@lunora/advisor 1.0.0-alpha.34 → 1.0.0-alpha.35

package/dist/packem_shared/finding-Dm_zvzS1.mjs

@@ -1,16 +0,0 @@
-const emit = (lint, occurrence) => {
-  return {
-    cacheKey: occurrence.cacheKey,
-    categories: occurrence.categories ?? lint.categories,
-    description: lint.description,
-    detail: occurrence.detail,
-    facing: occurrence.facing ?? lint.facing,
-    level: occurrence.level ?? lint.level,
-    metadata: occurrence.metadata,
-    name: lint.name,
-    remediation: lint.remediation,
-    title: lint.title
-  };
-};
-
-export { emit as e };

package/dist/packem_shared/fk-index-IUK1ukgs.mjs

@@ -1,7 +0,0 @@
-const PRIMARY_KEY = "_id";
-const suggestIndexName = (field) => `by${field.charAt(0).toUpperCase()}${field.slice(1)}`;
-const leadingIndexedColumns = (table) => new Set(
-  table.indexes.filter((index) => index.kind === "index").map((index) => index.fields[0]).filter((field) => field !== void 0)
-);
-
-export { PRIMARY_KEY as P, leadingIndexedColumns as l, suggestIndexName as s };

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-BhIs0shr.mjs

@@ -1,41 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const PROTECT_TOKENS = /* @__PURE__ */ new Set(["enforce", "gate", "lockdown", "rls"]);
-const PERMIT_TOKENS = /* @__PURE__ */ new Set(["allow", "bypass", "permit"]);
-const ACRONYM_WORD_BOUNDARY = /(?<=[A-Z])(?=[A-Z][a-z])/gu;
-const CAMEL_HUMP_BOUNDARY = /(?<=[a-z0-9])(?=[A-Z])/gu;
-const NON_ALPHANUMERIC_RUN = /[^a-z0-9]+/u;
-const tokenize = (key) => key.replaceAll(ACRONYM_WORD_BOUNDARY, " ").replaceAll(CAMEL_HUMP_BOUNDARY, " ").toLowerCase().split(NON_ALPHANUMERIC_RUN).filter((token) => token.length > 0);
-const hasUnsafeDefault = (row) => {
-  const tokens = tokenize(row.key);
-  const isProtect = tokens.some((token) => PROTECT_TOKENS.has(token));
-  const isPermit = tokens.some((token) => PERMIT_TOKENS.has(token));
-  if (isProtect === isPermit) {
-    return false;
-  }
-  return isProtect ? !row.defaultValue : row.defaultValue;
-};
-const flagGatesSecurityWithUnsafeDefault = {
-  categories: ["SECURITY"],
-  description: "A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "flag_gates_security_with_unsafe_default",
-  remediation: "Flip the default so a provider outage fails closed: default a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`) to `true`, and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) to `false`. The safe default is always the restrictive branch — never let an unreachable flag backend open access.",
-  run: (context) => {
-    if (context.flagSecurityDefaults === void 0) {
-      return [];
-    }
-    return context.flagSecurityDefaults.filter((row) => hasUnsafeDefault(row)).map(
-      (row) => emit(flagGatesSecurityWithUnsafeDefault, {
-        cacheKey: `flag_gates_security_with_unsafe_default:${row.file}:${row.line.toString()}`,
-        detail: `\`ctx.flags.boolean("${row.key}", ${String(row.defaultValue)})\` in \`${row.exportName}\` (${row.file}:${row.line.toString()}) fails open to the permissive branch — a provider outage returns \`${String(row.defaultValue)}\`, ${row.defaultValue ? "granting the guarded permission" : "disabling the guarded protection"}.`,
-        metadata: { defaultValue: row.defaultValue, exportName: row.exportName, file: row.file, key: row.key, line: row.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Security flag fails open to the permissive branch"
-};
-
-export { flagGatesSecurityWithUnsafeDefault as default };

package/dist/packem_shared/fromServerSchema-CVnbSf8j.mjs

@@ -1,70 +0,0 @@
-const fromServerSchema = (schema) => {
-  return {
-    rlsMode: schema.rlsMode,
-    tables: Object.entries(schema.tables).map(([name, table]) => {
-      const indexes = [
-        ...table.indexes.map((index) => {
-          return { fields: index.fields, kind: "index", name: index.name, unique: index.unique };
-        }),
-        ...table.searchIndexes.map((index) => {
-          return { fields: [index.field, ...index.filterFields ?? []], kind: "search", name: index.name };
-        }),
-        ...table.rankIndexes.map((index) => {
-          return { fields: [...index.sortBy.map((key) => key.field), ...index.partitionBy ?? []], kind: "rank", name: index.name };
-        }),
-        ...table.vectorIndexes.map((index) => {
-          return { fields: [index.field], kind: "vector", name: index.name };
-        }),
-        ...table.geoIndexes.map((index) => {
-          return { fields: [index.field], kind: "geo", name: index.name };
-        })
-      ];
-      const columnKinds = {};
-      for (const [fieldName, validator] of Object.entries(table.shape)) {
-        const inner = validator.kind === "optional" ? validator._meta?.inner : validator;
-        columnKinds[fieldName] = inner?.kind ?? validator.kind;
-      }
-      const optionalFields = /* @__PURE__ */ new Set();
-      for (const [fieldName, validator] of Object.entries(table.shape)) {
-        if (validator.kind === "optional") {
-          optionalFields.add(fieldName);
-        } else {
-          const column = validator._meta?.column;
-          if (column?.notNull === false) {
-            optionalFields.add(fieldName);
-          }
-        }
-      }
-      return {
-        externallyManaged: table.isExternallyManaged ?? false,
-        externalSource: table.externalSource ? {
-          hasReconcile: table.externalSource.reconcileEveryMs !== void 0,
-          hasSoftDelete: table.externalSource.softDeleteColumn !== void 0,
-          hasTenantBy: table.externalSource.tenantBy !== void 0,
-          mode: table.externalSource.mode
-        } : void 0,
-        columnKinds,
-        fields: Object.keys(table.shape),
-        indexes,
-        isPublic: table.isPublic ?? false,
-        name,
-        optionalFields,
-        shardKind: table.shardMode.kind,
-        softDelete: table.softDeleteMode,
-        ttl: table.ttlPolicy,
-        relations: Object.entries(table.relationMap).map(([accessor, relation]) => {
-          return {
-            field: relation.field,
-            kind: relation.kind,
-            name: accessor,
-            onDelete: relation.onDelete,
-            references: relation.references,
-            table: relation.table
-          };
-        })
-      };
-    })
-  };
-};
-
-export { fromServerSchema };

package/dist/packem_shared/geoIndexFieldNotGeopoint-CcaInLhY.mjs

@@ -1,40 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const geoIndexFieldNotGeopoint = {
-  categories: ["SCHEMA"],
-  description: "A `.geoIndex(name, { field })` points at a column that is not a `v.geoPoint()`, so its geohash companion can't be built and `withGeoIndex(...)` can never match.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "geo_index_field_not_geopoint",
-  remediation: "Point the geo index at a `v.geoPoint()` column, or change the column's type to `v.geoPoint()`.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      for (const index of table.indexes) {
-        if (index.kind !== "geo") {
-          continue;
-        }
-        const field = index.fields[0];
-        if (field === void 0) {
-          continue;
-        }
-        const kind = table.columnKinds?.[field];
-        if (kind === void 0 || kind === "geoPoint") {
-          continue;
-        }
-        findings.push(
-          emit(geoIndexFieldNotGeopoint, {
-            cacheKey: `geo_index_field_not_geopoint:${table.name}:${index.name}:${field}`,
-            detail: `Geo index "${index.name}" on table "${table.name}" indexes column "${field}", which is a ${kind}, not a v.geoPoint().`,
-            metadata: { field, index: index.name, kind, table: table.name }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Geo index field is not a geoPoint"
-};
-
-export { geoIndexFieldNotGeopoint as default };

package/dist/packem_shared/geoIndexUnused-D7I0UyND.mjs

@@ -1,40 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const geoIndexUnused = {
-  categories: ["SCHEMA"],
-  description: "A `.geoIndex(name, { field })` is declared but no handler reads it via `withGeoIndex(name, …)`. The geohash companion column is maintained on every write and read by nothing — dead overhead, the geo analogue of a dead index.",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "geo_index_unused",
-  remediation: 'Query the index from a handler with `ctx.db.query("<table>").withGeoIndex("<name>", q => q.near(point, radius))`, or drop the `.geoIndex(...)` declaration so writes stop maintaining its geohash companion.',
-  run: (context) => {
-    if (context.geoIndexUsages === void 0) {
-      return [];
-    }
-    const usages = context.geoIndexUsages;
-    if (usages.some((usage) => usage.indexName === "")) {
-      return [];
-    }
-    const used = new Set(usages.map((usage) => usage.indexName));
-    const findings = [];
-    for (const table of context.schema.tables) {
-      for (const index of table.indexes) {
-        if (index.kind !== "geo" || used.has(index.name)) {
-          continue;
-        }
-        findings.push(
-          emit(geoIndexUnused, {
-            cacheKey: `geo_index_unused:${table.name}:${index.name}`,
-            detail: `No handler reads geo index "${index.name}" on table "${table.name}" via \`withGeoIndex("${index.name}", …)\` — it's declared but never queried, so its geohash companion is maintained on every write for nothing.`,
-            metadata: { index: index.name, table: table.name }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Geo index is declared but never queried"
-};
-
-export { geoIndexUnused as default };

package/dist/packem_shared/hardcodedSecret-Be-pKVdn.mjs

@@ -1,31 +0,0 @@
-import { dedupeCacheKeys } from './dedupeCacheKeys-r5B7u_yq.mjs';
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const hardcodedSecret = {
-  categories: ["SECURITY"],
-  description: "A secret-shaped string literal (live API key, access key, private key, or high-entropy token) is hard-coded in the source. Committed secrets leak via clone/fork/history and force a redeploy to rotate.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "hardcoded_secret",
-  remediation: 'Move the secret out of source: set it locally in `.dev.vars` (`lunora env set <NAME> "<value>"`) and in production with `wrangler secret put <NAME>`, then read it at runtime from `env.<NAME>`. Rotate the exposed value — assume it is already compromised.',
-  run: (context) => {
-    if (context.secretLiterals === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const secret of context.secretLiterals) {
-      findings.push(
-        emit(hardcodedSecret, {
-          cacheKey: `hardcoded_secret:${secret.file}:${secret.line.toString()}:${secret.kind}`,
-          detail: `A ${secret.kind.replaceAll("_", " ")} (${secret.preview}) is hard-coded at ${secret.file}:${secret.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,
-          metadata: { file: secret.file, kind: secret.kind, line: secret.line, preview: secret.preview }
-        })
-      );
-    }
-    return dedupeCacheKeys(findings);
-  },
-  source: "static",
-  title: "Hard-coded secret in source"
-};
-
-export { hardcodedSecret as default };

package/dist/packem_shared/helpers-BySnKhVB.mjs

@@ -1,31 +0,0 @@
-const OWNERSHIP_FIELD_NAMES = /* @__PURE__ */ new Set([
-  "accountId",
-  "authorId",
-  "createdBy",
-  "createdById",
-  "organizationId",
-  "orgId",
-  "ownerId",
-  "tenantId",
-  "updatedBy",
-  "userId",
-  "workspaceId"
-]);
-const PII_FIELD_NAMES = /* @__PURE__ */ new Set([
-  "address",
-  "dateOfBirth",
-  "dob",
-  "email",
-  "firstName",
-  "lastName",
-  "phone",
-  "phoneNumber",
-  "socialSecurityNumber",
-  "ssn"
-]);
-const SYSTEM_FIELDS = /* @__PURE__ */ new Set(["_creationTime", "_id"]);
-const ownershipOrPiiColumns = (table) => table.fields.filter((field) => OWNERSHIP_FIELD_NAMES.has(field) || PII_FIELD_NAMES.has(field));
-const tableColumnSet = (table) => /* @__PURE__ */ new Set([...SYSTEM_FIELDS, ...table.fields]);
-const isPublicWrite = (procedure) => procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-
-export { PII_FIELD_NAMES as P, isPublicWrite as i, ownershipOrPiiColumns as o, tableColumnSet as t };

package/dist/packem_shared/hotShard-CkC7qpre.mjs

@@ -1,60 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SHARE_THRESHOLD = 0.5;
-const MIN_TOTAL_REQUESTS = 50;
-const hotShard = {
-  categories: ["PERFORMANCE"],
-  description: "One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hot_shard",
-  remediation: "Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",
-  run: (context) => {
-    const active = (context.shardTraffic ?? []).filter((shard) => shard.requests > 0);
-    const byGroup = /* @__PURE__ */ new Map();
-    for (const shard of active) {
-      const groupKey = shard.group ?? "";
-      const bucket = byGroup.get(groupKey);
-      if (bucket === void 0) {
-        byGroup.set(groupKey, [shard]);
-      } else {
-        bucket.push(shard);
-      }
-    }
-    const findings = [];
-    for (const [groupKey, groupShards] of byGroup) {
-      const totalRequests = groupShards.reduce((sum, shard) => sum + shard.requests, 0);
-      if (groupShards.length < 2 || totalRequests < MIN_TOTAL_REQUESTS) {
-        continue;
-      }
-      for (const shard of groupShards) {
-        const share = shard.requests / totalRequests;
-        if (share < HOT_SHARE_THRESHOLD) {
-          continue;
-        }
-        const scope = shard.group !== void 0 && shard.group !== "" ? `"${shard.group}" ` : "";
-        const label = shard.shardKey === "" ? "the root shard" : `shard "${shard.shardKey}"`;
-        const percent = Math.round(share * 100);
-        findings.push(
-          emit(hotShard, {
-            cacheKey: `hot_shard:${groupKey}:${shard.shardKey}`,
-            detail: `${scope}${label} handled ${shard.requests.toString()} of ${totalRequests.toString()} requests (${percent.toString()}%) across ${groupShards.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,
-            metadata: {
-              group: shard.group,
-              requests: shard.requests,
-              shardCount: groupShards.length,
-              shardKey: shard.shardKey,
-              share,
-              totalRequests
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Hot shard"
-};
-
-export { hotShard as default };

package/dist/packem_shared/httpActionMissingAuthGuard-CxipddNx.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const surfaceLabel = (kind, method) => kind === "httpRoute" && method ? `\`httpRoute\` ${method} handler` : "`httpAction` handler";
-const httpActionMissingAuthGuard = {
-  categories: ["SECURITY"],
-  description: "An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "http_action_missing_auth_guard",
-  remediation: "Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",
-  run: (context) => {
-    if (context.httpActionGuards === void 0) {
-      return [];
-    }
-    return context.httpActionGuards.filter((row) => !row.readsAuth).map((row) => {
-      const surface = surfaceLabel(row.kind, row.method);
-      return emit(httpActionMissingAuthGuard, {
-        cacheKey: `http_action_missing_auth_guard:${row.file}:${row.line.toString()}`,
-        detail: `${surface} \`${row.exportName}\` (${row.file}:${row.line.toString()}) calls \`ctx.${row.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          kind: row.kind,
-          line: row.line,
-          sideEffect: row.sideEffect,
-          ...row.method ? { method: row.method } : {}
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Unauthenticated HTTP handler performs a side effect"
-};
-
-export { httpActionMissingAuthGuard as default };

package/dist/packem_shared/httpActionResponseHeaderInjection-DOFS7pFT.mjs

@@ -1,39 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const VIA_LABELS = {
-  "headers-append": "a `headers.append(...)` call",
-  "headers-ctor": "a `new Headers({...})` initializer",
-  "headers-set": "a `headers.set(...)` call",
-  "response-init": "a `Response` init `headers` object"
-};
-const httpActionResponseHeaderInjection = {
-  categories: ["SECURITY"],
-  description: "An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "http_action_response_header_injection",
-  remediation: "Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",
-  run: (context) => {
-    if (context.httpHeaderWrites === void 0) {
-      return [];
-    }
-    return context.httpHeaderWrites.map((row) => {
-      const header = row.headerName === "" ? "a response header" : `the \`${row.headerName}\` response header`;
-      return emit(httpActionResponseHeaderInjection, {
-        cacheKey: `http_action_response_header_injection:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.exportName}\` (${row.file}:${row.line.toString()}) writes ${header} from raw request input via ${VIA_LABELS[row.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          headerName: row.headerName,
-          line: row.line,
-          via: row.via
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Response header written from unsanitized request input"
-};
-
-export { httpActionResponseHeaderInjection as default };

package/dist/packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const hyperdriveOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses Hyperdrive via `ctx.sql`. Hyperdrive hits an external database Lunora does not own: queries are non-deterministic (like `fetch`) and external writes are invisible to live queries. `ctx.sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "hyperdrive_outside_action",
-  remediation: "Move the `ctx.sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas the external DB is not.",
-  run: (context) => {
-    if (context.hyperdriveCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.hyperdriveCalls) {
-      findings.push(
-        emit(hyperdriveOutsideAction, {
-          cacheKey: `hyperdrive_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — Hyperdrive's \`ctx.sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external SQL into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Hyperdrive `ctx.sql` used outside an action"
-};
-
-export { hyperdriveOutsideAction as default };

package/dist/packem_shared/identityUndeclaredClaimTrusted-D8nXV2dd.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const identityUndeclaredClaimTrusted = {
-  categories: ["SECURITY"],
-  description: "An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "identity_undeclared_claim_trusted",
-  remediation: "Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",
-  run: (context) => {
-    if (context.identityClaimReads === void 0) {
-      return [];
-    }
-    return context.identityClaimReads.filter((row) => !row.declared).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      return emit(identityUndeclaredClaimTrusted, {
-        cacheKey: `identity_undeclared_claim_trusted:${row.file}:${row.line.toString()}:${row.key}`,
-        detail: `\`${row.key}\` in ${location} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,
-        metadata: {
-          exportName: row.exportName,
-          file: row.file,
-          key: row.key,
-          line: row.line
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Authorization trusts an undeclared identity claim"
-};
-
-export { identityUndeclaredClaimTrusted as default };

package/dist/packem_shared/imagesUrlSourceFromUserInput-YcDQ0b_Y.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const imagesUrlSourceFromUserInput = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `images_url_source_from_user_input:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",
-  detail: (access) => `\`buildImageDeliveryUrl\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.imageDeliveryUrlAccesses,
-  level: "WARN",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line };
-  },
-  name: "images_url_source_from_user_input",
-  remediation: "Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",
-  title: "Image delivery URL built from unscoped user input"
-});
-
-export { imagesUrlSourceFromUserInput as default };

package/dist/packem_shared/indexReferencesUnknownField-BSWNngxX.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-BySnKhVB.mjs';
-
-const indexReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "An index references a column that is not declared on its table. The index can never match, and the typo would otherwise surface only at runtime.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "index_references_unknown_field",
-  remediation: "Fix the column name in the index declaration, or add the column to the table.",
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const columns = tableColumnSet(table);
-      for (const index of table.indexes) {
-        for (const field of index.fields) {
-          if (columns.has(field)) {
-            continue;
-          }
-          findings.push(
-            emit(indexReferencesUnknownField, {
-              cacheKey: `index_references_unknown_field:${table.name}:${index.name}:${field}`,
-              detail: `Index "${index.name}" on table "${table.name}" references column "${field}", which is not declared on the table.`,
-              metadata: { field, index: index.name, indexKind: index.kind, table: table.name }
-            })
-          );
-        }
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Index references unknown field"
-};
-
-export { indexReferencesUnknownField as default };

package/dist/packem_shared/indexUtilization-B5DMQ3bI.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const HOT_SCAN_THRESHOLD = 25;
-const indexUtilization = {
-  categories: ["PERFORMANCE"],
-  description: "Recorded reads show an index the workload doesn't pay for: either a declared index no read ever used (dead overhead on every write) or a table read hot with no index at all (a repeated full scan that degrades as it grows).",
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "index_utilization",
-  remediation: "Drop a dead index so writes stop maintaining it; add an index covering the hot full-scanned table's read predicate so the read stops scanning every row.",
-  run: (context) => {
-    const findings = [];
-    for (const hit of context.indexHits ?? []) {
-      if (hit.reads > 0) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:dead_index:${hit.table}:${hit.index}`,
-          detail: `Index "${hit.index}" on table "${hit.table}" has recorded no reads since its counter was created — it's dead overhead: every write maintains it and nothing reads through it.`,
-          metadata: { index: hit.index, kind: "dead_index", reads: hit.reads, table: hit.table }
-        })
-      );
-    }
-    for (const scan of context.tableScans ?? []) {
-      if (scan.scans < HOT_SCAN_THRESHOLD) {
-        continue;
-      }
-      findings.push(
-        emit(indexUtilization, {
-          cacheKey: `index_utilization:hot_scan:${scan.table}`,
-          detail: `Table "${scan.table}" has been full-scanned ${scan.scans.toString()} times (cumulative) with no index — a repeated full scan that degrades linearly as "${scan.table}" grows. Add an index covering the read predicate.`,
-          facing: "EXTERNAL",
-          level: "WARN",
-          metadata: { kind: "hot_scan", scans: scan.scans, table: scan.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "runtime",
-  title: "Index utilization"
-};
-
-export { indexUtilization as default };

package/dist/packem_shared/insertManyUnsafeUserData-Dn77XpmX.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const insertManyUnsafeUserData = {
-  categories: ["SECURITY"],
-  description: "A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "insert_many_unsafe_user_data",
-  remediation: "Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    return context.procedureProtections.filter((procedure) => procedure.usesInsertManyUnsafe && procedure.visibility === "public").map(
-      (procedure) => emit(insertManyUnsafeUserData, {
-        cacheKey: `insert_many_unsafe_user_data:${procedure.file}:${procedure.exportName}`,
-        detail: `\`${procedure.exportName}\` (${procedure.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,
-        metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind }
-      })
-    );
-  },
-  source: "static",
-  title: "Public procedure uses insertManyUnsafe (bypasses validators and triggers)"
-};
-
-export { insertManyUnsafeUserData as default };

package/dist/packem_shared/kvUnscopedUserKeyIdor-YWwmfE8X.mjs

@@ -1,19 +0,0 @@
-import { m as makeArgumentDerivedSinkLint } from './argument-derived-sink-C1xTTqAt.mjs';
-
-const kvUnscopedUserKeyIdor = makeArgumentDerivedSinkLint({
-  cacheKey: (access) => `kv_unscoped_user_key_idor:${access.file}:${access.line.toString()}`,
-  categories: ["SECURITY"],
-  description: "A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",
-  detail: (access) => `\`ctx.kv.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,
-  facing: "EXTERNAL",
-  getAccesses: (context) => context.kvKeyAccesses,
-  level: "ERROR",
-  metadata: (access) => {
-    return { exportName: access.exportName, file: access.file, line: access.line, method: access.method };
-  },
-  name: "kv_unscoped_user_key_idor",
-  remediation: `Prefix every \`ctx.kv\` key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:\${args.id}\`) so a caller can only address their own entries. Never pass request input straight to \`ctx.kv.get\`/\`put\`/\`delete\`.`,
-  title: "Possible IDOR from arg-derived unscoped KV key"
-});
-
-export { kvUnscopedUserKeyIdor as default };