@metaobjectsdev/cli 1.0.0-rc.6 → 1.0.0-rc.8

package/dist/src/lib/wrangler.d.ts

@@ -6,8 +6,23 @@ export interface WranglerExecuteOptions {
 }
 export declare function buildWranglerExecuteArgs(opts: WranglerExecuteOptions): string[];
 /**
- * Run wrangler with the given args; return stdout. Stderr is included in the
- * error message when wrangler exits non-zero. `cwd` is the directory wrangler
+ * The reason to report when wrangler exits non-zero.
+ *
+ * **`--json` puts wrangler's error on STDOUT, and warnings on stderr.** This function
+ * exists because the runner used to report stderr alone, so a live D1 gate failing for
+ * want of a `CLOUDFLARE_API_TOKEN` told the adopter its cause was
+ * `▲ [WARNING] … "unsafe" fields are experimental` — a warning, named as the reason a
+ * schema gate failed, with the real cause discarded. Found by running an estate's own
+ * `verify:prod-schema` against production for the first time.
+ *
+ * Order: the structured error wrangler wrote, then stderr, then raw stdout, then the
+ * process's own message. Stderr is still consulted — a genuine wrangler failure that
+ * never reaches stdout must not be swallowed to fix the opposite mistake.
+ */
+export declare function wranglerFailureReason(stdout: string, stderr: string, fallback: string): string;
+/**
+ * Run wrangler with the given args; return stdout. The failure REASON is chosen by
+ * `wranglerFailureReason` when wrangler exits non-zero. `cwd` is the directory wrangler
  * runs in (defaults to process.cwd() — caller should pass the project root).
  */
 export type WranglerRunner = (args: string[], cwd: string) => Promise<{

package/dist/src/lib/wrangler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../../src/lib/wrangler.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAW/E;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1G,eAAO,MAAM,qBAAqB,EAAE,cAYnC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIjE"}
+{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../../src/lib/wrangler.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAW/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,MAAM,CAQR;AAsBD;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1G,eAAO,MAAM,qBAAqB,EAAE,cAYnC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIjE"}

package/dist/src/lib/wrangler.js

@@ -13,6 +13,55 @@ export function buildWranglerExecuteArgs(opts) {
     }
     return args;
 }
+/**
+ * The reason to report when wrangler exits non-zero.
+ *
+ * **`--json` puts wrangler's error on STDOUT, and warnings on stderr.** This function
+ * exists because the runner used to report stderr alone, so a live D1 gate failing for
+ * want of a `CLOUDFLARE_API_TOKEN` told the adopter its cause was
+ * `▲ [WARNING] … "unsafe" fields are experimental` — a warning, named as the reason a
+ * schema gate failed, with the real cause discarded. Found by running an estate's own
+ * `verify:prod-schema` against production for the first time.
+ *
+ * Order: the structured error wrangler wrote, then stderr, then raw stdout, then the
+ * process's own message. Stderr is still consulted — a genuine wrangler failure that
+ * never reaches stdout must not be swallowed to fix the opposite mistake.
+ */
+export function wranglerFailureReason(stdout, stderr, fallback) {
+    const structured = structuredWranglerError(stdout);
+    if (structured !== undefined)
+        return structured;
+    const err = stderr.trim();
+    if (err.length > 0)
+        return err;
+    const out = stdout.trim();
+    if (out.length > 0)
+        return out;
+    return fallback;
+}
+/** wrangler's two `--json` error shapes: `{error:{text}}` / `{error}` and the
+ *  `[{success:false,error}]` execute envelope. Anything else reads as absent. */
+function structuredWranglerError(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    const node = Array.isArray(parsed) ? parsed[0] : parsed;
+    if (node === null || typeof node !== "object")
+        return undefined;
+    const { error } = node;
+    if (typeof error === "string" && error.trim().length > 0)
+        return error.trim();
+    if (error !== null && typeof error === "object") {
+        const { text } = error;
+        if (typeof text === "string" && text.trim().length > 0)
+            return text.trim();
+    }
+    return undefined;
+}
 export const defaultWranglerRunner = async (args, cwd) => {
     try {
         const { stdout, stderr } = await execFile("wrangler", args, { cwd, maxBuffer: 16 * 1024 * 1024 });
@@ -23,8 +72,8 @@ export const defaultWranglerRunner = async (args, cwd) => {
         if (e.code === "ENOENT") {
             throw new Error(`wrangler not found on PATH; install it: 'npm i -D wrangler'`);
         }
-        const stderr = e.stderr ?? "";
-        throw new Error(`wrangler ${args.join(" ")} failed: ${stderr || e.message}`);
+        const reason = wranglerFailureReason(e.stdout ?? "", e.stderr ?? "", e.message);
+        throw new Error(`wrangler ${args.join(" ")} failed: ${reason}`);
     }
 };
 /**

package/dist/src/lib/wrangler.js.map

@@ -1 +1 @@
-{"version":3,"file":"wrangler.js","sourceRoot":"","sources":["../../../src/lib/wrangler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AASvC,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACpC,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,OAAO;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,CAAC,MAAM,qBAAqB,GAAmB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmE,CAAC;QAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"wrangler.js","sourceRoot":"","sources":["../../../src/lib/wrangler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;AASvC,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QACpC,QAAQ;QACR,WAAW,EAAE,IAAI,CAAC,OAAO;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,MAAc,EACd,QAAgB;IAEhB,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;iFACiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,KAAK,EAAE,GAAG,IAA2B,CAAC;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,KAA2B,CAAC;QAC7C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,MAAM,CAAC,MAAM,qBAAqB,GAAmB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAClG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmE,CAAC;QAC9E,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaobjectsdev/cli",
-  "version": "1.0.0-rc.6",
+  "version": "1.0.0-rc.8",
   "description": "CLI for MetaObjects: scaffold, codegen, migrate, and drift-detection commands.",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -51,15 +51,15 @@
     "@biomejs/js-api": "^0.7.0",
     "@biomejs/wasm-nodejs": "^1.9.4",
     "@libsql/kysely-libsql": "^0.4.0",
-    "@metaobjectsdev/codegen-ts": "1.0.0-rc.6",
-    "@metaobjectsdev/codegen-ts-react": "1.0.0-rc.6",
-    "@metaobjectsdev/codegen-ts-tanstack": "1.0.0-rc.6",
-    "@metaobjectsdev/docs-site": "1.0.0-rc.6",
-    "@metaobjectsdev/metadata": "1.0.0-rc.6",
-    "@metaobjectsdev/migrate-ts": "1.0.0-rc.6",
-    "@metaobjectsdev/render": "1.0.0-rc.6",
-    "@metaobjectsdev/runtime-ts": "1.0.0-rc.6",
-    "@metaobjectsdev/sdk": "1.0.0-rc.6",
+    "@metaobjectsdev/codegen-ts": "1.0.0-rc.8",
+    "@metaobjectsdev/codegen-ts-react": "1.0.0-rc.8",
+    "@metaobjectsdev/codegen-ts-tanstack": "1.0.0-rc.8",
+    "@metaobjectsdev/docs-site": "1.0.0-rc.8",
+    "@metaobjectsdev/metadata": "1.0.0-rc.8",
+    "@metaobjectsdev/migrate-ts": "1.0.0-rc.8",
+    "@metaobjectsdev/render": "1.0.0-rc.8",
+    "@metaobjectsdev/runtime-ts": "1.0.0-rc.8",
+    "@metaobjectsdev/sdk": "1.0.0-rc.8",
     "@toon-format/toon": "^2.3.0",
     "jiti": "^2.4.0"
   },

package/src/commands/upgrade.ts

@@ -126,6 +126,14 @@ export async function upgradeCommand(args: string[], cwd: string): Promise<numbe
     ...(flags.maxVersion !== undefined ? { maxVersion: flags.maxVersion } : {}),
   };
 
+  // One retirement RULE, however many occurrences it has. An estate hit this with 24
+  // `@forge*` attributes, and the per-occurrence rationale turned the output into ~96
+  // lines saying one thing four times over — the wall that buries the instruction it is
+  // made of, which is the exact failure `runGen`'s no-manifest refusal aggregates to
+  // avoid. Keyed by the rendered text, so two rules that happen to read identically
+  // collapse and two that differ anywhere do not.
+  const rules = new Map<string, { why: string; suggestions: string[]; subjects: Set<string> }>();
+
   for (const file of files) {
     const rel = relative(projectRoot, file);
     const before = await readFile(file, "utf8");
@@ -148,22 +156,24 @@ export async function upgradeCommand(args: string[], cwd: string): Promise<numbe
     log.info(`\n${rel}`);
     for (const c of r.changes) log.info(`  ${c.line}: @${c.from} → ${c.to}`);
     for (const f of r.refusals) {
-      // The WHY and the replacement both print, and the guide is not an alternative to
-      // them. This used to read `Retired in <since>. See <guide>` — dropping `why`
-      // whenever a guide existed, which is almost always, and dropping `replacedBy`
-      // unconditionally. For the `@forge*` entries that removed the only actionable
-      // sentence there is ("opt the provider in explicitly"), and for an authored
-      // `<type>.base` it announced a retirement of something that was never authorable —
-      // telling the reader they used to have a working feature. Hence "no longer accepted
-      // as of", which is true of both, with the carefully-written `why` beside it.
+      // The occurrence line is per-line information: file, line, subject, the value found.
+      // The RATIONALE that goes with it is per RULE and prints once, after the listing —
+      // see `rules` below.
       log.warn(
         `  ${f.line}: ${f.subject}${f.value !== undefined ? `: ${f.value}` : ""} — needs a decision ` +
           `(no longer accepted as of ${f.since}).`,
       );
-      log.warn(`      ${f.why}`);
-      // The same suggestion list every OTHER door prints for a retirement, rather than a
-      // second rendering of the same note that can drift from it.
-      for (const line of retirementSuggestions(f)) log.warn(`      ${line}`);
+      const key = `${f.why}\u0000${retirementSuggestions(f).join("\u0000")}`;
+      const rule = rules.get(key);
+      if (rule === undefined) {
+        rules.set(key, {
+          why: f.why,
+          suggestions: retirementSuggestions(f),
+          subjects: new Set([f.subject]),
+        });
+      } else {
+        rule.subjects.add(f.subject);
+      }
     }
 
     totalChanges += r.changes.length;
@@ -175,6 +185,21 @@ export async function upgradeCommand(args: string[], cwd: string): Promise<numbe
   }
 
   log.info("");
+
+  // The WHY and the options, once per rule. Both print, and the guide is not an
+  // alternative to them: this used to read `Retired in <since>. See <guide>`, dropping
+  // `why` whenever a guide existed — which is almost always — and dropping `replacedBy`
+  // unconditionally. For the `@forge*` entries that removed the only actionable sentence
+  // there is ("opt the provider in explicitly"). The subject list is what lets a reader
+  // connect the paragraph back to the lines above it now that it prints away from them.
+  for (const rule of rules.values()) {
+    const subjects = [...rule.subjects].sort().join(", ");
+    log.warn(`\n  ${subjects} — why, and what to do:`);
+    log.warn(`      ${rule.why}`);
+    for (const line of rule.suggestions) log.warn(`      ${line}`);
+  }
+  if (rules.size > 0) log.info("");
+
   if (notChecked.length > 0) {
     log.warn(
       `${notChecked.length} file(s) could not be parsed and were NOT checked — fix these ` +

package/src/commands/verify.ts

@@ -12,13 +12,14 @@ import { parseVerifyArgs, type MigrateFlags } from "../lib/args.js";
 import { log } from "../lib/log.js";
 import { emitStructured, type OutputFormat } from "../lib/format.js";
 import {
-  antiPatternRows, missingBaseUrlRows, ranSection, skippedSection, warnCapped,
+  antiPatternRows, missingBaseUrlRows, removedPropRows, ranSection, skippedSection, warnCapped,
   type AdvisoryDiagnosticRow, type AdvisoryFindingRow, type AdvisorySection,
 } from "../lib/advisory.js";
 import { warnIfAgentContextStale } from "../lib/agent-context-staleness.js";
 import { warnIfManifestIgnored } from "../lib/manifest-ignored-check.js";
 import { scanSourceForAntiPatterns } from "../lib/anti-patterns.js";
 import { scanForMissingBaseUrl, type BaseUrlFinding } from "../lib/base-url-advisory.js";
+import { scanForRemovedProps, type RemovedPropFinding } from "../lib/removed-prop-advisory.js";
 import { replayRemedy } from "../lib/replay-remedy.js";
 import { FileProvider } from "../lib/file-provider.js";
 import { derivePayloadFieldTree } from "../lib/payload-field-tree.js";
@@ -735,8 +736,21 @@ export async function verifyCommand(
       // Same discipline as above: an advisory scan never breaks verify. The anti-pattern
       // half already ran, so its rows are still reported rather than lost to this catch.
     }
+    // F99 — the other half of the same migration: the adopter who never renamed at all.
+    // Its own try/catch for the same reason, so one scanner throwing cannot take the
+    // other's rows with it.
+    let removedProps: RemovedPropFinding[] = [];
+    try {
+      removedProps = scanForRemovedProps(projectRoot);
+    } catch {
+      // advisory only — never breaks verify.
+    }
 
-    antiPatternSection = ranSection([...antiPatternRows(findings), ...missingBaseUrlRows(baseUrl)]);
+    antiPatternSection = ranSection([
+      ...antiPatternRows(findings),
+      ...missingBaseUrlRows(baseUrl),
+      ...removedPropRows(removedProps),
+    ]);
     if (findings.length > 0) {
       log.warn(
         `meta verify — ${findings.length} place(s) hand-roll what MetaObjects can model ` +
@@ -751,6 +765,13 @@ export async function verifyCommand(
       );
       warnCapped(baseUrl.map((f) => `  ${f.message}`), flags.limit, { structured });
     }
+    if (removedProps.length > 0) {
+      log.warn(
+        `meta verify — ${removedProps.length} provider(s) still mounted with a prop 1.0 ` +
+          `renamed away (advisory — does not fail the build, but the runtime will):`,
+      );
+      warnCapped(removedProps.map((f) => `  ${f.message}`), flags.limit, { structured });
+    }
   }
 
   // -- template (prompt / output) drift --------------------------------------

package/src/lib/advisory.ts

@@ -23,6 +23,7 @@
 import { log } from "./log.js";
 import type { AntiPatternFinding } from "./anti-patterns.js";
 import type { BaseUrlFinding } from "./base-url-advisory.js";
+import type { RemovedPropFinding } from "./removed-prop-advisory.js";
 
 /**
  * How many advisory lines TEXT output prints before it truncates.
@@ -134,6 +135,21 @@ export function missingBaseUrlRows(findings: readonly BaseUrlFinding[]): Advisor
   }));
 }
 
+/**
+ * F99 findings in that same row shape, for the same reason. `rule` carries the prop, so a
+ * consumer filtering the advisory list does not have to parse the message to learn WHICH
+ * rename fired — there will eventually be more than one.
+ */
+export function removedPropRows(findings: readonly RemovedPropFinding[]): AdvisoryFindingRow[] {
+  return findings.map((f) => ({
+    file: f.file,
+    line: f.line,
+    rule: `removed-prop:${f.prop}`,
+    construct: f.construct,
+    message: f.message,
+  }));
+}
+
 // ---------------------------------------------------------------------------
 // text output
 // ---------------------------------------------------------------------------

package/src/lib/anti-patterns.ts

@@ -18,6 +18,7 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { relPosix } from "./rel-posix.js";
+import { looksBundled } from "./authored-source.js";
 
 export interface AntiPatternFinding {
   file: string; // path relative to the scan root (posix-ish, sep-normalized)
@@ -259,6 +260,10 @@ function walk(dir: string, root: string, ignore: readonly RegExp[], acc: AntiPat
     }
     // Skip MetaObjects-generated output — it legitimately contains AVG/CHECK etc.
     if (text.slice(0, 600).includes(GENERATED_MARKER)) continue;
+    // …and skip a BUNDLE, which is nobody's source. The 512KB gate above is about cost, not
+    // authorship: a 300KB minified file passes it while being just as unfixable. Same rule
+    // the base-URL advisory applies, from the same module. See lib/authored-source.ts.
+    if (looksBundled(text)) continue;
     const isSql = e.name.endsWith(".sql");
     const lines = text.split("\n");
     for (let i = 0; i < lines.length; i++) {

package/src/lib/authored-source.ts

@@ -0,0 +1,45 @@
+/**
+ * Is this file text a HUMAN wrote, or a bundler's output?
+ *
+ * Both advisory scanners — the base-URL one and the anti-pattern one — exist to teach the
+ * author of a file something about the file. A bundle is not authored: nobody can act on a
+ * finding in it, the fix belongs in the source it was built from, and naming a generated
+ * artifact spends the scanners' whole false-positive budget in one line.
+ *
+ * The rule is a property of the ARTIFACT, not of a directory name. An estate proved why:
+ * its build output is `public/`, which no ignore list would have guessed (the lists cover
+ * `dist`, `build`, `.next`, `.output`, `out`), so `meta verify` reported
+ * `public/main.js:243 — <EntityFetcherProvider> is mounted with no baseUrl` while
+ * `client/src/main.tsx:26` — the source, the file a person edits — passes `baseUrl="/api"`
+ * correctly. Adding `public` to a list would have fixed that estate and nobody else.
+ *
+ * The two scanners keep their own walkers, deliberately (they diverge on eight axes and
+ * unifying them needs ~6 options for two callers). What they share is this judgment, so it
+ * lives here once rather than being decided twice.
+ */
+
+/**
+ * Bundlers emit lines in the thousands-to-hundreds-of-thousands of characters; the estate
+ * bundle that produced the false positive has a longest line of 266,226. Authored source
+ * does not reach 5,000 — the threshold sits an order of magnitude above the longest line
+ * any human writes and an order of magnitude below what minification produces, so it is a
+ * wide gap rather than a tuned one.
+ *
+ * NOT `>= 512KB`, which `anti-patterns.ts` already applies for a different reason (cost):
+ * that gate is about how much work a scan does, and a 300KB bundle sails through it while
+ * being exactly as unauthored as a 700KB one.
+ */
+const BUNDLED_LINE_LENGTH = 5000;
+
+/** True when `text` looks like build output rather than source someone edits. */
+export function looksBundled(text: string): boolean {
+  // Scan for a long line without splitting the whole file: a 700KB bundle would otherwise
+  // allocate an array of it, and this runs per file on every `meta verify` / `meta gen`.
+  let lineStart = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text.charCodeAt(i) !== 10 /* \n */) continue;
+    if (i - lineStart >= BUNDLED_LINE_LENGTH) return true;
+    lineStart = i + 1;
+  }
+  return text.length - lineStart >= BUNDLED_LINE_LENGTH;
+}

package/src/lib/base-url-advisory.ts

@@ -1,6 +1,8 @@
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { relPosix } from "./rel-posix.js";
+import { looksBundled } from "./authored-source.js";
+import { constructText } from "./jsx-construct.js";
 
 /**
  * F52 — a provider mounted with no `baseUrl` on a project whose `apiPrefix` is not empty.
@@ -51,66 +53,6 @@ const PROVIDERS: readonly { construct: string; open: RegExp; kind: "jsx" | "call
   { construct: "provideEntityFetcher()", open: /provideEntityFetcher\s*\(/g, kind: "call" },
 ];
 
-/**
- * The text of the opening construct that begins at `start`.
- *
- * JSX: up to the `>` that closes the opening TAG. Call this a one-file tokenizer rather
- * than a bracket count, because a bracket count is what the first version was and it was
- * wrong in both directions:
- *
- *   <EntityFetcherProvider title="a > b" fetcher={f} baseUrl="/api">
- *       → the `>` inside the STRING ended the tag before `baseUrl`, warning about a
- *         correct provider.
- *   <EntityFetcherProvider fetcher={mk(")")}>
- *       → the unbalanced `)` inside a string meant depth never returned to 0, so the
- *         4000-char cap swallowed an unrelated `baseUrl` later in the file and SUPPRESSED
- *         a real finding.
- *
- * So string literals (all three quote styles, with escapes), line comments and block
- * comments are skipped rather than counted. A regex literal is deliberately NOT handled —
- * telling `/` division from a regex needs real parsing, and a regex inside a JSX opening
- * tag is vanishingly rare next to the cost of getting it wrong.
- *
- * Call: to the `)` balancing the argument list, so a nested object or arrow does not end
- * it early.
- *
- * Both bail after a generous cap rather than scanning a whole minified file when a
- * construct is unterminated.
- */
-function constructText(src: string, start: number, kind: "jsx" | "call"): string {
-  const limit = Math.min(src.length, start + 4000);
-  let depth = 0;
-  for (let i = start; i < limit; i++) {
-    const c = src[i]!;
-
-    // --- skip what is not code -------------------------------------------------
-    if (c === '"' || c === "'" || c === "`") {
-      i++;
-      while (i < limit && src[i] !== c) { if (src[i] === "\\") i++; i++; }
-      continue;
-    }
-    if (c === "/" && src[i + 1] === "/") {
-      while (i < limit && src[i] !== "\n") i++;
-      continue;
-    }
-    if (c === "/" && src[i + 1] === "*") {
-      i += 2;
-      while (i < limit && !(src[i] === "*" && src[i + 1] === "/")) i++;
-      i++;
-      continue;
-    }
-
-    // --- code ------------------------------------------------------------------
-    if (kind === "jsx" && c === ">" && depth === 0) return src.slice(start, i + 1);
-    if (c === "{" || c === "(" || c === "[") depth++;
-    else if (c === "}" || c === ")" || c === "]") {
-      if (kind === "call" && depth === 1 && c === ")") return src.slice(start, i + 1);
-      depth--;
-    }
-  }
-  return src.slice(start, limit);
-}
-
 function scanFile(rel: string, src: string, apiPrefix: string): BaseUrlFinding[] {
   const out: BaseUrlFinding[] = [];
   for (const { construct, open, kind } of PROVIDERS) {
@@ -155,6 +97,10 @@ function walk(dir: string, root: string, acc: BaseUrlFinding[], apiPrefix: strin
     let src: string;
     try { src = readFileSync(abs, "utf8"); } catch { continue; }
     if (!src.includes("EntityFetcher")) continue;
+    // A bundle is not authored source: the fix belongs in the file it was built FROM, and
+    // an estate whose output directory is `public/` proved that no ignore list guesses the
+    // name. See lib/authored-source.ts.
+    if (looksBundled(src)) continue;
     acc.push(...scanFile(relPosix(root, abs), src, apiPrefix));
   }
 }

package/src/lib/jsx-construct.ts

@@ -0,0 +1,124 @@
+/**
+ * The text of one opening JSX tag or call expression, and its top-level attribute names.
+ *
+ * Lifted out of `base-url-advisory.ts` when a second advisory (F99, the removed `value`
+ * prop) needed exactly the same tokenizer. This is a shared PRIMITIVE, not a shared walker
+ * — the two advisories keep their own directory walks deliberately, because they disagree
+ * about what to scan and have diverged on purpose.
+ */
+
+/**
+ * The text of the construct that begins at `start`.
+ *
+ * JSX: up to the `>` that closes the opening TAG. Call this a one-file tokenizer rather
+ * than a bracket count, because a bracket count is what the first version was and it was
+ * wrong in both directions:
+ *
+ *   <EntityFetcherProvider title="a > b" fetcher={f} baseUrl="/api">
+ *       → the `>` inside the STRING ended the tag before `baseUrl`, warning about a
+ *         correct provider.
+ *   <EntityFetcherProvider fetcher={mk(")")}>
+ *       → the unbalanced `)` inside a string meant depth never returned to 0, so the
+ *         4000-char cap swallowed an unrelated `baseUrl` later in the file and SUPPRESSED
+ *         a real finding.
+ *
+ * So string literals (all three quote styles, with escapes), line comments and block
+ * comments are skipped rather than counted. A regex literal is deliberately NOT handled —
+ * telling `/` division from a regex needs real parsing, and a regex inside a JSX opening
+ * tag is vanishingly rare next to the cost of getting it wrong.
+ *
+ * Call: to the `)` balancing the argument list, so a nested object or arrow does not end
+ * it early.
+ *
+ * Both bail after a generous cap rather than scanning a whole minified file when a
+ * construct is unterminated.
+ */
+export function constructText(src: string, start: number, kind: "jsx" | "call"): string {
+  const limit = Math.min(src.length, start + 4000);
+  let depth = 0;
+  for (let i = start; i < limit; i++) {
+    const c = src[i]!;
+
+    // --- skip what is not code -------------------------------------------------
+    if (c === '"' || c === "'" || c === "`") {
+      i++;
+      while (i < limit && src[i] !== c) { if (src[i] === "\\") i++; i++; }
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "/") {
+      while (i < limit && src[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "/" && src[i + 1] === "*") {
+      i += 2;
+      while (i < limit && !(src[i] === "*" && src[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+
+    // --- code ------------------------------------------------------------------
+    if (kind === "jsx" && c === ">" && depth === 0) return src.slice(start, i + 1);
+    if (c === "{" || c === "(" || c === "[") depth++;
+    else if (c === "}" || c === ")" || c === "]") {
+      if (kind === "call" && depth === 1 && c === ")") return src.slice(start, i + 1);
+      depth--;
+    }
+  }
+  return src.slice(start, limit);
+}
+
+/**
+ * The attribute names written directly on an opening tag — depth 0 only.
+ *
+ * Depth is the whole point. `constructText` returns the tag INCLUDING every nested
+ * expression, so a substring test for `value=` convicts all of these, none of which pass
+ * `value` to the tag:
+ *
+ *   <P fetcher={mk({ value: 1 })}>          an object key
+ *   <P fetcher={o.value === 1 ? a : b}>     a comparison — note `=` is the first of `===`
+ *   <P fetcher={<Inner value={9} />}>       a DIFFERENT component's prop
+ *
+ * Strings and comments are skipped for the same reason they are in `constructText`, so a
+ * `title="pass value={x} here"` is prose, not an attribute.
+ *
+ * An identifier counts only when the next non-space character is a single `=` (not `=>`,
+ * not `==`). A valueless boolean attribute (`<P disabled>`) is therefore not reported —
+ * correct here, since every prop these advisories care about takes a value.
+ */
+export function topLevelAttrs(tag: string): Set<string> {
+  const out = new Set<string>();
+  let depth = 0;
+  // Start past the tag name so the component's own name is never read as an attribute.
+  let i = 0;
+  while (i < tag.length && !/\s/.test(tag[i]!)) i++;
+
+  for (; i < tag.length; i++) {
+    const c = tag[i]!;
+    if (c === '"' || c === "'" || c === "`") {
+      i++;
+      while (i < tag.length && tag[i] !== c) { if (tag[i] === "\\") i++; i++; }
+      continue;
+    }
+    if (c === "/" && tag[i + 1] === "/") { while (i < tag.length && tag[i] !== "\n") i++; continue; }
+    if (c === "/" && tag[i + 1] === "*") {
+      i += 2;
+      while (i < tag.length && !(tag[i] === "*" && tag[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    if (c === "{" || c === "(" || c === "[") { depth++; continue; }
+    if (c === "}" || c === ")" || c === "]") { depth--; continue; }
+    if (depth !== 0) continue;
+
+    if (/[A-Za-z_$]/.test(c)) {
+      const start = i;
+      while (i < tag.length && /[A-Za-z0-9_$-]/.test(tag[i]!)) i++;
+      const name = tag.slice(start, i);
+      let j = i;
+      while (j < tag.length && /\s/.test(tag[j]!)) j++;
+      if (tag[j] === "=" && tag[j + 1] !== "=" && tag[j + 1] !== ">") out.add(name);
+      i--; // the for-loop's i++ re-reads the delimiter we stopped on
+    }
+  }
+  return out;
+}