@voltro/cli 0.42.0 → 0.43.0

package/dist/{doctorCommand-TmZTAepc.js → doctorCommand-Ct_3BHgd.js}

@@ -1,8 +1,8 @@
-import { Bt as e, Ht as t, Vt as n } from "./dev-D4l_YOzI.js";
-import { at as r, it as i, ot as a, s as o, st as s, t as c, w as l, y as u } from "./webDev-Dk8lFUzf.js";
+import { Bt as e, Ht as t, Vt as n } from "./dev-B2rZfqxw.js";
+import { at as r, it as i, ot as a, s as o, st as s, t as c, w as l, y as u } from "./webDev-101csg6Q.js";
 import { w as d } from "./frameworkTableAssembly-oMPBKqlE.js";
 import { n as f } from "./pageConvention-cEiRxdab.js";
-import { r as p, u as m } from "./apiBuild-B_iH24qf.js";
+import { r as p, u as m } from "./apiBuild-DF0f69Gf.js";
 import { n as h, r as g, t as ee } from "./cliOutput-D1tSBoRM.js";
 import { n as _, t as te } from "./tsconfigPaths-BWXBWgcl.js";
 import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
@@ -477,33 +477,33 @@ var le = /* @__PURE__ */ new Set([
 		for (let n of e.problems) t.push(`    • ${n}`);
 	}
 	return e.unreadable.length > 0 && t.push(`… ${e.file}: ${e.unreadable.length} matcher(s) not statically readable (${e.unreadable.join(", ")}) — doctor did NOT check them. The boot still does.`), e.seen === 0 && t.push(`… ${e.file}: no \`defineMiddleware(...)\` found — doctor checked nothing here. A middleware assigned through a variable or re-exported from another module is invisible to this rule.`), t.length === 0 && e.seen > 0 && t.push(`✓ ${e.file}: ${e.seen} middleware(s), matchers resolve and do not overlap`), t;
-}, j = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), M = /* @__PURE__ */ new Set([
+}, j = (e) => e.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), ze = /* @__PURE__ */ new Set([
 	"requireScope",
 	"requireAnyScope",
 	"requireAuth",
 	"assertScope",
 	"assertCan",
 	"can"
-]), ze = (e) => {
+]), Be = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	for (let n of e) for (let e of j(n).matchAll(/\bexport\s+(?:const|function|async\s+function)\s+((?:require|assert)[A-Z]\w*)/g)) t.add(e[1]);
 	return t;
-}, Be = (e, t) => {
+}, Ve = (e, t) => {
 	for (let n of t) if (RegExp(`\\b${n}\\s*\\(`).test(e)) return n;
-}, Ve = (e) => {
+}, He = (e) => {
 	let t = /\bsubject\s*\.\s*id\b[^\n]*?(?:!==|===|!=|==)|(?:!==|===|!=|==)[^\n]*?\bsubject\s*\.\s*id\b/.test(e), n = /(?:Error|Denied|Forbidden|Unauthorized)\b|\b(?:fail|die|throw)\b/.test(e);
 	return t && n;
-}, He = (e, t, n) => {
+}, Ue = (e, t, n) => {
 	if (e.hasDeclaredGuards) return { kind: "declared-guard" };
-	let r = j(e.src), i = Be(r, t);
-	return i === void 0 ? Ve(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
+	let r = j(e.src), i = Ve(r, t);
+	return i === void 0 ? He(r) ? { kind: "inline-ownership" } : n.has(e.tag) ? { kind: "allowlisted" } : { kind: "unchecked" } : {
 		kind: "vocabulary-guard",
 		name: i
 	};
-}, Ue = (e, t, n) => {
+}, We = (e, t, n) => {
 	let r = e.op === "delete" ? 3 : e.op === "update" ? 2 : 1;
 	return e.table !== void 0 && (t.has(e.table) && (r += 2), n.has(e.table) && e.op === "delete" && (r += 2)), r;
-}, We = (e, t, n) => {
+}, Ge = (e, t, n) => {
 	switch (t.kind) {
 		case "declared-guard": return "guards: on the descriptor";
 		case "vocabulary-guard": return `calls ${t.name}()`;
@@ -511,15 +511,15 @@ var le = /* @__PURE__ */ new Set([
 		case "allowlisted": return "accepted by a previous run";
 		case "unchecked": return n ? e.op === "read" ? "no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt" : `${e.op}s${e.table ? ` ${e.table}` : ""} with no check in this file — this app registers a row filter; VERIFY it covers this table, then record it as reviewed= rather than debt` : e.op === "read" ? "returns a row the client selected, with nothing compared to the caller" : `${e.op}s${e.table ? ` ${e.table}` : ""} with nothing constraining WHICH row`;
 	}
-}, Ge = (e) => {
+}, Ke = (e) => {
 	let t = e.executors.map((t) => {
-		let n = He(t, e.guardVocabulary, e.allowlist);
+		let n = Ue(t, e.guardVocabulary, e.allowlist);
 		return {
 			tag: t.tag,
 			path: t.path,
 			verdict: n,
-			severity: Ue(t, e.tenantScopedTables, e.referencedTables),
-			why: We(t, n, e.rowFilterRegistered === !0)
+			severity: We(t, e.tenantScopedTables, e.referencedTables),
+			why: Ge(t, n, e.rowFilterRegistered === !0)
 		};
 	}), n = (e) => t.filter((t) => t.verdict.kind === e).length;
 	return {
@@ -533,7 +533,7 @@ var le = /* @__PURE__ */ new Set([
 		},
 		unchecked: t.filter((e) => e.verdict.kind === "unchecked").sort((e, t) => t.severity - e.severity || e.tag.localeCompare(t.tag))
 	};
-}, Ke = [
+}, qe = [
 	"# voltro doctor — authz allowlist",
 	"#",
 	"# Two KINDS of line, and the difference is the point:",
@@ -558,19 +558,19 @@ var le = /* @__PURE__ */ new Set([
 	"# `--write-authz-allowlist` PRESERVES reviewed= lines. It only ever adds debt",
 	"# lines for executors that are newly unchecked.",
 	""
-], qe = (e) => {
+], Je = (e) => {
 	let t = [...e].map((e) => typeof e == "string" ? { tag: e } : e), n = t.filter((e) => e.reviewed === void 0).map((e) => e.tag).sort(), r = t.filter((e) => e.reviewed !== void 0).sort((e, t) => e.tag.localeCompare(t.tag));
 	return [
-		...Ke,
+		...qe,
 		...n,
 		...r.length > 0 ? ["", "# reviewed — read by a human, open on purpose"] : [],
 		...r.map((e) => `${e.tag}  reviewed=${e.reviewed}`),
 		""
 	].join("\n");
-}, Je = (e, t) => {
+}, Ye = (e, t) => {
 	let n = [...new Set(t)].sort();
-	if (e === void 0) return qe(n.map((e) => ({ tag: e })));
-	let r = N(e).tags, i = n.filter((e) => !r.has(e));
+	if (e === void 0) return Je(n.map((e) => ({ tag: e })));
+	let r = M(e).tags, i = n.filter((e) => !r.has(e));
 	return i.length === 0 ? e : [
 		e.replace(/\n+$/, ""),
 		"",
@@ -579,25 +579,25 @@ var le = /* @__PURE__ */ new Set([
 		...i,
 		""
 	].join("\n");
-}, Ye = (e, t) => {
+}, Xe = (e, t) => {
 	let n = [...new Set(t)];
 	if (e === void 0) return {
 		added: n.length,
 		kept: 0,
 		removed: 0
 	};
-	let r = N(e).tags;
+	let r = M(e).tags;
 	return {
 		added: n.filter((e) => !r.has(e)).length,
 		kept: r.size,
 		removed: 0
 	};
-}, Xe = class extends Error {
+}, Ze = class extends Error {
 	tag;
 	constructor(e) {
 		super(`authz allowlist: '${e}' is marked reviewed with no reason. Write \`${e}  reviewed=<why it is genuinely open>\`. A bare tag is the other, honest option — it records the executor as DEBT, which is what an unexplained exemption is.`), this.tag = e, this.name = "AllowlistReasonMissingError";
 	}
-}, N = (e) => {
+}, M = (e) => {
 	let t = [];
 	for (let n of e.split("\n")) {
 		let e = n.trim();
@@ -610,7 +610,7 @@ var le = /* @__PURE__ */ new Set([
 			continue;
 		}
 		let a = r[2].trim();
-		if (a.length === 0) throw new Xe(i);
+		if (a.length === 0) throw new Ze(i);
 		t.push({
 			tag: i,
 			reviewed: a
@@ -620,13 +620,13 @@ var le = /* @__PURE__ */ new Set([
 		tags: new Set(t.map((e) => e.tag)),
 		entries: t
 	};
-}, Ze = (e) => {
+}, Qe = (e) => {
 	let t = e.indexOf(".");
 	return t <= 0 ? void 0 : e.slice(0, t);
-}, Qe = (e, t) => {
+}, $e = (e, t) => {
 	let n = new Set(t.tables), r = new Set(t.rpcTags), i = /* @__PURE__ */ new Map();
 	for (let e of t.rpcTags) {
-		let t = Ze(e);
+		let t = Qe(e);
 		if (t === void 0) continue;
 		let n = i.get(t);
 		n ? n.push(e) : i.set(t, [e]);
@@ -655,7 +655,7 @@ var le = /* @__PURE__ */ new Set([
 			});
 			continue;
 		}
-		let s = new Set(o.rpcTags.map(Ze).filter((e) => e !== void 0));
+		let s = new Set(o.rpcTags.map(Qe).filter((e) => e !== void 0));
 		for (let e of s) {
 			let t = i.get(e);
 			t !== void 0 && a.push({
@@ -668,12 +668,12 @@ var le = /* @__PURE__ */ new Set([
 		}
 	}
 	return a;
-}, $e = (e, t) => {
+}, et = (e, t) => {
 	let n = e.reduce((e, t) => e + t.tables.length, 0), r = [`plugin surface · ${e.length} plugin(s) contribute ${n} table(s)`];
 	if (t.length === 0) return r.push("  ✓ no overlap with your own tables or rpc namespaces"), r;
 	for (let e of t) r.push(`  ${e.fatal ? "✗" : "⚠"} ${e.plugin} — ${e.detail}`), r.push(`      ${e.fix}`);
 	return r;
-}, et = async (e) => {
+}, tt = async (e) => {
 	if (!await e.hasWorkflows().catch(() => !1)) return { kind: "not-applicable" };
 	let t;
 	try {
@@ -697,12 +697,12 @@ var le = /* @__PURE__ */ new Set([
 	} finally {
 		await t.close().catch(() => {});
 	}
-}, tt = (e) => {
+}, nt = (e) => {
 	let t = Math.round(e / 6e4);
 	if (t < 90) return `${t}m`;
 	let n = Math.round(t / 60);
 	return n < 48 ? `${n}h` : `${Math.round(n / 24)}d`;
-}, nt = (e) => {
+}, rt = (e) => {
 	if (e.kind === "not-applicable") return null;
 	if (e.kind === "skipped") return `•  stuck runs: NOT CHECKED — ${e.reason}\n   This is the one doctor rule that reads the database rather than your source.
    Run it where the app's DB env vars are set, or ignore this line locally.`;
@@ -710,13 +710,13 @@ var le = /* @__PURE__ */ new Set([
 	if (t.stalled.length === 0) n.push(`✓  stuck runs: none (${t.examined} live run(s) old enough to examine${t.waitingOnTimer > 0 ? `, ${t.waitingOnTimer} waiting on a durable timer` : ""}${t.alreadyReported > 0 ? `, ${t.alreadyReported} already reported` : ""})`);
 	else {
 		n.push(`✗  stuck runs: ${t.stalled.length} run(s) have made no progress`);
-		for (let e of t.stalled.slice(0, 20)) n.push(`   ${e.tag}  ${e.runId}  idle ${tt(e.idleMs)}  ${e.reason}`);
+		for (let e of t.stalled.slice(0, 20)) n.push(`   ${e.tag}  ${e.runId}  idle ${nt(e.idleMs)}  ${e.reason}`);
 		t.stalled.length > 20 && n.push(`   … and ${t.stalled.length - 20} more`), n.push("   Nothing was changed — this is a SUSPICION, not a verdict. `awaiting-signal` usually means the sender never came.");
 	}
 	t.sawFullRunPage && n.push("   (the examined page filled up — more old runs exist than were read this pass)");
 	for (let e of t.failures) n.push(`   ! could not examine ${e.subject}: ${e.detail}`);
 	return n.join("\n");
-}, rt = (e) => S(b(e, "app.config.ts")) || S(b(e, "app.config.js")), it = (e) => {
+}, it = (e) => S(b(e, "app.config.ts")) || S(b(e, "app.config.js")), at = (e) => {
 	let t = m(e), n = p(e);
 	return {
 		root: e,
@@ -725,19 +725,22 @@ var le = /* @__PURE__ */ new Set([
 		apiBundle: n,
 		apiBundlePresent: S(n)
 	};
-}, at = [
+}, ot = [
 	"Production `voltro serve` requires a precompiled serve bundle and never transpiles on demand.",
 	"Add a `voltro build .` step BEFORE `voltro serve .` in your Dockerfile / start script.",
 	"(Generated Dockerfiles from `voltro create-project` already do this.)"
-].join("\n  "), ot = (e, t = !1) => {
-	let n = it(e);
-	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !rt(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
+].join("\n  "), st = (e, t = !1) => {
+	let n = at(e);
+	if (console.log(`voltro doctor — serve preflight for ${n.root}`), !it(e)) return console.log("•  no app.config found here — nothing to check (run against an app root)."), 0;
 	console.log(`${n.serveBundlePresent ? "✓" : "✗"}  serve bundle: ${n.serveBundlePresent ? "present" : "MISSING"} (${n.serveBundle})`), console.log(`${n.apiBundlePresent ? "✓" : "•"}  api bundle:   ${n.apiBundlePresent ? "present" : "absent"} (${n.apiBundle})`);
 	let r = process.env.NODE_ENV === "production";
 	if (n.serveBundlePresent) return console.log("✓  serve preflight: ready for `voltro serve`."), 0;
 	let i = t || r;
-	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${at}`), +!!i;
-}, st = (e, t, n) => {
+	return console.error(`${i ? "✗" : "•"}  serve bundle missing — ${i ? "production `voltro serve` will FAIL." : "a non-production `voltro serve` still runs via tsx."}`), console.error(`  ${ot}`), +!!i;
+}, ct = (e) => {
+	let t = e.absPath.replace(/\.server\.(tsx?)$/, ".$1");
+	if (t !== e.absPath) return e.sources.get(t) ?? e.sources.get(t.replace(/\.ts$/, ".tsx"));
+}, lt = (e, t, n) => {
 	let r = new Set(e), i = _(n), a = (e) => (/\.(tsx?|jsx?)$/.test(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
@@ -763,7 +766,7 @@ var le = /* @__PURE__ */ new Set([
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => ft.test(y(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => mt.test(y(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -776,11 +779,11 @@ var le = /* @__PURE__ */ new Set([
 	let d = /* @__PURE__ */ new Set();
 	for (let e of s) l.has(e) || u.has(e) || d.add(e);
 	return d;
-}, P = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), ct = (e, t) => (e.match(t) ?? []).length, F = (e, t) => e.getDescendantsOfKind(O.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, lt = (e, t) => {
+}, N = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1").replace(/'(?:[^'\\\n]|\\.)*'/g, "''").replace(/"(?:[^"\\\n]|\\.)*"/g, "\"\""), ut = (e, t) => (e.match(t) ?? []).length, P = (e, t) => e.getDescendantsOfKind(O.CallExpression).filter((e) => t.test(e.getExpression().getText())).length, dt = (e, t) => {
 	if (e.src.includes(t)) return !0;
 	let n = t.replace(/^@voltro\/plugin-/, "");
-	return n !== t && F(e.file, RegExp(`^${n}Plugin$`)) > 0;
-}, ut = (e, t) => {
+	return n !== t && P(e.file, RegExp(`^${n}Plugin$`)) > 0;
+}, ft = (e, t) => {
 	let n = [], r = RegExp(`\\b${t}\\s*(?:<[^()]*>)?\\s*\\(`, "g"), i;
 	for (; (i = r.exec(e)) !== null;) {
 		let t = i.index + i[0].length, r = 1, a = t;
@@ -788,10 +791,10 @@ var le = /* @__PURE__ */ new Set([
 		n.push(e.slice(t, a - 1));
 	}
 	return n;
-}, dt = (e, t) => {
+}, pt = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
 	return n === void 0 ? [] : e.getDescendantsOfKind(O.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, ft = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, pt = /\.(query|mutation|action|stream)\.server\.tsx?$/, mt = [
+}, mt = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, ht = /\.(query|mutation|action|stream)\.server\.tsx?$/, gt = [
 	"Id",
 	"ID",
 	"Hash",
@@ -817,7 +820,7 @@ var le = /* @__PURE__ */ new Set([
 	"Comment",
 	"Provider",
 	"Format"
-], ht = RegExp(`(?:${mt.join("|")})$|_(?:${mt.map((e) => e.toLowerCase()).join("|")})$`), gt = [
+], _t = RegExp(`(?:${gt.join("|")})$|_(?:${gt.map((e) => e.toLowerCase()).join("|")})$`), vt = [
 	{
 		id: "hardcoded-framework-cookie",
 		scope: "client",
@@ -830,17 +833,22 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => pt.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => ht.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
 		scope: "server",
-		smell: "writes ctx.request.subject.id into the database with no guard on the descriptor — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
-		use: "add a guard (e.g. `.guard(requireScope('…'))`) or an explicit auth check, so an unauthenticated caller is refused BEFORE the write",
-		match: ({ src: e, path: t }) => {
-			if (!pt.test(t)) return !1;
-			let n = P(e);
-			return /\bsubject\s*\.\s*id\b/.test(n) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(n) && !/\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(n);
+		smell: "an openAccess procedure writes ctx.request.subject.id into the database and never checks whose row it is — an anonymous caller reaches the write and gets a raw statement failure instead of a typed refusal",
+		use: "declare `guards:` on the descriptor, or — if the procedure really is open — compare the loaded row's owner against `ctx.request.subject.id` and fail with a typed error",
+		match: (e) => {
+			let { src: t, path: n } = e;
+			if (!ht.test(n)) return !1;
+			let r = N(t);
+			if (!(/\bsubject\s*\.\s*id\b/.test(r) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(r)) || /\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(r) || /[=!]==?\s*[^;\n]*\bsubject\s*\.\s*id\b|\bsubject\s*\.\s*id\b\s*[=!]==/.test(r)) return !1;
+			let i = ct(e);
+			if (i === void 0) return !1;
+			let a = N(i);
+			return /\binternal\s*:\s*true\b/.test(a) || /\bguards\s*:\s*\[/.test(a) || /\.guard\s*\(/.test(a) ? !1 : /\bopenAccess\s*:/.test(a);
 		}
 	},
 	{
@@ -848,14 +856,14 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no traceparent, no retry, and no SSRF guard where the URL is not a constant)",
 		use: "yield* HttpClient — the framework client. It injects traceparent, retries, and honours `http.allowHosts`. Where the URL is built from anything a caller supplied it ALSO blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop — for a hard-coded host that half is redundant, and the first three are still the reason to switch",
-		match: ({ file: e, path: t, serverOnly: n }) => (ft.test(t) || n) && F(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (mt.test(t) || n) && P(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
 		scope: "client",
 		smell: "per-field useState + a submit flag (hand-rolled form)",
 		use: "useFormBinding — fields + validation from the mutation input Schema; server ValidationError({ field }) routes to the field",
-		match: ({ src: e, file: t }) => F(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
+		match: ({ src: e, file: t }) => P(t, /^useState$/) >= 4 && /onSubmit|handleSubmit|isSubmitting/.test(e)
 	},
 	{
 		id: "table",
@@ -883,7 +891,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "client",
 		smell: "useMemo fanning in multiple subscriptions (hand-maintained dep array)",
 		use: "useDerived — dependency-tracked, referentially stable",
-		match: ({ src: e }) => ct(e, /\buseSubscription\s*[(<]/g) >= 3 && ct(e, /\buseMemo\s*\(/g) >= 3
+		match: ({ src: e }) => ut(e, /\buseSubscription\s*[(<]/g) >= 3 && ut(e, /\buseMemo\s*\(/g) >= 3
 	},
 	{
 		id: "next-shim",
@@ -908,7 +916,7 @@ var le = /* @__PURE__ */ new Set([
 		match: ({ file: e }) => e.getDescendantsOfKind(O.CallExpression).filter((e) => /(^|\.)useSubscription$/.test(e.getExpression().getText())).flatMap((e) => {
 			let t = e.getFirstAncestorByKind(O.VariableDeclaration)?.getNameNode();
 			return t === void 0 ? [] : E.isObjectBindingPattern(t) ? t.getElements().filter((e) => (e.getPropertyNameNode() ?? e.getNameNode()).getText() === "data").map((e) => e.getNameNode()) : [];
-		}).some((t) => dt(e, t).some((e) => {
+		}).some((t) => pt(e, t).some((e) => {
 			let t = e.getParent();
 			if (E.isBinaryExpression(t)) {
 				let n = t.getOperatorToken().getText(), r = t.getLeft() === e ? t.getRight() : t.getLeft();
@@ -936,7 +944,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "several sequential store reads assembling related data (an N+1 you are writing by hand)",
 		use: "reads are a parent→child walk on ONE key → relations() in a *.relations.ts + .with({ … }) (ONE JSON-aggregate query, every dialect); reads collect ids from SEVERAL sources → keep the assembly and run the independent leading reads under Effect.all (same queries, same results, only concurrent — zero parity risk)",
-		match: (e) => F(e.file, /\bstore\.query$/) >= 3 || F(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
+		match: (e) => P(e.file, /\bstore\.query$/) >= 3 || P(e.file, /\bstore\.query$/) >= 2 && /\bnew Map\s*\(/.test(e.src)
 	},
 	{
 		id: "store-effect-lift",
@@ -959,7 +967,7 @@ var le = /* @__PURE__ */ new Set([
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || ht.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || _t.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -969,7 +977,7 @@ var le = /* @__PURE__ */ new Set([
 		use: "you cannot look a value up by equality AND encrypt it non-deterministically — `.encrypted()` would make this column unfindable. Store the HASH as the unique lookup key and keep the secret itself either `.encrypted()` in a second column or nowhere (the framework's own `_voltro_api_keys.hashedKey` is the shape: the presented value is hashed and compared, never read back). A deterministic cipher is the other option and buys equality lookup at the cost of leaking which rows share a value",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || ht.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || _t.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1033,9 +1041,9 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "setRowFilter is registered, but no test passes `rowFilter:` to makeTestContext",
 		use: "wire the filter into at least one test (`makeTestContext({ subject, store, rowFilter })`) and sabotage the predicate once to watch it go red — an untested row filter is a visibility rule nothing verifies",
-		match: ({ file: e, testSources: t }) => F(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
-			let t = P(e);
-			return ut(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
+		match: ({ file: e, testSources: t }) => P(e, /^setRowFilter$/) > 0 && ![...t.values()].some((e) => {
+			let t = N(e);
+			return ft(t, "makeTestContext").length > 0 && /\browFilter\b/.test(t);
 		})
 	},
 	{
@@ -1045,15 +1053,15 @@ var le = /* @__PURE__ */ new Set([
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], _t = (e) => L(e), vt = (e, t) => {
+], yt = (e) => I(e), bt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
 		let t = y(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, yt = /\.(tsx?|jsx?)$/, I = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, bt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, xt = (e, t = [], n = 0) => {
-	if (n > 12 || I.test(e)) return t;
+}, xt = /\.(tsx?|jsx?)$/, F = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, St = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Ct = (e, t = [], n = 0) => {
+	if (n > 12 || F.test(e)) return t;
 	let r;
 	try {
 		r = w(e, { withFileTypes: !0 });
@@ -1064,12 +1072,12 @@ var le = /* @__PURE__ */ new Set([
 		let r = v(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
-			xt(r, t, n + 1);
+			Ct(r, t, n + 1);
 		} else je.test(i.name) && t.push(r);
 	}
 	return t;
-}, L = (e, t = [], n = 0) => {
-	if (n > 12 || I.test(e)) return t;
+}, I = (e, t = [], n = 0) => {
+	if (n > 12 || F.test(e)) return t;
 	let r;
 	try {
 		r = w(e);
@@ -1083,11 +1091,11 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? L(r, t, n + 1) : yt.test(i) && !/\.(test|spec)\./.test(i) && !bt.test(i) && t.push(r);
+		a.isDirectory() ? I(r, t, n + 1) : xt.test(i) && !/\.(test|spec)\./.test(i) && !St.test(i) && t.push(r);
 	}
 	return t;
-}, St = (e, t = [], n = 0) => {
-	if (n > 12 || I.test(e)) return t;
+}, wt = (e, t = [], n = 0) => {
+	if (n > 12 || F.test(e)) return t;
 	let r;
 	try {
 		r = w(e);
@@ -1101,17 +1109,17 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? St(r, t, n + 1) : yt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? wt(r, t, n + 1) : xt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
-}, Ct = (e) => {
-	let t = _t(e);
+}, Tt = (e) => {
+	let t = yt(e);
 	return {
-		dirs: vt(e, t),
+		dirs: bt(e, t),
 		fileCount: t.length
 	};
-}, wt = (e) => {
-	let t = _t(e);
+}, Et = (e) => {
+	let t = yt(e);
 	if (t.length === 0) return [];
 	let n = new D({
 		useInMemoryFileSystem: !0,
@@ -1120,8 +1128,8 @@ var le = /* @__PURE__ */ new Set([
 	for (let e of t) try {
 		i.set(e, C(e, "utf8"));
 	} catch {}
-	let a = st([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
-	for (let t of St(e)) try {
+	let a = lt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
+	for (let t of wt(e)) try {
 		o.set(t, C(t, "utf8"));
 	} catch {}
 	for (let s of t) {
@@ -1134,28 +1142,30 @@ var le = /* @__PURE__ */ new Set([
 				file: n.createSourceFile(`/scan${s.endsWith("x") ? ".tsx" : ".ts"}`, t, { overwrite: !0 }),
 				path: y(e, s),
 				serverOnly: a.has(s),
-				testSources: o
+				testSources: o,
+				sources: i,
+				absPath: s
 			};
 		} catch {
 			continue;
 		}
-		for (let t of gt) {
-			if (t.plugin !== void 0 && lt(c, t.plugin) || !t.match(c)) continue;
+		for (let t of vt) {
+			if (t.plugin !== void 0 && dt(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
 			n.push(y(e, s)), r.set(t.id, n);
 		}
 	}
-	return gt.filter((e) => r.has(e.id)).map((e) => ({
+	return vt.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
-}, R = (e) => {
-	let t = Ct(e);
+}, L = (e) => {
+	let t = Tt(e);
 	return {
 		root: e,
 		scannedFiles: t.fileCount,
 		scannedDirs: t.dirs,
-		findings: wt(e).map(({ rule: e, files: t }) => ({
+		findings: Et(e).map(({ rule: e, files: t }) => ({
 			id: e.id,
 			scope: e.scope,
 			smell: e.smell,
@@ -1163,13 +1173,13 @@ var le = /* @__PURE__ */ new Set([
 			files: t
 		}))
 	};
-}, Tt = 3, Et = .2, Dt = 50, Ot = (e, t) => e >= Dt && t > 0 && e / t >= Et, kt = (e) => {
+}, Dt = 3, Ot = .2, kt = 50, At = (e, t) => e >= kt && t > 0 && e / t >= Ot, jt = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	for (let n of L(e)) try {
+	for (let n of I(e)) try {
 		t.set(y(e, n), C(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
-	for (let t of xt(e)) try {
+	for (let t of Ct(e)) try {
 		n.set(y(e, t), C(t, "utf8"));
 	} catch {}
 	let r = Me({
@@ -1177,8 +1187,8 @@ var le = /* @__PURE__ */ new Set([
 		envFiles: n
 	});
 	r !== void 0 && (console.log(""), console.log(Ne(r)));
-}, At = (e) => {
-	let t = R(e);
+}, Mt = (e) => {
+	let t = L(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
 	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
 	console.log(`\u2022  Shipped primitives you may be hand-rolling (scanned ${t.scannedFiles} files across ${t.scannedDirs.join(", ")}):`);
@@ -1189,24 +1199,24 @@ var le = /* @__PURE__ */ new Set([
 		console.log(`   [${e}]`);
 		let i = [...r].sort((e, t) => e.files.length - t.files.length);
 		for (let e of i) {
-			if (Ot(e.files.length, t.scannedFiles)) {
+			if (At(e.files.length, t.scannedFiles)) {
 				let n = Math.round(e.files.length / t.scannedFiles * 100);
 				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s), ${n}% of those scanned: a codebase-wide pattern rather than a work list`), console.log(`     \u2192 ${e.use}`), console.log("     (paths omitted on purpose at this scale — `voltro doctor --json` has every one.)");
 				continue;
 			}
-			let r = e.files.slice(0, Tt).join(", "), i = e.files.length - Tt;
+			let r = e.files.slice(0, Dt).join(", "), i = e.files.length - Dt;
 			i > 0 && (n += i);
 			let a = i > 0 ? `, +${i} more` : "";
 			console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${r}${a}`), console.log(`     \u2192 ${e.use}`);
 		}
 	}
 	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
-}, jt = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", Mt = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, Nt = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, Pt = (e) => {
-	let t = Mt.exec(e)?.[1];
+}, Nt = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", Pt = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, Ft = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, It = (e) => {
+	let t = Pt.exec(e)?.[1];
 	if (t !== void 0) return t === "ssr" ? "ssr" : null;
-	let n = Nt.exec(e)?.[1];
+	let n = Ft.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
-}, z = async (e) => {
+}, R = async (e) => {
 	let t = v(e, "src", "pages");
 	if (!S(t)) return [];
 	let { pages: n, dirs: r } = await u(t), i = [];
@@ -1219,7 +1229,7 @@ var le = /* @__PURE__ */ new Set([
 			continue;
 		}
 		if (c.test(n)) continue;
-		let s = Pt(n);
+		let s = It(n);
 		s !== null && i.push({
 			file: y(e, v(t, a.file)),
 			pattern: a.pattern,
@@ -1227,20 +1237,20 @@ var le = /* @__PURE__ */ new Set([
 		});
 	}
 	return i;
-}, Ft = 10, It = async (e) => {
+}, Lt = 10, Rt = async (e) => {
 	console.log("");
 	let t = v(e, "src", "pages");
 	if (!S(t)) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let n = await z(e);
+	let n = await R(e);
 	if (n.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
 	console.log(`•  renderMode:'spa' candidates (${n.length} page${n.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of n.slice(0, Ft)) {
+	for (let e of n.slice(0, Lt)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let r = n.length - Ft;
-	return r > 0 && console.log(`   (+${r} more page${r === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${jt}`), n.length;
-}, Lt = /* @__PURE__ */ new Set([
+	let r = n.length - Lt;
+	return r > 0 && console.log(`   (+${r} more page${r === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${Nt}`), n.length;
+}, zt = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -1248,7 +1258,7 @@ var le = /* @__PURE__ */ new Set([
 	".vite",
 	".framework",
 	".git"
-]), Rt = (e, t, n) => {
+]), Bt = (e, t, n) => {
 	let r;
 	try {
 		r = w(e, { withFileTypes: !0 });
@@ -1256,11 +1266,11 @@ var le = /* @__PURE__ */ new Set([
 		return;
 	}
 	for (let i of r) {
-		if (Lt.has(i.name)) continue;
+		if (zt.has(i.name)) continue;
 		let r = v(e, i.name);
-		i.isDirectory() ? Rt(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(y(t, r));
+		i.isDirectory() ? Bt(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(y(t, r));
 	}
-}, zt = (e, t) => {
+}, Vt = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
@@ -1285,16 +1295,16 @@ var le = /* @__PURE__ */ new Set([
 		}
 	}
 	return n;
-}, Bt = (e, t) => {
+}, Ht = (e, t) => {
 	let n = e.slice(t.length).split(x).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
-}, B = (e) => {
+}, z = (e) => {
 	let t = [], n = v(e, "src", "pages"), r = v(e, "src");
 	if (!S(r)) return t;
 	let i = [];
-	Rt(r, e, i), i.sort();
+	Bt(r, e, i), i.sort();
 	let a = `${y(e, n)}${x}`;
-	zt(e, i);
+	Vt(e, i);
 	for (let n of i) {
 		let r = n.slice(n.lastIndexOf(x) + 1);
 		if (n.startsWith(a)) {
@@ -1310,7 +1320,7 @@ var le = /* @__PURE__ */ new Set([
 					file: n
 				});
 			} catch {}
-			Bt(n, a) && t.push({
+			Ht(n, a) && t.push({
 				kind: "top-level-dynamic-route",
 				file: n
 			});
@@ -1322,35 +1332,35 @@ var le = /* @__PURE__ */ new Set([
 		});
 	}
 	return t;
-}, Vt = 10, V = (e, t, n) => {
+}, Ut = 10, B = (e, t, n) => {
 	if (t.length === 0) return;
 	console.log(`•  ${e} (${t.length}):`);
-	for (let e of t.slice(0, Vt)) console.log(`   ${e}`);
-	let r = t.length - Vt;
+	for (let e of t.slice(0, Ut)) console.log(`   ${e}`);
+	let r = t.length - Ut;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
-}, Ht = (e) => {
+}, Wt = (e) => {
 	console.log("");
 	let t = v(e, "src", "pages");
 	if (!S(t)) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
-	let n = B(e);
+	let n = z(e);
 	if (n.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
 	let r = (e) => n.filter((t) => t.kind === e).map((e) => e.file);
-	return V("will NEVER route — page.tsx outside src/pages/", r("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), V("pages with no test beside them", r("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), V("routes whose FIRST segment is dynamic — they claim every URL of that depth", r("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), V("pages with no `meta` export — they serve the APP name as their title", r("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), n.length;
-}, Ut = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", Wt = /* @__PURE__ */ new Map(), H = (e) => {
-	let t = Wt.get(e);
+	return B("will NEVER route — page.tsx outside src/pages/", r("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), B("pages with no test beside them", r("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), B("routes whose FIRST segment is dynamic — they claim every URL of that depth", r("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), B("pages with no `meta` export — they serve the APP name as their title", r("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), n.length;
+}, Gt = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", Kt = /* @__PURE__ */ new Map(), V = (e) => {
+	let t = Kt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-DuqBJC7g.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-D0E5x2Ue.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
 		};
 	})();
-	return Wt.set(e, n), n;
-}, Gt = async (e) => {
+	return Kt.set(e, n), n;
+}, qt = async (e) => {
 	let t;
 	try {
-		let { files: n, discovered: r } = await H(e), i = r.tables.map((e) => {
+		let { files: n, discovered: r } = await V(e), i = r.tables.map((e) => {
 			let t = e;
 			return {
 				name: t.tableName,
@@ -1363,7 +1373,7 @@ var le = /* @__PURE__ */ new Set([
 		return;
 	}
 	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
-}, Kt = (e) => e.map((e) => {
+}, Jt = (e) => e.map((e) => {
 	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
 		name: e,
 		type: typeof t?.type == "string" ? t.type : ""
@@ -1373,21 +1383,21 @@ var le = /* @__PURE__ */ new Set([
 		columns: n,
 		primaryKey: t.appliedPrimaryKey ?? []
 	};
-}), U = async (e) => {
+}), H = async (e) => {
 	try {
-		let { discovered: t } = await H(e);
-		return ve(Kt(t.tables));
+		let { discovered: t } = await V(e);
+		return ve(Jt(t.tables));
 	} catch {
 		return null;
 	}
-}, qt = async (e) => {
-	let t = await U(e);
+}, Yt = async (e) => {
+	let t = await H(e);
 	if (t === null || t.tablesChecked === 0) return;
 	let n = be(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
-}, W = async (e) => {
+}, U = async (e) => {
 	try {
-		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await H(e);
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await V(e);
 		return we(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
@@ -1400,19 +1410,19 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return null;
 	}
-}, Jt = async (e) => {
-	let t = await W(e);
+}, Xt = async (e) => {
+	let t = await U(e);
 	if (t === null || t.eventsChecked === 0) return;
 	let n = Te(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
 	let r = Ee(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
-}, G = (e) => {
+}, W = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
 	return r === void 0 ? n : `${r}: ${n}`;
-}, K = async (e) => {
+}, G = async (e) => {
 	try {
-		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await H(e)).discovered.serverOnlyLeaks, r = t(n);
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await V(e)).discovered.serverOnlyLeaks, r = t(n);
 		return {
 			status: {
 				checked: !0,
@@ -1423,12 +1433,12 @@ var le = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return { status: {
 			checked: !1,
-			reason: G(e)
+			reason: W(e)
 		} };
 	}
-}, q = async (r) => {
+}, K = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-DuqBJC7g.js"), { discovered: a } = await H(r), o = n(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-D0E5x2Ue.js"), { discovered: a } = await V(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1444,26 +1454,26 @@ var le = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return {
 			checked: !1,
-			reason: G(e),
+			reason: W(e),
 			defaultDeny: !0,
 			undecided: [],
 			openAccess: []
 		};
 	}
-}, Yt = async (e) => {
-	let t = await q(e);
+}, Zt = async (e) => {
+	let t = await K(e);
 	if (!t.checked) return console.log(""), console.log("•  access decisions: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
 	console.log(""), console.log(`access decisions · security.defaultDeny ${t.defaultDeny ? "ON" : "OFF"}`), console.log(`  ✗ no access decision                    ${String(t.undecided.length).padStart(4)}`), console.log(`  ✓ openAccess, declared on purpose       ${String(t.openAccess.length).padStart(4)}`);
 	for (let e of t.openAccess) console.log(`      ${e.tag} — ${e.openAccess ?? ""}`);
 	if (t.undecided.length === 0) return !1;
 	console.log("");
 	for (let e of t.undecided) console.log(`  ✗ ${e.tag}  (${e.kind})${e.file === void 0 ? "" : `\n      ${e.file}`}`);
-	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), Xt(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), Xt(), !1);
-}, Xt = () => {
+	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), Qt(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), Qt(), !1);
+}, Qt = () => {
 	console.log("    `guards: [{ scope: '…' }]`                       authority the SUBJECT holds globally"), console.log("    `guards: [{ action, resourceType, resource }]`   authority per ROW / per resource"), console.log("        — backed by `defineResourcePolicy` + a tuple source you register. If your"), console.log("          relationships already live in your own tables (a `teamMembers` row), register"), console.log("          a tuple source over them; nothing is copied. Fail-closed without a resolver."), console.log("          Docs: Authentication → Authorization."), console.log("    `openAccess: '<why anyone may call it>'`         deliberately unauthenticated");
-}, J = async (e) => {
+}, q = async (e) => {
 	try {
-		let { files: t } = await H(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-il9ti-HE.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
+		let { files: t } = await V(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-il9ti-HE.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
 		if (a.length === 0) return {
 			checked: !0,
 			unverified: [],
@@ -1490,14 +1500,14 @@ var le = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return {
 			checked: !1,
-			reason: G(e),
+			reason: W(e),
 			unverified: [],
 			open: [],
 			verified: 0
 		};
 	}
-}, Zt = async (e) => {
-	let t = await J(e);
+}, $t = async (e) => {
+	let t = await q(e);
 	if (!t.checked) return console.log(""), console.log("•  webhook verification: NOT CHECKED — the app's webhooks could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
 	if (t.verified + t.open.length + t.unverified.length === 0) return !1;
 	console.log(""), console.log("incoming webhook verification"), console.log(`  ✓ signature / provider verified         ${String(t.verified).padStart(4)}`), console.log(`  ! deliberately public (none)            ${String(t.open.length).padStart(4)}`), console.log(`  ✗ nothing verifies the caller           ${String(t.unverified.length).padStart(4)}`);
@@ -1506,13 +1516,13 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of t.unverified) console.log(`  ✗ ${e.id}\n      ${e.file}`);
 	return console.log(""), console.log("  These are public POSTs that run your application code, and `voltro dev` /"), console.log("  `voltro serve` REFUSE to mount them. Declare one of: `provider:` (a preset),"), console.log("  `signature:` (your own HMAC scheme), `verification: 'provider'` (your handler"), console.log("  verifies), or `verification: 'none'` (deliberately public)."), !0;
-}, Qt = async (e) => {
-	let { status: t, message: n } = await K(e);
+}, en = async (e) => {
+	let { status: t, message: n } = await G(e);
 	return t.checked ? n !== void 0 && (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, $t = async (e) => et({
-	hasWorkflows: async () => (await H(e)).discovered.workflows.length > 0,
+}, tn = async (e) => tt({
+	hasWorkflows: async () => (await V(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-DuqBJC7g.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-D0E5x2Ue.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1526,13 +1536,13 @@ var le = /* @__PURE__ */ new Set([
 		let { sweepStalledRuns: t } = await import("@voltro/workflow");
 		return t({ store: e });
 	}
-}), en = async (e) => {
-	let t = nt(await $t(e));
+}), nn = async (e) => {
+	let t = rt(await tn(e));
 	t !== null && (console.log(""), console.log(t));
-}, tn = async (e) => {
+}, rn = async (e) => {
 	let t;
 	try {
-		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await H(e);
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await V(e);
 		t = ke(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
@@ -1552,18 +1562,18 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, Y = "voltro-authz-allowlist.txt", nn = (e, t = (e) => {
+}, J = "voltro-authz-allowlist.txt", an = (e, t = (e) => {
 	try {
 		return C(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...M, ...ze(L(e).map(t))]), rn = (e, t) => {
+}) => /* @__PURE__ */ new Set([...ze, ...Be(I(e).map(t))]), Y = (e, t) => {
 	let n = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(String.raw`(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*define[A-Za-z]*Event\s*\(\s*\{[^}]*?name\s*:\s*['"\`]${n}['"\`]`, "s").exec(e)?.[1];
 }, X = async (e) => {
 	try {
-		let { discovered: t } = await H(e), n = t.events.map((e) => ({
+		let { discovered: t } = await V(e), n = t.events.map((e) => ({
 			name: e.descriptor.name,
 			file: e.file
 		})).filter((e) => typeof e.name == "string");
@@ -1574,25 +1584,25 @@ var le = /* @__PURE__ */ new Set([
 			} catch {
 				return "";
 			}
-		}, a = L(e).filter((e) => !r.has(e)).map(i).join("\n");
+		}, a = I(e).filter((e) => !r.has(e)).map(i).join("\n");
 		return n.filter(({ name: e, file: t }) => {
 			if (a.includes(e)) return !1;
-			let n = rn(i(t), e);
+			let n = Y(i(t), e);
 			return n === void 0 || !new RegExp(String.raw`\b${n}\b`).test(a);
 		}).map((e) => e.name).sort();
 	} catch {
 		return [];
 	}
-}, an = async (e) => {
+}, on = async (e) => {
 	let t = await X(e);
 	if (t.length !== 0) {
 		console.log(""), console.log(`•  ${t.length} declared event(s) with no emit call site found:`);
 		for (let e of t) console.log(`     ${e}`);
 		console.log(""), console.log("   An event you declare is an event partners can subscribe to. One that"), console.log("   never fires is indistinguishable, from their side, from a broken"), console.log("   endpoint of their own — so they debug your contract instead of"), console.log("   reading it."), console.log("   ADVISORY: this looks for the event name AND the identifier its"), console.log("   declaration binds it to, so `emit(ctx, apiKeyCreated, …)` counts. An"), console.log("   emit through an ASSEMBLED name still reads as missing here.");
 	}
-}, on = async (e) => {
+}, sn = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-DuqBJC7g.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-D0E5x2Ue.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1609,7 +1619,7 @@ var le = /* @__PURE__ */ new Set([
 		findings: []
 	});
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-B2RWrpWi.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await on(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-DBpTSK8d.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await sn(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) {
 			try {
 				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-DgylYh9_.js");
@@ -1636,7 +1646,7 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return t("app-not-importable");
 	}
-}, sn = async (e) => {
+}, cn = async (e) => {
 	let { findings: t, evaluated: n, notEvaluated: r } = await Z(e);
 	if (!n) {
 		if (console.log(""), r === "app-not-importable") {
@@ -1651,7 +1661,7 @@ var le = /* @__PURE__ */ new Set([
 		for (let e of t) console.log(`     ${e.node}${e.file === void 0 ? "" : `  ${e.file}`}`), console.log(`       ${e.detail}`);
 		console.log(""), console.log("   Each of these is uncallable by every user in every role — not"), console.log("   misconfigured, DEAD — and nothing fails at boot to say so. The"), console.log("   usual cause is a typo or a rename that moved one side only."), console.log(`   ${t[0].fix}`);
 	}
-}, cn = async (e) => {
+}, ln = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
 		let t = v(e, i);
@@ -1663,7 +1673,7 @@ var le = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-DuqBJC7g.js");
+		let { loadApiConfig: t } = await import("./dev-D0E5x2Ue.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1676,12 +1686,12 @@ var le = /* @__PURE__ */ new Set([
 		console.log("");
 		for (let e of Fe(a, n)) console.log(e);
 	}
-}, ln = async (e) => {
+}, un = async (e) => {
 	let t = v(e, "src", "pages");
 	if (!S(t)) return !1;
 	let n = [];
 	try {
-		let { walkPagesTree: e } = await import("./webDev-D6QeXw3P.js");
+		let { walkPagesTree: e } = await import("./webDev-BLKBO34K.js");
 		n = (await e(t)).pages.map((e) => e.pattern);
 	} catch {
 		return !1;
@@ -1691,10 +1701,10 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of Re(r)) console.log(e);
 	return r.problems.length > 0;
-}, un = async (e) => {
-	let { discovered: t } = await H(e), n = [];
+}, dn = async (e) => {
+	let { discovered: t } = await V(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-DuqBJC7g.js");
+		let { loadApiConfig: t } = await import("./dev-D0E5x2Ue.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -1707,8 +1717,8 @@ var le = /* @__PURE__ */ new Set([
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: dn.has(r),
-				canAlias: fn.has(r)
+				canDisableTables: fn.has(r),
+				canAlias: pn.has(r)
 			};
 		});
 	} catch {
@@ -1720,18 +1730,18 @@ var le = /* @__PURE__ */ new Set([
 		...t.mutations,
 		...t.actions,
 		...t.streams ?? []
-	].map((e) => String(e.descriptor.name)), i = Qe(n, {
+	].map((e) => String(e.descriptor.name)), i = $e(n, {
 		tables: t.tables.map((e) => e.tableName),
 		rpcTags: r
 	});
 	console.log();
-	for (let e of $e(n, i)) console.log(e);
-}, dn = /* @__PURE__ */ new Set([
+	for (let e of et(n, i)) console.log(e);
+}, fn = /* @__PURE__ */ new Set([
 	"@voltro/plugin-rbac",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-notifications",
 	"aiFlows"
-]), fn = /* @__PURE__ */ new Set([
+]), pn = /* @__PURE__ */ new Set([
 	"aiFlows",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-billing",
@@ -1748,7 +1758,7 @@ var le = /* @__PURE__ */ new Set([
 	"@voltro/plugin-sso-saml",
 	"@voltro/plugin-storage",
 	"@voltro/plugin-versioning"
-]), Q = 20, pn = async (e) => {
+]), Q = 20, mn = async (e) => {
 	let t = await $(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
 	return {
 		executors: t.executorCount,
@@ -1762,14 +1772,14 @@ var le = /* @__PURE__ */ new Set([
 		unchecked: t.result.unchecked
 	};
 }, $ = async (e) => {
-	let { discovered: t } = await H(e), n = /* @__PURE__ */ new Map(), r = (e) => {
+	let { discovered: t } = await V(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
 			n.set(e, C(e, "utf8"));
 		} catch {
 			n.set(e, "");
 		}
 		return n.get(e);
-	}, i = nn(e, r), a = /* @__PURE__ */ new Set();
+	}, i = an(e, r), a = /* @__PURE__ */ new Set();
 	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
 		e && a.add(e.tableName);
@@ -1801,12 +1811,12 @@ var le = /* @__PURE__ */ new Set([
 			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
 			...a?.table === void 0 ? {} : { table: a.table }
 		};
-	})), s = v(e, Y), c = S(s) ? N(C(s, "utf8")) : void 0, l = !1;
-	for (let t of L(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
+	})), s = v(e, J), c = S(s) ? M(C(s, "utf8")) : void 0, l = !1;
+	for (let t of I(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
 		l = !0;
 		break;
 	}
-	let u = Ge({
+	let u = Ke({
 		executors: o,
 		guardVocabulary: i,
 		tenantScopedTables: t.tenantScopedTables,
@@ -1823,46 +1833,46 @@ var le = /* @__PURE__ */ new Set([
 		executorCount: o.length,
 		allowPath: s
 	};
-}, mn = async (e, t) => {
+}, hn = async (e, t) => {
 	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await $(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
-	let u = [...r].filter((e) => !M.has(e)).sort();
+	let u = [...r].filter((e) => !ze.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
 	let d = new Set(a.map((e) => e.tag)), f = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !d.has(e.tag)).length, p = l.allowlisted - f;
-	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${Y})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
-		let e = S(s) ? C(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Ye(e, t);
-		return oe(s, Je(e, t), "utf8"), console.log(`\n${Y}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
+	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${J})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
+		let e = S(s) ? C(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = Xe(e, t);
+		return oe(s, Ye(e, t), "utf8"), console.log(`\n${J}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
 	}
 	if (n.unchecked.length === 0) return !1;
 	console.log("");
 	for (let e of n.unchecked.slice(0, Q)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
-	return n.unchecked.length > Q && console.log(`  … and ${n.unchecked.length - Q} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${Y} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${Y}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, hn = async (e) => {
-	if (e.includes("--help") || e.includes("-h")) return console.log(Ut), 0;
+	return n.unchecked.length > Q && console.log(`  … and ${n.unchecked.length - Q} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${J} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${J}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
+}, gn = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(Gt), 0;
 	let t = e.includes("--strict"), n = e.find((e) => !e.startsWith("-")), o = b(n ?? process.cwd());
 	if (g(e)) return ee(), h({
-		...R(o),
-		spaCandidates: await z(o),
-		pageConvention: B(o),
+		...L(o),
+		spaCandidates: await R(o),
+		pageConvention: z(o),
 		fileTaxonomy: re(o).findings,
-		junctionFks: (await U(o))?.issues ?? [],
-		eventDelivery: await W(o),
+		junctionFks: (await H(o))?.issues ?? [],
+		eventDelivery: await U(o),
 		duplicateInstances: i(o),
 		versionSkew: r(o) ?? null,
-		serverOnly: (await K(o)).status,
-		accessDecisions: await q(o),
-		webhookVerification: await J(o),
-		authz: await pn(o),
+		serverOnly: (await G(o)).status,
+		accessDecisions: await K(o),
+		webhookVerification: await q(o),
+		authz: await mn(o),
 		ungrantedScopes: await Z(o),
 		neverEmittedEvents: await X(o),
-		stalledRuns: await $t(o)
+		stalledRuns: await tn(o)
 	}), 0;
-	let c = ot(o, t);
-	At(o), kt(o), Ht(o), ne(o), await It(o), await tn(o), await en(o), await Gt(o), await qt(o), await Jt(o), await un(o), await sn(o), await an(o), await cn(o);
-	let l = await Qt(o), u = await mn(o, e.includes("--write-authz-allowlist")), d = await Yt(o), f = await Zt(o), p = await ln(o), m = s(r(o));
+	let c = st(o, t);
+	Mt(o), jt(o), Wt(o), ne(o), await Rt(o), await rn(o), await nn(o), await qt(o), await Yt(o), await Xt(o), await dn(o), await cn(o), await on(o), await ln(o);
+	let l = await en(o), u = await hn(o, e.includes("--write-authz-allowlist")), d = await Zt(o), f = await $t(o), p = await un(o), m = s(r(o));
 	m !== void 0 && (console.log(""), console.log(m));
 	let _ = a(i(o));
 	return _ !== void 0 && console.log(`\n${_}`), l || u || d || p || f ? Math.max(c, 1) : c;
 };
 //#endregion
-export { K as C, z as S, J as T, It as _, pn as a, wt as b, W as c, Ct as d, it as f, Ht as g, At as h, q as i, nn as l, kt as m, at as n, X as o, U as p, jt as r, rn as s, Ut as t, R as u, hn as v, Z as w, B as x, ot as y };
+export { G as C, R as S, q as T, Rt as _, mn as a, Et as b, U as c, Tt as d, at as f, Wt as g, Mt as h, K as i, an as l, jt as m, ot as n, X as o, H as p, Nt as r, Y as s, Gt as t, L as u, gn as v, Z as w, z as x, st as y };