@lunora/advisor 1.0.0-alpha.8 → 1.0.0-alpha.80

package/dist/packem_shared/maskUncoveredPiiColumn-DjGIPG6M.mjs

@@ -1,61 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const maskUncoveredPiiColumn = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads a table whose columns are masked by `.use(mask(...))` elsewhere in the app, but this procedure's builder chain does not include `.use(mask(...))`. It returns those columns in the clear while a sibling procedure redacts them.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mask_uncovered_pii_column",
-  remediation: "Add `.use(mask(policies))` to the procedure's builder chain — e.g. `c.use(mask(myMasks)).query(...)` — so its returned rows redact the same columns as the rest of the app. If this procedure is intentionally privileged (e.g. an admin export), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the procedure/table/column cross-reference reads clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.maskProcedures === void 0) {
-      return [];
-    }
-    const maskedColumnsByTable = /* @__PURE__ */ new Map();
-    for (const procedure of context.maskProcedures) {
-      for (const { column, table } of procedure.maskColumns) {
-        if (table === "" || column === "") {
-          continue;
-        }
-        const columns = maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set();
-        columns.add(column);
-        maskedColumnsByTable.set(table, columns);
-      }
-    }
-    if (maskedColumnsByTable.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.maskProcedures) {
-      if (procedure.usesMask) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of procedure.tablesRead) {
-        if (table !== "" && maskedColumnsByTable.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        const columns = [...maskedColumnsByTable.get(table) ?? /* @__PURE__ */ new Set()].toSorted((a, b) => a.localeCompare(b));
-        const columnList = columns.map((column) => `\`${column}\``).join(", ");
-        findings.push(
-          emit(maskUncoveredPiiColumn, {
-            cacheKey: `mask_uncovered_pii_column:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} reads table \`${table}\` without \`.use(mask(...))\` — its column${columns.length === 1 ? "" : "s"} ${columnList} ${columns.length === 1 ? "is" : "are"} masked elsewhere in the app but returned in the clear here.`,
-            metadata: { columns, exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Maskable column returned without mask() middleware"
-};
-
-export { maskUncoveredPiiColumn as default };

package/dist/packem_shared/mutatorFullRowReplace-BJnNDaIV.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const mutatorFullRowReplace = {
-  categories: ["SCHEMA"],
-  description: "A custom mutator's `server` impl writes with `ctx.db.replace(id, document)` — a whole-row overwrite. On a synced table this clobbers a concurrent edit to a different column; `ctx.db.patch(id, { field })` merges at the column level so independent field edits coexist.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "mutator_full_row_replace",
-  remediation: "Prefer `ctx.db.patch(id, { onlyTheChangedField })` so a concurrent edit to another column isn't lost. Keep `replace` only when the mutator genuinely owns the entire row (e.g. a full-form save).",
-  run: (context) => {
-    if (context.mutatorWrites === void 0) {
-      return [];
-    }
-    return context.mutatorWrites.map(
-      (write) => emit(mutatorFullRowReplace, {
-        cacheKey: `mutator_full_row_replace:${write.exportName}:${String(write.line)}`,
-        detail: `Mutator \`${write.exportName}\` (${write.file}:${String(write.line)}) writes with \`ctx.db.replace(...)\`, overwriting the whole row. A concurrent edit to a different column is clobbered — use \`ctx.db.patch(id, { field })\` to merge at the column level.`,
-        metadata: { exportName: write.exportName, file: write.file, line: write.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Mutator overwrites the whole row (clobbers concurrent column edits)"
-};
-
-export { mutatorFullRowReplace as default };

package/dist/packem_shared/nondeterministicQueryMutation-GXES1fLp.mjs

@@ -1,35 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const nondeterministicQueryMutation = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler calls a non-deterministic API (`Date.now`, `Math.random`, `crypto.randomUUID`, `crypto.getRandomValues`, or `fetch`). These handlers may be re-run on OCC retry / subscription re-evaluation, so they must be deterministic — time, randomness, and network belong in an `action`.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "nondeterministic_query_mutation",
-  remediation: "Move the non-deterministic call into an `action(...)` (which runs once and may use ambient APIs), then pass the computed value into the mutation as an argument — e.g. compute `Date.now()` in the action and call `ctx.runMutation(api.…, { now })`. Take generated ids/timestamps as args instead of producing them in the handler.",
-  run: (context) => {
-    if (context.nondeterministicCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    const occurrenceCount = /* @__PURE__ */ new Map();
-    for (const call of context.nondeterministicCalls) {
-      const baseKey = `${call.file}:${call.line.toString()}:${call.callee}`;
-      const occurrence = (occurrenceCount.get(baseKey) ?? 0) + 1;
-      occurrenceCount.set(baseKey, occurrence);
-      const occurrenceSuffix = occurrence > 1 ? `:${occurrence.toString()}` : "";
-      findings.push(
-        emit(nondeterministicQueryMutation, {
-          cacheKey: `nondeterministic_query_mutation:${baseKey}${occurrenceSuffix}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — query/mutation handlers must be deterministic. Compute it in an \`action\` and pass the value into the mutation as an argument.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Non-deterministic call in query/mutation handler"
-};
-
-export { nondeterministicQueryMutation as default };

package/dist/packem_shared/policyReferencesUnknownTable-DtaIEovd.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const policyReferencesUnknownTable = {
-  categories: ["SECURITY"],
-  description: "An RLS policy is bound to a `table` name that does not exist in the schema. The `rls()` middleware never matches it, so the table the policy was meant to protect is left ungated — reads return unrestricted rows and writes are allowed.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "policy_references_unknown_table",
-  remediation: "Fix the policy's `table` to a real table name (check for a typo or a table that was renamed/removed). If the table is gone, delete the dead policy.",
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const knownTables = new Set(context.schema.tables.map((table) => table.name));
-    const reported = /* @__PURE__ */ new Set();
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table === "" || knownTables.has(table) || reported.has(table)) {
-          continue;
-        }
-        reported.add(table);
-        findings.push(
-          emit(policyReferencesUnknownTable, {
-            cacheKey: `policy_references_unknown_table:${table}`,
-            detail: `An RLS policy in \`${procedure.exportName}\` (${procedure.file}) is bound to table \`${table}\`, which is not declared in the schema. The policy never matches, so \`${table}\` — if it exists under another name — is left ungated.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS policy bound to an unknown table"
-};
-
-export { policyReferencesUnknownTable as default };

package/dist/packem_shared/publicArgumentUsesAny-C71b2NCf.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const publicArgumentUsesAny = {
-  categories: ["SECURITY"],
-  description: "A public procedure declares a `v.any()` argument. `v.any()` accepts arbitrary untyped input from an untrusted client — defeating validation and opening injection / oversized-payload abuse.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_arg_uses_any",
-  remediation: "Replace `v.any()` with a precise validator — `v.object({...})`, `v.string()`, `v.union(...)`, etc. If the shape is genuinely dynamic, model the known variants with `v.union` rather than accepting anything.",
-  run: (context) => {
-    if (context.argValidators === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.argValidators) {
-      for (const argument of procedure.anyArgs) {
-        findings.push(
-          emit(publicArgumentUsesAny, {
-            cacheKey: `public_arg_uses_any:${procedure.file}:${procedure.exportName}:${argument}`,
-            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is \`v.any()\` — untrusted input with no validation. Give it a precise validator.`,
-            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public argument uses v.any()"
-};
-
-export { publicArgumentUsesAny as default };

package/dist/packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SENSITIVE_NAME_RE = /contact|forgot|login|magic|otp|register|reset|signin|signup|subscribe|verify/iu;
-const publicMutationWithoutRatelimit = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` has no `rateLimit` middleware. Publicly-callable writes are flood and brute-force targets — an attacker can exhaust writes, mail quota, or credits, or guess credentials on auth-shaped endpoints.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_mutation_without_ratelimit",
-  remediation: 'Attach a rate limit: `.use(rateLimit(limiter, "<bucket>"))` from `@lunora/ratelimit`, or wrap the recommended public-procedure guards with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Genuinely-open writes can be acknowledged by adding a permissive limiter.',
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-      if (!isPublicWrite || procedure.usesRateLimit) {
-        continue;
-      }
-      const sensitive = SENSITIVE_NAME_RE.test(procedure.exportName);
-      findings.push(
-        emit(publicMutationWithoutRatelimit, {
-          cacheKey: `public_mutation_without_ratelimit:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) has no rate limit${sensitive ? " — its name suggests an auth/abuse-sensitive endpoint, so this is high-risk" : ""}. Add \`.use(rateLimit(...))\` or \`.use(protectPublic({ rateLimit }))\`.`,
-          metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind, sensitive }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public write without a rate limit"
-};
-
-export { publicMutationWithoutRatelimit as default };

package/dist/packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const r2sqlOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses R2 SQL via `ctx.r2sql`. R2 SQL queries external Apache Iceberg tables over REST (no Workers binding): queries are non-deterministic (like `fetch`) and the reads are invisible to live queries. `ctx.r2sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "r2sql_outside_action",
-  remediation: "Move the `ctx.r2sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.r2sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas R2 SQL is not.",
-  run: (context) => {
-    if (context.r2sqlCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.r2sqlCalls) {
-      findings.push(
-        emit(r2sqlOutsideAction, {
-          cacheKey: `r2sql_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — R2 SQL's \`ctx.r2sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external query into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "R2 SQL `ctx.r2sql` used outside an action"
-};
-
-export { r2sqlOutsideAction as default };

package/dist/packem_shared/relationReferencesUnknownField-YznyXt_7.mjs

@@ -1,54 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
-
-const missingColumns = (byName, columnsOf, holder, relation) => {
-  const target = byName.get(relation.table);
-  if (!target) {
-    return [];
-  }
-  const fkTable = relation.kind === "one" ? holder : target;
-  const referencedTable = relation.kind === "one" ? target : holder;
-  const problems = [];
-  if (!columnsOf(fkTable).has(relation.field)) {
-    problems.push({ column: relation.field, owner: fkTable.name, side: "field" });
-  }
-  if (!columnsOf(referencedTable).has(relation.references)) {
-    problems.push({ column: relation.references, owner: referencedTable.name, side: "references" });
-  }
-  return problems;
-};
-const relationReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "A relation references a foreign-key or referenced column that is not declared on its table, so the join can never resolve.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_field",
-  remediation: "Fix the `field` / `references` column name in the relation, or add the missing column.",
-  run: (context) => {
-    const byName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    const columnsCache = /* @__PURE__ */ new Map();
-    const columnsOf = (table) => {
-      let columns = columnsCache.get(table);
-      if (!columns) {
-        columns = tableColumnSet(table);
-        columnsCache.set(table, columns);
-      }
-      return columns;
-    };
-    return context.schema.tables.flatMap(
-      (table) => table.relations.flatMap(
-        (relation) => missingColumns(byName, columnsOf, table, relation).map(
-          (problem) => emit(relationReferencesUnknownField, {
-            cacheKey: `relation_references_unknown_field:${table.name}:${relation.name}:${problem.side}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" uses ${problem.side} "${problem.column}", which is not declared on table "${problem.owner}".`,
-            metadata: { column: problem.column, owner: problem.owner, relation: relation.name, side: problem.side, table: table.name }
-          })
-        )
-      )
-    );
-  },
-  source: "static",
-  title: "Relation references unknown field"
-};
-
-export { relationReferencesUnknownField as default };

package/dist/packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const relationReferencesUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A relation targets a table that does not exist in the schema. The relation can never load — the target is a typo or a removed/renamed table.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_table",
-  remediation: "Fix the target table name in the relation, or add the missing table to the schema.",
-  run: (context) => {
-    const findings = [];
-    const tableNames = new Set(context.schema.tables.map((table) => table.name));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (tableNames.has(relation.table)) {
-          continue;
-        }
-        findings.push(
-          emit(relationReferencesUnknownTable, {
-            cacheKey: `relation_references_unknown_table:${table.name}:${relation.name}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" targets table "${relation.table}", which does not exist in the schema.`,
-            metadata: { relation: relation.name, table: table.name, target: relation.table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Relation references unknown table"
-};
-
-export { relationReferencesUnknownTable as default };

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -1,56 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const rlsUncoveredTable = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "rls_uncovered_table",
-  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const policyCoveredTables = /* @__PURE__ */ new Set();
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table !== "") {
-          policyCoveredTables.add(table);
-        }
-      }
-    }
-    if (policyCoveredTables.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      if (procedure.usesRls) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
-        if (table !== "" && policyCoveredTables.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        findings.push(
-          emit(rlsUncoveredTable, {
-            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS-gated table accessed without rls() middleware"
-};
-
-export { rlsUncoveredTable as default };

package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeTargetsGlobalTable = {
-  categories: ["PERFORMANCE"],
-  description: "A `defineShape` replicates from a `.global()` table. Global tables live outside the shard DO's SQLite op-log, so the shape is served through the cross-shard tier — coordinator/poll-refreshed and latency-tiered, not poke-live like a sharded shape.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "shape_targets_global_table",
-  remediation: "Expected if you want the cross-shard tier — just don't assume poke-live freshness; global shapes refresh on a poll. For live updates, replicate from a sharded table instead (denormalize the columns you need into the shard).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const globalTables = new Set(context.schema.tables.filter((table) => table.shardKind === "global").map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || !globalTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeTargetsGlobalTable, {
-          cacheKey: `shape_targets_global_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from the \`.global()\` table \`${shape.table}\`. It is served through the cross-shard global tier — poll-refreshed and latency-tiered, not poke-live.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape replicates from a global (cross-shard) table"
-};
-
-export { shapeTargetsGlobalTable as default };

package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const shapeUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A `defineShape` is bound to a `table` name that does not exist in the schema. The shape can never resolve a rowset — its subscription seeds empty and errors at the first flush.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "shape_unknown_table",
-  remediation: "Fix the shape's `table` to a real table name (check for a typo or a table that was renamed/removed).",
-  run: (context) => {
-    if (context.shapes === void 0) {
-      return [];
-    }
-    const knownTables = new Set(context.schema.tables.map((table) => table.name));
-    const findings = [];
-    for (const shape of context.shapes) {
-      if (shape.table === void 0 || knownTables.has(shape.table)) {
-        continue;
-      }
-      findings.push(
-        emit(shapeUnknownTable, {
-          cacheKey: `shape_unknown_table:${shape.exportName}`,
-          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from table \`${shape.table}\`, which is not declared in the schema. The shape can never resolve a rowset.`,
-          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Shape bound to an unknown table"
-};
-
-export { shapeUnknownTable as default };

package/dist/packem_shared/sqlInjectionRisk-zwytYGLt.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const sqlInjectionRisk = {
-  categories: ["SECURITY"],
-  description: "A `ctx.sql` tagged-template interpolates an unparameterized string-building expression (concatenation or nested template) instead of a bound value — splicing raw text into the query and reopening SQL injection.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "sql_injection_risk",
-  remediation: "Pass the value through a bound placeholder so the driver parameterizes it — keep request input inside a `ctx.sql` placeholder instead of concatenating it into the query string. Never build SQL text from request input by hand.",
-  run: (context) => {
-    if (context.sqlInterpolations === void 0) {
-      return [];
-    }
-    return context.sqlInterpolations.map(
-      (interpolation) => emit(sqlInjectionRisk, {
-        cacheKey: `sql_injection_risk:${interpolation.file}:${interpolation.line.toString()}`,
-        detail: `\`ctx.sql\` in \`${interpolation.exportName}\` (${interpolation.file}:${interpolation.line.toString()}) interpolates a string-building expression instead of a bound value — a SQL-injection vector. Pass the value through a bound placeholder so the driver parameterizes it.`,
-        metadata: { exportName: interpolation.exportName, file: interpolation.file, line: interpolation.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Possible SQL injection in ctx.sql interpolation"
-};
-
-export { sqlInjectionRisk as default };

package/dist/packem_shared/tableWithoutInsert-CbbaYIP4.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const tableWithoutInsert = {
-  categories: ["SCHEMA"],
-  description: 'No function inserts into this table via `ctx.db.insert("<table>", …)`. It may be read-only by design (seeded by a migration, replicated, or written through a path the advisor can\'t see) — or it may be dead schema.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "table_without_insert",
-  remediation: 'If the table should be writable, add a mutation that calls `ctx.db.insert("<table>", …)`. If it is read-only or seeded elsewhere, this advisory can be ignored.',
-  run: (context) => {
-    if (context.inserts === void 0) {
-      return [];
-    }
-    const insertedTables = new Set(context.inserts.filter((write) => write.table !== "").map((write) => write.table));
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (insertedTables.has(table.name) || table.externallyManaged === true) {
-        continue;
-      }
-      findings.push(
-        emit(tableWithoutInsert, {
-          cacheKey: `table_without_insert:${table.name}`,
-          detail: `No function calls \`ctx.db.insert("${table.name}", …)\` — table "${table.name}" has no discovered insert path.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Table has no insert path"
-};
-
-export { tableWithoutInsert as default };

package/dist/packem_shared/unboundedStringArgument-DThg2-wt.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const unboundedStringArgument = {
-  categories: ["SECURITY"],
-  description: "A public `v.string()` argument has no maximum-length bound. An unbounded string lets a client submit arbitrarily large input — abusing storage and CPU on every request that processes it.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unbounded_string_arg",
-  remediation: "Add a max-length bound via `.check(...)` / `.meta({ maxLength })` on the string validator (e.g. cap a name at 256, a body at a few KB). Size the cap to the field's real-world maximum.",
-  run: (context) => {
-    if (context.argValidators === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.argValidators) {
-      for (const argument of procedure.unboundedStringArgs) {
-        findings.push(
-          emit(unboundedStringArgument, {
-            cacheKey: `unbounded_string_arg:${procedure.file}:${procedure.exportName}:${argument}`,
-            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is an unbounded \`v.string()\`. Add a max-length bound to cap payload size.`,
-            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public string argument has no length bound"
-};
-
-export { unboundedStringArgument as default };

package/dist/packem_shared/unindexedForeignKey-BgJbKyqK.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { l as leadingIndexedColumns, P as PRIMARY_KEY, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedForeignKey = {
-  categories: ["PERFORMANCE"],
-  description: "A foreign-key column declared by a `one` relation has no index leading with it. Reads that filter or join on the column full-scan the table, which gets linearly slower as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_foreign_key",
-  remediation: 'Add a secondary index leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const indexed = leadingIndexedColumns(table);
-      for (const relation of table.relations) {
-        if (relation.kind !== "one") {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY || indexed.has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedForeignKey, {
-            cacheKey: `unindexed_foreign_key:${table.name}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" references "${relation.table}" via column "${fkColumn}", which is not the leading column of any index. Reads filtering or joining on "${fkColumn}" full-scan "${table.name}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: relation.table },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: table.name
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed foreign key"
-};
-
-export { unindexedForeignKey as default };