@voltro/cli 0.30.2 → 0.31.0

package/dist/{checkCommand-D_wdOFhw.js → checkCommand-D7r6_pk7.js}

@@ -1,30 +1,31 @@
-import { f as e, gt as t, n, o as r, z as i } from "./inspectMetrics-BM1vrsga.js";
-import { Ut as a, Wt as o } from "./dev-GAOIot9G.js";
-import { C as s, E as c, O as l, T as u, d, h as f, i as p, l as m, m as h, r as g, u as _ } from "./fileConventions-Cof68_BL.js";
-import { r as v, u as y } from "./apiBuild-BUS1RfPi.js";
-import { dirname as b, isAbsolute as ee, join as x, relative as S, resolve as C, sep as w } from "node:path";
-import { routeDiagnosticsToStderr as te } from "@voltro/logger";
-import { existsSync as T, readFileSync as E, readdirSync as D, statSync as O, writeFileSync as ne } from "node:fs";
+import { Ct as e, et as t, f as n, n as r, nt as i, o as a, rt as o, tt as s, z as c } from "./inspectMetrics-BeEAnjqw.js";
+import { Ht as l, Ut as u } from "./dev-DdQEn2Ia.js";
+import { C as d, E as f, O as p, T as m, d as h, h as g, i as _, l as v, m as y, r as ee, u as te } from "./fileConventions-Cof68_BL.js";
+import { r as ne, u as re } from "./apiBuild-CLPt-pX6.js";
+import { r as ie } from "./appGraph-gQ_6GkQQ.js";
+import { dirname as b, isAbsolute as ae, join as x, relative as S, resolve as C, sep as w } from "node:path";
+import { routeDiagnosticsToStderr as oe } from "@voltro/logger";
+import { existsSync as T, readFileSync as E, readdirSync as D, statSync as O, writeFileSync as se } from "node:fs";
 import { Node as k, Project as A, SyntaxKind as j } from "ts-morph";
 //#region src/cliOutput.ts
-var re = () => {
-	te();
+var ce = () => {
+	oe();
 }, M = (e, t = {}) => {
 	console.log(JSON.stringify(e, null, t.pretty === !1 ? 0 : 2));
-}, ie = (e) => {
+}, le = (e) => {
 	for (let t = 0; t < e.length; t++) {
 		let n = e[t];
 		if (n === "--json" || n === "--format=json" || n === "--format" && e[t + 1] === "json") return !0;
 	}
 	return !1;
-}, ae = (e, t, n = !1) => {
+}, ue = (e, t, n = !1) => {
 	let r = { ...e ?? {} }, i = t ?? process.env.VOLTRO_INSPECT_TOKEN;
 	if (i !== void 0 && i !== "" && (r.authorization = `Bearer ${i}`), n) {
 		let e = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
 		e !== void 0 && e !== "" && (r["x-voltro-inspect-write"] = e);
 	}
 	return r;
-}, oe = /* @__PURE__ */ new Set([
+}, de = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",
@@ -34,7 +35,7 @@ var re = () => {
 	try {
 		let t = await fetch(r, {
 			method: i,
-			headers: ae(a ? { "content-type": "application/json" } : void 0, e.inspectToken, oe.has(i)),
+			headers: ue(a ? { "content-type": "application/json" } : void 0, e.inspectToken, de.has(i)),
 			...a ? { body: JSON.stringify(n.body) } : {}
 		}), o = await t.text(), s;
 		if (o.length > 0) try {
@@ -43,7 +44,7 @@ var re = () => {
 			s = o;
 		}
 		if (!t.ok) {
-			let n = s, r = typeof n == "object" && n ? String(n.message ?? n.reason ?? n.error ?? `HTTP ${t.status}`) : `HTTP ${t.status}`, a = oe.has(i) && (process.env.VOLTRO_INSPECT_WRITE_TOKEN ?? "") === "" && /write/i.test(r);
+			let n = s, r = typeof n == "object" && n ? String(n.message ?? n.reason ?? n.error ?? `HTTP ${t.status}`) : `HTTP ${t.status}`, a = de.has(i) && (process.env.VOLTRO_INSPECT_WRITE_TOKEN ?? "") === "" && /write/i.test(r);
 			return {
 				kind: "err",
 				name: e.name,
@@ -63,7 +64,7 @@ var re = () => {
 			error: t.message || String(t)
 		};
 	}
-}, se = (e, t = process.env) => {
+}, P = (e, t = process.env) => {
 	let n = [], r, i;
 	for (let t = 0; t < e.length; t++) {
 		let a = e[t];
@@ -108,7 +109,7 @@ var re = () => {
 		},
 		rest: n
 	};
-}, ce = (e) => ({
+}, fe = (e) => ({
 	id: `remote:${e.url}`,
 	name: e.name,
 	kind: "api",
@@ -119,7 +120,7 @@ var re = () => {
 	status: "live",
 	logFile: "",
 	...e.token === void 0 ? {} : { inspectToken: e.token }
-}), le = async (e, n) => n === void 0 ? (await t()).apps.filter((t) => t.kind === "api" && t.status === "live" && t.url.length > 0 && (e === void 0 || t.name === e)) : [ce(n)], ue = (e) => {
+}), pe = async (t, n) => n === void 0 ? (await e()).apps.filter((e) => e.kind === "api" && e.status === "live" && e.url.length > 0 && (t === void 0 || e.name === t)) : [fe(n)], me = (e) => {
 	let t = "pretty", n = [];
 	for (let r = 0; r < e.length; r++) {
 		let i = e[r];
@@ -143,8 +144,8 @@ var re = () => {
 		format: t,
 		rest: n
 	};
-}, de = (e, t = process.env) => {
-	let { target: n, rest: r, error: i } = se(e, t), a, o = [];
+}, he = (e, t = process.env) => {
+	let { target: n, rest: r, error: i } = P(e, t), a, o = [];
 	for (let e = 0; e < r.length; e++) {
 		let t = r[e];
 		if (t === "--process") {
@@ -163,112 +164,6 @@ var re = () => {
 		rest: o,
 		...i === void 0 ? {} : { error: i }
 	};
-}, P = (e) => e.source === void 0 ? [] : typeof e.source == "string" ? [e.source] : e.source, fe = (e) => ({
-	tables: new Set(e.tables),
-	procedures: new Map(e.procedures.map((e) => [e.tag, e])),
-	scopes: new Set(e.scopes ?? []),
-	input: e
-}), pe = (e) => {
-	let t = [], n = /* @__PURE__ */ new Set();
-	for (let r of e.input.procedures) {
-		for (let i of P(r)) n.add(i), e.tables.has(i) || t.push({
-			rule: "reference/dangling-source",
-			node: `${r.kind}(${r.tag})`,
-			...r.file === void 0 ? {} : { file: r.file },
-			breaks: [`reads table '${i}' which does not exist`],
-			fix: `declare a '${i}.entity.ts' table or fix the query's source`,
-			severity: "error"
-		});
-		for (let i of r.targets ?? []) n.add(i.table), e.tables.has(i.table) || t.push({
-			rule: "reference/dangling-target",
-			node: `${r.kind}(${r.tag})`,
-			...r.file === void 0 ? {} : { file: r.file },
-			breaks: [`targets table '${i.table}' (op '${i.op}') which does not exist`],
-			fix: `declare a '${i.table}.entity.ts' table or fix the mutation's target`,
-			severity: "error"
-		});
-		for (let n of r.requiresScopes ?? []) e.scopes.size > 0 && !e.scopes.has(n) && t.push({
-			rule: "rbac/unknown-scope",
-			node: `${r.kind}(${r.tag})`,
-			...r.file === void 0 ? {} : { file: r.file },
-			breaks: [`requires scope '${n}' which is not declared`],
-			fix: `declare the scope '${n}' or fix the requireScope(...) call`,
-			severity: "error"
-		});
-		r.kind === "mutation" && r.hasGuards === !1 && t.push({
-			rule: "rbac/unguarded-mutation",
-			node: `${r.kind}(${r.tag})`,
-			...r.file === void 0 ? {} : { file: r.file },
-			breaks: [`'${r.tag}' changes state but declares no guard — any caller who can reach the rpc surface can invoke it`],
-			fix: "add a guard (e.g. `.guard(requireScope('…'))`), or confirm it is intentionally public",
-			severity: "warn"
-		});
-	}
-	for (let n of e.input.routes ?? []) for (let r of n.binds) e.procedures.has(r) || t.push({
-		rule: "binding/unknown-tag",
-		node: `route(${n.pattern})`,
-		...n.file === void 0 ? {} : { file: n.file },
-		breaks: [`binds rpc tag '${r}' which does not exist`],
-		fix: `bind an existing tag, or restore '${r}' (it may have been renamed/removed)`,
-		severity: "error"
-	});
-	for (let t of e.input.procedures) for (let e of t.targets ?? []) n.add(e.table);
-	let r = new Set(e.input.frameworkOwnedTables ?? []), i = e.input.procedures.filter((e) => e.kind === "action" && P(e).length === 0 && (e.targets ?? []).length === 0).length;
-	for (let a of e.tables) r.has(a) || n.has(a) || t.push({
-		rule: "orphan/unread-table",
-		node: `table(${a})`,
-		breaks: i > 0 ? [`no query reads and no mutation writes '${a}'`, `${i} action(s) declare neither source nor target, so one of them may still use it`] : [`no query reads and no mutation writes '${a}'`],
-		fix: i > 0 ? "declare `source`/`target` on your actions so this can be answered, then re-run" : `add a query/mutation for '${a}', or remove the table if it's dead`,
-		severity: "warn"
-	});
-	if (e.scopes.size > 0) {
-		let n = /* @__PURE__ */ new Set();
-		for (let t of e.input.procedures) for (let e of t.requiresScopes ?? []) n.add(e);
-		for (let r of [...e.scopes].sort()) r === "admin:full" || n.has(r) || t.push({
-			rule: "rbac/unenforced-scope",
-			node: `scope(${r})`,
-			breaks: [`'${r}' is granted by a role but NO query/mutation/action/stream guards on it`, "a scope nobody checks grants nothing and withholds nothing — the role map reads stricter than the app is"],
-			fix: `add \`.guard(requireScope('${r}'))\` to the handlers it is meant to protect — or, if a plugin route, a REST route, or a UI-only affordance enforces it, say so where the role is declared`,
-			severity: "warn"
-		});
-	}
-	return t;
-}, me = (e, t) => {
-	let n = [];
-	if (t.kind === "removeTable") for (let r of e.input.procedures) {
-		let e = P(r).includes(t.name), i = (r.targets ?? []).some((e) => e.table === t.name);
-		(e || i) && n.push({
-			rule: "blast/table-removed",
-			node: `${r.kind}(${r.tag})`,
-			...r.file === void 0 ? {} : { file: r.file },
-			breaks: [`${e ? "reads" : "writes"} table '${t.name}' — would break if removed`],
-			fix: `migrate or remove ${r.tag} before dropping '${t.name}'`,
-			severity: "error"
-		});
-	}
-	else if (t.kind === "removeProcedure") for (let r of e.input.routes ?? []) r.binds.includes(t.tag) && n.push({
-		rule: "blast/procedure-removed",
-		node: `route(${r.pattern})`,
-		...r.file === void 0 ? {} : { file: r.file },
-		breaks: [`binds '${t.tag}' — would break if removed`],
-		fix: `rebind ${r.pattern} to another tag before removing '${t.tag}'`,
-		severity: "error"
-	});
-	else for (let r of e.input.procedures) (r.requiresScopes ?? []).includes(t.name) && n.push({
-		rule: "blast/scope-removed",
-		node: `${r.kind}(${r.tag})`,
-		...r.file === void 0 ? {} : { file: r.file },
-		breaks: [`requires scope '${t.name}' — would become unguarded/dangling if removed`],
-		fix: `remove the requireScope('${t.name}') call or keep the scope`,
-		severity: "error"
-	});
-	return n;
-}, he = (e, t) => {
-	let n = fe(e), r = [...pe(n), ...t === void 0 ? [] : me(n, t)];
-	return {
-		ok: !r.some((e) => e.severity === "error"),
-		diagnostics: r
-	};
 }, ge = (e) => {
 	let t = "", n = !1;
 	for (let r = 0; r < e.length; r++) {
@@ -343,7 +238,7 @@ var re = () => {
 		}
 	} };
 }, ve = (e, t = "tsconfig.json") => {
-	let n = ee(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
+	let n = ae(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
 	if (i === void 0) return;
 	let a = {};
 	for (let [e, t] of Object.entries(i)) Array.isArray(t) && (a[e] = t.filter((e) => typeof e == "string"));
@@ -352,7 +247,7 @@ var re = () => {
 		paths: a
 	};
 }, I = (e, t = "tsconfig.json") => {
-	let n = ee(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
+	let n = ae(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
 	if (i === void 0) return [];
 	let a = C(b(n), r?.compilerOptions?.baseUrl ?? "."), o = [];
 	for (let [e, t] of Object.entries(i)) {
@@ -404,45 +299,45 @@ var re = () => {
 }, xe = (e, t) => t.some((t) => e === t.dir || e.startsWith(`${t.dir}${w}`)), Se = (e, t) => t.map((t) => `${S(e, t.dir) || "."}  (${t.source})`), Ce = [
 	{
 		id: "component.ui",
-		re: p,
+		re: _,
 		needsTest: !0
 	},
 	{
 		id: "component",
-		re: g,
+		re: ee,
 		needsTest: !0
 	},
 	{
 		id: "hook",
-		re: _,
+		re: te,
 		needsTest: !0
 	},
 	{
 		id: "tracking",
-		re: c,
+		re: f,
 		needsTest: !0
 	},
 	{
 		id: "store",
-		re: s,
+		re: d,
 		needsTest: !0
 	},
 	{
 		id: "internal",
-		re: d,
+		re: h,
 		needsTest: !0
 	},
 	{
 		id: "fixture",
-		re: m,
+		re: v,
 		needsTest: !1
 	},
 	{
 		id: "types",
-		re: l,
+		re: p,
 		needsTest: !1
 	}
-], R = (e) => Ce.find((t) => t.re.test(e))?.id ?? null, we = (e) => u.test(e), Te = /* @__PURE__ */ new Set([
+], R = (e) => Ce.find((t) => t.re.test(e))?.id ?? null, we = (e) => m.test(e), Te = /* @__PURE__ */ new Set([
 	"useMutation",
 	"useAction",
 	"useUpload",
@@ -487,17 +382,17 @@ var re = () => {
 		a.isDirectory() ? Ae(r, t, n + 1) : a.isFile() && ke.test(i) && !i.endsWith(".d.ts") && t.push(r);
 	}
 	return t;
-}, je = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, Me = /\b(?:memo|forwardRef|observer|styled)\b/, z = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), B = (e) => {
-	if (z(e)) return !0;
-	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return B(e.getExpression());
+}, je = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, Me = /\b(?:memo|forwardRef|observer|styled)\b/, Ne = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), z = (e) => {
+	if (Ne(e)) return !0;
+	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return z(e.getExpression());
 	if (k.isVariableDeclaration(e)) {
 		let t = e.getTypeNode();
 		if (t !== void 0 && je.test(t.getText())) return !0;
 		let n = e.getInitializer();
-		return n === void 0 || B(n);
+		return n === void 0 || z(n);
 	}
-	return k.isCallExpression(e) ? Me.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => z(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
-}, Ne = (e) => {
+	return k.isCallExpression(e) ? Me.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => Ne(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
+}, Pe = (e) => {
 	let t = [], n = [], r = [], i = /* @__PURE__ */ new Set();
 	for (let [a, o] of e.getExportedDeclarations()) {
 		let e = o[0];
@@ -508,7 +403,7 @@ var re = () => {
 			n.push(s);
 			continue;
 		}
-		if (/^[A-Z]/.test(s) && B(e)) {
+		if (/^[A-Z]/.test(s) && z(e)) {
 			t.push(s);
 			continue;
 		}
@@ -520,7 +415,7 @@ var re = () => {
 		others: r,
 		hasRuntimeExport: t.length + n.length + r.length > 0
 	};
-}, Pe = [], Fe = (e, t, n) => {
+}, B = [], Fe = (e, t, n) => {
 	let r = b(e), i = [];
 	for (let e = r;; e = b(e)) {
 		let r = n.get(e);
@@ -537,8 +432,8 @@ var re = () => {
 		}
 		if (e === t || b(e) === e) break;
 	}
-	for (let e of i) n.set(e, Pe);
-	return Pe;
+	for (let e of i) n.set(e, B);
+	return B;
 }, Ie = (e, t, n) => {
 	let r = t.startsWith(".") ? C(b(e), t) : ye(t, n);
 	if (r === void 0) return null;
@@ -627,14 +522,14 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		s.set(t, Ne(r)), c.set(t, Le(r, t, Fe(t, e, u))), l.set(t, Re(r));
+		s.set(t, Pe(r)), c.set(t, Le(r, t, Fe(t, e, u))), l.set(t, Re(r));
 	}
 	let d = /* @__PURE__ */ new Map();
 	for (let [e, t] of c) for (let n of t.localTargets) {
 		let t = d.get(n) ?? [];
 		t.push(e), d.set(n, t);
 	}
-	let p = (e) => {
+	let f = (e) => {
 		let t = s.get(e), n = /* @__PURE__ */ new Set([
 			...t?.components ?? [],
 			...t?.hooks ?? [],
@@ -655,12 +550,12 @@ var re = () => {
 			}
 		};
 		return a(e, null), [...r];
-	}, m = 0;
+	}, p = 0;
 	for (let e of r) {
 		let t = R(e), n = s.get(e), r = c.get(e);
 		if (n === void 0 || r === void 0) continue;
 		let i = we(e);
-		t !== null && !i && (m += 1);
+		t !== null && !i && (p += 1);
 		let u = d.get(e) ?? [];
 		if ((t === "component" || t === "component.ui") && !i) {
 			let t = ze(n.components);
@@ -729,9 +624,9 @@ var re = () => {
 				detail: `imports write hook(s): ${t.join(", ")}`,
 				fix: "a *.component.ui.tsx renders; it does not write. Lift the mutation into the *.component.tsx that owns it and pass a handler down. Reading (useT / useCan / usePermissions) stays allowed — threading those through props is prop-drilling, not reusability"
 			});
-			let n = p(e), i = n.filter((e) => {
+			let n = f(e), i = n.filter((e) => {
 				let t = R(e);
-				return t === "component" || t === "component.ui" || h.test(e) || f.has(e.slice(e.lastIndexOf(w) + 1));
+				return t === "component" || t === "component.ui" || y.test(e) || g.has(e.slice(e.lastIndexOf(w) + 1));
 			});
 			n.length === 0 ? a.push({
 				rule: "ui/orphaned",
@@ -794,7 +689,7 @@ var re = () => {
 	}
 	return a.sort((e, t) => e.file === t.file ? e.rule.localeCompare(t.rule) : e.file.localeCompare(t.file)), {
 		findings: a,
-		declared: m,
+		declared: p,
 		scanned: r.length,
 		vendored: n
 	};
@@ -1173,99 +1068,14 @@ var re = () => {
 	"   reaches your deploy target is not knowable from here — a secret manager",
 	"   or a CI variable is not a file. Naming it nowhere is conclusive; naming",
 	"   it somewhere is not a guarantee."
-].join("\n"), mt = (e) => e === "effect" || e.startsWith("@effect/") || e.startsWith("@voltro/") || e === "react" || e === "react-dom", ht = /(^|\/)(\.bin|\.cache|\.pnpm-store|dist|build)(\/|$)/, gt = (e) => {
-	let t = [], n = e;
-	for (let e = 0; e < 12; e++) {
-		let e = x(n, "node_modules");
-		T(e) && t.push(e);
-		let r = b(n);
-		if (r === n) break;
-		n = r;
-	}
-	return t;
-}, _t = (e) => {
-	try {
-		let t = JSON.parse(E(x(e, "package.json"), "utf8"));
-		return typeof t.version == "string" ? t.version : void 0;
-	} catch {
-		return;
-	}
-}, vt = (e) => {
-	let t = [], n;
-	try {
-		n = D(e);
-	} catch {
-		return t;
-	}
-	for (let r of n) {
-		if (r.startsWith(".") || ht.test(r)) continue;
-		let n = x(e, r);
-		if (r.startsWith("@")) {
-			let e;
-			try {
-				e = D(n);
-			} catch {
-				continue;
-			}
-			for (let i of e) t.push({
-				pkg: `${r}/${i}`,
-				dir: x(n, i)
-			});
-			continue;
-		}
-		try {
-			if (!O(n).isDirectory()) continue;
-		} catch {
-			continue;
-		}
-		t.push({
-			pkg: r,
-			dir: n
-		});
-	}
-	return t;
-}, yt = (e) => {
-	let t = /* @__PURE__ */ new Map();
-	for (let n of gt(e)) for (let { pkg: e, dir: r } of vt(n)) {
-		if (!mt(e)) continue;
-		let n = _t(r);
-		if (n === void 0) continue;
-		let i = t.get(e) ?? /* @__PURE__ */ new Map();
-		i.has(n) || i.set(n, r), t.set(e, i);
-	}
-	let n = [];
-	for (let [r, i] of t) i.size < 2 || n.push({
-		pkg: r,
-		versions: [...i.keys()].sort(),
-		paths: [...i.values()].map((t) => S(e, t)).sort()
-	});
-	return n.sort((e, t) => e.pkg.localeCompare(t.pkg));
-}, bt = (e) => {
-	if (e.length !== 0) return [
-		`•  ${e.length} package(s) resolved at more than one version:`,
-		...e.flatMap((e) => [`     ${e.pkg} — ${e.versions.join(", ")}`, ...e.paths.map((e) => `       ${e}`)]),
-		"",
-		"   Two copies of `effect` (or `@effect/*`) is the usual cause of type errors",
-		"   inside the GENERATED rpcGroup.generated.ts that look like framework bugs:",
-		"   \"Property '[TypeId]' is missing\", \"typeof Never is not assignable to All\",",
-		"   or an `Rpc<…, Stream<…>, …>` that will not go where `Any` is expected.",
-		"   Effect types are nominal, so a Schema built by one copy is not the same",
-		"   type as a Schema expected by the other — and the RUNTIME often still works,",
-		"   which is why this shows up as a red tsc against a green server.",
-		"",
-		"   Fix it in the install, not the code: align the version across the workspace",
-		"   (a root `pnpm.overrides` / `resolutions` entry for `effect` is the blunt",
-		"   instrument), then reinstall. Do not silence the generated file — it is where",
-		"   a genuine mistake in your own descriptors surfaces."
-	].join("\n");
-}, xt = (e) => {
+].join("\n"), mt = (e) => {
 	if (e.catalogCodes.length === 0) return;
 	let t = new Set(e.declaredLocales), n = e.catalogCodes.filter((e) => !t.has(e)).sort();
 	if (n.length !== 0) return {
 		orphaned: n,
 		noneDeclared: t.size === 0
 	};
-}, St = (e, t) => {
+}, ht = (e, t) => {
 	let n = e.orphaned.join(", ");
 	return e.noneDeclared ? [
 		`⚠  ${t} has ${e.orphaned.length} catalog(s) — ${n} — and the app declares no \`locales:\`.`,
@@ -1277,33 +1087,33 @@ var re = () => {
 		"   …or delete the files. A catalog that is never loaded looks from the inside",
 		"   exactly like one that works, which is why this is worth a line."
 	] : [`⚠  ${t} has catalog(s) not in \`locales:\` — ${n} — so they are never imported.`, "   Add the code(s) to `locales:` in your app config, or delete the file(s)."];
-}, Ct = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), wt = /* @__PURE__ */ new Set([
+}, gt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), _t = /* @__PURE__ */ new Set([
 	"requireScope",
 	"requireAnyScope",
 	"requireAuth",
 	"assertScope",
 	"assertCan",
 	"can"
-]), Tt = (e) => {
+]), vt = (e) => {
 	let t = /* @__PURE__ */ new Set();
-	for (let n of e) for (let e of Ct(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
+	for (let n of e) for (let e of gt(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
 	return t;
-}, Et = (e, t) => {
+}, yt = (e, t) => {
 	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
-}, Dt = (e) => {
+}, bt = (e) => {
 	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
 	return t && n;
-}, Ot = (e, t, n) => {
+}, xt = (e, t, n) => {
 	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
-	let r = Ct(e.src), i = Et(r, t);
-	return i === void 0 ? Dt(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+	let r = gt(e.src), i = yt(r, t);
+	return i === void 0 ? bt(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
 		kind: "vocabulary-guard",
 		name: i
 	};
-}, kt = (e, t, n) => {
+}, St = (e, t, n) => {
 	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
 	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
-}, At = (e, t, n) => {
+}, Ct = (e, t, n) => {
 	switch (t.kind) {
 		case "declared-guard": return "guards: on the descriptor";
 		case "vocabulary-guard": return `calls ${t.name}()`;
@@ -1311,15 +1121,15 @@ var re = () => {
 		case "allowlisted": return "accepted by a previous run";
 		case "unchecked": return n ? e.op === "read" ? "no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt" : `${e.op}s${e.table ? ` ${e.table}` : ""} with no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt` : e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
 	}
-}, jt = (e) => {
+}, wt = (e) => {
 	let t = e.executors.map((t) => {
-		let n = Ot(t, e.guardVocabulary, e.allowlist);
+		let n = xt(t, e.guardVocabulary, e.allowlist);
 		return {
 			tag: t.tag,
 			path: t.path,
 			verdict: n,
-			severity: kt(t, e.tenantScopedTables, e.referencedTables),
-			why: At(t, n, e.rowFilterRegistered === !0)
+			severity: St(t, e.tenantScopedTables, e.referencedTables),
+			why: Ct(t, n, e.rowFilterRegistered === !0)
 		};
 	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
 	return {
@@ -1333,7 +1143,7 @@ var re = () => {
 		},
 		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
 	};
-}, Mt = [
+}, Tt = [
 	"# voltro doctor — authz allowlist",
 	"#",
 	"# Two KINDS of line, and the difference is the point:",
@@ -1358,18 +1168,18 @@ var re = () => {
 	"# `--write-authz-allowlist` PRESERVES reviewed= lines. It only ever adds debt",
 	"# lines for executors that are newly unchecked.",
 	""
-], Nt = (e) => {
+], Et = (e) => {
 	let t = [...e].map((e) => typeof e == "string" ? { tag: e } : e), n = t.filter((e) => e.reviewed === void 0).map((e) => e.tag).sort(), r = t.filter((e) => e.reviewed !== void 0).sort((e, t) => e.tag.localeCompare(t.tag));
 	return [
-		...Mt,
+		...Tt,
 		...n,
 		...r.length > 0 ? ["", "# reviewed — read by a human, open on purpose"] : [],
 		...r.map((e) => `${e.tag}  reviewed=${e.reviewed}`),
 		""
 	].join("\n");
-}, Pt = (e, t) => {
+}, Dt = (e, t) => {
 	let n = [...new Set(t)].sort();
-	if (e === void 0) return Nt(n.map((e) => ({ tag: e })));
+	if (e === void 0) return Et(n.map((e) => ({ tag: e })));
 	let r = W(e).tags, i = n.filter((e) => !r.has(e));
 	return i.length === 0 ? e : [
 		e.replace(/\n+$/, ""),
@@ -1379,7 +1189,7 @@ var re = () => {
 		...i,
 		""
 	].join("\n");
-}, Ft = (e, t) => {
+}, Ot = (e, t) => {
 	let n = [...new Set(t)];
 	if (e === void 0) return {
 		added: n.length,
@@ -1392,7 +1202,7 @@ var re = () => {
 		kept: r.size,
 		removed: 0
 	};
-}, It = class extends Error {
+}, kt = class extends Error {
 	tag;
 	constructor(e) {
 		super(`authz allowlist: '${e}' is marked reviewed with no reason. Write \`${e}  reviewed=<why it is genuinely open>\`. A bare tag is the other, honest option — it records the executor as DEBT, which is what an unexplained exemption is.`), this.tag = e, this.name = "AllowlistReasonMissingError";
@@ -1410,7 +1220,7 @@ var re = () => {
 			continue;
 		}
 		let a = r[2].trim();
-		if (a.length === 0) throw new It(i);
+		if (a.length === 0) throw new kt(i);
 		t.push({
 			tag: i,
 			reviewed: a
@@ -1420,13 +1230,13 @@ var re = () => {
 		tags: new Set(t.map((e) => e.tag)),
 		entries: t
 	};
-}, Lt = (e) => {
+}, At = (e) => {
 	let t = e.indexOf(".");
 	return t <= 0 ? void 0 : e.slice(0, t);
-}, Rt = (e, t) => {
+}, jt = (e, t) => {
 	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
 	for (let e of t.rpcTags) {
-		let t = Lt(e);
+		let t = At(e);
 		if (t === void 0) continue;
 		let n = i.get(t);
 		n ? n.push(e) : i.set(t, [e]);
@@ -1455,7 +1265,7 @@ var re = () => {
 			});
 			continue;
 		}
-		let s = new Set(o.rpcTags.map(Lt).filter((e) => e !== void 0));
+		let s = new Set(o.rpcTags.map(At).filter((e) => e !== void 0));
 		for (let e of s) {
 			let t = i.get(e);
 			t !== void 0 && a.push({
@@ -1468,13 +1278,13 @@ var re = () => {
 		}
 	}
 	return a;
-}, zt = (e, t) => {
+}, Mt = (e, t) => {
 	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
 	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
 	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
 	return r;
-}, Bt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), Vt = (e) => {
-	let t = y(e), n = v(e);
+}, Nt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), Pt = (e) => {
+	let t = re(e), n = ne(e);
 	return {
 		root: e,
 		serveBundle: t,
@@ -1482,19 +1292,19 @@ var re = () => {
 		apiBundle: n,
 		apiBundlePresent: T(n)
 	};
-}, Ht = [
+}, Ft = [
 	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
 	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
 	"(Generated Dockerfiles from `voltro create-project` already do this.)"
-].join("\n  "), Ut = (e, t = !1) => {
-	let n = Vt(e);
-	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Bt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+].join("\n  "), It = (e, t = !1) => {
+	let n = Pt(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Nt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
 	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
 	let r = process.env.NODE_ENV === "production";
 	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
 	let i = t || r;
-	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${Ht}`), +!!i;
-}, Wt = (e, t, n) => {
+	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${Ft}`), +!!i;
+}, Lt = (e, t, n) => {
 	let r = new Set(e), i = I(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
@@ -1520,7 +1330,7 @@ var re = () => {
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Xt.test(S(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Ut.test(S(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -1533,11 +1343,11 @@ var re = () => {
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, Gt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), Kt = (e, t) => (e.match(t) ?? []).length, G = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, qt = (e, t) => {
+}, Rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), zt = (e, t) => (e.match(t) ?? []).length, G = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, Bt = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
 	return n !== t && G(e.file, RegExp(`^${n}Plugin$`)) > 0;
-}, Jt = (e, t) => {
+}, Vt = (e, t) => {
 	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
 	for (; (i = r.exec(e)) !== null;) {
 		let t = i.index + i[0].length, r = 1, a = t;
@@ -1545,10 +1355,10 @@ var re = () => {
 		n.push(e.slice(t, a - 1));
 	}
 	return n;
-}, Yt = (e, t) => {
+}, Ht = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
 	return n === void 0 ? [] : e.getDescendantsOfKind(j.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, Xt = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Zt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Qt = [
+}, Ut = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Wt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Gt = [
 	"Id",
 	"ID",
 	"Hash",
@@ -1574,12 +1384,12 @@ var re = () => {
 	"Comment",
 	"Provider",
 	"Format"
-], $t = RegExp(`(?:${Qt.join("|")})$|_(?:${Qt.map((e) => e.toLowerCase()).join("|")})$`), en = [
+], Kt = RegExp(`(?:${Gt.join("|")})$|_(?:${Gt.map((e) => e.toLowerCase()).join("|")})$`), qt = [
 	{
 		id: "hardcoded-framework-cookie",
 		scope: "client",
 		smell: "a framework cookie name written as a string literal instead of imported",
-		use: "import the constant — `LOCALE_COOKIE` / `THEME_COOKIE` from `@voltro/ui-shadcn` — so a rename in the framework is a compile error in your app rather than a preference that quietly stops working",
+		use: "import the constant — `LOCALE_COOKIE` / `THEME_COOKIE` from `@voltro/i18n` (or from `@voltro/ui-shadcn` if you use the kit) — so a rename in the framework is a compile error in your app rather than a preference that quietly stops working",
 		match: ({ src: e }) => /['"`]voltro:(?:locale|theme|lang)['"`]/.test(e)
 	},
 	{
@@ -1587,7 +1397,7 @@ var re = () => {
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => Zt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => Wt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
@@ -1595,8 +1405,8 @@ var re = () => {
 		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
 		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
 		match: ({ src: e, path: t }) => {
-			if (!Zt.test(t)) return !1;
-			let n = Gt(e);
+			if (!Wt.test(t)) return !1;
+			let n = Rt(e);
 			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
 		}
 	},
@@ -1605,7 +1415,7 @@ var re = () => {
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no traceparent, no retry, and no SSRF guard where the URL is not a constant)",
 		use: "yield* HttpClient — the framework client. It injects traceparent, retries, and honours `http.allowHosts`. Where the URL is built from anything a caller supplied it ALSO blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop — for a hard-coded host that half is redundant, and the first three are still the reason to switch",
-		match: ({ file: e, path: t, serverOnly: n }) => (Xt.test(t) || n) && G(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (Ut.test(t) || n) && G(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
@@ -1640,7 +1450,7 @@ var re = () => {
 		scope: "client",
 		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
 		use: "useDerived — dependency-tracked, referentially stable",
-		match: ({ src: e }) => Kt(e, /\buseSubscription\s*[(<]/g) >= 3 && Kt(e, /\buseMemo\s*\(/g) >= 3
+		match: ({ src: e }) => zt(e, /\buseSubscription\s*[(<]/g) >= 3 && zt(e, /\buseMemo\s*\(/g) >= 3
 	},
 	{
 		id: "next-shim",
@@ -1665,7 +1475,7 @@ var re = () => {
 		match: ({ file: e }) => e.getDescendantsOfKind(j.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
 			let t = e.getFirstAncestorByKind(j.VariableDeclaration)?.getNameNode();
 			return t === void 0 ? [] : k.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
-		}).some((t) => Yt(e, t).some((e) => {
+		}).some((t) => Ht(e, t).some((e) => {
 			let t = e.getParent();
 			if (k.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
@@ -1716,7 +1526,7 @@ var re = () => {
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || $t.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Kt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1726,7 +1536,7 @@ var re = () => {
 		use: "you cannot look a value up by equality AND encrypt it non-deterministically — `.encrypted()` would make this column unfindable. Store the HASH as the unique lookup key and keep the secret itself either `.encrypted()` in a second column or nowhere (the framework's own `_voltro_api_keys.hashedKey` is the shape: the presented value is hashed and compared, never read back). A deterministic cipher is the other option and buys equality lookup at the cost of leaking which rows share a value",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || $t.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Kt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1791,8 +1601,8 @@ var re = () => {
 		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
 		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
 		match: ({ file: e, testSources: t }) => G(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
-			let t = Gt(e);
-			return Jt(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+			let t = Rt(e);
+			return Vt(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
 		})
 	},
 	{
@@ -1802,14 +1612,14 @@ var re = () => {
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], tn = (e) => q(e), nn = (e, t) => {
+], Jt = (e) => q(e), Yt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
 		let t = S(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, rn = /\.(tsx?|jsx?)$/, K = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, an = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, on = (e, t = [], n = 0) => {
+}, Xt = /\.(tsx?|jsx?)$/, K = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Zt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Qt = (e, t = [], n = 0) => {
 	if (n > 12 || K.test(e)) return t;
 	let r;
 	try {
@@ -1821,7 +1631,7 @@ var re = () => {
 		let r = x(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
-			on(r, t, n + 1);
+			Qt(r, t, n + 1);
 		} else dt.test(i.name) && t.push(r);
 	}
 	return t;
@@ -1840,10 +1650,10 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? q(r, t, n + 1) : rn.test(i) && !/\.(test|spec)\./.test(i) && !an.test(i) && t.push(r);
+		a.isDirectory() ? q(r, t, n + 1) : Xt.test(i) && !/\.(test|spec)\./.test(i) && !Zt.test(i) && t.push(r);
 	}
 	return t;
-}, sn = (e, t = [], n = 0) => {
+}, $t = (e, t = [], n = 0) => {
 	if (n > 12 || K.test(e)) return t;
 	let r;
 	try {
@@ -1858,17 +1668,17 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? sn(r, t, n + 1) : rn.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? $t(r, t, n + 1) : Xt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
-}, cn = (e) => {
-	let t = tn(e);
+}, en = (e) => {
+	let t = Jt(e);
 	return {
-		dirs: nn(e, t),
+		dirs: Yt(e, t),
 		fileCount: t.length
 	};
-}, ln = (e) => {
-	let t = tn(e);
+}, tn = (e) => {
+	let t = Jt(e);
 	if (t.length === 0) return [];
 	let n = new A({
 		useInMemoryFileSystem: !0,
@@ -1877,8 +1687,8 @@ var re = () => {
 	for (let e of t) try {
 		i.set(e, E(e, "utf8"));
 	} catch {}
-	let a = Wt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
-	for (let t of sn(e)) try {
+	let a = Lt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
+	for (let t of $t(e)) try {
 		o.set(t, E(t, "utf8"));
 	} catch {}
 	for (let s of t) {
@@ -1896,23 +1706,23 @@ var re = () => {
 		} catch {
 			continue;
 		}
-		for (let t of en) {
-			if (t.plugin !== void 0 && qt(c, t.plugin) || !t.match(c)) continue;
+		for (let t of qt) {
+			if (t.plugin !== void 0 && Bt(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
 			n.push(S(e, s)), r.set(t.id, n);
 		}
 	}
-	return en.filter((e) => r.has(e.id)).map((e) => ({
+	return qt.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
-}, un = (e) => {
-	let t = cn(e);
+}, nn = (e) => {
+	let t = en(e);
 	return {
 		root: e,
 		scannedFiles: t.fileCount,
 		scannedDirs: t.dirs,
-		findings: ln(e).map(({ rule: e, files: t }) => ({
+		findings: tn(e).map(({ rule: e, files: t }) => ({
 			id: e.id,
 			scope: e.scope,
 			smell: e.smell,
@@ -1920,13 +1730,13 @@ var re = () => {
 			files: t
 		}))
 	};
-}, dn = 3, fn = .2, pn = 50, mn = (e, t) => e >= pn && t > 0 && e / t >= fn, hn = (e) => {
+}, rn = 3, an = .2, on = 50, sn = (e, t) => e >= on && t > 0 && e / t >= an, cn = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of q(e)) try {
 		t.set(S(e, n), E(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
-	for (let t of on(e)) try {
+	for (let t of Qt(e)) try {
 		n.set(S(e, t), E(t, "utf8"));
 	} catch {}
 	let r = ft({
@@ -1934,8 +1744,8 @@ var re = () => {
 		envFiles: n
 	});
 	r !== void 0 && (console.log(""), console.log(pt(r)));
-}, gn = (e) => {
-	let t = un(e);
+}, ln = (e) => {
+	let t = nn(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
 	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
 	console.log(`\u2022  Shipped primitives you may be hand-rolling (scanned ${t.scannedFiles} files across ${t.scannedDirs.join(", ")}):`);
@@ -1946,56 +1756,56 @@ var re = () => {
 		console.log(`   [${e}]`);
 		let i = [...r].sort((e, t) => e.files.length - t.files.length);
 		for (let e of i) {
-			if (mn(e.files.length, t.scannedFiles)) {
+			if (sn(e.files.length, t.scannedFiles)) {
 				let n = Math.round(e.files.length / t.scannedFiles * 100);
 				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s), ${n}% of those scanned: a codebase-wide pattern rather than a work list`), console.log(`     \u2192 ${e.use}`), console.log("     (paths omitted on purpose at this scale — `voltro doctor --json` has every one.)");
 				continue;
 			}
-			let r = e.files.slice(0, dn).join(", "), i = e.files.length - dn;
+			let r = e.files.slice(0, rn).join(", "), i = e.files.length - rn;
 			i > 0 && (n += i);
 			let a = i > 0 ? `, +${i} more` : "";
 			console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${r}${a}`), console.log(`     \u2192 ${e.use}`);
 		}
 	}
 	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
-}, _n = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", vn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, yn = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, bn = (e) => {
-	let t = vn.exec(e)?.[1];
+}, un = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", dn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, fn = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, pn = (e) => {
+	let t = dn.exec(e)?.[1];
 	if (t !== void 0) return t === "ssr" ? "ssr" : null;
-	let n = yn.exec(e)?.[1];
+	let n = fn.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
-}, xn = async (t) => {
-	let i = x(t, "src", "pages");
-	if (!T(i)) return [];
-	let { pages: a, dirs: o } = await e(i), s = [];
-	for (let e of a) {
-		if (!r(o, e.dirChain).some((e) => e.hasLayout)) continue;
-		let a;
+}, mn = async (e) => {
+	let t = x(e, "src", "pages");
+	if (!T(t)) return [];
+	let { pages: i, dirs: o } = await n(t), s = [];
+	for (let n of i) {
+		if (!a(o, n.dirChain).some((e) => e.hasLayout)) continue;
+		let i;
 		try {
-			a = E(x(i, e.file), "utf8");
+			i = E(x(t, n.file), "utf8");
 		} catch {
 			continue;
 		}
-		if (n.test(a)) continue;
-		let c = bn(a);
+		if (r.test(i)) continue;
+		let c = pn(i);
 		c !== null && s.push({
-			file: S(t, x(i, e.file)),
-			pattern: e.pattern,
+			file: S(e, x(t, n.file)),
+			pattern: n.pattern,
 			currentMode: c
 		});
 	}
 	return s;
-}, Sn = 10, Cn = async (e) => {
+}, hn = 10, gn = async (e) => {
 	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = await xn(e);
+	let t = await mn(e);
 	if (t.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
 	console.log(`•  renderMode:'spa' candidates (${t.length} page${t.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of t.slice(0, Sn)) {
+	for (let e of t.slice(0, hn)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let n = t.length - Sn;
-	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${_n}`), t.length;
-}, wn = /* @__PURE__ */ new Set([
+	let n = t.length - hn;
+	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${un}`), t.length;
+}, _n = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -2003,7 +1813,7 @@ var re = () => {
 	".vite",
 	".framework",
 	".git"
-]), J = (e, t, n) => {
+]), vn = (e, t, n) => {
 	let r;
 	try {
 		r = D(e, { withFileTypes: !0 });
@@ -2011,11 +1821,11 @@ var re = () => {
 		return;
 	}
 	for (let i of r) {
-		if (wn.has(i.name)) continue;
+		if (_n.has(i.name)) continue;
 		let r = x(e, i.name);
-		i.isDirectory() ? J(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
+		i.isDirectory() ? vn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
 	}
-}, Tn = (e, t) => {
+}, yn = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
@@ -2040,21 +1850,21 @@ var re = () => {
 		}
 	}
 	return n;
-}, En = (e, t) => {
+}, bn = (e, t) => {
 	let n = e.slice(t.length).split(w).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
-}, Y = (e) => {
+}, J = (e) => {
 	let t = [], n = x(e, "src", "pages"), r = x(e, "src");
 	if (!T(r)) return t;
-	let a = [];
-	J(r, e, a), a.sort();
-	let o = `${S(e, n)}${w}`;
-	Tn(e, a);
-	for (let n of a) {
+	let i = [];
+	vn(r, e, i), i.sort();
+	let a = `${S(e, n)}${w}`;
+	yn(e, i);
+	for (let n of i) {
 		let r = n.slice(n.lastIndexOf(w) + 1);
-		if (n.startsWith(o)) {
+		if (n.startsWith(a)) {
 			if (r !== "page.tsx") continue;
-			T(x(e, i(n))) || t.push({
+			T(x(e, c(n))) || t.push({
 				kind: "page-without-test",
 				file: n
 			});
@@ -2065,7 +1875,7 @@ var re = () => {
 					file: n
 				});
 			} catch {}
-			En(n, o) && t.push({
+			bn(n, a) && t.push({
 				kind: "top-level-dynamic-route",
 				file: n
 			});
@@ -2077,33 +1887,33 @@ var re = () => {
 		});
 	}
 	return t;
-}, Dn = 10, X = (e, t, n) => {
+}, xn = 10, Y = (e, t, n) => {
 	if (t.length === 0) return;
 	console.log(`•  ${e} (${t.length}):`);
-	for (let e of t.slice(0, Dn)) console.log(`   ${e}`);
-	let r = t.length - Dn;
+	for (let e of t.slice(0, xn)) console.log(`   ${e}`);
+	let r = t.length - xn;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
-}, On = (e) => {
+}, Sn = (e) => {
 	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = Y(e);
+	let t = J(e);
 	if (t.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
 	let n = (e) => t.filter((t) => t.kind === e).map((e) => e.file);
-	return X("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), X("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), X("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), X("pages with no `meta` export — they serve the APP name as their title", n("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). Advisory."), t.length;
-}, kn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", An = /* @__PURE__ */ new Map(), Z = (e) => {
-	let t = An.get(e);
+	return Y("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), Y("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), Y("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), Y("pages with no `meta` export — they serve the APP name as their title", n("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), t.length;
+}, Cn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", wn = /* @__PURE__ */ new Map(), X = (e) => {
+	let t = wn.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-tPcOmjPJ.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-DOZVMVfi.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
 		};
 	})();
-	return An.set(e, n), n;
-}, jn = async (e) => {
+	return wn.set(e, n), n;
+}, Tn = async (e) => {
 	let t;
 	try {
-		let { files: n, discovered: r } = await Z(e), i = r.tables.map((e) => {
+		let { files: n, discovered: r } = await X(e), i = r.tables.map((e) => {
 			let t = e;
 			return {
 				name: t.tableName,
@@ -2116,7 +1926,7 @@ var re = () => {
 		return;
 	}
 	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
-}, Mn = (e) => e.map((e) => {
+}, En = (e) => e.map((e) => {
 	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
 		name: e,
 		type: typeof t?.type == "string" ? t.type : ""
@@ -2126,21 +1936,21 @@ var re = () => {
 		columns: n,
 		primaryKey: t.appliedPrimaryKey ?? []
 	};
-}), Nn = async (e) => {
+}), Z = async (e) => {
 	try {
-		let { discovered: t } = await Z(e);
-		return Qe(Mn(t.tables));
+		let { discovered: t } = await X(e);
+		return Qe(En(t.tables));
 	} catch {
 		return null;
 	}
-}, Pn = async (e) => {
-	let t = await Nn(e);
+}, Dn = async (e) => {
+	let t = await Z(e);
 	if (t === null || t.tablesChecked === 0) return;
 	let n = et(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
-}, Fn = async (e) => {
+}, On = async (e) => {
 	try {
-		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await Z(e);
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await X(e);
 		return it(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
@@ -2153,19 +1963,19 @@ var re = () => {
 	} catch {
 		return null;
 	}
-}, In = async (e) => {
-	let t = await Fn(e);
+}, kn = async (e) => {
+	let t = await On(e);
 	if (t === null || t.eventsChecked === 0) return;
 	let n = at(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
 	let r = ot(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
-}, Ln = (e) => {
+}, An = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
 	return r === void 0 ? n : `${r}: ${n}`;
-}, Rn = async (e) => {
+}, jn = async (e) => {
 	try {
-		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await Z(e)).discovered.serverOnlyLeaks, r = t(n);
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await X(e)).discovered.serverOnlyLeaks, r = t(n);
 		return {
 			status: {
 				checked: !0,
@@ -2176,16 +1986,16 @@ var re = () => {
 	} catch (e) {
 		return { status: {
 			checked: !1,
-			reason: Ln(e)
+			reason: An(e)
 		} };
 	}
-}, zn = async (e) => {
-	let { status: t, message: n } = await Rn(e);
+}, Mn = async (e) => {
+	let { status: t, message: n } = await jn(e);
 	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, Bn = async (e) => {
+}, Nn = async (e) => {
 	let t;
 	try {
-		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await Z(e);
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await X(e);
 		t = lt(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
@@ -2205,13 +2015,54 @@ var re = () => {
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, Q = "voltro-authz-allowlist.txt", Vn = (e, t = (e) => {
+}, Q = "voltro-authz-allowlist.txt", Pn = (e, t = (e) => {
 	try {
 		return E(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...wt, ...Tt(q(e).map(t))]), Hn = async (e) => {
+}) => /* @__PURE__ */ new Set([..._t, ...vt(q(e).map(t))]), Fn = async (e) => {
+	try {
+		let { discovered: t } = await X(e), n = t.events.map((e) => e.descriptor.name).filter((e) => typeof e == "string");
+		if (n.length === 0) return [];
+		let r = new Set(t.events.map((e) => e.file)), i = q(e).filter((e) => !r.has(e)).map((e) => {
+			try {
+				return E(e, "utf8");
+			} catch {
+				return "";
+			}
+		}).join("\n");
+		return n.filter((e) => !i.includes(e)).sort();
+	} catch {
+		return [];
+	}
+}, In = async (e) => {
+	let t = await Fn(e);
+	if (t.length !== 0) {
+		console.log(""), console.log(`•  ${t.length} declared event(s) with no emit call site found:`);
+		for (let e of t) console.log(`     ${e}`);
+		console.log(""), console.log("   An event you declare is an event partners can subscribe to. One that"), console.log("   never fires is indistinguishable, from their side, from a broken"), console.log("   endpoint of their own — so they debug your contract instead of"), console.log("   reading it."), console.log("   ADVISORY: this looks for the event NAME in your sources. An emit"), console.log("   through a variable or an assembled name will read as missing here.");
+	}
+}, Ln = async (e) => {
+	try {
+		let { offlineManifest: t, toInput: n } = await import("./checkCommand-ClRvH_SN.js"), { buildAppGraph: r, checkAppGraph: i } = await import("./appGraph-CvQCte0z.js"), a = await t(e);
+		return i(r(n(a.manifest, a.tables))).filter((e) => e.rule === "rbac/unknown-scope").map((e) => ({
+			node: e.node,
+			...e.file === void 0 ? {} : { file: e.file },
+			detail: e.breaks.join("; "),
+			fix: e.fix
+		}));
+	} catch {
+		return [];
+	}
+}, Rn = async (e) => {
+	let t = await Ln(e);
+	if (t.length !== 0) {
+		console.log(""), console.log(`•  ${t.length} procedure(s) require a scope no declared role grants:`);
+		for (let e of t) console.log(`     ${e.node}${e.file === void 0 ? "" : `  ${e.file}`}`), console.log(`       ${e.detail}`);
+		console.log(""), console.log("   Each of these is uncallable by every user in every role — not"), console.log("   misconfigured, DEAD — and nothing fails at boot to say so. The"), console.log("   usual cause is a typo or a rename that moved one side only."), console.log(`   ${t[0].fix}`);
+	}
+}, zn = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
 		let t = x(e, i);
@@ -2223,23 +2074,23 @@ var re = () => {
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-tPcOmjPJ.js");
+		let { loadApiConfig: t } = await import("./dev-DOZVMVfi.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
 	}
-	let a = xt({
+	let a = mt({
 		catalogCodes: r,
 		declaredLocales: i
 	});
 	if (a !== void 0) {
 		console.log("");
-		for (let e of St(a, n)) console.log(e);
+		for (let e of ht(a, n)) console.log(e);
 	}
-}, Un = async (e) => {
-	let { discovered: t } = await Z(e), n = [];
+}, Bn = async (e) => {
+	let { discovered: t } = await X(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-tPcOmjPJ.js");
+		let { loadApiConfig: t } = await import("./dev-DOZVMVfi.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -2255,8 +2106,8 @@ var re = () => {
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: Wn.has(e.name),
-				canAlias: Gn.has(e.name)
+				canDisableTables: Vn.has(e.name),
+				canAlias: Hn.has(e.name)
 			};
 		});
 	} catch {
@@ -2268,14 +2119,14 @@ var re = () => {
 		...t.mutations,
 		...t.actions,
 		...t.streams ?? []
-	].map((e) => String(e.descriptor.name)), i = Rt(n, {
+	].map((e) => String(e.descriptor.name)), i = jt(n, {
 		tables: t.tables.map((e) => e.tableName),
 		rpcTags: r
 	});
 	console.log();
-	for (let e of zt(n, i)) console.log(e);
-}, Wn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Gn = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), $ = 20, Kn = async (e) => {
-	let t = await qn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
+	for (let e of Mt(n, i)) console.log(e);
+}, Vn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Hn = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), $ = 20, Un = async (e) => {
+	let t = await Wn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
 	return {
 		executors: t.executorCount,
 		guardVocabulary: [...t.vocabulary].sort(),
@@ -2287,15 +2138,15 @@ var re = () => {
 		},
 		unchecked: t.result.unchecked
 	};
-}, qn = async (e) => {
-	let { discovered: t } = await Z(e), n = /* @__PURE__ */ new Map(), r = (e) => {
+}, Wn = async (e) => {
+	let { discovered: t } = await X(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
 			n.set(e, E(e, "utf8"));
 		} catch {
 			n.set(e, "");
 		}
 		return n.get(e);
-	}, i = Vn(e, r), a = /* @__PURE__ */ new Set();
+	}, i = Pn(e, r), a = /* @__PURE__ */ new Set();
 	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
 		e && a.add(e.tableName);
@@ -2332,7 +2183,7 @@ var re = () => {
 		l = !0;
 		break;
 	}
-	let u = jt({
+	let u = wt({
 		executors: o,
 		guardVocabulary: i,
 		tenantScopedTables: t.tenantScopedTables,
@@ -2349,44 +2200,49 @@ var re = () => {
 		executorCount: o.length,
 		allowPath: s
 	};
-}, Jn = async (e, t) => {
-	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await qn(e), l = n.counts;
+}, Gn = async (e, t) => {
+	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await Wn(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
-	let u = [...r].filter((e) => !wt.has(e)).sort();
+	let u = [...r].filter((e) => !_t.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
 	let d = new Set(a.map((e) => e.tag)), f = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !d.has(e.tag)).length, p = l.allowlisted - f;
 	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${Q})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
-		let e = T(s) ? E(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ft(e, t);
-		return ne(s, Pt(e, t), "utf8"), console.log(`\n${Q}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
+		let e = T(s) ? E(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ot(e, t);
+		return se(s, Dt(e, t), "utf8"), console.log(`\n${Q}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
 	}
 	if (n.unchecked.length === 0) return !1;
 	console.log("");
 	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
 	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${Q} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${Q}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, Yn = async (e) => {
-	if (e.includes("--help") || e.includes("-h")) return console.log(kn), 0;
-	let t = e.includes("--strict"), n = C(e.find((e) => !e.startsWith("-")) ?? process.cwd());
-	if (ie(e)) return re(), M({
-		...un(n),
-		spaCandidates: await xn(n),
-		pageConvention: Y(n),
-		fileTaxonomy: V(n).findings,
-		junctionFks: (await Nn(n))?.issues ?? [],
-		eventDelivery: await Fn(n),
-		duplicateInstances: yt(n),
-		serverOnly: (await Rn(n)).status,
-		authz: await Kn(n)
+}, Kn = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(Cn), 0;
+	let n = e.includes("--strict"), r = C(e.find((e) => !e.startsWith("-")) ?? process.cwd());
+	if (le(e)) return ce(), M({
+		...nn(r),
+		spaCandidates: await mn(r),
+		pageConvention: J(r),
+		fileTaxonomy: V(r).findings,
+		junctionFks: (await Z(r))?.issues ?? [],
+		eventDelivery: await On(r),
+		duplicateInstances: t(r),
+		versionSkew: s(r) ?? null,
+		serverOnly: (await jn(r)).status,
+		authz: await Un(r),
+		ungrantedScopes: await Ln(r),
+		neverEmittedEvents: await Fn(r)
 	}), 0;
-	let r = Ut(n, t);
-	gn(n), hn(n), On(n), He(n), await Cn(n), await Bn(n), await jn(n), await Pn(n), await In(n), await Un(n), await Hn(n);
-	let i = await zn(n), a = await Jn(n, e.includes("--write-authz-allowlist")), o = bt(yt(n));
-	return o !== void 0 && console.log(`\n${o}`), i || a ? Math.max(r, 1) : r;
-}, Xn = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Zn = /* @__PURE__ */ new Set([
+	let a = It(r, n);
+	ln(r), cn(r), Sn(r), He(r), await gn(r), await Nn(r), await Tn(r), await Dn(r), await kn(r), await Bn(r), await Rn(r), await In(r), await zn(r);
+	let c = await Mn(r), l = await Gn(r, e.includes("--write-authz-allowlist")), u = o(s(r));
+	u !== void 0 && (console.log(""), console.log(u));
+	let d = i(t(r));
+	return d !== void 0 && console.log(`\n${d}`), c || l ? Math.max(a, 1) : a;
+}, qn = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Jn = /* @__PURE__ */ new Set([
 	"insert",
 	"update",
 	"delete",
 	"upsert"
-]), Qn = (e, t) => {
+]), Yn = (e, t) => {
 	let n = [], r = new Set(t.exercised), i = /* @__PURE__ */ new Map();
 	for (let e of t.edges) {
 		let t = i.get(e.tag);
@@ -2398,8 +2254,8 @@ var re = () => {
 			a.push(t.tag);
 			continue;
 		}
-		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(Xn(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
-		for (let t of c) if (Zn.has(t.op)) {
+		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(qn(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
+		for (let t of c) if (Jn.has(t.op)) {
 			let r = u.get(t.table);
 			r === void 0 ? n.push({
 				rule: "observed/undeclared-write",
@@ -2455,7 +2311,7 @@ var re = () => {
 			total: e.length
 		}
 	};
-}, $n = (e, t = [], n = 0) => {
+}, Xn = (e, t = [], n = 0) => {
 	if (n > 12) return t;
 	let r;
 	try {
@@ -2473,30 +2329,30 @@ var re = () => {
 			".git",
 			"coverage"
 		].includes(i)) continue;
-		let r = `${e}/${i}`, o;
+		let r = `${e}/${i}`, a;
 		try {
-			o = O(r);
+			a = O(r);
 		} catch {
 			continue;
 		}
-		o.isDirectory() ? $n(r, t, n + 1) : o.isFile() && a.test(i) && t.push(r);
+		a.isDirectory() ? Xn(r, t, n + 1) : a.isFile() && l.test(i) && t.push(r);
 	}
 	return t;
-}, er = /* @__PURE__ */ new Set(["actors", "tenants"]), tr = async (e) => {
+}, Zn = /* @__PURE__ */ new Set(["actors", "tenants"]), Qn = async (e) => {
 	try {
 		let { readFile: t } = await import("node:fs/promises"), { join: n } = await import("node:path"), r = await t(n(e, "app.graph.observed.generated.json"), "utf8"), i = JSON.parse(r);
 		return i?.version !== 1 || !Array.isArray(i.edges) || !Array.isArray(i.exercised) ? null : i;
 	} catch {
 		return null;
 	}
-}, nr = (e) => {
+}, $n = (e) => {
 	let { exercised: t, total: n } = e.coverage, r = `\nobserved: ${t}/${n} procedures exercised (${n === 0 ? 0 : Math.round(t / n * 100)}%)`;
 	if (e.diagnostics.length === 0) return `${r}\n  no declared/observed mismatches${e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : ""}`;
 	let i = e.diagnostics.map((e) => `  ${e.node}${e.file === void 0 ? "" : ` (${e.file})`}\n` + e.breaks.map((e) => `    ${e}`).join("\n") + `\n    fix: ${e.fix}`), a = e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : "";
 	return `${r}\n${i.join("\n")}${a}`;
-}, rr = (e, t) => ({
+}, er = (e, t) => ({
 	tables: (t.tables ?? []).map((e) => e.name),
-	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || er.has(e.name)).map((e) => e.name),
+	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || Zn.has(e.name)).map((e) => e.name),
 	scopes: e.scopes ?? [],
 	procedures: (e.procedures ?? []).map((e) => {
 		let t = (e.guards ?? []).flatMap((e) => e.kind === "scope" ? e.scope ?? [] : []);
@@ -2509,11 +2365,11 @@ var re = () => {
 			...e.guards === void 0 ? {} : { hasGuards: e.guards.length > 0 }
 		};
 	})
-}), ir = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
+}), tr = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
-}).join("\n"), ar = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-tPcOmjPJ.js"), { buildRpcEntry: i } = await import("./manifestBuild-Dj8Jjoto.js"), { buildCapabilityManifest: a } = await import("./inspect-mmBuRXmy.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+}).join("\n"), nr = async (e) => {
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-DOZVMVfi.js"), { buildRpcEntry: i } = await import("./manifestBuild-Dj8Jjoto.js"), { buildCapabilityManifest: a } = await import("./inspect-mmBuRXmy.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
@@ -2529,10 +2385,10 @@ var re = () => {
 		})), [], m),
 		tables: { tables: p }
 	};
-}, or = async (e) => {
-	let t = ue(e.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]));
+}, rr = async (e) => {
+	let t = me(e.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]));
 	if ("error" in t) return console.error(`voltro check: ${t.error}`), 1;
-	let { process: n, target: r, rest: i } = de(t.rest), a;
+	let { process: n, target: r, rest: i } = he(t.rest), a;
 	for (let e = 0; e < i.length; e++) if (i[e] === "--diff") {
 		let [t, n] = (i[++e] ?? "").split(":");
 		if (t === "removeTable" && n) a = {
@@ -2549,35 +2405,35 @@ var re = () => {
 		};
 		else return console.error("voltro check --diff: expected removeTable:<name> | removeProcedure:<tag> | removeScope:<name>"), 1;
 	}
-	let s = i.find((e) => !e.startsWith("-")) ?? process.cwd(), c = i.includes("--offline"), l = c ? [] : await le(n, r), u, d;
-	if (l.length === 0) {
-		if (!c && r !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
+	let o = i.find((e) => !e.startsWith("-")) ?? process.cwd(), s = i.includes("--offline"), c = s ? [] : await pe(n, r), l, d;
+	if (c.length === 0) {
+		if (!s && r !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
 		try {
-			let e = await ar(C(s));
-			u = e.manifest, d = e.tables;
+			let e = await nr(C(o));
+			l = e.manifest, d = e.tables;
 		} catch (e) {
 			return console.error(`voltro check: could not assemble the graph from source: ${e.message}`), console.error("  Start `voltro dev` to check against a running api instead."), 1;
 		}
 	} else {
-		let e = l[0], [t, n] = await Promise.all([N(e, "/_voltro/inspect/manifest"), N(e, "/_voltro/inspect/data/tables")]);
+		let e = c[0], [t, n] = await Promise.all([N(e, "/_voltro/inspect/manifest"), N(e, "/_voltro/inspect/data/tables")]);
 		if (t.kind === "err") return console.error(`voltro check: manifest fetch failed: ${t.error}`), 1;
-		u = t.data, d = n.kind === "ok" ? n.data : { tables: [] };
+		l = t.data, d = n.kind === "ok" ? n.data : { tables: [] };
 	}
-	let f = rr(u, d), p = he(f, a), m = [...V(s).findings.map((e) => ({
+	let f = er(l, d), p = ie(f, a), m = [...V(o).findings.map((e) => ({
 		rule: e.rule,
 		node: e.file,
 		file: e.file,
 		breaks: [e.detail],
 		fix: e.fix,
 		severity: e.severity
-	})), ...Y(s).map((e) => ({
+	})), ...J(o).map((e) => ({
 		rule: `page/${e.kind}`,
 		node: e.file,
 		file: e.file,
 		breaks: [e.kind === "suffixed-outside-pages" ? "a page.tsx outside src/pages/ never routes" : "no test beside it"],
 		fix: e.kind === "suffixed-outside-pages" ? "move it under src/pages/ into the directory whose route it serves, or rename it — page.tsx is reserved" : "write the test with the file — the name is derivable",
 		severity: e.kind === "suffixed-outside-pages" ? "error" : "warn"
-	}))], h = (await o(s, $n(s))).map((e) => ({
+	}))], h = (await u(o, Xn(o))).map((e) => ({
 		rule: "client/not-browser-safe",
 		node: e.file,
 		file: e.file,
@@ -2588,7 +2444,7 @@ var re = () => {
 		...p.diagnostics,
 		...m,
 		...h
-	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await tr(C(s)), y = v === null ? null : Qn(f.procedures, v);
+	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await Qn(C(o)), y = v === null ? null : Yn(f.procedures, v);
 	return t.format === "json" ? M(y === null ? {
 		...p,
 		ok: _,
@@ -2598,7 +2454,7 @@ var re = () => {
 		ok: _,
 		diagnostics: g,
 		observed: y
-	}) : (console.log(ir(g)), y !== null && console.log(nr(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
+	}) : (console.log(tr(g)), y !== null && console.log($n(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
 };
 //#endregion
-export { re as _, ze as a, I as c, N as d, ue as f, le as g, ce as h, Ut as i, ve as l, se as m, or as n, be as o, de as p, Yn as r, xe as s, ar as t, he as u, M as v, ie as y };
+export { ce as _, It as a, xe as c, N as d, me as f, pe as g, fe as h, Kn as i, I as l, P as m, rr as n, ze as o, he as p, er as r, be as s, nr as t, ve as u, M as v, le as y };