@voltro/cli 0.38.0 → 0.39.1

package/dist/{doctorCommand-gmDyALFL.js → doctorCommand-oLuzc-aC.js}

@@ -1,18 +1,18 @@
-import { Bt as e, Rt as t, zt as n } from "./dev-E7Eo5GHc.js";
-import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-BKdD7c_a.js";
+import { Bt as e, Ht as t, Vt as n } from "./dev-3mgc8c-H.js";
+import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-CTpSY-e_.js";
 import { w as u } from "./frameworkTableAssembly-oMPBKqlE.js";
 import { n as d } from "./pageConvention-cEiRxdab.js";
-import { r as f, u as p } from "./apiBuild-CvacV4zA.js";
+import { r as f, u as p } from "./apiBuild-D9FB13_2.js";
 import { n as m, r as h, t as g } from "./cliOutput-D1tSBoRM.js";
-import { n as ee, t as te } from "./tsconfigPaths-BWXBWgcl.js";
-import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
-import { basename as ie, dirname as ae, join as _, relative as v, resolve as y, sep as b } from "node:path";
-import { existsSync as x, readFileSync as S, readdirSync as C, statSync as w, writeFileSync as oe } from "node:fs";
-import { pathToFileURL as se } from "node:url";
-import { createLogger as ce } from "@voltro/logger";
-import { Node as T, Project as E, SyntaxKind as D } from "ts-morph";
+import { n as _, t as ee } from "./tsconfigPaths-BWXBWgcl.js";
+import { n as te, r as ne } from "./fileTaxonomy-CJfgOllU.js";
+import { basename as re, dirname as ie, join as v, relative as y, resolve as b, sep as x } from "node:path";
+import { existsSync as S, readFileSync as C, readdirSync as w, statSync as T, writeFileSync as ae } from "node:fs";
+import { pathToFileURL as oe } from "node:url";
+import { createLogger as se } from "@voltro/logger";
+import { Node as E, Project as D, SyntaxKind as O } from "ts-morph";
 //#region src/predicateColumnAudit.ts
-var le = /* @__PURE__ */ new Set([
+var ce = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
 	"gt",
@@ -30,43 +30,43 @@ var le = /* @__PURE__ */ new Set([
 	"endsWith",
 	"between",
 	"jsonField"
-]), ue = (e) => {
-	if (T.isPropertyAccessExpression(e)) return e.getName();
-	if (T.isIdentifier(e)) return e.getText();
-}, de = (e) => {
+]), le = (e) => {
+	if (E.isPropertyAccessExpression(e)) return e.getName();
+	if (E.isIdentifier(e)) return e.getText();
+}, ue = (e) => {
 	let t = e;
-	for (; T.isCallExpression(t);) {
+	for (; E.isCallExpression(t);) {
 		let e = t.getExpression();
-		if (!T.isPropertyAccessExpression(e)) break;
+		if (!E.isPropertyAccessExpression(e)) break;
 		t = e.getExpression();
 	}
 	return t;
-}, fe = (e, t, n) => {
-	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new E({
+}, de = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, new Set(e.columns)])), i = new Map(t.map((e) => [e.name, e.columns])), a = [], o = 0, s = new D({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	});
 	for (let t of e) {
 		let e;
 		try {
-			let n = S(t, "utf8");
+			let n = C(t, "utf8");
 			if (!n.includes(".where(") && !n.includes(".select(")) continue;
 			e = s.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
 		} catch {
 			continue;
 		}
-		let c = v(n, t);
-		for (let t of e.getDescendantsOfKind(D.CallExpression)) {
+		let c = y(n, t);
+		for (let t of e.getDescendantsOfKind(O.CallExpression)) {
 			let e = t.getExpression();
-			if (!T.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
-			let n = ue(de(e.getExpression()));
+			if (!E.isPropertyAccessExpression(e) || e.getName() !== "where") continue;
+			let n = le(ue(e.getExpression()));
 			if (n === void 0 || !r.has(n)) {
 				let t = e.getExpression();
-				if (T.isCallExpression(t)) {
+				if (E.isCallExpression(t)) {
 					let e = t.getExpression();
-					if (T.isPropertyAccessExpression(e) && e.getName() === "select") {
+					if (E.isPropertyAccessExpression(e) && e.getName() === "select") {
 						let e = t.getArguments()[0];
-						e !== void 0 && T.isStringLiteral(e) && (n = e.getLiteralValue());
+						e !== void 0 && E.isStringLiteral(e) && (n = e.getLiteralValue());
 					}
 				}
 			}
@@ -75,16 +75,16 @@ var le = /* @__PURE__ */ new Set([
 			if (s === void 0) continue;
 			let l = [], [u] = t.getArguments();
 			if (u !== void 0) {
-				if (T.isStringLiteral(u)) l.push({
+				if (E.isStringLiteral(u)) l.push({
 					column: u.getLiteralValue(),
 					line: u.getStartLineNumber()
 				});
-				else for (let e of [u, ...u.getDescendantsOfKind(D.CallExpression)]) {
-					if (!T.isCallExpression(e)) continue;
-					let t = e.getExpression(), n = T.isIdentifier(t) ? t.getText() : T.isPropertyAccessExpression(t) ? t.getName() : void 0;
-					if (n === void 0 || !le.has(n)) continue;
+				else for (let e of [u, ...u.getDescendantsOfKind(O.CallExpression)]) {
+					if (!E.isCallExpression(e)) continue;
+					let t = e.getExpression(), n = E.isIdentifier(t) ? t.getText() : E.isPropertyAccessExpression(t) ? t.getName() : void 0;
+					if (n === void 0 || !ce.has(n)) continue;
 					let r = e.getArguments()[0];
-					r !== void 0 && T.isStringLiteral(r) && l.push({
+					r !== void 0 && E.isStringLiteral(r) && l.push({
 						column: r.getLiteralValue(),
 						line: r.getStartLineNumber()
 					});
@@ -103,16 +103,16 @@ var le = /* @__PURE__ */ new Set([
 		issues: a,
 		checked: o
 	};
-}, O = 12, pe = (e) => {
+}, k = 12, fe = (e) => {
 	if (e.checked === 0) return null;
 	if (e.issues.length === 0) return `predicate columns: ${e.checked} checked — every filtered column exists on its table`;
 	let t = [`predicate columns: ${e.issues.length} filter${e.issues.length, "s"} on a column that does not exist (${e.checked} checked)`];
 	for (let n of e.issues) {
-		let e = n.available.slice(0, O).join(", "), r = n.available.length > O ? `, … (${n.available.length - O} more)` : "";
+		let e = n.available.slice(0, k).join(", "), r = n.available.length > k ? `, … (${n.available.length - k} more)` : "";
 		t.push(`  ${n.file}:${n.line}  '${n.table}' has no column '${n.column}'`), t.push(`    columns: ${e}${r}`);
 	}
 	return t.push("  This type-checks today and fails at runtime as a bare SQL error."), t.join("\n");
-}, me = /* @__PURE__ */ new Set([
+}, pe = /* @__PURE__ */ new Set([
 	"id",
 	"tenantId",
 	"tenant_id",
@@ -132,7 +132,7 @@ var le = /* @__PURE__ */ new Set([
 	"idempotency_id",
 	"idempotencyKey",
 	"idempotency_key"
-]), he = /* @__PURE__ */ new Set([
+]), me = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"created_at",
@@ -142,10 +142,10 @@ var le = /* @__PURE__ */ new Set([
 	"deleted_at",
 	"tenantId",
 	"tenant_id"
-]), ge = (e) => me.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), _e = (e) => e.type === "reference", ve = (e) => {
+]), he = (e) => pe.has(e) ? !1 : /[a-z0-9]Id$/.test(e) || /_id$/.test(e), ge = (e) => e.type === "reference", _e = (e) => {
 	let t = [];
 	for (let n of e) {
-		let e = n.columns.filter((e) => ge(e.name)), r = e.filter((e) => !_e(e)).map((e) => e.name);
+		let e = n.columns.filter((e) => he(e.name)), r = e.filter((e) => !ge(e)).map((e) => e.name);
 		if (r.length === 0) continue;
 		let i = new Set(n.primaryKey), a = r.filter((e) => i.has(e));
 		if (n.primaryKey.length >= 2 && a.length > 0) {
@@ -156,7 +156,7 @@ var le = /* @__PURE__ */ new Set([
 			});
 			continue;
 		}
-		if (e.some(_e) && e.length >= 2) {
+		if (e.some(ge) && e.length >= 2) {
 			t.push({
 				table: n.name,
 				columns: r,
@@ -164,7 +164,7 @@ var le = /* @__PURE__ */ new Set([
 			});
 			continue;
 		}
-		e.length >= 2 && n.columns.filter((e) => !ge(e.name) && !he.has(e.name)).length === 0 && t.push({
+		e.length >= 2 && n.columns.filter((e) => !he(e.name) && !me.has(e.name)).length === 0 && t.push({
 			table: n.name,
 			columns: r,
 			signal: "link-only"
@@ -174,20 +174,20 @@ var le = /* @__PURE__ */ new Set([
 		issues: t,
 		tablesChecked: e.length
 	};
-}, ye = {
+}, ve = {
 	"composite-pk": "part of a composite primary key",
 	"reference-sibling": "sits beside a wired reference() on this table",
 	"link-only": "this table is nothing but link columns"
-}, be = (e) => {
+}, ye = (e) => {
 	if (e.tablesChecked === 0) return null;
 	if (e.issues.length === 0) return `junction FKs: ${e.tablesChecked} table${e.tablesChecked === 1 ? "" : "s"} checked — every link column is a wired reference()`;
 	let t = e.issues.length, n = [`junction FKs: ${t} junction table${t === 1 ? "" : "s"} with an id column that is a plain text() and not a reference()`];
 	for (let t of e.issues) {
 		let e = t.columns.map((e) => `'${e}'`).join(", ");
-		n.push(`  '${t.table}': ${e} (${ye[t.signal]})`);
+		n.push(`  '${t.table}': ${e} (${ve[t.signal]})`);
 	}
 	return n.push("  Declare each as reference(() => <table>): the FK is enforced, the column is auto-indexed,"), n.push("  and the relationship becomes walkable (a plain text() id column is an invisible edge)."), n.join("\n");
-}, xe = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), Se = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), Ce = (e) => Se(e).some((e) => xe.has(e)), we = (e) => {
+}, be = /* @__PURE__ */ new Set(/* @__PURE__ */ "position.positions.move.moved.moving.cursor.pointer.mouse.drag.dragging.hover.frame.frames.tick.ticks.ping.heartbeat.typing.scroll.scrolling.zoom.pan.coord.coords.coordinate.coordinates.telemetry.sensor.sample.samples.viewport".split(".")), xe = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((e) => e.length > 0).map((e) => e.toLowerCase()), Se = (e) => xe(e).some((e) => be.has(e)), Ce = (e) => {
 	let t = [], n = [];
 	for (let r of e) t.push({
 		event: r.name,
@@ -196,7 +196,7 @@ var le = /* @__PURE__ */ new Set([
 		event: r.name,
 		kind: "wide-key",
 		keyFieldCount: r.keyFieldCount
-	}), r.hasWebhook && Ce(r.name) && n.push({
+	}), r.hasWebhook && Se(r.name) && n.push({
 		event: r.name,
 		kind: "webhook-high-rate"
 	});
@@ -205,45 +205,45 @@ var le = /* @__PURE__ */ new Set([
 		modes: t,
 		warnings: n
 	};
-}, Te = (e) => {
+}, we = (e) => {
 	if (e.eventsChecked === 0) return null;
 	let t = e.eventsChecked, n = [`event delivery: ${t} declared event${t === 1 ? "" : "s"} — the mode decides what a MISSING message means`];
 	for (let t of e.modes) n.push(`  '${t.event}': ${t.delivery}`);
 	return n.push("  each   — every delivery matters; a slow subscriber loses the oldest and is TOLD how many (the default)."), n.push("  latest — a newer delivery supersedes a pending one; a slow subscriber gets the current value, told nothing."), n.push("  Two events with identical route/subscriber/buffer numbers mean OPPOSITE things about a drop — the mode is the difference."), n.join("\n");
-}, Ee = (e) => {
+}, Te = (e) => {
 	if (e.warnings.length === 0) return null;
 	let t = e.warnings.length, n = [`events that may not scale as declared: ${t} finding${t === 1 ? "" : "s"}`];
 	for (let t of e.warnings) t.kind === "wide-key" ? (n.push(`  '${t.event}': routing key has ${t.keyFieldCount ?? 0} fields — every field FRAGMENTS the subscriber set (distinct routes are the PRODUCT of the fields’ value spaces).`), n.push("     Check each is an ADDRESS the delivery is decided by (arenaId), not a discriminator the handler reads (gameType) — the latter is payload, not key.")) : (n.push(`  '${t.event}': a webhook block on a per-frame-looking event — every publish is N HTTP deliveries per second per subscribed target.`), n.push("     The webhook rate limit DEFERS the excess as pending rows rather than failing, so the symptom is a growing table. Publish a coarser event (a summary / state change) for the outside world."));
 	return n.push("  WARNING, not a fault — a producer may intend the fan-out. `voltro doctor --json` prints every finding."), n.join("\n");
-}, De = /* @__PURE__ */ new Set([
+}, Ee = /* @__PURE__ */ new Set([
 	"start",
 	"run",
 	"child"
-]), Oe = (e) => T.isCallExpression(e) && (() => {
+]), De = (e) => E.isCallExpression(e) && (() => {
 	let t = e.getExpression();
-	if (!T.isPropertyAccessExpression(t) || !De.has(t.getName())) return !1;
+	if (!E.isPropertyAccessExpression(t) || !Ee.has(t.getName())) return !1;
 	let n = t.getExpression();
-	return T.isPropertyAccessExpression(n) ? n.getName() === "workflows" : T.isIdentifier(n) && n.getText() === "workflows";
-})(), ke = (e, t, n) => {
-	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new E({
+	return E.isPropertyAccessExpression(n) ? n.getName() === "workflows" : E.isIdentifier(n) && n.getText() === "workflows";
+})(), Oe = (e, t, n) => {
+	let r = new Map(t.map((e) => [e.name, e])), i = [...r.keys()].sort(), a = [], o = [], s = 0, c = 0, l = new D({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	});
 	for (let t of e) {
 		let e;
 		try {
-			let n = S(t, "utf8");
+			let n = C(t, "utf8");
 			if (!n.includes("workflows.")) continue;
 			e = l.createSourceFile(`/scan${t.endsWith("x") ? ".tsx" : ".ts"}`, n, { overwrite: !0 });
 		} catch {
 			continue;
 		}
-		let u = v(n, t);
-		for (let t of e.getDescendantsOfKind(D.CallExpression)) {
-			if (!Oe(t)) continue;
+		let u = y(n, t);
+		for (let t of e.getDescendantsOfKind(O.CallExpression)) {
+			if (!De(t)) continue;
 			c++;
 			let e = t.getStartLineNumber(), [n, l] = t.getArguments();
-			if (n === void 0 || !T.isStringLiteral(n)) {
+			if (n === void 0 || !E.isStringLiteral(n)) {
 				o.push({
 					file: u,
 					line: e,
@@ -262,7 +262,7 @@ var le = /* @__PURE__ */ new Set([
 				});
 				continue;
 			}
-			if (l === void 0 || !T.isObjectLiteralExpression(l)) {
+			if (l === void 0 || !E.isObjectLiteralExpression(l)) {
 				o.push({
 					file: u,
 					line: e,
@@ -270,7 +270,7 @@ var le = /* @__PURE__ */ new Set([
 				});
 				continue;
 			}
-			if (l.getProperties().some((e) => T.isSpreadAssignment(e))) {
+			if (l.getProperties().some((e) => E.isSpreadAssignment(e))) {
 				o.push({
 					file: u,
 					line: e,
@@ -279,14 +279,14 @@ var le = /* @__PURE__ */ new Set([
 				continue;
 			}
 			let p = /* @__PURE__ */ new Set(), m = !1;
-			for (let e of l.getProperties()) if (T.isPropertyAssignment(e) || T.isShorthandPropertyAssignment(e)) {
-				let t = (T.isPropertyAssignment(e), e.getNameNode());
-				if (T.isComputedPropertyName(t)) {
+			for (let e of l.getProperties()) if (E.isPropertyAssignment(e) || E.isShorthandPropertyAssignment(e)) {
+				let t = (E.isPropertyAssignment(e), e.getNameNode());
+				if (E.isComputedPropertyName(t)) {
 					m = !0;
 					break;
 				}
 				p.add(e.getName().replace(/^['"]|['"]$/g, ""));
-			} else (T.isMethodDeclaration(e) || T.isGetAccessorDeclaration(e)) && p.add(e.getName());
+			} else (E.isMethodDeclaration(e) || E.isGetAccessorDeclaration(e)) && p.add(e.getName());
 			if (m) {
 				o.push({
 					file: u,
@@ -324,7 +324,7 @@ var le = /* @__PURE__ */ new Set([
 		checked: s,
 		callSites: c
 	};
-}, Ae = (e) => {
+}, ke = (e) => {
 	if (e.callSites === 0) return null;
 	let t = [];
 	t.push(`workflow starts: ${e.checked}/${e.callSites} call sites checked`);
@@ -337,7 +337,7 @@ var le = /* @__PURE__ */ new Set([
 		for (let n of e.unchecked) t.push(`    ${n.file}:${n.line} — ${n.reason}`);
 	}
 	return e.issues.length === 0 && e.unchecked.length === 0 && t.push("  every call site matches its workflow"), t.join("\n");
-}, je = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, k = "VOLTRO_FIELD_ENCRYPTION_KEY", Me = (e) => {
+}, Ae = /(^|[/\\])(\.env(\.[\w.-]+)?|.*\.ya?ml|Dockerfile|.*\.tf|.*\.toml|Procfile)$/i, A = "VOLTRO_FIELD_ENCRYPTION_KEY", je = (e) => {
 	let t;
 	for (let [n, r] of e.sources) if (t === void 0 && /\bfieldEncryption\b/.test(r) && (t = {
 		reason: "fieldEncryption",
@@ -345,13 +345,13 @@ var le = /* @__PURE__ */ new Set([
 	}), t === void 0 && /\.encrypted\s*\(/.test(r) && (t = {
 		reason: "encrypted-column",
 		file: n
-	}), r.includes(k)) return;
+	}), r.includes(A)) return;
 	if (t !== void 0) {
-		for (let [, t] of e.envFiles) if (t.includes(k)) return;
+		for (let [, t] of e.envFiles) if (t.includes(A)) return;
 		return t;
 	}
-}, Ne = (e) => [
-	`✗  ${k} is named nowhere under this app root, and the app encrypts columns at rest`,
+}, Me = (e) => [
+	`✗  ${A} is named nowhere under this app root, and the app encrypts columns at rest`,
 	e.reason === "fieldEncryption" ? `   (\`fieldEncryption\` in ${e.file})` : `   (an \`.encrypted()\` column in ${e.file})`,
 	"",
 	"   A deploy without it does not degrade — it refuses to boot at `onActivate`,",
@@ -367,14 +367,14 @@ var le = /* @__PURE__ */ new Set([
 	"   reaches your deploy target is not knowable from here — a secret manager",
 	"   or a CI variable is not a file. Naming it nowhere is conclusive; naming",
 	"   it somewhere is not a guarantee."
-].join("\n"), Pe = (e) => {
+].join("\n"), Ne = (e) => {
 	if (e.catalogCodes.length === 0) return;
 	let t = new Set(e.declaredLocales), n = e.catalogCodes.filter((e) => !t.has(e)).sort();
 	if (n.length !== 0) return {
 		orphaned: n,
 		noneDeclared: t.size === 0
 	};
-}, Fe = (e, t) => {
+}, Pe = (e, t) => {
 	let n = e.orphaned.join(", ");
 	return e.noneDeclared ? [
 		`⚠  ${t} has ${e.orphaned.length} catalog(s) — ${n} — and the app declares no \`locales:\`.`,
@@ -386,33 +386,33 @@ var le = /* @__PURE__ */ new Set([
 		"   …or delete the files. A catalog that is never loaded looks from the inside",
 		"   exactly like one that works, which is why this is worth a line."
 	] : [`⚠  ${t} has catalog(s) not in \`locales:\` — ${n} — so they are never imported.`, "   Add the code(s) to `locales:` in your app config, or delete the file(s)."];
-}, A = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), j = /* @__PURE__ */ new Set([
+}, j = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), M = /* @__PURE__ */ new Set([
 	"requireScope",
 	"requireAnyScope",
 	"requireAuth",
 	"assertScope",
 	"assertCan",
 	"can"
-]), Ie = (e) => {
+]), Fe = (e) => {
 	let t = /* @__PURE__ */ new Set();
-	for (let n of e) for (let e of A(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
+	for (let n of e) for (let e of j(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
 	return t;
-}, Le = (e, t) => {
+}, Ie = (e, t) => {
 	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
-}, Re = (e) => {
+}, Le = (e) => {
 	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
 	return t && n;
-}, ze = (e, t, n) => {
+}, Re = (e, t, n) => {
 	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
-	let r = A(e.src), i = Le(r, t);
-	return i === void 0 ? Re(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+	let r = j(e.src), i = Ie(r, t);
+	return i === void 0 ? Le(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
 		kind: "vocabulary-guard",
 		name: i
 	};
-}, Be = (e, t, n) => {
+}, ze = (e, t, n) => {
 	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
 	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
-}, Ve = (e, t, n) => {
+}, Be = (e, t, n) => {
 	switch (t.kind) {
 		case "declared-guard": return "guards: on the descriptor";
 		case "vocabulary-guard": return `calls ${t.name}()`;
@@ -420,15 +420,15 @@ var le = /* @__PURE__ */ new Set([
 		case "allowlisted": return "accepted by a previous run";
 		case "unchecked": return n ? e.op === "read" ? "no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt" : `${e.op}s${e.table ? ` ${e.table}` : ""} with no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt` : e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
 	}
-}, He = (e) => {
+}, Ve = (e) => {
 	let t = e.executors.map((t) => {
-		let n = ze(t, e.guardVocabulary, e.allowlist);
+		let n = Re(t, e.guardVocabulary, e.allowlist);
 		return {
 			tag: t.tag,
 			path: t.path,
 			verdict: n,
-			severity: Be(t, e.tenantScopedTables, e.referencedTables),
-			why: Ve(t, n, e.rowFilterRegistered === !0)
+			severity: ze(t, e.tenantScopedTables, e.referencedTables),
+			why: Be(t, n, e.rowFilterRegistered === !0)
 		};
 	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
 	return {
@@ -442,7 +442,7 @@ var le = /* @__PURE__ */ new Set([
 		},
 		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
 	};
-}, Ue = [
+}, He = [
 	"# voltro doctor — authz allowlist",
 	"#",
 	"# Two KINDS of line, and the difference is the point:",
@@ -467,19 +467,19 @@ var le = /* @__PURE__ */ new Set([
 	"# `--write-authz-allowlist` PRESERVES reviewed= lines. It only ever adds debt",
 	"# lines for executors that are newly unchecked.",
 	""
-], We = (e) => {
+], Ue = (e) => {
 	let t = [...e].map((e) => typeof e == "string" ? { tag: e } : e), n = t.filter((e) => e.reviewed === void 0).map((e) => e.tag).sort(), r = t.filter((e) => e.reviewed !== void 0).sort((e, t) => e.tag.localeCompare(t.tag));
 	return [
-		...Ue,
+		...He,
 		...n,
 		...r.length > 0 ? ["", "# reviewed — read by a human, open on purpose"] : [],
 		...r.map((e) => `${e.tag}  reviewed=${e.reviewed}`),
 		""
 	].join("\n");
-}, Ge = (e, t) => {
+}, We = (e, t) => {
 	let n = [...new Set(t)].sort();
-	if (e === void 0) return We(n.map((e) => ({ tag: e })));
-	let r = M(e).tags, i = n.filter((e) => !r.has(e));
+	if (e === void 0) return Ue(n.map((e) => ({ tag: e })));
+	let r = N(e).tags, i = n.filter((e) => !r.has(e));
 	return i.length === 0 ? e : [
 		e.replace(/\n+$/, ""),
 		"",
@@ -488,25 +488,25 @@ var le = /* @__PURE__ */ new Set([
 		...i,
 		""
 	].join("\n");
-}, Ke = (e, t) => {
+}, Ge = (e, t) => {
 	let n = [...new Set(t)];
 	if (e === void 0) return {
 		added: n.length,
 		kept: 0,
 		removed: 0
 	};
-	let r = M(e).tags;
+	let r = N(e).tags;
 	return {
 		added: n.filter((e) => !r.has(e)).length,
 		kept: r.size,
 		removed: 0
 	};
-}, qe = class extends Error {
+}, Ke = class extends Error {
 	tag;
 	constructor(e) {
 		super(`authz allowlist: '${e}' is marked reviewed with no reason. Write \`${e}  reviewed=<why it is genuinely open>\`. A bare tag is the other, honest option — it records the executor as DEBT, which is what an unexplained exemption is.`), this.tag = e, this.name = "AllowlistReasonMissingError";
 	}
-}, M = (e) => {
+}, N = (e) => {
 	let t = [];
 	for (let n of e.split("\n")) {
 		let e = n.trim();
@@ -519,7 +519,7 @@ var le = /* @__PURE__ */ new Set([
 			continue;
 		}
 		let a = r[2].trim();
-		if (a.length === 0) throw new qe(i);
+		if (a.length === 0) throw new Ke(i);
 		t.push({
 			tag: i,
 			reviewed: a
@@ -529,13 +529,13 @@ var le = /* @__PURE__ */ new Set([
 		tags: new Set(t.map((e) => e.tag)),
 		entries: t
 	};
-}, N = (e) => {
+}, P = (e) => {
 	let t = e.indexOf(".");
 	return t <= 0 ? void 0 : e.slice(0, t);
-}, Je = (e, t) => {
+}, qe = (e, t) => {
 	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
 	for (let e of t.rpcTags) {
-		let t = N(e);
+		let t = P(e);
 		if (t === void 0) continue;
 		let n = i.get(t);
 		n ? n.push(e) : i.set(t, [e]);
@@ -564,7 +564,7 @@ var le = /* @__PURE__ */ new Set([
 			});
 			continue;
 		}
-		let s = new Set(o.rpcTags.map(N).filter((e) => e !== void 0));
+		let s = new Set(o.rpcTags.map(P).filter((e) => e !== void 0));
 		for (let e of s) {
 			let t = i.get(e);
 			t !== void 0 && a.push({
@@ -577,12 +577,12 @@ var le = /* @__PURE__ */ new Set([
 		}
 	}
 	return a;
-}, Ye = (e, t) => {
+}, Je = (e, t) => {
 	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
 	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
 	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
 	return r;
-}, Xe = async (e) => {
+}, Ye = async (e) => {
 	if (!await e.hasWorkflows().catch(() => !1)) return { kind: "not-applicable" };
 	let t;
 	try {
@@ -606,12 +606,12 @@ var le = /* @__PURE__ */ new Set([
 	} finally {
 		await t.close().catch(() => {});
 	}
-}, Ze = (e) => {
+}, Xe = (e) => {
 	let t = Math.round(e / 6e4);
 	if (t < 90) return `${t}m`;
 	let n = Math.round(t / 60);
 	return n < 48 ? `${n}h` : `${Math.round(n / 24)}d`;
-}, Qe = (e) => {
+}, Ze = (e) => {
 	if (e.kind === "not-applicable") return null;
 	if (e.kind === "skipped") return `•  stuck runs: NOT CHECKED — ${e.reason}\n   This is the one doctor rule that reads the database rather than your source.
    Run it where the app's DB env vars are set, or ignore this line locally.`;
@@ -619,41 +619,41 @@ var le = /* @__PURE__ */ new Set([
 	if (t.stalled.length === 0) n.push(`✓  stuck runs: none (${t.examined} live run(s) old enough to examine${t.waitingOnTimer > 0 ? `, ${t.waitingOnTimer} waiting on a durable timer` : ""}${t.alreadyReported > 0 ? `, ${t.alreadyReported} already reported` : ""})`);
 	else {
 		n.push(`✗  stuck runs: ${t.stalled.length} run(s) have made no progress`);
-		for (let e of t.stalled.slice(0, 20)) n.push(`   ${e.tag}  ${e.runId}  idle ${Ze(e.idleMs)}  ${e.reason}`);
+		for (let e of t.stalled.slice(0, 20)) n.push(`   ${e.tag}  ${e.runId}  idle ${Xe(e.idleMs)}  ${e.reason}`);
 		t.stalled.length > 20 && n.push(`   … and ${t.stalled.length - 20} more`), n.push("   Nothing was changed — this is a SUSPICION, not a verdict. `awaiting-signal` usually means the sender never came.");
 	}
 	t.sawFullRunPage && n.push("   (the examined page filled up — more old runs exist than were read this pass)");
 	for (let e of t.failures) n.push(`   ! could not examine ${e.subject}: ${e.detail}`);
 	return n.join("\n");
-}, $e = (e) => x(y(e, "app.config.ts")) || x(y(e, "app.config.js")), P = (e) => {
+}, Qe = (e) => S(b(e, "app.config.ts")) || S(b(e, "app.config.js")), $e = (e) => {
 	let t = p(e), n = f(e);
 	return {
 		root: e,
 		serveBundle: t,
-		serveBundlePresent: x(t),
+		serveBundlePresent: S(t),
 		apiBundle: n,
-		apiBundlePresent: x(n)
+		apiBundlePresent: S(n)
 	};
 }, et = [
 	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
 	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
 	"(Generated Dockerfiles from `voltro create-project` already do this.)"
 ].join("\n  "), tt = (e, t = !1) => {
-	let n = P(e);
-	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !$e(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+	let n = $e(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !Qe(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
 	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
 	let r = process.env.NODE_ENV === "production";
 	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
 	let i = t || r;
 	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${et}`), +!!i;
 }, nt = (e, t, n) => {
-	let r = new Set(e), i = ee(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
+	let r = new Set(e), i = _(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
 		`${e}.js`,
 		`${e}.jsx`,
-		_(e, "index.ts"),
-		_(e, "index.tsx")
+		v(e, "index.ts"),
+		v(e, "index.tsx")
 	]).find((e) => r.has(e)), o = (e) => {
 		let n = (t.get(e) ?? "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), r = [];
 		for (let e of [
@@ -666,13 +666,13 @@ var le = /* @__PURE__ */ new Set([
 		}
 		let o = [];
 		for (let t of r) {
-			let n = t.startsWith(".") ? y(ae(e), t) : te(t, i);
+			let n = t.startsWith(".") ? b(ie(e), t) : ee(t, i);
 			if (n === void 0) continue;
 			let r = a(n);
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => ct.test(v(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => ct.test(y(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -685,7 +685,7 @@ var le = /* @__PURE__ */ new Set([
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), it = (e, t) => (e.match(t) ?? []).length, F = (e, t) => e.getDescendantsOfKind(D.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, at = (e, t) => {
+}, rt = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), it = (e, t) => (e.match(t) ?? []).length, F = (e, t) => e.getDescendantsOfKind(O.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, at = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
 	return n !== t && F(e.file, RegExp(`^${n}Plugin$`)) > 0;
@@ -699,7 +699,7 @@ var le = /* @__PURE__ */ new Set([
 	return n;
 }, st = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
-	return n === void 0 ? [] : e.getDescendantsOfKind(D.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
+	return n === void 0 ? [] : e.getDescendantsOfKind(O.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
 }, ct = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, lt = /\.(query|mutation|action|stream)\.server\.tsx?$/, ut = [
 	"Id",
 	"ID",
@@ -814,16 +814,16 @@ var le = /* @__PURE__ */ new Set([
 		scope: "client",
 		smell: "checking a subscription's `data === undefined` (or `!data`) instead of its `loading` / `idle` flag",
 		use: "branch on `loading` (and `idle` when you pass `skip`) — `loading` narrows `data`, so the settled branch needs no `?? []` and no `!`",
-		match: ({ file: e }) => e.getDescendantsOfKind(D.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
-			let t = e.getFirstAncestorByKind(D.VariableDeclaration)?.getNameNode();
-			return t === void 0 ? [] : T.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
+		match: ({ file: e }) => e.getDescendantsOfKind(O.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
+			let t = e.getFirstAncestorByKind(O.VariableDeclaration)?.getNameNode();
+			return t === void 0 ? [] : E.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
 		}).some((t) => st(e, t).some((e) => {
 			let t = e.getParent();
-			if (T.isBinaryExpression(t)) {
+			if (E.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
 				return /^[!=]==?$/.test(n) && /^(undefined|null)$/.test(r.getText());
 			}
-			return T.isPrefixUnaryExpression(t) && t.getOperatorToken() === D.ExclamationToken;
+			return E.isPrefixUnaryExpression(t) && t.getOperatorToken() === O.ExclamationToken;
 		}))
 	},
 	{
@@ -957,7 +957,7 @@ var le = /* @__PURE__ */ new Set([
 ], pt = (e) => R(e), mt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
-		let t = v(e, r), i = t.split(/[\\/]/)[0];
+		let t = y(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
@@ -965,30 +965,30 @@ var le = /* @__PURE__ */ new Set([
 	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = C(e, { withFileTypes: !0 });
+		r = w(e, { withFileTypes: !0 });
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = _(e, i.name);
+		let r = v(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
 			gt(r, t, n + 1);
-		} else je.test(i.name) && t.push(r);
+		} else Ae.test(i.name) && t.push(r);
 	}
 	return t;
 }, R = (e, t = [], n = 0) => {
 	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = C(e);
+		r = w(e);
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = _(e, i), a;
+		let r = v(e, i), a;
 		try {
-			a = w(r);
+			a = T(r);
 		} catch {
 			continue;
 		}
@@ -999,14 +999,14 @@ var le = /* @__PURE__ */ new Set([
 	if (n > 12 || L.test(e)) return t;
 	let r;
 	try {
-		r = C(e);
+		r = w(e);
 	} catch {
 		return t;
 	}
 	for (let i of r) {
-		let r = _(e, i), a;
+		let r = v(e, i), a;
 		try {
-			a = w(r);
+			a = T(r);
 		} catch {
 			continue;
 		}
@@ -1022,16 +1022,16 @@ var le = /* @__PURE__ */ new Set([
 }, yt = (e) => {
 	let t = pt(e);
 	if (t.length === 0) return [];
-	let n = new E({
+	let n = new D({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
 	}), r = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
 	for (let e of t) try {
-		i.set(e, S(e, "utf8"));
+		i.set(e, C(e, "utf8"));
 	} catch {}
 	let a = nt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
 	for (let t of _t(e)) try {
-		o.set(t, S(t, "utf8"));
+		o.set(t, C(t, "utf8"));
 	} catch {}
 	for (let s of t) {
 		let t = i.get(s);
@@ -1041,7 +1041,7 @@ var le = /* @__PURE__ */ new Set([
 			c = {
 				src: t,
 				file: n.createSourceFile(`/scan${s.endsWith("x") ? ".tsx" : ".ts"}`, t, { overwrite: !0 }),
-				path: v(e, s),
+				path: y(e, s),
 				serverOnly: a.has(s),
 				testSources: o
 			};
@@ -1051,7 +1051,7 @@ var le = /* @__PURE__ */ new Set([
 		for (let t of ft) {
 			if (t.plugin !== void 0 && at(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
-			n.push(v(e, s)), r.set(t.id, n);
+			n.push(y(e, s)), r.set(t.id, n);
 		}
 	}
 	return ft.filter((e) => r.has(e.id)).map((e) => ({
@@ -1075,17 +1075,17 @@ var le = /* @__PURE__ */ new Set([
 }, bt = 3, xt = .2, St = 50, Ct = (e, t) => e >= St && t > 0 && e / t >= xt, wt = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of R(e)) try {
-		t.set(v(e, n), S(n, "utf8"));
+		t.set(y(e, n), C(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
 	for (let t of gt(e)) try {
-		n.set(v(e, t), S(t, "utf8"));
+		n.set(y(e, t), C(t, "utf8"));
 	} catch {}
-	let r = Me({
+	let r = je({
 		sources: t,
 		envFiles: n
 	});
-	r !== void 0 && (console.log(""), console.log(Ne(r)));
+	r !== void 0 && (console.log(""), console.log(Me(r)));
 }, Tt = (e) => {
 	let t = z(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
@@ -1116,37 +1116,39 @@ var le = /* @__PURE__ */ new Set([
 	let n = Ot.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
 }, B = async (e) => {
-	let t = _(e, "src", "pages");
-	if (!x(t)) return [];
+	let t = v(e, "src", "pages");
+	if (!S(t)) return [];
 	let { pages: n, dirs: r } = await l(t), i = [];
 	for (let a of n) {
 		if (!s(r, a.dirChain).some((e) => e.hasLayout)) continue;
 		let n;
 		try {
-			n = S(_(t, a.file), "utf8");
+			n = C(v(t, a.file), "utf8");
 		} catch {
 			continue;
 		}
 		if (c.test(n)) continue;
 		let o = kt(n);
 		o !== null && i.push({
-			file: v(e, _(t, a.file)),
+			file: y(e, v(t, a.file)),
 			pattern: a.pattern,
 			currentMode: o
 		});
 	}
 	return i;
 }, At = 10, jt = async (e) => {
-	if (console.log(""), !x(_(e, "src", "pages"))) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = await B(e);
-	if (t.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
-	console.log(`•  renderMode:'spa' candidates (${t.length} page${t.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of t.slice(0, At)) {
+	console.log("");
+	let t = v(e, "src", "pages");
+	if (!S(t)) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let n = await B(e);
+	if (n.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
+	console.log(`•  renderMode:'spa' candidates (${n.length} page${n.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
+	for (let e of n.slice(0, At)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let n = t.length - At;
-	return n > 0 && console.log(`   (+${n} more page${n === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${Et}`), t.length;
+	let r = n.length - At;
+	return r > 0 && console.log(`   (+${r} more page${r === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${Et}`), n.length;
 }, Mt = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
@@ -1158,60 +1160,60 @@ var le = /* @__PURE__ */ new Set([
 ]), Nt = (e, t, n) => {
 	let r;
 	try {
-		r = C(e, { withFileTypes: !0 });
+		r = w(e, { withFileTypes: !0 });
 	} catch {
 		return;
 	}
 	for (let i of r) {
 		if (Mt.has(i.name)) continue;
-		let r = _(e, i.name);
-		i.isDirectory() ? Nt(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(v(t, r));
+		let r = v(e, i.name);
+		i.isDirectory() ? Nt(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(y(t, r));
 	}
 }, Pt = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
 		try {
-			t = S(_(e, i), "utf8");
+			t = C(v(e, i), "utf8");
 		} catch {
 			continue;
 		}
-		let a = ae(_(e, i));
+		let a = ie(v(e, i));
 		for (let i of t.matchAll(r)) {
-			let t = y(a, i[1]);
+			let t = b(a, i[1]);
 			for (let r of [
 				t,
 				`${t}.tsx`,
 				`${t}.ts`,
-				_(t, "index.tsx"),
-				_(t, "index.ts")
-			]) if (x(r) && w(r).isFile()) {
-				n.add(v(e, r));
+				v(t, "index.tsx"),
+				v(t, "index.ts")
+			]) if (S(r) && T(r).isFile()) {
+				n.add(y(e, r));
 				break;
 			}
 		}
 	}
 	return n;
 }, Ft = (e, t) => {
-	let n = e.slice(t.length).split(b).slice(0, -1)[0];
+	let n = e.slice(t.length).split(x).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
 }, V = (e) => {
-	let t = [], n = _(e, "src", "pages"), r = _(e, "src");
-	if (!x(r)) return t;
+	let t = [], n = v(e, "src", "pages"), r = v(e, "src");
+	if (!S(r)) return t;
 	let i = [];
 	Nt(r, e, i), i.sort();
-	let a = `${v(e, n)}${b}`;
+	let a = `${y(e, n)}${x}`;
 	Pt(e, i);
 	for (let n of i) {
-		let r = n.slice(n.lastIndexOf(b) + 1);
+		let r = n.slice(n.lastIndexOf(x) + 1);
 		if (n.startsWith(a)) {
 			if (r !== "page.tsx") continue;
-			x(_(e, d(n))) || t.push({
+			S(v(e, d(n))) || t.push({
 				kind: "page-without-test",
 				file: n
 			});
 			try {
-				let r = S(_(e, n), "utf8");
+				let r = C(v(e, n), "utf8");
 				!/\bexport\s+(?:const|let|var|function)\s+meta\b/.test(r) && !/\bexport\s*\{[^}]*\bmeta\b/.test(r) && t.push({
 					kind: "page-without-meta",
 					file: n
@@ -1236,16 +1238,18 @@ var le = /* @__PURE__ */ new Set([
 	let r = t.length - It;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
 }, Lt = (e) => {
-	if (console.log(""), !x(_(e, "src", "pages"))) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let t = V(e);
-	if (t.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
-	let n = (e) => t.filter((t) => t.kind === e).map((e) => e.file);
-	return H("will NEVER route — page.tsx outside src/pages/", n("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), H("pages with no test beside them", n("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), H("routes whose FIRST segment is dynamic — they claim every URL of that depth", n("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), H("pages with no `meta` export — they serve the APP name as their title", n("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), t.length;
+	console.log("");
+	let t = v(e, "src", "pages");
+	if (!S(t)) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
+	let n = V(e);
+	if (n.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
+	let r = (e) => n.filter((t) => t.kind === e).map((e) => e.file);
+	return H("will NEVER route — page.tsx outside src/pages/", r("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), H("pages with no test beside them", r("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), H("routes whose FIRST segment is dynamic — they claim every URL of that depth", r("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), H("pages with no `meta` export — they serve the APP name as their title", r("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), n.length;
 }, Rt = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", zt = /* @__PURE__ */ new Map(), U = (e) => {
 	let t = zt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-CAOoXOkc.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-CjJAasDs.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
@@ -1263,7 +1267,7 @@ var le = /* @__PURE__ */ new Set([
 			};
 		});
 		if (i.length === 0) return;
-		t = pe(fe(n, i, e));
+		t = fe(de(n, i, e));
 	} catch {
 		return;
 	}
@@ -1281,19 +1285,19 @@ var le = /* @__PURE__ */ new Set([
 }), W = async (e) => {
 	try {
 		let { discovered: t } = await U(e);
-		return ve(Vt(t.tables));
+		return _e(Vt(t.tables));
 	} catch {
 		return null;
 	}
 }, Ht = async (e) => {
 	let t = await W(e);
 	if (t === null || t.tablesChecked === 0) return;
-	let n = be(t);
+	let n = ye(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
 }, G = async (e) => {
 	try {
 		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await U(e);
-		return we(n.events.map((e) => {
+		return Ce(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
 				name: n.name,
@@ -1308,9 +1312,9 @@ var le = /* @__PURE__ */ new Set([
 }, Ut = async (e) => {
 	let t = await G(e);
 	if (t === null || t.eventsChecked === 0) return;
-	let n = Te(t);
+	let n = we(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
-	let r = Ee(t);
+	let r = Te(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
 }, K = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
@@ -1333,7 +1337,7 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, J = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-CAOoXOkc.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-CjJAasDs.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1343,8 +1347,8 @@ var le = /* @__PURE__ */ new Set([
 		return {
 			checked: !0,
 			defaultDeny: o,
-			undecided: e(s),
-			openAccess: t(s)
+			undecided: t(s),
+			openAccess: e(s)
 		};
 	} catch (e) {
 		return {
@@ -1368,14 +1372,14 @@ var le = /* @__PURE__ */ new Set([
 	console.log("    `guards: [{ scope: '…' }]`                       authority the SUBJECT holds globally"), console.log("    `guards: [{ action, resourceType, resource }]`   authority per ROW / per resource"), console.log("        — backed by `defineResourcePolicy` + a tuple source you register. If your"), console.log("          relationships already live in your own tables (a `teamMembers` row), register"), console.log("          a tuple source over them; nothing is copied. Fail-closed without a resolver."), console.log("          Docs: Authentication → Authorization."), console.log("    `openAccess: '<why anyone may call it>'`         deliberately unauthenticated");
 }, Y = async (e) => {
 	try {
-		let { files: t } = await U(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-CrGAfhIG.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
+		let { files: t } = await U(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-il9ti-HE.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(re(e)));
 		if (a.length === 0) return {
 			checked: !0,
 			unverified: [],
 			open: [],
 			verified: 0
 		};
-		let o = await r(a, ce({ scope: "voltro:doctor" })), s = [], c = [], l = 0;
+		let o = await r(a, se({ scope: "voltro:doctor" })), s = [], c = [], l = 0;
 		for (let e of o.incoming) {
 			let t = i(e.descriptor);
 			t === null ? s.push({
@@ -1413,11 +1417,11 @@ var le = /* @__PURE__ */ new Set([
 	return console.log(""), console.log("  These are public POSTs that run your application code, and `voltro dev` /"), console.log("  `voltro serve` REFUSE to mount them. Declare one of: `provider:` (a preset),"), console.log("  `signature:` (your own HMAC scheme), `verification: 'provider'` (your handler"), console.log("  verifies), or `verification: 'none'` (deliberately public)."), !0;
 }, qt = async (e) => {
 	let { status: t, message: n } = await q(e);
-	return t.checked ? n === void 0 ? !1 : (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, Jt = async (e) => Xe({
+	return t.checked ? n !== void 0 && (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
+}, Jt = async (e) => Ye({
 	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-CAOoXOkc.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-CjJAasDs.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1432,13 +1436,13 @@ var le = /* @__PURE__ */ new Set([
 		return t({ store: e });
 	}
 }), Yt = async (e) => {
-	let t = Qe(await Jt(e));
+	let t = Ze(await Jt(e));
 	t !== null && (console.log(""), console.log(t));
 }, Xt = async (e) => {
 	let t;
 	try {
 		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await U(e);
-		t = ke(r, i.workflows.map((e) => {
+		t = Oe(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
 				optional: []
@@ -1452,18 +1456,18 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return;
 	}
-	let n = Ae(t);
+	let n = ke(t);
 	if (n === null) return;
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
 }, X = "voltro-authz-allowlist.txt", Zt = (e, t = (e) => {
 	try {
-		return S(e, "utf8");
+		return C(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...j, ...Ie(R(e).map(t))]), Qt = (e, t) => {
+}) => /* @__PURE__ */ new Set([...M, ...Fe(R(e).map(t))]), Qt = (e, t) => {
 	let n = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(String.raw`(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*define[A-Za-z]*Event\s*\(\s*\{[^}]*?name\s*:\s*['"\`]${n}['"\`]`, "s").exec(e)?.[1];
 }, Z = async (e) => {
@@ -1475,7 +1479,7 @@ var le = /* @__PURE__ */ new Set([
 		if (n.length === 0) return [];
 		let r = new Set(t.events.map((e) => e.file)), i = (e) => {
 			try {
-				return S(e, "utf8");
+				return C(e, "utf8");
 			} catch {
 				return "";
 			}
@@ -1497,24 +1501,33 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, en = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-CAOoXOkc.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
-		let a = (await import(se(y(e, r)).href))[i];
+		let a = (await import(oe(b(e, r)).href))[i];
 		return Array.isArray(a) ? a.filter((e) => typeof e == "string") : [];
 	} catch {
 		return [];
 	}
 }, Q = async (e) => {
-	let t = {
+	let t = (e) => ({
 		evaluated: !1,
+		notEvaluated: e,
 		vocabularySize: 0,
 		findings: []
-	};
+	});
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-wibtQx-N.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
-		if (l.length === 0) return t;
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-D9qK_gtA.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		if (l.length === 0) {
+			try {
+				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-DgylYh9_.js");
+				await t(e);
+			} catch {
+				return t("app-not-importable");
+			}
+			return t("no-vocabulary");
+		}
 		let u = i({
 			...s,
 			scopes: l
@@ -1530,12 +1543,16 @@ var le = /* @__PURE__ */ new Set([
 			}))
 		};
 	} catch {
-		return t;
+		return t("app-not-importable");
 	}
 }, tn = async (e) => {
-	let { findings: t, evaluated: n } = await Q(e);
+	let { findings: t, evaluated: n, notEvaluated: r } = await Q(e);
 	if (!n) {
-		console.log(""), console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
+		if (console.log(""), r === "app-not-importable") {
+			console.log("•  scope vocabulary: NOT EVALUATED — `app.config.ts` could not be imported."), console.log("   This is not a statement about your scopes: the rule never got to read"), console.log("   them. The commonest cause is a config that demands its environment while"), console.log("   it is evaluated — an auth strategy reading a secret, say — so it imports"), console.log("   inside the container and not on a workstation."), console.log(""), console.log("   Run doctor where that environment exists, or make the config importable"), console.log("   without it. The same import failure is reported above for plugin tables;"), console.log("   both sections have this one cause.");
+			return;
+		}
+		console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
 		return;
 	}
 	if (t.length !== 0) {
@@ -1546,32 +1563,32 @@ var le = /* @__PURE__ */ new Set([
 }, nn = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
-		let t = _(e, i);
-		if (x(t)) try {
-			r = C(t).filter((e) => /\.tsx?$/.test(e) && !e.endsWith(".d.ts")).map((e) => e.replace(/\.tsx?$/, "")), n = i;
+		let t = v(e, i);
+		if (S(t)) try {
+			r = w(t).filter((e) => /\.tsx?$/.test(e) && !e.endsWith(".d.ts")).map((e) => e.replace(/\.tsx?$/, "")), n = i;
 			break;
 		} catch {}
 	}
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CAOoXOkc.js");
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
 	}
-	let a = Pe({
+	let a = Ne({
 		catalogCodes: r,
 		declaredLocales: i
 	});
 	if (a !== void 0) {
 		console.log("");
-		for (let e of Fe(a, n)) console.log(e);
+		for (let e of Pe(a, n)) console.log(e);
 	}
 }, rn = async (e) => {
 	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CAOoXOkc.js");
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -1597,12 +1614,12 @@ var le = /* @__PURE__ */ new Set([
 		...t.mutations,
 		...t.actions,
 		...t.streams ?? []
-	].map((e) => String(e.descriptor.name)), i = Je(n, {
+	].map((e) => String(e.descriptor.name)), i = qe(n, {
 		tables: t.tables.map((e) => e.tableName),
 		rpcTags: r
 	});
 	console.log();
-	for (let e of Ye(n, i)) console.log(e);
+	for (let e of Je(n, i)) console.log(e);
 }, an = /* @__PURE__ */ new Set([
 	"@voltro/plugin-rbac",
 	"@voltro/plugin-audit",
@@ -1641,7 +1658,7 @@ var le = /* @__PURE__ */ new Set([
 }, cn = async (e) => {
 	let { discovered: t } = await U(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
-			n.set(e, S(e, "utf8"));
+			n.set(e, C(e, "utf8"));
 		} catch {
 			n.set(e, "");
 		}
@@ -1678,12 +1695,12 @@ var le = /* @__PURE__ */ new Set([
 			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
 			...a?.table === void 0 ? {} : { table: a.table }
 		};
-	})), s = _(e, X), c = x(s) ? M(S(s, "utf8")) : void 0, l = !1;
+	})), s = v(e, X), c = S(s) ? N(C(s, "utf8")) : void 0, l = !1;
 	for (let t of R(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
 		l = !0;
 		break;
 	}
-	let u = He({
+	let u = Ve({
 		executors: o,
 		guardVocabulary: i,
 		tenantScopedTables: t.tenantScopedTables,
@@ -1703,12 +1720,12 @@ var le = /* @__PURE__ */ new Set([
 }, ln = async (e, t) => {
 	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await cn(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
-	let u = [...r].filter((e) => !j.has(e)).sort();
+	let u = [...r].filter((e) => !M.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
 	let d = new Set(a.map((e) => e.tag)), f = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !d.has(e.tag)).length, p = l.allowlisted - f;
 	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${X})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
-		let e = x(s) ? S(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ke(e, t);
-		return oe(s, Ge(e, t), "utf8"), console.log(`\n${X}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
+		let e = S(s) ? C(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ge(e, t);
+		return ae(s, We(e, t), "utf8"), console.log(`\n${X}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
 	}
 	if (n.unchecked.length === 0) return !1;
 	console.log("");
@@ -1716,30 +1733,30 @@ var le = /* @__PURE__ */ new Set([
 	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${X} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${X}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
 }, un = async (e) => {
 	if (e.includes("--help") || e.includes("-h")) return console.log(Rt), 0;
-	let t = e.includes("--strict"), n = y(e.find((e) => !e.startsWith("-")) ?? process.cwd());
+	let t = e.includes("--strict"), n = e.find((e) => !e.startsWith("-")), s = b(n ?? process.cwd());
 	if (h(e)) return g(), m({
-		...z(n),
-		spaCandidates: await B(n),
-		pageConvention: V(n),
-		fileTaxonomy: re(n).findings,
-		junctionFks: (await W(n))?.issues ?? [],
-		eventDelivery: await G(n),
-		duplicateInstances: a(n),
-		versionSkew: o(n) ?? null,
-		serverOnly: (await q(n)).status,
-		accessDecisions: await J(n),
-		webhookVerification: await Y(n),
-		authz: await sn(n),
-		ungrantedScopes: await Q(n),
-		neverEmittedEvents: await Z(n),
-		stalledRuns: await Jt(n)
+		...z(s),
+		spaCandidates: await B(s),
+		pageConvention: V(s),
+		fileTaxonomy: ne(s).findings,
+		junctionFks: (await W(s))?.issues ?? [],
+		eventDelivery: await G(s),
+		duplicateInstances: a(s),
+		versionSkew: o(s) ?? null,
+		serverOnly: (await q(s)).status,
+		accessDecisions: await J(s),
+		webhookVerification: await Y(s),
+		authz: await sn(s),
+		ungrantedScopes: await Q(s),
+		neverEmittedEvents: await Z(s),
+		stalledRuns: await Jt(s)
 	}), 0;
-	let s = tt(n, t);
-	Tt(n), wt(n), Lt(n), ne(n), await jt(n), await Xt(n), await Yt(n), await Bt(n), await Ht(n), await Ut(n), await rn(n), await tn(n), await $t(n), await nn(n);
-	let c = await qt(n), l = await ln(n, e.includes("--write-authz-allowlist")), u = await Wt(n), d = await Kt(n), f = r(o(n));
-	f !== void 0 && (console.log(""), console.log(f));
-	let p = i(a(n));
-	return p !== void 0 && console.log(`\n${p}`), c || l || u || d ? Math.max(s, 1) : s;
+	let c = tt(s, t);
+	Tt(s), wt(s), Lt(s), te(s), await jt(s), await Xt(s), await Yt(s), await Bt(s), await Ht(s), await Ut(s), await rn(s), await tn(s), await $t(s), await nn(s);
+	let l = await qt(s), u = await ln(s, e.includes("--write-authz-allowlist")), d = await Wt(s), f = await Kt(s), p = r(o(s));
+	p !== void 0 && (console.log(""), console.log(p));
+	let _ = i(a(s));
+	return _ !== void 0 && console.log(`\n${_}`), l || u || d || f ? Math.max(c, 1) : c;
 };
 //#endregion
-export { q as C, B as S, Y as T, jt as _, sn as a, yt as b, G as c, vt as d, P as f, Lt as g, Tt as h, J as i, Zt as l, wt as m, et as n, Z as o, W as p, Et as r, Qt as s, Rt as t, z as u, un as v, Q as w, V as x, tt as y };
+export { q as C, B as S, Y as T, jt as _, sn as a, yt as b, G as c, vt as d, $e as f, Lt as g, Tt as h, J as i, Zt as l, wt as m, et as n, Z as o, W as p, Et as r, Qt as s, Rt as t, z as u, un as v, Q as w, V as x, tt as y };