@graphorin/cli 0.6.0 → 0.7.0

package/dist/commands/traces.d.ts

@@ -6,7 +6,13 @@ import { CommonOutputOptions } from "../internal/output.js";
 interface TracesCommonOptions extends CommonOutputOptions {
   readonly config?: string;
 }
-/** @stable */
+/**
+ * Field names predate the spans retarget (they said `StartedAt` when the
+ * command aimed at the phantom `traces` table) and are kept for JSON
+ * output stability; values now come from `spans.start_unix_nano`.
+ *
+ * @stable
+ */
 interface TracesStatusResult {
   readonly tableExists: boolean;
   readonly rows: number;
@@ -26,7 +32,13 @@ interface TracesPruneResult {
   readonly removed: number;
   readonly cutoff: string;
 }
-/** @stable */
+/**
+ * Delete spans that FINISHED before the cutoff (see `pruneSpans` in
+ * `@graphorin/store-sqlite` - the ms-to-ns conversion and the strict
+ * `<` boundary live there, backed by the `idx_spans_end` index).
+ *
+ * @stable
+ */
 declare function runTracesPrune(options: TracesPruneOptions): Promise<TracesPruneResult>;
 //#endregion
 export { TracesCommonOptions, TracesPruneOptions, TracesPruneResult, TracesStatusResult, runTracesPrune, runTracesStatus };

package/dist/commands/traces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traces.d.ts","names":[],"sources":["../../src/commands/traces.ts"],"sourcesContent":[],"mappings":";;;;;UA0BiB,mBAAA,SAA4B;;;;UAK5B,kBAAA;;;;;;;iBAQK,eAAA,WACX,sBACR,QAAQ;;UAyCM,kBAAA,SAA2B;;;;;;UAO3B,iBAAA;;;;;iBAMK,cAAA,UAAwB,qBAAqB,QAAQ"}
+{"version":3,"file":"traces.d.ts","names":[],"sources":["../../src/commands/traces.ts"],"sourcesContent":[],"mappings":";;;;;UA+BiB,mBAAA,SAA4B;;;;;;;;;;UAW5B,kBAAA;;;;;;;iBAQK,eAAA,WACX,sBACR,QAAQ;;UA2CM,kBAAA,SAA2B;;;;;;UAO3B,iBAAA;;;;;;;;;;;iBAYK,cAAA,UAAwB,qBAAqB,QAAQ"}

package/dist/commands/traces.js

@@ -1,35 +1,43 @@
 import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
 import { openStoreContext } from "../internal/store-context.js";
+import { pruneSpans } from "@graphorin/store-sqlite";
 
 //#region src/commands/traces.ts
 /**
-* `graphorin traces` - operate on the local trace cache.
+* `graphorin traces` - operate on persisted spans.
 *
 * Surface (per Phase 15 § Traces):
 *
-*  - `graphorin traces status` - count rows + report TTL config.
-*  - `graphorin traces prune [--before <date>]` - manual TTL
+*  - `graphorin traces status` - count spans + report time range.
+*  - `graphorin traces prune --before <date>` - manual retention
 *    enforcement.
 *
-* The trace cache lives in the SQLite store under the `traces` table
-* (registered in Phase 04). This command is read + delete only - the
-* trace producer is the running `@graphorin/observability` exporter.
+* W-007: the spans live in the `spans` table (migration 024, written by
+* the `createSqliteSpanExporter` from `@graphorin/store-sqlite`). The
+* command previously targeted a `traces` table that no migration or
+* runtime ever created, making it a permanent no-op - an operator who
+* put `traces prune` in cron believed retention was handled while
+* `spans` grew without bound. This command is read + delete only; the
+* span producer is the running observability exporter.
 *
 * @packageDocumentation
 */
 /** @stable */
 async function runTracesStatus(options = {}) {
-	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	const ctx = await openStoreContext({
+		migrationPolicy: "check",
+		...options.config !== void 0 ? { config: options.config } : {}
+	});
 	try {
 		const conn = ctx.store.connection;
-		const exists = tableExists(conn, "traces");
+		const exists = tableExists(conn, "spans");
 		let out;
 		if (exists) {
-			const oldest = pickIso(conn, "SELECT MIN(started_at) AS started_at FROM traces");
-			const newest = pickIso(conn, "SELECT MAX(started_at) AS started_at FROM traces");
+			const oldest = pickIso(conn, "SELECT MIN(start_unix_nano) AS nano FROM spans");
+			const newest = pickIso(conn, "SELECT MAX(start_unix_nano) AS nano FROM spans");
 			out = Object.freeze({
 				tableExists: true,
-				rows: numericCount(conn, "SELECT COUNT(*) AS n FROM traces"),
+				rows: numericCount(conn, "SELECT COUNT(*) AS n FROM spans"),
 				...oldest !== void 0 ? { oldestStartedAt: oldest } : {},
 				...newest !== void 0 ? { newestStartedAt: newest } : {}
 			});
@@ -40,38 +48,47 @@ async function runTracesStatus(options = {}) {
 		emitReport(options, out, () => {
 			const print = options.print ?? defaultPrintSink;
 			if (!out.tableExists) {
-				print(brand("traces table not found - the observability exporter has not initialized it yet."));
+				print(brand("spans table not found - run `graphorin migrate` to initialize the schema."));
 				return;
 			}
-			print(brand(`traces: ${out.rows} row(s) (oldest=${out.oldestStartedAt ?? "-"}, newest=${out.newestStartedAt ?? "-"})`));
+			print(brand(`spans: ${out.rows} row(s) (oldest=${out.oldestStartedAt ?? "-"}, newest=${out.newestStartedAt ?? "-"})`));
 		});
 		return out;
 	} finally {
 		await ctx.close();
 	}
 }
-/** @stable */
+/**
+* Delete spans that FINISHED before the cutoff (see `pruneSpans` in
+* `@graphorin/store-sqlite` - the ms-to-ns conversion and the strict
+* `<` boundary live there, backed by the `idx_spans_end` index).
+*
+* @stable
+*/
 async function runTracesPrune(options) {
 	const cutoffMs = parseCutoff(options.before);
-	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	const ctx = await openStoreContext({
+		migrationPolicy: "check",
+		...options.config !== void 0 ? { config: options.config } : {}
+	});
 	try {
-		if (!tableExists(ctx.store.connection, "traces")) {
+		if (!tableExists(ctx.store.connection, "spans")) {
 			const out$1 = Object.freeze({
 				removed: 0,
 				cutoff: new Date(cutoffMs).toISOString()
 			});
 			emitReport(options, out$1, () => {
-				(options.print ?? defaultPrintSink)(brand(`traces table not found; nothing to prune.`));
+				(options.print ?? defaultPrintSink)(brand(`spans table not found; nothing to prune.`));
 			});
 			return out$1;
 		}
-		const result = ctx.store.connection.run("DELETE FROM traces WHERE started_at < ?", [cutoffMs]);
+		const removed = pruneSpans(ctx.store.connection, { beforeEpochMs: cutoffMs });
 		const out = Object.freeze({
-			removed: result.changes,
+			removed,
 			cutoff: new Date(cutoffMs).toISOString()
 		});
 		emitReport(options, out, () => {
-			(options.print ?? defaultPrintSink)(brand(`${out.removed > 0 ? statusMarker("ok") : statusMarker("info")} pruned ${out.removed} trace row(s) (cutoff=${out.cutoff}).`));
+			(options.print ?? defaultPrintSink)(brand(`${out.removed > 0 ? statusMarker("ok") : statusMarker("info")} pruned ${out.removed} span row(s) (cutoff=${out.cutoff}).`));
 		});
 		return out;
 	} finally {
@@ -87,8 +104,8 @@ function numericCount(conn, sql) {
 }
 function pickIso(conn, sql) {
 	const row = conn.get(sql);
-	if (row === void 0 || row.started_at === null) return void 0;
-	return new Date(row.started_at).toISOString();
+	if (row === void 0 || row.nano === null) return void 0;
+	return new Date(Math.floor(row.nano / 1e6)).toISOString();
 }
 function parseCutoff(input) {
 	const numeric = Number(input);

package/dist/commands/traces.js.map

@@ -1 +1 @@
-{"version":3,"file":"traces.js","names":["out: TracesStatusResult","out: TracesPruneResult","out"],"sources":["../../src/commands/traces.ts"],"sourcesContent":["/**\n * `graphorin traces` - operate on the local trace cache.\n *\n * Surface (per Phase 15 § Traces):\n *\n *  - `graphorin traces status` - count rows + report TTL config.\n *  - `graphorin traces prune [--before <date>]` - manual TTL\n *    enforcement.\n *\n * The trace cache lives in the SQLite store under the `traces` table\n * (registered in Phase 04). This command is read + delete only - the\n * trace producer is the running `@graphorin/observability` exporter.\n *\n * @packageDocumentation\n */\n\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\n/** @stable */\nexport interface TracesCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/** @stable */\nexport interface TracesStatusResult {\n  readonly tableExists: boolean;\n  readonly rows: number;\n  readonly oldestStartedAt?: string;\n  readonly newestStartedAt?: string;\n}\n\n/** @stable */\nexport async function runTracesStatus(\n  options: TracesCommonOptions = {},\n): Promise<TracesStatusResult> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const conn = ctx.store.connection;\n    const exists = tableExists(conn, 'traces');\n    let out: TracesStatusResult;\n    if (exists) {\n      const oldest = pickIso(conn, 'SELECT MIN(started_at) AS started_at FROM traces');\n      const newest = pickIso(conn, 'SELECT MAX(started_at) AS started_at FROM traces');\n      out = Object.freeze({\n        tableExists: true,\n        rows: numericCount(conn, 'SELECT COUNT(*) AS n FROM traces'),\n        ...(oldest !== undefined ? { oldestStartedAt: oldest } : {}),\n        ...(newest !== undefined ? { newestStartedAt: newest } : {}),\n      });\n    } else {\n      out = Object.freeze({ tableExists: false, rows: 0 });\n    }\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (!out.tableExists) {\n        print(\n          brand('traces table not found - the observability exporter has not initialized it yet.'),\n        );\n        return;\n      }\n      print(\n        brand(\n          `traces: ${out.rows} row(s) (oldest=${out.oldestStartedAt ?? '-'}, newest=${out.newestStartedAt ?? '-'})`,\n        ),\n      );\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TracesPruneOptions extends TracesCommonOptions {\n  /** ISO date / epoch ms cutoff. Required so the helper never silently\n   * empties the table. */\n  readonly before: string;\n}\n\n/** @stable */\nexport interface TracesPruneResult {\n  readonly removed: number;\n  readonly cutoff: string;\n}\n\n/** @stable */\nexport async function runTracesPrune(options: TracesPruneOptions): Promise<TracesPruneResult> {\n  const cutoffMs = parseCutoff(options.before);\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    if (!tableExists(ctx.store.connection, 'traces')) {\n      const out: TracesPruneResult = Object.freeze({\n        removed: 0,\n        cutoff: new Date(cutoffMs).toISOString(),\n      });\n      emitReport(options, out, () => {\n        const print = options.print ?? defaultPrintSink;\n        print(brand(`traces table not found; nothing to prune.`));\n      });\n      return out;\n    }\n    const result = ctx.store.connection.run('DELETE FROM traces WHERE started_at < ?', [cutoffMs]);\n    const out: TracesPruneResult = Object.freeze({\n      removed: result.changes,\n      cutoff: new Date(cutoffMs).toISOString(),\n    });\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      const mark = out.removed > 0 ? statusMarker('ok') : statusMarker('info');\n      print(brand(`${mark} pruned ${out.removed} trace row(s) (cutoff=${out.cutoff}).`));\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction tableExists(\n  conn: { get: <T = unknown>(s: string, p?: ReadonlyArray<unknown>) => T | undefined },\n  name: string,\n): boolean {\n  const row = conn.get<{ name: string }>(\n    \"SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?\",\n    [name],\n  );\n  return row !== undefined;\n}\n\nfunction numericCount(\n  conn: { get: <T = unknown>(s: string) => T | undefined },\n  sql: string,\n): number {\n  const row = conn.get<{ n: number }>(sql);\n  return typeof row?.n === 'number' ? row.n : 0;\n}\n\nfunction pickIso(\n  conn: { get: <T = unknown>(s: string) => T | undefined },\n  sql: string,\n): string | undefined {\n  const row = conn.get<{ started_at: number | null }>(sql);\n  if (row === undefined || row.started_at === null) return undefined;\n  return new Date(row.started_at).toISOString();\n}\n\nfunction parseCutoff(input: string): number {\n  const numeric = Number(input);\n  if (Number.isFinite(numeric) && numeric > 0) return numeric;\n  const ms = Date.parse(input);\n  if (!Number.isFinite(ms)) {\n    throw new Error(\n      `[graphorin/cli] --before '${input}' is not a valid ISO date or epoch-ms value.`,\n    );\n  }\n  return ms;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuCA,eAAsB,gBACpB,UAA+B,EAAE,EACJ;CAC7B,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,OAAO,IAAI,MAAM;EACvB,MAAM,SAAS,YAAY,MAAM,SAAS;EAC1C,IAAIA;AACJ,MAAI,QAAQ;GACV,MAAM,SAAS,QAAQ,MAAM,mDAAmD;GAChF,MAAM,SAAS,QAAQ,MAAM,mDAAmD;AAChF,SAAM,OAAO,OAAO;IAClB,aAAa;IACb,MAAM,aAAa,MAAM,mCAAmC;IAC5D,GAAI,WAAW,SAAY,EAAE,iBAAiB,QAAQ,GAAG,EAAE;IAC3D,GAAI,WAAW,SAAY,EAAE,iBAAiB,QAAQ,GAAG,EAAE;IAC5D,CAAC;QAEF,OAAM,OAAO,OAAO;GAAE,aAAa;GAAO,MAAM;GAAG,CAAC;AAEtD,aAAW,SAAS,WAAW;GAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,CAAC,IAAI,aAAa;AACpB,UACE,MAAM,kFAAkF,CACzF;AACD;;AAEF,SACE,MACE,WAAW,IAAI,KAAK,kBAAkB,IAAI,mBAAmB,IAAI,WAAW,IAAI,mBAAmB,IAAI,GACxG,CACF;IACD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAkBrB,eAAsB,eAAe,SAAyD;CAC5F,MAAM,WAAW,YAAY,QAAQ,OAAO;CAC5C,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;AACF,MAAI,CAAC,YAAY,IAAI,MAAM,YAAY,SAAS,EAAE;GAChD,MAAMC,QAAyB,OAAO,OAAO;IAC3C,SAAS;IACT,QAAQ,IAAI,KAAK,SAAS,CAAC,aAAa;IACzC,CAAC;AACF,cAAW,SAASC,aAAW;AAE7B,KADc,QAAQ,SAAS,kBACzB,MAAM,4CAA4C,CAAC;KACzD;AACF,UAAOA;;EAET,MAAM,SAAS,IAAI,MAAM,WAAW,IAAI,2CAA2C,CAAC,SAAS,CAAC;EAC9F,MAAMD,MAAyB,OAAO,OAAO;GAC3C,SAAS,OAAO;GAChB,QAAQ,IAAI,KAAK,SAAS,CAAC,aAAa;GACzC,CAAC;AACF,aAAW,SAAS,WAAW;AAG7B,IAFc,QAAQ,SAAS,kBAEzB,MAAM,GADC,IAAI,UAAU,IAAI,aAAa,KAAK,GAAG,aAAa,OAAO,CACpD,UAAU,IAAI,QAAQ,wBAAwB,IAAI,OAAO,IAAI,CAAC;IAClF;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,YACP,MACA,MACS;AAKT,QAJY,KAAK,IACf,oEACA,CAAC,KAAK,CACP,KACc;;AAGjB,SAAS,aACP,MACA,KACQ;CACR,MAAM,MAAM,KAAK,IAAmB,IAAI;AACxC,QAAO,OAAO,KAAK,MAAM,WAAW,IAAI,IAAI;;AAG9C,SAAS,QACP,MACA,KACoB;CACpB,MAAM,MAAM,KAAK,IAAmC,IAAI;AACxD,KAAI,QAAQ,UAAa,IAAI,eAAe,KAAM,QAAO;AACzD,QAAO,IAAI,KAAK,IAAI,WAAW,CAAC,aAAa;;AAG/C,SAAS,YAAY,OAAuB;CAC1C,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,OAAO,SAAS,QAAQ,IAAI,UAAU,EAAG,QAAO;CACpD,MAAM,KAAK,KAAK,MAAM,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,GAAG,CACtB,OAAM,IAAI,MACR,6BAA6B,MAAM,8CACpC;AAEH,QAAO"}
+{"version":3,"file":"traces.js","names":["out: TracesStatusResult","out: TracesPruneResult","out"],"sources":["../../src/commands/traces.ts"],"sourcesContent":["/**\n * `graphorin traces` - operate on persisted spans.\n *\n * Surface (per Phase 15 § Traces):\n *\n *  - `graphorin traces status` - count spans + report time range.\n *  - `graphorin traces prune --before <date>` - manual retention\n *    enforcement.\n *\n * W-007: the spans live in the `spans` table (migration 024, written by\n * the `createSqliteSpanExporter` from `@graphorin/store-sqlite`). The\n * command previously targeted a `traces` table that no migration or\n * runtime ever created, making it a permanent no-op - an operator who\n * put `traces prune` in cron believed retention was handled while\n * `spans` grew without bound. This command is read + delete only; the\n * span producer is the running observability exporter.\n *\n * @packageDocumentation\n */\n\nimport { pruneSpans } from '@graphorin/store-sqlite';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\n/** @stable */\nexport interface TracesCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/**\n * Field names predate the spans retarget (they said `StartedAt` when the\n * command aimed at the phantom `traces` table) and are kept for JSON\n * output stability; values now come from `spans.start_unix_nano`.\n *\n * @stable\n */\nexport interface TracesStatusResult {\n  readonly tableExists: boolean;\n  readonly rows: number;\n  readonly oldestStartedAt?: string;\n  readonly newestStartedAt?: string;\n}\n\n/** @stable */\nexport async function runTracesStatus(\n  options: TracesCommonOptions = {},\n): Promise<TracesStatusResult> {\n  const ctx = await openStoreContext({\n    // W-068: read-only command - never auto-migrate a live database.\n    migrationPolicy: 'check',\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const conn = ctx.store.connection;\n    // After init() the migrations guarantee the table; the guard stays\n    // for databases opened without init.\n    const exists = tableExists(conn, 'spans');\n    let out: TracesStatusResult;\n    if (exists) {\n      const oldest = pickIso(conn, 'SELECT MIN(start_unix_nano) AS nano FROM spans');\n      const newest = pickIso(conn, 'SELECT MAX(start_unix_nano) AS nano FROM spans');\n      out = Object.freeze({\n        tableExists: true,\n        rows: numericCount(conn, 'SELECT COUNT(*) AS n FROM spans'),\n        ...(oldest !== undefined ? { oldestStartedAt: oldest } : {}),\n        ...(newest !== undefined ? { newestStartedAt: newest } : {}),\n      });\n    } else {\n      out = Object.freeze({ tableExists: false, rows: 0 });\n    }\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (!out.tableExists) {\n        print(brand('spans table not found - run `graphorin migrate` to initialize the schema.'));\n        return;\n      }\n      print(\n        brand(\n          `spans: ${out.rows} row(s) (oldest=${out.oldestStartedAt ?? '-'}, newest=${out.newestStartedAt ?? '-'})`,\n        ),\n      );\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TracesPruneOptions extends TracesCommonOptions {\n  /** ISO date / epoch ms cutoff. Required so the helper never silently\n   * empties the table. */\n  readonly before: string;\n}\n\n/** @stable */\nexport interface TracesPruneResult {\n  readonly removed: number;\n  readonly cutoff: string;\n}\n\n/**\n * Delete spans that FINISHED before the cutoff (see `pruneSpans` in\n * `@graphorin/store-sqlite` - the ms-to-ns conversion and the strict\n * `<` boundary live there, backed by the `idx_spans_end` index).\n *\n * @stable\n */\nexport async function runTracesPrune(options: TracesPruneOptions): Promise<TracesPruneResult> {\n  const cutoffMs = parseCutoff(options.before);\n  const ctx = await openStoreContext({\n    // W-068: read-only command - never auto-migrate a live database.\n    migrationPolicy: 'check',\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    if (!tableExists(ctx.store.connection, 'spans')) {\n      const out: TracesPruneResult = Object.freeze({\n        removed: 0,\n        cutoff: new Date(cutoffMs).toISOString(),\n      });\n      emitReport(options, out, () => {\n        const print = options.print ?? defaultPrintSink;\n        print(brand(`spans table not found; nothing to prune.`));\n      });\n      return out;\n    }\n    const removed = pruneSpans(ctx.store.connection, { beforeEpochMs: cutoffMs });\n    const out: TracesPruneResult = Object.freeze({\n      removed,\n      cutoff: new Date(cutoffMs).toISOString(),\n    });\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      const mark = out.removed > 0 ? statusMarker('ok') : statusMarker('info');\n      print(brand(`${mark} pruned ${out.removed} span row(s) (cutoff=${out.cutoff}).`));\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction tableExists(\n  conn: { get: <T = unknown>(s: string, p?: ReadonlyArray<unknown>) => T | undefined },\n  name: string,\n): boolean {\n  const row = conn.get<{ name: string }>(\n    \"SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?\",\n    [name],\n  );\n  return row !== undefined;\n}\n\nfunction numericCount(\n  conn: { get: <T = unknown>(s: string) => T | undefined },\n  sql: string,\n): number {\n  const row = conn.get<{ n: number }>(sql);\n  return typeof row?.n === 'number' ? row.n : 0;\n}\n\nfunction pickIso(\n  conn: { get: <T = unknown>(s: string) => T | undefined },\n  sql: string,\n): string | undefined {\n  const row = conn.get<{ nano: number | null }>(sql);\n  if (row === undefined || row.nano === null) return undefined;\n  return new Date(Math.floor(row.nano / 1e6)).toISOString();\n}\n\nfunction parseCutoff(input: string): number {\n  const numeric = Number(input);\n  if (Number.isFinite(numeric) && numeric > 0) return numeric;\n  const ms = Date.parse(input);\n  if (!Number.isFinite(ms)) {\n    throw new Error(\n      `[graphorin/cli] --before '${input}' is not a valid ISO date or epoch-ms value.`,\n    );\n  }\n  return ms;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,eAAsB,gBACpB,UAA+B,EAAE,EACJ;CAC7B,MAAM,MAAM,MAAM,iBAAiB;EAEjC,iBAAiB;EACjB,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;EACnE,CAAC;AACF,KAAI;EACF,MAAM,OAAO,IAAI,MAAM;EAGvB,MAAM,SAAS,YAAY,MAAM,QAAQ;EACzC,IAAIA;AACJ,MAAI,QAAQ;GACV,MAAM,SAAS,QAAQ,MAAM,iDAAiD;GAC9E,MAAM,SAAS,QAAQ,MAAM,iDAAiD;AAC9E,SAAM,OAAO,OAAO;IAClB,aAAa;IACb,MAAM,aAAa,MAAM,kCAAkC;IAC3D,GAAI,WAAW,SAAY,EAAE,iBAAiB,QAAQ,GAAG,EAAE;IAC3D,GAAI,WAAW,SAAY,EAAE,iBAAiB,QAAQ,GAAG,EAAE;IAC5D,CAAC;QAEF,OAAM,OAAO,OAAO;GAAE,aAAa;GAAO,MAAM;GAAG,CAAC;AAEtD,aAAW,SAAS,WAAW;GAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,CAAC,IAAI,aAAa;AACpB,UAAM,MAAM,4EAA4E,CAAC;AACzF;;AAEF,SACE,MACE,UAAU,IAAI,KAAK,kBAAkB,IAAI,mBAAmB,IAAI,WAAW,IAAI,mBAAmB,IAAI,GACvG,CACF;IACD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;;;;;;;AAwBrB,eAAsB,eAAe,SAAyD;CAC5F,MAAM,WAAW,YAAY,QAAQ,OAAO;CAC5C,MAAM,MAAM,MAAM,iBAAiB;EAEjC,iBAAiB;EACjB,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;EACnE,CAAC;AACF,KAAI;AACF,MAAI,CAAC,YAAY,IAAI,MAAM,YAAY,QAAQ,EAAE;GAC/C,MAAMC,QAAyB,OAAO,OAAO;IAC3C,SAAS;IACT,QAAQ,IAAI,KAAK,SAAS,CAAC,aAAa;IACzC,CAAC;AACF,cAAW,SAASC,aAAW;AAE7B,KADc,QAAQ,SAAS,kBACzB,MAAM,2CAA2C,CAAC;KACxD;AACF,UAAOA;;EAET,MAAM,UAAU,WAAW,IAAI,MAAM,YAAY,EAAE,eAAe,UAAU,CAAC;EAC7E,MAAMD,MAAyB,OAAO,OAAO;GAC3C;GACA,QAAQ,IAAI,KAAK,SAAS,CAAC,aAAa;GACzC,CAAC;AACF,aAAW,SAAS,WAAW;AAG7B,IAFc,QAAQ,SAAS,kBAEzB,MAAM,GADC,IAAI,UAAU,IAAI,aAAa,KAAK,GAAG,aAAa,OAAO,CACpD,UAAU,IAAI,QAAQ,uBAAuB,IAAI,OAAO,IAAI,CAAC;IACjF;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,YACP,MACA,MACS;AAKT,QAJY,KAAK,IACf,oEACA,CAAC,KAAK,CACP,KACc;;AAGjB,SAAS,aACP,MACA,KACQ;CACR,MAAM,MAAM,KAAK,IAAmB,IAAI;AACxC,QAAO,OAAO,KAAK,MAAM,WAAW,IAAI,IAAI;;AAG9C,SAAS,QACP,MACA,KACoB;CACpB,MAAM,MAAM,KAAK,IAA6B,IAAI;AAClD,KAAI,QAAQ,UAAa,IAAI,SAAS,KAAM,QAAO;AACnD,QAAO,IAAI,KAAK,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,CAAC,aAAa;;AAG3D,SAAS,YAAY,OAAuB;CAC1C,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,OAAO,SAAS,QAAQ,IAAI,UAAU,EAAG,QAAO;CACpD,MAAM,KAAK,KAAK,MAAM,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,GAAG,CACtB,OAAM,IAAI,MACR,6BAA6B,MAAM,8CACpC;AAEH,QAAO"}

package/dist/commands/triggers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"triggers.d.ts","names":[],"sources":["../../src/commands/triggers.ts"],"sourcesContent":[],"mappings":";;;;;;AAqJU,UAlHO,qBAAA,SAA8B,mBAkHrC,CAAA;EA0BO,SAAA,MAAA,CAAA,EAAA,MAAqB;AAStC;AAKA;AACW,iBAtJW,eAAA,CAsJX,OAAA,CAAA,EArJA,qBAqJA,CAAA,EApJR,OAoJQ,CApJA,aAoJA,CApJc,YAoJd,CAAA,CAAA;;AACR,UA1Hc,qBAAA,SAA8B,qBA0H5C,CAAA;EAAO,SAAA,EAAA,EAAA,MAAA;;;iBArHY,iBAAA,UACX,wBACR,QAAQ;;UA6BM,mBAAA,SAA4B;;;;iBAKvB,eAAA,UACX,sBACR;;;;;UA8Bc,sBAAA,SAA+B;;;;iBAK1B,kBAAA,UACX,yBACR,QAAQ;;UA0BM,oBAAA,SAA6B;;;;;;;;UAS7B,mBAAA;oBACG;;;iBAIE,gBAAA,WACX,uBACR,QAAQ"}
+{"version":3,"file":"triggers.d.ts","names":[],"sources":["../../src/commands/triggers.ts"],"sourcesContent":[],"mappings":";;;;;;AAwJU,UArHO,qBAAA,SAA8B,mBAqHrC,CAAA;EA0BO,SAAA,MAAA,CAAA,EAAA,MAAqB;AAStC;AAKA;AACW,iBAzJW,eAAA,CAyJX,OAAA,CAAA,EAxJA,qBAwJA,CAAA,EAvJR,OAuJQ,CAvJA,aAuJA,CAvJc,YAuJd,CAAA,CAAA;;AACR,UA3Hc,qBAAA,SAA8B,qBA2H5C,CAAA;EAAO,SAAA,EAAA,EAAA,MAAA;;;iBAtHY,iBAAA,UACX,wBACR,QAAQ;;UA8BM,mBAAA,SAA4B;;;;iBAKvB,eAAA,UACX,sBACR;;;;;UA8Bc,sBAAA,SAA+B;;;;iBAK1B,kBAAA,UACX,yBACR,QAAQ;;UA0BM,oBAAA,SAA6B;;;;;;;;UAS7B,mBAAA;oBACG;;;iBAIE,gBAAA,WACX,uBACR,QAAQ"}

package/dist/commands/triggers.js

@@ -5,7 +5,10 @@ import { openStoreContext } from "../internal/store-context.js";
 //#region src/commands/triggers.ts
 /** @stable */
 async function runTriggersList(options = {}) {
-	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	const ctx = await openStoreContext({
+		migrationPolicy: "check",
+		...options.config !== void 0 ? { config: options.config } : {}
+	});
 	try {
 		const list = await ctx.store.triggers.list();
 		emitReport(options, list, () => {
@@ -31,7 +34,6 @@ async function runTriggersStatus(options) {
 			const print = options.print ?? defaultPrintSink;
 			if (state === null) {
 				print(brand(`trigger '${options.id}' not found.`));
-				process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;
 				return;
 			}
 			print(brand(`trigger ${state.id}`));
@@ -43,6 +45,7 @@ async function runTriggersStatus(options) {
 			print(`  lastFiredAt: ${state.lastFiredAt ?? "-"}`);
 			print(`  missedFires: ${state.missedFires}`);
 		});
+		if (state === null) process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;
 		return state;
 	} finally {
 		await ctx.close();

package/dist/commands/triggers.js.map

@@ -1 +1 @@
-{"version":3,"file":"triggers.js","names":["next: TriggerState","removed: string[]","out: TriggersPruneResult"],"sources":["../../src/commands/triggers.ts"],"sourcesContent":["/**\n * `graphorin triggers` - operate on the durable trigger registry.\n *\n * Surface (per Phase 15 § Triggers):\n *\n *  - `graphorin triggers list` - every persisted trigger.\n *  - `graphorin triggers status <id>` - single-trigger detail.\n *  - `graphorin triggers fire <id>` - operator-fired side-effect (admin\n *    only). The CLI persists a fire-now signal into `trigger_admin`\n *    that the running scheduler picks up; library-mode triggers\n *    can also be fired by re-running the host process.\n *  - `graphorin triggers disable <id>` - flip the `disabled` column.\n *  - `graphorin triggers prune` - drop orphan rows whose callbackRef\n *    no longer exists in the running registry. Without a running\n *    server the CLI cannot tell which triggers are orphans, so the\n *    helper deletes only triggers whose `disabled` column is true and\n *    whose `lastFiredAt` is older than the cutoff supplied via\n *    `--before <ISO>`.\n *\n * @packageDocumentation\n */\n\nimport type { TriggerState } from '@graphorin/core/contracts';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\n/** @stable */\nexport interface TriggersCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/** @stable */\nexport async function runTriggersList(\n  options: TriggersCommonOptions = {},\n): Promise<ReadonlyArray<TriggerState>> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const list = await ctx.store.triggers.list();\n    emitReport(options, list, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (list.length === 0) {\n        print(brand('no triggers persisted.'));\n        return;\n      }\n      print(brand(`${list.length} trigger(s):`));\n      for (const t of list) {\n        const mark = t.disabled ? statusMarker('warn') : statusMarker('ok');\n        print(\n          `  ${mark} ${t.id} (kind=${t.kind}, spec=${t.spec}, next=${t.nextFireAt ?? '-'}, missed=${t.missedFires})`,\n        );\n      }\n    });\n    return list;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersStatusOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersStatus(\n  options: TriggersStatusOptions,\n): Promise<TriggerState | null> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const state = await ctx.store.triggers.get(options.id);\n    emitReport(options, state, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (state === null) {\n        print(brand(`trigger '${options.id}' not found.`));\n        process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;\n        return;\n      }\n      print(brand(`trigger ${state.id}`));\n      print(`  kind: ${state.kind}`);\n      print(`  spec: ${state.spec}`);\n      print(`  disabled: ${state.disabled}`);\n      print(`  catchupPolicy: ${state.catchupPolicy}`);\n      print(`  nextFireAt: ${state.nextFireAt ?? '-'}`);\n      print(`  lastFiredAt: ${state.lastFiredAt ?? '-'}`);\n      print(`  missedFires: ${state.missedFires}`);\n    });\n    return state;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersFireOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersFire(\n  options: TriggersFireOptions,\n): Promise<{ readonly fired: false; readonly unsupported: true }> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const state = await ctx.store.triggers.get(options.id);\n    if (state === null) {\n      throw new Error(`[graphorin/cli] trigger '${options.id}' not found.`);\n    }\n    // IP-4: the old implementation queued a row into a `trigger_admin`\n    // table NOTHING polled and reported success - the fire never\n    // happened. Until a daemon-side poll exists, the honest answer is\n    // UNSUPPORTED with the working alternative.\n    const result = { fired: false, unsupported: true } as const;\n    emitReport(options, result, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          `direct CLI fire is not wired yet - use the running server: POST /v1/triggers/${options.id}/fire (scope triggers:fire).`,\n        ),\n      );\n    });\n    process.exitCode = EXIT_CODES.UNSUPPORTED;\n    return result;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersDisableOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersDisable(\n  options: TriggersDisableOptions,\n): Promise<TriggerState | null> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const existing = await ctx.store.triggers.get(options.id);\n    if (existing === null) {\n      throw new Error(`[graphorin/cli] trigger '${options.id}' not found.`);\n    }\n    const next: TriggerState = {\n      ...existing,\n      disabled: true,\n      updatedAt: new Date().toISOString(),\n    };\n    await ctx.store.triggers.upsert(next);\n    emitReport(options, next, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(brand(`trigger '${options.id}' disabled.`));\n    });\n    return next;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersPruneOptions extends TriggersCommonOptions {\n  /**\n   * ISO date / epoch ms - drop disabled triggers whose `lastFiredAt`\n   * (or `createdAt`, when never fired) is older than this cutoff.\n   */\n  readonly before?: string;\n}\n\n/** @stable */\nexport interface TriggersPruneResult {\n  readonly removed: ReadonlyArray<string>;\n}\n\n/** @stable */\nexport async function runTriggersPrune(\n  options: TriggersPruneOptions = {},\n): Promise<TriggersPruneResult> {\n  const cutoff = options.before === undefined ? 0 : parseCutoff(options.before);\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const all = await ctx.store.triggers.list();\n    const removed: string[] = [];\n    for (const t of all) {\n      if (!t.disabled) continue;\n      const lastTouched = t.lastFiredAt ?? t.createdAt;\n      const lastTouchedMs = Date.parse(lastTouched);\n      if (Number.isFinite(lastTouchedMs) && lastTouchedMs >= cutoff) continue;\n      await ctx.store.triggers.remove(t.id);\n      removed.push(t.id);\n    }\n    const out: TriggersPruneResult = Object.freeze({ removed: Object.freeze(removed) });\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (out.removed.length === 0) {\n        print(brand('no orphan triggers found.'));\n        return;\n      }\n      print(brand(`pruned ${out.removed.length} orphan trigger(s):`));\n      for (const id of out.removed) print(`  - ${id}`);\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction parseCutoff(input: string): number {\n  const numeric = Number(input);\n  if (Number.isFinite(numeric) && numeric > 0) return numeric;\n  const ms = Date.parse(input);\n  if (!Number.isFinite(ms)) {\n    throw new Error(\n      `[graphorin/cli] --before '${input}' is not a valid ISO date or epoch-ms value.`,\n    );\n  }\n  return ms;\n}\n"],"mappings":";;;;;;AAwCA,eAAsB,gBACpB,UAAiC,EAAE,EACG;CACtC,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,OAAO,MAAM,IAAI,MAAM,SAAS,MAAM;AAC5C,aAAW,SAAS,YAAY;GAC9B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,KAAK,WAAW,GAAG;AACrB,UAAM,MAAM,yBAAyB,CAAC;AACtC;;AAEF,SAAM,MAAM,GAAG,KAAK,OAAO,cAAc,CAAC;AAC1C,QAAK,MAAM,KAAK,KAEd,OACE,KAFW,EAAE,WAAW,aAAa,OAAO,GAAG,aAAa,KAAK,CAEvD,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,cAAc,IAAI,WAAW,EAAE,YAAY,GACzG;IAEH;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,kBACpB,SAC8B;CAC9B,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,QAAQ,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG;AACtD,aAAW,SAAS,aAAa;GAC/B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,UAAU,MAAM;AAClB,UAAM,MAAM,YAAY,QAAQ,GAAG,cAAc,CAAC;AAClD,YAAQ,WAAW,WAAW;AAC9B;;AAEF,SAAM,MAAM,WAAW,MAAM,KAAK,CAAC;AACnC,SAAM,WAAW,MAAM,OAAO;AAC9B,SAAM,WAAW,MAAM,OAAO;AAC9B,SAAM,eAAe,MAAM,WAAW;AACtC,SAAM,oBAAoB,MAAM,gBAAgB;AAChD,SAAM,iBAAiB,MAAM,cAAc,MAAM;AACjD,SAAM,kBAAkB,MAAM,eAAe,MAAM;AACnD,SAAM,kBAAkB,MAAM,cAAc;IAC5C;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,gBACpB,SACgE;CAChE,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;AAEF,MADc,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,KACxC,KACZ,OAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,cAAc;EAMvE,MAAM,SAAS;GAAE,OAAO;GAAO,aAAa;GAAM;AAClD,aAAW,SAAS,cAAc;AAEhC,IADc,QAAQ,SAAS,kBAE7B,MACE,gFAAgF,QAAQ,GAAG,8BAC5F,CACF;IACD;AACF,UAAQ,WAAW,WAAW;AAC9B,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,mBACpB,SAC8B;CAC9B,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,WAAW,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG;AACzD,MAAI,aAAa,KACf,OAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,cAAc;EAEvE,MAAMA,OAAqB;GACzB,GAAG;GACH,UAAU;GACV,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC;AACD,QAAM,IAAI,MAAM,SAAS,OAAO,KAAK;AACrC,aAAW,SAAS,YAAY;AAE9B,IADc,QAAQ,SAAS,kBACzB,MAAM,YAAY,QAAQ,GAAG,aAAa,CAAC;IACjD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAmBrB,eAAsB,iBACpB,UAAgC,EAAE,EACJ;CAC9B,MAAM,SAAS,QAAQ,WAAW,SAAY,IAAI,YAAY,QAAQ,OAAO;CAC7E,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;EAC3C,MAAMC,UAAoB,EAAE;AAC5B,OAAK,MAAM,KAAK,KAAK;AACnB,OAAI,CAAC,EAAE,SAAU;GACjB,MAAM,cAAc,EAAE,eAAe,EAAE;GACvC,MAAM,gBAAgB,KAAK,MAAM,YAAY;AAC7C,OAAI,OAAO,SAAS,cAAc,IAAI,iBAAiB,OAAQ;AAC/D,SAAM,IAAI,MAAM,SAAS,OAAO,EAAE,GAAG;AACrC,WAAQ,KAAK,EAAE,GAAG;;EAEpB,MAAMC,MAA2B,OAAO,OAAO,EAAE,SAAS,OAAO,OAAO,QAAQ,EAAE,CAAC;AACnF,aAAW,SAAS,WAAW;GAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,IAAI,QAAQ,WAAW,GAAG;AAC5B,UAAM,MAAM,4BAA4B,CAAC;AACzC;;AAEF,SAAM,MAAM,UAAU,IAAI,QAAQ,OAAO,qBAAqB,CAAC;AAC/D,QAAK,MAAM,MAAM,IAAI,QAAS,OAAM,OAAO,KAAK;IAChD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,YAAY,OAAuB;CAC1C,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,OAAO,SAAS,QAAQ,IAAI,UAAU,EAAG,QAAO;CACpD,MAAM,KAAK,KAAK,MAAM,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,GAAG,CACtB,OAAM,IAAI,MACR,6BAA6B,MAAM,8CACpC;AAEH,QAAO"}
+{"version":3,"file":"triggers.js","names":["next: TriggerState","removed: string[]","out: TriggersPruneResult"],"sources":["../../src/commands/triggers.ts"],"sourcesContent":["/**\n * `graphorin triggers` - operate on the durable trigger registry.\n *\n * Surface (per Phase 15 § Triggers):\n *\n *  - `graphorin triggers list` - every persisted trigger.\n *  - `graphorin triggers status <id>` - single-trigger detail.\n *  - `graphorin triggers fire <id>` - operator-fired side-effect (admin\n *    only). The CLI persists a fire-now signal into `trigger_admin`\n *    that the running scheduler picks up; library-mode triggers\n *    can also be fired by re-running the host process.\n *  - `graphorin triggers disable <id>` - flip the `disabled` column.\n *  - `graphorin triggers prune` - drop orphan rows whose callbackRef\n *    no longer exists in the running registry. Without a running\n *    server the CLI cannot tell which triggers are orphans, so the\n *    helper deletes only triggers whose `disabled` column is true and\n *    whose `lastFiredAt` is older than the cutoff supplied via\n *    `--before <ISO>`.\n *\n * @packageDocumentation\n */\n\nimport type { TriggerState } from '@graphorin/core/contracts';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\n/** @stable */\nexport interface TriggersCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/** @stable */\nexport async function runTriggersList(\n  options: TriggersCommonOptions = {},\n): Promise<ReadonlyArray<TriggerState>> {\n  const ctx = await openStoreContext({\n    // W-068: read-only command - never auto-migrate a live database.\n    migrationPolicy: 'check',\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const list = await ctx.store.triggers.list();\n    emitReport(options, list, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (list.length === 0) {\n        print(brand('no triggers persisted.'));\n        return;\n      }\n      print(brand(`${list.length} trigger(s):`));\n      for (const t of list) {\n        const mark = t.disabled ? statusMarker('warn') : statusMarker('ok');\n        print(\n          `  ${mark} ${t.id} (kind=${t.kind}, spec=${t.spec}, next=${t.nextFireAt ?? '-'}, missed=${t.missedFires})`,\n        );\n      }\n    });\n    return list;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersStatusOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersStatus(\n  options: TriggersStatusOptions,\n): Promise<TriggerState | null> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const state = await ctx.store.triggers.get(options.id);\n    emitReport(options, state, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (state === null) {\n        print(brand(`trigger '${options.id}' not found.`));\n        return;\n      }\n      print(brand(`trigger ${state.id}`));\n      print(`  kind: ${state.kind}`);\n      print(`  spec: ${state.spec}`);\n      print(`  disabled: ${state.disabled}`);\n      print(`  catchupPolicy: ${state.catchupPolicy}`);\n      print(`  nextFireAt: ${state.nextFireAt ?? '-'}`);\n      print(`  lastFiredAt: ${state.lastFiredAt ?? '-'}`);\n      print(`  missedFires: ${state.missedFires}`);\n    });\n    // W-002: exit code independent of --json (see runAuditVerify).\n    if (state === null) process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;\n    return state;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersFireOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersFire(\n  options: TriggersFireOptions,\n): Promise<{ readonly fired: false; readonly unsupported: true }> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const state = await ctx.store.triggers.get(options.id);\n    if (state === null) {\n      throw new Error(`[graphorin/cli] trigger '${options.id}' not found.`);\n    }\n    // IP-4: the old implementation queued a row into a `trigger_admin`\n    // table NOTHING polled and reported success - the fire never\n    // happened. Until a daemon-side poll exists, the honest answer is\n    // UNSUPPORTED with the working alternative.\n    const result = { fired: false, unsupported: true } as const;\n    emitReport(options, result, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          `direct CLI fire is not wired yet - use the running server: POST /v1/triggers/${options.id}/fire (scope triggers:fire).`,\n        ),\n      );\n    });\n    process.exitCode = EXIT_CODES.UNSUPPORTED;\n    return result;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersDisableOptions extends TriggersCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runTriggersDisable(\n  options: TriggersDisableOptions,\n): Promise<TriggerState | null> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const existing = await ctx.store.triggers.get(options.id);\n    if (existing === null) {\n      throw new Error(`[graphorin/cli] trigger '${options.id}' not found.`);\n    }\n    const next: TriggerState = {\n      ...existing,\n      disabled: true,\n      updatedAt: new Date().toISOString(),\n    };\n    await ctx.store.triggers.upsert(next);\n    emitReport(options, next, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(brand(`trigger '${options.id}' disabled.`));\n    });\n    return next;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface TriggersPruneOptions extends TriggersCommonOptions {\n  /**\n   * ISO date / epoch ms - drop disabled triggers whose `lastFiredAt`\n   * (or `createdAt`, when never fired) is older than this cutoff.\n   */\n  readonly before?: string;\n}\n\n/** @stable */\nexport interface TriggersPruneResult {\n  readonly removed: ReadonlyArray<string>;\n}\n\n/** @stable */\nexport async function runTriggersPrune(\n  options: TriggersPruneOptions = {},\n): Promise<TriggersPruneResult> {\n  const cutoff = options.before === undefined ? 0 : parseCutoff(options.before);\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const all = await ctx.store.triggers.list();\n    const removed: string[] = [];\n    for (const t of all) {\n      if (!t.disabled) continue;\n      const lastTouched = t.lastFiredAt ?? t.createdAt;\n      const lastTouchedMs = Date.parse(lastTouched);\n      if (Number.isFinite(lastTouchedMs) && lastTouchedMs >= cutoff) continue;\n      await ctx.store.triggers.remove(t.id);\n      removed.push(t.id);\n    }\n    const out: TriggersPruneResult = Object.freeze({ removed: Object.freeze(removed) });\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (out.removed.length === 0) {\n        print(brand('no orphan triggers found.'));\n        return;\n      }\n      print(brand(`pruned ${out.removed.length} orphan trigger(s):`));\n      for (const id of out.removed) print(`  - ${id}`);\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction parseCutoff(input: string): number {\n  const numeric = Number(input);\n  if (Number.isFinite(numeric) && numeric > 0) return numeric;\n  const ms = Date.parse(input);\n  if (!Number.isFinite(ms)) {\n    throw new Error(\n      `[graphorin/cli] --before '${input}' is not a valid ISO date or epoch-ms value.`,\n    );\n  }\n  return ms;\n}\n"],"mappings":";;;;;;AAwCA,eAAsB,gBACpB,UAAiC,EAAE,EACG;CACtC,MAAM,MAAM,MAAM,iBAAiB;EAEjC,iBAAiB;EACjB,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;EACnE,CAAC;AACF,KAAI;EACF,MAAM,OAAO,MAAM,IAAI,MAAM,SAAS,MAAM;AAC5C,aAAW,SAAS,YAAY;GAC9B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,KAAK,WAAW,GAAG;AACrB,UAAM,MAAM,yBAAyB,CAAC;AACtC;;AAEF,SAAM,MAAM,GAAG,KAAK,OAAO,cAAc,CAAC;AAC1C,QAAK,MAAM,KAAK,KAEd,OACE,KAFW,EAAE,WAAW,aAAa,OAAO,GAAG,aAAa,KAAK,CAEvD,GAAG,EAAE,GAAG,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,cAAc,IAAI,WAAW,EAAE,YAAY,GACzG;IAEH;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,kBACpB,SAC8B;CAC9B,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,QAAQ,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG;AACtD,aAAW,SAAS,aAAa;GAC/B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,UAAU,MAAM;AAClB,UAAM,MAAM,YAAY,QAAQ,GAAG,cAAc,CAAC;AAClD;;AAEF,SAAM,MAAM,WAAW,MAAM,KAAK,CAAC;AACnC,SAAM,WAAW,MAAM,OAAO;AAC9B,SAAM,WAAW,MAAM,OAAO;AAC9B,SAAM,eAAe,MAAM,WAAW;AACtC,SAAM,oBAAoB,MAAM,gBAAgB;AAChD,SAAM,iBAAiB,MAAM,cAAc,MAAM;AACjD,SAAM,kBAAkB,MAAM,eAAe,MAAM;AACnD,SAAM,kBAAkB,MAAM,cAAc;IAC5C;AAEF,MAAI,UAAU,KAAM,SAAQ,WAAW,WAAW;AAClD,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,gBACpB,SACgE;CAChE,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;AAEF,MADc,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,KACxC,KACZ,OAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,cAAc;EAMvE,MAAM,SAAS;GAAE,OAAO;GAAO,aAAa;GAAM;AAClD,aAAW,SAAS,cAAc;AAEhC,IADc,QAAQ,SAAS,kBAE7B,MACE,gFAAgF,QAAQ,GAAG,8BAC5F,CACF;IACD;AACF,UAAQ,WAAW,WAAW;AAC9B,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,mBACpB,SAC8B;CAC9B,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,WAAW,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG;AACzD,MAAI,aAAa,KACf,OAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,cAAc;EAEvE,MAAMA,OAAqB;GACzB,GAAG;GACH,UAAU;GACV,4BAAW,IAAI,MAAM,EAAC,aAAa;GACpC;AACD,QAAM,IAAI,MAAM,SAAS,OAAO,KAAK;AACrC,aAAW,SAAS,YAAY;AAE9B,IADc,QAAQ,SAAS,kBACzB,MAAM,YAAY,QAAQ,GAAG,aAAa,CAAC;IACjD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAmBrB,eAAsB,iBACpB,UAAgC,EAAE,EACJ;CAC9B,MAAM,SAAS,QAAQ,WAAW,SAAY,IAAI,YAAY,QAAQ,OAAO;CAC7E,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;EAC3C,MAAMC,UAAoB,EAAE;AAC5B,OAAK,MAAM,KAAK,KAAK;AACnB,OAAI,CAAC,EAAE,SAAU;GACjB,MAAM,cAAc,EAAE,eAAe,EAAE;GACvC,MAAM,gBAAgB,KAAK,MAAM,YAAY;AAC7C,OAAI,OAAO,SAAS,cAAc,IAAI,iBAAiB,OAAQ;AAC/D,SAAM,IAAI,MAAM,SAAS,OAAO,EAAE,GAAG;AACrC,WAAQ,KAAK,EAAE,GAAG;;EAEpB,MAAMC,MAA2B,OAAO,OAAO,EAAE,SAAS,OAAO,OAAO,QAAQ,EAAE,CAAC;AACnF,aAAW,SAAS,WAAW;GAC7B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,IAAI,QAAQ,WAAW,GAAG;AAC5B,UAAM,MAAM,4BAA4B,CAAC;AACzC;;AAEF,SAAM,MAAM,UAAU,IAAI,QAAQ,OAAO,qBAAqB,CAAC;AAC/D,QAAK,MAAM,MAAM,IAAI,QAAS,OAAM,OAAO,KAAK;IAChD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,YAAY,OAAuB;CAC1C,MAAM,UAAU,OAAO,MAAM;AAC7B,KAAI,OAAO,SAAS,QAAQ,IAAI,UAAU,EAAG,QAAO;CACpD,MAAM,KAAK,KAAK,MAAM,MAAM;AAC5B,KAAI,CAAC,OAAO,SAAS,GAAG,CACtB,OAAM,IAAI,MACR,6BAA6B,MAAM,8CACpC;AAEH,QAAO"}

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import { AuditCommonOptions, AuditExportOptions, AuditExportResult, AuditPruneOptions, AuditVerifyResult, runAuditExport, runAuditPrune, runAuditVerify } from "./commands/audit.js";
 import { AuthCommonOptions, AuthListOptions, AuthLoginOptions, AuthRefreshOptions, AuthRevokeOptions, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "./commands/auth.js";
-import { CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "./commands/consolidator.js";
+import { CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorDlqClearOptions, ConsolidatorDlqClearResult, ConsolidatorDlqEntry, ConsolidatorDlqListOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, runConsolidatorDlqClear, runConsolidatorDlqList, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "./commands/consolidator.js";
 import { DoctorCommandOptions, DoctorReport, expectedFileModes, runDoctor } from "./commands/doctor.js";
 import { GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, runGuardExplain, runGuardStatus } from "./commands/guard.js";
 import { InitCommandOptions, InitCommandResult, runInit } from "./commands/init.js";
-import { MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy } from "./commands/memory.js";
+import { MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryPruneHistoryOptions, MemoryPruneHistoryResult, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryPruneHistory, runMemoryReview, runMemoryStatus, runMemoryWhy } from "./commands/memory.js";
 import { MigrateCommandOptions, MigrateCommandResult, runMigrate } from "./commands/migrate.js";
 import { MigrateConfigOptions, MigrateConfigResult, runMigrateConfig } from "./commands/migrate-config.js";
 import { MigrateExportOptions, MigrateExportResult, runMigrateExport } from "./commands/migrate-export.js";
@@ -12,7 +12,7 @@ import { PricingCommonOptions, PricingDiffOptions, PricingLookupOptions, Pricing
 import { SecretsCommonOptions, SecretsDeleteOptions, SecretsGetOptions, SecretsGetResult, SecretsListOptions, SecretsRefOptions, SecretsRefResult, SecretsRotateOptions, SecretsSetOptions, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet } from "./commands/secrets.js";
 import { SkillTrustLevelInput, SkillsAuditOptions, SkillsCommonOptions, SkillsInspectOptions, SkillsInstallOptions, SkillsMigrateFrontmatterOptions, SkillsMigrateFrontmatterResult, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter } from "./commands/skills.js";
 import { SecretsSourceFlag, StartCommandOptions, runStart } from "./commands/start.js";
-import { StorageBackupOptions, StorageBackupResult, StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus } from "./commands/storage.js";
+import { StorageBackupOptions, StorageBackupResult, StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageCompactOptions, StorageCompactResult, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, runStorageBackup, runStorageCleanupBackups, runStorageCompact, runStorageEncrypt, runStorageRekey, runStorageStatus } from "./commands/storage.js";
 import { TelemetryStatusResult, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus } from "./commands/telemetry.js";
 import { TokenCommonOptions, TokenCreateOptions, TokenCreateResult, TokenListOptions, TokenRekeyOptions, TokenRevokeOptions, TokenRotateOptions, TokenVerifyOptions, TokenVerifyResult, parseDuration, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify } from "./commands/token.js";
 import { ToolsLintOptions, ToolsLintReport, runToolsLint } from "./commands/tools-lint.js";
@@ -39,8 +39,7 @@ import { OfflineModeViolationError, assertNoNetworkInOfflineMode, checkOfflineMo
  *
  * @packageDocumentation
  */
-/** Canonical version constant. Mirrors the `package.json` version. */
-declare const VERSION = "0.6.0";
+declare const VERSION: string;
 //#endregion
-export { AuditCommonOptions, AuditExportOptions, AuditExportResult, AuditPruneOptions, AuditVerifyResult, AuthCommonOptions, AuthListOptions, AuthLoginOptions, AuthRefreshOptions, AuthRevokeOptions, CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, DoctorCommandOptions, DoctorReport, GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, InitCommandOptions, InitCommandResult, MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, MigrateCommandOptions, MigrateCommandResult, MigrateConfigOptions, MigrateConfigResult, MigrateExportOptions, MigrateExportResult, OfflineModeViolationError, PricingCommonOptions, PricingDiffOptions, PricingLookupOptions, PricingMissingOptions, PricingRefreshOptions, PricingStatusResult, SecretsCommonOptions, SecretsDeleteOptions, SecretsGetOptions, SecretsGetResult, SecretsListOptions, SecretsRefOptions, SecretsRefResult, SecretsRotateOptions, SecretsSetOptions, SecretsSourceFlag, SkillTrustLevelInput, SkillsAuditOptions, SkillsCommonOptions, SkillsInspectOptions, SkillsInstallOptions, SkillsMigrateFrontmatterOptions, SkillsMigrateFrontmatterResult, StartCommandOptions, StorageBackupOptions, StorageBackupResult, StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, TelemetryStatusResult, TokenCommonOptions, TokenCreateOptions, TokenCreateResult, TokenListOptions, TokenRekeyOptions, TokenRevokeOptions, TokenRotateOptions, TokenVerifyOptions, TokenVerifyResult, ToolsLintOptions, ToolsLintReport, TracesCommonOptions, TracesPruneOptions, TracesPruneResult, TracesStatusResult, TriggersCommonOptions, TriggersDisableOptions, TriggersFireOptions, TriggersPruneOptions, TriggersPruneResult, TriggersStatusOptions, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };
+export { AuditCommonOptions, AuditExportOptions, AuditExportResult, AuditPruneOptions, AuditVerifyResult, AuthCommonOptions, AuthListOptions, AuthLoginOptions, AuthRefreshOptions, AuthRevokeOptions, CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorDlqClearOptions, ConsolidatorDlqClearResult, ConsolidatorDlqEntry, ConsolidatorDlqListOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, DoctorCommandOptions, DoctorReport, GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, InitCommandOptions, InitCommandResult, MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryPruneHistoryOptions, MemoryPruneHistoryResult, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, MigrateCommandOptions, MigrateCommandResult, MigrateConfigOptions, MigrateConfigResult, MigrateExportOptions, MigrateExportResult, OfflineModeViolationError, PricingCommonOptions, PricingDiffOptions, PricingLookupOptions, PricingMissingOptions, PricingRefreshOptions, PricingStatusResult, SecretsCommonOptions, SecretsDeleteOptions, SecretsGetOptions, SecretsGetResult, SecretsListOptions, SecretsRefOptions, SecretsRefResult, SecretsRotateOptions, SecretsSetOptions, SecretsSourceFlag, SkillTrustLevelInput, SkillsAuditOptions, SkillsCommonOptions, SkillsInspectOptions, SkillsInstallOptions, SkillsMigrateFrontmatterOptions, SkillsMigrateFrontmatterResult, StartCommandOptions, StorageBackupOptions, StorageBackupResult, StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageCompactOptions, StorageCompactResult, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, TelemetryStatusResult, TokenCommonOptions, TokenCreateOptions, TokenCreateResult, TokenListOptions, TokenRekeyOptions, TokenRevokeOptions, TokenRotateOptions, TokenVerifyOptions, TokenVerifyResult, ToolsLintOptions, ToolsLintReport, TracesCommonOptions, TracesPruneOptions, TracesPruneResult, TracesStatusResult, TriggersCommonOptions, TriggersDisableOptions, TriggersFireOptions, TriggersPruneOptions, TriggersPruneResult, TriggersStatusOptions, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorDlqClear, runConsolidatorDlqList, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryPruneHistory, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageCompact, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAmBa,OAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAqBa"}

package/dist/index.js

@@ -1,11 +1,12 @@
+import { version } from "./package.js";
 import { runAuditExport, runAuditPrune, runAuditVerify } from "./commands/audit.js";
 import { OfflineModeViolationError, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, isOfflineMode } from "./internal/offline.js";
 import { runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "./commands/auth.js";
-import { CONSOLIDATOR_INVALID_TIER_EXIT, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "./commands/consolidator.js";
+import { CONSOLIDATOR_INVALID_TIER_EXIT, runConsolidatorDlqClear, runConsolidatorDlqList, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "./commands/consolidator.js";
 import { expectedFileModes, runDoctor } from "./commands/doctor.js";
 import { runGuardExplain, runGuardStatus } from "./commands/guard.js";
 import { runInit } from "./commands/init.js";
-import { runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy } from "./commands/memory.js";
+import { runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryPruneHistory, runMemoryReview, runMemoryStatus, runMemoryWhy } from "./commands/memory.js";
 import { runStart } from "./commands/start.js";
 import { runMigrate } from "./commands/migrate.js";
 import { runMigrateConfig } from "./commands/migrate-config.js";
@@ -13,13 +14,12 @@ import { runMigrateExport } from "./commands/migrate-export.js";
 import { runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus } from "./commands/pricing.js";
 import { runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet } from "./commands/secrets.js";
 import { runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter } from "./commands/skills.js";
-import { runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus } from "./commands/storage.js";
+import { runStorageBackup, runStorageCleanupBackups, runStorageCompact, runStorageEncrypt, runStorageRekey, runStorageStatus } from "./commands/storage.js";
 import { runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus } from "./commands/telemetry.js";
 import { parseDuration, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify } from "./commands/token.js";
 import { runToolsLint } from "./commands/tools-lint.js";
 import { runTracesPrune, runTracesStatus } from "./commands/traces.js";
 import { runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus } from "./commands/triggers.js";
-import "./commands/index.js";
 
 //#region src/index.ts
 /**
@@ -39,9 +39,9 @@ import "./commands/index.js";
 *
 * @packageDocumentation
 */
-/** Canonical version constant. Mirrors the `package.json` version. */
-const VERSION = "0.6.0";
+/** Canonical version constant, derived from `package.json` at build time. */
+const VERSION = version;
 
 //#endregion
-export { CONSOLIDATOR_INVALID_TIER_EXIT, OfflineModeViolationError, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };
+export { CONSOLIDATOR_INVALID_TIER_EXIT, OfflineModeViolationError, VERSION, assertNoNetworkInOfflineMode, checkOfflineModeBlocked, expectedFileModes, isOfflineMode, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorDlqClear, runConsolidatorDlqList, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryPruneHistory, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageBackup, runStorageCleanupBackups, runStorageCompact, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/cli` - operator CLI for the Graphorin framework.\n *\n * Phase 14a shipped the minimal `graphorin` binary with three\n * lifecycle commands: `start`, `init`, and `migrate`. Phase 15\n * extended the same binary with the operator surface (`doctor`,\n * `token`, `secrets`, `audit`, `storage`, `memory`, `consolidator`,\n * `triggers`, `auth`, `pricing`, `skills`, `traces`,\n * `migrate-export`, `migrate-config`, `guard`, `telemetry`,\n * `tools lint`).\n *\n * Every subcommand is exported as a typed library function so\n * downstream automations can call them directly without spawning a\n * child process.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant. Mirrors the `package.json` version. */\nexport const VERSION = '0.6.0';\n\nexport * from './commands/index.js';\nexport {\n  assertNoNetworkInOfflineMode,\n  checkOfflineModeBlocked,\n  isOfflineMode,\n  OfflineModeViolationError,\n} from './internal/offline.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,MAAa,UAAU"}
+{"version":3,"file":"index.js","names":["VERSION: string","pkg.version"],"sources":["../src/index.ts"],"sourcesContent":["/**\n * `@graphorin/cli` - operator CLI for the Graphorin framework.\n *\n * Phase 14a shipped the minimal `graphorin` binary with three\n * lifecycle commands: `start`, `init`, and `migrate`. Phase 15\n * extended the same binary with the operator surface (`doctor`,\n * `token`, `secrets`, `audit`, `storage`, `memory`, `consolidator`,\n * `triggers`, `auth`, `pricing`, `skills`, `traces`,\n * `migrate-export`, `migrate-config`, `guard`, `telemetry`,\n * `tools lint`).\n *\n * Every subcommand is exported as a typed library function so\n * downstream automations can call them directly without spawning a\n * child process.\n *\n * @packageDocumentation\n */\n\n/** Canonical version constant, derived from `package.json` at build time. */\nimport pkg from '../package.json' with { type: 'json' };\n\nexport const VERSION: string = pkg.version;\n\nexport * from './commands/index.js';\nexport {\n  assertNoNetworkInOfflineMode,\n  checkOfflineModeBlocked,\n  isOfflineMode,\n  OfflineModeViolationError,\n} from './internal/offline.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAaA,UAAkBC"}

package/dist/internal/output.js

@@ -46,6 +46,12 @@ function defaultJsonSink(payload) {
 * `--json`. Used by every Phase 15 subcommand that produces a single
 * status payload (e.g. `graphorin doctor`, `graphorin token list`).
 *
+* WARNING (W-002): `human()` runs ONLY in non-JSON mode. Side effects
+* that are part of the machine contract - `process.exitCode` above all
+* - are FORBIDDEN inside it: they would silently vanish for exactly
+* the `--json` consumers (CI) they exist for. Compute the failure
+* predicate before calling this and set the exit code after it.
+*
 * @internal
 */
 function emitReport(options, payload, human) {

package/dist/internal/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","names":[],"sources":["../../src/internal/output.ts"],"sourcesContent":["/**\n * Shared output helpers for Phase 15 subcommands. The CLI keeps three\n * output flavours uniform across every command:\n *\n *  1. **Human** - single-line `[graphorin/cli] ...` messages on stderr\n *     (the default path in Phase 14a; preserved for backward\n *     compatibility).\n *  2. **JSON** - one structured JSON document per subcommand emitted on\n *     stdout when `--json` is set. Phase 15 commands that produce a\n *     report (status / list / verify / lookup) ship a stable schema so\n *     CI pipelines can consume them.\n *  3. **Stub print sink** - every command accepts an optional\n *     `print(line: string)` callback so unit tests can capture output\n *     without spying on `process.stderr`.\n *\n * Helpers in this module are intentionally tiny - they exist so the\n * sixteen Phase 15 subcommand groups share one channel surface\n * (single-source-of-truth per Hard Rule 5 in the working plan).\n *\n * @internal\n */\n\nimport process from 'node:process';\n\n/**\n * Sink the CLI subcommands write human-readable lines through. The\n * default sink writes a trailing newline to `process.stderr`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type PrintSink = (line: string) => void;\n\n/**\n * Default `PrintSink` - appends a newline and writes to `stderr` so it\n * never collides with the JSON document on `stdout`.\n *\n * @internal\n */\nexport function defaultPrintSink(line: string): void {\n  process.stderr.write(`${line}\\n`);\n}\n\n/**\n * Sink the CLI uses when emitting structured JSON documents. Defaults\n * to writing a single trailing newline to `process.stdout`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type JsonSink = (payload: unknown) => void;\n\n/**\n * Default `JsonSink` - writes a stable, two-space indented JSON\n * document to `stdout` plus a trailing newline so consumers can split\n * a multi-document stream by lines.\n *\n * @internal\n */\nexport function defaultJsonSink(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload, null, 2)}\\n`);\n}\n\n/**\n * Common output options every Phase 15 command honours.\n *\n * @stable\n */\nexport interface CommonOutputOptions {\n  /** Emit a structured JSON document instead of human-readable text. */\n  readonly json?: boolean;\n  /** Force `--non-interactive` semantics (skip prompts; require flags / env). */\n  readonly nonInteractive?: boolean;\n  /** Test seam - capture human lines instead of writing to stderr. */\n  readonly print?: PrintSink;\n  /** Test seam - capture JSON documents instead of writing to stdout. */\n  readonly jsonPrint?: JsonSink;\n}\n\n/**\n * Emit either the JSON document or the human report depending on\n * `--json`. Used by every Phase 15 subcommand that produces a single\n * status payload (e.g. `graphorin doctor`, `graphorin token list`).\n *\n * @internal\n */\nexport function emitReport(\n  options: CommonOutputOptions,\n  payload: unknown,\n  human: () => void,\n): void {\n  if (options.json === true) {\n    const sink = options.jsonPrint ?? defaultJsonSink;\n    sink(payload);\n    return;\n  }\n  human();\n}\n\n/**\n * Format a status icon for human reports. The CLI is ASCII-only per\n * the Phase 15 spec (no emoji); the markers are unambiguous so\n * operators see at a glance what a row means.\n *\n * @internal\n */\nexport function statusMarker(status: 'ok' | 'warn' | 'fail' | 'skip' | 'info'): string {\n  switch (status) {\n    case 'ok':\n      return '[OK]';\n    case 'warn':\n      return '[WARN]';\n    case 'fail':\n      return '[FAIL]';\n    case 'skip':\n      return '[SKIP]';\n    case 'info':\n      return '[INFO]';\n  }\n}\n\n/**\n * Standardised `[graphorin/cli] <message>` prefix every human-format\n * line carries. Centralised so every command renders the same brand.\n *\n * @internal\n */\nexport function brand(line: string): string {\n  return `[graphorin/cli] ${line}`;\n}\n\n/**\n * Convenience helper - writes a branded message via the chosen sink.\n *\n * @internal\n */\nexport function brandedLine(options: CommonOutputOptions, line: string): void {\n  const sink = options.print ?? defaultPrintSink;\n  sink(brand(line));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,iBAAiB,MAAoB;AACnD,SAAQ,OAAO,MAAM,GAAG,KAAK,IAAI;;;;;;;;;AAmBnC,SAAgB,gBAAgB,SAAwB;AACtD,SAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;;;;;;;;;AA0B/D,SAAgB,WACd,SACA,SACA,OACM;AACN,KAAI,QAAQ,SAAS,MAAM;AAEzB,GADa,QAAQ,aAAa,iBAC7B,QAAQ;AACb;;AAEF,QAAO;;;;;;;;;AAUT,SAAgB,aAAa,QAA0D;AACrF,SAAQ,QAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;;;;;;;;;AAUb,SAAgB,MAAM,MAAsB;AAC1C,QAAO,mBAAmB"}
+{"version":3,"file":"output.js","names":[],"sources":["../../src/internal/output.ts"],"sourcesContent":["/**\n * Shared output helpers for Phase 15 subcommands. The CLI keeps three\n * output flavours uniform across every command:\n *\n *  1. **Human** - single-line `[graphorin/cli] ...` messages on stderr\n *     (the default path in Phase 14a; preserved for backward\n *     compatibility).\n *  2. **JSON** - one structured JSON document per subcommand emitted on\n *     stdout when `--json` is set. Phase 15 commands that produce a\n *     report (status / list / verify / lookup) ship a stable schema so\n *     CI pipelines can consume them.\n *  3. **Stub print sink** - every command accepts an optional\n *     `print(line: string)` callback so unit tests can capture output\n *     without spying on `process.stderr`.\n *\n * Helpers in this module are intentionally tiny - they exist so the\n * sixteen Phase 15 subcommand groups share one channel surface\n * (single-source-of-truth per Hard Rule 5 in the working plan).\n *\n * @internal\n */\n\nimport process from 'node:process';\n\n/**\n * Sink the CLI subcommands write human-readable lines through. The\n * default sink writes a trailing newline to `process.stderr`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type PrintSink = (line: string) => void;\n\n/**\n * Default `PrintSink` - appends a newline and writes to `stderr` so it\n * never collides with the JSON document on `stdout`.\n *\n * @internal\n */\nexport function defaultPrintSink(line: string): void {\n  process.stderr.write(`${line}\\n`);\n}\n\n/**\n * Sink the CLI uses when emitting structured JSON documents. Defaults\n * to writing a single trailing newline to `process.stdout`. Tests\n * inject a buffer.\n *\n * @internal\n */\nexport type JsonSink = (payload: unknown) => void;\n\n/**\n * Default `JsonSink` - writes a stable, two-space indented JSON\n * document to `stdout` plus a trailing newline so consumers can split\n * a multi-document stream by lines.\n *\n * @internal\n */\nexport function defaultJsonSink(payload: unknown): void {\n  process.stdout.write(`${JSON.stringify(payload, null, 2)}\\n`);\n}\n\n/**\n * Common output options every Phase 15 command honours.\n *\n * @stable\n */\nexport interface CommonOutputOptions {\n  /** Emit a structured JSON document instead of human-readable text. */\n  readonly json?: boolean;\n  /** Force `--non-interactive` semantics (skip prompts; require flags / env). */\n  readonly nonInteractive?: boolean;\n  /** Test seam - capture human lines instead of writing to stderr. */\n  readonly print?: PrintSink;\n  /** Test seam - capture JSON documents instead of writing to stdout. */\n  readonly jsonPrint?: JsonSink;\n}\n\n/**\n * Emit either the JSON document or the human report depending on\n * `--json`. Used by every Phase 15 subcommand that produces a single\n * status payload (e.g. `graphorin doctor`, `graphorin token list`).\n *\n * WARNING (W-002): `human()` runs ONLY in non-JSON mode. Side effects\n * that are part of the machine contract - `process.exitCode` above all\n * - are FORBIDDEN inside it: they would silently vanish for exactly\n * the `--json` consumers (CI) they exist for. Compute the failure\n * predicate before calling this and set the exit code after it.\n *\n * @internal\n */\nexport function emitReport(\n  options: CommonOutputOptions,\n  payload: unknown,\n  human: () => void,\n): void {\n  if (options.json === true) {\n    const sink = options.jsonPrint ?? defaultJsonSink;\n    sink(payload);\n    return;\n  }\n  human();\n}\n\n/**\n * Format a status icon for human reports. The CLI is ASCII-only per\n * the Phase 15 spec (no emoji); the markers are unambiguous so\n * operators see at a glance what a row means.\n *\n * @internal\n */\nexport function statusMarker(status: 'ok' | 'warn' | 'fail' | 'skip' | 'info'): string {\n  switch (status) {\n    case 'ok':\n      return '[OK]';\n    case 'warn':\n      return '[WARN]';\n    case 'fail':\n      return '[FAIL]';\n    case 'skip':\n      return '[SKIP]';\n    case 'info':\n      return '[INFO]';\n  }\n}\n\n/**\n * Standardised `[graphorin/cli] <message>` prefix every human-format\n * line carries. Centralised so every command renders the same brand.\n *\n * @internal\n */\nexport function brand(line: string): string {\n  return `[graphorin/cli] ${line}`;\n}\n\n/**\n * Convenience helper - writes a branded message via the chosen sink.\n *\n * @internal\n */\nexport function brandedLine(options: CommonOutputOptions, line: string): void {\n  const sink = options.print ?? defaultPrintSink;\n  sink(brand(line));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,iBAAiB,MAAoB;AACnD,SAAQ,OAAO,MAAM,GAAG,KAAK,IAAI;;;;;;;;;AAmBnC,SAAgB,gBAAgB,SAAwB;AACtD,SAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;;;;;;;;;;;;;;;AAgC/D,SAAgB,WACd,SACA,SACA,OACM;AACN,KAAI,QAAQ,SAAS,MAAM;AAEzB,GADa,QAAQ,aAAa,iBAC7B,QAAQ;AACb;;AAEF,QAAO;;;;;;;;;AAUT,SAAgB,aAAa,QAA0D;AACrF,SAAQ,QAAR;EACE,KAAK,KACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;EACT,KAAK,OACH,QAAO;;;;;;;;;AAUb,SAAgB,MAAM,MAAsB;AAC1C,QAAO,mBAAmB"}

package/dist/internal/store-context.js

@@ -1,7 +1,7 @@
 import { loadConfig } from "./load-config.js";
 import { resolveSecret } from "@graphorin/security";
 import { parseServerConfig } from "@graphorin/server";
-import { createSqliteStore } from "@graphorin/store-sqlite";
+import { createSqliteStore, pendingMigrations } from "@graphorin/store-sqlite";
 
 //#region src/internal/store-context.ts
 /**
@@ -41,7 +41,18 @@ async function openStoreContext(options = {}) {
 		};
 	}
 	const store = await factory(storeOpts);
-	if (options.skipInit !== true) await store.init();
+	if (options.skipInit !== true) if (options.migrationPolicy === "check") {
+		let pendingCount = 0;
+		try {
+			pendingCount = pendingMigrations(store.connection).length;
+		} catch {
+			pendingCount = 0;
+		}
+		if (pendingCount > 0) {
+			await store.close();
+			throw new Error(`[graphorin/cli] the database schema is ${pendingCount} migration(s) behind this CLI. This is a read-only command and will not upgrade a live database. Run 'graphorin migrate' (with the server stopped) or use a CLI version matching the server.`);
+		}
+	} else await store.init();
 	let pepper;
 	if (options.requirePepper === true) {
 		if (config.auth.kind !== "token" || config.auth.pepperRef === void 0) {

package/dist/internal/store-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-context.js","names":["storeOpts: CreateSqliteStoreOptions","resolveSecret","pepper: SecretValue | undefined"],"sources":["../../src/internal/store-context.ts"],"sourcesContent":["/**\n * Shared helper that loads `graphorin.config`, parses it through\n * `parseServerConfig(...)`, opens the SQLite store, optionally resolves\n * the server pepper, and returns a disposable handle for any Phase 15\n * subcommand that needs a live storage / auth context.\n *\n * Centralising the resource lifecycle here means every command (token,\n * audit, secrets, memory, triggers, storage, …) acquires + releases\n * the same way; tests only stub the loader once.\n *\n * @internal\n */\n\nimport { resolveSecret, type SecretValue } from '@graphorin/security';\nimport { parseServerConfig, type ServerConfigSpec } from '@graphorin/server';\nimport {\n  type CreateSqliteStoreOptions,\n  createSqliteStore,\n  type GraphorinSqliteStore,\n} from '@graphorin/store-sqlite';\n\nimport { loadConfig } from './load-config.js';\n\n/**\n * @internal\n */\nexport interface OpenStoreContextOptions {\n  /** Path to `graphorin.config.{ts,js,mjs,json}`. */\n  readonly config?: string;\n  /**\n   * When `true`, refuse to continue when `auth.pepperRef` cannot be\n   * resolved. Default `false` - callers that do not need the pepper\n   * (e.g. `graphorin audit verify`) skip resolution entirely.\n   */\n  readonly requirePepper?: boolean;\n  /**\n   * Override the store factory - tests inject a fake store so they\n   * can run subcommand integration without touching a real DB.\n   */\n  readonly storeFactory?: (options: CreateSqliteStoreOptions) => Promise<GraphorinSqliteStore>;\n  /**\n   * Skip migrations. Defaults to `false` so subcommands always operate\n   * against an initialized schema.\n   */\n  readonly skipInit?: boolean;\n}\n\n/**\n * @internal\n */\nexport interface StoreContext {\n  readonly configPath: string;\n  readonly config: ServerConfigSpec;\n  readonly store: GraphorinSqliteStore;\n  readonly pepper?: SecretValue;\n  /** Releases the underlying SQLite connection. */\n  close(): Promise<void>;\n}\n\n/**\n * Open the storage context for the provided config path. Throws on\n * Zod validation errors and on `requirePepper && !pepperRef`.\n *\n * @internal\n */\nexport async function openStoreContext(\n  options: OpenStoreContextOptions = {},\n): Promise<StoreContext> {\n  const loaded = await loadConfig(options.config);\n  const config = parseServerConfig(loaded.config);\n  const factory = options.storeFactory ?? createSqliteStore;\n  const storeOpts: CreateSqliteStoreOptions = {\n    path: config.storage.path,\n    mode: config.storage.mode,\n  };\n  // IP-1: the CLI honours the same encryption config as the server, so\n  // `graphorin` commands can open a database produced by\n  // `graphorin storage encrypt`.\n  if (config.storage.encryption.enabled) {\n    if (config.storage.encryption.passphraseRef === undefined) {\n      throw new Error(\n        '[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.',\n      );\n    }\n    const { resolveSecret } = await import('@graphorin/security/secrets');\n    const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);\n    (storeOpts as { encryption?: unknown }).encryption = {\n      enabled: true,\n      ...(config.storage.encryption.cipher !== undefined\n        ? { cipher: config.storage.encryption.cipher }\n        : {}),\n      passphraseResolver: async () => passphrase.use((v: string) => v),\n    };\n  }\n  const store = await factory(storeOpts);\n  if (options.skipInit !== true) {\n    await store.init();\n  }\n\n  let pepper: SecretValue | undefined;\n  if (options.requirePepper === true) {\n    if (config.auth.kind !== 'token' || config.auth.pepperRef === undefined) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`,\n      );\n    }\n    try {\n      pepper = await resolveSecret(config.auth.pepperRef);\n    } catch (err) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${(err as Error).message}`,\n        { cause: err },\n      );\n    }\n  }\n\n  const ctx: StoreContext = Object.freeze({\n    configPath: loaded.path,\n    config,\n    store,\n    ...(pepper !== undefined ? { pepper } : {}),\n    close: () => store.close(),\n  });\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,iBACpB,UAAmC,EAAE,EACd;CACvB,MAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;CAC/C,MAAM,SAAS,kBAAkB,OAAO,OAAO;CAC/C,MAAM,UAAU,QAAQ,gBAAgB;CACxC,MAAMA,YAAsC;EAC1C,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ;EACtB;AAID,KAAI,OAAO,QAAQ,WAAW,SAAS;AACrC,MAAI,OAAO,QAAQ,WAAW,kBAAkB,OAC9C,OAAM,IAAI,MACR,yFACD;EAEH,MAAM,EAAE,mCAAkB,MAAM,OAAO;EACvC,MAAM,aAAa,MAAMC,gBAAc,OAAO,QAAQ,WAAW,cAAc;AAC/E,EAAC,UAAuC,aAAa;GACnD,SAAS;GACT,GAAI,OAAO,QAAQ,WAAW,WAAW,SACrC,EAAE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,GAC5C,EAAE;GACN,oBAAoB,YAAY,WAAW,KAAK,MAAc,EAAE;GACjE;;CAEH,MAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,KAAI,QAAQ,aAAa,KACvB,OAAM,MAAM,MAAM;CAGpB,IAAIC;AACJ,KAAI,QAAQ,kBAAkB,MAAM;AAClC,MAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,cAAc,QAAW;AACvE,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,iFAAiF,OAAO,KAAK,IAC9F;;AAEH,MAAI;AACF,YAAS,MAAM,cAAc,OAAO,KAAK,UAAU;WAC5C,KAAK;AACZ,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,qDAAqD,OAAO,KAAK,UAAU,KAAM,IAAc,WAC/F,EAAE,OAAO,KAAK,CACf;;;AAWL,QAP0B,OAAO,OAAO;EACtC,YAAY,OAAO;EACnB;EACA;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,aAAa,MAAM,OAAO;EAC3B,CAAC"}
+{"version":3,"file":"store-context.js","names":["storeOpts: CreateSqliteStoreOptions","resolveSecret","pepper: SecretValue | undefined"],"sources":["../../src/internal/store-context.ts"],"sourcesContent":["/**\n * Shared helper that loads `graphorin.config`, parses it through\n * `parseServerConfig(...)`, opens the SQLite store, optionally resolves\n * the server pepper, and returns a disposable handle for any Phase 15\n * subcommand that needs a live storage / auth context.\n *\n * Centralising the resource lifecycle here means every command (token,\n * audit, secrets, memory, triggers, storage, …) acquires + releases\n * the same way; tests only stub the loader once.\n *\n * @internal\n */\n\nimport { resolveSecret, type SecretValue } from '@graphorin/security';\nimport { parseServerConfig, type ServerConfigSpec } from '@graphorin/server';\nimport {\n  type CreateSqliteStoreOptions,\n  createSqliteStore,\n  type GraphorinSqliteStore,\n  pendingMigrations,\n} from '@graphorin/store-sqlite';\n\nimport { loadConfig } from './load-config.js';\n\n/**\n * @internal\n */\nexport interface OpenStoreContextOptions {\n  /** Path to `graphorin.config.{ts,js,mjs,json}`. */\n  readonly config?: string;\n  /**\n   * When `true`, refuse to continue when `auth.pepperRef` cannot be\n   * resolved. Default `false` - callers that do not need the pepper\n   * (e.g. `graphorin audit verify`) skip resolution entirely.\n   */\n  readonly requirePepper?: boolean;\n  /**\n   * Override the store factory - tests inject a fake store so they\n   * can run subcommand integration without touching a real DB.\n   */\n  readonly storeFactory?: (options: CreateSqliteStoreOptions) => Promise<GraphorinSqliteStore>;\n  /**\n   * Skip migrations. Defaults to `false` so subcommands always operate\n   * against an initialized schema.\n   */\n  readonly skipInit?: boolean;\n  /**\n   * W-068: what to do about pending schema migrations.\n   *\n   * - `'apply'` (default, the historical behaviour): run `store.init()`,\n   *   which applies every pending migration.\n   * - `'check'`: do NOT migrate. Read-only commands use this so a newer\n   *   CLI never silently upgrades the schema of a database a running\n   *   (older) server owns; when the schema is behind, the command fails\n   *   with an actionable message instead.\n   *\n   * Ignored when `skipInit` is `true`.\n   */\n  readonly migrationPolicy?: 'apply' | 'check';\n}\n\n/**\n * @internal\n */\nexport interface StoreContext {\n  readonly configPath: string;\n  readonly config: ServerConfigSpec;\n  readonly store: GraphorinSqliteStore;\n  readonly pepper?: SecretValue;\n  /** Releases the underlying SQLite connection. */\n  close(): Promise<void>;\n}\n\n/**\n * Open the storage context for the provided config path. Throws on\n * Zod validation errors and on `requirePepper && !pepperRef`.\n *\n * @internal\n */\nexport async function openStoreContext(\n  options: OpenStoreContextOptions = {},\n): Promise<StoreContext> {\n  const loaded = await loadConfig(options.config);\n  const config = parseServerConfig(loaded.config);\n  const factory = options.storeFactory ?? createSqliteStore;\n  const storeOpts: CreateSqliteStoreOptions = {\n    path: config.storage.path,\n    mode: config.storage.mode,\n  };\n  // IP-1: the CLI honours the same encryption config as the server, so\n  // `graphorin` commands can open a database produced by\n  // `graphorin storage encrypt`.\n  if (config.storage.encryption.enabled) {\n    if (config.storage.encryption.passphraseRef === undefined) {\n      throw new Error(\n        '[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.',\n      );\n    }\n    const { resolveSecret } = await import('@graphorin/security/secrets');\n    const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);\n    (storeOpts as { encryption?: unknown }).encryption = {\n      enabled: true,\n      ...(config.storage.encryption.cipher !== undefined\n        ? { cipher: config.storage.encryption.cipher }\n        : {}),\n      passphraseResolver: async () => passphrase.use((v: string) => v),\n    };\n  }\n  const store = await factory(storeOpts);\n  if (options.skipInit !== true) {\n    if (options.migrationPolicy === 'check') {\n      // Read-only commands must not auto-migrate a live server's\n      // database (W-068). Compare the applied set against this build's\n      // bundle; refuse with a recipe when the schema is behind. The\n      // helper reads sqlite_master first, so a foreign database is not\n      // marked by creating schema_migrations.\n      let pendingCount = 0;\n      try {\n        pendingCount = pendingMigrations(store.connection).length;\n      } catch {\n        // A store without a raw connection (test fakes) has nothing to\n        // check - treat as up to date.\n        pendingCount = 0;\n      }\n      if (pendingCount > 0) {\n        await store.close();\n        throw new Error(\n          `[graphorin/cli] the database schema is ${pendingCount} migration(s) behind this CLI. ` +\n            'This is a read-only command and will not upgrade a live database. ' +\n            \"Run 'graphorin migrate' (with the server stopped) or use a CLI version matching the server.\",\n        );\n      }\n    } else {\n      await store.init();\n    }\n  }\n\n  let pepper: SecretValue | undefined;\n  if (options.requirePepper === true) {\n    if (config.auth.kind !== 'token' || config.auth.pepperRef === undefined) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`,\n      );\n    }\n    try {\n      pepper = await resolveSecret(config.auth.pepperRef);\n    } catch (err) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${(err as Error).message}`,\n        { cause: err },\n      );\n    }\n  }\n\n  const ctx: StoreContext = Object.freeze({\n    configPath: loaded.path,\n    config,\n    store,\n    ...(pepper !== undefined ? { pepper } : {}),\n    close: () => store.close(),\n  });\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA+EA,eAAsB,iBACpB,UAAmC,EAAE,EACd;CACvB,MAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;CAC/C,MAAM,SAAS,kBAAkB,OAAO,OAAO;CAC/C,MAAM,UAAU,QAAQ,gBAAgB;CACxC,MAAMA,YAAsC;EAC1C,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ;EACtB;AAID,KAAI,OAAO,QAAQ,WAAW,SAAS;AACrC,MAAI,OAAO,QAAQ,WAAW,kBAAkB,OAC9C,OAAM,IAAI,MACR,yFACD;EAEH,MAAM,EAAE,mCAAkB,MAAM,OAAO;EACvC,MAAM,aAAa,MAAMC,gBAAc,OAAO,QAAQ,WAAW,cAAc;AAC/E,EAAC,UAAuC,aAAa;GACnD,SAAS;GACT,GAAI,OAAO,QAAQ,WAAW,WAAW,SACrC,EAAE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,GAC5C,EAAE;GACN,oBAAoB,YAAY,WAAW,KAAK,MAAc,EAAE;GACjE;;CAEH,MAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,KAAI,QAAQ,aAAa,KACvB,KAAI,QAAQ,oBAAoB,SAAS;EAMvC,IAAI,eAAe;AACnB,MAAI;AACF,kBAAe,kBAAkB,MAAM,WAAW,CAAC;UAC7C;AAGN,kBAAe;;AAEjB,MAAI,eAAe,GAAG;AACpB,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,0CAA0C,aAAa,8LAGxD;;OAGH,OAAM,MAAM,MAAM;CAItB,IAAIC;AACJ,KAAI,QAAQ,kBAAkB,MAAM;AAClC,MAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,cAAc,QAAW;AACvE,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,iFAAiF,OAAO,KAAK,IAC9F;;AAEH,MAAI;AACF,YAAS,MAAM,cAAc,OAAO,KAAK,UAAU;WAC5C,KAAK;AACZ,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,qDAAqD,OAAO,KAAK,UAAU,KAAM,IAAc,WAC/F,EAAE,OAAO,KAAK,CACf;;;AAWL,QAP0B,OAAO,OAAO;EACtC,YAAY,OAAO;EACnB;EACA;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,aAAa,MAAM,OAAO;EAC3B,CAAC"}

package/dist/package.js

@@ -0,0 +1,6 @@
+//#region package.json
+var version = "0.7.0";
+
+//#endregion
+export { version };
+//# sourceMappingURL=package.js.map

package/dist/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","names":[],"sources":["../package.json"],"sourcesContent":["{\n  \"name\": \"@graphorin/cli\",\n  \"version\": \"0.7.0\",\n  \"description\": \"Operator CLI for the Graphorin framework. The `graphorin` binary covers the standalone server and the local stores end to end: `start`, `init`, `migrate`, `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `guard`, `telemetry`, `tools`, and `migrate-export`. Created and maintained by Oleksiy Stepurenko.\",\n  \"license\": \"MIT\",\n  \"author\": \"Oleksiy Stepurenko\",\n  \"homepage\": \"https://github.com/o-stepper/graphorin/tree/main/packages/cli\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/o-stepper/graphorin.git\",\n    \"directory\": \"packages/cli\"\n  },\n  \"bugs\": {\n    \"url\": \"https://github.com/o-stepper/graphorin/issues\"\n  },\n  \"keywords\": [\n    \"graphorin\",\n    \"ai\",\n    \"agents\",\n    \"framework\",\n    \"cli\",\n    \"graphorin-start\",\n    \"graphorin-init\",\n    \"graphorin-migrate\"\n  ],\n  \"type\": \"module\",\n  \"sideEffects\": [\n    \"./dist/bin/*\"\n  ],\n  \"engines\": {\n    \"node\": \">=22.12.0\"\n  },\n  \"main\": \"./dist/index.js\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"bin\": {\n    \"graphorin\": \"./dist/bin/graphorin.js\"\n  },\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"default\": \"./dist/index.js\"\n    },\n    \"./commands\": {\n      \"types\": \"./dist/commands/index.d.ts\",\n      \"default\": \"./dist/commands/index.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\",\n    \"src\",\n    \"README.md\",\n    \"CHANGELOG.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsdown\",\n    \"typecheck\": \"tsc --noEmit && tsc -p tsconfig.tests.json\",\n    \"test\": \"vitest run\",\n    \"lint\": \"biome check .\",\n    \"clean\": \"rimraf dist .turbo *.tsbuildinfo\"\n  },\n  \"dependencies\": {\n    \"@graphorin/core\": \"workspace:*\",\n    \"@graphorin/eslint-plugin\": \"workspace:*\",\n    \"@graphorin/memory\": \"workspace:*\",\n    \"@graphorin/pricing\": \"workspace:*\",\n    \"@graphorin/security\": \"workspace:*\",\n    \"@graphorin/server\": \"workspace:*\",\n    \"@graphorin/sessions\": \"workspace:*\",\n    \"@graphorin/skills\": \"workspace:*\",\n    \"@graphorin/store-sqlite\": \"workspace:*\",\n    \"commander\": \"^10.0.0\"\n  },\n  \"publishConfig\": {\n    \"access\": \"public\",\n    \"provenance\": true\n  },\n  \"devDependencies\": {\n    \"@graphorin/store-sqlite-encrypted\": \"workspace:*\"\n  }\n}\n"],"mappings":";cAEa"}