@voltro/cli 0.1.0

package/templates/apps/api-feature-flags/app.config.ts

@@ -0,0 +1,41 @@
+// Feature-flag backend for the {{projectName}} project.
+//
+// `flagsPlugin` declares flags AS CODE and gates rpc calls two ways:
+//   - declaratively via `gatedBy` (an off flag fails typed FlagDisabled
+//     BEFORE the handler runs), and
+//   - in-handler via `requireFlag(ctx, key)` / `isFlagEnabled(ctx, key)`.
+// A flag is a bare boolean (kill-switch) OR a rich definition with a
+// deterministic `% rollout` and OR-of-rules `targeting`. `store: 'memory'`
+// keeps this zero-infra; `store: 'postgres'` adds runtime-toggleable flags
+// overlaid on the code baseline.
+import { defineEnv, envVar } from '@voltro/env'
+import { flagsPlugin } from '@voltro/plugin-flags'
+
+export const env = defineEnv({
+  LOG_LEVEL: envVar.enum(['debug', 'info', 'warn', 'error'], { access: 'public', default: 'info' }),
+})
+
+export default {
+  type:  'api' as const,
+  name:  '{{capProjectName}}{{capAppName}}',
+  store: 'memory' as const,
+  plugins: [
+    flagsPlugin({
+      flags: {
+        // Bare boolean = kill-switch. `newEditor` is ON — the in-handler
+        // requireFlag guard on notes.create passes.
+        newEditor: true,
+        // OFF — the gatedBy map below blocks notes.export with FlagDisabled.
+        betaExport: false,
+        // Targeting: only subjects whose metadata says plan=pro see it.
+        proDashboard: { targeting: [{ metadata: { plan: 'pro' } }], description: 'Pro-plan dashboard.' },
+        // Deterministic % rollout — a given subject is stably in or out.
+        gradualRollout: { rollout: 25, description: '25% gradual rollout, bucketed by subject.' },
+      },
+      // Declarative gate: tag → flag. An off flag fails FlagDisabled pre-handler.
+      gatedBy: { 'notes.export': 'betaExport' },
+      store: 'memory',
+    }),
+  ],
+  env,
+}

package/templates/apps/api-feature-flags/database/schema.ts

@@ -0,0 +1,37 @@
+// Schema for the {{projectName}} feature-flags backend — a tiny `notes`
+// domain to gate. `actors` + `tenants` are the framework core tables.
+
+import {
+  databaseHandle,
+  id,
+  table,
+  text,
+  timestamp,
+  type InferRow,
+} from '@voltro/database'
+import { tenant } from '@voltro/plugin-multitenancy'
+
+export const actors = table('actors', {
+  id:          id(),
+  kind:        text().oneOf(['user', 'serviceAccount', 'apiKey', 'system']),
+  displayName: text().nullable(),
+  createdAt:   timestamp().default('now'),
+})
+
+export const tenants = table('tenants', {
+  id:        id(),
+  name:      text(),
+  createdAt: timestamp().default('now'),
+})
+
+export const notes = table('notes', {
+  id:    id({ prefix: 'note' }),
+  title: text(),
+  body:  text(),
+})
+  .with(tenant())
+  .reactive()
+
+export type Note = InferRow<typeof notes>
+
+export const database = databaseHandle({ actors, tenants, notes })

package/templates/apps/api-feature-flags/mutations/notes.create.mutation.server.ts

@@ -0,0 +1,29 @@
+import { EffectStore } from '@voltro/runtime'
+import type { AppContext } from '@voltro/runtime'
+import { requireFlag } from '@voltro/plugin-flags'
+import { Effect } from 'effect'
+
+const execute = (
+  input: { tenantId: string; title: string; body: string },
+  ctx: AppContext,
+) =>
+  Effect.gen(function* () {
+    // In-handler flag guard — short-circuits with typed FlagDisabled when the
+    // flag is off. Same shape as `requireScope` / `requireEntitlement`.
+    yield* requireFlag(ctx, 'newEditor')
+
+    const store = yield* EffectStore
+    const row = yield* store.insert('notes', {
+      title: input.title,
+      body: input.body,
+      tenantId: input.tenantId,
+    })
+    return {
+      id: row['id'] as string,
+      title: row['title'] as string,
+      body: row['body'] as string,
+      tenantId: row['tenantId'] as string,
+    }
+  })
+
+export default execute

package/templates/apps/api-feature-flags/mutations/notes.create.mutation.ts

@@ -0,0 +1,28 @@
+// Creates a note — but only if the `newEditor` flag is on for the caller.
+// The executor uses the IN-HANDLER guard `requireFlag(ctx, 'newEditor')`, which
+// fails typed `FlagDisabled` when the flag is off. Declaring `error: FlagDisabled`
+// here surfaces that to the client as a typed, pattern-matchable failure.
+//
+// `FlagDisabled` is imported from the browser-safe `/errors` subpath (no
+// node/db imports) so this descriptor stays safe for the client bundle.
+
+import { defineMutation } from '@voltro/protocol'
+import { FlagDisabled } from '@voltro/plugin-flags/errors'
+import { Schema } from 'effect'
+
+export const createNote = defineMutation({
+  name: 'notes.create',
+  target: { table: 'notes', op: 'insert' },
+  input: Schema.Struct({
+    tenantId: Schema.String,
+    title: Schema.NonEmptyString,
+    body: Schema.String,
+  }),
+  output: Schema.Struct({
+    id: Schema.String,
+    title: Schema.String,
+    body: Schema.String,
+    tenantId: Schema.String,
+  }),
+  error: FlagDisabled,
+})

package/templates/apps/api-feature-flags/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@{{projectName}}/{{appName}}",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "voltro dev .",
+    "migrate": "voltro migrate",
+    "test": "voltro test",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@effect/platform": "^0.96.1",
+    "@effect/rpc": "^0.75.1",
+    "@voltro/cli": "0.1.0",
+    "@voltro/database": "0.1.0",
+    "@voltro/env": "0.1.0",
+    "@voltro/plugin-flags": "0.1.0",
+    "@voltro/plugin-multitenancy": "0.1.0",
+    "@voltro/protocol": "0.1.0",
+    "@voltro/runtime": "0.1.0",
+    "effect": "^3.21.2"
+  },
+  "devDependencies": {
+    "@voltro/testing": "0.1.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}

package/templates/apps/api-feature-flags/template.json

@@ -0,0 +1,6 @@
+{
+  "id": "api-feature-flags",
+  "kind": "api",
+  "summary": "Feature flags wired turnkey — @voltro/plugin-flags: flags as code (kill-switch / % rollout / targeting), a declarative gatedBy map that fails typed FlagDisabled before the handler, an in-handler requireFlag guard, and the flags.evaluate query for useFlag() on the web. Memory store, zero infra.",
+  "tags": ["api", "feature-flags", "rollout", "kill-switch", "targeting", "plugin"]
+}

package/templates/apps/api-feature-flags/tests/notes.create.test.ts

@@ -0,0 +1,67 @@
+// Unit test for `notes.create` — driven through `@voltro/testing`.
+//
+// This executor is Effect-native: it `yield*`s the flag guard
+// `requireFlag(ctx, 'newEditor')` (fails typed `FlagDisabled` when the flag is
+// off for the caller) and then `yield* EffectStore` to insert. The flag registry
+// is populated by flagsPlugin at BOOT from app.config.ts — a step the unit
+// harness deliberately doesn't run, so under test every flag reads as off and
+// `requireFlag` fails `FlagDisabled`. We assert that REAL guard behavior (no
+// faking the plugin) + pin the descriptor's contract. `makeTestContext` exposes
+// the mixin-wrapped store as `ctx.store`, provided to the Effect as the
+// `EffectStore` layer via `makeEffectStoreLayer`. Run with `voltro test`.
+
+import { describe, it, expect } from 'vitest'
+import { Cause, Effect, Exit, Option, Schema } from 'effect'
+import { makeTestContext, mockStore } from '@voltro/testing'
+import { makeEffectStoreLayer } from '@voltro/runtime'
+import { database } from '../database/schema' // registers actors / tenants / notes
+import { createNote } from '../mutations/notes.create.mutation'
+import createNoteHandler from '../mutations/notes.create.mutation.server'
+import { FlagDisabled } from '@voltro/plugin-flags/errors'
+
+// Run the Effect-native executor with the test store provided as EffectStore,
+// returning the raw Exit so a typed failure can be inspected WITHOUT the
+// `FiberFailure` wrapper `Effect.runPromise` throws (which would defeat a plain
+// `instanceof FlagDisabled` assertion). Unwrap the Cause to get the real error.
+const runExit = (
+  input: { tenantId: string; title: string; body: string },
+  ctx: ReturnType<typeof makeTestContext>,
+) => Effect.runPromiseExit(createNoteHandler(input, ctx).pipe(Effect.provide(makeEffectStoreLayer(ctx.store))))
+
+describe('notes.create', () => {
+  it('fails typed FlagDisabled when the newEditor flag is off — nothing written', async () => {
+    // No plugin boot under unit test ⇒ the flag registry is empty ⇒ the flag is
+    // off ⇒ the in-handler requireFlag guard short-circuits before the insert.
+    const ctx = makeTestContext({
+      subject: { type: 'user', id: 'u1', tenantId: 'acme' },
+      store: mockStore({ notes: [] }),
+    })
+
+    const exit = await runExit({ tenantId: 'acme', title: 'Hello', body: 'World' }, ctx)
+
+    expect(Exit.isFailure(exit)).toBe(true)
+    const failure = Exit.isFailure(exit) ? Cause.failureOption(exit.cause) : Option.none()
+    expect(Option.getOrThrow(failure)).toBeInstanceOf(FlagDisabled)
+
+    const rows = await ctx.store.query(database.notes.descriptor)
+    expect(rows).toHaveLength(0)
+  })
+
+  it('pins the descriptor: name, input decode + the declared FlagDisabled error', () => {
+    expect(createNote.name).toBe('notes.create')
+
+    const decoded = Schema.decodeUnknownSync(createNote.input)({
+      tenantId: 'acme',
+      title: 'ok',
+      body: 'b',
+    })
+    expect(decoded).toEqual({ tenantId: 'acme', title: 'ok', body: 'b' })
+    // Empty title is rejected at the input Schema (NonEmptyString).
+    expect(() =>
+      Schema.decodeUnknownSync(createNote.input)({ tenantId: 'acme', title: '', body: '' }),
+    ).toThrow()
+
+    const disabled = new FlagDisabled({ flag: 'newEditor' })
+    expect(Schema.is(FlagDisabled)(disabled)).toBe(true)
+  })
+})

package/templates/apps/api-feature-flags/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["**/*.ts", "**/*.tsx"],
+  "exclude": ["node_modules", "dist"]
+}

package/templates/apps/api-governance/.env

@@ -0,0 +1,4 @@
+# AES-256-GCM key for `.encrypted()` columns (32 bytes / 64 hex chars).
+# DEV PLACEHOLDER — generate your own (`openssl rand -hex 32`) and keep it in a
+# real secret store for production. LOSE THIS KEY, LOSE THE ENCRYPTED DATA.
+VOLTRO_FIELD_ENCRYPTION_KEY=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef

package/templates/apps/api-governance/README.md

@@ -0,0 +1,61 @@
+# {{projectName}} / {{appName}}
+
+Voltro API scaffold (template: **api-governance**) — data governance with
+`@voltro/plugin-governance`: field encryption, GDPR, consent, retention.
+
+## Boot
+
+```bash
+pnpm install
+pnpm --filter @{{projectName}}/{{appName}} dev
+# → http://localhost:4000  (store: memory — zero infra)
+```
+
+The `.env` ships a DEV encryption key. Generate your own with
+`openssl rand -hex 32` and keep it in a secret store for production.
+
+## What this shows
+
+- **Field encryption** — `profiles.ssn` is `text().encrypted()`. You pass
+  plaintext; the store middleware encrypts it (AES-256-GCM) on write and
+  decrypts on read, so handlers always see plaintext while the column holds an
+  opaque `enc:v1:…` string at rest. `governancePlugin({ fieldEncryption: true })`
+  registers the cipher from `VOLTRO_FIELD_ENCRYPTION_KEY`. Boot fails loud if an
+  `.encrypted()` column exists but no cipher is registered.
+- **GDPR** — admin-gated `governance.export` / `governance.erase` walk the
+  declared `subjectScopes` (`[{ table: 'profiles', subjectField: 'id' }]`) to
+  bundle or erase everything belonging to a subject.
+- **Consent ledger** — `governance.consent` records a grant; `governance.hasConsent`
+  checks it. `GovernanceService` exposes the same in-handler.
+- **Retention** — `retention: [{ table, ttlMs, action }]` runs a periodic
+  sweep that deletes (or anonymises) rows past their TTL.
+
+## Try it
+
+```bash
+# create a profile, then read it back — ssn round-trips as plaintext:
+ID=$(curl -s localhost:4000/_voltro/inspect/invoke -H 'content-type: application/json' \
+  -d '{"tag":"profiles.create","input":{"name":"Ada","email":"ada@acme.com","ssn":"123-45-6789"}}' | python3 -c 'import sys,json;print(json.load(sys.stdin)["result"]["id"])')
+curl -s localhost:4000/_voltro/inspect/invoke -H 'content-type: application/json' \
+  -d "{\"tag\":\"profiles.get\",\"input\":{\"id\":\"$ID\"}}"
+# → { ok:true, result:{ …, ssn:"123-45-6789" } }   (plaintext — cipher decrypted it)
+
+# record consent (a mutation):
+curl -s localhost:4000/_voltro/inspect/invoke -H 'content-type: application/json' \
+  -d '{"tag":"governance.consent","input":{"purpose":"marketing","granted":true}}'
+# → { ok:true, result:{ ok:true } }
+```
+
+`governance.hasConsent` is a reactive QUERY (not invoke-able) — subscribe to it
+on the web, or call `GovernanceService.hasConsent(subjectId, purpose)` in a handler.
+
+`governance.export` / `governance.erase` are admin-gated — call them as a
+subject with the `admin:full` scope (see [`api-rbac`](https://voltro.cloud/docs/templates/api-rbac)).
+
+## Rules
+
+- **Don't encrypt what you filter on.** An `.encrypted()` column is ciphertext
+  on disk — you can't `WHERE`/`ORDER BY` it in SQL. Encrypt fields you read back
+  whole (PII, tokens, notes).
+- **The key is everything.** GCM fails closed on a bad key — you get an error,
+  never silent corruption. Back the key up; rotating it needs re-encrypting.

package/templates/apps/api-governance/actions/profiles.get.action.server.ts

@@ -0,0 +1,17 @@
+import type { AppContext } from '@voltro/runtime'
+import { eq } from '@voltro/database'
+import { database } from '../database/schema'
+
+const execute = async (input: { id: string }, ctx: AppContext) => {
+  const rows = await ctx.store.query(database.profiles.where(eq('id', input.id)).descriptor)
+  const p = rows[0]
+  if (!p) return null
+  return {
+    id: p['id'] as string,
+    name: p['name'] as string,
+    email: p['email'] as string,
+    ssn: p['ssn'] as string,        // decrypted by the store middleware
+  }
+}
+
+export default execute

package/templates/apps/api-governance/actions/profiles.get.action.ts

@@ -0,0 +1,17 @@
+// Reads a profile back — `ssn` comes out as PLAINTEXT. The store middleware
+// decrypts the `.encrypted()` column on read; the handler never touches the
+// `enc:v1:…` ciphertext. (In a real app you'd gate this read behind auth.)
+
+import { defineAction } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export const getProfile = defineAction({
+  name: 'profiles.get',
+  input: Schema.Struct({ id: Schema.String }),
+  output: Schema.NullOr(Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    email: Schema.String,
+    ssn: Schema.String,
+  })),
+})

package/templates/apps/api-governance/app.config.ts

@@ -0,0 +1,35 @@
+// Data-governance backend for the {{projectName}} project — field encryption,
+// GDPR export/erase, a consent ledger, and retention sweeps in one plugin.
+//
+// `@voltro/plugin-governance` does four things:
+//   - fieldEncryption: registers the AES-256-GCM cipher for `.encrypted()`
+//     columns (key from the secret VOLTRO_FIELD_ENCRYPTION_KEY). Handlers see
+//     plaintext; the column stores an opaque `enc:v1:…` string at rest.
+//   - GDPR: synthesizes admin-gated `governance.export` / `governance.erase`
+//     that walk the declared `subjectScopes`.
+//   - consent: `governance.consent` / `governance.hasConsent` + the service.
+//   - retention: a periodic sweep that deletes/anonymises rows past their TTL.
+import { defineEnv, envVar } from '@voltro/env'
+import { governancePlugin } from '@voltro/plugin-governance'
+
+export const env = defineEnv({
+  LOG_LEVEL: envVar.enum(['debug', 'info', 'warn', 'error'], { access: 'public', default: 'info' }),
+})
+
+export default {
+  type:  'api' as const,
+  name:  '{{capProjectName}}{{capAppName}}',
+  store: 'memory' as const,
+  plugins: [
+    governancePlugin({
+      // Reads the secret VOLTRO_FIELD_ENCRYPTION_KEY (see .env). LOSE THE KEY,
+      // LOSE THE DATA — GCM fails closed, it never silently corrupts.
+      fieldEncryption: true,
+      // GDPR export/erase walk these (table + the column holding the subject id).
+      subjectScopes: [{ table: 'profiles', subjectField: 'id' }],
+      // Delete profiles untouched for a year (the sweep runs periodically).
+      retention: [{ table: 'profiles', ttlMs: 365 * 86_400_000, action: 'delete' }],
+    }),
+  ],
+  env,
+}

package/templates/apps/api-governance/database/schema.ts

@@ -0,0 +1,41 @@
+// Schema for the {{projectName}} governance backend — a `profiles` table with
+// an ENCRYPTED column. `actors` + `tenants` are the framework core tables.
+
+import {
+  databaseHandle,
+  id,
+  table,
+  text,
+  timestamp,
+  type InferRow,
+} from '@voltro/database'
+import { audit } from '@voltro/plugin-audit'
+
+export const actors = table('actors', {
+  id:          id(),
+  kind:        text().oneOf(['user', 'serviceAccount', 'apiKey', 'system']),
+  displayName: text().nullable(),
+  createdAt:   timestamp().default('now'),
+})
+
+export const tenants = table('tenants', {
+  id:        id(),
+  name:      text(),
+  createdAt: timestamp().default('now'),
+})
+
+export const profiles = table('profiles', {
+  id:    id({ prefix: 'prof' }),
+  name:  text(),
+  email: text(),
+  // .encrypted() → AES-256-GCM at rest. The handler always sees plaintext; the
+  // stored value is an opaque `enc:v1:…` string. Encrypt only what you read
+  // back WHOLE (you can't filter/sort on it in SQL — it's ciphertext on disk).
+  ssn:   text().encrypted(),
+})
+  .with(audit())     // createdAt drives the retention sweep
+  .reactive()
+
+export type Profile = InferRow<typeof profiles>
+
+export const database = databaseHandle({ actors, tenants, profiles })

package/templates/apps/api-governance/mutations/profiles.create.mutation.server.ts

@@ -0,0 +1,17 @@
+import type { AppContext } from '@voltro/runtime'
+
+const execute = async (
+  input: { name: string; email: string; ssn: string },
+  ctx: AppContext,
+) => {
+  // ssn is encrypted on write by the store middleware — we just pass plaintext.
+  const row = await ctx.store.insert('profiles', {
+    name: input.name,
+    email: input.email,
+    ssn: input.ssn,
+  })
+  // Don't echo the ssn back here — read it via profiles.get when you need it.
+  return { id: row['id'] as string, name: row['name'] as string, email: row['email'] as string }
+}
+
+export default execute

package/templates/apps/api-governance/mutations/profiles.create.mutation.ts

@@ -0,0 +1,21 @@
+// Creates a profile. `ssn` is an `.encrypted()` column — you pass plaintext,
+// the store middleware encrypts it on write (the cipher is registered by
+// governancePlugin's fieldEncryption). Nothing special in the handler.
+
+import { defineMutation } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export const createProfile = defineMutation({
+  name: 'profiles.create',
+  target: { table: 'profiles', op: 'insert' },
+  input: Schema.Struct({
+    name: Schema.NonEmptyString,
+    email: Schema.String,
+    ssn: Schema.String,
+  }),
+  output: Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    email: Schema.String,
+  }),
+})

package/templates/apps/api-governance/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@{{projectName}}/{{appName}}",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "voltro dev .",
+    "migrate": "voltro migrate",
+    "test": "voltro test",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@effect/platform": "^0.96.1",
+    "@effect/rpc": "^0.75.1",
+    "@voltro/cli": "0.1.0",
+    "@voltro/database": "0.1.0",
+    "@voltro/env": "0.1.0",
+    "@voltro/plugin-audit": "0.1.0",
+    "@voltro/plugin-governance": "0.1.0",
+    "@voltro/protocol": "0.1.0",
+    "@voltro/runtime": "0.1.0",
+    "effect": "^3.21.2"
+  },
+  "devDependencies": {
+    "@voltro/testing": "0.1.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}

package/templates/apps/api-governance/template.json

@@ -0,0 +1,6 @@
+{
+  "id": "api-governance",
+  "kind": "api",
+  "summary": "Data governance in one plugin — @voltro/plugin-governance: AES-256-GCM field encryption for .encrypted() columns (handler sees plaintext, ciphertext at rest), admin-gated GDPR governance.export/erase over declared subjectScopes, a consent ledger, and retention TTL sweeps. Memory store, zero infra.",
+  "tags": ["api", "governance", "encryption", "gdpr", "compliance", "retention", "plugin"]
+}

package/templates/apps/api-governance/tests/profiles.create.test.ts

@@ -0,0 +1,59 @@
+// Unit test for `profiles.create` — driven through `@voltro/testing`.
+//
+// The governance features (field encryption, retention TTL sweep, GDPR
+// export/erase) are wired by governancePlugin at boot — store middleware +
+// scheduled sweeps that the unit harness does NOT run. So this test targets the
+// executor's OWN observable behavior: a plain audited insert that echoes back
+// { id, name, email } (never the ssn). `makeTestContext` hands the handler the
+// SAME mixin-wrapped `ctx.store` it gets in production, so the audit() mixin
+// auto-fills createdAt/createdBy exactly as at runtime.
+// Run with `voltro test` (vitest).
+
+import { afterAll, beforeAll, describe, it, expect } from 'vitest'
+import { makeFieldCipher, setFieldCipher } from '@voltro/runtime'
+import { makeTestContext, mockStore, invoke } from '@voltro/testing'
+import { database } from '../database/schema' // registers actors / tenants / profiles
+import { createProfile } from '../mutations/profiles.create.mutation'
+import createProfileHandler from '../mutations/profiles.create.mutation.server'
+
+const subject = { type: 'user', id: 'admin_1', tenantId: 'acme' } as const
+
+// `profiles.ssn` is an `.encrypted()` column, so the store middleware refuses to
+// write it unless a field cipher is registered — normally `governancePlugin({
+// fieldEncryption: true })` does that at boot from VOLTRO_FIELD_ENCRYPTION_KEY,
+// a step the unit harness doesn't run. We register the SAME AES-256-GCM cipher
+// process-globally here so the encrypted insert exercises the real write path
+// (plaintext in, ciphertext at rest), then clear it so the global doesn't leak.
+beforeAll(() => setFieldCipher(makeFieldCipher('unit-test-field-encryption-key')))
+afterAll(() => setFieldCipher(undefined))
+
+describe('profiles.create', () => {
+  it('inserts a profile + echoes back { id, name, email } with a prof_ TypeID', async () => {
+    const ctx = makeTestContext({ subject, store: mockStore({ profiles: [] }) })
+
+    const row = (await invoke(
+      createProfile,
+      createProfileHandler,
+      { name: 'Ada Lovelace', email: 'ada@example.com', ssn: '123-45-6789' },
+      ctx,
+    )) as { id: string; name: string; email: string }
+
+    expect(row.name).toBe('Ada Lovelace')
+    expect(row.email).toBe('ada@example.com')
+    expect(row.id).toMatch(/^prof_/)
+    // The handler deliberately does NOT echo the ssn — only id/name/email.
+    expect(row).not.toHaveProperty('ssn')
+
+    // The row is really persisted — the live query sees it.
+    const rows = await ctx.store.query(database.profiles.descriptor)
+    expect(rows).toHaveLength(1)
+  })
+
+  it('rejects an empty name at the input-schema decode (NonEmptyString)', async () => {
+    const ctx = makeTestContext({ subject, store: mockStore({ profiles: [] }) })
+
+    await expect(
+      invoke(createProfile, createProfileHandler, { name: '', email: 'x@y.z', ssn: '000' }, ctx),
+    ).rejects.toThrow()
+  })
+})

package/templates/apps/api-governance/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "include": ["**/*.ts", "**/*.tsx"],
+  "exclude": ["node_modules", "dist"]
+}