@voltro/cli 0.31.0 → 0.32.0

package/dist/{commands-CNVVv03h.js → commands-C0nEePif.js}

@@ -1,18 +1,18 @@
 import { t as e } from "./cliRuntime-Oh517vCV.js";
-import { A as t, Ct as n, D as r, Dt as i, Et as a, F as o, I as s, M as c, N as l, O as u, P as d, R as f, S as p, X as m, Y as h, Z as g, _t as _, a as v, b as y, bt as b, c as ee, d as te, f as ne, gt as re, h as ie, ht as ae, j as oe, m as se, o as ce, p as le, s as ue, u as de, vt as fe, w as pe, x as me, xt as he, yt as ge } from "./inspectMetrics-BeEAnjqw.js";
-import { _ as _e, a as ve, c as ye, d as x, f as be, g as xe, h as Se, i as Ce, l as we, m as Te, n as Ee, o as De, p as Oe, s as ke, t as Ae, u as je, v as S, y as Me } from "./checkCommand-D7r6_pk7.js";
+import { A as t, Ct as n, D as r, Dt as i, Et as a, F as o, I as s, M as c, N as l, O as u, P as d, R as f, S as p, X as m, Y as h, Z as g, _t as _, a as v, b as y, bt as b, c as ee, d as te, f as ne, gt as re, h as ie, ht as ae, j as oe, m as se, o as ce, p as le, s as ue, u as de, vt as fe, w as pe, x as me, xt as he, yt as ge } from "./inspectMetrics-BqO4E9G0.js";
+import { _ as _e, a as ve, c as ye, d as x, f as be, g as xe, h as Se, i as Ce, l as we, m as Te, n as Ee, o as De, p as Oe, s as ke, t as Ae, u as je, v as S, y as Me } from "./checkCommand-dm7OHtPt.js";
 import { s as Ne } from "./seedRunner-Bqxgp7HZ.js";
 import { n as Pe } from "./appModuleLoader-C9r9mxZt.js";
 import { a as C, c as Fe, i as Ie, o as Le, s as Re } from "./devActivity-BhIu6ncs.js";
-import { Gt as ze, It as Be, Vt as Ve, Wt as He, c as Ue, f as We, i as Ge, l as Ke, o as qe, rn as Je, z as Ye } from "./dev-DdQEn2Ia.js";
+import { Gt as ze, It as Be, Vt as Ve, Wt as He, c as Ue, f as We, i as Ge, l as Ke, o as qe, rn as Je, z as Ye } from "./dev-5ficNnvF.js";
 import { C as Xe, i as Ze, o as Qe } from "./frameworkTableAssembly-BwIrO5nv.js";
 import { D as $e, E as et, N as tt, O as nt, T as rt, a as it, d as at, f as ot, h as st, i as ct, j as lt, k as ut, l as dt, m as ft, r as pt, u as mt } from "./fileConventions-Cof68_BL.js";
-import { i as ht, n as gt, o as _t, s as vt } from "./apiBuild-CLPt-pX6.js";
+import { i as ht, n as gt, o as _t, s as vt } from "./apiBuild-C4uEbs3s.js";
 import { r as yt } from "./appGraph-gQ_6GkQQ.js";
-import { t as bt } from "./start-CI2QdKy9.js";
+import { t as bt } from "./start-D1-8eKrO.js";
 import { a as xt, i as St, n as Ct, r as wt, t as Tt } from "./cliArgs-qdZSElM3.js";
-import { n as Et, r as Dt } from "./serveCommand-KsKXXWn4.js";
-import { c as Ot, r as kt, s as At } from "./dbCommand-BH8GAYuf.js";
+import { n as Et, r as Dt } from "./serveCommand-PxMmn96o.js";
+import { c as Ot, r as kt, s as At } from "./dbCommand-ifOMafuG.js";
 import { basename as w, dirname as T, isAbsolute as jt, join as E, relative as D, resolve as O, sep as Mt } from "node:path";
 import { fileURLToPath as Nt, pathToFileURL as Pt } from "node:url";
 import { FileSystem as Ft } from "@effect/platform";
@@ -870,10 +870,10 @@ never mint — inspect stays closed until an operator opens it.`);
 }, Kr = async (e) => {
 	let t = await ue(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-DOZVMVfi.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-rc3fwPSZ.js"), n = await t(e);
 		if (n) {
 			V.info("building api app", { app: n.name ?? "(unnamed)" });
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BOqL1dlg.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-OJEjtwcn.js");
 			await t(e);
 			try {
 				await r(e);
@@ -1092,7 +1092,7 @@ never mint — inspect stays closed until an operator opens it.`);
 	return t.ran ? t.exitCode : (yield* k.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), Jr = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-v9WV8zRi.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-B_5mHQS2.js");
 		return e(t);
 	}
 	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await e(qr(n), { scope: "voltro:build" }), i = Je(n);
@@ -4447,6 +4447,48 @@ never mint — inspect stays closed until an operator opens it.`);
 			"credential on the Subject — `connectionCredentials(...)` keeps it in the",
 			"framework vault."
 		].join("\n")
+	}),
+	H({
+		version: "0.32.0",
+		id: "0.32.0/01_audit-redacts-outcome",
+		title: "`auditPlugin` now redacts `outcome` by default — opt out if your trail reads it",
+		kind: "manual",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => /auditPlugin\s*\(/.test(e.getFullText())),
+		note: [
+			"`auditPlugin` gained `redactOutcome`, and it DEFAULTS TO `'all'`.",
+			"",
+			"What changes in your `_voltro_audit_log` rows from this version on:",
+			"",
+			"  outcome.value  (on success)  →  { \"__redacted\": \"all\" }",
+			"  outcome.error  (on failure)  →  { \"_tag\": \"<yours>\" }   ← the tag SURVIVES",
+			"  outcome.kind, outcome.durationMs                        ← unchanged",
+			"",
+			"Nothing else moves: the input and subject policies are unchanged, the",
+			"caller still receives the real result, and a `record` predicate still sees",
+			"the live outcome, so a filter keyed on what a call returned keeps working.",
+			"",
+			"WHY: a credential-issuing call has nothing sensitive in its INPUT — the",
+			"secret is the thing it returns. `redactInput` could never reach it. A team",
+			"found four live webhook signing secrets stored in full in this column, with",
+			"both existing redaction options already enabled.",
+			"",
+			"IF YOUR TRAIL IS READ FOR THE RESULT PAYLOAD, opt out explicitly:",
+			"",
+			"    auditPlugin({ sink: 'datastore', redactOutcome: 'none' })",
+			"",
+			"or keep the shape and drop only the sensitive part:",
+			"",
+			"    auditPlugin({ sink: 'datastore', redactOutcome: (e) => summarise(e) })",
+			"",
+			"AND WHILE YOU ARE HERE — the rows already written are not touched by this.",
+			"Run the scan on every environment:",
+			"",
+			"    voltro db scan-credentials",
+			"",
+			"It exits 1 on a hit and 2 when it examined nothing. If it finds something,",
+			"purge the rows AND rotate the credentials — assume anything written to a",
+			"log table has been read."
+		].join("\n")
 	})
 ], ls = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -8181,7 +8223,7 @@ replicas = 1
 	return Ne(e);
 }, yf = async (t) => {
 	if (t.includes("--create-only")) return e(gf(O(t.find((e) => !e.startsWith("-")) ?? process.cwd())), { scope: "voltro:migrate" });
-	let { runDbCommand: n } = await import("./dbCommand-BwQ_Jl98.js");
+	let { runDbCommand: n } = await import("./dbCommand-By__Ev0R.js");
 	return n(["apply", ...t]);
 }, bf = "voltro-backup-stamp.json", xf = (e) => ({
 	stampVersion: 1,

package/dist/dbCommand-By__Ev0R.js

@@ -0,0 +1,2 @@
+import { s as e } from "./dbCommand-ifOMafuG.js";
+export { e as runDbCommand };