@voltro/cli 0.29.0 → 0.30.1

package/dist/{checkCommand-BPAtyWs8.js → checkCommand-C4konUy9.js}

@@ -1,7 +1,7 @@
-import { R as e, f as t, ht as n, n as r, o as i } from "./inspectMetrics-DHYygE4s.js";
-import { Mt as a, jt as o } from "./dev-Cg4BKLmi.js";
+import { R as e, f as t, ht as n, n as r, o as i } from "./inspectMetrics-CkB2J0Zn.js";
+import { Ut as a, Wt as o } from "./dev-C_NPcLDp.js";
 import { C as s, E as c, O as l, T as u, d, h as f, i as p, l as m, m as h, r as g, u as _ } from "./fileConventions-Cof68_BL.js";
-import { r as v, u as y } from "./apiBuild-BESZbTjA.js";
+import { r as v, u as y } from "./apiBuild-DmkzRyv7.js";
 import { dirname as b, isAbsolute as ee, join as x, relative as S, resolve as C, sep as w } from "node:path";
 import { routeDiagnosticsToStderr as te } from "@voltro/logger";
 import { existsSync as T, readFileSync as E, readdirSync as D, statSync as O, writeFileSync as ne } from "node:fs";
@@ -442,7 +442,7 @@ var re = () => {
 		re: l,
 		needsTest: !1
 	}
-], R = (e) => Ce.find((t) => t.re.test(e))?.id ?? null, z = (e) => u.test(e), we = /* @__PURE__ */ new Set([
+], R = (e) => Ce.find((t) => t.re.test(e))?.id ?? null, we = (e) => u.test(e), Te = /* @__PURE__ */ new Set([
 	"useMutation",
 	"useAction",
 	"useUpload",
@@ -452,12 +452,12 @@ var re = () => {
 	"useAgentStream",
 	"useResumableAgentStream",
 	"useWorkflow"
-]), Te = /* @__PURE__ */ new Set(["defineTracking"]), Ee = /* @__PURE__ */ new Set([
+]), Ee = /* @__PURE__ */ new Set(["defineTracking"]), De = /* @__PURE__ */ new Set([
 	"useSubscription",
 	"useWindowedSubscription",
 	"useRecord",
 	"useQuery"
-]), De = /* @__PURE__ */ new Set([
+]), Oe = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -468,7 +468,7 @@ var re = () => {
 	".git",
 	"coverage",
 	".publish"
-]), Oe = /\.tsx?$/, B = (e, t = [], n = 0) => {
+]), ke = /\.tsx?$/, z = (e, t = [], n = 0) => {
 	if (n > 12) return t;
 	let r;
 	try {
@@ -477,27 +477,27 @@ var re = () => {
 		return t;
 	}
 	for (let i of r) {
-		if (De.has(i)) continue;
+		if (Oe.has(i)) continue;
 		let r = x(e, i), a;
 		try {
 			a = O(r);
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? B(r, t, n + 1) : a.isFile() && Oe.test(i) && !i.endsWith(".d.ts") && t.push(r);
+		a.isDirectory() ? z(r, t, n + 1) : a.isFile() && ke.test(i) && !i.endsWith(".d.ts") && t.push(r);
 	}
 	return t;
-}, ke = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, Ae = /\b(?:memo|forwardRef|observer|styled)\b/, V = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), H = (e) => {
-	if (V(e)) return !0;
-	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return H(e.getExpression());
+}, Ae = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, je = /\b(?:memo|forwardRef|observer|styled)\b/, B = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), V = (e) => {
+	if (B(e)) return !0;
+	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return V(e.getExpression());
 	if (k.isVariableDeclaration(e)) {
 		let t = e.getTypeNode();
-		if (t !== void 0 && ke.test(t.getText())) return !0;
+		if (t !== void 0 && Ae.test(t.getText())) return !0;
 		let n = e.getInitializer();
-		return n === void 0 || H(n);
+		return n === void 0 || V(n);
 	}
-	return k.isCallExpression(e) ? Ae.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => V(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
-}, je = (e) => {
+	return k.isCallExpression(e) ? je.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => B(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
+}, Me = (e) => {
 	let t = [], n = [], r = [], i = /* @__PURE__ */ new Set();
 	for (let [a, o] of e.getExportedDeclarations()) {
 		let e = o[0];
@@ -508,7 +508,7 @@ var re = () => {
 			n.push(s);
 			continue;
 		}
-		if (/^[A-Z]/.test(s) && H(e)) {
+		if (/^[A-Z]/.test(s) && V(e)) {
 			t.push(s);
 			continue;
 		}
@@ -520,7 +520,7 @@ var re = () => {
 		others: r,
 		hasRuntimeExport: t.length + n.length + r.length > 0
 	};
-}, Me = [], Ne = (e, t, n) => {
+}, Ne = [], Pe = (e, t, n) => {
 	let r = b(e), i = [];
 	for (let e = r;; e = b(e)) {
 		let r = n.get(e);
@@ -537,9 +537,9 @@ var re = () => {
 		}
 		if (e === t || b(e) === e) break;
 	}
-	for (let e of i) n.set(e, Me);
-	return Me;
-}, Pe = (e, t, n) => {
+	for (let e of i) n.set(e, Ne);
+	return Ne;
+}, Fe = (e, t, n) => {
 	let r = t.startsWith(".") ? C(b(e), t) : ye(t, n);
 	if (r === void 0) return null;
 	for (let e of [
@@ -552,9 +552,9 @@ var re = () => {
 		if (O(e).isFile()) return e;
 	} catch {}
 	return null;
-}, Fe = (e, t, n) => {
+}, Ie = (e, t, n) => {
 	let r = [], i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Map(), o = (e) => {
-		let i = Pe(t, e, n);
+		let i = Fe(t, e, n);
 		return i !== null && r.push(i), i;
 	};
 	for (let t of e.getImportDeclarations()) if (o(t.getModuleSpecifierValue()), !t.isTypeOnly()) for (let e of t.getNamedImports()) e.isTypeOnly() || i.add(e.getName());
@@ -581,22 +581,22 @@ var re = () => {
 		namedBindings: i,
 		reExports: a
 	};
-}, Ie = (e) => {
+}, Le = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e.getDescendantsOfKind(j.CallExpression)) {
 		let e = n.getExpression(), r = k.isPropertyAccessExpression(e) ? e.getName() : e.getText();
 		t.set(r, (t.get(r) ?? 0) + 1);
 	}
 	return t;
-}, Le = (e) => {
+}, Re = (e) => {
 	if (e.length <= 1) return e.length === 1;
 	let t = [...e].sort((e, t) => e.length - t.length)[0];
 	return e.every((e) => e.startsWith(t));
-}, Re = (e, t) => {
+}, ze = (e, t) => {
 	let n = b(t);
 	return e.startsWith(`${n}${w}`) || b(e) === n;
-}, U = (e) => {
-	let t = B(e);
+}, H = (e) => {
+	let t = z(e);
 	if (t.length === 0) return {
 		findings: [],
 		declared: 0,
@@ -627,7 +627,7 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		s.set(t, je(r)), c.set(t, Fe(r, t, Ne(t, e, u))), l.set(t, Ie(r));
+		s.set(t, Me(r)), c.set(t, Ie(r, t, Pe(t, e, u))), l.set(t, Le(r));
 	}
 	let d = /* @__PURE__ */ new Map();
 	for (let [e, t] of c) for (let n of t.localTargets) {
@@ -659,11 +659,11 @@ var re = () => {
 	for (let e of r) {
 		let t = R(e), n = s.get(e), r = c.get(e);
 		if (n === void 0 || r === void 0) continue;
-		let i = z(e);
+		let i = we(e);
 		t !== null && !i && (m += 1);
 		let u = d.get(e) ?? [];
 		if ((t === "component" || t === "component.ui") && !i) {
-			let t = Le(n.components);
+			let t = Re(n.components);
 			(n.components.length === 0 || !t) && a.push({
 				rule: "component/one-per-file",
 				file: o(e),
@@ -701,7 +701,7 @@ var re = () => {
 			].join(", ")}`,
 			fix: "a *.types.ts has NO runtime export. That is what makes importing it provably free AND makes it impossible for it to sit in a runtime import cycle — the guarantee is the point, so move the value to a sibling module"
 		}), t === "internal") {
-			let t = u.filter((t) => !Re(t, e));
+			let t = u.filter((t) => !ze(t, e));
 			t.length > 0 && a.push({
 				rule: "internal/foreign-import",
 				file: o(e),
@@ -711,7 +711,7 @@ var re = () => {
 			});
 		}
 		if (t === "fixture") {
-			let t = u.filter((e) => !z(e) && R(e) !== "fixture");
+			let t = u.filter((e) => !we(e) && R(e) !== "fixture");
 			t.length > 0 && a.push({
 				rule: "fixture/production-import",
 				file: o(e),
@@ -721,7 +721,7 @@ var re = () => {
 			});
 		}
 		if (t === "component.ui" && !i) {
-			let t = [...r.namedBindings].filter((e) => we.has(e)).sort();
+			let t = [...r.namedBindings].filter((e) => Te.has(e)).sort();
 			t.length > 0 && a.push({
 				rule: "ui/no-write",
 				file: o(e),
@@ -756,7 +756,7 @@ var re = () => {
 				detail: t === 0 ? "declares a store file but calls no defineStore()" : `declares ${t} stores`,
 				fix: "a store file defines exactly ONE store — the SSR seed pass and devtools address stores by name, so two in a file makes both harder to find and neither easier to reason about"
 			});
-			let n = [...l.get(e)?.keys() ?? []].filter((e) => Ee.has(e)).sort();
+			let n = [...l.get(e)?.keys() ?? []].filter((e) => De.has(e)).sort();
 			n.length > 0 && a.push({
 				rule: "store/mirrors-server-state",
 				file: o(e),
@@ -766,7 +766,7 @@ var re = () => {
 			});
 		}
 		if (t !== "tracking" && !i) {
-			let t = [...l.get(e)?.keys() ?? []].filter((e) => Te.has(e)).sort();
+			let t = [...l.get(e)?.keys() ?? []].filter((e) => Ee.has(e)).sort();
 			t.length > 0 && a.push({
 				rule: "tracking/outside-tracking-file",
 				file: o(e),
@@ -798,8 +798,8 @@ var re = () => {
 		scanned: r.length,
 		vendored: n
 	};
-}, ze = 10, Be = (e) => {
-	let { findings: t, declared: n, scanned: r, vendored: i } = U(e);
+}, Be = 10, Ve = (e) => {
+	let { findings: t, declared: n, scanned: r, vendored: i } = H(e);
 	console.log("");
 	for (let t of Se(e, i)) console.log(`·  not ours, exempt: ${t}`);
 	if (r === 0) return console.log("•  file-taxonomy scan: no sources here — nothing to check."), 0;
@@ -813,12 +813,12 @@ var re = () => {
 	console.log(`•  file taxonomy: ${t.length} finding(s) — ${o} error, ${t.length - o} advisory (${n} declared / ${r} scanned):`);
 	for (let [e, t] of [...a].sort()) {
 		console.log(`   ${t[0].severity === "error" ? "✗" : "·"} ${e} (${t.length})`);
-		for (let e of t.slice(0, ze)) console.log(`       ${e.file} — ${e.detail}`);
-		let n = t.length - ze;
+		for (let e of t.slice(0, Be)) console.log(`       ${e.file} — ${e.detail}`);
+		let n = t.length - Be;
 		n > 0 && console.log(`       (+${n} more — \`voltro doctor --json\` prints every one.)`), console.log(`         → ${t[0].fix}`);
 	}
 	return t.length;
-}, Ve = /* @__PURE__ */ new Set([
+}, He = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
 	"gt",
@@ -836,10 +836,10 @@ var re = () => {
 	"endsWith",
 	"between",
 	"jsonField"
-]), He = (e) => {
+]), Ue = (e) => {
 	if (k.isPropertyAccessExpression(e)) return e.getName();
 	if (k.isIdentifier(e)) return e.getText();
-}, Ue = (e) => {
+}, We = (e) => {
 	let t = e;
 	for (; k.isCallExpression(t);) {
 		let e = t.getExpression();
@@ -847,7 +847,7 @@ var re = () => {
 		t = e.getExpression();
 	}
 	return t;
-}, We = (e, t, n) => {
+}, Ge = (e, t, n) => {
 	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new A({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
@@ -865,7 +865,7 @@ var re = () => {
 		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
 			let e = t.getExpression();
 			if (!k.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
-			let n = He(Ue(e.getExpression()));
+			let n = Ue(We(e.getExpression()));
 			if (n === void 0 || !r.has(n)) {
 				let t = e.getExpression();
 				if (k.isCallExpression(t)) {
@@ -888,7 +888,7 @@ var re = () => {
 				else for (let e of [u, ...u.getDescendantsOfKind(j.CallExpression)]) {
 					if (!k.isCallExpression(e)) continue;
 					let t = e.getExpression(), n = k.isIdentifier(t) ? t.getText() : k.isPropertyAccessExpression(t) ? t.getName() : void 0;
-					if (n === void 0 || !Ve.has(n)) continue;
+					if (n === void 0 || !He.has(n)) continue;
 					let r = e.getArguments()[0];
 					r !== void 0 && k.isStringLiteral(r) && l.push({
 						column: r.getLiteralValue(),
@@ -909,16 +909,16 @@ var re = () => {
 		issues: a,
 		checked: o
 	};
-}, W = 12, Ge = (e) => {
+}, U = 12, Ke = (e) => {
 	if (e.checked === 0) return null;
 	if (e.issues.length === 0) return `predicate columns: ${e.checked} checked — every filtered column exists on its table`;
 	let t = [`predicate columns: ${e.issues.length} filter${e.issues.length, "s"} on a column that does not exist (${e.checked} checked)`];
 	for (let n of e.issues) {
-		let e = n.available.slice(0, W).join(", "), r = n.available.length > W ? `, … (${n.available.length - W} more)` : "";
+		let e = n.available.slice(0, U).join(", "), r = n.available.length > U ? `, … (${n.available.length - U} more)` : "";
 		t.push(`  ${n.file}:${n.line}  '${n.table}' has no column '${n.column}'`), t.push(`    columns: ${e}${r}`);
 	}
 	return t.push("  This type-checks today and fails at runtime as a bare SQL error."), t.join("\n");
-}, Ke = /* @__PURE__ */ new Set([
+}, qe = /* @__PURE__ */ new Set([
 	"id",
 	"tenantId",
 	"tenant_id",
@@ -938,7 +938,7 @@ var re = () => {
 	"idempotency_id",
 	"idempotencyKey",
 	"idempotency_key"
-]), qe = /* @__PURE__ */ new Set([
+]), Je = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"created_at",
@@ -948,10 +948,10 @@ var re = () => {
 	"deleted_at",
 	"tenantId",
 	"tenant_id"
-]), Je = (e) => Ke.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), Ye = (e) => e.type === "reference", Xe = (e) => {
+]), Ye = (e) => qe.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), Xe = (e) => e.type === "reference", Ze = (e) => {
 	let t = [];
 	for (let n of e) {
-		let e = n.columns.filter((e) => Je(e.name)), r = e.filter((e) => !Ye(e)).map((e) => e.name);
+		let e = n.columns.filter((e) => Ye(e.name)), r = e.filter((e) => !Xe(e)).map((e) => e.name);
 		if (r.length === 0) continue;
 		let i = new Set(n.primaryKey), a = r.filter((e) => i.has(e));
 		if (n.primaryKey.length >= 2 && a.length > 0) {
@@ -962,7 +962,7 @@ var re = () => {
 			});
 			continue;
 		}
-		if (e.some(Ye) && e.length >= 2) {
+		if (e.some(Xe) && e.length >= 2) {
 			t.push({
 				table: n.name,
 				columns: r,
@@ -970,7 +970,7 @@ var re = () => {
 			});
 			continue;
 		}
-		e.length >= 2 && n.columns.filter((e) => !Je(e.name) && !qe.has(e.name)).length === 0 && t.push({
+		e.length >= 2 && n.columns.filter((e) => !Ye(e.name) && !Je.has(e.name)).length === 0 && t.push({
 			table: n.name,
 			columns: r,
 			signal: "link-only"
@@ -980,20 +980,20 @@ var re = () => {
 		issues: t,
 		tablesChecked: e.length
 	};
-}, Ze = {
+}, Qe = {
 	"composite-pk": "part of a composite primary key",
 	"reference-sibling": "sits beside a wired reference() on this table",
 	"link-only": "this table is nothing but link columns"
-}, Qe = (e) => {
+}, $e = (e) => {
 	if (e.tablesChecked === 0) return null;
 	if (e.issues.length === 0) return `junction FKs: ${e.tablesChecked} table${e.tablesChecked === 1 ? "" : "s"} checked — every link column is a wired reference()`;
 	let t = e.issues.length, n = [`junction FKs: ${t} junction table${t === 1 ? "" : "s"} with an id column that is a plain text() and not a reference()`];
 	for (let t of e.issues) {
 		let e = t.columns.map((e) => `'${e}'`).join(", ");
-		n.push(`  '${t.table}': ${e} (${Ze[t.signal]})`);
+		n.push(`  '${t.table}': ${e} (${Qe[t.signal]})`);
 	}
 	return n.push("  Declare each as reference(() => <table>): the FK is enforced, the column is auto-indexed,"), n.push("  and the relationship becomes walkable (a plain text() id column is an invisible edge)."), n.join("\n");
-}, $e = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), et = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), tt = (e) => et(e).some((e) => $e.has(e)), nt = (e) => {
+}, et = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), tt = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), nt = (e) => tt(e).some((e) => et.has(e)), rt = (e) => {
 	let t = [], n = [];
 	for (let r of e) t.push({
 		event: r.name,
@@ -1002,7 +1002,7 @@ var re = () => {
 		event: r.name,
 		kind: "wide-key",
 		keyFieldCount: r.keyFieldCount
-	}), r.hasWebhook && tt(r.name) && n.push({
+	}), r.hasWebhook && nt(r.name) && n.push({
 		event: r.name,
 		kind: "webhook-high-rate"
 	});
@@ -1011,26 +1011,26 @@ var re = () => {
 		modes: t,
 		warnings: n
 	};
-}, rt = (e) => {
+}, it = (e) => {
 	if (e.eventsChecked === 0) return null;
 	let t = e.eventsChecked, n = [`event delivery: ${t} declared event${t === 1 ? "" : "s"} — the mode decides what a MISSING message means`];
 	for (let t of e.modes) n.push(`  '${t.event}': ${t.delivery}`);
 	return n.push("  each   — every delivery matters; a slow subscriber loses the oldest and is TOLD how many (the default)."), n.push("  latest — a newer delivery supersedes a pending one; a slow subscriber gets the current value, told nothing."), n.push("  Two events with identical route/subscriber/buffer numbers mean OPPOSITE things about a drop — the mode is the difference."), n.join("\n");
-}, it = (e) => {
+}, at = (e) => {
 	if (e.warnings.length === 0) return null;
 	let t = e.warnings.length, n = [`events that may not scale as declared: ${t} finding${t === 1 ? "" : "s"}`];
 	for (let t of e.warnings) t.kind === "wide-key" ? (n.push(`  '${t.event}': routing key has ${t.keyFieldCount ?? 0} fields — every field FRAGMENTS the subscriber set (distinct routes are the PRODUCT of the fields’ value spaces).`), n.push("     Check each is an ADDRESS the delivery is decided by (arenaId), not a discriminator the handler reads (gameType) — the latter is payload, not key.")) : (n.push(`  '${t.event}': a webhook block on a per-frame-looking event — every publish is N HTTP deliveries per second per subscribed target.`), n.push("     The webhook rate limit DEFERS the excess as pending rows rather than failing, so the symptom is a growing table. Publish a coarser event (a summary / state change) for the outside world."));
 	return n.push("  WARNING, not a fault — a producer may intend the fan-out. `voltro doctor --json` prints every finding."), n.join("\n");
-}, at = /* @__PURE__ */ new Set([
+}, ot = /* @__PURE__ */ new Set([
 	"start",
 	"run",
 	"child"
-]), ot = (e) => k.isCallExpression(e) && (() => {
+]), st = (e) => k.isCallExpression(e) && (() => {
 	let t = e.getExpression();
-	if (!k.isPropertyAccessExpression(t) || !at.has(t.getName())) return !1;
+	if (!k.isPropertyAccessExpression(t) || !ot.has(t.getName())) return !1;
 	let n = t.getExpression();
 	return k.isPropertyAccessExpression(n) ? n.getName() === "workflows" : k.isIdentifier(n) && n.getText() === "workflows";
-})(), st = (e, t, n) => {
+})(), ct = (e, t, n) => {
 	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new A({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
@@ -1046,7 +1046,7 @@ var re = () => {
 		}
 		let u = S(n, t);
 		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
-			if (!ot(t)) continue;
+			if (!st(t)) continue;
 			c++;
 			let e = t.getStartLineNumber(), [n, l] = t.getArguments();
 			if (n === void 0 || !k.isStringLiteral(n)) {
@@ -1130,7 +1130,7 @@ var re = () => {
 		checked: s,
 		callSites: c
 	};
-}, ct = (e) => {
+}, lt = (e) => {
 	if (e.callSites === 0) return null;
 	let t = [];
 	t.push(`workflow starts: ${e.checked}/${e.callSites} call sites checked`);
@@ -1143,7 +1143,7 @@ var re = () => {
 		for (let n of e.unchecked) t.push(`    ${n.file}:${n.line} — ${n.reason}`);
 	}
 	return e.issues.length === 0 && e.unchecked.length === 0 && t.push("  every call site matches its workflow"), t.join("\n");
-}, lt = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, G = "VOLTRO_FIELD_ENCRYPTION_KEY", ut = (e) => {
+}, ut = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, W = "VOLTRO_FIELD_ENCRYPTION_KEY", dt = (e) => {
 	let t;
 	for (let [n, r] of e.sources) if (t === void 0 && /\bfieldEncryption\b/.test(r) && (t = {
 		reason: "fieldEncryption",
@@ -1151,13 +1151,13 @@ var re = () => {
 	}), t === void 0 && /\.encrypted\s*\(/.test(r) && (t = {
 		reason: "encrypted-column",
 		file: n
-	}), r.includes(G)) return;
+	}), r.includes(W)) return;
 	if (t !== void 0) {
-		for (let [, t] of e.envFiles) if (t.includes(G)) return;
+		for (let [, t] of e.envFiles) if (t.includes(W)) return;
 		return t;
 	}
-}, dt = (e) => [
-	`✗  ${G} is named nowhere under this app root, and the app encrypts columns at rest`,
+}, ft = (e) => [
+	`✗  ${W} is named nowhere under this app root, and the app encrypts columns at rest`,
 	e.reason === "fieldEncryption" ? `   (\`fieldEncryption\` in ${e.file})` : `   (an \`.encrypted()\` column in ${e.file})`,
 	"",
 	"   A deploy without it does not degrade — it refuses to boot at `onActivate`,",
@@ -1173,7 +1173,7 @@ var re = () => {
 	"   reaches your deploy target is not knowable from here — a secret manager",
 	"   or a CI variable is not a file. Naming it nowhere is conclusive; naming",
 	"   it somewhere is not a guarantee."
-].join("\n"), ft = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", pt = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, mt = (e) => {
+].join("\n"), pt = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", mt = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, ht = (e) => {
 	let t = [], n = e;
 	for (let e = 0; e < 12; e++) {
 		let e = x(n, "node_modules");
@@ -1183,14 +1183,14 @@ var re = () => {
 		n = r;
 	}
 	return t;
-}, ht = (e) => {
+}, gt = (e) => {
 	try {
 		let t = JSON.parse(E(x(e, "package.json"), "utf8"));
 		return typeof t.version == "string" ? t.version : void 0;
 	} catch {
 		return;
 	}
-}, gt = (e) => {
+}, _t = (e) => {
 	let t = [], n;
 	try {
 		n = D(e);
@@ -1198,7 +1198,7 @@ var re = () => {
 		return t;
 	}
 	for (let r of n) {
-		if (r.startsWith(".") || pt.test(r)) continue;
+		if (r.startsWith(".") || mt.test(r)) continue;
 		let n = x(e, r);
 		if (r.startsWith("@")) {
 			let e;
@@ -1224,11 +1224,11 @@ var re = () => {
 		});
 	}
 	return t;
-}, _t = (e) => {
+}, vt = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	for (let n of mt(e)) for (let { pkg: e, dir: r } of gt(n)) {
-		if (!ft(e)) continue;
-		let n = ht(r);
+	for (let n of ht(e)) for (let { pkg: e, dir: r } of _t(n)) {
+		if (!pt(e)) continue;
+		let n = gt(r);
 		if (n === void 0) continue;
 		let i = t.get(e) ?? /* @__PURE__ */ new Map();
 		i.has(n) || i.set(n, r), t.set(e, i);
@@ -1240,7 +1240,7 @@ var re = () => {
 		paths: [...i.values()].map((t) => S(e, t)).sort()
 	});
 	return n.sort((e, t) => e.pkg.localeCompare(t.pkg));
-}, vt = (e) => {
+}, yt = (e) => {
 	if (e.length !== 0) return [
 		`•  ${e.length} package(s) resolved at more than one version:`,
 		...e.flatMap((e) => [`     ${e.pkg} — ${e.versions.join(", ")}`, ...e.paths.map((e) => `       ${e}`)]),
@@ -1258,33 +1258,52 @@ var re = () => {
 		"   instrument), then reinstall. Do not silence the generated file — it is where",
 		"   a genuine mistake in your own descriptors surfaces."
 	].join("\n");
-}, yt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), bt = /* @__PURE__ */ new Set([
+}, bt = (e) => {
+	if (e.catalogCodes.length === 0) return;
+	let t = new Set(e.declaredLocales), n = e.catalogCodes.filter((e) => !t.has(e)).sort();
+	if (n.length !== 0) return {
+		orphaned: n,
+		noneDeclared: t.size === 0
+	};
+}, xt = (e, t) => {
+	let n = e.orphaned.join(", ");
+	return e.noneDeclared ? [
+		`⚠  ${t} has ${e.orphaned.length} catalog(s) — ${n} — and the app declares no \`locales:\`.`,
+		"   Nothing imports them: no provider is generated and `useT()` would not find a catalog.",
+		"   Either declare them in your app config:",
+		"",
+		`       locales: [${e.orphaned.map((e) => `'${e}'`).join(", ")}],`,
+		"",
+		"   …or delete the files. A catalog that is never loaded looks from the inside",
+		"   exactly like one that works, which is why this is worth a line."
+	] : [`⚠  ${t} has catalog(s) not in \`locales:\` — ${n} — so they are never imported.`, "   Add the code(s) to `locales:` in your app config, or delete the file(s)."];
+}, St = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), Ct = /* @__PURE__ */ new Set([
 	"requireScope",
 	"requireAnyScope",
 	"requireAuth",
 	"assertScope",
 	"assertCan",
 	"can"
-]), xt = (e) => {
+]), wt = (e) => {
 	let t = /* @__PURE__ */ new Set();
-	for (let n of e) for (let e of yt(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
+	for (let n of e) for (let e of St(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
 	return t;
-}, St = (e, t) => {
+}, Tt = (e, t) => {
 	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
-}, Ct = (e) => {
+}, Et = (e) => {
 	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
 	return t && n;
-}, wt = (e, t, n) => {
+}, Dt = (e, t, n) => {
 	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
-	let r = yt(e.src), i = St(r, t);
-	return i === void 0 ? Ct(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+	let r = St(e.src), i = Tt(r, t);
+	return i === void 0 ? Et(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
 		kind: "vocabulary-guard",
 		name: i
 	};
-}, Tt = (e, t, n) => {
+}, Ot = (e, t, n) => {
 	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
 	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
-}, Et = (e, t) => {
+}, kt = (e, t) => {
 	switch (t.kind) {
 		case "declared-guard": return "guards: on the descriptor";
 		case "vocabulary-guard": return `calls ${t.name}()`;
@@ -1292,15 +1311,15 @@ var re = () => {
 		case "allowlisted": return "accepted by a previous run";
 		case "unchecked": return e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
 	}
-}, Dt = (e) => {
+}, At = (e) => {
 	let t = e.executors.map((t) => {
-		let n = wt(t, e.guardVocabulary, e.allowlist);
+		let n = Dt(t, e.guardVocabulary, e.allowlist);
 		return {
 			tag: t.tag,
 			path: t.path,
 			verdict: n,
-			severity: Tt(t, e.tenantScopedTables, e.referencedTables),
-			why: Et(t, n)
+			severity: Ot(t, e.tenantScopedTables, e.referencedTables),
+			why: kt(t, n)
 		};
 	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
 	return {
@@ -1314,26 +1333,75 @@ var re = () => {
 		},
 		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
 	};
-}, Ot = (e) => [
+}, jt = [
 	"# voltro doctor — authz allowlist",
 	"#",
-	"# Executors with no access check that a previous run accepted. This is DEBT,",
-	"# not approval: every line is an executor nobody has confirmed is safe.",
+	"# Two KINDS of line, and the difference is the point:",
+	"#",
+	"#   <tag>                          DEBT, not approval. Nobody has confirmed",
+	"#                                  this executor is safe; it was accepted so",
+	"#                                  the ratchet could start. Every one of",
+	"#                                  these is owed work.",
+	"#",
+	"#   <tag>  reviewed=<why>          REVIEWED. A human read it and states why it",
+	"#                                  is genuinely open — constrained by something",
+	"#                                  the scanner cannot see. The reason is",
+	"#                                  REQUIRED: \"reviewed\" with no why is the",
+	"#                                  claim without the evidence, and doctor",
+	"#                                  refuses it.",
 	"#",
 	"# Doctor fails on any executor NOT listed here, so the list can only shrink",
 	"# unless someone adds a line deliberately. Delete a line once its executor",
 	"# has a guard — doctor reports it as guarded from then on, whether or not the",
 	"# line is still here.",
-	"",
-	...[...e].sort(),
+	"#",
+	"# `--write-authz-allowlist` PRESERVES reviewed= lines. It only ever adds debt",
+	"# lines for executors that are newly unchecked.",
 	""
-].join("\n"), kt = (e) => new Set(e.split("\n").map((e) => e.trim()).filter((e) => e.length > 0 && !e.startsWith("#"))), At = (e) => {
+], Mt = (e) => {
+	let t = [...e].map((e) => typeof e == "string" ? { tag: e } : e), n = t.filter((e) => e.reviewed === void 0).map((e) => e.tag).sort(), r = t.filter((e) => e.reviewed !== void 0).sort((e, t) => e.tag.localeCompare(t.tag));
+	return [
+		...jt,
+		...n,
+		...r.length > 0 ? ["", "# reviewed — read by a human, open on purpose"] : [],
+		...r.map((e) => `${e.tag}  reviewed=${e.reviewed}`),
+		""
+	].join("\n");
+}, Nt = class extends Error {
+	tag;
+	constructor(e) {
+		super(`authz allowlist: '${e}' is marked reviewed with no reason. Write \`${e}  reviewed=<why it is genuinely open>\`. A bare tag is the other, honest option — it records the executor as DEBT, which is what an unexplained exemption is.`), this.tag = e, this.name = "AllowlistReasonMissingError";
+	}
+}, Pt = (e) => {
+	let t = [];
+	for (let n of e.split("\n")) {
+		let e = n.trim();
+		if (e.length === 0 || e.startsWith("#")) continue;
+		let r = /^(\S+)(?:\s+reviewed=(.*))?$/.exec(e);
+		if (!r) continue;
+		let i = r[1];
+		if (r[2] === void 0) {
+			t.push({ tag: i });
+			continue;
+		}
+		let a = r[2].trim();
+		if (a.length === 0) throw new Nt(i);
+		t.push({
+			tag: i,
+			reviewed: a
+		});
+	}
+	return {
+		tags: new Set(t.map((e) => e.tag)),
+		entries: t
+	};
+}, Ft = (e) => {
 	let t = e.indexOf(".");
 	return t <= 0 ? void 0 : e.slice(0, t);
-}, jt = (e, t) => {
+}, It = (e, t) => {
 	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
 	for (let e of t.rpcTags) {
-		let t = At(e);
+		let t = Ft(e);
 		if (t === void 0) continue;
 		let n = i.get(t);
 		n ? n.push(e) : i.set(t, [e]);
@@ -1362,7 +1430,7 @@ var re = () => {
 			});
 			continue;
 		}
-		let s = new Set(o.rpcTags.map(At).filter((e) => e !== void 0));
+		let s = new Set(o.rpcTags.map(Ft).filter((e) => e !== void 0));
 		for (let e of s) {
 			let t = i.get(e);
 			t !== void 0 && a.push({
@@ -1375,12 +1443,12 @@ var re = () => {
 		}
 	}
 	return a;
-}, Mt = (e, t) => {
+}, Lt = (e, t) => {
 	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
 	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
 	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
 	return r;
-}, Nt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), Pt = (e) => {
+}, Rt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), zt = (e) => {
 	let t = y(e), n = v(e);
 	return {
 		root: e,
@@ -1389,19 +1457,19 @@ var re = () => {
 		apiBundle: n,
 		apiBundlePresent: T(n)
 	};
-}, Ft = [
+}, Bt = [
 	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
 	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
 	"(Generated Dockerfiles from `voltro create-project` already do this.)"
-].join("\n  "), It = (e, t = !1) => {
-	let n = Pt(e);
-	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Nt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+].join("\n  "), Vt = (e, t = !1) => {
+	let n = zt(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Rt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
 	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
 	let r = process.env.NODE_ENV === "production";
 	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
 	let i = t || r;
-	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${Ft}`), +!!i;
-}, Lt = (e, t, n) => {
+	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${Bt}`), +!!i;
+}, Ht = (e, t, n) => {
 	let r = new Set(e), i = I(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
@@ -1427,7 +1495,7 @@ var re = () => {
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Ut.test(S(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Jt.test(S(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -1440,11 +1508,11 @@ var re = () => {
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, Rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), zt = (e, t) => (e.match(t) ?? []).length, K = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, Bt = (e, t) => {
+}, Ut = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), Wt = (e, t) => (e.match(t) ?? []).length, G = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, Gt = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
-	return n !== t && K(e.file, RegExp(`^${n}Plugin$`)) > 0;
-}, Vt = (e, t) => {
+	return n !== t && G(e.file, RegExp(`^${n}Plugin$`)) > 0;
+}, Kt = (e, t) => {
 	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
 	for (; (i = r.exec(e)) !== null;) {
 		let t = i.index + i[0].length, r = 1, a = t;
@@ -1452,10 +1520,10 @@ var re = () => {
 		n.push(e.slice(t, a - 1));
 	}
 	return n;
-}, Ht = (e, t) => {
+}, qt = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
 	return n === void 0 ? [] : e.getDescendantsOfKind(j.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, Ut = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Wt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Gt = [
+}, Jt = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Yt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Xt = [
 	"Id",
 	"ID",
 	"Hash",
@@ -1481,13 +1549,20 @@ var re = () => {
 	"Comment",
 	"Provider",
 	"Format"
-], Kt = RegExp(`(?:${Gt.join("|")})$|_(?:${Gt.map((e) => e.toLowerCase()).join("|")})$`), qt = [
+], Zt = RegExp(`(?:${Xt.join("|")})$|_(?:${Xt.map((e) => e.toLowerCase()).join("|")})$`), Qt = [
+	{
+		id: "hardcoded-framework-cookie",
+		scope: "client",
+		smell: "a framework cookie name written as a string literal instead of imported",
+		use: "import the constant — `LOCALE_COOKIE` / `THEME_COOKIE` from `@voltro/ui-shadcn` — so a rename in the framework is a compile error in your app rather than a preference that quietly stops working",
+		match: ({ src: e }) => /['"`]voltro:(?:locale|theme|lang)['"`]/.test(e)
+	},
 	{
 		id: "executor-without-descriptor",
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => Wt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => Yt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
@@ -1495,8 +1570,8 @@ var re = () => {
 		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
 		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
 		match: ({ src: e, path: t }) => {
-			if (!Wt.test(t)) return !1;
-			let n = Rt(e);
+			if (!Yt.test(t)) return !1;
+			let n = Ut(e);
 			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
 		}
 	},
@@ -1505,14 +1580,14 @@ var re = () => {
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no SSRF guard, no traceparent, no retry)",
 		use: "yield* HttpClient — the framework client. It blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop, injects traceparent, and honours `http.allowHosts` for deliberate internal targets",
-		match: ({ file: e, path: t, serverOnly: n }) => (Ut.test(t) || n) && K(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (Jt.test(t) || n) && G(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
 		scope: "client",
 		smell: "per-field useState + a submit flag (hand-rolled form)",
 		use: "useFormBinding — fields + validation from the mutation input Schema; server ValidationError({ field }) routes to the field",
-		match: ({ src: e, file: t }) => K(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
+		match: ({ src: e, file: t }) => G(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
 	},
 	{
 		id: "table",
@@ -1540,7 +1615,7 @@ var re = () => {
 		scope: "client",
 		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
 		use: "useDerived — dependency-tracked, referentially stable",
-		match: ({ src: e }) => zt(e, /\buseSubscription\s*[(<]/g) >= 3 && zt(e, /\buseMemo\s*\(/g) >= 3
+		match: ({ src: e }) => Wt(e, /\buseSubscription\s*[(<]/g) >= 3 && Wt(e, /\buseMemo\s*\(/g) >= 3
 	},
 	{
 		id: "next-shim",
@@ -1565,7 +1640,7 @@ var re = () => {
 		match: ({ file: e }) => e.getDescendantsOfKind(j.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
 			let t = e.getFirstAncestorByKind(j.VariableDeclaration)?.getNameNode();
 			return t === void 0 ? [] : k.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
-		}).some((t) => Ht(e, t).some((e) => {
+		}).some((t) => qt(e, t).some((e) => {
 			let t = e.getParent();
 			if (k.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
@@ -1593,7 +1668,7 @@ var re = () => {
 		scope: "server",
 		smell: "several sequential store reads assembling related data (an N+1 you are writing by hand)",
 		use: "reads are a parent→child walk on ONE key → relations() in a *.relations.ts + .with({ … }) (ONE JSON-aggregate query, every dialect); reads collect ids from SEVERAL sources → keep the assembly and run the independent leading reads under Effect.all (same queries, same results, only concurrent — zero parity risk)",
-		match: (e) => K(e.file, /\bstore\.query$/) >= 3 || K(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
+		match: (e) => G(e.file, /\bstore\.query$/) >= 3 || G(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
 	},
 	{
 		id: "store-effect-lift",
@@ -1616,7 +1691,7 @@ var re = () => {
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Kt.test(n) || /^vault/i.test(n) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Zt.test(n) || /^vault/i.test(n) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1680,9 +1755,9 @@ var re = () => {
 		scope: "server",
 		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
 		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
-		match: ({ file: e, testSources: t }) => K(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
-			let t = Rt(e);
-			return Vt(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+		match: ({ file: e, testSources: t }) => G(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
+			let t = Ut(e);
+			return Kt(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
 		})
 	},
 	{
@@ -1692,15 +1767,15 @@ var re = () => {
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], Jt = (e) => J(e), Yt = (e, t) => {
+], $t = (e) => q(e), en = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
 		let t = S(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, Xt = /\.(tsx?|jsx?)$/, q = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Zt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Qt = (e, t = [], n = 0) => {
-	if (n > 12 || q.test(e)) return t;
+}, tn = /\.(tsx?|jsx?)$/, K = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, nn = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, rn = (e, t = [], n = 0) => {
+	if (n > 12 || K.test(e)) return t;
 	let r;
 	try {
 		r = D(e, { withFileTypes: !0 });
@@ -1711,12 +1786,12 @@ var re = () => {
 		let r = x(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
-			Qt(r, t, n + 1);
-		} else lt.test(i.name) && t.push(r);
+			rn(r, t, n + 1);
+		} else ut.test(i.name) && t.push(r);
 	}
 	return t;
-}, J = (e, t = [], n = 0) => {
-	if (n > 12 || q.test(e)) return t;
+}, q = (e, t = [], n = 0) => {
+	if (n > 12 || K.test(e)) return t;
 	let r;
 	try {
 		r = D(e);
@@ -1730,11 +1805,11 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? J(r, t, n + 1) : Xt.test(i) && !/\.(test|spec)\./.test(i) && !Zt.test(i) && t.push(r);
+		a.isDirectory() ? q(r, t, n + 1) : tn.test(i) && !/\.(test|spec)\./.test(i) && !nn.test(i) && t.push(r);
 	}
 	return t;
-}, $t = (e, t = [], n = 0) => {
-	if (n > 12 || q.test(e)) return t;
+}, an = (e, t = [], n = 0) => {
+	if (n > 12 || K.test(e)) return t;
 	let r;
 	try {
 		r = D(e);
@@ -1748,17 +1823,17 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? $t(r, t, n + 1) : Xt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? an(r, t, n + 1) : tn.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
-}, en = (e) => {
-	let t = Jt(e);
+}, on = (e) => {
+	let t = $t(e);
 	return {
-		dirs: Yt(e, t),
+		dirs: en(e, t),
 		fileCount: t.length
 	};
-}, tn = (e) => {
-	let t = Jt(e);
+}, sn = (e) => {
+	let t = $t(e);
 	if (t.length === 0) return [];
 	let n = new A({
 		useInMemoryFileSystem: !0,
@@ -1767,8 +1842,8 @@ var re = () => {
 	for (let e of t) try {
 		i.set(e, E(e, "utf8"));
 	} catch {}
-	let a = Lt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
-	for (let t of $t(e)) try {
+	let a = Ht([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
+	for (let t of an(e)) try {
 		o.set(t, E(t, "utf8"));
 	} catch {}
 	for (let s of t) {
@@ -1786,23 +1861,23 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		for (let t of qt) {
-			if (t.plugin !== void 0 && Bt(c, t.plugin) || !t.match(c)) continue;
+		for (let t of Qt) {
+			if (t.plugin !== void 0 && Gt(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
 			n.push(S(e, s)), r.set(t.id, n);
 		}
 	}
-	return qt.filter((e) => r.has(e.id)).map((e) => ({
+	return Qt.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
-}, nn = (e) => {
-	let t = en(e);
+}, cn = (e) => {
+	let t = on(e);
 	return {
 		root: e,
 		scannedFiles: t.fileCount,
 		scannedDirs: t.dirs,
-		findings: tn(e).map(({ rule: e, files: t }) => ({
+		findings: sn(e).map(({ rule: e, files: t }) => ({
 			id: e.id,
 			scope: e.scope,
 			smell: e.smell,
@@ -1810,45 +1885,50 @@ var re = () => {
 			files: t
 		}))
 	};
-}, rn = 3, an = (e) => {
+}, ln = 3, un = .2, dn = 50, fn = (e, t) => e >= dn && t > 0 && e / t >= un, pn = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	for (let n of J(e)) try {
+	for (let n of q(e)) try {
 		t.set(S(e, n), E(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
-	for (let t of Qt(e)) try {
+	for (let t of rn(e)) try {
 		n.set(S(e, t), E(t, "utf8"));
 	} catch {}
-	let r = ut({
+	let r = dt({
 		sources: t,
 		envFiles: n
 	});
-	r !== void 0 && (console.log(""), console.log(dt(r)));
-}, on = (e) => {
-	let t = nn(e);
+	r !== void 0 && (console.log(""), console.log(ft(r)));
+}, mn = (e) => {
+	let t = cn(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
 	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
 	console.log(`\u2022  Shipped primitives you may be hand-rolling (scanned ${t.scannedFiles} files across ${t.scannedDirs.join(", ")}):`);
 	let n = 0;
 	for (let e of ["server", "client"]) {
 		let r = t.findings.filter((t) => t.scope === e);
-		if (r.length !== 0) {
-			console.log(`   [${e}]`);
-			for (let e of r) {
-				let t = e.files.slice(0, rn).join(", "), r = e.files.length - rn;
-				r > 0 && (n += r);
-				let i = r > 0 ? `, +${r} more` : "";
-				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${t}${i}`), console.log(`     \u2192 ${e.use}`);
+		if (r.length === 0) continue;
+		console.log(`   [${e}]`);
+		let i = [...r].sort((e, t) => e.files.length - t.files.length);
+		for (let e of i) {
+			if (fn(e.files.length, t.scannedFiles)) {
+				let n = Math.round(e.files.length / t.scannedFiles * 100);
+				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s), ${n}% of those scanned: a codebase-wide pattern rather than a work list`), console.log(`     \u2192 ${e.use}`), console.log("     (paths omitted on purpose at this scale — `voltro doctor --json` has every one.)");
+				continue;
 			}
+			let r = e.files.slice(0, ln).join(", "), i = e.files.length - ln;
+			i > 0 && (n += i);
+			let a = i > 0 ? `, +${i} more` : "";
+			console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${r}${a}`), console.log(`     \u2192 ${e.use}`);
 		}
 	}
 	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
-}, sn = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", cn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, ln = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, un = (e) => {
-	let t = cn.exec(e)?.[1];
+}, hn = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", gn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, _n = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, vn = (e) => {
+	let t = gn.exec(e)?.[1];
 	if (t !== void 0) return t === "ssr" ? "ssr" : null;
-	let n = ln.exec(e)?.[1];
+	let n = _n.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
-}, dn = async (e) => {
+}, yn = async (e) => {
 	let n = x(e, "src", "pages");
 	if (!T(n)) return [];
 	let { pages: a, dirs: o } = await t(n), s = [];
@@ -1861,7 +1941,7 @@ var re = () => {
 			continue;
 		}
 		if (r.test(a)) continue;
-		let c = un(a);
+		let c = vn(a);
 		c !== null && s.push({
 			file: S(e, x(n, t.file)),
 			pattern: t.pattern,
@@ -1869,18 +1949,18 @@ var re = () => {
 		});
 	}
 	return s;
-}, fn = 10, pn = async (e) => {
+}, bn = 10, xn = async (e) => {
 	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = await dn(e);
+	let t = await yn(e);
 	if (t.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
 	console.log(`•  renderMode:'spa' candidates (${t.length} page${t.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of t.slice(0, fn)) {
+	for (let e of t.slice(0, bn)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let n = t.length - fn;
-	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${sn}`), t.length;
-}, mn = /* @__PURE__ */ new Set([
+	let n = t.length - bn;
+	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${hn}`), t.length;
+}, Sn = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -1888,7 +1968,7 @@ var re = () => {
 	".vite",
 	".framework",
 	".git"
-]), hn = (e, t, n) => {
+]), Cn = (e, t, n) => {
 	let r;
 	try {
 		r = D(e, { withFileTypes: !0 });
@@ -1896,11 +1976,11 @@ var re = () => {
 		return;
 	}
 	for (let i of r) {
-		if (mn.has(i.name)) continue;
+		if (Sn.has(i.name)) continue;
 		let r = x(e, i.name);
-		i.isDirectory() ? hn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
+		i.isDirectory() ? Cn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
 	}
-}, gn = (e, t) => {
+}, wn = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
@@ -1925,16 +2005,16 @@ var re = () => {
 		}
 	}
 	return n;
-}, _n = (e, t) => {
+}, Tn = (e, t) => {
 	let n = e.slice(t.length).split(w).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
-}, Y = (t) => {
+}, J = (t) => {
 	let n = [], r = x(t, "src", "pages"), i = x(t, "src");
 	if (!T(i)) return n;
 	let a = [];
-	hn(i, t, a), a.sort();
+	Cn(i, t, a), a.sort();
 	let o = `${S(t, r)}${w}`;
-	gn(t, a);
+	wn(t, a);
 	for (let r of a) {
 		let i = r.slice(r.lastIndexOf(w) + 1);
 		if (r.startsWith(o)) {
@@ -1942,7 +2022,7 @@ var re = () => {
 			T(x(t, e(r))) || n.push({
 				kind: "page-without-test",
 				file: r
-			}), _n(r, o) && n.push({
+			}), Tn(r, o) && n.push({
 				kind: "top-level-dynamic-route",
 				file: r
 			});
@@ -1954,33 +2034,33 @@ var re = () => {
 		});
 	}
 	return n;
-}, X = 10, Z = (e, t, n) => {
+}, Y = 10, X = (e, t, n) => {
 	if (t.length === 0) return;
 	console.log(`•  ${e} (${t.length}):`);
-	for (let e of t.slice(0, X)) console.log(`   ${e}`);
-	let r = t.length - X;
+	for (let e of t.slice(0, Y)) console.log(`   ${e}`);
+	let r = t.length - Y;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
-}, vn = (e) => {
+}, En = (e) => {
 	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = Y(e);
+	let t = J(e);
 	if (t.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
 	let n = (e) => t.filter((t) => t.kind === e).map((e) => e.file);
-	return Z("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), Z("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), Z("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), t.length;
-}, yn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", bn = /* @__PURE__ */ new Map(), Q = (e) => {
-	let t = bn.get(e);
+	return X("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), X("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), X("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), t.length;
+}, Dn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", On = /* @__PURE__ */ new Map(), Z = (e) => {
+	let t = On.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-DeEJj5T4.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-DXhhZ7-f.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
 		};
 	})();
-	return bn.set(e, n), n;
-}, xn = async (e) => {
+	return On.set(e, n), n;
+}, kn = async (e) => {
 	let t;
 	try {
-		let { files: n, discovered: r } = await Q(e), i = r.tables.map((e) => {
+		let { files: n, discovered: r } = await Z(e), i = r.tables.map((e) => {
 			let t = e;
 			return {
 				name: t.tableName,
@@ -1988,12 +2068,12 @@ var re = () => {
 			};
 		});
 		if (i.length === 0) return;
-		t = Ge(We(n, i, e));
+		t = Ke(Ge(n, i, e));
 	} catch {
 		return;
 	}
 	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
-}, Sn = (e) => e.map((e) => {
+}, An = (e) => e.map((e) => {
 	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
 		name: e,
 		type: typeof t?.type == "string" ? t.type : ""
@@ -2003,22 +2083,22 @@ var re = () => {
 		columns: n,
 		primaryKey: t.appliedPrimaryKey ?? []
 	};
-}), Cn = async (e) => {
+}), jn = async (e) => {
 	try {
-		let { discovered: t } = await Q(e);
-		return Xe(Sn(t.tables));
+		let { discovered: t } = await Z(e);
+		return Ze(An(t.tables));
 	} catch {
 		return null;
 	}
-}, wn = async (e) => {
-	let t = await Cn(e);
+}, Mn = async (e) => {
+	let t = await jn(e);
 	if (t === null || t.tablesChecked === 0) return;
-	let n = Qe(t);
+	let n = $e(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
-}, Tn = async (e) => {
+}, Nn = async (e) => {
 	try {
-		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await Q(e);
-		return nt(n.events.map((e) => {
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await Z(e);
+		return rt(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
 				name: n.name,
@@ -2030,19 +2110,19 @@ var re = () => {
 	} catch {
 		return null;
 	}
-}, En = async (e) => {
-	let t = await Tn(e);
+}, Pn = async (e) => {
+	let t = await Nn(e);
 	if (t === null || t.eventsChecked === 0) return;
-	let n = rt(t);
+	let n = it(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
-	let r = it(t);
+	let r = at(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
-}, Dn = (e) => {
+}, Fn = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
 	return r === void 0 ? n : `${r}: ${n}`;
-}, On = async (e) => {
+}, In = async (e) => {
 	try {
-		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await Q(e)).discovered.serverOnlyLeaks, r = t(n);
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await Z(e)).discovered.serverOnlyLeaks, r = t(n);
 		return {
 			status: {
 				checked: !0,
@@ -2053,17 +2133,17 @@ var re = () => {
 	} catch (e) {
 		return { status: {
 			checked: !1,
-			reason: Dn(e)
+			reason: Fn(e)
 		} };
 	}
-}, kn = async (e) => {
-	let { status: t, message: n } = await On(e);
+}, Ln = async (e) => {
+	let { status: t, message: n } = await In(e);
 	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, An = async (e) => {
+}, Rn = async (e) => {
 	let t;
 	try {
-		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await Q(e);
-		t = st(r, i.workflows.map((e) => {
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await Z(e);
+		t = ct(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
 				optional: []
@@ -2077,21 +2157,46 @@ var re = () => {
 	} catch {
 		return;
 	}
-	let n = ct(t);
+	let n = lt(t);
 	if (n === null) return;
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, $ = "voltro-authz-allowlist.txt", jn = (e, t = (e) => {
+}, Q = "voltro-authz-allowlist.txt", zn = (e, t = (e) => {
 	try {
 		return E(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...bt, ...xt(J(e).map(t))]), Mn = async (e) => {
-	let { discovered: t } = await Q(e), n = [];
+}) => /* @__PURE__ */ new Set([...Ct, ...wt(q(e).map(t))]), Bn = async (e) => {
+	let t = ["src/locales", "locales"], n, r = [];
+	for (let i of t) {
+		let t = x(e, i);
+		if (T(t)) try {
+			r = D(t).filter((e) => /\.tsx?$/.test(e) && !e.endsWith(".d.ts")).map((e) => e.replace(/\.tsx?$/, "")), n = i;
+			break;
+		} catch {}
+	}
+	if (n === void 0 || r.length === 0) return;
+	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-DeEJj5T4.js");
+		let { loadApiConfig: t } = await import("./dev-DXhhZ7-f.js");
+		i = (await t(e))?.locales ?? [];
+	} catch {
+		return;
+	}
+	let a = bt({
+		catalogCodes: r,
+		declaredLocales: i
+	});
+	if (a !== void 0) {
+		console.log("");
+		for (let e of xt(a, n)) console.log(e);
+	}
+}, Vn = async (e) => {
+	let { discovered: t } = await Z(e), n = [];
+	try {
+		let { loadApiConfig: t } = await import("./dev-DXhhZ7-f.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -2107,8 +2212,8 @@ var re = () => {
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: Nn.has(e.name),
-				canAlias: Pn.has(e.name)
+				canDisableTables: Hn.has(e.name),
+				canAlias: Un.has(e.name)
 			};
 		});
 	} catch {
@@ -2120,89 +2225,115 @@ var re = () => {
 		...t.mutations,
 		...t.actions,
 		...t.streams ?? []
-	].map((e) => String(e.descriptor.name)), i = jt(n, {
+	].map((e) => String(e.descriptor.name)), i = It(n, {
 		tables: t.tables.map((e) => e.tableName),
 		rpcTags: r
 	});
 	console.log();
-	for (let e of Mt(n, i)) console.log(e);
-}, Nn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Pn = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), Fn = async (e, t) => {
-	let { discovered: n } = await Q(e), r = /* @__PURE__ */ new Map(), i = (e) => {
-		if (!r.has(e)) try {
-			r.set(e, E(e, "utf8"));
+	for (let e of Lt(n, i)) console.log(e);
+}, Hn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Un = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), $ = 20, Wn = async (e) => {
+	let t = await Gn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
+	return {
+		executors: t.executorCount,
+		guardVocabulary: [...t.vocabulary].sort(),
+		counts: t.result.counts,
+		allowlist: {
+			exists: t.existing !== void 0,
+			debt: r,
+			reviewed: t.result.counts.allowlisted - r
+		},
+		unchecked: t.result.unchecked
+	};
+}, Gn = async (e) => {
+	let { discovered: t } = await Z(e), n = /* @__PURE__ */ new Map(), r = (e) => {
+		if (!n.has(e)) try {
+			n.set(e, E(e, "utf8"));
 		} catch {
-			r.set(e, "");
+			n.set(e, "");
 		}
-		return r.get(e);
-	}, a = jn(e, i), o = /* @__PURE__ */ new Set();
-	for (let e of n.tables) for (let t of Object.values(e.fields ?? {})) try {
+		return n.get(e);
+	}, i = zn(e, r), a = /* @__PURE__ */ new Set();
+	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
-		e && o.add(e.tableName);
+		e && a.add(e.tableName);
 	} catch {}
-	let s = [
+	let o = [
 		{
-			list: n.queries,
+			list: t.queries,
 			op: "read"
 		},
 		{
-			list: n.mutations,
+			list: t.mutations,
 			op: "update"
 		},
 		{
-			list: n.actions,
+			list: t.actions,
 			op: "update"
 		},
 		{
-			list: n.streams,
+			list: t.streams,
 			op: "read"
 		}
 	].flatMap(({ list: e, op: t }) => e.map((e) => {
-		let n = e.descriptor, r = n.target, a = Array.isArray(r) ? r[0] : r, o = e.file.replace(/\.(tsx?)$/, ".server.$1");
+		let n = e.descriptor, i = n.target, a = Array.isArray(i) ? i[0] : i, o = e.file.replace(/\.(tsx?)$/, ".server.$1");
 		return {
 			tag: String(n.name ?? e.file),
 			path: o,
-			src: i(o),
+			src: r(o),
 			hasDeclaredGuards: Array.isArray(n.guards) && n.guards.length > 0,
 			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
 			...a?.table === void 0 ? {} : { table: a.table }
 		};
-	})), c = x(e, $), l = T(c) ? kt(E(c, "utf8")) : void 0, u = Dt({
-		executors: s,
-		guardVocabulary: a,
-		tenantScopedTables: n.tenantScopedTables,
-		referencedTables: o,
-		allowlist: l ?? /* @__PURE__ */ new Set()
-	}), d = u.counts;
-	console.log(`\nauthz scan · ${s.length} executor(s)`);
-	let f = [...a].filter((e) => !bt.has(e)).sort();
-	if (console.log(f.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${f.length} from your source (${f.slice(0, 6).join(", ")}${f.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(d.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(d.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(d.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(d.vocabularyGuard).padStart(4)}`), console.log(`  – accepted as recorded debt             ${String(d.allowlisted).padStart(4)}   (${$})`), t) return ne(c, Ot(u.unchecked.map((e) => e.tag)), "utf8"), console.log(`\nwrote ${u.unchecked.length} tag(s) to ${$}. Doctor now fails on ADDITIONS only.`), !1;
-	if (u.unchecked.length === 0) return !1;
+	})), s = x(e, Q), c = T(s) ? Pt(E(s, "utf8")) : void 0;
+	return {
+		result: At({
+			executors: o,
+			guardVocabulary: i,
+			tenantScopedTables: t.tenantScopedTables,
+			referencedTables: a,
+			allowlist: c?.tags ?? /* @__PURE__ */ new Set()
+		}),
+		vocabulary: i,
+		existing: c,
+		reviewed: (c?.entries ?? []).filter((e) => e.reviewed !== void 0),
+		executorCount: o.length,
+		allowPath: s
+	};
+}, Kn = async (e, t) => {
+	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s } = await Gn(e), c = n.counts;
+	console.log(`\nauthz scan · ${o} executor(s)`);
+	let l = [...r].filter((e) => !Ct.has(e)).sort();
+	console.log(l.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${l.length} from your source (${l.slice(0, 6).join(", ")}${l.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(c.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(c.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(c.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(c.vocabularyGuard).padStart(4)}`);
+	let u = new Set(a.map((e) => e.tag)), d = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !u.has(e.tag)).length, f = c.allowlisted - d;
+	if (console.log(`  – accepted as recorded debt             ${String(d).padStart(4)}   (${Q})`), console.log(`  ✓ reviewed, open on purpose             ${String(f).padStart(4)}   (\`reviewed=<why>\` in that file)`), t) return ne(s, Mt([...a, ...n.unchecked.map((e) => ({ tag: e.tag }))]), "utf8"), console.log(`\nwrote ${n.unchecked.length} debt tag(s) to ${Q}${a.length > 0 ? `, keeping ${a.length} reviewed line(s)` : ""}. Doctor now fails on ADDITIONS only.`), !1;
+	if (n.unchecked.length === 0) return !1;
 	console.log("");
-	for (let e of u.unchecked.slice(0, 20)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
-	return u.unchecked.length > 20 && console.log(`  … and ${u.unchecked.length - 20} more`), l === void 0 ? (console.log(`\nNo ${$} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${u.unchecked.length} executor(s) with no access check are not in ${$}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, In = async (e) => {
-	if (e.includes("--help") || e.includes("-h")) return console.log(yn), 0;
+	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
+	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${Q} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${Q}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
+}, qn = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(Dn), 0;
 	let t = e.includes("--strict"), n = C(e.find((e) => !e.startsWith("-")) ?? process.cwd());
 	if (ie(e)) return re(), M({
-		...nn(n),
-		spaCandidates: await dn(n),
-		pageConvention: Y(n),
-		fileTaxonomy: U(n).findings,
-		junctionFks: (await Cn(n))?.issues ?? [],
-		eventDelivery: await Tn(n),
-		duplicateInstances: _t(n),
-		serverOnly: (await On(n)).status
+		...cn(n),
+		spaCandidates: await yn(n),
+		pageConvention: J(n),
+		fileTaxonomy: H(n).findings,
+		junctionFks: (await jn(n))?.issues ?? [],
+		eventDelivery: await Nn(n),
+		duplicateInstances: vt(n),
+		serverOnly: (await In(n)).status,
+		authz: await Wn(n)
 	}), 0;
-	let r = It(n, t);
-	on(n), an(n), vn(n), Be(n), await pn(n), await An(n), await xn(n), await wn(n), await En(n), await Mn(n);
-	let i = await kn(n), a = await Fn(n, e.includes("--write-authz-allowlist")), o = vt(_t(n));
+	let r = Vt(n, t);
+	mn(n), pn(n), En(n), Ve(n), await xn(n), await Rn(n), await kn(n), await Mn(n), await Pn(n), await Vn(n), await Bn(n);
+	let i = await Ln(n), a = await Kn(n, e.includes("--write-authz-allowlist")), o = yt(vt(n));
 	return o !== void 0 && console.log(`\n${o}`), i || a ? Math.max(r, 1) : r;
-}, Ln = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Rn = /* @__PURE__ */ new Set([
+}, Jn = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Yn = /* @__PURE__ */ new Set([
 	"insert",
 	"update",
 	"delete",
 	"upsert"
-]), zn = (e, t) => {
+]), Xn = (e, t) => {
 	let n = [], r = new Set(t.exercised), i = /* @__PURE__ */ new Map();
 	for (let e of t.edges) {
 		let t = i.get(e.tag);
@@ -2214,8 +2345,8 @@ var re = () => {
 			a.push(t.tag);
 			continue;
 		}
-		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(Ln(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
-		for (let t of c) if (Rn.has(t.op)) {
+		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(Jn(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
+		for (let t of c) if (Yn.has(t.op)) {
 			let r = u.get(t.table);
 			r === void 0 ? n.push({
 				rule: "observed/undeclared-write",
@@ -2271,7 +2402,7 @@ var re = () => {
 			total: e.length
 		}
 	};
-}, Bn = (e, t = [], n = 0) => {
+}, Zn = (e, t = [], n = 0) => {
 	if (n > 12) return t;
 	let r;
 	try {
@@ -2289,30 +2420,30 @@ var re = () => {
 			".git",
 			"coverage"
 		].includes(i)) continue;
-		let r = `${e}/${i}`, a;
+		let r = `${e}/${i}`, o;
 		try {
-			a = O(r);
+			o = O(r);
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? Bn(r, t, n + 1) : a.isFile() && o.test(i) && t.push(r);
+		o.isDirectory() ? Zn(r, t, n + 1) : o.isFile() && a.test(i) && t.push(r);
 	}
 	return t;
-}, Vn = /* @__PURE__ */ new Set(["actors", "tenants"]), Hn = async (e) => {
+}, Qn = /* @__PURE__ */ new Set(["actors", "tenants"]), $n = async (e) => {
 	try {
 		let { readFile: t } = await import("node:fs/promises"), { join: n } = await import("node:path"), r = await t(n(e, "app.graph.observed.generated.json"), "utf8"), i = JSON.parse(r);
 		return i?.version !== 1 || !Array.isArray(i.edges) || !Array.isArray(i.exercised) ? null : i;
 	} catch {
 		return null;
 	}
-}, Un = (e) => {
+}, er = (e) => {
 	let { exercised: t, total: n } = e.coverage, r = `\nobserved: ${t}/${n} procedures exercised (${n === 0 ? 0 : Math.round(t / n * 100)}%)`;
 	if (e.diagnostics.length === 0) return `${r}\n  no declared/observed mismatches${e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : ""}`;
 	let i = e.diagnostics.map((e) => `  ${e.node}${e.file === void 0 ? "" : ` (${e.file})`}\n` + e.breaks.map((e) => `    ${e}`).join("\n") + `\n    fix: ${e.fix}`), a = e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : "";
 	return `${r}\n${i.join("\n")}${a}`;
-}, Wn = (e, t) => ({
+}, tr = (e, t) => ({
 	tables: (t.tables ?? []).map((e) => e.name),
-	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || Vn.has(e.name)).map((e) => e.name),
+	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || Qn.has(e.name)).map((e) => e.name),
 	scopes: e.scopes ?? [],
 	procedures: (e.procedures ?? []).map((e) => {
 		let t = (e.guards ?? []).flatMap((e) => e.kind === "scope" ? e.scope ?? [] : []);
@@ -2325,16 +2456,16 @@ var re = () => {
 			...e.guards === void 0 ? {} : { hasGuards: e.guards.length > 0 }
 		};
 	})
-}), Gn = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
+}), nr = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
-}).join("\n"), Kn = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-DeEJj5T4.js"), { buildRpcEntry: i } = await import("./manifestBuild-Ck_90gZy.js"), { buildCapabilityManifest: a } = await import("./inspect-DHeaMZak.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+}).join("\n"), rr = async (e) => {
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-DXhhZ7-f.js"), { buildRpcEntry: i } = await import("./manifestBuild-Dj8Jjoto.js"), { buildCapabilityManifest: a } = await import("./inspect-mmBuRXmy.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
 		...s.streams.map((e) => c(e.descriptor, "stream", e.file))
-	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-BTNirAAk.js"), d = await u({ root: e }).catch(() => []), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
+	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-Bn_c4Mnl.js"), d = await u({ root: e }).catch(() => []), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
 		name: e,
 		framework: !0
 	}))], m = await r(e).then((e) => e?.plugins ?? []).catch(() => []);
@@ -2345,21 +2476,21 @@ var re = () => {
 		})), [], m),
 		tables: { tables: p }
 	};
-}, qn = async (e) => {
+}, ir = async (e) => {
 	let t = ue(e.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]));
 	if ("error" in t) return console.error(`voltro check: ${t.error}`), 1;
-	let { process: n, target: r, rest: i } = de(t.rest), o;
+	let { process: n, target: r, rest: i } = de(t.rest), a;
 	for (let e = 0; e < i.length; e++) if (i[e] === "--diff") {
 		let [t, n] = (i[++e] ?? "").split(":");
-		if (t === "removeTable" && n) o = {
+		if (t === "removeTable" && n) a = {
 			kind: "removeTable",
 			name: n
 		};
-		else if (t === "removeProcedure" && n) o = {
+		else if (t === "removeProcedure" && n) a = {
 			kind: "removeProcedure",
 			tag: n
 		};
-		else if (t === "removeScope" && n) o = {
+		else if (t === "removeScope" && n) a = {
 			kind: "removeScope",
 			name: n
 		};
@@ -2369,7 +2500,7 @@ var re = () => {
 	if (l.length === 0) {
 		if (!c && r !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
 		try {
-			let e = await Kn(C(s));
+			let e = await rr(C(s));
 			u = e.manifest, d = e.tables;
 		} catch (e) {
 			return console.error(`voltro check: could not assemble the graph from source: ${e.message}`), console.error("  Start `voltro dev` to check against a running api instead."), 1;
@@ -2379,21 +2510,21 @@ var re = () => {
 		if (t.kind === "err") return console.error(`voltro check: manifest fetch failed: ${t.error}`), 1;
 		u = t.data, d = n.kind === "ok" ? n.data : { tables: [] };
 	}
-	let f = Wn(u, d), p = he(f, o), m = [...U(s).findings.map((e) => ({
+	let f = tr(u, d), p = he(f, a), m = [...H(s).findings.map((e) => ({
 		rule: e.rule,
 		node: e.file,
 		file: e.file,
 		breaks: [e.detail],
 		fix: e.fix,
 		severity: e.severity
-	})), ...Y(s).map((e) => ({
+	})), ...J(s).map((e) => ({
 		rule: `page/${e.kind}`,
 		node: e.file,
 		file: e.file,
 		breaks: [e.kind === "suffixed-outside-pages" ? "a page.tsx outside src/pages/ never routes" : "no test beside it"],
 		fix: e.kind === "suffixed-outside-pages" ? "move it under src/pages/ into the directory whose route it serves, or rename it — page.tsx is reserved" : "write the test with the file — the name is derivable",
 		severity: e.kind === "suffixed-outside-pages" ? "error" : "warn"
-	}))], h = (await a(s, Bn(s))).map((e) => ({
+	}))], h = (await o(s, Zn(s))).map((e) => ({
 		rule: "client/not-browser-safe",
 		node: e.file,
 		file: e.file,
@@ -2404,7 +2535,7 @@ var re = () => {
 		...p.diagnostics,
 		...m,
 		...h
-	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await Hn(C(s)), y = v === null ? null : zn(f.procedures, v);
+	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await $n(C(s)), y = v === null ? null : Xn(f.procedures, v);
 	return t.format === "json" ? M(y === null ? {
 		...p,
 		ok: _,
@@ -2414,7 +2545,7 @@ var re = () => {
 		ok: _,
 		diagnostics: g,
 		observed: y
-	}) : (console.log(Gn(g)), y !== null && console.log(Un(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
+	}) : (console.log(nr(g)), y !== null && console.log(er(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
 };
 //#endregion
-export { re as _, Le as a, I as c, N as d, ue as f, le as g, ce as h, It as i, ve as l, se as m, qn as n, be as o, de as p, In as r, xe as s, Kn as t, he as u, M as v, ie as y };
+export { re as _, Re as a, I as c, N as d, ue as f, le as g, ce as h, Vt as i, ve as l, se as m, ir as n, be as o, de as p, qn as r, xe as s, rr as t, he as u, M as v, ie as y };