@voltro/cli 0.37.0 → 0.38.0

package/dist/{codemodRunner-cyqu5oxr.js → codemodRunner-CXgQ-ecJ.js}

@@ -2764,11 +2764,11 @@ var x = (e, t, n) => {
 		"that legitimately resolves to `undefined` does not throw — only a missing",
 		"`loader` does."
 	].join("\n")
-}), U = "@voltro/ui-shadcn", W = "voltro:lang", hn = "voltro:locale", G = "parsePreferenceCookies", gn = (e, t) => {
+}), U = "@voltro/ui-shadcn", W = "voltro:lang", hn = "voltro:locale", gn = "parsePreferenceCookies", _n = (e, t) => {
 	let n = [];
 	for (let r of e.getImportDeclarations()) if (r.getModuleSpecifierValue() === U) for (let e of r.getNamedImports()) e.getName() === t && n.push(e.getAliasNode()?.getText() ?? e.getName());
 	return n;
-}, _n = (e) => {
+}, vn = (e) => {
 	let t = 0;
 	for (let n of e.getSourceFiles()) n.getFullText().includes(W) && n.forEachDescendant((e) => {
 		if (y.isStringLiteral(e) || y.isNoSubstitutionTemplateLiteral(e) || y.isTemplateHead(e) || y.isTemplateMiddle(e) || y.isTemplateTail(e) || y.isRegularExpressionLiteral(e)) {
@@ -2778,10 +2778,10 @@ var x = (e, t, n) => {
 		}
 	});
 	return t;
-}, vn = (e) => {
+}, yn = (e) => {
 	let t = 0, n = 0;
 	for (let r of e.getSourceFiles()) {
-		let e = gn(r, G);
+		let e = _n(r, gn);
 		e.length !== 0 && r.forEachDescendant((r) => {
 			if (!y.isCallExpression(r) || !e.includes(r.getExpression().getText())) return;
 			let i = r.getParent();
@@ -2804,29 +2804,29 @@ var x = (e, t, n) => {
 		access: t,
 		destructured: n
 	};
-}, yn = C({
+}, bn = C({
 	version: "0.30.0",
 	id: "0.30.0/01_locale-cookie-rename",
 	title: "the language-preference cookie is `voltro:locale` (was `voltro:lang`)",
 	kind: "transform",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return t.includes(W) || t.includes(U) && (t.includes("LANG_COOKIE") || t.includes(G));
+		return t.includes(W) || t.includes(U) && (t.includes("LANG_COOKIE") || t.includes(gn));
 	}),
 	transform: ({ project: e, helpers: t, log: n }) => {
 		let r = t.renameImport(e, {
 			module: U,
 			from: "LANG_COOKIE",
 			to: "LOCALE_COOKIE"
-		}), i = _n(e), { access: a, destructured: o } = vn(e), s = [];
+		}), i = vn(e), { access: a, destructured: o } = yn(e), s = [];
 		r > 0 && s.push(`LANG_COOKIE → LOCALE_COOKIE (${r} import(s))`), i > 0 && s.push(`'voltro:lang' → 'voltro:locale' (${i} literal(s))`), a + o > 0 && s.push(`parsePreferenceCookies().lang → .locale (${a + o} site(s))`), s.length !== 0 && n(`locale cookie rename: ${s.join("; ")}. Your SOURCE is migrated. Your USERS' cookies are not — the old \`voltro:lang\` cookie in an already-visited browser is no longer read, so each user falls back to Accept-Language / defaultLocale once and re-picks their language. Nothing errors. If that reset is unacceptable, copy the old value forward at your own boot — the codemod file has the three-line bridge.` + (o > 0 ? ` ${o} destructure(s) were rewritten as \`{ locale: lang }\` to keep the local name safe from a scope collision — rename the binding yourself if you want the vocabulary to match.` : ""));
 	}
-}), bn = /auditPlugin\s*\(|versioningPlugin\s*\(|atlassianPlugin\s*\(/, xn = C({
+}), xn = /auditPlugin\s*\(|versioningPlugin\s*\(|atlassianPlugin\s*\(/, Sn = C({
 	version: "0.30.0",
 	id: "0.30.0/02_audit-purge-query-recheck",
 	title: "re-run the credential-purge query — the 0.28.0 spelling under-reported on MySQL/MariaDB",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => bn.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => xn.test(e.getFullText())),
 	note: [
 		"IF YOU ALREADY RAN THE 0.28.0 PURGE CHECK ON MySQL OR MariaDB, RUN IT AGAIN.",
 		"The query that note shipped under-reported, and it under-reported by",
@@ -2873,14 +2873,14 @@ var x = (e, t, n) => {
 		"  `connectionCredentials(...)` keeps it in the framework vault",
 		"  (see `0.28.0/03_atlassian-credentials-context`)."
 	].join("\n")
-}), Sn = /\.webhooks\s*\.\s*emit\s*\(|useWebhooks\s*\(/, Cn = C({
+}), Cn = /\.webhooks\s*\.\s*emit\s*\(|useWebhooks\s*\(/, wn = C({
 	version: "0.30.0",
 	id: "0.30.0/03_webhook-emit-durable-deferral",
 	title: "a deferred `webhooks.emit` rides the transactional outbox; `{ immediate: true }` opts out",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return Sn.test(t) || w("emit").test(t);
+		return Cn.test(t) || w("emit").test(t);
 	}),
 	note: [
 		"A `ctx.webhooks.emit(...)` inside a MUTATION now enqueues a transactional",
@@ -2930,14 +2930,14 @@ var x = (e, t, n) => {
 		"created by the declarative differ on the next `voltro dev` boot or",
 		"`voltro db apply` — there is nothing to run by hand."
 	].join("\n")
-}), wn = /\.executionId\b|workflows\s*\.\s*start\s*\(|workflows\s*\.\s*child\s*\(/, Tn = C({
+}), Tn = /\.executionId\b|workflows\s*\.\s*start\s*\(|workflows\s*\.\s*child\s*\(/, En = C({
 	version: "0.30.0",
 	id: "0.30.0/04_workflow-run-handle-nullable-execution",
 	title: "`WorkflowRunHandle.executionId` is `string | null`; `status` gains queued/dropped/skipped",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return wn.test(t) || w("start").test(t);
+		return Tn.test(t) || w("start").test(t);
 	}),
 	note: [
 		"A workflow start no longer always becomes a run. With declarative flow",
@@ -3002,12 +3002,12 @@ var x = (e, t, n) => {
 		"  and `singleton: { mode: 'skip' }` throws `WorkflowSingletonHeldError`",
 		"  carrying the incumbent's execution id, so you can wait on THAT run."
 	].join("\n")
-}), En = /auditPlugin\s*\(|versioningPlugin\s*\(|atlassianPlugin\s*\(/, Dn = C({
+}), Dn = /auditPlugin\s*\(|versioningPlugin\s*\(|atlassianPlugin\s*\(/, On = C({
 	version: "0.31.0",
 	id: "0.31.0/01_rerun-credential-scan",
 	title: "re-run `voltro db scan-credentials` — on 0.30.0–0.30.2 it skipped the column credentials land in",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => En.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Dn.test(e.getFullText())),
 	note: [
 		"IF YOU RAN `voltro db scan-credentials` ON 0.30.0, 0.30.1 OR 0.30.2, RUN IT",
 		"AGAIN. Its answer did not cover the column a leaked credential is most",
@@ -3041,7 +3041,7 @@ var x = (e, t, n) => {
 		"credential on the Subject — `connectionCredentials(...)` keeps it in the",
 		"framework vault."
 	].join("\n")
-}), On = C({
+}), kn = C({
 	version: "0.32.0",
 	id: "0.32.0/01_audit-redacts-outcome",
 	title: "`auditPlugin` now redacts `outcome` by default — opt out if your trail reads it",
@@ -3082,7 +3082,7 @@ var x = (e, t, n) => {
 		"purge the rows AND rotate the credentials — assume anything written to a",
 		"log table has been read."
 	].join("\n")
-}), kn = C({
+}), An = C({
 	version: "0.33.0",
 	id: "0.33.0/01_opentelemetry-optional-peer",
 	title: "`@effect/opentelemetry` is now an optional peer — install it if you use tracing",
@@ -3114,7 +3114,7 @@ var x = (e, t, n) => {
 		"never wrote down. It is a startup failure, not a silent loss of traces —",
 		"losing telemetry quietly would be the worse outcome."
 	].join("\n")
-}), An = C({
+}), jn = C({
 	version: "0.33.0",
 	id: "0.33.0/02_coordinated-handle-gained-wake",
 	title: "`CoordinatedScheduleHandle` gained `wake()`, `currentIntervalMs()` and `isArmed()` — update hand-written test doubles",
@@ -3164,7 +3164,7 @@ var x = (e, t, n) => {
 		"Reporting nothing is the conservative default on purpose — a task that",
 		"cannot tell whether it was idle must not be slowed down on a guess."
 	].join("\n")
-}), jn = C({
+}), Mn = C({
 	version: "0.34.0",
 	id: "0.34.0/01_serve-does-mount-inspect",
 	title: "Correction: `voltro serve` DOES mount an inspect surface (the 0.12.0 note said it mounts none)",
@@ -3205,12 +3205,12 @@ var x = (e, t, n) => {
 		"place, everyone already past 0.12.0 — which is everyone the wrong sentence",
 		"could have misled — would never have seen it."
 	].join("\n")
-}), Mn = (e) => /\.with\(\s*[\w.]*tenant\(/.test(e) || /\.serverOnly\(\s*\)/.test(e), Nn = C({
+}), Nn = (e) => /\.with\(\s*[\w.]*tenant\(/.test(e) || /\.serverOnly\(\s*\)/.test(e), Pn = C({
 	version: "0.34.0",
 	id: "0.34.0/02_keyed-writes-are-tenant-scoped",
 	title: "Keyed-by-pk writes are tenant-enforced, and `crud` refuses `.serverOnly()` input",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Mn(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Nn(e.getFullText())),
 	note: [
 		"TWO WRITE-SIDE REFUSALS ARE NEW. Neither changes a type, so `tsc` will not",
 		"point at the call sites — these are runtime behaviour changes.",
@@ -3274,12 +3274,12 @@ var x = (e, t, n) => {
 		"   an attack look like a no-op and leaves an honest caller debugging a",
 		"   value that quietly did not land."
 	].join("\n")
-}), Pn = /* @__PURE__ */ new Set([
+}), Fn = /* @__PURE__ */ new Set([
 	"defineQuery",
 	"defineMutation",
 	"defineAction",
 	"defineStream"
-]), Fn = (e) => {
+]), In = (e) => {
 	let t = e.getArguments()[0];
 	if (t === void 0 || !t.isKind(b.ObjectLiteralExpression)) return /* @__PURE__ */ new Set();
 	let n = /* @__PURE__ */ new Set();
@@ -3288,16 +3288,16 @@ var x = (e, t, n) => {
 		t !== void 0 && n.add(t);
 	}
 	return n;
-}, In = (e, t) => /define(Query|Mutation|Action|Stream)\s*\(/.test(e) ? t.some((e) => {
-	if (!Pn.has(e.getExpression().getText())) return !1;
-	let t = Fn(e);
+}, Ln = (e, t) => /define(Query|Mutation|Action|Stream)\s*\(/.test(e) ? t.some((e) => {
+	if (!Fn.has(e.getExpression().getText())) return !1;
+	let t = In(e);
 	return !t.has("internal") && !t.has("guards") && !t.has("openAccess");
-}) : !1, Ln = C({
+}) : !1, Rn = C({
 	version: "0.34.0",
 	id: "0.34.0/03_procedure-access-decision",
 	title: "Every wire-exposed procedure declares an access decision (`guards:` or `openAccess:`)",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => In(e.getFullText(), e.getDescendantsOfKind(b.CallExpression))),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Ln(e.getFullText(), e.getDescendantsOfKind(b.CallExpression))),
 	note: [
 		"YOUR APP WILL NOT BOOT UNTIL EVERY WIRE-EXPOSED PROCEDURE DECIDES WHO MAY",
 		"CALL IT. This is the single largest behaviour change in this release, and it",
@@ -3342,18 +3342,18 @@ var x = (e, t, n) => {
 		"procedures your PLUGINS declare — the gate reads your app's own discovered",
 		"files only, so adopting this does not turn into a plugin bug report."
 	].join("\n")
-}), Rn = [
+}), zn = [
 	"workosAuthorizationUrl",
 	"workosAuthenticateWithCode",
 	"workosBeginLogin"
-], zn = C({
+], Bn = C({
 	version: "0.34.0",
 	id: "0.34.0/04_workos-oauth-state-pkce",
 	title: "WorkOS hosted login: `workosAuthorizationUrl` → `workosBeginLogin`, with mandatory `state` + PKCE",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return t.includes("@voltro/plugin-auth-workos") && Rn.some((e) => t.includes(e));
+		return t.includes("@voltro/plugin-auth-workos") && zn.some((e) => t.includes(e));
 	}),
 	note: [
 		"YOUR WORKOS HOSTED-LOGIN FLOW HAD NO CSRF PROTECTION BY DEFAULT, AND NO PKCE.",
@@ -3411,12 +3411,12 @@ var x = (e, t, n) => {
 		"are accepted on the existing endpoints; your registered redirect URI is",
 		"unchanged."
 	].join("\n")
-}), Bn = /mirrorTables|_?voltro_mirror_/, Vn = C({
+}), Vn = /mirrorTables|_?voltro_mirror_/, Hn = C({
 	version: "0.34.0",
 	id: "0.34.0/05_analytics-mirror-versioned-writes",
 	title: "Analytics CDC-mirror: version-ordered writes, tombstoned deletes, retry + repair",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Bn.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Vn.test(e.getFullText())),
 	note: [
 		"The analytics CDC-mirror (`mirrorTables`) now orders every write and",
 		"retries the ones that fail. Three things to do.",
@@ -3471,7 +3471,7 @@ var x = (e, t, n) => {
 		"  VOLTRO_ANALYTICS_MIRROR_REPAIR_INTERVAL_MS  (60000, 0 disables)",
 		"  VOLTRO_ANALYTICS_MIRROR_REPAIR_QUEUE_LIMIT  (10000)"
 	].join("\n")
-}), Hn = C({
+}), Un = C({
 	version: "0.34.0",
 	id: "0.34.0/06_origin-guard-and-trusted-proxies",
 	title: "Cross-site protection, trusted proxies and security headers are ON by default on the api listener",
@@ -3595,7 +3595,7 @@ var x = (e, t, n) => {
 		"   a `Transfer-Encoding: chunked` body skipped it and was buffered without",
 		"   bound. No action needed; VOLTRO_MAX_RPC_BODY_BYTES still tunes it."
 	].join("\n")
-}), Un = C({
+}), Wn = C({
 	version: "0.34.0",
 	id: "0.34.0/07_incoming-webhook-declares-verification",
 	title: "An incoming webhook with no signature scheme now refuses to boot",
@@ -3644,7 +3644,7 @@ var x = (e, t, n) => {
 		"value — the sender holds the other half of it, so a generated one would",
 		"authenticate nobody."
 	].join("\n")
-}), Wn = C({
+}), Gn = C({
 	version: "0.34.0",
 	id: "0.34.0/08_init-initialises-the-workspace",
 	title: "`voltro init` initialises the workspace root; scaffolding is `create-project` only",
@@ -3696,20 +3696,20 @@ var x = (e, t, n) => {
 		"all 18 of its scripts — including the `pnpm db:up` the CLI then printed as a",
 		"next step. Run `voltro init` in the root first."
 	].join("\n")
-}), Gn = (e, t) => (e.getProperty(t)?.asKind(b.PropertyAssignment))?.getInitializer()?.asKind(b.ObjectLiteralExpression), Kn = (e) => {
+}), Kn = (e, t) => (e.getProperty(t)?.asKind(b.PropertyAssignment))?.getInitializer()?.asKind(b.ObjectLiteralExpression), qn = (e) => {
 	if (e.getExpression().getText() !== "workflow") return !1;
 	let t = e.getArguments()[0]?.asKind(b.ObjectLiteralExpression);
 	if (t === void 0) return !1;
-	let n = Gn(t, "messages");
+	let n = Kn(t, "messages");
 	return n !== void 0 && n.getProperty("queries") !== void 0;
-}, qn = C({
+}, Jn = C({
 	version: "0.34.0",
 	id: "0.34.0/09_workflow-messages-queries-removed",
 	title: "`workflow({ messages: { queries } })` is removed — it never had a send path",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return !t.includes("queries") || !/workflow\s*\(/.test(t) ? !1 : e.getDescendantsOfKind(b.CallExpression).some(Kn);
+		return !t.includes("queries") || !/workflow\s*\(/.test(t) ? !1 : e.getDescendantsOfKind(b.CallExpression).some(qn);
 	}),
 	note: [
 		"YOU DECLARED `messages: { queries: { … } }` ON A WORKFLOW. That channel is",
@@ -3752,7 +3752,7 @@ var x = (e, t, n) => {
 		"in-flight runs finish on the old path after a deploy. See the Versioning",
 		"page in the docs."
 	].join("\n")
-}), Jn = C({
+}), Yn = C({
 	version: "0.34.0",
 	id: "0.34.0/11_ai-flows-per-step-human-signal",
 	title: "`HUMAN_RESPONSE_SIGNAL` removed — a human step's signal name is now per-step",
@@ -3796,23 +3796,23 @@ var x = (e, t, n) => {
 		"per flow (`humanTimeoutMs`), per app (`aiFlowsPlugin({ humanReviewTimeoutMs })`)",
 		"or per deploy (`VOLTRO_AI_FLOW_HUMAN_REVIEW_TIMEOUT_HOURS`). `0` = wait forever."
 	].join("\n")
-}), Yn = /* @__PURE__ */ new Set([
+}), Xn = /* @__PURE__ */ new Set([
 	"@voltro/plugin-auth",
 	"@voltro/protocol/session",
 	"@voltro/plugin-sso-saml"
-]), Xn = /* @__PURE__ */ new Set(["issueSession", "signSession"]), Zn = (e) => {
+]), Zn = /* @__PURE__ */ new Set(["issueSession", "signSession"]), Qn = (e) => {
 	let t = e.getFullText();
 	if (!/issueSession|signSession|resolveScopes|@voltro\/(plugin-auth|protocol\/session|plugin-sso-saml)/.test(t)) return !1;
-	for (let t of e.getImportDeclarations()) if (Yn.has(t.getModuleSpecifierValue())) return !0;
-	for (let t of e.getDescendantsOfKind(b.CallExpression)) if (Xn.has(t.getExpression().getText())) return !0;
+	for (let t of e.getImportDeclarations()) if (Xn.has(t.getModuleSpecifierValue())) return !0;
+	for (let t of e.getDescendantsOfKind(b.CallExpression)) if (Zn.has(t.getExpression().getText())) return !0;
 	for (let t of e.getDescendantsOfKind(b.PropertyAssignment)) if (t.getName() === "resolveScopes") return !0;
 	return !1;
-}, Qn = C({
+}, $n = C({
 	version: "0.34.0",
 	id: "0.34.0/12_session-cookie-carries-identity",
 	title: "The session cookie carries identity only — authority resolves per request",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some(Zn),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some(Qn),
 	note: [
 		"YOUR USERS WILL SIGN IN ONCE MORE, AND A SESSION COOKIE CAN NO LONGER",
 		"CARRY PERMISSIONS.",
@@ -3903,12 +3903,12 @@ var x = (e, t, n) => {
 		"not have: an authoritative resolver now overrides a token's own scope",
 		"claim, which union-only could never do."
 	].join("\n")
-}), $n = /\bMockEmail\b|\.email\.(sent|lastTo|clear)\b|\bSentEmail\b/, er = C({
+}), er = /\bMockEmail\b|\.email\.(sent|lastTo|clear)\b|\bSentEmail\b/, tr = C({
 	version: "0.34.0",
 	id: "0.34.0/10_testing-mail-is-a-service",
 	title: "`ctx.email` / `MockEmail` removed — assert mail through the mail plugin",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => $n.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => er.test(e.getFullText())),
 	note: [
 		"`@voltro/testing` no longer ships `MockEmail`, and `makeTestContext()` no",
 		"longer returns `ctx.email`. Your tests that touch it will not compile.",
@@ -3977,12 +3977,12 @@ var x = (e, t, n) => {
 		"  • `makeTestContext({ layers })` — your app's own `app.config.ts`",
 		"    `layers:` now resolve for an Effect-mode handler under test."
 	].join("\n")
-}), tr = /from\s+['"]@voltro\/plugin-billing(?:\/[\w-]+)?['"]/, nr = C({
+}), nr = /from\s+['"]@voltro\/plugin-billing(?:\/[\w-]+)?['"]/, rr = C({
 	version: "0.34.0",
 	id: "0.34.0/13_billing-provider-dunning",
 	title: "Billing dunning — `BillingProvider.fetchSubscription` is required, and `plan()` now honours a grace period",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => tr.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => nr.test(e.getFullText())),
 	note: [
 		"BILLING GAINED A DUNNING SEQUENCE. TWO THINGS CHANGED UNDER YOU.",
 		"",
@@ -4058,12 +4058,12 @@ var x = (e, t, n) => {
 		"`pastDueSince` / `statusEventAt` columns ride the declarative differ — they",
 		"are applied by `voltro db apply` and by a `voltro dev` boot, on every dialect."
 	].join("\n")
-}), rr = /from\s+['"]@voltro\/plugin-search(?:\/[\w-]+)?['"]/, ir = C({
+}), ir = /from\s+['"]@voltro\/plugin-search(?:\/[\w-]+)?['"]/, ar = C({
 	version: "0.34.0",
 	id: "0.34.0/14_search-memory-backend-refuses-production",
 	title: "`plugin-search` on the in-memory backend now refuses to boot in production",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => rr.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => ir.test(e.getFullText())),
 	note: [
 		"THE ZERO-CONFIG SEARCH BACKEND NO LONGER BOOTS IN PRODUCTION.",
 		"",
@@ -4132,7 +4132,7 @@ var x = (e, t, n) => {
 		"(`ts_headline` / `snippet()` / …) that `SearchQuery` promises. Degrading",
 		"those silently would replace one lie with another."
 	].join("\n")
-}), ar = C({
+}), or = C({
 	version: "0.34.0",
 	id: "0.34.0/15_mysql-mssql-tls-honoured",
 	title: "mysql/mariadb and mssql connections honour ?ssl= / ?sslmode= — or refuse to boot",
@@ -4204,7 +4204,7 @@ var x = (e, t, n) => {
 		"spins in-tick and starves the event loop. Set it only if you know nothing in",
 		"your process does that, and set it well above their peak concurrency."
 	].join("\n")
-}), or = C({
+}), sr = C({
 	version: "0.34.0",
 	id: "0.34.0/16_declare-node-env-for-migration-commands",
 	title: "`voltro db apply` / `voltro migrate` now treat an unset NODE_ENV as production",
@@ -4268,12 +4268,12 @@ var x = (e, t, n) => {
 		"process environment if you want a non-production `voltro serve` without a",
 		"built bundle. Everything downstream of the launcher does honour `.env`."
 	].join("\n")
-}), sr = /\/(?:src\/)?pages\//, cr = /\bcacheInvalidatesOn\b/, lr = C({
+}), cr = /\/(?:src\/)?pages\//, lr = /\bcacheInvalidatesOn\b/, ur = C({
 	version: "0.34.0",
 	id: "0.34.0/17_isr-postgres-refuses-without-a-database",
 	title: "The postgres ISR cache + CDC invalidator read DB_URL, and no longer fall back silently",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => cr.test(e.getFullText()) || sr.test(e.getFilePath())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => lr.test(e.getFullText()) || cr.test(e.getFilePath())),
 	note: [
 		"YOUR WEB PROCESS MAY HAVE BEEN USING THE MEMORY ISR CACHE ALL ALONG.",
 		"",
@@ -4318,12 +4318,12 @@ var x = (e, t, n) => {
 		"   until their `revalidate` window expires. Give the web process a `DB_URL`",
 		"   or remove the declaration."
 	].join("\n")
-}), ur = /\.migration\.ts$/, dr = C({
+}), dr = /\.migration\.ts$/, fr = C({
 	version: "0.34.0",
 	id: "0.34.0/18_serve-refuses-pending-file-migrations",
 	title: "`voltro serve` refuses to boot with pending file-based migrations",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => ur.test(e.getFilePath())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => dr.test(e.getFilePath())),
 	note: [
 		"YOUR DEPLOY MUST RUN `migrations/*.migration.ts` BEFORE `voltro serve`.",
 		"",
@@ -4366,11 +4366,11 @@ var x = (e, t, n) => {
 		"fingerprint check — it is the one switch for \"no boot-time schema checks\",",
 		"and it now covers both."
 	].join("\n")
-}), fr = /* @__PURE__ */ new Set([
+}), pr = /* @__PURE__ */ new Set([
 	"@voltro/plugin-auth",
 	"@voltro/plugin-auth/schema",
 	"@voltro/plugin-auth/plugin"
-]), pr = /* @__PURE__ */ new Set([
+]), mr = /* @__PURE__ */ new Set([
 	"UserStore",
 	"authTables",
 	"SendEmail",
@@ -4378,20 +4378,20 @@ var x = (e, t, n) => {
 	"memoryUserStore",
 	"postgresUserStore",
 	"authRoutesPlugin"
-]), mr = (e) => {
+]), hr = (e) => {
 	if (!e.getFullText().includes("@voltro/plugin-auth")) return !1;
-	for (let t of e.getImportDeclarations()) if (fr.has(t.getModuleSpecifierValue())) {
-		for (let e of t.getNamedImports()) if (pr.has(e.getName())) return !0;
+	for (let t of e.getImportDeclarations()) if (pr.has(t.getModuleSpecifierValue())) {
+		for (let e of t.getNamedImports()) if (mr.has(e.getName())) return !0;
 		if (t.getNamespaceImport() !== void 0) return !0;
 	}
 	for (let t of e.getDescendantsOfKind(b.TypeReference)) if (t.getTypeName().getText() === "UserStore") return !0;
 	return !1;
-}, hr = C({
+}, gr = C({
 	version: "0.34.0",
 	id: "0.34.0/20_user-store-auth-feature-methods",
 	title: "UserStore gained the email-verification, invitation and impersonation methods",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some(mr),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some(hr),
 	note: [
 		"IF YOU USE memoryUserStore OR postgresUserStore, THERE IS NOTHING TO DO.",
 		"Both already implement everything below. Read on only if you wrote your",
@@ -4471,26 +4471,26 @@ var x = (e, t, n) => {
 		"   is the difference between \"new signups must confirm\" and \"everyone is",
 		"   locked out until they check their mail\"."
 	].join("\n")
-}), K = /* @__PURE__ */ new Set([
+}), _r = /* @__PURE__ */ new Set([
 	"bindConnectionSubject",
 	"getConnectionSubject",
 	"unbindConnectionSubject",
 	"onBindConnectionSubject",
 	"connectionSubjectsSnapshot"
-]), gr = (e) => {
+]), vr = (e) => {
 	let t = e.getFullText();
 	if (!/ConnectionSubject|connectionSubjectsSnapshot|rebind/.test(t)) return !1;
-	for (let t of e.getDescendantsOfKind(b.CallExpression)) if (K.has(t.getExpression().getText())) return !0;
-	for (let t of e.getImportDeclarations()) for (let e of t.getNamedImports()) if (K.has(e.getName())) return !0;
+	for (let t of e.getDescendantsOfKind(b.CallExpression)) if (_r.has(t.getExpression().getText())) return !0;
+	for (let t of e.getImportDeclarations()) for (let e of t.getNamedImports()) if (_r.has(e.getName())) return !0;
 	for (let t of e.getDescendantsOfKind(b.PropertyAssignment)) if (t.getName() === "rebind") return !0;
 	for (let t of e.getDescendantsOfKind(b.ShorthandPropertyAssignment)) if (t.getName() === "rebind") return !0;
 	return !1;
-}, _r = C({
+}, yr = C({
 	version: "0.34.0",
 	id: "0.34.0/19_connection-override-carries-a-credential",
 	title: "Soft re-auth presents a credential — it no longer hands the server a Subject",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some(gr),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some(vr),
 	note: [
 		"A LIVE CONNECTION CAN NO LONGER BE HANDED A SUBJECT. IT PRESENTS A",
 		"CREDENTIAL, AND THE SERVER RESOLVES IT LIKE ANY OTHER REQUEST.",
@@ -4575,19 +4575,19 @@ var x = (e, t, n) => {
 		"it behaves identically under `voltro dev` and `voltro serve`, because both",
 		"now build the middleware from one function (`makeAuthMiddlewareLayers`)."
 	].join("\n")
-}), vr = (e) => {
+}), br = (e) => {
 	if (/\.workflow(\.server)?\.tsx?$/.test(e.getBaseName())) return !0;
 	let t = e.getFullText();
 	if (!/resolveScopes|defineWorkflow|ctx\.workflows/.test(t)) return !1;
 	for (let t of e.getDescendantsOfKind(b.PropertyAssignment)) if (t.getName() === "resolveScopes") return !0;
 	for (let t of e.getDescendantsOfKind(b.CallExpression)) if (t.getExpression().getText() === "defineWorkflow") return !0;
 	return !1;
-}, yr = C({
+}, xr = C({
 	version: "0.34.0",
 	id: "0.34.0/20_workflow-authority-resolves-at-resume",
 	title: "A resumed workflow re-resolves its caller's authority instead of restoring it",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some(vr),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some(br),
 	note: [
 		"A WORKFLOW NO LONGER CARRIES ITS CALLER'S PERMISSIONS FORWARD. IT CARRIES",
 		"THEIR IDENTITY, AND ASKS YOUR APP WHAT THEY MAY DO WHEN IT RUNS.",
@@ -4652,7 +4652,7 @@ var x = (e, t, n) => {
 		"   contain scopes and are stripped on READ — a resumed run cannot re-assert",
 		"   authority the old build persisted."
 	].join("\n")
-}), br = /* @__PURE__ */ new Set([
+}), Sr = /* @__PURE__ */ new Set([
 	"listTag",
 	"createTag",
 	"updateTag",
@@ -4660,21 +4660,21 @@ var x = (e, t, n) => {
 	"createScope",
 	"writeScope",
 	"deleteScope"
-]), xr = (e) => {
+]), Cr = (e) => {
 	let t = e.getFullText();
 	if (!/EntityAdminSpec|deriveEntityAdmins|Tag\b|Scope\b/.test(t)) return !1;
 	for (let t of e.getImportDeclarations()) for (let e of t.getNamedImports()) {
 		let t = e.getName();
 		if (t === "EntityAdminSpec" || t === "deriveEntityAdmins") return !0;
 	}
-	for (let t of e.getDescendantsOfKind(b.PropertyAccessExpression)) if (br.has(t.getName())) return !0;
+	for (let t of e.getDescendantsOfKind(b.PropertyAccessExpression)) if (Sr.has(t.getName())) return !0;
 	return !1;
-}, Sr = C({
+}, wr = C({
 	version: "0.34.0",
 	id: "0.34.0/21_admin-gates-on-declared-access",
 	title: "The derived admin gates on the api's DECLARED access — the invented `<table>:create` scopes are gone",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some(xr),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some(Cr),
 	note: [
 		"YOUR ADMIN WAS GATING ON SCOPE STRINGS NOTHING PRODUCED.",
 		"",
@@ -4764,14 +4764,14 @@ var x = (e, t, n) => {
 		"from \"undeclared\", so an intentionally public action rendered as forbidden",
 		"to everybody."
 	].join("\n")
-}), Cr = /\b(useMutation|useAction|useWorkflow|useWorkflowSignal|useWorkflowUpdate|useUpload)\b/, wr = /FiberFailure|Cause\.squash|squashWith/, Tr = C({
+}), Tr = /\b(useMutation|useAction|useWorkflow|useWorkflowSignal|useWorkflowUpdate|useUpload)\b/, Er = /FiberFailure|Cause\.squash|squashWith/, Dr = C({
 	version: "0.34.0",
 	id: "0.34.0/22_write-rejections-carry-the-typed-error",
 	title: "A rejected mutate/run/signal/upload carries the typed error, not a FiberFailure",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return Cr.test(t) || wr.test(t);
+		return Tr.test(t) || Er.test(t);
 	}),
 	note: [
 		"WHAT CHANGED. A write hook that rejects now rejects with the typed error",
@@ -4824,12 +4824,12 @@ var x = (e, t, n) => {
 		"contract, reject from a real rpc client, or assert on the value your",
 		"component branches on rather than on the literal the test wrote."
 	].join("\n")
-}), Er = /@voltro\/plugin-sso-saml|samlSsoPlugin/, Dr = C({
+}), Or = /@voltro\/plugin-sso-saml|samlSsoPlugin/, kr = C({
 	version: "0.34.0",
 	id: "0.34.0/23_saml-signature-and-replay-defaults",
 	title: "SAML: response-signature requirement relaxed + surfaced; replay protection ON by default",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Er.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Or.test(e.getFullText())),
 	note: [
 		"Two defaults in `samlSsoPlugin` moved. Read both — they interact.",
 		"",
@@ -4920,24 +4920,24 @@ var x = (e, t, n) => {
 		"request, and the envelope is unauthenticated. If you must run unsolicited,",
 		"set `wantAuthnResponseSigned: true`."
 	].join("\n")
-}), Or = /\b(signPayload|verifySignature)\s*\(/, kr = C({
+}), Ar = /\b(signPayload|verifySignature)\s*\(/, jr = C({
 	version: "0.34.0",
 	id: "0.34.0/24_webhook-signing-renders-headers",
 	title: "Webhook signing: `signPayload`/`verifySignature` → `signRequest`/`verifyRequest`",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Or.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Ar.test(e.getFullText())),
 	note: "A webhook signature scheme now renders a header MAP rather than one header,\nand verifies against the request's whole header map.\n\n  - signPayload(scheme, rawBody, secret)\n      → signRequest(scheme, { rawBody, secret, messageId })\n      returns { headers } instead of { headerName, headerValue }\n\n  - verifySignature(scheme, rawBody, secret, headerValue)\n      → verifyRequest(scheme, { rawBody, secret, headers })\n\nRewrite each call site:\n\n    // before\n    const { headerName, headerValue } = signPayload(scheme, body, secret)\n    await fetch(url, { headers: { [headerName]: headerValue }, body })\n\n    // after\n    const { headers } = signRequest(scheme, { rawBody: body, secret, messageId: deliveryId })\n    await fetch(url, { headers, body })\n\nWHY `messageId` IS REQUIRED, AND WHY THIS IS NOT AUTOMATED:\n\n  Standard Webhooks signs over `<messageId>.<timestamp>.<body>` and sends the\n  id as `webhook-id` — which is also the value the spec tells consumers to\n  use as their IDEMPOTENCY KEY. Pass the id that identifies the message to\n  THAT receiver, stable across retries (the framework passes its delivery\n  id). A fresh `randomUUID()` per attempt compiles and reads fine, and\n  quietly makes every retry look like a new message to the receiver.\n\nTHE DEFAULT OUTGOING SCHEME CHANGED:\n\n  `defaultOutgoingSignature()` now returns Standard Webhooks v1.0.0 —\n  `webhook-id` / `webhook-timestamp` / `webhook-signature: v1,<base64>` — so\n  a NEW subscription signs to an interoperable spec every conformant\n  consumer library already verifies. Existing target rows are untouched:\n  each stores the scheme it was created with.\n\n  Its key serialization differs too: `whsec_` + base64 of 24..64 random\n  bytes, HMAC-ing the DECODED bytes. `subscribe()` mints the right shape\n  automatically; passing your own hex secret for a standard-webhooks target\n  is REFUSED at subscribe rather than producing signatures no consumer\n  accepts.\n\n  To keep the previous house format on a new subscription, pass it\n  explicitly: `webhooks.subscribe({ …, signing: genericHmacSignature() })`\n  — the same shape as before, under a name that says it is a choice.\n\nALSO IN THIS RELEASE, no code change needed:\n\n  - a 3xx response is a failure and redirects are no longer FOLLOWED (they\n    were, by fetch's default — which also walked past the SSRF guard);\n  - a `410 Gone` disables the target immediately, whatever the\n    consecutive-failure threshold says;\n  - each attempt has a 30s wire timeout (`VOLTRO_WEBHOOK_TIMEOUT_MS`, or\n    `timeoutMs`). There was none, so a receiver that accepted the connection\n    and never answered held the delivery workflow open indefinitely.\n\nAnd `slackSignature()` is now a REAL verifier. It shipped as a stub that\nreturned false unconditionally, workable only through a header-packing\nconvention in the route mounter. A scheme now receives the whole header map\nand reads `x-slack-request-timestamp` itself."
-}), Ar = /from\s+['"]@voltro\/plugin-presence(?:\/[a-z]+)?['"]/, jr = /\b(lastSeen|presenceTable|memoryPresenceStore|isOnline|filterOnline|staleKeys|PresenceStore|PresenceEntry|PresenceTracker)\b/, Mr = /_voltro_presence/, Nr = C({
+}), Mr = /from\s+['"]@voltro\/plugin-presence(?:\/[a-z]+)?['"]/, Nr = /\b(lastSeen|presenceTable|memoryPresenceStore|isOnline|filterOnline|staleKeys|PresenceStore|PresenceEntry|PresenceTracker)\b/, Pr = /_voltro_presence/, Fr = C({
 	version: "0.34.0",
 	id: "0.34.0/25_presence-has-no-table",
 	title: "Presence: `_voltro_presence` is gone, and so is `lastSeen` on the roster",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return Mr.test(t) || Ar.test(t) && jr.test(t);
+		return Pr.test(t) || Mr.test(t) && Nr.test(t);
 	}),
 	note: "@voltro/plugin-presence no longer declares a table. Four things moved.\n\n1. A roster member is now { key, meta } — there is NO `lastSeen`.\n\n   It was the OWNING replica's clock, so on more than one replica \"active 3\n   minutes ago\" rendered from it was wrong by the skew between two pods, with\n   nothing to say so. It was also the only field a plain heartbeat changed,\n   which is what made the roster push on every beat instead of on every change.\n\n       // before\n       members.map((m) => `${m.key} — ${ago(m.lastSeen)}`)\n       // after: put anything time-shaped you need into meta\n       usePresence(channel, { meta: { joinedAt: Date.now() } })\n       members.map((m) => `${m.key} — ${ago(m.meta?.joinedAt)}`)\n\n2. `PresenceTracker.track()` and `.untrack()` return { delta, changed }.\n\n       // before\n       bus.announce(tracker.track({ channel, tenantId, key }))\n       // after — announce ALWAYS (a peer's sweep needs the liveness signal),\n       // push only on a change\n       const write = tracker.track({ channel, tenantId, key })\n       bus.announce(write.delta)\n       if (write.changed) publishReactivity(store, presenceRoster)\n\n   Do not blind-append `.delta` and move on: dropping `changed` restores the\n   per-heartbeat push this release removed, and nothing will report it.\n\n   `attachPresenceBus` also takes an optional `onRosterChanged` now — call it\n   if you drive the bus yourself, or a peer's join and a peer's death will\n   update your tracker and push nobody.\n\n3. These exports are DELETED, with no replacement:\n\n       presenceTable, PresenceStore, PresenceEntry,\n       memoryPresenceStore, isOnline, filterOnline, staleKeys\n\n   They were the table era's read model — an abstraction over rows plus the\n   staleness filter a row needed because it outlived the client that wrote it.\n   Presence has neither. Reading the roster is `presence.list` / `usePresence`;\n   the staleness sweep is the plugin's own and needs nothing from you.\n\n4. If your `source:` names '_voltro_presence' as a string, point it at the\n   channel object instead:\n\n       import { presenceRoster } from '@voltro/plugin-presence'\n       defineQuery({ name: 'room.summary', source: presenceRoster, ... })\n\n   And to push it yourself:\n\n       import { publishReactivity } from '@voltro/protocol'\n       publishReactivity(ctx.store, presenceRoster)\n\nTHE TABLE IS NOT DROPPED FOR YOU. The declarative differ never plans a drop for\na framework table no app declares — deliberately, so a live `_voltro_*` table is\nnever destroyed by an app that simply does not know about it. So an existing\n`_voltro_presence` stays, empty, until you remove it:\n\n    DROP TABLE IF EXISTS _voltro_presence;\n\nIt holds no data anyone can use: nothing has written a row to it since presence\nmoved into memory."
-}), Pr = (e) => {
+}), Ir = (e) => {
 	let t = e.getArguments()[0];
 	if (t === void 0 || !t.isKind(b.ObjectLiteralExpression)) return /* @__PURE__ */ new Set();
 	let n = /* @__PURE__ */ new Set();
@@ -4946,32 +4946,32 @@ var x = (e, t, n) => {
 		t !== void 0 && n.add(t);
 	}
 	return n;
-}, Fr = (e, t) => /defineEvent\s*\(/.test(e) ? t.some((e) => {
+}, Lr = (e, t) => /defineEvent\s*\(/.test(e) ? t.some((e) => {
 	if (e.getExpression().getText() !== "defineEvent") return !1;
-	let t = Pr(e);
+	let t = Ir(e);
 	return !t.has("guards") && !t.has("openAccess");
-}) : !1, Ir = C({
+}) : !1, Rr = C({
 	version: "0.35.0",
 	id: "0.35.0/01_event-access-decision",
 	title: "Every declared event decides who may listen (`guards:` or `openAccess:`)",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Fr(e.getFullText(), e.getDescendantsOfKind(b.CallExpression))),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Lr(e.getFullText(), e.getDescendantsOfKind(b.CallExpression))),
 	note: (/* @__PURE__ */ "YOUR APP WILL NOT BOOT UNTIL EVERY DECLARED EVENT DECIDES WHO MAY LISTEN.(This closes the sibling of 0.34.0's procedure gate: `defineEvent`'s `guards:`(was optional and enforcement skipped an empty list, so an event with no(decision was silently subscribable by ANY authenticated session that could(open the socket.((WHAT TO DO, IN THIS ORDER:((1) LIST THEM. `voltro doctor` prints every undecided event with its tag and(   file — the same set, from the same function, that the boot refuses on.(   `voltro doctor --json` carries it as `accessDecisions.undecided` for CI.((2) DECIDE EACH ONE. There are exactly two answers and they are not the same(   claim:((       guards: [{ scope: 'display:read' }]     a subscriber must hold a scope(       openAccess: 'public scoreboard'         anyone may listen — and why((   `openAccess` takes a REASON, not a boolean. It is what a reviewer reads(   later, and it is what makes \"we decided this is open\" distinguishable(   from \"nobody looked\".((3) DO NOT RUBBER-STAMP. Reaching for a scope every caller already holds(   satisfies the gate, reads as protection, and enforces nothing. If the(   event is open, say `openAccess`. If it should not be open, this gate just(   found a real hole — an event often carries exactly the data its table(   guards behind a scoped query.((IF YOU NEED TO SHIP FIRST. The same field that covers procedures covers(events, in `app.config.ts`:((       export default { security: { defaultDeny: false } }((That restores the old default-allow for the WHOLE app, in one place a(reviewer can see. There is no env var for it, on purpose. `voltro doctor`(keeps listing the undecided events while it is off, marked advisory.((NOT AFFECTED: apps already running `security: { defaultDeny: false }`, and(events your PLUGINS declare — the gate reads your app's own discovered(`*.event.ts` files only.".split("(")).join("\n")
-}), Lr = /\brouteHttp\s*\(/, Rr = C({
+}), zr = /\brouteHttp\s*\(/, Br = C({
 	version: "0.34.0",
 	id: "0.34.0/26_route-http-is-async",
 	title: "`routeHttp` returns a Promise",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Lr.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => zr.test(e.getFullText())),
 	note: "`routeHttp` (@voltro/mcp) is async now:\n\n    routeHttp(options): HttpOutcome        // before\n    routeHttp(options): Promise<HttpOutcome>  // after\n\nAwait it, and make the enclosing function async if it is not already:\n\n    // before\n    const outcome = routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\n    // after\n    const outcome = await routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\nWhy it moved: `tools/list` now folds in the app's agent tools and `tools/call`\nexecutes one, so two of the methods reach the app. The rest still resolve without\ntouching anything, and the function is still pure in the sense that matters — it\nbinds no socket, and a test supplies a `live` double.\n\nIf you use the shipped `serveHttp` transport there is nothing to do; it already\nawaits."
-}), zr = /@voltro\/plugin-(billing|governance|storage)/, Br = /* @__PURE__ */ RegExp("\\b(billing\\.(startCheckout|portalUrl|previewChange|changePlan|changeSeats|invoices|reportUsage)|governance\\.(export|erase)|storage\\.(mintUploadUrl|ingestUrl|listRefs))\\b"), Vr = /\bdefinePluginRoute\s*\(|\broutes\s*:\s*\[/, Hr = C({
+}), Vr = /@voltro\/plugin-(billing|governance|storage)/, Hr = /* @__PURE__ */ RegExp("\\b(billing\\.(startCheckout|portalUrl|previewChange|changePlan|changeSeats|invoices|reportUsage)|governance\\.(export|erase)|storage\\.(mintUploadUrl|ingestUrl|listRefs))\\b"), Ur = /\bdefinePluginRoute\s*\(|\broutes\s*:\s*\[/, Wr = C({
 	version: "0.35.0",
 	id: "0.35.0/02_plugin-procedures-carry-access-decisions",
 	title: "First-party plugin procedures carry access decisions; twelve now require a scope",
 	kind: "manual",
 	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
 		let t = e.getFullText();
-		return zr.test(t) || Br.test(t) || Vr.test(t) && /VoltroPlugin|definePlugin/.test(t);
+		return Vr.test(t) || Hr.test(t) || Ur.test(t) && /VoltroPlugin|definePlugin/.test(t);
 	}),
 	note: [
 		"Every first-party plugin rpc route now declares an access decision, and the",
@@ -5036,12 +5036,12 @@ var x = (e, t, n) => {
 		"`openAccess` with the reason each is safe (self-scoped rows, signed",
 		"subject-bound tickets, per-object grants), and behave exactly as before."
 	].join("\n")
-}), Ur = /AnalyticsMirrorImpl/, Wr = C({
+}), Gr = /AnalyticsMirrorImpl/, Kr = C({
 	version: "0.35.0",
 	id: "0.35.0/03_analytics-mirror-max-version",
 	title: "Custom analytics mirror sinks answer `maxVersion` (fleet-scope seed read)",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Ur.test(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Gr.test(e.getFullText())),
 	note: [
 		"The analytics CDC-mirror now derives its version from the CHANGE under",
 		"`changeScope: 'fleet'` (postgres CDC, mysql binlog): warehouse baseline +",
@@ -5066,37 +5066,95 @@ var x = (e, t, n) => {
 		"",
 		"The read is issued at most once per key per process, off the commit path."
 	].join("\n")
-}), Gr = (e) => /RunStepStatus/.test(e) || /['"]succeeded['"]/.test(e) && /['"]waiting['"]/.test(e) && /RunStep|runStep|flow/i.test(e), Kr = C({
+}), qr = (e) => /RunStepStatus/.test(e) || /['"]succeeded['"]/.test(e) && /['"]waiting['"]/.test(e) && /RunStep|runStep|flow/i.test(e), Jr = C({
 	version: "0.35.0",
 	id: "0.35.0/04_flow-run-step-skipped",
 	title: "A flow run step can now be 'skipped' — handle it where you render a run timeline",
 	kind: "manual",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Gr(e.getFullText())),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => qr(e.getFullText())),
 	note: (/* @__PURE__ */ "A FLOW RUN STEP CAN NOW BE 'skipped'.((`when:` on a flow step gates it on a prior value, and a step whose condition(is false is SKIPPED rather than run. That is a sixth member of(`RunStepStatus`, so an exhaustive switch over it no longer compiles, and a(lookup keyed by status now has a hole.((WHAT TO DO:((1) FIND IT. Anywhere you render or branch on a run step status — a timeline(   component, a status badge map, a progress calculation.((2) DECIDE WHAT A SKIPPED STEP LOOKS LIKE. It is NOT a failure and NOT a(   success: it did not run, on purpose, and it produced no output. The(   step carries `skipReason` — the rendered condition, e.g.(   `{{mode}} equals \"full\"` — so the timeline can say WHY.((3) DO NOT DEFAULT IT TO INVISIBLE. Dropping the row compiles and reads fine(   in review, and it reproduces exactly the problem `skipReason` exists to(   prevent: a step that vanished is indistinguishable from a step nobody(   declared, which is the first thing a user reports as a bug.((A PROGRESS COUNT probably needs a second look too: `succeeded / total` now(under-reports a completed run that skipped a step. Counting(`succeeded + skipped` against the total is usually what was meant.((If your app does not render a flow timeline, there is nothing to do — this(note fires on any file that names the status type or its literals.".split("(")).join("\n")
-}), qr = C({
+}), Yr = C({
 	version: "0.35.0",
 	id: "0.35.0/05_declared-schema-drops-runtime-flags",
 	title: "The declared schema no longer reads `CDC` / `VOLTRO_UNDO` / `VOLTRO_TRACING_PERSIST`",
 	kind: "manual",
 	appliesTo: () => !0,
 	note: (/* @__PURE__ */ "The set of framework tables your app DECLARES is hashed into the schema(fingerprint. A pre-deploy `voltro db apply` records that hash; every serving(container recomputes it and refuses to boot if it differs. Until this release(three RUNTIME flags fed into that set:((    CDC=0                       removed `_voltro_cdc_offsets`(    VOLTRO_UNDO=on              added   `_voltro_undo_log`(    VOLTRO_TRACING_PERSIST=all  added   `_voltro_traces`((All three read as pure runtime knobs, so they tend to live on the PODS and(not on the pre-upgrade migrate Job — which is a green migrate followed by(every pod in CrashLoopBackOff. This was reported against a Helm deployment(where `CDC: \"0\"` was in all three overlays' pod blocks and none of their(jobs; it had been latent for months and would have fired on the next deploy.((WHAT YOU MUST DO — only if you set one of these to turn a table ON in(production:((  * `VOLTRO_UNDO=on` in production  → add to app.config.ts:(        export default { schema: { undo: true }, … }(  * `VOLTRO_TRACING_PERSIST` keeping trace history in production → add:(        export default { schema: { traces: true }, … }((    Without the declaration, `voltro serve` now REFUSES to boot and names the(    field. That refusal is the point: before, the same configuration either(    wrote to a table nobody created or produced a fingerprint the migrate job(    could not reproduce.((    Turning capture OFF still needs no declaration and never will — a declared(    table nobody writes to is harmless. Only turning it ON is a schema claim.((WHAT HAPPENS WITHOUT ANY ACTION:((  * On mariadb or mssql you will see ONE additive `create-table` in your next(    plan: `_voltro_cdc_offsets` is now declared by the DIALECT rather than by(    `CDC`, so it exists whether or not that process drives CDC. It is an(    offsets table — a handful of rows — and the alternative was leaving a(    runtime flag able to split your fleet.(  * On postgres/sqlite nothing changes: those dialects have no offsets table.((AND ONE THING WORTH DOING ANYWAY: if you are upgrading a deployment that has(a separate migrate job, diff that job's `env:` against your pods' once. The(framework can now guarantee its OWN tables do not depend on a runtime flag;(it cannot make the same guarantee for a plugin's `extendSchema.tables`, which(is app code and may read anything. A `prod-mismatch` refusal now prints which(tables this process decided and from which input, so the comparison is quick.".split("(")).join("\n")
-}), q = "session_expired", Jr = C({
+}), G = "session_expired", Xr = C({
 	version: "0.35.1",
 	id: "0.35.1/01_unauthorized-replaces-session-expired",
 	title: "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
 	kind: "transform",
-	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes(q)),
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes(G)),
 	transform: ({ project: e, log: t }) => {
 		let n = [];
 		for (let t of e.getSourceFiles()) {
-			if (!t.getFullText().includes(q)) continue;
+			if (!t.getFullText().includes(G)) continue;
 			let e = !1;
-			for (let n of t.getDescendantsOfKind(11)) n.getLiteralValue() === q && (n.setLiteralValue("unauthorized"), e = !0);
+			for (let n of t.getDescendantsOfKind(11)) n.getLiteralValue() === G && (n.setLiteralValue("unauthorized"), e = !0);
 			e && n.push(t.getFilePath());
 		}
-		n.length !== 0 && t(`rewrote '${q}' to 'unauthorized' in ${n.length} file(s).\n  A 401 now means only "the credential was refused" — expired, revoked, wrong\n  scope and MALFORMED all produce that status, and the old name asserted the\n  first one. If a rewritten branch was meant to catch a credential your\n  CONNECTION VAULT could not produce (no grant, revoked grant, failed refresh),\n  change it to 'credential_unusable' — that is the code the vault raises, and it\n  is the one where re-auth is genuinely the right action.\n  A health check that logs the user out on this code should read 'unauthorized'\n  as "ask again", not as "the session is gone".\n` + n.map((e) => `    ${e}`).join("\n"));
+		n.length !== 0 && t(`rewrote '${G}' to 'unauthorized' in ${n.length} file(s).\n  A 401 now means only "the credential was refused" — expired, revoked, wrong\n  scope and MALFORMED all produce that status, and the old name asserted the\n  first one. If a rewritten branch was meant to catch a credential your\n  CONNECTION VAULT could not produce (no grant, revoked grant, failed refresh),\n  change it to 'credential_unusable' — that is the code the vault raises, and it\n  is the one where re-auth is genuinely the right action.\n  A health check that logs the user out on this code should read 'unauthorized'\n  as "ask again", not as "the session is gone".\n` + n.map((e) => `    ${e}`).join("\n"));
 	}
-}), Yr = /\(\s*\{[^}]*\.\.\./, Xr = /\bquery\??\.?\(\s*['"`]/, J = [
+}), Zr = /\(\s*\{[^}]*\.\.\./, Qr = /\bquery\??\.?\(\s*['"`]/, $r = C({
+	version: "0.37.0",
+	id: "0.37.0/01_procedure-input-rejects-undeclared-fields",
+	title: "a procedure input rejects a field it does not declare (it used to drop it)",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
+		let t = e.getFullText();
+		return Zr.test(t) || Qr.test(t) || w("query").test(t);
+	}),
+	note: [
+		"A procedure call whose input carries a field the schema does not declare",
+		"now fails with a ParseError naming the field. Before this release the",
+		"field was DISCARDED and the call ran with what was left.",
+		"",
+		"The measurement that caused it — a consumer's root layout:",
+		"",
+		"    query?.('userSettings.list', { employeeId })",
+		"",
+		"That procedure declares `userId` / `userIdIn`. The payload decoded to `{}`,",
+		"which for a LIST query is not a narrower filter — it is NO filter. An admin",
+		"was served a different user's settings row, and nothing logged anything.",
+		"",
+		"WHAT TO DO",
+		"",
+		"1. Run your test suite and your app against a dev build. A wrong field now",
+		"   surfaces as a ParseError that NAMES the key and lists the accepted ones,",
+		"   so each one is a one-line read rather than an investigation.",
+		"",
+		"2. Look at every SPREAD into a procedure input:",
+		"",
+		"       await api.orders.list({ ...filters, limit })",
+		"",
+		"   This is the construct the change is aimed at. The keys come from a value,",
+		"   so nobody reading the call site can see what is being sent — which is",
+		"   exactly the condition under which a stray key survived unnoticed.",
+		"",
+		"3. If a spread legitimately carries more than the procedure declares, narrow",
+		"   it at the call site (`{ status: filters.status, limit }`) rather than",
+		"   widening the input schema. Widening restores the silent drop under a",
+		"   different name: the field is accepted and still does nothing.",
+		"",
+		"WHAT DOES NOT CHANGE",
+		"",
+		"  • A DECLARED field, including every optional one, decodes exactly as",
+		"    before. An empty input to a procedure that declares none is still fine.",
+		"  • Nested objects and union members follow the same rule — that is the",
+		"    point, since a filter object one level down is the commoner spelling.",
+		"  • A non-object input (a scalar, a void input) is unaffected; there is no",
+		"    excess property for it to have.",
+		"",
+		"WHY IT IS NOT A WARNING",
+		"",
+		"The decoder cannot tell a projection field from a FILTER field. Dropping an",
+		"unknown `include` costs a caller some data; dropping an unknown `tenantId`",
+		"hands them somebody else's. Since nothing at decode time distinguishes the",
+		"two, the only safe direction is to refuse — and a warning would have to be",
+		"read by someone, in a log, after the wrong rows were already served."
+	].join("\n")
+}), K = "@voltro/plugin-auth", q = "@voltro/protocol", J = "IMPERSONATION_METADATA_KEY", ei = [
 	ge,
 	_e,
 	ye,
@@ -5157,104 +5215,159 @@ var x = (e, t, n) => {
 	un,
 	fn,
 	mn,
-	yn,
-	xn,
-	Cn,
-	Tn,
-	Dn,
+	bn,
+	Sn,
+	wn,
+	En,
 	On,
 	kn,
 	An,
 	jn,
-	Nn,
-	Ln,
-	zn,
-	Vn,
+	Mn,
+	Pn,
+	Rn,
+	Bn,
 	Hn,
 	Un,
 	Wn,
-	qn,
-	er,
+	Gn,
 	Jn,
-	Qn,
-	nr,
-	ir,
+	tr,
+	Yn,
+	$n,
+	rr,
 	ar,
 	or,
-	lr,
-	dr,
-	_r,
+	sr,
+	ur,
+	fr,
 	yr,
-	hr,
-	Sr,
-	Tr,
+	xr,
+	gr,
+	wr,
 	Dr,
 	kr,
-	Nr,
+	jr,
+	Fr,
+	Br,
 	Rr,
-	Ir,
-	Hr,
 	Wr,
 	Kr,
-	qr,
 	Jr,
+	Yr,
+	Xr,
+	$r,
+	C({
+		version: "0.38.0",
+		id: "0.38.0/01_impersonation-key-in-protocol",
+		title: `\`${J}\` is imported from @voltro/protocol`,
+		kind: "transform",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getImportDeclarations().some((e) => e.getModuleSpecifierValue() === K && e.getNamedImports().some((e) => e.getName() === J))),
+		transform: ({ project: e, log: t }) => {
+			let n = 0;
+			for (let t of e.getSourceFiles()) for (let e of t.getImportDeclarations()) {
+				if (e.getModuleSpecifierValue() !== K) continue;
+				let r = e.getNamedImports().find((e) => e.getName() === J);
+				if (r === void 0) continue;
+				let i = r.getAliasNode()?.getText(), a = e.isTypeOnly() || r.isTypeOnly();
+				r.remove();
+				let o = t.getImportDeclarations().find((e) => e.getModuleSpecifierValue() === q && e.isTypeOnly() === a), s = {
+					name: J,
+					...i === void 0 ? {} : { alias: i }
+				};
+				o === void 0 ? t.addImportDeclaration({
+					moduleSpecifier: q,
+					isTypeOnly: a,
+					namedImports: [s]
+				}) : o.addNamedImport(s), e.getNamedImports().length === 0 && e.getDefaultImport() === void 0 && e.getNamespaceImport() === void 0 && e.remove(), n += 1;
+			}
+			n > 0 && t(`${J}: ${n} import(s) repointed to ${q}`);
+		}
+	}),
 	C({
-		version: "0.37.0",
-		id: "0.37.0/01_procedure-input-rejects-undeclared-fields",
-		title: "a procedure input rejects a field it does not declare (it used to drop it)",
+		version: "0.38.0",
+		id: "0.38.0/02_startup-failure-refuses-boot",
+		title: "a `*.startup.ts` that fails refuses the boot (it used to warn and continue)",
 		kind: "manual",
-		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
-			let t = e.getFullText();
-			return Yr.test(t) || Xr.test(t) || w("query").test(t);
-		}),
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => /\.startup\.tsx?$/.test(e.getFilePath())),
 		note: [
-			"A procedure call whose input carries a field the schema does not declare",
-			"now fails with a ParseError naming the field. Before this release the",
-			"field was DISCARDED and the call ran with what was left.",
+			"A `*.startup.ts` whose function throws or rejects now ABORTS the boot,",
+			"naming the file and the cause. Before this release it logged a warning and",
+			"the server came up without whatever the startup was there to install.",
+			"",
+			"WHY IT CHANGED",
 			"",
-			"The measurement that caused it — a consumer's root layout:",
+			"A startup is the documented place to REGISTER things the request path",
+			"depends on — `setRowFilter` (row-level security) above all. We measured a",
+			"startup that threw on its first line and produced this:",
 			"",
-			"    query?.('userSettings.list', { employeeId })",
+			"    warn   startup: function rejected",
+			"    info   startup: registered      <- next line, same file",
 			"",
-			"That procedure declares `userId` / `userIdIn`. The payload decoded to `{}`,",
-			"which for a LIST query is not a narrower filter — it is NO filter. An admin",
-			"was served a different user's settings row, and nothing logged anything.",
+			"and then a server that answered every request with no row filter",
+			"registered. The two lines contradict each other and the second asserts",
+			"exactly the thing that had just failed.",
+			"",
+			"The runner cannot tell a registration from a background loop, and the two",
+			"outcomes are not symmetric: \"the app refuses to boot\" is fixed in seconds",
+			"and everyone sees it; \"the app serves without its access control\" is seen",
+			"by nobody.",
 			"",
 			"WHAT TO DO",
 			"",
-			"1. Run your test suite and your app against a dev build. A wrong field now",
-			"   surfaces as a ParseError that NAMES the key and lists the accepted ones,",
-			"   so each one is a one-line read rather than an investigation.",
+			"1. Boot each app once. A startup that was failing silently now says so, and",
+			"   the message names the file. This is the whole migration for most apps —",
+			"   a startup that worked keeps working.",
+			"",
+			"2. If a startup CAN fail and that is acceptable — a best-effort cache warm,",
+			"   an optional metrics bridge — catch it yourself:",
+			"",
+			"       export default async (ctx) => {",
+			"         try {",
+			"           await warmTheCache(ctx.store)",
+			"         } catch (err) {",
+			"           ctx.log.warn('cache warm failed; serving cold', {}, err)",
+			"         }",
+			"       }",
 			"",
-			"2. Look at every SPREAD into a procedure input:",
+			"   The catch belongs at the site where somebody decided the failure was",
+			"   acceptable, where a reviewer can see the decision. That is the ONLY",
+			"   reason this is not a flag: a flag would move the decision away from the",
+			"   startup it applies to and make it one setting for all of them.",
 			"",
-			"       await api.orders.list({ ...filters, limit })",
+			"TWO MORE WAYS A STARTUP USED TO VANISH, now also refusals",
 			"",
-			"   This is the construct the change is aimed at. The keys come from a value,",
-			"   so nobody reading the call site can see what is being sent — which is",
-			"   exactly the condition under which a stray key survived unnoticed.",
+			"  • A startup file that cannot be IMPORTED (a bad import path, a syntax",
+			"    error) used to warn and skip the file.",
+			"  • A startup file with no DEFAULT-exported function used to warn and skip.",
+			"    The convention is `export default async (ctx) => {…}` — a named export",
+			"    is discovered and never runs, which is indistinguishable from a startup",
+			"    that ran and did nothing.",
 			"",
-			"3. If a spread legitimately carries more than the procedure declares, narrow",
-			"   it at the call site (`{ status: filters.status, limit }`) rather than",
-			"   widening the input schema. Widening restores the silent drop under a",
-			"   different name: the field is accepted and still does nothing.",
+			"THE OTHER HALF: A STARTUP MUST RETURN",
 			"",
-			"WHAT DOES NOT CHANGE",
+			"A startup function that never returns now refuses the boot too, after",
+			"`VOLTRO_STARTUP_TIMEOUT_MS` (60s default). Awaiting forever used to be",
+			"allowed and documented, and it is what made a slow-then-failing startup",
+			"unreportable: the boot moved on after 2 seconds, so a rejection arriving",
+			"later had nothing left to refuse.",
 			"",
-			"  • A DECLARED field, including every optional one, decodes exactly as",
-			"    before. An empty input to a procedure that declares none is still fine.",
-			"  • Nested objects and union members follow the same rule — that is the",
-			"    point, since a filter object one level down is the commoner spelling.",
-			"  • A non-object input (a scalar, a void input) is unaffected; there is no",
-			"    excess property for it to have.",
+			"Start the work and RETURN; hand the teardown to `onShutdown`:",
 			"",
-			"WHY IT IS NOT A WARNING",
+			"       export default async ({ store, log, onShutdown }) => {",
+			"         const timer = setInterval(() => sync(store), 60_000)",
+			"         onShutdown(() => clearInterval(timer))",
+			"       }",
 			"",
-			"The decoder cannot tell a projection field from a FILTER field. Dropping an",
-			"unknown `include` costs a caller some data; dropping an unknown `tenantId`",
-			"hands them somebody else's. Since nothing at decode time distinguishes the",
-			"two, the only safe direction is to refuse — and a warning would have to be",
-			"read by someone, in a log, after the wrong rows were already served."
+			"Every startup this framework ships already has that shape, so most apps",
+			"need no change. If yours awaits a fiber until shutdown, move the await",
+			"behind the return.",
+			"",
+			"A startup that is legitimately SLOW is unaffected — it is waited for, and",
+			"it registers when it finishes. Raise VOLTRO_STARTUP_TIMEOUT_MS if a real",
+			"backfill needs more than a minute, or (better) register first and do the",
+			"long work after, so a failure in the long half cannot hide a missing",
+			"registration."
 		].join("\n")
 	})
 ], Y = /* @__PURE__ */ new Set([
@@ -5269,12 +5382,12 @@ var x = (e, t, n) => {
 	".turbo",
 	".cache",
 	".output"
-]), Zr = () => [...[...Y].map((e) => `**/${e}/**`), "**/.voltro-*/**"], X = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, Z = /\.(?:tsx?|jsx?|mjs|cjs)$/, Qr = (e) => m(e).replace(Z, ""), $r = (e) => {
+]), ti = () => [...[...Y].map((e) => `**/${e}/**`), "**/.voltro-*/**"], X = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, ni = /\.(?:tsx?|jsx?|mjs|cjs)$/, ri = (e) => m(e).replace(ni, ""), ii = (e) => {
 	let t = e.split("/").filter((e) => e.length > 0).pop();
 	if (t === void 0 || t === "." || t === "..") return;
-	let n = t.replace(Z, "");
+	let n = t.replace(ni, "");
 	return n.length > 0 ? n : void 0;
-}, ei = (e) => {
+}, ai = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e;
@@ -5285,55 +5398,55 @@ var x = (e, t, n) => {
 		}
 		X.lastIndex = 0;
 		for (let r = X.exec(e); r !== null; r = X.exec(e)) {
-			let e = $r(r[1] ?? r[2] ?? "");
+			let e = ii(r[1] ?? r[2] ?? "");
 			if (e === void 0) continue;
 			let i = t.get(e);
 			i === void 0 ? t.set(e, /* @__PURE__ */ new Set([n])) : i.add(n);
 		}
 	}
 	return t;
-}, ti = (e, t) => {
+}, oi = (e, t) => {
 	let n = new Set(e);
-	for (let r of e) for (let e of [Qr(r), m(h(r))]) {
+	for (let r of e) for (let e of [ri(r), m(h(r))]) {
 		let r = t.get(e);
 		if (r !== void 0) for (let e of r) n.add(e);
 	}
 	return n;
-}, ni = [
+}, si = [
 	"**/*.ts",
 	"**/*.tsx",
 	"!**/node_modules/**",
 	"!**/dist/**",
 	"!**/.framework/**",
 	"!**/*.d.ts"
-], Q = (e, t, n = ai) => {
+], Z = (e, t, n = ui) => {
 	let r = /* @__PURE__ */ new Set();
-	for (let e of t) for (let t of e.scope ?? ni) r.add(t);
+	for (let e of t) for (let t of e.scope ?? si) r.add(t);
 	let i = n(e);
 	if (i !== void 0) {
-		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => ii(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => ii(e.slice(1))), a = [...Y], o = [];
+		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => li(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => li(e.slice(1))), a = [...Y], o = [];
 		for (let r of i) {
 			if (a.some((e) => r === e || r.startsWith(`${e}/`) || r.includes(`/${e}/`)) || !t.some((e) => e(r)) || n.some((e) => e(r))) continue;
 			let i = g(e, r);
 			v(i) && o.push(i);
 		}
-		return ri(o.length, e), o;
+		return ci(o.length, e), o;
 	}
 	let a = oe([...r], {
 		cwd: e,
 		absolute: !0,
 		expandDirectories: !1,
 		followSymbolicLinks: !1,
-		ignore: [...Zr()]
+		ignore: [...ti()]
 	});
-	return ri(a.length, e), a;
-}, ri = (e, t) => {
-	let n = oi();
+	return ci(a.length, e), a;
+}, ci = (e, t) => {
+	let n = di();
 	if (!(e <= n)) throw Error(`voltro update: the codemod scan matched ${e} files under ${t}, past the ${n} ceiling.\n  Every matched file is parsed into one ts-morph project, so the heap needed grows with\n  this number — past the ceiling it runs out of memory, and V8 aborts without naming a\n  limit, which is why this stops here instead. Three ways out, in order:\n    • put non-source directories in .gitignore (inside a git repo the scan then never\n      sees them at all — a build cache, a data dump, a virtualenv),\n    • run \`voltro update\` from the app directory rather than the workspace root, or\n    • take one codemod at a time: \`voltro update --dry-run\` lists the ids, then\n      \`voltro update --codemods-only --only <id>\` runs a single one.\n  If every one of those files really is source this pass must rewrite, raise the ceiling\n  with VOLTRO_CODEMOD_MAX_FILES and give node room: NODE_OPTIONS=--max-old-space-size=8192.`);
-}, ii = (e) => {
+}, li = (e) => {
 	let t = e.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*").replace(/\u0000/g, "(?:.*/)?").replace(/\\\{([^}]*)\\\}/g, (e, t) => `(?:${t.split(",").join("|")})`);
 	return (e) => RegExp(`^${t}$`).test(e);
-}, ai = (e) => {
+}, ui = (e) => {
 	try {
 		let t = re("git", [
 			"ls-files",
@@ -5354,17 +5467,17 @@ var x = (e, t, n) => {
 	} catch {
 		return;
 	}
-}, oi = () => {
+}, di = () => {
 	let e = Number(process.env.VOLTRO_CODEMOD_MAX_FILES);
 	return Number.isInteger(e) && e > 0 ? e : 2e4;
-}, $ = (e, t) => {
+}, Q = (e, t) => {
 	let n = e.split(".").map(Number), r = t.split(".").map(Number);
 	for (let e = 0; e < 3; e++) {
 		let t = (n[e] ?? 0) - (r[e] ?? 0);
 		if (t !== 0) return t;
 	}
 	return 0;
-}, si = (e, t, n = J) => n.filter((n) => $(e, n.version) < 0 && $(n.version, t) <= 0).slice().sort(he), ci = (e, t, n = () => {}) => {
+}, fi = (e, t, n = ei) => n.filter((n) => Q(e, n.version) < 0 && Q(n.version, t) <= 0).slice().sort(he), $ = (e, t, n = () => {}) => {
 	let r = [], i = [], a = [];
 	for (let o of t) {
 		if (!(!o.appliesTo || o.appliesTo({ project: e }))) {
@@ -5410,8 +5523,8 @@ var x = (e, t, n) => {
 		manual: i,
 		skipped: a
 	};
-}, li = async (e) => {
-	let t = e.log ?? (() => {}), n = si(e.from, e.to, e.codemods ?? J), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
+}, pi = async (e) => {
+	let t = e.log ?? (() => {}), n = fi(e.from, e.to, e.codemods ?? ei), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
 		let t = n.filter((t) => e.only.includes(t.id)), r = e.only.filter((e) => !n.some((t) => t.id === e));
 		if (r.length > 0) throw Error(`voltro update --only: no codemod in ${e.from} → ${e.to} has id ${r.map((e) => `"${e}"`).join(", ")}.\n  Available for this jump:\n${n.map((e) => `    ${e.id}`).join("\n")}`);
 		return t;
@@ -5430,15 +5543,15 @@ var x = (e, t, n) => {
 			baseUrl: i.baseUrl,
 			paths: i.paths
 		} }
-	}), o, s = Q(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? ei(Q(e.root, [{
+	}), o, s = Z(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? ai(Z(e.root, [{
 		...c[0],
-		scope: ni
+		scope: si
 	}])) : void 0;
 	for (let n of r) {
 		if (c.includes(n)) {
-			let r = a(), i = Q(e.root, [n]);
-			for (let e of ti(i, p)) v(e) && r.addSourceFileAtPath(e);
-			let s = ci(r, [n], t);
+			let r = a(), i = Z(e.root, [n]);
+			for (let e of oi(i, p)) v(e) && r.addSourceFileAtPath(e);
+			let s = $(r, [n], t);
 			e.dryRun || await r.save(), l.push(...s.applied), u.push(...s.manual), d.push(...s.skipped), o = void 0;
 			continue;
 		}
@@ -5447,7 +5560,7 @@ var x = (e, t, n) => {
 			for (let t of s) v(t) && e.addSourceFileAtPath(t);
 			return e;
 		})();
-		let r = ci(o, [n], t);
+		let r = $(o, [n], t);
 		e.dryRun || await o.save(), l.push(...r.applied), u.push(...r.manual), d.push(...r.skipped);
 	}
 	return {
@@ -5457,4 +5570,4 @@ var x = (e, t, n) => {
 	};
 };
 //#endregion
-export { C as i, li as n, Y as r, $ as t };
+export { C as i, pi as n, Y as r, Q as t };