@voltro/cli 0.34.0 → 0.36.0

package/dist/doctorCommand-BYffQc0s.js

@@ -0,0 +1,2 @@
+import { v as e, y as t } from "./doctorCommand-CNFtt3nR.js";
+export { e as runDoctorCommand, t as runServePreflight };

package/dist/{doctorCommand-CnDXQxfa.js → doctorCommand-CNFtt3nR.js}

@@ -1,8 +1,8 @@
-import { Ft as e, Nt as t, Pt as n } from "./dev-CerMd0mW.js";
-import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-CBYvPqQr.js";
-import { w as u } from "./frameworkTableAssembly-DkkP6BgC.js";
+import { Bt as e, Rt as t, zt as n } from "./dev-Dc4cpmRl.js";
+import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-Dybxew86.js";
+import { w as u } from "./frameworkTableAssembly-oMPBKqlE.js";
 import { n as d } from "./pageConvention-cEiRxdab.js";
-import { r as f, u as p } from "./apiBuild-DZF_f0_I.js";
+import { r as f, u as p } from "./apiBuild-DiE9zcj6.js";
 import { n as m, r as h, t as g } from "./cliOutput-D1tSBoRM.js";
 import { n as ee, t as te } from "./tsconfigPaths-BWXBWgcl.js";
 import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
@@ -672,7 +672,7 @@ var le = /* @__PURE__ */ new Set([
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => st.test(v(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => ct.test(v(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -685,11 +685,11 @@ var le = /* @__PURE__ */ new Set([
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, F = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), rt = (e, t) => (e.match(t) ?? []).length, I = (e, t) => e.getDescendantsOfKind(D.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, it = (e, t) => {
+}, rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), it = (e, t) => (e.match(t) ?? []).length, F = (e, t) => e.getDescendantsOfKind(D.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, at = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
-	return n !== t && I(e.file, RegExp(`^${n}Plugin$`)) > 0;
-}, at = (e, t) => {
+	return n !== t && F(e.file, RegExp(`^${n}Plugin$`)) > 0;
+}, ot = (e, t) => {
 	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
 	for (; (i = r.exec(e)) !== null;) {
 		let t = i.index + i[0].length, r = 1, a = t;
@@ -697,10 +697,10 @@ var le = /* @__PURE__ */ new Set([
 		n.push(e.slice(t, a - 1));
 	}
 	return n;
-}, ot = (e, t) => {
+}, st = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
 	return n === void 0 ? [] : e.getDescendantsOfKind(D.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, st = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, ct = /\.(query|mutation|action|stream)\.server\.tsx?$/, lt = [
+}, ct = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, lt = /\.(query|mutation|action|stream)\.server\.tsx?$/, ut = [
 	"Id",
 	"ID",
 	"Hash",
@@ -726,7 +726,7 @@ var le = /* @__PURE__ */ new Set([
 	"Comment",
 	"Provider",
 	"Format"
-], ut = RegExp(`(?:${lt.join("|")})$|_(?:${lt.map((e) => e.toLowerCase()).join("|")})$`), dt = [
+], dt = RegExp(`(?:${ut.join("|")})$|_(?:${ut.map((e) => e.toLowerCase()).join("|")})$`), ft = [
 	{
 		id: "hardcoded-framework-cookie",
 		scope: "client",
@@ -739,7 +739,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => ct.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => lt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
@@ -747,8 +747,8 @@ var le = /* @__PURE__ */ new Set([
 		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
 		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
 		match: ({ src: e, path: t }) => {
-			if (!ct.test(t)) return !1;
-			let n = F(e);
+			if (!lt.test(t)) return !1;
+			let n = rt(e);
 			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
 		}
 	},
@@ -757,14 +757,14 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no traceparent, no retry, and no SSRF guard where the URL is not a constant)",
 		use: "yield* HttpClient — the framework client. It injects traceparent, retries, and honours `http.allowHosts`. Where the URL is built from anything a caller supplied it ALSO blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop — for a hard-coded host that half is redundant, and the first three are still the reason to switch",
-		match: ({ file: e, path: t, serverOnly: n }) => (st.test(t) || n) && I(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (ct.test(t) || n) && F(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
 		scope: "client",
 		smell: "per-field useState + a submit flag (hand-rolled form)",
 		use: "useFormBinding — fields + validation from the mutation input Schema; server ValidationError({ field }) routes to the field",
-		match: ({ src: e, file: t }) => I(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
+		match: ({ src: e, file: t }) => F(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
 	},
 	{
 		id: "table",
@@ -792,7 +792,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "client",
 		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
 		use: "useDerived — dependency-tracked, referentially stable",
-		match: ({ src: e }) => rt(e, /\buseSubscription\s*[(<]/g) >= 3 && rt(e, /\buseMemo\s*\(/g) >= 3
+		match: ({ src: e }) => it(e, /\buseSubscription\s*[(<]/g) >= 3 && it(e, /\buseMemo\s*\(/g) >= 3
 	},
 	{
 		id: "next-shim",
@@ -817,7 +817,7 @@ var le = /* @__PURE__ */ new Set([
 		match: ({ file: e }) => e.getDescendantsOfKind(D.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
 			let t = e.getFirstAncestorByKind(D.VariableDeclaration)?.getNameNode();
 			return t === void 0 ? [] : T.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
-		}).some((t) => ot(e, t).some((e) => {
+		}).some((t) => st(e, t).some((e) => {
 			let t = e.getParent();
 			if (T.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
@@ -845,7 +845,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "several sequential store reads assembling related data (an N+1 you are writing by hand)",
 		use: "reads are a parent→child walk on ONE key → relations() in a *.relations.ts + .with({ … }) (ONE JSON-aggregate query, every dialect); reads collect ids from SEVERAL sources → keep the assembly and run the independent leading reads under Effect.all (same queries, same results, only concurrent — zero parity risk)",
-		match: (e) => I(e.file, /\bstore\.query$/) >= 3 || I(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
+		match: (e) => F(e.file, /\bstore\.query$/) >= 3 || F(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
 	},
 	{
 		id: "store-effect-lift",
@@ -868,7 +868,7 @@ var le = /* @__PURE__ */ new Set([
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || ut.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || dt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -878,7 +878,7 @@ var le = /* @__PURE__ */ new Set([
 		use: "you cannot look a value up by equality AND encrypt it non-deterministically — `.encrypted()` would make this column unfindable. Store the HASH as the unique lookup key and keep the secret itself either `.encrypted()` in a second column or nowhere (the framework's own `_voltro_api_keys.hashedKey` is the shape: the presented value is hashed and compared, never read back). A deterministic cipher is the other option and buys equality lookup at the cost of leaking which rows share a value",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || ut.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || dt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -942,9 +942,9 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
 		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
-		match: ({ file: e, testSources: t }) => I(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
-			let t = F(e);
-			return at(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+		match: ({ file: e, testSources: t }) => F(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
+			let t = rt(e);
+			return ot(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
 		})
 	},
 	{
@@ -954,14 +954,14 @@ var le = /* @__PURE__ */ new Set([
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], ft = (e) => R(e), pt = (e, t) => {
+], pt = (e) => R(e), mt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
 		let t = v(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, mt = /\.(tsx?|jsx?)$/, L = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, ht = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, gt = (e, t = [], n = 0) => {
+}, I = /\.(tsx?|jsx?)$/, L = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, ht = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, gt = (e, t = [], n = 0) => {
 	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
@@ -992,7 +992,7 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? R(r, t, n + 1) : mt.test(i) && !/\.(test|spec)\./.test(i) && !ht.test(i) && t.push(r);
+		a.isDirectory() ? R(r, t, n + 1) : I.test(i) && !/\.(test|spec)\./.test(i) && !ht.test(i) && t.push(r);
 	}
 	return t;
 }, _t = (e, t = [], n = 0) => {
@@ -1010,17 +1010,17 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? _t(r, t, n + 1) : mt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? _t(r, t, n + 1) : I.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
 }, vt = (e) => {
-	let t = ft(e);
+	let t = pt(e);
 	return {
-		dirs: pt(e, t),
+		dirs: mt(e, t),
 		fileCount: t.length
 	};
 }, yt = (e) => {
-	let t = ft(e);
+	let t = pt(e);
 	if (t.length === 0) return [];
 	let n = new E({
 		useInMemoryFileSystem: !0,
@@ -1048,13 +1048,13 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		for (let t of dt) {
-			if (t.plugin !== void 0 && it(c, t.plugin) || !t.match(c)) continue;
+		for (let t of ft) {
+			if (t.plugin !== void 0 && at(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
 			n.push(v(e, s)), r.set(t.id, n);
 		}
 	}
-	return dt.filter((e) => r.has(e.id)).map((e) => ({
+	return ft.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
@@ -1245,7 +1245,7 @@ var le = /* @__PURE__ */ new Set([
 	let t = zt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-CoG-ZPx8.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-BSFTgCQ5.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
@@ -1333,11 +1333,12 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, J = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-CoG-ZPx8.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-BSFTgCQ5.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
-			streams: a.streams
+			streams: a.streams,
+			events: a.events
 		};
 		return {
 			checked: !0,
@@ -1362,7 +1363,9 @@ var le = /* @__PURE__ */ new Set([
 	if (t.undecided.length === 0) return !1;
 	console.log("");
 	for (let e of t.undecided) console.log(`  ✗ ${e.tag}  (${e.kind})${e.file === void 0 ? "" : `\n      ${e.file}`}`);
-	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), console.log("  `guards: [{ scope: '…' }]`, or `openAccess: '<why anyone may call it>'`."), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), !1);
+	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), Gt(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), Gt(), !1);
+}, Gt = () => {
+	console.log("    `guards: [{ scope: '…' }]`                       authority the SUBJECT holds globally"), console.log("    `guards: [{ action, resourceType, resource }]`   authority per ROW / per resource"), console.log("        — backed by `defineResourcePolicy` + a tuple source you register. If your"), console.log("          relationships already live in your own tables (a `teamMembers` row), register"), console.log("          a tuple source over them; nothing is copied. Fail-closed without a resolver."), console.log("          Docs: Authentication → Authorization."), console.log("    `openAccess: '<why anyone may call it>'`         deliberately unauthenticated");
 }, Y = async (e) => {
 	try {
 		let { files: t } = await U(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-CrGAfhIG.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
@@ -1398,7 +1401,7 @@ var le = /* @__PURE__ */ new Set([
 			verified: 0
 		};
 	}
-}, Gt = async (e) => {
+}, Kt = async (e) => {
 	let t = await Y(e);
 	if (!t.checked) return console.log(""), console.log("•  webhook verification: NOT CHECKED — the app's webhooks could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
 	if (t.verified + t.open.length + t.unverified.length === 0) return !1;
@@ -1408,13 +1411,13 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of t.unverified) console.log(`  ✗ ${e.id}\n      ${e.file}`);
 	return console.log(""), console.log("  These are public POSTs that run your application code, and `voltro dev` /"), console.log("  `voltro serve` REFUSE to mount them. Declare one of: `provider:` (a preset),"), console.log("  `signature:` (your own HMAC scheme), `verification: 'provider'` (your handler"), console.log("  verifies), or `verification: 'none'` (deliberately public)."), !0;
-}, Kt = async (e) => {
+}, qt = async (e) => {
 	let { status: t, message: n } = await q(e);
 	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, qt = async (e) => Xe({
+}, Jt = async (e) => Xe({
 	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-CoG-ZPx8.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-BSFTgCQ5.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1428,10 +1431,10 @@ var le = /* @__PURE__ */ new Set([
 		let { sweepStalledRuns: t } = await import("@voltro/workflow");
 		return t({ store: e });
 	}
-}), Jt = async (e) => {
-	let t = Qe(await qt(e));
+}), Yt = async (e) => {
+	let t = Qe(await Jt(e));
 	t !== null && (console.log(""), console.log(t));
-}, Yt = async (e) => {
+}, Xt = async (e) => {
 	let t;
 	try {
 		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await U(e);
@@ -1454,13 +1457,13 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, X = "voltro-authz-allowlist.txt", Xt = (e, t = (e) => {
+}, X = "voltro-authz-allowlist.txt", Zt = (e, t = (e) => {
 	try {
 		return S(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...j, ...Ie(R(e).map(t))]), Zt = (e, t) => {
+}) => /* @__PURE__ */ new Set([...j, ...Ie(R(e).map(t))]), Qt = (e, t) => {
 	let n = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(String.raw`(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*define[A-Za-z]*Event\s*\(\s*\{[^}]*?name\s*:\s*['"\`]${n}['"\`]`, "s").exec(e)?.[1];
 }, Z = async (e) => {
@@ -1479,22 +1482,22 @@ var le = /* @__PURE__ */ new Set([
 		}, a = R(e).filter((e) => !r.has(e)).map(i).join("\n");
 		return n.filter(({ name: e, file: t }) => {
 			if (a.includes(e)) return !1;
-			let n = Zt(i(t), e);
+			let n = Qt(i(t), e);
 			return n === void 0 || !new RegExp(String.raw`\b${n}\b`).test(a);
 		}).map((e) => e.name).sort();
 	} catch {
 		return [];
 	}
-}, Qt = async (e) => {
+}, $t = async (e) => {
 	let t = await Z(e);
 	if (t.length !== 0) {
 		console.log(""), console.log(`•  ${t.length} declared event(s) with no emit call site found:`);
 		for (let e of t) console.log(`     ${e}`);
 		console.log(""), console.log("   An event you declare is an event partners can subscribe to. One that"), console.log("   never fires is indistinguishable, from their side, from a broken"), console.log("   endpoint of their own — so they debug your contract instead of"), console.log("   reading it."), console.log("   ADVISORY: this looks for the event name AND the identifier its"), console.log("   declaration binds it to, so `emit(ctx, apiKeyCreated, …)` counts. An"), console.log("   emit through an ASSEMBLED name still reads as missing here.");
 	}
-}, $t = async (e) => {
+}, en = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-CoG-ZPx8.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1510,7 +1513,7 @@ var le = /* @__PURE__ */ new Set([
 		findings: []
 	};
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-YZDmkAGd.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-CvQCte0z.js"), o = await n(e), s = r(o.manifest, o.tables), c = await $t(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-BTA6P3Yr.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) return t;
 		let u = i({
 			...s,
@@ -1529,7 +1532,7 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return t;
 	}
-}, en = async (e) => {
+}, tn = async (e) => {
 	let { findings: t, evaluated: n } = await Q(e);
 	if (!n) {
 		console.log(""), console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
@@ -1540,7 +1543,7 @@ var le = /* @__PURE__ */ new Set([
 		for (let e of t) console.log(`     ${e.node}${e.file === void 0 ? "" : `  ${e.file}`}`), console.log(`       ${e.detail}`);
 		console.log(""), console.log("   Each of these is uncallable by every user in every role — not"), console.log("   misconfigured, DEAD — and nothing fails at boot to say so. The"), console.log("   usual cause is a typo or a rename that moved one side only."), console.log(`   ${t[0].fix}`);
 	}
-}, tn = async (e) => {
+}, nn = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
 		let t = _(e, i);
@@ -1552,7 +1555,7 @@ var le = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CoG-ZPx8.js");
+		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1565,10 +1568,10 @@ var le = /* @__PURE__ */ new Set([
 		console.log("");
 		for (let e of Fe(a, n)) console.log(e);
 	}
-}, nn = async (e) => {
+}, rn = async (e) => {
 	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CoG-ZPx8.js");
+		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -1581,8 +1584,8 @@ var le = /* @__PURE__ */ new Set([
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: rn.has(r),
-				canAlias: an.has(r)
+				canDisableTables: an.has(r),
+				canAlias: on.has(r)
 			};
 		});
 	} catch {
@@ -1600,12 +1603,12 @@ var le = /* @__PURE__ */ new Set([
 	});
 	console.log();
 	for (let e of Ye(n, i)) console.log(e);
-}, rn = /* @__PURE__ */ new Set([
+}, an = /* @__PURE__ */ new Set([
 	"@voltro/plugin-rbac",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-notifications",
 	"aiFlows"
-]), an = /* @__PURE__ */ new Set([
+]), on = /* @__PURE__ */ new Set([
 	"aiFlows",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-billing",
@@ -1622,8 +1625,8 @@ var le = /* @__PURE__ */ new Set([
 	"@voltro/plugin-sso-saml",
 	"@voltro/plugin-storage",
 	"@voltro/plugin-versioning"
-]), $ = 20, on = async (e) => {
-	let t = await sn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
+]), $ = 20, sn = async (e) => {
+	let t = await cn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
 	return {
 		executors: t.executorCount,
 		guardVocabulary: [...t.vocabulary].sort(),
@@ -1635,7 +1638,7 @@ var le = /* @__PURE__ */ new Set([
 		},
 		unchecked: t.result.unchecked
 	};
-}, sn = async (e) => {
+}, cn = async (e) => {
 	let { discovered: t } = await U(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
 			n.set(e, S(e, "utf8"));
@@ -1643,7 +1646,7 @@ var le = /* @__PURE__ */ new Set([
 			n.set(e, "");
 		}
 		return n.get(e);
-	}, i = Xt(e, r), a = /* @__PURE__ */ new Set();
+	}, i = Zt(e, r), a = /* @__PURE__ */ new Set();
 	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
 		e && a.add(e.tableName);
@@ -1697,8 +1700,8 @@ var le = /* @__PURE__ */ new Set([
 		executorCount: o.length,
 		allowPath: s
 	};
-}, cn = async (e, t) => {
-	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await sn(e), l = n.counts;
+}, ln = async (e, t) => {
+	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await cn(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
 	let u = [...r].filter((e) => !j.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
@@ -1711,7 +1714,7 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
 	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${X} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${X}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, ln = async (e) => {
+}, un = async (e) => {
 	if (e.includes("--help") || e.includes("-h")) return console.log(Rt), 0;
 	let t = e.includes("--strict"), n = y(e.find((e) => !e.startsWith("-")) ?? process.cwd());
 	if (h(e)) return g(), m({
@@ -1726,17 +1729,17 @@ var le = /* @__PURE__ */ new Set([
 		serverOnly: (await q(n)).status,
 		accessDecisions: await J(n),
 		webhookVerification: await Y(n),
-		authz: await on(n),
+		authz: await sn(n),
 		ungrantedScopes: await Q(n),
 		neverEmittedEvents: await Z(n),
-		stalledRuns: await qt(n)
+		stalledRuns: await Jt(n)
 	}), 0;
 	let s = tt(n, t);
-	Tt(n), wt(n), Lt(n), ne(n), await jt(n), await Yt(n), await Jt(n), await Bt(n), await Ht(n), await Ut(n), await nn(n), await en(n), await Qt(n), await tn(n);
-	let c = await Kt(n), l = await cn(n, e.includes("--write-authz-allowlist")), u = await Wt(n), d = await Gt(n), f = r(o(n));
+	Tt(n), wt(n), Lt(n), ne(n), await jt(n), await Xt(n), await Yt(n), await Bt(n), await Ht(n), await Ut(n), await rn(n), await tn(n), await $t(n), await nn(n);
+	let c = await qt(n), l = await ln(n, e.includes("--write-authz-allowlist")), u = await Wt(n), d = await Kt(n), f = r(o(n));
 	f !== void 0 && (console.log(""), console.log(f));
 	let p = i(a(n));
 	return p !== void 0 && console.log(`\n${p}`), c || l || u || d ? Math.max(s, 1) : s;
 };
 //#endregion
-export { q as C, B as S, Y as T, jt as _, on as a, yt as b, G as c, vt as d, P as f, Lt as g, Tt as h, J as i, Xt as l, wt as m, et as n, Z as o, W as p, Et as r, Zt as s, Rt as t, z as u, ln as v, Q as w, V as x, tt as y };
+export { q as C, B as S, Y as T, jt as _, sn as a, yt as b, G as c, vt as d, P as f, Lt as g, Tt as h, J as i, Zt as l, wt as m, et as n, Z as o, W as p, Et as r, Qt as s, Rt as t, z as u, un as v, Q as w, V as x, tt as y };

package/dist/{dormancyCommand-Dszo57d6.js → dormancyCommand-6F6NsJKf.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-CerMd0mW.js";
+import { c as e, i as t } from "./dev-Dc4cpmRl.js";
 import { n, t as r } from "./cliArgs-D4p8n7EE.js";
 import { r as i } from "./appPort-B_HpJ_ck.js";
 import { resolve as a } from "node:path";

package/dist/{embeddingsCommand-C0sKVRo1.js → embeddingsCommand-DRRdneJD.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-CerMd0mW.js";
+import { c as e, i as t } from "./dev-Dc4cpmRl.js";
 import { Effect as n } from "effect";
 import { embedMany as r } from "@voltro/ai";
 //#region src/embeddingsBackfill.ts

package/dist/{envCommand-DPgdV1Bq.js → envCommand-TZzcyqZ-.js}

@@ -1,5 +1,5 @@
-import { c as e } from "./dev-CerMd0mW.js";
-import { at as t, ct as n, lt as r, ot as i } from "./webDev-CBYvPqQr.js";
+import { c as e } from "./dev-Dc4cpmRl.js";
+import { at as t, ct as n, lt as r, ot as i } from "./webDev-Dybxew86.js";
 import { join as a } from "node:path";
 import { promises as o } from "node:fs";
 import { createLogger as s } from "@voltro/logger";

package/dist/{evolveCommand-DHpkgjgH.js → evolveCommand-iU35TPjT.js}

@@ -1,6 +1,6 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
-import { t } from "./checkCommand-Dv8r9tGO.js";
-import { i as n, n as r } from "./codemodRunner-DRRqXR74.js";
+import { t } from "./checkCommand-BhG0gmUD.js";
+import { i as n, n as r } from "./codemodRunner-DjQGrdmg.js";
 import { basename as i, join as a, resolve as o } from "node:path";
 import { branchNamespaceName as s, planBranchProvision as c } from "@voltro/database";
 import { readFile as l } from "node:fs/promises";

package/dist/frameworkTableAssembly-YyVe32Cb.js

@@ -0,0 +1,2 @@
+import { n as e } from "./frameworkTableAssembly-oMPBKqlE.js";
+export { e as assembleFrameworkTables };