@voltro/cli 0.49.0 → 0.50.1

package/CHANGELOG.md

@@ -39,6 +39,120 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.50.1] — 2026-08-24
+
+### Added
+
+- **@voltro/cli** — A `0.51.0` upgrade note for the case 0.45.0's typed-`source:` note left open: a source that is COMPUTED but whose names are all known — a generic reader that takes its table from `input` or a registry. Both remedies the original offered are wrong there. There is no misspelled name to fix, and widening to `ReactivitySourceValue` (or casting) compiles instantly while taking that entire set of tables permanently out of the check the narrowing exists to provide.
+
+  The note carries the recipe that keeps the names — `as const satisfies`, with the key set recovered separately — and the trap under it: an ANNOTATION widens the keys back even when the literal carries `as const`, because it is checked against the literal and then replaces its type. Filed under an unreached version because codemod selection is `from < version <= to`: 0.45.0's note can never fire again for anyone already past it. Documented on the subscriptions page in both languages.
+
+### Changed
+
+- **@voltro/data-transfer** — The `mariadb-dump`-not-on-PATH hint now also warns that a MariaDB 12.x client requires TLS by default, so running it BY HAND against a server without TLS fails with `TLS/SSL error: SSL is required` (2026) and needs `--skip-ssl`. Our own invocation is unaffected. It is said here because this hint is what sends people to install that client package, and the next thing many of them do is run the tool by hand — where the failure reads like a broken install of the thing we just told them to install.
+
+### Fixed
+
+- **@voltro/cli, @voltro/mcp** — `voltro check`'s `rbac/unguarded-mutation` no longer fires on `internal: true` procedures. Those are in no rpc group and on no route, so the finding's own sentence — "any caller who can reach the rpc surface can invoke it" — named a surface that does not exist, and neither remedy it offered was available: a guard protects nothing there, and `openAccess` is refused outright on an internal descriptor. An app with 990 internal mutations got 990 warnings and a `FAILED` exit from the same tree on which `voltro doctor` reported zero procedures without an access decision, which made `check` unusable as the CI gate it exists to be.
+
+  The capability manifest now carries `internal: true` per procedure (present only when true), and the rule reads it through `isWireReachable` — the same predicate the boot access gate and all three rpc-group assemblies use, rather than a fourth spelling of the same flag. A manifest that does not carry the field is read as REACHABLE, so the rule stays loud on an api older than the field rather than going quiet on it.
+- **@voltro/data-transfer, @voltro/cli** — `--assets` aborted the whole capture at the first blob reference the storage provider could not resolve. A dangling reference is a fact about the source data — a row pointing at an object that was deleted, or that never arrived because an earlier import ran without the flag — and no backup can put back bytes that are not there. Aborting made the flag unusable for exactly the deployment that needed it: 178 references, one resolvable, and the run stopped at the second.
+
+  The phase now records the key, steps over it, and the run reports how many were skipped. Only a genuine not-found (`status === 404`) is treated this way; a 403 from a rotated credential or a 5xx from a backend outage still fails the capture, because calling those "the object is gone" turns a recoverable outage into a backup that quietly contains nothing.
+
+  The same abort also cost the artefact its provenance: `voltro-backup-stamp.json` was written after the asset phase, so a backup taken WITH `--assets` had no stamp at all, and `restore` then greeted an artefact this tool had written minutes earlier as "an older/handmade backup. Cannot verify dialect or schema version." The stamp is now written on every path — it describes the dump, and the dump is on disk and correct by the time the assets run.
+- **@voltro/cli** — `voltro doctor`'s eager-loaded-relation rule resolves nested relations against their PARENT's target table instead of against the query's roots, so every level is reported in one pass. It flattened the `.with({ … })` tree before resolving, which meant a level-2 relation stayed invisible until level 1's table had been added to `source:` — each fix revealed the next level, and a clean run after the first fix meant nothing. One app ran `doctor → fix → doctor` twice before the output stopped producing new findings.
+
+  The one case that is still genuinely under-reported is now stated instead of being silent: when the executor's base table is neither declared nor textually readable, nothing resolves, and doctor prints which relation names it could not check rather than reporting clean.
+- **@voltro/data-transfer** — A native restore whose client exited before consuming its input took the whole CLI down with an unhandled `EPIPE`. `createReadStream(dump).pipe(child.stdin)` had no `error` listener, so Node threw on a write to a pipe with no reader:
+
+  Error: write EPIPE Emitted 'error' event on Socket instance at: at Socket.onerror (node:internal/streams/readable:1045:14)
+
+  What that cost is the point. The crash landed before `close`, so the step never resumed: the client's stderr — the one place the reason was written down — was discarded, the transfer row was never closed, the in-progress marker was never re-asserted, and the operator got a raw Node stack trace over a database that was now half replaced. A deployment met it on a 64 MB restore and could not diagnose it at all, because the only diagnosis had been thrown away.
+
+  Every stream in the step now carries a handler. `EPIPE` on the child's stdin is deliberately swallowed — a child closes the pipe by dying, and its exit code and stderr are the actual failure — while any other stream error is carried and reported. The failure line now always includes the tool's stderr (and says so explicitly when the tool printed none), plus how many bytes of the artefact had been fed before it stopped. A source error also ends the child's stdin, which turns a restore that used to hang forever on a vanished dump into one that fails, and a clean exit over a broken input stream is reported as a failure rather than as a truncated success.
+- **@voltro/cli** — `voltro check`'s observed-vs-declared findings advised an op that does not exist. The recorder reports what the store did, and `store.upsert` is one call; a `target:` is `InsertTarget | UpdateTarget | DeleteTarget` and has no `upsert` member. So `observed/undeclared-write` said to add `{ table: '…', op: 'upsert' }` — a `TS2322`, from a line whose whole purpose is to be pasted. It now advises both halves, and the observed → declarable mapping is typed `Record<ObservedWriteOp, ReadonlyArray<TargetSpec['op']>>` so a new recorder op cannot ship without a declarable answer.
+
+  The remedy no longer produces a finding of its own either: declared targets are now collected per table as a SET. `new Map(targets.map(t => [t.table, t.op]))` kept only the last op, so the correct two-entry declaration read as "declares update" and the insert half came back as a `wrong-op`.
+- **@voltro/data-transfer, @voltro/cli** — The in-progress restore marker did not survive a native restore, on the exact dialects that were documented as safe. The claim — postgres and the mysql family drop only the objects the dump names, so the marker row survives — had a correct argument and a wrong premise: a native dump names the WHOLE database, `_voltro_replace_in_progress` included, and a mysql-family restore writes `DROP TABLE IF EXISTS` in front of each table. The table sorts early, so the guard was removed near the START of the window it exists to cover. Measured downstream as one row before and zero after, twice, once by hand and once through the command — and then a restore died and left a database with a schema, some of its tables, no users and no blobs, with nothing to stop the next boot.
+
+  Two changes, covering different dumps. `voltro data backup` now excludes the marker table (`--exclude-table` / `--ignore-table`), so an artefact we produce cannot carry the thing that erases the guard on the way back in. And `restore` re-asserts the marker after the tool exits, on the failing path as well as the succeeding one, which covers dumps taken before this change and dumps made by hand: rewritten is a warning, and unwritable is an error, because the guard is then off for that run.
+- **@voltro/plugin-storage, @voltro/cli** — `--assets` could not be refused when no storage was configured, and resolved the wrong backend when it was.
+
+  `resolveStorageProvider({})` is total: its final `default:` arm returns an in-process `memoryProvider`. So the three `if (!provider)` refusals in `voltro data backup` / `export` / `restore` — whose entire job is to refuse a flag the app cannot honour — were checking a condition that cannot hold. What they let through is worse than an unchecked flag: with no storage configured, `backup --assets` captured from a fresh memory provider, found nothing in it, and wrote an artefact stamped `assets: { count: 0 }` — a rollback story that says the blobs are in there.
+
+  It also ignored the provider the app REGISTERED. An app on `storagePlugin({ provider: s3(…) })` had its export/import/backup read and write the env-derived default instead, which surfaces later as "no object at key" — the exact drift `appStorageProvider()` exists to prevent, in call sites that never adopted it.
+
+  `configuredStorageProvider()` is the honest predicate: the app's registered provider, else the env-named one, else `undefined`. A memory provider nobody asked for is not a decision. The CLI now loads the app config BEFORE resolving — `storagePlugin(...)` registers at construction, so asking first answered with the default no matter what the app had configured.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/cli** — `voltro data backup` / `restore` / `clear-replace-marker` are now driven end to end, one case per declared option and one per refusal, as real CLI subprocesses against a real database.
+
+  Every defect this command has shipped lived in the SEQUENCE rather than in a function — an unhandled `EPIPE` that discarded the client's stderr before `close` fired, a marker erased by the restore's own artefact, an asset abort that skipped the provenance stamp, a refusal that could not fire — so none of them was reachable by testing a part. `nativeBackupRestore.e2e.test.ts` covers the whole surface against sqlite (a file copy: no vendor binary, runs anywhere) and `nativeBackupRestoreDialects.integration.test.ts` runs the vendor-tool half against postgres, mariadb and mysql, skipping BY NAME when the server or the client binary is absent — including when the client is present but too old for the server, which a "is it on PATH" check reports as ready.
+
+  The suite checks itself against `DATA_FLAGS`, the command's own declared option list, so an option cannot be added without a case that drives it.
+
+---
+
+## [0.50.0] — 2026-08-23
+
+### ⚠ BREAKING
+
+- **@voltro/cli** — The read-only run-history endpoint moved:
+
+  GET /_voltro/admin/imports → GET /_voltro/admin/transfers
+
+  Same secret, same query parameters, same response shape. Only the path changed.
+
+  It answers for four directions now — import, export, native backup, native restore — and it named one of them. The subcommand and the table were renamed for exactly that reason in 0.49.0 and this path was left behind, which is worse than renaming none of them: a reader who follows a rename tries the matching path, gets a 404, and concludes the instance is too old.
+
+  `voltro data transfers --target api` uses the new path for you. What needs a hand is anything calling it directly — a monitoring check, an uptime probe, a curl in a runbook, a dashboard datasource. The codemod is `manual` and declares `reach: 'beyond-source'`, so it prints whether or not the path is found in your repository.
+- **@voltro/database, @voltro/voltro** — `InterruptedReplace.tables` is `number | null`, and the interface gains `kind?: 'replace' | 'restore'`.
+
+  `_voltro_replace_in_progress` records two destructive operations now — an import's `--mode replace` and a native `voltro data restore`. A restore replaces the whole database from an artefact, so "how many tables was this going to empty and refill" has no answer: not known up front, not meaningful after.
+
+  Writing `0` would have preserved the type and been worse. That number is rendered into the boot refusal, which is read under pressure, and it would have said `began emptying 0 table(s)` — a measurement that was never taken. The framework's own text says "this database" instead; `Number(null)` is `0`, so coercing it reintroduces exactly the sentence being avoided.
+
+  `DataTransferRun.direction` also widens to name `'backup'` and `'restore'` explicitly. That one is documentary — the union already ended in `| string`, so no assignability changes.
+
+  **`voltro update` carries you across this** — codemod `0.50.0/03_interrupted-replace-tables-nullable`.
+
+### Added
+
+- **@voltro/cli, @voltro/data-transfer, @voltro/database** — `voltro data backup --assets` and `voltro data restore --assets` now move the stored blobs alongside the vendor dump, through the same content-addressed phase the logical `export` / `import` path uses — streamed, deduped by sha256, verified on the way back, resumable per key.
+
+  `--assets` was accepted by `backup` and silently ignored, with the only signal a field in the closing JSON reading `NOT included`; `restore` did not accept it at all. A rows-only backup restores a database whose rows reference objects nothing puts back, and the reference and the object are checked at different times, so that state is discovered by a user rather than by the restore.
+
+  Three refusals, each for a belief that is otherwise acted on silently: `backup --assets` with no storage provider is refused rather than swallowed; `restore --assets` on a rows-only artefact is refused; a restore WITHOUT `--assets` over an artefact that has them warns and proceeds, because restoring rows without blobs is legitimate and refusing it would push people at `--force`.
+
+  The dump itself still has no resume — a vendor artefact is one opaque file with no offset to restart from, and the logical path is what exists for that.
+- **@voltro/cli, @voltro/database, @voltro/data-transfer** — A native `backup` / `restore` now writes to the same `_voltro_data_transfers` record `import` and `export` use, so `voltro data transfers` answers "did last night's backup finish" from the instance that ran it. A native run reports blobs rather than rows — a vendor tool reports no row count we can trust, and printing `0 row(s)` over a dump that worked would be a wrong measurement.
+
+  `restore` also writes the `_voltro_replace_in_progress` marker before its first destructive statement and clears it after the last write, blobs included, so a killed restore refuses the next boot instead of serving a half-loaded database. `--allow-live` guards from the wrong side — it asks you not to — and this guards from the right one. The marker carries a `kind` so the refusal can say something different for a `replace` (re-import the capture) and a `restore` (finish the restore), and `tables` is nullable because a native restore has no table count to claim.
+
+  The sqlite / turso restore is atomic now (temp file + rename): its marker lives in the very file being replaced, so a plain in-place copy would leave a truncated database with nothing left to catch it.
+
+  A target with no `_voltro_data_transfers` table still gets its backup; the closing line says it was not recorded rather than implying it was.
+- **@voltro/cli** — A re-issued migration note for the `voltro data imports` → `voltro data transfers` rename that shipped in 0.49.0.
+
+  Codemods are selected by `from < version <= to`, so the 0.49.0 note fires once, on the jump that crosses 0.49.0, and cannot be corrected for anyone already past it. Its gate searched `.ts` / `.tsx` while the command it is about lives in shell scripts, CI job definitions and runbooks — so a project whose only occurrence sat in `.gitlab-ci.yml` crossed 0.49.0 and was told there was nothing to apply.
+
+  The re-issue is filed under 0.50.0, prints unconditionally, and says what to grep for. Redundant for anyone already fixed; the alternative is firing for nobody.
+
+### Fixed
+
+- **@voltro/cli** — A `manual` codemod's `appliesTo` can now search every text file the project owns — `.sh`, `.yml`, `.json`, `.md`, `Makefile`, the `.js` scripts — through a new `ctx.text` on the predicate context, and a codemod may declare `reach: 'beyond-source'` to print its note even when nothing matched.
+
+  Both halves close the same gap, and it was in the codemod most in need of a gate. A manual codemod exists BECAUSE its subject could not be transformed, which usually means it is not source at all — and `appliesTo` was reading the ts-morph project, which holds `.ts` / `.tsx` and nothing else. Measured with one identical CLI invocation in four files: the `.ts` one printed the note, the `.sh`, `.yml` and `.md` ones printed nothing, and the run reported `codemods: nothing to apply for this jump`. That is an acquittal from a check that never looked at the file, and an acquittal gets acted on.
+
+  `reach: 'beyond-source'` covers what no scan of one repository can reach — an inline script in a CI runner's own UI, a CronJob spec in another repo, a wiki runbook. The note prints either way; only its framing changes, and an uncertain one says plainly that we could not look there.
+- **@voltro/data-transfer** — When `mariadb-dump` is absent and the mysql-family fallback runs Oracle's `mysqldump` against a MariaDB server, the failure now names the way out.
+
+  The stderr it prints is the child's own words and is the right first thing to show — and on its own it is a dead end: `Unknown table 'COLUMN_STATISTICS' in information_schema (1109)` names a table nobody asked for, in a schema nobody wrote, about a feature nobody enabled. Everything needed to act on it was known where the fallback was DECIDED: which binary we wanted, which one we took, and why the difference matters. That travels with the step now and prints under the stderr, including the counter-move a reader reaches for on their own (`--column-statistics=0` does not exist on `mariadb-dump`, so it fixes the wrong client and breaks the right one).
+
+---
+
 ## [0.49.0] — 2026-08-23
 
 ### ⚠ BREAKING

package/dist/apiBuild-BZ-plaQN.js

@@ -0,0 +1,2 @@
+import { c as e, l as t } from "./apiBuild-D3s7lx57.js";
+export { e as runApiBuild, t as runServeBundleBuild };

package/dist/{apiBuild-QmYHaCF4.js → apiBuild-D3s7lx57.js}

@@ -1,5 +1,5 @@
-import { f as e } from "./dev-C31Nvlbv.js";
-import { vt as t } from "./webDev-B4IEMB0n.js";
+import { f as e } from "./dev-C0cbqysu.js";
+import { vt as t } from "./webDev-BbdkzMbd.js";
 import { t as n } from "./dialectDriver-czCHYpeH.js";
 import { dirname as r, isAbsolute as i, join as a, relative as o, resolve as s } from "node:path";
 import { existsSync as c, promises as l } from "node:fs";

package/dist/appGraph-CM9wvUmD.js

@@ -0,0 +1,2 @@
+import { n as e, t } from "./appGraph-Cv2W_wO5.js";
+export { t as buildAppGraph, e as checkAppGraph };

package/dist/appGraph-Cv2W_wO5.js

@@ -0,0 +1,111 @@
+import { isWireReachable as e } from "@voltro/protocol";
+//#region src/appGraph.ts
+var t = (e) => e.source === void 0 ? [] : typeof e.source == "string" ? [e.source] : e.source, n = (e) => ({
+	tables: new Set(e.tables),
+	procedures: new Map(e.procedures.map((e) => [e.tag, e])),
+	scopes: new Set(e.scopes ?? []),
+	input: e
+}), r = (n) => {
+	let r = [], i = /* @__PURE__ */ new Set();
+	for (let a of n.input.procedures) {
+		for (let e of t(a)) i.add(e), n.tables.has(e) || r.push({
+			rule: "reference/dangling-source",
+			node: `${a.kind}(${a.tag})`,
+			...a.file === void 0 ? {} : { file: a.file },
+			breaks: [`reads table '${e}' which does not exist`],
+			fix: `declare a '${e}.entity.ts' table or fix the query's source`,
+			severity: "error"
+		});
+		for (let e of a.targets ?? []) i.add(e.table), n.tables.has(e.table) || r.push({
+			rule: "reference/dangling-target",
+			node: `${a.kind}(${a.tag})`,
+			...a.file === void 0 ? {} : { file: a.file },
+			breaks: [`targets table '${e.table}' (op '${e.op}') which does not exist`],
+			fix: `declare a '${e.table}.entity.ts' table or fix the mutation's target`,
+			severity: "error"
+		});
+		for (let e of a.requiresScopes ?? []) n.scopes.size > 0 && !n.scopes.has(e) && r.push({
+			rule: "rbac/unknown-scope",
+			node: `${a.kind}(${a.tag})`,
+			...a.file === void 0 ? {} : { file: a.file },
+			breaks: [`requires scope '${e}' which is not declared`],
+			fix: `declare the scope '${e}' or fix the requireScope(...) call`,
+			severity: "error"
+		});
+		a.kind === "mutation" && a.hasGuards === !1 && a.openAccess === void 0 && e(a) && r.push({
+			rule: "rbac/unguarded-mutation",
+			node: `${a.kind}(${a.tag})`,
+			...a.file === void 0 ? {} : { file: a.file },
+			breaks: [`'${a.tag}' changes state but declares no guard — any caller who can reach the rpc surface can invoke it`],
+			fix: "add a guard (e.g. `.guard(requireScope('…'))`), or confirm it is intentionally public",
+			severity: "warn"
+		});
+	}
+	for (let e of n.input.routes ?? []) for (let t of e.binds) n.procedures.has(t) || r.push({
+		rule: "binding/unknown-tag",
+		node: `route(${e.pattern})`,
+		...e.file === void 0 ? {} : { file: e.file },
+		breaks: [`binds rpc tag '${t}' which does not exist`],
+		fix: `bind an existing tag, or restore '${t}' (it may have been renamed/removed)`,
+		severity: "error"
+	});
+	for (let e of n.input.procedures) for (let t of e.targets ?? []) i.add(t.table);
+	let a = new Set(n.input.frameworkOwnedTables ?? []), o = n.input.procedures.filter((e) => e.kind === "action" && t(e).length === 0 && (e.targets ?? []).length === 0).length;
+	for (let e of n.tables) a.has(e) || i.has(e) || r.push({
+		rule: "orphan/unread-table",
+		node: `table(${e})`,
+		breaks: o > 0 ? [`no query reads and no mutation writes '${e}'`, `${o} action(s) declare neither source nor target, so one of them may still use it`] : [`no query reads and no mutation writes '${e}'`],
+		fix: o > 0 ? "declare `source`/`target` on your actions so this can be answered, then re-run" : `add a query/mutation for '${e}', or remove the table if it's dead`,
+		severity: "warn"
+	});
+	if (n.scopes.size > 0) {
+		let e = /* @__PURE__ */ new Set();
+		for (let t of n.input.procedures) for (let n of t.requiresScopes ?? []) e.add(n);
+		for (let t of [...n.scopes].sort()) t === "admin:full" || e.has(t) || r.push({
+			rule: "rbac/unenforced-scope",
+			node: `scope(${t})`,
+			breaks: [`'${t}' is granted by a role but NO query/mutation/action/stream guards on it`, "a scope nobody checks grants nothing and withholds nothing — the role map reads stricter than the app is"],
+			fix: `add \`.guard(requireScope('${t}'))\` to the handlers it is meant to protect — or, if a plugin route, a REST route, or a UI-only affordance enforces it, say so where the role is declared`,
+			severity: "warn"
+		});
+	}
+	return r;
+}, i = (e, n) => {
+	let r = [];
+	if (n.kind === "removeTable") for (let i of e.input.procedures) {
+		let e = t(i).includes(n.name), a = (i.targets ?? []).some((e) => e.table === n.name);
+		(e || a) && r.push({
+			rule: "blast/table-removed",
+			node: `${i.kind}(${i.tag})`,
+			...i.file === void 0 ? {} : { file: i.file },
+			breaks: [`${e ? "reads" : "writes"} table '${n.name}' — would break if removed`],
+			fix: `migrate or remove ${i.tag} before dropping '${n.name}'`,
+			severity: "error"
+		});
+	}
+	else if (n.kind === "removeProcedure") for (let t of e.input.routes ?? []) t.binds.includes(n.tag) && r.push({
+		rule: "blast/procedure-removed",
+		node: `route(${t.pattern})`,
+		...t.file === void 0 ? {} : { file: t.file },
+		breaks: [`binds '${n.tag}' — would break if removed`],
+		fix: `rebind ${t.pattern} to another tag before removing '${n.tag}'`,
+		severity: "error"
+	});
+	else for (let t of e.input.procedures) (t.requiresScopes ?? []).includes(n.name) && r.push({
+		rule: "blast/scope-removed",
+		node: `${t.kind}(${t.tag})`,
+		...t.file === void 0 ? {} : { file: t.file },
+		breaks: [`requires scope '${n.name}' — would become unguarded/dangling if removed`],
+		fix: `remove the requireScope('${n.name}') call or keep the scope`,
+		severity: "error"
+	});
+	return r;
+}, a = (e, t) => {
+	let a = n(e), o = [...r(a), ...t === void 0 ? [] : i(a, t)];
+	return {
+		ok: !o.some((e) => e.severity === "error"),
+		diagnostics: o
+	};
+};
+//#endregion
+export { i, r as n, a as r, n as t };

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as e } from "./commands-a5PxCaIg.js";
+import { r as e } from "./commands-Brp4DI8u.js";
 import { a as t } from "./nodeEnvironment-cGFAj1J8.js";
 import { t as n } from "./loadEnv-D9nEOClM.js";
 import { n as r } from "./cliError-BmdYnghb.js";

package/dist/{build-Bi4O_g7T.js → build-CFmqF39c.js}

@@ -1,8 +1,8 @@
-import { gn as e } from "./dev-C31Nvlbv.js";
-import { $ as t, A as n, F as r, I as i, L as a, Q as o, a as s, b as c, d as l, et as u, f as d, ht as f, k as p, rt as m, s as h, v as g, vt as _, y as v } from "./webDev-B4IEMB0n.js";
+import { gn as e } from "./dev-C0cbqysu.js";
+import { $ as t, A as n, F as r, I as i, L as a, Q as o, a as s, b as c, d as l, et as u, f as d, ht as f, k as p, rt as m, s as h, v as g, vt as _, y as v } from "./webDev-BbdkzMbd.js";
 import { t as y } from "./cliRuntime-Dh7UDinH.js";
 import { a as b } from "./renderModeScan-D7J1B7Kw.js";
-import { i as x, o as S, s as C } from "./apiBuild-QmYHaCF4.js";
+import { i as x, o as S, s as C } from "./apiBuild-D3s7lx57.js";
 import { n as w } from "./renderProfile-1OWWAAtx.js";
 import { dirname as T, join as E, resolve as D } from "node:path";
 import { existsSync as O, promises as k } from "node:fs";
@@ -477,7 +477,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 		file: n.file,
 		reason: n.reason
 	});
-	let { regenerateRpcGroup: r } = await import("./codegenCommand-DApSH7hK.js"), i = await r(e);
+	let { regenerateRpcGroup: r } = await import("./codegenCommand-C0S27nbB.js"), i = await r(e);
 	if (i.kind === "refused") {
 		F.warn("could not regenerate the rpc group — building against what is on disk", { reason: i.reason });
 		return;
@@ -489,10 +489,10 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 }, K = async (e) => {
 	let n = await l(e);
 	if (!n) {
-		let { loadApiConfig: t } = await import("./dev-DFVuzOj7.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-Dz9GqA6P.js"), n = await t(e);
 		if (n) {
 			F.info("building api app", { app: n.name ?? "(unnamed)" }), await G(e);
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-dZbHdqMg.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BZ-plaQN.js");
 			await t(e);
 			try {
 				await r(e);
@@ -711,7 +711,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 	return t.ran ? t.exitCode : (yield* j.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), J = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-CIi5gM17.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-OZhiT2vz.js");
 		return e(t);
 	}
 	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await y(q(n), { scope: "voltro:build" }), i = e(n);

package/dist/{checkCommand-udbQpphy.js → checkCommand-DomvYDi1.js}

@@ -1,2 +1,2 @@
-import { n as e, r as t, t as n } from "./checkCommand-D8vjQXQt.js";
+import { n as e, r as t, t as n } from "./checkCommand-DsKIjL6k.js";
 export { n as offlineManifest, e as runCheckCommand, t as toInput };

package/dist/{checkCommand-D8vjQXQt.js → checkCommand-DsKIjL6k.js}

@@ -1,19 +1,19 @@
 import { t as e } from "./cliArgs-D4p8n7EE.js";
 import { a as t, l as n } from "./codegen-CrMXs4hb.js";
-import { r } from "./appGraph-KGDPTuTy.js";
+import { r } from "./appGraph-Cv2W_wO5.js";
 import { n as i } from "./cliOutput-D1tSBoRM.js";
 import { n as a, o, r as s, t as c } from "./inspectFetch-EMuhTG_9.js";
 import { r as l } from "./fileTaxonomy-CJfgOllU.js";
-import { S as u } from "./doctorCommand-B3uraeAe.js";
+import { S as u } from "./doctorCommand-DyViaaCP.js";
 import { resolve as d } from "node:path";
 import { readdirSync as f, statSync as p } from "node:fs";
 //#region src/observedDiff.ts
-var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PURE__ */ new Set([
-	"insert",
-	"update",
-	"delete",
-	"upsert"
-]), g = (e, t) => {
+var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = {
+	insert: ["insert"],
+	update: ["update"],
+	delete: ["delete"],
+	upsert: ["insert", "update"]
+}, g = (e) => e !== "read", _ = (e, t) => `{ table: '${e}', op: '${t}' }`, v = (e, t) => {
 	let n = [], r = new Set(t.exercised), i = /* @__PURE__ */ new Map();
 	for (let e of t.edges) {
 		let t = i.get(e.tag);
@@ -25,24 +25,32 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 			a.push(t.tag);
 			continue;
 		}
-		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(m(t.source)), u = new Map((t.targets ?? []).map((e) => [e.table, e.op]));
-		for (let t of c) if (h.has(t.op)) {
-			let r = u.get(t.table);
-			r === void 0 ? n.push({
+		let e = `${t.kind}(${t.tag})`, s = t.file, c = i.get(t.tag) ?? [], l = new Set(m(t.source)), u = /* @__PURE__ */ new Map();
+		for (let e of t.targets ?? []) {
+			let t = u.get(e.table) ?? /* @__PURE__ */ new Set();
+			t.add(e.op), u.set(e.table, t);
+		}
+		for (let t of c) if (g(t.op)) {
+			let r = h[t.op], i = u.get(t.table);
+			if (i === void 0) n.push({
 				rule: "observed/undeclared-write",
 				node: e,
 				...s === void 0 ? {} : { file: s },
 				breaks: [`writes '${t.table}' (${t.op}) but declares no target for it`, "subscriptions on that table are not invalidated by this mutation"],
-				fix: `add { table: '${t.table}', op: '${t.op}' } to this procedure's targets`,
-				severity: "warn"
-			}) : r !== t.op && n.push({
-				rule: "observed/wrong-op",
-				node: e,
-				...s === void 0 ? {} : { file: s },
-				breaks: [`declares op '${r}' on '${t.table}' but performed '${t.op}'`, "the synthesized optimistic patch has the wrong shape"],
-				fix: `change the target op for '${t.table}' to '${t.op}'`,
+				fix: `add ${r.map((e) => _(t.table, e)).join(" and ")} to this procedure's targets`,
 				severity: "warn"
 			});
+			else {
+				let a = r.filter((e) => !i.has(e));
+				a.length > 0 && n.push({
+					rule: "observed/wrong-op",
+					node: e,
+					...s === void 0 ? {} : { file: s },
+					breaks: [`declares ${[...i].map((e) => `'${e}'`).join(" + ")} on '${t.table}' but performed '${t.op}'`, "the synthesized optimistic patch has the wrong shape"],
+					fix: r.length > 1 ? `an upsert is both halves — declare ${r.map((e) => _(t.table, e)).join(" and ")}` : `change the target op for '${t.table}' to '${a[0]}'`,
+					severity: "warn"
+				});
+			}
 		} else !l.has(t.table) && !u.has(t.table) && n.push({
 			rule: "observed/undeclared-read",
 			node: e,
@@ -82,7 +90,7 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 			total: e.length
 		}
 	};
-}, _ = (e, n = [], r = 0) => {
+}, y = (e, n = [], r = 0) => {
 	if (r > 12) return n;
 	let i;
 	try {
@@ -106,24 +114,24 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 		} catch {
 			continue;
 		}
-		o.isDirectory() ? _(i, n, r + 1) : o.isFile() && t.test(a) && n.push(i);
+		o.isDirectory() ? y(i, n, r + 1) : o.isFile() && t.test(a) && n.push(i);
 	}
 	return n;
-}, v = /* @__PURE__ */ new Set(["actors", "tenants"]), y = async (e) => {
+}, b = /* @__PURE__ */ new Set(["actors", "tenants"]), x = async (e) => {
 	try {
 		let { readFile: t } = await import("node:fs/promises"), { join: n } = await import("node:path"), r = await t(n(e, "app.graph.observed.generated.json"), "utf8"), i = JSON.parse(r);
 		return i?.version !== 1 || !Array.isArray(i.edges) || !Array.isArray(i.exercised) ? null : i;
 	} catch {
 		return null;
 	}
-}, b = (e) => {
+}, S = (e) => {
 	let { exercised: t, total: n } = e.coverage, r = `\nobserved: ${t}/${n} procedures exercised (${n === 0 ? 0 : Math.round(t / n * 100)}%)`;
 	if (e.diagnostics.length === 0) return `${r}\n  no declared/observed mismatches${e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : ""}`;
 	let i = e.diagnostics.map((e) => `  ${e.node}${e.file === void 0 ? "" : ` (${e.file})`}\n` + e.breaks.map((e) => `    ${e}`).join("\n") + `\n    fix: ${e.fix}`), a = e.unexercised.length > 0 ? `\n  ${e.unexercised.length} unexercised — no recording, so nothing is claimed about them` : "";
 	return `${r}\n${i.join("\n")}${a}`;
-}, x = (e, t) => ({
+}, C = (e, t) => ({
 	tables: (t.tables ?? []).map((e) => e.name),
-	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || v.has(e.name)).map((e) => e.name),
+	frameworkOwnedTables: (t.tables ?? []).filter((e) => e.framework === !0 || e.name.startsWith("_voltro_") || b.has(e.name)).map((e) => e.name),
 	scopes: e.scopes ?? [],
 	procedures: (e.procedures ?? []).map((e) => {
 		let t = (e.guards ?? []).flatMap((e) => e.kind === "scope" ? e.scope ?? [] : []), n = (e.guards ?? []).find((e) => e.kind === "open")?.reason;
@@ -134,14 +142,15 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 			...e.targets === void 0 ? {} : { targets: e.targets },
 			...t.length > 0 ? { requiresScopes: [...new Set(t)] } : {},
 			...e.guards === void 0 ? {} : { hasGuards: e.guards.some((e) => e.kind !== "open") },
-			...n === void 0 ? {} : { openAccess: n }
+			...n === void 0 ? {} : { openAccess: n },
+			...e.internal === !0 ? { internal: !0 } : {}
 		};
 	})
-}), S = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
+}), w = (e) => e.length === 0 ? "✓ voltro check: no issues" : e.map((e) => {
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
-}).join("\n"), C = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-DFVuzOj7.js"), { buildRpcEntry: i } = await import("./manifestBuild-j0n109tt.js"), { buildCapabilityManifest: a } = await import("./inspect-DUze25t0.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+}).join("\n"), T = async (e) => {
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-Dz9GqA6P.js"), { buildRpcEntry: i } = await import("./manifestBuild-CPjhvM62.js"), { buildCapabilityManifest: a } = await import("./inspect-CuGDYES0.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
@@ -157,31 +166,31 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 		})), [], m),
 		tables: { tables: p }
 	};
-}, w = async (t) => {
+}, E = async (t) => {
 	let f = t.flatMap((e) => e === "--json" ? ["--format", "json"] : [e]), p = a(f);
 	if ("error" in p) return console.error(`voltro check: ${p.error}`), 1;
-	let { process: m, target: h, rest: v } = s(p.rest), w;
-	for (let e = 0; e < v.length; e++) if (v[e] === "--diff") {
-		let [t, n] = (v[++e] ?? "").split(":");
-		if (t === "removeTable" && n) w = {
+	let { process: m, target: h, rest: g } = s(p.rest), _;
+	for (let e = 0; e < g.length; e++) if (g[e] === "--diff") {
+		let [t, n] = (g[++e] ?? "").split(":");
+		if (t === "removeTable" && n) _ = {
 			kind: "removeTable",
 			name: n
 		};
-		else if (t === "removeProcedure" && n) w = {
+		else if (t === "removeProcedure" && n) _ = {
 			kind: "removeProcedure",
 			tag: n
 		};
-		else if (t === "removeScope" && n) w = {
+		else if (t === "removeScope" && n) _ = {
 			kind: "removeScope",
 			name: n
 		};
 		else return console.error("voltro check --diff: expected removeTable:<name> | removeProcedure:<tag> | removeScope:<name>"), 1;
 	}
-	let T = e(v, ["--diff"]) ?? process.cwd(), E = v.includes("--offline"), D = E ? [] : await o(m, h), O, k;
+	let b = e(g, ["--diff"]) ?? process.cwd(), E = g.includes("--offline"), D = E ? [] : await o(m, h), O, k;
 	if (D.length === 0) {
 		if (!E && h !== void 0) return console.error("voltro check: --url given but no api reachable there."), 1;
 		try {
-			let e = await C(d(T));
+			let e = await T(d(b));
 			O = e.manifest, k = e.tables;
 		} catch (e) {
 			return console.error(`voltro check: could not assemble the graph from source: ${e.message}`), console.error("  Start `voltro dev` to check against a running api instead."), 1;
@@ -191,21 +200,21 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 		if (t.kind === "err") return console.error(`voltro check: manifest fetch failed: ${t.error}`), 1;
 		O = t.data, k = n.kind === "ok" ? n.data : { tables: [] };
 	}
-	let A = x(O, k), j = r(A, w), M = [...l(T).findings.map((e) => ({
+	let A = C(O, k), j = r(A, _), M = [...l(b).findings.map((e) => ({
 		rule: e.rule,
 		node: e.file,
 		file: e.file,
 		breaks: [e.detail],
 		fix: e.fix,
 		severity: e.severity
-	})), ...u(T).map((e) => ({
+	})), ...u(b).map((e) => ({
 		rule: `page/${e.kind}`,
 		node: e.file,
 		file: e.file,
 		breaks: [e.kind === "suffixed-outside-pages" ? "a page.tsx outside src/pages/ never routes" : "no test beside it"],
 		fix: e.kind === "suffixed-outside-pages" ? "move it under src/pages/ into the directory whose route it serves, or rename it — page.tsx is reserved" : "write the test with the file — the name is derivable",
 		severity: e.kind === "suffixed-outside-pages" ? "error" : "warn"
-	}))], N = (await n(T, _(T))).map((e) => ({
+	}))], N = (await n(b, y(b))).map((e) => ({
 		rule: "client/not-browser-safe",
 		node: e.file,
 		file: e.file,
@@ -216,7 +225,7 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 		...j.diagnostics,
 		...M,
 		...N
-	], F = j.ok && !M.some((e) => e.severity === "error") && N.length === 0, I = await y(d(T)), L = I === null ? null : g(A.procedures, I);
+	], F = j.ok && !M.some((e) => e.severity === "error") && N.length === 0, I = await x(d(b)), L = I === null ? null : v(A.procedures, I);
 	return p.format === "json" ? i(L === null ? {
 		...j,
 		ok: F,
@@ -226,7 +235,7 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 		ok: F,
 		diagnostics: P,
 		observed: L
-	}) : (console.log(S(P)), L !== null && console.log(b(L)), console.log(F ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!F;
+	}) : (console.log(w(P)), L !== null && console.log(S(L)), console.log(F ? "\nvoltro check: OK" : "\nvoltro check: FAILED (errors above)")), +!F;
 };
 //#endregion
-export { w as n, x as r, C as t };
+export { E as n, C as r, T as t };

package/dist/{codegenCommand-DApSH7hK.js → codegenCommand-C0S27nbB.js}

@@ -1,5 +1,5 @@
-import { B as e, Sn as t, l as n, u as r, xn as i } from "./dev-C31Nvlbv.js";
-import { dt as a } from "./webDev-B4IEMB0n.js";
+import { B as e, Sn as t, l as n, u as r, xn as i } from "./dev-C0cbqysu.js";
+import { dt as a } from "./webDev-BbdkzMbd.js";
 import { n as o } from "./frameworkTableAssembly-BwJVEKLr.js";
 import { i as s, r as c } from "./codegen-CrMXs4hb.js";
 import { basename as l, join as u, relative as d, resolve as f } from "node:path";