@lunora/advisor 1.0.0-alpha.4 → 1.0.0-alpha.40

package/dist/packem_shared/publicMutationWithoutRatelimit-xBpJ6GWK.mjs

@@ -1,36 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const SENSITIVE_NAME_RE = /contact|forgot|login|magic|otp|register|reset|signin|signup|subscribe|verify/iu;
-const publicMutationWithoutRatelimit = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` has no `rateLimit` middleware. Publicly-callable writes are flood and brute-force targets — an attacker can exhaust writes, mail quota, or credits, or guess credentials on auth-shaped endpoints.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "public_mutation_without_ratelimit",
-  remediation: 'Attach a rate limit: `.use(rateLimit(limiter, "<bucket>"))` from `@lunora/ratelimit`, or wrap the recommended public-procedure guards with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Genuinely-open writes can be acknowledged by adding a permissive limiter.',
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-      if (!isPublicWrite || procedure.usesRateLimit) {
-        continue;
-      }
-      const sensitive = SENSITIVE_NAME_RE.test(procedure.exportName);
-      findings.push(
-        emit(publicMutationWithoutRatelimit, {
-          cacheKey: `public_mutation_without_ratelimit:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) has no rate limit${sensitive ? " — its name suggests an auth/abuse-sensitive endpoint, so this is high-risk" : ""}. Add \`.use(rateLimit(...))\` or \`.use(protectPublic({ rateLimit }))\`.`,
-          metadata: { exportName: procedure.exportName, file: procedure.file, kind: procedure.kind, sensitive }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public write without a rate limit"
-};
-
-export { publicMutationWithoutRatelimit as default };

package/dist/packem_shared/r2sqlOutsideAction-CtqxvMuV.mjs

@@ -1,30 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const r2sqlOutsideAction = {
-  categories: ["SCHEMA"],
-  description: "A `query`/`mutation` handler accesses R2 SQL via `ctx.r2sql`. R2 SQL queries external Apache Iceberg tables over REST (no Workers binding): queries are non-deterministic (like `fetch`) and the reads are invisible to live queries. `ctx.r2sql` is available on `ActionCtx` only and must be confined to `action` handlers.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "r2sql_outside_action",
-  remediation: "Move the `ctx.r2sql` access into an `action(...)` (the only context where it is typed), where external I/O is allowed. If a query/mutation needs the data, have the action read it via `ctx.r2sql` and write a projection into a `defineSchema` DO/D1 table — that write is tracked by live queries, whereas R2 SQL is not.",
-  run: (context) => {
-    if (context.r2sqlCalls === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const call of context.r2sqlCalls) {
-      findings.push(
-        emit(r2sqlOutsideAction, {
-          cacheKey: `r2sql_outside_action:${call.file}:${call.line.toString()}:${call.callee}`,
-          detail: `\`${call.callee}(…)\` in ${call.exportName} (${call.file}:${call.line.toString()}) runs inside a ${call.kind} handler — R2 SQL's \`ctx.r2sql\` is non-deterministic and non-reactive, so it is available only in actions. Move the external query into an \`action\` and project the result into a Lunora table if a query/mutation needs it.`,
-          metadata: { callee: call.callee, exportName: call.exportName, file: call.file, kind: call.kind, line: call.line }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "R2 SQL `ctx.r2sql` used outside an action"
-};
-
-export { r2sqlOutsideAction as default };

package/dist/packem_shared/relationReferencesUnknownField-YznyXt_7.mjs

@@ -1,54 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { t as tableColumnSet } from './helpers-DNCkMWZQ.mjs';
-
-const missingColumns = (byName, columnsOf, holder, relation) => {
-  const target = byName.get(relation.table);
-  if (!target) {
-    return [];
-  }
-  const fkTable = relation.kind === "one" ? holder : target;
-  const referencedTable = relation.kind === "one" ? target : holder;
-  const problems = [];
-  if (!columnsOf(fkTable).has(relation.field)) {
-    problems.push({ column: relation.field, owner: fkTable.name, side: "field" });
-  }
-  if (!columnsOf(referencedTable).has(relation.references)) {
-    problems.push({ column: relation.references, owner: referencedTable.name, side: "references" });
-  }
-  return problems;
-};
-const relationReferencesUnknownField = {
-  categories: ["SCHEMA"],
-  description: "A relation references a foreign-key or referenced column that is not declared on its table, so the join can never resolve.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_field",
-  remediation: "Fix the `field` / `references` column name in the relation, or add the missing column.",
-  run: (context) => {
-    const byName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    const columnsCache = /* @__PURE__ */ new Map();
-    const columnsOf = (table) => {
-      let columns = columnsCache.get(table);
-      if (!columns) {
-        columns = tableColumnSet(table);
-        columnsCache.set(table, columns);
-      }
-      return columns;
-    };
-    return context.schema.tables.flatMap(
-      (table) => table.relations.flatMap(
-        (relation) => missingColumns(byName, columnsOf, table, relation).map(
-          (problem) => emit(relationReferencesUnknownField, {
-            cacheKey: `relation_references_unknown_field:${table.name}:${relation.name}:${problem.side}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" uses ${problem.side} "${problem.column}", which is not declared on table "${problem.owner}".`,
-            metadata: { column: problem.column, owner: problem.owner, relation: relation.name, side: problem.side, table: table.name }
-          })
-        )
-      )
-    );
-  },
-  source: "static",
-  title: "Relation references unknown field"
-};
-
-export { relationReferencesUnknownField as default };

package/dist/packem_shared/relationReferencesUnknownTable-DrorpKYe.mjs

@@ -1,33 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const relationReferencesUnknownTable = {
-  categories: ["SCHEMA"],
-  description: "A relation targets a table that does not exist in the schema. The relation can never load — the target is a typo or a removed/renamed table.",
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "relation_references_unknown_table",
-  remediation: "Fix the target table name in the relation, or add the missing table to the schema.",
-  run: (context) => {
-    const findings = [];
-    const tableNames = new Set(context.schema.tables.map((table) => table.name));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (tableNames.has(relation.table)) {
-          continue;
-        }
-        findings.push(
-          emit(relationReferencesUnknownTable, {
-            cacheKey: `relation_references_unknown_table:${table.name}:${relation.name}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" targets table "${relation.table}", which does not exist in the schema.`,
-            metadata: { relation: relation.name, table: table.name, target: relation.table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Relation references unknown table"
-};
-
-export { relationReferencesUnknownTable as default };

package/dist/packem_shared/rlsUncoveredTable-CxEfZ5eZ.mjs

@@ -1,56 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const rlsUncoveredTable = {
-  categories: ["SECURITY"],
-  description: "A public procedure reads or writes a table that is covered by an RLS policy elsewhere in the app, but this procedure's builder chain does not include `.use(rls(...))`. The raw, unwrapped `ctx.db` silently bypasses every policy in the list.",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "rls_uncovered_table",
-  remediation: "Add `.use(rls(policies))` to the procedure's builder chain — e.g. `c.use(rls(myPolicies)).query(...)` — so its `ctx.db` is wrapped by the same policy evaluator as the rest of the app. If this procedure is intentionally privileged (e.g. a background job), declare it with `internalQuery` / `internalMutation` / `internalAction` instead of the public builder so the intent is explicit.",
-  // eslint-disable-next-line sonarjs/cognitive-complexity -- the policy/table cross-reference is clearest as one linear pass; splitting it would obscure the flow.
-  run: (context) => {
-    if (context.rlsProcedures === void 0) {
-      return [];
-    }
-    const policyCoveredTables = /* @__PURE__ */ new Set();
-    for (const procedure of context.rlsProcedures) {
-      for (const table of procedure.rlsTables) {
-        if (table !== "") {
-          policyCoveredTables.add(table);
-        }
-      }
-    }
-    if (policyCoveredTables.size === 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.rlsProcedures) {
-      if (procedure.usesRls) {
-        continue;
-      }
-      if (procedure.visibility === "internal") {
-        continue;
-      }
-      const touched = /* @__PURE__ */ new Set();
-      for (const table of [...procedure.tablesRead, ...procedure.tablesWritten]) {
-        if (table !== "" && policyCoveredTables.has(table)) {
-          touched.add(table);
-        }
-      }
-      for (const table of touched) {
-        findings.push(
-          emit(rlsUncoveredTable, {
-            cacheKey: `rls_uncovered_table:${procedure.file}:${procedure.exportName}:${table}`,
-            detail: `\`${procedure.exportName}\` in ${procedure.file} accesses table \`${table}\` without \`.use(rls(...))\` — the table is policy-gated elsewhere in the app but this procedure bypasses those policies entirely.`,
-            metadata: { exportName: procedure.exportName, file: procedure.file, table }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "RLS-gated table accessed without rls() middleware"
-};
-
-export { rlsUncoveredTable as default };

package/dist/packem_shared/sqlInjectionRisk-zwytYGLt.mjs

@@ -1,26 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const sqlInjectionRisk = {
-  categories: ["SECURITY"],
-  description: "A `ctx.sql` tagged-template interpolates an unparameterized string-building expression (concatenation or nested template) instead of a bound value — splicing raw text into the query and reopening SQL injection.",
-  facing: "EXTERNAL",
-  level: "ERROR",
-  name: "sql_injection_risk",
-  remediation: "Pass the value through a bound placeholder so the driver parameterizes it — keep request input inside a `ctx.sql` placeholder instead of concatenating it into the query string. Never build SQL text from request input by hand.",
-  run: (context) => {
-    if (context.sqlInterpolations === void 0) {
-      return [];
-    }
-    return context.sqlInterpolations.map(
-      (interpolation) => emit(sqlInjectionRisk, {
-        cacheKey: `sql_injection_risk:${interpolation.file}:${interpolation.line.toString()}`,
-        detail: `\`ctx.sql\` in \`${interpolation.exportName}\` (${interpolation.file}:${interpolation.line.toString()}) interpolates a string-building expression instead of a bound value — a SQL-injection vector. Pass the value through a bound placeholder so the driver parameterizes it.`,
-        metadata: { exportName: interpolation.exportName, file: interpolation.file, line: interpolation.line }
-      })
-    );
-  },
-  source: "static",
-  title: "Possible SQL injection in ctx.sql interpolation"
-};
-
-export { sqlInjectionRisk as default };

package/dist/packem_shared/tableWithoutInsert-CbbaYIP4.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const tableWithoutInsert = {
-  categories: ["SCHEMA"],
-  description: 'No function inserts into this table via `ctx.db.insert("<table>", …)`. It may be read-only by design (seeded by a migration, replicated, or written through a path the advisor can\'t see) — or it may be dead schema.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "table_without_insert",
-  remediation: 'If the table should be writable, add a mutation that calls `ctx.db.insert("<table>", …)`. If it is read-only or seeded elsewhere, this advisory can be ignored.',
-  run: (context) => {
-    if (context.inserts === void 0) {
-      return [];
-    }
-    const insertedTables = new Set(context.inserts.filter((write) => write.table !== "").map((write) => write.table));
-    const findings = [];
-    for (const table of context.schema.tables) {
-      if (insertedTables.has(table.name) || table.externallyManaged === true) {
-        continue;
-      }
-      findings.push(
-        emit(tableWithoutInsert, {
-          cacheKey: `table_without_insert:${table.name}`,
-          detail: `No function calls \`ctx.db.insert("${table.name}", …)\` — table "${table.name}" has no discovered insert path.`,
-          metadata: { table: table.name }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Table has no insert path"
-};
-
-export { tableWithoutInsert as default };

package/dist/packem_shared/unboundedStringArgument-DThg2-wt.mjs

@@ -1,32 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const unboundedStringArgument = {
-  categories: ["SECURITY"],
-  description: "A public `v.string()` argument has no maximum-length bound. An unbounded string lets a client submit arbitrarily large input — abusing storage and CPU on every request that processes it.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unbounded_string_arg",
-  remediation: "Add a max-length bound via `.check(...)` / `.meta({ maxLength })` on the string validator (e.g. cap a name at 256, a body at a few KB). Size the cap to the field's real-world maximum.",
-  run: (context) => {
-    if (context.argValidators === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.argValidators) {
-      for (const argument of procedure.unboundedStringArgs) {
-        findings.push(
-          emit(unboundedStringArgument, {
-            cacheKey: `unbounded_string_arg:${procedure.file}:${procedure.exportName}:${argument}`,
-            detail: `Arg \`${argument}\` of public procedure \`${procedure.exportName}\` (${procedure.file}:${procedure.line.toString()}) is an unbounded \`v.string()\`. Add a max-length bound to cap payload size.`,
-            metadata: { argument, exportName: procedure.exportName, file: procedure.file, line: procedure.line }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Public string argument has no length bound"
-};
-
-export { unboundedStringArgument as default };

package/dist/packem_shared/unindexedForeignKey-BgJbKyqK.mjs

@@ -1,45 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { l as leadingIndexedColumns, P as PRIMARY_KEY, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedForeignKey = {
-  categories: ["PERFORMANCE"],
-  description: "A foreign-key column declared by a `one` relation has no index leading with it. Reads that filter or join on the column full-scan the table, which gets linearly slower as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_foreign_key",
-  remediation: 'Add a secondary index leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    for (const table of context.schema.tables) {
-      const indexed = leadingIndexedColumns(table);
-      for (const relation of table.relations) {
-        if (relation.kind !== "one") {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY || indexed.has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedForeignKey, {
-            cacheKey: `unindexed_foreign_key:${table.name}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" references "${relation.table}" via column "${fkColumn}", which is not the leading column of any index. Reads filtering or joining on "${fkColumn}" full-scan "${table.name}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: relation.table },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: table.name
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed foreign key"
-};
-
-export { unindexedForeignKey as default };

package/dist/packem_shared/unindexedRelationTarget-D6eyj6Xx.mjs

@@ -1,53 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-import { P as PRIMARY_KEY, l as leadingIndexedColumns, s as suggestIndexName } from './fk-index-IUK1ukgs.mjs';
-
-const unindexedRelationTarget = {
-  categories: ["PERFORMANCE"],
-  description: "A `many` relation's foreign-key column on the target table has no index leading with it. Relation predicates (`some`/`none`/`every`) and `with:` child reads filter the target on that column, full-scanning it as rows accumulate.",
-  facing: "EXTERNAL",
-  level: "INFO",
-  name: "unindexed_relation_target",
-  remediation: 'Add a secondary index on the target table leading with the FK column, e.g. `.index("byAuthorId", ["authorId"])`.',
-  run: (context) => {
-    const findings = [];
-    const tablesByName = new Map(context.schema.tables.map((table) => [table.name, table]));
-    for (const table of context.schema.tables) {
-      for (const relation of table.relations) {
-        if (relation.kind !== "many") {
-          continue;
-        }
-        const target = tablesByName.get(relation.table);
-        if (target === void 0) {
-          continue;
-        }
-        const fkColumn = relation.field;
-        if (fkColumn === PRIMARY_KEY) {
-          continue;
-        }
-        const coveredByForeignKeyLint = target.relations.some((targetRelation) => targetRelation.kind === "one" && targetRelation.field === fkColumn);
-        if (coveredByForeignKeyLint || leadingIndexedColumns(target).has(fkColumn)) {
-          continue;
-        }
-        const suggestedIndex = suggestIndexName(fkColumn);
-        findings.push(
-          emit(unindexedRelationTarget, {
-            cacheKey: `unindexed_relation_target:${relation.table}:${fkColumn}`,
-            detail: `Relation "${relation.name}" on table "${table.name}" is a to-many over "${relation.table}" via its column "${fkColumn}", which is not the leading column of any index on "${relation.table}". Relation predicates (\`some\`/\`none\`/\`every\`) and \`with:\` reads of "${relation.name}" full-scan "${relation.table}".`,
-            metadata: {
-              fkColumn,
-              references: { column: relation.references, table: table.name },
-              relation: relation.name,
-              suggestedIndex: { fields: [fkColumn], name: suggestedIndex },
-              table: relation.table
-            }
-          })
-        );
-      }
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Unindexed relation target"
-};
-
-export { unindexedRelationTarget as default };

package/dist/packem_shared/userCreatingMutationWithoutCaptcha-CH31YsUZ.mjs

@@ -1,42 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const userCreatingMutationWithoutCaptcha = {
-  categories: ["SECURITY"],
-  description: "A public `mutation`/`action` that creates a user/session or sends mail has no CAPTCHA / bot check. Account-creating and mail-sending endpoints are prime automated-abuse targets (credential stuffing, mailbox flooding, disposable-account farming).",
-  facing: "EXTERNAL",
-  level: "WARN",
-  name: "user_creating_mutation_without_captcha",
-  remediation: "Add a server-verified human check: `.use(verifyTurnstile({ secret, token }))` from `@lunora/auth`, or wrap it with `.use(protectPublic({ rateLimit, captcha }))` from `@lunora/server`. Pair with a rate limit for defense in depth.",
-  run: (context) => {
-    if (context.procedureProtections === void 0) {
-      return [];
-    }
-    const findings = [];
-    for (const procedure of context.procedureProtections) {
-      const isPublicWrite = procedure.visibility === "public" && (procedure.kind === "mutation" || procedure.kind === "action");
-      const sensitive = procedure.writesUserTable || procedure.callsMail;
-      if (!isPublicWrite || !sensitive || procedure.usesCaptcha) {
-        continue;
-      }
-      const reason = procedure.writesUserTable ? "writes a user/session table" : "sends mail";
-      findings.push(
-        emit(userCreatingMutationWithoutCaptcha, {
-          cacheKey: `user_creating_mutation_without_captcha:${procedure.file}:${procedure.exportName}`,
-          detail: `Public ${procedure.kind} \`${procedure.exportName}\` (${procedure.file}) ${reason} but has no CAPTCHA check. Add \`.use(verifyTurnstile(...))\` or \`.use(protectPublic({ captcha }))\`.`,
-          metadata: {
-            callsMail: procedure.callsMail,
-            exportName: procedure.exportName,
-            file: procedure.file,
-            kind: procedure.kind,
-            writesUserTable: procedure.writesUserTable
-          }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Account-creating / mail-sending write without a CAPTCHA"
-};
-
-export { userCreatingMutationWithoutCaptcha as default };

package/dist/packem_shared/workflowUnknownTarget-Cdd7WhKQ.mjs

@@ -1,34 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnknownTarget = {
-  categories: ["SCHEMA"],
-  description: 'A `ctx.workflows.get("<name>")` call references a workflow that is not declared by any `defineWorkflow` export in `lunora/workflows.ts`. The name is a typo or points at a removed/renamed workflow — the call throws at runtime.',
-  facing: "INTERNAL",
-  level: "ERROR",
-  name: "workflow_unknown_target",
-  remediation: 'Fix the workflow name in the `ctx.workflows.get("…")` call, or add the missing `defineWorkflow` export to `lunora/workflows.ts`.',
-  run: (context) => {
-    if (context.workflows === void 0 || context.workflowCalls === void 0) {
-      return [];
-    }
-    const declared = new Set(context.workflows.map((workflow) => workflow.exportName));
-    const findings = [];
-    for (const call of context.workflowCalls) {
-      if (call.workflow === "" || declared.has(call.workflow)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnknownTarget, {
-          cacheKey: `workflow_unknown_target:${call.file}:${call.exportName}:${call.workflow}`,
-          detail: `\`ctx.workflows.get("${call.workflow}")\` in "${call.exportName}" (${call.file}) references workflow "${call.workflow}", which is not declared in lunora/workflows.ts.`,
-          metadata: { exportName: call.exportName, file: call.file, line: call.line, workflow: call.workflow }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow call references unknown workflow"
-};
-
-export { workflowUnknownTarget as default };

package/dist/packem_shared/workflowUnused-D0jHxdz9.mjs

@@ -1,38 +0,0 @@
-import { e as emit } from './finding-Dm_zvzS1.mjs';
-
-const workflowUnused = {
-  categories: ["SCHEMA"],
-  description: 'No function starts this workflow via `ctx.workflows.get("<name>")`. It may be triggered through a path the advisor can\'t see (the Cloudflare API, a wrangler invocation, a cross-service binding) — or it may be dead code that still deploys as a billable WorkflowEntrypoint.',
-  facing: "INTERNAL",
-  level: "INFO",
-  name: "workflow_unused",
-  remediation: 'If the workflow should be triggered in-app, start it from a mutation/action with `ctx.workflows.get("<name>").create({ params })`. If it is started externally or is no longer needed, this advisory can be ignored (or remove the `defineWorkflow` export).',
-  run: (context) => {
-    if (context.workflows === void 0) {
-      return [];
-    }
-    const calls = context.workflowCalls ?? [];
-    if (calls.some((call) => call.workflow === "")) {
-      return [];
-    }
-    const started = new Set(calls.map((call) => call.workflow));
-    const findings = [];
-    for (const workflow of context.workflows) {
-      if (started.has(workflow.exportName)) {
-        continue;
-      }
-      findings.push(
-        emit(workflowUnused, {
-          cacheKey: `workflow_unused:${workflow.exportName}`,
-          detail: `No function calls \`ctx.workflows.get("${workflow.exportName}")\` — workflow "${workflow.exportName}" is declared but never started in app code.`,
-          metadata: { workflow: workflow.exportName }
-        })
-      );
-    }
-    return findings;
-  },
-  source: "static",
-  title: "Workflow is never started"
-};
-
-export { workflowUnused as default };