@happyvertical/smrt-cli 0.53.2 → 0.53.4

package/AGENTS.md

@@ -42,6 +42,7 @@ smrt config:export           # Export agent config for SSG
 smrt init                    # Init new project
 smrt gnode                   # Scaffold gnode site
 smrt dispatch:*              # Dispatch management (list/process/retry/cleanup)
+smrt app <op>                # App install/setup/start/migrate/worker…: agents/app-commands.md
 ```
 
 File-backed SQL/TypeScript migration generation is not supported. SMRT schema

package/README.md

@@ -242,6 +242,45 @@ consumer projects receive the CLI's published release line.
 | `smrt playground dev` | Run the shared workspace host or local app playground |
 | `smrt playground list` | Show discovered playground modules and preview entries |
 
+### Application operations (`smrt app`)
+
+Operational commands for a generated s-m-r-t application, run from the
+application root. They replace the template's copied `scripts/*.mjs`, so an
+app's `package.json` scripts are one-liners:
+
+```json
+{
+  "dev": "smrt app dev",
+  "build": "smrt app build",
+  "preview": "smrt app start",
+  "db:migrate": "vite build && smrt app migrate",
+  "app:setup": "smrt app setup",
+  "app:doctor": "smrt app doctor",
+  "worker": "smrt app worker task",
+  "worker:schedule": "smrt app worker schedule"
+}
+```
+
+| Command | Description |
+|---------|------------|
+| `smrt app install` | Local: setup, start, and open owner onboarding under one operation lock |
+| `smrt app setup` | Build, run `smrt db:migrate` explicitly, and prepare the private owner-onboarding handoff |
+| `smrt app recover` | Local: rotate the single-use owner onboarding invitation |
+| `smrt app start` / `stop` | Local: run the production build on loopback; readiness is proven by app id, process instance, and configuration fingerprint |
+| `smrt app doctor` | Secret-free findings (`invalid-runtime-profile`, `unsafe-local-bind`, `runtime-path-unavailable`, `migration-required`, …); exits 1 on any error (default operation) |
+| `smrt app open` | Open the app, or the pending onboarding launch file |
+| `smrt app backup [destination]` | Local: copy the validated data root to a new private directory outside the checkout |
+| `smrt app export [path]` / `import <path>` | Logical, asset-aware bundle; import requires an empty target (deployed: `SMRT_MAINTENANCE_MODE=true`) |
+| `smrt app migrate` | Establish local storage custody, then `smrt db:migrate`, under the operation lock |
+| `smrt app worker [task\|schedule]` | Deployed: imports `.smrt/runtime/register.js`, then runs the jobs runner until SIGTERM. The kind defaults to `task`; any other value is a usage error before anything starts |
+| `smrt app dev\|build\|vite [args]` | Run the app's installed Vite with `.env` loaded (shell wins); `build` validates `./mcp-apps` first |
+
+Success output is JSON on stdout; a failure is one JSON envelope on stderr with
+exit code 1 and never contains secret values. The same primitives (operation
+lock, writer lease, state root, artifact-path custody, portability) are
+importable without side effects from `@happyvertical/smrt-cli/app`. Contract
+details: [agents/app-commands.md](agents/app-commands.md).
+
 ### Auto-Generated Object Commands
 
 For each registered s-m-r-t object, the CLI generates:
@@ -345,4 +384,5 @@ If compiled classes cannot be loaded, the CLI falls back to manifest-only mode (
 
 - `@happyvertical/smrt-core` -- ORM, manifest, code generation
 - `@happyvertical/smrt-config` -- configuration loading
+- `@happyvertical/smrt-app-runtime` -- local storage custody and runtime composition for `smrt app`
 - `@happyvertical/smrt-scanner` -- AST scanning for metadata extraction

package/agents/app-commands.md

@@ -0,0 +1,93 @@
+# `smrt app` — application operator commands (#3371)
+
+`smrt app <operation>` is the CLI home of the operations a generated SMRT app
+used to ship as copied `scripts/*.mjs`. It is a port, not a redesign: state
+files, JSON output, exit codes, environment variables, and messages match the
+template's scripts so an app's `package.json` scripts become one-liners.
+
+| Template script | Command |
+|---|---|
+| `scripts/smrt-app.mjs <op>` | `smrt app install\|setup\|recover\|start\|stop\|doctor\|open\|backup\|export\|import` |
+| `scripts/smrt-prepare-migration.mjs` | `smrt app migrate` |
+| `scripts/smrt-worker.mjs [task\|schedule]` | `smrt app worker [task\|schedule]` |
+| `node --env-file-if-exists=.env scripts/smrt-vite.mjs <args>` | `smrt app vite <args>` (`smrt app dev …` = `vite dev …`) |
+| `smrt-mcp-apps.mjs validate-if-present && …smrt-vite.mjs build` | `smrt app build [vite args]` |
+| `scripts/smrt-web.mjs` | `bin/smrt-web.mjs` (spawned by `start`) |
+| helper modules | `@happyvertical/smrt-cli/app` (side-effect-free subpath) |
+
+## Source
+
+`src/app/`: `cli.ts` (dispatch, help, error envelope), `operations.ts`,
+`launchers.ts` (migrate/worker/vite), `identity.ts` (artifact-path custody;
+re-exports identity and state root), `process-record.ts`, `portability.ts`,
+`portability-assets.ts`, `runtime.ts` (context, runners, profile-aware child
+environment). Application ID, configuration fingerprint, state root,
+operation lock, writer lease, stale reclaim, and provider readiness are
+`@happyvertical/smrt-app-runtime`'s (the web process takes the same lease
+without depending on the CLI); `./app` re-exports them unchanged. `main()` dispatches `app` before manifest or
+config loading; `bin/smrt.js` imports `dist/` in-process so SIGTERM reaches
+`smrt app worker`.
+
+## Contracts that must not drift
+
+- **State root** `<XDG_STATE_HOME|~/.local/state|~/Library/Application Support|%LOCALAPPDATA%>/.<appId>-<sha256(dataRoot)[:12]>-state`,
+  mode 0700, every ancestor user/root-owned and not group/world-writable,
+  app-bound empty 0600 marker `.smrt-state-<appId>`. Shared with the running
+  web server (`writer.lease`), so record formats are byte-compatible.
+- **Locks**: `operation.lock` (one operator op; dead owner reclaimed;
+  unparsable fails closed; never unlinks a replaced lock) and `writer.lease`
+  (one writer; a live op blocks a writer unless it presents that op's
+  `instance`, which `start` passes as `SMRT_OPERATION_INSTANCE`). Stale
+  records are removed only under an exclusive SQLite transaction on
+  `<state>/.smrt-lock-reclaim.sqlite` (kernel lock, released on death), after
+  re-reading that the file still holds the exact dead record
+  (app-runtime `stale-reclaim.ts`); a contender waits up to 2 s, then fails. Acquisition
+  is still a plain `O_EXCL` create, so formats are unchanged.
+- **Storage custody** belongs to `@happyvertical/smrt-app-runtime`: `setup`
+  goes through `initializeLocalApplicationRuntime` with an explicit
+  `prepareDatabase` that runs `smrt db:migrate`; `migrate` calls
+  `prepareLocalDatabaseStorage`; `doctor`/`backup`/`export`/`import` call
+  `validateLocalDatabaseStorage`, which never creates or repairs storage.
+- **No runtime schema**: migrations run only through `smrt db:migrate`.
+- **Output**: success JSON on stdout; failure is one stderr line
+  `{schemaVersion:1,status:'error',code:'operation-failed',message,recovery,secretValuesIncluded:false}`
+  plus `runtimeCode` when a `LocalRuntimeError` carries one
+  (`migration_failed` + `MIGRATION_FAILED_MESSAGE`). Messages pass through
+  `redactSecrets()` (secret-named env values, URL userinfo, `token=`, Bearer).
+  The bootstrap token is written only to mode-0600 `onboarding.json` /
+  `onboarding-launch.html`; `open` passes the launch file URL, never the token.
+- **Artifacts**: backup/export/import paths go through
+  `assertExternalArtifactPath` (real path of nearest existing ancestor, never
+  in or over the checkout). Backup refuses an existing destination; export
+  publishes via `link()` (never replaces); import requires a 0600 regular
+  bundle for the same app, an exactly matching manifest schema, and an empty
+  target; deployed import requires `SMRT_MAINTENANCE_MODE=true`.
+- **Process identity**: `app.pid` is trusted only when the live command
+  line's last two tokens are a path with basename `smrt-web.mjs` and exactly
+  `--smrt-instance=<record instance>` (an app started by the template's former
+  `scripts/smrt-web.mjs` still matches); `stop` re-reads it immediately before SIGTERM
+  (`checkOwnedProcess`: only `gone`/`mismatched` drop `app.pid`; an
+  `unverifiable` query keeps it, sends nothing, and fails naming the pid). A `start`
+  whose launcher never proves readiness is sent SIGTERM, then SIGKILL; only a
+  confirmed exit removes `app.pid`, otherwise the record stays and the error
+  names the pid.
+- **Application resolution**: Vite and bare readiness-module specifiers
+  resolve from the app's own `node_modules` chain (never `NODE_PATH`).
+  Readiness specifiers go through Node's own ESM resolver re-parented to the
+  app root (a temporary `module.registerHooks` resolve hook, because the
+  `import.meta.resolve` parent argument is still flagged), so `exports`
+  precedence, condition order, `null` targets, and invalid targets follow
+  Node exactly; the result must stay inside the installed package. Relative
+  readiness specifiers resolve against the app root.
+- **Import recovery**: after the database commit the asset journal gains an
+  additive `committedAt`. A leftover journal with matching table counts is
+  accepted as complete only with that marker for the same bundle digest, or
+  when every table's rows equal the bundle's; otherwise recovery refuses
+  (`asset-recovery-target-mismatch`) and keeps the journal.
+- `scripts/smrt-portability.mjs`, when an app provides it, still overrides
+  the built-in export/import adapter (the documented extension point).
+
+Tests: `src/app/__tests__/` (primitives, operations in-process, real CLI
+process, and the template's portability-asset suite ported verbatim); lock,
+lease, state-custody, and readiness cases (including review findings R1, R3,
+T2) live in app-runtime's `src/operator-primitives.test.ts`.

package/bin/smrt-web.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// Web launcher spawned by `smrt app start` (cwd = application root).
+//
+// The file name and the `--smrt-instance=<32 hex>` argument are the process
+// identity `smrt app stop` verifies before signalling a recorded pid, so a
+// recycled pid is never terminated. Ported from the template's
+// `scripts/smrt-web.mjs`.
+
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const instance = process.argv
+  .find((value) => value.startsWith('--smrt-instance='))
+  ?.slice('--smrt-instance='.length);
+if (!instance || !/^[a-f0-9]{32}$/.test(instance)) {
+  throw new Error('A valid application process identity is required.');
+}
+
+await import(pathToFileURL(resolve(process.cwd(), 'build', 'index.js')).href);

package/bin/smrt.js

@@ -3,24 +3,30 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const distEntry = resolve(packageRoot, 'dist/index.js');
 const sourceEntry = resolve(packageRoot, 'src/index.ts');
 
-const command = existsSync(distEntry)
-  ? [distEntry, ...process.argv.slice(2)]
-  : ['--import', 'tsx', sourceEntry, ...process.argv.slice(2)];
+if (existsSync(distEntry)) {
+  // Run the built CLI in this process so signals reach long-running commands
+  // (a container's SIGTERM to `smrt app worker`), and exit codes are its own.
+  await import(pathToFileURL(distEntry).href);
+} else {
+  const result = spawnSync(
+    process.execPath,
+    ['--import', 'tsx', sourceEntry, ...process.argv.slice(2)],
+    { stdio: 'inherit' },
+  );
 
-const result = spawnSync(process.execPath, command, { stdio: 'inherit' });
+  if (result.error) {
+    throw result.error;
+  }
 
-if (result.error) {
-  throw result.error;
-}
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+  }
 
-if (result.signal) {
-  process.kill(process.pid, result.signal);
+  process.exit(result.status ?? 1);
 }
-
-process.exit(result.status ?? 1);

package/dist/{ApiKey-BZmbOTnL-nvcrCRDQ.js → ApiKey-BZmbOTnL-DPPF6Swn.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-BYlxfKXV.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-D60BSg6H.js";
 import { SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { createHash, randomBytes } from "node:crypto";
 //#region ../profiles/dist/chunks/ApiKey-BZmbOTnL.js
@@ -127,7 +127,7 @@ var ApiKey = class extends SmrtObject {
 	*/
 	static async verify(key, options = {}) {
 		const keyHash = ApiKey.hashKey(key);
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-CZVWaFPV.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-B1-2YKj8.js").then((n) => n.n);
 		const apiKey = await (await ApiKeyCollection.create(options)).findOne({ where: { keyHash } });
 		if (!apiKey) return null;
 		if (!apiKey.isValid()) return null;

package/dist/ApiKeyCollection-Bfb_nw81-B1-2YKj8.js

@@ -0,0 +1,2 @@
+import { L as ApiKeyCollection_exports } from "./dist-C2BqYVu7.js";
+export { ApiKeyCollection_exports as n };

package/dist/AuditLogCollection-B1YonCAP-DP4PCCw-.js

@@ -0,0 +1,2 @@
+import { F as AuditLogCollection_exports } from "./dist-C2BqYVu7.js";
+export { AuditLogCollection_exports as n };

package/dist/{NostrIdentity-n70E0vck-BYlxfKXV.js → NostrIdentity-n70E0vck-D60BSg6H.js}

@@ -4097,21 +4097,21 @@ var NostrIdentity = class extends SmrtObject {
 	* Find identity by public key
 	*/
 	static async findByPubkey(pubkey, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C1Q9BNQc.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { pubkey } });
 	}
 	/**
 	* Find identity by email
 	*/
 	static async findByEmail(email, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C1Q9BNQc.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { email: email.toLowerCase() } });
 	}
 	/**
 	* Find identity by NIP-05 username
 	*/
 	static async findByNip05(username, options = {}) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C1Q9BNQc.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(options)).findOne({ where: { nip05Username: username.toLowerCase() } });
 	}
 	/**

package/dist/NostrIdentityCollection-Ca74dkaL-C-v57o9N.js

@@ -0,0 +1,2 @@
+import { M as NostrIdentityCollection_exports } from "./dist-C2BqYVu7.js";
+export { NostrIdentityCollection_exports as n };

package/dist/{OidcIdentity-Cb1bxreM-DDXZ2ULx.js → OidcIdentity-Cb1bxreM-B2eV2ahq.js}

@@ -35,7 +35,7 @@ var OidcIdentity = class extends SmrtObject {
 	* Find identity by issuer and subject
 	*/
 	static async findBySubject(issuer, subject, options = {}) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-RZ2ocmoN.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-BodvOtPJ.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(options)).findBySubject(issuer, subject);
 	}
 	/** Build the collision-free natural key for one OIDC issuer subject. */
@@ -58,7 +58,7 @@ var OidcIdentity = class extends SmrtObject {
 	static async findOrCreate(profile, oidcData, options = {}) {
 		const profileId = profile.id;
 		if (typeof profileId !== "string" || !profileId) throw new Error("OidcIdentity.findOrCreate() requires a saved Profile.");
-		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-B-PK6RwU-CkUCBn4e.js").then((n) => n.i);
+		const { reuseExistingOidcIdentityForProfile } = await import("./resolveIdentity-B-PK6RwU-BmAU1Kse.js").then((n) => n.i);
 		const profileOptions = profile.options ?? {};
 		return (await reuseExistingOidcIdentityForProfile(profileId, {
 			email: oidcData.email,

package/dist/OidcIdentityCollection-TV8VdK69-BodvOtPJ.js

@@ -0,0 +1,2 @@
+import { A as OidcIdentityCollection_exports } from "./dist-C2BqYVu7.js";
+export { OidcIdentityCollection_exports as r };

package/dist/ProfileAssetCollection-B9hacUJa-B7PLe0ld.js

@@ -0,0 +1,2 @@
+import { D as ProfileAssetCollection_exports } from "./dist-C2BqYVu7.js";
+export { ProfileAssetCollection_exports as n };

package/dist/{ProfileCollection-DuJT7Mum-CEPfbh20.js → ProfileCollection-DuJT7Mum-B3Uhqphs.js}

@@ -1,7 +1,7 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { a as queryGlobal, i as tenantId, l as withSystemContext, n as resolvePrompt, o as queryWithGlobals, r as TenantScoped, s as getTenantId, t as definePrompt } from "./dist-BGsb09DN.js";
-import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-BYlxfKXV.js";
-import { a as getOwnedAssetsFromCollection, i as assertValidOwnedAssetSortOrder, n as assertAssetLinkable, o as removeOwnedAssetFromCollection, r as assertValidOwnedAssetRelationship, s as resolveOwnedAssetsById, t as addOwnedAssetFromCollection } from "./dist-BCAkEXaz.js";
+import { a as queryGlobal, i as tenantId, l as withSystemContext, n as resolvePrompt, o as queryWithGlobals, r as TenantScoped, s as getTenantId, t as definePrompt } from "./dist-EJ63xUEp.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-D60BSg6H.js";
+import { a as getOwnedAssetsFromCollection, i as assertValidOwnedAssetSortOrder, n as assertAssetLinkable, o as removeOwnedAssetFromCollection, r as assertValidOwnedAssetRelationship, s as resolveOwnedAssetsById, t as addOwnedAssetFromCollection } from "./dist-D4BNILLN.js";
 import { RuntimeError, SmrtCollection, SmrtObject, ValidationError, field, foreignKey, isAbortedTransactionError, oneToMany, smrt } from "@happyvertical/smrt-core";
 import { BackfillTableUnavailableError, BackfillTracker } from "@happyvertical/smrt-core/migrations";
 //#region ../profiles/dist/chunks/ProfileCollection-DuJT7Mum.js
@@ -430,8 +430,8 @@ var Profile = class extends SmrtObject {
 	* @param value - The value to set
 	*/
 	async addMetadata(metafieldSlug, value) {
-		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CoBuM_5G-DiMAQiDg.js").then((n) => n.n);
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Dog-9nKM.js").then((n) => n.n);
+		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CoBuM_5G-D-VqQuY1.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Bzv-E4ep.js").then((n) => n.n);
 		const metafield = await this.resolveMetafield(await ProfileMetafieldCollection.create(this.options), metafieldSlug);
 		if (!metafield) throw new Error(`Metafield '${metafieldSlug}' not found`);
 		await metafield.validateValue(value);
@@ -464,7 +464,7 @@ var Profile = class extends SmrtObject {
 	* @returns Object with metafield slugs as keys
 	*/
 	async getMetadata() {
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Dog-9nKM.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Bzv-E4ep.js").then((n) => n.n);
 		return await (await ProfileMetadataCollection.create(this.options)).getMetadataObject(this.id);
 	}
 	/**
@@ -481,8 +481,8 @@ var Profile = class extends SmrtObject {
 	* @param metafieldSlug - The slug of the metafield to remove
 	*/
 	async removeMetadata(metafieldSlug) {
-		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CoBuM_5G-DiMAQiDg.js").then((n) => n.n);
-		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Dog-9nKM.js").then((n) => n.n);
+		const { ProfileMetafieldCollection } = await import("./ProfileMetafieldCollection-CoBuM_5G-D-VqQuY1.js").then((n) => n.n);
+		const { ProfileMetadataCollection } = await import("./ProfileMetadataCollection-DQhbfEfa-Bzv-E4ep.js").then((n) => n.n);
 		const metafield = await this.resolveMetafield(await ProfileMetafieldCollection.create(this.options), metafieldSlug);
 		if (!metafield) throw new Error(`Metafield '${metafieldSlug}' not found`);
 		const existing = await (await ProfileMetadataCollection.create(this.options)).list({
@@ -507,7 +507,7 @@ var Profile = class extends SmrtObject {
 		return candidates.find((candidate) => ownerTenantId && candidate.tenantId === ownerTenantId) ?? candidates.find((candidate) => !candidate.tenantId) ?? null;
 	}
 	async getProfileLinkCollection() {
-		const { ProfileLinkCollection } = await import("./ProfileLinkCollection-4uNURz32-GWzU0-kb.js").then((n) => n.r);
+		const { ProfileLinkCollection } = await import("./ProfileLinkCollection-4uNURz32-CLY1cBnn.js").then((n) => n.r);
 		return ProfileLinkCollection.create({ db: this.db });
 	}
 	/** This profile's web links in display order. */
@@ -524,7 +524,7 @@ var Profile = class extends SmrtObject {
 		return (await this.getProfileLinkCollection()).replaceForProfile(this.id, links);
 	}
 	async getProfileAssetCollection() {
-		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-B9hacUJa-C1qMe0_q.js").then((n) => n.n);
+		const { ProfileAssetCollection } = await import("./ProfileAssetCollection-B9hacUJa-B7PLe0ld.js").then((n) => n.n);
 		return ProfileAssetCollection.create({ db: this.db });
 	}
 	async getAssets(relationship) {
@@ -555,9 +555,9 @@ var Profile = class extends SmrtObject {
 	* @param contextProfile - Optional context profile for tertiary relationships
 	*/
 	async addRelationship(toProfile, relationshipSlug, contextProfile) {
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-DEnQtZuK.js").then((n) => n.n);
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-CUh6lQdy.js").then((n) => n.n);
-		const { ProfileRelationshipType } = await import("./ProfileRelationshipType-BRiRka6t-C0Sh1CTk.js").then((n) => n.n).then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-CaQMLH9f.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-gEkDBmkh.js").then((n) => n.n);
+		const { ProfileRelationshipType } = await import("./ProfileRelationshipType-BRiRka6t-Ci-qvFhm.js").then((n) => n.n).then((n) => n.n);
 		const relationshipType = await (await ProfileRelationshipTypeCollection.create(this.options)).getBySlug(relationshipSlug);
 		if (!relationshipType) throw new Error(`Relationship type '${relationshipSlug}' not found`);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
@@ -581,8 +581,8 @@ var Profile = class extends SmrtObject {
 	* @returns Array of ProfileRelationship instances
 	*/
 	async getRelationships(options) {
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-CUh6lQdy.js").then((n) => n.n);
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-DEnQtZuK.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-gEkDBmkh.js").then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-CaQMLH9f.js").then((n) => n.n);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
 		const direction = options?.direction || "all";
 		let typeId;
@@ -625,8 +625,8 @@ var Profile = class extends SmrtObject {
 	* @param relationshipSlug - The type of relationship to remove
 	*/
 	async removeRelationship(toProfile, relationshipSlug) {
-		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-DEnQtZuK.js").then((n) => n.n);
-		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-CUh6lQdy.js").then((n) => n.n);
+		const { ProfileRelationshipTypeCollection } = await import("./ProfileRelationshipTypeCollection-BdXwd7Kf-CaQMLH9f.js").then((n) => n.n);
+		const { ProfileRelationshipCollection } = await import("./ProfileRelationshipCollection-DUVgaIqf-gEkDBmkh.js").then((n) => n.n);
 		const relationshipType = await (await ProfileRelationshipTypeCollection.create(this.options)).getBySlug(relationshipSlug);
 		if (!relationshipType) throw new Error(`Relationship type '${relationshipSlug}' not found`);
 		const relationshipCollection = await ProfileRelationshipCollection.create(this.options);
@@ -719,7 +719,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of API keys
 	*/
 	async getApiKeys() {
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-CZVWaFPV.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-B1-2YKj8.js").then((n) => n.n);
 		return await (await ApiKeyCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -728,7 +728,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of active API keys
 	*/
 	async getActiveApiKeys() {
-		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-CZVWaFPV.js").then((n) => n.n);
+		const { ApiKeyCollection } = await import("./ApiKeyCollection-Bfb_nw81-B1-2YKj8.js").then((n) => n.n);
 		return await (await ApiKeyCollection.create(this.options)).findActiveByProfile(this.id);
 	}
 	/**
@@ -738,7 +738,7 @@ var Profile = class extends SmrtObject {
 	* @returns The generated key (plaintext) and ApiKey record
 	*/
 	async generateApiKey(options) {
-		const { ApiKey } = await import("./ApiKey-BZmbOTnL-nvcrCRDQ.js").then((n) => n.n).then((n) => n.n);
+		const { ApiKey } = await import("./ApiKey-BZmbOTnL-DPPF6Swn.js").then((n) => n.n).then((n) => n.n);
 		return await ApiKey.generate(this, {
 			...options,
 			db: this.options?.db
@@ -750,7 +750,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of OIDC identity records
 	*/
 	async getOidcIdentities() {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-RZ2ocmoN.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-BodvOtPJ.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -763,7 +763,7 @@ var Profile = class extends SmrtObject {
 	* type, but refuses to create or rebind authority.
 	*/
 	async linkOidcIdentity(oidcData) {
-		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-RZ2ocmoN.js").then((n) => n.r);
+		const { OidcIdentityCollection } = await import("./OidcIdentityCollection-TV8VdK69-BodvOtPJ.js").then((n) => n.r);
 		return await (await OidcIdentityCollection.create(this.options)).linkToProfile(this, oidcData);
 	}
 	/**
@@ -772,7 +772,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of Nostr identity records
 	*/
 	async getNostrIdentities() {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C1Q9BNQc.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(this.options)).findByProfile(this.id);
 	}
 	/**
@@ -782,7 +782,7 @@ var Profile = class extends SmrtObject {
 	* @returns The linked Nostr identity record
 	*/
 	async linkNostrIdentity(nostrData) {
-		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C1Q9BNQc.js").then((n) => n.n);
+		const { NostrIdentityCollection } = await import("./NostrIdentityCollection-Ca74dkaL-C-v57o9N.js").then((n) => n.n);
 		return await (await NostrIdentityCollection.create(this.options)).linkToProfile(this, nostrData);
 	}
 	/**
@@ -792,7 +792,7 @@ var Profile = class extends SmrtObject {
 	* @returns Array of audit log entries
 	*/
 	async getAuditLogs(limit = 50) {
-		const { AuditLogCollection } = await import("./AuditLogCollection-B1YonCAP-CnMHEquA.js").then((n) => n.n);
+		const { AuditLogCollection } = await import("./AuditLogCollection-B1YonCAP-DP4PCCw-.js").then((n) => n.n);
 		return await (await AuditLogCollection.create(this.options)).getRecentActivity(this.id, limit);
 	}
 	/**
@@ -802,7 +802,7 @@ var Profile = class extends SmrtObject {
 	* @returns The created audit log entry
 	*/
 	async recordAction(options) {
-		const { AuditLogCollection } = await import("./AuditLogCollection-B1YonCAP-CnMHEquA.js").then((n) => n.n);
+		const { AuditLogCollection } = await import("./AuditLogCollection-B1YonCAP-DP4PCCw-.js").then((n) => n.n);
 		return await (await AuditLogCollection.create(this.options)).record({
 			profile: this,
 			...options

package/dist/ProfileLinkCollection-4uNURz32-CLY1cBnn.js

@@ -0,0 +1,2 @@
+import { S as ProfileLinkCollection_exports } from "./dist-C2BqYVu7.js";
+export { ProfileLinkCollection_exports as r };

package/dist/ProfileMetadataCollection-DQhbfEfa-Bzv-E4ep.js

@@ -0,0 +1,2 @@
+import { v as ProfileMetadataCollection_exports } from "./dist-C2BqYVu7.js";
+export { ProfileMetadataCollection_exports as n };

package/dist/{ProfileMetafieldCollection-CoBuM_5G-DiMAQiDg.js → ProfileMetafieldCollection-CoBuM_5G-D-VqQuY1.js}

@@ -1,2 +1,2 @@
-import { h as ProfileMetafieldCollection_exports } from "./dist-vvYmwpFv.js";
+import { h as ProfileMetafieldCollection_exports } from "./dist-C2BqYVu7.js";
 export { ProfileMetafieldCollection_exports as n };

package/dist/{ProfileRelationshipCollection-DUVgaIqf-CUh6lQdy.js → ProfileRelationshipCollection-DUVgaIqf-gEkDBmkh.js}

@@ -1,2 +1,2 @@
-import { f as ProfileRelationshipCollection_exports } from "./dist-vvYmwpFv.js";
+import { f as ProfileRelationshipCollection_exports } from "./dist-C2BqYVu7.js";
 export { ProfileRelationshipCollection_exports as n };

package/dist/{ProfileRelationshipTermCollection-DtA9OM23-Sn18A9Vz.js → ProfileRelationshipTermCollection-DtA9OM23-DI_awdol.js}

@@ -1,2 +1,2 @@
-import { l as ProfileRelationshipTermCollection_exports } from "./dist-vvYmwpFv.js";
+import { l as ProfileRelationshipTermCollection_exports } from "./dist-C2BqYVu7.js";
 export { ProfileRelationshipTermCollection_exports as n };

package/dist/{ProfileRelationshipType-BRiRka6t-C0Sh1CTk.js → ProfileRelationshipType-BRiRka6t-Ci-qvFhm.js}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-BYlxfKXV.js";
+import { n as __exportAll$1 } from "./NostrIdentity-n70E0vck-D60BSg6H.js";
 import { SmrtObject, field, smrt } from "@happyvertical/smrt-core";
 //#region ../profiles/dist/chunks/ProfileRelationshipType-BRiRka6t.js
 var ProfileRelationshipType_BRiRka6t_exports = /* @__PURE__ */ __exportAll({

package/dist/{ProfileRelationshipTypeCollection-BdXwd7Kf-DEnQtZuK.js → ProfileRelationshipTypeCollection-BdXwd7Kf-CaQMLH9f.js}

@@ -1,2 +1,2 @@
-import { o as ProfileRelationshipTypeCollection_exports } from "./dist-vvYmwpFv.js";
+import { o as ProfileRelationshipTypeCollection_exports } from "./dist-C2BqYVu7.js";
 export { ProfileRelationshipTypeCollection_exports as n };

package/dist/app/cli.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `smrt app <operation>` dispatcher.
+ *
+ * Every operation writes machine-readable JSON to stdout and, on failure,
+ * one secret-free JSON envelope to stderr with exit code 1 — the contract
+ * the template's `scripts/smrt-app.mjs` established.
+ */
+import { type AppCommandDependencies, type AppCommandIo } from './runtime.js';
+/** Recovery line carried by every error envelope. */
+export declare const APP_RECOVERY = "Run pnpm app:doctor and follow its recovery instructions.";
+/** Every `smrt app` command with a one-line description (for help output). */
+export declare const APP_COMMANDS: Readonly<Record<string, string>>;
+/** Options for {@link runAppCommand}. */
+export interface RunAppCommandOptions {
+    /** Application root. Defaults to `process.cwd()`. */
+    cwd?: string;
+    /** Output sinks. Defaults to the process streams. */
+    io?: Partial<AppCommandIo>;
+    /** Collaborator overrides (tests, embedding). */
+    dependencies?: Partial<AppCommandDependencies>;
+}
+/** Secret-free failure envelope written to stderr. */
+export interface AppErrorEnvelope {
+    schemaVersion: 1;
+    status: 'error';
+    code: 'operation-failed';
+    /** Stable runtime code when the failure carries one (e.g. `migration_failed`). */
+    runtimeCode?: string;
+    message: string;
+    recovery: string;
+    secretValuesIncluded: false;
+}
+/** Build the stderr envelope for `error`, redacting secret material. */
+export declare function errorEnvelope(error: unknown): AppErrorEnvelope;
+/** Render `smrt app` usage. */
+export declare function renderAppHelp(): string;
+/**
+ * Run `smrt app <argv…>` and resolve to the process exit code.
+ *
+ * `argv` is everything after `app`. A leading `--` before operation
+ * arguments is ignored, matching `pnpm app:import -- <path>`.
+ */
+export declare function runAppCommand(argv: string[], options?: RunAppCommandOptions): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/app/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/app/cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAeH,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAKlB,MAAM,cAAc,CAAC;AAEtB,qDAAqD;AACrD,eAAO,MAAM,YAAY,8DACoC,CAAC;AAE9D,8EAA8E;AAC9E,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBxD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,EAAE,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3B,iDAAiD;IACjD,YAAY,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAChD;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,kBAAkB,CAAC;IACzB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,KAAK,CAAC;CAC7B;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAkB9D;AAED,+BAA+B;AAC/B,wBAAgB,aAAa,IAAI,MAAM,CAMtC;AAUD;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAuDjB"}

package/dist/app/errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared error helpers for the `smrt app` command group.
+ */
+/** Read a Node `code` from an unknown thrown value. */
+export declare function errorCode(error: unknown): string | undefined;
+/** Error carrying a process exit code from a failed child command. */
+export declare class AppCommandError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Remove secret material from an operator-facing message.
+ *
+ * Errors raised by drivers, config loaders, and providers routinely echo a
+ * connection string, credential, or bootstrap token. Redaction covers:
+ * literal values of secret-named environment variables, URL userinfo,
+ * `token=`/`password=`/`secret=` query values, and bearer tokens.
+ */
+export declare function redactSecrets(message: string, environment?: Record<string, string | undefined>): string;
+//# sourceMappingURL=errors.d.ts.map

package/dist/app/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/app/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,uDAAuD;AACvD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAO5D;AAED,sEAAsE;AACtE,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAYzE;AASD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,MAAM,CAwBR"}

package/dist/app/identity.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Application identity, private state root, and operator-artifact path
+ * custody for the `smrt app` command group.
+ *
+ * Identity, configuration fingerprint, and the private state root are
+ * `@happyvertical/smrt-app-runtime`'s single implementation (re-exported
+ * here), so the running web process and these commands can never derive
+ * different identities or lock domains. Operator-artifact path custody is
+ * CLI-only and stays here.
+ */
+export { type ApplicationStateRootOptions, type FingerprintRuntime, prepareApplicationStateRoot, type ResolveApplicationIdOptions, resolveApplicationId, resolveApplicationStateRoot, runtimeConfigurationFingerprint, type StateCustodyOptions, } from '@happyvertical/smrt-app-runtime';
+/** Inputs for {@link assertExternalArtifactPath}. */
+export interface ExternalArtifactPathOptions {
+    sourceRoot: string;
+    path: string;
+    /** Message label, e.g. `Backup destination`. Defaults to `Artifact`. */
+    label?: string;
+}
+/**
+ * Resolve an operator-selected artifact through its nearest existing ancestor
+ * and reject paths that could place application data in or over the checkout.
+ */
+export declare function assertExternalArtifactPath(options: ExternalArtifactPathOptions): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/app/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/app/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,2BAA2B,EAC3B,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,iCAAiC,CAAC;AAWzC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,MAAM,CAuBR"}