@voltro/cli 0.33.0 → 0.35.0

package/dist/{checkCommand-xGhRFFg2.js → doctorCommand-DnimF5IM.js}

@@ -1,720 +1,18 @@
-import { Ct as e, et as t, f as n, n as r, nt as i, o as a, rt as o, tt as s, z as c } from "./inspectMetrics-1xzTKAFx.js";
-import { Gt as l, Wt as u } from "./dev-C_P8FLSx.js";
-import { C as d, E as f, O as p, T as m, d as h, h as g, i as _, l as v, m as y, r as ee, u as te } from "./fileConventions-Cof68_BL.js";
-import { r as ne, u as re } from "./apiBuild-h9VHtnlw.js";
-import { r as ie } from "./appGraph-gQ_6GkQQ.js";
-import { dirname as b, isAbsolute as ae, join as x, relative as S, resolve as C, sep as w } from "node:path";
-import { pathToFileURL as oe } from "node:url";
-import { routeDiagnosticsToStderr as se } from "@voltro/logger";
-import { existsSync as T, readFileSync as E, readdirSync as D, statSync as O, writeFileSync as ce } from "node:fs";
-import { Node as k, Project as A, SyntaxKind as j } from "ts-morph";
-//#region src/cliOutput.ts
-var le = () => {
-	se();
-}, M = (e, t = {}) => {
-	console.log(JSON.stringify(e, null, t.pretty === !1 ? 0 : 2));
-}, ue = (e) => {
-	for (let t = 0; t < e.length; t++) {
-		let n = e[t];
-		if (n === "--json" || n === "--format=json" || n === "--format" && e[t + 1] === "json") return !0;
-	}
-	return !1;
-}, de = (e, t, n = !1) => {
-	let r = { ...e ?? {} }, i = t ?? process.env.VOLTRO_INSPECT_TOKEN;
-	if (i !== void 0 && i !== "" && (r.authorization = `Bearer ${i}`), n) {
-		let e = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
-		e !== void 0 && e !== "" && (r["x-voltro-inspect-write"] = e);
-	}
-	return r;
-}, fe = /* @__PURE__ */ new Set([
-	"POST",
-	"PUT",
-	"PATCH",
-	"DELETE"
-]), N = async (e, t, n) => {
-	let r = `${e.url.replace(/\/+$/, "")}${t.startsWith("/") ? t : `/${t}`}`, i = n?.method ?? "GET", a = n?.body !== void 0;
-	try {
-		let t = await fetch(r, {
-			method: i,
-			headers: de(a ? { "content-type": "application/json" } : void 0, e.inspectToken, fe.has(i)),
-			...a ? { body: JSON.stringify(n.body) } : {}
-		}), o = await t.text(), s;
-		if (o.length > 0) try {
-			s = JSON.parse(o);
-		} catch {
-			s = o;
-		}
-		if (!t.ok) {
-			let n = s, r = typeof n == "object" && n ? String(n.message ?? n.reason ?? n.error ?? `HTTP ${t.status}`) : `HTTP ${t.status}`, a = fe.has(i) && (process.env.VOLTRO_INSPECT_WRITE_TOKEN ?? "") === "" && /write/i.test(r);
-			return {
-				kind: "err",
-				name: e.name,
-				error: a ? `${r}\n  VOLTRO_INSPECT_WRITE_TOKEN is not set in this shell. \`voltro dev\` mints it into the project's \`.env.local\`; export it (or run from a shell that loaded it).` : r
-			};
-		}
-		return {
-			kind: "ok",
-			name: e.name,
-			status: t.status,
-			data: s
-		};
-	} catch (t) {
-		return {
-			kind: "err",
-			name: e.name,
-			error: t.message || String(t)
-		};
-	}
-}, P = (e, t = process.env) => {
-	let n = [], r, i;
-	for (let t = 0; t < e.length; t++) {
-		let a = e[t];
-		if (a === "--url") {
-			r = e[++t];
-			continue;
-		}
-		if (a.startsWith("--url=")) {
-			r = a.slice(6);
-			continue;
-		}
-		if (a === "--token") {
-			i = e[++t];
-			continue;
-		}
-		if (a.startsWith("--token=")) {
-			i = a.slice(8);
-			continue;
-		}
-		n.push(a);
-	}
-	if (r ??= t.VOLTRO_INSPECT_URL, r === void 0 || r === "") return {
-		target: void 0,
-		rest: n
-	};
-	let a;
-	try {
-		a = new URL(r);
-	} catch {
-		return {
-			target: void 0,
-			rest: n,
-			error: `--url: not a valid URL: "${r}"`
-		};
-	}
-	let o = i ?? t.VOLTRO_INSPECT_TOKEN;
-	return {
-		target: {
-			url: r.replace(/\/+$/, ""),
-			name: a.host,
-			...o !== void 0 && o !== "" ? { token: o } : {}
-		},
-		rest: n
-	};
-}, pe = (e) => ({
-	id: `remote:${e.url}`,
-	name: e.name,
-	kind: "api",
-	url: e.url,
-	pid: 0,
-	registeredAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-	heartbeatAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-	status: "live",
-	logFile: "",
-	...e.token === void 0 ? {} : { inspectToken: e.token }
-}), me = async (t, n) => n === void 0 ? (await e()).apps.filter((e) => e.kind === "api" && e.status === "live" && e.url.length > 0 && (t === void 0 || e.name === t)) : [pe(n)], he = (e) => {
-	let t = "pretty", n = [];
-	for (let r = 0; r < e.length; r++) {
-		let i = e[r];
-		if (i === "--format") {
-			let n = e[++r];
-			if (n !== "pretty" && n !== "json") return { error: "--format: must be 'pretty' | 'json'" };
-			t = n;
-			continue;
-		}
-		if (i === "--json" || i === "--format=json") {
-			t = "json";
-			continue;
-		}
-		if (i === "--format=pretty") {
-			t = "pretty";
-			continue;
-		}
-		n.push(i);
-	}
-	return {
-		format: t,
-		rest: n
-	};
-}, ge = (e, t = process.env) => {
-	let { target: n, rest: r, error: i } = P(e, t), a, o = [];
-	for (let e = 0; e < r.length; e++) {
-		let t = r[e];
-		if (t === "--process") {
-			a = r[++e];
-			continue;
-		}
-		if (t.startsWith("--process=")) {
-			a = t.slice(10);
-			continue;
-		}
-		o.push(t);
-	}
-	return {
-		process: a,
-		target: n,
-		rest: o,
-		...i === void 0 ? {} : { error: i }
-	};
-}, _e = (e) => {
-	let t = "", n = !1;
-	for (let r = 0; r < e.length; r++) {
-		let i = e[r];
-		if (n) {
-			if (t += i, i === "\\") {
-				t += e[r + 1] ?? "", r++;
-				continue;
-			}
-			i === "\"" && (n = !1);
-			continue;
-		}
-		if (i === "\"") {
-			n = !0, t += i;
-			continue;
-		}
-		if (i === "/" && e[r + 1] === "*") {
-			let t = e.indexOf("*/", r + 2);
-			r = t === -1 ? e.length : t + 1;
-			continue;
-		}
-		if (i === "/" && e[r + 1] === "/") {
-			let t = e.indexOf("\n", r);
-			r = t === -1 ? e.length : t - 1;
-			continue;
-		}
-		t += i;
-	}
-	return JSON.parse(ve(t));
-}, ve = (e) => {
-	let t = "", n = !1;
-	for (let r = 0; r < e.length; r++) {
-		let i = e[r];
-		if (n) {
-			if (t += i, i === "\\") {
-				t += e[r + 1] ?? "", r++;
-				continue;
-			}
-			i === "\"" && (n = !1);
-			continue;
-		}
-		if (i === "\"") {
-			n = !0, t += i;
-			continue;
-		}
-		if (i === ",") {
-			let t = e.slice(r + 1);
-			if (/^\s*[}\]]/.exec(t)) continue;
-		}
-		t += i;
-	}
-	return t;
-}, F = (e, t) => {
-	if (t.has(e) || !T(e)) return;
-	t.add(e);
-	let n;
-	try {
-		n = _e(E(e, "utf8"));
-	} catch {
-		return;
-	}
-	if (n.extends === void 0) return n;
-	let r = n.extends;
-	if (!r.startsWith(".")) return n;
-	let i = F(C(b(e), r), t);
-	return i === void 0 ? n : { compilerOptions: {
-		...i.compilerOptions,
-		...n.compilerOptions,
-		paths: {
-			...i.compilerOptions?.paths,
-			...n.compilerOptions?.paths
-		}
-	} };
-}, ye = (e, t = "tsconfig.json") => {
-	let n = ae(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
-	if (i === void 0) return;
-	let a = {};
-	for (let [e, t] of Object.entries(i)) Array.isArray(t) && (a[e] = t.filter((e) => typeof e == "string"));
-	if (Object.keys(a).length !== 0) return {
-		baseUrl: C(b(n), r?.compilerOptions?.baseUrl ?? "."),
-		paths: a
-	};
-}, I = (e, t = "tsconfig.json") => {
-	let n = ae(t) ? t : C(e, t), r = F(n, /* @__PURE__ */ new Set()), i = r?.compilerOptions?.paths;
-	if (i === void 0) return [];
-	let a = C(b(n), r?.compilerOptions?.baseUrl ?? "."), o = [];
-	for (let [e, t] of Object.entries(i)) {
-		let n = t[0];
-		if (typeof n != "string") continue;
-		let r = e.endsWith("*");
-		o.push({
-			prefix: r ? e.slice(0, -1) : e,
-			target: C(a, r ? n.replace(/\*$/, "") : n),
-			wildcard: r
-		});
-	}
-	return o.sort((e, t) => t.prefix.length - e.prefix.length);
-}, be = (e, t) => {
-	for (let n of t) if (n.wildcard) {
-		if (e.startsWith(n.prefix)) return x(n.target, e.slice(n.prefix.length));
-	} else if (e === n.prefix) return n.target;
-}, L = ".voltro-vendored", xe = (e, t) => {
-	let n = [], r = /* @__PURE__ */ new Set(), i = (e, t) => {
-		let i = C(e);
-		r.has(i) || !T(i) || (r.add(i), n.push({
-			dir: i,
-			source: t
-		}));
-	}, a = x(e, "components.json");
-	if (T(a)) try {
-		let t = JSON.parse(E(a, "utf8"));
-		for (let n of ["ui"]) {
-			let r = t.aliases?.[n];
-			if (typeof r != "string" || r === "") continue;
-			let a = r.replace(/^@\//, "").replace(/^~\//, "");
-			for (let t of [x(e, a), x(e, "src", a)]) if (T(t)) {
-				i(t, `components.json (aliases.${n})`);
-				break;
-			}
-		}
-	} catch {}
-	for (let e of t) {
-		let t = e.slice(0, e.lastIndexOf(w)), n = x(t, L);
-		if (!r.has(C(t)) && T(n)) {
-			let e = "";
-			try {
-				e = E(n, "utf8").trim().split("\n")[0] ?? "";
-			} catch {}
-			i(t, e === "" ? L : `${L}: ${e}`);
-		}
-	}
-	return n;
-}, Se = (e, t) => t.some((t) => e === t.dir || e.startsWith(`${t.dir}${w}`)), Ce = (e, t) => t.map((t) => `${S(e, t.dir) || "."}  (${t.source})`), we = [
-	{
-		id: "component.ui",
-		re: _,
-		needsTest: !0
-	},
-	{
-		id: "component",
-		re: ee,
-		needsTest: !0
-	},
-	{
-		id: "hook",
-		re: te,
-		needsTest: !0
-	},
-	{
-		id: "tracking",
-		re: f,
-		needsTest: !0
-	},
-	{
-		id: "store",
-		re: d,
-		needsTest: !0
-	},
-	{
-		id: "internal",
-		re: h,
-		needsTest: !0
-	},
-	{
-		id: "fixture",
-		re: v,
-		needsTest: !1
-	},
-	{
-		id: "types",
-		re: p,
-		needsTest: !1
-	}
-], R = (e) => we.find((t) => t.re.test(e))?.id ?? null, Te = (e) => m.test(e), Ee = /* @__PURE__ */ new Set([
-	"useMutation",
-	"useAction",
-	"useUpload",
-	"useUndo",
-	"useOutbox",
-	"useAgentChat",
-	"useAgentStream",
-	"useResumableAgentStream",
-	"useWorkflow"
-]), De = /* @__PURE__ */ new Set(["defineTracking"]), Oe = /* @__PURE__ */ new Set([
-	"useSubscription",
-	"useWindowedSubscription",
-	"useRecord",
-	"useQuery"
-]), ke = /* @__PURE__ */ new Set([
-	"node_modules",
-	"dist",
-	"build",
-	".framework",
-	".turbo",
-	".vite",
-	".next",
-	".git",
-	"coverage",
-	".publish"
-]), Ae = /\.tsx?$/, je = (e, t = [], n = 0) => {
-	if (n > 12) return t;
-	let r;
-	try {
-		r = D(e);
-	} catch {
-		return t;
-	}
-	for (let i of r) {
-		if (ke.has(i)) continue;
-		let r = x(e, i), a;
-		try {
-			a = O(r);
-		} catch {
-			continue;
-		}
-		a.isDirectory() ? je(r, t, n + 1) : a.isFile() && Ae.test(i) && !i.endsWith(".d.ts") && t.push(r);
-	}
-	return t;
-}, Me = /\b(?:FC|FunctionComponent|ComponentType|ForwardRefExoticComponent|MemoExoticComponent)\b/, Ne = /\b(?:memo|forwardRef|observer|styled)\b/, Pe = (e) => k.isArrowFunction(e) || k.isFunctionExpression(e) || k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isClassExpression(e), z = (e) => {
-	if (Pe(e)) return !0;
-	if (k.isExportAssignment(e) || k.isAsExpression(e) || k.isSatisfiesExpression(e) || k.isParenthesizedExpression(e)) return z(e.getExpression());
-	if (k.isVariableDeclaration(e)) {
-		let t = e.getTypeNode();
-		if (t !== void 0 && Me.test(t.getText())) return !0;
-		let n = e.getInitializer();
-		return n === void 0 || z(n);
-	}
-	return k.isCallExpression(e) ? Ne.test(e.getExpression().getText()) ? !0 : e.getArguments().some((e) => Pe(e) || k.isIdentifier(e)) : k.isTaggedTemplateExpression(e) ? !0 : !(k.isObjectLiteralExpression(e) || k.isArrayLiteralExpression(e) || k.isStringLiteral(e) || k.isNoSubstitutionTemplateLiteral(e) || k.isNumericLiteral(e) || k.isTemplateExpression(e) || k.isNewExpression(e) || k.isPropertyAccessExpression(e) || e.getKind() === j.TrueKeyword || e.getKind() === j.FalseKeyword || e.getKind() === j.NullKeyword);
-}, Fe = (e) => {
-	let t = [], n = [], r = [], i = /* @__PURE__ */ new Set();
-	for (let [a, o] of e.getExportedDeclarations()) {
-		let e = o[0];
-		if (e === void 0 || k.isInterfaceDeclaration(e) || k.isTypeAliasDeclaration(e) || i.has(e)) continue;
-		i.add(e);
-		let s = a === "default" ? (k.isFunctionDeclaration(e) || k.isClassDeclaration(e) || k.isVariableDeclaration(e) ? e.getName() : void 0) ?? "Default" : a;
-		if (/^use[A-Z]/.test(s)) {
-			n.push(s);
-			continue;
-		}
-		if (/^[A-Z]/.test(s) && z(e)) {
-			t.push(s);
-			continue;
-		}
-		r.push(s);
-	}
-	return {
-		components: t,
-		hooks: n,
-		others: r,
-		hasRuntimeExport: t.length + n.length + r.length > 0
-	};
-}, B = [], Ie = (e, t, n) => {
-	let r = b(e), i = [];
-	for (let e = r;; e = b(e)) {
-		let r = n.get(e);
-		if (r !== void 0) {
-			for (let e of i) n.set(e, r);
-			return r;
-		}
-		if (i.push(e), T(x(e, "tsconfig.json"))) {
-			let t = I(e);
-			if (t.length > 0) {
-				for (let e of i) n.set(e, t);
-				return t;
-			}
-		}
-		if (e === t || b(e) === e) break;
-	}
-	for (let e of i) n.set(e, B);
-	return B;
-}, Le = (e, t, n) => {
-	let r = t.startsWith(".") ? C(b(e), t) : be(t, n);
-	if (r === void 0) return null;
-	for (let e of [
-		r,
-		`${r}.tsx`,
-		`${r}.ts`,
-		x(r, "index.tsx"),
-		x(r, "index.ts")
-	]) try {
-		if (O(e).isFile()) return e;
-	} catch {}
-	return null;
-}, Re = (e, t, n) => {
-	let r = [], i = /* @__PURE__ */ new Set(), a = /* @__PURE__ */ new Map(), o = (e) => {
-		let i = Le(t, e, n);
-		return i !== null && r.push(i), i;
-	};
-	for (let t of e.getImportDeclarations()) if (o(t.getModuleSpecifierValue()), !t.isTypeOnly()) for (let e of t.getNamedImports()) e.isTypeOnly() || i.add(e.getName());
-	for (let t of e.getExportDeclarations()) {
-		let e = t.getModuleSpecifierValue();
-		if (e === void 0) continue;
-		let n = o(e);
-		if (n === null || t.isTypeOnly()) continue;
-		let r = t.getNamedExports();
-		if (r.length === 0) {
-			a.set(n, "*");
-			continue;
-		}
-		let i = r.filter((e) => !e.isTypeOnly()).map((e) => e.getAliasNode()?.getText() ?? e.getName()), s = a.get(n);
-		a.set(n, s === "*" ? "*" : [...s ?? [], ...i]);
-	}
-	for (let t of e.getDescendantsOfKind(j.CallExpression)) {
-		if (t.getExpression().getKind() !== j.ImportKeyword) continue;
-		let e = t.getArguments()[0];
-		e !== void 0 && k.isStringLiteral(e) && o(e.getLiteralValue());
-	}
-	return {
-		localTargets: r,
-		namedBindings: i,
-		reExports: a
-	};
-}, ze = (e) => {
-	let t = /* @__PURE__ */ new Map();
-	for (let n of e.getDescendantsOfKind(j.CallExpression)) {
-		let e = n.getExpression(), r = k.isPropertyAccessExpression(e) ? e.getName() : e.getText();
-		t.set(r, (t.get(r) ?? 0) + 1);
-	}
-	return t;
-}, Be = (e) => {
-	if (e.length <= 1) return e.length === 1;
-	let t = [...e].sort((e, t) => e.length - t.length)[0];
-	return e.every((e) => e.startsWith(t));
-}, Ve = (e, t) => {
-	let n = b(t);
-	return e.startsWith(`${n}${w}`) || b(e) === n;
-}, V = (e) => {
-	let t = je(e);
-	if (t.length === 0) return {
-		findings: [],
-		declared: 0,
-		scanned: 0,
-		vendored: []
-	};
-	let n = xe(e, t), r = t.filter((e) => !Se(e, n));
-	if (r.length === 0) return {
-		findings: [],
-		declared: 0,
-		scanned: 0,
-		vendored: n
-	};
-	let i = new A({
-		useInMemoryFileSystem: !0,
-		skipAddingFilesFromTsConfig: !0
-	}), a = [], o = (t) => S(e, t), s = /* @__PURE__ */ new Map(), c = /* @__PURE__ */ new Map(), l = /* @__PURE__ */ new Map(), u = /* @__PURE__ */ new Map();
-	for (let t of r) {
-		let n;
-		try {
-			n = E(t, "utf8");
-		} catch {
-			continue;
-		}
-		let r;
-		try {
-			r = i.createSourceFile(t.endsWith("x") ? "/scan.tsx" : "/scan.ts", n, { overwrite: !0 });
-		} catch {
-			continue;
-		}
-		s.set(t, Fe(r)), c.set(t, Re(r, t, Ie(t, e, u))), l.set(t, ze(r));
-	}
-	let d = /* @__PURE__ */ new Map();
-	for (let [e, t] of c) for (let n of t.localTargets) {
-		let t = d.get(n) ?? [];
-		t.push(e), d.set(n, t);
-	}
-	let f = (e) => {
-		let t = s.get(e), n = /* @__PURE__ */ new Set([
-			...t?.components ?? [],
-			...t?.hooks ?? [],
-			...t?.others ?? []
-		]), r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Set([e]), a = (e, t) => {
-			for (let o of d.get(e) ?? []) {
-				if (i.has(o)) continue;
-				let s = c.get(o);
-				if (s === void 0) continue;
-				let l = s.reExports.get(e);
-				if (l !== void 0) {
-					i.add(o), r.add(o);
-					let e = l === "*" ? t ?? n : new Set(l), s = t === null ? e : new Set([...e].filter((e) => t.has(e)));
-					s.size > 0 && a(o, s);
-					continue;
-				}
-				(t === null || [...s.namedBindings].some((e) => t.has(e))) && r.add(o);
-			}
-		};
-		return a(e, null), [...r];
-	}, p = 0;
-	for (let e of r) {
-		let t = R(e), n = s.get(e), r = c.get(e);
-		if (n === void 0 || r === void 0) continue;
-		let i = Te(e);
-		t !== null && !i && (p += 1);
-		let u = d.get(e) ?? [];
-		if ((t === "component" || t === "component.ui") && !i) {
-			let t = Be(n.components);
-			(n.components.length === 0 || !t) && a.push({
-				rule: "component/one-per-file",
-				file: o(e),
-				severity: "error",
-				detail: n.components.length === 0 ? "declares a component file but exports no component" : `exports ${n.components.length} unrelated components: ${n.components.join(", ")}`,
-				fix: "a component file exports ONE component — or one NAMESPACED family sharing its name (`Card`, `CardHeader`, `CardTitle`), which is one component with parts. Types alongside are fine. Unrelated components belong in their own files"
-			}), n.hooks.length > 0 && a.push({
-				rule: "component/no-hook-export",
-				file: o(e),
-				severity: "error",
-				detail: `also exports hook(s): ${n.hooks.join(", ")}`,
-				fix: "move the hook into its own *.hook.ts — a file exporting both is two files wearing one name, and neither can be reused without dragging the other"
-			});
-		}
-		if (t === "hook" && !i && (n.hooks.length !== 1 && a.push({
-			rule: "hook/one-per-file",
-			file: o(e),
-			severity: "error",
-			detail: n.hooks.length === 0 ? "declares a hook file but exports no use* hook" : `exports ${n.hooks.length} hooks: ${n.hooks.join(", ")}`,
-			fix: "a hook file exports exactly ONE use* hook (types alongside are fine)"
-		}), n.components.length > 0 && a.push({
-			rule: "hook/no-component-export",
-			file: o(e),
-			severity: "error",
-			detail: `also exports component(s): ${n.components.join(", ")}`,
-			fix: "move the component into its own *.component.tsx"
-		})), t === "types" && n.hasRuntimeExport && a.push({
-			rule: "types/runtime-export",
-			file: o(e),
-			severity: "error",
-			detail: `exports runtime value(s): ${[
-				...n.components,
-				...n.hooks,
-				...n.others
-			].join(", ")}`,
-			fix: "a *.types.ts has NO runtime export. That is what makes importing it provably free AND makes it impossible for it to sit in a runtime import cycle — the guarantee is the point, so move the value to a sibling module"
-		}), t === "internal") {
-			let t = u.filter((t) => !Ve(t, e));
-			t.length > 0 && a.push({
-				rule: "internal/foreign-import",
-				file: o(e),
-				severity: "error",
-				detail: `imported from outside its own directory by: ${t.slice(0, 5).map(o).join(", ")}${t.length > 5 ? ` (+${t.length - 5})` : ""}`,
-				fix: "export it through the feature's public module, or move the importer inside. `.internal` is the promise that refactoring within this directory breaks nobody — a foreign import revokes it silently, which is how a feature boundary rots without a single review comment"
-			});
-		}
-		if (t === "fixture") {
-			let t = u.filter((e) => !Te(e) && R(e) !== "fixture");
-			t.length > 0 && a.push({
-				rule: "fixture/production-import",
-				file: o(e),
-				severity: "error",
-				detail: `imported by non-test file(s): ${t.slice(0, 5).map(o).join(", ")}`,
-				fix: "test material must not be reachable from a production path — it ships in the bundle, and it is written to be convenient rather than correct"
-			});
-		}
-		if (t === "component.ui" && !i) {
-			let t = [...r.namedBindings].filter((e) => Ee.has(e)).sort();
-			t.length > 0 && a.push({
-				rule: "ui/no-write",
-				file: o(e),
-				severity: "error",
-				detail: `imports write hook(s): ${t.join(", ")}`,
-				fix: "a *.component.ui.tsx renders; it does not write. Lift the mutation into the *.component.tsx that owns it and pass a handler down. Reading (useT / useCan / usePermissions) stays allowed — threading those through props is prop-drilling, not reusability"
-			});
-			let n = f(e), i = n.filter((e) => {
-				let t = R(e);
-				return t === "component" || t === "component.ui" || y.test(e) || g.has(e.slice(e.lastIndexOf(w) + 1));
-			});
-			n.length === 0 ? a.push({
-				rule: "ui/orphaned",
-				file: o(e),
-				severity: "warn",
-				detail: "nothing imports it",
-				fix: "render it from a *.component.tsx or a page, or delete it — an unrendered presentational component is carried, reviewed and refactored forever without reaching a user"
-			}) : i.length === 0 && a.push({
-				rule: "ui/unlinked",
-				file: o(e),
-				severity: "warn",
-				detail: `reached only by: ${n.slice(0, 5).map(o).join(", ")}${n.length > 5 ? ` (+${n.length - 5})` : ""} — barrels resolved through`,
-				fix: "a presentational component should be reached from a *.component.tsx, another *.component.ui.tsx, or a page"
-			});
-		}
-		if (t === "store" && !i) {
-			let t = l.get(e)?.get("defineStore") ?? 0;
-			t !== 1 && a.push({
-				rule: "store/one-per-file",
-				file: o(e),
-				severity: "error",
-				detail: t === 0 ? "declares a store file but calls no defineStore()" : `declares ${t} stores`,
-				fix: "a store file defines exactly ONE store — the SSR seed pass and devtools address stores by name, so two in a file makes both harder to find and neither easier to reason about"
-			});
-			let n = [...l.get(e)?.keys() ?? []].filter((e) => Oe.has(e)).sort();
-			n.length > 0 && a.push({
-				rule: "store/mirrors-server-state",
-				file: o(e),
-				severity: "error",
-				detail: `reads server state here: ${n.join(", ")}`,
-				fix: "a store holds CLIENT state. A subscription is already live server state; copying it into a store gives you a second copy that does not live, and the page then shows the stale one — a bug that reads as \"reactivity is broken\". Read the subscription where you render it"
-			});
-		}
-		if (t !== "tracking" && !i) {
-			let t = [...l.get(e)?.keys() ?? []].filter((e) => De.has(e)).sort();
-			t.length > 0 && a.push({
-				rule: "tracking/outside-tracking-file",
-				file: o(e),
-				severity: "error",
-				detail: `calls ${t.join(", ")} outside a *.tracking.ts`,
-				fix: "move the defineTracking(...) spec into a *.tracking.ts and import it here. The event catalogue — names, property bags, the decisions about what personal data goes out — belongs in one place you can list; calling useTracking with a spec from there is fine"
-			});
-		}
-		if (we.find((e) => e.id === t)?.needsTest === !0 && !i) {
-			let t = e.replace(/\.tsx?$/, ""), n = e.endsWith("x") ? "tsx" : "ts";
-			["test", "spec"].flatMap((e) => [`${t}.${e}.ts`, `${t}.${e}.tsx`]).some((e) => {
-				try {
-					return O(e).isFile();
-				} catch {
-					return !1;
-				}
-			}) || a.push({
-				rule: "convention/missing-test",
-				file: o(e),
-				severity: "warn",
-				detail: "no test beside it",
-				fix: `add ${o(t)}.test.${n} — the name is derivable, so write it with the file. A shallow test earns its place: what it buys is that something MOUNTS the component, and a render loop, a crashing effect or a missing provider is invisible until then. One app wrote 251 of these and the first run found a render loop that made a page take 423 s and exhaust the heap — in a browser it had looked usable`
-			});
-		}
-	}
-	return a.sort((e, t) => e.file === t.file ? e.rule.localeCompare(t.rule) : e.file.localeCompare(t.file)), {
-		findings: a,
-		declared: p,
-		scanned: r.length,
-		vendored: n
-	};
-}, He = 10, Ue = (e) => {
-	let { findings: t, declared: n, scanned: r, vendored: i } = V(e);
-	console.log("");
-	for (let t of Ce(e, i)) console.log(`·  not ours, exempt: ${t}`);
-	if (r === 0) return console.log("•  file-taxonomy scan: no sources here — nothing to check."), 0;
-	if (t.length === 0) return console.log(`✓  file-taxonomy scan: ${n} declared file(s) keep their contract (${r} scanned).`), 0;
-	let a = /* @__PURE__ */ new Map();
-	for (let e of t) {
-		let t = a.get(e.rule) ?? [];
-		t.push(e), a.set(e.rule, t);
-	}
-	let o = t.filter((e) => e.severity === "error").length;
-	console.log(`•  file taxonomy: ${t.length} finding(s) — ${o} error, ${t.length - o} advisory (${n} declared / ${r} scanned):`);
-	for (let [e, t] of [...a].sort()) {
-		console.log(`   ${t[0].severity === "error" ? "✗" : "·"} ${e} (${t.length})`);
-		for (let e of t.slice(0, He)) console.log(`       ${e.file} — ${e.detail}`);
-		let n = t.length - He;
-		n > 0 && console.log(`       (+${n} more — \`voltro doctor --json\` prints every one.)`), console.log(`         → ${t[0].fix}`);
-	}
-	return t.length;
-}, We = /* @__PURE__ */ new Set([
+import { Bt as e, Rt as t, zt as n } from "./dev-C7sFZq3m.js";
+import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-Dybxew86.js";
+import { w as u } from "./frameworkTableAssembly-oMPBKqlE.js";
+import { n as d } from "./pageConvention-cEiRxdab.js";
+import { r as f, u as p } from "./apiBuild-DYD_ONLD.js";
+import { n as m, r as h, t as g } from "./cliOutput-D1tSBoRM.js";
+import { n as ee, t as te } from "./tsconfigPaths-BWXBWgcl.js";
+import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
+import { basename as ie, dirname as ae, join as _, relative as v, resolve as y, sep as b } from "node:path";
+import { existsSync as x, readFileSync as S, readdirSync as C, statSync as w, writeFileSync as oe } from "node:fs";
+import { pathToFileURL as se } from "node:url";
+import { createLogger as ce } from "@voltro/logger";
+import { Node as T, Project as E, SyntaxKind as D } from "ts-morph";
+//#region src/predicateColumnAudit.ts
+var le = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
 	"gt",
@@ -732,43 +30,43 @@ var le = () => {
 	"endsWith",
 	"between",
 	"jsonField"
-]), Ge = (e) => {
-	if (k.isPropertyAccessExpression(e)) return e.getName();
-	if (k.isIdentifier(e)) return e.getText();
-}, Ke = (e) => {
+]), ue = (e) => {
+	if (T.isPropertyAccessExpression(e)) return e.getName();
+	if (T.isIdentifier(e)) return e.getText();
+}, de = (e) => {
 	let t = e;
-	for (; k.isCallExpression(t);) {
+	for (; T.isCallExpression(t);) {
 		let e = t.getExpression();
-		if (!k.isPropertyAccessExpression(e)) break;
+		if (!T.isPropertyAccessExpression(e)) break;
 		t = e.getExpression();
 	}
 	return t;
-}, qe = (e, t, n) => {
-	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new A({
+}, fe = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new E({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	});
 	for (let t of e) {
 		let e;
 		try {
-			let n = E(t, "utf8");
+			let n = S(t, "utf8");
 			if (!n.includes(".where(") && !n.includes(".select(")) continue;
 			e = s.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
 		} catch {
 			continue;
 		}
-		let c = S(n, t);
-		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
+		let c = v(n, t);
+		for (let t of e.getDescendantsOfKind(D.CallExpression)) {
 			let e = t.getExpression();
-			if (!k.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
-			let n = Ge(Ke(e.getExpression()));
+			if (!T.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
+			let n = ue(de(e.getExpression()));
 			if (n === void 0 || !r.has(n)) {
 				let t = e.getExpression();
-				if (k.isCallExpression(t)) {
+				if (T.isCallExpression(t)) {
 					let e = t.getExpression();
-					if (k.isPropertyAccessExpression(e) && e.getName() === "select") {
+					if (T.isPropertyAccessExpression(e) && e.getName() === "select") {
 						let e = t.getArguments()[0];
-						e !== void 0 && k.isStringLiteral(e) && (n = e.getLiteralValue());
+						e !== void 0 && T.isStringLiteral(e) && (n = e.getLiteralValue());
 					}
 				}
 			}
@@ -777,16 +75,16 @@ var le = () => {
 			if (s === void 0) continue;
 			let l = [], [u] = t.getArguments();
 			if (u !== void 0) {
-				if (k.isStringLiteral(u)) l.push({
+				if (T.isStringLiteral(u)) l.push({
 					column: u.getLiteralValue(),
 					line: u.getStartLineNumber()
 				});
-				else for (let e of [u, ...u.getDescendantsOfKind(j.CallExpression)]) {
-					if (!k.isCallExpression(e)) continue;
-					let t = e.getExpression(), n = k.isIdentifier(t) ? t.getText() : k.isPropertyAccessExpression(t) ? t.getName() : void 0;
-					if (n === void 0 || !We.has(n)) continue;
+				else for (let e of [u, ...u.getDescendantsOfKind(D.CallExpression)]) {
+					if (!T.isCallExpression(e)) continue;
+					let t = e.getExpression(), n = T.isIdentifier(t) ? t.getText() : T.isPropertyAccessExpression(t) ? t.getName() : void 0;
+					if (n === void 0 || !le.has(n)) continue;
 					let r = e.getArguments()[0];
-					r !== void 0 && k.isStringLiteral(r) && l.push({
+					r !== void 0 && T.isStringLiteral(r) && l.push({
 						column: r.getLiteralValue(),
 						line: r.getStartLineNumber()
 					});
@@ -805,16 +103,16 @@ var le = () => {
 		issues: a,
 		checked: o
 	};
-}, H = 12, Je = (e) => {
+}, O = 12, pe = (e) => {
 	if (e.checked === 0) return null;
 	if (e.issues.length === 0) return `predicate columns: ${e.checked} checked — every filtered column exists on its table`;
 	let t = [`predicate columns: ${e.issues.length} filter${e.issues.length, "s"} on a column that does not exist (${e.checked} checked)`];
 	for (let n of e.issues) {
-		let e = n.available.slice(0, H).join(", "), r = n.available.length > H ? `, … (${n.available.length - H} more)` : "";
+		let e = n.available.slice(0, O).join(", "), r = n.available.length > O ? `, … (${n.available.length - O} more)` : "";
 		t.push(`  ${n.file}:${n.line}  '${n.table}' has no column '${n.column}'`), t.push(`    columns: ${e}${r}`);
 	}
 	return t.push("  This type-checks today and fails at runtime as a bare SQL error."), t.join("\n");
-}, Ye = /* @__PURE__ */ new Set([
+}, me = /* @__PURE__ */ new Set([
 	"id",
 	"tenantId",
 	"tenant_id",
@@ -834,7 +132,7 @@ var le = () => {
 	"idempotency_id",
 	"idempotencyKey",
 	"idempotency_key"
-]), Xe = /* @__PURE__ */ new Set([
+]), he = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"created_at",
@@ -844,10 +142,10 @@ var le = () => {
 	"deleted_at",
 	"tenantId",
 	"tenant_id"
-]), Ze = (e) => Ye.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), Qe = (e) => e.type === "reference", $e = (e) => {
+]), ge = (e) => me.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), _e = (e) => e.type === "reference", ve = (e) => {
 	let t = [];
 	for (let n of e) {
-		let e = n.columns.filter((e) => Ze(e.name)), r = e.filter((e) => !Qe(e)).map((e) => e.name);
+		let e = n.columns.filter((e) => ge(e.name)), r = e.filter((e) => !_e(e)).map((e) => e.name);
 		if (r.length === 0) continue;
 		let i = new Set(n.primaryKey), a = r.filter((e) => i.has(e));
 		if (n.primaryKey.length >= 2 && a.length > 0) {
@@ -858,7 +156,7 @@ var le = () => {
 			});
 			continue;
 		}
-		if (e.some(Qe) && e.length >= 2) {
+		if (e.some(_e) && e.length >= 2) {
 			t.push({
 				table: n.name,
 				columns: r,
@@ -866,7 +164,7 @@ var le = () => {
 			});
 			continue;
 		}
-		e.length >= 2 && n.columns.filter((e) => !Ze(e.name) && !Xe.has(e.name)).length === 0 && t.push({
+		e.length >= 2 && n.columns.filter((e) => !ge(e.name) && !he.has(e.name)).length === 0 && t.push({
 			table: n.name,
 			columns: r,
 			signal: "link-only"
@@ -876,20 +174,20 @@ var le = () => {
 		issues: t,
 		tablesChecked: e.length
 	};
-}, et = {
+}, ye = {
 	"composite-pk": "part of a composite primary key",
 	"reference-sibling": "sits beside a wired reference() on this table",
 	"link-only": "this table is nothing but link columns"
-}, tt = (e) => {
+}, be = (e) => {
 	if (e.tablesChecked === 0) return null;
 	if (e.issues.length === 0) return `junction FKs: ${e.tablesChecked} table${e.tablesChecked === 1 ? "" : "s"} checked — every link column is a wired reference()`;
 	let t = e.issues.length, n = [`junction FKs: ${t} junction table${t === 1 ? "" : "s"} with an id column that is a plain text() and not a reference()`];
 	for (let t of e.issues) {
 		let e = t.columns.map((e) => `'${e}'`).join(", ");
-		n.push(`  '${t.table}': ${e} (${et[t.signal]})`);
+		n.push(`  '${t.table}': ${e} (${ye[t.signal]})`);
 	}
 	return n.push("  Declare each as reference(() => <table>): the FK is enforced, the column is auto-indexed,"), n.push("  and the relationship becomes walkable (a plain text() id column is an invisible edge)."), n.join("\n");
-}, nt = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), rt = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), it = (e) => rt(e).some((e) => nt.has(e)), at = (e) => {
+}, xe = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), Se = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), Ce = (e) => Se(e).some((e) => xe.has(e)), we = (e) => {
 	let t = [], n = [];
 	for (let r of e) t.push({
 		event: r.name,
@@ -898,7 +196,7 @@ var le = () => {
 		event: r.name,
 		kind: "wide-key",
 		keyFieldCount: r.keyFieldCount
-	}), r.hasWebhook && it(r.name) && n.push({
+	}), r.hasWebhook && Ce(r.name) && n.push({
 		event: r.name,
 		kind: "webhook-high-rate"
 	});
@@ -907,45 +205,45 @@ var le = () => {
 		modes: t,
 		warnings: n
 	};
-}, ot = (e) => {
+}, Te = (e) => {
 	if (e.eventsChecked === 0) return null;
 	let t = e.eventsChecked, n = [`event delivery: ${t} declared event${t === 1 ? "" : "s"} — the mode decides what a MISSING message means`];
 	for (let t of e.modes) n.push(`  '${t.event}': ${t.delivery}`);
 	return n.push("  each   — every delivery matters; a slow subscriber loses the oldest and is TOLD how many (the default)."), n.push("  latest — a newer delivery supersedes a pending one; a slow subscriber gets the current value, told nothing."), n.push("  Two events with identical route/subscriber/buffer numbers mean OPPOSITE things about a drop — the mode is the difference."), n.join("\n");
-}, st = (e) => {
+}, Ee = (e) => {
 	if (e.warnings.length === 0) return null;
 	let t = e.warnings.length, n = [`events that may not scale as declared: ${t} finding${t === 1 ? "" : "s"}`];
 	for (let t of e.warnings) t.kind === "wide-key" ? (n.push(`  '${t.event}': routing key has ${t.keyFieldCount ?? 0} fields — every field FRAGMENTS the subscriber set (distinct routes are the PRODUCT of the fields’ value spaces).`), n.push("     Check each is an ADDRESS the delivery is decided by (arenaId), not a discriminator the handler reads (gameType) — the latter is payload, not key.")) : (n.push(`  '${t.event}': a webhook block on a per-frame-looking event — every publish is N HTTP deliveries per second per subscribed target.`), n.push("     The webhook rate limit DEFERS the excess as pending rows rather than failing, so the symptom is a growing table. Publish a coarser event (a summary / state change) for the outside world."));
 	return n.push("  WARNING, not a fault — a producer may intend the fan-out. `voltro doctor --json` prints every finding."), n.join("\n");
-}, ct = /* @__PURE__ */ new Set([
+}, De = /* @__PURE__ */ new Set([
 	"start",
 	"run",
 	"child"
-]), lt = (e) => k.isCallExpression(e) && (() => {
+]), Oe = (e) => T.isCallExpression(e) && (() => {
 	let t = e.getExpression();
-	if (!k.isPropertyAccessExpression(t) || !ct.has(t.getName())) return !1;
+	if (!T.isPropertyAccessExpression(t) || !De.has(t.getName())) return !1;
 	let n = t.getExpression();
-	return k.isPropertyAccessExpression(n) ? n.getName() === "workflows" : k.isIdentifier(n) && n.getText() === "workflows";
-})(), ut = (e, t, n) => {
-	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new A({
+	return T.isPropertyAccessExpression(n) ? n.getName() === "workflows" : T.isIdentifier(n) && n.getText() === "workflows";
+})(), ke = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new E({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	});
 	for (let t of e) {
 		let e;
 		try {
-			let n = E(t, "utf8");
+			let n = S(t, "utf8");
 			if (!n.includes("workflows.")) continue;
 			e = l.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
 		} catch {
 			continue;
 		}
-		let u = S(n, t);
-		for (let t of e.getDescendantsOfKind(j.CallExpression)) {
-			if (!lt(t)) continue;
+		let u = v(n, t);
+		for (let t of e.getDescendantsOfKind(D.CallExpression)) {
+			if (!Oe(t)) continue;
 			c++;
 			let e = t.getStartLineNumber(), [n, l] = t.getArguments();
-			if (n === void 0 || !k.isStringLiteral(n)) {
+			if (n === void 0 || !T.isStringLiteral(n)) {
 				o.push({
 					file: u,
 					line: e,
@@ -964,7 +262,7 @@ var le = () => {
 				});
 				continue;
 			}
-			if (l === void 0 || !k.isObjectLiteralExpression(l)) {
+			if (l === void 0 || !T.isObjectLiteralExpression(l)) {
 				o.push({
 					file: u,
 					line: e,
@@ -972,7 +270,7 @@ var le = () => {
 				});
 				continue;
 			}
-			if (l.getProperties().some((e) => k.isSpreadAssignment(e))) {
+			if (l.getProperties().some((e) => T.isSpreadAssignment(e))) {
 				o.push({
 					file: u,
 					line: e,
@@ -981,14 +279,14 @@ var le = () => {
 				continue;
 			}
 			let p = /* @__PURE__ */ new Set(), m = !1;
-			for (let e of l.getProperties()) if (k.isPropertyAssignment(e) || k.isShorthandPropertyAssignment(e)) {
-				let t = (k.isPropertyAssignment(e), e.getNameNode());
-				if (k.isComputedPropertyName(t)) {
+			for (let e of l.getProperties()) if (T.isPropertyAssignment(e) || T.isShorthandPropertyAssignment(e)) {
+				let t = (T.isPropertyAssignment(e), e.getNameNode());
+				if (T.isComputedPropertyName(t)) {
 					m = !0;
 					break;
 				}
 				p.add(e.getName().replace(/^['"]|['"]$/g, ""));
-			} else (k.isMethodDeclaration(e) || k.isGetAccessorDeclaration(e)) && p.add(e.getName());
+			} else (T.isMethodDeclaration(e) || T.isGetAccessorDeclaration(e)) && p.add(e.getName());
 			if (m) {
 				o.push({
 					file: u,
@@ -1026,7 +324,7 @@ var le = () => {
 		checked: s,
 		callSites: c
 	};
-}, dt = (e) => {
+}, Ae = (e) => {
 	if (e.callSites === 0) return null;
 	let t = [];
 	t.push(`workflow starts: ${e.checked}/${e.callSites} call sites checked`);
@@ -1039,7 +337,7 @@ var le = () => {
 		for (let n of e.unchecked) t.push(`    ${n.file}:${n.line} — ${n.reason}`);
 	}
 	return e.issues.length === 0 && e.unchecked.length === 0 && t.push("  every call site matches its workflow"), t.join("\n");
-}, ft = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, U = "VOLTRO_FIELD_ENCRYPTION_KEY", pt = (e) => {
+}, je = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, k = "VOLTRO_FIELD_ENCRYPTION_KEY", Me = (e) => {
 	let t;
 	for (let [n, r] of e.sources) if (t === void 0 && /\bfieldEncryption\b/.test(r) && (t = {
 		reason: "fieldEncryption",
@@ -1047,13 +345,13 @@ var le = () => {
 	}), t === void 0 && /\.encrypted\s*\(/.test(r) && (t = {
 		reason: "encrypted-column",
 		file: n
-	}), r.includes(U)) return;
+	}), r.includes(k)) return;
 	if (t !== void 0) {
-		for (let [, t] of e.envFiles) if (t.includes(U)) return;
+		for (let [, t] of e.envFiles) if (t.includes(k)) return;
 		return t;
 	}
-}, mt = (e) => [
-	`✗  ${U} is named nowhere under this app root, and the app encrypts columns at rest`,
+}, Ne = (e) => [
+	`✗  ${k} is named nowhere under this app root, and the app encrypts columns at rest`,
 	e.reason === "fieldEncryption" ? `   (\`fieldEncryption\` in ${e.file})` : `   (an \`.encrypted()\` column in ${e.file})`,
 	"",
 	"   A deploy without it does not degrade — it refuses to boot at `onActivate`,",
@@ -1069,14 +367,14 @@ var le = () => {
 	"   reaches your deploy target is not knowable from here — a secret manager",
 	"   or a CI variable is not a file. Naming it nowhere is conclusive; naming",
 	"   it somewhere is not a guarantee."
-].join("\n"), ht = (e) => {
+].join("\n"), Pe = (e) => {
 	if (e.catalogCodes.length === 0) return;
 	let t = new Set(e.declaredLocales), n = e.catalogCodes.filter((e) => !t.has(e)).sort();
 	if (n.length !== 0) return {
 		orphaned: n,
 		noneDeclared: t.size === 0
 	};
-}, gt = (e, t) => {
+}, Fe = (e, t) => {
 	let n = e.orphaned.join(", ");
 	return e.noneDeclared ? [
 		`⚠  ${t} has ${e.orphaned.length} catalog(s) — ${n} — and the app declares no \`locales:\`.`,
@@ -1088,33 +386,33 @@ var le = () => {
 		"   …or delete the files. A catalog that is never loaded looks from the inside",
 		"   exactly like one that works, which is why this is worth a line."
 	] : [`⚠  ${t} has catalog(s) not in \`locales:\` — ${n} — so they are never imported.`, "   Add the code(s) to `locales:` in your app config, or delete the file(s)."];
-}, _t = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), vt = /* @__PURE__ */ new Set([
+}, A = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), j = /* @__PURE__ */ new Set([
 	"requireScope",
 	"requireAnyScope",
 	"requireAuth",
 	"assertScope",
 	"assertCan",
 	"can"
-]), yt = (e) => {
+]), Ie = (e) => {
 	let t = /* @__PURE__ */ new Set();
-	for (let n of e) for (let e of _t(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
+	for (let n of e) for (let e of A(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
 	return t;
-}, bt = (e, t) => {
+}, Le = (e, t) => {
 	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
-}, xt = (e) => {
+}, Re = (e) => {
 	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
 	return t && n;
-}, St = (e, t, n) => {
+}, ze = (e, t, n) => {
 	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
-	let r = _t(e.src), i = bt(r, t);
-	return i === void 0 ? xt(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+	let r = A(e.src), i = Le(r, t);
+	return i === void 0 ? Re(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
 		kind: "vocabulary-guard",
 		name: i
 	};
-}, Ct = (e, t, n) => {
+}, Be = (e, t, n) => {
 	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
 	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
-}, wt = (e, t, n) => {
+}, Ve = (e, t, n) => {
 	switch (t.kind) {
 		case "declared-guard": return "guards: on the descriptor";
 		case "vocabulary-guard": return `calls ${t.name}()`;
@@ -1122,15 +420,15 @@ var le = () => {
 		case "allowlisted": return "accepted by a previous run";
 		case "unchecked": return n ? e.op === "read" ? "no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt" : `${e.op}s${e.table ? ` ${e.table}` : ""} with no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt` : e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
 	}
-}, Tt = (e) => {
+}, He = (e) => {
 	let t = e.executors.map((t) => {
-		let n = St(t, e.guardVocabulary, e.allowlist);
+		let n = ze(t, e.guardVocabulary, e.allowlist);
 		return {
 			tag: t.tag,
 			path: t.path,
 			verdict: n,
-			severity: Ct(t, e.tenantScopedTables, e.referencedTables),
-			why: wt(t, n, e.rowFilterRegistered === !0)
+			severity: Be(t, e.tenantScopedTables, e.referencedTables),
+			why: Ve(t, n, e.rowFilterRegistered === !0)
 		};
 	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
 	return {
@@ -1144,7 +442,7 @@ var le = () => {
 		},
 		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
 	};
-}, Et = [
+}, Ue = [
 	"# voltro doctor — authz allowlist",
 	"#",
 	"# Two KINDS of line, and the difference is the point:",
@@ -1169,19 +467,19 @@ var le = () => {
 	"# `--write-authz-allowlist` PRESERVES reviewed= lines. It only ever adds debt",
 	"# lines for executors that are newly unchecked.",
 	""
-], Dt = (e) => {
+], We = (e) => {
 	let t = [...e].map((e) => typeof e == "string" ? { tag: e } : e), n = t.filter((e) => e.reviewed === void 0).map((e) => e.tag).sort(), r = t.filter((e) => e.reviewed !== void 0).sort((e, t) => e.tag.localeCompare(t.tag));
 	return [
-		...Et,
+		...Ue,
 		...n,
 		...r.length > 0 ? ["", "# reviewed — read by a human, open on purpose"] : [],
 		...r.map((e) => `${e.tag}  reviewed=${e.reviewed}`),
 		""
 	].join("\n");
-}, Ot = (e, t) => {
+}, Ge = (e, t) => {
 	let n = [...new Set(t)].sort();
-	if (e === void 0) return Dt(n.map((e) => ({ tag: e })));
-	let r = W(e).tags, i = n.filter((e) => !r.has(e));
+	if (e === void 0) return We(n.map((e) => ({ tag: e })));
+	let r = M(e).tags, i = n.filter((e) => !r.has(e));
 	return i.length === 0 ? e : [
 		e.replace(/\n+$/, ""),
 		"",
@@ -1190,25 +488,25 @@ var le = () => {
 		...i,
 		""
 	].join("\n");
-}, kt = (e, t) => {
+}, Ke = (e, t) => {
 	let n = [...new Set(t)];
 	if (e === void 0) return {
 		added: n.length,
 		kept: 0,
 		removed: 0
 	};
-	let r = W(e).tags;
+	let r = M(e).tags;
 	return {
 		added: n.filter((e) => !r.has(e)).length,
 		kept: r.size,
 		removed: 0
 	};
-}, At = class extends Error {
+}, qe = class extends Error {
 	tag;
 	constructor(e) {
 		super(`authz allowlist: '${e}' is marked reviewed with no reason. Write \`${e}  reviewed=<why it is genuinely open>\`. A bare tag is the other, honest option — it records the executor as DEBT, which is what an unexplained exemption is.`), this.tag = e, this.name = "AllowlistReasonMissingError";
 	}
-}, W = (e) => {
+}, M = (e) => {
 	let t = [];
 	for (let n of e.split("\n")) {
 		let e = n.trim();
@@ -1221,7 +519,7 @@ var le = () => {
 			continue;
 		}
 		let a = r[2].trim();
-		if (a.length === 0) throw new At(i);
+		if (a.length === 0) throw new qe(i);
 		t.push({
 			tag: i,
 			reviewed: a
@@ -1231,13 +529,13 @@ var le = () => {
 		tags: new Set(t.map((e) => e.tag)),
 		entries: t
 	};
-}, jt = (e) => {
+}, N = (e) => {
 	let t = e.indexOf(".");
 	return t <= 0 ? void 0 : e.slice(0, t);
-}, Mt = (e, t) => {
+}, Je = (e, t) => {
 	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
 	for (let e of t.rpcTags) {
-		let t = jt(e);
+		let t = N(e);
 		if (t === void 0) continue;
 		let n = i.get(t);
 		n ? n.push(e) : i.set(t, [e]);
@@ -1266,7 +564,7 @@ var le = () => {
 			});
 			continue;
 		}
-		let s = new Set(o.rpcTags.map(jt).filter((e) => e !== void 0));
+		let s = new Set(o.rpcTags.map(N).filter((e) => e !== void 0));
 		for (let e of s) {
 			let t = i.get(e);
 			t !== void 0 && a.push({
@@ -1279,40 +577,83 @@ var le = () => {
 		}
 	}
 	return a;
-}, Nt = (e, t) => {
+}, Ye = (e, t) => {
 	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
 	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
 	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
 	return r;
-}, Pt = (e) => T(C(e, "app.config.ts")) || T(C(e, "app.config.js")), Ft = (e) => {
-	let t = re(e), n = ne(e);
+}, Xe = async (e) => {
+	if (!await e.hasWorkflows().catch(() => !1)) return { kind: "not-applicable" };
+	let t;
+	try {
+		t = await e.openStore();
+	} catch (e) {
+		return {
+			kind: "skipped",
+			reason: e instanceof Error ? e.message : String(e)
+		};
+	}
+	try {
+		return {
+			kind: "checked",
+			result: await e.sweep(t.store)
+		};
+	} catch (e) {
+		return {
+			kind: "skipped",
+			reason: e instanceof Error ? e.message : String(e)
+		};
+	} finally {
+		await t.close().catch(() => {});
+	}
+}, Ze = (e) => {
+	let t = Math.round(e / 6e4);
+	if (t < 90) return `${t}m`;
+	let n = Math.round(t / 60);
+	return n < 48 ? `${n}h` : `${Math.round(n / 24)}d`;
+}, Qe = (e) => {
+	if (e.kind === "not-applicable") return null;
+	if (e.kind === "skipped") return `•  stuck runs: NOT CHECKED — ${e.reason}\n   This is the one doctor rule that reads the database rather than your source.
+   Run it where the app's DB env vars are set, or ignore this line locally.`;
+	let { result: t } = e, n = [];
+	if (t.stalled.length === 0) n.push(`✓  stuck runs: none (${t.examined} live run(s) old enough to examine${t.waitingOnTimer > 0 ? `, ${t.waitingOnTimer} waiting on a durable timer` : ""}${t.alreadyReported > 0 ? `, ${t.alreadyReported} already reported` : ""})`);
+	else {
+		n.push(`✗  stuck runs: ${t.stalled.length} run(s) have made no progress`);
+		for (let e of t.stalled.slice(0, 20)) n.push(`   ${e.tag}  ${e.runId}  idle ${Ze(e.idleMs)}  ${e.reason}`);
+		t.stalled.length > 20 && n.push(`   … and ${t.stalled.length - 20} more`), n.push("   Nothing was changed — this is a SUSPICION, not a verdict. `awaiting-signal` usually means the sender never came.");
+	}
+	t.sawFullRunPage && n.push("   (the examined page filled up — more old runs exist than were read this pass)");
+	for (let e of t.failures) n.push(`   ! could not examine ${e.subject}: ${e.detail}`);
+	return n.join("\n");
+}, $e = (e) => x(y(e, "app.config.ts")) || x(y(e, "app.config.js")), P = (e) => {
+	let t = p(e), n = f(e);
 	return {
 		root: e,
 		serveBundle: t,
-		serveBundlePresent: T(t),
+		serveBundlePresent: x(t),
 		apiBundle: n,
-		apiBundlePresent: T(n)
+		apiBundlePresent: x(n)
 	};
-}, It = [
+}, et = [
 	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
 	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
 	"(Generated Dockerfiles from `voltro create-project` already do this.)"
-].join("\n  "), Lt = (e, t = !1) => {
-	let n = Ft(e);
-	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Pt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+].join("\n  "), tt = (e, t = !1) => {
+	let n = P(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !$e(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
 	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
 	let r = process.env.NODE_ENV === "production";
 	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
 	let i = t || r;
-	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${It}`), +!!i;
-}, Rt = (e, t, n) => {
-	let r = new Set(e), i = I(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
+	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${et}`), +!!i;
+}, nt = (e, t, n) => {
+	let r = new Set(e), i = ee(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
 		`${e}.js`,
 		`${e}.jsx`,
-		x(e, "index.ts"),
-		x(e, "index.tsx")
+		_(e, "index.ts"),
+		_(e, "index.tsx")
 	]).find((e) => r.has(e)), o = (e) => {
 		let n = (t.get(e) ?? "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), r = [];
 		for (let e of [
@@ -1325,13 +666,13 @@ var le = () => {
 		}
 		let o = [];
 		for (let t of r) {
-			let n = t.startsWith(".") ? C(b(e), t) : be(t, i);
+			let n = t.startsWith(".") ? y(ae(e), t) : te(t, i);
 			if (n === void 0) continue;
 			let r = a(n);
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Wt.test(S(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => ct.test(v(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -1344,11 +685,11 @@ var le = () => {
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, zt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), Bt = (e, t) => (e.match(t) ?? []).length, G = (e, t) => e.getDescendantsOfKind(j.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, Vt = (e, t) => {
+}, rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), it = (e, t) => (e.match(t) ?? []).length, F = (e, t) => e.getDescendantsOfKind(D.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, at = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
-	return n !== t && G(e.file, RegExp(`^${n}Plugin$`)) > 0;
-}, Ht = (e, t) => {
+	return n !== t && F(e.file, RegExp(`^${n}Plugin$`)) > 0;
+}, ot = (e, t) => {
 	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
 	for (; (i = r.exec(e)) !== null;) {
 		let t = i.index + i[0].length, r = 1, a = t;
@@ -1356,10 +697,10 @@ var le = () => {
 		n.push(e.slice(t, a - 1));
 	}
 	return n;
-}, Ut = (e, t) => {
+}, st = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
-	return n === void 0 ? [] : e.getDescendantsOfKind(j.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, Wt = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Gt = /\.(query|mutation|action|stream)\.server\.tsx?$/, Kt = [
+	return n === void 0 ? [] : e.getDescendantsOfKind(D.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
+}, ct = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, lt = /\.(query|mutation|action|stream)\.server\.tsx?$/, ut = [
 	"Id",
 	"ID",
 	"Hash",
@@ -1385,7 +726,7 @@ var le = () => {
 	"Comment",
 	"Provider",
 	"Format"
-], qt = RegExp(`(?:${Kt.join("|")})$|_(?:${Kt.map((e) => e.toLowerCase()).join("|")})$`), Jt = [
+], dt = RegExp(`(?:${ut.join("|")})$|_(?:${ut.map((e) => e.toLowerCase()).join("|")})$`), ft = [
 	{
 		id: "hardcoded-framework-cookie",
 		scope: "client",
@@ -1398,7 +739,7 @@ var le = () => {
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => Gt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => lt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
@@ -1406,8 +747,8 @@ var le = () => {
 		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
 		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
 		match: ({ src: e, path: t }) => {
-			if (!Gt.test(t)) return !1;
-			let n = zt(e);
+			if (!lt.test(t)) return !1;
+			let n = rt(e);
 			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
 		}
 	},
@@ -1416,14 +757,14 @@ var le = () => {
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no traceparent, no retry, and no SSRF guard where the URL is not a constant)",
 		use: "yield* HttpClient — the framework client. It injects traceparent, retries, and honours `http.allowHosts`. Where the URL is built from anything a caller supplied it ALSO blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop — for a hard-coded host that half is redundant, and the first three are still the reason to switch",
-		match: ({ file: e, path: t, serverOnly: n }) => (Wt.test(t) || n) && G(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (ct.test(t) || n) && F(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
 		scope: "client",
 		smell: "per-field useState + a submit flag (hand-rolled form)",
 		use: "useFormBinding — fields + validation from the mutation input Schema; server ValidationError({ field }) routes to the field",
-		match: ({ src: e, file: t }) => G(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
+		match: ({ src: e, file: t }) => F(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
 	},
 	{
 		id: "table",
@@ -1451,7 +792,7 @@ var le = () => {
 		scope: "client",
 		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
 		use: "useDerived — dependency-tracked, referentially stable",
-		match: ({ src: e }) => Bt(e, /\buseSubscription\s*[(<]/g) >= 3 && Bt(e, /\buseMemo\s*\(/g) >= 3
+		match: ({ src: e }) => it(e, /\buseSubscription\s*[(<]/g) >= 3 && it(e, /\buseMemo\s*\(/g) >= 3
 	},
 	{
 		id: "next-shim",
@@ -1473,16 +814,16 @@ var le = () => {
 		scope: "client",
 		smell: "checking a subscription's `data === undefined` (or `!data`) instead of its `loading` / `idle` flag",
 		use: "branch on `loading` (and `idle` when you pass `skip`) — `loading` narrows `data`, so the settled branch needs no `?? []` and no `!`",
-		match: ({ file: e }) => e.getDescendantsOfKind(j.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
-			let t = e.getFirstAncestorByKind(j.VariableDeclaration)?.getNameNode();
-			return t === void 0 ? [] : k.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
-		}).some((t) => Ut(e, t).some((e) => {
+		match: ({ file: e }) => e.getDescendantsOfKind(D.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
+			let t = e.getFirstAncestorByKind(D.VariableDeclaration)?.getNameNode();
+			return t === void 0 ? [] : T.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
+		}).some((t) => st(e, t).some((e) => {
 			let t = e.getParent();
-			if (k.isBinaryExpression(t)) {
+			if (T.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
 				return /^[!=]==?$/.test(n) && /^(undefined|null)$/.test(r.getText());
 			}
-			return k.isPrefixUnaryExpression(t) && t.getOperatorToken() === j.ExclamationToken;
+			return T.isPrefixUnaryExpression(t) && t.getOperatorToken() === D.ExclamationToken;
 		}))
 	},
 	{
@@ -1504,7 +845,7 @@ var le = () => {
 		scope: "server",
 		smell: "several sequential store reads assembling related data (an N+1 you are writing by hand)",
 		use: "reads are a parent→child walk on ONE key → relations() in a *.relations.ts + .with({ … }) (ONE JSON-aggregate query, every dialect); reads collect ids from SEVERAL sources → keep the assembly and run the independent leading reads under Effect.all (same queries, same results, only concurrent — zero parity risk)",
-		match: (e) => G(e.file, /\bstore\.query$/) >= 3 || G(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
+		match: (e) => F(e.file, /\bstore\.query$/) >= 3 || F(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
 	},
 	{
 		id: "store-effect-lift",
@@ -1527,7 +868,7 @@ var le = () => {
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || qt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || dt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1537,7 +878,7 @@ var le = () => {
 		use: "you cannot look a value up by equality AND encrypt it non-deterministically — `.encrypted()` would make this column unfindable. Store the HASH as the unique lookup key and keep the secret itself either `.encrypted()` in a second column or nowhere (the framework's own `_voltro_api_keys.hashedKey` is the shape: the presented value is hashed and compared, never read back). A deterministic cipher is the other option and buys equality lookup at the cost of leaking which rows share a value",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || qt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || dt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1601,9 +942,9 @@ var le = () => {
 		scope: "server",
 		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
 		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
-		match: ({ file: e, testSources: t }) => G(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
-			let t = zt(e);
-			return Ht(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+		match: ({ file: e, testSources: t }) => F(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
+			let t = rt(e);
+			return ot(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
 		})
 	},
 	{
@@ -1613,84 +954,84 @@ var le = () => {
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], Yt = (e) => q(e), Xt = (e, t) => {
+], pt = (e) => R(e), mt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
-		let t = S(e, r), i = t.split(/[\\/]/)[0];
+		let t = v(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, Zt = /\.(tsx?|jsx?)$/, K = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Qt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, $t = (e, t = [], n = 0) => {
-	if (n > 12 || K.test(e)) return t;
+}, I = /\.(tsx?|jsx?)$/, L = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, ht = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, gt = (e, t = [], n = 0) => {
+	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = D(e, { withFileTypes: !0 });
+		r = C(e, { withFileTypes: !0 });
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = x(e, i.name);
+		let r = _(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
-			$t(r, t, n + 1);
-		} else ft.test(i.name) && t.push(r);
+			gt(r, t, n + 1);
+		} else je.test(i.name) && t.push(r);
 	}
 	return t;
-}, q = (e, t = [], n = 0) => {
-	if (n > 12 || K.test(e)) return t;
+}, R = (e, t = [], n = 0) => {
+	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = D(e);
+		r = C(e);
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = x(e, i), a;
+		let r = _(e, i), a;
 		try {
-			a = O(r);
+			a = w(r);
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? q(r, t, n + 1) : Zt.test(i) && !/\.(test|spec)\./.test(i) && !Qt.test(i) && t.push(r);
+		a.isDirectory() ? R(r, t, n + 1) : I.test(i) && !/\.(test|spec)\./.test(i) && !ht.test(i) && t.push(r);
 	}
 	return t;
-}, en = (e, t = [], n = 0) => {
-	if (n > 12 || K.test(e)) return t;
+}, _t = (e, t = [], n = 0) => {
+	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = D(e);
+		r = C(e);
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = x(e, i), a;
+		let r = _(e, i), a;
 		try {
-			a = O(r);
+			a = w(r);
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? en(r, t, n + 1) : Zt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? _t(r, t, n + 1) : I.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
-}, tn = (e) => {
-	let t = Yt(e);
+}, vt = (e) => {
+	let t = pt(e);
 	return {
-		dirs: Xt(e, t),
+		dirs: mt(e, t),
 		fileCount: t.length
 	};
-}, nn = (e) => {
-	let t = Yt(e);
+}, yt = (e) => {
+	let t = pt(e);
 	if (t.length === 0) return [];
-	let n = new A({
+	let n = new E({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	}), r = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
 	for (let e of t) try {
-		i.set(e, E(e, "utf8"));
+		i.set(e, S(e, "utf8"));
 	} catch {}
-	let a = Rt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
-	for (let t of en(e)) try {
-		o.set(t, E(t, "utf8"));
+	let a = nt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
+	for (let t of _t(e)) try {
+		o.set(t, S(t, "utf8"));
 	} catch {}
 	for (let s of t) {
 		let t = i.get(s);
@@ -1700,30 +1041,30 @@ var le = () => {
 			c = {
 				src: t,
 				file: n.createSourceFile(`/scan${s.endsWith("x") ? ".tsx" : ".ts"}`, t, { overwrite: !0 }),
-				path: S(e, s),
+				path: v(e, s),
 				serverOnly: a.has(s),
 				testSources: o
 			};
 		} catch {
 			continue;
 		}
-		for (let t of Jt) {
-			if (t.plugin !== void 0 && Vt(c, t.plugin) || !t.match(c)) continue;
+		for (let t of ft) {
+			if (t.plugin !== void 0 && at(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
-			n.push(S(e, s)), r.set(t.id, n);
+			n.push(v(e, s)), r.set(t.id, n);
 		}
 	}
-	return Jt.filter((e) => r.has(e.id)).map((e) => ({
+	return ft.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
-}, rn = (e) => {
-	let t = tn(e);
+}, z = (e) => {
+	let t = vt(e);
 	return {
 		root: e,
 		scannedFiles: t.fileCount,
 		scannedDirs: t.dirs,
-		findings: nn(e).map(({ rule: e, files: t }) => ({
+		findings: yt(e).map(({ rule: e, files: t }) => ({
 			id: e.id,
 			scope: e.scope,
 			smell: e.smell,
@@ -1731,22 +1072,22 @@ var le = () => {
 			files: t
 		}))
 	};
-}, an = 3, on = .2, sn = 50, cn = (e, t) => e >= sn && t > 0 && e / t >= on, ln = (e) => {
+}, bt = 3, xt = .2, St = 50, Ct = (e, t) => e >= St && t > 0 && e / t >= xt, wt = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	for (let n of q(e)) try {
-		t.set(S(e, n), E(n, "utf8"));
+	for (let n of R(e)) try {
+		t.set(v(e, n), S(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
-	for (let t of $t(e)) try {
-		n.set(S(e, t), E(t, "utf8"));
+	for (let t of gt(e)) try {
+		n.set(v(e, t), S(t, "utf8"));
 	} catch {}
-	let r = pt({
+	let r = Me({
 		sources: t,
 		envFiles: n
 	});
-	r !== void 0 && (console.log(""), console.log(mt(r)));
-}, un = (e) => {
-	let t = rn(e);
+	r !== void 0 && (console.log(""), console.log(Ne(r)));
+}, Tt = (e) => {
+	let t = z(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
 	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
 	console.log(`\u2022  Shipped primitives you may be hand-rolling (scanned ${t.scannedFiles} files across ${t.scannedDirs.join(", ")}):`);
@@ -1757,56 +1098,56 @@ var le = () => {
 		console.log(`   [${e}]`);
 		let i = [...r].sort((e, t) => e.files.length - t.files.length);
 		for (let e of i) {
-			if (cn(e.files.length, t.scannedFiles)) {
+			if (Ct(e.files.length, t.scannedFiles)) {
 				let n = Math.round(e.files.length / t.scannedFiles * 100);
 				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s), ${n}% of those scanned: a codebase-wide pattern rather than a work list`), console.log(`     \u2192 ${e.use}`), console.log("     (paths omitted on purpose at this scale — `voltro doctor --json` has every one.)");
 				continue;
 			}
-			let r = e.files.slice(0, an).join(", "), i = e.files.length - an;
+			let r = e.files.slice(0, bt).join(", "), i = e.files.length - bt;
 			i > 0 && (n += i);
 			let a = i > 0 ? `, +${i} more` : "";
 			console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${r}${a}`), console.log(`     \u2192 ${e.use}`);
 		}
 	}
 	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
-}, dn = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", fn = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, pn = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, mn = (e) => {
-	let t = fn.exec(e)?.[1];
+}, Et = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", Dt = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, Ot = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, kt = (e) => {
+	let t = Dt.exec(e)?.[1];
 	if (t !== void 0) return t === "ssr" ? "ssr" : null;
-	let n = pn.exec(e)?.[1];
+	let n = Ot.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
-}, hn = async (e) => {
-	let t = x(e, "src", "pages");
-	if (!T(t)) return [];
-	let { pages: i, dirs: o } = await n(t), s = [];
-	for (let n of i) {
-		if (!a(o, n.dirChain).some((e) => e.hasLayout)) continue;
-		let i;
+}, B = async (e) => {
+	let t = _(e, "src", "pages");
+	if (!x(t)) return [];
+	let { pages: n, dirs: r } = await l(t), i = [];
+	for (let a of n) {
+		if (!s(r, a.dirChain).some((e) => e.hasLayout)) continue;
+		let n;
 		try {
-			i = E(x(t, n.file), "utf8");
+			n = S(_(t, a.file), "utf8");
 		} catch {
 			continue;
 		}
-		if (r.test(i)) continue;
-		let c = mn(i);
-		c !== null && s.push({
-			file: S(e, x(t, n.file)),
-			pattern: n.pattern,
-			currentMode: c
+		if (c.test(n)) continue;
+		let o = kt(n);
+		o !== null && i.push({
+			file: v(e, _(t, a.file)),
+			pattern: a.pattern,
+			currentMode: o
 		});
 	}
-	return s;
-}, gn = 10, _n = async (e) => {
-	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = await hn(e);
+	return i;
+}, At = 10, jt = async (e) => {
+	if (console.log(""), !x(_(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let t = await B(e);
 	if (t.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
 	console.log(`•  renderMode:'spa' candidates (${t.length} page${t.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of t.slice(0, gn)) {
+	for (let e of t.slice(0, At)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let n = t.length - gn;
-	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${dn}`), t.length;
-}, vn = /* @__PURE__ */ new Set([
+	let n = t.length - At;
+	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${Et}`), t.length;
+}, Mt = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -1814,69 +1155,69 @@ var le = () => {
 	".vite",
 	".framework",
 	".git"
-]), yn = (e, t, n) => {
+]), Nt = (e, t, n) => {
 	let r;
 	try {
-		r = D(e, { withFileTypes: !0 });
+		r = C(e, { withFileTypes: !0 });
 	} catch {
 		return;
 	}
 	for (let i of r) {
-		if (vn.has(i.name)) continue;
-		let r = x(e, i.name);
-		i.isDirectory() ? yn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(S(t, r));
+		if (Mt.has(i.name)) continue;
+		let r = _(e, i.name);
+		i.isDirectory() ? Nt(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(v(t, r));
 	}
-}, bn = (e, t) => {
+}, Pt = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
 		try {
-			t = E(x(e, i), "utf8");
+			t = S(_(e, i), "utf8");
 		} catch {
 			continue;
 		}
-		let a = b(x(e, i));
+		let a = ae(_(e, i));
 		for (let i of t.matchAll(r)) {
-			let t = C(a, i[1]);
+			let t = y(a, i[1]);
 			for (let r of [
 				t,
 				`${t}.tsx`,
 				`${t}.ts`,
-				x(t, "index.tsx"),
-				x(t, "index.ts")
-			]) if (T(r) && O(r).isFile()) {
-				n.add(S(e, r));
+				_(t, "index.tsx"),
+				_(t, "index.ts")
+			]) if (x(r) && w(r).isFile()) {
+				n.add(v(e, r));
 				break;
 			}
 		}
 	}
 	return n;
-}, xn = (e, t) => {
-	let n = e.slice(t.length).split(w).slice(0, -1)[0];
+}, Ft = (e, t) => {
+	let n = e.slice(t.length).split(b).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
-}, J = (e) => {
-	let t = [], n = x(e, "src", "pages"), r = x(e, "src");
-	if (!T(r)) return t;
+}, V = (e) => {
+	let t = [], n = _(e, "src", "pages"), r = _(e, "src");
+	if (!x(r)) return t;
 	let i = [];
-	yn(r, e, i), i.sort();
-	let a = `${S(e, n)}${w}`;
-	bn(e, i);
+	Nt(r, e, i), i.sort();
+	let a = `${v(e, n)}${b}`;
+	Pt(e, i);
 	for (let n of i) {
-		let r = n.slice(n.lastIndexOf(w) + 1);
+		let r = n.slice(n.lastIndexOf(b) + 1);
 		if (n.startsWith(a)) {
 			if (r !== "page.tsx") continue;
-			T(x(e, c(n))) || t.push({
+			x(_(e, d(n))) || t.push({
 				kind: "page-without-test",
 				file: n
 			});
 			try {
-				let r = E(x(e, n), "utf8");
+				let r = S(_(e, n), "utf8");
 				!/\bexport\s+(?:const|let|var|function)\s+meta\b/.test(r) && !/\bexport\s*\{[^}]*\bmeta\b/.test(r) && t.push({
 					kind: "page-without-meta",
 					file: n
 				});
 			} catch {}
-			xn(n, a) && t.push({
+			Ft(n, a) && t.push({
 				kind: "top-level-dynamic-route",
 				file: n
 			});
@@ -1888,33 +1229,33 @@ var le = () => {
 		});
 	}
 	return t;
-}, Sn = 10, Y = (e, t, n) => {
+}, It = 10, H = (e, t, n) => {
 	if (t.length === 0) return;
 	console.log(`•  ${e} (${t.length}):`);
-	for (let e of t.slice(0, Sn)) console.log(`   ${e}`);
-	let r = t.length - Sn;
+	for (let e of t.slice(0, It)) console.log(`   ${e}`);
+	let r = t.length - It;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
-}, Cn = (e) => {
-	if (console.log(""), !T(x(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = J(e);
+}, Lt = (e) => {
+	if (console.log(""), !x(_(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let t = V(e);
 	if (t.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
 	let n = (e) => t.filter((t) => t.kind === e).map((e) => e.file);
-	return Y("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), Y("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), Y("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), Y("pages with no `meta` export — they serve the APP name as their title", n("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), t.length;
-}, wn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", Tn = /* @__PURE__ */ new Map(), X = (e) => {
-	let t = Tn.get(e);
+	return H("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), H("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), H("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), H("pages with no `meta` export — they serve the APP name as their title", n("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), t.length;
+}, Rt = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", zt = /* @__PURE__ */ new Map(), U = (e) => {
+	let t = zt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-iiMtlkfs.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-D2BikO7a.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
 		};
 	})();
-	return Tn.set(e, n), n;
-}, En = async (e) => {
+	return zt.set(e, n), n;
+}, Bt = async (e) => {
 	let t;
 	try {
-		let { files: n, discovered: r } = await X(e), i = r.tables.map((e) => {
+		let { files: n, discovered: r } = await U(e), i = r.tables.map((e) => {
 			let t = e;
 			return {
 				name: t.tableName,
@@ -1922,12 +1263,12 @@ var le = () => {
 			};
 		});
 		if (i.length === 0) return;
-		t = Je(qe(n, i, e));
+		t = pe(fe(n, i, e));
 	} catch {
 		return;
 	}
 	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
-}, Dn = (e) => e.map((e) => {
+}, Vt = (e) => e.map((e) => {
 	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
 		name: e,
 		type: typeof t?.type == "string" ? t.type : ""
@@ -1937,22 +1278,22 @@ var le = () => {
 		columns: n,
 		primaryKey: t.appliedPrimaryKey ?? []
 	};
-}), Z = async (e) => {
+}), W = async (e) => {
 	try {
-		let { discovered: t } = await X(e);
-		return $e(Dn(t.tables));
+		let { discovered: t } = await U(e);
+		return ve(Vt(t.tables));
 	} catch {
 		return null;
 	}
-}, On = async (e) => {
-	let t = await Z(e);
+}, Ht = async (e) => {
+	let t = await W(e);
 	if (t === null || t.tablesChecked === 0) return;
-	let n = tt(t);
+	let n = be(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
-}, kn = async (e) => {
+}, G = async (e) => {
 	try {
-		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await X(e);
-		return at(n.events.map((e) => {
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await U(e);
+		return we(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
 				name: n.name,
@@ -1964,19 +1305,19 @@ var le = () => {
 	} catch {
 		return null;
 	}
-}, An = async (e) => {
-	let t = await kn(e);
+}, Ut = async (e) => {
+	let t = await G(e);
 	if (t === null || t.eventsChecked === 0) return;
-	let n = ot(t);
+	let n = Te(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
-	let r = st(t);
+	let r = Ee(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
-}, jn = (e) => {
+}, K = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
 	return r === void 0 ? n : `${r}: ${n}`;
-}, Mn = async (e) => {
+}, q = async (e) => {
 	try {
-		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await X(e)).discovered.serverOnlyLeaks, r = t(n);
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await U(e)).discovered.serverOnlyLeaks, r = t(n);
 		return {
 			status: {
 				checked: !0,
@@ -1987,17 +1328,117 @@ var le = () => {
 	} catch (e) {
 		return { status: {
 			checked: !1,
-			reason: jn(e)
+			reason: K(e)
 		} };
 	}
-}, Nn = async (e) => {
-	let { status: t, message: n } = await Mn(e);
+}, J = async (r) => {
+	try {
+		let { loadApiConfig: i } = await import("./dev-D2BikO7a.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
+			queries: a.queries,
+			mutations: a.mutations,
+			actions: a.actions,
+			streams: a.streams,
+			events: a.events
+		};
+		return {
+			checked: !0,
+			defaultDeny: o,
+			undecided: e(s),
+			openAccess: t(s)
+		};
+	} catch (e) {
+		return {
+			checked: !1,
+			reason: K(e),
+			defaultDeny: !0,
+			undecided: [],
+			openAccess: []
+		};
+	}
+}, Wt = async (e) => {
+	let t = await J(e);
+	if (!t.checked) return console.log(""), console.log("•  access decisions: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
+	console.log(""), console.log(`access decisions · security.defaultDeny ${t.defaultDeny ? "ON" : "OFF"}`), console.log(`  ✗ no access decision                    ${String(t.undecided.length).padStart(4)}`), console.log(`  ✓ openAccess, declared on purpose       ${String(t.openAccess.length).padStart(4)}`);
+	for (let e of t.openAccess) console.log(`      ${e.tag} — ${e.openAccess ?? ""}`);
+	if (t.undecided.length === 0) return !1;
+	console.log("");
+	for (let e of t.undecided) console.log(`  ✗ ${e.tag}  (${e.kind})${e.file === void 0 ? "" : `\n      ${e.file}`}`);
+	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), Gt(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), Gt(), !1);
+}, Gt = () => {
+	console.log("    `guards: [{ scope: '…' }]`                       authority the SUBJECT holds globally"), console.log("    `guards: [{ action, resourceType, resource }]`   authority per ROW / per resource"), console.log("        — backed by `defineResourcePolicy` + a tuple source you register. If your"), console.log("          relationships already live in your own tables (a `teamMembers` row), register"), console.log("          a tuple source over them; nothing is copied. Fail-closed without a resolver."), console.log("          Docs: Authentication → Authorization."), console.log("    `openAccess: '<why anyone may call it>'`         deliberately unauthenticated");
+}, Y = async (e) => {
+	try {
+		let { files: t } = await U(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-CrGAfhIG.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
+		if (a.length === 0) return {
+			checked: !0,
+			unverified: [],
+			open: [],
+			verified: 0
+		};
+		let o = await r(a, ce({ scope: "voltro:doctor" })), s = [], c = [], l = 0;
+		for (let e of o.incoming) {
+			let t = i(e.descriptor);
+			t === null ? s.push({
+				id: e.descriptor.id,
+				file: e.file
+			}) : t === "none" ? c.push({
+				id: e.descriptor.id,
+				file: e.file
+			}) : l += 1;
+		}
+		return {
+			checked: !0,
+			unverified: s,
+			open: c,
+			verified: l
+		};
+	} catch (e) {
+		return {
+			checked: !1,
+			reason: K(e),
+			unverified: [],
+			open: [],
+			verified: 0
+		};
+	}
+}, Kt = async (e) => {
+	let t = await Y(e);
+	if (!t.checked) return console.log(""), console.log("•  webhook verification: NOT CHECKED — the app's webhooks could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
+	if (t.verified + t.open.length + t.unverified.length === 0) return !1;
+	console.log(""), console.log("incoming webhook verification"), console.log(`  ✓ signature / provider verified         ${String(t.verified).padStart(4)}`), console.log(`  ! deliberately public (none)            ${String(t.open.length).padStart(4)}`), console.log(`  ✗ nothing verifies the caller           ${String(t.unverified.length).padStart(4)}`);
+	for (let e of t.open) console.log(`      ${e.id} — \`verification: 'none'\`; a gateway / IP allow-list owns this URL`), console.log(`        ${e.file}`);
+	if (t.unverified.length === 0) return !1;
+	console.log("");
+	for (let e of t.unverified) console.log(`  ✗ ${e.id}\n      ${e.file}`);
+	return console.log(""), console.log("  These are public POSTs that run your application code, and `voltro dev` /"), console.log("  `voltro serve` REFUSE to mount them. Declare one of: `provider:` (a preset),"), console.log("  `signature:` (your own HMAC scheme), `verification: 'provider'` (your handler"), console.log("  verifies), or `verification: 'none'` (deliberately public)."), !0;
+}, qt = async (e) => {
+	let { status: t, message: n } = await q(e);
 	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, Pn = async (e) => {
+}, Jt = async (e) => Xe({
+	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
+	openStore: async () => {
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-D2BikO7a.js"), r = await t(e);
+		if (r === null) throw Error("no app.config.ts in this directory");
+		let i = await n(r, void 0);
+		return {
+			store: i,
+			close: async () => {
+				await i.close?.();
+			}
+		};
+	},
+	sweep: async (e) => {
+		let { sweepStalledRuns: t } = await import("@voltro/workflow");
+		return t({ store: e });
+	}
+}), Yt = async (e) => {
+	let t = Qe(await Jt(e));
+	t !== null && (console.log(""), console.log(t));
+}, Xt = async (e) => {
 	let t;
 	try {
-		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await X(e);
-		t = ut(r, i.workflows.map((e) => {
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await U(e);
+		t = ke(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
 				optional: []
@@ -2011,68 +1452,68 @@ var le = () => {
 	} catch {
 		return;
 	}
-	let n = dt(t);
+	let n = Ae(t);
 	if (n === null) return;
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, Q = "voltro-authz-allowlist.txt", Fn = (e, t = (e) => {
+}, X = "voltro-authz-allowlist.txt", Zt = (e, t = (e) => {
 	try {
-		return E(e, "utf8");
+		return S(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...vt, ...yt(q(e).map(t))]), In = (e, t) => {
+}) => /* @__PURE__ */ new Set([...j, ...Ie(R(e).map(t))]), Qt = (e, t) => {
 	let n = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(String.raw`(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*define[A-Za-z]*Event\s*\(\s*\{[^}]*?name\s*:\s*['"\`]${n}['"\`]`, "s").exec(e)?.[1];
-}, Ln = async (e) => {
+}, Z = async (e) => {
 	try {
-		let { discovered: t } = await X(e), n = t.events.map((e) => ({
+		let { discovered: t } = await U(e), n = t.events.map((e) => ({
 			name: e.descriptor.name,
 			file: e.file
 		})).filter((e) => typeof e.name == "string");
 		if (n.length === 0) return [];
 		let r = new Set(t.events.map((e) => e.file)), i = (e) => {
 			try {
-				return E(e, "utf8");
+				return S(e, "utf8");
 			} catch {
 				return "";
 			}
-		}, a = q(e).filter((e) => !r.has(e)).map(i).join("\n");
+		}, a = R(e).filter((e) => !r.has(e)).map(i).join("\n");
 		return n.filter(({ name: e, file: t }) => {
 			if (a.includes(e)) return !1;
-			let n = In(i(t), e);
+			let n = Qt(i(t), e);
 			return n === void 0 || !new RegExp(String.raw`\b${n}\b`).test(a);
 		}).map((e) => e.name).sort();
 	} catch {
 		return [];
 	}
-}, Rn = async (e) => {
-	let t = await Ln(e);
+}, $t = async (e) => {
+	let t = await Z(e);
 	if (t.length !== 0) {
 		console.log(""), console.log(`•  ${t.length} declared event(s) with no emit call site found:`);
 		for (let e of t) console.log(`     ${e}`);
 		console.log(""), console.log("   An event you declare is an event partners can subscribe to. One that"), console.log("   never fires is indistinguishable, from their side, from a broken"), console.log("   endpoint of their own — so they debug your contract instead of"), console.log("   reading it."), console.log("   ADVISORY: this looks for the event name AND the identifier its"), console.log("   declaration binds it to, so `emit(ctx, apiKeyCreated, …)` counts. An"), console.log("   emit through an ASSEMBLED name still reads as missing here.");
 	}
-}, zn = async (e) => {
+}, en = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-iiMtlkfs.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-D2BikO7a.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
-		let a = (await import(oe(C(e, r)).href))[i];
+		let a = (await import(se(y(e, r)).href))[i];
 		return Array.isArray(a) ? a.filter((e) => typeof e == "string") : [];
 	} catch {
 		return [];
 	}
-}, Bn = async (e) => {
+}, Q = async (e) => {
 	let t = {
 		evaluated: !1,
 		vocabularySize: 0,
 		findings: []
 	};
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-DRovTKza.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-CvQCte0z.js"), o = await n(e), s = r(o.manifest, o.tables), c = await zn(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-DKpDLlqu.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) return t;
 		let u = i({
 			...s,
@@ -2091,8 +1532,8 @@ var le = () => {
 	} catch {
 		return t;
 	}
-}, Vn = async (e) => {
-	let { findings: t, evaluated: n } = await Bn(e);
+}, tn = async (e) => {
+	let { findings: t, evaluated: n } = await Q(e);
 	if (!n) {
 		console.log(""), console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
 		return;
@@ -2102,35 +1543,35 @@ var le = () => {
 		for (let e of t) console.log(`     ${e.node}${e.file === void 0 ? "" : `  ${e.file}`}`), console.log(`       ${e.detail}`);
 		console.log(""), console.log("   Each of these is uncallable by every user in every role — not"), console.log("   misconfigured, DEAD — and nothing fails at boot to say so. The"), console.log("   usual cause is a typo or a rename that moved one side only."), console.log(`   ${t[0].fix}`);
 	}
-}, Hn = async (e) => {
+}, nn = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
-		let t = x(e, i);
-		if (T(t)) try {
-			r = D(t).filter((e) => /\.tsx?$/.test(e) && !e.endsWith(".d.ts")).map((e) => e.replace(/\.tsx?$/, "")), n = i;
+		let t = _(e, i);
+		if (x(t)) try {
+			r = C(t).filter((e) => /\.tsx?$/.test(e) && !e.endsWith(".d.ts")).map((e) => e.replace(/\.tsx?$/, "")), n = i;
 			break;
 		} catch {}
 	}
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-iiMtlkfs.js");
+		let { loadApiConfig: t } = await import("./dev-D2BikO7a.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
 	}
-	let a = ht({
+	let a = Pe({
 		catalogCodes: r,
 		declaredLocales: i
 	});
 	if (a !== void 0) {
 		console.log("");
-		for (let e of gt(a, n)) console.log(e);
+		for (let e of Fe(a, n)) console.log(e);
 	}
-}, Un = async (e) => {
-	let { discovered: t } = await X(e), n = [];
+}, rn = async (e) => {
+	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-iiMtlkfs.js");
+		let { loadApiConfig: t } = await import("./dev-D2BikO7a.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -2138,16 +1579,13 @@ var le = () => {
 					tableName: typeof t.tableName == "string" ? t.tableName : "",
 					renamedFrom: typeof t.renamedFrom == "string" ? t.renamedFrom : void 0
 				};
-			}).filter((e) => e.tableName !== ""), n = (e.rpcClientDescriptors ?? []).map((e) => {
-				let t = e, n = t.descriptor?.name ?? t.name;
-				return typeof n == "string" ? n : "";
-			}).filter((e) => e !== "");
+			}).filter((e) => e.tableName !== ""), n = (e.rpcClientDescriptors ?? []).map((t) => typeof t.tag == "string" ? u(e, t.tag) : "").filter((e) => e !== ""), r = e.baseName ?? e.name;
 			return {
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: Wn.has(e.name),
-				canAlias: Gn.has(e.name)
+				canDisableTables: an.has(r),
+				canAlias: on.has(r)
 			};
 		});
 	} catch {
@@ -2159,14 +1597,36 @@ var le = () => {
 		...t.mutations,
 		...t.actions,
 		...t.streams ?? []
-	].map((e) => String(e.descriptor.name)), i = Mt(n, {
+	].map((e) => String(e.descriptor.name)), i = Je(n, {
 		tables: t.tables.map((e) => e.tableName),
 		rpcTags: r
 	});
 	console.log();
-	for (let e of Nt(n, i)) console.log(e);
-}, Wn = /* @__PURE__ */ new Set(["@voltro/plugin-rbac"]), Gn = /* @__PURE__ */ new Set(["@voltro/plugin-ai-flows"]), $ = 20, Kn = async (e) => {
-	let t = await qn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
+	for (let e of Ye(n, i)) console.log(e);
+}, an = /* @__PURE__ */ new Set([
+	"@voltro/plugin-rbac",
+	"@voltro/plugin-audit",
+	"@voltro/plugin-notifications",
+	"aiFlows"
+]), on = /* @__PURE__ */ new Set([
+	"aiFlows",
+	"@voltro/plugin-audit",
+	"@voltro/plugin-billing",
+	"@voltro/plugin-cdc-out",
+	"@voltro/plugin-flags",
+	"@voltro/plugin-governance",
+	"@voltro/plugin-mail",
+	"@voltro/plugin-moderation",
+	"@voltro/plugin-notifications",
+	"@voltro/plugin-presence",
+	"@voltro/plugin-rbac",
+	"@voltro/plugin-scim",
+	"@voltro/plugin-search",
+	"@voltro/plugin-sso-saml",
+	"@voltro/plugin-storage",
+	"@voltro/plugin-versioning"
+]), $ = 20, sn = async (e) => {
+	let t = await cn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
 	return {
 		executors: t.executorCount,
 		guardVocabulary: [...t.vocabulary].sort(),
@@ -2178,15 +1638,15 @@ var le = () => {
 		},
 		unchecked: t.result.unchecked
 	};
-}, qn = async (e) => {
-	let { discovered: t } = await X(e), n = /* @__PURE__ */ new Map(), r = (e) => {
+}, cn = async (e) => {
+	let { discovered: t } = await U(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
-			n.set(e, E(e, "utf8"));
+			n.set(e, S(e, "utf8"));
 		} catch {
 			n.set(e, "");
 		}
 		return n.get(e);
-	}, i = Fn(e, r), a = /* @__PURE__ */ new Set();
+	}, i = Zt(e, r), a = /* @__PURE__ */ new Set();
 	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
 		e && a.add(e.tableName);
@@ -2218,12 +1678,12 @@ var le = () => {
 			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
 			...a?.table === void 0 ? {} : { table: a.table }
 		};
-	})), s = x(e, Q), c = T(s) ? W(E(s, "utf8")) : void 0, l = !1;
-	for (let t of q(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
+	})), s = _(e, X), c = x(s) ? M(S(s, "utf8")) : void 0, l = !1;
+	for (let t of R(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
 		l = !0;
 		break;
 	}
-	let u = Tt({
+	let u = He({
 		executors: o,
 		guardVocabulary: i,
 		tenantScopedTables: t.tenantScopedTables,
@@ -2240,261 +1700,46 @@ var le = () => {
 		executorCount: o.length,
 		allowPath: s
 	};
-}, Jn = async (e, t) => {
-	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await qn(e), l = n.counts;
+}, ln = async (e, t) => {
+	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await cn(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
-	let u = [...r].filter((e) => !vt.has(e)).sort();
+	let u = [...r].filter((e) => !j.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
 	let d = new Set(a.map((e) => e.tag)), f = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !d.has(e.tag)).length, p = l.allowlisted - f;
-	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${Q})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
-		let e = T(s) ? E(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = kt(e, t);
-		return ce(s, Ot(e, t), "utf8"), console.log(`\n${Q}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
+	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${X})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
+		let e = x(s) ? S(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ke(e, t);
+		return oe(s, Ge(e, t), "utf8"), console.log(`\n${X}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
 	}
 	if (n.unchecked.length === 0) return !1;
 	console.log("");
 	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
-	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${Q} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${Q}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, Yn = async (e) => {
-	if (e.includes("--help") || e.includes("-h")) return console.log(wn), 0;
-	let n = e.includes("--strict"), r = C(e.find((e) => !e.startsWith("-")) ?? process.cwd());
-	if (ue(e)) return le(), M({
-		...rn(r),
-		spaCandidates: await hn(r),
-		pageConvention: J(r),
-		fileTaxonomy: V(r).findings,
-		junctionFks: (await Z(r))?.issues ?? [],
-		eventDelivery: await kn(r),
-		duplicateInstances: t(r),
-		versionSkew: s(r) ?? null,
-		serverOnly: (await Mn(r)).status,
-		authz: await Kn(r),
-		ungrantedScopes: await Bn(r),
-		neverEmittedEvents: await Ln(r)
+	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${X} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${X}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
+}, un = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(Rt), 0;
+	let t = e.includes("--strict"), n = y(e.find((e) => !e.startsWith("-")) ?? process.cwd());
+	if (h(e)) return g(), m({
+		...z(n),
+		spaCandidates: await B(n),
+		pageConvention: V(n),
+		fileTaxonomy: re(n).findings,
+		junctionFks: (await W(n))?.issues ?? [],
+		eventDelivery: await G(n),
+		duplicateInstances: a(n),
+		versionSkew: o(n) ?? null,
+		serverOnly: (await q(n)).status,
+		accessDecisions: await J(n),
+		webhookVerification: await Y(n),
+		authz: await sn(n),
+		ungrantedScopes: await Q(n),
+		neverEmittedEvents: await Z(n),
+		stalledRuns: await Jt(n)
 	}), 0;
-	let a = Lt(r, n);
-	un(r), ln(r), Cn(r), Ue(r), await _n(r), await Pn(r), await En(r), await On(r), await An(r), await Un(r), await Vn(r), await Rn(r), await Hn(r);
-	let c = await Nn(r), l = await Jn(r, e.includes("--write-authz-allowlist")), u = o(s(r));
-	u !== void 0 && (console.log(""), console.log(u));
-	let d = i(t(r));
-	return d !== void 0 && console.log(`\n${d}`), c || l ? Math.max(a, 1) : a;
-}, Xn = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, Zn = /* @__PURE__ */ new Set([
-	"insert",
-	"update",
-	"delete",
-	"upsert"
-]), Qn = (e, t) => {
-	let n = [], r = new Set(t.exercised), i = /* @__PURE__ */ new Map();
-	for (let e of t.edges) {
-		let t = i.get(e.tag);
-		t === void 0 ? i.set(e.tag, [e]) : t.push(e);
-	}
-	let a = [], o = [];
-	for (let t of e) {
-		if (!r.has(t.tag)) {
-			a.push(t.tag);
-			continue;
-		}
-		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(Xn(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
-		for (let t of c) if (Zn.has(t.op)) {
-			let r = u.get(t.table);
-			r === void 0 ? n.push({
-				rule: "observed/undeclared-write",
-				node: e,
-				...s === void 0 ? {} : { file: s },
-				breaks: [`writes '${t.table}' (${t.op}) but declares no target for it`, "subscriptions on that table are not invalidated by this mutation"],
-				fix: `add { table: '${t.table}', op: '${t.op}' } to this procedure's targets`,
-				severity: "warn"
-			}) : r !== t.op && n.push({
-				rule: "observed/wrong-op",
-				node: e,
-				...s === void 0 ? {} : { file: s },
-				breaks: [`declares op '${r}' on '${t.table}' but performed '${t.op}'`, "the synthesized optimistic patch has the wrong shape"],
-				fix: `change the target op for '${t.table}' to '${t.op}'`,
-				severity: "warn"
-			});
-		} else !l.has(t.table) && !u.has(t.table) && n.push({
-			rule: "observed/undeclared-read",
-			node: e,
-			...s === void 0 ? {} : { file: s },
-			breaks: [`reads '${t.table}' but declares no source for it`],
-			fix: `add '${t.table}' to this procedure's source`,
-			severity: "warn"
-		});
-		if (c.length === 0) {
-			o.push(t.tag);
-			continue;
-		}
-		let d = new Set(c.map((e) => e.table));
-		for (let t of l) d.has(t) || n.push({
-			rule: "observed/declared-but-unobserved",
-			node: e,
-			...s === void 0 ? {} : { file: s },
-			breaks: [`declares source '${t}' but never read it while running`],
-			fix: `remove '${t}' from source, or check whether the handler still reads it`,
-			severity: "warn"
-		});
-		for (let [t] of u) d.has(t) || n.push({
-			rule: "observed/declared-but-unobserved",
-			node: e,
-			...s === void 0 ? {} : { file: s },
-			breaks: [`declares target '${t}' but never wrote it while running`],
-			fix: `remove the '${t}' target, or check whether the handler still writes it`,
-			severity: "warn"
-		});
-	}
-	return {
-		diagnostics: n,
-		unexercised: a.sort(),
-		unobservedReads: o.sort(),
-		coverage: {
-			exercised: e.length - a.length - o.length,
-			total: e.length
-		}
-	};
-}, $n = (e, t = [], n = 0) => {
-	if (n > 12) return t;
-	let r;
-	try {
-		r = D(e);
-	} catch {
-		return t;
-	}
-	for (let i of r) {
-		if ([
-			"node_modules",
-			"dist",
-			"build",
-			".framework",
-			".turbo",
-			".git",
-			"coverage"
-		].includes(i)) continue;
-		let r = `${e}/${i}`, a;
-		try {
-			a = O(r);
-		} catch {
-			continue;
-		}
-		a.isDirectory() ? $n(r, t, n + 1) : a.isFile() && u.test(i) && t.push(r);
-	}
-	return t;
-}, er = /* @__PURE__ */ new Set(["actors", "tenants"]), tr = async (e) => {
-	try {
-		let { readFile: t } = await import("node:fs/promises"), { join: n } = await import("node:path"), r = await t(n(e, "app.graph.observed.generated.json"), "utf8"), i = JSON.parse(r);
-		return i?.version !== 1 || !Array.isArray(i.edges) || !Array.isArray(i.exercised) ? null : i;
-	} catch {
-		return null;
-	}
-}, nr = (e) => {
-	let { exercised: t, total: n } = e.coverage, r = `\nobserved: ${t}/${n} procedures exercised (${n === 0 ? 0 : Math.round(t / n * 100)}%)`;
-	if (e.diagnostics.length === 0) return `${r}\n  no declared/observed mismatches${e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : ""}`;
-	let i = e.diagnostics.map((e) => `  ${e.node}${e.file === void 0 ? "" : ` (${e.file})`}\n` + e.breaks.map((e) => `    ${e}`).join("\n") + `\n    fix: ${e.fix}`), a = e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : "";
-	return `${r}\n${i.join("\n")}${a}`;
-}, rr = (e, t) => ({
-	tables: (t.tables ?? []).map((e) => e.name),
-	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || er.has(e.name)).map((e) => e.name),
-	scopes: e.scopes ?? [],
-	procedures: (e.procedures ?? []).map((e) => {
-		let t = (e.guards ?? []).flatMap((e) => e.kind === "scope" ? e.scope ?? [] : []);
-		return {
-			tag: e.tag,
-			kind: e.kind,
-			...e.source === void 0 ? {} : { source: e.source },
-			...e.targets === void 0 ? {} : { targets: e.targets },
-			...t.length > 0 ? { requiresScopes: [...new Set(t)] } : {},
-			...e.guards === void 0 ? {} : { hasGuards: e.guards.length > 0 }
-		};
-	})
-}), ir = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
-	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
-	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
-}).join("\n"), ar = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-iiMtlkfs.js"), { buildRpcEntry: i } = await import("./manifestBuild-Dj8Jjoto.js"), { buildCapabilityManifest: a } = await import("./inspect-mmBuRXmy.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
-		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
-		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
-		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
-		...s.streams.map((e) => c(e.descriptor, "stream", e.file))
-	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-D-EebUQX.js"), d = await u({ root: e }).catch((e) => (console.warn(`\n⚠  plugin tables could not be collected — this report is INCOMPLETE.\n   ${e instanceof Error ? e.message.split("\n")[0] : String(e)}\n`), [])), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
-		name: e,
-		framework: !0
-	}))], m = await r(e).then((e) => e?.plugins ?? []).catch(() => []);
-	return {
-		manifest: a(l, s.workflows.map((t) => ({
-			tag: t.definition.name ?? "",
-			file: o(e, t.file)
-		})), [], m),
-		tables: { tables: p }
-	};
-}, or = async (e) => {
-	let t = he(e.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]));
-	if ("error" in t) return console.error(`voltro check: ${t.error}`), 1;
-	let { process: n, target: r, rest: i } = ge(t.rest), a;
-	for (let e = 0; e < i.length; e++) if (i[e] === "--diff") {
-		let [t, n] = (i[++e] ?? "").split(":");
-		if (t === "removeTable" && n) a = {
-			kind: "removeTable",
-			name: n
-		};
-		else if (t === "removeProcedure" && n) a = {
-			kind: "removeProcedure",
-			tag: n
-		};
-		else if (t === "removeScope" && n) a = {
-			kind: "removeScope",
-			name: n
-		};
-		else return console.error("voltro check --diff: expected removeTable:<name> | removeProcedure:<tag> | removeScope:<name>"), 1;
-	}
-	let o = i.find((e) => !e.startsWith("-")) ?? process.cwd(), s = i.includes("--offline"), c = s ? [] : await me(n, r), u, d;
-	if (c.length === 0) {
-		if (!s && r !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
-		try {
-			let e = await ar(C(o));
-			u = e.manifest, d = e.tables;
-		} catch (e) {
-			return console.error(`voltro check: could not assemble the graph from source: ${e.message}`), console.error("  Start `voltro dev` to check against a running api instead."), 1;
-		}
-	} else {
-		let e = c[0], [t, n] = await Promise.all([N(e, "/_voltro/inspect/manifest"), N(e, "/_voltro/inspect/data/tables")]);
-		if (t.kind === "err") return console.error(`voltro check: manifest fetch failed: ${t.error}`), 1;
-		u = t.data, d = n.kind === "ok" ? n.data : { tables: [] };
-	}
-	let f = rr(u, d), p = ie(f, a), m = [...V(o).findings.map((e) => ({
-		rule: e.rule,
-		node: e.file,
-		file: e.file,
-		breaks: [e.detail],
-		fix: e.fix,
-		severity: e.severity
-	})), ...J(o).map((e) => ({
-		rule: `page/${e.kind}`,
-		node: e.file,
-		file: e.file,
-		breaks: [e.kind === "suffixed-outside-pages" ? "a page.tsx outside src/pages/ never routes" : "no test beside it"],
-		fix: e.kind === "suffixed-outside-pages" ? "move it under src/pages/ into the directory whose route it serves, or rename it — page.tsx is reserved" : "write the test with the file — the name is derivable",
-		severity: e.kind === "suffixed-outside-pages" ? "error" : "warn"
-	}))], h = (await l(o, $n(o))).map((e) => ({
-		rule: "client/not-browser-safe",
-		node: e.file,
-		file: e.file,
-		breaks: [`reaches the server-only '${e.violation.specifier}' — chain: ${e.violation.chain.join(" → ")}`],
-		fix: "move the server-only code behind a *.server.ts, or drop the .client suffix — an unmarked file makes no claim",
-		severity: "error"
-	})), g = [
-		...p.diagnostics,
-		...m,
-		...h
-	], _ = p.ok && !m.some((e) => e.severity === "error") && h.length === 0, v = await tr(C(o)), y = v === null ? null : Qn(f.procedures, v);
-	return t.format === "json" ? M(y === null ? {
-		...p,
-		ok: _,
-		diagnostics: g
-	} : {
-		...p,
-		ok: _,
-		diagnostics: g,
-		observed: y
-	}) : (console.log(ir(g)), y !== null && console.log(nr(y)), console.log(_ ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!_;
+	let s = tt(n, t);
+	Tt(n), wt(n), Lt(n), ne(n), await jt(n), await Xt(n), await Yt(n), await Bt(n), await Ht(n), await Ut(n), await rn(n), await tn(n), await $t(n), await nn(n);
+	let c = await qt(n), l = await ln(n, e.includes("--write-authz-allowlist")), u = await Wt(n), d = await Kt(n), f = r(o(n));
+	f !== void 0 && (console.log(""), console.log(f));
+	let p = i(a(n));
+	return p !== void 0 && console.log(`\n${p}`), c || l || u || d ? Math.max(s, 1) : s;
 };
 //#endregion
-export { le as _, Lt as a, Se as c, N as d, he as f, me as g, pe as h, Yn as i, I as l, P as m, or as n, Be as o, ge as p, rr as r, xe as s, ar as t, ye as u, M as v, ue as y };
+export { q as C, B as S, Y as T, jt as _, sn as a, yt as b, G as c, vt as d, P as f, Lt as g, Tt as h, J as i, Zt as l, wt as m, et as n, Z as o, W as p, Et as r, Qt as s, Rt as t, z as u, un as v, Q as w, V as x, tt as y };