@lunora/advisor 1.0.0-alpha.34 → 1.0.0-alpha.36

package/dist/packem_shared/mailInboundDispatchWithoutVerify-CHSRA8zz.mjs

@@ -1,28 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailInboundDispatchWithoutVerify = {
-  categories: ["SECURITY"],
-  description: "`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-  name: "mail_inbound_dispatch_without_verify",
-  remediation: "Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",
-  run: (context) => {
-    if (context.configCalls === void 0) {
-      return [];
-    }
-    return context.configCalls.filter((call) => call.callee === "createInboundEmailHandler" && call.analyzable && !call.presentKeys.includes("verify")).map(
-      (call) => emit(mailInboundDispatchWithoutVerify, {
-        // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
-        cacheKey: `mail_inbound_dispatch_without_verify:${call.file}:${call.line.toString()}`,
-        detail: `\`createInboundEmailHandler({...})\` in ${call.file}:${call.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,
-        metadata: { callee: call.callee, file: call.file, line: call.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Inbound email handler without a verify hook"
-};
-
-export { mailInboundDispatchWithoutVerify as default };

package/dist/packem_shared/mailRecipientFromRequestInput-Cka2qu5J.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mailRecipientFromRequestInput = {
-  categories: ["SECURITY"],
-  description: "A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mail_recipient_from_request_input",
-  remediation: "Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",
-  run: (context) => {
-    if (context.mailRecipientAccesses === void 0) {
-      return [];
-    }
-    return context.mailRecipientAccesses.map(
-      (access) => emit(mailRecipientFromRequestInput, {
-        cacheKey: `mail_recipient_from_request_input:${access.file}:${access.line.toString()}`,
-        detail: `\`ctx.mail.${access.method}\` in \`${access.exportName}\` (${access.file}:${access.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,
-        metadata: { exportName: access.exportName, file: access.file, line: access.line, method: access.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Mail recipient derived from request input"
-};
-
-export { mailRecipientFromRequestInput as default };

package/dist/packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs

@@ -1,61 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskUncoveredPiiColumn = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_uncovered_pii_column",
-  remediation: "Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the procedure/table/column cross-reference reads clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.maskProcedures === void 0) {
-      return [];
-    }
-    const maskedColumnsByTable = /* @__PURE__ */ new Map();
-    for (const procedure of context.maskProcedures) {
-      for (const { column, table } of procedure.maskColumns) {
-        if (table === "" || column === "") {
-          continue;
-        }
-        const columns = maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set();
-        columns.add(column);
-        maskedColumnsByTable.set(table, columns);
-      }
-    }
-    if (maskedColumnsByTable.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.maskProcedures) {
-      if (procedure.usesMask) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of procedure.tablesRead) {
-        if (table !== "" && maskedColumnsByTable.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        const columns = [...maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set()].toSorted((a, b) => a.localeCompare(b));
-        const columnList = columns.map((column) => `\`${column}\``).join(", ");
-        findings.push(
-          emit(maskUncoveredPiiColumn, {
-            cacheKey: `mask_uncovered_pii_column:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} reads table \`${table}\` without \`.use(mask(...))\` — its column${columns.length === 1 ? "" : "s"} ${columnList} ${columns.length === 1 ? "is" : "are"} masked elsewhere in the app but returned in the clear here.`,
-            metadata: { columns, exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Maskable column returned without mask() middleware"
-};
-
-export { maskUncoveredPiiColumn as default };

package/dist/packem_shared/maskWeakHashStrategyOnPii-1c4q8Opf.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const PII_COLUMN_RE = /address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u;
-const isPiiColumn = (column) => PII_COLUMN_RE.test(column.replaceAll(/[^a-z0-9]/giu, "").toLowerCase());
-const maskWeakHashStrategyOnPii = {
-  categories: ["SECURITY"],
-  description: 'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_weak_hash_strategy_on_pii",
-  remediation: 'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',
-  run: (context) => {
-    if (context.maskStrategies === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const strategy of context.maskStrategies) {
-      if (strategy.strategy !== "hash" || !isPiiColumn(strategy.column)) {
-        continue;
-      }
-      findings.push(
-        emit(maskWeakHashStrategyOnPii, {
-          cacheKey: `mask_weak_hash_strategy_on_pii:${strategy.file}:${strategy.line.toString()}`,
-          detail: `\`${strategy.exportName}\` in ${strategy.file} masks \`${strategy.table === "" ? strategy.column : `${strategy.table}.${strategy.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,
-          metadata: { column: strategy.column, exportName: strategy.exportName, file: strategy.file, table: strategy.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: 'Weak "hash" mask strategy on a PII column'
-};
-
-export { maskWeakHashStrategyOnPii as default };

package/dist/packem_shared/maskedRelationLeakViaWith-CPI4s0sl.mjs

@@ -1,76 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskedTablesOf = (context) => {
-  const tables = /* @__PURE__ */ new Set();
-  for (const procedure of context.maskProcedures ?? []) {
-    for (const { table } of procedure.maskColumns) {
-      if (table !== "") {
-        tables.add(table);
-      }
-    }
-  }
-  for (const strategy of context.maskStrategies ?? []) {
-    if (strategy.table !== "") {
-      tables.add(strategy.table);
-    }
-  }
-  return tables;
-};
-const relationTargetsOf = (context) => {
-  const targets = /* @__PURE__ */ new Map();
-  for (const table of context.schema.tables) {
-    for (const relation of table.relations) {
-      targets.set(`${table.name} ${relation.name}`, relation.table);
-    }
-  }
-  return targets;
-};
-const maskedRelationLeakViaWith = {
-  categories: ["SECURITY"],
-  description: "A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "masked_relation_leak_via_with",
-  remediation: "Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",
-  run: (context) => {
-    if (context.relationLoads === void 0) {
-      return [];
-    }
-    const maskedTables = maskedTablesOf(context);
-    if (maskedTables.size === 0) {
-      return [];
-    }
-    const relationTargets = relationTargetsOf(context);
-    const findings = [];
-    for (const row of context.relationLoads) {
-      if (row.visibility !== "public" || row.parentTable === "") {
-        continue;
-      }
-      for (const relation of row.relations) {
-        const target = relationTargets.get(`${row.parentTable} ${relation}`);
-        if (target === void 0 || !maskedTables.has(target)) {
-          continue;
-        }
-        findings.push(
-          emit(maskedRelationLeakViaWith, {
-            cacheKey: `masked_relation_leak_via_with:${row.file}:${row.line.toString()}:${row.parentTable}:${relation}`,
-            detail: `The public read in \`${row.exportName}\` (${row.file}:${row.line.toString()}) hydrates relation \`${relation}\` (masked table \`${target}\`) via \`with\` on \`${row.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${target}\`'s masked columns are returned in the clear.`,
-            metadata: {
-              exportName: row.exportName,
-              file: row.file,
-              line: row.line,
-              parentTable: row.parentTable,
-              relation,
-              relationTable: target
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Masked table surfaced unmasked through a with-relation on a public read"
-};
-
-export { maskedRelationLeakViaWith as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mutatorFullRowReplace = {
-  categories: ["SCHEMA"],
-  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mutator_full_row_replace",
-  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
-  run: (context) => {
-    if (context.mutatorWrites === void 0) {
-      return [];
-    }
-    return context.mutatorWrites.map(
-      (write) => emit(mutatorFullRowReplace, {
-        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
-        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
-        metadata: { exportName: write.exportName, file: write.file, line: write.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
-};
-
-export { mutatorFullRowReplace as default };

package/dist/packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const nondeterministicQueryMutation = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). These handlers may be re-run on OCC retry / subscription re-evaluation, so they must be deterministic — time, randomness, and network belong in an `action`.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "nondeterministic_query_mutation",
-  remediation: "Move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument — e.g. compute `Date.now()` in the action and call `ctx.runMutation(api.…, { now })`. Take generated ids/timestamps as args instead of producing them in the handler.",
-  run: (context) => {
-    if (context.nondeterministicCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
-    for (const call of context.nondeterministicCalls) {
-      const baseKey = `${call.file}:${call.line.toString()}:${call.callee}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
-      findings.push(
-        emit(nondeterministicQueryMutation, {
-          cacheKey: `nondeterministic_query_mutation:${baseKey}${occurrenceSuffix}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — query/mutation handlers must be deterministic. Compute it in an \`action\` and pass the value into the mutation as an argument.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Non-deterministic call in query/mutation handler"
-};
-
-export { nondeterministicQueryMutation as default };

package/dist/packem_shared/normalizeIdUsedAsAuthorization-BVPtCpzT.mjs

@@ -1,50 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SINK_LABELS = {
-  delete: "deletes the row",
-  get: "reads the row",
-  patch: "patches the row"
-};
-const normalizeIdUsedAsAuthorization = {
-  categories: ["SECURITY"],
-  description: "A `.public()` `query`/`mutation` gates a `ctx.db.get`/`patch`/`delete` on a null-checked `ctx.db.normalizeId(table, id)` result with no ownership predicate and no RLS. `normalizeId` validates id *shape* only — it never reads the database — so a non-null result proves the id is well-formed, never that the caller owns the row (an IDOR).",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "normalize_id_used_as_authorization",
-  remediation: 'Don\'t treat a non-null `normalizeId` result as authorization — it only validates id shape. After loading the row, compare its ownership column (`userId`/`ownerId`/…) against the server-trusted identity (`ctx.auth.userId`), or protect the procedure with `.use(rls(...))` / put the schema in `.rls("required")` mode so the row policy runs on every access.',
-  run: (context) => {
-    if (context.normalizeIdAuthorizations === void 0) {
-      return [];
-    }
-    const rlsRequired = context.schema.rlsMode === "required";
-    const rlsOptOutTables = new Set(context.schema.tables.filter((table) => table.isPublic).map((table) => table.name));
-    const findings = [];
-    for (const row of context.normalizeIdAuthorizations) {
-      if (row.visibility !== "public" || row.usesRls || row.mentionsOwnership) {
-        continue;
-      }
-      if (rlsRequired && (row.table === "" || !rlsOptOutTables.has(row.table))) {
-        continue;
-      }
-      const target = row.table === "" ? "the row" : `the \`${row.table}\` row`;
-      findings.push(
-        emit(normalizeIdUsedAsAuthorization, {
-          cacheKey: `normalize_id_used_as_authorization:${row.file}:${row.line.toString()}`,
-          detail: `Public procedure \`${row.exportName}\` (${row.file}:${row.line.toString()}) gates access on \`ctx.db.normalizeId(...)\` and then ${SINK_LABELS[row.sinkMethod]} — but \`normalizeId\` only validates id shape, it never reads the database or checks ownership. Any caller supplying a well-formed id of ${target} reaches it (IDOR). Compare the loaded row's ownership column against \`ctx.auth\`, or cover the procedure with \`.use(rls(...))\`.`,
-          metadata: {
-            exportName: row.exportName,
-            file: row.file,
-            line: row.line,
-            sinkMethod: row.sinkMethod,
-            table: row.table
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "normalizeId result used as authorization (validates id shape, not ownership)"
-};
-
-export { normalizeIdUsedAsAuthorization as default };

package/dist/packem_shared/notifyMissingPushConfig-Ca9EzRzy.mjs

@@ -1,27 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const notifyMissingPushConfig = {
-  categories: ["SCHEMA"],
-  description: "The app sends push notifications via `ctx.push` but `defineNotify(...)` configures neither a Web Push nor an FCM channel, so every send fails at runtime. Wire at least one push channel (`webPush` and/or `fcm`) and provide its secrets (`VAPID_*` / `FCM_*`).",
-  facing: "INTERNAL",
-  level: "WARN",
-  name: "notify_missing_push_config",
-  remediation: "In `lunora/notify.ts`, wire a push channel: `defineNotify({ webPush: (env) => webPushFromEnv(env) })` and set `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY` / `VAPID_SUBJECT` in `.dev.vars` (or configure `fcm` with `FCM_PROJECT_ID`). Generate a VAPID keypair with `npx web-push generate-vapid-keys`.",
-  run: (context) => {
-    const config = context.notifyConfig;
-    if (config === void 0 || !config.usesPush || config.hasWebPush || config.hasFcm) {
-      return [];
-    }
-    return [
-      emit(notifyMissingPushConfig, {
-        cacheKey: "notify_missing_push_config",
-        detail: "`ctx.push` is used to send notifications, but `defineNotify(...)` wires neither `webPush` nor `fcm` — every push send will fail at runtime. Configure at least one push channel and its secrets.",
-        metadata: { hasFcm: config.hasFcm, hasWebPush: config.hasWebPush, usesPush: config.usesPush }
-      })
-    ];
-  },
-  source: "static",
-  title: "Push used with no Web Push / FCM channel configured"
-};
-
-export { notifyMissingPushConfig as default };

package/dist/packem_shared/notifySendOutsideAction-BUZSIZa4.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const notifySendOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler sends a notification via `ctx.notify`/`ctx.push`. A send is external I/O (a `fetch` to a push service / FCM): it is non-deterministic like `fetch`, and a mutation re-run on OCC retry would re-send it (duplicate pushes). These facades are available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "notify_send_outside_action",
-  remediation: "Move the `ctx.notify`/`ctx.push` send into an `action(...)`, where external I/O is allowed. If a query/mutation must trigger a notification, have it enqueue the send (`enqueuePushBroadcast` via `@lunora/queue`) or schedule an action — the queue/scheduler runs the send exactly once, off the transactional path.",
-  run: (context) => {
-    if (context.notifyCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.notifyCalls) {
-      findings.push(
-        emit(notifySendOutsideAction, {
-          cacheKey: `notify_send_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — a notification send is non-deterministic external I/O and a retried ${call.kind} would re-send it. Move it into an \`action\`, or enqueue/schedule the send.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Notification send used outside an action"
-};
-
-export { notifySendOutsideAction as default };

package/dist/packem_shared/outputProjectionMissingOnPublicRead-Bl5IMx0k.mjs

@@ -1,51 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { P as PII_FIELD_NAMES } from './helpers-BySnKhVB.mjs';
-
-const outputProjectionMissingOnPublicRead = {
-  categories: ["SECURITY"],
-  description: "A `.public()` `query` returns raw table rows (no `.output(...)` projection, no `.use(mask(...))`) from a table carrying PII-named columns (`email`, `phone`, `ssn`, …). Every column ships to the caller, and a column added to the table later leaks by default.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "output_projection_missing_on_public_read",
-  remediation: "Add an explicit return projection to the public query — `.output(v.object({ … }))` listing only the fields a client needs — or apply a `.use(mask(...))` policy to the PII columns. This makes the exposed shape intentional and stops a newly-added column from leaking through this query by default.",
-  run: (context) => {
-    if (context.rawRowReturns === void 0) {
-      return [];
-    }
-    const piiColumnsByTable = /* @__PURE__ */ new Map();
-    for (const table of context.schema.tables) {
-      const piiColumns = table.fields.filter((field) => PII_FIELD_NAMES.has(field));
-      if (piiColumns.length > 0) {
-        piiColumnsByTable.set(table.name, piiColumns);
-      }
-    }
-    const findings = [];
-    for (const row of context.rawRowReturns) {
-      if (row.visibility !== "public" || row.usesOutput || row.usesMask || row.table === "") {
-        continue;
-      }
-      const piiColumns = piiColumnsByTable.get(row.table);
-      if (piiColumns === void 0) {
-        continue;
-      }
-      findings.push(
-        emit(outputProjectionMissingOnPublicRead, {
-          cacheKey: `output_projection_missing_on_public_read:${row.file}:${row.line.toString()}`,
-          detail: `Public query \`${row.exportName}\` (${row.file}:${row.line.toString()}) returns raw \`${row.table}\` rows with no \`.output(...)\` projection — shipping PII column(s) ${piiColumns.join(", ")} to every caller, and any column added to \`${row.table}\` later leaks by default. Project the return with \`.output(v.object({ … }))\` or mask the PII columns.`,
-          metadata: {
-            columns: piiColumns,
-            exportName: row.exportName,
-            file: row.file,
-            line: row.line,
-            table: row.table
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public query returns raw rows with PII and no output projection"
-};
-
-export { outputProjectionMissingOnPublicRead as default };

package/dist/packem_shared/ownerFieldFromArgsNotAuth-mOw3hE5z.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const ownerFieldFromArgsNotAuth = {
-  categories: ["SECURITY"],
-  description: "A `ctx.db` write sets an ownership/identity column (`userId`, `ownerId`, `tenantId`, …) from the handler's `args`. The caller controls who the row belongs to, so any caller can write rows owned by another user or tenant — an act-as-any-user / cross-tenant IDOR.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "owner_field_from_args_not_auth",
-  remediation: "Stamp the ownership column from the server-trusted identity (`ctx.auth.userId` / `ctx.identity`), never from request input. Drop the field from the accepted `args` so a caller cannot supply it.",
-  run: (context) => {
-    if (context.ownerFieldWrites === void 0) {
-      return [];
-    }
-    return context.ownerFieldWrites.map(
-      (write) => emit(ownerFieldFromArgsNotAuth, {
-        cacheKey: `owner_field_from_args_not_auth:${write.file}:${write.line.toString()}:${write.field}`,
-        detail: `\`${write.method}\` in \`${write.exportName}\` (${write.file}:${write.line.toString()}) sets the ownership field \`${write.field}\` from \`args\` instead of the server-trusted identity — any caller can write rows owned by another user/tenant (IDOR). Stamp \`${write.field}\` from \`ctx.auth\`/\`ctx.identity\`, never from request input.`,
-        metadata: { exportName: write.exportName, field: write.field, file: write.file, line: write.line, method: write.method }
-      })
-    );
-  },
-  source: "static",
-  title: "Ownership field written from args, not server identity"
-};
-
-export { ownerFieldFromArgsNotAuth as default };

package/dist/packem_shared/paymentCreateWithoutAuthorize-BYm4JLxo.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const paymentCreateWithoutAuthorize = {
-  categories: ["SECURITY"],
-  description: "`createPayment({...})` was constructed without an `authorize` callback, so its access-control gate never runs — any caller that reaches a payment reference id can drive a charge, refund, or subscription change against it (a broken-access-control / IDOR risk on money movement).",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "payment_create_without_authorize",
-  remediation: "Pass an `authorize(referenceId)` callback to `createPayment({...})` that verifies the current caller (via `ctx.auth`) owns the payment/subscription reference before the operation runs. Prefer the `ctx.payments` accessor, which is authorization-scoped by default.",
-  run: (context) => {
-    if (context.configCalls === void 0) {
-      return [];
-    }
-    return context.configCalls.filter((call) => call.callee === "createPayment" && call.analyzable && !call.presentKeys.includes("authorize")).map(
-      (call) => emit(paymentCreateWithoutAuthorize, {
-        cacheKey: `payment_create_without_authorize:${call.file}:${call.line.toString()}`,
-        detail: `\`createPayment({...})\` in ${call.file}:${call.line.toString()} has no \`authorize\` callback — its access-control gate never runs, so any caller reaching the payment reference can move money against it. Add an \`authorize(referenceId)\` gate that checks \`ctx.auth\` ownership before the operation.`,
-        metadata: { callee: call.callee, file: call.file, line: call.line }
-      })
-    );
-  },
-  source: "static",
-  title: "createPayment without an authorize gate"
-};
-
-export { paymentCreateWithoutAuthorize as default };

package/dist/packem_shared/paymentWebhookWideTolerance-D9QQJMJq.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const WIDE_TOLERANCE_THRESHOLD_SECONDS = 60 * 60;
-const paymentWebhookWideTolerance = {
-  categories: ["SECURITY"],
-  description: "A payment webhook adapter configured with an implausibly wide `webhookToleranceSeconds` (over an hour). The timestamp tolerance is the webhook replay window; widening it far past the 300s default keeps captured signed events replayable long after capture, defeating the replay check.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "payment_webhook_wide_tolerance",
-  remediation: "Keep `webhookToleranceSeconds` at or near the 300s default — just enough for clock skew. If a wide window was set to work around retries or backfills, handle those with idempotency on the event id instead, not by loosening the replay-window guard.",
-  run: (context) => {
-    if (context.paymentWebhooks === void 0) {
-      return [];
-    }
-    const isWide = (row) => row.toleranceSeconds !== void 0 && row.toleranceSeconds >= WIDE_TOLERANCE_THRESHOLD_SECONDS;
-    return context.paymentWebhooks.filter((row) => isWide(row)).map((row) => {
-      const location = `\`${row.exportName}\` (${row.file}:${row.line.toString()})`;
-      return emit(paymentWebhookWideTolerance, {
-        cacheKey: `payment_webhook_wide_tolerance:${row.file}:${row.line.toString()}`,
-        detail: `\`${row.callee}\` in ${location} sets \`webhookToleranceSeconds\` to ${(row.toleranceSeconds ?? 0).toString()}s (default 300s). That replay window keeps captured signed events valid long after capture.`,
-        metadata: {
-          callee: row.callee,
-          exportName: row.exportName,
-          file: row.file,
-          line: row.line,
-          toleranceSeconds: row.toleranceSeconds
-        }
-      });
-    });
-  },
-  source: "static",
-  title: "Payment webhook replay-tolerance window is implausibly wide"
-};
-
-export { paymentWebhookWideTolerance as default };

package/dist/packem_shared/plaintextSecretInWranglerVariables-NKO4YkKf.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const plaintextSecretInWranglerVariables = {
-  categories: ["SECURITY"],
-  description: "A plaintext secret is committed to `wrangler.jsonc`'s `vars` block. `vars` are cleartext — baked into the deployed Worker and checked into source control — so the secret leaks via the repo and the bundle, and rotating it needs a config edit plus a redeploy.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "plaintext_secret_in_wrangler_vars",
-  remediation: "Move the value out of `vars`: bind it through a Secrets Store (`ctx.secrets.get(<NAME>)`) or set it with `wrangler secret put <NAME>` and read it from `env.<NAME>`. Delete the `vars` entry and rotate the exposed value — assume it is already compromised. Public/publishable keys (name them `*_PUBLIC` / `*_PUBLISHABLE`) are exempt.",
-  run: (context) => {
-    if (context.wranglerVariables === void 0) {
-      return [];
-    }
-    const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
-    for (const wranglerVariable of context.wranglerVariables) {
-      const baseKey = `${wranglerVariable.file}:${wranglerVariable.key}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
-      findings.push(
-        emit(plaintextSecretInWranglerVariables, {
-          cacheKey: `plaintext_secret_in_wrangler_vars:${baseKey}${occurrenceSuffix}`,
-          detail: `The \`vars\` entry \`${wranglerVariable.key}\` in ${wranglerVariable.file} holds a plaintext ${wranglerVariable.kind.replaceAll("_", " ")} (${wranglerVariable.preview}). \`vars\` ship in cleartext to the deployed Worker and are committed to source control — move it to a Secrets Store binding or \`wrangler secret put\` and rotate the exposed value.`,
-          metadata: { file: wranglerVariable.file, key: wranglerVariable.key, kind: wranglerVariable.kind, preview: wranglerVariable.preview }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Plaintext secret in wrangler vars"
-};
-
-export { plaintextSecretInWranglerVariables as default };

package/dist/packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const policyReferencesUnknownTable = {
-  categories: ["SECURITY"],
-  description: "An RLS policy is bound to a `table` name that does not exist in the schema. The `rls()` middleware never matches it, so the table the policy was meant to protect is left ungated — reads return unrestricted rows and writes are allowed.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "policy_references_unknown_table",
-  remediation: "Fix the policy's `table` to a real table name (check for a typo or a table that was renamed/removed). If the table is gone, delete the dead policy.",
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const knownTables = new Set(context.schema.tables.map((table) => table.name));
-    const reported = /* @__PURE__ */ new Set();
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table === "" || knownTables.has(table) || reported.has(table)) {
-          continue;
-        }
-        reported.add(table);
-        findings.push(
-          emit(policyReferencesUnknownTable, {
-            cacheKey: `policy_references_unknown_table:${table}`,
-            detail: `An RLS policy in \`${procedure.exportName}\` (${procedure.file}) is bound to table \`${table}\`, which is not declared in the schema. The policy never matches, so \`${table}\` — if it exists under another name — is left ungated.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS policy bound to an unknown table"
-};
-
-export { policyReferencesUnknownTable as default };