@open-mercato/cli 0.6.8-develop.7101.1.bd9356828a → 0.7.1-develop.7102.1.b41f7e3e51

package/dist/agentic/shared/ai/skills/om-auto-upgrade-0.6.7-to-0.7.0/SKILL.md

@@ -24,10 +24,16 @@ Reject unknown flags and combining `--only` with `--skip`.
 
 | ID | Classification | Detect | Action |
 | --- | --- | --- | --- |
+| `passkey-mfa-assertion` | Detect and report | Callers that post `{ credentialId, challenge }`, or a bare credential id, to `POST /api/security/mfa/verify` or `POST /api/security/sudo/verify`, and custom passkey enrollment paths | Report the removed payload shape and require the object returned by `startAuthentication()` as `payload.response`; carry the operator actions for credentials enrolled through the still-open attestation shortcut (#5296) and never delete or reset MFA rows automatically |
+| `jwt-secret-required` | Detect and report | `${JWT_SECRET:-…}` defaults in compose files, `JWT_SECRET` or `JWT_<AUDIENCE>_SECRET` values that are absent, shorter than 32 characters, or a published placeholder, and `JWT_LEGACY_GRACE_MINUTES` set without `JWT_LEGACY_CUTOVER_AT` | Report the required operator steps before the production rollout, including the legacy-token cutover decision; never generate, print, or write a secret value into a repository file |
+| `standalone-ds-i18n-gates` | Detect and report | Standalone apps missing `scripts/ds-check.mjs`, `scripts/i18n-check-hardcoded.mjs`, the matching `package.json` scripts, the `typecheck` memory headroom, or `yarn ds:check` in `.ai/agentic.config.json` `validation.commands` | Report the copy-and-register steps against the current template and the reasoned `.ds-check-ignore` baseline; keep `yarn i18n:check-hardcoded` advisory and never add a hard-failing gate to a user's config unprompted |
+| `module-fact-sheet-directories` | Automatic when exact; otherwise report | Literal `.ai/guides/modules/<id>.md` or `.ai/guides/reference-modules/<id>.md` reads in harness scripts, skills, or docs | Rewrite only an exact flat-sheet path to the `<id>/index.md` form; report globs, manifest-driven readers, and any consumer that enumerated the flat layout |
 | `user-confirmation-semantics` | Detect and report | User creation, setup, or update code that writes `isConfirmed: false` | Report each write whose users are still expected to authenticate; do not invent a replacement field |
 | `audit-log-context-shape` | Detect and report | Command interceptors returning `metadata.context`, and consumers that assume keys are absent from `ActionLog.context_json` | Explain the new `metadata.logContext` input and shallow-merge precedence; do not rewrite ownership-sensitive logging code |
 | `global-search-acl` | Detect and report | Clients of `/api/search/search/global` authorized only by `search.view`, custom `search.ts` entities without `aclFeatures`, and custom-entity search consumers | Report the required `search.global` grant and per-entity view features; include the post-upgrade role-ACL sync command as manual work |
+| `hybrid-search-acl` | Detect and report | Callers of `GET /api/search/search` authorized only by `search.view`, and custom `search.ts` entities that declare no `aclFeatures` | Report the per-entity view features those callers now need and the fail-closed behaviour for entity types without `aclFeatures`; point at `OM_SEARCH_DEBUG=true` for the dropped-type diagnosis and never widen a role's grants automatically |
 | `preset-search-module` | No code action | Existing `crm` or `empty` apps whose module registry omits `search` | Explain that only new scaffolds changed and show the optional module registration for apps that want Cmd+K search |
+| `data-sync-batch-traces` | Detect and report | Adapter `streamImport`/`streamExport` implementations that return a synchronous iterable of promises, hand-rolled per-batch spans, and saved traces or dashboards that assumed sync work nested under the triggering request | Report the enforced genuine `AsyncIterable` contract, the now-redundant adapter span, and the new `data_sync.*.batch` root traces reached through a span link; never rewrite an adapter's iteration protocol automatically |
 | `tanstack-table-v9` | Automatic when exact; otherwise report | Root imports of `ColumnDef`, `useReactTable`, row-model factories, renamed state/function types, and Jest transform allowlists | Rewrite only an exact single-specifier type import of `ColumnDef` to `LegacyColumnDef as ColumnDef` from `@tanstack/react-table/legacy`; report combined imports, hooks, generics, renamed types, and Jest config for review |
 | `ioredis-resp2` | Detect and report | Direct `ioredis` construction that does not use shared connection helpers or `REDIS_WIRE_PROTOCOL` | Report the client and require an explicit RESP2 decision; never inject connection options blindly |
 | `sales-line-default-order` | No code action | Consumers of order-line or quote-line list endpoints that pass no explicit sort | Explain the new `line_number ASC, id ASC` default, cache-TTL caveat, and `?sortField=id` compatibility choice |
@@ -38,6 +44,7 @@ Reject unknown flags and combining `--only` with `--skip`.
 | `settings-section-group-id` | Automatic when exact; otherwise report | Injected `groupId` values and `buildSettingsSections` order maps keyed by rendered-label slugs | Replace only the exact `groupId: 'module-configs'` or double-quoted equivalent with `settings.sections.moduleConfigs`, preserving quote style; report every other slug and `sectionOrder` key |
 | `webhook-body-limits` | No code action | Public webhook deployments and custom payment handler registrations | Report the 1 MiB global ceiling, the InboxOps override, proxy-limit alignment, and provider verification required before opting payment handlers into `maxBodyBytes` |
 | `standalone-security-headers` | Detect and report | Standalone `next.config.*` files missing the current CSP and attachment sandbox headers | Point to the latest template and require a manual merge that preserves provider origins and the attachment sandbox; never replace a whole Next.js config |
+| `sidebar-preference-null` | Detect and report | Callers of `loadSidebarPreference` from `@open-mercato/core/modules/auth/services/sidebarPreferencesService` | Report the `findSidebarPreference` replacement and its `null` contract, and warn that feeding the fabricated default object back into `applySidebarPreference` erases the role layer; leave intentional default-object callers to `(await findSidebarPreference(em, scope)) ?? normalizeSidebarSettings(null)` |
 
 ## Workflow
 
@@ -53,7 +60,7 @@ Exclude `.git/`, `node_modules/`, `.yarn/`, `.next/`, `dist/`, `build/`, `covera
 
 Run every selected detection before editing. Report each match as `{checkId, file, line, classification, proposedAction}`. For environment matches, report only the variable name, file, and line number, never the value. Show totals by check and distinguish exact automatic matches from manual candidates.
 
-For `tanstack-table-v9`, an automatic match is exactly one type-only import whose only specifier is `ColumnDef`; preserve indentation, quote style, and semicolon style. For `settings-section-group-id`, require the literal `groupId` property and the exact `module-configs` value. For `removed-example-injection-flag`, require a single exact assignment line in a regular `.env*` file. Downgrade every broader or ambiguous shape to detect-and-report.
+For `tanstack-table-v9`, an automatic match is exactly one type-only import whose only specifier is `ColumnDef`; preserve indentation, quote style, and semicolon style. For `settings-section-group-id`, require the literal `groupId` property and the exact `module-configs` value. For `removed-example-injection-flag`, require a single exact assignment line in a regular `.env*` file. For `module-fact-sheet-directories`, require a literal flat sheet path — a glob, a manifest-driven read, or any consumer that enumerated the flat layout is a manual candidate. Downgrade every broader or ambiguous shape to detect-and-report.
 
 With `--dry-run`, print the complete plan, all no-code-action reminders, and unresolved manual work, then stop without edits, package-manager commands, generation, tests, or builds.
 
@@ -64,6 +71,7 @@ Ask for confirmation of the displayed plan. Apply one minimal, idempotent edit p
 - Repoint the exact `ColumnDef` type import to `LegacyColumnDef as ColumnDef` at the legacy entry point.
 - Replace the exact settings `groupId` slug with `settings.sections.moduleConfigs`.
 - Delete only the exact removed-flag assignment line from a `.env*` file without reading its value into the report.
+- Repoint the exact flat module fact-sheet path to its `<id>/index.md` form.
 
 Preserve file encoding, line endings, and unrelated formatting. Re-scan after editing: exact old shapes must be absent, while every manual candidate remains listed. Never perform repository-wide string replacement.
 
@@ -88,9 +96,9 @@ Report:
 - every detect-and-report finding, with exact file and line;
 - every no-code-action reminder, no-match check, and skipped check;
 - validation commands and outcomes;
-- unresolved operational work: role-ACL sync, stored workflow review, Redis protocol choice, webhook/proxy ceilings, and standalone header adoption where applicable.
+- unresolved operational work: the `JWT_SECRET` and legacy-token cutover decision, passkey credentials enrolled through the attestation shortcut, role-ACL sync for the global and hybrid search gates, stored workflow review, Redis protocol choice, webhook/proxy ceilings, design-system and i18n gate adoption, and standalone header adoption where applicable.
 
-If no code changes were required, still report that all fourteen upgrade categories ran. Recommend reviewing the complete `0.6.7 → 0.7.0` section of `UPGRADE_NOTES.md` before deployment.
+If no code changes were required, still report that all twenty-one upgrade categories ran. Recommend reviewing the complete `0.6.7 → 0.7.0` section of `UPGRADE_NOTES.md` before deployment.
 
 ## Rules
 
@@ -98,5 +106,6 @@ If no code changes were required, still report that all fourteen upgrade categor
 - Never change dependency versions, lockfiles, generated output, vendor files, framework-owned packages, or secrets.
 - Never display environment values while removing the obsolete example-injection flag.
 - Never broaden auth grants, invent ACL features, rewrite stored workflow intent, repin generated fact IDs, or weaken CSP automatically.
+- Never generate, print, or persist a `JWT_SECRET`, and never delete or reset a user's MFA credentials while reporting the passkey change.
 - Never weaken typecheck, tests, or build to make the upgrade appear green.
 - Always show the edit plan before mutation and the exact changed-file list afterward.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.6.8-develop.7101.1.bd9356828a",
+  "version": "0.7.1-develop.7102.1.b41f7e3e51",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,9 +60,9 @@
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/migrations": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/queue": "0.6.8-develop.7101.1.bd9356828a",
-    "@open-mercato/shared": "0.6.8-develop.7101.1.bd9356828a",
-    "@open-mercato/telemetry": "0.6.8-develop.7101.1.bd9356828a",
+    "@open-mercato/queue": "0.7.1-develop.7102.1.b41f7e3e51",
+    "@open-mercato/shared": "0.7.1-develop.7102.1.b41f7e3e51",
+    "@open-mercato/telemetry": "0.7.1-develop.7102.1.b41f7e3e51",
     "cross-spawn": "^7.0.6",
     "pg": "8.22.0",
     "semver": "^7.8.5",
@@ -73,10 +73,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7101.1.bd9356828a"
+    "@open-mercato/shared": "0.7.1-develop.7102.1.b41f7e3e51"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7101.1.bd9356828a",
+    "@open-mercato/shared": "0.7.1-develop.7102.1.b41f7e3e51",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"
@@ -89,5 +89,5 @@
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/cli"
   },
-  "stableVersion": "0.6.7"
+  "stableVersion": "0.7.0"
 }