@graphorin/cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # @graphorin/cli
 
+## 0.7.0
+
+### Minor Changes
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-072: every export map's `import` condition becomes `default`, and the Node floor rises to `>=22.12.0`.
+
+  CJS consumers previously hit a bewildering `ERR_PACKAGE_PATH_NOT_EXPORTED` instead of a clear ESM-only signal. With the `default` condition, plain `require('@graphorin/core')` works via Node's stable `require(esm)` - which shipped in 22.12, hence the engines bump across every workspace manifest (packages, examples, benchmarks, docs; enforced by the widened mvp-readiness sweep). No dual-instance hazard: there is no CJS build, `require()` returns the same ESM module instance. ESM consumers are unaffected (`default` serves both paths; `types` stays first). The pack gate now runs attw under the full `node16` profile (was `esm-only`) and adds a runtime `require(esm)` smoke against the packed tarballs. Installs on Node 22.0-22.11 with `engine-strict` will refuse - upgrade Node (see the migration guide).
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-003/W-041: `graphorin init` stops printing a dead credential and stops teaching argv secrets.
+
+  init generated and printed a "bootstrap admin token (shown ONCE)" whose hash was never persisted anywhere - verification requires an HMAC lookup in the auth-token store (migrations + pepper), and init's contract is "write the config file only" - so the token was guaranteed to 401; the working path (`graphorin token create` after `migrate`) was not even mentioned. Following the IP-4 honesty precedent, init no longer emits a token (`InitCommandResult.bootstrapToken` removed - BREAKING for scripts parsing it, though the value never worked) and the next-steps now walk the real path: (1) persist the pepper via stdin - `printf '%s' '<hex>' | graphorin secrets set graphorin_server_pepper --from-stdin`, never `--value` on argv, which parked the key material behind every token HMAC in shell history (W-041); (2) `graphorin migrate`; (3) `graphorin token create --label bootstrap` (raw token shown once, verifiable); (4) `graphorin start`. The pepper hex is still printed exactly once to stderr.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-068: migration-runner TOCTOU fence + read-only CLI commands stop auto-migrating live databases.
+
+  `runMigrations` re-checks `schema_migrations` INSIDE each per-migration IMMEDIATE transaction: when two processes race to migrate one file, the loser now skips (no-op) instead of crashing on non-idempotent SQL ("duplicate column name"). New read-only `pendingMigrations(conn)` helper reads `sqlite_master` first, so probing a foreign database never marks it by creating the bookkeeping table. The CLI store context gains `migrationPolicy: 'apply' | 'check'`; read-only commands (`memory inspect`/`activity`, `traces status|prune`, `triggers list`, `consolidator status`/`dlq-list`) now run with `'check'`: a newer CLI pointed at a running (older) server's database refuses with "schema is N migration(s) behind ... run 'graphorin migrate' (with the server stopped) or use a CLI version matching the server" instead of silently upgrading the schema under the live process. BEHAVIOR CHANGE: those commands now also refuse on a never-migrated database instead of creating the schema as a side effect.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Reachable retention lever for `memory_history` (W-066):
+
+  - `@graphorin/core`: new `MemoryStoreExt` contract (`extends MemoryStore` with `pruneHistory(olderThanMs)`), mirroring the `SessionStoreExt` precedent - strictly additive, custom `MemoryStore` implementations keep compiling. The TSDoc pins the unit semantics: the argument is an AGE in milliseconds, never an epoch cutoff.
+  - `@graphorin/store-sqlite`: `SqliteMemoryStore` declares `implements MemoryStoreExt` and `GraphorinSqliteStore.memory` is now typed `MemoryStoreExt`, so `pruneHistory` is reachable without casts.
+  - `@graphorin/cli`: new `graphorin memory prune-history --older-than <duration|date>` command. `--older-than` is mandatory (destructive by design, no default), takes a duration (`30d`, `12h`) or a PAST ISO date (converted to `now - date`; future dates are refused - they would prune the whole table). Documented in the CLI guide and the memory-system guide: history grows by design, `purge()` already scrubs sensitive text, pruning is storage-cost hygiene.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-065: lifecycle owners for four small tables. `SqliteConsolidatorStateStore` gains `pruneRuns(beforeEpochMs)` (terminal per-tick run-log rows; `status='running'` always survives) and `pruneExhaustedBatches(beforeEpochMs)` (DLQ batches parked forever with `next_retry_at IS NULL`; batches awaiting retry stay claimable). New CLI `graphorin consolidator dlq-list` / `dlq-clear` (`--exhausted-only` default true, `--before`, `--id`, `--user`) make the permanent `dead-letter queue: N` status warning actionable - operator-level, cross-user, in the same style as the existing `dlqSize` counter. `IdempotencyStore.prune`'s TSDoc now names its production caller (the server's hourly sweep). Migration 031 drops the dead `trigger_fire_log` table (created by 007, never written or read by any code; append-only discipline preserved - 007 untouched).
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - Database-file compaction path (W-064). `openConnection` now declares `PRAGMA auto_vacuum = INCREMENTAL` on every database it CREATES (checked via `page_count == 0`, right after the cipher pragmas, so encrypted databases opened through the `store-sqlite-encrypted` delegate get it automatically; pre-existing databases are untouched - the pragma is a spec-guaranteed no-op there). New `graphorin storage compact` command: `wal_checkpoint(TRUNCATE)` + batched `PRAGMA incremental_vacuum` (`--batch-pages`, default 1000, keeps writer locks short) + a final checkpoint, reporting freelist before/after and reclaimed bytes. Unlike the forbidden `VACUUM`, incremental vacuum relocates free pages through the pointer map without renumbering implicit rowids, so FTS5 external-content mappings survive - covered by an integrity + search test. On a database created before this version (`auto_vacuum=0`) the command reports the high-water-mark limitation honestly and exits 0 without modifying the file; reclaiming disk there requires recreating the store. Docs: storage guide danger-block extended with the incremental-vacuum contrast, cli + deployment guides gain the command.
+
+- [#160](https://github.com/o-stepper/graphorin/pull/160) [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156) Thanks [@o-stepper](https://github.com/o-stepper)! - W-097: `graphorin pricing refresh` finally works against the dataset the docs point at. New pure converter (`convertGenaiPrices` / `isGenaiPricesShape`, exported) maps the published `@pydantic/genai-prices` dataset (providers[] -> models[] -> per-Mtok prices incl. cache read/write legs) into per-token `ModelPrice` entries; unrepresentable model entries (tiered/conditional pricing) are skipped with a counter instead of failing the refresh, and the supported subset is pinned by a vendored fixture + doc comment. `refreshPricing` gains `format: 'auto' | 'graphorin' | 'genai-prices'` (default auto: native first, then detection), stamps converted snapshots `version: 'genai-prices+converted'` with an additive `PricingSnapshot.conversion { format, skipped }`, and REJECTS a dataset declaring a non-USD currency instead of silently stamping dollars. The CLI adds `--format` and prints the skipped count; the pricing reference documents a working raw-URL example. Native-shape refreshes are byte-identical; no baked-in endpoint was added (privacy contract).
+
+### Patch Changes
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Audit retention vs Merkle anchoring (W-062):
+
+  - `@graphorin/security`: fixed a crash in `pruneAudit` against the shipped better-sqlite3 binding - the re-hash loop wrote through the connection while `iterate()` held a live statement iterator, throwing "This database connection is busy executing a query" whenever surviving entries needed re-rooting (the in-memory test double masked it). Survivors are now rewritten in closed-iterator batches (bounded memory). The `pruneAudit` package docs now state explicitly that verification against ANY pre-prune Merkle checkpoint fails afterwards by design, indistinguishably from a truncate-and-re-root attack. A contract test pins this behavior.
+  - `@graphorin/cli`: `graphorin audit prune` prints a re-anchor reminder after every destructive prune (sign + distribute a fresh checkpoint, mark old anchors superseded).
+  - Security guide: new "Retention and anchoring" runbook (prune -> sign fresh checkpoint -> distribute -> supersede old anchors -> accept anchored-history reset) plus the documented identifier-level erasure limitation of the time-prefix-only prune.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Help-text honesty sweep (W-040): `consolidator set-tier` / `consolidator stop` no longer promise persistence they never had (both report UNSUPPORTED with exit 2 and now say so, pointing at `consolidator.tier` in the config per the existing IP-4 note); `tools lint` and its module header describe the discovery as the text-based static scan it actually is, not "AST analysis". The CLI guide's `migrate-export` row/example gained the mandatory `--to <file>` (copy-paste no longer dies on "required option not specified"), the phantom `tools lint <path>` positional is gone, and the `pricing diff`/`lookup`/`missing` examples now carry their required options. The `check-cli-docs` gate grew a requiredOption pass (alias-aware, `--flag=value` aware) so this drift class fails CI from now on - it caught the three pricing examples immediately.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-012: `encryptDatabase({ swap: true })` now probes for a live writer BEFORE touching the source and refuses with the new typed `EncryptSwapLiveWriterError` when another connection holds the database. The swap path renames the source file; a running server would keep writing into the renamed `.bak.<ts>` inode, silently diverging from the encrypted copy until `storage cleanup-backups` deletes those writes. The probe (a journal-mode switch, which sqlite3mc refuses with "database is locked" under any other open connection) restores WAL in `finally`; the probe-to-rename window remains a documented best-effort residual. CLI `--swap` help and the storage guide now state the stopped-server requirement.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-002: exit codes are honored in `--json` mode. Eight commands set `process.exitCode` inside the `human()` callback of `emitReport`, which `--json` skips entirely - so exactly the machine consumers the flag exists for saw exit 0 on failure, worst of all `graphorin audit verify --json` returning 0 on a broken hash chain. The assignments are hoisted outside the callback (matching the existing doctor/tools-lint pattern) for: `audit verify`, `secrets get`, `secrets ref`, `token revoke`, `token verify`, `pricing lookup`, `skills inspect`, `triggers status`. `emitReport`'s doc now forbids side effects in `human()`. CI pipelines that (incorrectly) relied on exit 0 under `--json` on failure will now see the documented exit 1.
+
+- [#154](https://github.com/o-stepper/graphorin/pull/154) [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04) Thanks [@o-stepper](https://github.com/o-stepper)! - W-007: `graphorin traces status|prune` now operates on the REAL `spans` table (migration 024) instead of a `traces` table no migration or runtime ever created. The command was a permanent no-op ("traces table not found") - an operator with `traces prune` in cron believed retention was handled while spans grew without bound. `status` reads counts + ISO time range from `start_unix_nano`; `prune` delegates to `pruneSpans` (deletes spans that FINISHED strictly before `--before`, index-backed). JSON field names (`oldestStartedAt`/`newestStartedAt`) are unchanged, so machine consumers keep working. NOTE: an existing cron `traces prune` will now actually delete old spans - that is the documented behavior finally happening.
+
+- [#153](https://github.com/o-stepper/graphorin/pull/153) [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534) Thanks [@o-stepper](https://github.com/o-stepper)! - Release-flow hardening (W-015, repo-level): the root `version` script now chains `changeset version && node scripts/bump-version.mjs --sync`, so any Version Packages pass (bot or maintainer) leaves the private workspaces and every text version site synchronized and self-verified by `check-version-consistency` in one step. `release.yml` reads `secrets.RELEASE_PAT || secrets.GITHUB_TOKEN`, giving the maintainer two documented paths (fine-grained PAT or the repo setting allowing Actions to create PRs) to restore the fully-automatic Version Packages PR; without either, the documented manual flow is unchanged. CONTRIBUTING lists the four remaining manual follow-ups.
+
+- [#158](https://github.com/o-stepper/graphorin/pull/158) [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab) Thanks [@o-stepper](https://github.com/o-stepper)! - Tool discovery and grading are comment-aware (W-044). Discovery and every grading path run over a comment-blanked view of the source (newlines preserved, offsets stable; string/template and - conservatively - regex literals untouched): a commented-out `tool({...})` no longer appears in `graphorin tools lint` reports or the three ESLint tool rules, a commented-out property inside a live literal is never extracted, a commented email inside a live `examples:` block no longer penalizes the axis, and a `tool(` inside a string never matches. `DiscoveredTool` gains `gradingSource` (the blanked slice all graders consume) while `source` keeps the original text for reports. The description axis gets a deterministic anti-degenerate guard: 80+ chars of repeated filler (under 4 unique words, or one word over half the text) caps at 16 instead of scoring 40 - RB-49 calibration fixtures are unchanged; degenerate descriptions may now fall below `--threshold` gates. The false-positive contract (any callee lexically ending in `tool(`, renamed/wrapped calls invisible) is now documented in the module header and README.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - Tarballs now ship `src/` so the published `dist/**/*.d.ts.map` files actually work (W-136): the maps referenced `../src/*.ts` that the `files` whitelist excluded, so go-to-definition fell back into `.d.ts` and the shipped maps were dead weight. The pack gate gains a `map-integrity` leg: every source referenced by a shipped map must resolve inside the tarball (or be embedded via `sourcesContent`), with an anti-vacuous guard - a package whose tsdown config emits declaration maps must contain a non-zero number of `.d.ts.map` files, so a cache-restored dist that silently dropped maps fails the gate instead of passing vacuously. `mvp-readiness` now requires `src` in every publishable `files` array.
+
+- [#164](https://github.com/o-stepper/graphorin/pull/164) [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00) Thanks [@o-stepper](https://github.com/o-stepper)! - Every published package now declares its tree-shaking contract via `sideEffects` (W-137): 18 packages audited to a pure module scope get `false`, the CLI declares its bin entry (`["./dist/bin/*"]`), and `@graphorin/security` gets an explicit `true` - its secrets subsystem registers built-in resolvers and the SecretValue caller-context provider at import time, so marking it pure would let bundlers drop those registrations. `mvp-readiness` now fails any publishable manifest without a declared `sideEffects`, closing the drift for future packages.
+
+- Updated dependencies [[`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`c1af9c7`](https://github.com/o-stepper/graphorin/commit/c1af9c790757fbe82da6dd2b6c1fdc497b5c605e), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3), [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`73b19ca`](https://github.com/o-stepper/graphorin/commit/73b19caeda388bda628a48138cb7d70b1db839a3), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`4ee256e`](https://github.com/o-stepper/graphorin/commit/4ee256e30fe9190cef6c48dc6785464757707156), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`32bbd03`](https://github.com/o-stepper/graphorin/commit/32bbd03b588136a355e4b5ad6ac5e19b36b4d8ab), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`764239b`](https://github.com/o-stepper/graphorin/commit/764239b97e0e0202442e91272583f13adeb12d00), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`832f22e`](https://github.com/o-stepper/graphorin/commit/832f22e570b8c3175c1adeb4c150070cbd131534), [`fe98522`](https://github.com/o-stepper/graphorin/commit/fe98522ce2477c9a7dc09029f9dcfdb1f7c9aa04)]:
+  - @graphorin/core@0.7.0
+  - @graphorin/security@0.7.0
+  - @graphorin/server@0.7.0
+  - @graphorin/store-sqlite@0.7.0
+  - @graphorin/memory@0.7.0
+  - @graphorin/eslint-plugin@0.7.0
+  - @graphorin/pricing@0.7.0
+  - @graphorin/sessions@0.7.0
+  - @graphorin/skills@0.7.0
+
+## 0.6.1
+
+### Patch Changes
+
+- [#142](https://github.com/o-stepper/graphorin/pull/142) [`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430) Thanks [@o-stepper](https://github.com/o-stepper)! - Version constants and version-bearing strings now derive from each package's manifest at build time (`VERSION = pkg.version`; writer ids, client/server info, OTLP framework attributes, build-info metrics interpolate it). No behavioral change at the current version: the rendered strings are byte-identical. A release bump no longer edits source; the new `check-version-consistency` gate fails any reintroduced hardcoded framework version.
+
+- Updated dependencies [[`436d6ca`](https://github.com/o-stepper/graphorin/commit/436d6ca5ebbd16df094e915682d3915c279a8430)]:
+  - @graphorin/core@0.6.1
+  - @graphorin/eslint-plugin@0.6.1
+  - @graphorin/memory@0.6.1
+  - @graphorin/pricing@0.6.1
+  - @graphorin/security@0.6.1
+  - @graphorin/server@0.6.1
+  - @graphorin/sessions@0.6.1
+  - @graphorin/skills@0.6.1
+  - @graphorin/store-sqlite@0.6.1
+
 ## 0.6.0
 
 ### Patch Changes

package/README.md

@@ -5,7 +5,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Node.js: 22+](https://img.shields.io/badge/Node.js-22%2B-43853d.svg)](https://nodejs.org)
 
-- **Version:** v0.6.0
+- **Version:** v0.7.0
 - **License:** [MIT](./LICENSE) (© 2026 Oleksiy Stepurenko)
 - **Repository:** <https://github.com/o-stepper/graphorin/tree/main/packages/cli>
 - **Issues:** <https://github.com/o-stepper/graphorin/issues>
@@ -44,7 +44,7 @@
 
 | Command | Purpose |
 |---|---|
-| `graphorin storage status / encrypt / rekey / cleanup-backups` | Inspect + encrypt + re-key the SQLite store. `encrypt` and `rekey` require the `@graphorin/store-sqlite-encrypted` sub-pack from Phase 16. |
+| `graphorin storage status / backup / encrypt / rekey / cleanup-backups` | Inspect, back up (online, consistent copy via the driver's page-level backup API), encrypt, and re-key the SQLite store. `encrypt` and `rekey` require the `@graphorin/store-sqlite-encrypted` sub-pack from Phase 16. |
 | `graphorin audit verify / prune / export` | Operate on the encrypted, hash-chained audit log (DEC-124). |
 | `graphorin memory status / migrate` | Inspect counts + active embedder; `migrate` swaps embedders. |
 | `graphorin consolidator status / set-tier / stop` | Inspect + steer the background memory consolidator (DEC-134 / ADR-038). |
@@ -123,8 +123,8 @@ Phase 15 ships ready-to-copy templates for production deployments:
 
 ## Status
 
-`@graphorin/cli` is part of the Graphorin framework's `v0.6.0` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
+`@graphorin/cli` is part of the Graphorin framework's `v0.7.0` pre-release. Once published, the package follows the lockstep release cadence shared by every `@graphorin/*` package on the `0.x` line.
 
 ---
 
-**Project Graphorin** · v0.6.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>
+**Project Graphorin** · v0.7.0 · MIT License · © 2026 Oleksiy Stepurenko · <https://github.com/o-stepper/graphorin>

package/dist/bin/graphorin.js

@@ -2,11 +2,11 @@
 import { runAuditExport, runAuditPrune, runAuditVerify } from "../commands/audit.js";
 import { isOfflineMode } from "../internal/offline.js";
 import { runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "../commands/auth.js";
-import { runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "../commands/consolidator.js";
+import { runConsolidatorDlqClear, runConsolidatorDlqList, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "../commands/consolidator.js";
 import { runDoctor } from "../commands/doctor.js";
 import { runGuardExplain, runGuardStatus } from "../commands/guard.js";
 import { runInit } from "../commands/init.js";
-import { runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy } from "../commands/memory.js";
+import { runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryPruneHistory, runMemoryReview, runMemoryStatus, runMemoryWhy } from "../commands/memory.js";
 import { runStart } from "../commands/start.js";
 import { runMigrate } from "../commands/migrate.js";
 import { runMigrateConfig } from "../commands/migrate-config.js";
@@ -14,7 +14,7 @@ import { runMigrateExport } from "../commands/migrate-export.js";
 import { runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus } from "../commands/pricing.js";
 import { runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet } from "../commands/secrets.js";
 import { runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter } from "../commands/skills.js";
-import { runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus } from "../commands/storage.js";
+import { runStorageBackup, runStorageCleanupBackups, runStorageCompact, runStorageEncrypt, runStorageRekey, runStorageStatus } from "../commands/storage.js";
 import { runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus } from "../commands/telemetry.js";
 import { runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify } from "../commands/token.js";
 import { runToolsLint } from "../commands/tools-lint.js";
@@ -100,7 +100,7 @@ function registerLifecycleCommands(program) {
 			...opts.strictSecrets !== void 0 ? { strictSecrets: opts.strictSecrets } : {}
 		});
 	});
-	program.command("init").description("[Bootstrap] Generate a fresh graphorin.config.ts and a one-shot bootstrap admin token.").option("-o, --out <path>", "Output path; defaults to ./graphorin.config.ts.").option("--non-interactive", "Accept defaults / env vars without prompting.", false).option("--cloud-consent <tier>", "Cloud-upload consent tier: public-only | public-and-internal | all-with-warnings.").option("--encrypted", "Enable storage encryption opt-in.").option("--no-encrypted", "Disable storage encryption opt-in.").action(async (opts) => {
+	program.command("init").description("[Bootstrap] Generate a fresh graphorin.config.ts + the server pepper (mint tokens afterwards with token create).").option("-o, --out <path>", "Output path; defaults to ./graphorin.config.ts.").option("--non-interactive", "Accept defaults / env vars without prompting.", false).option("--cloud-consent <tier>", "Cloud-upload consent tier: public-only | public-and-internal | all-with-warnings.").option("--encrypted", "Enable storage encryption opt-in.").option("--no-encrypted", "Disable storage encryption opt-in.").action(async (opts) => {
 		if (isOfflineMode()) process.stderr.write("[graphorin/cli] GRAPHORIN_OFFLINE=1 - init never reaches the network.\n");
 		await runInit({
 			...opts.out !== void 0 ? { out: opts.out } : {},
@@ -242,7 +242,7 @@ function registerStorageCommands(program) {
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
-	storage.command("encrypt").description("Encrypt the store. Requires the @graphorin/store-sqlite-encrypted sub-pack (Phase 16).").requiredOption("--passphrase-from <ref>", "SecretRef URI for the new passphrase.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--target-path <path>", "Override the encrypted output path. Default <storage>.encrypted.").option("--swap", "Atomically swap the encrypted output into the storage path; original kept under .bak.<ts>.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+	storage.command("encrypt").description("Encrypt the store. Requires the @graphorin/store-sqlite-encrypted sub-pack (Phase 16).").requiredOption("--passphrase-from <ref>", "SecretRef URI for the new passphrase.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--target-path <path>", "Override the encrypted output path. Default <storage>.encrypted.").option("--swap", "Atomically swap the encrypted output into the storage path (REQUIRES a stopped server - refused when another process holds the DB); original kept under .bak.<ts>.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		await runStorageEncrypt({
 			passphraseFrom: opts.passphraseFrom,
 			...opts.config !== void 0 ? { config: opts.config } : {},
@@ -267,6 +267,13 @@ function registerStorageCommands(program) {
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
+	storage.command("compact").description("Return pruned pages to the OS via batched incremental_vacuum (rowid-safe, unlike the forbidden VACUUM). Requires a database created with auto_vacuum=2; reports the high-water-mark limitation honestly on older files.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--batch-pages <n>", "Free pages released per incremental_vacuum batch (keeps writer locks short). Default 1000.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runStorageCompact({
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.batchPages !== void 0 ? { batchPages: Number(opts.batchPages) } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
 	storage.command("cleanup-backups").description("Drop stale .bak / .tmp.<ts> files left by previous encrypt / rekey runs.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--dry-run", "Print what would be removed without touching the filesystem.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		await runStorageCleanupBackups({
 			...opts.config !== void 0 ? { config: opts.config } : {},
@@ -333,6 +340,13 @@ function registerMemoryCommands(program) {
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
+	memory.command("prune-history").description("Delete memory_history rows older than the threshold (storage-cost hygiene; purge() already scrubs sensitive text).").requiredOption("--older-than <duration|date>", "Age threshold: a duration ('30d', '12h') or a past ISO date. Mandatory - destructive.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runMemoryPruneHistory({
+			olderThan: opts.olderThan,
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
 	memory.command("why").description("Explain why facts were recalled (ranking signals) from the persisted recall spans.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--session <id>", "Restrict to one session's recall spans.").option("--limit <n>", "Cap on the most-recent recall spans (default 5).").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		const limit = opts.limit !== void 0 ? Number.parseInt(opts.limit, 10) : void 0;
 		await runMemoryWhy({
@@ -362,19 +376,37 @@ function registerConsolidatorCommands(program) {
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
-	c.command("set-tier <tier>").description("Persist a tier hint (free | cheap | standard | full | custom).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (tier, opts) => {
+	c.command("set-tier <tier>").description("Runtime tier switching is not wired yet: reports UNSUPPORTED (exit 2) and points at consolidator.tier in the config (IP-4).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (tier, opts) => {
 		await runConsolidatorSetTier({
 			tier,
 			...opts.config !== void 0 ? { config: opts.config } : {},
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
-	c.command("stop").description("Persist a pause flag the running daemon honours.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+	c.command("stop").description("Runtime pause is not wired yet: reports UNSUPPORTED (exit 2); stop the server process to stop consolidation (IP-4).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		await runConsolidatorStop({
 			...opts.config !== void 0 ? { config: opts.config } : {},
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
+	c.command("dlq-list").description("List dead-letter batches (all users; narrow with --user).").option("--user <id>", "Only batches scoped to this user id.").option("--limit <n>", "Maximum rows to list.", "100").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runConsolidatorDlqList({
+			...opts.user !== void 0 ? { user: opts.user } : {},
+			...opts.limit !== void 0 ? { limit: Number(opts.limit) } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
+	c.command("dlq-clear").description("Delete dead-letter batches. Default: only EXHAUSTED batches (retries used up); batches awaiting retry need --exhausted-only=false.").option("--exhausted-only [bool]", "Only exhausted batches (default true).", "true").option("--before <date>", "Only batches that failed before this ISO date / epoch ms.").option("--id <id>", "Clear one batch by id.").option("--user <id>", "Only batches scoped to this user id.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		await runConsolidatorDlqClear({
+			exhaustedOnly: String(opts.exhaustedOnly ?? "true") !== "false",
+			...opts.before !== void 0 ? { before: opts.before } : {},
+			...opts.id !== void 0 ? { id: opts.id } : {},
+			...opts.user !== void 0 ? { user: opts.user } : {},
+			...opts.config !== void 0 ? { config: opts.config } : {},
+			...opts.json !== void 0 ? { json: opts.json } : {}
+		});
+	});
 }
 function registerTriggersCommands(program) {
 	const t = program.command("triggers").description("[Storage] Operate on the durable trigger registry.");
@@ -456,9 +488,15 @@ function registerPricingCommands(program) {
 	p.command("status").description("Show bundled snapshot version + entry count + digest.").option("--json", "Emit a structured JSON document on stdout.").action((opts) => {
 		runPricingStatus({ ...opts.json !== void 0 ? { json: opts.json } : {} });
 	});
-	p.command("refresh").description("Pull a fresh snapshot from --url (network).").requiredOption("--url <url>", "Snapshot URL.").option("--out <file>", "Optional path to write the refreshed snapshot to.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+	p.command("refresh").description("Pull a fresh snapshot from --url (network).").requiredOption("--url <url>", "Snapshot URL.").option("--out <file>", "Optional path to write the refreshed snapshot to.").option("--format <format>", "Body format: 'auto' (default), 'graphorin', or 'genai-prices'.", "auto").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+		const format = opts.format ?? "auto";
+		if (format !== "auto" && format !== "graphorin" && format !== "genai-prices") {
+			process.stderr.write(`graphorin pricing refresh: invalid --format '${format}' (expected auto | graphorin | genai-prices)\n`);
+			process.exit(2);
+		}
 		await runPricingRefresh({
 			url: opts.url,
+			format,
 			...opts.out !== void 0 ? { out: opts.out } : {},
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
@@ -516,14 +554,14 @@ function registerSkillsCommands(program) {
 	});
 }
 function registerTracesCommands(program) {
-	const t = program.command("traces").description("[Diagnostics] Operate on the trace cache.");
-	t.command("status").description("Count rows + report TTL config.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+	const t = program.command("traces").description("[Diagnostics] Operate on persisted spans.");
+	t.command("status").description("Count persisted spans + report their time range.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		await runTracesStatus({
 			...opts.config !== void 0 ? { config: opts.config } : {},
 			...opts.json !== void 0 ? { json: opts.json } : {}
 		});
 	});
-	t.command("prune").description("Manual TTL enforcement (cutoff is required).").requiredOption("--before <date>", "ISO date / epoch ms cutoff.").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
+	t.command("prune").description("Delete spans that FINISHED before the cutoff (cutoff is required).").requiredOption("--before <date>", "ISO date / epoch ms cutoff (spans ending strictly before it are deleted).").option("-c, --config <path>", "Path to the graphorin.config file.").option("--json", "Emit a structured JSON document on stdout.").action(async (opts) => {
 		await runTracesPrune({
 			before: opts.before,
 			...opts.config !== void 0 ? { config: opts.config } : {},
@@ -584,10 +622,10 @@ function registerTelemetryCommands(program) {
 }
 function registerToolsCommands(program) {
 	program.command("tools").description("[Catalogue] Operate on the tool registry.").command("lint").description([
-		"Static AST analysis of every tool({...}) registration; per-tool grader + threshold gate (RB-49).",
+		"Text-based static scan of every tool({...}) registration; per-tool grader + threshold gate (RB-49).",
 		"",
 		"Grader rubric (40 + 30 + 30 = 100 points):",
-		"  description axis (0..40): 0 if missing/placeholder/<20 chars; 16/24/32/40 by length.",
+		"  description axis (0..40): 0 if missing/placeholder/<20 chars; 16/24/32/40 by length; degenerate text (under 4 unique words or one word over half the text) caps at 16 (W-044).",
 		"  examples axis    (0..30): 0 if none or >5; 12 base + 6 per additional, cap 30; -6 per PII.",
 		"  parameter naming (0..30): 30 base; -30/N per ambiguous name; -10/N per numeric suffix.",
 		"",