@voltro/cli 0.30.1 → 0.31.0

package/dist/{dbCommand-qn__kLEt.js → dbCommand-BH8GAYuf.js}

@@ -1,6 +1,6 @@
 import { i as e, n as t, r as n, s as r, t as i } from "./seedRunner-Bqxgp7HZ.js";
 import { n as a } from "./appModuleLoader-C9r9mxZt.js";
-import { t as o } from "./frameworkTableAssembly-Cpgn2e88.js";
+import { n as o } from "./frameworkTableAssembly-BwIrO5nv.js";
 import { b as s } from "./fileConventions-Cof68_BL.js";
 import { a as c, n as l, t as u } from "./cliArgs-qdZSElM3.js";
 import { basename as d, join as f, relative as p, resolve as m } from "node:path";
@@ -146,7 +146,52 @@ var k = class extends Error {
 	"credential",
 	"privatekey",
 	"private_key"
-], Oe = ["_voltro_audit_log", "_voltro_row_history"], ke = (e, t) => {
+], Oe = [
+	{
+		table: "_voltro_audit_log",
+		column: "subject"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "actor"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "scope"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "metadata"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "input"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "outcome"
+	},
+	{
+		table: "_voltro_audit_log",
+		column: "subjectId"
+	},
+	{
+		table: "_voltro_row_history",
+		column: "data"
+	},
+	{
+		table: "_voltro_row_history",
+		column: "actor"
+	},
+	{
+		table: "_voltro_row_history",
+		column: "scope"
+	},
+	{
+		table: "_voltro_row_history",
+		column: "subjectId"
+	}
+], ke = (e, t) => {
 	switch (t) {
 		case "postgres": return `LOWER(CAST(${e} AS text))`;
 		case "mysql":
@@ -169,24 +214,39 @@ var k = class extends Error {
 				table: a.table,
 				column: a.column,
 				scanned: void 0,
-				hits: void 0
+				hits: void 0,
+				unavailable: "table"
 			});
 			continue;
 		}
-		let s = await je(e, `SELECT COUNT(*) AS n FROM ${n}\n   WHERE ${Ae(r(a.column), t)}`);
-		i.push({
-			table: a.table,
-			column: a.column,
-			scanned: o,
-			hits: s
-		});
+		try {
+			let s = await je(e, `SELECT COUNT(*) AS n FROM ${n}\n   WHERE ${Ae(r(a.column), t)}`);
+			i.push({
+				table: a.table,
+				column: a.column,
+				scanned: o,
+				hits: s
+			});
+		} catch {
+			i.push({
+				table: a.table,
+				column: a.column,
+				scanned: o,
+				hits: void 0,
+				unavailable: "column"
+			});
+		}
 	}
 	return i;
 }, Ne = (e, t) => {
-	let n = [`credential scan · dialect ${t}`, ""];
+	let n = [`credential scan · dialect ${t}`, ""], r = /* @__PURE__ */ new Set();
 	for (let t of e) {
+		if (t.unavailable === "column") {
+			n.push(`  ·  ${t.table}.${t.column} — column is not present on this deployment (${t.scanned} row(s) exist but this column was not scanned)`);
+			continue;
+		}
 		if (t.scanned === void 0) {
-			n.push(`  ·  ${t.table} — table not present (nothing scanned)`);
+			r.has(t.table) || (r.add(t.table), n.push(`  ·  ${t.table} — table not present (nothing scanned)`));
 			continue;
 		}
 		if (t.scanned === 0) {
@@ -196,9 +256,9 @@ var k = class extends Error {
 		let e = (t.hits ?? 0) > 0 ? "✗" : "✓";
 		n.push(`  ${e}  ${t.table}.${t.column} — ${t.hits} of ${t.scanned} row(s) match a credential-shaped key`);
 	}
-	let r = e.reduce((e, t) => e + (t.hits ?? 0), 0);
-	return n.push(""), r > 0 ? n.push(`  ${r} row(s) carry something credential-shaped.`, "  Purge them AND rotate the credentials — assume anything written to a log", "  table has been read. Then stop putting the credential on the Subject:", "  `connectionCredentials(...)` keeps it in the framework vault.") : e.every((e) => e.scanned === void 0 || e.scanned === 0) ? n.push("  NOTHING WAS SCANNED. This run proves nothing about your data.") : n.push("  No credential-shaped keys found in the rows that exist."), n.push("", "  Run this on EVERY environment. A dev database is not a sample of production."), n.join("\n");
-}, Pe = (e) => e.some((e) => (e.hits ?? 0) > 0) ? 1 : e.every((e) => e.scanned === void 0 || e.scanned === 0) ? 2 : 0, j = /\.migration\.ts$/, M = async (e, t) => {
+	let i = e.reduce((e, t) => e + (t.hits ?? 0), 0);
+	return n.push(""), i > 0 ? n.push(`  ${i} row(s) carry something credential-shaped.`, "  Purge them AND rotate the credentials — assume anything written to a log", "  table has been read. Then stop putting the credential on the Subject:", "  `connectionCredentials(...)` keeps it in the framework vault.") : e.every((e) => e.scanned === void 0 || e.scanned === 0 || e.unavailable !== void 0) ? n.push("  NOTHING WAS SCANNED. This run proves nothing about your data.") : n.push("  No credential-shaped keys found in the rows that exist."), n.push("", "  Run this on EVERY environment. A dev database is not a sample of production."), n.join("\n");
+}, Pe = (e) => e.some((e) => (e.hits ?? 0) > 0) ? 1 : e.every((e) => e.unavailable !== void 0 || e.scanned === void 0 || e.scanned === 0) ? 2 : 0, j = /\.migration\.ts$/, M = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -1216,10 +1276,7 @@ export default defineMigration({
 				column: a
 			});
 		}
-		let r = [...Oe.map((e) => ({
-			table: e,
-			column: "subject"
-		})), ...n], i = await J(await q(), b.SqlClient.pipe(g.flatMap((e) => g.promise(() => Me(e, t, r, G)))));
+		let r = [...Oe, ...n], i = await J(await q(), b.SqlClient.pipe(g.flatMap((e) => g.promise(() => Me(e, t, r, G)))));
 		return console.log(Ne(i, t)), Pe(i);
 	}
 }, vt = async (e) => {

package/dist/dbCommand-BwQ_Jl98.js

@@ -0,0 +1,2 @@
+import { s as e } from "./dbCommand-BH8GAYuf.js";
+export { e as runDbCommand };

package/dist/{dev-DXhhZ7-f.js → dev-DOZVMVfi.js}

@@ -1,3 +1,3 @@
 import "./seedRunner-Bqxgp7HZ.js";
-import { c as e, h as t, u as n } from "./dev-C_NPcLDp.js";
+import { c as e, h as t, u as n } from "./dev-DdQEn2Ia.js";
 export { e as loadApiConfig, n as loadDiscovered, t as walk };