@voltro/cli 0.47.0 → 0.49.0

package/dist/dataProfile-Du3ztYxv.js

@@ -0,0 +1,51 @@
+import { DATA_TRANSFERS_TABLE as e } from "@voltro/database";
+//#region src/importRunStatus.ts
+var t = async (t, n) => {
+	let r = (await t.query({
+		table: e,
+		predicate: {
+			column: "id",
+			op: "eq",
+			value: n
+		},
+		order: [],
+		take: 1,
+		skip: 0,
+		projection: void 0
+	}).catch(() => []))[0];
+	return r === void 0 ? null : {
+		...r,
+		startedAt: new Date(r.startedAt),
+		finishedAt: r.finishedAt === null || r.finishedAt === void 0 ? null : new Date(r.finishedAt)
+	};
+}, n = (e) => {
+	if (e !== null) return e.failure !== null && e.failure !== void 0 && String(e.failure) !== "" ? "failed" : e.finishedAt === null ? void 0 : "ok";
+}, r = (e) => {
+	let t = n(e);
+	return t === "ok" ? 0 : t === "failed" ? 1 : 2;
+}, i = (e) => e === null ? "  waiting — no record visible yet (the instance may still be opening the bundle)" : e.failure !== null && e.failure !== void 0 && String(e.failure) !== "" ? `  FAILED — ${String(e.failure)}` : e.finishedAt === null ? `  importing — ${e.rowsWritten} row(s) across ${e.tablesWritten} table(s)` + (e.staged === !0 ? " (staged; the target still holds its own rows)" : "") : `  done — ${e.rowsWritten} row(s) across ${e.tablesWritten} table(s)`, a = async (e) => {
+	let t = e.intervalMs ?? 1e3, r = Date.now() + (e.timeoutMs ?? 864e5), i = e.notFoundGraceMs ?? 3e4, a = e.sleep ?? ((e) => new Promise((t) => {
+		setTimeout(t, e);
+	})), o = Date.now(), s = !1, c = null;
+	for (;;) {
+		if (c = await e.read(), c !== null && (s = !0), e.onTick?.(c), n(c) !== void 0 || Date.now() >= r) return c;
+		if (!s && Date.now() - o >= i) return null;
+		await a(t);
+	}
+}, o = /^[A-Za-z0-9_-]{1,64}$/, s = async (e, t = {}) => {
+	let { resolve: n, sep: r } = await import("node:path"), { existsSync: i } = await import("node:fs"), a = n(process.cwd(), "data-profiles"), s = t.allowPath === !0 ? [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => n(process.cwd(), e)) : o.test(e) ? [n(a, `${e}.ts`), n(a, `${e}.profile.ts`)] : [];
+	if (t.allowPath !== !0 && s.length === 0) throw Error(`data profile '${e}' is not a valid profile name. A profile is named, not pathed: use letters, digits, \`_\` or \`-\` only, and put the file in \`data-profiles/\`.`);
+	let c = s.find((e) => i(e));
+	if (!c) throw Error(`data profile '${e}' not found (looked for: ${s.join(", ")})`);
+	if (t.allowPath !== !0 && !c.startsWith(a + r)) throw Error(`data profile '${e}' resolved outside data-profiles/ — refusing to load it`);
+	let l = await import(c), u = l.default ?? l.profile;
+	if (!u) throw Error(`data profile '${c}' has no default export`);
+	return u;
+};
+//#endregion
+export { t as a, r as i, a as n, n as o, i as r, s as t };

package/dist/{dbCommand-jbrmzwW_.js → dbCommand-Bf7Cy0mn.js}

@@ -1,4 +1,4 @@
-import { t as e } from "./subcommandNames-CKG5Dz3a.js";
+import { n as e } from "./subcommandNames-DpYs3DXr.js";
 import { n as t, r as n } from "./nodeEnvironment-cGFAj1J8.js";
 import { t as r } from "./cliError-BmdYnghb.js";
 import { n as i } from "./appModuleLoader-C9r9mxZt.js";
@@ -6,7 +6,7 @@ import { a, i as o, n as s, t as c } from "./cliArgs-D4p8n7EE.js";
 import { r as l } from "./dialectDriver-czCHYpeH.js";
 import { a as u } from "./connectionConfig-Bk9IC7D0.js";
 import { i as d, n as f, r as p, s as m, t as h } from "./seedRunner-Dgsiwk_e.js";
-import { n as g, s as _, y as v } from "./frameworkTableAssembly-BvZ0Lil_.js";
+import { g, n as _, s as v } from "./frameworkTableAssembly-BwJVEKLr.js";
 import { b as y, x as b } from "./fileConventions-Cof68_BL.js";
 import { r as x, t as S } from "./inspectGateHint-BjnFubmH.js";
 import { basename as ee, join as C, relative as w, resolve as T } from "node:path";
@@ -962,7 +962,7 @@ var Pe = (e) => typeof e != "string", Fe = (e, t, n, r) => {
 }, Z = async (e) => {
 	let t = await It(e);
 	if (t.length === 0) return;
-	let n = await g({ root: e });
+	let n = await _({ root: e });
 	return Lt(Rt([
 		...t,
 		...ae,
@@ -971,8 +971,8 @@ var Pe = (e) => typeof e != "string", Fe = (e, t, n, r) => {
 }, Q = async (e, t, n) => {
 	let r;
 	try {
-		let t = await _(e);
-		await J(n, v(t, (e, t) => {
+		let t = await v(e);
+		await J(n, g(t, (e, t) => {
 			B.info(`db apply: ${e}`, t ?? {});
 		}));
 	} catch (e) {

package/dist/dbCommand-Bnl7MSGC.js

@@ -0,0 +1,2 @@
+import { s as e } from "./dbCommand-Bf7Cy0mn.js";
+export { e as runDbCommand };

package/dist/declaredSchemaGates-BlcwObhb.js

@@ -0,0 +1,25 @@
+//#region src/declaredSchemaGates.ts
+var e = (e) => ({
+	traces: e.declared?.traces ?? !0,
+	undo: e.declared?.undo ?? !0,
+	cdc: e.cdcDialect !== void 0
+}), t = (e) => {
+	let t = e.nodeEnv ?? "<unset>", n = (t) => e.declared?.[t] === void 0 ? "the default (the same one in every environment)" : `app.config.ts \`schema: { ${t}: ${String(e.declared[t])} }\``, r = (e, t, n) => `  ${e ? "+" : "-"} ${t.padEnd(22)} ${n}`;
+	return `The three tables whose presence is DECIDED rather than implied by your source tree —
+compare these against the other process's environment before anything else:
+
+${r(e.gates.traces, "_voltro_traces", n("traces"))}\n${r(e.gates.undo, "_voltro_undo_log", n("undo"))}\n${r(e.gates.cdc, "_voltro_cdc_offsets", `DB_DIALECT=${e.cdcDialect ?? "<no out-of-band CDC>"}`)}\n\nNone of them reads a runtime flag or NODE_ENV any more (this process: NODE_ENV=${t}).\nIf you are upgrading FROM a version where they did, the two sides recorded different sets —\nre-run \`voltro db apply\` once on this version and both will agree.`;
+}, n = (e) => {
+	let t = [{
+		key: "traces",
+		table: "_voltro_traces",
+		envVar: "VOLTRO_TRACING_PERSIST"
+	}, {
+		key: "undo",
+		table: "_voltro_undo_log",
+		envVar: "VOLTRO_UNDO"
+	}].filter((t) => e.runtime[t.key] && !e.gates[t.key]);
+	if (t.length !== 0) return `refusing to boot — a runtime flag asks for a table the deployment does not declare:\n\n${t.map(({ key: e, table: t, envVar: n }) => `  \`${n}\` turns ${e} capture ON, but \`${t}\` is not in this app's declared schema.\n  Declare it: \`schema: { ${e}: true }\` in app.config.ts.`).join("\n\n")}\n\nThe declaration has to live in app.config.ts rather than in the environment because the\npre-deploy migrate job runs with its OWN env block. A flag set on the pods and not on the\njob produces a green apply and a schema fingerprint no container can reproduce.`;
+};
+//#endregion
+export { e as n, n as r, t };

package/dist/{dev-RjB7eE_B.js → dev-C31Nvlbv.js}

@@ -10,7 +10,8 @@ import { n as ne, r as S } from "./dialectDriver-czCHYpeH.js";
 import { a as C, i as re, n as ie, t as ae } from "./connectionConfig-Bk9IC7D0.js";
 import { a as oe, c as se, i as ce, n as le, o as ue, r as de, t as fe } from "./seedRunner-Dgsiwk_e.js";
 import { r as pe } from "./devActivity-Dx_3nnGv.js";
-import { C as me, E as w, S as he, T as ge, _ as _e, b as ve, d as ye, f as be, g as xe, h as Se, m as Ce, o as we, p as T, r as Te, u as Ee, v as De, w as Oe, x as ke } from "./frameworkTableAssembly-BvZ0Lil_.js";
+import { C as w, S as me, _ as he, b as ge, d as _e, f as ve, h as ye, l as be, m as xe, o as Se, p as Ce, r as we, u as T, v as Te, x as Ee, y as De } from "./frameworkTableAssembly-BwJVEKLr.js";
+import { n as Oe, r as ke } from "./declaredSchemaGates-BlcwObhb.js";
 import { A as Ae, D as je, M as Me, P as Ne, S as Pe, _ as Fe, a as E, b as D, c as Ie, g as O, k as Le, n as Re, o as ze, p as Be, s as Ve, t as He, v as Ue, w as We, x as Ge, y as k } from "./fileConventions-Cof68_BL.js";
 import { A as Ke, C as qe, D as A, E as j, N as Je, O as Ye, S as Xe, T as Ze, _ as Qe, a as $e, b as et, c as tt, d as nt, f as rt, g as it, h as at, i as ot, l as st, m as ct, o as lt, p as ut, r as dt, s as ft, t as pt, u as mt, v as ht, w as M, x as gt, y as _t } from "./inspect-B7U7Cl_Z.js";
 import { t as vt } from "./manifestBuild-BK42hu0k.js";
@@ -4311,7 +4312,7 @@ var rc = (e) => {
 	for (let n of e) {
 		let e = n.dashboard ?? [];
 		if (e.length === 0) continue;
-		let r = ge(n.name), i = /* @__PURE__ */ new Set();
+		let r = me(n.name), i = /* @__PURE__ */ new Set();
 		for (let a of e) {
 			if (i.has(a.id)) throw Error(`plugin "${n.name}" declares duplicate dashboard mount id "${a.id}"`);
 			i.add(a.id), t.push({
@@ -4384,7 +4385,7 @@ var rc = (e) => {
 	if (r.length === 0) return [];
 	let i = await _p(n);
 	return r.map((e) => {
-		let n = ge(e.name), r = {
+		let n = me(e.name), r = {
 			pluginName: e.name,
 			pluginAlias: n,
 			apiName: t,
@@ -4400,7 +4401,7 @@ var rc = (e) => {
 	pluginContributions: await vp(e, t, n),
 	pluginErrorImports: e.flatMap((e) => (e.errorSchemas ?? []).map((e) => e.import)),
 	pluginRpcImports: e.flatMap((e) => (e.rpcClientDescriptors ?? []).map((t) => ({
-		tag: Oe(e, t.tag),
+		tag: Ee(e, t.tag),
 		kind: t.kind,
 		module: t.import.module,
 		name: t.import.name
@@ -6482,7 +6483,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 		for (let i of r) {
 			if (Wh.has(i.name)) continue;
 			let r = P(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (O.test(i.name) && !Fe.test(i.name) || Fe.test(i.name) || Ae.test(i.name) || Me.test(i.name) || je.test(i.name) || D.test(i.name) || k.test(i.name) || Ge.test(i.name) || Pe.test(i.name) || E.test(i.name) || Le.test(i.name) || lf.test(i.name) || Ce.test(i.name) || Se.test(i.name) || We.test(i.name) || Be.test(i.name) || Ue.test(i.name) || He.test(i.name) || Ve.test(i.name) || Re.test(i.name) || Ie.test(i.name) || ze.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (O.test(i.name) && !Fe.test(i.name) || Fe.test(i.name) || Ae.test(i.name) || Me.test(i.name) || je.test(i.name) || D.test(i.name) || k.test(i.name) || Ge.test(i.name) || Pe.test(i.name) || E.test(i.name) || Le.test(i.name) || lf.test(i.name) || _e.test(i.name) || ve.test(i.name) || We.test(i.name) || Be.test(i.name) || Ue.test(i.name) || He.test(i.name) || Ve.test(i.name) || Re.test(i.name) || Ie.test(i.name) || ze.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
@@ -6719,9 +6720,9 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 	});
 	let x = e.filter((e) => be.test(N(e))), ne = x.length > 0 ? await T(x, Z.child("connections")) : [], S = {
 		workflows: c.length > 0 || u.length > 0,
-		schedules: d.length > 0 || e.some((e) => we(N(e))),
+		schedules: d.length > 0 || e.some((e) => Se(N(e))),
 		webhooks: e.some((e) => Le.test(N(e))),
-		agents: e.some((e) => Ce.test(N(e))),
+		agents: e.some((e) => _e.test(N(e))),
 		connections: x.length > 0
 	};
 	return xr(), {
@@ -6958,16 +6959,16 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 		version: Ih,
 		logFile: fe.path
 	}), g(n, Z);
-	let ge = await pe({
+	let me = await pe({
 		project: N(n),
 		cliVersion: Ih
 	});
-	if (ge.kind === "not-personal") return Z.error(`voltro dev needs a personal login — the stored credential belongs to no user.
-  ${ge.message}`), 1;
-	ge.kind === "reported" && ge.seat === "claimed" && Z.info("cloud: this machine now counts toward your organisation's seats (voltro cloud whoami)");
-	let be = process.env.VOLTRO_DEV_HEALTH_PORT, Se = be === void 0 ? C + 1 : Number(be), we;
-	Se > 0 && Number.isFinite(Se) && (we = await bm({
-		port: Se,
+	if (me.kind === "not-personal") return Z.error(`voltro dev needs a personal login — the stored credential belongs to no user.
+  ${me.message}`), 1;
+	me.kind === "reported" && me.seat === "claimed" && Z.info("cloud: this machine now counts toward your organisation's seats (voltro cloud whoami)");
+	let ve = process.env.VOLTRO_DEV_HEALTH_PORT, be = ve === void 0 ? C + 1 : Number(ve), Se;
+	be > 0 && Number.isFinite(be) && (Se = await bm({
+		port: be,
 		log: {
 			info: (e, t) => Z.debug(e, t),
 			warn: (e, t) => Z.warn(e, t)
@@ -6982,9 +6983,9 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 	});
 	let T = await Gh(n);
 	Z.info(`discovered ${T.length} files`, { count: T.length });
-	let { pluginContributions: Oe, pluginErrorImports: Ae, pluginRpcImports: je } = await yp(v?.plugins ?? [], v?.name ?? N(n), n), Me = await Et({
+	let { pluginContributions: Ee, pluginErrorImports: Ae, pluginRpcImports: je } = await yp(v?.plugins ?? [], v?.name ?? N(n), n), Me = await Et({
 		root: n,
-		...Oe.length > 0 ? { pluginContributions: Oe } : {},
+		...Ee.length > 0 ? { pluginContributions: Ee } : {},
 		...Ae.length > 0 ? { pluginErrorImports: Ae } : {},
 		...je.length > 0 ? { pluginRpcImports: je } : {},
 		...v?.name === void 0 ? {} : { apiName: v.name }
@@ -7036,11 +7037,11 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 			"apikeys:issue:other"
 		].some((t) => e.has(t)) && !e.has("admin:full") && Z.warn("apiKeys is enabled but no role declares any of apikeys:issue:self / :org / :other. The management routes are mounted and every issue request will fail its guard — the capability is on and reachable by nobody. Grant the right one in your role map (`:self` lets a user mint their own key, `:org` a shared one, `:other` on behalf of a colleague).");
 	}
-	let bt = (typeof yt == "object" ? yt.prefix : void 0) ?? "voltro_", xt, Ct = yt ? [Ui({ resolveByHash: (e, t) => xt ? xt.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: bt })] : [], Rt = zh([...M?.auth?.strategies ?? [], ...Ct], Bs(M?.plugins ?? []), M?.auth?.anonymousTenantRequired ?? !1, M?.auth, () => vt.current), zt = ha({ resolveSubject: Rt }), Bt = Ee({
+	let bt = (typeof yt == "object" ? yt.prefix : void 0) ?? "voltro_", xt, Ct = yt ? [Ui({ resolveByHash: (e, t) => xt ? xt.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: bt })] : [], Rt = zh([...M?.auth?.strategies ?? [], ...Ct], Bs(M?.plugins ?? []), M?.auth?.anonymousTenantRequired ?? !1, M?.auth, () => vt.current), zt = ha({ resolveSubject: Rt }), Bt = Oe({
 		nodeEnv: process.env.NODE_ENV,
 		cdcDialect: Fe,
 		declared: M?.schema
-	}), Vt = ye({
+	}), Vt = ke({
 		gates: Bt,
 		runtime: {
 			traces: mm(),
@@ -7048,7 +7049,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 		}
 	});
 	if (Vt !== void 0) throw r(`dev: ${Vt}`);
-	let Ht = Te({
+	let Ht = we({
 		mix: it,
 		plugins: M?.plugins ?? [],
 		gates: Bt,
@@ -7089,9 +7090,9 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 		count: Yt.length,
 		mounts: Yt.map((e) => `${e.fullId} (${e.slot})`)
 	});
-	let en = ke(M?.plugins ?? []);
+	let en = Te(M?.plugins ?? []);
 	en.length > 0 && Z.info("plugin schema contributions", { plugins: en.map((e) => `${e.pluginName}: ${e.tables}t/${e.migrations}m`) });
-	let tn = me(M?.plugins ?? []);
+	let tn = ge(M?.plugins ?? []);
 	if (tn.length > 0) {
 		let e = [
 			...E.map((e) => e.descriptor.name),
@@ -7102,7 +7103,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 			...E.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
 			...D.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
 			...O.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
-		]), n = he(tn, e, t);
+		]), n = De(tn, e, t);
 		tn.length - n.length > 0 && Z.info(`plugin routes overridden by app procedures: ${[...t].join(", ")}`);
 		for (let e of n) e.kind === "query" ? E.push({
 			file: e.file,
@@ -7122,14 +7123,14 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 			routes: tn.map((e) => `${e.plugin.name}:${e.descriptor.name} (${e.kind})`)
 		});
 	}
-	let an = Z.child("agent"), sn = T.filter((e) => xe.test(N(e)));
+	let an = Z.child("agent"), sn = T.filter((e) => Ce.test(N(e)));
 	if (sn.length > 0) {
-		let e = await De(sn, an);
+		let e = await ye(sn, an);
 		e > 0 && an.info("wired tool handlers", { tools: e });
 	}
-	let cn = T.filter((e) => Ce.test(N(e))), ln = [];
+	let cn = T.filter((e) => _e.test(N(e))), ln = [];
 	if (cn.length > 0) {
-		let e = await _e(cn, an);
+		let e = await xe(cn, an);
 		ln = e.agents.map((e) => e.descriptor.name);
 		for (let t of e.agents) for (let e of yf(t)) e.kind === "action" ? O.push({
 			file: e.file,
@@ -7364,7 +7365,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 			dialect: hi,
 			env: t,
 			tables: I.length
-		}), we?.set({
+		}), Se?.set({
 			phase: "migrating",
 			tablesTotal: I.length
 		});
@@ -7393,7 +7394,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 			if (c.kind === "refused-blocked" || c.kind === "prod-mismatch") throw Z.error(Fr(c, r.id)), Error("auto-migrate refused — see error above");
 			Z.info(Fr(c, r.id), { durationMs: Date.now() - e });
 		} catch (e) {
-			throw Z.error("auto-migrate failed — aborting boot", { err: e }), we?.set({
+			throw Z.error("auto-migrate failed — aborting boot", { err: e }), Se?.set({
 				phase: "error",
 				error: e instanceof Error ? e.message : String(e)
 			}), e;
@@ -7414,7 +7415,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 	if ((M?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && Ei !== "memory") {
 		let e = (await S(Ei)).makeSqlLayer(Q());
 		try {
-			let t = await z.runPromise(ve(M.plugins).pipe(z.provide(e))), n = t.filter((e) => e.status === "applied"), r = t.filter((e) => e.status === "skipped");
+			let t = await z.runPromise(he(M.plugins).pipe(z.provide(e))), n = t.filter((e) => e.status === "applied"), r = t.filter((e) => e.status === "skipped");
 			Z.info("plugin migrations complete", {
 				applied: n.map((e) => `${e.pluginName}:${e.migrationId} (${e.durationMs}ms)`),
 				skippedCount: r.length
@@ -8924,7 +8925,7 @@ ${r.join("\n")}\n  A deployment with no producer waits forever and looks exactly
 		port: C,
 		ws: `ws://localhost:${C}/ws`,
 		store: Y
-	}), we?.set({ phase: "ready" }), process.send?.({ type: vl }), process.channel?.unref(), Y === "postgres" && Z.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await ns();
+	}), Se?.set({ phase: "ready" }), process.send?.({ type: vl }), process.channel?.unref(), Y === "postgres" && Z.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await ns();
 	try {
 		await Nt({
 			id: oe,

package/dist/{dev-CaIfZnw5.js → dev-DFVuzOj7.js}

@@ -1,3 +1,3 @@
-import { c as e, d as t, f as n, i as r, u as i } from "./dev-RjB7eE_B.js";
+import { c as e, d as t, f as n, i as r, u as i } from "./dev-C31Nvlbv.js";
 import "./dialectDriver-czCHYpeH.js";
 export { r as buildStore, e as loadApiConfig, i as loadDiscovered, t as runDev, n as walk };

package/dist/{doctorCommand-D7X29cw6.js → doctorCommand-B3uraeAe.js}

@@ -1,8 +1,8 @@
-import { Ht as e, Ut as t, Vt as n } from "./dev-RjB7eE_B.js";
+import { Ht as e, Ut as t, Vt as n } from "./dev-C31Nvlbv.js";
 import { at as r, it as i, ot as a, s as o, st as s, t as c, w as l, y as u } from "./webDev-B4IEMB0n.js";
-import { w as d } from "./frameworkTableAssembly-BvZ0Lil_.js";
+import { x as d } from "./frameworkTableAssembly-BwJVEKLr.js";
 import { n as f } from "./pageConvention-cEiRxdab.js";
-import { r as p, u as m } from "./apiBuild-FpHCWiv6.js";
+import { r as p, u as m } from "./apiBuild-QmYHaCF4.js";
 import { n as h, r as g, t as ee } from "./cliOutput-D1tSBoRM.js";
 import { n as _, t as te } from "./tsconfigPaths-BWXBWgcl.js";
 import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
@@ -1350,7 +1350,7 @@ var le = /* @__PURE__ */ new Set([
 	let t = Wt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-CaIfZnw5.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-DFVuzOj7.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
@@ -1459,7 +1459,7 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, J = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-CaIfZnw5.js"), { discovered: a } = await U(r), o = e(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-DFVuzOj7.js"), { discovered: a } = await U(r), o = e(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1543,7 +1543,7 @@ var le = /* @__PURE__ */ new Set([
 }, nn = async (e) => nt({
 	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-CaIfZnw5.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-DFVuzOj7.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1623,7 +1623,7 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, ln = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-CaIfZnw5.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-DFVuzOj7.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1640,10 +1640,10 @@ var le = /* @__PURE__ */ new Set([
 		findings: []
 	});
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-B2Fw73lu.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await ln(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-udbQpphy.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await ln(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) {
 			try {
-				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-DDKtwsy2.js");
+				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-CVDB2hCq.js");
 				await t(e);
 			} catch {
 				return t("app-not-importable");
@@ -1694,7 +1694,7 @@ var le = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CaIfZnw5.js");
+		let { loadApiConfig: t } = await import("./dev-DFVuzOj7.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1725,7 +1725,7 @@ var le = /* @__PURE__ */ new Set([
 }, pn = async (e) => {
 	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-CaIfZnw5.js");
+		let { loadApiConfig: t } = await import("./dev-DFVuzOj7.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;
@@ -1869,6 +1869,23 @@ var le = /* @__PURE__ */ new Set([
 	for (let e of n.unchecked.slice(0, $)) console.log(`  ✗ ${e.tag}  — ${e.why}\n      ${e.path}`);
 	return n.unchecked.length > $ && console.log(`  … and ${n.unchecked.length - $} more — \`voltro doctor --json\` prints every one (\`authz.unchecked\`).`), i === void 0 ? (console.log(`\nNo ${X} yet, so this run is advisory. To start the ratchet:`), console.log("\n    voltro doctor --write-authz-allowlist\n"), console.log("That records today's unchecked handlers as DEBT and fails every run after on"), console.log("anything NEW. Fix a handler and its line stops mattering — the scan reports it as"), console.log("guarded whether or not the line is still there."), !1) : (console.log(`\n${n.unchecked.length} executor(s) with no access check are not in ${X}.`), console.log("Add a guard, or add the tag to that file if it is genuinely open."), console.log("\nBefore hand-rolling another check: `guards: [{ action, resourceType, resource }]`"), console.log("answers \"may this subject act on THIS row\" declaratively, and an app whose"), console.log("relationships live in its own tables registers its own tuple source rather than"), console.log("copying data into a framework table. See the authorization docs."), !0);
 }, yn = async (e) => {
+	try {
+		let { loadApiConfig: t } = await import("./dev-DFVuzOj7.js"), { decidedSchemaReport: n } = await import("./doctorDecidedSchema-BlbWgCD_.js"), r = await t(e);
+		return r == null ? null : n({
+			...r.schema ? { declared: r.schema } : {},
+			...r.store === void 0 ? {} : { store: r.store },
+			nodeEnv: process.env.NODE_ENV
+		});
+	} catch {
+		return null;
+	}
+}, bn = async (e) => {
+	let t = await yn(e);
+	if (t !== null) {
+		console.log(""), console.log("•  framework tables whose presence is DECIDED rather than implied by your source tree:");
+		for (let e of t.text.split("\n")) console.log(`   ${e}`);
+	}
+}, xn = async (e) => {
 	if (e.includes("--help") || e.includes("-h")) return console.log(Ut), 0;
 	let t = e.includes("--strict"), n = e.find((e) => !e.startsWith("-")), o = b(n ?? process.cwd());
 	if (g(e)) return ee(), h({
@@ -1886,14 +1903,15 @@ var le = /* @__PURE__ */ new Set([
 		authz: await gn(o),
 		ungrantedScopes: await Q(o),
 		neverEmittedEvents: await Z(o),
-		stalledRuns: await nn(o)
+		stalledRuns: await nn(o),
+		decidedSchema: await yn(o)
 	}), 0;
 	let c = ct(o, t);
-	z(o), At(o), Ht(o), ne(o), await It(o), await an(o), await rn(o), await Gt(o), await Xt(o), await Yt(o), await Zt(o), await pn(o), await un(o), await cn(o), await dn(o);
+	z(o), At(o), Ht(o), ne(o), await It(o), await an(o), await rn(o), await Gt(o), await Xt(o), await Yt(o), await bn(o), await Zt(o), await pn(o), await un(o), await cn(o), await dn(o);
 	let l = await tn(o), u = await vn(o, e.includes("--write-authz-allowlist")), d = await Qt(o), f = await en(o), p = await fn(o), m = s(r(o));
 	m !== void 0 && (console.log(""), console.log(m));
 	let _ = a(i(o));
 	return _ !== void 0 && console.log(`\n${_}`), l || u || d || p || f ? Math.max(c, 1) : c;
 };
 //#endregion
-export { B as C, Y as E, V as S, Q as T, Ht as _, gn as a, ct as b, G as c, L as d, ot as f, z as g, At as h, J as i, on as l, qt as m, st as n, Z as o, W as p, jt as r, sn as s, Ut as t, R as u, It as v, q as w, Tt as x, yn as y };
+export { B as C, Y as E, V as S, Q as T, Ht as _, gn as a, ct as b, G as c, L as d, ot as f, z as g, At as h, J as i, on as l, qt as m, st as n, Z as o, W as p, jt as r, sn as s, Ut as t, R as u, It as v, q as w, Tt as x, xn as y };

package/dist/doctorCommand-CPL6EhrW.js

@@ -0,0 +1,2 @@
+import { b as e, y as t } from "./doctorCommand-B3uraeAe.js";
+export { t as runDoctorCommand, e as runServePreflight };

package/dist/doctorDecidedSchema-BlbWgCD_.js

@@ -0,0 +1,23 @@
+import { n as e, t } from "./declaredSchemaGates-BlcwObhb.js";
+//#region src/doctorDecidedSchema.ts
+var n = (e) => e === "mariadb" || e === "mssql" ? e : void 0, r = (r) => {
+	let i = n(r.store), a = e({
+		nodeEnv: r.nodeEnv,
+		...i ? { cdcDialect: i } : {},
+		...r.declared ? { declared: r.declared } : {}
+	}), o = ["traces", "undo"].filter((e) => r.declared?.[e] !== void 0);
+	return {
+		traces: a.traces,
+		undo: a.undo,
+		cdc: a.cdc,
+		declaredInConfig: o,
+		text: t({
+			gates: a,
+			nodeEnv: r.nodeEnv,
+			...i ? { cdcDialect: i } : {},
+			...r.declared ? { declared: r.declared } : {}
+		})
+	};
+};
+//#endregion
+export { r as decidedSchemaReport };

package/dist/{dormancyCommand-BGOP27fz.js → dormancyCommand-QUXQ9yoz.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-RjB7eE_B.js";
+import { c as e, i as t } from "./dev-C31Nvlbv.js";
 import { n, t as r } from "./cliArgs-D4p8n7EE.js";
 import { r as i } from "./appPort-B_HpJ_ck.js";
 import { resolve as a } from "node:path";

package/dist/{embeddingsCommand-D72E22bw.js → embeddingsCommand-Zw1-rYSF.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-RjB7eE_B.js";
+import { c as e, i as t } from "./dev-C31Nvlbv.js";
 import { Effect as n } from "effect";
 import { embedMany as r } from "@voltro/ai";
 //#region src/embeddingsBackfill.ts

package/dist/{envCommand-BHSxz6wC.js → envCommand-DtaJ4xEf.js}

@@ -1,4 +1,4 @@
-import { c as e } from "./dev-RjB7eE_B.js";
+import { c as e } from "./dev-C31Nvlbv.js";
 import { _t as t, gt as n, mt as r, pt as i } from "./webDev-B4IEMB0n.js";
 import { join as a } from "node:path";
 import { promises as o } from "node:fs";

package/dist/{evolveCommand-C2ofGGlz.js → evolveCommand-JDD3hE1i.js}

@@ -1,6 +1,6 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
-import { t } from "./checkCommand-D0dAKciE.js";
-import { i as n, n as r } from "./codemodRunner-DSZjgyCL.js";
+import { t } from "./checkCommand-D8vjQXQt.js";
+import { i as n, n as r } from "./codemodRunner-De1_316I.js";
 import { basename as i, join as a, resolve as o } from "node:path";
 import { branchNamespaceName as s, planBranchProvision as c } from "@voltro/database";
 import { readFile as l } from "node:fs/promises";