@voltro/cli 0.34.0 → 0.35.0

package/dist/{codemodRunner-DRRqXR74.js → codemodRunner-BnFq3Fgu.js}

@@ -4937,7 +4937,136 @@ var x = (e, t, n) => {
 		return Mr.test(t) || Ar.test(t) && jr.test(t);
 	}),
 	note: "@voltro/plugin-presence no longer declares a table. Four things moved.\n\n1. A roster member is now { key, meta } — there is NO `lastSeen`.\n\n   It was the OWNING replica's clock, so on more than one replica \"active 3\n   minutes ago\" rendered from it was wrong by the skew between two pods, with\n   nothing to say so. It was also the only field a plain heartbeat changed,\n   which is what made the roster push on every beat instead of on every change.\n\n       // before\n       members.map((m) => `${m.key} — ${ago(m.lastSeen)}`)\n       // after: put anything time-shaped you need into meta\n       usePresence(channel, { meta: { joinedAt: Date.now() } })\n       members.map((m) => `${m.key} — ${ago(m.meta?.joinedAt)}`)\n\n2. `PresenceTracker.track()` and `.untrack()` return { delta, changed }.\n\n       // before\n       bus.announce(tracker.track({ channel, tenantId, key }))\n       // after — announce ALWAYS (a peer's sweep needs the liveness signal),\n       // push only on a change\n       const write = tracker.track({ channel, tenantId, key })\n       bus.announce(write.delta)\n       if (write.changed) publishReactivity(store, presenceRoster)\n\n   Do not blind-append `.delta` and move on: dropping `changed` restores the\n   per-heartbeat push this release removed, and nothing will report it.\n\n   `attachPresenceBus` also takes an optional `onRosterChanged` now — call it\n   if you drive the bus yourself, or a peer's join and a peer's death will\n   update your tracker and push nobody.\n\n3. These exports are DELETED, with no replacement:\n\n       presenceTable, PresenceStore, PresenceEntry,\n       memoryPresenceStore, isOnline, filterOnline, staleKeys\n\n   They were the table era's read model — an abstraction over rows plus the\n   staleness filter a row needed because it outlived the client that wrote it.\n   Presence has neither. Reading the roster is `presence.list` / `usePresence`;\n   the staleness sweep is the plugin's own and needs nothing from you.\n\n4. If your `source:` names '_voltro_presence' as a string, point it at the\n   channel object instead:\n\n       import { presenceRoster } from '@voltro/plugin-presence'\n       defineQuery({ name: 'room.summary', source: presenceRoster, ... })\n\n   And to push it yourself:\n\n       import { publishReactivity } from '@voltro/protocol'\n       publishReactivity(ctx.store, presenceRoster)\n\nTHE TABLE IS NOT DROPPED FOR YOU. The declarative differ never plans a drop for\na framework table no app declares — deliberately, so a live `_voltro_*` table is\nnever destroyed by an app that simply does not know about it. So an existing\n`_voltro_presence` stays, empty, until you remove it:\n\n    DROP TABLE IF EXISTS _voltro_presence;\n\nIt holds no data anyone can use: nothing has written a row to it since presence\nmoved into memory."
-}), Pr = /\brouteHttp\s*\(/, q = [
+}), Pr = (e) => {
+	let t = e.getArguments()[0];
+	if (t === void 0 || !t.isKind(b.ObjectLiteralExpression)) return /* @__PURE__ */ new Set();
+	let n = /* @__PURE__ */ new Set();
+	for (let e of t.getProperties()) {
+		let t = (e.asKind(b.PropertyAssignment) ?? e.asKind(b.ShorthandPropertyAssignment))?.getName?.();
+		t !== void 0 && n.add(t);
+	}
+	return n;
+}, Fr = (e, t) => /defineEvent\s*\(/.test(e) ? t.some((e) => {
+	if (e.getExpression().getText() !== "defineEvent") return !1;
+	let t = Pr(e);
+	return !t.has("guards") && !t.has("openAccess");
+}) : !1, Ir = C({
+	version: "0.35.0",
+	id: "0.35.0/01_event-access-decision",
+	title: "Every declared event decides who may listen (`guards:` or `openAccess:`)",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Fr(e.getFullText(), e.getDescendantsOfKind(b.CallExpression))),
+	note: (/* @__PURE__ */ "YOUR APP WILL NOT BOOT UNTIL EVERY DECLARED EVENT DECIDES WHO MAY LISTEN.(This closes the sibling of 0.34.0's procedure gate: `defineEvent`'s `guards:`(was optional and enforcement skipped an empty list, so an event with no(decision was silently subscribable by ANY authenticated session that could(open the socket.((WHAT TO DO, IN THIS ORDER:((1) LIST THEM. `voltro doctor` prints every undecided event with its tag and(   file — the same set, from the same function, that the boot refuses on.(   `voltro doctor --json` carries it as `accessDecisions.undecided` for CI.((2) DECIDE EACH ONE. There are exactly two answers and they are not the same(   claim:((       guards: [{ scope: 'display:read' }]     a subscriber must hold a scope(       openAccess: 'public scoreboard'         anyone may listen — and why((   `openAccess` takes a REASON, not a boolean. It is what a reviewer reads(   later, and it is what makes \"we decided this is open\" distinguishable(   from \"nobody looked\".((3) DO NOT RUBBER-STAMP. Reaching for a scope every caller already holds(   satisfies the gate, reads as protection, and enforces nothing. If the(   event is open, say `openAccess`. If it should not be open, this gate just(   found a real hole — an event often carries exactly the data its table(   guards behind a scoped query.((IF YOU NEED TO SHIP FIRST. The same field that covers procedures covers(events, in `app.config.ts`:((       export default { security: { defaultDeny: false } }((That restores the old default-allow for the WHOLE app, in one place a(reviewer can see. There is no env var for it, on purpose. `voltro doctor`(keeps listing the undecided events while it is off, marked advisory.((NOT AFFECTED: apps already running `security: { defaultDeny: false }`, and(events your PLUGINS declare — the gate reads your app's own discovered(`*.event.ts` files only.".split("(")).join("\n")
+}), Lr = /\brouteHttp\s*\(/, Rr = C({
+	version: "0.34.0",
+	id: "0.34.0/26_route-http-is-async",
+	title: "`routeHttp` returns a Promise",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Lr.test(e.getFullText())),
+	note: "`routeHttp` (@voltro/mcp) is async now:\n\n    routeHttp(options): HttpOutcome        // before\n    routeHttp(options): Promise<HttpOutcome>  // after\n\nAwait it, and make the enclosing function async if it is not already:\n\n    // before\n    const outcome = routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\n    // after\n    const outcome = await routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\nWhy it moved: `tools/list` now folds in the app's agent tools and `tools/call`\nexecutes one, so two of the methods reach the app. The rest still resolve without\ntouching anything, and the function is still pure in the sense that matters — it\nbinds no socket, and a test supplies a `live` double.\n\nIf you use the shipped `serveHttp` transport there is nothing to do; it already\nawaits."
+}), zr = /@voltro\/plugin-(billing|governance|storage)/, Br = /* @__PURE__ */ RegExp("\\b(billing\\.(startCheckout|portalUrl|previewChange|changePlan|changeSeats|invoices|reportUsage)|governance\\.(export|erase)|storage\\.(mintUploadUrl|ingestUrl|listRefs))\\b"), Vr = /\bdefinePluginRoute\s*\(|\broutes\s*:\s*\[/, Hr = C({
+	version: "0.35.0",
+	id: "0.35.0/02_plugin-procedures-carry-access-decisions",
+	title: "First-party plugin procedures carry access decisions; twelve now require a scope",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
+		let t = e.getFullText();
+		return zr.test(t) || Br.test(t) || Vr.test(t) && /VoltroPlugin|definePlugin/.test(t);
+	}),
+	note: [
+		"Every first-party plugin rpc route now declares an access decision, and the",
+		"dispatch spine enforces `security.defaultDeny` PER REQUEST as defense in",
+		"depth behind the boot gate. Twelve routes that any authenticated session",
+		"could previously call now require a SCOPE — a caller without it gets a",
+		"typed ScopeError:",
+		"",
+		"    billing.startCheckout      billing:manage",
+		"    billing.portalUrl          billing:manage",
+		"    billing.previewChange      billing:manage",
+		"    billing.changePlan         billing:manage",
+		"    billing.changeSeats        billing:manage",
+		"    billing.invoices           billing:manage   (a guarded READ: invoice",
+		"                               amounts + hosted-invoice links are billing-",
+		"                               admin material, not member-banner material)",
+		"    billing.reportUsage        billing:report   (an unguarded usage report",
+		"                               let any session inflate its tenant's counters",
+		"                               until a quota locked the tenant out)",
+		"    governance.export          admin:full       (already enforced in-handler;",
+		"    governance.erase           admin:full        the descriptor now declares it,",
+		"                               so clients + doctor can see it — behaviour is",
+		"                               unchanged for these two)",
+		"    storage.mintUploadUrl      storage:manage   (raw bring-your-own-key PUT;",
+		"                               bypasses upload limits + virus scan)",
+		"    storage.ingestUrl          storage:manage   (the server fetches a caller-",
+		"                               supplied URL — an SSRF surface)",
+		"    storage.listRefs           storage:browse   (tenant-WIDE media-library",
+		"                               index, private objects' metadata included)",
+		"",
+		"WHAT TO DO:",
+		"",
+		"1) Decide WHO in your app holds each capability, then grant the scope there",
+		"   — an rbac role (`rbacPlugin({ roles: { billingAdmin: { scopes:",
+		"   ['billing:manage'] } } })`), your auth strategy's `resolveScopes`, or an",
+		"   api key's scope set. `admin:full` passes every guard, as always.",
+		"",
+		"2) If a surface in your UI calls one of these for EVERY member (for example",
+		"   a pricing page calling billing.previewChange), move it behind the role",
+		"   that owns it or grant the scope deliberately — do NOT hand the scope to",
+		"   everyone just to make the error go away. That is the rubber-stamp shape",
+		"   this change removes; the open-by-design reads your members need",
+		"   (billing.subscription, billing.entitlementStatus, the whole",
+		"   notifications/presence/flags surface) stayed open, each with its reason",
+		"   in `openAccess`.",
+		"",
+		"3) If YOU author a plugin with `routes:`: give every route `guards:` or",
+		"   `openAccess: '<why>'`. Under `security.defaultDeny` (the default) the",
+		"   dispatch spine now refuses an undecided plugin route per-request with a",
+		"   typed ScopeError naming the tag — the same rule your app procedures",
+		"   already meet at boot. Spreading a browser-safe descriptor that carries",
+		"   the decision (`{ ...listDescriptor, execute }`) is enough.",
+		"",
+		"ESCAPE HATCH (whole app, reviewable, no env var): `app.config.ts` →",
+		"`security: { defaultDeny: false }` restores default-allow for undecided",
+		"descriptors everywhere. The twelve scoped routes above still require their",
+		"scopes — a declared guard is enforced regardless of defaultDeny.",
+		"",
+		"NOT AFFECTED: notifications.* (13 routes), presence.* (3), flags.* (2),",
+		"governance.consent / hasConsent, billing.subscription / entitlementStatus,",
+		"and the storage upload/share flow (13 routes) — all now declare",
+		"`openAccess` with the reason each is safe (self-scoped rows, signed",
+		"subject-bound tickets, per-object grants), and behave exactly as before."
+	].join("\n")
+}), Ur = /AnalyticsMirrorImpl/, Wr = C({
+	version: "0.35.0",
+	id: "0.35.0/03_analytics-mirror-max-version",
+	title: "Custom analytics mirror sinks answer `maxVersion` (fleet-scope seed read)",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Ur.test(e.getFullText())),
+	note: [
+		"The analytics CDC-mirror now derives its version from the CHANGE under",
+		"`changeScope: 'fleet'` (postgres CDC, mysql binlog): warehouse baseline +",
+		"per-key stream ordinal, so N replicas stamp IDENTICAL versions for one",
+		"change and the duplicate writes dedupe in the warehouse for free.",
+		"",
+		"Your custom `AnalyticsMirrorImpl` must answer the baseline read:",
+		"",
+		"    maxVersion: ({ table, primaryKeyValue }) =>",
+		"      // the HIGHEST version you have persisted for that key,",
+		"      // tombstones included — or null if the key was never written.",
+		"",
+		"Two rules, both load-bearing:",
+		"",
+		"  * TOMBSTONES ANSWER TOO. If your `remove` deletes the row physically,",
+		"    a re-created key would seed below the delete and never reappear.",
+		"    Keep deletes as tombstones (the shipped sinks all do).",
+		"  * `null` means \"never written\", and only that. Answering 0 for an",
+		"    unknown key is fine (baseline 0 is the null path); answering null",
+		"    for a KNOWN key restarts its numbering and the version guard then",
+		"    silently rejects every later write until the count catches up.",
+		"",
+		"The read is issued at most once per key per process, off the commit path."
+	].join("\n")
+}), Gr = (e) => /RunStepStatus/.test(e) || /['"]succeeded['"]/.test(e) && /['"]waiting['"]/.test(e) && /RunStep|runStep|flow/i.test(e), q = [
 	ge,
 	_e,
 	ye,
@@ -5032,13 +5161,25 @@ var x = (e, t, n) => {
 	Dr,
 	kr,
 	Nr,
+	Rr,
+	Ir,
+	Hr,
+	Wr,
+	C({
+		version: "0.35.0",
+		id: "0.35.0/04_flow-run-step-skipped",
+		title: "A flow run step can now be 'skipped' — handle it where you render a run timeline",
+		kind: "manual",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Gr(e.getFullText())),
+		note: (/* @__PURE__ */ "A FLOW RUN STEP CAN NOW BE 'skipped'.((`when:` on a flow step gates it on a prior value, and a step whose condition(is false is SKIPPED rather than run. That is a sixth member of(`RunStepStatus`, so an exhaustive switch over it no longer compiles, and a(lookup keyed by status now has a hole.((WHAT TO DO:((1) FIND IT. Anywhere you render or branch on a run step status — a timeline(   component, a status badge map, a progress calculation.((2) DECIDE WHAT A SKIPPED STEP LOOKS LIKE. It is NOT a failure and NOT a(   success: it did not run, on purpose, and it produced no output. The(   step carries `skipReason` — the rendered condition, e.g.(   `{{mode}} equals \"full\"` — so the timeline can say WHY.((3) DO NOT DEFAULT IT TO INVISIBLE. Dropping the row compiles and reads fine(   in review, and it reproduces exactly the problem `skipReason` exists to(   prevent: a step that vanished is indistinguishable from a step nobody(   declared, which is the first thing a user reports as a bug.((A PROGRESS COUNT probably needs a second look too: `succeeded / total` now(under-reports a completed run that skipped a step. Counting(`succeeded + skipped` against the total is usually what was meant.((If your app does not render a flow timeline, there is nothing to do — this(note fires on any file that names the status type or its literals.".split("(")).join("\n")
+	}),
 	C({
-		version: "0.34.0",
-		id: "0.34.0/26_route-http-is-async",
-		title: "`routeHttp` returns a Promise",
+		version: "0.35.0",
+		id: "0.35.0/05_declared-schema-drops-runtime-flags",
+		title: "The declared schema no longer reads `CDC` / `VOLTRO_UNDO` / `VOLTRO_TRACING_PERSIST`",
 		kind: "manual",
-		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Pr.test(e.getFullText())),
-		note: "`routeHttp` (@voltro/mcp) is async now:\n\n    routeHttp(options): HttpOutcome        // before\n    routeHttp(options): Promise<HttpOutcome>  // after\n\nAwait it, and make the enclosing function async if it is not already:\n\n    // before\n    const outcome = routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\n    // after\n    const outcome = await routeHttp({ method, url, body, tools })\n    if (outcome.kind === 'json') respond(outcome)\n\nWhy it moved: `tools/list` now folds in the app's agent tools and `tools/call`\nexecutes one, so two of the methods reach the app. The rest still resolve without\ntouching anything, and the function is still pure in the sense that matters — it\nbinds no socket, and a test supplies a `live` double.\n\nIf you use the shipped `serveHttp` transport there is nothing to do; it already\nawaits."
+		appliesTo: () => !0,
+		note: (/* @__PURE__ */ "The set of framework tables your app DECLARES is hashed into the schema(fingerprint. A pre-deploy `voltro db apply` records that hash; every serving(container recomputes it and refuses to boot if it differs. Until this release(three RUNTIME flags fed into that set:((    CDC=0                       removed `_voltro_cdc_offsets`(    VOLTRO_UNDO=on              added   `_voltro_undo_log`(    VOLTRO_TRACING_PERSIST=all  added   `_voltro_traces`((All three read as pure runtime knobs, so they tend to live on the PODS and(not on the pre-upgrade migrate Job — which is a green migrate followed by(every pod in CrashLoopBackOff. This was reported against a Helm deployment(where `CDC: \"0\"` was in all three overlays' pod blocks and none of their(jobs; it had been latent for months and would have fired on the next deploy.((WHAT YOU MUST DO — only if you set one of these to turn a table ON in(production:((  * `VOLTRO_UNDO=on` in production  → add to app.config.ts:(        export default { schema: { undo: true }, … }(  * `VOLTRO_TRACING_PERSIST` keeping trace history in production → add:(        export default { schema: { traces: true }, … }((    Without the declaration, `voltro serve` now REFUSES to boot and names the(    field. That refusal is the point: before, the same configuration either(    wrote to a table nobody created or produced a fingerprint the migrate job(    could not reproduce.((    Turning capture OFF still needs no declaration and never will — a declared(    table nobody writes to is harmless. Only turning it ON is a schema claim.((WHAT HAPPENS WITHOUT ANY ACTION:((  * On mariadb or mssql you will see ONE additive `create-table` in your next(    plan: `_voltro_cdc_offsets` is now declared by the DIALECT rather than by(    `CDC`, so it exists whether or not that process drives CDC. It is an(    offsets table — a handful of rows — and the alternative was leaving a(    runtime flag able to split your fleet.(  * On postgres/sqlite nothing changes: those dialects have no offsets table.((AND ONE THING WORTH DOING ANYWAY: if you are upgrading a deployment that has(a separate migrate job, diff that job's `env:` against your pods' once. The(framework can now guarantee its OWN tables do not depend on a runtime flag;(it cannot make the same guarantee for a plugin's `extendSchema.tables`, which(is app code and may read anything. A `prod-mismatch` refusal now prints which(tables this process decided and from which input, so the comparison is quick.".split("(")).join("\n")
 	})
 ], J = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -5052,12 +5193,12 @@ var x = (e, t, n) => {
 	".turbo",
 	".cache",
 	".output"
-]), Fr = () => [...[...J].map((e) => `**/${e}/**`), "**/.voltro-*/**"], Y = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, X = /\.(?:tsx?|jsx?|mjs|cjs)$/, Ir = (e) => m(e).replace(X, ""), Lr = (e) => {
+]), Kr = () => [...[...J].map((e) => `**/${e}/**`), "**/.voltro-*/**"], Y = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, X = /\.(?:tsx?|jsx?|mjs|cjs)$/, qr = (e) => m(e).replace(X, ""), Jr = (e) => {
 	let t = e.split("/").filter((e) => e.length > 0).pop();
 	if (t === void 0 || t === "." || t === "..") return;
 	let n = t.replace(X, "");
 	return n.length > 0 ? n : void 0;
-}, Rr = (e) => {
+}, Yr = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e;
@@ -5068,55 +5209,55 @@ var x = (e, t, n) => {
 		}
 		Y.lastIndex = 0;
 		for (let r = Y.exec(e); r !== null; r = Y.exec(e)) {
-			let e = Lr(r[1] ?? r[2] ?? "");
+			let e = Jr(r[1] ?? r[2] ?? "");
 			if (e === void 0) continue;
 			let i = t.get(e);
 			i === void 0 ? t.set(e, /* @__PURE__ */ new Set([n])) : i.add(n);
 		}
 	}
 	return t;
-}, zr = (e, t) => {
+}, Xr = (e, t) => {
 	let n = new Set(e);
-	for (let r of e) for (let e of [Ir(r), m(h(r))]) {
+	for (let r of e) for (let e of [qr(r), m(h(r))]) {
 		let r = t.get(e);
 		if (r !== void 0) for (let e of r) n.add(e);
 	}
 	return n;
-}, Z = [
+}, Zr = [
 	"**/*.ts",
 	"**/*.tsx",
 	"!**/node_modules/**",
 	"!**/dist/**",
 	"!**/.framework/**",
 	"!**/*.d.ts"
-], Q = (e, t, n = Hr) => {
+], Z = (e, t, n = ei) => {
 	let r = /* @__PURE__ */ new Set();
-	for (let e of t) for (let t of e.scope ?? Z) r.add(t);
+	for (let e of t) for (let t of e.scope ?? Zr) r.add(t);
 	let i = n(e);
 	if (i !== void 0) {
-		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => Vr(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => Vr(e.slice(1))), a = [...J], o = [];
+		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => $r(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => $r(e.slice(1))), a = [...J], o = [];
 		for (let r of i) {
 			if (a.some((e) => r === e || r.startsWith(`${e}/`) || r.includes(`/${e}/`)) || !t.some((e) => e(r)) || n.some((e) => e(r))) continue;
 			let i = g(e, r);
 			v(i) && o.push(i);
 		}
-		return Br(o.length, e), o;
+		return Qr(o.length, e), o;
 	}
 	let a = oe([...r], {
 		cwd: e,
 		absolute: !0,
 		expandDirectories: !1,
 		followSymbolicLinks: !1,
-		ignore: [...Fr()]
+		ignore: [...Kr()]
 	});
-	return Br(a.length, e), a;
-}, Br = (e, t) => {
-	let n = Ur();
+	return Qr(a.length, e), a;
+}, Qr = (e, t) => {
+	let n = ti();
 	if (!(e <= n)) throw Error(`voltro update: the codemod scan matched ${e} files under ${t}, past the ${n} ceiling.\n  Every matched file is parsed into one ts-morph project, so the heap needed grows with\n  this number — past the ceiling it runs out of memory, and V8 aborts without naming a\n  limit, which is why this stops here instead. Three ways out, in order:\n    • put non-source directories in .gitignore (inside a git repo the scan then never\n      sees them at all — a build cache, a data dump, a virtualenv),\n    • run \`voltro update\` from the app directory rather than the workspace root, or\n    • take one codemod at a time: \`voltro update --dry-run\` lists the ids, then\n      \`voltro update --codemods-only --only <id>\` runs a single one.\n  If every one of those files really is source this pass must rewrite, raise the ceiling\n  with VOLTRO_CODEMOD_MAX_FILES and give node room: NODE_OPTIONS=--max-old-space-size=8192.`);
-}, Vr = (e) => {
+}, $r = (e) => {
 	let t = e.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*").replace(/\u0000/g, "(?:.*/)?").replace(/\\\{([^}]*)\\\}/g, (e, t) => `(?:${t.split(",").join("|")})`);
 	return (e) => RegExp(`^${t}$`).test(e);
-}, Hr = (e) => {
+}, ei = (e) => {
 	try {
 		let t = re("git", [
 			"ls-files",
@@ -5137,17 +5278,17 @@ var x = (e, t, n) => {
 	} catch {
 		return;
 	}
-}, Ur = () => {
+}, ti = () => {
 	let e = Number(process.env.VOLTRO_CODEMOD_MAX_FILES);
 	return Number.isInteger(e) && e > 0 ? e : 2e4;
-}, $ = (e, t) => {
+}, Q = (e, t) => {
 	let n = e.split(".").map(Number), r = t.split(".").map(Number);
 	for (let e = 0; e < 3; e++) {
 		let t = (n[e] ?? 0) - (r[e] ?? 0);
 		if (t !== 0) return t;
 	}
 	return 0;
-}, Wr = (e, t, n = q) => n.filter((n) => $(e, n.version) < 0 && $(n.version, t) <= 0).slice().sort(he), Gr = (e, t, n = () => {}) => {
+}, ni = (e, t, n = q) => n.filter((n) => Q(e, n.version) < 0 && Q(n.version, t) <= 0).slice().sort(he), $ = (e, t, n = () => {}) => {
 	let r = [], i = [], a = [];
 	for (let o of t) {
 		if (!(!o.appliesTo || o.appliesTo({ project: e }))) {
@@ -5193,8 +5334,8 @@ var x = (e, t, n) => {
 		manual: i,
 		skipped: a
 	};
-}, Kr = async (e) => {
-	let t = e.log ?? (() => {}), n = Wr(e.from, e.to, e.codemods ?? q), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
+}, ri = async (e) => {
+	let t = e.log ?? (() => {}), n = ni(e.from, e.to, e.codemods ?? q), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
 		let t = n.filter((t) => e.only.includes(t.id)), r = e.only.filter((e) => !n.some((t) => t.id === e));
 		if (r.length > 0) throw Error(`voltro update --only: no codemod in ${e.from} → ${e.to} has id ${r.map((e) => `"${e}"`).join(", ")}.\n  Available for this jump:\n${n.map((e) => `    ${e.id}`).join("\n")}`);
 		return t;
@@ -5213,15 +5354,15 @@ var x = (e, t, n) => {
 			baseUrl: i.baseUrl,
 			paths: i.paths
 		} }
-	}), o, s = Q(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? Rr(Q(e.root, [{
+	}), o, s = Z(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? Yr(Z(e.root, [{
 		...c[0],
-		scope: Z
+		scope: Zr
 	}])) : void 0;
 	for (let n of r) {
 		if (c.includes(n)) {
-			let r = a(), i = Q(e.root, [n]);
-			for (let e of zr(i, p)) v(e) && r.addSourceFileAtPath(e);
-			let s = Gr(r, [n], t);
+			let r = a(), i = Z(e.root, [n]);
+			for (let e of Xr(i, p)) v(e) && r.addSourceFileAtPath(e);
+			let s = $(r, [n], t);
 			e.dryRun || await r.save(), l.push(...s.applied), u.push(...s.manual), d.push(...s.skipped), o = void 0;
 			continue;
 		}
@@ -5230,7 +5371,7 @@ var x = (e, t, n) => {
 			for (let t of s) v(t) && e.addSourceFileAtPath(t);
 			return e;
 		})();
-		let r = Gr(o, [n], t);
+		let r = $(o, [n], t);
 		e.dryRun || await o.save(), l.push(...r.applied), u.push(...r.manual), d.push(...r.skipped);
 	}
 	return {
@@ -5240,4 +5381,4 @@ var x = (e, t, n) => {
 	};
 };
 //#endregion
-export { C as i, Kr as n, J as r, $ as t };
+export { C as i, ri as n, J as r, Q as t };

package/dist/{commands-gutsz-Ac.js → commands-BE8E7zF3.js}

@@ -90,7 +90,7 @@ var a = () => {
 		name: "dev",
 		summary: "Start the local development server (auto-discovers routes / mutations).",
 		status: "wired",
-		run: (e) => import("./dev-CoG-ZPx8.js").then((t) => t.runDev(e)),
+		run: (e) => import("./dev-D2BikO7a.js").then((t) => t.runDev(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro dev", "boot the app in the current directory"], ["voltro dev apps/acme/api", "boot a specific app"]],
@@ -108,7 +108,7 @@ var a = () => {
 		name: "dashboard",
 		summary: "Serve the DevTools dashboard standalone (from @voltro/dashboard). Targets via VOLTRO_DASHBOARD_APPS; --port to override.",
 		status: "wired",
-		run: (e) => import("./dashboardCommand-3YG8p-UA.js").then((t) => t.runDashboardCommand(e)),
+		run: (e) => import("./dashboardCommand-D7SgZGaN.js").then((t) => t.runDashboardCommand(e)),
 		help: {
 			usage: "[--port <n>]",
 			flags: [["--port <n>", "port to serve the dashboard on"]],
@@ -120,7 +120,7 @@ var a = () => {
 		name: "check",
 		summary: "Verify the app graph (blast-radius checks) against a running api; LLM-shaped --json diagnostics. Flags: --json, --process <p>, --diff removeTable:<name>.",
 		status: "wired",
-		run: (e) => import("./checkCommand-YZDmkAGd.js").then((t) => t.runCheckCommand(e)),
+		run: (e) => import("./checkCommand-DKpDLlqu.js").then((t) => t.runCheckCommand(e)),
 		help: {
 			usage: "[--json] [--offline] [--process <name>] [--diff removeTable:<name>]",
 			flags: [
@@ -154,7 +154,7 @@ var a = () => {
 		name: "webhooks",
 		summary: "Outbound-webhook artefacts. `consumer` generates the ZERO-DEPENDENCY Standard-Webhooks verification package a subscriber installs, from this app's own declared events; `events` lists the events a subscriber can register for. Usage: voltro webhooks <consumer|events> [path] [--out <dir>] [--name <pkg>] [--json].",
 		status: "wired",
-		run: (e) => import("./webhooksCommand-CID96Rga.js").then((t) => t.runWebhooksCommand(e)),
+		run: (e) => import("./webhooksCommand-DlAgS2Iw.js").then((t) => t.runWebhooksCommand(e)),
 		help: {
 			usage: "<consumer|events> [path] [--out <dir>] [--name <pkg>] [--json]",
 			flags: [
@@ -170,7 +170,7 @@ var a = () => {
 		name: "evolve",
 		summary: "Schema-evolution copilot: propose an observed-graph-driven codemod + a branch-verified backfill for a schema change (rename/retype/split/drop a column, rename a table). Dry-run by default; --write applies. Usage: voltro evolve rename-column <table>.<col> --to <newName> [--write] [--json].",
 		status: "wired",
-		run: (e) => import("./evolveCommand-DHpkgjgH.js").then((t) => t.runEvolveCommand(e)),
+		run: (e) => import("./evolveCommand-CHsLCtDf.js").then((t) => t.runEvolveCommand(e)),
 		help: {
 			usage: "<rename-column|rename-table|retype-column|split-column|drop-column> <target> [--to <new>] [--write]",
 			flags: [
@@ -187,7 +187,7 @@ var a = () => {
 		name: "codegen",
 		summary: "Emit rpcGroup.generated.ts from discovered route / mutation descriptors.",
 		status: "wired",
-		run: (e) => import("./codegenCommand-DC6w2tNZ.js").then((t) => t.runCodegenCommand(e)),
+		run: (e) => import("./codegenCommand-C4YoQIc2.js").then((t) => t.runCodegenCommand(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro codegen", "regenerate rpcGroup.generated.ts for the app in the cwd"]],
@@ -198,7 +198,7 @@ var a = () => {
 		name: "migrate",
 		summary: "Apply the declared schema to the database (alias of `db apply` — diffs declared vs live and emits the ALTERs). `--create-only` for the bootstrap-only CREATE TABLE IF NOT EXISTS path.",
 		status: "wired",
-		run: (e) => import("./migrate-CBwOt_iV.js").then((t) => t.runMigrateCommand(e)),
+		run: (e) => import("./migrate-BV7I-ZHZ.js").then((t) => t.runMigrateCommand(e)),
 		help: {
 			usage: "[app] [--create-only]",
 			flags: [["--create-only", "only CREATE TABLE IF NOT EXISTS — never ALTER (bootstrap)"]],
@@ -258,7 +258,7 @@ var a = () => {
 		name: "info",
 		summary: "Report versions (CLI, node, every installed @voltro/* — flags lockstep skew), package manager, and dialect. --json for CI. Exits 1 on version skew.",
 		status: "wired",
-		run: (e) => import("./infoCommand-BJw9nLUR.js").then((t) => t.runInfoCommand(e)),
+		run: (e) => import("./infoCommand-DwOgK1t6.js").then((t) => t.runInfoCommand(e)),
 		help: {
 			usage: "[--json]",
 			flags: [["--json", "machine-readable report"]],
@@ -279,7 +279,7 @@ var a = () => {
 		name: "env",
 		summary: "Inspect/sync the typed-env manifest. Subcommands: check (default), sync (.env.example), types (env.generated.d.ts for CI tsc), turbo.",
 		status: "wired",
-		run: (e) => import("./envCommand-DPgdV1Bq.js").then((t) => t.runEnvCommand(e)),
+		run: (e) => import("./envCommand-CCGPRQY1.js").then((t) => t.runEnvCommand(e)),
 		help: {
 			usage: "[check|sync|types|turbo] [--force]",
 			flags: [["--force", "overwrite the generated file instead of refusing on a conflict"]],
@@ -308,12 +308,12 @@ var a = () => {
 		run: async (e) => {
 			let t = e.find((e) => !e.startsWith("-")) ?? process.cwd();
 			if (e.includes("--preflight")) {
-				let { runServePreflight: e } = await import("./doctorCommand-BvqGBwNG.js");
+				let { runServePreflight: e } = await import("./doctorCommand-CM4Ch9C7.js");
 				return e(n(t), !0);
 			}
-			let { tryRunWebServe: r } = await import("./webDev-Cg-fFiyd2.js"), i = await r(n(t));
+			let { tryRunWebServe: r } = await import("./webDev-BcykISYQ2.js"), i = await r(n(t));
 			if (!i.ran) {
-				let { runServeDispatch: t } = await import("./serveCommand-DOvbgRnQ.js");
+				let { runServeDispatch: t } = await import("./serveCommand-CbDHU6l-.js");
 				return t(e);
 			}
 			return i.exitCode;
@@ -341,13 +341,13 @@ var a = () => {
 		handlesHelp: !0,
 		summary: "Preflight an app for production: the precompiled serve bundle, hand-rolled primitives (naming the shipped one), @voltro/* version skew, executors with no access check, `.serverOnly()` leaks, and junction-FK gaps.",
 		status: "wired",
-		run: (e) => import("./doctorCommand-BvqGBwNG.js").then((t) => t.runDoctorCommand(e))
+		run: (e) => import("./doctorCommand-CM4Ch9C7.js").then((t) => t.runDoctorCommand(e))
 	},
 	{
 		name: "build",
 		summary: "Production build for a web app (vite build + per-page SSG pre-render).",
 		status: "wired",
-		run: (e) => import("./build-CE7Ca9gm.js").then((t) => t.runBuildCommand(e)),
+		run: (e) => import("./build-CD8K4XOr.js").then((t) => t.runBuildCommand(e)),
 		help: {
 			usage: "[app] [--target <t>]",
 			flags: [["--target <t>", "build target"]],
@@ -363,14 +363,14 @@ var a = () => {
 		name: "prune-runtime",
 		summary: "Trim a deployed web tree’s node_modules to the reachable runtime set (standalone image slimming).",
 		status: "wired",
-		run: (e) => import("./runtimeTrace-CRxalXTs.js").then((t) => t.runPruneRuntimeCommand(e)),
+		run: (e) => import("./runtimeTrace-CH3eUiMw.js").then((t) => t.runPruneRuntimeCommand(e)),
 		hidden: !0
 	},
 	{
 		name: "generate",
 		summary: "AI app-builder (round-2/06): generate app graph + files from a prompt, gated by `voltro check`. Dry-run by default; --write applies. Usage: voltro generate \"<prompt>\" [--write].",
 		status: "wired",
-		run: (e) => import("./generateCommand-oibemh97.js").then((t) => t.runGenerateCommand(e)),
+		run: (e) => import("./generateCommand-DbgcUpGw.js").then((t) => t.runGenerateCommand(e)),
 		help: {
 			usage: "\"<prompt>\" [--write]",
 			flags: [["--write", "write the generated files (dry-run is the default)"]],
@@ -381,7 +381,7 @@ var a = () => {
 		name: "dormancy",
 		summary: "Single-node scale-to-zero: front the API with a wake-orchestrator that stops the app when idle and brings it back on a request or a due wakeup (cron/workflow). Needs a SQL store. Flags: --port, --app-port, --idle-grace-ms, --tick-ms.",
 		status: "wired",
-		run: (e) => import("./dormancyCommand-Dszo57d6.js").then((t) => t.runDormancyCommand(e)),
+		run: (e) => import("./dormancyCommand-QewYug_s.js").then((t) => t.runDormancyCommand(e)),
 		help: {
 			usage: "[app] [--port <n>] [--app-port <n>] [--idle-grace-ms <n>] [--tick-ms <n>]",
 			flags: [
@@ -398,7 +398,7 @@ var a = () => {
 		name: "start",
 		summary: "Production runtime: serves dist + SSR-on-demand for ssr/isr pages.",
 		status: "wired",
-		run: (e) => import("./start-B-9Nsp-S.js").then((t) => t.runStartCommand(e)),
+		run: (e) => import("./start-BgN62boB.js").then((t) => t.runStartCommand(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro start", "serve a built web app (dist + SSR-on-demand)"]],
@@ -452,7 +452,7 @@ var a = () => {
 		name: "db",
 		summary: "Database subcommands. Declarative flow: plan, apply, branch, plans, drift [--accept], squash, restore-snapshot. File migrations: generate [name], migrate, rollback, status, files, rollback-file. Also: seed, gc-snapshots.",
 		status: "wired",
-		run: (e) => import("./dbCommand-CpdKLeQq.js").then((t) => t.runDbCommand(e)),
+		run: (e) => import("./dbCommand-DS4b97Is.js").then((t) => t.runDbCommand(e)),
 		help: {
 			usage: "<plan|apply|branch|plans|drift|squash|restore-snapshot|generate|migrate|rollback|status|files|rollback-file|seed|gc-snapshots>",
 			examples: [
@@ -468,7 +468,7 @@ var a = () => {
 		name: "data",
 		summary: "Export/import + backup/restore of app data. Logical (rows + optional assets): export <dir> [--tenant <id>|--tables a,b] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot]; import <dir> [--assets] [--no-verify]. Native (rows ONLY — no blobs): backup <dir> / restore <dir> (pg_dump/mariadb-dump/…). Resumable; typed-NDJSON; content-addressed assets on the logical path.",
 		status: "wired",
-		run: (e) => import("./dataCommand-qL0r7fPO.js").then((t) => t.runDataCommand(e)),
+		run: (e) => import("./dataCommand-BhYwDgg-.js").then((t) => t.runDataCommand(e)),
 		help: {
 			usage: "<export|import|backup|restore> <dir> [options]",
 			flags: [
@@ -523,20 +523,20 @@ var a = () => {
 		handlesHelp: !0,
 		summary: "Upgrade the app to the latest framework: bump every @voltro/* dependency (across ALL workspace members, install once at the workspace root), then run the codemods shipped with the target version. Flags: --to <version>, --from <version>, --codemods-only, --dry-run, --force, --exact, --help. After: run `voltro db apply`.",
 		status: "wired",
-		run: (e) => import("./updateCommand-us1_hdIC.js").then((t) => t.runUpdateCommand(e))
+		run: (e) => import("./updateCommand-BlMZhWgO.js").then((t) => t.runUpdateCommand(e))
 	},
 	{
 		name: "_apply-codemods",
 		summary: "Internal: apply shipped codemods for a framework version jump (re-exec target of `voltro update`).",
 		status: "wired",
 		hidden: !0,
-		run: (e) => import("./updateCommand-us1_hdIC.js").then((t) => t.runApplyCodemods(e))
+		run: (e) => import("./updateCommand-BlMZhWgO.js").then((t) => t.runApplyCodemods(e))
 	},
 	{
 		name: "embeddings",
 		summary: "Embeddings tooling. Subcommand: backfill <table> --text <field> --vector <field> [--model <m>] [--model-field <f>] [--batch <n>] [--dry-run] — (re)embed rows the vectorEmbedding() mixin missed.",
 		status: "wired",
-		run: (e) => import("./embeddingsCommand-C0sKVRo1.js").then((t) => t.runEmbeddingsCommand(e)),
+		run: (e) => import("./embeddingsCommand-BfiLS_QI.js").then((t) => t.runEmbeddingsCommand(e)),
 		help: {
 			usage: "backfill <table> --text <field> --vector <field> [--model <m>] [--batch <n>] [--dry-run]",
 			flags: [
@@ -577,12 +577,19 @@ var a = () => {
 			notes: ["A file whose first lines carry the `voltro:agents-md:keep` marker is never overwritten."]
 		}
 	},
+	{
+		name: "probe",
+		summary: "Ask a RUNNING app whether its declared access is enforced. `access` calls every guarded procedure with NO credentials and reports any that answer (--process, --url, --strict, --format).",
+		status: "wired",
+		handlesHelp: !0,
+		run: (e) => import("./probeCommand-CZfaaUOZ.js").then((t) => t.runProbeCommand(e))
+	},
 	{
 		name: "schedule",
 		summary: "Operate on registered schedules. `run <name>` fires one on demand (--process, --trigger manual|external, --url).",
 		status: "wired",
 		handlesHelp: !0,
-		run: (e) => import("./scheduleCmd--jksTrf6.js").then((t) => t.runScheduleCommand(e))
+		run: (e) => import("./scheduleCmd-DQRu6BZC.js").then((t) => t.runScheduleCommand(e))
 	},
 	{
 		name: "schedule-manifest",
@@ -604,35 +611,35 @@ var a = () => {
 		handlesHelp: !0,
 		summary: "Tail recent log records from every running voltro process. --tail N --since 30s --level error --filter PAT --format json|pretty|text.",
 		status: "wired",
-		run: (e) => import("./logsCmd-CCca3KRZ.js").then((t) => t.runLogsCommand(e))
+		run: (e) => import("./logsCmd-D36xK7Zu.js").then((t) => t.runLogsCommand(e))
 	},
 	{
 		name: "traces",
 		handlesHelp: !0,
 		summary: "Distributed traces from every running api. --tail N --errors --since 30s --process NAME --format json|pretty. Use --id <traceId> for the waterfall of one trace.",
 		status: "wired",
-		run: (e) => import("./tracesCmd-CkEZQrtt.js").then((t) => t.runTracesCommand(e))
+		run: (e) => import("./tracesCmd-DStmCJPi.js").then((t) => t.runTracesCommand(e))
 	},
 	{
 		name: "inspect",
 		handlesHelp: !0,
 		summary: "Query the live /_voltro/inspect/* surface. Subcommands: app, routes, rpc, metrics, cache, schedules, aggregates, invoke. --process NAME --format json|pretty. `schedules --failing` reports only broken crons and exits 1 if any (usable as a post-deploy gate).",
 		status: "wired",
-		run: (e) => import("./inspectCmd-Bppy-GGw.js").then((t) => t.runInspectCommand(e))
+		run: (e) => import("./inspectCmd-EHFZ9yYu.js").then((t) => t.runInspectCommand(e))
 	},
 	{
 		name: "workflows",
 		handlesHelp: !0,
 		summary: "Inspect + operate workflow runs. Subcommands: list, show <runId>, start <name>, retry|cancel|suspend|resume <runId>, signal|update <runId> --name, children <parentExecutionId>, flow (declarative flow-control queue + ledger), pause|unpause <workflowName>.",
 		status: "wired",
-		run: (e) => import("./workflowsCmd-D1VTmLMY.js").then((t) => t.runWorkflowsCommand(e))
+		run: (e) => import("./workflowsCmd-BGF-mRZ5.js").then((t) => t.runWorkflowsCommand(e))
 	},
 	{
 		name: "cluster",
 		handlesHelp: !0,
 		summary: "Clustering snapshot of every running api. Subcommand: status — per-instance replicaId, runner address, dialect, CDC flavor, coordination, server_id, + a flag for SQL runners stuck on localhost. --process NAME --format json|pretty.",
 		status: "wired",
-		run: (e) => import("./clusterCmd-CNXKlcvD.js").then((t) => t.runClusterCommand(e))
+		run: (e) => import("./clusterCmd-D5wsCmA_.js").then((t) => t.runClusterCommand(e))
 	},
 	{
 		name: "login",
@@ -719,6 +726,7 @@ var a = () => {
 		"workflows",
 		"cluster",
 		"check",
+		"probe",
 		"eval",
 		"doctor",
 		"capabilities"

package/dist/{dashboardCommand-3YG8p-UA.js → dashboardCommand-D7SgZGaN.js}

@@ -1,6 +1,6 @@
-import { d as e } from "./dev-CerMd0mW.js";
-import { P as t, j as n } from "./webDev-CBYvPqQr.js";
-import { t as r } from "./start-9LiUOfES.js";
+import { d as e } from "./dev-C7sFZq3m.js";
+import { P as t, j as n } from "./webDev-Dybxew86.js";
+import { t as r } from "./start-T4VesWiM.js";
 import { join as i } from "node:path";
 import { existsSync as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";