@lunora/advisor 0.0.0 → 1.0.0-alpha.10

package/dist/packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs

@@ -0,0 +1,30 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const r2sqlOutsideAction = {
+  categories: ["SCHEMA"],
+  description: "A `query`/`mutation` handler accesses R2 SQL via `ctx.r2sql`. R2 SQL queries external Apache Iceberg tables over REST (no Workers binding): queries are non-deterministic (like `fetch`) and the reads are invisible to live queries. `ctx.r2sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "r2sql_outside_action",
+  remediation: "Move the `ctx.r2sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.r2sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas R2 SQL is not.",
+  run: (context) => {
+    if (context.r2sqlCalls === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const call of context.r2sqlCalls) {
+      findings.push(
+        emit(r2sqlOutsideAction, {
+          cacheKey: `r2sql_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
+          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — R2 SQL's \`ctx.r2sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external query into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
+          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "R2 SQL `ctx.r2sql` used outside an action"
+};
+
+export { r2sqlOutsideAction as default };

package/dist/packem_shared/relationReferencesUnknownField-YznyXt_7.mjs

@@ -0,0 +1,54 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
+
+const missingColumns = (byName, columnsOf, holder, relation) => {
+  const target = byName.get(relation.table);
+  if (!target) {
+    return [];
+  }
+  const fkTable = relation.kind === "one" ? holder : target;
+  const referencedTable = relation.kind === "one" ? target : holder;
+  const problems = [];
+  if (!columnsOf(fkTable).has(relation.field)) {
+    problems.push({ column: relation.field, owner: fkTable.name, side: "field" });
+  }
+  if (!columnsOf(referencedTable).has(relation.references)) {
+    problems.push({ column: relation.references, owner: referencedTable.name, side: "references" });
+  }
+  return problems;
+};
+const relationReferencesUnknownField = {
+  categories: ["SCHEMA"],
+  description: "A relation references a foreign-key or referenced column that is not declared on its table, so the join can never resolve.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "relation_references_unknown_field",
+  remediation: "Fix the `field` / `references` column name in the relation, or add the missing column.",
+  run: (context) => {
+    const byName = new Map(context.schema.tables.map((table) => [table.name, table]));
+    const columnsCache = /* @__PURE__ */ new Map();
+    const columnsOf = (table) => {
+      let columns = columnsCache.get(table);
+      if (!columns) {
+        columns = tableColumnSet(table);
+        columnsCache.set(table, columns);
+      }
+      return columns;
+    };
+    return context.schema.tables.flatMap(
+      (table) => table.relations.flatMap(
+        (relation) => missingColumns(byName, columnsOf, table, relation).map(
+          (problem) => emit(relationReferencesUnknownField, {
+            cacheKey: `relation_references_unknown_field:${table.name}:${relation.name}:${problem.side}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" uses ${problem.side} "${problem.column}", which is not declared on table "${problem.owner}".`,
+            metadata: { column: problem.column, owner: problem.owner, relation: relation.name, side: problem.side, table: table.name }
+          })
+        )
+      )
+    );
+  },
+  source: "static",
+  title: "Relation references unknown field"
+};
+
+export { relationReferencesUnknownField as default };

package/dist/packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs

@@ -0,0 +1,33 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const relationReferencesUnknownTable = {
+  categories: ["SCHEMA"],
+  description: "A relation targets a table that does not exist in the schema. The relation can never load — the target is a typo or a removed/renamed table.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "relation_references_unknown_table",
+  remediation: "Fix the target table name in the relation, or add the missing table to the schema.",
+  run: (context) => {
+    const findings = [];
+    const tableNames = new Set(context.schema.tables.map((table) => table.name));
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (tableNames.has(relation.table)) {
+          continue;
+        }
+        findings.push(
+          emit(relationReferencesUnknownTable, {
+            cacheKey: `relation_references_unknown_table:${table.name}:${relation.name}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" targets table "${relation.table}", which does not exist in the schema.`,
+            metadata: { relation: relation.name, table: table.name, target: relation.table }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Relation references unknown table"
+};
+
+export { relationReferencesUnknownTable as default };

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -0,0 +1,56 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const rlsUncoveredTable = {
+  categories: ["SECURITY"],
+  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "rls_uncovered_table",
+  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
+  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
+  run: (context) => {
+    if (context.rlsProcedures === void 0) {
+      return [];
+    }
+    const policyCoveredTables = /* @__PURE__ */ new Set();
+    for (const procedure of context.rlsProcedures) {
+      for (const table of procedure.rlsTables) {
+        if (table !== "") {
+          policyCoveredTables.add(table);
+        }
+      }
+    }
+    if (policyCoveredTables.size === 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.rlsProcedures) {
+      if (procedure.usesRls) {
+        continue;
+      }
+      if (procedure.visibility === "internal") {
+        continue;
+      }
+      const touched = /* @__PURE__ */ new Set();
+      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
+        if (table !== "" && policyCoveredTables.has(table)) {
+          touched.add(table);
+        }
+      }
+      for (const table of touched) {
+        findings.push(
+          emit(rlsUncoveredTable, {
+            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
+            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
+            metadata: { exportName: procedure.exportName, file: procedure.file, table }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "RLS-gated table accessed without rls() middleware"
+};
+
+export { rlsUncoveredTable as default };

package/dist/packem_shared/shapeTargetsGlobalTable-DHrf4Koi.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const shapeTargetsGlobalTable = {
+  categories: ["PERFORMANCE"],
+  description: "A `defineShape` replicates from a `.global()` table. Global tables live outside the shard DO's SQLite op-log, so the shape is served through the cross-shard tier — coordinator/poll-refreshed and latency-tiered, not poke-live like a sharded shape.",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "shape_targets_global_table",
+  remediation: "Expected if you want the cross-shard tier — just don't assume poke-live freshness; global shapes refresh on a poll. For live updates, replicate from a sharded table instead (denormalize the columns you need into the shard).",
+  run: (context) => {
+    if (context.shapes === void 0) {
+      return [];
+    }
+    const globalTables = new Set(context.schema.tables.filter((table) => table.shardKind === "global").map((table) => table.name));
+    const findings = [];
+    for (const shape of context.shapes) {
+      if (shape.table === void 0 || !globalTables.has(shape.table)) {
+        continue;
+      }
+      findings.push(
+        emit(shapeTargetsGlobalTable, {
+          cacheKey: `shape_targets_global_table:${shape.exportName}`,
+          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from the \`.global()\` table \`${shape.table}\`. It is served through the cross-shard global tier — poll-refreshed and latency-tiered, not poke-live.`,
+          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Shape replicates from a global (cross-shard) table"
+};
+
+export { shapeTargetsGlobalTable as default };

package/dist/packem_shared/shapeUnknownTable-C8aDWFoe.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const shapeUnknownTable = {
+  categories: ["SCHEMA"],
+  description: "A `defineShape` is bound to a `table` name that does not exist in the schema. The shape can never resolve a rowset — its subscription seeds empty and errors at the first flush.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "shape_unknown_table",
+  remediation: "Fix the shape's `table` to a real table name (check for a typo or a table that was renamed/removed).",
+  run: (context) => {
+    if (context.shapes === void 0) {
+      return [];
+    }
+    const knownTables = new Set(context.schema.tables.map((table) => table.name));
+    const findings = [];
+    for (const shape of context.shapes) {
+      if (shape.table === void 0 || knownTables.has(shape.table)) {
+        continue;
+      }
+      findings.push(
+        emit(shapeUnknownTable, {
+          cacheKey: `shape_unknown_table:${shape.exportName}`,
+          detail: `Shape \`${shape.exportName}\` (${shape.file}) replicates from table \`${shape.table}\`, which is not declared in the schema. The shape can never resolve a rowset.`,
+          metadata: { exportName: shape.exportName, file: shape.file, table: shape.table }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Shape bound to an unknown table"
+};
+
+export { shapeUnknownTable as default };

package/dist/packem_shared/sqlInjectionRisk-zwytYGLt.mjs

@@ -0,0 +1,26 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const sqlInjectionRisk = {
+  categories: ["SECURITY"],
+  description: "A `ctx.sql` tagged-template interpolates an unparameterized string-building expression (concatenation or nested template) instead of a bound value — splicing raw text into the query and reopening SQL injection.",
+  facing: "EXTERNAL",
+  level: "ERROR",
+  name: "sql_injection_risk",
+  remediation: "Pass the value through a bound placeholder so the driver parameterizes it — keep request input inside a `ctx.sql` placeholder instead of concatenating it into the query string. Never build SQL text from request input by hand.",
+  run: (context) => {
+    if (context.sqlInterpolations === void 0) {
+      return [];
+    }
+    return context.sqlInterpolations.map(
+      (interpolation) => emit(sqlInjectionRisk, {
+        cacheKey: `sql_injection_risk:${interpolation.file}:${interpolation.line.toString()}`,
+        detail: `\`ctx.sql\` in \`${interpolation.exportName}\` (${interpolation.file}:${interpolation.line.toString()}) interpolates a string-building expression instead of a bound value — a SQL-injection vector. Pass the value through a bound placeholder so the driver parameterizes it.`,
+        metadata: { exportName: interpolation.exportName, file: interpolation.file, line: interpolation.line }
+      })
+    );
+  },
+  source: "static",
+  title: "Possible SQL injection in ctx.sql interpolation"
+};
+
+export { sqlInjectionRisk as default };

package/dist/packem_shared/tableWithoutInsert-CbbaYIP4.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const tableWithoutInsert = {
+  categories: ["SCHEMA"],
+  description: 'No function inserts into this table via `ctx.db.insert("<table>", …)`. It may be read-only by design (seeded by a migration, replicated, or written through a path the advisor can\'t see) — or it may be dead schema.',
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "table_without_insert",
+  remediation: 'If the table should be writable, add a mutation that calls `ctx.db.insert("<table>", …)`. If it is read-only or seeded elsewhere, this advisory can be ignored.',
+  run: (context) => {
+    if (context.inserts === void 0) {
+      return [];
+    }
+    const insertedTables = new Set(context.inserts.filter((write) => write.table !== "").map((write) => write.table));
+    const findings = [];
+    for (const table of context.schema.tables) {
+      if (insertedTables.has(table.name) || table.externallyManaged === true) {
+        continue;
+      }
+      findings.push(
+        emit(tableWithoutInsert, {
+          cacheKey: `table_without_insert:${table.name}`,
+          detail: `No function calls \`ctx.db.insert("${table.name}", …)\` — table "${table.name}" has no discovered insert path.`,
+          metadata: { table: table.name }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Table has no insert path"
+};
+
+export { tableWithoutInsert as default };

package/dist/packem_shared/unboundedStringArgument-DThg2-wt.mjs

@@ -0,0 +1,32 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const unboundedStringArgument = {
+  categories: ["SECURITY"],
+  description: "A public `v.string()` argument has no maximum-length bound. An unbounded string lets a client submit arbitrarily large input — abusing storage and CPU on every request that processes it.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unbounded_string_arg",
+  remediation: "Add a max-length bound via `.check(...)` / `.meta({ maxLength })` on the string validator (e.g. cap a name at 256, a body at a few KB). Size the cap to the field's real-world maximum.",
+  run: (context) => {
+    if (context.argValidators === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.argValidators) {
+      for (const argument of procedure.unboundedStringArgs) {
+        findings.push(
+          emit(unboundedStringArgument, {
+            cacheKey: `unbounded_string_arg:${procedure.file}:${procedure.exportName}:${argument}`,
+            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is an unbounded \`v.string()\`. Add a max-length bound to cap payload size.`,
+            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Public string argument has no length bound"
+};
+
+export { unboundedStringArgument as default };

package/dist/packem_shared/unindexedForeignKey-BgJbKyqK.mjs

@@ -0,0 +1,45 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { l as leadingIndexedColumns, P as PRIMARY_KEY, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
+
+const unindexedForeignKey = {
+  categories: ["PERFORMANCE"],
+  description: "A foreign-key column declared by a `one` relation has no index leading with it. Reads that filter or join on the column full-scan the table, which gets linearly slower as rows accumulate.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unindexed_foreign_key",
+  remediation: 'Add a secondary index leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
+  run: (context) => {
+    const findings = [];
+    for (const table of context.schema.tables) {
+      const indexed = leadingIndexedColumns(table);
+      for (const relation of table.relations) {
+        if (relation.kind !== "one") {
+          continue;
+        }
+        const fkColumn = relation.field;
+        if (fkColumn === PRIMARY_KEY || indexed.has(fkColumn)) {
+          continue;
+        }
+        const suggestedIndex = suggestIndexName(fkColumn);
+        findings.push(
+          emit(unindexedForeignKey, {
+            cacheKey: `unindexed_foreign_key:${table.name}:${fkColumn}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" references "${relation.table}" via column "${fkColumn}", which is not the leading column of any index. Reads filtering or joining on "${fkColumn}" full-scan "${table.name}".`,
+            metadata: {
+              fkColumn,
+              references: { column: relation.references, table: relation.table },
+              relation: relation.name,
+              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
+              table: table.name
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Unindexed foreign key"
+};
+
+export { unindexedForeignKey as default };

package/dist/packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs

@@ -0,0 +1,53 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+import { P as PRIMARY_KEY, l as leadingIndexedColumns, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
+
+const unindexedRelationTarget = {
+  categories: ["PERFORMANCE"],
+  description: "A `many` relation's foreign-key column on the target table has no index leading with it. Relation predicates (`some`/`none`/`every`) and `with:` child reads filter the target on that column, full-scanning it as rows accumulate.",
+  facing: "EXTERNAL",
+  level: "INFO",
+  name: "unindexed_relation_target",
+  remediation: 'Add a secondary index on the target table leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
+  run: (context) => {
+    const findings = [];
+    const tablesByName = new Map(context.schema.tables.map((table) => [table.name, table]));
+    for (const table of context.schema.tables) {
+      for (const relation of table.relations) {
+        if (relation.kind !== "many") {
+          continue;
+        }
+        const target = tablesByName.get(relation.table);
+        if (target === void 0) {
+          continue;
+        }
+        const fkColumn = relation.field;
+        if (fkColumn === PRIMARY_KEY) {
+          continue;
+        }
+        const coveredByForeignKeyLint = target.relations.some((targetRelation) => targetRelation.kind === "one" && targetRelation.field === fkColumn);
+        if (coveredByForeignKeyLint || leadingIndexedColumns(target).has(fkColumn)) {
+          continue;
+        }
+        const suggestedIndex = suggestIndexName(fkColumn);
+        findings.push(
+          emit(unindexedRelationTarget, {
+            cacheKey: `unindexed_relation_target:${relation.table}:${fkColumn}`,
+            detail: `Relation "${relation.name}" on table "${table.name}" is a to-many over "${relation.table}" via its column "${fkColumn}", which is not the leading column of any index on "${relation.table}". Relation predicates (\`some\`/\`none\`/\`every\`) and \`with:\` reads of "${relation.name}" full-scan "${relation.table}".`,
+            metadata: {
+              fkColumn,
+              references: { column: relation.references, table: table.name },
+              relation: relation.name,
+              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
+              table: relation.table
+            }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Unindexed relation target"
+};
+
+export { unindexedRelationTarget as default };

package/dist/packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs

@@ -0,0 +1,42 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const userCreatingMutationWithoutCaptcha = {
+  categories: ["SECURITY"],
+  description: "A public `mutation`/`action` that creates a user/session or sends mail has no CAPTCHA / bot check. Account-creating and mail-sending endpoints are prime automated-abuse targets (credential stuffing, mailbox flooding, disposable-account farming).",
+  facing: "EXTERNAL",
+  level: "WARN",
+  name: "user_creating_mutation_without_captcha",
+  remediation: "Add a server-verified human check: `.use(verifyTurnstile({ secret, token }))` from `@lunora/auth`, or wrap it with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Pair with a rate limit for defense in depth.",
+  run: (context) => {
+    if (context.procedureProtections === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const procedure of context.procedureProtections) {
+      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
+      const sensitive = procedure.writesUserTable || procedure.callsMail;
+      if (!isPublicWrite || !sensitive || procedure.usesCaptcha) {
+        continue;
+      }
+      const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";
+      findings.push(
+        emit(userCreatingMutationWithoutCaptcha, {
+          cacheKey: `user_creating_mutation_without_captcha:${procedure.file}:${procedure.exportName}`,
+          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) ${reason} but has no CAPTCHA check. Add \`.use(verifyTurnstile(...))\` or \`.use(protectPublic({ captcha }))\`.`,
+          metadata: {
+            callsMail: procedure.callsMail,
+            exportName: procedure.exportName,
+            file: procedure.file,
+            kind: procedure.kind,
+            writesUserTable: procedure.writesUserTable
+          }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Account-creating / mail-sending write without a CAPTCHA"
+};
+
+export { userCreatingMutationWithoutCaptcha as default };

package/dist/packem_shared/workflowDuplicateStepName-ioBxPBCy.mjs

@@ -0,0 +1,48 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowDuplicateStepName = {
+  categories: ["SCHEMA"],
+  description: "Two durable steps in this workflow share a name. Cloudflare memoizes a step by its name, so on replay the second call returns the first step's cached result instead of running its body — silently skipping the work without an error.",
+  facing: "INTERNAL",
+  level: "ERROR",
+  // eslint-disable-next-line no-secrets/no-secrets -- the lint's rule id, not a credential
+  name: "workflow_duplicate_step_name",
+  remediation: "Give every `step.do` / `step.sleep` / `step.sleepUntil` / `step.waitForEvent` call in the workflow a unique name. If a step legitimately repeats (e.g. a loop), make the name distinct per iteration by interpolating the item id into the step name.",
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const findings = [];
+    for (const workflow of context.workflows) {
+      const { steps } = workflow;
+      if (steps === void 0 || steps.length === 0) {
+        continue;
+      }
+      const firstLineByName = /* @__PURE__ */ new Map();
+      const reported = /* @__PURE__ */ new Set();
+      for (const step of steps) {
+        const firstLine = firstLineByName.get(step.name);
+        if (firstLine === void 0) {
+          firstLineByName.set(step.name, step.line);
+          continue;
+        }
+        if (reported.has(step.name)) {
+          continue;
+        }
+        reported.add(step.name);
+        findings.push(
+          emit(workflowDuplicateStepName, {
+            cacheKey: `workflow_duplicate_step_name:${workflow.exportName}:${step.name}`,
+            detail: `Workflow "${workflow.exportName}" reuses the durable step name "${step.name}" (first at line ${String(firstLine)}, again at line ${String(step.line)}). The second call returns the first's cached result instead of running.`,
+            metadata: { firstLine, line: step.line, stepName: step.name, workflow: workflow.exportName }
+          })
+        );
+      }
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Duplicate durable step name in workflow"
+};
+
+export { workflowDuplicateStepName as default };

package/dist/packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs

@@ -0,0 +1,34 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowUnknownTarget = {
+  categories: ["SCHEMA"],
+  description: 'A `ctx.workflows.get("<name>")` call references a workflow that is not declared by any `defineWorkflow` export in `lunora/workflows.ts`. The name is a typo or points at a removed/renamed workflow — the call throws at runtime.',
+  facing: "INTERNAL",
+  level: "ERROR",
+  name: "workflow_unknown_target",
+  remediation: 'Fix the workflow name in the `ctx.workflows.get("…")` call, or add the missing `defineWorkflow` export to `lunora/workflows.ts`.',
+  run: (context) => {
+    if (context.workflows === void 0 || context.workflowCalls === void 0) {
+      return [];
+    }
+    const declared = new Set(context.workflows.map((workflow) => workflow.exportName));
+    const findings = [];
+    for (const call of context.workflowCalls) {
+      if (call.workflow === "" || declared.has(call.workflow)) {
+        continue;
+      }
+      findings.push(
+        emit(workflowUnknownTarget, {
+          cacheKey: `workflow_unknown_target:${call.file}:${call.exportName}:${call.workflow}`,
+          detail: `\`ctx.workflows.get("${call.workflow}")\` in "${call.exportName}" (${call.file}) references workflow "${call.workflow}", which is not declared in lunora/workflows.ts.`,
+          metadata: { exportName: call.exportName, file: call.file, line: call.line, workflow: call.workflow }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Workflow call references unknown workflow"
+};
+
+export { workflowUnknownTarget as default };

package/dist/packem_shared/workflowUnused-D0jHxdz9.mjs

@@ -0,0 +1,38 @@
+import { e as emit } from './finding-Dm_zvzS1.mjs';
+
+const workflowUnused = {
+  categories: ["SCHEMA"],
+  description: 'No function starts this workflow via `ctx.workflows.get("<name>")`. It may be triggered through a path the advisor can\'t see (the Cloudflare API, a wrangler invocation, a cross-service binding) — or it may be dead code that still deploys as a billable WorkflowEntrypoint.',
+  facing: "INTERNAL",
+  level: "INFO",
+  name: "workflow_unused",
+  remediation: 'If the workflow should be triggered in-app, start it from a mutation/action with `ctx.workflows.get("<name>").create({ params })`. If it is started externally or is no longer needed, this advisory can be ignored (or remove the `defineWorkflow` export).',
+  run: (context) => {
+    if (context.workflows === void 0) {
+      return [];
+    }
+    const calls = context.workflowCalls ?? [];
+    if (calls.some((call) => call.workflow === "")) {
+      return [];
+    }
+    const started = new Set(calls.map((call) => call.workflow));
+    const findings = [];
+    for (const workflow of context.workflows) {
+      if (started.has(workflow.exportName)) {
+        continue;
+      }
+      findings.push(
+        emit(workflowUnused, {
+          cacheKey: `workflow_unused:${workflow.exportName}`,
+          detail: `No function calls \`ctx.workflows.get("${workflow.exportName}")\` — workflow "${workflow.exportName}" is declared but never started in app code.`,
+          metadata: { workflow: workflow.exportName }
+        })
+      );
+    }
+    return findings;
+  },
+  source: "static",
+  title: "Workflow is never started"
+};
+
+export { workflowUnused as default };