@voltro/cli 0.27.0 → 0.29.0

package/dist/checkCommand-BPAtyWs8.js

@@ -0,0 +1,2420 @@
+import { R as e, f as t, ht as n, n as r, o as i } from "./inspectMetrics-DHYygE4s.js";
+import { Mt as a, jt as o } from "./dev-Cg4BKLmi.js";
+import { C as s, E as c, O as l, T as u, d, h as f, i as p, l as m, m as h, r as g, u as _ } from "./fileConventions-Cof68_BL.js";
+import { r as v, u as y } from "./apiBuild-BESZbTjA.js";
+import { dirname as b, isAbsolute as ee, join as x, relative as S, resolve as C, sep as w } from "node:path";
+import { routeDiagnosticsToStderr as te } from "@voltro/logger";
+import { existsSync as T, readFileSync as E, readdirSync as D, statSync as O, writeFileSync as ne } from "node:fs";
+import { Node as k, Project as A, SyntaxKind as j } from "ts-morph";
+//#region src/cliOutput.ts
+var re = () => {
+	te();
+}, M = (e, t = {}) => {
+	console.log(JSON.stringify(e, null, t.pretty === !1 ? 0 : 2));
+}, ie = (e) => {
+	for (let t = 0; t < e.length; t++) {
+		let n = e[t];
+		if (n === "--json" || n === "--format=json" || n === "--format" && e[t + 1] === "json") return !0;
+	}
+	return !1;
+}, ae = (e, t, n = !1) => {
+	let r = { ...e ?? {} }, i = t ?? process.env.VOLTRO_INSPECT_TOKEN;
+	if (i !== void 0 && i !== "" && (r.authorization = `Bearer ${i}`), n) {
+		let e = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
+		e !== void 0 && e !== "" && (r["x-voltro-inspect-write"] = e);
+	}
+	return r;
+}, oe = /* @__PURE__ */ new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]), N = async (e, t, n) => {
+	let r = `${e.url.replace(/\/+$/, "")}${t.startsWith("/") ? t : `/${t}`}`, i = n?.method ?? "GET", a = n?.body !== void 0;
+	try {
+		let t = await fetch(r, {
+			method: i,
+			headers: ae(a ? { "content-type": "application/json" } : void 0, e.inspectToken, oe.has(i)),
+			...a ? { body: JSON.stringify(n.body) } : {}
+		}), o = await t.text(), s;
+		if (o.length > 0) try {
+			s = JSON.parse(o);
+		} catch {
+			s = o;
+		}
+		if (!t.ok) {
+			let n = s, r = typeof n == "object" && n ? String(n.message ?? n.reason ?? n.error ?? `HTTP ${t.status}`) : `HTTP ${t.status}`, a = oe.has(i) && (process.env.VOLTRO_INSPECT_WRITE_TOKEN ?? "") === "" && /write/i.test(r);
+			return {
+				kind: "err",
+				name: e.name,
+				error: a ? `${r}\n  VOLTRO_INSPECT_WRITE_TOKEN is not set in this shell. \`voltro dev\` mints it into the project's \`.env.local\`; export it (or run from a shell that loaded it).` : r
+			};
+		}
+		return {
+			kind: "ok",
+			name: e.name,
+			status: t.status,
+			data: s
+		};
+	} catch (t) {
+		return {
+			kind: "err",
+			name: e.name,
+			error: t.message || String(t)
+		};
+	}
+}, se = (e, t = process.env) => {
+	let n = [], r, i;
+	for (let t = 0; t < e.length; t++) {
+		let a = e[t];
+		if (a === "--url") {
+			r = e[++t];
+			continue;
+		}
+		if (a.startsWith("--url=")) {
+			r = a.slice(6);
+			continue;
+		}
+		if (a === "--token") {
+			i = e[++t];
+			continue;
+		}
+		if (a.startsWith("--token=")) {
+			i = a.slice(8);
+			continue;
+		}
+		n.push(a);
+	}
+	if (r ??= t.VOLTRO_INSPECT_URL, r === void 0 || r === "") return {
+		target: void 0,
+		rest: n
+	};
+	let a;
+	try {
+		a = new URL(r);
+	} catch {
+		return {
+			target: void 0,
+			rest: n,
+			error: `--url: not a valid URL: "${r}"`
+		};
+	}
+	let o = i ?? t.VOLTRO_INSPECT_TOKEN;
+	return {
+		target: {
+			url: r.replace(/\/+$/, ""),
+			name: a.host,
+			...o !== void 0 && o !== "" ? { token: o } : {}
+		},
+		rest: n
+	};
+}, ce = (e) => ({
+	id: `remote:${e.url}`,
+	name: e.name,
+	kind: "api",
+	url: e.url,
+	pid: 0,
+	registeredAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+	heartbeatAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+	status: "live",
+	logFile: "",
+	...e.token === void 0 ? {} : { inspectToken: e.token }
+}), le = async (e, t) => t === void 0 ? (await n()).apps.filter((t) => t.kind === "api" && t.status === "live" && t.url.length > 0 && (e === void 0 || t.name === e)) : [ce(t)], ue = (e) => {
+	let t = "pretty", n = [];
+	for (let r = 0; r < e.length; r++) {
+		let i = e[r];
+		if (i === "--format") {
+			let n = e[++r];
+			if (n !== "pretty" && n !== "json") return { error: "--format: must be 'pretty' | 'json'" };
+			t = n;
+			continue;
+		}
+		if (i === "--json" || i === "--format=json") {
+			t = "json";
+			continue;
+		}
+		if (i === "--format=pretty") {
+			t = "pretty";
+			continue;
+		}
+		n.push(i);
+	}
+	return {
+		format: t,
+		rest: n
+	};
+}, de = (e, t = process.env) => {
+	let { target: n, rest: r, error: i } = se(e, t), a, o = [];
+	for (let e = 0; e < r.length; e++) {
+		let t = r[e];
+		if (t === "--process") {
+			a = r[++e];
+			continue;
+		}
+		if (t.startsWith("--process=")) {
+			a = t.slice(10);
+			continue;
+		}
+		o.push(t);
+	}
+	return {
+		process: a,
+		target: n,
+		rest: o,
+		...i === void 0 ? {} : { error: i }
+	};
+}, P = (e) => e.source === void 0 ? [] : typeof e.source == "string" ? [e.source] : e.source, fe = (e) => ({
+	tables: new Set(e.tables),
+	procedures: new Map(e.procedures.map((e) => [e.tag, e])),
+	scopes: new Set(e.scopes ?? []),
+	input: e
+}), pe = (e) => {
+	let t = [], n = /* @__PURE__ */ new Set();
+	for (let r of e.input.procedures) {
+		for (let i of P(r)) n.add(i), e.tables.has(i) || t.push({
+			rule: "reference/dangling-source",
+			node: `${r.kind}(${r.tag})`,
+			...r.file === void 0 ? {} : { file: r.file },
+			breaks: [`reads table '${i}' which does not exist`],
+			fix: `declare a '${i}.entity.ts' table or fix the query's source`,
+			severity: "error"
+		});
+		for (let i of r.targets ?? []) n.add(i.table), e.tables.has(i.table) || t.push({
+			rule: "reference/dangling-target",
+			node: `${r.kind}(${r.tag})`,
+			...r.file === void 0 ? {} : { file: r.file },
+			breaks: [`targets table '${i.table}' (op '${i.op}') which does not exist`],
+			fix: `declare a '${i.table}.entity.ts' table or fix the mutation's target`,
+			severity: "error"
+		});
+		for (let n of r.requiresScopes ?? []) e.scopes.size > 0 && !e.scopes.has(n) && t.push({
+			rule: "rbac/unknown-scope",
+			node: `${r.kind}(${r.tag})`,
+			...r.file === void 0 ? {} : { file: r.file },
+			breaks: [`requires scope '${n}' which is not declared`],
+			fix: `declare the scope '${n}' or fix the requireScope(...) call`,
+			severity: "error"
+		});
+		r.kind === "mutation" && r.hasGuards === !1 && t.push({
+			rule: "rbac/unguarded-mutation",
+			node: `${r.kind}(${r.tag})`,
+			...r.file === void 0 ? {} : { file: r.file },
+			breaks: [`'${r.tag}' changes state but declares no guard — any caller who can reach the rpc surface can invoke it`],
+			fix: "add a guard (e.g. `.guard(requireScope('…'))`), or confirm it is intentionally public",
+			severity: "warn"
+		});
+	}
+	for (let n of e.input.routes ?? []) for (let r of n.binds) e.procedures.has(r) || t.push({
+		rule: "binding/unknown-tag",
+		node: `route(${n.pattern})`,
+		...n.file === void 0 ? {} : { file: n.file },
+		breaks: [`binds rpc tag '${r}' which does not exist`],
+		fix: `bind an existing tag, or restore '${r}' (it may have been renamed/removed)`,
+		severity: "error"
+	});
+	for (let t of e.input.procedures) for (let e of t.targets ?? []) n.add(e.table);
+	let r = new Set(e.input.frameworkOwnedTables ?? []), i = e.input.procedures.filter((e) => e.kind === "action" && P(e).length === 0 && (e.targets ?? []).length === 0).length;
+	for (let a of e.tables) r.has(a) || n.has(a) || t.push({
+		rule: "orphan/unread-table",
+		node: `table(${a})`,
+		breaks: i > 0 ? [`no query reads and no mutation writes '${a}'`, `${i} action(s) declare neither source nor target, so one of them may still use it`] : [`no query reads and no mutation writes '${a}'`],
+		fix: i > 0 ? "declare `source`/`target` on your actions so this can be answered, then re-run" : `add a query/mutation for '${a}', or remove the table if it's dead`,
+		severity: "warn"
+	});
+	if (e.scopes.size > 0) {
+		let n = /* @__PURE__ */ new Set();
+		for (let t of e.input.procedures) for (let e of t.requiresScopes ?? []) n.add(e);
+		for (let r of [...e.scopes].sort()) r === "admin:full" || n.has(r) || t.push({
+			rule: "rbac/unenforced-scope",
+			node: `scope(${r})`,
+			breaks: [`'${r}' is granted by a role but NO query/mutation/action/stream guards on it`, "a scope nobody checks grants nothing and withholds nothing — the role map reads stricter than the app is"],
+			fix: `add \`.guard(requireScope('${r}'))\` to the handlers it is meant to protect — or, if a plugin route, a REST route, or a UI-only affordance enforces it, say so where the role is declared`,
+			severity: "warn"
+		});
+	}
+	return t;
+}, me = (e, t) => {
+	let n = [];
+	if (t.kind === "removeTable") for (let r of e.input.procedures) {
+		let e = P(r).includes(t.name), i = (r.targets ?? []).some((e) => e.table === t.name);
+		(e || i) && n.push({
+			rule: "blast/table-removed",
+			node: `${r.kind}(${r.tag})`,
+			...r.file === void 0 ? {} : { file: r.file },
+			breaks: [`${e ? "reads" : "writes"} table '${t.name}' — would break if removed`],
+			fix: `migrate or remove ${r.tag} before dropping '${t.name}'`,
+			severity: "error"
+		});
+	}
+	else if (t.kind === "removeProcedure") for (let r of e.input.routes ?? []) r.binds.includes(t.tag) && n.push({
+		rule: "blast/procedure-removed",
+		node: `route(${r.pattern})`,
+		...r.file === void 0 ? {} : { file: r.file },
+		breaks: [`binds '${t.tag}' — would break if removed`],
+		fix: `rebind ${r.pattern} to another tag before removing '${t.tag}'`,
+		severity: "error"
+	});
+	else for (let r of e.input.procedures) (r.requiresScopes ?? []).includes(t.name) && n.push({
+		rule: "blast/scope-removed",
+		node: `${r.kind}(${r.tag})`,
+		...r.file === void 0 ? {} : { file: r.file },
+		breaks: [`requires scope '${t.name}' — would become unguarded/dangling if removed`],
+		fix: `remove the requireScope('${t.name}') call or keep the scope`,
+		severity: "error"
+	});
+	return n;
+}, he = (e, t) => {
+	let n = fe(e), r = [...pe(n), ...t === void 0 ? [] : me(n, t)];
+	return {
+		ok: !r.some((e) => e.severity === "error"),
+		diagnostics: r
+	};
+}, ge = (e) => {
+	let t = "", n = !1;
+	for (let r = 0; r < e.length; r++) {
+		let i = e[r];
+		if (n) {
+			if (t += i, i === "\\") {
+				t += e[r + 1] ?? "", r++;
+				continue;
+			}
+			i === "\"" && (n = !1);
+			continue;
+		}
+		if (i === "\"") {
+			n = !0, t += i;
+			continue;
+		}
+		if (i === "/" && e[r + 1] === "*") {
+			let t = e.indexOf("*/", r + 2);
+			r = t === -1 ? e.length : t + 1;
+			continue;
+		}
+		if (i === "/" && e[r + 1] === "/") {
+			let t = e.indexOf("\n", r);
+			r = t === -1 ? e.length : t - 1;
+			continue;
+		}
+		t += i;
+	}
+	return JSON.parse(_e(t));
+}, _e = (e) => {
+	let t = "", n = !1;
+	for (let r = 0; r < e.length; r++) {
+		let i = e[r];
+		if (n) {
+			if (t += i, i === "\\") {
+				t += e[r + 1] ?? "", r++;
+				continue;
+			}
+			i === "\"" && (n = !1);
+			continue;
+		}
+		if (i === "\"") {
+			n = !0, t += i;
+			continue;
+		}
+		if (i === ",") {
+			let t = e.slice(r + 1);
+			if (/^\s*[}\]]/.exec(t)) continue;
+		}
+		t += i;
+	}
+	return t;
+}, F = (e, t) => {
+	if (t.has(e) || !T(e)) return;
+	t.add(e);
+	let n;
+	try {
+		n = ge(E(e, "utf8"));
+	} catch {
+		return;
+	}
+	if (n.extends === void 0) return n;
+	let r = n.extends;
+	if (!r.startsWith(".")) return n;
+	let i = F(C(b(e), r), t);
+	return i === void 0 ? n : { compilerOptions: {
+		...i.compilerOptions,
+		...n.compilerOptions,
+		paths: {
+			...i.compilerOptions?.paths,
+			...n.compilerOptions?.paths
+		}
+	} };
+}, ve = (e, t = "tsconfig.json") => {
+	let n = ee(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
+	if (i === void 0) return;
+	let a = {};
+	for (let [e, t] of Object.entries(i)) Array.isArray(t) && (a[e] = t.filter((e) => typeof e == "string"));
+	if (Object.keys(a).length !== 0) return {
+		baseUrl: C(b(n), r?.compilerOptions?.baseUrl ?? "."),
+		paths: a
+	};
+}, I = (e, t = "tsconfig.json") => {
+	let n = ee(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
+	if (i === void 0) return [];
+	let a = C(b(n), r?.compilerOptions?.baseUrl ?? "."), o = [];
+	for (let [e, t] of Object.entries(i)) {
+		let n = t[0];
+		if (typeof n != "string") continue;
+		let r = e.endsWith("*");
+		o.push({
+			prefix: r ? e.slice(0, -1) : e,
+			target: C(a, r ? n.replace(/\*$/, "") : n),
+			wildcard: r
+		});
+	}
+	return o.sort((e, t) => t.prefix.length - e.prefix.length);
+}, ye = (e, t) => {
+	for (let n of t) if (n.wildcard) {
+		if (e.startsWith(n.prefix)) return x(n.target, e.slice(n.prefix.length));
+	} else if (e === n.prefix) return n.target;
+}, L = ".voltro-vendored", be = (e, t) => {
+	let n = [], r = /* @__PURE__ */ new Set(), i = (e, t) => {
+		let i = C(e);
+		r.has(i) || !T(i) || (r.add(i), n.push({
+			dir: i,
+			source: t
+		}));
+	}, a = x(e, "components.json");
+	if (T(a)) try {
+		let t = JSON.parse(E(a, "utf8"));
+		for (let n of ["ui"]) {
+			let r = t.aliases?.[n];
+			if (typeof r != "string" || r === "") continue;
+			let a = r.replace(/^@\//, "").replace(/^~\//, "");
+			for (let t of [x(e, a), x(e, "src", a)]) if (T(t)) {
+				i(t, `components.json (aliases.${n})`);
+				break;
+			}
+		}
+	} catch {}
+	for (let e of t) {
+		let t = e.slice(0, e.lastIndexOf(w)), n = x(t, L);
+		if (!r.has(C(t)) && T(n)) {
+			let e = "";
+			try {
+				e = E(n, "utf8").trim().split("\n")[0] ?? "";
+			} catch {}
+			i(t, e === "" ? L : `${L}: ${e}`);
+		}
+	}
+	return n;
+}, xe = (e, t) => t.some((t) => e === t.dir || e.startsWith(`${t.dir}${w}`)), Se = (e, t) => t.map((t) => `${S(e, t.dir) || "."}  (${t.source})`), Ce = [
+	{
+		id: "component.ui",
+		re: p,
+		needsTest: !0
+	},
+	{
+		id: "component",
+		re: g,
+		needsTest: !0
+	},
+	{
+		id: "hook",
+		re: _,
+		needsTest: !0
+	},
+	{
+		id: "tracking",
+		re: c,
+		needsTest: !0
+	},
+	{
+		id: "store",
+		re: s,
+		needsTest: !0
+	},
+	{
+		id: "internal",
+		re: d,
+		needsTest: !0
+	},
+	{
+		id: "fixture",
+		re: m,
+		needsTest: !1
+	},
+	{
+		id: "types",
+		re: l,
+		needsTest: !1
+	}
+], R = (e) => Ce.find((t) => t.re.test(e))?.id ?? null, z = (e) => u.test(e), we = /* @__PURE__ */ new Set([
+	"useMutation",
+	"useAction",
+	"useUpload",
+	"useUndo",
+	"useOutbox",
+	"useAgentChat",
+	"useAgentStream",
+	"useResumableAgentStream",
+	"useWorkflow"
+]), Te = /* @__PURE__ */ new Set(["defineTracking"]), Ee = /* @__PURE__ */ new Set([
+	"useSubscription",
+	"useWindowedSubscription",
+	"useRecord",
+	"useQuery"
+]), De = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	"build",
+	".framework",
+	".turbo",
+	".vite",
+	".next",
+	".git",
+	"coverage",
+	".publish"
+]), Oe = /\.tsx?$/, B = (e, t = [], n = 0) => {
+	if (n > 12) return t;
+	let r;
+	try {
+		r = D(e);
+	} catch {
+		return t;
+	}
+	for (let i of r) {
+		if (De.has(i)) continue;
+		let r = x(e, i), a;
+		try {
+			a = O(r);
+		} catch {
+			continue;
+		}
+		a.isDirectory() ? B(r, t, n + 1) : a.isFile() && Oe.test(i) && !i.endsWith(".d.ts") && t.push(r);
+	}
+	return t;
+}, ke = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, Ae = /\b(?:memo|forwardRef|observer|styled)\b/, V = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), H = (e) => {
+	if (V(e)) return !0;
+	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return H(e.getExpression());
+	if (k.isVariableDeclaration(e)) {
+		let t = e.getTypeNode();
+		if (t !== void 0 && ke.test(t.getText())) return !0;
+		let n = e.getInitializer();
+		return n === void 0 || H(n);
+	}
+	return k.isCallExpression(e) ? Ae.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => V(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
+}, je = (e) => {
+	let t = [], n = [], r = [], i = /* @__PURE__ */ new Set();
+	for (let [a, o] of e.getExportedDeclarations()) {
+		let e = o[0];
+		if (e === void 0 || k.isInterfaceDeclaration(e) || k.isTypeAliasDeclaration(e) || i.has(e)) continue;
+		i.add(e);
+		let s = a === "default" ? (k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isVariableDeclaration(e) ? e.getName() : void 0) ?? "Default" : a;
+		if (/^use[A-Z]/.test(s)) {
+			n.push(s);
+			continue;
+		}
+		if (/^[A-Z]/.test(s) && H(e)) {
+			t.push(s);
+			continue;
+		}
+		r.push(s);
+	}
+	return {
+		components: t,
+		hooks: n,
+		others: r,
+		hasRuntimeExport: t.length + n.length + r.length > 0
+	};
+}, Me = [], Ne = (e, t, n) => {
+	let r = b(e), i = [];
+	for (let e = r;; e = b(e)) {
+		let r = n.get(e);
+		if (r !== void 0) {
+			for (let e of i) n.set(e, r);
+			return r;
+		}
+		if (i.push(e), T(x(e, "tsconfig.json"))) {
+			let t = I(e);
+			if (t.length > 0) {
+				for (let e of i) n.set(e, t);
+				return t;
+			}
+		}
+		if (e === t || b(e) === e) break;
+	}
+	for (let e of i) n.set(e, Me);
+	return Me;
+}, Pe = (e, t, n) => {
+	let r = t.startsWith(".") ? C(b(e), t) : ye(t, n);
+	if (r === void 0) return null;
+	for (let e of [
+		r,
+		`${r}.tsx`,
+		`${r}.ts`,
+		x(r, "index.tsx"),
+		x(r, "index.ts")
+	]) try {
+		if (O(e).isFile()) return e;
+	} catch {}
+	return null;
+}, Fe = (e, t, n) => {
+	let r = [], i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Map(), o = (e) => {
+		let i = Pe(t, e, n);
+		return i !== null && r.push(i), i;
+	};
+	for (let t of e.getImportDeclarations()) if (o(t.getModuleSpecifierValue()), !t.isTypeOnly()) for (let e of t.getNamedImports()) e.isTypeOnly() || i.add(e.getName());
+	for (let t of e.getExportDeclarations()) {
+		let e = t.getModuleSpecifierValue();
+		if (e === void 0) continue;
+		let n = o(e);
+		if (n === null || t.isTypeOnly()) continue;
+		let r = t.getNamedExports();
+		if (r.length === 0) {
+			a.set(n, "*");
+			continue;
+		}
+		let i = r.filter((e) => !e.isTypeOnly()).map((e) => e.getAliasNode()?.getText() ?? e.getName()), s = a.get(n);
+		a.set(n, s === "*" ? "*" : [...s ?? [], ...i]);
+	}
+	for (let t of e.getDescendantsOfKind(j.CallExpression)) {
+		if (t.getExpression().getKind() !== j.ImportKeyword) continue;
+		let e = t.getArguments()[0];
+		e !== void 0 && k.isStringLiteral(e) && o(e.getLiteralValue());
+	}
+	return {
+		localTargets: r,
+		namedBindings: i,
+		reExports: a
+	};
+}, Ie = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e.getDescendantsOfKind(j.CallExpression)) {
+		let e = n.getExpression(), r = k.isPropertyAccessExpression(e) ? e.getName() : e.getText();
+		t.set(r, (t.get(r) ?? 0) + 1);
+	}
+	return t;
+}, Le = (e) => {
+	if (e.length <= 1) return e.length === 1;
+	let t = [...e].sort((e, t) => e.length - t.length)[0];
+	return e.every((e) => e.startsWith(t));
+}, Re = (e, t) => {
+	let n = b(t);
+	return e.startsWith(`${n}${w}`) || b(e) === n;
+}, U = (e) => {
+	let t = B(e);
+	if (t.length === 0) return {
+		findings: [],
+		declared: 0,
+		scanned: 0,
+		vendored: []
+	};
+	let n = be(e, t), r = t.filter((e) => !xe(e, n));
+	if (r.length === 0) return {
+		findings: [],
+		declared: 0,
+		scanned: 0,
+		vendored: n
+	};
+	let i = new A({
+		useInMemoryFileSystem: !0,
+		skipAddingFilesFromTsConfig: !0
+	}), a = [], o = (t) => S(e, t), s = /* @__PURE__ */ new Map(), c = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = /* @__PURE__ */ new Map();
+	for (let t of r) {
+		let n;
+		try {
+			n = E(t, "utf8");
+		} catch {
+			continue;
+		}
+		let r;
+		try {
+			r = i.createSourceFile(t.endsWith("x") ? "/scan.tsx" : "/scan.ts", n, { overwrite: !0 });
+		} catch {
+			continue;
+		}
+		s.set(t, je(r)), c.set(t, Fe(r, t, Ne(t, e, u))), l.set(t, Ie(r));
+	}
+	let d = /* @__PURE__ */ new Map();
+	for (let [e, t] of c) for (let n of t.localTargets) {
+		let t = d.get(n) ?? [];
+		t.push(e), d.set(n, t);
+	}
+	let p = (e) => {
+		let t = s.get(e), n = /* @__PURE__ */ new Set([
+			...t?.components ?? [],
+			...t?.hooks ?? [],
+			...t?.others ?? []
+		]), r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Set([e]), a = (e, t) => {
+			for (let o of d.get(e) ?? []) {
+				if (i.has(o)) continue;
+				let s = c.get(o);
+				if (s === void 0) continue;
+				let l = s.reExports.get(e);
+				if (l !== void 0) {
+					i.add(o), r.add(o);
+					let e = l === "*" ? t ?? n : new Set(l), s = t === null ? e : new Set([...e].filter((e) => t.has(e)));
+					s.size > 0 && a(o, s);
+					continue;
+				}
+				(t === null || [...s.namedBindings].some((e) => t.has(e))) && r.add(o);
+			}
+		};
+		return a(e, null), [...r];
+	}, m = 0;
+	for (let e of r) {
+		let t = R(e), n = s.get(e), r = c.get(e);
+		if (n === void 0 || r === void 0) continue;
+		let i = z(e);
+		t !== null && !i && (m += 1);
+		let u = d.get(e) ?? [];
+		if ((t === "component" || t === "component.ui") && !i) {
+			let t = Le(n.components);
+			(n.components.length === 0 || !t) && a.push({
+				rule: "component/one-per-file",
+				file: o(e),
+				severity: "error",
+				detail: n.components.length === 0 ? "declares a component file but exports no component" : `exports ${n.components.length} unrelated components: ${n.components.join(", ")}`,
+				fix: "a component file exports ONE component — or one NAMESPACED family sharing its name (`Card`, `CardHeader`, `CardTitle`), which is one component with parts. Types alongside are fine. Unrelated components belong in their own files"
+			}), n.hooks.length > 0 && a.push({
+				rule: "component/no-hook-export",
+				file: o(e),
+				severity: "error",
+				detail: `also exports hook(s): ${n.hooks.join(", ")}`,
+				fix: "move the hook into its own *.hook.ts — a file exporting both is two files wearing one name, and neither can be reused without dragging the other"
+			});
+		}
+		if (t === "hook" && !i && (n.hooks.length !== 1 && a.push({
+			rule: "hook/one-per-file",
+			file: o(e),
+			severity: "error",
+			detail: n.hooks.length === 0 ? "declares a hook file but exports no use* hook" : `exports ${n.hooks.length} hooks: ${n.hooks.join(", ")}`,
+			fix: "a hook file exports exactly ONE use* hook (types alongside are fine)"
+		}), n.components.length > 0 && a.push({
+			rule: "hook/no-component-export",
+			file: o(e),
+			severity: "error",
+			detail: `also exports component(s): ${n.components.join(", ")}`,
+			fix: "move the component into its own *.component.tsx"
+		})), t === "types" && n.hasRuntimeExport && a.push({
+			rule: "types/runtime-export",
+			file: o(e),
+			severity: "error",
+			detail: `exports runtime value(s): ${[
+				...n.components,
+				...n.hooks,
+				...n.others
+			].join(", ")}`,
+			fix: "a *.types.ts has NO runtime export. That is what makes importing it provably free AND makes it impossible for it to sit in a runtime import cycle — the guarantee is the point, so move the value to a sibling module"
+		}), t === "internal") {
+			let t = u.filter((t) => !Re(t, e));
+			t.length > 0 && a.push({
+				rule: "internal/foreign-import",
+				file: o(e),
+				severity: "error",
+				detail: `imported from outside its own directory by: ${t.slice(0, 5).map(o).join(", ")}${t.length > 5 ? ` (+${t.length - 5})` : ""}`,
+				fix: "export it through the feature's public module, or move the importer inside. `.internal` is the promise that refactoring within this directory breaks nobody — a foreign import revokes it silently, which is how a feature boundary rots without a single review comment"
+			});
+		}
+		if (t === "fixture") {
+			let t = u.filter((e) => !z(e) && R(e) !== "fixture");
+			t.length > 0 && a.push({
+				rule: "fixture/production-import",
+				file: o(e),
+				severity: "error",
+				detail: `imported by non-test file(s): ${t.slice(0, 5).map(o).join(", ")}`,
+				fix: "test material must not be reachable from a production path — it ships in the bundle, and it is written to be convenient rather than correct"
+			});
+		}
+		if (t === "component.ui" && !i) {
+			let t = [...r.namedBindings].filter((e) => we.has(e)).sort();
+			t.length > 0 && a.push({
+				rule: "ui/no-write",
+				file: o(e),
+				severity: "error",
+				detail: `imports write hook(s): ${t.join(", ")}`,
+				fix: "a *.component.ui.tsx renders; it does not write. Lift the mutation into the *.component.tsx that owns it and pass a handler down. Reading (useT / useCan / usePermissions) stays allowed — threading those through props is prop-drilling, not reusability"
+			});
+			let n = p(e), i = n.filter((e) => {
+				let t = R(e);
+				return t === "component" || t === "component.ui" || h.test(e) || f.has(e.slice(e.lastIndexOf(w) + 1));
+			});
+			n.length === 0 ? a.push({
+				rule: "ui/orphaned",
+				file: o(e),
+				severity: "warn",
+				detail: "nothing imports it",
+				fix: "render it from a *.component.tsx or a page, or delete it — an unrendered presentational component is carried, reviewed and refactored forever without reaching a user"
+			}) : i.length === 0 && a.push({
+				rule: "ui/unlinked",
+				file: o(e),
+				severity: "warn",
+				detail: `reached only by: ${n.slice(0, 5).map(o).join(", ")}${n.length > 5 ? ` (+${n.length - 5})` : ""} — barrels resolved through`,
+				fix: "a presentational component should be reached from a *.component.tsx, another *.component.ui.tsx, or a page"
+			});
+		}
+		if (t === "store" && !i) {
+			let t = l.get(e)?.get("defineStore") ?? 0;
+			t !== 1 && a.push({
+				rule: "store/one-per-file",
+				file: o(e),
+				severity: "error",
+				detail: t === 0 ? "declares a store file but calls no defineStore()" : `declares ${t} stores`,
+				fix: "a store file defines exactly ONE store — the SSR seed pass and devtools address stores by name, so two in a file makes both harder to find and neither easier to reason about"
+			});
+			let n = [...l.get(e)?.keys() ?? []].filter((e) => Ee.has(e)).sort();
+			n.length > 0 && a.push({
+				rule: "store/mirrors-server-state",
+				file: o(e),
+				severity: "error",
+				detail: `reads server state here: ${n.join(", ")}`,
+				fix: "a store holds CLIENT state. A subscription is already live server state; copying it into a store gives you a second copy that does not live, and the page then shows the stale one — a bug that reads as \"reactivity is broken\". Read the subscription where you render it"
+			});
+		}
+		if (t !== "tracking" && !i) {
+			let t = [...l.get(e)?.keys() ?? []].filter((e) => Te.has(e)).sort();
+			t.length > 0 && a.push({
+				rule: "tracking/outside-tracking-file",
+				file: o(e),
+				severity: "error",
+				detail: `calls ${t.join(", ")} outside a *.tracking.ts`,
+				fix: "move the defineTracking(...) spec into a *.tracking.ts and import it here. The event catalogue — names, property bags, the decisions about what personal data goes out — belongs in one place you can list; calling useTracking with a spec from there is fine"
+			});
+		}
+		if (Ce.find((e) => e.id === t)?.needsTest === !0 && !i) {
+			let t = e.replace(/\.tsx?$/, ""), n = e.endsWith("x") ? "tsx" : "ts";
+			["test", "spec"].flatMap((e) => [`${t}.${e}.ts`, `${t}.${e}.tsx`]).some((e) => {
+				try {
+					return O(e).isFile();
+				} catch {
+					return !1;
+				}
+			}) || a.push({
+				rule: "convention/missing-test",
+				file: o(e),
+				severity: "warn",
+				detail: "no test beside it",
+				fix: `add ${o(t)}.test.${n} — the name is derivable, so write it with the file. A shallow test earns its place: what it buys is that something MOUNTS the component, and a render loop, a crashing effect or a missing provider is invisible until then. One app wrote 251 of these and the first run found a render loop that made a page take 423 s and exhaust the heap — in a browser it had looked usable`
+			});
+		}
+	}
+	return a.sort((e, t) => e.file === t.file ? e.rule.localeCompare(t.rule) : e.file.localeCompare(t.file)), {
+		findings: a,
+		declared: m,
+		scanned: r.length,
+		vendored: n
+	};
+}, ze = 10, Be = (e) => {
+	let { findings: t, declared: n, scanned: r, vendored: i } = U(e);
+	console.log("");
+	for (let t of Se(e, i)) console.log(`·  not ours, exempt: ${t}`);
+	if (r === 0) return console.log("•  file-taxonomy scan: no sources here — nothing to check."), 0;
+	if (t.length === 0) return console.log(`✓  file-taxonomy scan: ${n} declared file(s) keep their contract (${r} scanned).`), 0;
+	let a = /* @__PURE__ */ new Map();
+	for (let e of t) {
+		let t = a.get(e.rule) ?? [];
+		t.push(e), a.set(e.rule, t);
+	}
+	let o = t.filter((e) => e.severity === "error").length;
+	console.log(`•  file taxonomy: ${t.length} finding(s) — ${o} error, ${t.length - o} advisory (${n} declared / ${r} scanned):`);
+	for (let [e, t] of [...a].sort()) {
+		console.log(`   ${t[0].severity === "error" ? "✗" : "·"} ${e} (${t.length})`);
+		for (let e of t.slice(0, ze)) console.log(`       ${e.file} — ${e.detail}`);
+		let n = t.length - ze;
+		n > 0 && console.log(`       (+${n} more — \`voltro doctor --json\` prints every one.)`), console.log(`         → ${t[0].fix}`);
+	}
+	return t.length;
+}, Ve = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"isNull",
+	"isNotNull",
+	"inSet",
+	"notInSet",
+	"like",
+	"ilike",
+	"contains",
+	"startsWith",
+	"endsWith",
+	"between",
+	"jsonField"
+]), He = (e) => {
+	if (k.isPropertyAccessExpression(e)) return e.getName();
+	if (k.isIdentifier(e)) return e.getText();
+}, Ue = (e) => {
+	let t = e;
+	for (; k.isCallExpression(t);) {
+		let e = t.getExpression();
+		if (!k.isPropertyAccessExpression(e)) break;
+		t = e.getExpression();
+	}
+	return t;
+}, We = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new A({
+		useInMemoryFileSystem: !0,
+		skipAddingFilesFromTsConfig: !0
+	});
+	for (let t of e) {
+		let e;
+		try {
+			let n = E(t, "utf8");
+			if (!n.includes(".where(") && !n.includes(".select(")) continue;
+			e = s.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
+		} catch {
+			continue;
+		}
+		let c = S(n, t);
+		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
+			let e = t.getExpression();
+			if (!k.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
+			let n = He(Ue(e.getExpression()));
+			if (n === void 0 || !r.has(n)) {
+				let t = e.getExpression();
+				if (k.isCallExpression(t)) {
+					let e = t.getExpression();
+					if (k.isPropertyAccessExpression(e) && e.getName() === "select") {
+						let e = t.getArguments()[0];
+						e !== void 0 && k.isStringLiteral(e) && (n = e.getLiteralValue());
+					}
+				}
+			}
+			if (n === void 0) continue;
+			let s = r.get(n);
+			if (s === void 0) continue;
+			let l = [], [u] = t.getArguments();
+			if (u !== void 0) {
+				if (k.isStringLiteral(u)) l.push({
+					column: u.getLiteralValue(),
+					line: u.getStartLineNumber()
+				});
+				else for (let e of [u, ...u.getDescendantsOfKind(j.CallExpression)]) {
+					if (!k.isCallExpression(e)) continue;
+					let t = e.getExpression(), n = k.isIdentifier(t) ? t.getText() : k.isPropertyAccessExpression(t) ? t.getName() : void 0;
+					if (n === void 0 || !Ve.has(n)) continue;
+					let r = e.getArguments()[0];
+					r !== void 0 && k.isStringLiteral(r) && l.push({
+						column: r.getLiteralValue(),
+						line: r.getStartLineNumber()
+					});
+				}
+				for (let { column: e, line: t } of l) o++, !s.has(e) && a.push({
+					file: c,
+					line: t,
+					table: n,
+					column: e,
+					available: i.get(n) ?? []
+				});
+			}
+		}
+	}
+	return {
+		issues: a,
+		checked: o
+	};
+}, W = 12, Ge = (e) => {
+	if (e.checked === 0) return null;
+	if (e.issues.length === 0) return `predicate columns: ${e.checked} checked — every filtered column exists on its table`;
+	let t = [`predicate columns: ${e.issues.length} filter${e.issues.length, "s"} on a column that does not exist (${e.checked} checked)`];
+	for (let n of e.issues) {
+		let e = n.available.slice(0, W).join(", "), r = n.available.length > W ? `, … (${n.available.length - W} more)` : "";
+		t.push(`  ${n.file}:${n.line}  '${n.table}' has no column '${n.column}'`), t.push(`    columns: ${e}${r}`);
+	}
+	return t.push("  This type-checks today and fails at runtime as a bare SQL error."), t.join("\n");
+}, Ke = /* @__PURE__ */ new Set([
+	"id",
+	"tenantId",
+	"tenant_id",
+	"traceId",
+	"trace_id",
+	"spanId",
+	"span_id",
+	"requestId",
+	"request_id",
+	"sessionId",
+	"session_id",
+	"correlationId",
+	"correlation_id",
+	"externalId",
+	"external_id",
+	"idempotencyId",
+	"idempotency_id",
+	"idempotencyKey",
+	"idempotency_key"
+]), qe = /* @__PURE__ */ new Set([
+	"id",
+	"createdAt",
+	"created_at",
+	"updatedAt",
+	"updated_at",
+	"deletedAt",
+	"deleted_at",
+	"tenantId",
+	"tenant_id"
+]), Je = (e) => Ke.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), Ye = (e) => e.type === "reference", Xe = (e) => {
+	let t = [];
+	for (let n of e) {
+		let e = n.columns.filter((e) => Je(e.name)), r = e.filter((e) => !Ye(e)).map((e) => e.name);
+		if (r.length === 0) continue;
+		let i = new Set(n.primaryKey), a = r.filter((e) => i.has(e));
+		if (n.primaryKey.length >= 2 && a.length > 0) {
+			t.push({
+				table: n.name,
+				columns: a,
+				signal: "composite-pk"
+			});
+			continue;
+		}
+		if (e.some(Ye) && e.length >= 2) {
+			t.push({
+				table: n.name,
+				columns: r,
+				signal: "reference-sibling"
+			});
+			continue;
+		}
+		e.length >= 2 && n.columns.filter((e) => !Je(e.name) && !qe.has(e.name)).length === 0 && t.push({
+			table: n.name,
+			columns: r,
+			signal: "link-only"
+		});
+	}
+	return {
+		issues: t,
+		tablesChecked: e.length
+	};
+}, Ze = {
+	"composite-pk": "part of a composite primary key",
+	"reference-sibling": "sits beside a wired reference() on this table",
+	"link-only": "this table is nothing but link columns"
+}, Qe = (e) => {
+	if (e.tablesChecked === 0) return null;
+	if (e.issues.length === 0) return `junction FKs: ${e.tablesChecked} table${e.tablesChecked === 1 ? "" : "s"} checked — every link column is a wired reference()`;
+	let t = e.issues.length, n = [`junction FKs: ${t} junction table${t === 1 ? "" : "s"} with an id column that is a plain text() and not a reference()`];
+	for (let t of e.issues) {
+		let e = t.columns.map((e) => `'${e}'`).join(", ");
+		n.push(`  '${t.table}': ${e} (${Ze[t.signal]})`);
+	}
+	return n.push("  Declare each as reference(() => <table>): the FK is enforced, the column is auto-indexed,"), n.push("  and the relationship becomes walkable (a plain text() id column is an invisible edge)."), n.join("\n");
+}, $e = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), et = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), tt = (e) => et(e).some((e) => $e.has(e)), nt = (e) => {
+	let t = [], n = [];
+	for (let r of e) t.push({
+		event: r.name,
+		delivery: r.delivery
+	}), r.keyFieldCount >= 3 && n.push({
+		event: r.name,
+		kind: "wide-key",
+		keyFieldCount: r.keyFieldCount
+	}), r.hasWebhook && tt(r.name) && n.push({
+		event: r.name,
+		kind: "webhook-high-rate"
+	});
+	return {
+		eventsChecked: e.length,
+		modes: t,
+		warnings: n
+	};
+}, rt = (e) => {
+	if (e.eventsChecked === 0) return null;
+	let t = e.eventsChecked, n = [`event delivery: ${t} declared event${t === 1 ? "" : "s"} — the mode decides what a MISSING message means`];
+	for (let t of e.modes) n.push(`  '${t.event}': ${t.delivery}`);
+	return n.push("  each   — every delivery matters; a slow subscriber loses the oldest and is TOLD how many (the default)."), n.push("  latest — a newer delivery supersedes a pending one; a slow subscriber gets the current value, told nothing."), n.push("  Two events with identical route/subscriber/buffer numbers mean OPPOSITE things about a drop — the mode is the difference."), n.join("\n");
+}, it = (e) => {
+	if (e.warnings.length === 0) return null;
+	let t = e.warnings.length, n = [`events that may not scale as declared: ${t} finding${t === 1 ? "" : "s"}`];
+	for (let t of e.warnings) t.kind === "wide-key" ? (n.push(`  '${t.event}': routing key has ${t.keyFieldCount ?? 0} fields — every field FRAGMENTS the subscriber set (distinct routes are the PRODUCT of the fields’ value spaces).`), n.push("     Check each is an ADDRESS the delivery is decided by (arenaId), not a discriminator the handler reads (gameType) — the latter is payload, not key.")) : (n.push(`  '${t.event}': a webhook block on a per-frame-looking event — every publish is N HTTP deliveries per second per subscribed target.`), n.push("     The webhook rate limit DEFERS the excess as pending rows rather than failing, so the symptom is a growing table. Publish a coarser event (a summary / state change) for the outside world."));
+	return n.push("  WARNING, not a fault — a producer may intend the fan-out. `voltro doctor --json` prints every finding."), n.join("\n");
+}, at = /* @__PURE__ */ new Set([
+	"start",
+	"run",
+	"child"
+]), ot = (e) => k.isCallExpression(e) && (() => {
+	let t = e.getExpression();
+	if (!k.isPropertyAccessExpression(t) || !at.has(t.getName())) return !1;
+	let n = t.getExpression();
+	return k.isPropertyAccessExpression(n) ? n.getName() === "workflows" : k.isIdentifier(n) && n.getText() === "workflows";
+})(), st = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new A({
+		useInMemoryFileSystem: !0,
+		skipAddingFilesFromTsConfig: !0
+	});
+	for (let t of e) {
+		let e;
+		try {
+			let n = E(t, "utf8");
+			if (!n.includes("workflows.")) continue;
+			e = l.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
+		} catch {
+			continue;
+		}
+		let u = S(n, t);
+		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
+			if (!ot(t)) continue;
+			c++;
+			let e = t.getStartLineNumber(), [n, l] = t.getArguments();
+			if (n === void 0 || !k.isStringLiteral(n)) {
+				o.push({
+					file: u,
+					line: e,
+					reason: "workflow name is not a literal"
+				});
+				continue;
+			}
+			let d = n.getLiteralValue(), f = r.get(d);
+			if (f === void 0) {
+				a.push({
+					kind: "unknown-workflow",
+					file: u,
+					line: e,
+					name: d,
+					known: i
+				});
+				continue;
+			}
+			if (l === void 0 || !k.isObjectLiteralExpression(l)) {
+				o.push({
+					file: u,
+					line: e,
+					reason: "payload is not an object literal"
+				});
+				continue;
+			}
+			if (l.getProperties().some((e) => k.isSpreadAssignment(e))) {
+				o.push({
+					file: u,
+					line: e,
+					reason: "payload spreads a value"
+				});
+				continue;
+			}
+			let p = /* @__PURE__ */ new Set(), m = !1;
+			for (let e of l.getProperties()) if (k.isPropertyAssignment(e) || k.isShorthandPropertyAssignment(e)) {
+				let t = (k.isPropertyAssignment(e), e.getNameNode());
+				if (k.isComputedPropertyName(t)) {
+					m = !0;
+					break;
+				}
+				p.add(e.getName().replace(/^['"]|['"]$/g, ""));
+			} else (k.isMethodDeclaration(e) || k.isGetAccessorDeclaration(e)) && p.add(e.getName());
+			if (m) {
+				o.push({
+					file: u,
+					line: e,
+					reason: "payload is not an object literal"
+				});
+				continue;
+			}
+			s++;
+			let h = f.required.filter((e) => !p.has(e));
+			h.length > 0 && a.push({
+				kind: "missing-fields",
+				file: u,
+				line: e,
+				name: d,
+				missing: h
+			});
+			let g = /* @__PURE__ */ new Set([...f.required, ...f.optional]);
+			if (g.size > 0) {
+				let t = [...p].filter((e) => !g.has(e));
+				t.length > 0 && a.push({
+					kind: "unknown-fields",
+					file: u,
+					line: e,
+					name: d,
+					unknown: t,
+					accepted: [...g].sort()
+				});
+			}
+		}
+	}
+	return {
+		issues: a,
+		unchecked: o,
+		checked: s,
+		callSites: c
+	};
+}, ct = (e) => {
+	if (e.callSites === 0) return null;
+	let t = [];
+	t.push(`workflow starts: ${e.checked}/${e.callSites} call sites checked`);
+	for (let n of e.issues) {
+		let e = `  ${n.file}:${n.line}`;
+		n.kind === "unknown-workflow" ? (t.push(`${e}  starts unknown workflow '${n.name}'`), t.push(`    registered: ${n.known.length > 0 ? n.known.join(", ") : "(none)"}`)) : n.kind === "missing-fields" ? t.push(`${e}  '${n.name}' payload is missing: ${n.missing.join(", ")}`) : (t.push(`${e}  '${n.name}' payload has unknown field(s): ${n.unknown.join(", ")}`), t.push(`    accepted: ${n.accepted.join(", ")}`));
+	}
+	if (e.unchecked.length > 0) {
+		t.push(`  ${e.unchecked.length} UNCHECKED (not verified — not a pass):`);
+		for (let n of e.unchecked) t.push(`    ${n.file}:${n.line} — ${n.reason}`);
+	}
+	return e.issues.length === 0 && e.unchecked.length === 0 && t.push("  every call site matches its workflow"), t.join("\n");
+}, lt = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, G = "VOLTRO_FIELD_ENCRYPTION_KEY", ut = (e) => {
+	let t;
+	for (let [n, r] of e.sources) if (t === void 0 && /\bfieldEncryption\b/.test(r) && (t = {
+		reason: "fieldEncryption",
+		file: n
+	}), t === void 0 && /\.encrypted\s*\(/.test(r) && (t = {
+		reason: "encrypted-column",
+		file: n
+	}), r.includes(G)) return;
+	if (t !== void 0) {
+		for (let [, t] of e.envFiles) if (t.includes(G)) return;
+		return t;
+	}
+}, dt = (e) => [
+	`✗  ${G} is named nowhere under this app root, and the app encrypts columns at rest`,
+	e.reason === "fieldEncryption" ? `   (\`fieldEncryption\` in ${e.file})` : `   (an \`.encrypted()\` column in ${e.file})`,
+	"",
+	"   A deploy without it does not degrade — it refuses to boot at `onActivate`,",
+	"   in the container, after you have pushed. Mint the key with",
+	"",
+	"       voltro secret generate field-encryption",
+	"",
+	"   and put it wherever the session secret already lives. LOSE THE KEY, LOSE",
+	"   THE DATA: a column encrypted under a key you no longer have has no",
+	"   recovery path, so it belongs in the same backup.",
+	"",
+	"   This checks only that the name appears SOMEWHERE in the repo. Whether it",
+	"   reaches your deploy target is not knowable from here — a secret manager",
+	"   or a CI variable is not a file. Naming it nowhere is conclusive; naming",
+	"   it somewhere is not a guarantee."
+].join("\n"), ft = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", pt = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, mt = (e) => {
+	let t = [], n = e;
+	for (let e = 0; e < 12; e++) {
+		let e = x(n, "node_modules");
+		T(e) && t.push(e);
+		let r = b(n);
+		if (r === n) break;
+		n = r;
+	}
+	return t;
+}, ht = (e) => {
+	try {
+		let t = JSON.parse(E(x(e, "package.json"), "utf8"));
+		return typeof t.version == "string" ? t.version : void 0;
+	} catch {
+		return;
+	}
+}, gt = (e) => {
+	let t = [], n;
+	try {
+		n = D(e);
+	} catch {
+		return t;
+	}
+	for (let r of n) {
+		if (r.startsWith(".") || pt.test(r)) continue;
+		let n = x(e, r);
+		if (r.startsWith("@")) {
+			let e;
+			try {
+				e = D(n);
+			} catch {
+				continue;
+			}
+			for (let i of e) t.push({
+				pkg: `${r}/${i}`,
+				dir: x(n, i)
+			});
+			continue;
+		}
+		try {
+			if (!O(n).isDirectory()) continue;
+		} catch {
+			continue;
+		}
+		t.push({
+			pkg: r,
+			dir: n
+		});
+	}
+	return t;
+}, _t = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of mt(e)) for (let { pkg: e, dir: r } of gt(n)) {
+		if (!ft(e)) continue;
+		let n = ht(r);
+		if (n === void 0) continue;
+		let i = t.get(e) ?? /* @__PURE__ */ new Map();
+		i.has(n) || i.set(n, r), t.set(e, i);
+	}
+	let n = [];
+	for (let [r, i] of t) i.size < 2 || n.push({
+		pkg: r,
+		versions: [...i.keys()].sort(),
+		paths: [...i.values()].map((t) => S(e, t)).sort()
+	});
+	return n.sort((e, t) => e.pkg.localeCompare(t.pkg));
+}, vt = (e) => {
+	if (e.length !== 0) return [
+		`•  ${e.length} package(s) resolved at more than one version:`,
+		...e.flatMap((e) => [`     ${e.pkg} — ${e.versions.join(", ")}`, ...e.paths.map((e) => `       ${e}`)]),
+		"",
+		"   Two copies of `effect` (or `@effect/*`) is the usual cause of type errors",
+		"   inside the GENERATED rpcGroup.generated.ts that look like framework bugs:",
+		"   \"Property '[TypeId]' is missing\", \"typeof Never is not assignable to All\",",
+		"   or an `Rpc<…, Stream<…>, …>` that will not go where `Any` is expected.",
+		"   Effect types are nominal, so a Schema built by one copy is not the same",
+		"   type as a Schema expected by the other — and the RUNTIME often still works,",
+		"   which is why this shows up as a red tsc against a green server.",
+		"",
+		"   Fix it in the install, not the code: align the version across the workspace",
+		"   (a root `pnpm.overrides` / `resolutions` entry for `effect` is the blunt",
+		"   instrument), then reinstall. Do not silence the generated file — it is where",
+		"   a genuine mistake in your own descriptors surfaces."
+	].join("\n");
+}, yt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), bt = /* @__PURE__ */ new Set([
+	"requireScope",
+	"requireAnyScope",
+	"requireAuth",
+	"assertScope",
+	"assertCan",
+	"can"
+]), xt = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of e) for (let e of yt(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
+	return t;
+}, St = (e, t) => {
+	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
+}, Ct = (e) => {
+	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
+	return t && n;
+}, wt = (e, t, n) => {
+	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
+	let r = yt(e.src), i = St(r, t);
+	return i === void 0 ? Ct(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+		kind: "vocabulary-guard",
+		name: i
+	};
+}, Tt = (e, t, n) => {
+	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
+	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
+}, Et = (e, t) => {
+	switch (t.kind) {
+		case "declared-guard": return "guards: on the descriptor";
+		case "vocabulary-guard": return `calls ${t.name}()`;
+		case "inline-ownership": return "compares the caller to the row and refuses — correct, but only this file knows it";
+		case "allowlisted": return "accepted by a previous run";
+		case "unchecked": return e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
+	}
+}, Dt = (e) => {
+	let t = e.executors.map((t) => {
+		let n = wt(t, e.guardVocabulary, e.allowlist);
+		return {
+			tag: t.tag,
+			path: t.path,
+			verdict: n,
+			severity: Tt(t, e.tenantScopedTables, e.referencedTables),
+			why: Et(t, n)
+		};
+	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
+	return {
+		findings: t,
+		counts: {
+			declaredGuard: n("declared-guard"),
+			vocabularyGuard: n("vocabulary-guard"),
+			inlineOwnership: n("inline-ownership"),
+			allowlisted: n("allowlisted"),
+			unchecked: n("unchecked")
+		},
+		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
+	};
+}, Ot = (e) => [
+	"# voltro doctor — authz allowlist",
+	"#",
+	"# Executors with no access check that a previous run accepted. This is DEBT,",
+	"# not approval: every line is an executor nobody has confirmed is safe.",
+	"#",
+	"# Doctor fails on any executor NOT listed here, so the list can only shrink",
+	"# unless someone adds a line deliberately. Delete a line once its executor",
+	"# has a guard — doctor reports it as guarded from then on, whether or not the",
+	"# line is still here.",
+	"",
+	...[...e].sort(),
+	""
+].join("\n"), kt = (e) => new Set(e.split("\n").map((e) => e.trim()).filter((e) => e.length > 0 && !e.startsWith("#"))), At = (e) => {
+	let t = e.indexOf(".");
+	return t <= 0 ? void 0 : e.slice(0, t);
+}, jt = (e, t) => {
+	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
+	for (let e of t.rpcTags) {
+		let t = At(e);
+		if (t === void 0) continue;
+		let n = i.get(t);
+		n ? n.push(e) : i.set(t, [e]);
+	}
+	let a = [];
+	for (let o of e) {
+		for (let e of o.tables) {
+			if (e.renamedFrom === void 0 || !n.has(e.renamedFrom)) continue;
+			let r = t.rowCounts?.[e.renamedFrom];
+			a.push({
+				kind: "renamed-from-yours",
+				plugin: o.plugin,
+				detail: `plugin table \`${e.tableName}\` declares .renamedFrom('${e.renamedFrom}'), which you also declare` + (r === void 0 ? "" : ` (${r} row${r === 1 ? "" : "s"})`),
+				fix: `your table keeps its rows and \`${e.tableName}\` is created EMPTY — that is intended, not a failed migration. ` + (o.canDisableTables ? "Pass `tables: false` if you want the plugin to bring no persistence at all." : "This plugin has no `tables` option, so its table is created either way; it is inert if nothing reads it."),
+				fatal: !1
+			});
+		}
+		let e = o.rpcTags.filter((e) => r.has(e));
+		if (e.length > 0) {
+			a.push({
+				kind: "rpc-tag-collision",
+				plugin: o.plugin,
+				detail: `rpc tag${e.length === 1 ? "" : "s"} ${e.map((e) => `\`${e}\``).join(", ")} ${e.length === 1 ? "is" : "are"} declared by BOTH this plugin and your app`,
+				fix: o.canAlias ? "pass `alias: '<prefix>'` to move the plugin's namespace." : "this plugin has no `alias` option — rename your procedure, or do not install it.",
+				fatal: !0
+			});
+			continue;
+		}
+		let s = new Set(o.rpcTags.map(At).filter((e) => e !== void 0));
+		for (let e of s) {
+			let t = i.get(e);
+			t !== void 0 && a.push({
+				kind: "rpc-namespace",
+				plugin: o.plugin,
+				detail: `rpc namespace \`${e}.*\` is shared with ${t.length} of your procedure${t.length === 1 ? "" : "s"}`,
+				fix: o.canAlias ? "pass `alias: '<prefix>'` so one namespace has one owner." : "this plugin has no `alias` option yet — the namespace stays split until it does.",
+				fatal: !1
+			});
+		}
+	}
+	return a;
+}, Mt = (e, t) => {
+	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
+	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
+	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
+	return r;
+}, Nt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), Pt = (e) => {
+	let t = y(e), n = v(e);
+	return {
+		root: e,
+		serveBundle: t,
+		serveBundlePresent: T(t),
+		apiBundle: n,
+		apiBundlePresent: T(n)
+	};
+}, Ft = [
+	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
+	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
+	"(Generated Dockerfiles from `voltro create-project` already do this.)"
+].join("\n  "), It = (e, t = !1) => {
+	let n = Pt(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Nt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
+	let r = process.env.NODE_ENV === "production";
+	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
+	let i = t || r;
+	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${Ft}`), +!!i;
+}, Lt = (e, t, n) => {
+	let r = new Set(e), i = I(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
+		`${e}.ts`,
+		`${e}.tsx`,
+		`${e}.js`,
+		`${e}.jsx`,
+		x(e, "index.ts"),
+		x(e, "index.tsx")
+	]).find((e) => r.has(e)), o = (e) => {
+		let n = (t.get(e) ?? "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), r = [];
+		for (let e of [
+			/(?:^|[\n;}])\s*(?:import|export)\s+[^;'"]*?\s+from\s+['"]([^'"]+)['"]/g,
+			/(?:^|[\n;}])\s*import\s+['"]([^'"]+)['"]/g,
+			/\bimport\(\s*['"]([^'"]+)['"]\s*\)/g
+		]) {
+			let t;
+			for (; (t = e.exec(n)) !== null;) r.push(t[1]);
+		}
+		let o = [];
+		for (let t of r) {
+			let n = t.startsWith(".") ? C(b(e), t) : ye(t, i);
+			if (n === void 0) continue;
+			let r = a(n);
+			r !== void 0 && o.push(r);
+		}
+		return o;
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Ut.test(S(n, e))), l = new Set(c);
+	for (; c.length > 0;) {
+		let e = c.shift();
+		if (!s.has(e)) {
+			s.add(e);
+			for (let t of o(e)) s.has(t) || c.push(t);
+		}
+	}
+	let u = /* @__PURE__ */ new Set();
+	for (let t of e) if (!s.has(t)) for (let e of o(t)) u.add(e);
+	let d = /* @__PURE__ */ new Set();
+	for (let e of s) l.has(e) || u.has(e) || d.add(e);
+	return d;
+}, Rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), zt = (e, t) => (e.match(t) ?? []).length, K = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, Bt = (e, t) => {
+	if (e.src.includes(t)) return !0;
+	let n = t.replace(/^@voltro\/plugin-/, "");
+	return n !== t && K(e.file, RegExp(`^${n}Plugin$`)) > 0;
+}, Vt = (e, t) => {
+	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
+	for (; (i = r.exec(e)) !== null;) {
+		let t = i.index + i[0].length, r = 1, a = t;
+		for (; a < e.length && r > 0; a++) e[a] === "(" ? r++ : e[a] === ")" && r--;
+		n.push(e.slice(t, a - 1));
+	}
+	return n;
+}, Ht = (e, t) => {
+	let n = t.getSymbol()?.getDeclarations()?.[0];
+	return n === void 0 ? [] : e.getDescendantsOfKind(j.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
+}, Ut = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Wt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Gt = [
+	"Id",
+	"ID",
+	"Hash",
+	"HASH",
+	"Digest",
+	"Fingerprint",
+	"Name",
+	"Type",
+	"Kind",
+	"Label",
+	"Prefix",
+	"Suffix",
+	"Status",
+	"State",
+	"Scope",
+	"Scopes",
+	"Algorithm",
+	"Algo",
+	"Version",
+	"Count",
+	"Note",
+	"Description",
+	"Comment",
+	"Provider",
+	"Format"
+], Kt = RegExp(`(?:${Gt.join("|")})$|_(?:${Gt.map((e) => e.toLowerCase()).join("|")})$`), qt = [
+	{
+		id: "executor-without-descriptor",
+		scope: "server",
+		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
+		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
+		match: ({ src: e, path: t }) => Wt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+	},
+	{
+		id: "subject-write-no-guard",
+		scope: "server",
+		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
+		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
+		match: ({ src: e, path: t }) => {
+			if (!Wt.test(t)) return !1;
+			let n = Rt(e);
+			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
+		}
+	},
+	{
+		id: "raw-fetch",
+		scope: "server",
+		smell: "raw fetch() for outbound HTTP on the server (no SSRF guard, no traceparent, no retry)",
+		use: "yield* HttpClient — the framework client. It blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop, injects traceparent, and honours `http.allowHosts` for deliberate internal targets",
+		match: ({ file: e, path: t, serverOnly: n }) => (Ut.test(t) || n) && K(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+	},
+	{
+		id: "form",
+		scope: "client",
+		smell: "per-field useState + a submit flag (hand-rolled form)",
+		use: "useFormBinding — fields + validation from the mutation input Schema; server ValidationError({ field }) routes to the field",
+		match: ({ src: e, file: t }) => K(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
+	},
+	{
+		id: "table",
+		scope: "client",
+		smell: "hand-rolled table with local sort/filter state",
+		use: "useDataTable — columns from the query output Schema, live rows, sort/filter/pagination",
+		match: ({ src: e }) => /<TableHeader|<TableBody/.test(e) && /sort(By|Key|Field|Direction)|setSort/i.test(e)
+	},
+	{
+		id: "upload",
+		scope: "client",
+		smell: "FileReader / base64 upload path",
+		use: "useUpload — progress + cancel, works on every storage provider (no base64 ceiling)",
+		match: ({ src: e }) => /new FileReader\(|readAsDataURL\(/.test(e)
+	},
+	{
+		id: "debounce",
+		scope: "client",
+		smell: "setTimeout debounce inside useEffect",
+		use: "useDebounced (and useAsyncValidation for checks that need the DB)",
+		match: ({ src: e }) => /useEffect\(/.test(e) && /setTimeout\(/.test(e) && /clearTimeout\(/.test(e)
+	},
+	{
+		id: "derived",
+		scope: "client",
+		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
+		use: "useDerived — dependency-tracked, referentially stable",
+		match: ({ src: e }) => zt(e, /\buseSubscription\s*[(<]/g) >= 3 && zt(e, /\buseMemo\s*\(/g) >= 3
+	},
+	{
+		id: "next-shim",
+		scope: "client",
+		smell: "local Next.js compat shim",
+		use: "the native @voltro/web exports (useSearchParams, redirect, notFound, useServerRequest, …)",
+		match: ({ src: e }) => /from\s+['"][^'"]*next-(compat|shims)/.test(e)
+	},
+	{
+		id: "presence",
+		scope: "client",
+		smell: "hand-rolled presence heartbeat/roster",
+		use: "@voltro/plugin-presence (server table + RPCs AND the client hook)",
+		plugin: "@voltro/plugin-presence",
+		match: ({ src: e }) => /presence/i.test(e) && /heartbeat/i.test(e)
+	},
+	{
+		id: "subscription-undefined-check",
+		scope: "client",
+		smell: "checking a subscription's `data === undefined` (or `!data`) instead of its `loading` / `idle` flag",
+		use: "branch on `loading` (and `idle` when you pass `skip`) — `loading` narrows `data`, so the settled branch needs no `?? []` and no `!`",
+		match: ({ file: e }) => e.getDescendantsOfKind(j.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
+			let t = e.getFirstAncestorByKind(j.VariableDeclaration)?.getNameNode();
+			return t === void 0 ? [] : k.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
+		}).some((t) => Ht(e, t).some((e) => {
+			let t = e.getParent();
+			if (k.isBinaryExpression(t)) {
+				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
+				return /^[!=]==?$/.test(n) && /^(undefined|null)$/.test(r.getText());
+			}
+			return k.isPrefixUnaryExpression(t) && t.getOperatorToken() === j.ExclamationToken;
+		}))
+	},
+	{
+		id: "row-not-found",
+		scope: "server",
+		smell: "hand-written not-found branch on rows[0]",
+		use: "branch fails with YOUR typed error → .maybeOne(builder) and keep the Effect.fail (removes the rows[0] hop, error contract unchanged); branch throws something generic → .one(), which raises the typed NoRowFound on zero rows AND on more than one",
+		match: ({ src: e }) => /if\s*\(\s*!\s*[A-Za-z_$][\w$]*\s*\[\s*0\s*\]\s*\)/.test(e) || /if\s*\(\s*[A-Za-z_$][\w$]*\s*\[\s*0\s*\]\s*===?\s*(undefined|null)\s*\)/.test(e) || /\bstore\.query\s*\(/.test(e) && /if\s*\(\s*[A-Za-z_$][\w$]*\s*\.length\s*===?\s*0\s*\)/.test(e)
+	},
+	{
+		id: "row-value-read",
+		scope: "server",
+		smell: "first row bound to a variable (const x = rows[0]) — the same hop, without a not-found branch",
+		use: ".maybeOne(builder) — typed first-or-null, drops the array hop entirely; .one() if the row is genuinely required and a typed NoRowFound is acceptable to the caller",
+		match: ({ src: e }) => /\bstore\.query\s*\(/.test(e) && (/\b(?:const|let)\s+[A-Za-z_$][\w$]*\s*=\s*[A-Za-z_$][\w$]*[Rr]ows\s*\[\s*0\s*\]/.test(e) || /\breturn\s+[A-Za-z_$][\w$]*[Rr]ows\s*\[\s*0\s*\]/.test(e))
+	},
+	{
+		id: "n-plus-one",
+		scope: "server",
+		smell: "several sequential store reads assembling related data (an N+1 you are writing by hand)",
+		use: "reads are a parent→child walk on ONE key → relations() in a *.relations.ts + .with({ … }) (ONE JSON-aggregate query, every dialect); reads collect ids from SEVERAL sources → keep the assembly and run the independent leading reads under Effect.all (same queries, same results, only concurrent — zero parity risk)",
+		match: (e) => K(e.file, /\bstore\.query$/) >= 3 || K(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
+	},
+	{
+		id: "store-effect-lift",
+		scope: "server",
+		smell: "ctx.store lifted into Effect with Effect.promise / Effect.tryPromise",
+		use: "yield* EffectStore — its failures land on the typed StoreError channel instead of becoming a defect",
+		match: ({ src: e }) => /Effect\.(promise|tryPromise)\s*\(\s*(\{[^}]*try:\s*)?\(\s*\)\s*=>\s*ctx\.store\./.test(e)
+	},
+	{
+		id: "imperative-scope",
+		scope: "server",
+		smell: "imperative scope check at the top of an executor",
+		use: "guards: on the descriptor — enforced BEFORE the executor (and before a mutation opens its transaction), typed ScopeError. A check that needs a LOADED row is still declarative: a policy guard names { action, resourceType, resource } and the registered resolver loads the row (an app whose relationships live in its own tables registers its own tuple source). Keep ctx.access for what genuinely cannot be answered before the handler runs",
+		match: ({ src: e }) => /\b(requireScope|assertScope|ensureScope)\s*\(/.test(e)
+	},
+	{
+		id: "plaintext-secret",
+		scope: "server",
+		smell: "a credential-shaped column stored without field encryption",
+		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
+		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
+			let n = t[1];
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Kt.test(n) || /^vault/i.test(n) ? !1 : !/\.encrypted\s*\(/.test(e);
+		}))
+	},
+	{
+		id: "mutation-tail-effect",
+		scope: "server",
+		smell: "a notify / webhook helper called at the tail of a mutation",
+		use: "defineSubscriber (*.subscribe.ts) or defineReaction (*.reaction.tsx) — declarative, post-commit, with the old/new diff, instead of reactivity hidden inside every executor",
+		match: ({ src: e, path: t }) => /\b(notify|sendNotification|sendWebhook|dispatchWebhook|trigger[A-Z]\w*)\s*\(/.test(e) && (/\bexport\s+default\b/.test(e) || /\.(mutation|action)\.server\.tsx?$/.test(t))
+	},
+	{
+		id: "hand-cursor",
+		scope: "server",
+		smell: "hand-rolled cursor pagination (limit+1 / slice / hasMore)",
+		use: "paginateById — the cursor, the over-fetch probe and hasMore in one call",
+		match: ({ src: e }) => /\bhasMore\b/.test(e) && /(limit|take|pageSize)\s*\+\s*1/.test(e)
+	},
+	{
+		id: "offset-pagination",
+		scope: "server",
+		smell: "OFFSET pagination (`input.offset` / `.skip(...)`) — O(n) in the page number",
+		use: "paginateBy / paginateById — keyset pagination, constant-time per page. Sortable ids (typeid/ulid) need no schema change",
+		match: ({ src: e, path: t }) => /\.(query|stream)\.server\.tsx?$/.test(t) && (/\.offset\s*\(/.test(e) || /\binput\.offset\b/.test(e) || /\.skip\s*\(/.test(e))
+	},
+	{
+		id: "oauth-token-table",
+		scope: "server",
+		smell: "a hand-rolled per-user OAuth credential store (access/refresh token columns)",
+		use: "defineConnection({ kind: 'oauth2' }) — encrypted per-user token store, authorize/callback routes, refresh-before-use, useConnection + <ConnectAccount>",
+		match: ({ src: e, path: t }) => /\.(entity|schema)\.tsx?$|schema\.tsx?$/.test(t) && /\b(accessToken|refreshToken|access_token|refresh_token)\b/.test(e)
+	},
+	{
+		id: "non-incremental-aggregate",
+		scope: "server",
+		smell: "an aggregate rescanned in full on every refresh",
+		use: "incremental: true — count/sum/avg/min/max group-bys are maintained on write instead of rescanned",
+		match: ({ src: e, path: t }) => /\.aggregate\.tsx?$/.test(t) && /\b(count|sum|avg|min|max)\s*\(/.test(e) && !/\bincremental\s*:/.test(e)
+	},
+	{
+		id: "external-state-library",
+		scope: "client",
+		smell: "a third-party client state library (jotai / zustand / redux / mobx)",
+		use: "defineStore — reactive, participates in the subscription graph, no second runtime to keep in sync",
+		match: ({ src: e }) => /from\s+['"](jotai|zustand|mobx|@reduxjs\/toolkit|react-redux)(\/[^'"]*)?['"]/.test(e)
+	},
+	{
+		id: "hand-route-module",
+		scope: "client",
+		smell: "a hand-maintained route/url module",
+		use: ".framework/routes.generated — a per-route typed builder, so a renamed page is a compile error rather than a 404",
+		match: ({ src: e }) => /from\s+['"][^'"]*\/(routes|route-?paths|urls|app-?url)['"]/.test(e) && !/routes\.generated/.test(e)
+	},
+	{
+		id: "hand-permission-check",
+		scope: "client",
+		smell: "reading a permission bag by hand in a component",
+		use: "useCan / useCanAny / useResourceCan from @voltro/client — they read the SAME effective scopes the server guards on",
+		match: ({ src: e, path: t }) => /\.tsx$/.test(t) && /\bpermissions\s*[?.[]/.test(e) && !/\buseCan\b|\buseResourceCan\b/.test(e)
+	},
+	{
+		id: "unexercised-row-filter",
+		scope: "server",
+		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
+		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
+		match: ({ file: e, testSources: t }) => K(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
+			let t = Rt(e);
+			return Vt(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+		})
+	},
+	{
+		id: "hand-serialized-date",
+		scope: "server",
+		smell: "Date converted by hand on the way out of a handler",
+		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
+		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
+	}
+], Jt = (e) => J(e), Yt = (e, t) => {
+	let n = /* @__PURE__ */ new Set();
+	for (let r of t) {
+		let t = S(e, r), i = t.split(/[\\/]/)[0];
+		n.add(i !== void 0 && i !== t ? i : ".");
+	}
+	return [...n].sort();
+}, Xt = /\.(tsx?|jsx?)$/, q = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Zt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Qt = (e, t = [], n = 0) => {
+	if (n > 12 || q.test(e)) return t;
+	let r;
+	try {
+		r = D(e, { withFileTypes: !0 });
+	} catch {
+		return t;
+	}
+	for (let i of r) {
+		let r = x(e, i.name);
+		if (i.isDirectory()) {
+			if (i.name.startsWith(".")) continue;
+			Qt(r, t, n + 1);
+		} else lt.test(i.name) && t.push(r);
+	}
+	return t;
+}, J = (e, t = [], n = 0) => {
+	if (n > 12 || q.test(e)) return t;
+	let r;
+	try {
+		r = D(e);
+	} catch {
+		return t;
+	}
+	for (let i of r) {
+		let r = x(e, i), a;
+		try {
+			a = O(r);
+		} catch {
+			continue;
+		}
+		a.isDirectory() ? J(r, t, n + 1) : Xt.test(i) && !/\.(test|spec)\./.test(i) && !Zt.test(i) && t.push(r);
+	}
+	return t;
+}, $t = (e, t = [], n = 0) => {
+	if (n > 12 || q.test(e)) return t;
+	let r;
+	try {
+		r = D(e);
+	} catch {
+		return t;
+	}
+	for (let i of r) {
+		let r = x(e, i), a;
+		try {
+			a = O(r);
+		} catch {
+			continue;
+		}
+		a.isDirectory() ? $t(r, t, n + 1) : Xt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+	}
+	return t;
+}, en = (e) => {
+	let t = Jt(e);
+	return {
+		dirs: Yt(e, t),
+		fileCount: t.length
+	};
+}, tn = (e) => {
+	let t = Jt(e);
+	if (t.length === 0) return [];
+	let n = new A({
+		useInMemoryFileSystem: !0,
+		skipAddingFilesFromTsConfig: !0
+	}), r = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
+	for (let e of t) try {
+		i.set(e, E(e, "utf8"));
+	} catch {}
+	let a = Lt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
+	for (let t of $t(e)) try {
+		o.set(t, E(t, "utf8"));
+	} catch {}
+	for (let s of t) {
+		let t = i.get(s);
+		if (t === void 0) continue;
+		let c;
+		try {
+			c = {
+				src: t,
+				file: n.createSourceFile(`/scan${s.endsWith("x") ? ".tsx" : ".ts"}`, t, { overwrite: !0 }),
+				path: S(e, s),
+				serverOnly: a.has(s),
+				testSources: o
+			};
+		} catch {
+			continue;
+		}
+		for (let t of qt) {
+			if (t.plugin !== void 0 && Bt(c, t.plugin) || !t.match(c)) continue;
+			let n = r.get(t.id) ?? [];
+			n.push(S(e, s)), r.set(t.id, n);
+		}
+	}
+	return qt.filter((e) => r.has(e.id)).map((e) => ({
+		rule: e,
+		files: r.get(e.id)
+	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
+}, nn = (e) => {
+	let t = en(e);
+	return {
+		root: e,
+		scannedFiles: t.fileCount,
+		scannedDirs: t.dirs,
+		findings: tn(e).map(({ rule: e, files: t }) => ({
+			id: e.id,
+			scope: e.scope,
+			smell: e.smell,
+			use: e.use,
+			files: t
+		}))
+	};
+}, rn = 3, an = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of J(e)) try {
+		t.set(S(e, n), E(n, "utf8"));
+	} catch {}
+	let n = /* @__PURE__ */ new Map();
+	for (let t of Qt(e)) try {
+		n.set(S(e, t), E(t, "utf8"));
+	} catch {}
+	let r = ut({
+		sources: t,
+		envFiles: n
+	});
+	r !== void 0 && (console.log(""), console.log(dt(r)));
+}, on = (e) => {
+	let t = nn(e);
+	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
+	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
+	console.log(`\u2022  Shipped primitives you may be hand-rolling (scanned ${t.scannedFiles} files across ${t.scannedDirs.join(", ")}):`);
+	let n = 0;
+	for (let e of ["server", "client"]) {
+		let r = t.findings.filter((t) => t.scope === e);
+		if (r.length !== 0) {
+			console.log(`   [${e}]`);
+			for (let e of r) {
+				let t = e.files.slice(0, rn).join(", "), r = e.files.length - rn;
+				r > 0 && (n += r);
+				let i = r > 0 ? `, +${r} more` : "";
+				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${t}${i}`), console.log(`     \u2192 ${e.use}`);
+			}
+		}
+	}
+	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
+}, sn = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", cn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, ln = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, un = (e) => {
+	let t = cn.exec(e)?.[1];
+	if (t !== void 0) return t === "ssr" ? "ssr" : null;
+	let n = ln.exec(e)?.[1];
+	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
+}, dn = async (e) => {
+	let n = x(e, "src", "pages");
+	if (!T(n)) return [];
+	let { pages: a, dirs: o } = await t(n), s = [];
+	for (let t of a) {
+		if (!i(o, t.dirChain).some((e) => e.hasLayout)) continue;
+		let a;
+		try {
+			a = E(x(n, t.file), "utf8");
+		} catch {
+			continue;
+		}
+		if (r.test(a)) continue;
+		let c = un(a);
+		c !== null && s.push({
+			file: S(e, x(n, t.file)),
+			pattern: t.pattern,
+			currentMode: c
+		});
+	}
+	return s;
+}, fn = 10, pn = async (e) => {
+	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let t = await dn(e);
+	if (t.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
+	console.log(`•  renderMode:'spa' candidates (${t.length} page${t.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
+	for (let e of t.slice(0, fn)) {
+		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
+		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
+	}
+	let n = t.length - fn;
+	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${sn}`), t.length;
+}, mn = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist",
+	"build",
+	".turbo",
+	".vite",
+	".framework",
+	".git"
+]), hn = (e, t, n) => {
+	let r;
+	try {
+		r = D(e, { withFileTypes: !0 });
+	} catch {
+		return;
+	}
+	for (let i of r) {
+		if (mn.has(i.name)) continue;
+		let r = x(e, i.name);
+		i.isDirectory() ? hn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
+	}
+}, gn = (e, t) => {
+	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
+	for (let i of t) {
+		let t;
+		try {
+			t = E(x(e, i), "utf8");
+		} catch {
+			continue;
+		}
+		let a = b(x(e, i));
+		for (let i of t.matchAll(r)) {
+			let t = C(a, i[1]);
+			for (let r of [
+				t,
+				`${t}.tsx`,
+				`${t}.ts`,
+				x(t, "index.tsx"),
+				x(t, "index.ts")
+			]) if (T(r) && O(r).isFile()) {
+				n.add(S(e, r));
+				break;
+			}
+		}
+	}
+	return n;
+}, _n = (e, t) => {
+	let n = e.slice(t.length).split(w).slice(0, -1)[0];
+	return n !== void 0 && n.startsWith("[");
+}, Y = (t) => {
+	let n = [], r = x(t, "src", "pages"), i = x(t, "src");
+	if (!T(i)) return n;
+	let a = [];
+	hn(i, t, a), a.sort();
+	let o = `${S(t, r)}${w}`;
+	gn(t, a);
+	for (let r of a) {
+		let i = r.slice(r.lastIndexOf(w) + 1);
+		if (r.startsWith(o)) {
+			if (i !== "page.tsx") continue;
+			T(x(t, e(r))) || n.push({
+				kind: "page-without-test",
+				file: r
+			}), _n(r, o) && n.push({
+				kind: "top-level-dynamic-route",
+				file: r
+			});
+			continue;
+		}
+		i === "page.tsx" && n.push({
+			kind: "suffixed-outside-pages",
+			file: r
+		});
+	}
+	return n;
+}, X = 10, Z = (e, t, n) => {
+	if (t.length === 0) return;
+	console.log(`•  ${e} (${t.length}):`);
+	for (let e of t.slice(0, X)) console.log(`   ${e}`);
+	let r = t.length - X;
+	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
+}, vn = (e) => {
+	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let t = Y(e);
+	if (t.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
+	let n = (e) => t.filter((t) => t.kind === e).map((e) => e.file);
+	return Z("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), Z("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), Z("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), t.length;
+}, yn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", bn = /* @__PURE__ */ new Map(), Q = (e) => {
+	let t = bn.get(e);
+	if (t !== void 0) return t;
+	let n = (async () => {
+		let { walk: t, loadDiscovered: n } = await import("./dev-DeEJj5T4.js"), r = await t(e);
+		return {
+			files: r,
+			discovered: await n(r)
+		};
+	})();
+	return bn.set(e, n), n;
+}, xn = async (e) => {
+	let t;
+	try {
+		let { files: n, discovered: r } = await Q(e), i = r.tables.map((e) => {
+			let t = e;
+			return {
+				name: t.tableName,
+				columns: Object.keys(t.fields ?? {})
+			};
+		});
+		if (i.length === 0) return;
+		t = Ge(We(n, i, e));
+	} catch {
+		return;
+	}
+	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
+}, Sn = (e) => e.map((e) => {
+	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
+		name: e,
+		type: typeof t?.type == "string" ? t.type : ""
+	}));
+	return {
+		name: t.tableName,
+		columns: n,
+		primaryKey: t.appliedPrimaryKey ?? []
+	};
+}), Cn = async (e) => {
+	try {
+		let { discovered: t } = await Q(e);
+		return Xe(Sn(t.tables));
+	} catch {
+		return null;
+	}
+}, wn = async (e) => {
+	let t = await Cn(e);
+	if (t === null || t.tablesChecked === 0) return;
+	let n = Qe(t);
+	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
+}, Tn = async (e) => {
+	try {
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await Q(e);
+		return nt(n.events.map((e) => {
+			let n = e.descriptor, r = t(n.key);
+			return {
+				name: n.name,
+				delivery: n.delivery ?? "each",
+				keyFieldCount: r.required.length + r.optional.length,
+				hasWebhook: n.webhook !== void 0
+			};
+		}));
+	} catch {
+		return null;
+	}
+}, En = async (e) => {
+	let t = await Tn(e);
+	if (t === null || t.eventsChecked === 0) return;
+	let n = rt(t);
+	n !== null && (console.log(""), console.log(`•  ${n}`));
+	let r = it(t);
+	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
+}, Dn = (e) => {
+	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
+	return r === void 0 ? n : `${r}: ${n}`;
+}, On = async (e) => {
+	try {
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await Q(e)).discovered.serverOnlyLeaks, r = t(n);
+		return {
+			status: {
+				checked: !0,
+				leaks: n.length
+			},
+			...r === void 0 ? {} : { message: r }
+		};
+	} catch (e) {
+		return { status: {
+			checked: !1,
+			reason: Dn(e)
+		} };
+	}
+}, kn = async (e) => {
+	let { status: t, message: n } = await On(e);
+	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
+}, An = async (e) => {
+	let t;
+	try {
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await Q(e);
+		t = st(r, i.workflows.map((e) => {
+			let t = e.definition, r = t.payloadSchema === void 0 ? {
+				required: [],
+				optional: []
+			} : n(t.payloadSchema);
+			return {
+				name: t.name ?? "",
+				required: r.required,
+				optional: r.optional
+			};
+		}), e);
+	} catch {
+		return;
+	}
+	let n = ct(t);
+	if (n === null) return;
+	console.log("");
+	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
+	console.log(`${r}  ${n}`);
+}, $ = "voltro-authz-allowlist.txt", jn = (e, t = (e) => {
+	try {
+		return E(e, "utf8");
+	} catch {
+		return "";
+	}
+}) => /* @__PURE__ */ new Set([...bt, ...xt(J(e).map(t))]), Mn = async (e) => {
+	let { discovered: t } = await Q(e), n = [];
+	try {
+		let { loadApiConfig: t } = await import("./dev-DeEJj5T4.js");
+		n = ((await t(e))?.plugins ?? []).map((e) => {
+			let t = (e.extendSchema?.tables ?? []).map((e) => {
+				let t = e;
+				return {
+					tableName: typeof t.tableName == "string" ? t.tableName : "",
+					renamedFrom: typeof t.renamedFrom == "string" ? t.renamedFrom : void 0
+				};
+			}).filter((e) => e.tableName !== ""), n = (e.rpcClientDescriptors ?? []).map((e) => {
+				let t = e, n = t.descriptor?.name ?? t.name;
+				return typeof n == "string" ? n : "";
+			}).filter((e) => e !== "");
+			return {
+				plugin: e.name,
+				tables: t,
+				rpcTags: n,
+				canDisableTables: Nn.has(e.name),
+				canAlias: Pn.has(e.name)
+			};
+		});
+	} catch {
+		return;
+	}
+	if (n.length === 0) return;
+	let r = [
+		...t.queries,
+		...t.mutations,
+		...t.actions,
+		...t.streams ?? []
+	].map((e) => String(e.descriptor.name)), i = jt(n, {
+		tables: t.tables.map((e) => e.tableName),
+		rpcTags: r
+	});
+	console.log();
+	for (let e of Mt(n, i)) console.log(e);
+}, Nn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Pn = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), Fn = async (e, t) => {
+	let { discovered: n } = await Q(e), r = /* @__PURE__ */ new Map(), i = (e) => {
+		if (!r.has(e)) try {
+			r.set(e, E(e, "utf8"));
+		} catch {
+			r.set(e, "");
+		}
+		return r.get(e);
+	}, a = jn(e, i), o = /* @__PURE__ */ new Set();
+	for (let e of n.tables) for (let t of Object.values(e.fields ?? {})) try {
+		let e = t.references?.();
+		e && o.add(e.tableName);
+	} catch {}
+	let s = [
+		{
+			list: n.queries,
+			op: "read"
+		},
+		{
+			list: n.mutations,
+			op: "update"
+		},
+		{
+			list: n.actions,
+			op: "update"
+		},
+		{
+			list: n.streams,
+			op: "read"
+		}
+	].flatMap(({ list: e, op: t }) => e.map((e) => {
+		let n = e.descriptor, r = n.target, a = Array.isArray(r) ? r[0] : r, o = e.file.replace(/\.(tsx?)$/, ".server.$1");
+		return {
+			tag: String(n.name ?? e.file),
+			path: o,
+			src: i(o),
+			hasDeclaredGuards: Array.isArray(n.guards) && n.guards.length > 0,
+			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
+			...a?.table === void 0 ? {} : { table: a.table }
+		};
+	})), c = x(e, $), l = T(c) ? kt(E(c, "utf8")) : void 0, u = Dt({
+		executors: s,
+		guardVocabulary: a,
+		tenantScopedTables: n.tenantScopedTables,
+		referencedTables: o,
+		allowlist: l ?? /* @__PURE__ */ new Set()
+	}), d = u.counts;
+	console.log(`\nauthz scan · ${s.length} executor(s)`);
+	let f = [...a].filter((e) => !bt.has(e)).sort();
+	if (console.log(f.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${f.length} from your source (${f.slice(0, 6).join(", ")}${f.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(d.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(d.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(d.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(d.vocabularyGuard).padStart(4)}`), console.log(`  – accepted as recorded debt             ${String(d.allowlisted).padStart(4)}   (${$})`), t) return ne(c, Ot(u.unchecked.map((e) => e.tag)), "utf8"), console.log(`\nwrote ${u.unchecked.length} tag(s) to ${$}. Doctor now fails on ADDITIONS only.`), !1;
+	if (u.unchecked.length === 0) return !1;
+	console.log("");
+	for (let e of u.unchecked.slice(0, 20)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
+	return u.unchecked.length > 20 && console.log(`  … and ${u.unchecked.length - 20} more`), l === void 0 ? (console.log(`\nNo ${$} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${u.unchecked.length} executor(s) with no access check are not in ${$}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
+}, In = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(yn), 0;
+	let t = e.includes("--strict"), n = C(e.find((e) => !e.startsWith("-")) ?? process.cwd());
+	if (ie(e)) return re(), M({
+		...nn(n),
+		spaCandidates: await dn(n),
+		pageConvention: Y(n),
+		fileTaxonomy: U(n).findings,
+		junctionFks: (await Cn(n))?.issues ?? [],
+		eventDelivery: await Tn(n),
+		duplicateInstances: _t(n),
+		serverOnly: (await On(n)).status
+	}), 0;
+	let r = It(n, t);
+	on(n), an(n), vn(n), Be(n), await pn(n), await An(n), await xn(n), await wn(n), await En(n), await Mn(n);
+	let i = await kn(n), a = await Fn(n, e.includes("--write-authz-allowlist")), o = vt(_t(n));
+	return o !== void 0 && console.log(`\n${o}`), i || a ? Math.max(r, 1) : r;
+}, Ln = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Rn = /* @__PURE__ */ new Set([
+	"insert",
+	"update",
+	"delete",
+	"upsert"
+]), zn = (e, t) => {
+	let n = [], r = new Set(t.exercised), i = /* @__PURE__ */ new Map();
+	for (let e of t.edges) {
+		let t = i.get(e.tag);
+		t === void 0 ? i.set(e.tag, [e]) : t.push(e);
+	}
+	let a = [], o = [];
+	for (let t of e) {
+		if (!r.has(t.tag)) {
+			a.push(t.tag);
+			continue;
+		}
+		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(Ln(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
+		for (let t of c) if (Rn.has(t.op)) {
+			let r = u.get(t.table);
+			r === void 0 ? n.push({
+				rule: "observed/undeclared-write",
+				node: e,
+				...s === void 0 ? {} : { file: s },
+				breaks: [`writes '${t.table}' (${t.op}) but declares no target for it`, "subscriptions on that table are not invalidated by this mutation"],
+				fix: `add { table: '${t.table}', op: '${t.op}' } to this procedure's targets`,
+				severity: "warn"
+			}) : r !== t.op && n.push({
+				rule: "observed/wrong-op",
+				node: e,
+				...s === void 0 ? {} : { file: s },
+				breaks: [`declares op '${r}' on '${t.table}' but performed '${t.op}'`, "the synthesized optimistic patch has the wrong shape"],
+				fix: `change the target op for '${t.table}' to '${t.op}'`,
+				severity: "warn"
+			});
+		} else !l.has(t.table) && !u.has(t.table) && n.push({
+			rule: "observed/undeclared-read",
+			node: e,
+			...s === void 0 ? {} : { file: s },
+			breaks: [`reads '${t.table}' but declares no source for it`],
+			fix: `add '${t.table}' to this procedure's source`,
+			severity: "warn"
+		});
+		if (c.length === 0) {
+			o.push(t.tag);
+			continue;
+		}
+		let d = new Set(c.map((e) => e.table));
+		for (let t of l) d.has(t) || n.push({
+			rule: "observed/declared-but-unobserved",
+			node: e,
+			...s === void 0 ? {} : { file: s },
+			breaks: [`declares source '${t}' but never read it while running`],
+			fix: `remove '${t}' from source, or check whether the handler still reads it`,
+			severity: "warn"
+		});
+		for (let [t] of u) d.has(t) || n.push({
+			rule: "observed/declared-but-unobserved",
+			node: e,
+			...s === void 0 ? {} : { file: s },
+			breaks: [`declares target '${t}' but never wrote it while running`],
+			fix: `remove the '${t}' target, or check whether the handler still writes it`,
+			severity: "warn"
+		});
+	}
+	return {
+		diagnostics: n,
+		unexercised: a.sort(),
+		unobservedReads: o.sort(),
+		coverage: {
+			exercised: e.length - a.length - o.length,
+			total: e.length
+		}
+	};
+}, Bn = (e, t = [], n = 0) => {
+	if (n > 12) return t;
+	let r;
+	try {
+		r = D(e);
+	} catch {
+		return t;
+	}
+	for (let i of r) {
+		if ([
+			"node_modules",
+			"dist",
+			"build",
+			".framework",
+			".turbo",
+			".git",
+			"coverage"
+		].includes(i)) continue;
+		let r = `${e}/${i}`, a;
+		try {
+			a = O(r);
+		} catch {
+			continue;
+		}
+		a.isDirectory() ? Bn(r, t, n + 1) : a.isFile() && o.test(i) && t.push(r);
+	}
+	return t;
+}, Vn = /* @__PURE__ */ new Set(["actors", "tenants"]), Hn = async (e) => {
+	try {
+		let { readFile: t } = await import("node:fs/promises"), { join: n } = await import("node:path"), r = await t(n(e, "app.graph.observed.generated.json"), "utf8"), i = JSON.parse(r);
+		return i?.version !== 1 || !Array.isArray(i.edges) || !Array.isArray(i.exercised) ? null : i;
+	} catch {
+		return null;
+	}
+}, Un = (e) => {
+	let { exercised: t, total: n } = e.coverage, r = `\nobserved: ${t}/${n} procedures exercised (${n === 0 ? 0 : Math.round(t / n * 100)}%)`;
+	if (e.diagnostics.length === 0) return `${r}\n  no declared/observed mismatches${e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : ""}`;
+	let i = e.diagnostics.map((e) => `  ${e.node}${e.file === void 0 ? "" : ` (${e.file})`}\n` + e.breaks.map((e) => `    ${e}`).join("\n") + `\n    fix: ${e.fix}`), a = e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : "";
+	return `${r}\n${i.join("\n")}${a}`;
+}, Wn = (e, t) => ({
+	tables: (t.tables ?? []).map((e) => e.name),
+	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || Vn.has(e.name)).map((e) => e.name),
+	scopes: e.scopes ?? [],
+	procedures: (e.procedures ?? []).map((e) => {
+		let t = (e.guards ?? []).flatMap((e) => e.kind === "scope" ? e.scope ?? [] : []);
+		return {
+			tag: e.tag,
+			kind: e.kind,
+			...e.source === void 0 ? {} : { source: e.source },
+			...e.targets === void 0 ? {} : { targets: e.targets },
+			...t.length > 0 ? { requiresScopes: [...new Set(t)] } : {},
+			...e.guards === void 0 ? {} : { hasGuards: e.guards.length > 0 }
+		};
+	})
+}), Gn = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
+	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
+	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
+}).join("\n"), Kn = async (e) => {
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-DeEJj5T4.js"), { buildRpcEntry: i } = await import("./manifestBuild-Ck_90gZy.js"), { buildCapabilityManifest: a } = await import("./inspect-DHeaMZak.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
+		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
+		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
+		...s.streams.map((e) => c(e.descriptor, "stream", e.file))
+	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-BTNirAAk.js"), d = await u({ root: e }).catch(() => []), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
+		name: e,
+		framework: !0
+	}))], m = await r(e).then((e) => e?.plugins ?? []).catch(() => []);
+	return {
+		manifest: a(l, s.workflows.map((t) => ({
+			tag: t.definition.name ?? "",
+			file: o(e, t.file)
+		})), [], m),
+		tables: { tables: p }
+	};
+}, qn = async (e) => {
+	let t = ue(e.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]));
+	if ("error" in t) return console.error(`voltro check: ${t.error}`), 1;
+	let { process: n, target: r, rest: i } = de(t.rest), o;
+	for (let e = 0; e < i.length; e++) if (i[e] === "--diff") {
+		let [t, n] = (i[++e] ?? "").split(":");
+		if (t === "removeTable" && n) o = {
+			kind: "removeTable",
+			name: n
+		};
+		else if (t === "removeProcedure" && n) o = {
+			kind: "removeProcedure",
+			tag: n
+		};
+		else if (t === "removeScope" && n) o = {
+			kind: "removeScope",
+			name: n
+		};
+		else return console.error("voltro check --diff: expected removeTable:<name> | removeProcedure:<tag> | removeScope:<name>"), 1;
+	}
+	let s = i.find((e) => !e.startsWith("-")) ?? process.cwd(), c = i.includes("--offline"), l = c ? [] : await le(n, r), u, d;
+	if (l.length === 0) {
+		if (!c && r !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
+		try {
+			let e = await Kn(C(s));
+			u = e.manifest, d = e.tables;
+		} catch (e) {
+			return console.error(`voltro check: could not assemble the graph from source: ${e.message}`), console.error("  Start `voltro dev` to check against a running api instead."), 1;
+		}
+	} else {
+		let e = l[0], [t, n] = await Promise.all([N(e, "/_voltro/inspect/manifest"), N(e, "/_voltro/inspect/data/tables")]);
+		if (t.kind === "err") return console.error(`voltro check: manifest fetch failed: ${t.error}`), 1;
+		u = t.data, d = n.kind === "ok" ? n.data : { tables: [] };
+	}
+	let f = Wn(u, d), p = he(f, o), m = [...U(s).findings.map((e) => ({
+		rule: e.rule,
+		node: e.file,
+		file: e.file,
+		breaks: [e.detail],
+		fix: e.fix,
+		severity: e.severity
+	})), ...Y(s).map((e) => ({
+		rule: `page/${e.kind}`,
+		node: e.file,
+		file: e.file,
+		breaks: [e.kind === "suffixed-outside-pages" ? "a page.tsx outside src/pages/ never routes" : "no test beside it"],
+		fix: e.kind === "suffixed-outside-pages" ? "move it under src/pages/ into the directory whose route it serves, or rename it — page.tsx is reserved" : "write the test with the file — the name is derivable",
+		severity: e.kind === "suffixed-outside-pages" ? "error" : "warn"
+	}))], h = (await a(s, Bn(s))).map((e) => ({
+		rule: "client/not-browser-safe",
+		node: e.file,
+		file: e.file,
+		breaks: [`reaches the server-only '${e.violation.specifier}' — chain: ${e.violation.chain.join(" → ")}`],
+		fix: "move the server-only code behind a *.server.ts, or drop the .client suffix — an unmarked file makes no claim",
+		severity: "error"
+	})), g = [
+		...p.diagnostics,
+		...m,
+		...h
+	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await Hn(C(s)), y = v === null ? null : zn(f.procedures, v);
+	return t.format === "json" ? M(y === null ? {
+		...p,
+		ok: _,
+		diagnostics: g
+	} : {
+		...p,
+		ok: _,
+		diagnostics: g,
+		observed: y
+	}) : (console.log(Gn(g)), y !== null && console.log(Un(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
+};
+//#endregion
+export { re as _, Le as a, I as c, N as d, ue as f, le as g, ce as h, It as i, ve as l, se as m, qn as n, be as o, de as p, In as r, xe as s, Kn as t, he as u, M as v, ie as y };