECURITY"],
+  description: "A payment webhook adapter configured with an implausibly wide `webhookToleranceSeconds` (over an hour). The timestamp tolerance is the webhook replay window; widening it far past the 300s default keeps captured signed events replayable long after capture, defeating the replay check.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "payment_webhook_wide_tolerance",
+  remediation: "Keep `webhookToleranceSeconds` at or near the 300s default — just enough for clock skew. If a wide window was set to work around retries or backfills, handle those with idempotency on the event id instead, not by loosening the replay-window guard.",
+  run: (context) => {
+    if (context.paymentWebhooks === void 0) {
+      return [];
+    }
+    const isWide = (row) => row.toleranceSeconds !== void 0 && row.toleranceSeconds >= WIDE_TOLERANCE_THRESHOLD_SECONDS;
+    return context.paymentWebhooks.filter((row) => isWide(row)).map((row) => {
+      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
+      return emit(paymentWebhookWideTolerance, {
+        cacheKey: `payment_webhook_wide_tolerance:${row.file}:${row.line.toString()}`,
+        detail: `\`${row.callee}\` in ${location} sets \`webhookToleranceSeconds\` to ${(row.toleranceSeconds ?? 0).toString()}s (default 300s). That replay window keeps captured signed events valid long after capture.`,
+        metadata: {
+          callee: row.callee,
+          exportName: row.exportName,
+          file: row.file,
+          line: row.line,
+          toleranceSeconds: row.toleranceSeconds
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Payment webhook replay-tolerance window is implausibly wide"
+};
+
+export { paymentWebhookWideTolerance as default };

package/dist/packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs

@@ -0,0 +1,35 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const plaintextSecretInWranglerVariables = {
+  categories: ["SECURITY"],
+  description: "A plaintext secret is committed to `wrangler.jsonc`'s `vars` block. `vars` are cleartext — baked into the deployed Worker and checked into source control — so the secret leaks via the repo and the bundle, and rotating it needs a config edit plus a redeploy.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "plaintext_secret_in_wrangler_vars",
+  remediation: "Move the value out of `vars`: bind it through a Secrets Store (`ctx.secrets.get(<NAME>)`) or set it with `wrangler secret put <NAME>` and read it from `env.<NAME>`. Delete the `vars` entry and rotate the exposed value — assume it is already compromised. Public/publishable keys (name them `*_PUBLIC` / `*_PUBLISHABLE`) are exempt.",
+  run: (context) => {
+    if (context.wranglerVariables === void 0) {
+      return [];
+    }
+    const findings = [];
+    const occurrenceCount = /* @__PURE__ */ new Map();
+    for (const wranglerVariable of context.wranglerVariables) {
+      const baseKey = `${wranglerVariable.file}:${wranglerVariable.key}`;
+      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
+      occurrenceCount.set(baseKey, occurrence);
+      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
+      findings.push(
+        emit(plaintextSecretInWranglerVariables, {
+          cacheKey: `plaintext_secret_in_wrangler_vars:${baseKey}${occurrenceSuffix}`,
+          detail: `The \`vars\` entry \`${wranglerVariable.key}\` in ${wranglerVariable.file} holds a plaintext ${wranglerVariable.kind.replaceAll("_", " ")} (${wranglerVariable.preview}). \`vars\` ship in cleartext to the deployed Worker and are committed to source control — move it to a Secrets Store binding or \`wrangler secret put\` and rotate the exposed value.`,
+          metadata: { file: wranglerVariable.file, key: wranglerVariable.key, kind: wranglerVariable.kind, preview: wranglerVariable.preview }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Plaintext secret in wrangler vars"
+};
+
+export { plaintextSecretInWranglerVariables as default };

package/dist/packem_shared/privilegedDispatchUnvalidatedPayload-5Forjckt.mjs

@@ -0,0 +1,37 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const privilegedDispatchUnvalidatedPayload = {
+  categories: ["SECURITY"],
+  description: "A `defineQueue`/`defineWorkflow` handler forwards its untrusted payload (queue body / workflow params) straight into a `ctx.run` dispatch whose target is RLS-gated. The handler runs under the system identity with RLS disabled, so the target's row policy — the only thing guarding it — is bypassed, letting a caller act as any user / write across tenants.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "privileged_dispatch_unvalidated_payload",
+  remediation: "Don't forward an unchecked queue body / workflow param into an RLS-gated function. Re-derive the ownership/identity keys from server-trusted state (or an argument you validate against it) before dispatching, or route the work through a function that re-checks the caller's identity rather than relying on the row policy the privileged handler skips.",
+  run: (context) => {
+    if (context.privilegedDispatches === void 0) {
+      return [];
+    }
+    const rlsProcedures = context.rlsProcedures ?? [];
+    const targetUsesRls = (targetFile, targetExport) => rlsProcedures.some((procedure) => procedure.usesRls && procedure.file === targetFile && procedure.exportName === targetExport);
+    return context.privilegedDispatches.filter((dispatch) => targetUsesRls(dispatch.targetFile, dispatch.targetExport)).map((dispatch) => {
+      const handlerKind = dispatch.dispatchKind === "queue" ? "queue" : "workflow";
+      const payloadSource = dispatch.dispatchKind === "queue" ? "queue message body" : "workflow params";
+      return emit(privilegedDispatchUnvalidatedPayload, {
+        cacheKey: `privileged_dispatch_unvalidated_payload:${dispatch.file}:${dispatch.line.toString()}`,
+        detail: `The ${handlerKind} handler \`${dispatch.handlerExport}\` (${dispatch.file}:${dispatch.line.toString()}) forwards its untrusted ${payloadSource} straight into \`${dispatch.targetFile}.${dispatch.targetExport}\`, which is guarded by \`.use(rls(...))\`. The handler runs under the system identity with RLS disabled, so the target's row policy is bypassed — any ownership/identity field the payload controls lets a caller act as another user or write across tenants. Re-derive the identity keys from server-trusted state before dispatching, or route through a function that re-checks the caller.`,
+        metadata: {
+          dispatchKind: dispatch.dispatchKind,
+          file: dispatch.file,
+          handlerExport: dispatch.handlerExport,
+          line: dispatch.line,
+          targetExport: dispatch.targetExport,
+          targetFile: dispatch.targetFile
+        }
+      });
+    });
+  },
+  source: "static",
+  title: "Privileged handler forwards untrusted payload into an RLS-gated function"
+};
+
+export { privilegedDispatchUnvalidatedPayload as default };