@lunora/advisor 1.0.0-alpha.33 → 1.0.0-alpha.35

package/dist/packem_shared/constraintValidator-CxwtpJ6E.mjs

@@ -1,206 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const MAX_EXAMPLE_IDS = 5;
-const rowId = (row) => typeof row["_id"] === "string" ? row["_id"] : "?";
-const truncatedSuffix = (capped, cap, phrase) => capped ? ` (sample capped at ${cap.toString()} rows — ${phrase})` : "";
-const formatExamples = (ids, total) => {
-  const examples = ids.slice(0, MAX_EXAMPLE_IDS);
-  const more = total - examples.length;
-  const list = examples.map((id) => `"${id}"`).join(", ");
-  return more > 0 ? `${list} (+${more.toString()} more)` : list;
-};
-const resolveReferenceValues = (referencedColumn, targetSample) => {
-  if (referencedColumn === "_id") {
-    return targetSample.existingIds;
-  }
-  const values = /* @__PURE__ */ new Set();
-  for (const row of targetSample.rows) {
-    const value = row[referencedColumn];
-    if (value !== null && value !== void 0) {
-      values.add(String(value));
-    }
-  }
-  return values;
-};
-const checkFkRelation = (lint, sample, relation, targetSample) => {
-  if (relation.kind !== "one") {
-    return void 0;
-  }
-  if (targetSample.truncated) {
-    return void 0;
-  }
-  const referencedColumn = relation.references;
-  const referenceValues = resolveReferenceValues(referencedColumn, targetSample);
-  const fkColumn = relation.field;
-  const danglingIds = [];
-  for (const row of sample.rows) {
-    const fkValue = row[fkColumn];
-    if (fkValue === null || fkValue === void 0) {
-      continue;
-    }
-    const fkString = String(fkValue);
-    if (!referenceValues.has(fkString)) {
-      danglingIds.push(rowId(row));
-    }
-  }
-  if (danglingIds.length === 0) {
-    return void 0;
-  }
-  const isTruncated = sample.truncated;
-  const { cap } = sample;
-  const referencedLabel = referencedColumn === "_id" ? `"${relation.table}"` : `"${relation.table}"."${referencedColumn}"`;
-  const detail = `Table "${sample.table}": ${danglingIds.length.toString()} sampled row(s) have a dangling FK value in column "${fkColumn}" — the referenced ${referencedLabel} row does not exist. Row ids: ${formatExamples(danglingIds, danglingIds.length)}${truncatedSuffix(isTruncated, cap, "more rows may exist beyond the window")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:fk:${sample.table}:${fkColumn}`,
-    detail,
-    metadata: {
-      cap,
-      column: fkColumn,
-      count: danglingIds.length,
-      examples: danglingIds.slice(0, MAX_EXAMPLE_IDS),
-      kind: "fk",
-      references: referencedColumn,
-      referencesTable: relation.table,
-      table: sample.table,
-      truncated: isTruncated
-    }
-  });
-};
-const checkNullField = (lint, sample, field, isRequired) => {
-  if (!isRequired) {
-    return void 0;
-  }
-  const nullIds = [];
-  for (const row of sample.rows) {
-    const value = row[field];
-    if (value === null || value === void 0) {
-      nullIds.push(rowId(row));
-    }
-  }
-  if (nullIds.length === 0) {
-    return void 0;
-  }
-  const detail = `Table "${sample.table}": ${nullIds.length.toString()} sampled row(s) have a null/missing value in column "${field}", which is declared as non-optional. Row ids: ${formatExamples(nullIds, nullIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "more rows may exist beyond the window")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:null:${sample.table}:${field}`,
-    detail,
-    metadata: {
-      cap: sample.cap,
-      column: field,
-      count: nullIds.length,
-      examples: nullIds.slice(0, MAX_EXAMPLE_IDS),
-      kind: "null",
-      table: sample.table,
-      truncated: sample.truncated
-    }
-  });
-};
-const compositeKey = (row, fields) => {
-  const parts = [];
-  for (const field of fields) {
-    const value = row[field];
-    if (value === null || value === void 0) {
-      return void 0;
-    }
-    parts.push(JSON.stringify(value));
-  }
-  return parts.join("|");
-};
-const recordDuplicate = (id, existingId, duplicateIds) => {
-  if (!duplicateIds.includes(existingId)) {
-    duplicateIds.push(existingId);
-  }
-  duplicateIds.push(id);
-};
-const checkUniqueIndex = (lint, sample, index) => {
-  if (index.kind !== "index" || index.unique !== true) {
-    return void 0;
-  }
-  const seen = /* @__PURE__ */ new Map();
-  const duplicateIds = [];
-  for (const row of sample.rows) {
-    const id = rowId(row);
-    const key = compositeKey(row, index.fields);
-    if (key === void 0) {
-      continue;
-    }
-    const existingId = seen.get(key);
-    if (existingId === void 0) {
-      seen.set(key, id);
-    } else {
-      recordDuplicate(id, existingId, duplicateIds);
-    }
-  }
-  if (duplicateIds.length === 0) {
-    return void 0;
-  }
-  const detail = `Table "${sample.table}": ${duplicateIds.length.toString()} sampled row(s) share duplicate values on unique index "${index.name}" (${index.fields.join(", ")}). Row ids: ${formatExamples(duplicateIds, duplicateIds.length)}${truncatedSuffix(sample.truncated, sample.cap, "duplicates beyond the window may exist")}.`;
-  return emit(lint, {
-    cacheKey: `constraint_validator:unique:${sample.table}:${index.name}`,
-    detail,
-    metadata: {
-      cap: sample.cap,
-      count: duplicateIds.length,
-      examples: duplicateIds.slice(0, MAX_EXAMPLE_IDS),
-      fields: index.fields,
-      index: index.name,
-      kind: "unique",
-      table: sample.table,
-      truncated: sample.truncated
-    }
-  });
-};
-const checkTable = (lint, sample, sampleByTable, tableByName) => {
-  const schemaTable = tableByName.get(sample.table);
-  if (!schemaTable) {
-    return [];
-  }
-  const findings = [];
-  for (const relation of schemaTable.relations) {
-    const targetSample = sampleByTable.get(relation.table);
-    if (!targetSample) {
-      continue;
-    }
-    const f = checkFkRelation(lint, sample, relation, targetSample);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  for (const field of schemaTable.fields) {
-    const isRequired = !schemaTable.optionalFields?.has(field);
-    const f = checkNullField(lint, sample, field, isRequired);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  for (const index of schemaTable.indexes) {
-    const f = checkUniqueIndex(lint, sample, index);
-    if (f) {
-      findings.push(f);
-    }
-  }
-  return findings;
-};
-const constraintValidator = {
-  categories: ["SCHEMA"],
-  description: "Sampled rows violate one or more declared constraints: a foreign-key column references a non-existent row, a non-optional column contains null, or a unique-indexed column has duplicate values. These violations indicate data inserted before a constraint was enforced (e.g. a schema migration, a raw import, or a bug in a past data-migration transform).",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "constraint_validator",
-  remediation: "Inspect the listed rows and correct or remove the violating values. Run a data migration to backfill nulls, dedup unique violations, or re-link dangling FK references. For FK violations, confirm the target table rows exist before fixing the referencing rows.",
-  run: (context) => {
-    if (!context.tableSamples || context.tableSamples.length === 0) {
-      return [];
-    }
-    const sampleByTable = /* @__PURE__ */ new Map();
-    for (const sample of context.tableSamples) {
-      sampleByTable.set(sample.table, sample);
-    }
-    const tableByName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    return context.tableSamples.flatMap((sample) => checkTable(constraintValidator, sample, sampleByTable, tableByName));
-  },
-  source: "runtime",
-  title: "Constraint violation"
-};
-
-export { constraintValidator as default };

package/dist/packem_shared/containerInstanceKeyFromUserInput-BUXj2J4w.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const containerInstanceKeyFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `container_instance_key_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",
-  detail: (access) => `\`ctx.containers.*.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.containerKeyAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "container_instance_key_from_user_input",
-  remediation: `Derive the container instance key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`) or a record the caller owns — never pass request input straight to \`ctx.containers.<name>.get\`.`,
-  title: "Possible cross-tenant IDOR from arg-derived unscoped container key"
-});
-
-export { containerInstanceKeyFromUserInput as default };

package/dist/packem_shared/containerOversizedInstance-5U1VKPRM.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const LARGE_NAMED = /* @__PURE__ */ new Set(["standard-3", "standard-4"]);
-const VCPU_THRESHOLD = 2;
-const MEMORY_MIB_THRESHOLD = 4096;
-const isOversized = (instanceType) => typeof instanceType === "string" ? LARGE_NAMED.has(instanceType) : (instanceType.vcpu ?? 0) > VCPU_THRESHOLD || (instanceType.memoryMib ?? 0) > MEMORY_MIB_THRESHOLD;
-const containerOversizedInstance = {
-  categories: ["PERFORMANCE"],
-  description: "A container is declared on a large instance type, whose provisioned memory and disk are billed for the lifetime of every running instance.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "container_oversized_instance",
-  remediation: "Confirm the workload needs this size; a smaller instanceType (lite/basic/standard-1) costs less while idle-but-running.",
-  run: (context) => {
-    const findings = [];
-    for (const container of context.containers ?? []) {
-      const { instanceType } = container;
-      if (instanceType === void 0 || !isOversized(instanceType)) {
-        continue;
-      }
-      const size = typeof instanceType === "string" ? instanceType : JSON.stringify(instanceType);
-      findings.push(
-        emit(containerOversizedInstance, {
-          cacheKey: `container_oversized_instance:${container.exportName}`,
-          detail: `Container "${container.exportName}" uses a large instance type (${size}); its memory + disk are billed while any instance runs.`,
-          metadata: { container: container.exportName, instanceType }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Oversized container instance"
-};
-
-export { containerOversizedInstance as default };

package/dist/packem_shared/containerPublicInternet-CuNerJE5.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerPublicInternet = {
-  categories: ["SECURITY"],
-  description: "A container leaves outbound internet access at the default (enabled), which is billed per GB of egress and widens the attack surface.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "container_public_internet",
-  remediation: "Set `enableInternet: false` on the container if it doesn't call external services, or `true` to opt in deliberately.",
-  run: (context) => {
-    const findings = [];
-    for (const container of context.containers ?? []) {
-      if (container.enableInternet !== void 0) {
-        continue;
-      }
-      findings.push(
-        emit(containerPublicInternet, {
-          cacheKey: `container_public_internet:${container.exportName}`,
-          detail: `Container "${container.exportName}" doesn't set enableInternet, so outbound internet is on by default (egress is billed).`,
-          metadata: { container: container.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Container egress enabled by default"
-};
-
-export { containerPublicInternet as default };

package/dist/packem_shared/containerRuntimeEgressRelaxation-B0LlfmDA.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerRuntimeEgressRelaxation = {
-  categories: ["SECURITY"],
-  description: "A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "container_runtime_egress_relaxation",
-  remediation: "Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",
-  run: (context) => {
-    if (context.containerOverrides === void 0) {
-      return [];
-    }
-    return context.containerOverrides.filter((override) => override.kind === "egress_relaxation").map(
-      (override) => emit(containerRuntimeEgressRelaxation, {
-        cacheKey: `container_runtime_egress_relaxation:${override.file}:${override.line.toString()}`,
-        detail: `\`${override.exportName}\` calls \`.egress.${override.detail}(...)\` at runtime, mutating the container's egress firewall.`,
-        metadata: { exportName: override.exportName, file: override.file, line: override.line, method: override.detail }
-      })
-    );
-  },
-  source: "static",
-  title: "Runtime egress mutation relaxes the container firewall"
-};
-
-export { containerRuntimeEgressRelaxation as default };

package/dist/packem_shared/containerStartEnableInternetOverride-DDaHZQ1L.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const containerStartEnableInternetOverride = {
-  categories: ["SECURITY"],
-  description: "A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "container_start_enable_internet_override",
-  remediation: "Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",
-  run: (context) => {
-    if (context.containerOverrides === void 0) {
-      return [];
-    }
-    return context.containerOverrides.filter((override) => override.kind === "enable_internet").map(
-      (override) => emit(containerStartEnableInternetOverride, {
-        cacheKey: `container_start_enable_internet_override:${override.file}:${override.line.toString()}`,
-        detail: `\`${override.exportName}\` calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,
-        metadata: { exportName: override.exportName, file: override.file, line: override.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Runtime .start() override re-enables container internet access"
-};
-
-export { containerStartEnableInternetOverride as default };

package/dist/packem_shared/dedupeCacheKeys-r5B7u_yq.mjs

@@ -1,13 +0,0 @@
-const dedupeCacheKeys = (findings) => {
-  const seen = /* @__PURE__ */ new Map();
-  return findings.map((finding) => {
-    const occurrence = (seen.get(finding.cacheKey) ?? 0) + 1;
-    seen.set(finding.cacheKey, occurrence);
-    if (occurrence === 1) {
-      return finding;
-    }
-    return { ...finding, cacheKey: `${finding.cacheKey}:${occurrence.toString()}` };
-  });
-};
-
-export { dedupeCacheKeys };

package/dist/packem_shared/duplicateIndex-BOublMSt.mjs

@@ -1,57 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const isLeadingPrefix = (a, b) => {
-  if (a.length > b.length) {
-    return false;
-  }
-  return a.every((field, position) => field === b[position]);
-};
-const duplicateIndex = {
-  categories: ["PERFORMANCE"],
-  description: "A secondary index is redundant because another index already covers every lookup it serves (its columns are a leading prefix of the other's). The redundant index costs storage and is maintained on every write for no read benefit.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "duplicate_index",
-  remediation: "Drop the redundant index; the covering index already serves its lookups.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const secondary = table.indexes.filter((index) => index.kind === "index");
-      for (const candidate of secondary) {
-        if (candidate.unique === true) {
-          continue;
-        }
-        const cover = secondary.find((other) => {
-          if (other === candidate) {
-            return false;
-          }
-          if (!isLeadingPrefix(candidate.fields, other.fields)) {
-            return false;
-          }
-          const sameLength = candidate.fields.length === other.fields.length;
-          return sameLength ? candidate.name > other.name : true;
-        });
-        if (!cover) {
-          continue;
-        }
-        findings.push(
-          emit(duplicateIndex, {
-            cacheKey: `duplicate_index:${table.name}:${candidate.name}`,
-            detail: `Index "${candidate.name}" on table "${table.name}" (${candidate.fields.join(", ")}) is redundant — index "${cover.name}" (${cover.fields.join(", ")}) already covers its lookups.`,
-            metadata: {
-              coveredBy: { fields: cover.fields, name: cover.name },
-              fields: candidate.fields,
-              index: candidate.name,
-              table: table.name
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Duplicate / redundant index"
-};
-
-export { duplicateIndex as default };

package/dist/packem_shared/emptyIndex-BX8EuEY7.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const emptyIndex = {
-  categories: ["SCHEMA"],
-  description: "An index declares no columns, so it indexes nothing and can never narrow a read.",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "empty_index",
-  remediation: "Give the index its columns, or remove it.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      for (const index of table.indexes) {
-        if (index.kind !== "index" || index.fields.length > 0) {
-          continue;
-        }
-        findings.push(
-          emit(emptyIndex, {
-            cacheKey: `empty_index:${table.name}:${index.name}`,
-            detail: `Index "${index.name}" on table "${table.name}" declares no columns.`,
-            metadata: { index: index.name, table: table.name }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Empty index"
-};
-
-export { emptyIndex as default };

package/dist/packem_shared/exportSinkMisconfigured-897sVMUa.mjs

@@ -1,46 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const REQUIRED_KEYS = {
-  defineExportSink: ["name", "deliver"],
-  r2Sink: ["bucket", "name"],
-  webhookExportSink: ["name", "url"]
-};
-const exportSinkMisconfigured = {
-  categories: ["SCHEMA"],
-  description: "A CDC export sink (`defineExportSink` / `webhookExportSink` / `r2Sink`) is missing a required config field (a webhook with no `url`, an R2 sink with no `bucket`, or a sink with no `name`/`deliver`). The sink can never deliver a change batch, so the export tap silently drains nothing.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "export_sink_misconfigured",
-  remediation: "Supply the missing field: a non-empty `url` for `webhookExportSink`, a `bucket` R2 binding for `r2Sink`, or `name` + `deliver` for `defineExportSink`.",
-  run: (context) => {
-    if (context.exportSinks === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const sink of context.exportSinks) {
-      if (!sink.analyzable) {
-        continue;
-      }
-      const present = new Set(sink.presentKeys);
-      const empty = new Set(sink.emptyKeys);
-      for (const key of REQUIRED_KEYS[sink.factory] ?? []) {
-        if (present.has(key) && !empty.has(key)) {
-          continue;
-        }
-        const reason = empty.has(key) ? "is set to an empty string" : "is missing";
-        findings.push(
-          emit(exportSinkMisconfigured, {
-            cacheKey: `export_sink_misconfigured:${sink.file}:${sink.line.toString()}:${key}`,
-            detail: `\`${sink.factory}({ … })\` in ${sink.file}:${sink.line.toString()} ${reason} its required \`${key}\` field — the sink can never deliver a change batch, so the export tap drains nothing.`,
-            metadata: { factory: sink.factory, field: key, file: sink.file, line: sink.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Export sink is misconfigured"
-};
-
-export { exportSinkMisconfigured as default };

package/dist/packem_shared/externalSourceIncrementalNoDeletePath-DvX9cRBD.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const externalSourceIncrementalNoDeletePath = {
-  categories: ["SCHEMA"],
-  description: "A `.source({ mode: 'incremental' })` table declares no delete-visibility path (`reconcileEveryMs` or `softDeleteColumn`), so upstream deletes are never applied and the materialized table accumulates phantom rows.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "external_source_incremental_no_delete_path",
-  remediation: "Add `reconcileEveryMs` (a periodic full-pull sweep that GCs vanished rows) or `softDeleteColumn` (an upstream tombstone column the incremental pull returns). Incremental ingest can't see a delete otherwise.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const source = table.externalSource;
-      if (source === void 0) {
-        continue;
-      }
-      if (source.unanalyzable) {
-        findings.push(
-          emit(externalSourceIncrementalNoDeletePath, {
-            cacheKey: `external_source_incremental_no_delete_path:${table.name}`,
-            detail: `Table \`${table.name}\`'s \`.source(...)\` config is not a static object literal, so its \`mode\`/delete-visibility can't be verified. If it is \`mode: "incremental"\`, confirm it declares \`reconcileEveryMs\` or \`softDeleteColumn\` — an incremental source without one accumulates phantom rows on every upstream delete.`,
-            level: "WARN",
-            metadata: { table: table.name }
-          })
-        );
-        continue;
-      }
-      if (source.mode !== "incremental" || source.hasReconcile || source.hasSoftDelete) {
-        continue;
-      }
-      findings.push(
-        emit(externalSourceIncrementalNoDeletePath, {
-          cacheKey: `external_source_incremental_no_delete_path:${table.name}`,
-          detail: `Table \`${table.name}\` is \`.source({ mode: "incremental" })\` but declares neither \`reconcileEveryMs\` nor \`softDeleteColumn\` — an incremental pull never sees upstream deletes, so the materialized table would accumulate phantom rows. Add one of the two delete-visibility paths.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Incremental sourced table has no delete-visibility path"
-};
-
-export { externalSourceIncrementalNoDeletePath as default };

package/dist/packem_shared/externalSourceOnGlobal-Bg-NfCX9.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const externalSourceOnGlobal = {
-  categories: ["SCHEMA"],
-  description: "A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "external_source_on_global",
-  remediation: 'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (table.externalSource === void 0 || table.shardKind !== "global") {
-        continue;
-      }
-      findings.push(
-        emit(externalSourceOnGlobal, {
-          cacheKey: `external_source_on_global:${table.name}`,
-          detail: `Table \`${table.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Sourced table cannot also be global"
-};
-
-export { externalSourceOnGlobal as default };

package/dist/packem_shared/externalSourceUnscoped-5vT-Bup3.mjs

@@ -1,44 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const externalSourceUnscoped = {
-  categories: ["SECURITY"],
-  description: "A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "external_source_unscoped",
-  remediation: "Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (table.externalSource === void 0 || table.shardKind !== "shardBy") {
-        continue;
-      }
-      if (table.externalSource.unanalyzable) {
-        findings.push(
-          emit(externalSourceUnscoped, {
-            cacheKey: `external_source_unscoped:${table.name}`,
-            detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,
-            level: "WARN",
-            metadata: { table: table.name }
-          })
-        );
-        continue;
-      }
-      if (table.externalSource.hasTenantBy) {
-        continue;
-      }
-      findings.push(
-        emit(externalSourceUnscoped, {
-          cacheKey: `external_source_unscoped:${table.name}`,
-          detail: `Table \`${table.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Sourced + sharded table is not tenant-scoped"
-};
-
-export { externalSourceUnscoped as default };

package/dist/packem_shared/filterWithoutIndex-BYVeJaSs.mjs

@@ -1,31 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const filterWithoutIndex = {
-  categories: ["PERFORMANCE"],
-  description: "A query calls `.filter()` without a `.withIndex()` / `.withSearchIndex()`, so it loads every row in the table and filters in memory — a full table scan that gets linearly slower as the table grows.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "filter_without_index",
-  remediation: 'Narrow the read with `.withIndex("name", (q) => q.eq(...))` first, then `.filter()` only for what the index cannot express.',
-  run: (context) => {
-    const findings = [];
-    for (const read of context.queries ?? []) {
-      if (!read.hasFilter || read.hasIndex || read.table === "") {
-        continue;
-      }
-      const location = read.line > 0 ? `${read.file}:${read.line.toString()}` : read.file;
-      findings.push(
-        emit(filterWithoutIndex, {
-          cacheKey: `filter_without_index:${read.file}:${read.line.toString()}:${read.table}`,
-          detail: `Query on "${read.table}" at ${location} calls .filter() without an index — it loads every row of "${read.table}" and filters in memory.`,
-          metadata: { file: read.file, line: read.line, table: read.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Filter without index"
-};
-
-export { filterWithoutIndex as default };