@voltro/cli 0.35.0 → 0.36.0

package/CHANGELOG.md

@@ -39,6 +39,74 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.36.0] — 2026-08-13
+
+### ⚠ BREAKING
+
+- **@voltro/integration-http, @voltro/plugin-atlassian** — A 401 from an upstream now produces `code: 'unauthorized'`, not `code: 'session_expired'`. The connection vault's own failure — where we DO know the credential is unusable — becomes `code: 'credential_unusable'`.
+
+  `session_expired` asserted a cause the status cannot support. A 401 says the credential was not accepted and says nothing about why: expired, revoked, insufficient scope and MALFORMED all produce it. A consumer's plugin sent ciphertext as a bearer token (a separate defect, fixed in the same release), the upstream answered 401, this name called it an expired session, and their health check acted on the name and deleted a valid session. Login loop, with every symptom pointing at a revoked credential.
+
+  Names get acted on, which is the whole reason to split them:
+
+  - `'unauthorized'` — the upstream refused. Non-transient, so still never retried; `status` rides along so a caller that knows more about its own upstream can decide for itself. Deciding for them is what this gives up. - `'credential_unusable'` — the connection vault could not produce a credential (no grant, revoked grant, refresh failed). Here the claim is ours to make, because the failure is ours rather than the far end's.
+
+  The 401 message stopped saying "session expired" too. It now says the credential was refused and that the reason is not in the response — which is the honest sentence and the one that would have saved the day this cost.
+
+  Its test asserts the CLAIM rather than banning the word: the first version forbade `/expired/i` and went red against the corrected message, which lists expiry as one of several things a 401 can mean. That distinction is the point of the change, so the assertion had to be about `session expired` specifically.
+
+  **`voltro update` carries you across this** — codemod `0.35.1/01_unauthorized-replaces-session-expired`.
+
+### Added
+
+- **@voltro/web** — **`apiSurface: compatible` — why the three altered golden lines cannot break a caller.** `LoaderContext` and `LoaderFn` each gained a type parameter WITH a default, so an unparameterised reference still resolves. The one that needed proving is `query?`, which went from a written-out signature to `LoaderQuery<Procedures>` — and `LoaderQuery` is a conditional whose false branch is character-for-character the previous signature. `unknown` does not extend `ProcedureTypeMap`, so the defaulted instantiation takes that branch.
+
+  Proved with `tsc` rather than by reading it: a probe asserting mutual assignability between `LoaderQuery<unknown>` and the old signature compiles, and inverting the probe fails — with tsc printing the resolved type as `<T = unknown>(tag: string, input?: Record<string, unknown> | undefined) => Promise<T>`, which is the old signature verbatim.
+
+  `LoaderContext` takes the app's procedure map, so a loader's `query` infers its input and output from the descriptor instead of returning `unknown`.
+
+  ```ts
+  import type { AppProcedures } from '<your-api>/rpcGroup'
+  
+  export const loader = async ({ query }: LoaderContext<AppProcedures>) => {
+    const rows = await query?.('bookmarks.list', { limit: 100 })
+    //    ^ inferred; an unknown tag or a wrong input shape is a compile error
+  }
+  ```
+
+  `AppProcedures` is generated already and has been for a while — it was wired to `createHooks` on the CLIENT and to nothing on the server, so every loader call site spelled its own output type by hand and a typo in a tag compiled. A consumer reported it twice.
+
+  The extraction reuses `ProcedureInput` / `ProcedureOutput` from `@voltro/client` rather than re-deriving them: a second answer to "what does this tag return" drifts the first time a descriptor field is renamed, and both answers look right in isolation.
+
+  Opt-in, and non-breaking: with no map named, the signature is the previous `<T = unknown>(tag: string, …)`. The framework cannot import an app's generated file, which is the same reason `createHooks<AppProcedures>` takes it explicitly.
+
+  Covered by a `.test-d.ts`, because the failure mode is "it compiles when it should not" and no runtime assertion can observe that. Two of its cases exist because the first version was vacuous: an `interface` fixture does not satisfy the map constraint (no implicit index signature — the codegen emits an alias for exactly this reason), so the typed branch fell back silently and every `@ts-expect-error` came back unused.
+
+### Fixed
+
+- **@voltro/cli** — The store a plugin receives through `bindDataStore` now carries the storage codec, so an `.encrypted()` column read through it decrypts.
+
+  A consumer measured both stores inside one request: `ctx.store` gave a 44-character plaintext PAT, and the store their plugin's `credentialsResolver` received gave 113 characters of `enc:v1:…`. Ciphertext is a syntactically valid bearer token, so nothing threw. Jira answered 401, `@voltro/integration-http` named that `session_expired`, their PAT health check did the reasonable thing with that name and deleted the session, and the user got login → dashboard → login forever. A configuration error in the costume of an authentication refusal, where every symptom pointed at the one explanation that was wrong.
+
+  The part worth recording is that `bootStoreCodec.ts` was written for exactly this, after it happened at two other seams, and its header predicts this consumer's symptom verbatim: "a route reading an `.encrypted()` column got the literal string `enc:v1:…` back … the failure reads as 'wrong credential'". The fix was applied per-seam. `bindDataStore` was not one of the seams anybody listed, so it happened a third time — and a per-seam test stayed green throughout, because it covered the two seams somebody remembered.
+
+  `bootStoreHandouts.test.ts` asserts the rule instead: no boot path hands a plugin the raw driver, on either boot path, with the wrapper applied before the handout. The codec needs no Subject — it is how a column is spelled on disk versus in JS — so there was never anything a boot-level store could not carry.
+
+  Also relevant to anyone who followed the 0.28.0 codemod: that codemod told apps to stop carrying a credential on the Subject and look it up in the resolver instead. Doing exactly that is what put an app on this seam, so the instruction and `.encrypted()` were not simultaneously satisfiable through it.
+- **@voltro/runtime, @voltro/cli** — The rpc/WebSocket query and stream arms now resolve row visibility before the executor sees a context. Fixes a 0.35.0 regression that made every read throw for an app with a registered row filter, and the older leak underneath it.
+
+  0.35.0 shipped two things for the row filter: the registration moved to `globalThis` (so a duplicate `@voltro/runtime` instance cannot hide it), and a scoped store built without a resolved scope started throwing instead of silently serving unfiltered rows. The first was a real fix for a real hazard. The second was correct in principle and immediately fatal in practice, because the framework itself had a path that did exactly what it now refuses.
+
+  The consumer who reported the original leak ran the two-line check we asked for and `getRowFilter()` was visible from their request path — so the instance split was NOT their cause, and our hypothesis was wrong. Their measurement is what found the real one: the refusal fired, meaning the registration was FOUND and `ctx.rowFilter` was still undefined at the store. Nothing was missing; a step was.
+
+  Four arms reach a request context. `makeOneShotQueryRunner` (REST) and `makeQuerySubscriber` (SSE) both `await withRowFilter(...)` and say so in a comment. The rpc query handler and the stream handler — each hand-copied into both boot paths — handed the raw request straight through. So a user's executor received a context whose `ctx.store` applied no row filter, on the two arms that carry the most traffic. It survived because subscriptions are refiltered per DELIVERY, which made a descriptor-returning query look correct end to end while the executor's own reads were not.
+
+  `withScopedRequest` is the seam that fixes it once: a request that already carries a scope passes through untouched (resolving twice would run the app's `load` twice per request), an app with NO filter stays fully synchronous, and an app with one gets an Effect — which every one of these call sites already accepts. A boot-path parity test pins both stream arms and the shared producer.
+
+  The refusal also stopped firing for a SYSTEM subject. That is not a softening: `resolveRowFilterScopeFor` returns `NO_ROW_FILTER` for a system subject, so the only correct value was already determined, and several legitimate paths (schedules, resumed workflows, the webhook trigger context) build a context directly with no scope. Demanding a decision there is what took the api down.
+
+---
+
 ## [0.35.0] — 2026-08-13
 
 ### ⚠ BREAKING

package/dist/{apiBuild-DYD_ONLD.js → apiBuild-DiE9zcj6.js}

@@ -1,4 +1,4 @@
-import { f as e } from "./dev-C7sFZq3m.js";
+import { f as e } from "./dev-Dc4cpmRl.js";
 import { ut as t } from "./webDev-Dybxew86.js";
 import { t as n } from "./dialectDriver-CgXnDfec.js";
 import { dirname as r, isAbsolute as i, join as a, relative as o, resolve as s } from "node:path";

package/dist/apiBuild-ZEZnCXn2.js

@@ -0,0 +1,2 @@
+import { c as e, l as t } from "./apiBuild-DiE9zcj6.js";
+export { e as runApiBuild, t as runServeBundleBuild };

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as e } from "./commands-BE8E7zF3.js";
+import { r as e } from "./commands-Bp7utV-7.js";
 import { a as t } from "./nodeEnvironment-cGFAj1J8.js";
 import { t as n } from "./loadEnv-D9nEOClM.js";
 import { n as r } from "./cliError-BmdYnghb.js";

package/dist/{build-CD8K4XOr.js → build-DBe6c7qC.js}

@@ -1,8 +1,8 @@
-import { pn as e } from "./dev-C7sFZq3m.js";
+import { pn as e } from "./dev-Dc4cpmRl.js";
 import { D as t, G as n, K as r, O as i, S as a, W as o, Y as s, a as c, b as l, d as u, f as d, k as f, s as p, st as m, ut as h, v as g, x as _, y as v } from "./webDev-Dybxew86.js";
 import { t as y } from "./cliRuntime-Dh7UDinH.js";
 import { a as b } from "./renderModeScan-D7J1B7Kw.js";
-import { i as x, o as S, s as C } from "./apiBuild-DYD_ONLD.js";
+import { i as x, o as S, s as C } from "./apiBuild-DiE9zcj6.js";
 import { n as w } from "./renderProfile-1OWWAAtx.js";
 import { dirname as T, join as E, resolve as D } from "node:path";
 import { existsSync as O, promises as k } from "node:fs";
@@ -467,7 +467,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 		file: n.file,
 		reason: n.reason
 	});
-	let { regenerateRpcGroup: r } = await import("./codegenCommand-C4YoQIc2.js"), i = await r(e);
+	let { regenerateRpcGroup: r } = await import("./codegenCommand-DH-8ZXzR.js"), i = await r(e);
 	if (i.kind === "refused") {
 		F.warn("could not regenerate the rpc group — building against what is on disk", { reason: i.reason });
 		return;
@@ -479,10 +479,10 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 }, K = async (e) => {
 	let t = await u(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-D2BikO7a.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js"), n = await t(e);
 		if (n) {
 			F.info("building api app", { app: n.name ?? "(unnamed)" }), await G(e);
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-B8aoJvuw.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-ZEZnCXn2.js");
 			await t(e);
 			try {
 				await r(e);
@@ -701,7 +701,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 	return t.ran ? t.exitCode : (yield* j.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), J = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-BLkvGRfX.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-82xVuvbt.js");
 		return e(t);
 	}
 	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await y(q(n), { scope: "voltro:build" }), i = e(n);

package/dist/{checkCommand-DKpDLlqu.js → checkCommand-BTA6P3Yr.js}

@@ -1,2 +1,2 @@
-import { n as e, r as t, t as n } from "./checkCommand-Ct9xkTrS.js";
+import { n as e, r as t, t as n } from "./checkCommand-BhG0gmUD.js";
 export { n as offlineManifest, e as runCheckCommand, t as toInput };

package/dist/{checkCommand-Ct9xkTrS.js → checkCommand-BhG0gmUD.js}

@@ -4,7 +4,7 @@ import { r } from "./appGraph-KGDPTuTy.js";
 import { n as i } from "./cliOutput-D1tSBoRM.js";
 import { n as a, o, r as s, t as c } from "./inspectFetch-EMuhTG_9.js";
 import { r as l } from "./fileTaxonomy-CJfgOllU.js";
-import { x as u } from "./doctorCommand-DnimF5IM.js";
+import { x as u } from "./doctorCommand-CNFtt3nR.js";
 import { resolve as d } from "node:path";
 import { readdirSync as f, statSync as p } from "node:fs";
 //#region src/observedDiff.ts
@@ -141,7 +141,7 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
 }).join("\n"), C = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-D2BikO7a.js"), { buildRpcEntry: i } = await import("./manifestBuild-COkJoyAr.js"), { buildCapabilityManifest: a } = await import("./inspect-P4pxoMaV.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-BSFTgCQ5.js"), { buildRpcEntry: i } = await import("./manifestBuild-COkJoyAr.js"), { buildCapabilityManifest: a } = await import("./inspect-P4pxoMaV.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),

package/dist/{codegenCommand-C4YoQIc2.js → codegenCommand-DH-8ZXzR.js}

@@ -1,4 +1,4 @@
-import { l as e, z as t } from "./dev-C7sFZq3m.js";
+import { l as e, z as t } from "./dev-Dc4cpmRl.js";
 import { r as n } from "./codegen-CYM3Zqrf.js";
 import { basename as r, relative as i, resolve as a } from "node:path";
 //#region src/codegenCommand.ts

package/dist/{codemodRunner-BnFq3Fgu.js → codemodRunner-DjQGrdmg.js}

@@ -5066,7 +5066,21 @@ var x = (e, t, n) => {
 		"",
 		"The read is issued at most once per key per process, off the commit path."
 	].join("\n")
-}), Gr = (e) => /RunStepStatus/.test(e) || /['"]succeeded['"]/.test(e) && /['"]waiting['"]/.test(e) && /RunStep|runStep|flow/i.test(e), q = [
+}), Gr = (e) => /RunStepStatus/.test(e) || /['"]succeeded['"]/.test(e) && /['"]waiting['"]/.test(e) && /RunStep|runStep|flow/i.test(e), Kr = C({
+	version: "0.35.0",
+	id: "0.35.0/04_flow-run-step-skipped",
+	title: "A flow run step can now be 'skipped' — handle it where you render a run timeline",
+	kind: "manual",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Gr(e.getFullText())),
+	note: (/* @__PURE__ */ "A FLOW RUN STEP CAN NOW BE 'skipped'.((`when:` on a flow step gates it on a prior value, and a step whose condition(is false is SKIPPED rather than run. That is a sixth member of(`RunStepStatus`, so an exhaustive switch over it no longer compiles, and a(lookup keyed by status now has a hole.((WHAT TO DO:((1) FIND IT. Anywhere you render or branch on a run step status — a timeline(   component, a status badge map, a progress calculation.((2) DECIDE WHAT A SKIPPED STEP LOOKS LIKE. It is NOT a failure and NOT a(   success: it did not run, on purpose, and it produced no output. The(   step carries `skipReason` — the rendered condition, e.g.(   `{{mode}} equals \"full\"` — so the timeline can say WHY.((3) DO NOT DEFAULT IT TO INVISIBLE. Dropping the row compiles and reads fine(   in review, and it reproduces exactly the problem `skipReason` exists to(   prevent: a step that vanished is indistinguishable from a step nobody(   declared, which is the first thing a user reports as a bug.((A PROGRESS COUNT probably needs a second look too: `succeeded / total` now(under-reports a completed run that skipped a step. Counting(`succeeded + skipped` against the total is usually what was meant.((If your app does not render a flow timeline, there is nothing to do — this(note fires on any file that names the status type or its literals.".split("(")).join("\n")
+}), qr = C({
+	version: "0.35.0",
+	id: "0.35.0/05_declared-schema-drops-runtime-flags",
+	title: "The declared schema no longer reads `CDC` / `VOLTRO_UNDO` / `VOLTRO_TRACING_PERSIST`",
+	kind: "manual",
+	appliesTo: () => !0,
+	note: (/* @__PURE__ */ "The set of framework tables your app DECLARES is hashed into the schema(fingerprint. A pre-deploy `voltro db apply` records that hash; every serving(container recomputes it and refuses to boot if it differs. Until this release(three RUNTIME flags fed into that set:((    CDC=0                       removed `_voltro_cdc_offsets`(    VOLTRO_UNDO=on              added   `_voltro_undo_log`(    VOLTRO_TRACING_PERSIST=all  added   `_voltro_traces`((All three read as pure runtime knobs, so they tend to live on the PODS and(not on the pre-upgrade migrate Job — which is a green migrate followed by(every pod in CrashLoopBackOff. This was reported against a Helm deployment(where `CDC: \"0\"` was in all three overlays' pod blocks and none of their(jobs; it had been latent for months and would have fired on the next deploy.((WHAT YOU MUST DO — only if you set one of these to turn a table ON in(production:((  * `VOLTRO_UNDO=on` in production  → add to app.config.ts:(        export default { schema: { undo: true }, … }(  * `VOLTRO_TRACING_PERSIST` keeping trace history in production → add:(        export default { schema: { traces: true }, … }((    Without the declaration, `voltro serve` now REFUSES to boot and names the(    field. That refusal is the point: before, the same configuration either(    wrote to a table nobody created or produced a fingerprint the migrate job(    could not reproduce.((    Turning capture OFF still needs no declaration and never will — a declared(    table nobody writes to is harmless. Only turning it ON is a schema claim.((WHAT HAPPENS WITHOUT ANY ACTION:((  * On mariadb or mssql you will see ONE additive `create-table` in your next(    plan: `_voltro_cdc_offsets` is now declared by the DIALECT rather than by(    `CDC`, so it exists whether or not that process drives CDC. It is an(    offsets table — a handful of rows — and the alternative was leaving a(    runtime flag able to split your fleet.(  * On postgres/sqlite nothing changes: those dialects have no offsets table.((AND ONE THING WORTH DOING ANYWAY: if you are upgrading a deployment that has(a separate migrate job, diff that job's `env:` against your pods' once. The(framework can now guarantee its OWN tables do not depend on a runtime flag;(it cannot make the same guarantee for a plugin's `extendSchema.tables`, which(is app code and may read anything. A `prod-mismatch` refusal now prints which(tables this process decided and from which input, so the comparison is quick.".split("(")).join("\n")
+}), q = "session_expired", J = [
 	ge,
 	_e,
 	ye,
@@ -5165,23 +5179,26 @@ var x = (e, t, n) => {
 	Ir,
 	Hr,
 	Wr,
+	Kr,
+	qr,
 	C({
-		version: "0.35.0",
-		id: "0.35.0/04_flow-run-step-skipped",
-		title: "A flow run step can now be 'skipped' — handle it where you render a run timeline",
-		kind: "manual",
-		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => Gr(e.getFullText())),
-		note: (/* @__PURE__ */ "A FLOW RUN STEP CAN NOW BE 'skipped'.((`when:` on a flow step gates it on a prior value, and a step whose condition(is false is SKIPPED rather than run. That is a sixth member of(`RunStepStatus`, so an exhaustive switch over it no longer compiles, and a(lookup keyed by status now has a hole.((WHAT TO DO:((1) FIND IT. Anywhere you render or branch on a run step status — a timeline(   component, a status badge map, a progress calculation.((2) DECIDE WHAT A SKIPPED STEP LOOKS LIKE. It is NOT a failure and NOT a(   success: it did not run, on purpose, and it produced no output. The(   step carries `skipReason` — the rendered condition, e.g.(   `{{mode}} equals \"full\"` — so the timeline can say WHY.((3) DO NOT DEFAULT IT TO INVISIBLE. Dropping the row compiles and reads fine(   in review, and it reproduces exactly the problem `skipReason` exists to(   prevent: a step that vanished is indistinguishable from a step nobody(   declared, which is the first thing a user reports as a bug.((A PROGRESS COUNT probably needs a second look too: `succeeded / total` now(under-reports a completed run that skipped a step. Counting(`succeeded + skipped` against the total is usually what was meant.((If your app does not render a flow timeline, there is nothing to do — this(note fires on any file that names the status type or its literals.".split("(")).join("\n")
-	}),
-	C({
-		version: "0.35.0",
-		id: "0.35.0/05_declared-schema-drops-runtime-flags",
-		title: "The declared schema no longer reads `CDC` / `VOLTRO_UNDO` / `VOLTRO_TRACING_PERSIST`",
-		kind: "manual",
-		appliesTo: () => !0,
-		note: (/* @__PURE__ */ "The set of framework tables your app DECLARES is hashed into the schema(fingerprint. A pre-deploy `voltro db apply` records that hash; every serving(container recomputes it and refuses to boot if it differs. Until this release(three RUNTIME flags fed into that set:((    CDC=0                       removed `_voltro_cdc_offsets`(    VOLTRO_UNDO=on              added   `_voltro_undo_log`(    VOLTRO_TRACING_PERSIST=all  added   `_voltro_traces`((All three read as pure runtime knobs, so they tend to live on the PODS and(not on the pre-upgrade migrate Job — which is a green migrate followed by(every pod in CrashLoopBackOff. This was reported against a Helm deployment(where `CDC: \"0\"` was in all three overlays' pod blocks and none of their(jobs; it had been latent for months and would have fired on the next deploy.((WHAT YOU MUST DO — only if you set one of these to turn a table ON in(production:((  * `VOLTRO_UNDO=on` in production  → add to app.config.ts:(        export default { schema: { undo: true }, … }(  * `VOLTRO_TRACING_PERSIST` keeping trace history in production → add:(        export default { schema: { traces: true }, … }((    Without the declaration, `voltro serve` now REFUSES to boot and names the(    field. That refusal is the point: before, the same configuration either(    wrote to a table nobody created or produced a fingerprint the migrate job(    could not reproduce.((    Turning capture OFF still needs no declaration and never will — a declared(    table nobody writes to is harmless. Only turning it ON is a schema claim.((WHAT HAPPENS WITHOUT ANY ACTION:((  * On mariadb or mssql you will see ONE additive `create-table` in your next(    plan: `_voltro_cdc_offsets` is now declared by the DIALECT rather than by(    `CDC`, so it exists whether or not that process drives CDC. It is an(    offsets table — a handful of rows — and the alternative was leaving a(    runtime flag able to split your fleet.(  * On postgres/sqlite nothing changes: those dialects have no offsets table.((AND ONE THING WORTH DOING ANYWAY: if you are upgrading a deployment that has(a separate migrate job, diff that job's `env:` against your pods' once. The(framework can now guarantee its OWN tables do not depend on a runtime flag;(it cannot make the same guarantee for a plugin's `extendSchema.tables`, which(is app code and may read anything. A `prod-mismatch` refusal now prints which(tables this process decided and from which input, so the comparison is quick.".split("(")).join("\n")
+		version: "0.35.1",
+		id: "0.35.1/01_unauthorized-replaces-session-expired",
+		title: "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
+		kind: "transform",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes(q)),
+		transform: ({ project: e, log: t }) => {
+			let n = [];
+			for (let t of e.getSourceFiles()) {
+				if (!t.getFullText().includes(q)) continue;
+				let e = !1;
+				for (let n of t.getDescendantsOfKind(11)) n.getLiteralValue() === q && (n.setLiteralValue("unauthorized"), e = !0);
+				e && n.push(t.getFilePath());
+			}
+			n.length !== 0 && t(`rewrote '${q}' to 'unauthorized' in ${n.length} file(s).\n  A 401 now means only "the credential was refused" — expired, revoked, wrong\n  scope and MALFORMED all produce that status, and the old name asserted the\n  first one. If a rewritten branch was meant to catch a credential your\n  CONNECTION VAULT could not produce (no grant, revoked grant, failed refresh),\n  change it to 'credential_unusable' — that is the code the vault raises, and it\n  is the one where re-auth is genuinely the right action.\n  A health check that logs the user out on this code should read 'unauthorized'\n  as "ask again", not as "the session is gone".\n` + n.map((e) => `    ${e}`).join("\n"));
+		}
 	})
-], J = /* @__PURE__ */ new Set([
+], Y = /* @__PURE__ */ new Set([
 	"node_modules",
 	".git",
 	"dist",
@@ -5193,12 +5210,12 @@ var x = (e, t, n) => {
 	".turbo",
 	".cache",
 	".output"
-]), Kr = () => [...[...J].map((e) => `**/${e}/**`), "**/.voltro-*/**"], Y = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, X = /\.(?:tsx?|jsx?|mjs|cjs)$/, qr = (e) => m(e).replace(X, ""), Jr = (e) => {
+]), Jr = () => [...[...Y].map((e) => `**/${e}/**`), "**/.voltro-*/**"], X = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, Z = /\.(?:tsx?|jsx?|mjs|cjs)$/, Yr = (e) => m(e).replace(Z, ""), Xr = (e) => {
 	let t = e.split("/").filter((e) => e.length > 0).pop();
 	if (t === void 0 || t === "." || t === "..") return;
-	let n = t.replace(X, "");
+	let n = t.replace(Z, "");
 	return n.length > 0 ? n : void 0;
-}, Yr = (e) => {
+}, Zr = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e;
@@ -5207,57 +5224,57 @@ var x = (e, t, n) => {
 		} catch {
 			continue;
 		}
-		Y.lastIndex = 0;
-		for (let r = Y.exec(e); r !== null; r = Y.exec(e)) {
-			let e = Jr(r[1] ?? r[2] ?? "");
+		X.lastIndex = 0;
+		for (let r = X.exec(e); r !== null; r = X.exec(e)) {
+			let e = Xr(r[1] ?? r[2] ?? "");
 			if (e === void 0) continue;
 			let i = t.get(e);
 			i === void 0 ? t.set(e, /* @__PURE__ */ new Set([n])) : i.add(n);
 		}
 	}
 	return t;
-}, Xr = (e, t) => {
+}, Qr = (e, t) => {
 	let n = new Set(e);
-	for (let r of e) for (let e of [qr(r), m(h(r))]) {
+	for (let r of e) for (let e of [Yr(r), m(h(r))]) {
 		let r = t.get(e);
 		if (r !== void 0) for (let e of r) n.add(e);
 	}
 	return n;
-}, Zr = [
+}, $r = [
 	"**/*.ts",
 	"**/*.tsx",
 	"!**/node_modules/**",
 	"!**/dist/**",
 	"!**/.framework/**",
 	"!**/*.d.ts"
-], Z = (e, t, n = ei) => {
+], Q = (e, t, n = ni) => {
 	let r = /* @__PURE__ */ new Set();
-	for (let e of t) for (let t of e.scope ?? Zr) r.add(t);
+	for (let e of t) for (let t of e.scope ?? $r) r.add(t);
 	let i = n(e);
 	if (i !== void 0) {
-		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => $r(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => $r(e.slice(1))), a = [...J], o = [];
+		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => ti(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => ti(e.slice(1))), a = [...Y], o = [];
 		for (let r of i) {
 			if (a.some((e) => r === e || r.startsWith(`${e}/`) || r.includes(`/${e}/`)) || !t.some((e) => e(r)) || n.some((e) => e(r))) continue;
 			let i = g(e, r);
 			v(i) && o.push(i);
 		}
-		return Qr(o.length, e), o;
+		return ei(o.length, e), o;
 	}
 	let a = oe([...r], {
 		cwd: e,
 		absolute: !0,
 		expandDirectories: !1,
 		followSymbolicLinks: !1,
-		ignore: [...Kr()]
+		ignore: [...Jr()]
 	});
-	return Qr(a.length, e), a;
-}, Qr = (e, t) => {
-	let n = ti();
+	return ei(a.length, e), a;
+}, ei = (e, t) => {
+	let n = ri();
 	if (!(e <= n)) throw Error(`voltro update: the codemod scan matched ${e} files under ${t}, past the ${n} ceiling.\n  Every matched file is parsed into one ts-morph project, so the heap needed grows with\n  this number — past the ceiling it runs out of memory, and V8 aborts without naming a\n  limit, which is why this stops here instead. Three ways out, in order:\n    • put non-source directories in .gitignore (inside a git repo the scan then never\n      sees them at all — a build cache, a data dump, a virtualenv),\n    • run \`voltro update\` from the app directory rather than the workspace root, or\n    • take one codemod at a time: \`voltro update --dry-run\` lists the ids, then\n      \`voltro update --codemods-only --only <id>\` runs a single one.\n  If every one of those files really is source this pass must rewrite, raise the ceiling\n  with VOLTRO_CODEMOD_MAX_FILES and give node room: NODE_OPTIONS=--max-old-space-size=8192.`);
-}, $r = (e) => {
+}, ti = (e) => {
 	let t = e.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*").replace(/\u0000/g, "(?:.*/)?").replace(/\\\{([^}]*)\\\}/g, (e, t) => `(?:${t.split(",").join("|")})`);
 	return (e) => RegExp(`^${t}$`).test(e);
-}, ei = (e) => {
+}, ni = (e) => {
 	try {
 		let t = re("git", [
 			"ls-files",
@@ -5278,17 +5295,17 @@ var x = (e, t, n) => {
 	} catch {
 		return;
 	}
-}, ti = () => {
+}, ri = () => {
 	let e = Number(process.env.VOLTRO_CODEMOD_MAX_FILES);
 	return Number.isInteger(e) && e > 0 ? e : 2e4;
-}, Q = (e, t) => {
+}, $ = (e, t) => {
 	let n = e.split(".").map(Number), r = t.split(".").map(Number);
 	for (let e = 0; e < 3; e++) {
 		let t = (n[e] ?? 0) - (r[e] ?? 0);
 		if (t !== 0) return t;
 	}
 	return 0;
-}, ni = (e, t, n = q) => n.filter((n) => Q(e, n.version) < 0 && Q(n.version, t) <= 0).slice().sort(he), $ = (e, t, n = () => {}) => {
+}, ii = (e, t, n = J) => n.filter((n) => $(e, n.version) < 0 && $(n.version, t) <= 0).slice().sort(he), ai = (e, t, n = () => {}) => {
 	let r = [], i = [], a = [];
 	for (let o of t) {
 		if (!(!o.appliesTo || o.appliesTo({ project: e }))) {
@@ -5334,8 +5351,8 @@ var x = (e, t, n) => {
 		manual: i,
 		skipped: a
 	};
-}, ri = async (e) => {
-	let t = e.log ?? (() => {}), n = ni(e.from, e.to, e.codemods ?? q), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
+}, oi = async (e) => {
+	let t = e.log ?? (() => {}), n = ii(e.from, e.to, e.codemods ?? J), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
 		let t = n.filter((t) => e.only.includes(t.id)), r = e.only.filter((e) => !n.some((t) => t.id === e));
 		if (r.length > 0) throw Error(`voltro update --only: no codemod in ${e.from} → ${e.to} has id ${r.map((e) => `"${e}"`).join(", ")}.\n  Available for this jump:\n${n.map((e) => `    ${e.id}`).join("\n")}`);
 		return t;
@@ -5354,15 +5371,15 @@ var x = (e, t, n) => {
 			baseUrl: i.baseUrl,
 			paths: i.paths
 		} }
-	}), o, s = Z(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? Yr(Z(e.root, [{
+	}), o, s = Q(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? Zr(Q(e.root, [{
 		...c[0],
-		scope: Zr
+		scope: $r
 	}])) : void 0;
 	for (let n of r) {
 		if (c.includes(n)) {
-			let r = a(), i = Z(e.root, [n]);
-			for (let e of Xr(i, p)) v(e) && r.addSourceFileAtPath(e);
-			let s = $(r, [n], t);
+			let r = a(), i = Q(e.root, [n]);
+			for (let e of Qr(i, p)) v(e) && r.addSourceFileAtPath(e);
+			let s = ai(r, [n], t);
 			e.dryRun || await r.save(), l.push(...s.applied), u.push(...s.manual), d.push(...s.skipped), o = void 0;
 			continue;
 		}
@@ -5371,7 +5388,7 @@ var x = (e, t, n) => {
 			for (let t of s) v(t) && e.addSourceFileAtPath(t);
 			return e;
 		})();
-		let r = $(o, [n], t);
+		let r = ai(o, [n], t);
 		e.dryRun || await o.save(), l.push(...r.applied), u.push(...r.manual), d.push(...r.skipped);
 	}
 	return {
@@ -5381,4 +5398,4 @@ var x = (e, t, n) => {
 	};
 };
 //#endregion
-export { C as i, ri as n, J as r, Q as t };
+export { C as i, oi as n, Y as r, $ as t };

package/dist/{commands-BE8E7zF3.js → commands-Bp7utV-7.js}

@@ -90,7 +90,7 @@ var a = () => {
 		name: "dev",
 		summary: "Start the local development server (auto-discovers routes / mutations).",
 		status: "wired",
-		run: (e) => import("./dev-D2BikO7a.js").then((t) => t.runDev(e)),
+		run: (e) => import("./dev-BSFTgCQ5.js").then((t) => t.runDev(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro dev", "boot the app in the current directory"], ["voltro dev apps/acme/api", "boot a specific app"]],
@@ -108,7 +108,7 @@ var a = () => {
 		name: "dashboard",
 		summary: "Serve the DevTools dashboard standalone (from @voltro/dashboard). Targets via VOLTRO_DASHBOARD_APPS; --port to override.",
 		status: "wired",
-		run: (e) => import("./dashboardCommand-D7SgZGaN.js").then((t) => t.runDashboardCommand(e)),
+		run: (e) => import("./dashboardCommand-D5Jwjmr1.js").then((t) => t.runDashboardCommand(e)),
 		help: {
 			usage: "[--port <n>]",
 			flags: [["--port <n>", "port to serve the dashboard on"]],
@@ -120,7 +120,7 @@ var a = () => {
 		name: "check",
 		summary: "Verify the app graph (blast-radius checks) against a running api; LLM-shaped --json diagnostics. Flags: --json, --process <p>, --diff removeTable:<name>.",
 		status: "wired",
-		run: (e) => import("./checkCommand-DKpDLlqu.js").then((t) => t.runCheckCommand(e)),
+		run: (e) => import("./checkCommand-BTA6P3Yr.js").then((t) => t.runCheckCommand(e)),
 		help: {
 			usage: "[--json] [--offline] [--process <name>] [--diff removeTable:<name>]",
 			flags: [
@@ -154,7 +154,7 @@ var a = () => {
 		name: "webhooks",
 		summary: "Outbound-webhook artefacts. `consumer` generates the ZERO-DEPENDENCY Standard-Webhooks verification package a subscriber installs, from this app's own declared events; `events` lists the events a subscriber can register for. Usage: voltro webhooks <consumer|events> [path] [--out <dir>] [--name <pkg>] [--json].",
 		status: "wired",
-		run: (e) => import("./webhooksCommand-DlAgS2Iw.js").then((t) => t.runWebhooksCommand(e)),
+		run: (e) => import("./webhooksCommand-di1CJVzu.js").then((t) => t.runWebhooksCommand(e)),
 		help: {
 			usage: "<consumer|events> [path] [--out <dir>] [--name <pkg>] [--json]",
 			flags: [
@@ -170,7 +170,7 @@ var a = () => {
 		name: "evolve",
 		summary: "Schema-evolution copilot: propose an observed-graph-driven codemod + a branch-verified backfill for a schema change (rename/retype/split/drop a column, rename a table). Dry-run by default; --write applies. Usage: voltro evolve rename-column <table>.<col> --to <newName> [--write] [--json].",
 		status: "wired",
-		run: (e) => import("./evolveCommand-CHsLCtDf.js").then((t) => t.runEvolveCommand(e)),
+		run: (e) => import("./evolveCommand-iU35TPjT.js").then((t) => t.runEvolveCommand(e)),
 		help: {
 			usage: "<rename-column|rename-table|retype-column|split-column|drop-column> <target> [--to <new>] [--write]",
 			flags: [
@@ -187,7 +187,7 @@ var a = () => {
 		name: "codegen",
 		summary: "Emit rpcGroup.generated.ts from discovered route / mutation descriptors.",
 		status: "wired",
-		run: (e) => import("./codegenCommand-C4YoQIc2.js").then((t) => t.runCodegenCommand(e)),
+		run: (e) => import("./codegenCommand-DH-8ZXzR.js").then((t) => t.runCodegenCommand(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro codegen", "regenerate rpcGroup.generated.ts for the app in the cwd"]],
@@ -258,7 +258,7 @@ var a = () => {
 		name: "info",
 		summary: "Report versions (CLI, node, every installed @voltro/* — flags lockstep skew), package manager, and dialect. --json for CI. Exits 1 on version skew.",
 		status: "wired",
-		run: (e) => import("./infoCommand-DwOgK1t6.js").then((t) => t.runInfoCommand(e)),
+		run: (e) => import("./infoCommand-unqisJGp.js").then((t) => t.runInfoCommand(e)),
 		help: {
 			usage: "[--json]",
 			flags: [["--json", "machine-readable report"]],
@@ -279,7 +279,7 @@ var a = () => {
 		name: "env",
 		summary: "Inspect/sync the typed-env manifest. Subcommands: check (default), sync (.env.example), types (env.generated.d.ts for CI tsc), turbo.",
 		status: "wired",
-		run: (e) => import("./envCommand-CCGPRQY1.js").then((t) => t.runEnvCommand(e)),
+		run: (e) => import("./envCommand-TZzcyqZ-.js").then((t) => t.runEnvCommand(e)),
 		help: {
 			usage: "[check|sync|types|turbo] [--force]",
 			flags: [["--force", "overwrite the generated file instead of refusing on a conflict"]],
@@ -308,12 +308,12 @@ var a = () => {
 		run: async (e) => {
 			let t = e.find((e) => !e.startsWith("-")) ?? process.cwd();
 			if (e.includes("--preflight")) {
-				let { runServePreflight: e } = await import("./doctorCommand-CM4Ch9C7.js");
+				let { runServePreflight: e } = await import("./doctorCommand-BYffQc0s.js");
 				return e(n(t), !0);
 			}
 			let { tryRunWebServe: r } = await import("./webDev-BcykISYQ2.js"), i = await r(n(t));
 			if (!i.ran) {
-				let { runServeDispatch: t } = await import("./serveCommand-CbDHU6l-.js");
+				let { runServeDispatch: t } = await import("./serveCommand-CEBVP36A.js");
 				return t(e);
 			}
 			return i.exitCode;
@@ -341,13 +341,13 @@ var a = () => {
 		handlesHelp: !0,
 		summary: "Preflight an app for production: the precompiled serve bundle, hand-rolled primitives (naming the shipped one), @voltro/* version skew, executors with no access check, `.serverOnly()` leaks, and junction-FK gaps.",
 		status: "wired",
-		run: (e) => import("./doctorCommand-CM4Ch9C7.js").then((t) => t.runDoctorCommand(e))
+		run: (e) => import("./doctorCommand-BYffQc0s.js").then((t) => t.runDoctorCommand(e))
 	},
 	{
 		name: "build",
 		summary: "Production build for a web app (vite build + per-page SSG pre-render).",
 		status: "wired",
-		run: (e) => import("./build-CD8K4XOr.js").then((t) => t.runBuildCommand(e)),
+		run: (e) => import("./build-DBe6c7qC.js").then((t) => t.runBuildCommand(e)),
 		help: {
 			usage: "[app] [--target <t>]",
 			flags: [["--target <t>", "build target"]],
@@ -363,7 +363,7 @@ var a = () => {
 		name: "prune-runtime",
 		summary: "Trim a deployed web tree’s node_modules to the reachable runtime set (standalone image slimming).",
 		status: "wired",
-		run: (e) => import("./runtimeTrace-CH3eUiMw.js").then((t) => t.runPruneRuntimeCommand(e)),
+		run: (e) => import("./runtimeTrace-D5LJ_N55.js").then((t) => t.runPruneRuntimeCommand(e)),
 		hidden: !0
 	},
 	{
@@ -381,7 +381,7 @@ var a = () => {
 		name: "dormancy",
 		summary: "Single-node scale-to-zero: front the API with a wake-orchestrator that stops the app when idle and brings it back on a request or a due wakeup (cron/workflow). Needs a SQL store. Flags: --port, --app-port, --idle-grace-ms, --tick-ms.",
 		status: "wired",
-		run: (e) => import("./dormancyCommand-QewYug_s.js").then((t) => t.runDormancyCommand(e)),
+		run: (e) => import("./dormancyCommand-6F6NsJKf.js").then((t) => t.runDormancyCommand(e)),
 		help: {
 			usage: "[app] [--port <n>] [--app-port <n>] [--idle-grace-ms <n>] [--tick-ms <n>]",
 			flags: [
@@ -468,7 +468,7 @@ var a = () => {
 		name: "data",
 		summary: "Export/import + backup/restore of app data. Logical (rows + optional assets): export <dir> [--tenant <id>|--tables a,b] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot]; import <dir> [--assets] [--no-verify]. Native (rows ONLY — no blobs): backup <dir> / restore <dir> (pg_dump/mariadb-dump/…). Resumable; typed-NDJSON; content-addressed assets on the logical path.",
 		status: "wired",
-		run: (e) => import("./dataCommand-BhYwDgg-.js").then((t) => t.runDataCommand(e)),
+		run: (e) => import("./dataCommand-DnCm0B2C.js").then((t) => t.runDataCommand(e)),
 		help: {
 			usage: "<export|import|backup|restore> <dir> [options]",
 			flags: [
@@ -523,20 +523,20 @@ var a = () => {
 		handlesHelp: !0,
 		summary: "Upgrade the app to the latest framework: bump every @voltro/* dependency (across ALL workspace members, install once at the workspace root), then run the codemods shipped with the target version. Flags: --to <version>, --from <version>, --codemods-only, --dry-run, --force, --exact, --help. After: run `voltro db apply`.",
 		status: "wired",
-		run: (e) => import("./updateCommand-BlMZhWgO.js").then((t) => t.runUpdateCommand(e))
+		run: (e) => import("./updateCommand-CSBXVsYq.js").then((t) => t.runUpdateCommand(e))
 	},
 	{
 		name: "_apply-codemods",
 		summary: "Internal: apply shipped codemods for a framework version jump (re-exec target of `voltro update`).",
 		status: "wired",
 		hidden: !0,
-		run: (e) => import("./updateCommand-BlMZhWgO.js").then((t) => t.runApplyCodemods(e))
+		run: (e) => import("./updateCommand-CSBXVsYq.js").then((t) => t.runApplyCodemods(e))
 	},
 	{
 		name: "embeddings",
 		summary: "Embeddings tooling. Subcommand: backfill <table> --text <field> --vector <field> [--model <m>] [--model-field <f>] [--batch <n>] [--dry-run] — (re)embed rows the vectorEmbedding() mixin missed.",
 		status: "wired",
-		run: (e) => import("./embeddingsCommand-BfiLS_QI.js").then((t) => t.runEmbeddingsCommand(e)),
+		run: (e) => import("./embeddingsCommand-DRRdneJD.js").then((t) => t.runEmbeddingsCommand(e)),
 		help: {
 			usage: "backfill <table> --text <field> --vector <field> [--model <m>] [--batch <n>] [--dry-run]",
 			flags: [

package/dist/{dashboardCommand-D7SgZGaN.js → dashboardCommand-D5Jwjmr1.js}

@@ -1,4 +1,4 @@
-import { d as e } from "./dev-C7sFZq3m.js";
+import { d as e } from "./dev-Dc4cpmRl.js";
 import { P as t, j as n } from "./webDev-Dybxew86.js";
 import { t as r } from "./start-T4VesWiM.js";
 import { join as i } from "node:path";

package/dist/{dataCommand-BhYwDgg-.js → dataCommand-DnCm0B2C.js}

@@ -1,5 +1,5 @@
 import { t as e } from "./cliError-BmdYnghb.js";
-import { c as t, i as n, o as r } from "./dev-C7sFZq3m.js";
+import { c as t, i as n, o as r } from "./dev-Dc4cpmRl.js";
 import { n as i, t as a } from "./cliArgs-D4p8n7EE.js";
 import { r as o } from "./dialectDriver-CgXnDfec.js";
 import { t as s } from "./dataProfile-dW-PsfLB.js";

package/dist/{dev-D2BikO7a.js → dev-BSFTgCQ5.js}

@@ -1,3 +1,3 @@
-import { c as e, d as t, f as n, i as r, u as i } from "./dev-C7sFZq3m.js";
+import { c as e, d as t, f as n, i as r, u as i } from "./dev-Dc4cpmRl.js";
 import "./dialectDriver-CgXnDfec.js";
 export { r as buildStore, e as loadApiConfig, i as loadDiscovered, t as runDev, n as walk };