@voltro/cli 0.34.0 → 0.35.0

package/dist/probeCommand-CZfaaUOZ.js

@@ -0,0 +1,122 @@
+import { n as e } from "./cliOutput-D1tSBoRM.js";
+import { n as t, o as n, r, t as i } from "./inspectFetch-EMuhTG_9.js";
+import { ansi as a } from "@voltro/logger";
+//#region src/probeCommand.ts
+var o = () => {
+	console.log(`${a.bold("voltro probe")} — ask a RUNNING app whether its declared access is enforced
+
+  ${a.bold("access")}    call every guarded procedure with NO credentials and
+            report any that answer anyway
+
+Options
+  --process NAME    target one app by name (default: every live api)
+  --url URL         address a process directly instead of via the local registry
+  --strict          also fail on INCONCLUSIVE (recommended in CI)
+  --format pretty|json
+
+What it does NOT do, stated because the opposite is the natural assumption:
+it probes ANONYMOUSLY, so it cannot tell one scope from another. It answers
+exactly one question — does a procedure that DECLARES a guard admit a caller
+that presents nothing? A guard declared and never bound is the failure it finds.
+
+The target must expose the inspect surface: set ${a.bold("VOLTRO_INSPECT_TOKEN")} on the
+server and in this shell.`);
+}, s = (e) => e.filter((e) => (e.guards ?? []).some((e) => e.kind !== "open")), c = (e) => {
+	if (e.kind === "err") return {
+		verdict: "inconclusive",
+		detail: "transport failure — the app did not answer"
+	};
+	let t = e.status ?? 0;
+	if (t === 401 || t === 403) return {
+		verdict: "refused",
+		detail: `refused (HTTP ${t})`
+	};
+	let n = Array.isArray(e.data) ? e.data : [], r = [], i = !1;
+	for (let e of n) {
+		if (e._tag === "Defect") return {
+			verdict: "inconclusive",
+			detail: `the app answered a defect (${e.defect?.name ?? "Defect"}) — the call never reached the guard`
+		};
+		for (let t of e.values ?? []) if (t._tag === "error") {
+			let e = t.error?._tag;
+			e !== void 0 && r.push(e);
+		} else i = !0;
+	}
+	let a = r.find((e) => e === "ScopeError" || e === "Unauthorized" || e === "AuthError");
+	return a === void 0 ? r.length > 0 ? {
+		verdict: "inconclusive",
+		detail: `answered '${r[0]}' — not an access refusal, so the guard was not reached`
+	} : i ? {
+		verdict: "admitted",
+		detail: "ANSWERED an unauthenticated call"
+	} : {
+		verdict: "inconclusive",
+		detail: n.length === 0 ? `HTTP ${t} with no rpc envelope — the app did not speak the wire protocol` : `HTTP ${t} with no value and no error — nothing to judge`
+	} : {
+		verdict: "refused",
+		detail: `refused (${a})`
+	};
+}, l = 0, u = (e) => ({
+	_tag: "Request",
+	id: String(++l),
+	tag: e,
+	payload: {},
+	headers: []
+}), d = async (e, t) => {
+	let { verdict: n, detail: r } = c(await i(e, "/rpc", {
+		method: "POST",
+		body: u(t.tag),
+		anonymous: !0
+	}));
+	return {
+		tag: t.tag,
+		kind: t.kind,
+		verdict: n,
+		detail: r
+	};
+}, f = (t, n, r, i) => {
+	let o = n.filter((e) => e.verdict === "admitted"), s = n.filter((e) => e.verdict === "inconclusive"), c = n.filter((e) => e.verdict === "refused");
+	if (r === "json") e({
+		app: t,
+		probed: n.length,
+		refused: c.length,
+		admitted: o.length,
+		inconclusive: s.length,
+		results: n
+	});
+	else if (n.length === 0) console.log(`${a.yellow("○")} ${t}: no guarded procedure to probe — every route is openAccess or undecided.`), console.log("  Undecided routes are `voltro check`'s finding, not this one's.");
+	else {
+		console.log(`${a.bold(t)}: probed ${n.length} guarded procedure(s) with NO credentials`);
+		for (let e of o) console.log(`  ${a.red("✗")} ${a.bold(e.tag)} — ${e.detail}`);
+		for (let e of s) console.log(`  ${a.yellow("?")} ${e.tag} — ${e.detail}`);
+		console.log(`  ${a.green("✓")} ${c.length} refused · ${a.yellow(String(s.length))} inconclusive · ${a.red(String(o.length))} admitted`);
+	}
+	return o.length > 0 ? (r !== "json" && console.error(`\n${a.red("A declared guard did not refuse an anonymous caller.")}\n  The declaration and the behaviour disagree — the guard is on the descriptor and
+  nothing enforces it on this path. Check that the procedure is bound through the
+  dispatch spine (not a hand-mounted route), and that its guard list is not empty.`), 1) : i && s.length > 0 ? (r !== "json" && console.error(`\n${a.yellow("--strict:")} ${s.length} procedure(s) could not be judged.\n  Their calls failed before the guard was reached (usually payload validation).
+  That is not evidence of enforcement, so under --strict it is not a pass.`), 1) : 0;
+}, p = async (e) => {
+	let o = t(e);
+	if ("error" in o) return console.error(`voltro probe access: ${o.error}`), 1;
+	let { format: c } = o, { process: l, target: u, rest: p, error: m } = r(o.rest);
+	if (m !== void 0) return console.error(`voltro probe access: ${m}`), 1;
+	let h = p.includes("--strict"), g = await n(l, u);
+	if (g.length === 0) return console.error("voltro probe access: no live api found.\n  This command asks a RUNNING app what it does — there is nothing to ask a source tree.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
+	let _ = 0;
+	for (let e of g) {
+		let t = await i(e, "/_voltro/inspect/manifest");
+		if (t.kind === "err" || t.status < 200 || t.status >= 300) {
+			console.error(`${a.red("✗")} ${e.name}: could not read the manifest — ${t.kind === "err" ? t.error : `HTTP ${t.status}`}`), t.kind === "ok" && t.status === 401 && console.error("  Set VOLTRO_INSPECT_TOKEN on the server and in this shell."), _ = 1;
+			continue;
+		}
+		let n = s(t.data?.procedures ?? []), r = [];
+		for (let t of n) r.push(await d(e, t));
+		_ = Math.max(_, f(e.name, r, c, h));
+	}
+	return _;
+}, m = async (e) => {
+	let [t, ...n] = e;
+	return t === void 0 || t === "--help" || t === "-h" ? (o(), +(t === void 0)) : t === "access" ? p(n) : (console.error(`voltro probe: unknown subcommand "${t}" (expected: access)`), 1);
+};
+//#endregion
+export { m as runProbeCommand };

package/dist/{runtimeTrace-CRxalXTs.js → runtimeTrace-CH3eUiMw.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./apiBuild-DZF_f0_I.js";
+import { n as e } from "./apiBuild-DYD_ONLD.js";
 import { join as t, resolve as n, sep as r } from "node:path";
 import { existsSync as i, promises as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";

package/dist/scheduleCmd-DQRu6BZC.js

@@ -0,0 +1,149 @@
+import { t as e } from "./cliArgs-D4p8n7EE.js";
+import { n as t } from "./cliOutput-D1tSBoRM.js";
+import { n, o as r, r as i, t as a } from "./inspectFetch-EMuhTG_9.js";
+import { ansi as o } from "@voltro/logger";
+//#region src/scheduleCmd.ts
+var s = () => {
+	console.log(`${o.bold("voltro schedule")} — operate on registered schedules
+
+  ${o.bold("run <name>")}        fire the named schedule once, now
+  ${o.bold("backfill <name>")}   fire every occurrence in an explicit range
+                    (boot backfill only walks from the last recorded run, and
+                    cluster cron caps its own catch-up at one day — a longer
+                    outage needs this verb)
+
+Options
+  --process NAME    target one app by name (default: every live api)
+  --trigger manual|external
+                    (run) how the run is recorded (default: manual)
+  --from ISO --to ISO
+                    (backfill) the range, half-open (from, to]
+  --yes             (backfill) confirm a range above the server's threshold
+  --limit N         (backfill) raise the per-request occurrence cap
+  --format pretty|json
+  --url URL         address a process directly instead of via the local registry
+
+Examples
+  voltro schedule run nightly-reconcile
+  voltro schedule backfill nightly-reconcile --from 2026-08-01T00:00:00Z --to 2026-08-05T00:00:00Z
+  voltro schedule backfill hourly-sync --from 2026-08-10T00:00:00Z --to 2026-08-12T00:00:00Z --yes
+
+The target must expose the inspect surface: set ${o.bold("VOLTRO_INSPECT_TOKEN")} on the
+server and in this shell. \`voltro dev\` mints one per project; \`serve\` / \`start\`
+never mint — inspect stays closed until an operator opens it.`);
+}, c = (e, n, r, i) => {
+	if (i === "json") {
+		t({
+			app: e,
+			schedule: n,
+			runId: r
+		});
+		return;
+	}
+	if (r === null) {
+		console.log(`${o.yellow("○")} ${e}: ${o.bold(n)} not started — no run id.\n  Another replica holds the coordination lock, or the previous run is still going and this schedule's onOverlap is 'skip'.`);
+		return;
+	}
+	console.log(`${o.green("✓")} ${e}: ${o.bold(n)} fired — run ${o.bold(r)}`), console.log(`  watch it: voltro inspect schedules --process ${e}`);
+}, l = (e, t) => {
+	let n = e.indexOf(t);
+	if (n === -1) return;
+	let r = e[n + 1];
+	return r !== void 0 && !r.startsWith("--") ? r : void 0;
+}, u = [
+	"--from",
+	"--to",
+	"--limit",
+	"--format",
+	"--process",
+	"--url",
+	"--token"
+], d = async (s) => {
+	let c = e(s, u);
+	if (c === void 0) return console.error("voltro schedule backfill: a schedule name is required — `voltro schedule backfill <name> --from <iso> --to <iso>`"), 1;
+	let d = n(s);
+	if ("error" in d) return console.error(`voltro schedule backfill: ${d.error}`), 1;
+	let { format: f } = d, { process: p, target: m, rest: h, error: g } = i(d.rest);
+	if (g !== void 0) return console.error(`voltro schedule backfill: ${g}`), 1;
+	let _ = l(h, "--from"), v = l(h, "--to");
+	if (_ === void 0 || v === void 0) return console.error("voltro schedule backfill: both --from and --to are required (ISO instants, e.g. 2026-08-01T00:00:00Z)"), 1;
+	let y = l(h, "--limit"), b = y === void 0 ? void 0 : Number(y);
+	if (b !== void 0 && (!Number.isFinite(b) || b <= 0)) return console.error(`voltro schedule backfill: --limit must be a positive number (got ${y})`), 1;
+	let x = h.includes("--yes"), S = await r(p, m);
+	if (S.length === 0) return console.error("voltro schedule backfill: no live api found.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
+	let C = 0;
+	for (let e of S) {
+		let n = await a(e, `/_voltro/inspect/schedules/${encodeURIComponent(c)}/backfill`, {
+			method: "POST",
+			body: {
+				from: _,
+				to: v,
+				confirm: x,
+				...b === void 0 ? {} : { limit: b }
+			}
+		});
+		if (n.kind === "err") {
+			C += 1, console.error(`${o.red("✗")} ${e.name}: ${n.error}`);
+			continue;
+		}
+		let r = n.data;
+		if (n.status === 409 && r?.kind === "refused") {
+			if (C += 1, f === "json") {
+				t({
+					app: e.name,
+					...r
+				});
+				continue;
+			}
+			console.error(`${o.yellow("○")} ${e.name}: refused — ${r.reason}`);
+			continue;
+		}
+		if (n.status < 200 || n.status >= 300) {
+			C += 1;
+			let t = r?.message === void 0 ? r?.error === void 0 ? `HTTP ${n.status}` : String(r.error) : String(r.message);
+			console.error(`${o.red("✗")} ${e.name}: ${t}`), n.status === 401 && console.error("  Set VOLTRO_INSPECT_TOKEN on the server and in this shell.");
+			continue;
+		}
+		if (f === "json") {
+			t({
+				app: e.name,
+				...r
+			});
+			continue;
+		}
+		console.log(`${o.green("✓")} ${e.name}: ${o.bold(c)} backfilled — ${r?.fired ?? 0}/${r?.occurrences ?? 0} firing(s) over ${_} .. ${v}`), console.log(`  review the runs: voltro inspect schedules --process ${e.name}`);
+	}
+	return +(C > 0);
+}, f = async (t) => {
+	let [l, ...f] = t;
+	if (l === void 0 || l === "--help" || l === "-h") return s(), +(l === void 0);
+	if (l === "backfill") return d(f);
+	if (l !== "run") return console.error(`voltro schedule: unknown subcommand "${l}" (expected: run | backfill)`), 1;
+	let p = e(f, u);
+	if (p === void 0) return console.error("voltro schedule run: a schedule name is required — `voltro schedule run <name>`"), 1;
+	let m = n(f);
+	if ("error" in m) return console.error(`voltro schedule run: ${m.error}`), 1;
+	let { format: h } = m, { process: g, target: _, rest: v, error: y } = i(m.rest);
+	if (y !== void 0) return console.error(`voltro schedule run: ${y}`), 1;
+	let b = v[v.indexOf("--trigger") + 1], x = v.includes("--trigger") && b === "external" ? "external" : "manual", S = await r(g, _);
+	if (S.length === 0) return console.error("voltro schedule run: no live api found.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
+	let C = 0;
+	for (let e of S) {
+		let t = await a(e, `/_voltro/inspect/schedules/${encodeURIComponent(p)}/fire?trigger=${x}`, { method: "POST" });
+		if (t.kind === "err") {
+			C += 1, console.error(`${o.red("✗")} ${e.name}: ${t.error}`);
+			continue;
+		}
+		if (t.status < 200 || t.status >= 300) {
+			C += 1;
+			let n = t.data, r = n?.message === void 0 ? n?.error === void 0 ? `HTTP ${t.status}` : String(n.error) : String(n.message);
+			console.error(`${o.red("✗")} ${e.name}: ${r}`), t.status === 401 && console.error("  Set VOLTRO_INSPECT_TOKEN on the server and in this shell."), t.status === 404 && console.error("  A 404 here means the app is older than this endpoint, or it is a web app (schedules are api-only).");
+			continue;
+		}
+		let n = t.data?.runId ?? null;
+		c(e.name, p, n, h);
+	}
+	return +(C > 0);
+};
+//#endregion
+export { f as runScheduleCommand };

package/dist/{sdkgen-CYJscZC7.js → sdkgen-BLkvGRfX.js}

@@ -422,7 +422,7 @@ let package = Package(
 		await l.mkdir(o(e), { recursive: !0 }), await l.writeFile(e, n.content, "utf8");
 	}
 }, X = async (e) => {
-	let { offlineManifest: t } = await import("./checkCommand-YZDmkAGd.js"), { manifest: n } = await t(e);
+	let { offlineManifest: t } = await import("./checkCommand-DKpDLlqu.js"), { manifest: n } = await t(e);
 	return n;
 }, Z = async (e) => {
 	let t = J(await (e.manifestProvider ?? X)(e.root), {

package/dist/{seedRunner-TFHHiToI.js → seedRunner-ZmLSqNe2.js}

@@ -2,15 +2,15 @@ import { n as e } from "./appModuleLoader-C9r9mxZt.js";
 import { promises as t } from "node:fs";
 import { Cause as n, Effect as r } from "effect";
 import { SqlClient as i } from "@effect/sql";
-import { DEFAULT_CDC_CHANNEL as a, VOLTRO_MIGRATION_LOCK_KEY as o, detectReactiveTriggerDrift as s, reactiveTriggerRepairSql as c } from "@voltro/database/sql";
-import { _voltroSeedsTable as l, and as u, eq as d, generateId as f, isSeedDefinition as p, setSchemaChangeSeedHook as m, setTenantCreateSeedHook as h } from "@voltro/database";
-import { defineSchedule as g } from "@voltro/runtime";
-import { createHash as _ } from "node:crypto";
+import { DEFAULT_CDC_CHANNEL as a, detectReactiveTriggerDrift as o, migrationLockKeyForSchema as s, reactiveTriggerRepairSql as c, resolveMigrationLockSchema as l } from "@voltro/database/sql";
+import { _voltroSeedsTable as u, and as d, eq as f, generateId as p, isSeedDefinition as m, setSchemaChangeSeedHook as h, setTenantCreateSeedHook as g } from "@voltro/database";
+import { defineSchedule as _ } from "@voltro/runtime";
+import { createHash as v } from "node:crypto";
 //#region src/reactiveTriggerBoot.ts
-var v = (e, t = process.env) => {
+var y = (e, t = process.env) => {
 	let n = (t.VOLTRO_REACTIVE_TRIGGERS ?? "").trim().toLowerCase(), r = n === "repair" || n === "report" || n === "off" ? n : e ?? "repair";
 	return r === "repair" && t.VOLTRO_AUTO_MIGRATE === "0" ? "report" : r;
-}, y = (e, t, n = a) => r.map(s(e, t, n), (e) => ({
+}, b = (e, t, n = a) => r.map(o(e, t, n), (e) => ({
 	drift: e,
 	statements: c({
 		tables: t,
@@ -18,28 +18,31 @@ var v = (e, t = process.env) => {
 		channel: n,
 		...e
 	})
-})), b = (e, t) => r.gen(function* () {
-	let n = yield* i.SqlClient, { drift: s, statements: c } = yield* y(n, e, t.channel ?? a), l = {
-		missing: s.missing.length,
-		stale: s.stale.length,
+})), x = (e, t) => r.gen(function* () {
+	let n = yield* i.SqlClient, { drift: o, statements: c } = yield* b(n, e, t.channel ?? a), u = {
+		missing: o.missing.length,
+		stale: o.stale.length,
 		statements: c.length
 	};
-	return c.length === 0 ? {
+	if (c.length === 0) return {
 		kind: "clean",
-		...l
-	} : t.mode === "report" ? {
+		...u
+	};
+	if (t.mode === "report") return {
 		kind: "reported",
-		...l
-	} : (yield* n`
-      SELECT pg_try_advisory_lock(${o.toString()}::bigint) AS got`)[0]?.got === !0 ? yield* r.gen(function* () {
+		...u
+	};
+	let d = s(l({ schema: t.lockSchema }));
+	return (yield* n`
+      SELECT pg_try_advisory_lock(${d.toString()}::bigint) AS got`)[0]?.got === !0 ? yield* r.gen(function* () {
 		for (let e of c) yield* n.unsafe(e);
 		return {
 			kind: "repaired",
-			...l
+			...u
 		};
-	}).pipe(r.ensuring(n`SELECT pg_advisory_unlock(${o.toString()}::bigint)`.pipe(r.catchAll(() => r.void)))) : {
+	}).pipe(r.ensuring(n`SELECT pg_advisory_unlock(${d.toString()}::bigint)`.pipe(r.catchAll(() => r.void)))) : {
 		kind: "lock-held",
-		...l
+		...u
 	};
 }).pipe(r.catchAllCause((e) => r.succeed({
 	kind: "failed",
@@ -47,7 +50,7 @@ var v = (e, t = process.env) => {
 	stale: 0,
 	statements: 0,
 	detail: n.pretty(e)
-}))), x = async (e) => {
+}))), S = async (e) => {
 	let t = {
 		kind: "skipped",
 		missing: 0,
@@ -55,9 +58,10 @@ var v = (e, t = process.env) => {
 		statements: 0
 	};
 	if (e.dialectId !== "postgres" || e.mode === "off" || e.tables.length === 0) return t;
-	let n = await e.makeLayer(), i = await r.runPromise(b(e.tables, {
+	let n = await e.makeLayer(), i = await r.runPromise(x(e.tables, {
 		mode: e.mode,
-		...e.channel === void 0 ? {} : { channel: e.channel }
+		...e.channel === void 0 ? {} : { channel: e.channel },
+		...e.lockSchema === void 0 ? {} : { lockSchema: e.lockSchema }
 	}).pipe(r.provide(n))).catch((e) => ({
 		kind: "failed",
 		missing: 0,
@@ -90,7 +94,7 @@ var v = (e, t = process.env) => {
 		default: break;
 	}
 	return i;
-}, S = async (n, r) => {
+}, C = async (n, r) => {
 	let i = [];
 	for (let a of n) {
 		let n;
@@ -100,12 +104,12 @@ var v = (e, t = process.env) => {
 			r.warn("seed: failed to import", { file: a }, e);
 			continue;
 		}
-		let o = (n.default && p(n.default) ? n.default : void 0) ?? Object.values(n).find(p);
+		let o = (n.default && m(n.default) ? n.default : void 0) ?? Object.values(n).find(m);
 		if (!o) {
 			r.warn("seed: no defineSeed export", { file: a });
 			continue;
 		}
-		let s = await t.readFile(a, "utf8").catch(() => ""), c = o.fingerprint ? o.fingerprint({ src: s }) : _("sha256").update(s).digest("hex").slice(0, 16);
+		let s = await t.readFile(a, "utf8").catch(() => ""), c = o.fingerprint ? o.fingerprint({ src: s }) : v("sha256").update(s).digest("hex").slice(0, 16);
 		i.push({
 			file: a,
 			definition: o,
@@ -113,7 +117,7 @@ var v = (e, t = process.env) => {
 		});
 	}
 	return i;
-}, C = (e) => ({
+}, w = (e) => ({
 	query: (t) => e.query({
 		table: t.table,
 		order: t.order ?? [],
@@ -126,14 +130,14 @@ var v = (e, t = process.env) => {
 	insertIgnore: (t, n, r) => e.insertIgnore(t, n, r),
 	update: (t, n, r) => e.update(t, n, r),
 	delete: (t, n) => e.delete(t, n)
-}), w = (e) => async (t, n, r) => {
+}), T = (e) => async (t, n, r) => {
 	let i = Object.keys(n);
 	if (i.length === 0) throw Error("upsertByUnique: matchFields must have at least one key");
 	let a;
 	if (i.length === 1) {
 		let e = i[0];
-		a = d(e, n[e]);
-	} else a = u(...i.map((e) => d(e, n[e])));
+		a = f(e, n[e]);
+	} else a = d(...i.map((e) => f(e, n[e])));
 	let o = (await e.query({
 		table: t,
 		order: [],
@@ -150,30 +154,30 @@ var v = (e, t = process.env) => {
 		row: await e.insert(t, r),
 		created: !0
 	};
-}, T = (e, t) => {
-	let n = w(e);
+}, E = (e, t) => {
+	let n = T(e);
 	return {
-		store: C(e),
+		store: w(e),
 		upsertByUnique: n,
 		progress: (e, n) => t.debug("seed progress", {
 			done: e,
 			total: n
 		})
 	};
-}, E = "_voltro_seeds", D = () => {
-	let e = l.fields.id?.idScheme;
-	return (e ? f(e, E) : null) ?? f({
+}, D = "_voltro_seeds", O = () => {
+	let e = u.fields.id?.idScheme;
+	return (e ? p(e, D) : null) ?? p({
 		kind: "typeid",
 		prefix: "seed"
-	}, E);
-}, O = {
+	}, D);
+}, k = {
 	isUnchanged: () => !1,
 	record: async () => {}
-}, k = (e, t) => `${e.definition.id}${t}`, A = async (e, t, n = "") => {
+}, A = (e, t) => `${e.definition.id}${t}`, j = async (e, t, n = "") => {
 	let r;
 	try {
 		r = await e.query({
-			table: E,
+			table: D,
 			order: [],
 			predicate: void 0,
 			projection: void 0,
@@ -182,19 +186,19 @@ var v = (e, t = process.env) => {
 		});
 	} catch (e) {
 		return t.warn("seeds: ledger unreadable — nothing will be skipped and nothing recorded", {
-			table: E,
+			table: D,
 			error: String(e)
-		}), O;
+		}), k;
 	}
 	let i = new Map(r.map((e) => [e.name, e]));
 	return {
 		isUnchanged: (e) => {
-			let t = i.get(k(e, n));
+			let t = i.get(A(e, n));
 			return t?.lastRunStatus === "succeeded" && t.fingerprint === e.fingerprint;
 		},
 		record: async (r, a) => {
 			let o = {
-				name: k(r, n),
+				name: A(r, n),
 				lifecycle: r.definition.lifecycle,
 				fingerprint: r.fingerprint,
 				lastRunStatus: a.status,
@@ -204,22 +208,22 @@ var v = (e, t = process.env) => {
 				lastError: a.error?.message ?? null
 			};
 			try {
-				let t = i.get(k(r, n));
-				t ? await e.update(E, t.id, o) : await e.insert(E, {
-					id: D(),
+				let t = i.get(A(r, n));
+				t ? await e.update(D, t.id, o) : await e.insert(D, {
+					id: O(),
 					...o
 				});
 			} catch (e) {
 				t.warn("seeds: could not record the ledger row — this seed will re-run on every boot", {
 					seedId: r.definition.id,
-					table: E,
+					table: D,
 					error: String(e)
 				});
 			}
 		}
 	};
-}, j = async (e, t, n) => {
-	let r = Date.now(), i = T(t, n), a = 0;
+}, M = async (e, t, n) => {
+	let r = Date.now(), i = E(t, n), a = 0;
 	for (let t of e.definition.steps) try {
 		let e = await t.body(i);
 		e && typeof e.rowsTouched == "number" && (a += e.rowsTouched);
@@ -246,10 +250,10 @@ var v = (e, t = process.env) => {
 		durationMs: Date.now() - r,
 		rowsTouched: a
 	};
-}, M = async (e, t, n, r = {}) => {
+}, N = async (e, t, n, r = {}) => {
 	let i = e.filter((e) => e.definition.lifecycle === "boot");
 	if (i.length === 0) return [];
-	let a = await A(t, n), o = [], s = 0;
+	let a = await j(t, n), o = [], s = 0;
 	for (let e of i) {
 		if (!r.force && a.isUnchanged(e)) {
 			s++, n.debug(`seed "${e.definition.id}" unchanged — skipped`, { fingerprint: e.fingerprint }), o.push({
@@ -260,7 +264,7 @@ var v = (e, t = process.env) => {
 			});
 			continue;
 		}
-		let i = await j(e, t, n);
+		let i = await M(e, t, n);
 		i.status === "succeeded" && n.info(`seed "${i.seedId}" applied`, {
 			durationMs: i.durationMs,
 			rowsTouched: i.rowsTouched,
@@ -272,19 +276,19 @@ var v = (e, t = process.env) => {
 		skipped: s,
 		...r.force ? { forced: !0 } : {}
 	}), o;
-}, N = async (e, t, n, r) => {
+}, P = async (e, t, n, r) => {
 	let i = e.find((e) => e.definition.id === t);
 	if (!i) throw Error(`seed not found: ${t}`);
-	let a = await j(i, n, r);
-	return await (await A(n, r)).record(i, a), a;
-}, P = async (e, t, n, r) => {
+	let a = await M(i, n, r);
+	return await (await j(n, r)).record(i, a), a;
+}, F = async (e, t, n, r) => {
 	let i = e.filter((e) => e.definition.lifecycle === "onTenantCreate");
 	if (i.length === 0) return [];
 	let a = n.withNamespace?.(t);
 	if (a == null) throw Error(`onTenantCreate seeds (${i.map((e) => e.definition.id).join(", ")}) cannot run for namespace "${t}": this store has no namespace scoping, so the only place to write them would be the SHARED tables — one tenant's fixture in every tenant's data. Refusing. Namespace isolation needs a dialect that has it (postgres schemas, mysql databases, mssql schemas); on a single-namespace deployment declare the seed as \`lifecycle: 'boot'\`.`);
-	let o = await A(n, r, `@${t}`), s = [];
+	let o = await j(n, r, `@${t}`), s = [];
 	for (let e of i) {
-		let n = await j(e, a, r);
+		let n = await M(e, a, r);
 		n.status === "succeeded" && r.info(`seed "${n.seedId}" applied to new tenant namespace`, {
 			namespace: t,
 			durationMs: n.durationMs,
@@ -297,12 +301,12 @@ var v = (e, t = process.env) => {
 		namespace: t,
 		ran: s.length
 	}), s;
-}, F = async (e, t, n, r) => {
+}, I = async (e, t, n, r) => {
 	let i = new Set(t), a = e.filter((e) => e.definition.lifecycle === "onSchemaChange" && (e.definition.watchedTables ?? []).some((e) => i.has(e)));
 	if (a.length === 0) return [];
-	let o = await A(n, r), s = [];
+	let o = await j(n, r), s = [];
 	for (let e of a) {
-		let t = await j(e, n, r);
+		let t = await M(e, n, r);
 		t.status === "succeeded" && r.info(`seed "${t.seedId}" applied after a schema change`, {
 			watchedTables: e.definition.watchedTables,
 			rowsTouched: t.rowsTouched
@@ -310,20 +314,20 @@ var v = (e, t = process.env) => {
 	}
 	let c = s.filter((e) => e.status === "failed");
 	return c.length > 0 && r.warn("one or more onSchemaChange seeds failed (the schema apply itself succeeded)", { failedIds: c.map((e) => e.seedId) }), s;
-}, I = (e, t, n) => (h(async (r) => {
-	await P(e, r.namespace, t, n);
-}), m(async (r) => {
-	await F(e, r.changedTables, t, n);
+}, L = (e, t, n) => (g(async (r) => {
+	await F(e, r.namespace, t, n);
+}), h(async (r) => {
+	await I(e, r.changedTables, t, n);
 }), () => {
-	h(null), m(null);
-}), L = "seed:", R = (e, t, n) => e.filter((e) => e.definition.lifecycle === "cron").map((r) => g({
-	name: `${L}${r.definition.id}`,
+	g(null), h(null);
+}), R = "seed:", z = (e, t, n) => e.filter((e) => e.definition.lifecycle === "cron").map((r) => _({
+	name: `${R}${r.definition.id}`,
 	cron: r.definition.cron ?? "",
 	timezone: r.definition.timezone ?? "UTC",
 	description: `seed "${r.definition.name}" (${r.file})`,
 	handler: async () => {
-		await N(e, r.definition.id, t, n);
+		await P(e, r.definition.id, t, n);
 	}
 }));
 //#endregion
-export { R as a, v as c, N as i, S as n, x as o, M as r, y as s, I as t };
+export { z as a, y as c, P as i, C as n, S as o, N as r, b as s, L as t };

package/dist/serveCommand-CbDHU6l-.js

@@ -0,0 +1,2 @@
+import { n as e } from "./serveCommand-iwlUBNS1.js";
+export { e as runServeDispatch };