@lunora/advisor 1.0.0-alpha.7 → 1.0.0-alpha.71

package/dist/index.mjs

@@ -1,79 +1 @@
-import constraintValidator from './packem_shared/constraintValidator-Dr9Py3FD.mjs';
-import hotShard from './packem_shared/hotShard-Ir5D0B6J.mjs';
-import indexUtilization from './packem_shared/indexUtilization-B5DMQ3bI.mjs';
-import adminRouteWithoutGuard from './packem_shared/adminRouteWithoutGuard-UUGBkAjU.mjs';
-import authApiCallWithoutHeaders from './packem_shared/authApiCallWithoutHeaders-BeJhCZaf.mjs';
-import circularFk from './packem_shared/circularFk-B2freHrP.mjs';
-import containerOversizedInstance from './packem_shared/containerOversizedInstance-5U1VKPRM.mjs';
-import containerPublicInternet from './packem_shared/containerPublicInternet-CuNerJE5.mjs';
-import duplicateIndex from './packem_shared/duplicateIndex-BOublMSt.mjs';
-import emptyIndex from './packem_shared/emptyIndex-BX8EuEY7.mjs';
-import filterWithoutIndex from './packem_shared/filterWithoutIndex-BYVeJaSs.mjs';
-import hardcodedSecret from './packem_shared/hardcodedSecret-W2pz1UZB.mjs';
-import hyperdriveOutsideAction from './packem_shared/hyperdriveOutsideAction-BgZqX7Xg.mjs';
-import indexReferencesUnknownField from './packem_shared/indexReferencesUnknownField-DH0_dbUY.mjs';
-import maskUncoveredPiiColumn from './packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs';
-import nondeterministicQueryMutation from './packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs';
-import policyReferencesUnknownTable from './packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs';
-import publicArgumentUsesAny from './packem_shared/publicArgumentUsesAny-C71b2NCf.mjs';
-import publicMutationWithoutRatelimit from './packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs';
-import r2sqlOutsideAction from './packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs';
-import relationReferencesUnknownField from './packem_shared/relationReferencesUnknownField-YznyXt_7.mjs';
-import relationReferencesUnknownTable from './packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs';
-import rlsUncoveredTable from './packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs';
-import sqlInjectionRisk from './packem_shared/sqlInjectionRisk-zwytYGLt.mjs';
-import tableWithoutInsert from './packem_shared/tableWithoutInsert-CbbaYIP4.mjs';
-import unboundedStringArgument from './packem_shared/unboundedStringArgument-DThg2-wt.mjs';
-import unindexedForeignKey from './packem_shared/unindexedForeignKey-BgJbKyqK.mjs';
-import unindexedRelationTarget from './packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs';
-import userCreatingMutationWithoutCaptcha from './packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs';
-import workflowUnknownTarget from './packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs';
-import workflowUnused from './packem_shared/workflowUnused-D0jHxdz9.mjs';
-export { AE_METRIC_EVENTS, loadAnalyticsRuntimeMetrics } from './packem_shared/AE_METRIC_EVENTS-DexctYv6.mjs';
-export { fromServerSchema } from './packem_shared/fromServerSchema-DinF1nph.mjs';
-
-const STATIC_LINTS = [
-  indexReferencesUnknownField,
-  relationReferencesUnknownTable,
-  relationReferencesUnknownField,
-  workflowUnknownTarget,
-  emptyIndex,
-  circularFk,
-  unindexedForeignKey,
-  unindexedRelationTarget,
-  duplicateIndex,
-  tableWithoutInsert,
-  workflowUnused,
-  filterWithoutIndex,
-  nondeterministicQueryMutation,
-  hyperdriveOutsideAction,
-  r2sqlOutsideAction,
-  authApiCallWithoutHeaders,
-  policyReferencesUnknownTable,
-  rlsUncoveredTable,
-  maskUncoveredPiiColumn,
-  containerOversizedInstance,
-  containerPublicInternet,
-  publicMutationWithoutRatelimit,
-  userCreatingMutationWithoutCaptcha,
-  publicArgumentUsesAny,
-  unboundedStringArgument,
-  hardcodedSecret,
-  sqlInjectionRisk,
-  adminRouteWithoutGuard
-];
-const RUNTIME_LINTS = [hotShard, indexUtilization, constraintValidator];
-const ALL_LINTS = [...STATIC_LINTS, ...RUNTIME_LINTS];
-const runAdvisor = (context, options = {}) => {
-  const lints = options.lints ?? ALL_LINTS;
-  const findings = [];
-  for (const lint of lints) {
-    if (options.source !== void 0 && lint.source !== options.source) {
-      continue;
-    }
-    findings.push(...lint.run(context));
-  }
-  return findings;
-};
-
-export { ALL_LINTS, RUNTIME_LINTS, STATIC_LINTS, adminRouteWithoutGuard, authApiCallWithoutHeaders, circularFk, constraintValidator, containerOversizedInstance, containerPublicInternet, duplicateIndex, emptyIndex, filterWithoutIndex, hardcodedSecret, hotShard, hyperdriveOutsideAction, indexReferencesUnknownField, indexUtilization, maskUncoveredPiiColumn, nondeterministicQueryMutation, policyReferencesUnknownTable, publicArgumentUsesAny, publicMutationWithoutRatelimit, r2sqlOutsideAction, relationReferencesUnknownField, relationReferencesUnknownTable, rlsUncoveredTable, runAdvisor, sqlInjectionRisk, tableWithoutInsert, unboundedStringArgument, unindexedForeignKey, unindexedRelationTarget, userCreatingMutationWithoutCaptcha, workflowUnknownTarget, workflowUnused };
+import{dedupeCacheKeys as m}from"./packem_shared/dedupeCacheKeys-7JgxaQWV.mjs";import s from"./packem_shared/constraintValidator-N339mfyx.mjs";import n from"./packem_shared/errorRateOutlier-CgK42sq0.mjs";import p from"./packem_shared/hotShard-io-eF2Sx.mjs";import f from"./packem_shared/indexUtilization-QfbIH_w4.mjs";import l from"./packem_shared/actionFetchSsrf-BbWxy1Yf.mjs";import u from"./packem_shared/actionWithoutErrorHandling-rhzjCEqm.mjs";import d from"./packem_shared/adminRouteWithoutGuard-BbscPp1m.mjs";import c from"./packem_shared/aiRawRunEscapeHatch-DfhjYm43.mjs";import $ from"./packem_shared/aiRunWithoutLogging-B0K93Pga.mjs";import h from"./packem_shared/aiToolSideEffectPromptInjection-DnWQOoKi.mjs";import g from"./packem_shared/aiUnboundedGenerationPublic-iu7crnSa.mjs";import S from"./packem_shared/allowUnauthenticatedShardAccessEnabled-D4aMNBb0.mjs";import b from"./packem_shared/authApiCallWithoutHeaders-BHkik-EF.mjs";import y from"./packem_shared/authCsrfCheckDisabled-De9ammtV.mjs";import U from"./packem_shared/authEmailVerificationDisabled-BFKdJcx4.mjs";import I from"./packem_shared/authScimWithoutTransactions-DCtLXzks.mjs";import A from"./packem_shared/authSecureCookiesDisabled-B4WIzvMm.mjs";import R from"./packem_shared/authSessionFreshageZero-Bpcaf_Pe.mjs";import T from"./packem_shared/authTrustedOriginsWildcard-DjU9NXEm.mjs";import W from"./packem_shared/browserAllowPrivateTargets-Dxyeh6lg.mjs";import v from"./packem_shared/browserUserUrlWithoutAllowlist-BHBS6b0N.mjs";import k from"./packem_shared/circularFk-ZNjkhLaE.mjs";import w from"./packem_shared/containerInstanceKeyFromUserInput-C8S4T3ty.mjs";import x from"./packem_shared/containerOversizedInstance-B9wW_sU5.mjs";import F from"./packem_shared/containerPublicInternet-g0TRsayn.mjs";import C from"./packem_shared/containerRuntimeEgressRelaxation-BQ2ZD1aV.mjs";import M from"./packem_shared/containerStartEnableInternetOverride-B62WUura.mjs";import P from"./packem_shared/duplicateIndex-DFT7qLQD.mjs";import D from"./packem_shared/emptyIndex-Bp-Y81D0.mjs";import N from"./packem_shared/errorWithoutCatalog-0PbxiZL4.mjs";import O from"./packem_shared/exportSinkMisconfigured-DvpAaa6j.mjs";import E from"./packem_shared/externalSourceIncrementalNoDeletePath-DnoL64YY.mjs";import G from"./packem_shared/externalSourceOnGlobal-IYnALPlO.mjs";import K from"./packem_shared/externalSourceUnscoped-DqBp5jYr.mjs";import L from"./packem_shared/filterOnPrimaryKey-Db947tQY.mjs";import _ from"./packem_shared/filterWithoutIndex-pIpqk-O8.mjs";import j from"./packem_shared/flagGatesSecurityWithUnsafeDefault-DPGFEHTt.mjs";import q from"./packem_shared/geoIndexFieldNotGeopoint-DAGLZtaH.mjs";import z from"./packem_shared/geoIndexUnused-B5Oww9o2.mjs";import H from"./packem_shared/hardcodedSecret-yu14ITlW.mjs";import V from"./packem_shared/httpActionMissingAuthGuard-BZDdeW_D.mjs";import B from"./packem_shared/httpActionResponseHeaderInjection-D063rB7U.mjs";import Q from"./packem_shared/hyperdriveOutsideAction-B8ffQwgl.mjs";import Z from"./packem_shared/identityUndeclaredClaimTrusted-BYRYGQ74.mjs";import J from"./packem_shared/imagesUrlSourceFromUserInput-Cy5pc_dA.mjs";import X from"./packem_shared/indexReferencesUnknownField-BPJjE0zg.mjs";import Y from"./packem_shared/insertManyUnsafeUserData-xLYAkcKj.mjs";import oo from"./packem_shared/kvUnscopedUserKeyIdor-B4lGxRxh.mjs";import ro from"./packem_shared/mailInboundDispatchWithoutVerify-BivYJ5F9.mjs";import to from"./packem_shared/mailRecipientFromRequestInput-BR_oSh65.mjs";import eo from"./packem_shared/maskUncoveredPiiColumn-DqPfZM2O.mjs";import io from"./packem_shared/maskWeakHashStrategyOnPii-DcEwc4Sz.mjs";import ao from"./packem_shared/maskedRelationLeakViaWith-CxYk0MDW.mjs";import{i as mo}from"./packem_shared/finding-BAVgqnCF.mjs";import so from"./packem_shared/mutatorFullRowReplace-CEgecSGm.mjs";import no from"./packem_shared/nondeterministicQueryMutation-BZV_biUV.mjs";import po from"./packem_shared/normalizeIdUsedAsAuthorization-FjISSXJm.mjs";import fo from"./packem_shared/notifyMissingPushConfig-C_GbVw3S.mjs";import lo from"./packem_shared/notifySendOutsideAction-B9DcirhJ.mjs";import uo from"./packem_shared/outputProjectionMissingOnPublicRead-9Pm9766s.mjs";import co from"./packem_shared/ownerFieldFromArgsNotAuth-D4K-_0aD.mjs";import $o from"./packem_shared/paymentCreateWithoutAuthorize-CurtqN8K.mjs";import ho from"./packem_shared/paymentWebhookWideTolerance-I7ingfR8.mjs";import go from"./packem_shared/plaintextSecretInWranglerVariables-CmbygN6_.mjs";import So from"./packem_shared/policyReferencesUnknownTable-D3WelAQa.mjs";import bo from"./packem_shared/privilegedDispatchUnvalidatedPayload-74GuGye1.mjs";import yo from"./packem_shared/privilegedFanoutFromPublicProcedure-sMsZN4uP.mjs";import Uo from"./packem_shared/procedureWithoutStructuredEvent-l40nx9tX.mjs";import Io from"./packem_shared/publicArgumentUsesAny-BzdcoJ9C.mjs";import Ao from"./packem_shared/publicMutationWithoutRatelimit-CozomYXw.mjs";import Ro from"./packem_shared/publicTableRlsOptoutConfusion-CaWtPGAn.mjs";import To from"./packem_shared/queueWithoutDlq-BLY3iy9Q.mjs";import Wo from"./packem_shared/r2sqlOutsideAction-DCMAsAeM.mjs";import vo from"./packem_shared/ratelimitDefaultMemoryStore-mOdI3Jmb.mjs";import ko from"./packem_shared/ratelimitKeySpoofableOrGlobal-DaGId_Fh.mjs";import wo from"./packem_shared/ratelimitMiddlewareFailOpen-CTWVosEc.mjs";import xo from"./packem_shared/relationReferencesUnknownField-clqyB69Y.mjs";import Fo from"./packem_shared/relationReferencesUnknownTable-EOtKyaHx.mjs";import Co from"./packem_shared/rlsUncoveredTable-DYHgnoos.mjs";import Mo from"./packem_shared/shapeTargetsGlobalTable-SAlq2N-T.mjs";import Po from"./packem_shared/shapeUnknownTable-DhvsbEtT.mjs";import Do from"./packem_shared/signupMutationWithoutDisposableGating-Tgv9SbsY.mjs";import No from"./packem_shared/softDeleteIncludeDeletedFromArgs-DgxpQHRA.mjs";import Oo from"./packem_shared/sqlInjectionRisk-D2NaT-5c.mjs";import Eo from"./packem_shared/storageGenerateUploadUrlNoContentTypePin-C9cjl6Jh.mjs";import Go from"./packem_shared/storageKeyFromUserArgs-CI-6kyte.mjs";import Ko from"./packem_shared/storagePresignedUrlForPrivateContent-j7VhwIdu.mjs";import Lo from"./packem_shared/storageUploadWithoutContentTypeAllowlist-oxKLecuf.mjs";import _o from"./packem_shared/storageUploadWithoutMaxSize-DUDxPutk.mjs";import jo from"./packem_shared/tableWithoutInsert-BV7qsPKx.mjs";import qo from"./packem_shared/ttlFieldNotTimestamp-BFiRkSZD.mjs";import zo from"./packem_shared/unboundedStringArgument-DN8w1bg-.mjs";import Ho from"./packem_shared/unindexedForeignKey-DK4eWXkb.mjs";import Vo from"./packem_shared/unindexedRelationTarget-B5fFq1E8.mjs";import Bo from"./packem_shared/unrestrictedWhereBranch-YKiydie4.mjs";import Qo from"./packem_shared/userCreatingMutationWithoutCaptcha-DIeHIeTU.mjs";import Zo from"./packem_shared/vectorsNamespaceFromUserInput-Cyq5B2kF.mjs";import Jo from"./packem_shared/workflowDuplicateStepName-cXF6Rpvg.mjs";import Xo from"./packem_shared/workflowUnknownTarget-BzKlYSCg.mjs";import Yo from"./packem_shared/workflowUnused-D9fC9E9b.mjs";import{compareToBaseline as oe,parseAdvisorMap as re}from"./packem_shared/compareToBaseline-BwXFusQG.mjs";import{gradeFromScore as ee}from"./packem_shared/gradeFromScore-DW82YDVY.mjs";import{MAP_VERSION as ae,byCodepoint as me,scoreAdvisor as se}from"./packem_shared/MAP_VERSION-DxkFCiLX.mjs";import{default as pe}from"./packem_shared/classifySensitivity-B1kkm44P.mjs";import{fromServerSchema as le}from"./packem_shared/fromServerSchema-9aaK1J7g.mjs";const or={convex:"migrating/from-convex",firebase:"migrating/from-firebase",supabase:"migrating/from-supabase"},i={categories:["SCHEMA"],description:"A migrated-away platform's SDK is still imported from `lunora/` source. The code compiles and typechecks, so a half-finished port keeps reading from the old platform at runtime and the two stores silently drift apart.",facing:"INTERNAL",level:"WARN",name:"migration_stale_import",remediation:"Replace the call with its Lunora equivalent and drop the dependency. If the import is deliberate — a second data source you still read from — move it out of `lunora/` so it is not mistaken for an unfinished migration.",run:r=>r.staleMigrationImports===void 0?[]:r.staleMigrationImports.map(o=>mo(i,{cacheKey:`migration_stale_import:${o.file}:${o.line.toString()}:${o.moduleSpecifier}`,detail:`\`${o.file}\` (line ${o.line.toString()}) still imports \`${o.moduleSpecifier}\`. Finish the port — see \`${or[o.platform]}\` — or move the import out of \`lunora/\` if you genuinely still read from ${o.platform}.`,metadata:{file:o.file,line:o.line,moduleSpecifier:o.moduleSpecifier,platform:o.platform}})),source:"static",title:"Stale migration import"},rr=[X,Fo,xo,Xo,Jo,Po,E,G,K,D,N,q,z,O,qo,k,Ho,Vo,P,jo,Yo,To,L,_,Mo,so,no,Q,Wo,b,So,Co,eo,io,x,F,Ao,Bo,Qo,Do,Io,zo,H,Oo,d,$o,ro,vo,W,yo,Uo,Y,g,l,u,co,Go,oo,w,c,$,Zo,to,v,bo,M,C,I,T,y,A,U,R,J,ko,Ro,S,Lo,_o,Eo,Ko,V,B,wo,j,h,Z,ho,No,ao,uo,po,lo,fo,go,i],tr=[p,f,s,n],er=[...rr,...tr],Jt=(r,o={})=>{const a=o.lints??er,t=[];for(const e of a)o.source!==void 0&&e.source!==o.source||t.push(...e.run(r));return m(t)};export{er as ALL_LINTS,ae as MAP_VERSION,tr as RUNTIME_LINTS,rr as STATIC_LINTS,l as actionFetchSsrf,u as actionWithoutErrorHandling,d as adminRouteWithoutGuard,c as aiRawRunEscapeHatch,$ as aiRunWithoutLogging,h as aiToolSideEffectPromptInjection,g as aiUnboundedGenerationPublic,S as allowUnauthenticatedShardAccessEnabled,b as authApiCallWithoutHeaders,y as authCsrfCheckDisabled,U as authEmailVerificationDisabled,I as authScimWithoutTransactions,A as authSecureCookiesDisabled,R as authSessionFreshageZero,T as authTrustedOriginsWildcard,W as browserAllowPrivateTargets,v as browserUserUrlWithoutAllowlist,me as byCodepoint,k as circularFk,pe as classifySensitivity,oe as compareToBaseline,s as constraintValidator,w as containerInstanceKeyFromUserInput,x as containerOversizedInstance,F as containerPublicInternet,C as containerRuntimeEgressRelaxation,M as containerStartEnableInternetOverride,m as dedupeCacheKeys,P as duplicateIndex,D as emptyIndex,n as errorRateOutlier,N as errorWithoutCatalog,O as exportSinkMisconfigured,E as externalSourceIncrementalNoDeletePath,G as externalSourceOnGlobal,K as externalSourceUnscoped,L as filterOnPrimaryKey,_ as filterWithoutIndex,j as flagGatesSecurityWithUnsafeDefault,le as fromServerSchema,q as geoIndexFieldNotGeopoint,z as geoIndexUnused,ee as gradeFromScore,H as hardcodedSecret,p as hotShard,V as httpActionMissingAuthGuard,B as httpActionResponseHeaderInjection,Q as hyperdriveOutsideAction,Z as identityUndeclaredClaimTrusted,J as imagesUrlSourceFromUserInput,X as indexReferencesUnknownField,f as indexUtilization,Y as insertManyUnsafeUserData,oo as kvUnscopedUserKeyIdor,ro as mailInboundDispatchWithoutVerify,to as mailRecipientFromRequestInput,eo as maskUncoveredPiiColumn,io as maskWeakHashStrategyOnPii,ao as maskedRelationLeakViaWith,so as mutatorFullRowReplace,no as nondeterministicQueryMutation,po as normalizeIdUsedAsAuthorization,fo as notifyMissingPushConfig,lo as notifySendOutsideAction,uo as outputProjectionMissingOnPublicRead,co as ownerFieldFromArgsNotAuth,re as parseAdvisorMap,$o as paymentCreateWithoutAuthorize,ho as paymentWebhookWideTolerance,go as plaintextSecretInWranglerVariables,So as policyReferencesUnknownTable,bo as privilegedDispatchUnvalidatedPayload,yo as privilegedFanoutFromPublicProcedure,Uo as procedureWithoutStructuredEvent,Io as publicArgumentUsesAny,Ao as publicMutationWithoutRatelimit,Ro as publicTableRlsOptoutConfusion,To as queueWithoutDlq,Wo as r2sqlOutsideAction,vo as ratelimitDefaultMemoryStore,ko as ratelimitKeySpoofableOrGlobal,wo as ratelimitMiddlewareFailOpen,xo as relationReferencesUnknownField,Fo as relationReferencesUnknownTable,Co as rlsUncoveredTable,Jt as runAdvisor,se as scoreAdvisor,Mo as shapeTargetsGlobalTable,Po as shapeUnknownTable,Do as signupMutationWithoutDisposableGating,No as softDeleteIncludeDeletedFromArgs,Oo as sqlInjectionRisk,Eo as storageGenerateUploadUrlNoContentTypePin,Go as storageKeyFromUserArgs,Ko as storagePresignedUrlForPrivateContent,Lo as storageUploadWithoutContentTypeAllowlist,_o as storageUploadWithoutMaxSize,jo as tableWithoutInsert,qo as ttlFieldNotTimestamp,zo as unboundedStringArgument,Ho as unindexedForeignKey,Vo as unindexedRelationTarget,Bo as unrestrictedWhereBranch,Qo as userCreatingMutationWithoutCaptcha,Zo as vectorsNamespaceFromUserInput,Jo as workflowDuplicateStepName,Xo as workflowUnknownTarget,Yo as workflowUnused};

package/dist/packem_shared/MAP_VERSION-DxkFCiLX.mjs

@@ -0,0 +1 @@
+import{scoreProcedure as h,procedureWeight as y,coverageFromScore as k,scoreGlobal as N,gradeFromScore as $,projectWeight as b,worstLevel as M,weightFor as j}from"./gradeFromScore-DW82YDVY.mjs";import F from"./classifySensitivity-B1kkm44P.mjs";const S=(e,o)=>e===o?0:e<o?-1:1,w=(e,o)=>S(e.name,o.name),x=(e,o)=>{const t=e[o];return typeof t=="string"?t:void 0},p=(e,o)=>`${e}#${o}`,R=(e,o,t,s)=>e===void 0?{level:o,name:t,occurrences:1,weight:s}:{level:M(e.level,o),name:t,occurrences:e.occurrences+1,weight:Math.max(e.weight,s)},A=(e,o,t)=>{const s=new Map;for(const a of e)s.set(p(a.file,a.exportName),new Map);const c=new Map;for(const a of o){const n=x(a.metadata,"file"),l=x(a.metadata,"exportName"),m=(n!==void 0&&l!==void 0?s.get(p(n,l)):void 0)??c;m.set(a.name,R(m.get(a.name),a.level,a.name,t(a)))}return{byProcedure:new Map([...s].map(([a,n])=>[a,[...n.values()].toSorted(w)])),project:[...c.values()].toSorted(w)}},I=(e,o)=>{const t={clean:0,exempt:0,failing:0,warned:0};let s=o.checks.length;for(const c of e)t[c.coverage]+=1,s+=c.checks.length;return{clean:t.clean,exempt:t.exempt,failing:t.failing,procedures:e.length,rulesFired:s,warned:t.warned}},O=1,W=(e,o,t={})=>{const s=new Set(t.exempt),c=A(e,o,r=>j(r.level)),a=e.map(r=>{const i=p(r.file,r.exportName),v=c.byProcedure.get(i)??[],u=h(v),d=s.has(i)||r.exempt===!0,f=F(r);return{checks:v,coverage:d?"exempt":k(u),...d?{exemptReason:r.exemptReason??""}:{},exportName:r.exportName,file:r.file,id:i,kind:r.kind,score:u,sensitivity:f,visibility:r.visibility,weight:d?0:y(r,f.level)}}).toSorted((r,i)=>S(r.id,i.id)),n={checks:c.project,score:h(c.project)},l=a.filter(r=>r.coverage!=="exempt"),m=l.reduce((r,i)=>r+i.weight,0),g=N([...l,{score:n.score,weight:b(m)}]);return{generatedAt:t.generatedAt??new Date().toISOString(),grade:$(g),procedures:a,project:n,score:g,summary:I(a,n),version:O}};export{O as MAP_VERSION,S as byCodepoint,W as scoreAdvisor};

package/dist/packem_shared/actionFetchSsrf-BbWxy1Yf.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const r={categories:["SECURITY"],description:"An action's `ctx.fetch(url)` fetches a URL derived from the handler's `args`. `ctx.fetch` applies no host allowlist, so request-controlled URLs let a caller reach cloud metadata endpoints or internal services — server-side request forgery.",facing:"EXTERNAL",level:"ERROR",name:"action_fetch_ssrf",remediation:"Validate the URL against an allowlist of expected hosts before fetching, and reject private, loopback, and link-local addresses (notably `169.254.169.254`). Never pass request input straight to `ctx.fetch`.",run:t=>t.argumentDerivedFetches===void 0?[]:t.argumentDerivedFetches.map(e=>a(r,{cacheKey:`action_fetch_ssrf:${e.file}:${e.line.toString()}`,detail:`\`ctx.fetch\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) fetches a URL derived from \`args\` — a server-side request forgery vector. Validate the URL against a host allowlist and reject private/link-local targets before fetching.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"Possible SSRF from arg-derived ctx.fetch URL"};export{r as default};

package/dist/packem_shared/actionWithoutErrorHandling-rhzjCEqm.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";const a={categories:["SCHEMA"],description:"An `action` calls an outbound surface (fetch, mail, queues, storage, sql, ai) with no `try`/`catch`. Those fail routinely, and an uncaught rejection reaches the caller with no indication of which dependency broke.",facing:"EXTERNAL",level:"WARN",name:"action_without_error_handling",remediation:"Wrap the outbound call in `try`/`catch`, then either degrade or rethrow a coded `LunoraError` naming the dependency that failed.",run:t=>t.procedureProtections===void 0?[]:t.procedureProtections.filter(e=>e.kind==="action"&&e.reachesOutbound===!0&&e.handlesErrors===!1).map(e=>r(a,{cacheKey:`action_without_error_handling:${e.file}:${e.exportName}`,detail:`Action \`${e.exportName}\` (${e.file}) calls an outbound surface with no \`try\`/\`catch\`. A dependency failure will surface to the caller unexplained.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"Action performs outbound I/O with no error handling"};export{a as default};

package/dist/packem_shared/adminRouteWithoutGuard-BbscPp1m.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"An `httpRoute` on an admin/privileged path has no visible auth/admin guard. REST routes aren't covered by RLS, so an unguarded `/admin/*` route is callable by anyone who reaches the URL.",facing:"EXTERNAL",level:"WARN",name:"admin_route_without_guard",remediation:"Assert an authenticated, authorized caller at the top of the handler — check `ctx.auth` / `getSession(...)`, or a `requireAdmin`-style guard — and reject (401/403) before doing privileged work. For machine callers, verify a secret with a timing-safe compare.",run:t=>t.adminRoutes===void 0?[]:t.adminRoutes.filter(e=>!e.usesGuard).map(e=>a(i,{cacheKey:`admin_route_without_guard:${e.file}:${e.method}:${e.path}`,detail:`Route \`${e.method} ${e.path}\` (\`${e.exportName}\` in ${e.file}) is on an admin/privileged path but its handler shows no auth/admin guard. Assert an authorized caller before doing privileged work.`,metadata:{exportName:e.exportName,file:e.file,method:e.method,path:e.path}})),source:"static",title:"Admin route without an auth guard"};export{i as default};

package/dist/packem_shared/aiRawRunEscapeHatch-DfhjYm43.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";const t={categories:["SECURITY"],description:"A `ctx.ai.run(model, …)` call selects its model from the handler's `args` with no server-side scoping. `ctx.ai.run` is the raw Workers AI binding passthrough, so an arg-derived model id lets any caller pick an arbitrary model — bypassing the typed `ctx.ai.model(...)` + AI-SDK layer's cap/schema.",facing:"EXTERNAL",level:"WARN",name:"ai_raw_run_escape_hatch",remediation:"Select the model from a fixed server-side allowlist — never from `args`. Prefer the typed `ctx.ai.model(...)` + `generateText`/`streamText` path with an output cap over the raw `ctx.ai.run` escape hatch.",run:a=>a.aiRawRuns===void 0?[]:a.aiRawRuns.map(e=>r(t,{cacheKey:`ai_raw_run_escape_hatch:${e.file}:${e.line.toString()}`,detail:`\`ctx.ai.run\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) selects its model from \`args\` with no server-side scoping — any caller can pick an arbitrary model, bypassing the typed AI-SDK layer's cap/schema. Select the model from a fixed server-side allowlist instead.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"Possible arbitrary model selection from arg-derived ctx.ai.run"};export{t as default};

package/dist/packem_shared/aiRunWithoutLogging-B0K93Pga.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const o={categories:["PERFORMANCE"],description:"A procedure runs an AI generation but emits no structured event. Model calls bill per invocation and are not reproducible, so without one there is no way to attribute spend or trace a bad answer back to its prompt.",facing:"INTERNAL",level:"INFO",name:"ai_run_without_logging",remediation:'Emit an event around the generation — `ctx.span("<name>", …)`, or a `ctx.log` line carrying the model and token usage.',run:t=>t.procedureProtections===void 0?[]:t.procedureProtections.filter(e=>e.runsAiGeneration===!0&&e.emitsEvent===!1).map(e=>n(o,{cacheKey:`ai_run_without_logging:${e.file}:${e.exportName}`,detail:`${e.kind} \`${e.exportName}\` (${e.file}) runs an AI generation with no structured event, so its cost and output cannot be attributed later.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"AI generation with no structured event"};export{o as default};

package/dist/packem_shared/aiToolSideEffectPromptInjection-DnWQOoKi.mjs

@@ -0,0 +1 @@
+import{i as o}from"./finding-BAVgqnCF.mjs";const n={categories:["SECURITY"],description:"A `generateText` / `streamText` call whose prompt/messages carry user-supplied text and whose model-callable `tools` perform a privileged side effect (DB write, `ctx.run` dispatch, or outbound send). An injected instruction in the user text can steer the model into firing that action — the confused-deputy prompt-injection hazard.",facing:"EXTERNAL",level:"WARN",name:"ai_tool_side_effect_prompt_injection",remediation:"Don't let a model with user-derived input directly trigger a privileged action. Have the tool return a proposal the server validates and authorizes before executing, gate the side effect behind an explicit human/step confirmation, or keep side-effecting tools out of any generation whose prompt includes untrusted input.",run:t=>t.aiToolSideEffects===void 0?[]:t.aiToolSideEffects.filter(e=>e.userInputDerived).map(e=>{const i=`\`${e.exportName}\` (${e.file}:${e.line.toString()})`;return o(n,{cacheKey:`ai_tool_side_effect_prompt_injection:${e.file}:${e.line.toString()}`,detail:`\`${e.method}\` in ${i} feeds user-derived input to a model whose tools reach \`${e.sideEffect}\`. An injected instruction can steer the model into firing that side effect.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,method:e.method,sideEffect:e.sideEffect}})}),source:"static",title:"AI tool side effect reachable via prompt injection"};export{n as default};

package/dist/packem_shared/aiUnboundedGenerationPublic-iu7crnSa.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";import{m as i}from"./procedure-protections-DRQotu9I.mjs";const o={categories:["SECURITY"],description:"A public procedure runs an AI generation (`generateText`/`streamText`/`generateObject`/`streamObject`) with no `maxOutputTokens` bound. Generation bills per output token, so an anonymous caller can request arbitrarily long completions in a loop — a denial-of-wallet vector that also ties up worker time on long streams.",facing:"EXTERNAL",level:"WARN",name:"ai_unbounded_generation_public",remediation:"Cap the completion with `maxOutputTokens` in the generation config, and rate-limit the public entry point (`.use(rateLimit(...))`). For expensive models, prefer running generation from an internal, authenticated path rather than exposing it directly to anonymous callers.",run:t=>t.procedureProtections===void 0?[]:t.procedureProtections.filter(e=>i(e.unboundedAiGeneration)&&e.visibility==="public").map(e=>n(o,{cacheKey:`ai_unbounded_generation_public:${e.file}:${e.exportName}`,detail:`\`${e.exportName}\` (${e.file}) is public and runs an AI generation with no \`maxOutputTokens\` bound — an anonymous caller can drive unbounded, billable completions in a loop. Add a \`maxOutputTokens\` cap and rate-limit the entry point.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"Public procedure runs unbounded AI generation (no maxOutputTokens)"};export{o as default};

package/dist/packem_shared/allowUnauthenticatedShardAccessEnabled-D4aMNBb0.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const n={categories:["SECURITY"],description:"`.extend(() => ({ allowUnauthenticatedShardAccess: true }))` disables the fail-closed default that denies an unauthenticated shard lookup. Combined with a schema that doesn't enforce `.rls(\"required\")` everywhere (or that leaves a table `.public()`), an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.",facing:"EXTERNAL",level:"WARN",name:"allow_unauthenticated_shard_access_enabled",remediation:"Prefer `authorizeShard` / `authorizeFanOut` (which take precedence over `allowUnauthenticatedShardAccess` and let you allow specific unauthenticated cases) over the blanket opt-out. If the app genuinely needs open shard access, enforce `.rls(\"required\")` on the schema with no `.public()` tables so a missing identity still can't read another tenant's rows.",run:a=>a.configCalls===void 0?[]:a.schema.rlsMode!=="required"||a.schema.tables.some(e=>e.isPublic)?a.configCalls.filter(e=>e.callee==="extend"&&e.trueKeys.includes("allowUnauthenticatedShardAccess")).map(e=>t(n,{cacheKey:`allow_unauthenticated_shard_access_enabled:${e.file}:${e.line.toString()}`,detail:`\`.extend(...)\` in ${e.file}:${e.line.toString()} sets \`allowUnauthenticatedShardAccess: true\`, and the schema has an RLS gap (no \`.rls("required")\`, or a \`.public()\` table) — an unauthenticated caller can shard-hop into another tenant's rows with no row-security guard behind the door.`,metadata:{callee:e.callee,file:e.file,line:e.line}})):[],source:"static",title:"Unauthenticated shard access enabled on an RLS-gapped schema"};export{n as default};

package/dist/packem_shared/argument-derived-sink-BpO3NPPM.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";const s=e=>{const a={categories:e.categories,description:e.description,facing:e.facing,level:e.level,name:e.name,remediation:e.remediation,run:i=>{const n=e.getAccesses(i);return n===void 0||e.suppressWhen?.(i)===!0?[]:n.map(t=>r(a,{cacheKey:e.cacheKey(t),detail:e.detail(t),metadata:e.metadata(t)}))},source:"static",title:e.title};return a};export{s as m};

package/dist/packem_shared/authApiCallWithoutHeaders-BHkik-EF.mjs

@@ -0,0 +1 @@
+import{dedupeCacheKeys as i}from"./dedupeCacheKeys-7JgxaQWV.mjs";import{i as a}from"./finding-BAVgqnCF.mjs";const s={categories:["SECURITY"],description:"A `ctx.authApi.<method>(...)` call omits `headers` — better-auth skips session authorization and runs the call with full server-to-server privileges, regardless of the caller's identity.",facing:"EXTERNAL",level:"WARN",name:"auth_api_call_without_headers",remediation:"Pass the inbound `headers` from the incoming request into every `ctx.authApi.*` call: `ctx.authApi.<method>({ body, headers: request.headers })`. See the `withAuthPlugins` middleware doc for details.",run:t=>t.authApiCalls===void 0?[]:i(t.authApiCalls.filter(e=>!e.hasHeaders).map(e=>a(s,{cacheKey:`auth_api_call_without_headers:${e.file}:${e.line.toString()}:${e.method}`,detail:`\`ctx.authApi.${e.method||"<method>"}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) is called without \`headers\` — better-auth skips session authorization, so this runs with full privileges. Pass the inbound \`headers\`.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,method:e.method}}))),source:"static",title:"Privileged ctx.authApi call missing headers"};export{s as default};

package/dist/packem_shared/authCsrfCheckDisabled-De9ammtV.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call sets `advanced.disableCSRFCheck: true`, turning off better-auth's origin validation for state-changing auth requests — a cross-site request riding the ambient auth cookie is processed like a same-origin one.",facing:"EXTERNAL",level:"ERROR",name:"auth_csrf_check_disabled",remediation:"Remove `advanced.disableCSRFCheck: true` from `createAuth({...})` and rely on `trustedOrigins` for origin validation instead of disabling the check.",run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(e=>e.analyzable&&e.disableCsrfCheck).map(e=>a(i,{cacheKey:`auth_csrf_check_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) sets \`advanced.disableCSRFCheck: true\`, turning off origin validation for state-changing auth requests. Remove the flag and rely on \`trustedOrigins\` instead.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"createAuth CSRF check disabled"};export{i as default};

package/dist/packem_shared/authEmailVerificationDisabled-BFKdJcx4.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const t={categories:["SECURITY"],description:"A `createAuth({...})` call enables `emailAndPassword` with no `requireEmailVerification: true`. better-auth defaults email verification off, so an account is usable before the caller has proven ownership of the email address.",facing:"EXTERNAL",level:"WARN",name:"auth_email_verification_disabled",remediation:"Set `emailAndPassword.requireEmailVerification: true` on `createAuth({...})` so a new account can't act until its email address is verified.",run:i=>i.authConfigs===void 0?[]:i.authConfigs.filter(e=>e.analyzable&&e.emailPasswordEnabled&&!e.requireEmailVerification).map(e=>a(t,{cacheKey:`auth_email_verification_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) enables \`emailAndPassword\` with no \`requireEmailVerification: true\`, so an account is usable before its email is proven. Set \`emailAndPassword.requireEmailVerification: true\`.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"createAuth email verification disabled"};export{t as default};

package/dist/packem_shared/authScimWithoutTransactions-DCtLXzks.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call loads `scim()` with a `database` that has no native transactions (`lunoraD1Adapter` / `lunoraAuthAdapter`). `@better-auth/scim` refuses to serve on such an adapter, so every SCIM request fails.",facing:"EXTERNAL",level:"ERROR",name:"auth_scim_without_transactions",remediation:"Move the auth tables somewhere with real transactions: `.auth({ namespace })` with a `LunoraAuthDO` (Durable Object storage), or a Postgres/MySQL kysely dialect over `@lunora/hyperdrive` with `transaction: true`. D1 cannot host SCIM.",run:e=>e.authConfigs===void 0?[]:e.authConfigs.filter(a=>a.analyzable&&a.scimOnNonTransactionalAdapter).map(a=>t(i,{cacheKey:`auth_scim_without_transactions:${a.file}:${a.line.toString()}`,detail:`\`createAuth\` in \`${a.exportName}\` (${a.file}:${a.line.toString()}) loads \`scim()\` on an adapter without native transactions, so the SCIM plugin will refuse to serve and every provisioning request from your IdP fails. Host the auth tables in a Durable Object (\`.auth({ namespace })\`) or on Postgres/MySQL via \`@lunora/hyperdrive\`.`,metadata:{exportName:a.exportName,file:a.file,line:a.line}})),source:"static",title:"SCIM configured on an adapter without transactions"};export{i as default};

package/dist/packem_shared/authSecureCookiesDisabled-B4WIzvMm.mjs

@@ -0,0 +1 @@
+import{i as o}from"./finding-BAVgqnCF.mjs";const s={categories:["SECURITY"],description:"A `createAuth({...})` call sets `advanced.useSecureCookies: false`, overriding Lunora's secure-by-default posture — the session cookie ships without `Secure` even on an HTTPS deployment, so it can be sent over a plaintext connection.",facing:"EXTERNAL",level:"ERROR",name:"auth_secure_cookies_disabled",remediation:"Remove `advanced.useSecureCookies: false` from `createAuth({...})` — let Lunora's secure-by-default posture set the `Secure` cookie attribute for an HTTPS deployment.",run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(e=>e.analyzable&&e.secureCookiesDisabled).map(e=>o(s,{cacheKey:`auth_secure_cookies_disabled:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) sets \`advanced.useSecureCookies: false\`, so the session cookie ships without \`Secure\` even on an HTTPS deployment. Remove the override and let Lunora's secure-by-default posture apply.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"createAuth secure cookies disabled"};export{s as default};

package/dist/packem_shared/authSessionFreshageZero-Bpcaf_Pe.mjs

@@ -0,0 +1 @@
+import{i as s}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"A `createAuth({...})` call sets `session.freshAge: 0`, disabling better-auth's recent-reauth check for sensitive operations — a long-lived stolen session can perform them without proving the caller still controls the credentials.",facing:"EXTERNAL",level:"WARN",name:"auth_session_freshage_zero",remediation:"Remove `session.freshAge: 0` from `createAuth({...})` (or set it to a real window) so sensitive operations require a recently re-authenticated session.",run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(e=>e.analyzable&&e.sessionFreshAgeZero).map(e=>s(i,{cacheKey:`auth_session_freshage_zero:${e.file}:${e.line.toString()}`,detail:`\`createAuth\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) sets \`session.freshAge: 0\`, disabling the recent-reauth check for sensitive operations. Remove the override or set a real window.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"createAuth session freshAge zero"};export{i as default};

package/dist/packem_shared/authTrustedOriginsWildcard-DjU9NXEm.mjs

@@ -0,0 +1 @@
+import{i as e}from"./finding-BAVgqnCF.mjs";const r={categories:["SECURITY"],description:"A `createAuth({...})` call's `trustedOrigins` array contains a `\"*\"` entry, disabling better-auth's CSRF/origin validation entirely — any origin is accepted for state-changing auth requests.",facing:"EXTERNAL",level:"ERROR",name:"auth_trusted_origins_wildcard",remediation:'List the specific origins your deployment serves in `trustedOrigins` instead of `"*"` — a wildcard disables origin validation for every caller.',run:t=>t.authConfigs===void 0?[]:t.authConfigs.filter(i=>i.analyzable&&i.trustedOriginsWildcard).map(i=>e(r,{cacheKey:`auth_trusted_origins_wildcard:${i.file}:${i.line.toString()}`,detail:`\`createAuth\` in \`${i.exportName}\` (${i.file}:${i.line.toString()}) sets \`trustedOrigins\` to include \`"*"\`, disabling CSRF/origin validation for every request. List the specific origins your deployment serves instead.`,metadata:{exportName:i.exportName,file:i.file,line:i.line}})),source:"static",title:"createAuth trustedOrigins wildcard"};export{r as default};

package/dist/packem_shared/browserAllowPrivateTargets-Dxyeh6lg.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const r={categories:["SECURITY"],description:"`createBrowser({ allowPrivateTargets: true })` disables the private/internal-IP SSRF guard, letting a navigated URL reach cloud metadata endpoints, internal services, or loopback. Combined with a request-supplied URL this is a server-side request forgery path.",facing:"EXTERNAL",level:"ERROR",name:"browser_allow_private_targets",remediation:"Remove `allowPrivateTargets: true` from `createBrowser({...})` so the private/internal-address guard stays on. If a specific internal host is genuinely required, pin it with an `allowedHosts` allowlist instead of opening all private targets.",run:a=>a.configCalls===void 0?[]:a.configCalls.filter(e=>e.callee==="createBrowser"&&e.trueKeys.includes("allowPrivateTargets")).map(e=>t(r,{cacheKey:`browser_allow_private_targets:${e.file}:${e.line.toString()}`,detail:`\`createBrowser({ allowPrivateTargets: true })\` in ${e.file}:${e.line.toString()} disables the private/internal-address SSRF guard — a navigated URL can then reach cloud metadata, internal services, or loopback. Remove the override, or pin the specific host with \`allowedHosts\` instead.`,metadata:{callee:e.callee,file:e.file,line:e.line}})),source:"static",title:"Browser with private-target SSRF guard disabled"};export{r as default};

package/dist/packem_shared/browserUserUrlWithoutAllowlist-BHBS6b0N.mjs

@@ -0,0 +1 @@
+import{m as t}from"./argument-derived-sink-BpO3NPPM.mjs";const a=t({cacheKey:e=>`browser_user_url_without_allowlist:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `ctx.browser.<method>(url, …)` call navigates to a URL derived from the handler's `args` with no server-side scoping, and no `createBrowser` allowlist contains it. The default guard blocks private targets but not arbitrary public URLs, so any caller can make the headless browser an open-proxy / SSRF tool (fetch arbitrary third-party URLs, DNS-rebind to internal hosts).",detail:e=>`\`ctx.browser.${e.method}\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) navigates to a URL derived from \`args\` with no server-side scoping, and no \`createBrowser\` allowlist contains it — the default guard blocks private targets but not arbitrary public URLs, so any caller can turn the headless browser into an open-proxy / SSRF tool. Pin \`allowedHosts\` (and/or \`resolveDns\`) on \`createBrowser({...})\`, and derive the URL from server-trusted state where possible.`,facing:"EXTERNAL",getAccesses:e=>e.browserUrlAccesses,level:"WARN",metadata:e=>({exportName:e.exportName,file:e.file,line:e.line,method:e.method}),name:"browser_user_url_without_allowlist",remediation:"Pin the browser with an `allowedHosts` allowlist (and/or `resolveDns`) on `createBrowser({...})`, and derive the navigation URL from server-trusted state where possible rather than passing `args` straight to `ctx.browser`.",suppressWhen:e=>(e.configCalls??[]).some(r=>r.callee==="createBrowser"&&r.analyzable&&(r.presentKeys.includes("allowedHosts")||r.presentKeys.includes("resolveDns"))),title:"Browser navigates to arg-derived URL with no allowlist"});export{a as default};

package/dist/packem_shared/circularFk-ZNjkhLaE.mjs

@@ -0,0 +1 @@
+import{i as E}from"./finding-BAVgqnCF.mjs";const S=100,k={categories:["SCHEMA"],description:"A chain of foreign-key relations forms a cycle (e.g. A → B → C → A). Circular FK dependencies can cause unexpected behavior during DELETE operations — a CASCADE chain may loop indefinitely, and even a RESTRICT cycle prevents deletion of any row in the loop without temporarily disabling constraints.",facing:"INTERNAL",level:"WARN",name:"circular_fk",remediation:"Remove or break the cycle by dropping at least one FK relation from the loop. Consider replacing the circular dependency with a nullable FK and explicit application logic, or restructure the schema using a junction table.",run:u=>{const h=[],r=[...new Set(u.schema.tables.map(e=>e.name))].toSorted((e,t)=>e.localeCompare(t)),g=new Map(r.map((e,t)=>[e,t])),s=new Map;for(const e of u.schema.tables)for(const t of e.relations){if(t.kind!=="one"||!g.has(t.table))continue;let n=s.get(e.name);n===void 0&&(n=new Set,s.set(e.name,n)),n.add(t.table)}const i=new Set,c=new Map,d=[],f=new Set;let p=!1;const m=e=>{i.delete(e);const t=c.get(e);if(t!==void 0)for(const n of t)t.delete(n),i.has(n)&&m(n)},w=()=>{const e=[...d];if(e.length<2)return;let t=0;for(let l=1;l<e.length;l+=1)e[l]<e[t]&&(t=l);const n=[...e.slice(t),...e.slice(0,t)],a=n.join("→");if(f.has(a))return;f.add(a);const o=[...n,n[0]].join(" → ");h.push(E(k,{cacheKey:`circular_fk:${a}`,detail:`Circular foreign-key dependency detected: ${o}. This cycle can cause unexpected behavior during DELETE operations.`,metadata:{cycle:n,path:o,tables:n}})),f.size>=S&&(p=!0)},y=(e,t)=>[...s.get(e)??[]].filter(n=>g.get(n)>=t),C=(e,t)=>{for(const n of y(e,t)){let a=c.get(n);a===void 0&&(a=new Set,c.set(n,a)),a.add(e)}},b=(e,t,n)=>{let a=!1;d.push(e),i.add(e);for(const o of y(e,n)){if(p)break;o===t?(w(),a=!0):!i.has(o)&&b(o,t,n)&&(a=!0)}return a?m(e):C(e,n),d.pop(),a};for(let e=0;e<r.length&&!p;e+=1)i.clear(),c.clear(),b(r[e],r[e],e);return h},source:"static",title:"Circular foreign-key dependency"};export{k as default};

package/dist/packem_shared/classifySensitivity-B1kkm44P.mjs

@@ -0,0 +1 @@
+const o=[{fact:e=>e.writesUserTable,reason:"writes an identity table"},{fact:e=>e.callsMail,reason:"sends mail"},{fact:e=>e.fanOut,reason:"fans out to a privileged dispatch surface"},{fact:e=>e.usesInsertManyUnsafe,reason:"bypasses validators with insertManyUnsafe"},{fact:e=>e.unboundedAiGeneration,reason:"runs an unbounded AI generation"}],r="may exhibit sensitive behaviour — its handler body could not be read",i=e=>{const a=[];let n=!1;for(const s of o){const t=s.fact(e);t===!0?a.push(s.reason):t===void 0&&(n=!0)}return n&&a.push(r),{level:a.length===0?"none":"high",reasons:a}};export{i as default};

package/dist/packem_shared/compareToBaseline-BwXFusQG.mjs

@@ -0,0 +1 @@
+import{byCodepoint as p}from"./MAP_VERSION-DxkFCiLX.mjs";const l=new Set(["clean","exempt","failing","warned"]),d=(e,r)=>{const t=new Map(e.map(s=>[s.name,s.occurrences]));return r.some(s=>s.occurrences>(t.get(s.name)??0))},i=e=>typeof e=="number"&&Number.isFinite(e),g=e=>{if(typeof e!="object"||e===null)return!1;const r=e;return typeof r.id=="string"&&i(r.score)&&typeof r.coverage=="string"&&l.has(r.coverage)},m=e=>{if(typeof e!="object"||e===null)return!1;const r=e;return Array.isArray(r.checks)&&i(r.score)},v=(e,r)=>{if(r.version!==e.version)return{comparable:!1,reason:"version-mismatch"};const t=new Map(r.procedures.map(o=>[o.id,o])),s=[],n=[],a=[];for(const o of e.procedures){if(o.coverage==="exempt")continue;const c=t.get(o.id);c!==void 0&&c.coverage!=="exempt"&&o.score<c.score&&s.push({after:o.score,before:c.score,id:o.id}),o.coverage==="failing"&&c?.coverage!=="failing"&&n.push(o.id),d(c?.checks??[],o.checks)&&a.push(o.id)}s.sort((o,c)=>p(o.id,c.id)),n.sort(p),a.sort(p);const u=e.score-r.score,f=d(r.project.checks,e.project.checks);return{comparable:!0,dropped:s,newFailing:n,projectRegressed:f,regressed:u<0||s.length>0||n.length>0||a.length>0||f,scoreDelta:u,worsened:a}},y=e=>{if(typeof e!="object"||e===null)return;const r=e;if(!(!i(r.version)||!i(r.score))&&!(!Array.isArray(r.procedures)||!r.procedures.every(t=>g(t)))&&m(r.project))return e};export{v as compareToBaseline,y as parseAdvisorMap};

package/dist/packem_shared/constraintValidator-N339mfyx.mjs

@@ -0,0 +1 @@
+import{i as u}from"./finding-BAVgqnCF.mjs";const d=5,f=a=>typeof a._id=="string"?a._id:"?",m=(a,t,e)=>a?` (sample capped at ${t.toString()} rows — ${e})`:"",p=(a,t)=>{const e=a.slice(0,d),o=t-e.length,n=e.map(i=>`"${i}"`).join(", ");return o>0?`${n} (+${o.toString()} more)`:n},v=(a,t)=>{if(a==="_id")return t.existingIds;const e=new Set;for(const o of t.rows){const n=o[a];n!=null&&e.add(String(n))}return e},x=(a,t,e,o)=>{if(e.kind!=="one"||o.truncated)return;const n=e.references,i=v(n,o),s=e.field,r=[];for(const g of t.rows){const h=g[s];if(h==null)continue;const $=String(h);i.has($)||r.push(f(g))}if(r.length===0)return;const l=t.truncated,{cap:c}=t,b=n==="_id"?`"${e.table}"`:`"${e.table}"."${n}"`,w=`Table "${t.table}": ${r.length.toString()} sampled row(s) have a dangling FK value in column "${s}" — the referenced ${b} row does not exist. Row ids: ${p(r,r.length)}${m(l,c,"more rows may exist beyond the window")}.`;return u(a,{cacheKey:`constraint_validator:fk:${t.table}:${s}`,detail:w,metadata:{cap:c,column:s,count:r.length,examples:r.slice(0,d),kind:"fk",references:n,referencesTable:e.table,table:t.table,truncated:l}})},S=(a,t,e,o)=>{if(!o)return;const n=[];for(const s of t.rows)s[e]==null&&n.push(f(s));if(n.length===0)return;const i=`Table "${t.table}": ${n.length.toString()} sampled row(s) have a null/missing value in column "${e}", which is declared as non-optional. Row ids: ${p(n,n.length)}${m(t.truncated,t.cap,"more rows may exist beyond the window")}.`;return u(a,{cacheKey:`constraint_validator:null:${t.table}:${e}`,detail:i,metadata:{cap:t.cap,column:e,count:n.length,examples:n.slice(0,d),kind:"null",table:t.table,truncated:t.truncated}})},y=(a,t)=>{const e=[];for(const o of t){const n=a[o];if(n==null)return;e.push(JSON.stringify(n))}return e.join("|")},k=(a,t,e)=>{e.includes(t)||e.push(t),e.push(a)},_=(a,t,e)=>{if(e.kind!=="index"||e.unique!==!0)return;const o=new Map,n=[];for(const s of t.rows){const r=f(s),l=y(s,e.fields);if(l===void 0)continue;const c=o.get(l);c===void 0?o.set(l,r):k(r,c,n)}if(n.length===0)return;const i=`Table "${t.table}": ${n.length.toString()} sampled row(s) share duplicate values on unique index "${e.name}" (${e.fields.join(", ")}). Row ids: ${p(n,n.length)}${m(t.truncated,t.cap,"duplicates beyond the window may exist")}.`;return u(a,{cacheKey:`constraint_validator:unique:${t.table}:${e.name}`,detail:i,metadata:{cap:t.cap,count:n.length,examples:n.slice(0,d),fields:e.fields,index:e.name,kind:"unique",table:t.table,truncated:t.truncated}})},R=(a,t,e,o)=>{const n=o.get(t.table);if(!n)return[];const i=[];for(const s of n.relations){const r=e.get(s.table);if(!r)continue;const l=x(a,t,s,r);l&&i.push(l)}for(const s of n.fields){const r=!n.optionalFields?.has(s),l=S(a,t,s,r);l&&i.push(l)}for(const s of n.indexes){const r=_(a,t,s);r&&i.push(r)}return i},T={categories:["SCHEMA"],description:"Sampled rows violate one or more declared constraints: a foreign-key column references a non-existent row, a non-optional column contains null, or a unique-indexed column has duplicate values. These violations indicate data inserted before a constraint was enforced (e.g. a schema migration, a raw import, or a bug in a past data-migration transform).",facing:"INTERNAL",level:"WARN",name:"constraint_validator",remediation:"Inspect the listed rows and correct or remove the violating values. Run a data migration to backfill nulls, dedup unique violations, or re-link dangling FK references. For FK violations, confirm the target table rows exist before fixing the referencing rows.",run:a=>{if(!a.tableSamples||a.tableSamples.length===0)return[];const t=new Map;for(const o of a.tableSamples)t.set(o.table,o);const e=new Map(a.schema.tables.map(o=>[o.name,o]));return a.tableSamples.flatMap(o=>R(T,o,t,e))},source:"runtime",title:"Constraint violation"};export{T as default};

package/dist/packem_shared/containerInstanceKeyFromUserInput-C8S4T3ty.mjs

@@ -0,0 +1 @@
+import{m as t}from"./argument-derived-sink-BpO3NPPM.mjs";const r=t({cacheKey:e=>`container_instance_key_from_user_input:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `ctx.containers.<name>.get` call routes to a container instance using a key derived from the handler's `args` with no server-side scoping. Any caller can supply another tenant's key and reach that tenant's container instance — a cross-tenant insecure direct object reference (IDOR).",detail:e=>`\`ctx.containers.*.${e.method}\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) routes to a container instance using a key derived from \`args\` with no server-side scoping — any caller can reach another tenant's container (IDOR). Derive the key from a server-trusted identity (e.g. \`\${ctx.auth.userId}\`).`,facing:"EXTERNAL",getAccesses:e=>e.containerKeyAccesses,level:"WARN",metadata:e=>({exportName:e.exportName,file:e.file,line:e.line,method:e.method}),name:"container_instance_key_from_user_input",remediation:"Derive the container instance key from a server-trusted identity (e.g. `${ctx.auth.userId}`) or a record the caller owns — never pass request input straight to `ctx.containers.<name>.get`.",title:"Possible cross-tenant IDOR from arg-derived unscoped container key"});export{r as default};

package/dist/packem_shared/containerOversizedInstance-B9wW_sU5.mjs

@@ -0,0 +1 @@
+import{i as s}from"./finding-BAVgqnCF.mjs";const r=new Set(["standard-3","standard-4"]),o=2,c=4096,d=e=>typeof e=="string"?r.has(e):(e.vcpu??0)>o||(e.memoryMib??0)>c,l={categories:["PERFORMANCE"],description:"A container is declared on a large instance type, whose provisioned memory and disk are billed for the lifetime of every running instance.",facing:"INTERNAL",level:"INFO",name:"container_oversized_instance",remediation:"Confirm the workload needs this size; a smaller instanceType (lite/basic/standard-1) costs less while idle-but-running.",run:e=>{const t=[];for(const i of e.containers??[]){const{instanceType:n}=i;if(n===void 0||!d(n))continue;const a=typeof n=="string"?n:JSON.stringify(n);t.push(s(l,{cacheKey:`container_oversized_instance:${i.exportName}`,detail:`Container "${i.exportName}" uses a large instance type (${a}); its memory + disk are billed while any instance runs.`,metadata:{container:i.exportName,instanceType:n}}))}return t},source:"static",title:"Oversized container instance"};export{l as default};

package/dist/packem_shared/containerPublicInternet-g0TRsayn.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const a={categories:["SECURITY"],description:"A container leaves outbound internet access at the default (enabled), which is billed per GB of egress and widens the attack surface.",facing:"INTERNAL",level:"INFO",name:"container_public_internet",remediation:"Set `enableInternet: false` on the container if it doesn't call external services, or `true` to opt in deliberately.",run:t=>(t.containers??[]).filter(e=>e.enableInternet===void 0).map(e=>n(a,{cacheKey:`container_public_internet:${e.exportName}`,detail:`Container "${e.exportName}" doesn't set enableInternet, so outbound internet is on by default (egress is billed).`,metadata:{container:e.exportName}})),source:"static",title:"Container egress enabled by default"};export{a as default};

package/dist/packem_shared/containerRuntimeEgressRelaxation-BQ2ZD1aV.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"A runtime `.egress.allow(...)` / `.egress.deny(...)` / `.egress.setAllowed(...)` call mutates the container's egress firewall at runtime, re-opening a network surface the static analysis assumes is locked to the `defineContainer` declaration.",facing:"EXTERNAL",level:"WARN",name:"container_runtime_egress_relaxation",remediation:"Prefer declaring the egress policy statically in `lunora/containers.ts` where it is auditable. When a runtime mutation is unavoidable, scope it behind a server-trusted check and keep the change narrow (a specific host, not a broad allow) rather than an unconditional relaxation.",run:a=>a.containerOverrides===void 0?[]:a.containerOverrides.filter(e=>e.kind==="egress_relaxation").map(e=>t(i,{cacheKey:`container_runtime_egress_relaxation:${e.file}:${e.line.toString()}`,detail:`\`${e.exportName}\` calls \`.egress.${e.detail}(...)\` at runtime, mutating the container's egress firewall.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,method:e.detail}})),source:"static",title:"Runtime egress mutation relaxes the container firewall"};export{i as default};

package/dist/packem_shared/containerStartEnableInternetOverride-B62WUura.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const i={categories:["SECURITY"],description:"A runtime `.start({ enableInternet: true, … })` call overrides the static `defineContainer` declaration and re-opens public internet egress for that container instance, defeating the `container_public_internet` lint's assumption that the declaration is authoritative.",facing:"EXTERNAL",level:"WARN",name:"container_start_enable_internet_override",remediation:"Avoid overriding `enableInternet` at `.start()` time. Set it once on the `defineContainer` declaration in `lunora/containers.ts` so the static advisors can reason about it, and gate any runtime opt-in behind a server-trusted check rather than an unconditional literal.",run:t=>t.containerOverrides===void 0?[]:t.containerOverrides.filter(e=>e.kind==="enable_internet").map(e=>n(i,{cacheKey:`container_start_enable_internet_override:${e.file}:${e.line.toString()}`,detail:`\`${e.exportName}\` calls \`.start({ enableInternet: true })\`, overriding the container's static egress posture.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"Runtime .start() override re-enables container internet access"};export{i as default};

package/dist/packem_shared/dedupeCacheKeys-7JgxaQWV.mjs

@@ -0,0 +1 @@
+const n=a=>{const t=new Map;return a.map(e=>{const c=(t.get(e.cacheKey)??0)+1;return t.set(e.cacheKey,c),c===1?e:{...e,cacheKey:`${e.cacheKey}:${c.toString()}`}})};export{n as dedupeCacheKeys};

package/dist/packem_shared/duplicateIndex-DFT7qLQD.mjs

@@ -0,0 +1 @@
+import{i as o}from"./finding-BAVgqnCF.mjs";const r=(a,i)=>a.length>i.length?!1:a.every((n,d)=>n===i[d]),l={categories:["PERFORMANCE"],description:"A secondary index is redundant because another index already covers every lookup it serves (its columns are a leading prefix of the other's). The redundant index costs storage and is maintained on every write for no read benefit.",facing:"INTERNAL",level:"INFO",name:"duplicate_index",remediation:"Drop the redundant index; the covering index already serves its lookups.",run:a=>{const i=[];for(const n of a.schema.tables){const d=n.indexes.filter(e=>e.kind==="index");for(const e of d){if(e.unique===!0)continue;const t=d.find(s=>s===e||!r(e.fields,s.fields)?!1:e.fields.length===s.fields.length?e.name>s.name:!0);t&&i.push(o(l,{cacheKey:`duplicate_index:${n.name}:${e.name}`,detail:`Index "${e.name}" on table "${n.name}" (${e.fields.join(", ")}) is redundant — index "${t.name}" (${t.fields.join(", ")}) already covers its lookups.`,metadata:{coveredBy:{fields:t.fields,name:t.name},fields:e.fields,index:e.name,table:n.name}}))}}return i},source:"static",title:"Duplicate / redundant index"};export{l as default};

package/dist/packem_shared/emptyIndex-Bp-Y81D0.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const i={categories:["SCHEMA"],description:"An index declares no columns, so it indexes nothing and can never narrow a read.",facing:"INTERNAL",level:"WARN",name:"empty_index",remediation:"Give the index its columns, or remove it.",run:a=>a.schema.tables.flatMap(n=>n.indexes.filter(e=>e.kind==="index"&&e.fields.length===0).map(e=>t(i,{cacheKey:`empty_index:${n.name}:${e.name}`,detail:`Index "${e.name}" on table "${n.name}" declares no columns.`,metadata:{index:e.name,table:n.name}}))),source:"static",title:"Empty index"};export{i as default};

package/dist/packem_shared/errorRateOutlier-CgK42sq0.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const i=20,s=.1,l={categories:["PERFORMANCE"],description:"A function's observed error rate has cleared a threshold high enough to be a genuine reliability signal — the same errorHotspots signal `lunora insights` reports, now gated in `lunora advisor`.",facing:"EXTERNAL",level:"WARN",name:"error_rate_outlier",remediation:"Read the function's `lastErrorMessage` / traces to find the failing dependency or input shape, then fix or guard it; `lunora insights` ranks every function by error rate for the same window.",run:o=>{const t=[];for(const r of o.functionMetrics??[]){if(r.calls<i)continue;const e=r.errors/r.calls;if(e<s)continue;const a=Math.round(e*100);t.push(n(l,{cacheKey:`error_rate_outlier:${r.path}`,detail:`"${r.path}" errored on ${r.errors.toString()} of ${r.calls.toString()} calls (${a.toString()}%) over the observed window.`,metadata:{calls:r.calls,errors:r.errors,path:r.path,rate:e}}))}return t},source:"runtime",title:"Error-rate outlier"};export{l as default};

package/dist/packem_shared/errorWithoutCatalog-0PbxiZL4.mjs

@@ -0,0 +1 @@
+import{i as o}from"./finding-BAVgqnCF.mjs";const t={categories:["SCHEMA"],description:"A procedure throws a bare `new Error(...)`. It reaches the client as an opaque message the caller cannot branch on, and error grouping cannot fingerprint it into a stable issue.",facing:"EXTERNAL",level:"WARN",name:"error_without_catalog",remediation:'Throw a coded error instead: `throw new LunoraError("<CODE>", { … })` from `@lunora/errors`, adding the code to `ERROR_CATALOG` if it is new.',run:e=>e.procedureProtections===void 0?[]:e.procedureProtections.filter(r=>r.throwsBareError===!0).map(r=>o(t,{cacheKey:`error_without_catalog:${r.file}:${r.exportName}`,detail:`${r.kind} \`${r.exportName}\` (${r.file}) throws a bare \`new Error(...)\`. Use \`LunoraError\` with a catalog code so the client can branch on it and Studio can group it.`,metadata:{exportName:r.exportName,file:r.file,kind:r.kind}})),source:"static",title:"Bare Error thrown instead of a coded LunoraError"};export{t as default};

package/dist/packem_shared/exportSinkMisconfigured-DvpAaa6j.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const c={defineExportSink:["name","deliver"],r2Sink:["bucket","name"],webhookExportSink:["name","url"]},f={categories:["SCHEMA"],description:"A CDC export sink (`defineExportSink` / `webhookExportSink` / `r2Sink`) is missing a required config field (a webhook with no `url`, an R2 sink with no `bucket`, or a sink with no `name`/`deliver`). The sink can never deliver a change batch, so the export tap silently drains nothing.",facing:"INTERNAL",level:"ERROR",name:"export_sink_misconfigured",remediation:"Supply the missing field: a non-empty `url` for `webhookExportSink`, a `bucket` R2 binding for `r2Sink`, or `name` + `deliver` for `defineExportSink`.",run:n=>{if(n.exportSinks===void 0)return[];const t=[];for(const e of n.exportSinks){if(!e.analyzable)continue;const r=new Set(e.presentKeys),o=new Set(e.emptyKeys);for(const i of c[e.factory]??[]){if(r.has(i)&&!o.has(i))continue;const s=o.has(i)?"is set to an empty string":"is missing";t.push(a(f,{cacheKey:`export_sink_misconfigured:${e.file}:${e.line.toString()}:${i}`,detail:`\`${e.factory}({ … })\` in ${e.file}:${e.line.toString()} ${s} its required \`${i}\` field — the sink can never deliver a change batch, so the export tap drains nothing.`,metadata:{factory:e.factory,field:i,file:e.file,line:e.line}}))}}return t},source:"static",title:"Export sink is misconfigured"};export{f as default};

package/dist/packem_shared/externalSourceIncrementalNoDeletePath-DnoL64YY.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const l={categories:["SCHEMA"],description:"A `.source({ mode: 'incremental' })` table declares no delete-visibility path (`reconcileEveryMs` or `softDeleteColumn`), so upstream deletes are never applied and the materialized table accumulates phantom rows.",facing:"EXTERNAL",level:"ERROR",name:"external_source_incremental_no_delete_path",remediation:"Add `reconcileEveryMs` (a periodic full-pull sweep that GCs vanished rows) or `softDeleteColumn` (an upstream tombstone column the incremental pull returns). Incremental ingest can't see a delete otherwise.",run:o=>{const a=[];for(const e of o.schema.tables){const t=e.externalSource;if(t!==void 0){if(t.unanalyzable){a.push(n(l,{cacheKey:`external_source_incremental_no_delete_path:${e.name}`,detail:`Table \`${e.name}\`'s \`.source(...)\` config is not a static object literal, so its \`mode\`/delete-visibility can't be verified. If it is \`mode: "incremental"\`, confirm it declares \`reconcileEveryMs\` or \`softDeleteColumn\` — an incremental source without one accumulates phantom rows on every upstream delete.`,level:"WARN",metadata:{table:e.name}}));continue}t.mode!=="incremental"||t.hasReconcile||t.hasSoftDelete||a.push(n(l,{cacheKey:`external_source_incremental_no_delete_path:${e.name}`,detail:`Table \`${e.name}\` is \`.source({ mode: "incremental" })\` but declares neither \`reconcileEveryMs\` nor \`softDeleteColumn\` — an incremental pull never sees upstream deletes, so the materialized table would accumulate phantom rows. Add one of the two delete-visibility paths.`,metadata:{table:e.name}}))}}return a},source:"static",title:"Incremental sourced table has no delete-visibility path"};export{l as default};

package/dist/packem_shared/externalSourceOnGlobal-IYnALPlO.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const l={categories:["SCHEMA"],description:"A table is both `.source(...)` and `.global()`. A global table lives in the external/global tier; a sourced table is materialized into a shard DO's SQLite — the two are mutually exclusive.",facing:"INTERNAL",level:"ERROR",name:"external_source_on_global",remediation:'Drop either `.source(...)` or `.global()`. To ingest an external database into per-tenant DOs, use `.source(...)` with `.shardBy(...)`; to read it in place as a global table, use `.global({ backend: "hyperdrive" })`.',run:a=>a.schema.tables.filter(e=>e.externalSource!==void 0&&e.shardKind==="global").map(e=>t(l,{cacheKey:`external_source_on_global:${e.name}`,detail:`Table \`${e.name}\` is both \`.source(...)\` and \`.global()\` — contradictory. A sourced table materializes into a shard DO's SQLite; a global table lives in the external tier.`,metadata:{table:e.name}})),source:"static",title:"Sourced table cannot also be global"};export{l as default};

package/dist/packem_shared/externalSourceUnscoped-DqBp5jYr.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const n={categories:["SECURITY"],description:"A `.source(...)` table that is also `.shardBy(...)` has no `tenantBy` mapper, so every tenant's Durable Object runs the same unscoped query and replicates the whole multitenant table — a cross-tenant data leak.",facing:"EXTERNAL",level:"ERROR",name:"external_source_unscoped",remediation:"Add `tenantBy: (shardKey) => [shardKey]` (matching the query's bound parameters) so each shard DO pulls only its own tenant's rows. The shard key MUST bind into the source `WHERE`.",run:s=>{const t=[];for(const e of s.schema.tables)if(!(e.externalSource===void 0||e.shardKind!=="shardBy")){if(e.externalSource.unanalyzable){t.push(a(n,{cacheKey:`external_source_unscoped:${e.name}`,detail:`Table \`${e.name}\` is \`.source(...)\` + \`.shardBy(...)\` but its source config is not a static object literal, so \`tenantBy\` can't be verified. Confirm \`tenantBy\` binds the shard key into the query, or inline the config so the linter can check it — an unscoped query leaks every tenant's rows into each DO.`,level:"WARN",metadata:{table:e.name}}));continue}e.externalSource.hasTenantBy||t.push(a(n,{cacheKey:`external_source_unscoped:${e.name}`,detail:`Table \`${e.name}\` is \`.source(...)\` + \`.shardBy(...)\` but declares no \`tenantBy\` — every tenant DO would pull the whole table. Add a \`tenantBy\` that binds the shard key into the query.`,metadata:{table:e.name}}))}return t},source:"static",title:"Sourced + sharded table is not tenant-scoped"};export{n as default};

package/dist/packem_shared/filterOnPrimaryKey-Db947tQY.mjs

@@ -0,0 +1 @@
+import{i}from"./finding-BAVgqnCF.mjs";const a={categories:["PERFORMANCE"],description:"A query filters on `_id`, the primary key. That walks the table comparing every row's id, when `ctx.db.get(id)` fetches the row directly. There is no case where the scan is preferable.",facing:"EXTERNAL",level:"WARN",name:"filter_on_primary_key",remediation:'Replace `ctx.db.query("table").filter((d) => d._id === id).first()` with `ctx.db.get(id)`. Passing a typed `Id<"table">` also narrows the result to that table\'s `Doc`, where the scan form returns the shared row type.',run:t=>(t.queries??[]).filter(e=>e.filtersPrimaryKey===!0&&e.table!=="").map(e=>{const r=e.line>0?`${e.file}:${e.line.toString()}`:e.file;return i(a,{cacheKey:`filter_on_primary_key:${e.file}:${e.line.toString()}:${e.table}`,detail:`Query on "${e.table}" at ${r} filters on \`_id\` — it scans "${e.table}" to find a row \`ctx.db.get(id)\` addresses directly.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,table:e.table}})}),source:"static",title:"Filter on primary key instead of ctx.db.get"};export{a as default};

package/dist/packem_shared/filterWithoutIndex-pIpqk-O8.mjs

@@ -0,0 +1 @@
+import{i as l}from"./finding-BAVgqnCF.mjs";const s={categories:["PERFORMANCE"],description:"A query calls `.filter()` without a `.withIndex()` / `.withSearchIndex()`, so it loads every row in the table and filters in memory — a full table scan that gets linearly slower as the table grows.",facing:"EXTERNAL",level:"WARN",name:"filter_without_index",remediation:'Narrow the read with `.withIndex("name", (q) => q.eq(...))` first, then `.filter()` only for what the index cannot express.',run:i=>{const t=[],d=new Map(i.schema.tables.map(e=>[e.name,e.shardKind]));for(const e of i.queries??[]){if(!e.hasFilter||e.hasIndex||e.table===""||e.filtersPrimaryKey===!0)continue;const n=e.line>0?`${e.file}:${e.line.toString()}`:e.file,a=d.get(e.table),r={exportName:e.exportName,file:e.file,line:e.line,shardKind:a??"unknown",table:e.table},o=`filter_without_index:${e.file}:${e.line.toString()}:${e.table}`;if(a==="shardBy"){t.push(l(s,{cacheKey:o,detail:`Query on "${e.table}" at ${n} calls .filter() without an index. "${e.table}" is \`.shardBy()\`, so the read is already scoped to one shard rather than the whole table — this is bounded by one tenant's row count, not the dataset. Add an index if that per-shard count grows large.`,level:"INFO",metadata:r}));continue}const h=new Map([["global",`it scans the whole D1 table "${e.table}" — unbounded, and the cost is a cross-region round trip`],["root",`it loads every row of "${e.table}" from the root Durable Object's SQLite and filters in memory`]]).get(a??"")??`it loads every row of "${e.table}" and filters in memory`;t.push(l(s,{cacheKey:o,detail:`Query on "${e.table}" at ${n} calls .filter() without an index — ${h}.`,metadata:r}))}return t},source:"static",title:"Filter without index"};export{s as default};

package/dist/packem_shared/finding-BAVgqnCF.mjs

@@ -0,0 +1 @@
+const t=(e,i)=>({cacheKey:i.cacheKey,categories:i.categories??e.categories,description:e.description,detail:i.detail,facing:i.facing??e.facing,level:i.level??e.level,metadata:i.metadata,name:e.name,remediation:e.remediation,title:e.title});export{t as i};

package/dist/packem_shared/fk-index-Bmk19RvQ.mjs

@@ -0,0 +1 @@
+const d="_id",i=s=>`by${s.charAt(0).toUpperCase()}${s.slice(1)}`,n=s=>new Set(s.indexes.filter(e=>e.kind==="index").map(e=>e.fields[0]).filter(e=>e!==void 0));export{d as P,n as l,i as s};

package/dist/packem_shared/flagGatesSecurityWithUnsafeDefault-DPGFEHTt.mjs

@@ -0,0 +1 @@
+import{i as s}from"./finding-BAVgqnCF.mjs";const i=new Set(["enforce","gate","lockdown","rls"]),o=new Set(["allow","bypass","permit"]),n=/(?<=[A-Z])(?=[A-Z][a-z])/gu,u=/(?<=[a-z0-9])(?=[A-Z])/gu,f=/[^a-z0-9]+/u,d=a=>a.replaceAll(n," ").replaceAll(u," ").toLowerCase().split(f).filter(e=>e.length>0),c=a=>{const e=d(a.key),l=e.some(t=>i.has(t)),r=e.some(t=>o.has(t));return l===r?!1:l?!a.defaultValue:a.defaultValue},p={categories:["SECURITY"],description:"A `ctx.flags.boolean(key, default)` read on a security-shaped key has a fail-open default that selects the permissive branch. OpenFeature returns the default when the provider errors, so an outage silently disables a protection (a `false` default on an `enforce`/`rls`/`gate`/`lockdown` key) or grants a permission (a `true` default on an `allow`/`permit`/`bypass` key).",facing:"EXTERNAL",level:"WARN",name:"flag_gates_security_with_unsafe_default",remediation:"Flip the default so a provider outage fails closed: default a protection flag (`enforce*`/`rls*`/`gate*`/`lockdown*`) to `true`, and a permission/bypass flag (`allow*`/`permit*`/`bypass*`) to `false`. The safe default is always the restrictive branch — never let an unreachable flag backend open access.",run:a=>a.flagSecurityDefaults===void 0?[]:a.flagSecurityDefaults.filter(e=>c(e)).map(e=>s(p,{cacheKey:`flag_gates_security_with_unsafe_default:${e.file}:${e.line.toString()}`,detail:`\`ctx.flags.boolean("${e.key}", ${String(e.defaultValue)})\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) fails open to the permissive branch — a provider outage returns \`${String(e.defaultValue)}\`, ${e.defaultValue?"granting the guarded permission":"disabling the guarded protection"}.`,metadata:{defaultValue:e.defaultValue,exportName:e.exportName,file:e.file,key:e.key,line:e.line}})),source:"static",title:"Security flag fails open to the permissive branch"};export{p as default};

package/dist/packem_shared/fromServerSchema-9aaK1J7g.mjs

@@ -0,0 +1 @@
+const r=t=>({rlsMode:t.rlsMode,tables:Object.entries(t.tables).map(([d,a])=>{const s=[...a.indexes.map(e=>({fields:e.fields,kind:"index",name:e.name,unique:e.unique})),...a.searchIndexes.map(e=>({fields:[e.field,...e.filterFields??[]],kind:"search",name:e.name})),...a.rankIndexes.map(e=>({fields:[...e.sortBy.map(n=>n.field),...e.partitionBy??[]],kind:"rank",name:e.name})),...a.vectorIndexes.map(e=>({fields:[e.field],kind:"vector",name:e.name})),...a.geoIndexes.map(e=>({fields:[e.field],kind:"geo",name:e.name}))],i={},l=new Set;for(const[e,n]of Object.entries(a.shape))if(n.kind==="optional"){const o=n._meta?.inner;i[e]=o?.kind??n.kind,l.add(e)}else i[e]=n.kind,n._meta?.column?.notNull===!1&&l.add(e);return{externallyManaged:a.isExternallyManaged??!1,externalSource:a.externalSource?{hasReconcile:a.externalSource.reconcileEveryMs!==void 0,hasSoftDelete:a.externalSource.softDeleteColumn!==void 0,hasTenantBy:a.externalSource.tenantBy!==void 0,mode:a.externalSource.mode}:void 0,columnKinds:i,fields:Object.keys(a.shape),indexes:s,isPublic:a.isPublic??!1,name:d,optionalFields:l,shardKind:a.shardMode.kind,softDelete:a.softDeleteMode,ttl:a.ttlPolicy,relations:Object.entries(a.relationMap).map(([e,n])=>({field:n.field,kind:n.kind,name:e,onDelete:n.onDelete,references:n.references,table:n.table}))}})});export{r as fromServerSchema};

package/dist/packem_shared/geoIndexFieldNotGeopoint-DAGLZtaH.mjs

@@ -0,0 +1 @@
+import{i as c}from"./finding-BAVgqnCF.mjs";const d={categories:["SCHEMA"],description:"A `.geoIndex(name, { field })` points at a column that is not a `v.geoPoint()`, so its geohash companion can't be built and `withGeoIndex(...)` can never match.",facing:"INTERNAL",level:"ERROR",name:"geo_index_field_not_geopoint",remediation:"Point the geo index at a `v.geoPoint()` column, or change the column's type to `v.geoPoint()`.",run:a=>{const i=[];for(const e of a.schema.tables)for(const n of e.indexes){if(n.kind!=="geo")continue;const o=n.fields[0];if(o===void 0)continue;const t=e.columnKinds?.[o];t===void 0||t==="geoPoint"||i.push(c(d,{cacheKey:`geo_index_field_not_geopoint:${e.name}:${n.name}:${o}`,detail:`Geo index "${n.name}" on table "${e.name}" indexes column "${o}", which is a ${t}, not a v.geoPoint().`,metadata:{field:o,index:n.name,kind:t,table:e.name}}))}return i},source:"static",title:"Geo index field is not a geoPoint"};export{d as default};

package/dist/packem_shared/geoIndexUnused-B5Oww9o2.mjs

@@ -0,0 +1 @@
+import{i as d}from"./finding-BAVgqnCF.mjs";const t={categories:["SCHEMA"],description:"A `.geoIndex(name, { field })` is declared but no handler reads it via `withGeoIndex(name, …)`. The geohash companion column is maintained on every write and read by nothing — dead overhead, the geo analogue of a dead index.",facing:"INTERNAL",level:"INFO",name:"geo_index_unused",remediation:'Query the index from a handler with `ctx.db.query("<table>").withGeoIndex("<name>", q => q.near(point, radius))`, or drop the `.geoIndex(...)` declaration so writes stop maintaining its geohash companion.',run:a=>{if(a.geoIndexUsages===void 0)return[];const i=a.geoIndexUsages;if(i.some(e=>e.indexName===""))return[];const o=new Set(i.map(e=>e.indexName));return a.schema.tables.flatMap(e=>e.indexes.filter(n=>n.kind==="geo"&&!o.has(n.name)).map(n=>d(t,{cacheKey:`geo_index_unused:${e.name}:${n.name}`,detail:`No handler reads geo index "${n.name}" on table "${e.name}" via \`withGeoIndex("${n.name}", …)\` — it's declared but never queried, so its geohash companion is maintained on every write for nothing.`,metadata:{index:n.name,table:e.name}})))},source:"static",title:"Geo index is declared but never queried"};export{t as default};

package/dist/packem_shared/gradeFromScore-DW82YDVY.mjs

@@ -0,0 +1 @@
+const s={ERROR:20,INFO:5,WARN:10},i={ERROR:3,INFO:1,WARN:2},n=e=>Number.isFinite(e)&&e>=0?e:0,c=e=>s[e],u=(e,r)=>i[e]>=i[r]?e:r,h=(e,r="none")=>{const o=e.visibility==="public"?2:.5,t=e.kind==="query"?.5:o;return r==="high"?t*2:t},g=e=>Math.max(1,e*.2),d=e=>{const r=e.reduce((o,t)=>o+n(t.weight),0);return Math.min(100,Math.max(0,100-r))},l=e=>{const r=e.reduce((t,a)=>t+a.weight,0);if(r===0)return 100;const o=e.reduce((t,a)=>t+a.score*a.weight,0);return Math.round(o/r)},R=e=>e>=90?"excellent":e>=70?"good":e>=50?"needs-work":"at-risk",m=e=>e===100?"clean":e>=50?"warned":"failing";export{s as DEFAULT_WEIGHT_BY_LEVEL,m as coverageFromScore,R as gradeFromScore,n as normalizeWeight,h as procedureWeight,g as projectWeight,l as scoreGlobal,d as scoreProcedure,c as weightFor,u as worstLevel};

package/dist/packem_shared/hardcodedSecret-yu14ITlW.mjs

@@ -0,0 +1 @@
+import{dedupeCacheKeys as r}from"./dedupeCacheKeys-7JgxaQWV.mjs";import{i}from"./finding-BAVgqnCF.mjs";const a={categories:["SECURITY"],description:"A secret-shaped string literal (live API key, access key, private key, or high-entropy token) is hard-coded in the source. Committed secrets leak via clone/fork/history and force a redeploy to rotate.",facing:"INTERNAL",level:"ERROR",name:"hardcoded_secret",remediation:'Move the secret out of source: set it locally in `.dev.vars` (`lunora env set <NAME> "<value>"`) and in production with `wrangler secret put <NAME>`, then read it at runtime from `env.<NAME>`. Rotate the exposed value — assume it is already compromised.',run:t=>t.secretLiterals===void 0?[]:r(t.secretLiterals.map(e=>i(a,{cacheKey:`hardcoded_secret:${e.file}:${e.line.toString()}:${e.kind}`,detail:`A ${e.kind.replaceAll("_"," ")} (${e.preview}) is hard-coded at ${e.file}:${e.line.toString()}. Move it to \`.dev.vars\` / \`wrangler secret put\` and read it from \`env\`. Rotate the exposed value.`,metadata:{file:e.file,kind:e.kind,line:e.line,preview:e.preview}}))),source:"static",title:"Hard-coded secret in source"};export{a as default};

package/dist/packem_shared/helpers-DwlvEUCh.mjs

@@ -0,0 +1 @@
+const t=new Set(["accountId","authorId","createdBy","createdById","organizationId","orgId","ownerId","tenantId","updatedBy","userId","workspaceId"]),a=new Set(["address","dateOfBirth","dob","email","firstName","lastName","phone","phoneNumber","socialSecurityNumber","ssn"]),d=new Set(["_creationTime","_id"]),n=e=>e.fields.filter(i=>t.has(i)||a.has(i)),s=e=>new Set([...d,...e.fields]),o=e=>e.visibility==="public"&&(e.kind==="mutation"||e.kind==="action");export{a as P,o as i,n as o,s as t};

package/dist/packem_shared/hotShard-io-eF2Sx.mjs

@@ -0,0 +1 @@
+import{i as h}from"./finding-BAVgqnCF.mjs";const u=.5,c=50,l=o=>{const r=new Map;for(const s of o){const t=s.group??"",e=r.get(t);e===void 0?r.set(t,[s]):e.push(s)}return r},g=(o,r,s)=>{const t=s.reduce((e,a)=>e+a.requests,0);return s.length<2||t<c?[]:s.filter(e=>e.requests/t>=u).map(e=>{const a=e.requests/t,n=e.group!==void 0&&e.group!==""?`"${e.group}" `:"",i=e.shardKey===""?"the root shard":`shard "${e.shardKey}"`,d=Math.round(a*100);return h(o,{cacheKey:`hot_shard:${r}:${e.shardKey}`,detail:`${n}${i} handled ${e.requests.toString()} of ${t.toString()} requests (${d.toString()}%) across ${s.length.toString()} shards — a hot-key skew. Re-shard on a more evenly-distributed key.`,metadata:{group:e.group,requests:e.requests,shardCount:s.length,shardKey:e.shardKey,share:a,totalRequests:t}})})},p={categories:["PERFORMANCE"],description:"One shard is taking a disproportionate share of a sharded function's traffic, so the busy shard becomes a single-DO bottleneck while its siblings sit idle — the hot-key skew sharding is meant to avoid.",facing:"EXTERNAL",level:"WARN",name:"hot_shard",remediation:"Re-shard on a higher-cardinality / more evenly-distributed key, or split the hot entity's state, so request volume spreads across shards instead of concentrating on one.",run:o=>{const r=(o.shardTraffic??[]).filter(s=>s.requests>0);return[...l(r)].flatMap(([s,t])=>g(p,s,t))},source:"runtime",title:"Hot shard"};export{p as default};

package/dist/packem_shared/httpActionMissingAuthGuard-BZDdeW_D.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const n=(t,e)=>t==="httpRoute"&&e?`\`httpRoute\` ${e} handler`:"`httpAction` handler",r={categories:["SECURITY"],description:"An `httpAction`/`httpRoute` handler performs a side effect (`ctx.runMutation`/`ctx.runAction`/a `ctx.db` write) but never reads `ctx.auth` — an unauthenticated HTTP endpoint driving a state change, bypassing the identity/RLS checks that guard the rest of the app.",facing:"EXTERNAL",level:"WARN",name:"http_action_missing_auth_guard",remediation:"Read `ctx.auth` in the handler before the side effect — call `await ctx.auth.getIdentity()` (or check `ctx.auth.userId`) and reject unauthenticated/unauthorized requests, or forward through a `mutation`/`action` whose RLS policies enforce access. If the endpoint is intentionally public (e.g. a signed webhook), verify the provider signature before the write.",run:t=>t.httpActionGuards===void 0?[]:t.httpActionGuards.filter(e=>!e.readsAuth).map(e=>{const i=n(e.kind,e.method);return a(r,{cacheKey:`http_action_missing_auth_guard:${e.file}:${e.line.toString()}`,detail:`${i} \`${e.exportName}\` (${e.file}:${e.line.toString()}) calls \`ctx.${e.sideEffect}\` but never reads \`ctx.auth\` — an anonymous caller can drive this write. Authenticate the request before the side effect.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind,line:e.line,sideEffect:e.sideEffect,...e.method?{method:e.method}:{}}})}),source:"static",title:"Unauthenticated HTTP handler performs a side effect"};export{r as default};

package/dist/packem_shared/httpActionResponseHeaderInjection-D063rB7U.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const i={"headers-append":"a `headers.append(...)` call","headers-ctor":"a `new Headers({...})` initializer","headers-set":"a `headers.set(...)` call","response-init":"a `Response` init `headers` object"},n={categories:["SECURITY"],description:"An `httpAction` handler writes a response-header value derived from raw request input (`request.headers`/URL/query/body) with no CR/LF sanitizer. A `Request`-derived string placed verbatim into a response header lets a caller smuggle `\\r\\n` and inject extra headers or split the response (HTTP response splitting / header injection).",facing:"EXTERNAL",level:"WARN",name:"http_action_response_header_injection",remediation:"Never place a raw request value into a response header. Route it through a CR/LF guard (`isSafeHeaderValue` from `@lunora/server`, rejecting values containing `\\r`/`\\n`/`\\0`), URL-encode it (`encodeURIComponent`), or coerce it to a number — before writing the header. `String(...)` / `.toString()` do NOT strip CR/LF and are not sufficient.",run:r=>r.httpHeaderWrites===void 0?[]:r.httpHeaderWrites.map(e=>{const t=e.headerName===""?"a response header":`the \`${e.headerName}\` response header`;return a(n,{cacheKey:`http_action_response_header_injection:${e.file}:${e.line.toString()}`,detail:`\`${e.exportName}\` (${e.file}:${e.line.toString()}) writes ${t} from raw request input via ${i[e.via]} with no CR/LF guard — a caller can smuggle \`\\r\\n\` to inject headers or split the response. Route the value through \`isSafeHeaderValue\` or \`encodeURIComponent\` first.`,metadata:{exportName:e.exportName,file:e.file,headerName:e.headerName,line:e.line,via:e.via}})}),source:"static",title:"Response header written from unsanitized request input"};export{n as default};

package/dist/packem_shared/hyperdriveOutsideAction-B8ffQwgl.mjs

@@ -0,0 +1 @@
+import{i}from"./finding-BAVgqnCF.mjs";const a={categories:["SCHEMA"],description:"A `query`/`mutation` handler accesses Hyperdrive via `ctx.sql`. Hyperdrive hits an external database Lunora does not own: queries are non-deterministic (like `fetch`) and external writes are invisible to live queries. `ctx.sql` is available on `ActionCtx` only and must be confined to `action` handlers.",facing:"EXTERNAL",level:"WARN",name:"hyperdrive_outside_action",remediation:"Move the `ctx.sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas the external DB is not.",run:t=>t.hyperdriveCalls===void 0?[]:t.hyperdriveCalls.map(e=>i(a,{cacheKey:`hyperdrive_outside_action:${e.file}:${e.line.toString()}:${e.callee}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a ${e.kind} handler — Hyperdrive's \`ctx.sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external SQL into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,metadata:{callee:e.callee,exportName:e.exportName,file:e.file,kind:e.kind,line:e.line}})),source:"static",title:"Hyperdrive `ctx.sql` used outside an action"};export{a as default};

package/dist/packem_shared/identityUndeclaredClaimTrusted-BYRYGQ74.mjs

@@ -0,0 +1 @@
+import{i as a}from"./finding-BAVgqnCF.mjs";const d={categories:["SECURITY"],description:"An authorization read of `auth.identity.<key>` for a claim outside the declared `defineIdentity({ ... })` contract. `defineIdentity` validates only declared claims and forwards undeclared ones verbatim, so the value the policy trusts was never validated — an attacker's token can forge it.",facing:"EXTERNAL",level:"WARN",name:"identity_undeclared_claim_trusted",remediation:"Declare the claim in `defineIdentity({ ... })` (e.g. `role: v.optional(v.string())`) so the worker validates it at the trust boundary before a policy reads it, or stop trusting it for authorization. Declared claims (and `userId`) are validated; undeclared claims are forwarded unchecked.",run:t=>t.identityClaimReads===void 0?[]:t.identityClaimReads.filter(e=>!e.declared).map(e=>{const i=`\`${e.exportName}\` (${e.file}:${e.line.toString()})`;return a(d,{cacheKey:`identity_undeclared_claim_trusted:${e.file}:${e.line.toString()}:${e.key}`,detail:`\`${e.key}\` in ${i} is read off \`identity\` but is not declared in \`defineIdentity({ ... })\`. Undeclared claims are forwarded unvalidated, so this authorization decision trusts a forgeable value.`,metadata:{exportName:e.exportName,file:e.file,key:e.key,line:e.line}})}),source:"static",title:"Authorization trusts an undeclared identity claim"};export{d as default};

package/dist/packem_shared/imagesUrlSourceFromUserInput-Cy5pc_dA.mjs

@@ -0,0 +1 @@
+import{m as r}from"./argument-derived-sink-BpO3NPPM.mjs";const a=r({cacheKey:e=>`images_url_source_from_user_input:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `buildImageDeliveryUrl({ key, … })` call's `key` — the CDN transform's source image, an absolute URL or an origin-relative key — is derived from the handler's `args` with no server-side scoping, so any caller can point the CDN's on-the-fly transform at an attacker-chosen origin (SSRF / open proxy) or an arbitrary key under the account's own store.",detail:e=>`\`buildImageDeliveryUrl\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) builds its delivery URL from a \`key\` derived from \`args\` with no server-side scoping — any caller can point the CDN's on-the-fly transform at an attacker-chosen origin or store key. Validate \`key\` against an allowlist, or derive it from server-trusted state.`,facing:"EXTERNAL",getAccesses:e=>e.imageDeliveryUrlAccesses,level:"WARN",metadata:e=>({exportName:e.exportName,file:e.file,line:e.line}),name:"images_url_source_from_user_input",remediation:"Validate `key` against an allowlist of known origins/prefixes before calling `buildImageDeliveryUrl`, or derive it from server-trusted state (a stored record's own image key) rather than passing `args` straight through.",title:"Image delivery URL built from unscoped user input"});export{a as default};

package/dist/packem_shared/indexReferencesUnknownField-BPJjE0zg.mjs

@@ -0,0 +1 @@
+import{i as o}from"./finding-BAVgqnCF.mjs";import{t as d}from"./helpers-DwlvEUCh.mjs";const r={categories:["SCHEMA"],description:"An index references a column that is not declared on its table. The index can never match, and the typo would otherwise surface only at runtime.",facing:"INTERNAL",level:"ERROR",name:"index_references_unknown_field",remediation:"Fix the column name in the index declaration, or add the column to the table.",run:t=>t.schema.tables.flatMap(e=>{const i=d(e);return e.indexes.flatMap(n=>n.fields.filter(a=>!i.has(a)).map(a=>o(r,{cacheKey:`index_references_unknown_field:${e.name}:${n.name}:${a}`,detail:`Index "${n.name}" on table "${e.name}" references column "${a}", which is not declared on the table.`,metadata:{field:a,index:n.name,indexKind:n.kind,table:e.name}})))}),source:"static",title:"Index references unknown field"};export{r as default};

package/dist/packem_shared/indexUtilization-QfbIH_w4.mjs

@@ -0,0 +1 @@
+import{i as d}from"./finding-BAVgqnCF.mjs";const i=25,n={categories:["PERFORMANCE"],description:"Recorded reads show an index the workload doesn't pay for: either a declared index no read ever used (dead overhead on every write) or a table read hot with no index at all (a repeated full scan that degrades as it grows).",facing:"INTERNAL",level:"INFO",name:"index_utilization",remediation:"Drop a dead index so writes stop maintaining it; add an index covering the hot full-scanned table's read predicate so the read stops scanning every row.",run:t=>{const a=[];for(const e of t.indexHits??[])e.reads>0||a.push(d(n,{cacheKey:`index_utilization:dead_index:${e.table}:${e.index}`,detail:`Index "${e.index}" on table "${e.table}" has recorded no reads since its counter was created — it's dead overhead: every write maintains it and nothing reads through it.`,metadata:{index:e.index,kind:"dead_index",reads:e.reads,table:e.table}}));for(const e of t.tableScans??[])e.scans<i||a.push(d(n,{cacheKey:`index_utilization:hot_scan:${e.table}`,detail:`Table "${e.table}" has been full-scanned ${e.scans.toString()} times (cumulative) with no index — a repeated full scan that degrades linearly as "${e.table}" grows. Add an index covering the read predicate.`,facing:"EXTERNAL",level:"WARN",metadata:{kind:"hot_scan",scans:e.scans,table:e.table}}));return a},source:"runtime",title:"Index utilization"};export{n as default};

package/dist/packem_shared/insertManyUnsafeUserData-xLYAkcKj.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";import{m as i}from"./procedure-protections-DRQotu9I.mjs";const s={categories:["SECURITY"],description:"A public procedure calls `ctx.db.insertManyUnsafe(...)`, which writes rows straight to storage and bypasses both the per-row validators and the schema's insert triggers (server-trusted columns, ownership stamping, RLS write checks). On a public entry point the rows are request-shaped, so a caller can write columns they shouldn't control and skip every trigger-enforced invariant.",facing:"EXTERNAL",level:"WARN",name:"insert_many_unsafe_user_data",remediation:"Use the validated `ctx.db.insert(...)` path in public procedures so validators and insert triggers run. If you need the unsafe bulk write, move it into an internal function (`internalMutation`/`internalAction`) that is fed only server-constructed rows, never request input.",run:t=>t.procedureProtections===void 0?[]:t.procedureProtections.filter(e=>i(e.usesInsertManyUnsafe)&&e.visibility==="public").map(e=>r(s,{cacheKey:`insert_many_unsafe_user_data:${e.file}:${e.exportName}`,detail:`\`${e.exportName}\` (${e.file}) is public and calls \`ctx.db.insertManyUnsafe(...)\`, bypassing validators and insert triggers on request-shaped rows. Switch to \`ctx.db.insert(...)\`, or move the bulk write into an internal function fed server-built rows.`,metadata:{exportName:e.exportName,file:e.file,kind:e.kind}})),source:"static",title:"Public procedure uses insertManyUnsafe (bypasses validators and triggers)"};export{s as default};

package/dist/packem_shared/kvUnscopedUserKeyIdor-B4lGxRxh.mjs

@@ -0,0 +1 @@
+import{m as r}from"./argument-derived-sink-BpO3NPPM.mjs";const s=r({cacheKey:e=>`kv_unscoped_user_key_idor:${e.file}:${e.line.toString()}`,categories:["SECURITY"],description:"A `ctx.kv` read/write uses a namespace key derived from the handler's `args` with no server-side scoping. Workers KV is a flat namespace, so an unscoped key lets any caller read, overwrite, or delete another user's entry — an insecure direct object reference (IDOR).",detail:e=>`\`ctx.kv.${e.method}\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) uses a KV key derived from \`args\` with no server-side scoping — any caller can read/overwrite/delete another user's entry (IDOR). Prefix the key with a server-trusted identity (e.g. \`\${ctx.auth.userId}:…\`).`,facing:"EXTERNAL",getAccesses:e=>e.kvKeyAccesses,level:"ERROR",metadata:e=>({exportName:e.exportName,file:e.file,line:e.line,method:e.method}),name:"kv_unscoped_user_key_idor",remediation:"Prefix every `ctx.kv` key with a server-trusted identity (e.g. `${ctx.auth.userId}:${args.id}`) so a caller can only address their own entries. Never pass request input straight to `ctx.kv.get`/`put`/`delete`.",title:"Possible IDOR from arg-derived unscoped KV key"});export{s as default};

package/dist/packem_shared/mailInboundDispatchWithoutVerify-BivYJ5F9.mjs

@@ -0,0 +1 @@
+import{i}from"./finding-BAVgqnCF.mjs";const t={categories:["SECURITY"],description:"`createInboundEmailHandler({...})` has no `verify` hook, so it trusts every inbound message — the `from` address is spoofable and DKIM/SPF/DMARC verdicts go unchecked. If the handler dispatches into a Lunora function (admin bearer, RLS disabled), a forged sender can drive privileged writes (a confused-deputy escalation).",facing:"EXTERNAL",level:"ERROR",name:"mail_inbound_dispatch_without_verify",remediation:"Pass a `verify` hook to `createInboundEmailHandler({...})` that rejects the message unless its DKIM/SPF/DMARC authentication verdicts pass and the sender is expected — before any dispatch into a Lunora function. Never trust the `from` header alone.",run:a=>a.configCalls===void 0?[]:a.configCalls.filter(e=>e.callee==="createInboundEmailHandler"&&e.analyzable&&!e.presentKeys.includes("verify")).map(e=>i(t,{cacheKey:`mail_inbound_dispatch_without_verify:${e.file}:${e.line.toString()}`,detail:`\`createInboundEmailHandler({...})\` in ${e.file}:${e.line.toString()} has no \`verify\` hook — it trusts the spoofable \`from\` address and unchecked DKIM/SPF/DMARC verdicts. A forged sender can then reach whatever the handler dispatches to (a Lunora function runs with the admin bearer and RLS disabled). Add a \`verify\` gate that enforces the authentication verdicts before dispatch.`,metadata:{callee:e.callee,file:e.file,line:e.line}})),source:"static",title:"Inbound email handler without a verify hook"};export{t as default};

package/dist/packem_shared/mailRecipientFromRequestInput-BR_oSh65.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const r={categories:["SECURITY"],description:"A `ctx.mail`/`ctx.email` `send`/`queue` call sets a recipient field (to/cc/bcc) from the handler's `args` with no server-side scoping. Sending to an address taken straight from request input turns the deployment into an open relay / spam amplifier.",facing:"EXTERNAL",level:"WARN",name:"mail_recipient_from_request_input",remediation:"Derive recipients from server-trusted state (e.g. the authenticated user's own record via `ctx.auth`), never straight from `args`. If user-chosen recipients are intended, gate the path behind authentication and rate limiting.",run:i=>i.mailRecipientAccesses===void 0?[]:i.mailRecipientAccesses.map(e=>t(r,{cacheKey:`mail_recipient_from_request_input:${e.file}:${e.line.toString()}`,detail:`\`ctx.mail.${e.method}\` in \`${e.exportName}\` (${e.file}:${e.line.toString()}) sets a recipient field (to/cc/bcc) derived from \`args\` with no server-side scoping — any caller can direct mail to an arbitrary address (open relay / spam amplifier). Derive the recipient from server-trusted state instead (e.g. \`ctx.auth.user.email\`).`,metadata:{exportName:e.exportName,file:e.file,line:e.line,method:e.method}})),source:"static",title:"Mail recipient derived from request input"};export{r as default};

package/dist/packem_shared/maskUncoveredPiiColumn-DqPfZM2O.mjs

@@ -0,0 +1 @@
+import{i as u}from"./finding-BAVgqnCF.mjs";const d={categories:["SECURITY"],description:"A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",facing:"EXTERNAL",level:"WARN",name:"mask_uncovered_pii_column",remediation:"Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",run:a=>{if(a.maskProcedures===void 0)return[];const i=new Map;for(const t of a.maskProcedures)for(const{column:o,table:e}of t.maskColumns){if(e===""||o==="")continue;const s=i.get(e)??new Set;s.add(o),i.set(e,s)}if(i.size===0)return[];const r=[];for(const t of a.maskProcedures){if(t.usesMask||t.visibility==="internal")continue;const o=new Set;for(const e of t.tablesRead)e!==""&&i.has(e)&&o.add(e);for(const e of o){const s=[...i.get(e)??new Set].toSorted((n,l)=>n.localeCompare(l)),c=s.map(n=>`\`${n}\``).join(", ");r.push(u(d,{cacheKey:`mask_uncovered_pii_column:${t.file}:${t.exportName}:${e}`,detail:`\`${t.exportName}\` in ${t.file} reads table \`${e}\` without \`.use(mask(...))\` — its column${s.length===1?"":"s"} ${c} ${s.length===1?"is":"are"} masked elsewhere in the app but returned in the clear here.`,metadata:{columns:s,exportName:t.exportName,file:t.file,table:e}}))}}return r},source:"static",title:"Maskable column returned without mask() middleware"};export{d as default};

package/dist/packem_shared/maskWeakHashStrategyOnPii-DcEwc4Sz.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const s=/address|birthdate|creditcard|dateofbirth|dob|driverslicense|email|firstname|fullname|lastname|nationalid|passport|phone|socialsecurity|ssn|taxid/u,i=a=>s.test(a.replaceAll(/[^a-z0-9]/giu,"").toLowerCase()),o={categories:["SECURITY"],description:'A `mask(policies)` column named like PII (email, SSN, phone, …) uses the `"hash"` strategy. `"hash"` is an unsalted 32-bit FNV-1a digest — brute-force-recoverable and cross-row-correlatable — not a confidentiality control, so it does not actually hide the value.',facing:"EXTERNAL",level:"WARN",name:"mask_weak_hash_strategy_on_pii",remediation:'Use `"redact"` instead of `"hash"` for this column — e.g. `mask({ <table>: { <column>: "redact" } })`. Reserve `"hash"` for columns where a stable, joinable pseudonym is the goal and the value itself is not sensitive.',run:a=>a.maskStrategies===void 0?[]:a.maskStrategies.filter(e=>e.strategy==="hash"&&i(e.column)).map(e=>t(o,{cacheKey:`mask_weak_hash_strategy_on_pii:${e.file}:${e.line.toString()}`,detail:`\`${e.exportName}\` in ${e.file} masks \`${e.table===""?e.column:`${e.table}.${e.column}`}\` with \`"hash"\` — its name suggests PII, and \`"hash"\` is brute-force-recoverable and leaks cross-row equality. Use \`"redact"\` instead.`,metadata:{column:e.column,exportName:e.exportName,file:e.file,table:e.table}})),source:"static",title:'Weak "hash" mask strategy on a PII column'};export{o as default};

package/dist/packem_shared/maskedRelationLeakViaWith-CxYk0MDW.mjs

@@ -0,0 +1 @@
+import{i as s}from"./finding-BAVgqnCF.mjs";const l=a=>{const t=new Set;for(const o of a.maskProcedures??[])for(const{table:n}of o.maskColumns)n!==""&&t.add(n);for(const o of a.maskStrategies??[])o.table!==""&&t.add(o.table);return t},d=a=>{const t=new Map;for(const o of a.schema.tables)for(const n of o.relations)t.set(`${o.name} ${n.name}`,n.table);return t},c={categories:["SECURITY"],description:"A public read hydrates a masked table through a `with` relation. Column masking does not descend into `with`-hydrated relations, so the related table's masked columns are returned in the clear.",facing:"EXTERNAL",level:"INFO",name:"masked_relation_leak_via_with",remediation:"Don't hydrate a masked table through `with` on an unprotected read: drop the relation, project only non-sensitive columns, or route the parent read through a procedure that re-applies masking to the joined table. Masking is per-procedure and top-level only — it never reaches `with`-loaded relations.",run:a=>{if(a.relationLoads===void 0)return[];const t=l(a);if(t.size===0)return[];const o=d(a),n=[];for(const e of a.relationLoads)if(!(e.visibility!=="public"||e.parentTable===""))for(const i of e.relations){const r=o.get(`${e.parentTable} ${i}`);r===void 0||!t.has(r)||n.push(s(c,{cacheKey:`masked_relation_leak_via_with:${e.file}:${e.line.toString()}:${e.parentTable}:${i}`,detail:`The public read in \`${e.exportName}\` (${e.file}:${e.line.toString()}) hydrates relation \`${i}\` (masked table \`${r}\`) via \`with\` on \`${e.parentTable}\`. Masking is top-level only and does not descend into \`with\`, so \`${r}\`'s masked columns are returned in the clear.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,parentTable:e.parentTable,relation:i,relationTable:r}}))}return n},source:"static",title:"Masked table surfaced unmasked through a with-relation on a public read"};export{c as default};

package/dist/packem_shared/mutatorFullRowReplace-CEgecSGm.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";const o={categories:["SCHEMA"],description:"A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",facing:"EXTERNAL",level:"WARN",name:"mutator_full_row_replace",remediation:"Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",run:t=>t.mutatorWrites===void 0?[]:t.mutatorWrites.map(e=>r(o,{cacheKey:`mutator_full_row_replace:${e.exportName}:${String(e.line)}`,detail:`Mutator \`${e.exportName}\` (${e.file}:${String(e.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,metadata:{exportName:e.exportName,file:e.file,line:e.line}})),source:"static",title:"Mutator overwrites the whole row (clobbers concurrent column edits)"};export{o as default};

package/dist/packem_shared/nondeterministicQueryMutation-BZV_biUV.mjs

@@ -0,0 +1 @@
+import{i as l}from"./finding-BAVgqnCF.mjs";const u={categories:["SCHEMA"],description:"A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). A `query` may be re-run by a live subscription, so non-determinism there can flicker between evaluations (WARN). An ordinary `mutation` handler does not replay on this runtime — it runs at most once per logical write — so this is informational there (INFO) unless the mutation is itself invoked from a workflow step or queue consumer that can replay.",facing:"EXTERNAL",level:"WARN",name:"nondeterministic_query_mutation",remediation:"For a `query`: move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument, or accept that the value may differ across re-evaluations. For an ordinary `mutation`: no action needed — the handler runs at most once per logical write on this runtime. If the mutation is dispatched from inside a workflow step or queue consumer, treat it like an action value instead, since the surrounding step/consumer can replay.",run:a=>{if(a.nondeterministicCalls===void 0)return[];const n=[],o=new Map;for(const e of a.nondeterministicCalls){const t=`${e.file}:${e.line.toString()}:${e.callee}`,i=(o.get(t)??0)+1;o.set(t,i);const r=i>1?`:${i.toString()}`:"",s={callee:e.callee,exportName:e.exportName,file:e.file,kind:e.kind,line:e.line};if(e.kind==="mutation"){n.push(l(u,{cacheKey:`nondeterministic_query_mutation:${t}${r}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a mutation handler. Ordinary mutations don't replay on this runtime (idempotency dedup returns a cached result rather than re-running the handler, and an OCC conflict throws to the caller instead of retrying internally), so this is informational — no action needed unless \`${e.exportName}\` is invoked from a workflow step or queue consumer that can itself replay.`,facing:"INTERNAL",level:"INFO",metadata:s}));continue}n.push(l(u,{cacheKey:`nondeterministic_query_mutation:${t}${r}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a query handler — a live subscription may re-run this query, so the result can differ between evaluations. Compute it in an \`action\` and pass the value into the mutation as an argument.`,metadata:s}))}return n},source:"static",title:"Non-deterministic call in query/mutation handler"};export{u as default};

package/dist/packem_shared/normalizeIdUsedAsAuthorization-FjISSXJm.mjs

@@ -0,0 +1 @@
+import{i as s}from"./finding-BAVgqnCF.mjs";const n={delete:"deletes the row",get:"reads the row",patch:"patches the row"},l={categories:["SECURITY"],description:"A `.public()` `query`/`mutation` gates a `ctx.db.get`/`patch`/`delete` on a null-checked `ctx.db.normalizeId(table, id)` result with no ownership predicate and no RLS. `normalizeId` validates id *shape* only — it never reads the database — so a non-null result proves the id is well-formed, never that the caller owns the row (an IDOR).",facing:"EXTERNAL",level:"INFO",name:"normalize_id_used_as_authorization",remediation:'Don\'t treat a non-null `normalizeId` result as authorization — it only validates id shape. After loading the row, compare its ownership column (`userId`/`ownerId`/…) against the server-trusted identity (`ctx.auth.userId`), or protect the procedure with `.use(rls(...))` / put the schema in `.rls("required")` mode so the row policy runs on every access.',run:t=>{if(t.normalizeIdAuthorizations===void 0)return[];const i=t.schema.rlsMode==="required",r=new Set(t.schema.tables.filter(e=>e.isPublic).map(e=>e.name)),a=[];for(const e of t.normalizeIdAuthorizations){if(e.visibility!=="public"||e.usesRls||e.mentionsOwnership||i&&(e.table===""||!r.has(e.table)))continue;const o=e.table===""?"the row":`the \`${e.table}\` row`;a.push(s(l,{cacheKey:`normalize_id_used_as_authorization:${e.file}:${e.line.toString()}`,detail:`Public procedure \`${e.exportName}\` (${e.file}:${e.line.toString()}) gates access on \`ctx.db.normalizeId(...)\` and then ${n[e.sinkMethod]} — but \`normalizeId\` only validates id shape, it never reads the database or checks ownership. Any caller supplying a well-formed id of ${o} reaches it (IDOR). Compare the loaded row's ownership column against \`ctx.auth\`, or cover the procedure with \`.use(rls(...))\`.`,metadata:{exportName:e.exportName,file:e.file,line:e.line,sinkMethod:e.sinkMethod,table:e.table}}))}return a},source:"static",title:"normalizeId result used as authorization (validates id shape, not ownership)"};export{l as default};

package/dist/packem_shared/notifyMissingPushConfig-C_GbVw3S.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const i={categories:["SCHEMA"],description:"The app sends push notifications via `ctx.push` but `defineNotify(...)` configures neither a Web Push nor an FCM channel, so every send fails at runtime. Wire at least one push channel (`webPush` and/or `fcm`) and provide its secrets (`VAPID_*` / `FCM_*`).",facing:"INTERNAL",level:"WARN",name:"notify_missing_push_config",remediation:"In `lunora/notify.ts`, wire a push channel: `defineNotify({ webPush: (env) => webPushFromEnv(env) })` and set `VAPID_PUBLIC_KEY` / `VAPID_PRIVATE_KEY` / `VAPID_SUBJECT` in `.dev.vars` (or configure `fcm` with `FCM_PROJECT_ID`). Generate a VAPID keypair with `npx web-push generate-vapid-keys`.",run:s=>{const e=s.notifyConfig;return e===void 0||!e.usesPush||e.hasWebPush||e.hasFcm?[]:[n(i,{cacheKey:"notify_missing_push_config",detail:"`ctx.push` is used to send notifications, but `defineNotify(...)` wires neither `webPush` nor `fcm` — every push send will fail at runtime. Configure at least one push channel and its secrets.",metadata:{hasFcm:e.hasFcm,hasWebPush:e.hasWebPush,usesPush:e.usesPush}})]},source:"static",title:"Push used with no Web Push / FCM channel configured"};export{i as default};

package/dist/packem_shared/notifySendOutsideAction-B9DcirhJ.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const i={categories:["SCHEMA"],description:"A `query`/`mutation` handler sends a notification via `ctx.notify`/`ctx.push`. A send is external I/O (a `fetch` to a push service / FCM): it is non-deterministic like `fetch`, and a mutation re-run on OCC retry would re-send it (duplicate pushes). These facades are available on `ActionCtx` only and must be confined to `action` handlers.",facing:"EXTERNAL",level:"WARN",name:"notify_send_outside_action",remediation:"Move the `ctx.notify`/`ctx.push` send into an `action(...)`, where external I/O is allowed. If a query/mutation must trigger a notification, have it enqueue the send (`enqueuePushBroadcast` via `@lunora/queue`) or schedule an action — the queue/scheduler runs the send exactly once, off the transactional path.",run:n=>n.notifyCalls===void 0?[]:n.notifyCalls.map(e=>t(i,{cacheKey:`notify_send_outside_action:${e.file}:${e.line.toString()}:${e.callee}`,detail:`\`${e.callee}(…)\` in ${e.exportName} (${e.file}:${e.line.toString()}) runs inside a ${e.kind} handler — a notification send is non-deterministic external I/O and a retried ${e.kind} would re-send it. Move it into an \`action\`, or enqueue/schedule the send.`,metadata:{callee:e.callee,exportName:e.exportName,file:e.file,kind:e.kind,line:e.line}})),source:"static",title:"Notification send used outside an action"};export{i as default};

package/dist/packem_shared/outputProjectionMissingOnPublicRead-9Pm9766s.mjs

@@ -0,0 +1 @@
+import{i as r}from"./finding-BAVgqnCF.mjs";import{P as l}from"./helpers-DwlvEUCh.mjs";const s={categories:["SECURITY"],description:"A `.public()` `query` returns raw table rows (no `.output(...)` projection, no `.use(mask(...))`) from a table carrying PII-named columns (`email`, `phone`, `ssn`, …). Every column ships to the caller, and a column added to the table later leaks by default.",facing:"EXTERNAL",level:"INFO",name:"output_projection_missing_on_public_read",remediation:"Add an explicit return projection to the public query — `.output(v.object({ … }))` listing only the fields a client needs — or apply a `.use(mask(...))` policy to the PII columns. This makes the exposed shape intentional and stops a newly-added column from leaking through this query by default.",run:o=>{if(o.rawRowReturns===void 0)return[];const n=new Map;for(const e of o.schema.tables){const t=e.fields.filter(i=>l.has(i));t.length>0&&n.set(e.name,t)}const a=[];for(const e of o.rawRowReturns){if(e.visibility!=="public"||e.usesOutput||e.usesMask||e.table==="")continue;const t=n.get(e.table);t!==void 0&&a.push(r(s,{cacheKey:`output_projection_missing_on_public_read:${e.file}:${e.line.toString()}`,detail:`Public query \`${e.exportName}\` (${e.file}:${e.line.toString()}) returns raw \`${e.table}\` rows with no \`.output(...)\` projection — shipping PII column(s) ${t.join(", ")} to every caller, and any column added to \`${e.table}\` later leaks by default. Project the return with \`.output(v.object({ … }))\` or mask the PII columns.`,metadata:{columns:t,exportName:e.exportName,file:e.file,line:e.line,table:e.table}}))}return a},source:"static",title:"Public query returns raw rows with PII and no output projection"};export{s as default};

package/dist/packem_shared/ownerFieldFromArgsNotAuth-D4K-_0aD.mjs

@@ -0,0 +1 @@
+import{i as n}from"./finding-BAVgqnCF.mjs";const a={categories:["SECURITY"],description:"A `ctx.db` write sets an ownership/identity column (`userId`, `ownerId`, `tenantId`, …) from the handler's `args`. The caller controls who the row belongs to, so any caller can write rows owned by another user or tenant — an act-as-any-user / cross-tenant IDOR.",facing:"EXTERNAL",level:"ERROR",name:"owner_field_from_args_not_auth",remediation:"Stamp the ownership column from the server-trusted identity (`ctx.auth.userId` / `ctx.identity`), never from request input. Drop the field from the accepted `args` so a caller cannot supply it.",run:t=>t.ownerFieldWrites===void 0?[]:t.ownerFieldWrites.map(e=>{const r=`\`${e.method}\` in \`${e.exportName}\` (${e.file}:${e.line.toString()})`,i={exportName:e.exportName,field:e.field,file:e.file,line:e.line,method:e.method,visibility:e.visibility??"unknown"};return e.visibility==="internal"?n(a,{cacheKey:`owner_field_from_args_not_auth:${e.file}:${e.line.toString()}:${e.field}`,detail:`${r} sets the ownership field \`${e.field}\` from \`args\`. This is expected for an \`internal\` procedure — no caller can reach it directly, and the trusted caller passes the subject along. Audit the PUBLIC procedures that dispatch to it: if one forwards \`args.${e.field}\` straight through, the IDOR is there.`,facing:"INTERNAL",level:"INFO",metadata:i}):n(a,{cacheKey:`owner_field_from_args_not_auth:${e.file}:${e.line.toString()}:${e.field}`,detail:`${r} sets the ownership field \`${e.field}\` from \`args\` instead of the server-trusted identity — any caller can write rows owned by another user/tenant (IDOR). Stamp \`${e.field}\` from \`ctx.auth\`/\`ctx.identity\`, never from request input.`,metadata:i})}),source:"static",title:"Ownership field written from args, not server identity"};export{a as default};

package/dist/packem_shared/paymentCreateWithoutAuthorize-CurtqN8K.mjs

@@ -0,0 +1 @@
+import{i as t}from"./finding-BAVgqnCF.mjs";const r={categories:["SECURITY"],description:"`createPayment({...})` was constructed without an `authorize` callback, so its access-control gate never runs — any caller that reaches a payment reference id can drive a charge, refund, or subscription change against it (a broken-access-control / IDOR risk on money movement).",facing:"EXTERNAL",level:"ERROR",name:"payment_create_without_authorize",remediation:"Pass an `authorize(referenceId)` callback to `createPayment({...})` that verifies the current caller (via `ctx.auth`) owns the payment/subscription reference before the operation runs. Prefer the `ctx.payments` accessor, which is authorization-scoped by default.",run:a=>a.configCalls===void 0?[]:a.configCalls.filter(e=>e.callee==="createPayment"&&e.analyzable&&!e.presentKeys.includes("authorize")).map(e=>t(r,{cacheKey:`payment_create_without_authorize:${e.file}:${e.line.toString()}`,detail:`\`createPayment({...})\` in ${e.file}:${e.line.toString()} has no \`authorize\` callback — its access-control gate never runs, so any caller reaching the payment reference can move money against it. Add an \`authorize(referenceId)\` gate that checks \`ctx.auth\` ownership before the operation.`,metadata:{callee:e.callee,file:e.file,line:e.line}})),source:"static",title:"createPayment without an authorize gate"};export{r as default};