@graphorin/cli 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @graphorin/cli
 
+## 0.6.1
+
+### Patch Changes
+
+- [#142](https://github.com/o-stepper/graphorin/pull/142) [`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430) Thanks [@o-stepper](https://github.com/o-stepper)! - Version constants and version-bearing strings now derive from each package's manifest at build time (`VERSION = pkg.version`; writer ids, client/server info, OTLP framework attributes, build-info metrics interpolate it). No behavioral change at the current version: the rendered strings are byte-identical. A release bump no longer edits source; the new `check-version-consistency` gate fails any reintroduced hardcoded framework version.
+
+- Updated dependencies [[`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430)]:
+  - @graphorin/core@0.6.1
+  - @graphorin/eslint-plugin@0.6.1
+  - @graphorin/memory@0.6.1
+  - @graphorin/pricing@0.6.1
+  - @graphorin/security@0.6.1
+  - @graphorin/server@0.6.1
+  - @graphorin/sessions@0.6.1
+  - @graphorin/skills@0.6.1
+  - @graphorin/store-sqlite@0.6.1
+
 ## 0.6.0
 
 ### Patch Changes

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Node.js: 22+](https://img.shields.io/badge/Node.js-22%2B-43853d.svg)](https://nodejs.org)
 
-- **Version:** v0.6.0
+- **Version:** v0.6.1
 - **License:** [MIT](./LICENSE) (© 2026 Oleksiy Stepurenko)
 - **Repository:** <https://github.com/o-stepper/graphorin/tree/main/packages/cli>
 - **Issues:** <https://github.com/o-stepper/graphorin/issues>
@@ -44,7 +44,7 @@
 
 | Command | Purpose |
 |---|---|
-| `graphorin storage status / encrypt / rekey / cleanup-backups` | Inspect + encrypt + re-key the SQLite store. `encrypt` and `rekey` require the `@graphorin/store-sqlite-encrypted` sub-pack from Phase 16. |
+| `graphorin storage status / backup / encrypt / rekey / cleanup-backups` | Inspect, back up (online, consistent copy via the driver's page-level backup API), encrypt, and re-key the SQLite store. `encrypt` and `rekey` require the `@graphorin/store-sqlite-encrypted` sub-pack from Phase 16. |
 | `graphorin audit verify / prune / export` | Operate on the encrypted, hash-chained audit log (DEC-124). |
 | `graphorin memory status / migrate` | Inspect counts + active embedder; `migrate` swaps embedders. |
 | `graphorin consolidator status / set-tier / stop` | Inspect + steer the background memory consolidator (DEC-134 / ADR-038). |
@@ -123,8 +123,8 @@ Phase 15 ships ready-to-copy templates for production deployments:
 
 ## Status
 
-`@graphorin/cli` is part of the Graphorin framework's `v0.6.0` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
+`@graphorin/cli` is part of the Graphorin framework's `v0.6.1` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
 
 ---
 
-**Project Graphorin** · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>
+**Project Graphorin** · v0.6.1 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","names":[],"sources":["../../src/commands/doctor.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAkDiB,oBAAA,SAA6B;;;;;;;;;;;;;;;;;;;;;yCAqBL;;;;;UAMxB,YAAA;;;qBAGI,MAAA,CAAO;mBACT,cAAc;;;;;;;wBAOT;;;;;;;;iBASF,SAAA,WAAmB,uBAA4B,QAAQ;;;;;;;iBA4F7D,iBAAA,gBAAiC,SAAS"}
+{"version":3,"file":"doctor.d.ts","names":[],"sources":["../../src/commands/doctor.ts"],"sourcesContent":[],"mappings":";;;;;;;AAmDA;AA2BiB,UA3BA,oBAAA,SAA6B,mBA2BjB,CAAA;EAGR;;;;EAQgB,SAAA,IAAA,CAAA,EAAA,MAAA;EASf;EAAmB,SAAA,QAAA,CAAA,EAAA,OAAA;EAAoC;EAAR,SAAA,UAAA,CAAA,EAAA,OAAA;EAAO;EA4F5D,SAAA,YAAiB,CAAA,EAAA,OAAyB;;;;;;;;;;yCAtHjB;;;;;UAMxB,YAAA;;;qBAGI,MAAA,CAAO;mBACT,cAAc;;;;;;;wBAOT;;;;;;;;iBASF,SAAA,WAAmB,uBAA4B,QAAQ;;;;;;;iBA4F7D,iBAAA,gBAAiC,SAAS"}

package/dist/commands/doctor.js

@@ -1,3 +1,4 @@
+import { version } from "../package.js";
 import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
 import { EXIT_CODES } from "../internal/exit.js";
 import { join } from "node:path";
@@ -81,7 +82,7 @@ async function runDoctor(options = {}) {
 	};
 	for (const c of checks) summary[c.status] += 1;
 	const report = Object.freeze({
-		version: "0.6.0",
+		version,
 		home,
 		platform: process.platform,
 		checks: Object.freeze(checks),

package/dist/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","names":["checks: CheckResult[]","fixed: string[]","summary: Record<'ok' | 'warn' | 'fail' | 'skip', number>","report: DoctorReport"],"sources":["../../src/commands/doctor.ts"],"sourcesContent":["/**\n * `graphorin doctor` - host health check.\n *\n * Wraps the read-only library helpers in `@graphorin/security/hardening`\n * (`checkPerms`, `checkSecrets`, `checkEncryption`, `checkSystemd`)\n * with `--fix-perms` repair, `--all` aggregation, JSON output for CI\n * pipelines, and exit-code semantics:\n *\n *  - exit `0` - every check passed (`fail` count is `0`).\n *  - exit `1` - at least one check returned `'fail'`.\n *  - exit `2` - invocation could not even start (e.g. config missing\n *    when `--check-secrets` requires the bootstrapped store).\n *\n * The doctor never writes to disk unless `--fix-perms` is supplied.\n * When repair is requested the CLI calls `ensureFileMode(...)` /\n * `ensureDirMode(...)` from `@graphorin/security/hardening` and re-runs\n * the perms check so the report reflects the post-fix state.\n *\n * Source-of-truth: process-hardening + `graphorin doctor` policy\n * (DEC-135).\n *\n * @packageDocumentation\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport process from 'node:process';\n\nimport {\n  type CheckResult,\n  checkEncryption,\n  checkPerms,\n  checkSecrets,\n  checkSystemd,\n  ensureDirMode,\n  ensureFileMode,\n} from '@graphorin/security';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/**\n * @stable\n */\nexport interface DoctorCommandOptions extends CommonOutputOptions {\n  /**\n   * Override the directory the doctor checks. Defaults to\n   * `~/.graphorin/`. Tests inject a fresh tmp dir.\n   */\n  readonly home?: string;\n  /** Run the file-perms repair. */\n  readonly fixPerms?: boolean;\n  /** Run the file-perms check. Implied by `--all`. */\n  readonly checkPerms?: boolean;\n  /** Run the secrets-store check. */\n  readonly checkSecrets?: boolean;\n  /** Run the audit-encryption check. */\n  readonly checkEncryption?: boolean;\n  /** Run the systemd check. Linux-only. */\n  readonly checkSystemd?: boolean;\n  /** Optional systemd unit identifier (default `graphorin.service`). */\n  readonly systemdUnit?: string;\n  /** Run every check. Equivalent to passing every `--check-*` flag. */\n  readonly all?: boolean;\n  /** Test seam - supply a custom systemd executor. */\n  readonly systemdRun?: (cmd: string) => Promise<string>;\n}\n\n/**\n * @stable\n */\nexport interface DoctorReport {\n  readonly version: string;\n  readonly home: string;\n  readonly platform: NodeJS.Platform;\n  readonly checks: ReadonlyArray<CheckResult>;\n  readonly summary: {\n    readonly ok: number;\n    readonly warn: number;\n    readonly fail: number;\n    readonly skip: number;\n  };\n  readonly fixedPerms?: ReadonlyArray<string>;\n}\n\n/**\n * Programmatic entry point. Returns the {@link DoctorReport} so tests\n * and downstream automations consume the structured payload directly.\n *\n * @stable\n */\nexport async function runDoctor(options: DoctorCommandOptions = {}): Promise<DoctorReport> {\n  const home = options.home ?? join(homedir(), '.graphorin');\n  const expected = expectedFileModes(home);\n\n  const enable = expandFlags(options);\n  const checks: CheckResult[] = [];\n  const fixed: string[] = [];\n\n  if (enable.perms) {\n    if (options.fixPerms === true) {\n      const before = await checkPerms({ expected });\n      for (const result of before) {\n        if (result.status === 'fail' && expected[result.check] !== undefined) {\n          const mode = expected[result.check] as number;\n          try {\n            if (mode === 0o700) {\n              await ensureDirMode(result.check, mode);\n            } else {\n              await ensureFileMode(result.check, mode);\n            }\n            fixed.push(result.check);\n          } catch (err) {\n            checks.push({\n              check: result.check,\n              status: 'fail',\n              message: `--fix-perms failed: ${(err as Error).message}`,\n            });\n          }\n        }\n      }\n      // Re-run after the repair so the final report reflects the\n      // post-fix state.\n      const after = await checkPerms({ expected });\n      checks.push(...after);\n    } else {\n      const result = await checkPerms({ expected });\n      checks.push(...result);\n    }\n  }\n\n  if (enable.secrets) {\n    checks.push(...checkSecrets());\n  }\n\n  if (enable.encryption) {\n    checks.push(...checkEncryption());\n  }\n\n  if (enable.systemd) {\n    const unit =\n      options.systemdUnit ?? (process.platform === 'linux' ? 'graphorin.service' : undefined);\n    const result = await checkSystemd({\n      ...(unit !== undefined ? { unit } : {}),\n      ...(options.systemdRun !== undefined ? { run: options.systemdRun } : {}),\n    });\n    checks.push(...result);\n  }\n\n  const summary: Record<'ok' | 'warn' | 'fail' | 'skip', number> = {\n    ok: 0,\n    warn: 0,\n    fail: 0,\n    skip: 0,\n  };\n  for (const c of checks) {\n    summary[c.status] += 1;\n  }\n\n  const report: DoctorReport = Object.freeze({\n    version: '0.6.0',\n    home,\n    platform: process.platform,\n    checks: Object.freeze(checks),\n    summary: Object.freeze(summary),\n    ...(fixed.length > 0 ? { fixedPerms: Object.freeze(fixed) } : {}),\n  });\n\n  emitReport(options, report, () => emitHumanReport(report, options));\n\n  if (summary.fail > 0) {\n    process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;\n  }\n\n  return report;\n}\n\n/**\n * Default expected file modes per the project's process-hardening\n * policy (DEC-135).\n *\n * @internal\n */\nexport function expectedFileModes(home: string): Readonly<Record<string, number>> {\n  return Object.freeze({\n    [home]: 0o700,\n    [`${home}/config.json`]: 0o600,\n    [`${home}/data.db`]: 0o600,\n    [`${home}/audit.db`]: 0o600,\n    [`${home}/secrets.kse`]: 0o600,\n  });\n}\n\ninterface DoctorChecks {\n  readonly perms: boolean;\n  readonly secrets: boolean;\n  readonly encryption: boolean;\n  readonly systemd: boolean;\n}\n\nfunction expandFlags(options: DoctorCommandOptions): DoctorChecks {\n  if (options.all === true) {\n    return { perms: true, secrets: true, encryption: true, systemd: true };\n  }\n  const explicit =\n    options.checkPerms === true ||\n    options.checkSecrets === true ||\n    options.checkEncryption === true ||\n    options.checkSystemd === true ||\n    options.fixPerms === true;\n  if (!explicit) {\n    return { perms: true, secrets: false, encryption: false, systemd: false };\n  }\n  return {\n    perms: options.checkPerms === true || options.fixPerms === true,\n    secrets: options.checkSecrets === true,\n    encryption: options.checkEncryption === true,\n    systemd: options.checkSystemd === true,\n  };\n}\n\nfunction emitHumanReport(report: DoctorReport, options: DoctorCommandOptions): void {\n  const print = options.print ?? defaultPrintSink;\n  print(\n    brand(\n      `graphorin doctor v${report.version} (host: ${report.home}, platform: ${report.platform})`,\n    ),\n  );\n  if (report.fixedPerms !== undefined) {\n    print(brand(`--fix-perms repaired:`));\n    for (const path of report.fixedPerms) print(`  - ${path}`);\n  }\n  if (report.checks.length === 0) {\n    print(brand('no checks were enabled. Pass --all or one of --check-*.'));\n    return;\n  }\n  for (const c of report.checks) {\n    print(`  ${statusMarker(c.status)} ${c.check}: ${c.message}`);\n    if (c.hint !== undefined) print(`        -> ${c.hint}`);\n  }\n  print(\n    brand(\n      `summary: ${report.summary.ok} ok, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`,\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGA,eAAsB,UAAU,UAAgC,EAAE,EAAyB;CACzF,MAAM,OAAO,QAAQ,QAAQ,KAAK,SAAS,EAAE,aAAa;CAC1D,MAAM,WAAW,kBAAkB,KAAK;CAExC,MAAM,SAAS,YAAY,QAAQ;CACnC,MAAMA,SAAwB,EAAE;CAChC,MAAMC,QAAkB,EAAE;AAE1B,KAAI,OAAO,MACT,KAAI,QAAQ,aAAa,MAAM;EAC7B,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,OAAK,MAAM,UAAU,OACnB,KAAI,OAAO,WAAW,UAAU,SAAS,OAAO,WAAW,QAAW;GACpE,MAAM,OAAO,SAAS,OAAO;AAC7B,OAAI;AACF,QAAI,SAAS,IACX,OAAM,cAAc,OAAO,OAAO,KAAK;QAEvC,OAAM,eAAe,OAAO,OAAO,KAAK;AAE1C,UAAM,KAAK,OAAO,MAAM;YACjB,KAAK;AACZ,WAAO,KAAK;KACV,OAAO,OAAO;KACd,QAAQ;KACR,SAAS,uBAAwB,IAAc;KAChD,CAAC;;;EAMR,MAAM,QAAQ,MAAM,WAAW,EAAE,UAAU,CAAC;AAC5C,SAAO,KAAK,GAAG,MAAM;QAChB;EACL,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,SAAO,KAAK,GAAG,OAAO;;AAI1B,KAAI,OAAO,QACT,QAAO,KAAK,GAAG,cAAc,CAAC;AAGhC,KAAI,OAAO,WACT,QAAO,KAAK,GAAG,iBAAiB,CAAC;AAGnC,KAAI,OAAO,SAAS;EAClB,MAAM,OACJ,QAAQ,gBAAgB,QAAQ,aAAa,UAAU,sBAAsB;EAC/E,MAAM,SAAS,MAAM,aAAa;GAChC,GAAI,SAAS,SAAY,EAAE,MAAM,GAAG,EAAE;GACtC,GAAI,QAAQ,eAAe,SAAY,EAAE,KAAK,QAAQ,YAAY,GAAG,EAAE;GACxE,CAAC;AACF,SAAO,KAAK,GAAG,OAAO;;CAGxB,MAAMC,UAA2D;EAC/D,IAAI;EACJ,MAAM;EACN,MAAM;EACN,MAAM;EACP;AACD,MAAK,MAAM,KAAK,OACd,SAAQ,EAAE,WAAW;CAGvB,MAAMC,SAAuB,OAAO,OAAO;EACzC,SAAS;EACT;EACA,UAAU,QAAQ;EAClB,QAAQ,OAAO,OAAO,OAAO;EAC7B,SAAS,OAAO,OAAO,QAAQ;EAC/B,GAAI,MAAM,SAAS,IAAI,EAAE,YAAY,OAAO,OAAO,MAAM,EAAE,GAAG,EAAE;EACjE,CAAC;AAEF,YAAW,SAAS,cAAc,gBAAgB,QAAQ,QAAQ,CAAC;AAEnE,KAAI,QAAQ,OAAO,EACjB,SAAQ,WAAW,WAAW;AAGhC,QAAO;;;;;;;;AAST,SAAgB,kBAAkB,MAAgD;AAChF,QAAO,OAAO,OAAO;GAClB,OAAO;GACP,GAAG,KAAK,gBAAgB;GACxB,GAAG,KAAK,YAAY;GACpB,GAAG,KAAK,aAAa;GACrB,GAAG,KAAK,gBAAgB;EAC1B,CAAC;;AAUJ,SAAS,YAAY,SAA6C;AAChE,KAAI,QAAQ,QAAQ,KAClB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAM,YAAY;EAAM,SAAS;EAAM;AAQxE,KAAI,EALF,QAAQ,eAAe,QACvB,QAAQ,iBAAiB,QACzB,QAAQ,oBAAoB,QAC5B,QAAQ,iBAAiB,QACzB,QAAQ,aAAa,MAErB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAO,YAAY;EAAO,SAAS;EAAO;AAE3E,QAAO;EACL,OAAO,QAAQ,eAAe,QAAQ,QAAQ,aAAa;EAC3D,SAAS,QAAQ,iBAAiB;EAClC,YAAY,QAAQ,oBAAoB;EACxC,SAAS,QAAQ,iBAAiB;EACnC;;AAGH,SAAS,gBAAgB,QAAsB,SAAqC;CAClF,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OACE,MACE,qBAAqB,OAAO,QAAQ,UAAU,OAAO,KAAK,cAAc,OAAO,SAAS,GACzF,CACF;AACD,KAAI,OAAO,eAAe,QAAW;AACnC,QAAM,MAAM,wBAAwB,CAAC;AACrC,OAAK,MAAM,QAAQ,OAAO,WAAY,OAAM,OAAO,OAAO;;AAE5D,KAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,QAAM,MAAM,0DAA0D,CAAC;AACvE;;AAEF,MAAK,MAAM,KAAK,OAAO,QAAQ;AAC7B,QAAM,KAAK,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,UAAU;AAC7D,MAAI,EAAE,SAAS,OAAW,OAAM,cAAc,EAAE,OAAO;;AAEzD,OACE,MACE,YAAY,OAAO,QAAQ,GAAG,OAAO,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,OACpH,CACF"}
+{"version":3,"file":"doctor.js","names":["checks: CheckResult[]","fixed: string[]","summary: Record<'ok' | 'warn' | 'fail' | 'skip', number>","report: DoctorReport","pkg.version"],"sources":["../../src/commands/doctor.ts"],"sourcesContent":["import pkg from '../../package.json' with { type: 'json' };\n/**\n * `graphorin doctor` - host health check.\n *\n * Wraps the read-only library helpers in `@graphorin/security/hardening`\n * (`checkPerms`, `checkSecrets`, `checkEncryption`, `checkSystemd`)\n * with `--fix-perms` repair, `--all` aggregation, JSON output for CI\n * pipelines, and exit-code semantics:\n *\n *  - exit `0` - every check passed (`fail` count is `0`).\n *  - exit `1` - at least one check returned `'fail'`.\n *  - exit `2` - invocation could not even start (e.g. config missing\n *    when `--check-secrets` requires the bootstrapped store).\n *\n * The doctor never writes to disk unless `--fix-perms` is supplied.\n * When repair is requested the CLI calls `ensureFileMode(...)` /\n * `ensureDirMode(...)` from `@graphorin/security/hardening` and re-runs\n * the perms check so the report reflects the post-fix state.\n *\n * Source-of-truth: process-hardening + `graphorin doctor` policy\n * (DEC-135).\n *\n * @packageDocumentation\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport process from 'node:process';\n\nimport {\n  type CheckResult,\n  checkEncryption,\n  checkPerms,\n  checkSecrets,\n  checkSystemd,\n  ensureDirMode,\n  ensureFileMode,\n} from '@graphorin/security';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/**\n * @stable\n */\nexport interface DoctorCommandOptions extends CommonOutputOptions {\n  /**\n   * Override the directory the doctor checks. Defaults to\n   * `~/.graphorin/`. Tests inject a fresh tmp dir.\n   */\n  readonly home?: string;\n  /** Run the file-perms repair. */\n  readonly fixPerms?: boolean;\n  /** Run the file-perms check. Implied by `--all`. */\n  readonly checkPerms?: boolean;\n  /** Run the secrets-store check. */\n  readonly checkSecrets?: boolean;\n  /** Run the audit-encryption check. */\n  readonly checkEncryption?: boolean;\n  /** Run the systemd check. Linux-only. */\n  readonly checkSystemd?: boolean;\n  /** Optional systemd unit identifier (default `graphorin.service`). */\n  readonly systemdUnit?: string;\n  /** Run every check. Equivalent to passing every `--check-*` flag. */\n  readonly all?: boolean;\n  /** Test seam - supply a custom systemd executor. */\n  readonly systemdRun?: (cmd: string) => Promise<string>;\n}\n\n/**\n * @stable\n */\nexport interface DoctorReport {\n  readonly version: string;\n  readonly home: string;\n  readonly platform: NodeJS.Platform;\n  readonly checks: ReadonlyArray<CheckResult>;\n  readonly summary: {\n    readonly ok: number;\n    readonly warn: number;\n    readonly fail: number;\n    readonly skip: number;\n  };\n  readonly fixedPerms?: ReadonlyArray<string>;\n}\n\n/**\n * Programmatic entry point. Returns the {@link DoctorReport} so tests\n * and downstream automations consume the structured payload directly.\n *\n * @stable\n */\nexport async function runDoctor(options: DoctorCommandOptions = {}): Promise<DoctorReport> {\n  const home = options.home ?? join(homedir(), '.graphorin');\n  const expected = expectedFileModes(home);\n\n  const enable = expandFlags(options);\n  const checks: CheckResult[] = [];\n  const fixed: string[] = [];\n\n  if (enable.perms) {\n    if (options.fixPerms === true) {\n      const before = await checkPerms({ expected });\n      for (const result of before) {\n        if (result.status === 'fail' && expected[result.check] !== undefined) {\n          const mode = expected[result.check] as number;\n          try {\n            if (mode === 0o700) {\n              await ensureDirMode(result.check, mode);\n            } else {\n              await ensureFileMode(result.check, mode);\n            }\n            fixed.push(result.check);\n          } catch (err) {\n            checks.push({\n              check: result.check,\n              status: 'fail',\n              message: `--fix-perms failed: ${(err as Error).message}`,\n            });\n          }\n        }\n      }\n      // Re-run after the repair so the final report reflects the\n      // post-fix state.\n      const after = await checkPerms({ expected });\n      checks.push(...after);\n    } else {\n      const result = await checkPerms({ expected });\n      checks.push(...result);\n    }\n  }\n\n  if (enable.secrets) {\n    checks.push(...checkSecrets());\n  }\n\n  if (enable.encryption) {\n    checks.push(...checkEncryption());\n  }\n\n  if (enable.systemd) {\n    const unit =\n      options.systemdUnit ?? (process.platform === 'linux' ? 'graphorin.service' : undefined);\n    const result = await checkSystemd({\n      ...(unit !== undefined ? { unit } : {}),\n      ...(options.systemdRun !== undefined ? { run: options.systemdRun } : {}),\n    });\n    checks.push(...result);\n  }\n\n  const summary: Record<'ok' | 'warn' | 'fail' | 'skip', number> = {\n    ok: 0,\n    warn: 0,\n    fail: 0,\n    skip: 0,\n  };\n  for (const c of checks) {\n    summary[c.status] += 1;\n  }\n\n  const report: DoctorReport = Object.freeze({\n    version: pkg.version,\n    home,\n    platform: process.platform,\n    checks: Object.freeze(checks),\n    summary: Object.freeze(summary),\n    ...(fixed.length > 0 ? { fixedPerms: Object.freeze(fixed) } : {}),\n  });\n\n  emitReport(options, report, () => emitHumanReport(report, options));\n\n  if (summary.fail > 0) {\n    process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;\n  }\n\n  return report;\n}\n\n/**\n * Default expected file modes per the project's process-hardening\n * policy (DEC-135).\n *\n * @internal\n */\nexport function expectedFileModes(home: string): Readonly<Record<string, number>> {\n  return Object.freeze({\n    [home]: 0o700,\n    [`${home}/config.json`]: 0o600,\n    [`${home}/data.db`]: 0o600,\n    [`${home}/audit.db`]: 0o600,\n    [`${home}/secrets.kse`]: 0o600,\n  });\n}\n\ninterface DoctorChecks {\n  readonly perms: boolean;\n  readonly secrets: boolean;\n  readonly encryption: boolean;\n  readonly systemd: boolean;\n}\n\nfunction expandFlags(options: DoctorCommandOptions): DoctorChecks {\n  if (options.all === true) {\n    return { perms: true, secrets: true, encryption: true, systemd: true };\n  }\n  const explicit =\n    options.checkPerms === true ||\n    options.checkSecrets === true ||\n    options.checkEncryption === true ||\n    options.checkSystemd === true ||\n    options.fixPerms === true;\n  if (!explicit) {\n    return { perms: true, secrets: false, encryption: false, systemd: false };\n  }\n  return {\n    perms: options.checkPerms === true || options.fixPerms === true,\n    secrets: options.checkSecrets === true,\n    encryption: options.checkEncryption === true,\n    systemd: options.checkSystemd === true,\n  };\n}\n\nfunction emitHumanReport(report: DoctorReport, options: DoctorCommandOptions): void {\n  const print = options.print ?? defaultPrintSink;\n  print(\n    brand(\n      `graphorin doctor v${report.version} (host: ${report.home}, platform: ${report.platform})`,\n    ),\n  );\n  if (report.fixedPerms !== undefined) {\n    print(brand(`--fix-perms repaired:`));\n    for (const path of report.fixedPerms) print(`  - ${path}`);\n  }\n  if (report.checks.length === 0) {\n    print(brand('no checks were enabled. Pass --all or one of --check-*.'));\n    return;\n  }\n  for (const c of report.checks) {\n    print(`  ${statusMarker(c.status)} ${c.check}: ${c.message}`);\n    if (c.hint !== undefined) print(`        -> ${c.hint}`);\n  }\n  print(\n    brand(\n      `summary: ${report.summary.ok} ok, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`,\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkGA,eAAsB,UAAU,UAAgC,EAAE,EAAyB;CACzF,MAAM,OAAO,QAAQ,QAAQ,KAAK,SAAS,EAAE,aAAa;CAC1D,MAAM,WAAW,kBAAkB,KAAK;CAExC,MAAM,SAAS,YAAY,QAAQ;CACnC,MAAMA,SAAwB,EAAE;CAChC,MAAMC,QAAkB,EAAE;AAE1B,KAAI,OAAO,MACT,KAAI,QAAQ,aAAa,MAAM;EAC7B,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,OAAK,MAAM,UAAU,OACnB,KAAI,OAAO,WAAW,UAAU,SAAS,OAAO,WAAW,QAAW;GACpE,MAAM,OAAO,SAAS,OAAO;AAC7B,OAAI;AACF,QAAI,SAAS,IACX,OAAM,cAAc,OAAO,OAAO,KAAK;QAEvC,OAAM,eAAe,OAAO,OAAO,KAAK;AAE1C,UAAM,KAAK,OAAO,MAAM;YACjB,KAAK;AACZ,WAAO,KAAK;KACV,OAAO,OAAO;KACd,QAAQ;KACR,SAAS,uBAAwB,IAAc;KAChD,CAAC;;;EAMR,MAAM,QAAQ,MAAM,WAAW,EAAE,UAAU,CAAC;AAC5C,SAAO,KAAK,GAAG,MAAM;QAChB;EACL,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,SAAO,KAAK,GAAG,OAAO;;AAI1B,KAAI,OAAO,QACT,QAAO,KAAK,GAAG,cAAc,CAAC;AAGhC,KAAI,OAAO,WACT,QAAO,KAAK,GAAG,iBAAiB,CAAC;AAGnC,KAAI,OAAO,SAAS;EAClB,MAAM,OACJ,QAAQ,gBAAgB,QAAQ,aAAa,UAAU,sBAAsB;EAC/E,MAAM,SAAS,MAAM,aAAa;GAChC,GAAI,SAAS,SAAY,EAAE,MAAM,GAAG,EAAE;GACtC,GAAI,QAAQ,eAAe,SAAY,EAAE,KAAK,QAAQ,YAAY,GAAG,EAAE;GACxE,CAAC;AACF,SAAO,KAAK,GAAG,OAAO;;CAGxB,MAAMC,UAA2D;EAC/D,IAAI;EACJ,MAAM;EACN,MAAM;EACN,MAAM;EACP;AACD,MAAK,MAAM,KAAK,OACd,SAAQ,EAAE,WAAW;CAGvB,MAAMC,SAAuB,OAAO,OAAO;EAChCC;EACT;EACA,UAAU,QAAQ;EAClB,QAAQ,OAAO,OAAO,OAAO;EAC7B,SAAS,OAAO,OAAO,QAAQ;EAC/B,GAAI,MAAM,SAAS,IAAI,EAAE,YAAY,OAAO,OAAO,MAAM,EAAE,GAAG,EAAE;EACjE,CAAC;AAEF,YAAW,SAAS,cAAc,gBAAgB,QAAQ,QAAQ,CAAC;AAEnE,KAAI,QAAQ,OAAO,EACjB,SAAQ,WAAW,WAAW;AAGhC,QAAO;;;;;;;;AAST,SAAgB,kBAAkB,MAAgD;AAChF,QAAO,OAAO,OAAO;GAClB,OAAO;GACP,GAAG,KAAK,gBAAgB;GACxB,GAAG,KAAK,YAAY;GACpB,GAAG,KAAK,aAAa;GACrB,GAAG,KAAK,gBAAgB;EAC1B,CAAC;;AAUJ,SAAS,YAAY,SAA6C;AAChE,KAAI,QAAQ,QAAQ,KAClB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAM,YAAY;EAAM,SAAS;EAAM;AAQxE,KAAI,EALF,QAAQ,eAAe,QACvB,QAAQ,iBAAiB,QACzB,QAAQ,oBAAoB,QAC5B,QAAQ,iBAAiB,QACzB,QAAQ,aAAa,MAErB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAO,YAAY;EAAO,SAAS;EAAO;AAE3E,QAAO;EACL,OAAO,QAAQ,eAAe,QAAQ,QAAQ,aAAa;EAC3D,SAAS,QAAQ,iBAAiB;EAClC,YAAY,QAAQ,oBAAoB;EACxC,SAAS,QAAQ,iBAAiB;EACnC;;AAGH,SAAS,gBAAgB,QAAsB,SAAqC;CAClF,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OACE,MACE,qBAAqB,OAAO,QAAQ,UAAU,OAAO,KAAK,cAAc,OAAO,SAAS,GACzF,CACF;AACD,KAAI,OAAO,eAAe,QAAW;AACnC,QAAM,MAAM,wBAAwB,CAAC;AACrC,OAAK,MAAM,QAAQ,OAAO,WAAY,OAAM,OAAO,OAAO;;AAE5D,KAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,QAAM,MAAM,0DAA0D,CAAC;AACvE;;AAEF,MAAK,MAAM,KAAK,OAAO,QAAQ;AAC7B,QAAM,KAAK,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,UAAU;AAC7D,MAAI,EAAE,SAAS,OAAW,OAAM,cAAc,EAAE,OAAO;;AAEzD,OACE,MACE,YAAY,OAAO,QAAQ,GAAG,OAAO,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,OACpH,CACF"}

package/dist/commands/memory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.d.ts","names":[],"sources":["../../src/commands/memory.ts"],"sourcesContent":[],"mappings":";;;;;AAyPgC,UAxNf,mBAAA,SAA4B,mBAwNb,CAAA;EAAd,SAAA,MAAA,CAAA,EAAA,MAAA;;;AAEkB,UArNnB,oBAAA,CAqNmB;EAAd,SAAA,EAAA,EAAA,MAAA;EACmB,SAAA,KAAA,EAAA,MAAA;EAAd,SAAA,GAAA,EAAA,MAAA;EAEc,SAAA,cAAA,EAAA,MAAA;EAAd,SAAA,OAAA,EAAA,OAAA;EAAa,SAAA,SAAA,EAAA,MAAA;EAIvB,SAAA,SAAA,CAAA,EAAA,MAAqB;AAatC;;AAEW,UAhOM,kBAAA,CAgON;EAAR,SAAA,WAAA,EAAA,MAAA;EAAO,SAAA,SAAA,EA9NY,aA8NZ,CA9N0B,oBA8N1B,CAAA;EAwJO,SAAA,MAAA,EAAA;IASA,SAAA,KAAA,EAAA,MAAsB;IAStB,SAAA,QAAA,EAAoB,MAAA;IAMG,SAAA,eAAA,EAAA,MAAA;IAAd,SAAA,UAAA,EAAA,MAAA;EACgB,CAAA;;;AAIzB,iBAzYK,eAAA,CAyYiB,OAA2B,CAAnB,EAxYpC,mBAwYuD,CAAA,EAvY/D,OAuY+D,CAvYvD,kBAuYuD,CAAA;AAclE;AACW,UAtWM,oBAAA,SAA6B,mBAsWnC,CAAA;EACA,SAAA,IAAA,EAAA,MAAA;EAAR,SAAA,EAAA,EAAA,MAAA;EAAO,SAAA,QAAA,EAAA,eAAA,GAAA,cAAA,GAAA,cAAA;EAiGO;;;;;AAajB;AAKA;EAqBsB,SAAA,eAAY,CAAA,EAAA,MAAA;;;;;AAyElC;AAOA;;;;AAIqB,iBA7iBC,gBAAA,CA6iBD,OAAA,EA7iB2B,oBA6iB3B,CAAA,EA7iBkD,OA6iBlD,CAAA,KAAA,CAAA;;AACA,UAnfJ,iBAAA,CAmfI;EACgB,SAAA,EAAA,EAAA,MAAA;EAAd,SAAA,IAAA,EAAA,MAAA;EAAa,SAAA,MAAA,EAAA,MAAA;EAInB,SAAA,UAAA,EAAA,MAAoB,GAAA,IAAA;EA2Bf;EACX,SAAA,UAAA,EAAA,MAAA,GAAA,IAAA;EACA,SAAA,SAAA,EAAA,MAAA,GAAA,IAAA;EAAR,SAAA,OAAA,EAAA,MAAA,GAAA,IAAA;EAAO,SAAA,UAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;;;UAjgBO,mBAAA;;;;;;;;UASA,kBAAA;;;;;;UAOA,mBAAA;;;;;;;;;UAUA,mBAAA;;;;;;;UAQA,mBAAA;;iBAEA;kBACC,cAAc;oBACZ,cAAc;sBACZ,cAAc;2BACT,cAAc;;2BAEd,cAAc;;;UAIxB,oBAAA,SAA6B;;;;;;;;;;;;iBAaxB,gBAAA,UACX,uBACR,QAAQ;;UAwJM,mBAAA;;;;;;;;UASA,sBAAA;;;;;;;;UASA,oBAAA;;;;;;0BAMS,cAAc;4BACZ,cAAc;;;UAIzB,qBAAA,SAA8B;;;;;;;;;;;;;iBAczB,iBAAA,WACX,wBACR,QAAQ;;UAiGM,eAAA;;;;oBAIG;;;;sBAIE,SAAS;;;;UAKd,eAAA;oBACG,cAAc;;;UAIjB,gBAAA,SAAyB;;;;;;;;;;;;;;iBAqBpB,YAAA,UAAsB,mBAAmB,QAAQ;;UAyEtD,gBAAA;;;;;;UAOA,kBAAA;;;;;;kBAGC,cAAc;qBACX,cAAc;qBACd,cAAc;uBACZ,cAAc;;;UAIpB,mBAAA,SAA4B;;;;;;;;;;;;;;;;;;;iBA2BvB,eAAA,WACX,sBACR,QAAQ"}
+{"version":3,"file":"memory.d.ts","names":[],"sources":["../../src/commands/memory.ts"],"sourcesContent":[],"mappings":";;;;;AAyPgC,UAxNf,mBAAA,SAA4B,mBAwNb,CAAA;EAAd,SAAA,MAAA,CAAA,EAAA,MAAA;;;AAEkB,UArNnB,oBAAA,CAqNmB;EAAd,SAAA,EAAA,EAAA,MAAA;EACmB,SAAA,KAAA,EAAA,MAAA;EAAd,SAAA,GAAA,EAAA,MAAA;EAEc,SAAA,cAAA,EAAA,MAAA;EAAd,SAAA,OAAA,EAAA,OAAA;EAAa,SAAA,SAAA,EAAA,MAAA;EAIvB,SAAA,SAAA,CAAA,EAAA,MAAqB;AAatC;;AAEW,UAhOM,kBAAA,CAgON;EAAR,SAAA,WAAA,EAAA,MAAA;EAAO,SAAA,SAAA,EA9NY,aA8NZ,CA9N0B,oBA8N1B,CAAA;EAwJO,SAAA,MAAA,EAAA;IASA,SAAA,KAAA,EAAA,MAAsB;IAStB,SAAA,QAAA,EAAoB,MAAA;IAMG,SAAA,eAAA,EAAA,MAAA;IAAd,SAAA,UAAA,EAAA,MAAA;EACgB,CAAA;;;AAIzB,iBAzYK,eAAA,CAyYyB,OAAmB,CAAnB,EAxYpC,mBAwYuD,CAAA,EAvY/D,OAuY+D,CAvYvD,kBAuYuD,CAAA;AAclE;AACW,UAtWM,oBAAA,SAA6B,mBAsWnC,CAAA;EACA,SAAA,IAAA,EAAA,MAAA;EAAR,SAAA,EAAA,EAAA,MAAA;EAAO,SAAA,QAAA,EAAA,eAAA,GAAA,cAAA,GAAA,cAAA;EAiGO;;;;;AAajB;AAKA;EAqBsB,SAAA,eAAY,CAAA,EAAA,MAAA;;;;;AAyElC;AAOA;;;;AAIqB,iBA7iBC,gBAAA,CA6iBD,OAAA,EA7iB2B,oBA6iB3B,CAAA,EA7iBkD,OA6iBlD,CAAA,KAAA,CAAA;;AACA,UAnfJ,iBAAA,CAmfI;EACgB,SAAA,EAAA,EAAA,MAAA;EAAd,SAAA,IAAA,EAAA,MAAA;EAAa,SAAA,MAAA,EAAA,MAAA;EAInB,SAAA,UAAA,EAAA,MAAoB,GAAA,IAAQ;EA2BvB;EACX,SAAA,UAAA,EAAA,MAAA,GAAA,IAAA;EACA,SAAA,SAAA,EAAA,MAAA,GAAA,IAAA;EAAR,SAAA,OAAA,EAAA,MAAA,GAAA,IAAA;EAAO,SAAA,UAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;;;UAjgBO,mBAAA;;;;;;;;UASA,kBAAA;;;;;;UAOA,mBAAA;;;;;;;;;UAUA,mBAAA;;;;;;;UAQA,mBAAA;;iBAEA;kBACC,cAAc;oBACZ,cAAc;sBACZ,cAAc;2BACT,cAAc;;2BAEd,cAAc;;;UAIxB,oBAAA,SAA6B;;;;;;;;;;;;iBAaxB,gBAAA,UACX,uBACR,QAAQ;;UAwJM,mBAAA;;;;;;;;UASA,sBAAA;;;;;;;;UASA,oBAAA;;;;;;0BAMS,cAAc;4BACZ,cAAc;;;UAIzB,qBAAA,SAA8B;;;;;;;;;;;;;iBAczB,iBAAA,WACX,wBACR,QAAQ;;UAiGM,eAAA;;;;oBAIG;;;;sBAIE,SAAS;;;;UAKd,eAAA;oBACG,cAAc;;;UAIjB,gBAAA,SAAyB;;;;;;;;;;;;;;iBAqBpB,YAAA,UAAsB,mBAAmB,QAAQ;;UAyEtD,gBAAA;;;;;;UAOA,kBAAA;;;;;;kBAGC,cAAc;qBACX,cAAc;qBACd,cAAc;uBACZ,cAAc;;;UAIpB,mBAAA,SAA4B;;;;;;;;;;;;;;;;;;;iBA2BvB,eAAA,WACX,sBACR,QAAQ"}

package/dist/commands/migrate-export.d.ts

@@ -1,14 +1,13 @@
 import { CommonOutputOptions } from "../internal/output.js";
 
 //#region src/commands/migrate-export.d.ts
-
 /** @stable */
 interface MigrateExportOptions extends CommonOutputOptions {
   readonly input: string;
   readonly to: string;
   /** Defaults to the writer's current schema (e.g. `'1.0'`). */
   readonly toSchema?: string;
-  /** Surfaced on the meta header. Defaults to `'graphorin-cli@0.6.0'`. */
+  /** Surfaced on the meta header. Defaults to `graphorin-cli@<version>` (the current package version). */
   readonly writer?: string;
 }
 /** @stable */

package/dist/commands/migrate-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-export.d.ts","names":[],"sources":["../../src/commands/migrate-export.ts"],"sourcesContent":[],"mappings":";;;;;UAwCiB,oBAAA,SAA6B;;;;;;;;;UAU7B,mBAAA;;;;;;;;iBASK,gBAAA,UACX,uBACR,QAAQ"}
+{"version":3,"file":"migrate-export.d.ts","names":[],"sources":["../../src/commands/migrate-export.ts"],"sourcesContent":[],"mappings":";;;;UAyCiB,oBAAA,SAA6B;EAA7B,SAAA,KAAA,EAAA,MAAA;EAUA,SAAA,EAAA,EAAA,MAAA;EASK;EACX,SAAA,QAAA,CAAA,EAAA,MAAA;EACA;EAAR,SAAA,MAAA,CAAA,EAAA,MAAA;;;UAXc,mBAAA;;;;;;;;iBASK,gBAAA,UACX,uBACR,QAAQ"}

package/dist/commands/migrate-export.js

@@ -1,3 +1,4 @@
+import { version } from "../package.js";
 import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
 import { EXIT_CODES } from "../internal/exit.js";
 import { readFile, writeFile } from "node:fs/promises";
@@ -37,7 +38,7 @@ async function runMigrateExport(options) {
 	const parsed = readSessionExport(await readFile(inputPath, "utf8"));
 	const buffer = createBufferSink();
 	const writer = createSessionExportWriter(buffer.sink, {
-		writer: options.writer ?? "graphorin-cli@0.6.0",
+		writer: options.writer ?? `graphorin-cli@${version}`,
 		...parsed.meta.embedderIds !== void 0 ? { embedderIds: parsed.meta.embedderIds } : {}
 	});
 	for (const record of parsed.records) {

package/dist/commands/migrate-export.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrate-export.js","names":["out: MigrateExportResult"],"sources":["../../src/commands/migrate-export.ts"],"sourcesContent":["/**\n * `graphorin migrate-export <input> --to-schema <X.Y>` - schema-version\n * migration for `graphorin-session-export/N.N` JSONL files (DEC-155 /\n * ADR-042).\n *\n * The exporter ships schema 1.0 in v0.1; the migrator's main job today\n * is to validate that the supplied input file is a well-formed session\n * export with a schema in the framework's N-2 backwards-compat band\n * and to round-trip the records through the writer with the desired\n * target schema. When the runtime reaches MAJOR 2.x / 3.x the\n * migrator extends the per-record transforms in place.\n *\n * The output path is required (`--to <file>`); the helper never\n * overwrites the input.\n *\n * @packageDocumentation\n */\n\nimport { readFile, writeFile } from 'node:fs/promises';\nimport { isAbsolute, resolve } from 'node:path';\nimport process from 'node:process';\n\nimport {\n  createBufferSink,\n  createSessionExportWriter,\n  readSessionExport,\n  SESSION_EXPORT_SCHEMA_CURRENT,\n  type SessionExportRecord,\n} from '@graphorin/sessions';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/** @stable */\nexport interface MigrateExportOptions extends CommonOutputOptions {\n  readonly input: string;\n  readonly to: string;\n  /** Defaults to the writer's current schema (e.g. `'1.0'`). */\n  readonly toSchema?: string;\n  /** Surfaced on the meta header. Defaults to `'graphorin-cli@0.6.0'`. */\n  readonly writer?: string;\n}\n\n/** @stable */\nexport interface MigrateExportResult {\n  readonly input: string;\n  readonly output: string;\n  readonly schemaIn: string;\n  readonly schemaOut: string;\n  readonly records: number;\n}\n\n/** @stable */\nexport async function runMigrateExport(\n  options: MigrateExportOptions,\n): Promise<MigrateExportResult> {\n  const cwd = process.cwd();\n  const inputPath = isAbsolute(options.input) ? options.input : resolve(cwd, options.input);\n  const outputPath = isAbsolute(options.to) ? options.to : resolve(cwd, options.to);\n  const targetSchema = options.toSchema ?? SESSION_EXPORT_SCHEMA_CURRENT;\n\n  if (inputPath === outputPath) {\n    throw new Error(\n      `[graphorin/cli] migrate-export refuses to overwrite the input file '${inputPath}'.`,\n    );\n  }\n  if (targetSchema !== SESSION_EXPORT_SCHEMA_CURRENT) {\n    const print = options.print ?? defaultPrintSink;\n    print(\n      brand(\n        `requested target schema '${targetSchema}' is not the writer's current schema (${SESSION_EXPORT_SCHEMA_CURRENT}); v0.1 supports the current schema only.`,\n      ),\n    );\n    process.exit(EXIT_CODES.UNSUPPORTED);\n  }\n\n  const raw = await readFile(inputPath, 'utf8');\n  const parsed = readSessionExport(raw);\n\n  const buffer = createBufferSink();\n  const writer = createSessionExportWriter(buffer.sink, {\n    writer: options.writer ?? 'graphorin-cli@0.6.0',\n    ...(parsed.meta.embedderIds !== undefined ? { embedderIds: parsed.meta.embedderIds } : {}),\n  });\n  for (const record of parsed.records) {\n    if (record.kind === 'unknown') continue;\n    await writer.writeRecord(record as SessionExportRecord);\n  }\n  await writer.close();\n  await writeFile(outputPath, buffer.toString(), { mode: 0o600 });\n\n  const out: MigrateExportResult = Object.freeze({\n    input: inputPath,\n    output: outputPath,\n    schemaIn: parsed.meta.version,\n    schemaOut: targetSchema,\n    records: parsed.records.length,\n  });\n  emitReport(options, out, () => {\n    const print = options.print ?? defaultPrintSink;\n    print(\n      brand(\n        `${statusMarker('ok')} migrated ${out.records} record(s) from schema ${out.schemaIn} -> ${out.schemaOut}`,\n      ),\n    );\n    print(`  input:  ${out.input}`);\n    print(`  output: ${out.output}`);\n  });\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,eAAsB,iBACpB,SAC8B;CAC9B,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,YAAY,WAAW,QAAQ,MAAM,GAAG,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,MAAM;CACzF,MAAM,aAAa,WAAW,QAAQ,GAAG,GAAG,QAAQ,KAAK,QAAQ,KAAK,QAAQ,GAAG;CACjF,MAAM,eAAe,QAAQ,YAAY;AAEzC,KAAI,cAAc,WAChB,OAAM,IAAI,MACR,uEAAuE,UAAU,IAClF;AAEH,KAAI,iBAAiB,+BAA+B;AAElD,GADc,QAAQ,SAAS,kBAE7B,MACE,4BAA4B,aAAa,wCAAwC,8BAA8B,2CAChH,CACF;AACD,UAAQ,KAAK,WAAW,YAAY;;CAItC,MAAM,SAAS,kBADH,MAAM,SAAS,WAAW,OAAO,CACR;CAErC,MAAM,SAAS,kBAAkB;CACjC,MAAM,SAAS,0BAA0B,OAAO,MAAM;EACpD,QAAQ,QAAQ,UAAU;EAC1B,GAAI,OAAO,KAAK,gBAAgB,SAAY,EAAE,aAAa,OAAO,KAAK,aAAa,GAAG,EAAE;EAC1F,CAAC;AACF,MAAK,MAAM,UAAU,OAAO,SAAS;AACnC,MAAI,OAAO,SAAS,UAAW;AAC/B,QAAM,OAAO,YAAY,OAA8B;;AAEzD,OAAM,OAAO,OAAO;AACpB,OAAM,UAAU,YAAY,OAAO,UAAU,EAAE,EAAE,MAAM,KAAO,CAAC;CAE/D,MAAMA,MAA2B,OAAO,OAAO;EAC7C,OAAO;EACP,QAAQ;EACR,UAAU,OAAO,KAAK;EACtB,WAAW;EACX,SAAS,OAAO,QAAQ;EACzB,CAAC;AACF,YAAW,SAAS,WAAW;EAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,QACE,MACE,GAAG,aAAa,KAAK,CAAC,YAAY,IAAI,QAAQ,yBAAyB,IAAI,SAAS,MAAM,IAAI,YAC/F,CACF;AACD,QAAM,aAAa,IAAI,QAAQ;AAC/B,QAAM,aAAa,IAAI,SAAS;GAChC;AACF,QAAO"}
+{"version":3,"file":"migrate-export.js","names":["pkg.version","out: MigrateExportResult"],"sources":["../../src/commands/migrate-export.ts"],"sourcesContent":["import pkg from '../../package.json' with { type: 'json' };\n/**\n * `graphorin migrate-export <input> --to-schema <X.Y>` - schema-version\n * migration for `graphorin-session-export/N.N` JSONL files (DEC-155 /\n * ADR-042).\n *\n * The exporter ships schema 1.0 in v0.1; the migrator's main job today\n * is to validate that the supplied input file is a well-formed session\n * export with a schema in the framework's N-2 backwards-compat band\n * and to round-trip the records through the writer with the desired\n * target schema. When the runtime reaches MAJOR 2.x / 3.x the\n * migrator extends the per-record transforms in place.\n *\n * The output path is required (`--to <file>`); the helper never\n * overwrites the input.\n *\n * @packageDocumentation\n */\n\nimport { readFile, writeFile } from 'node:fs/promises';\nimport { isAbsolute, resolve } from 'node:path';\nimport process from 'node:process';\n\nimport {\n  createBufferSink,\n  createSessionExportWriter,\n  readSessionExport,\n  SESSION_EXPORT_SCHEMA_CURRENT,\n  type SessionExportRecord,\n} from '@graphorin/sessions';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/** @stable */\nexport interface MigrateExportOptions extends CommonOutputOptions {\n  readonly input: string;\n  readonly to: string;\n  /** Defaults to the writer's current schema (e.g. `'1.0'`). */\n  readonly toSchema?: string;\n  /** Surfaced on the meta header. Defaults to `graphorin-cli@<version>` (the current package version). */\n  readonly writer?: string;\n}\n\n/** @stable */\nexport interface MigrateExportResult {\n  readonly input: string;\n  readonly output: string;\n  readonly schemaIn: string;\n  readonly schemaOut: string;\n  readonly records: number;\n}\n\n/** @stable */\nexport async function runMigrateExport(\n  options: MigrateExportOptions,\n): Promise<MigrateExportResult> {\n  const cwd = process.cwd();\n  const inputPath = isAbsolute(options.input) ? options.input : resolve(cwd, options.input);\n  const outputPath = isAbsolute(options.to) ? options.to : resolve(cwd, options.to);\n  const targetSchema = options.toSchema ?? SESSION_EXPORT_SCHEMA_CURRENT;\n\n  if (inputPath === outputPath) {\n    throw new Error(\n      `[graphorin/cli] migrate-export refuses to overwrite the input file '${inputPath}'.`,\n    );\n  }\n  if (targetSchema !== SESSION_EXPORT_SCHEMA_CURRENT) {\n    const print = options.print ?? defaultPrintSink;\n    print(\n      brand(\n        `requested target schema '${targetSchema}' is not the writer's current schema (${SESSION_EXPORT_SCHEMA_CURRENT}); v0.1 supports the current schema only.`,\n      ),\n    );\n    process.exit(EXIT_CODES.UNSUPPORTED);\n  }\n\n  const raw = await readFile(inputPath, 'utf8');\n  const parsed = readSessionExport(raw);\n\n  const buffer = createBufferSink();\n  const writer = createSessionExportWriter(buffer.sink, {\n    writer: options.writer ?? `graphorin-cli@${pkg.version}`,\n    ...(parsed.meta.embedderIds !== undefined ? { embedderIds: parsed.meta.embedderIds } : {}),\n  });\n  for (const record of parsed.records) {\n    if (record.kind === 'unknown') continue;\n    await writer.writeRecord(record as SessionExportRecord);\n  }\n  await writer.close();\n  await writeFile(outputPath, buffer.toString(), { mode: 0o600 });\n\n  const out: MigrateExportResult = Object.freeze({\n    input: inputPath,\n    output: outputPath,\n    schemaIn: parsed.meta.version,\n    schemaOut: targetSchema,\n    records: parsed.records.length,\n  });\n  emitReport(options, out, () => {\n    const print = options.print ?? defaultPrintSink;\n    print(\n      brand(\n        `${statusMarker('ok')} migrated ${out.records} record(s) from schema ${out.schemaIn} -> ${out.schemaOut}`,\n      ),\n    );\n    print(`  input:  ${out.input}`);\n    print(`  output: ${out.output}`);\n  });\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4DA,eAAsB,iBACpB,SAC8B;CAC9B,MAAM,MAAM,QAAQ,KAAK;CACzB,MAAM,YAAY,WAAW,QAAQ,MAAM,GAAG,QAAQ,QAAQ,QAAQ,KAAK,QAAQ,MAAM;CACzF,MAAM,aAAa,WAAW,QAAQ,GAAG,GAAG,QAAQ,KAAK,QAAQ,KAAK,QAAQ,GAAG;CACjF,MAAM,eAAe,QAAQ,YAAY;AAEzC,KAAI,cAAc,WAChB,OAAM,IAAI,MACR,uEAAuE,UAAU,IAClF;AAEH,KAAI,iBAAiB,+BAA+B;AAElD,GADc,QAAQ,SAAS,kBAE7B,MACE,4BAA4B,aAAa,wCAAwC,8BAA8B,2CAChH,CACF;AACD,UAAQ,KAAK,WAAW,YAAY;;CAItC,MAAM,SAAS,kBADH,MAAM,SAAS,WAAW,OAAO,CACR;CAErC,MAAM,SAAS,kBAAkB;CACjC,MAAM,SAAS,0BAA0B,OAAO,MAAM;EACpD,QAAQ,QAAQ,UAAU,iBAAiBA;EAC3C,GAAI,OAAO,KAAK,gBAAgB,SAAY,EAAE,aAAa,OAAO,KAAK,aAAa,GAAG,EAAE;EAC1F,CAAC;AACF,MAAK,MAAM,UAAU,OAAO,SAAS;AACnC,MAAI,OAAO,SAAS,UAAW;AAC/B,QAAM,OAAO,YAAY,OAA8B;;AAEzD,OAAM,OAAO,OAAO;AACpB,OAAM,UAAU,YAAY,OAAO,UAAU,EAAE,EAAE,MAAM,KAAO,CAAC;CAE/D,MAAMC,MAA2B,OAAO,OAAO;EAC7C,OAAO;EACP,QAAQ;EACR,UAAU,OAAO,KAAK;EACtB,WAAW;EACX,SAAS,OAAO,QAAQ;EACzB,CAAC;AACF,YAAW,SAAS,WAAW;EAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,QACE,MACE,GAAG,aAAa,KAAK,CAAC,YAAY,IAAI,QAAQ,yBAAyB,IAAI,SAAS,MAAM,IAAI,YAC/F,CACF;AACD,QAAM,aAAa,IAAI,QAAQ;AAC/B,QAAM,aAAa,IAAI,SAAS;GAChC;AACF,QAAO"}

package/dist/index.d.ts

@@ -39,8 +39,7 @@ import { OfflineModeViolationError, assertNoNetworkInOfflineMode, checkOfflineMo
  *
  * @packageDocumentation
  */
-/** Canonical version constant. Mirrors the `package.json` version. */
-declare const VERSION = "0.6.0";
+declare const VERSION: string;
 //#endregion
 export { AuditCommonOptions, AuditExportOptions, AuditExportResult, AuditPruneOptions, AuditVerifyResult, AuthCommonOptions, AuthListOptions, AuthLoginOptions, AuthRefreshOptions, AuthRevokeOptions, CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, DoctorCommandOptions, DoctorReport, GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, InitCommandOptions, InitCommandResult, MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, MigrateCommandOptions, MigrateCommandResult, MigrateConfigOptions, MigrateConfigResult, MigrateExportOptions, MigrateExportResult, OfflineModeViolationError, PricingCommonOptions, PricingDiffOptions, PricingLookupOptions, PricingMissingOptions, PricingRefreshOptions, PricingStatusResult, SecretsCommonOptions, SecretsDeleteOptions, SecretsGetOptions, SecretsGetResult, SecretsListOptions, SecretsRefOptions, SecretsRefResult, SecretsRotateOptions, SecretsSetOptions, SecretsSourceFlag, SkillTrustLevelInput, SkillsAuditOptions, SkillsCommonOptions, SkillsInspectOptions, SkillsInstallOptions, SkillsMigrateFrontmatterOptions, SkillsMigrateFrontmatterResult, StartCommandOptions, StorageBackupOptions, StorageBackupResult, StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, TelemetryStatusResult, TokenCommonOptions, TokenCreateOptions, TokenCreateResult, TokenListOptions, TokenRekeyOptions, TokenRevokeOptions, TokenRotateOptions, TokenVerifyOptions, TokenVerifyResult, ToolsLintOptions, ToolsLintReport, TracesCommonOptions, TracesPruneOptions, TracesPruneResult, TracesStatusResult, TriggersCommonOptions, TriggersDisableOptions, TriggersFireOptions, TriggersPruneOptions, TriggersPruneResult, TriggersStatusOptions, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAmBa,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqBa"}

package/dist/index.js

@@ -1,3 +1,4 @@
+import { version } from "./package.js";
 import { runAuditExport, runAuditPrune, runAuditVerify } from "./commands/audit.js";
 import { OfflineModeViolationError, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, isOfflineMode } from "./internal/offline.js";
 import { runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "./commands/auth.js";
@@ -39,8 +40,8 @@ import "./commands/index.js";
 *
 * @packageDocumentation
 */
-/** Canonical version constant. Mirrors the `package.json` version. */
-const VERSION = "0.6.0";
+/** Canonical version constant, derived from `package.json` at build time. */
+const VERSION = version;
 
 //#endregion
 export { CONSOLIDATOR_INVALID_TIER_EXIT, OfflineModeViolationError, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/cli` - operator CLI for the Graphorin framework.\n *\n * Phase 14a shipped the minimal `graphorin` binary with three\n * lifecycle commands: `start`, `init`, and `migrate`. Phase 15\n * extended the same binary with the operator surface (`doctor`,\n * `token`, `secrets`, `audit`, `storage`, `memory`, `consolidator`,\n * `triggers`, `auth`, `pricing`, `skills`, `traces`,\n * `migrate-export`, `migrate-config`, `guard`, `telemetry`,\n * `tools lint`).\n *\n * Every subcommand is exported as a typed library function so\n * downstream automations can call them directly without spawning a\n * child process.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant. Mirrors the `package.json` version. */\nexport const VERSION = '0.6.0';\n\nexport * from './commands/index.js';\nexport {\n  assertNoNetworkInOfflineMode,\n  checkOfflineModeBlocked,\n  isOfflineMode,\n  OfflineModeViolationError,\n} from './internal/offline.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,UAAU"}
+{"version":3,"file":"index.js","names":["VERSION: string","pkg.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/cli` - operator CLI for the Graphorin framework.\n *\n * Phase 14a shipped the minimal `graphorin` binary with three\n * lifecycle commands: `start`, `init`, and `migrate`. Phase 15\n * extended the same binary with the operator surface (`doctor`,\n * `token`, `secrets`, `audit`, `storage`, `memory`, `consolidator`,\n * `triggers`, `auth`, `pricing`, `skills`, `traces`,\n * `migrate-export`, `migrate-config`, `guard`, `telemetry`,\n * `tools lint`).\n *\n * Every subcommand is exported as a typed library function so\n * downstream automations can call them directly without spawning a\n * child process.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant, derived from `package.json` at build time. */\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const VERSION: string = pkg.version;\n\nexport * from './commands/index.js';\nexport {\n  assertNoNetworkInOfflineMode,\n  checkOfflineModeBlocked,\n  isOfflineMode,\n  OfflineModeViolationError,\n} from './internal/offline.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAaA,UAAkBC"}

package/dist/package.js

@@ -0,0 +1,6 @@
+//#region package.json
+var version = "0.6.1";
+
+//#endregion
+export { version };
+//# sourceMappingURL=package.js.map

package/dist/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","names":[],"sources":["../package.json"],"sourcesContent":["{\n  \"name\": \"@graphorin/cli\",\n  \"version\": \"0.6.1\",\n  \"description\": \"Operator CLI for the Graphorin framework. The `graphorin` binary covers the standalone server and the local stores end to end: `start`, `init`, `migrate`, `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `guard`, `telemetry`, `tools`, and `migrate-export`. Created and maintained by Oleksiy Stepurenko.\",\n  \"license\": \"MIT\",\n  \"author\": \"Oleksiy Stepurenko\",\n  \"homepage\": \"https://github.com/o-stepper/graphorin/tree/main/packages/cli\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/o-stepper/graphorin.git\",\n    \"directory\": \"packages/cli\"\n  },\n  \"bugs\": {\n    \"url\": \"https://github.com/o-stepper/graphorin/issues\"\n  },\n  \"keywords\": [\n    \"graphorin\",\n    \"ai\",\n    \"agents\",\n    \"framework\",\n    \"cli\",\n    \"graphorin-start\",\n    \"graphorin-init\",\n    \"graphorin-migrate\"\n  ],\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=22.0.0\"\n  },\n  \"main\": \"./dist/index.js\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"bin\": {\n    \"graphorin\": \"./dist/bin/graphorin.js\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\"\n    },\n    \"./commands\": {\n      \"types\": \"./dist/commands/index.d.ts\",\n      \"import\": \"./dist/commands/index.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"CHANGELOG.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsdown\",\n    \"typecheck\": \"tsc --noEmit && tsc -p tsconfig.tests.json\",\n    \"test\": \"vitest run\",\n    \"lint\": \"biome check .\",\n    \"clean\": \"rimraf dist .turbo *.tsbuildinfo\"\n  },\n  \"dependencies\": {\n    \"@graphorin/core\": \"workspace:*\",\n    \"@graphorin/eslint-plugin\": \"workspace:*\",\n    \"@graphorin/memory\": \"workspace:*\",\n    \"@graphorin/pricing\": \"workspace:*\",\n    \"@graphorin/security\": \"workspace:*\",\n    \"@graphorin/server\": \"workspace:*\",\n    \"@graphorin/sessions\": \"workspace:*\",\n    \"@graphorin/skills\": \"workspace:*\",\n    \"@graphorin/store-sqlite\": \"workspace:*\",\n    \"commander\": \"^10.0.0\"\n  },\n  \"publishConfig\": {\n    \"access\": \"public\",\n    \"provenance\": true\n  },\n  \"devDependencies\": {\n    \"@graphorin/store-sqlite-encrypted\": \"workspace:*\"\n  }\n}\n"],"mappings":";cAEa"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphorin/cli",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Operator CLI for the Graphorin framework. The `graphorin` binary covers the standalone server and the local stores end to end: `start`, `init`, `migrate`, `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `guard`, `telemetry`, `tools`, and `migrate-export`. Created and maintained by Oleksiy Stepurenko.",
   "license": "MIT",
   "author": "Oleksiy Stepurenko",
@@ -52,22 +52,22 @@
   ],
   "dependencies": {
     "commander": "^10.0.0",
-    "@graphorin/core": "0.6.0",
-    "@graphorin/eslint-plugin": "0.6.0",
-    "@graphorin/memory": "0.6.0",
-    "@graphorin/pricing": "0.6.0",
-    "@graphorin/security": "0.6.0",
-    "@graphorin/server": "0.6.0",
-    "@graphorin/sessions": "0.6.0",
-    "@graphorin/skills": "0.6.0",
-    "@graphorin/store-sqlite": "0.6.0"
+    "@graphorin/core": "0.6.1",
+    "@graphorin/eslint-plugin": "0.6.1",
+    "@graphorin/memory": "0.6.1",
+    "@graphorin/pricing": "0.6.1",
+    "@graphorin/security": "0.6.1",
+    "@graphorin/server": "0.6.1",
+    "@graphorin/sessions": "0.6.1",
+    "@graphorin/skills": "0.6.1",
+    "@graphorin/store-sqlite": "0.6.1"
   },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "devDependencies": {
-    "@graphorin/store-sqlite-encrypted": "0.6.0"
+    "@graphorin/store-sqlite-encrypted": "0.6.1"
   },
   "scripts": {
     "build": "tsdown",