@voltro/cli 0.51.0 → 0.53.0

package/dist/imagePipeline-CBZmjT4i.js

@@ -0,0 +1,127 @@
+import { join as e } from "node:path";
+import { mkdir as t, readFile as n, stat as r, writeFile as i } from "node:fs/promises";
+import { createHash as a } from "node:crypto";
+//#region src/imagePipeline.ts
+var o = [
+	640,
+	750,
+	828,
+	1080,
+	1200,
+	1920,
+	2048,
+	3840
+], s = {
+	formats: ["avif", "webp"],
+	quality: 75
+}, c = (e) => ({
+	formats: e?.formats !== void 0 && e.formats.length > 0 ? e.formats.filter((e) => e === "avif" || e === "webp") : s.formats,
+	quality: e?.quality !== void 0 && Number.isFinite(e.quality) && e.quality >= 1 && e.quality <= 100 ? Math.round(e.quality) : s.quality
+}), l, u = !1, d, f = async () => {
+	if (l !== void 0) return l;
+	try {
+		let e = await import("sharp");
+		l = e.default ?? e;
+	} catch (e) {
+		let t = e instanceof Error ? e.message : String(e);
+		d = t.includes("Could not load the sharp module") ? {
+			reason: "binary-missing",
+			detail: t
+		} : {
+			reason: "not-installed",
+			detail: t
+		}, l = null;
+	}
+	return l;
+}, p = () => d, m = (e) => {
+	if (u) return;
+	u = !0;
+	let t = d?.reason === "binary-missing" ? "sharp is installed but its platform binary is missing (an install that omitted optional dependencies drops the @img/* prebuilds). Reinstall without omitting optional deps, or run `pnpm add -D sharp` in this app to pin it directly." : "sharp is not installed. It ships as an optional dependency of @voltro/cli; if your installer skipped optional dependencies, run `pnpm add -D sharp` in this app.";
+	e.warn(`image pipeline: serving ORIGINAL images without srcSet variants or blur placeholders — ${t} Until then <Image> falls back to the passthrough loader.`);
+}, h = (e, t, n, r) => `${e}-w${t}-q${r}.${n}`, g = (t) => e(t, ".framework", "image-cache"), _ = (e) => a("sha256").update(e).digest("hex").slice(0, 16), v = 4, y = 0, b = [], x = async (e) => {
+	y >= v && await new Promise((e) => b.push(e)), y += 1;
+	try {
+		return await e();
+	} finally {
+		--y, b.shift()?.();
+	}
+}, S = async (r) => {
+	let a = await f();
+	if (!a) return null;
+	let o = e(r.cacheDir, h(r.sourceHash, r.width, r.format, r.quality));
+	try {
+		let e = await n(o);
+		return r.onCache?.("hit"), new Uint8Array(e);
+	} catch {}
+	r.onCache?.("miss");
+	let s = await x(async () => {
+		let e = await a(Buffer.from(r.sourceBytes), { failOn: "none" }).resize({
+			width: r.width,
+			withoutEnlargement: !0
+		}).toFormat(r.format, { quality: r.quality }).toBuffer();
+		return new Uint8Array(e);
+	});
+	return await t(r.cacheDir, { recursive: !0 }), await i(o, s), s;
+}, C = async (e) => {
+	let t = await f();
+	if (!t) return null;
+	try {
+		let n = await t(Buffer.from(e), { failOn: "none" }).metadata();
+		return n.width === void 0 || n.height === void 0 || n.format === void 0 ? null : {
+			width: n.width,
+			height: n.height,
+			format: n.format
+		};
+	} catch {
+		return null;
+	}
+}, w = async (e, t, n) => {
+	let r = await S({
+		sourceBytes: e,
+		sourceHash: t,
+		width: 16,
+		format: "webp",
+		quality: 40,
+		cacheDir: n
+	});
+	return r === null ? null : `data:image/webp;base64,${Buffer.from(r).toString("base64")}`;
+}, T = (e) => [...o.filter((t) => t < e), e], E = async (e) => {
+	let t = await C(e.sourceBytes);
+	if (t === null) return null;
+	let n = _(e.sourceBytes), r = T(t.width), i = t.format === "png" ? "png" : "jpeg", a = [...e.config.formats, i], o = [];
+	for (let t of a) for (let i of r) {
+		let r = await S({
+			sourceBytes: e.sourceBytes,
+			sourceHash: n,
+			width: i,
+			format: t,
+			quality: e.config.quality,
+			cacheDir: e.cacheDir,
+			...e.onCache === void 0 ? {} : { onCache: e.onCache }
+		});
+		if (r === null) return null;
+		o.push({
+			width: i,
+			format: t,
+			bytes: r,
+			hash: _(r)
+		});
+	}
+	let s = await w(e.sourceBytes, n, e.cacheDir);
+	return s === null ? null : {
+		width: t.width,
+		height: t.height,
+		blurDataURL: s,
+		widths: r,
+		variants: o,
+		fallbackFormat: i
+	};
+}, D = async (e) => {
+	try {
+		return (await r(e)).isFile() ? new Uint8Array(await n(e)) : null;
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { g as a, f as c, S as d, m as f, E as i, D as l, o as n, c as o, T as p, w as r, C as s, s as t, p as u };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-B1OiS9bX.js";
+import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-DyxAmhP0.js";
 import { r as o } from "./templates-BR-fb4SP.js";
 //#region src/index.ts
 var s = "framework";

package/dist/{infoCommand-BnRFEF1o.js → infoCommand-_53iOc_j.js}

@@ -1,5 +1,5 @@
 import { n as e, r as t, t as n } from "./cliOutput-D1tSBoRM.js";
-import { o as r } from "./updateCommand-Bs322Q78.js";
+import { o as r } from "./updateCommand-C_8I8Rzo.js";
 import { join as i, resolve as a } from "node:path";
 import { readFileSync as o, readdirSync as s, statSync as c } from "node:fs";
 //#region src/infoCommand.ts

package/dist/{inspect-CtL_xTbu.js → inspect-Bd8-9wsi.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./inspectGateHint-BjnFubmH.js";
+import { n as e } from "./inspectGateHint-4LxkNtrz.js";
 import { lastWriteProvenance as t } from "@voltro/runtime";
 import { timingSafeStringEqual as n } from "@voltro/protocol/session";
 //#region src/inspect.ts

package/dist/inspect-CuoDInfZ.js

@@ -0,0 +1,2 @@
+import { r as e } from "./inspect-Bd8-9wsi.js";
+export { e as buildCapabilityManifest };

package/dist/{inspectGateHint-BjnFubmH.js → inspectGateHint-4LxkNtrz.js}

@@ -1,5 +1,5 @@
 //#region src/inspectGateHint.ts
-var e = (e) => e === 401 || e === 403, t = (e) => e === 403 ? "The inspect surface rejected the credential. VOLTRO_INSPECT_TOKEN must be set on the SERVER and in this shell, and the two values must match. (This is a framework gate, not a database permission.)" : "The inspect surface is gated and this request carried no credential. Set VOLTRO_INSPECT_TOKEN on the server and in this shell (same value), or pass --token.", n = "`voltro dev` mints VOLTRO_INSPECT_WRITE_TOKEN into the project's gitignored .env.local, so read the value from there and send it in this shell; outside dev nothing mints it and you set it explicitly on both sides.", r = (e, t) => {
+var e = (e) => e === 401 || e === 403, t = (e) => e === 403 ? "The inspect surface rejected the credential. VOLTRO_INSPECT_TOKEN must be set on the SERVER and in this shell, and the two values must match. (This is a framework gate, not a database permission.)" : "The inspect surface is gated and this request carried no credential. Set VOLTRO_INSPECT_TOKEN on the server and in this shell (same value), or pass --token.", n = "`voltro dev` mints VOLTRO_INSPECT_WRITE_TOKEN into the project's gitignored .env.local, so read the value from there and send it in this shell; outside dev nothing mints it — generate one with `voltro secret generate inspect-write` and set it explicitly on both sides.", r = (e, t) => {
 	let r = `inspect: ${(t || "unknown-method").toUpperCase()} is a mutating request and needs the WRITE credential — VOLTRO_INSPECT_WRITE_TOKEN, sent as the \`x-voltro-inspect-write\` header alongside the bearer. The read token authorises reads only.`;
 	return e === "unset" ? `${r} The SERVER has none configured, so no header can satisfy this. Mutating inspect endpoints (GDPR erase/export, storage share/revoke, schedule fire) need their own secret. ${n}` : e === "mismatch" ? `${r} The header was sent and does not match the server's value — so this is the two values disagreeing, not a missing setting. ${n}` : `${r} This request carried no such header. ${n}`;
 };

package/dist/inspectMetrics-CGF94puw.js

@@ -0,0 +1,143 @@
+import { o as e, t } from "./connectionConfig-Bk9IC7D0.js";
+import { createLogger as n } from "@voltro/logger";
+import { Effect as r } from "effect";
+import { recordSample as i, setRevalidationPublisher as a } from "@voltro/runtime";
+import { channelFor as o, resolveBroadcastNamespace as s, resolveBroadcastProvider as c } from "@voltro/plugin-broadcast";
+//#region src/revalidationWiring.ts
+var l = "voltro_revalidate", u = (e) => o(s({ env: e.VOLTRO_BROADCAST_NAMESPACE }), "revalidate"), d = (i) => {
+	let o = i.logger ?? n({ scope: "voltro:revalidate" });
+	if (i.mode === "dev") return a((e) => (o.debug(`revalidate ${e.kind} '${e.value}' — no-op under voltro dev (no ISR cache)`), Promise.resolve())), {
+		transports: [],
+		stop: () => (a(null), Promise.resolve())
+	};
+	let s = [], d = i.dialect === "postgres" && t(), f = null, m = null, h = () => m || (m = (async () => {
+		try {
+			let t = new (await (import("pg"))).default.Client(e());
+			return await t.connect(), f = t, t;
+		} catch (e) {
+			return o.warn("revalidate: could not open the NOTIFY connection — pg transport disabled for this process", {}, e), null;
+		}
+	})(), m);
+	d && s.push("pg-notify");
+	let g = null, _ = !1;
+	if (i.provider !== void 0 && i.provider.name !== "memory") g = i.provider;
+	else if (i.provider === void 0) {
+		let e = c({}, process.env);
+		e.crossReplica && (g = e.provider, _ = !0);
+	}
+	let v = u(process.env);
+	return g && s.push("broker"), a(async (e) => {
+		let t = JSON.stringify(e), n = !1;
+		if (d) {
+			let r = await h();
+			if (r) try {
+				await r.query("SELECT pg_notify($1, $2)", [l, t]), n = !0;
+			} catch (t) {
+				o.warn(`revalidate ${e.kind} '${e.value}': NOTIFY failed`, {}, t);
+			}
+		}
+		if (g) try {
+			await r.runPromise(g.publish(v, t)), n = !0;
+		} catch (t) {
+			o.warn(`revalidate ${e.kind} '${e.value}': broker publish failed`, {}, t);
+		}
+		!n && s.length === 0 && p(o);
+	}), s.length > 0 && o.info(`revalidation publisher: ${s.join(" + ")}`, {
+		...d ? { pgChannel: l } : {},
+		...g ? { brokerChannel: v } : {}
+	}), {
+		transports: s,
+		stop: async () => {
+			if (a(null), f) {
+				try {
+					await f.end();
+				} catch {}
+				f = null;
+			}
+			if (g && _) try {
+				await r.runPromise(g.close());
+			} catch {}
+			g = null;
+		}
+	};
+}, f = !1, p = (e) => {
+	f || (f = !0, e.warn("revalidatePath/revalidateTable/revalidateTag was called, but this process has NO transport to reach the web replicas: the store is not postgres (no NOTIFY line) and no broker is configured. The call is a no-op — cached pages stay until their own `revalidate` window. Set BROADCAST_URL (redis:// or nats://) on BOTH the api and the web deployment, or run on postgres where the NOTIFY line is built in."));
+}, m = (e) => {
+	let t = {}, n = e?.http?.maxBodyBytes;
+	typeof n == "number" && Number.isFinite(n) && n > 0 && (t.maxBodyBytes = n);
+	let r = e?.http?.compression;
+	if (r !== void 0) {
+		let e = {};
+		typeof r.enabled == "boolean" && (e.enabled = r.enabled), typeof r.minBytes == "number" && Number.isFinite(r.minBytes) && r.minBytes >= 0 && (e.minBytes = r.minBytes), t.compression = e;
+	}
+	return t;
+}, h = 5e3, g = 6e4, _ = (e, t) => {
+	if (e.length === 0) return 0;
+	if (e.length === 1) return e[0];
+	let n = t * (e.length - 1), r = Math.floor(n), i = Math.ceil(n);
+	if (r === i) return e[r];
+	let a = n - r;
+	return e[r] * (1 - a) + e[i] * a;
+}, v = (e) => {
+	if (e.length === 0) return {
+		p50: 0,
+		p95: 0,
+		p99: 0,
+		mean: 0,
+		min: 0,
+		max: 0
+	};
+	let t = e.slice().sort((e, t) => e - t), n = 0;
+	for (let e of t) n += e;
+	return {
+		p50: _(t, .5),
+		p95: _(t, .95),
+		p99: _(t, .99),
+		mean: n / t.length,
+		min: t[0],
+		max: t[t.length - 1]
+	};
+}, y = (e = {}) => {
+	let t = e.maxSamples ?? h, n = e.defaultWindowMs ?? g, r = [];
+	return {
+		record(e) {
+			i(e), r.push({
+				...e,
+				ts: Date.now()
+			}), r.length > t && r.shift();
+		},
+		snapshot(e) {
+			let t = e ?? n, i = Date.now(), a = i - t, o = /* @__PURE__ */ new Map(), s = 0;
+			for (let e of r) {
+				if (e.ts < a) continue;
+				s++;
+				let t = `${e.kind}\u0000${e.tag}`, n = o.get(t);
+				n || (n = {
+					kind: e.kind,
+					tag: e.tag,
+					samples: []
+				}, o.set(t, n)), n.samples.push(e);
+			}
+			let c = [];
+			for (let e of o.values()) {
+				let t = e.samples.map((e) => e.durationMs), n = 0;
+				for (let t of e.samples) t.status === "error" && n++;
+				c.push({
+					kind: e.kind,
+					tag: e.tag,
+					count: e.samples.length,
+					errorCount: n,
+					latencyMs: v(t)
+				});
+			}
+			return c.sort((e, t) => t.count - e.count), {
+				windowMs: t,
+				capturedAt: i,
+				totalSamples: s,
+				buckets: c
+			};
+		}
+	};
+};
+//#endregion
+export { d as i, m as n, u as r, y as t };

package/dist/manifestBuild-C4-J1-m_.js

@@ -0,0 +1,2 @@
+import { t as e } from "./manifestBuild-Cqgsx2bM.js";
+export { e as buildRpcEntry };

package/dist/{manifestBuild-CuU1VrSm.js → manifestBuild-Cqgsx2bM.js}

@@ -1,4 +1,4 @@
-import { P as e } from "./inspect-CtL_xTbu.js";
+import { P as e } from "./inspect-Bd8-9wsi.js";
 import { JSONSchema as t } from "effect";
 //#region src/manifestBuild.ts
 var n = (e) => {

package/dist/{metaCommands-CfRLra0s.js → metaCommands-Cn2oboG4.js}

@@ -1,7 +1,7 @@
 import { i as e, n as t, r as n } from "./cliArgs-D4p8n7EE.js";
 import { t as r } from "./cliRuntime-Dh7UDinH.js";
-import { n as i } from "./renderProfile-1OWWAAtx.js";
-import { a, i as o } from "./projectScaffold-mIX_DpSe.js";
+import { n as i } from "./renderProfile-CskIgAfn.js";
+import { a, i as o } from "./projectScaffold-B4dmTlwT.js";
 import { t as s } from "./discover-C9XKJDco.js";
 import { basename as c, join as l, relative as u, resolve as d } from "node:path";
 import { createLogger as f } from "@voltro/logger";
@@ -141,7 +141,13 @@ var v = /* @__PURE__ */ new Set([
 		env: "VOLTRO_INSPECT_TOKEN",
 		encoding: "base64url",
 		bytes: 32,
-		note: "bearer token for /_voltro/inspect/*"
+		note: "bearer token for /_voltro/inspect/* (reads)"
+	},
+	"inspect-write": {
+		env: "VOLTRO_INSPECT_WRITE_TOKEN",
+		encoding: "base64url",
+		bytes: 32,
+		note: "second factor for MUTATING inspect endpoints (x-voltro-inspect-write header)"
 	},
 	webhook: {
 		env: "VOLTRO_WEBHOOK_SECRET_<ID>",

package/dist/{migrate-DehuBakM.js → migrate-Cko9rswM.js}

@@ -1,7 +1,7 @@
 import { t as e } from "./cliError-BmdYnghb.js";
 import { r as t } from "./dialectDriver-czCHYpeH.js";
 import { a as n, r } from "./connectionConfig-Bk9IC7D0.js";
-import { g as i, n as a, s as o } from "./frameworkTableAssembly-BwJVEKLr.js";
+import { g as i, n as a, s as o } from "./frameworkTableAssembly-DKx3ba3S.js";
 import { t as s } from "./cliRuntime-Dh7UDinH.js";
 import { join as c, relative as l, resolve as u } from "node:path";
 import { pathToFileURL as d } from "node:url";
@@ -79,7 +79,7 @@ var _ = /* @__PURE__ */ new Set([
 		let t = u(e.find((e) => !e.startsWith("-")) ?? process.cwd());
 		return s(S(t), { scope: "voltro:migrate" });
 	}
-	let { runDbCommand: t } = await import("./dbCommand-C27HIsGE.js");
+	let { runDbCommand: t } = await import("./dbCommand-B1EXBC6f.js");
 	return t(["apply", ...e]);
 };
 //#endregion

package/dist/{pageConvention-cEiRxdab.js → pageConvention-C938S8oC.js}

@@ -1,4 +1,4 @@
-import { T as e } from "./fileConventions-Cof68_BL.js";
+import { E as e } from "./fileConventions-DASGEmj-.js";
 //#region src/pageConvention.ts
 var t = (t) => e.test(t), n = (e) => e.replace(/page\.tsx$/, "page.test.tsx");
 //#endregion

package/dist/{privacyCommand-XejDMvmu.js → privacyCommand-DWTQMC6R.js}

@@ -1,6 +1,6 @@
 import { t as e } from "./cliError-BmdYnghb.js";
 import { i as t, n, t as r } from "./cliArgs-D4p8n7EE.js";
-import { b as i, y as a } from "./fileConventions-Cof68_BL.js";
+import { b as i, x as a } from "./fileConventions-DASGEmj-.js";
 import { n as o } from "./cliOutput-D1tSBoRM.js";
 import { join as s, resolve as c } from "node:path";
 import { promises as l } from "node:fs";
@@ -38,7 +38,7 @@ var _ = d({ scope: "voltro:privacy" }), v = /* @__PURE__ */ new Set([
 	return await r(e), n;
 }, x = (e) => typeof e == "object" && !!e && "tableName" in e && "fields" in e && typeof e.tableName == "string", S = async (e) => {
 	f();
-	let t = 0, n = 0, r = [...await b(e, i), ...await b(e, a)];
+	let t = 0, n = 0, r = [...await b(e, a), ...await b(e, i)];
 	for (let e of r) {
 		let r;
 		try {

package/dist/{probeCommand-C9gazU0H.js → probeCommand-DkGGLknv.js}

@@ -1,4 +1,4 @@
-import { r as e, t } from "./inspectGateHint-BjnFubmH.js";
+import { r as e, t } from "./inspectGateHint-4LxkNtrz.js";
 import { n } from "./cliOutput-D1tSBoRM.js";
 import { n as r, o as i, r as a, t as o } from "./inspectFetch-EMuhTG_9.js";
 import { ansi as s } from "@voltro/logger";
@@ -57,25 +57,84 @@ server and in this shell.`);
 		verdict: "refused",
 		detail: `refused (${a})`
 	};
-}, d = 0, f = (e) => ({
+}, d = 0, f = (e, t) => ({
 	_tag: "Request",
 	id: String(++d),
 	tag: e,
-	payload: {},
+	payload: t,
 	headers: []
-}), p = async (e, t) => {
-	let { verdict: n, detail: r } = u(await o(e, "/rpc", {
+}), p = (e, t = 0) => {
+	if (t > 6 || typeof e != "object" || !e) return;
+	let n = e;
+	switch (n._tag) {
+		case "StringKeyword": return "probe";
+		case "NumberKeyword": return 0;
+		case "BooleanKeyword": return !1;
+		case "BigIntKeyword": return "0";
+		case "UnknownKeyword":
+		case "AnyKeyword":
+		case "ObjectKeyword": return {};
+		case "VoidKeyword":
+		case "UndefinedKeyword": return;
+		case "Literal": return n.literal;
+		case "Enums": return n.enums?.[0]?.[1];
+		case "TypeLiteral": {
+			let e = {};
+			for (let r of n.propertySignatures ?? []) {
+				if (r.isOptional === !0) continue;
+				let n = p(r.type, t + 1);
+				if (n === void 0) return;
+				e[String(r.name)] = n;
+			}
+			return e;
+		}
+		case "TupleType": {
+			if ((n.elements ?? []).length === 0) return [];
+			let e = (n.elements ?? []).map((e) => p(e.type ?? e, t + 1));
+			return e.some((e) => e === void 0) ? void 0 : e;
+		}
+		case "Union":
+			for (let e of n.types ?? []) {
+				let n = p(e, t + 1);
+				if (n !== void 0) return n;
+			}
+			(n.types ?? []).some((e) => e._tag === "UndefinedKeyword");
+			return;
+		case "Refinement":
+		case "Transformation": return p(n.from, t + 1);
+		case "Suspend": return;
+		default: return;
+	}
+}, m = async (e) => {
+	let t = /* @__PURE__ */ new Map();
+	try {
+		let { walk: n, loadDiscovered: r } = await import("./dev-GjJWAYo2.js"), i = await r(await n(e)), a = [
+			...i.queries,
+			...i.mutations,
+			...i.actions,
+			...i.streams
+		];
+		for (let e of a) {
+			let n = e.descriptor.input;
+			if (n?.ast === void 0) continue;
+			let r = p(n.ast);
+			r !== void 0 && t.set(e.descriptor.name, r);
+		}
+	} catch {}
+	return t;
+}, h = async (e, t, n) => {
+	let { verdict: r, detail: i } = u(await o(e, "/rpc", {
 		method: "POST",
-		body: f(t.tag),
+		body: f(t.tag, n),
 		anonymous: !0
 	}));
 	return {
 		tag: t.tag,
 		kind: t.kind,
-		verdict: n,
-		detail: r
+		verdict: r,
+		detail: i
 	};
-}, m = (e, t, r, i) => {
+}, g = (e, t, r, i) => {
 	let a = t.filter((e) => e.verdict === "admitted"), o = t.filter((e) => e.verdict === "inconclusive"), c = t.filter((e) => e.verdict === "refused");
 	if (r === "json") n({
 		app: e,
@@ -107,28 +166,28 @@ server and in this shell.`);
   There an anonymous request carries \`tenantId: null\`, which is the case a guard
   has to refuse — and the case a tenant-keyed role map most easily gets wrong.`), 1) : i && o.length > 0 ? (r !== "json" && console.error(`\n${s.yellow("--strict:")} ${o.length} procedure(s) could not be judged.\n  Their calls failed before the guard was reached (usually payload validation).
   That is not evidence of enforcement, so under --strict it is not a pass.`), 1) : 0;
-}, h = async (n) => {
+}, _ = async (n) => {
 	let c = r(n);
 	if ("error" in c) return console.error(`voltro probe access: ${c.error}`), 1;
-	let { format: u } = c, { process: d, target: f, rest: h, error: g } = a(c.rest);
-	if (g !== void 0) return console.error(`voltro probe access: ${g}`), 1;
-	let _ = h.includes("--strict"), v = await i(d, f);
-	if (v.length === 0) return console.error("voltro probe access: no live api found.\n  This command asks a RUNNING app what it does — there is nothing to ask a source tree.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
-	let y = 0;
-	for (let n of v) {
+	let { format: u } = c, { process: d, target: f, rest: p, error: _ } = a(c.rest);
+	if (_ !== void 0) return console.error(`voltro probe access: ${_}`), 1;
+	let v = p.includes("--strict"), y = await i(d, f);
+	if (y.length === 0) return console.error("voltro probe access: no live api found.\n  This command asks a RUNNING app what it does — there is nothing to ask a source tree.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
+	let b = 0;
+	for (let n of y) {
 		let r = await o(n, "/_voltro/inspect/manifest");
 		if (r.kind === "err" || r.status < 200 || r.status >= 300) {
-			console.error(`${s.red("✗")} ${n.name}: could not read the manifest — ${r.kind === "err" ? r.error : `HTTP ${r.status}`}`), r.kind === "ok" && e(r.status) && console.error(`  ${t(r.status)}`), y = 1;
+			console.error(`${s.red("✗")} ${n.name}: could not read the manifest — ${r.kind === "err" ? r.error : `HTTP ${r.status}`}`), r.kind === "ok" && e(r.status) && console.error(`  ${t(r.status)}`), b = 1;
 			continue;
 		}
-		let i = l(r.data?.procedures ?? []), a = [];
-		for (let e of i) a.push(await p(n, e));
-		y = Math.max(y, m(n.name, a, u, _));
+		let i = l(r.data?.procedures ?? []), a = await m(process.cwd()), c = [];
+		for (let e of i) c.push(await h(n, e, a.get(e.tag) ?? {}));
+		b = Math.max(b, g(n.name, c, u, v));
 	}
-	return y;
-}, g = async (e) => {
+	return b;
+}, v = async (e) => {
 	let [t, ...n] = e;
-	return t === void 0 || t === "--help" || t === "-h" ? (c(), +(t === void 0)) : t === "access" ? h(n) : (console.error(`voltro probe: unknown subcommand "${t}" (expected: access)`), 1);
+	return t === void 0 || t === "--help" || t === "-h" ? (c(), +(t === void 0)) : t === "access" ? _(n) : (console.error(`voltro probe: unknown subcommand "${t}" (expected: access)`), 1);
 };
 //#endregion
-export { g as runProbeCommand };
+export { v as runProbeCommand };

package/dist/{projectScaffold-mIX_DpSe.js → projectScaffold-B4dmTlwT.js}

@@ -1,7 +1,7 @@
 import { a as e, i as t, n, r, t as i } from "./templates-BR-fb4SP.js";
 import { i as a, n as o, t as s } from "./cloudClient-DWL-Hw_T.js";
 import { t as c } from "./cliRuntime-Dh7UDinH.js";
-import { n as l } from "./agentsMd-D6yD7IQv.js";
+import { n as l } from "./agentsMd-0l980yhL.js";
 import { n as u } from "./addCommand-C05L9tZh.js";
 import { a as d, n as f, r as p } from "./baselineCommand-Ck2Xm8M7.js";
 import { basename as m, dirname as h, join as g, resolve as _ } from "node:path";

package/dist/{projectScaffold-BIl97_E6.js → projectScaffold-EzlErR4E.js}

@@ -1,2 +1,2 @@
-import { c as e, l as t, s as n } from "./projectScaffold-mIX_DpSe.js";
+import { c as e, l as t, s as n } from "./projectScaffold-B4dmTlwT.js";
 export { n as runAddApp, e as runCreateProject, t as runListTemplates };

package/dist/{renderModeScan-D7J1B7Kw.js → renderModeScan-CUbOeOAg.js}

@@ -2,23 +2,29 @@ import { join as e } from "node:path";
 import { readFile as t } from "node:fs/promises";
 //#region src/isrCache.ts
 var n = () => {
-	let e = /* @__PURE__ */ new Map();
+	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map(), n = (e) => {
+		t.set(e, (t.get(e) ?? 0) + 1);
+	};
 	return {
 		get(t) {
 			return e.get(t);
 		},
-		set(t, n) {
-			e.set(t, n);
+		set(n, r, i) {
+			return i?.ifGeneration !== void 0 && (t.get(n) ?? 0) !== i.ifGeneration ? !1 : (e.set(n, r), !0);
+		},
+		generation(e) {
+			return t.get(e) ?? 0;
 		},
 		invalidate(t) {
-			e.delete(t);
+			e.delete(t), n(t);
 		},
 		invalidateBy(t) {
-			let n = 0;
-			for (let r of e.keys()) t(r) && (e.delete(r), n++);
-			return n;
+			let r = 0;
+			for (let i of e.keys()) t(i) && (e.delete(i), n(i), r++);
+			return r;
 		},
 		clear() {
+			for (let t of e.keys()) n(t);
 			e.clear();
 		},
 		size() {
@@ -67,7 +73,9 @@ var n = () => {
 	interactive: e.interactive ?? "full",
 	hasLoader: typeof e.loader == "function",
 	hasMeta: e.meta != null,
-	hasGetStaticPaths: typeof e.getStaticPaths == "function"
+	hasGetStaticPaths: typeof e.getStaticPaths == "function",
+	hasOgImage: typeof e.ogImage == "function",
+	ppr: e.ppr === !0
 }), m = /export\s+const\s+renderMode\s*(?::[^=]+)?=\s*['"]([^'"]*)['"]/, h = (e) => m.exec(e)?.[1] ?? null, g = /export\s*\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g, _ = (e) => {
 	g.lastIndex = 0;
 	let t;
@@ -88,7 +96,16 @@ var n = () => {
 		if ((t === -1 ? e : e.slice(t + 4)).trim() === "default") return !0;
 	}
 	return !1;
-}, b = async (n, r) => {
+}, b = (e) => {
+	if (/^export const searchParams\b/m.test(e)) return !0;
+	v.lastIndex = 0;
+	let t;
+	for (; (t = v.exec(e)) !== null;) for (let e of t[1].split(",")) {
+		let t = e.lastIndexOf(" as ");
+		if ((t === -1 ? e : e.slice(t + 4)).trim() === "searchParams") return !0;
+	}
+	return !1;
+}, x = async (n, r) => {
 	let i = (await Promise.all(r.map(async (r) => {
 		let i;
 		try {
@@ -97,9 +114,9 @@ var n = () => {
 			return null;
 		}
 		let a = h(i);
-		return a !== null && !c(a) ? u(e("src", "pages", r.file), a) : y(i) ? null : `${e("src", "pages", r.file)} is a route (a \`page.tsx\` under src/pages/) but exports no default.\n\n  A page's default export IS its component — the router has nothing to render without it,\n  and the failure would otherwise surface only in \`voltro build\`'s prerender as\n  "SSR received a descriptor with no Component", long after the file was written.\n\n  Fix: \`export default function Page() { … }\`, or re-export another page's component\n  (\`export { default } from '../page'\`). If this file is NOT a route, rename it —\n  only the reserved names route, and anything else under src/pages/ is ordinary code\n  that may live beside the page that uses it.`;
+		return a !== null && !c(a) ? u(e("src", "pages", r.file), a) : a === "isr" && b(i) ? `${e("src", "pages", r.file)} declares BOTH renderMode 'isr' and a \`searchParams\` schema.\n\n  The isr cache is keyed by path (plus tenant+locale) — the query string is not part of\n  the key, so the first request's variant would be cached and served for every other\n  query. A page whose render varies by search params cannot be isr-cached safely.\n\n  Fix: use \`renderMode: 'ssr'\` (per-request render, params fully honoured), or remove\n  the \`searchParams\` export and read the query client-side only.` : y(i) ? null : `${e("src", "pages", r.file)} is a route (a \`page.tsx\` under src/pages/) but exports no default.\n\n  A page's default export IS its component — the router has nothing to render without it,\n  and the failure would otherwise surface only in \`voltro build\`'s prerender as\n  "SSR received a descriptor with no Component", long after the file was written.\n\n  Fix: \`export default function Page() { … }\`, or re-export another page's component\n  (\`export { default } from '../page'\`). If this file is NOT a route, rename it —\n  only the reserved names route, and anything else under src/pages/ is ordinary code\n  that may live beside the page that uses it.`;
 	}))).filter((e) => e !== null);
 	if (i.length !== 0) throw Error(i.join("\n\n"));
 };
 //#endregion
-export { p as a, f as c, o as d, n as f, s as i, i as l, h as n, c as o, r as p, _ as r, u as s, b as t, a as u };
+export { p as a, f as c, o as d, n as f, s as i, i as l, h as n, c as o, r as p, _ as r, u as s, x as t, a as u };

package/dist/{renderProfile-1OWWAAtx.js → renderProfile-CskIgAfn.js}

@@ -1,5 +1,5 @@
-import { m as e } from "./fileConventions-Cof68_BL.js";
-import { i as t, n, o as r, r as i, s as a } from "./renderModeScan-D7J1B7Kw.js";
+import { h as e } from "./fileConventions-DASGEmj-.js";
+import { i as t, n, o as r, r as i, s as a } from "./renderModeScan-CUbOeOAg.js";
 import { dirname as o, join as s, relative as c, resolve as l } from "node:path";
 import { Effect as u } from "effect";
 import { readFile as d, readdir as f } from "node:fs/promises";

package/dist/{runtimeTrace-ZsBU7Tkx.js → runtimeTrace-c0APJz7E.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./apiBuild-CPDHXF72.js";
+import { n as e } from "./apiBuild-CaPfoWku.js";
 import { join as t, resolve as n, sep as r } from "node:path";
 import { existsSync as i, promises as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";

package/dist/{sdkgen-O4XqWOjM.js → sdkgen-BiQCgIEr.js}

@@ -422,7 +422,7 @@ let package = Package(
 		await l.mkdir(o(e), { recursive: !0 }), await l.writeFile(e, n.content, "utf8");
 	}
 }, X = async (e) => {
-	let { offlineManifest: t } = await import("./checkCommand-CWcnDArJ.js"), { manifest: n } = await t(e);
+	let { offlineManifest: t } = await import("./checkCommand-D2ZduVlh.js"), { manifest: n } = await t(e);
 	return n;
 }, Z = async (e) => {
 	let t = J(await (e.manifestProvider ?? X)(e.root), {