@graphorin/cli 0.5.0 → 0.6.0

package/dist/internal/offline.js.map

@@ -1 +1 @@
-{"version":3,"file":"offline.js","names":[],"sources":["../../src/internal/offline.ts"],"sourcesContent":["/**\n * `GRAPHORIN_OFFLINE=1` enforcement. The framework promises zero\n * implicit network calls (DEC-154 / ADR-041); the CLI mirrors the\n * promise on the operator-facing side by surfacing the same flag\n * every subcommand obeys.\n *\n * The flag is informational in Phase 14a — the three commands the\n * binary ships do NOT make any outbound network calls. A future\n * phase that exposes a network-using subcommand (e.g. `graphorin\n * pricing refresh`) reads {@link isOfflineMode} to short-circuit.\n *\n * @internal\n */\n\n/**\n * `true` when `process.env.GRAPHORIN_OFFLINE` is set to `'1'` or\n * `'true'` (case-insensitive). Mirrors the documented contract.\n *\n * @stable\n */\nexport function isOfflineMode(env: NodeJS.ProcessEnv = process.env): boolean {\n  const raw = env.GRAPHORIN_OFFLINE;\n  if (raw === undefined) return false;\n  const normalized = raw.trim().toLowerCase();\n  return normalized === '1' || normalized === 'true' || normalized === 'yes';\n}\n\n/**\n * Throws when the operator opted into offline mode. Phase 14a calls\n * this from every subcommand entry point so the contract is\n * enforced uniformly.\n *\n * @stable\n */\nexport function assertNoNetworkInOfflineMode(operation: string): void {\n  if (!isOfflineMode()) return;\n  throw new OfflineModeViolationError(operation);\n}\n\n/**\n * Phase 15 helper for subcommands that informationally **may** make\n * network calls (e.g. `graphorin auth login`, `graphorin pricing\n * refresh`, `graphorin skills install`). When `GRAPHORIN_OFFLINE=1`\n * is set the helper writes an explanatory branded line through the\n * supplied sink (default: `process.stderr`) and returns `false`,\n * letting the caller short-circuit cleanly without throwing. Returns\n * `true` when the network is permitted.\n *\n * @stable\n */\nexport function checkOfflineModeBlocked(\n  operation: string,\n  options: { readonly print?: (line: string) => void; readonly env?: NodeJS.ProcessEnv } = {},\n): boolean {\n  const env = options.env ?? process.env;\n  if (!isOfflineMode(env)) return true;\n  const sink = options.print ?? ((line: string) => process.stderr.write(`${line}\\n`));\n  sink(\n    `[graphorin/cli] GRAPHORIN_OFFLINE=1 — refusing to perform '${operation}'. Unset GRAPHORIN_OFFLINE to opt back in.`,\n  );\n  return false;\n}\n\n/**\n * Raised when a CLI subcommand attempts a network call while\n * `GRAPHORIN_OFFLINE=1` is set.\n *\n * @stable\n */\nexport class OfflineModeViolationError extends Error {\n  readonly kind = 'offline-mode-violation' as const;\n  readonly operation: string;\n\n  constructor(operation: string) {\n    super(\n      `[graphorin/cli] GRAPHORIN_OFFLINE=1 is set; refusing to perform a network operation: ${operation}.`,\n    );\n    this.name = 'OfflineModeViolationError';\n    this.operation = operation;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,cAAc,MAAyB,QAAQ,KAAc;CAC3E,MAAM,MAAM,IAAI;AAChB,KAAI,QAAQ,OAAW,QAAO;CAC9B,MAAM,aAAa,IAAI,MAAM,CAAC,aAAa;AAC3C,QAAO,eAAe,OAAO,eAAe,UAAU,eAAe;;;;;;;;;AAUvE,SAAgB,6BAA6B,WAAyB;AACpE,KAAI,CAAC,eAAe,CAAE;AACtB,OAAM,IAAI,0BAA0B,UAAU;;;;;;;;;;;;;AAchD,SAAgB,wBACd,WACA,UAAyF,EAAE,EAClF;AAET,KAAI,CAAC,cADO,QAAQ,OAAO,QAAQ,IACZ,CAAE,QAAO;AAEhC,EADa,QAAQ,WAAW,SAAiB,QAAQ,OAAO,MAAM,GAAG,KAAK,IAAI,GAEhF,8DAA8D,UAAU,4CACzE;AACD,QAAO;;;;;;;;AAST,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,WAAmB;AAC7B,QACE,wFAAwF,UAAU,GACnG;AACD,OAAK,OAAO;AACZ,OAAK,YAAY"}
+{"version":3,"file":"offline.js","names":[],"sources":["../../src/internal/offline.ts"],"sourcesContent":["/**\n * `GRAPHORIN_OFFLINE=1` enforcement. The framework promises zero\n * implicit network calls (DEC-154 / ADR-041); the CLI mirrors the\n * promise on the operator-facing side by surfacing the same flag\n * every subcommand obeys.\n *\n * The flag is informational in Phase 14a - the three commands the\n * binary ships do NOT make any outbound network calls. A future\n * phase that exposes a network-using subcommand (e.g. `graphorin\n * pricing refresh`) reads {@link isOfflineMode} to short-circuit.\n *\n * @internal\n */\n\n/**\n * `true` when `process.env.GRAPHORIN_OFFLINE` is set to `'1'` or\n * `'true'` (case-insensitive). Mirrors the documented contract.\n *\n * @stable\n */\nexport function isOfflineMode(env: NodeJS.ProcessEnv = process.env): boolean {\n  const raw = env.GRAPHORIN_OFFLINE;\n  if (raw === undefined) return false;\n  const normalized = raw.trim().toLowerCase();\n  return normalized === '1' || normalized === 'true' || normalized === 'yes';\n}\n\n/**\n * Throws when the operator opted into offline mode. Phase 14a calls\n * this from every subcommand entry point so the contract is\n * enforced uniformly.\n *\n * @stable\n */\nexport function assertNoNetworkInOfflineMode(operation: string): void {\n  if (!isOfflineMode()) return;\n  throw new OfflineModeViolationError(operation);\n}\n\n/**\n * Phase 15 helper for subcommands that informationally **may** make\n * network calls (e.g. `graphorin auth login`, `graphorin pricing\n * refresh`, `graphorin skills install`). When `GRAPHORIN_OFFLINE=1`\n * is set the helper writes an explanatory branded line through the\n * supplied sink (default: `process.stderr`) and returns `false`,\n * letting the caller short-circuit cleanly without throwing. Returns\n * `true` when the network is permitted.\n *\n * @stable\n */\nexport function checkOfflineModeBlocked(\n  operation: string,\n  options: { readonly print?: (line: string) => void; readonly env?: NodeJS.ProcessEnv } = {},\n): boolean {\n  const env = options.env ?? process.env;\n  if (!isOfflineMode(env)) return true;\n  const sink = options.print ?? ((line: string) => process.stderr.write(`${line}\\n`));\n  sink(\n    `[graphorin/cli] GRAPHORIN_OFFLINE=1 - refusing to perform '${operation}'. Unset GRAPHORIN_OFFLINE to opt back in.`,\n  );\n  return false;\n}\n\n/**\n * Raised when a CLI subcommand attempts a network call while\n * `GRAPHORIN_OFFLINE=1` is set.\n *\n * @stable\n */\nexport class OfflineModeViolationError extends Error {\n  readonly kind = 'offline-mode-violation' as const;\n  readonly operation: string;\n\n  constructor(operation: string) {\n    super(\n      `[graphorin/cli] GRAPHORIN_OFFLINE=1 is set; refusing to perform a network operation: ${operation}.`,\n    );\n    this.name = 'OfflineModeViolationError';\n    this.operation = operation;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,cAAc,MAAyB,QAAQ,KAAc;CAC3E,MAAM,MAAM,IAAI;AAChB,KAAI,QAAQ,OAAW,QAAO;CAC9B,MAAM,aAAa,IAAI,MAAM,CAAC,aAAa;AAC3C,QAAO,eAAe,OAAO,eAAe,UAAU,eAAe;;;;;;;;;AAUvE,SAAgB,6BAA6B,WAAyB;AACpE,KAAI,CAAC,eAAe,CAAE;AACtB,OAAM,IAAI,0BAA0B,UAAU;;;;;;;;;;;;;AAchD,SAAgB,wBACd,WACA,UAAyF,EAAE,EAClF;AAET,KAAI,CAAC,cADO,QAAQ,OAAO,QAAQ,IACZ,CAAE,QAAO;AAEhC,EADa,QAAQ,WAAW,SAAiB,QAAQ,OAAO,MAAM,GAAG,KAAK,IAAI,GAEhF,8DAA8D,UAAU,4CACzE;AACD,QAAO;;;;;;;;AAST,IAAa,4BAAb,cAA+C,MAAM;CACnD,AAAS,OAAO;CAChB,AAAS;CAET,YAAY,WAAmB;AAC7B,QACE,wFAAwF,UAAU,GACnG;AACD,OAAK,OAAO;AACZ,OAAK,YAAY"}

package/dist/internal/output.d.ts

@@ -3,18 +3,18 @@
  * Shared output helpers for Phase 15 subcommands. The CLI keeps three
  * output flavours uniform across every command:
  *
- *  1. **Human** — single-line `[graphorin/cli] ...` messages on stderr
+ *  1. **Human** - single-line `[graphorin/cli] ...` messages on stderr
  *     (the default path in Phase 14a; preserved for backward
  *     compatibility).
- *  2. **JSON** — one structured JSON document per subcommand emitted on
+ *  2. **JSON** - one structured JSON document per subcommand emitted on
  *     stdout when `--json` is set. Phase 15 commands that produce a
  *     report (status / list / verify / lookup) ship a stable schema so
  *     CI pipelines can consume them.
- *  3. **Stub print sink** — every command accepts an optional
+ *  3. **Stub print sink** - every command accepts an optional
  *     `print(line: string)` callback so unit tests can capture output
  *     without spying on `process.stderr`.
  *
- * Helpers in this module are intentionally tiny — they exist so the
+ * Helpers in this module are intentionally tiny - they exist so the
  * sixteen Phase 15 subcommand groups share one channel surface
  * (single-source-of-truth per Hard Rule 5 in the working plan).
  *
@@ -46,9 +46,9 @@ interface CommonOutputOptions {
   readonly json?: boolean;
   /** Force `--non-interactive` semantics (skip prompts; require flags / env). */
   readonly nonInteractive?: boolean;
-  /** Test seam — capture human lines instead of writing to stderr. */
+  /** Test seam - capture human lines instead of writing to stderr. */
   readonly print?: PrintSink;
-  /** Test seam — capture JSON documents instead of writing to stdout. */
+  /** Test seam - capture JSON documents instead of writing to stdout. */
   readonly jsonPrint?: JsonSink;
 }
 //#endregion

package/dist/internal/output.js

@@ -5,25 +5,25 @@ import process from "node:process";
 * Shared output helpers for Phase 15 subcommands. The CLI keeps three
 * output flavours uniform across every command:
 *
-*  1. **Human** — single-line `[graphorin/cli] ...` messages on stderr
+*  1. **Human** - single-line `[graphorin/cli] ...` messages on stderr
 *     (the default path in Phase 14a; preserved for backward
 *     compatibility).
-*  2. **JSON** — one structured JSON document per subcommand emitted on
+*  2. **JSON** - one structured JSON document per subcommand emitted on
 *     stdout when `--json` is set. Phase 15 commands that produce a
 *     report (status / list / verify / lookup) ship a stable schema so
 *     CI pipelines can consume them.
-*  3. **Stub print sink** — every command accepts an optional
+*  3. **Stub print sink** - every command accepts an optional
 *     `print(line: string)` callback so unit tests can capture output
 *     without spying on `process.stderr`.
 *
-* Helpers in this module are intentionally tiny — they exist so the
+* Helpers in this module are intentionally tiny - they exist so the
 * sixteen Phase 15 subcommand groups share one channel surface
 * (single-source-of-truth per Hard Rule 5 in the working plan).
 *
 * @internal
 */
 /**
-* Default `PrintSink` — appends a newline and writes to `stderr` so it
+* Default `PrintSink` - appends a newline and writes to `stderr` so it
 * never collides with the JSON document on `stdout`.
 *
 * @internal
@@ -32,7 +32,7 @@ function defaultPrintSink(line) {
 	process.stderr.write(`${line}\n`);
 }
 /**
-* Default `JsonSink` — writes a stable, two-space indented JSON
+* Default `JsonSink` - writes a stable, two-space indented JSON
 * document to `stdout` plus a trailing newline so consumers can split
 * a multi-document stream by lines.
 *

package/dist/internal/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","names":[],"sources":["../../src/internal/output.ts"],"sourcesContent":["/**\n * Shared output helpers for Phase 15 subcommands. The CLI keeps three\n * output flavours uniform across every command:\n *\n *  1. **Human** — single-line `[graphorin/cli] ...` messages on stderr\n *     (the default path in Phase 14a; preserved for backward\n *     compatibility).\n *  2. **JSON** — one structured JSON document per subcommand emitted on\n *     stdout when `--json` is set. Phase 15 commands that produce a\n *     report (status / list / verify / lookup) ship a stable schema so\n *     CI pipelines can consume them.\n *  3. **Stub print sink** — every command accepts an optional\n *     `print(line: string)` callback so unit tests can capture output\n *     without spying on `process.stderr`.\n *\n * Helpers in this module are intentionally tiny — they exist so the\n * sixteen Phase 15 subcommand groups share one channel surface\n * (single-source-of-truth per Hard Rule 5 in the working plan).\n *\n * @internal\n */\n\nimport process from 'node:process';\n\n/**\n * Sink the CLI subcommands write human-readable lines through. The\n * default sink writes a trailing newline to `process.stderr`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type PrintSink = (line: string) => void;\n\n/**\n * Default `PrintSink` — appends a newline and writes to `stderr` so it\n * never collides with the JSON document on `stdout`.\n *\n * @internal\n */\nexport function defaultPrintSink(line: string): void {\n  process.stderr.write(`${line}\\n`);\n}\n\n/**\n * Sink the CLI uses when emitting structured JSON documents. Defaults\n * to writing a single trailing newline to `process.stdout`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type JsonSink = (payload: unknown) => void;\n\n/**\n * Default `JsonSink` — writes a stable, two-space indented JSON\n * document to `stdout` plus a trailing newline so consumers can split\n * a multi-document stream by lines.\n *\n * @internal\n */\nexport function defaultJsonSink(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload, null, 2)}\\n`);\n}\n\n/**\n * Common output options every Phase 15 command honours.\n *\n * @stable\n */\nexport interface CommonOutputOptions {\n  /** Emit a structured JSON document instead of human-readable text. */\n  readonly json?: boolean;\n  /** Force `--non-interactive` semantics (skip prompts; require flags / env). */\n  readonly nonInteractive?: boolean;\n  /** Test seam — capture human lines instead of writing to stderr. */\n  readonly print?: PrintSink;\n  /** Test seam — capture JSON documents instead of writing to stdout. */\n  readonly jsonPrint?: JsonSink;\n}\n\n/**\n * Emit either the JSON document or the human report depending on\n * `--json`. Used by every Phase 15 subcommand that produces a single\n * status payload (e.g. `graphorin doctor`, `graphorin token list`).\n *\n * @internal\n */\nexport function emitReport(\n  options: CommonOutputOptions,\n  payload: unknown,\n  human: () => void,\n): void {\n  if (options.json === true) {\n    const sink = options.jsonPrint ?? defaultJsonSink;\n    sink(payload);\n    return;\n  }\n  human();\n}\n\n/**\n * Format a status icon for human reports. The CLI is ASCII-only per\n * the Phase 15 spec (no emoji); the markers are unambiguous so\n * operators see at a glance what a row means.\n *\n * @internal\n */\nexport function statusMarker(status: 'ok' | 'warn' | 'fail' | 'skip' | 'info'): string {\n  switch (status) {\n    case 'ok':\n      return '[OK]';\n    case 'warn':\n      return '[WARN]';\n    case 'fail':\n      return '[FAIL]';\n    case 'skip':\n      return '[SKIP]';\n    case 'info':\n      return '[INFO]';\n  }\n}\n\n/**\n * Standardised `[graphorin/cli] <message>` prefix every human-format\n * line carries. Centralised so every command renders the same brand.\n *\n * @internal\n */\nexport function brand(line: string): string {\n  return `[graphorin/cli] ${line}`;\n}\n\n/**\n * Convenience helper — writes a branded message via the chosen sink.\n *\n * @internal\n */\nexport function brandedLine(options: CommonOutputOptions, line: string): void {\n  const sink = options.print ?? defaultPrintSink;\n  sink(brand(line));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,iBAAiB,MAAoB;AACnD,SAAQ,OAAO,MAAM,GAAG,KAAK,IAAI;;;;;;;;;AAmBnC,SAAgB,gBAAgB,SAAwB;AACtD,SAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;;;;;;;;;AA0B/D,SAAgB,WACd,SACA,SACA,OACM;AACN,KAAI,QAAQ,SAAS,MAAM;AAEzB,GADa,QAAQ,aAAa,iBAC7B,QAAQ;AACb;;AAEF,QAAO;;;;;;;;;AAUT,SAAgB,aAAa,QAA0D;AACrF,SAAQ,QAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;;;;;;;;;AAUb,SAAgB,MAAM,MAAsB;AAC1C,QAAO,mBAAmB"}
+{"version":3,"file":"output.js","names":[],"sources":["../../src/internal/output.ts"],"sourcesContent":["/**\n * Shared output helpers for Phase 15 subcommands. The CLI keeps three\n * output flavours uniform across every command:\n *\n *  1. **Human** - single-line `[graphorin/cli] ...` messages on stderr\n *     (the default path in Phase 14a; preserved for backward\n *     compatibility).\n *  2. **JSON** - one structured JSON document per subcommand emitted on\n *     stdout when `--json` is set. Phase 15 commands that produce a\n *     report (status / list / verify / lookup) ship a stable schema so\n *     CI pipelines can consume them.\n *  3. **Stub print sink** - every command accepts an optional\n *     `print(line: string)` callback so unit tests can capture output\n *     without spying on `process.stderr`.\n *\n * Helpers in this module are intentionally tiny - they exist so the\n * sixteen Phase 15 subcommand groups share one channel surface\n * (single-source-of-truth per Hard Rule 5 in the working plan).\n *\n * @internal\n */\n\nimport process from 'node:process';\n\n/**\n * Sink the CLI subcommands write human-readable lines through. The\n * default sink writes a trailing newline to `process.stderr`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type PrintSink = (line: string) => void;\n\n/**\n * Default `PrintSink` - appends a newline and writes to `stderr` so it\n * never collides with the JSON document on `stdout`.\n *\n * @internal\n */\nexport function defaultPrintSink(line: string): void {\n  process.stderr.write(`${line}\\n`);\n}\n\n/**\n * Sink the CLI uses when emitting structured JSON documents. Defaults\n * to writing a single trailing newline to `process.stdout`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type JsonSink = (payload: unknown) => void;\n\n/**\n * Default `JsonSink` - writes a stable, two-space indented JSON\n * document to `stdout` plus a trailing newline so consumers can split\n * a multi-document stream by lines.\n *\n * @internal\n */\nexport function defaultJsonSink(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload, null, 2)}\\n`);\n}\n\n/**\n * Common output options every Phase 15 command honours.\n *\n * @stable\n */\nexport interface CommonOutputOptions {\n  /** Emit a structured JSON document instead of human-readable text. */\n  readonly json?: boolean;\n  /** Force `--non-interactive` semantics (skip prompts; require flags / env). */\n  readonly nonInteractive?: boolean;\n  /** Test seam - capture human lines instead of writing to stderr. */\n  readonly print?: PrintSink;\n  /** Test seam - capture JSON documents instead of writing to stdout. */\n  readonly jsonPrint?: JsonSink;\n}\n\n/**\n * Emit either the JSON document or the human report depending on\n * `--json`. Used by every Phase 15 subcommand that produces a single\n * status payload (e.g. `graphorin doctor`, `graphorin token list`).\n *\n * @internal\n */\nexport function emitReport(\n  options: CommonOutputOptions,\n  payload: unknown,\n  human: () => void,\n): void {\n  if (options.json === true) {\n    const sink = options.jsonPrint ?? defaultJsonSink;\n    sink(payload);\n    return;\n  }\n  human();\n}\n\n/**\n * Format a status icon for human reports. The CLI is ASCII-only per\n * the Phase 15 spec (no emoji); the markers are unambiguous so\n * operators see at a glance what a row means.\n *\n * @internal\n */\nexport function statusMarker(status: 'ok' | 'warn' | 'fail' | 'skip' | 'info'): string {\n  switch (status) {\n    case 'ok':\n      return '[OK]';\n    case 'warn':\n      return '[WARN]';\n    case 'fail':\n      return '[FAIL]';\n    case 'skip':\n      return '[SKIP]';\n    case 'info':\n      return '[INFO]';\n  }\n}\n\n/**\n * Standardised `[graphorin/cli] <message>` prefix every human-format\n * line carries. Centralised so every command renders the same brand.\n *\n * @internal\n */\nexport function brand(line: string): string {\n  return `[graphorin/cli] ${line}`;\n}\n\n/**\n * Convenience helper - writes a branded message via the chosen sink.\n *\n * @internal\n */\nexport function brandedLine(options: CommonOutputOptions, line: string): void {\n  const sink = options.print ?? defaultPrintSink;\n  sink(brand(line));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,iBAAiB,MAAoB;AACnD,SAAQ,OAAO,MAAM,GAAG,KAAK,IAAI;;;;;;;;;AAmBnC,SAAgB,gBAAgB,SAAwB;AACtD,SAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;;;;;;;;;AA0B/D,SAAgB,WACd,SACA,SACA,OACM;AACN,KAAI,QAAQ,SAAS,MAAM;AAEzB,GADa,QAAQ,aAAa,iBAC7B,QAAQ;AACb;;AAEF,QAAO;;;;;;;;;AAUT,SAAgB,aAAa,QAA0D;AACrF,SAAQ,QAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;;;;;;;;;AAUb,SAAgB,MAAM,MAAsB;AAC1C,QAAO,mBAAmB"}

package/dist/internal/store-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-context.js","names":["storeOpts: CreateSqliteStoreOptions","resolveSecret","pepper: SecretValue | undefined"],"sources":["../../src/internal/store-context.ts"],"sourcesContent":["/**\n * Shared helper that loads `graphorin.config`, parses it through\n * `parseServerConfig(...)`, opens the SQLite store, optionally resolves\n * the server pepper, and returns a disposable handle for any Phase 15\n * subcommand that needs a live storage / auth context.\n *\n * Centralising the resource lifecycle here means every command (token,\n * audit, secrets, memory, triggers, storage, …) acquires + releases\n * the same way; tests only stub the loader once.\n *\n * @internal\n */\n\nimport { resolveSecret, type SecretValue } from '@graphorin/security';\nimport { parseServerConfig, type ServerConfigSpec } from '@graphorin/server';\nimport {\n  type CreateSqliteStoreOptions,\n  createSqliteStore,\n  type GraphorinSqliteStore,\n} from '@graphorin/store-sqlite';\n\nimport { loadConfig } from './load-config.js';\n\n/**\n * @internal\n */\nexport interface OpenStoreContextOptions {\n  /** Path to `graphorin.config.{ts,js,mjs,json}`. */\n  readonly config?: string;\n  /**\n   * When `true`, refuse to continue when `auth.pepperRef` cannot be\n   * resolved. Default `false` — callers that do not need the pepper\n   * (e.g. `graphorin audit verify`) skip resolution entirely.\n   */\n  readonly requirePepper?: boolean;\n  /**\n   * Override the store factory — tests inject a fake store so they\n   * can run subcommand integration without touching a real DB.\n   */\n  readonly storeFactory?: (options: CreateSqliteStoreOptions) => Promise<GraphorinSqliteStore>;\n  /**\n   * Skip migrations. Defaults to `false` so subcommands always operate\n   * against an initialized schema.\n   */\n  readonly skipInit?: boolean;\n}\n\n/**\n * @internal\n */\nexport interface StoreContext {\n  readonly configPath: string;\n  readonly config: ServerConfigSpec;\n  readonly store: GraphorinSqliteStore;\n  readonly pepper?: SecretValue;\n  /** Releases the underlying SQLite connection. */\n  close(): Promise<void>;\n}\n\n/**\n * Open the storage context for the provided config path. Throws on\n * Zod validation errors and on `requirePepper && !pepperRef`.\n *\n * @internal\n */\nexport async function openStoreContext(\n  options: OpenStoreContextOptions = {},\n): Promise<StoreContext> {\n  const loaded = await loadConfig(options.config);\n  const config = parseServerConfig(loaded.config);\n  const factory = options.storeFactory ?? createSqliteStore;\n  const storeOpts: CreateSqliteStoreOptions = {\n    path: config.storage.path,\n    mode: config.storage.mode,\n  };\n  // IP-1: the CLI honours the same encryption config as the server, so\n  // `graphorin` commands can open a database produced by\n  // `graphorin storage encrypt`.\n  if (config.storage.encryption.enabled) {\n    if (config.storage.encryption.passphraseRef === undefined) {\n      throw new Error(\n        '[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.',\n      );\n    }\n    const { resolveSecret } = await import('@graphorin/security/secrets');\n    const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);\n    (storeOpts as { encryption?: unknown }).encryption = {\n      enabled: true,\n      ...(config.storage.encryption.cipher !== undefined\n        ? { cipher: config.storage.encryption.cipher }\n        : {}),\n      passphraseResolver: async () => passphrase.use((v: string) => v),\n    };\n  }\n  const store = await factory(storeOpts);\n  if (options.skipInit !== true) {\n    await store.init();\n  }\n\n  let pepper: SecretValue | undefined;\n  if (options.requirePepper === true) {\n    if (config.auth.kind !== 'token' || config.auth.pepperRef === undefined) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`,\n      );\n    }\n    try {\n      pepper = await resolveSecret(config.auth.pepperRef);\n    } catch (err) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${(err as Error).message}`,\n        { cause: err },\n      );\n    }\n  }\n\n  const ctx: StoreContext = Object.freeze({\n    configPath: loaded.path,\n    config,\n    store,\n    ...(pepper !== undefined ? { pepper } : {}),\n    close: () => store.close(),\n  });\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,iBACpB,UAAmC,EAAE,EACd;CACvB,MAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;CAC/C,MAAM,SAAS,kBAAkB,OAAO,OAAO;CAC/C,MAAM,UAAU,QAAQ,gBAAgB;CACxC,MAAMA,YAAsC;EAC1C,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ;EACtB;AAID,KAAI,OAAO,QAAQ,WAAW,SAAS;AACrC,MAAI,OAAO,QAAQ,WAAW,kBAAkB,OAC9C,OAAM,IAAI,MACR,yFACD;EAEH,MAAM,EAAE,mCAAkB,MAAM,OAAO;EACvC,MAAM,aAAa,MAAMC,gBAAc,OAAO,QAAQ,WAAW,cAAc;AAC/E,EAAC,UAAuC,aAAa;GACnD,SAAS;GACT,GAAI,OAAO,QAAQ,WAAW,WAAW,SACrC,EAAE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,GAC5C,EAAE;GACN,oBAAoB,YAAY,WAAW,KAAK,MAAc,EAAE;GACjE;;CAEH,MAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,KAAI,QAAQ,aAAa,KACvB,OAAM,MAAM,MAAM;CAGpB,IAAIC;AACJ,KAAI,QAAQ,kBAAkB,MAAM;AAClC,MAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,cAAc,QAAW;AACvE,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,iFAAiF,OAAO,KAAK,IAC9F;;AAEH,MAAI;AACF,YAAS,MAAM,cAAc,OAAO,KAAK,UAAU;WAC5C,KAAK;AACZ,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,qDAAqD,OAAO,KAAK,UAAU,KAAM,IAAc,WAC/F,EAAE,OAAO,KAAK,CACf;;;AAWL,QAP0B,OAAO,OAAO;EACtC,YAAY,OAAO;EACnB;EACA;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,aAAa,MAAM,OAAO;EAC3B,CAAC"}
+{"version":3,"file":"store-context.js","names":["storeOpts: CreateSqliteStoreOptions","resolveSecret","pepper: SecretValue | undefined"],"sources":["../../src/internal/store-context.ts"],"sourcesContent":["/**\n * Shared helper that loads `graphorin.config`, parses it through\n * `parseServerConfig(...)`, opens the SQLite store, optionally resolves\n * the server pepper, and returns a disposable handle for any Phase 15\n * subcommand that needs a live storage / auth context.\n *\n * Centralising the resource lifecycle here means every command (token,\n * audit, secrets, memory, triggers, storage, …) acquires + releases\n * the same way; tests only stub the loader once.\n *\n * @internal\n */\n\nimport { resolveSecret, type SecretValue } from '@graphorin/security';\nimport { parseServerConfig, type ServerConfigSpec } from '@graphorin/server';\nimport {\n  type CreateSqliteStoreOptions,\n  createSqliteStore,\n  type GraphorinSqliteStore,\n} from '@graphorin/store-sqlite';\n\nimport { loadConfig } from './load-config.js';\n\n/**\n * @internal\n */\nexport interface OpenStoreContextOptions {\n  /** Path to `graphorin.config.{ts,js,mjs,json}`. */\n  readonly config?: string;\n  /**\n   * When `true`, refuse to continue when `auth.pepperRef` cannot be\n   * resolved. Default `false` - callers that do not need the pepper\n   * (e.g. `graphorin audit verify`) skip resolution entirely.\n   */\n  readonly requirePepper?: boolean;\n  /**\n   * Override the store factory - tests inject a fake store so they\n   * can run subcommand integration without touching a real DB.\n   */\n  readonly storeFactory?: (options: CreateSqliteStoreOptions) => Promise<GraphorinSqliteStore>;\n  /**\n   * Skip migrations. Defaults to `false` so subcommands always operate\n   * against an initialized schema.\n   */\n  readonly skipInit?: boolean;\n}\n\n/**\n * @internal\n */\nexport interface StoreContext {\n  readonly configPath: string;\n  readonly config: ServerConfigSpec;\n  readonly store: GraphorinSqliteStore;\n  readonly pepper?: SecretValue;\n  /** Releases the underlying SQLite connection. */\n  close(): Promise<void>;\n}\n\n/**\n * Open the storage context for the provided config path. Throws on\n * Zod validation errors and on `requirePepper && !pepperRef`.\n *\n * @internal\n */\nexport async function openStoreContext(\n  options: OpenStoreContextOptions = {},\n): Promise<StoreContext> {\n  const loaded = await loadConfig(options.config);\n  const config = parseServerConfig(loaded.config);\n  const factory = options.storeFactory ?? createSqliteStore;\n  const storeOpts: CreateSqliteStoreOptions = {\n    path: config.storage.path,\n    mode: config.storage.mode,\n  };\n  // IP-1: the CLI honours the same encryption config as the server, so\n  // `graphorin` commands can open a database produced by\n  // `graphorin storage encrypt`.\n  if (config.storage.encryption.enabled) {\n    if (config.storage.encryption.passphraseRef === undefined) {\n      throw new Error(\n        '[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.',\n      );\n    }\n    const { resolveSecret } = await import('@graphorin/security/secrets');\n    const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);\n    (storeOpts as { encryption?: unknown }).encryption = {\n      enabled: true,\n      ...(config.storage.encryption.cipher !== undefined\n        ? { cipher: config.storage.encryption.cipher }\n        : {}),\n      passphraseResolver: async () => passphrase.use((v: string) => v),\n    };\n  }\n  const store = await factory(storeOpts);\n  if (options.skipInit !== true) {\n    await store.init();\n  }\n\n  let pepper: SecretValue | undefined;\n  if (options.requirePepper === true) {\n    if (config.auth.kind !== 'token' || config.auth.pepperRef === undefined) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`,\n      );\n    }\n    try {\n      pepper = await resolveSecret(config.auth.pepperRef);\n    } catch (err) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${(err as Error).message}`,\n        { cause: err },\n      );\n    }\n  }\n\n  const ctx: StoreContext = Object.freeze({\n    configPath: loaded.path,\n    config,\n    store,\n    ...(pepper !== undefined ? { pepper } : {}),\n    close: () => store.close(),\n  });\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,iBACpB,UAAmC,EAAE,EACd;CACvB,MAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;CAC/C,MAAM,SAAS,kBAAkB,OAAO,OAAO;CAC/C,MAAM,UAAU,QAAQ,gBAAgB;CACxC,MAAMA,YAAsC;EAC1C,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ;EACtB;AAID,KAAI,OAAO,QAAQ,WAAW,SAAS;AACrC,MAAI,OAAO,QAAQ,WAAW,kBAAkB,OAC9C,OAAM,IAAI,MACR,yFACD;EAEH,MAAM,EAAE,mCAAkB,MAAM,OAAO;EACvC,MAAM,aAAa,MAAMC,gBAAc,OAAO,QAAQ,WAAW,cAAc;AAC/E,EAAC,UAAuC,aAAa;GACnD,SAAS;GACT,GAAI,OAAO,QAAQ,WAAW,WAAW,SACrC,EAAE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,GAC5C,EAAE;GACN,oBAAoB,YAAY,WAAW,KAAK,MAAc,EAAE;GACjE;;CAEH,MAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,KAAI,QAAQ,aAAa,KACvB,OAAM,MAAM,MAAM;CAGpB,IAAIC;AACJ,KAAI,QAAQ,kBAAkB,MAAM;AAClC,MAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,cAAc,QAAW;AACvE,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,iFAAiF,OAAO,KAAK,IAC9F;;AAEH,MAAI;AACF,YAAS,MAAM,cAAc,OAAO,KAAK,UAAU;WAC5C,KAAK;AACZ,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,qDAAqD,OAAO,KAAK,UAAU,KAAM,IAAc,WAC/F,EAAE,OAAO,KAAK,CACf;;;AAWL,QAP0B,OAAO,OAAO;EACtC,YAAY,OAAO;EACnB;EACA;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,aAAa,MAAM,OAAO;EAC3B,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@graphorin/cli",
-  "version": "0.5.0",
-  "description": "Operator CLI for the Graphorin framework. Phase 14a ships the minimal `graphorin` binary with three commands: `graphorin start` (boot the standalone server with lifecycle hooks + pre-bind validation + storage migrations + audit log), `graphorin init` (interactive prompts for cloud-upload consent, opt-in storage encryption, and one-shot bootstrap-token issuance; --non-interactive accepts every option as flags or env vars), and `graphorin migrate` (idempotent storage migrations against the configured SQLite store). Phase 15 extends the same binary with `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `migrate-export`, `guard`, and `telemetry`. Created and maintained by Oleksiy Stepurenko.",
+  "version": "0.6.0",
+  "description": "Operator CLI for the Graphorin framework. The `graphorin` binary covers the standalone server and the local stores end to end: `start`, `init`, `migrate`, `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `guard`, `telemetry`, `tools`, and `migrate-export`. Created and maintained by Oleksiy Stepurenko.",
   "license": "MIT",
   "author": "Oleksiy Stepurenko",
   "homepage": "https://github.com/o-stepper/graphorin/tree/main/packages/cli",
@@ -52,22 +52,22 @@
   ],
   "dependencies": {
     "commander": "^10.0.0",
-    "@graphorin/core": "0.5.0",
-    "@graphorin/eslint-plugin": "0.5.0",
-    "@graphorin/memory": "0.5.0",
-    "@graphorin/pricing": "0.5.0",
-    "@graphorin/security": "0.5.0",
-    "@graphorin/server": "0.5.0",
-    "@graphorin/sessions": "0.5.0",
-    "@graphorin/skills": "0.5.0",
-    "@graphorin/store-sqlite": "0.5.0"
+    "@graphorin/core": "0.6.0",
+    "@graphorin/eslint-plugin": "0.6.0",
+    "@graphorin/memory": "0.6.0",
+    "@graphorin/pricing": "0.6.0",
+    "@graphorin/security": "0.6.0",
+    "@graphorin/server": "0.6.0",
+    "@graphorin/sessions": "0.6.0",
+    "@graphorin/skills": "0.6.0",
+    "@graphorin/store-sqlite": "0.6.0"
   },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "devDependencies": {
-    "@graphorin/store-sqlite-encrypted": "0.5.0"
+    "@graphorin/store-sqlite-encrypted": "0.6.0"
   },
   "scripts": {
     "build": "tsdown",