@voltro/cli 0.56.0 → 0.57.0

package/dist/{doctorCommand-aR_bFmIi.js → doctorCommand-BrWu67JZ.js}

@@ -1,7 +1,7 @@
-import { Ht as e, Ut as t, Wt as n } from "./dev-Dw263KPu.js";
-import { F as r, Ft as i, Mt as a, Nt as o, Pt as s, S as c, t as l, u } from "./webDev-C53hJdcL.js";
-import { r as d, u as f } from "./apiBuild-Bdaetr37.js";
-import { x as p } from "./frameworkTableAssembly-DNOFXfEQ.js";
+import { Jt as e, Xt as t, Yt as n } from "./dev-DOEJXicj.js";
+import { Bt as r, Lt as i, R as a, Rt as o, S as s, t as c, u as l, zt as u } from "./webDev-BgdkyjP6.js";
+import { r as d, u as f } from "./apiBuild-DDr2aNFd.js";
+import { S as p } from "./frameworkTableAssembly-vfkzuzEo.js";
 import { n as m } from "./pageConvention-CMpfDN6r.js";
 import { n as h, r as g, t as ee } from "./cliOutput-D1tSBoRM.js";
 import { n as _, t as te } from "./tsconfigPaths-BWXBWgcl.js";
@@ -496,12 +496,12 @@ var le = /* @__PURE__ */ new Set([
 }, qe = (e, t) => {
 	let n = ["middleware.ts", "middleware.tsx"].find((t) => S(v(e, t)));
 	if (n === void 0) return;
-	let i = new D({
+	let r = new D({
 		useInMemoryFileSystem: !0,
 		skipAddingFilesFromTsConfig: !0
-	}), a;
+	}), i;
 	try {
-		a = i.createSourceFile(n, C(v(e, n), "utf8"));
+		i = r.createSourceFile(n, C(v(e, n), "utf8"));
 	} catch {
 		return {
 			problems: [],
@@ -511,7 +511,7 @@ var le = /* @__PURE__ */ new Set([
 		};
 	}
 	let o = [], s = [], c = 0;
-	for (let e of a.getVariableDeclarations()) {
+	for (let e of i.getVariableDeclarations()) {
 		let t = e.getInitializerIfKind(O.CallExpression);
 		if (t?.getExpression().getText() !== "defineMiddleware") continue;
 		c += 1;
@@ -535,7 +535,7 @@ var le = /* @__PURE__ */ new Set([
 		});
 	}
 	return {
-		problems: r(o, t).map((e) => e.message),
+		problems: a(o, t).map((e) => e.message),
 		unreadable: s,
 		seen: c,
 		file: n
@@ -863,7 +863,7 @@ var le = /* @__PURE__ */ new Set([
 			r !== void 0 && o.push(r);
 		}
 		return o;
-	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => Ft.test(y(n, e))), l = new Set(c);
+	}, s = /* @__PURE__ */ new Set(), c = e.filter((e) => zt.test(y(n, e))), l = new Set(c);
 	for (; c.length > 0;) {
 		let e = c.shift();
 		if (!s.has(e)) {
@@ -891,7 +891,7 @@ var le = /* @__PURE__ */ new Set([
 }, kt = (e, t) => {
 	let n = t.getSymbol()?.getDeclarations()?.[0];
 	return n === void 0 ? [] : e.getDescendantsOfKind(O.Identifier).filter((e) => e.getSymbol()?.getDeclarations()?.[0] === n);
-}, At = /^(insert|insertMany|insertIgnore|update|updateMany|upsert|delete|deleteMany|hardDelete|patchJson)$/, jt = /^(notify|sendNotification|sendWebhook|dispatchWebhook|sendMail|trigger[A-Z]\w*)$/, Mt = (e, t) => {
+}, At = /^(insert|insertMany|insertIgnore|update|updateMany|upsert|delete|deleteMany|hardDelete|patchJson)$/, jt = /^(notify|sendNotification|sendWebhook|dispatchWebhook|sendMail|trigger)\w*$/, Mt = (e, t) => {
 	if (!E.isObjectLiteralExpression(e)) return;
 	let n = e.getProperty("handler");
 	if (n === void 0 || !E.isPropertyAssignment(n)) return;
@@ -913,17 +913,97 @@ var le = /* @__PURE__ */ new Set([
 		n === "publish" && t.push(RegExp(`^${r}$`)), n === "store" && t.push(RegExp(`^${r}\\.${At.source.replace(/^\^|\$$/g, "")}$`));
 	}
 	return t;
-}, Pt = (e) => e.getDescendantsOfKind(O.CallExpression).filter((e) => e.getExpression().getText() === "defineSubscriber").some((t) => {
+}, Pt = (e, t, n, r = 0, i = /* @__PURE__ */ new Set()) => {
+	let a = e.getDescendantsOfKind(O.CallExpression);
+	for (let e of a) {
+		let t = e.getExpression().getText();
+		if (n.some((e) => e.test(t))) return !0;
+	}
+	if (r >= 2) return !1;
+	for (let e of a) {
+		let a = e.getExpression().getText();
+		if (!/^[A-Za-z_$][\w$]*$/.test(a) || i.has(a)) continue;
+		i.add(a);
+		let o = t.getFunction(a) ?? (() => {
+			let e = t.getVariableDeclaration(a)?.getInitializer();
+			return e !== void 0 && (E.isArrowFunction(e) || E.isFunctionExpression(e)) ? e : void 0;
+		})();
+		if (o !== void 0 && Pt(o, t, [...n, ...Nt(o)], r + 1, i)) return !0;
+	}
+	return !1;
+}, Ft = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of e.values()) {
+		if (!/\bsetRowFilter\s*[<(]/.test(n)) continue;
+		let e = /\btables\s*:\s*\[([^\]]*)\]/.exec(n);
+		if (e !== null) for (let n of e[1].matchAll(/['"`]([A-Za-z_][\w]*)['"`]/g)) t.add(n[1]);
+	}
+	return t;
+}, It = (e) => {
+	if (!/\.(query|stream|mutation|action)\.server\.tsx?$/.test(e.path)) return !1;
+	let t = Ft(e.sources);
+	return t.size === 0 || ![...e.src.matchAll(/\btable\s*:\s*['"`]([A-Za-z_][\w]*)['"`]/g)].map((e) => e[1]).some((e) => t.has(e)) ? !1 : /\b(eq|and|inSet)\s*\(/.test(e.src) || /\bwhere\s*:/.test(e.src);
+}, Lt = (e) => e.getDescendantsOfKind(O.CallExpression).filter((e) => e.getExpression().getText() === "defineSubscriber").some((t) => {
 	let n = t.getArguments()[0];
 	if (n === void 0 || !E.isObjectLiteralExpression(n) || n.getProperty("once") !== void 0) return !1;
 	let r = Mt(n, e);
-	if (r === void 0) return !1;
-	let i = Nt(r);
-	return r.getDescendantsOfKind(O.CallExpression).some((e) => {
-		let t = e.getExpression().getText();
-		return i.some((e) => e.test(t));
-	});
-}), Ft = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, It = /\.(query|mutation|action|stream)\.server\.tsx?$/, Lt = [
+	return r !== void 0 && Pt(r, e, Nt(r));
+}), Rt = (e) => e.getDescendantsOfKind(O.CallExpression).filter((e) => e.getExpression().getText() === "defineSubscriber").filter((e) => {
+	let t = e.getArguments()[0];
+	return t !== void 0 && E.isObjectLiteralExpression(t) && t.getProperty("once") === void 0;
+}).length, zt = /\.(server|cron|workflow\.server|subscribe|reaction|outbox|startup|trigger|webhook|migration|seed)\.tsx?$/, Bt = (e, t) => {
+	let n;
+	try {
+		n = t.createSourceFile("/descriptor-scan.ts", e, { overwrite: !0 });
+	} catch {
+		return;
+	}
+	for (let e of n.getDescendantsOfKind(O.PropertyAssignment)) {
+		if (e.getName() !== "output") continue;
+		let t = e.getInitializer();
+		if (t !== void 0 && E.isCallExpression(t) && /\.Array$/.test(t.getExpression().getText()) && (t = t.getArguments()[0]), t === void 0 || !E.isCallExpression(t) || !/\.Struct$/.test(t.getExpression().getText())) return;
+		let n = t.getArguments()[0];
+		if (n === void 0 || !E.isObjectLiteralExpression(n)) return;
+		let r = [];
+		for (let e of [n, ...n.getDescendantsOfKind(O.ObjectLiteralExpression)]) for (let t of e.getProperties()) if (E.isPropertyAssignment(t) || E.isShorthandPropertyAssignment(t)) r.push(t.getName());
+		else if (E.isSpreadAssignment(t)) return;
+		return r;
+	}
+}, Vt = (e, t) => {
+	let n = [], r = (e) => {
+		e !== void 0 && (E.isObjectLiteralExpression(e) ? n.push(e) : E.isParenthesizedExpression(e) && r(e.getExpression()));
+	};
+	for (let t of e.getDescendantsOfKind(O.ReturnStatement)) r(t.getExpression());
+	for (let t of e.getDescendantsOfKind(O.ArrowFunction)) r(t.getBody());
+	let i = /* @__PURE__ */ new Set();
+	for (let e of n) {
+		let n = [];
+		for (let t of e.getProperties()) if (E.isPropertyAssignment(t) || E.isShorthandPropertyAssignment(t)) n.push(t.getName());
+		else if (E.isSpreadAssignment(t)) return;
+		if (n.some((e) => t.has(e))) for (let e of n) i.add(e);
+	}
+	return [...i];
+}, Ht = (e, t, n) => {
+	let r = RegExp(`\\btable\\(\\s*['"\`]${e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"\`]`);
+	for (let [, i] of t) {
+		if (!r.test(i)) continue;
+		let t;
+		try {
+			t = n.createSourceFile("/entity-scan.ts", i, { overwrite: !0 });
+		} catch {
+			continue;
+		}
+		for (let n of t.getDescendantsOfKind(O.CallExpression)) {
+			if (n.getExpression().getText() !== "table") continue;
+			let [t, r] = n.getArguments();
+			if (t === void 0 || !E.isStringLiteral(t) || t.getLiteralValue() !== e) continue;
+			if (r === void 0 || !E.isObjectLiteralExpression(r)) return;
+			let i = /* @__PURE__ */ new Set();
+			for (let e of r.getProperties()) E.isPropertyAssignment(e) && /\.nullable\s*\(/.test(e.getText()) && i.add(e.getName());
+			return i;
+		}
+	}
+}, Ut = (e) => /\bNullOr\b|\bSchema\.Null\b|\bnullable\s*\(/.test(e), P = /\.(query|mutation|action|stream)\.server\.tsx?$/, Wt = [
 	"Id",
 	"ID",
 	"Hash",
@@ -949,7 +1029,7 @@ var le = /* @__PURE__ */ new Set([
 	"Comment",
 	"Provider",
 	"Format"
-], Rt = RegExp(`(?:${Lt.join("|")})$|_(?:${Lt.map((e) => e.toLowerCase()).join("|")})$`), zt = [
+], Gt = RegExp(`(?:${Wt.join("|")})$|_(?:${Wt.map((e) => e.toLowerCase()).join("|")})$`), Kt = [
 	{
 		id: "hardcoded-framework-cookie",
 		scope: "client",
@@ -962,7 +1042,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "an executor that never names its own descriptor — its input type is hand-written, so it can drift from the contract it implements",
 		use: "import the descriptor and type the input as `ExecutorInput<typeof descriptor>`, so the wire contract and the handler cannot disagree",
-		match: ({ src: e, path: t }) => It.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
+		match: ({ src: e, path: t }) => P.test(t) && !/\bimport\s[^;]*\bfrom\s*['"][^'"]*['"]/.test((e.match(/^\s*import\s[^;]*from\s*['"]\.[^'"]*['"]/gm) ?? []).join("\n"))
 	},
 	{
 		id: "subject-write-no-guard",
@@ -971,7 +1051,7 @@ var le = /* @__PURE__ */ new Set([
 		use: "declare `guards:` on the descriptor, or — if the procedure really is open — compare the loaded row's owner against `ctx.request.subject.id` and fail with a typed error",
 		match: (e) => {
 			let { src: t, path: n } = e;
-			if (!It.test(n)) return !1;
+			if (!P.test(n)) return !1;
 			let r = M(t);
 			if (!(/\bsubject\s*\.\s*id\b/.test(r) && /\b(?:insert|update|upsert|insertMany|updateMany|insertRow|upsertRow|updateManyRow)\s*\(/.test(r)) || /\b(?:guard|guards|requireScope|requireAnyScope|assertCan|assertScope|requireAuth|Unauthenticated)\b/.test(r) || /[=!]==?\s*[^;\n]*\bsubject\s*\.\s*id\b|\bsubject\s*\.\s*id\b\s*[=!]==/.test(r)) return !1;
 			let i = wt(e);
@@ -985,7 +1065,7 @@ var le = /* @__PURE__ */ new Set([
 		scope: "server",
 		smell: "raw fetch() for outbound HTTP on the server (no traceparent, no retry, and no SSRF guard where the URL is not a constant)",
 		use: "yield* HttpClient — the framework client. It injects traceparent, retries, and honours `http.allowHosts`. Where the URL is built from anything a caller supplied it ALSO blocks loopback / RFC-1918 / link-local targets (incl. 169.254.169.254) on the initial request AND every redirect hop — for a hard-coded host that half is redundant, and the first three are still the reason to switch",
-		match: ({ file: e, path: t, serverOnly: n }) => (Ft.test(t) || n) && N(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
+		match: ({ file: e, path: t, serverOnly: n }) => (zt.test(t) || n) && N(e, /^(?:globalThis\.|window\.|self\.)?fetch$/) > 0
 	},
 	{
 		id: "form",
@@ -1103,7 +1183,7 @@ var le = /* @__PURE__ */ new Set([
 		use: ".encrypted() on the column — boot fails loudly if no cipher is configured, so it can never silently persist plaintext (a *Hash column and a vault* handle are NOT plaintext secrets: the hash IS the protection — often a unique lookup key — and the handle only names a secret held elsewhere, so both are skipped)",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Rt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Gt.test(n) || /^vault/i.test(n) || /\.unique\s*\(/.test(e) ? !1 : !/\.encrypted\s*\(/.test(e);
 		}))
 	},
 	{
@@ -1113,15 +1193,60 @@ var le = /* @__PURE__ */ new Set([
 		use: "you cannot look a value up by equality AND encrypt it non-deterministically — `.encrypted()` would make this column unfindable. Store the HASH as the unique lookup key and keep the secret itself either `.encrypted()` in a second column or nowhere (the framework's own `_voltro_api_keys.hashedKey` is the shape: the presented value is hashed and compared, never read back). A deterministic cipher is the other option and buys equality lookup at the cost of leaking which rows share a value",
 		match: ({ src: e }) => e.split("\n").some((e) => [...e.matchAll(/\b([A-Za-z_$][\w$]*)\s*:\s*(?:text|varchar|string|longtext)\s*\(/g)].some((t) => {
 			let n = t[1];
-			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Rt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
+			return !/token|secret|credential|password|apikey|accesskey/i.test(n) || Gt.test(n) || /^vault/i.test(n) ? !1 : /\.unique\s*\(/.test(e) && !/\.encrypted\s*\(/.test(e);
 		}))
 	},
+	{
+		id: "nullable-column-a-mutation-cannot-clear",
+		scope: "server",
+		smell: "a mutation writes a NULLABLE column through an input field that does not accept `null` — the value can be set once and never cleared",
+		use: "declare the field as `Schema.optional(Schema.NullOr(...))` — a column the schema lets be empty needs a wire shape that can say so",
+		match: (e) => {
+			if (!/\.mutation\.tsx?$/.test(e.path)) return !1;
+			let t = /target\s*:\s*\{[^}]*\btable\s*:\s*['"`]([^'"`]+)['"`]/.exec(e.src)?.[1];
+			if (t === void 0) return !1;
+			let n = Ht(t, e.sources, e.file.getProject());
+			if (n === void 0 || n.size === 0) return !1;
+			for (let t of e.file.getDescendantsOfKind(O.PropertyAssignment)) {
+				if (t.getName() !== "input") continue;
+				let e = t.getInitializer();
+				if (e === void 0 || !E.isCallExpression(e) || !/\.Struct$/.test(e.getExpression().getText())) continue;
+				let r = e.getArguments()[0];
+				if (!(r === void 0 || !E.isObjectLiteralExpression(r))) {
+					for (let e of r.getProperties()) if (E.isPropertyAssignment(e) && n.has(e.getName()) && !Ut(e.getText())) return !0;
+				}
+			}
+			return !1;
+		}
+	},
+	{
+		id: "executor-builds-an-undeclared-field",
+		scope: "server",
+		smell: "an executor builds a field its descriptor's `output` does not declare (silently stripped on the way out)",
+		use: "add the field to the descriptor's `output` struct, or stop building it — `output` IS the serializer, so an undeclared key never reaches the caller",
+		match: (e) => {
+			if (!P.test(e.path)) return !1;
+			let t = wt(e);
+			if (t === void 0) return !1;
+			let n = Bt(t, e.file.getProject());
+			if (n === void 0 || n.length === 0) return !1;
+			let r = Vt(e.file, new Set(n));
+			return r === void 0 || r.length === 0 ? !1 : r.some((e) => !n.includes(e));
+		}
+	},
 	{
 		id: "subscriber-effect-without-once",
 		scope: "server",
 		smell: "a *.subscribe.ts handler that WRITES or publishes with no `once:` (it runs on every replica, so the effect repeats once per replica)",
 		use: "once: true on defineSubscriber — one INSERT-wins claim per change, fleet-wide (or `once: (event) => key` for a coarser key). A hand-rolled `insertIgnore` dedupe is this, written out.",
-		match: ({ file: e }) => Pt(e)
+		match: ({ file: e }) => Lt(e)
+	},
+	{
+		id: "row-filter-duplicated-by-hand",
+		scope: "server",
+		smell: "a handler that constrains a table your registered `setRowFilter` already constrains",
+		use: "drop the hand-written predicate — the filter covers the query, the mutation, the stream AND the subscription delivery. Keep it only if this handler must be NARROWER than the filter, and say so in a comment (two identical predicates ANDed are as tight as one, so this is maintenance, not a leak)",
+		match: (e) => It(e)
 	},
 	{
 		id: "mutation-tail-effect",
@@ -1196,14 +1321,14 @@ var le = /* @__PURE__ */ new Set([
 		use: "timestampMs / timestampMsOrNull from @voltro/database/wire in the descriptor's output struct — `output` IS the serializer (it is the rpc success schema), so a Date field declared as timestampMs crosses as epoch ms on its own; declaring Schema.Number describes the WIRE type and leaves nothing to convert",
 		match: ({ src: e }) => /\.(getTime|toISOString)\s*\(\s*\)/.test(e) && /\.map\s*\(|=>\s*\(\{/.test(e) && /\bexport\s+default\b/.test(e)
 	}
-], P = (e) => L(e), Bt = (e, t) => {
+], F = (e) => L(e), qt = (e, t) => {
 	let n = /* @__PURE__ */ new Set();
 	for (let r of t) {
 		let t = y(e, r), i = t.split(/[\\/]/)[0];
 		n.add(i !== void 0 && i !== t ? i : ".");
 	}
 	return [...n].sort();
-}, F = /\.(tsx?|jsx?)$/, I = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Vt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Ht = (e, t = [], n = 0) => {
+}, Jt = /\.(tsx?|jsx?)$/, I = /(^|\/)(node_modules|dist|build|\.framework|\.next|coverage)(\/|$)/, Yt = /(^|[\\/])[^\\/]*\.generated\.[cm]?[jt]sx?$|\.d\.[cm]?ts$/, Xt = (e, t = [], n = 0) => {
 	if (n > 12 || I.test(e)) return t;
 	let r;
 	try {
@@ -1215,7 +1340,7 @@ var le = /* @__PURE__ */ new Set([
 		let r = v(e, i.name);
 		if (i.isDirectory()) {
 			if (i.name.startsWith(".")) continue;
-			Ht(r, t, n + 1);
+			Xt(r, t, n + 1);
 		} else je.test(i.name) && t.push(r);
 	}
 	return t;
@@ -1234,10 +1359,10 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? L(r, t, n + 1) : F.test(i) && !/\.(test|spec)\./.test(i) && !Vt.test(i) && t.push(r);
+		a.isDirectory() ? L(r, t, n + 1) : Jt.test(i) && !/\.(test|spec)\./.test(i) && !Yt.test(i) && t.push(r);
 	}
 	return t;
-}, Ut = (e, t = [], n = 0) => {
+}, Zt = (e, t = [], n = 0) => {
 	if (n > 12 || I.test(e)) return t;
 	let r;
 	try {
@@ -1252,17 +1377,17 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		a.isDirectory() ? Ut(r, t, n + 1) : F.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
+		a.isDirectory() ? Zt(r, t, n + 1) : Jt.test(i) && /\.(test|spec)\./.test(i) && t.push(r);
 	}
 	return t;
-}, Wt = (e) => {
-	let t = P(e);
+}, Qt = (e) => {
+	let t = F(e);
 	return {
-		dirs: Bt(e, t),
+		dirs: qt(e, t),
 		fileCount: t.length
 	};
-}, Gt = (e) => {
-	let t = P(e);
+}, $t = (e) => {
+	let t = F(e);
 	if (t.length === 0) return [];
 	let n = new D({
 		useInMemoryFileSystem: !0,
@@ -1272,7 +1397,7 @@ var le = /* @__PURE__ */ new Set([
 		i.set(e, C(e, "utf8"));
 	} catch {}
 	let a = Tt([...i.keys()], i, e), o = /* @__PURE__ */ new Map();
-	for (let t of Ut(e)) try {
+	for (let t of Zt(e)) try {
 		o.set(t, C(t, "utf8"));
 	} catch {}
 	for (let s of t) {
@@ -1292,23 +1417,34 @@ var le = /* @__PURE__ */ new Set([
 		} catch {
 			continue;
 		}
-		for (let t of zt) {
+		for (let t of Kt) {
 			if (t.plugin !== void 0 && Dt(c, t.plugin) || !t.match(c)) continue;
 			let n = r.get(t.id) ?? [];
 			n.push(y(e, s)), r.set(t.id, n);
 		}
 	}
-	return zt.filter((e) => r.has(e.id)).map((e) => ({
+	return Kt.filter((e) => r.has(e.id)).map((e) => ({
 		rule: e,
 		files: r.get(e.id)
 	})).sort((e, t) => t.files.length - e.files.length || e.rule.id.localeCompare(t.rule.id));
+}, en = (e) => {
+	let t = new D({
+		useInMemoryFileSystem: !0,
+		skipAddingFilesFromTsConfig: !0
+	}), n = 0;
+	for (let r of F(e)) if (/\.subscribe\.tsx?$/.test(r)) try {
+		let e = t.createSourceFile(`/count${r.endsWith("x") ? ".tsx" : ".ts"}`, C(r, "utf8"), { overwrite: !0 });
+		n += Rt(e);
+	} catch {}
+	return n;
 }, R = (e) => {
-	let t = Wt(e);
+	let t = Qt(e);
 	return {
 		root: e,
 		scannedFiles: t.fileCount,
 		scannedDirs: t.dirs,
-		findings: Gt(e).map(({ rule: e, files: t }) => ({
+		subscribersWithoutOnce: en(e),
+		findings: $t(e).map(({ rule: e, files: t }) => ({
 			id: e.id,
 			scope: e.scope,
 			smell: e.smell,
@@ -1316,13 +1452,13 @@ var le = /* @__PURE__ */ new Set([
 			files: t
 		}))
 	};
-}, Kt = 3, qt = .2, Jt = 50, Yt = (e, t) => e >= Jt && t > 0 && e / t >= qt, Xt = (e) => {
+}, tn = 3, nn = .2, rn = 50, an = (e, t) => e >= rn && t > 0 && e / t >= nn, on = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of L(e)) try {
 		t.set(y(e, n), C(n, "utf8"));
 	} catch {}
 	let n = /* @__PURE__ */ new Map();
-	for (let t of Ht(e)) try {
+	for (let t of Xt(e)) try {
 		n.set(y(e, t), C(t, "utf8"));
 	} catch {}
 	let r = Me({
@@ -1330,7 +1466,7 @@ var le = /* @__PURE__ */ new Set([
 		envFiles: n
 	});
 	r !== void 0 && (console.log(""), console.log(Ne(r)));
-}, Zt = (e) => {
+}, sn = (e) => {
 	let t = R(e);
 	if (console.log(""), t.scannedFiles === 0) return console.log(`\u2022  hand-roll scan: no source directories found under ${e}.`), console.log("   Walked the app root recursively (node_modules / dist / .framework pruned). Run `voltro doctor <app>` against an app root."), 0;
 	if (t.findings.length === 0) return console.log(`\u2713  hand-roll scan: ${t.scannedFiles} file${t.scannedFiles === 1 ? "" : "s"} across ${t.scannedDirs.join(", ")} \u2014 no hand-rolled primitives found.`), 0;
@@ -1342,37 +1478,43 @@ var le = /* @__PURE__ */ new Set([
 		console.log(`   [${e}]`);
 		let i = [...r].sort((e, t) => e.files.length - t.files.length);
 		for (let e of i) {
-			if (Yt(e.files.length, t.scannedFiles)) {
+			if (an(e.files.length, t.scannedFiles)) {
 				let n = Math.round(e.files.length / t.scannedFiles * 100);
 				console.log(`   ${e.smell} \u2014 ${e.files.length} file(s), ${n}% of those scanned: a codebase-wide pattern rather than a work list`), console.log(`     \u2192 ${e.use}`), console.log("     (paths omitted on purpose at this scale — `voltro doctor --json` has every one.)");
 				continue;
 			}
-			let r = e.files.slice(0, Kt).join(", "), i = e.files.length - Kt;
+			let r = e.files.slice(0, tn).join(", "), i = e.files.length - tn;
 			i > 0 && (n += i);
 			let a = i > 0 ? `, +${i} more` : "";
 			console.log(`   ${e.smell} \u2014 ${e.files.length} file(s): ${r}${a}`), console.log(`     \u2192 ${e.use}`);
 		}
 	}
-	return n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`), console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
-}, Qt = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", $t = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, en = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, tn = (e) => {
-	let t = $t.exec(e)?.[1];
+	n > 0 && console.log(`   (${n} more file path${n === 1 ? "" : "s"} not shown \u2014 \`voltro doctor --json\` prints every one.)`);
+	let r = t.findings.find((e) => e.id === "subscriber-effect-without-once");
+	if (t.subscribersWithoutOnce > 0) {
+		let e = r?.files.length ?? 0;
+		console.log(`   \u24d8 ${t.subscribersWithoutOnce} subscriber(s) declare no \`once:\`; an effect was found in ${e}. The rule reads each subscriber's OWN file (its handler and the functions that file declares) and does not resolve imports — a write in another module is unexamined, not absent.`);
+	}
+	return console.log("   (See the \"Pick the SERVER primitive\" / \"Pick the CLIENT primitive\" rubrics in AGENTS.md / CLAUDE.md.)"), t.findings.length;
+}, cn = "renderMode:'spa' skips this page's SSR compile while its layout shell still renders server-side — adopt it if the page BODY does not need SSR (internal/authenticated pages); keep 'ssr' if the page content needs SEO or server first-paint.", ln = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, un = /export\s+const\s+dynamic\s*=\s*['"]force-(dynamic|static)['"]/, dn = (e) => {
+	let t = ln.exec(e)?.[1];
 	if (t !== void 0) return t === "ssr" ? "ssr" : null;
-	let n = en.exec(e)?.[1];
+	let n = un.exec(e)?.[1];
 	return n === "dynamic" ? "ssr" : n === "static" ? null : "default";
 }, z = async (e) => {
 	let t = v(e, "src", "pages");
 	if (!S(t)) return [];
-	let { pages: n, dirs: r } = await c(t), i = [];
+	let { pages: n, dirs: r } = await s(t), i = [];
 	for (let a of n) {
-		if (!u(r, a.dirChain).some((e) => e.hasLayout)) continue;
+		if (!l(r, a.dirChain).some((e) => e.hasLayout)) continue;
 		let n;
 		try {
 			n = C(v(t, a.file), "utf8");
 		} catch {
 			continue;
 		}
-		if (l.test(n)) continue;
-		let o = tn(n);
+		if (c.test(n)) continue;
+		let o = dn(n);
 		o !== null && i.push({
 			file: y(e, v(t, a.file)),
 			pattern: a.pattern,
@@ -1380,20 +1522,20 @@ var le = /* @__PURE__ */ new Set([
 		});
 	}
 	return i;
-}, nn = 10, rn = async (e) => {
+}, fn = 10, pn = async (e) => {
 	console.log("");
 	let t = v(e, "src", "pages");
 	if (!S(t)) return console.log("•  spa-candidate scan: no src/pages here — nothing to check (web apps only)."), 0;
 	let n = await z(e);
 	if (n.length === 0) return console.log("✓  spa-candidate scan: no loader-free, layout-backed pages to flag."), 0;
 	console.log(`•  renderMode:'spa' candidates (${n.length} page${n.length === 1 ? "" : "s"} — loader-free, under a layout, currently ssr/default):`);
-	for (let e of n.slice(0, nn)) {
+	for (let e of n.slice(0, fn)) {
 		let t = e.currentMode === "ssr" ? "renderMode:'ssr'" : "default renderMode";
 		console.log(`   ${e.file}  (${e.pattern}) — ${t}`);
 	}
-	let r = n.length - nn;
-	return r > 0 && console.log(`   (+${r} more page${r === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${Qt}`), n.length;
-}, an = /* @__PURE__ */ new Set([
+	let r = n.length - fn;
+	return r > 0 && console.log(`   (+${r} more page${r === 1 ? "" : "s"} not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${cn}`), n.length;
+}, mn = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -1401,7 +1543,7 @@ var le = /* @__PURE__ */ new Set([
 	".vite",
 	".framework",
 	".git"
-]), on = (e, t, n) => {
+]), hn = (e, t, n) => {
 	let r;
 	try {
 		r = w(e, { withFileTypes: !0 });
@@ -1409,11 +1551,11 @@ var le = /* @__PURE__ */ new Set([
 		return;
 	}
 	for (let i of r) {
-		if (an.has(i.name)) continue;
+		if (mn.has(i.name)) continue;
 		let r = v(e, i.name);
-		i.isDirectory() ? on(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(y(t, r));
+		i.isDirectory() ? hn(r, t, n) : i.isFile() && i.name.endsWith(".tsx") && n.push(y(t, r));
 	}
-}, sn = (e, t) => {
+}, gn = (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = /(?:from|import)\s*\(?\s*['"](\.[^'"]*)['"]/g;
 	for (let i of t) {
 		let t;
@@ -1438,16 +1580,16 @@ var le = /* @__PURE__ */ new Set([
 		}
 	}
 	return n;
-}, cn = (e, t) => {
+}, _n = (e, t) => {
 	let n = e.slice(t.length).split(x).slice(0, -1)[0];
 	return n !== void 0 && n.startsWith("[");
 }, B = (e) => {
 	let t = [], n = v(e, "src", "pages"), r = v(e, "src");
 	if (!S(r)) return t;
 	let i = [];
-	on(r, e, i), i.sort();
+	hn(r, e, i), i.sort();
 	let a = `${y(e, n)}${x}`;
-	sn(e, i);
+	gn(e, i);
 	for (let n of i) {
 		let r = n.slice(n.lastIndexOf(x) + 1);
 		if (n.startsWith(a)) {
@@ -1463,7 +1605,7 @@ var le = /* @__PURE__ */ new Set([
 					file: n
 				});
 			} catch {}
-			cn(n, a) && t.push({
+			_n(n, a) && t.push({
 				kind: "top-level-dynamic-route",
 				file: n
 			});
@@ -1475,35 +1617,35 @@ var le = /* @__PURE__ */ new Set([
 		});
 	}
 	return t;
-}, V = 10, H = (e, t, n) => {
+}, vn = 10, V = (e, t, n) => {
 	if (t.length === 0) return;
 	console.log(`•  ${e} (${t.length}):`);
-	for (let e of t.slice(0, V)) console.log(`   ${e}`);
-	let r = t.length - V;
+	for (let e of t.slice(0, vn)) console.log(`   ${e}`);
+	let r = t.length - vn;
 	r > 0 && console.log(`   (+${r} more not shown — \`voltro doctor --json\` prints every one.)`), console.log(`     → ${n}`);
-}, ln = (e) => {
+}, yn = (e) => {
 	console.log("");
 	let t = v(e, "src", "pages");
 	if (!S(t)) return console.log("•  page-convention scan: no src/pages here — nothing to check (web apps only)."), 0;
 	let n = B(e);
 	if (n.length === 0) return console.log("✓  page-convention scan: every route is a page.tsx in its own directory, with a test beside it."), 0;
 	let r = (e) => n.filter((t) => t.kind === e).map((e) => e.file);
-	return H("will NEVER route — page.tsx outside src/pages/", r("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), H("pages with no test beside them", r("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), H("routes whose FIRST segment is dynamic — they claim every URL of that depth", r("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), H("pages with no `meta` export — they serve the APP name as their title", r("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), n.length;
-}, un = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", dn = /* @__PURE__ */ new Map(), U = (e) => {
-	let t = dn.get(e);
+	return V("will NEVER route — page.tsx outside src/pages/", r("suffixed-outside-pages"), "the name says \"route\", the location says otherwise, and the location wins: the URL comes from the directory chain under src/pages/. Move it into the directory whose route it serves, or rename it."), V("pages with no test beside them", r("page-without-test"), "a page and its test belong together — `users/[id].page.tsx` → `users/[id].page.test.tsx`. Advisory only; a missing test is a gap, not a defect."), V("routes whose FIRST segment is dynamic — they claim every URL of that depth", r("top-level-dynamic-route"), "a route like `[id]/[code]` answers `/api/health`, `/internal/readiness` and anything else with that many segments on this origin. That is what the pattern means, so it is not a bug — but it is invisible until something requests such a URL, and then the page renders, its loader runs, and the failure reads as an application error rather than as a route claiming a path nobody meant it to. Give the route a literal first segment (`scan/[id]/[code]`) if you did not intend to own the whole origin at that depth. Advisory."), V("pages with no `meta` export — they serve the APP name as their title", r("page-without-meta"), "a page with no `meta` sets no title, so the response carries `<title>{your app.config name}</title>` — the same string on every such page, to every reader that does not run JavaScript: link previews, crawlers, a bookmark taken before hydration, a screen reader announcing the document. The client router fixes the tab after hydration, which is exactly why this is easy to miss. Add `export const meta = { title: \"…\" }` (or a function of params/loaderData). If such a page also has no real body — it redirects from an effect, say — the missing title is the symptom rather than the bug: on an `ssr` route the server answers 200 with an empty document and the redirect happens only once JavaScript runs. Move it into the loader (`redirect(...)`, a real 303). Advisory."), n.length;
+}, bn = "voltro doctor [app] [flags]\n\nPreflight an app root: verify it can boot under production `voltro serve`,\nreport shipped primitives the source looks to be hand-rolling, and flag pages\nthat are safe `renderMode:'spa'` candidates.\n\nArguments:\n  [app]        App directory to check (default: the current directory).\n\nFlags:\n  --strict     Treat a missing serve bundle as blocking regardless of NODE_ENV\n               (the `voltro serve --preflight` behavior). Without it, a missing\n               bundle only fails when NODE_ENV=production.\n  --json       Print the complete scan as JSON — hand-roll findings AND spa\n               candidates, every file path, nothing elided. Skips the preflight output.\n  --write-authz-allowlist\n               Record today's executors that reference NO access check into\n               voltro-authz-allowlist.txt, so every later run fails only on\n               ADDITIONS. The list is DEBT, not approval — an entry stops\n               mattering as soon as its executor gains a guard.\n  -h, --help   Print this help.", xn = /* @__PURE__ */ new Map(), H = (e) => {
+	let t = xn.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-B9Gz0k85.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-Bl9HqtV7.js"), r = await t(e);
 		return {
 			files: r,
-			discovered: await n(r)
+			discovered: await n(r, { root: e })
 		};
 	})();
-	return dn.set(e, n), n;
-}, fn = async (e) => {
+	return xn.set(e, n), n;
+}, Sn = async (e) => {
 	let t;
 	try {
-		let { files: n, discovered: r } = await U(e), i = r.tables.map((e) => {
+		let { files: n, discovered: r } = await H(e), i = r.tables.map((e) => {
 			let t = e;
 			return {
 				name: t.tableName,
@@ -1516,7 +1658,7 @@ var le = /* @__PURE__ */ new Set([
 		return;
 	}
 	t !== null && (console.log(""), console.log(`${t.includes("does not exist") ? "✗" : "✓"}  ${t}`));
-}, pn = (e) => e.map((e) => {
+}, Cn = (e) => e.map((e) => {
 	let t = e, n = Object.entries(t.fields ?? {}).map(([e, t]) => ({
 		name: e,
 		type: typeof t?.type == "string" ? t.type : ""
@@ -1526,13 +1668,13 @@ var le = /* @__PURE__ */ new Set([
 		columns: n,
 		primaryKey: t.appliedPrimaryKey ?? []
 	};
-}), mn = async (e) => {
+}), wn = async (e) => {
 	try {
-		let { missingRelationSources: t } = await import("./doctorSourceRelations-c5mlN5HI.js"), { sourceKeys: n } = await import("@voltro/protocol"), { readFile: r } = await import("node:fs/promises"), { discovered: i } = await U(e), a = [], o = [];
+		let { missingRelationSources: t } = await import("./doctorSourceRelations-c5mlN5HI.js"), { sourceKeys: n } = await import("@voltro/protocol"), { readFile: r } = await import("node:fs/promises"), { discovered: i } = await H(e), a = [], o = [];
 		for (let e of i.queries) {
 			let i = n(e.descriptor.source);
 			if (i.length === 0) continue;
-			let s = hn(e.file);
+			let s = Tn(e.file);
 			if (s === void 0) continue;
 			let c = await r(s, "utf8").catch(() => null);
 			if (c === null) continue;
@@ -1549,8 +1691,8 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return null;
 	}
-}, hn = (e) => e.endsWith(".ts") && !e.endsWith(".server.ts") ? `${e.slice(0, -3)}.server.ts` : void 0, gn = async (e) => {
-	let t = await mn(e);
+}, Tn = (e) => e.endsWith(".ts") && !e.endsWith(".server.ts") ? `${e.slice(0, -3)}.server.ts` : void 0, En = async (e) => {
+	let t = await wn(e);
 	if (t === null) return;
 	let n = t.findings;
 	if (n.length > 0) {
@@ -1563,21 +1705,21 @@ var le = /* @__PURE__ */ new Set([
 		for (let e of t.unresolved) console.log(`   ${e.procedure}: ${e.relations.map((e) => `\`${e}\``).join(", ")} resolved against no table`);
 		console.log("   declare the base table in `source:` and re-run — relations under it are unchecked until then.");
 	}
-}, W = async (e) => {
+}, U = async (e) => {
 	try {
-		let { discovered: t } = await U(e);
-		return ve(pn(t.tables));
+		let { discovered: t } = await H(e);
+		return ve(Cn(t.tables));
 	} catch {
 		return null;
 	}
-}, _n = async (e) => {
-	let t = await W(e);
+}, Dn = async (e) => {
+	let t = await U(e);
 	if (t === null || t.tablesChecked === 0) return;
 	let n = be(t);
 	n !== null && (console.log(""), console.log(`${t.issues.length > 0 ? "✗" : "✓"}  ${n}`));
-}, G = async (e) => {
+}, W = async (e) => {
 	try {
-		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await U(e);
+		let { payloadPropertyNames: t } = await import("@voltro/runtime"), { discovered: n } = await H(e);
 		return we(n.events.map((e) => {
 			let n = e.descriptor, r = t(n.key);
 			return {
@@ -1590,19 +1732,19 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return null;
 	}
-}, vn = async (e) => {
-	let t = await G(e);
+}, On = async (e) => {
+	let t = await W(e);
 	if (t === null || t.eventsChecked === 0) return;
 	let n = Te(t);
 	n !== null && (console.log(""), console.log(`•  ${n}`));
 	let r = Ee(t);
 	r !== null && (console.log(""), console.log(`⚠️  ${r}`));
-}, K = (e) => {
+}, G = (e) => {
 	let t = e, n = typeof t?.message == "string" && t.message !== "" ? t.message : String(e), r = typeof t?.code == "string" ? t.code : void 0;
 	return r === void 0 ? n : `${r}: ${n}`;
-}, q = async (e) => {
+}, K = async (e) => {
 	try {
-		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await U(e)).discovered.serverOnlyLeaks, r = t(n);
+		let { formatServerOnlyLeaks: t } = await import("@voltro/runtime"), n = (await H(e)).discovered.serverOnlyLeaks, r = t(n);
 		return {
 			status: {
 				checked: !0,
@@ -1613,12 +1755,12 @@ var le = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return { status: {
 			checked: !1,
-			reason: K(e)
+			reason: G(e)
 		} };
 	}
-}, J = async (r) => {
+}, q = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-B9Gz0k85.js"), { discovered: a } = await U(r), o = t(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-Bl9HqtV7.js"), { discovered: a } = await H(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1628,32 +1770,32 @@ var le = /* @__PURE__ */ new Set([
 		return {
 			checked: !0,
 			defaultDeny: o,
-			undecided: n(s),
+			undecided: t(s),
 			openAccess: e(s)
 		};
 	} catch (e) {
 		return {
 			checked: !1,
-			reason: K(e),
+			reason: G(e),
 			defaultDeny: !0,
 			undecided: [],
 			openAccess: []
 		};
 	}
-}, yn = async (e) => {
-	let t = await J(e);
+}, kn = async (e) => {
+	let t = await q(e);
 	if (!t.checked) return console.log(""), console.log("•  access decisions: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
 	console.log(""), console.log(`access decisions · security.defaultDeny ${t.defaultDeny ? "ON" : "OFF"}`), console.log(`  ✗ no access decision                    ${String(t.undecided.length).padStart(4)}`), console.log(`  ✓ openAccess, declared on purpose       ${String(t.openAccess.length).padStart(4)}`);
 	for (let e of t.openAccess) console.log(`      ${e.tag} — ${e.openAccess ?? ""}`);
 	if (t.undecided.length === 0) return !1;
 	console.log("");
 	for (let e of t.undecided) console.log(`  ✗ ${e.tag}  (${e.kind})${e.file === void 0 ? "" : `\n      ${e.file}`}`);
-	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), bn(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), bn(), !1);
-}, bn = () => {
+	return console.log(""), t.defaultDeny ? (console.log("  `voltro dev` and `voltro serve` REFUSE to boot on these. Give each a decision:"), An(), !0) : (console.log("  This app sets `security: { defaultDeny: false }`, so these BOOT — and each one is"), console.log("  callable by any authenticated session. Advisory here for that reason only."), An(), !1);
+}, An = () => {
 	console.log("    `guards: [{ scope: '…' }]`                       authority the SUBJECT holds globally"), console.log("    `guards: [{ action, resourceType, resource }]`   authority per ROW / per resource"), console.log("        — backed by `defineResourcePolicy` + a tuple source you register. If your"), console.log("          relationships already live in your own tables (a `teamMembers` row), register"), console.log("          a tuple source over them; nothing is copied. Fail-closed without a resolver."), console.log("          Docs: Authentication → Authorization."), console.log("    `openAccess: '<why anyone may call it>'`         deliberately unauthenticated");
-}, Y = async (e) => {
+}, J = async (e) => {
 	try {
-		let { files: t } = await U(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-il9ti-HE.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
+		let { files: t } = await H(e), { WEBHOOK_PATTERN: n, loadWebhookFiles: r } = await import("./webhookDiscovery-il9ti-HE.js"), { incomingWebhookVerification: i } = await import("@voltro/plugin-webhooks"), a = t.filter((e) => n.test(ie(e)));
 		if (a.length === 0) return {
 			checked: !0,
 			unverified: [],
@@ -1680,14 +1822,14 @@ var le = /* @__PURE__ */ new Set([
 	} catch (e) {
 		return {
 			checked: !1,
-			reason: K(e),
+			reason: G(e),
 			unverified: [],
 			open: [],
 			verified: 0
 		};
 	}
-}, xn = async (e) => {
-	let t = await Y(e);
+}, jn = async (e) => {
+	let t = await J(e);
 	if (!t.checked) return console.log(""), console.log("•  webhook verification: NOT CHECKED — the app's webhooks could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), !1;
 	if (t.verified + t.open.length + t.unverified.length === 0) return !1;
 	console.log(""), console.log("incoming webhook verification"), console.log(`  ✓ signature / provider verified         ${String(t.verified).padStart(4)}`), console.log(`  ! deliberately public (none)            ${String(t.open.length).padStart(4)}`), console.log(`  ✗ nothing verifies the caller           ${String(t.unverified.length).padStart(4)}`);
@@ -1696,13 +1838,13 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of t.unverified) console.log(`  ✗ ${e.id}\n      ${e.file}`);
 	return console.log(""), console.log("  These are public POSTs that run your application code, and `voltro dev` /"), console.log("  `voltro serve` REFUSE to mount them. Declare one of: `provider:` (a preset),"), console.log("  `signature:` (your own HMAC scheme), `verification: 'provider'` (your handler"), console.log("  verifies), or `verification: 'none'` (deliberately public)."), !0;
-}, Sn = async (e) => {
-	let { status: t, message: n } = await q(e);
+}, Mn = async (e) => {
+	let { status: t, message: n } = await K(e);
 	return t.checked ? n !== void 0 && (console.log(""), console.log(`✗  [serverOnly] ${n}`), !0) : (console.log(""), console.log("•  serverOnly: NOT CHECKED — the app's descriptors could not be loaded (not a pass)"), console.log(`   reason: ${t.reason ?? "unknown"}`), console.log("   This audit is the automated check that a hash or a token cannot reach the wire, so"), console.log("   an app that leans on `.serverOnly()` should treat a persistent skip as a failure."), console.log("   `voltro doctor --json` reports it as `serverOnly.checked: false` for a CI gate."), !1);
-}, Cn = async (e) => ft({
-	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
+}, Nn = async (e) => ft({
+	hasWorkflows: async () => (await H(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-B9Gz0k85.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-Bl9HqtV7.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1716,13 +1858,13 @@ var le = /* @__PURE__ */ new Set([
 		let { sweepStalledRuns: t } = await import("@voltro/workflow");
 		return t({ store: e });
 	}
-}), wn = async (e) => {
-	let t = mt(await Cn(e));
+}), Pn = async (e) => {
+	let t = mt(await Nn(e));
 	t !== null && (console.log(""), console.log(t));
-}, Tn = async (e) => {
+}, Fn = async (e) => {
 	let t;
 	try {
-		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await U(e);
+		let { payloadPropertyNames: n } = await import("@voltro/runtime"), { files: r, discovered: i } = await H(e);
 		t = ke(r, i.workflows.map((e) => {
 			let t = e.definition, r = t.payloadSchema === void 0 ? {
 				required: [],
@@ -1742,18 +1884,18 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	let r = t.issues.length > 0 ? "✗" : t.unchecked.length > 0 ? "•" : "✓";
 	console.log(`${r}  ${n}`);
-}, X = "voltro-authz-allowlist.txt", En = (e, t = (e) => {
+}, Y = "voltro-authz-allowlist.txt", In = (e, t = (e) => {
 	try {
 		return C(e, "utf8");
 	} catch {
 		return "";
 	}
-}) => /* @__PURE__ */ new Set([...Xe, ...Ze(L(e).map(t))]), Dn = (e, t) => {
+}) => /* @__PURE__ */ new Set([...Xe, ...Ze(L(e).map(t))]), X = (e, t) => {
 	let n = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	return new RegExp(String.raw`(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*define[A-Za-z]*Event\s*\(\s*\{[^}]*?name\s*:\s*['"\`]${n}['"\`]`, "s").exec(e)?.[1];
 }, Z = async (e) => {
 	try {
-		let { discovered: t } = await U(e), n = t.events.map((e) => ({
+		let { discovered: t } = await H(e), n = t.events.map((e) => ({
 			name: e.descriptor.name,
 			file: e.file
 		})).filter((e) => typeof e.name == "string");
@@ -1767,22 +1909,22 @@ var le = /* @__PURE__ */ new Set([
 		}, a = L(e).filter((e) => !r.has(e)).map(i).join("\n");
 		return n.filter(({ name: e, file: t }) => {
 			if (a.includes(e)) return !1;
-			let n = Dn(i(t), e);
+			let n = X(i(t), e);
 			return n === void 0 || !new RegExp(String.raw`\b${n}\b`).test(a);
 		}).map((e) => e.name).sort();
 	} catch {
 		return [];
 	}
-}, On = async (e) => {
+}, Ln = async (e) => {
 	let t = await Z(e);
 	if (t.length !== 0) {
 		console.log(""), console.log(`•  ${t.length} declared event(s) with no emit call site found:`);
 		for (let e of t) console.log(`     ${e}`);
 		console.log(""), console.log("   An event you declare is an event partners can subscribe to. One that"), console.log("   never fires is indistinguishable, from their side, from a broken"), console.log("   endpoint of their own — so they debug your contract instead of"), console.log("   reading it."), console.log("   ADVISORY: this looks for the event name AND the identifier its"), console.log("   declaration binds it to, so `emit(ctx, apiKeyCreated, …)` counts. An"), console.log("   emit through an ASSEMBLED name still reads as missing here.");
 	}
-}, kn = async (e) => {
+}, Rn = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-B9Gz0k85.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-Bl9HqtV7.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1799,10 +1941,10 @@ var le = /* @__PURE__ */ new Set([
 		findings: []
 	});
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-D0QV_zM_.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-CFmFKHb2.js"), o = await n(e), s = r(o.manifest, o.tables), c = await kn(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-BISqx1OJ.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-CFmFKHb2.js"), o = await n(e), s = r(o.manifest, o.tables), c = await Rn(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) {
 			try {
-				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-CGNC0qr7.js");
+				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-B96WCNJA.js");
 				await t(e);
 			} catch {
 				return t("app-not-importable");
@@ -1826,7 +1968,7 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return t("app-not-importable");
 	}
-}, An = async (e) => {
+}, zn = async (e) => {
 	let { findings: t, evaluated: n, notEvaluated: r } = await Q(e);
 	if (!n) {
 		if (console.log(""), r === "app-not-importable") {
@@ -1841,7 +1983,7 @@ var le = /* @__PURE__ */ new Set([
 		for (let e of t) console.log(`     ${e.node}${e.file === void 0 ? "" : `  ${e.file}`}`), console.log(`       ${e.detail}`);
 		console.log(""), console.log("   Each of these is uncallable by every user in every role — not"), console.log("   misconfigured, DEAD — and nothing fails at boot to say so. The"), console.log("   usual cause is a typo or a rename that moved one side only."), console.log(`   ${t[0].fix}`);
 	}
-}, jn = (e) => {
+}, Bn = (e) => {
 	let t = v(e, "src");
 	if (!S(t)) return;
 	let n = [], r = (t, i = 0) => {
@@ -1877,7 +2019,7 @@ var le = /* @__PURE__ */ new Set([
 		console.log("");
 		for (let e of i) console.log(e);
 	}
-}, Mn = async (e) => {
+}, Vn = async (e) => {
 	let t = ["src/locales", "locales"], n, r = [];
 	for (let i of t) {
 		let t = v(e, i);
@@ -1889,7 +2031,7 @@ var le = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-B9Gz0k85.js");
+		let { loadApiConfig: t } = await import("./dev-Bl9HqtV7.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1902,7 +2044,7 @@ var le = /* @__PURE__ */ new Set([
 		console.log("");
 		for (let e of Ge(a, n)) console.log(e);
 	}
-}, Nn = async (e) => {
+}, Hn = async (e) => {
 	let t = v(e, "src");
 	if (!S(t)) return;
 	let n = !1, r = (e) => {
@@ -1921,9 +2063,9 @@ var le = /* @__PURE__ */ new Set([
 		return;
 	}
 	a()?.reason === "binary-missing" ? (console.log("image pipeline: sharp is INSTALLED but its platform binary is missing —"), console.log("  an install that omitted optional dependencies drops the @img/* prebuilds."), console.log("  Fix: reinstall without omitting optional deps, or `pnpm add -D sharp` in this app.")) : (console.log("image pipeline: sharp is NOT installed — ?image imports serve originals (no srcSet, no blur)."), console.log("  Fix: `pnpm add -D sharp` in this app (it is an optional dependency of @voltro/cli;"), console.log("  your installer skipped optional dependencies)."));
-}, Pn = async (e) => {
+}, Un = async (e) => {
 	try {
-		let { loadConfig: t } = await import("./webDev-C2dRz9s5.js"), n = (await t(e, { preferSource: !0 }))?.fonts;
+		let { loadConfig: t } = await import("./webDev-B6ZMX42w.js"), n = (await t(e, { preferSource: !0 }))?.fonts;
 		if (n === void 0 || n.length === 0) return;
 		let { loadFontkit: r, loadSubsetFont: i } = await import("./fontPipeline-LxIHa1vo.js"), a = [];
 		if (await r() === null && a.push("fontkit (size-adjust fallback metrics — the CLS guard — are skipped)"), await i() === null && a.push("subset-font (declared `subsets:` ship the full files)"), console.log(""), a.length === 0) {
@@ -1933,12 +2075,12 @@ var le = /* @__PURE__ */ new Set([
 		for (let e of a) console.log(`font pipeline: ${e}`);
 		console.log("  Fix: reinstall without omitting optional deps, or `pnpm add -D fontkit subset-font` in this app.");
 	} catch {}
-}, Fn = async (e) => {
+}, Wn = async (e) => {
 	let t = v(e, "src", "pages");
 	if (!S(t)) return !1;
 	let n = [];
 	try {
-		let { walkPagesTree: e } = await import("./webDev-C2dRz9s5.js");
+		let { walkPagesTree: e } = await import("./webDev-B6ZMX42w.js");
 		n = (await e(t)).pages.map((e) => e.pattern);
 	} catch {
 		return !1;
@@ -1948,10 +2090,10 @@ var le = /* @__PURE__ */ new Set([
 	console.log("");
 	for (let e of Je(r)) console.log(e);
 	return r.problems.length > 0;
-}, In = async (e) => {
-	let { discovered: t } = await U(e), n = [];
+}, Gn = async (e) => {
+	let { discovered: t } = await H(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-B9Gz0k85.js");
+		let { loadApiConfig: t } = await import("./dev-Bl9HqtV7.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -1964,8 +2106,8 @@ var le = /* @__PURE__ */ new Set([
 				plugin: e.name,
 				tables: t,
 				rpcTags: n,
-				canDisableTables: Ln.has(r),
-				canAlias: Rn.has(r)
+				canDisableTables: Kn.has(r),
+				canAlias: qn.has(r)
 			};
 		});
 	} catch {
@@ -1983,12 +2125,12 @@ var le = /* @__PURE__ */ new Set([
 	});
 	console.log();
 	for (let e of dt(n, i)) console.log(e);
-}, Ln = /* @__PURE__ */ new Set([
+}, Kn = /* @__PURE__ */ new Set([
 	"@voltro/plugin-rbac",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-notifications",
 	"aiFlows"
-]), Rn = /* @__PURE__ */ new Set([
+]), qn = /* @__PURE__ */ new Set([
 	"aiFlows",
 	"@voltro/plugin-audit",
 	"@voltro/plugin-billing",
@@ -2006,8 +2148,8 @@ var le = /* @__PURE__ */ new Set([
 	"@voltro/plugin-sso-saml",
 	"@voltro/plugin-storage",
 	"@voltro/plugin-row-history"
-]), $ = 20, zn = async (e) => {
-	let t = await Bn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
+]), $ = 20, Jn = async (e) => {
+	let t = await Yn(e), n = new Set(t.reviewed.map((e) => e.tag)), r = t.result.findings.filter((e) => e.verdict.kind === "allowlisted" && !n.has(e.tag)).length;
 	return {
 		executors: t.executorCount,
 		guardVocabulary: [...t.vocabulary].sort(),
@@ -2019,15 +2161,15 @@ var le = /* @__PURE__ */ new Set([
 		},
 		unchecked: t.result.unchecked
 	};
-}, Bn = async (e) => {
-	let { discovered: t } = await U(e), n = /* @__PURE__ */ new Map(), r = (e) => {
+}, Yn = async (e) => {
+	let { discovered: t } = await H(e), n = /* @__PURE__ */ new Map(), r = (e) => {
 		if (!n.has(e)) try {
 			n.set(e, C(e, "utf8"));
 		} catch {
 			n.set(e, "");
 		}
 		return n.get(e);
-	}, i = En(e, r), a = /* @__PURE__ */ new Set();
+	}, i = In(e, r), a = /* @__PURE__ */ new Set();
 	for (let e of t.tables) for (let t of Object.values(e.fields ?? {})) try {
 		let e = t.references?.();
 		e && a.add(e.tableName);
@@ -2059,7 +2201,7 @@ var le = /* @__PURE__ */ new Set([
 			op: a?.op === "delete" || a?.op === "insert" ? a.op : t,
 			...a?.table === void 0 ? {} : { table: a.table }
 		};
-	})), s = v(e, X), c = S(s) ? j(C(s, "utf8")) : void 0, l = !1;
+	})), s = v(e, Y), c = S(s) ? j(C(s, "utf8")) : void 0, l = !1;
 	for (let t of L(e)) if (/\bsetRowFilter\s*[<(]/.test(r(t))) {
 		l = !0;
 		break;
@@ -2081,23 +2223,23 @@ var le = /* @__PURE__ */ new Set([
 		executorCount: o.length,
 		allowPath: s
 	};
-}, Vn = async (e, t) => {
-	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await Bn(e), l = n.counts;
+}, Xn = async (e, t) => {
+	let { result: n, vocabulary: r, existing: i, reviewed: a, executorCount: o, allowPath: s, rowFilterRegistered: c } = await Yn(e), l = n.counts;
 	console.log(`\nauthz scan · ${o} executor(s)`);
 	let u = [...r].filter((e) => !Xe.has(e)).sort();
 	console.log(u.length === 0 ? "  guard vocabulary: framework names only — no exported require*/assert* found in this app" : `  guard vocabulary: ${u.length} from your source (${u.slice(0, 6).join(", ")}${u.length > 6 ? ", …" : ""})`), console.log(`  ✗ no access check                       ${String(l.unchecked).padStart(4)}`), console.log(`  ⚠ inline ownership check, no named guard${String(l.inlineOwnership).padStart(4)}   (informational)`), console.log(`  ✓ guards: on the descriptor             ${String(l.declaredGuard).padStart(4)}`), console.log(`  ✓ calls a guard from the vocabulary     ${String(l.vocabularyGuard).padStart(4)}`);
 	let d = new Set(a.map((e) => e.tag)), f = n.findings.filter((e) => e.verdict.kind === "allowlisted" && !d.has(e.tag)).length, p = l.allowlisted - f;
-	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${X})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
+	if (console.log(`  – accepted as recorded debt             ${String(f).padStart(4)}   (${Y})`), console.log(`  ✓ reviewed, open on purpose             ${String(p).padStart(4)}   (\`reviewed=<why>\` in that file)`), c && console.log("  ⓘ this app registers setRowFilter — the scan CANNOT see through it. A finding below may\n    already be constrained; verify the filter covers that table and record it as `reviewed=`."), t) {
 		let e = S(s) ? C(s, "utf8") : void 0, t = n.unchecked.map((e) => e.tag), r = st(e, t);
-		return oe(s, ot(e, t), "utf8"), console.log(`\n${X}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
+		return oe(s, ot(e, t), "utf8"), console.log(`\n${Y}: +${r.added} new, ${r.kept} kept, ${r.removed} removed. Doctor now fails on ADDITIONS only.`), r.added === 0 && console.log("  (nothing new was unchecked — the file is unchanged.)"), !1;
 	}
 	if (n.unchecked.length === 0) return !1;
 	console.log("");
 	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
-	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${X} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${X}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
-}, Hn = async (e) => {
+	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${Y} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${Y}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
+}, Zn = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-B9Gz0k85.js"), { decidedSchemaReport: n } = await import("./doctorDecidedSchema-BlbWgCD_.js"), r = await t(e);
+		let { loadApiConfig: t } = await import("./dev-Bl9HqtV7.js"), { decidedSchemaReport: n } = await import("./doctorDecidedSchema-BlbWgCD_.js"), r = await t(e);
 		return r == null ? null : n({
 			...r.schema ? { declared: r.schema } : {},
 			...r.store === void 0 ? {} : { store: r.store },
@@ -2106,42 +2248,42 @@ var le = /* @__PURE__ */ new Set([
 	} catch {
 		return null;
 	}
-}, Un = async (e) => {
-	let t = await Hn(e);
+}, Qn = async (e) => {
+	let t = await Zn(e);
 	if (t !== null) {
 		console.log(""), console.log("•  framework tables whose presence is DECIDED rather than implied by your source tree:");
 		for (let e of t.text.split("\n")) console.log(`   ${e}`);
 	}
-}, Wn = async (e) => {
-	if (e.includes("--help") || e.includes("-h")) return console.log(un), 0;
-	let t = e.includes("--strict"), n = e.find((e) => !e.startsWith("-")), r = b(n ?? process.cwd());
+}, $n = async (e) => {
+	if (e.includes("--help") || e.includes("-h")) return console.log(bn), 0;
+	let t = e.includes("--strict"), n = e.find((e) => !e.startsWith("-")), a = b(n ?? process.cwd());
 	if (g(e)) return ee(), h({
-		...R(r),
-		spaCandidates: await z(r),
-		pageConvention: B(r),
-		fileTaxonomy: re(r).findings,
-		junctionFks: (await W(r))?.issues ?? [],
-		eventDelivery: await G(r),
-		duplicateInstances: a(r),
-		versionSkew: o(r) ?? null,
-		serverOnly: (await q(r)).status,
-		accessDecisions: await J(r),
-		webhookVerification: await Y(r),
-		authz: await zn(r),
-		ungrantedScopes: await Q(r),
-		neverEmittedEvents: await Z(r),
-		unimportedDeps: He(r),
-		stalledRuns: await Cn(r),
-		decidedSchema: await Hn(r)
+		...R(a),
+		spaCandidates: await z(a),
+		pageConvention: B(a),
+		fileTaxonomy: re(a).findings,
+		junctionFks: (await U(a))?.issues ?? [],
+		eventDelivery: await W(a),
+		duplicateInstances: i(a),
+		versionSkew: o(a) ?? null,
+		serverOnly: (await K(a)).status,
+		accessDecisions: await q(a),
+		webhookVerification: await J(a),
+		authz: await Jn(a),
+		ungrantedScopes: await Q(a),
+		neverEmittedEvents: await Z(a),
+		unimportedDeps: He(a),
+		stalledRuns: await Nn(a),
+		decidedSchema: await Zn(a)
 	}), 0;
-	let c = Ct(r, t);
-	Zt(r), Xt(r), ln(r), ne(r), await rn(r), await Tn(r), await wn(r), await fn(r), await _n(r), await gn(r), await Un(r), await vn(r), await In(r), await An(r), await On(r), console.log("");
-	for (let e of Ue(He(r))) console.log(e);
-	await Mn(r), jn(r), await Nn(r), await Pn(r);
-	let l = await Sn(r), u = await Vn(r, e.includes("--write-authz-allowlist")), d = await yn(r), f = await xn(r), p = await Fn(r), m = i(o(r));
+	let s = Ct(a, t);
+	sn(a), on(a), yn(a), ne(a), await pn(a), await Fn(a), await Pn(a), await Sn(a), await Dn(a), await En(a), await Qn(a), await On(a), await Gn(a), await zn(a), await Ln(a), console.log("");
+	for (let e of Ue(He(a))) console.log(e);
+	await Vn(a), Bn(a), await Hn(a), await Un(a);
+	let c = await Mn(a), l = await Xn(a, e.includes("--write-authz-allowlist")), d = await kn(a), f = await jn(a), p = await Wn(a), m = r(o(a));
 	m !== void 0 && (console.log(""), console.log(m));
-	let _ = s(a(r));
-	return _ !== void 0 && console.log(`\n${_}`), l || u || d || p || f ? Math.max(c, 1) : c;
+	let _ = u(i(a));
+	return _ !== void 0 && console.log(`\n${_}`), c || l || d || p || f ? Math.max(s, 1) : s;
 };
 //#endregion
-export { z as C, Y as E, B as S, Q as T, ln as _, zn as a, Ct as b, G as c, Wt as d, xt as f, Zt as g, Xt as h, J as i, En as l, mn as m, St as n, Z as o, W as p, Qt as r, Dn as s, un as t, R as u, rn as v, q as w, Gt as x, Wn as y };
+export { z as C, J as D, Q as E, B as S, Rt as T, yn as _, Jn as a, Ct as b, W as c, Qt as d, xt as f, sn as g, on as h, q as i, In as l, wn as m, St as n, Z as o, U as p, cn as r, X as s, bn as t, R as u, pn as v, K as w, $t as x, $n as y };