@voltro/cli 0.31.0 → 0.33.0

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
-import { ct as e } from "./inspectMetrics-BeEAnjqw.js";
+import { ct as e } from "./inspectMetrics-1xzTKAFx.js";
 import { c as t } from "./seedRunner-Bqxgp7HZ.js";
 import { r as n } from "./appModuleLoader-C9r9mxZt.js";
-import { t as r } from "./serveCommand-KsKXXWn4.js";
+import { t as r } from "./serveCommand-DdaM4Hup.js";
 export { e as loadDotEnv, n as registerAppModules, t as registerDriver, r as runServe };

package/dist/{start-CI2QdKy9.js → start-C0koT0UO.js}

@@ -1,4 +1,4 @@
-import { $ as e, C as t, Ct as n, D as r, E as i, G as a, J as o, K as s, L as c, P as l, Q as u, S as d, St as ee, Tt as f, V as p, W as m, _ as h, _t as g, a as _, b as v, bt as y, c as b, dt as te, f as x, ft as S, g as C, h as w, i as T, k as E, m as D, mt as O, o as ne, p as re, pt as k, q as ie, r as A, s as j, t as M, ut as N, v as ae, wt as oe, x as P, y as F } from "./inspectMetrics-BeEAnjqw.js";
+import { $ as e, C as t, Ct as n, D as r, E as i, G as a, J as o, K as s, L as c, P as l, Q as u, S as d, St as ee, Tt as f, V as p, W as m, _ as h, _t as g, a as _, b as v, bt as y, c as b, dt as te, f as x, ft as S, g as C, h as w, i as T, k as E, m as D, mt as O, o as ne, p as re, pt as k, q as ie, r as A, s as j, t as M, ut as N, v as ae, wt as oe, x as P, y as F } from "./inspectMetrics-1xzTKAFx.js";
 import { A as se, E as I, O as ce, a as le, k as L, m as ue } from "./inspect-BUUjt773.js";
 import { t as de } from "./bootTiming-BdyP9nYw.js";
 import { dirname as fe, extname as pe, join as R, resolve as z } from "node:path";

package/dist/startEntry.js

@@ -1,3 +1,3 @@
-import { ct as e } from "./inspectMetrics-BeEAnjqw.js";
-import { t } from "./start-CI2QdKy9.js";
+import { ct as e } from "./inspectMetrics-1xzTKAFx.js";
+import { t } from "./start-C0koT0UO.js";
 export { e as loadDotEnv, t as runStartCommand };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -50,11 +50,424 @@
       "types": "./dist/startEntry.d.ts",
       "import": "./dist/startEntry.js",
       "default": "./dist/startEntry.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "voltro": {
+    "codemods": [
+      {
+        "version": "0.10.0",
+        "id": "0.10.0/01_render-mode-client-to-spa",
+        "title": "renderMode is a closed set — `'client'` becomes `'spa'`",
+        "kind": "transform"
+      },
+      {
+        "version": "0.10.0",
+        "id": "0.10.0/02_router-state-carries-its-path",
+        "title": "`renderRouterStateScript` now requires the `path` it rendered",
+        "kind": "manual"
+      },
+      {
+        "version": "0.10.0",
+        "id": "0.10.0/03_workflow-caller-context-resolved",
+        "title": "workflow `buildContext` receives a RESOLVED caller context",
+        "kind": "manual"
+      },
+      {
+        "version": "0.10.0",
+        "id": "0.10.0/04_seed-run-status-skipped",
+        "title": "seed run status gained `skipped`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.10.0",
+        "id": "0.10.0/05_subscription-idle-state",
+        "title": "`useSubscription` gained an idle state for `skip`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.11.0",
+        "id": "0.11.0/01_step-options-type-params",
+        "title": "`StepOptions` takes the context type first",
+        "kind": "manual"
+      },
+      {
+        "version": "0.12.0",
+        "id": "0.12.0/01_outbound-http-ssrf-guard",
+        "title": "Outbound HttpClient blocks internal targets by default (add `http.allowHosts` if you call one)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.12.0",
+        "id": "0.12.0/02_api-key-revoke-tenant-scope",
+        "title": "apiKeyService.revoke/rotate now require the caller's tenantId",
+        "kind": "manual"
+      },
+      {
+        "version": "0.12.0",
+        "id": "0.12.0/03_api-key-on-behalf-of",
+        "title": "API keys: createdBy is provenance, onBehalfOf is ownership",
+        "kind": "manual"
+      },
+      {
+        "version": "0.12.0",
+        "id": "0.12.0/04_inspect-fail-closed",
+        "title": "The inspect surface requires VOLTRO_INSPECT_TOKEN (previously open when unset)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.13.0",
+        "id": "0.13.0/01_bearer-gates-fail-closed",
+        "title": "checkBearer is fail-closed; scimPlugin refuses an empty token",
+        "kind": "manual"
+      },
+      {
+        "version": "0.13.0",
+        "id": "0.13.0/02_storage-grants-owner-only",
+        "title": "storage.share / revoke / listGrants require ownership",
+        "kind": "manual"
+      },
+      {
+        "version": "0.13.0",
+        "id": "0.13.0/03_apply-plan-convergence-proof",
+        "title": "applyPlan requires a `replan` convergence proof",
+        "kind": "manual"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/01_resolve-scopes-store",
+        "title": "auth.resolveScopes receives the app DataStore",
+        "kind": "manual"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/02_reactive-by-default",
+        "title": "Reactivity is the default; .reactive() is removed",
+        "kind": "transform"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/03_pages-suffix",
+        "title": "Pages are declared with a .page.tsx suffix",
+        "kind": "transform"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/04_file-taxonomy",
+        "title": "Web files declare their contract (*.component.tsx / *.hook.ts / *.types.ts)",
+        "kind": "transform"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/05_typed-tracking",
+        "title": "Tracking catalogues are typed against the component props",
+        "kind": "manual"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/06_voltro-test-skips-e2e",
+        "title": "`voltro test` leaves `e2e/` to `voltro e2e`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.14.0",
+        "id": "0.14.0/07_dev-remote-file-migrations",
+        "title": "voltro dev refuses unattended file migrations against a remote database",
+        "kind": "manual"
+      },
+      {
+        "version": "0.15.0",
+        "id": "0.15.0/01_undo-mistaken-taxonomy-renames",
+        "title": "Undo the two file renames 0.14.0 got wrong (framework primitives, side-effect modules)",
+        "kind": "transform"
+      },
+      {
+        "version": "0.15.0",
+        "id": "0.15.0/02_error-tag-in-protocol",
+        "title": "`errorTag` is imported from @voltro/protocol",
+        "kind": "transform"
+      },
+      {
+        "version": "0.17.0",
+        "id": "0.17.0/01_pages-are-directories",
+        "title": "A directory is a route segment; its route is page.tsx",
+        "kind": "transform"
+      },
+      {
+        "version": "0.18.0",
+        "id": "0.18.0/01_where-like-removed",
+        "title": "the `'like'` where-operator is removed — pick `contains` or `startsWith`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.19.0",
+        "id": "0.19.0/01_server-only-gates-the-boot",
+        "title": "`.serverOnly()` now FAILS the boot under `voltro serve` — it used to only warn",
+        "kind": "manual"
+      },
+      {
+        "version": "0.19.0",
+        "id": "0.19.0/02_audit-redact-input-default",
+        "title": "`auditPlugin` now redacts mutation input by default (`redactInput: 'all'`)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.20.0",
+        "id": "0.20.0/01_write-recorder-port",
+        "title": "`WriteRecorder` takes a port (`{ append, maxOf }`) instead of a bare `append`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.21.0",
+        "id": "0.21.0/01_maxlength-now-migrates",
+        "title": "`text().maxLength(n)` now migrates EXISTING columns — plan before you apply",
+        "kind": "manual"
+      },
+      {
+        "version": "0.22.0",
+        "id": "0.22.0/01_rename-index-op",
+        "title": "`MigrationOperation` gained a `rename-index` kind",
+        "kind": "manual"
+      },
+      {
+        "version": "0.22.0",
+        "id": "0.22.0/02_plugin-tables-voltro-prefixed",
+        "title": "plugin-owned tables are `_voltro_`-prefixed (the rows move themselves)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.22.0",
+        "id": "0.22.0/03_cache-scope-gained-tenant",
+        "title": "`cache.scope` gained 'tenant' — an exhaustive switch over it needs a branch",
+        "kind": "manual"
+      },
+      {
+        "version": "0.22.0",
+        "id": "0.22.0/04_inspect-write-credential",
+        "title": "Mutating `/_voltro/inspect/*` endpoints need VOLTRO_INSPECT_WRITE_TOKEN",
+        "kind": "manual"
+      },
+      {
+        "version": "0.23.0",
+        "id": "0.23.0/01_versioning-is-opt-out",
+        "title": "versioningPlugin: `tables: string[]` → opt-out by default, `include` / `exclude` by value",
+        "kind": "manual"
+      },
+      {
+        "version": "0.24.0",
+        "id": "0.24.0/01_agent-tables-voltro-prefixed",
+        "title": "the two agent tables are `_voltro_`-prefixed (the rows move themselves)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.25.0",
+        "id": "0.25.0/01_events-emit-to-publish",
+        "title": "`ctx.events.emit(name, data)` → `ctx.events.publish(descriptor, key, payload)`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.25.0",
+        "id": "0.25.0/02_outgoing-event-to-define-event",
+        "title": "`defineOutgoingEvent` → `defineEvent({ …, webhook: { … } })`",
+        "kind": "transform"
+      },
+      {
+        "version": "0.25.0",
+        "id": "0.25.0/03_broadcast-channel-to-namespace",
+        "title": "`broadcast({ channel })` → `broadcast({ namespace })`",
+        "kind": "transform"
+      },
+      {
+        "version": "0.26.0",
+        "id": "0.26.0/01_event-webhook-retry-removed",
+        "title": "`defineEvent({ webhook: { retry } })` is gone — it never did anything",
+        "kind": "manual"
+      },
+      {
+        "version": "0.26.0",
+        "id": "0.26.0/02_step-retry-enforced",
+        "title": "workflow step `retry:` is now ENFORCED (was metadata) — drop any redundant manual retry",
+        "kind": "manual"
+      },
+      {
+        "version": "0.28.0",
+        "id": "0.28.0/01_notifications-resolve-subject-id-async",
+        "title": "`makeSubjectId` returns a Promise; `resolveSubjectId` may be async",
+        "kind": "manual"
+      },
+      {
+        "version": "0.28.0",
+        "id": "0.28.0/02_plugin-ref-change-event",
+        "title": "`PluginRefChange` is removed — the change channel's `ChangeEvent` is the one shape",
+        "kind": "manual"
+      },
+      {
+        "version": "0.28.0",
+        "id": "0.28.0/03_atlassian-credentials-context",
+        "title": "`credentialsResolver` receives `{ subject, store }` instead of a bare Subject",
+        "kind": "manual"
+      },
+      {
+        "version": "0.28.0",
+        "id": "0.28.0/04_audit-redacts-subject-metadata",
+        "title": "`auditPlugin` redacts `subject.metadata` by default",
+        "kind": "manual"
+      },
+      {
+        "version": "0.29.0",
+        "id": "0.29.0/01_loader-data-absence",
+        "title": "`useLoaderData()` throws at a level that declares no `loader`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.3.0",
+        "id": "0.3.0/01_prod-serve-requires-build",
+        "title": "Production `voltro serve` requires a precompiled bundle (build before serve)",
+        "kind": "manual"
+      },
+      {
+        "version": "0.30.0",
+        "id": "0.30.0/01_locale-cookie-rename",
+        "title": "the language-preference cookie is `voltro:locale` (was `voltro:lang`)",
+        "kind": "transform"
+      },
+      {
+        "version": "0.30.0",
+        "id": "0.30.0/02_audit-purge-query-recheck",
+        "title": "re-run the credential-purge query — the 0.28.0 spelling under-reported on MySQL/MariaDB",
+        "kind": "manual"
+      },
+      {
+        "version": "0.30.0",
+        "id": "0.30.0/03_webhook-emit-durable-deferral",
+        "title": "a deferred `webhooks.emit` rides the transactional outbox; `{ immediate: true }` opts out",
+        "kind": "manual"
+      },
+      {
+        "version": "0.30.0",
+        "id": "0.30.0/04_workflow-run-handle-nullable-execution",
+        "title": "`WorkflowRunHandle.executionId` is `string | null`; `status` gains queued/dropped/skipped",
+        "kind": "manual"
+      },
+      {
+        "version": "0.31.0",
+        "id": "0.31.0/01_rerun-credential-scan",
+        "title": "re-run `voltro db scan-credentials` — on 0.30.0–0.30.2 it skipped the column credentials land in",
+        "kind": "manual"
+      },
+      {
+        "version": "0.32.0",
+        "id": "0.32.0/01_audit-redacts-outcome",
+        "title": "`auditPlugin` now redacts `outcome` by default — opt out if your trail reads it",
+        "kind": "manual"
+      },
+      {
+        "version": "0.33.0",
+        "id": "0.33.0/01_opentelemetry-optional-peer",
+        "title": "`@effect/opentelemetry` is now an optional peer — install it if you use tracing",
+        "kind": "manual"
+      },
+      {
+        "version": "0.33.0",
+        "id": "0.33.0/02_coordinated-handle-gained-wake",
+        "title": "`CoordinatedScheduleHandle` gained `wake()`, `currentIntervalMs()` and `isArmed()` — update hand-written test doubles",
+        "kind": "manual"
+      },
+      {
+        "version": "0.4.0",
+        "id": "0.4.0/01_rbac-forbidden-to-scopeerror",
+        "title": "@voltro/plugin-rbac: `Forbidden` → protocol `ScopeError` (one denial tag)",
+        "kind": "transform"
+      },
+      {
+        "version": "0.4.0",
+        "id": "0.4.0/02_rbac-web-to-client-permissions",
+        "title": "@voltro/plugin-rbac/web removed — the UI gate lives in @voltro/client",
+        "kind": "transform"
+      },
+      {
+        "version": "0.5.0",
+        "id": "0.5.0/01_one-terminal-exactly-one",
+        "title": ".one() now fails on MORE than one row; NoRowFound is a declarable typed error",
+        "kind": "manual"
+      },
+      {
+        "version": "0.5.0",
+        "id": "0.5.0/02_typed-store-rows",
+        "title": "store.query() now returns the row type — casts on row fields may stop compiling",
+        "kind": "manual"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/01_no-dev-session-secret",
+        "title": "The built-in dev session secret is removed; VOLTRO_SESSION_SECRET is required",
+        "kind": "manual"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/02_subscription-state-union",
+        "title": "SubscriptionState is a discriminated union — `loading` now narrows `data`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/03_billing-on-stripe-sdk",
+        "title": "Billing moved onto the Stripe SDK; proration + dunning are now Stripe’s",
+        "kind": "manual"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/04_relation-key-validation",
+        "title": "relation key options are validated at boot; `one` now fails on more than one match",
+        "kind": "manual"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/05_atlassian-avatar-mode",
+        "title": "atlassianPlugin's `avatar` config requires an explicit `mode: 'service' | 'perUser'`",
+        "kind": "transform"
+      },
+      {
+        "version": "0.6.0",
+        "id": "0.6.0/06_ui-strings-connect-account",
+        "title": "UiStrings gained a required `connectAccount` section",
+        "kind": "manual"
+      },
+      {
+        "version": "0.7.0",
+        "id": "0.7.0/01_row-filter-load-failure",
+        "title": "A row filter that fails to load now errors instead of returning zero rows",
+        "kind": "manual"
+      },
+      {
+        "version": "0.7.0",
+        "id": "0.7.0/02_testing-invoke-effect-handlers",
+        "title": "@voltro/testing: invoke() runs Effect handlers; executor types widened",
+        "kind": "manual"
+      },
+      {
+        "version": "0.8.0",
+        "id": "0.8.0/01_optional-password-hash",
+        "title": "`UserRecord.passwordHash` is optional — password-less identities are now first-class",
+        "kind": "manual"
+      },
+      {
+        "version": "0.8.0",
+        "id": "0.8.0/02_ssr-streams-and-loaderdata",
+        "title": "`ssr` pages stream; `useLoaderData<T>()` returns `LoaderData<T>`",
+        "kind": "manual"
+      },
+      {
+        "version": "0.9.0",
+        "id": "0.9.0/01_ssr-layout-shell-for-spa",
+        "title": "A `renderMode:'spa'` page under a layout now server-renders that layout",
+        "kind": "manual"
+      }
+    ]
+  },
   "engines": {
     "node": ">=24.0.0"
   },
@@ -62,22 +475,22 @@
     "@effect/platform-node": "^0.108.0",
     "@effect/sql": "^0.52.0",
     "@effect/workflow": "^0.19.0",
-    "@voltro/ai": "0.31.0",
-    "@voltro/cache": "0.31.0",
-    "@voltro/data-transfer": "0.31.0",
-    "@voltro/database": "0.31.0",
-    "@voltro/env": "0.31.0",
-    "@voltro/kv": "0.31.0",
-    "@voltro/logger": "0.31.0",
-    "@voltro/plugin-auth": "0.31.0",
-    "@voltro/plugin-broadcast": "0.31.0",
-    "@voltro/plugin-mail": "0.31.0",
-    "@voltro/plugin-storage": "0.31.0",
-    "@voltro/plugin-webhooks": "0.31.0",
-    "@voltro/protocol": "0.31.0",
-    "@voltro/runtime": "0.31.0",
-    "@voltro/serverless": "0.31.0",
-    "@voltro/workflow": "0.31.0",
+    "@voltro/ai": "0.33.0",
+    "@voltro/cache": "0.33.0",
+    "@voltro/data-transfer": "0.33.0",
+    "@voltro/database": "0.33.0",
+    "@voltro/env": "0.33.0",
+    "@voltro/kv": "0.33.0",
+    "@voltro/logger": "0.33.0",
+    "@voltro/plugin-auth": "0.33.0",
+    "@voltro/plugin-broadcast": "0.33.0",
+    "@voltro/plugin-mail": "0.33.0",
+    "@voltro/plugin-storage": "0.33.0",
+    "@voltro/plugin-webhooks": "0.33.0",
+    "@voltro/protocol": "0.33.0",
+    "@voltro/runtime": "0.33.0",
+    "@voltro/serverless": "0.33.0",
+    "@voltro/workflow": "0.33.0",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/AGENTS.md

@@ -652,7 +652,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.31.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.33.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/_index.md

@@ -9,7 +9,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.31.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.33.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/database/misc.md

@@ -225,6 +225,43 @@ Precedence, exactly:
 3. **`.safe()`** on an encrypted column suppresses the implied secret and copies
    it verbatim — say this only when you have genuinely reviewed the plaintext.
 
+## Encrypting a column that already has rows
+
+`.encrypted()` encrypts on **write**. Adding it to a populated column converts
+nothing that is already stored — those rows stay plaintext until something
+rewrites them, which for a credential column may be never.
+
+```sh
+voltro db encrypt-column integrations.webhookSecret --dry-run
+voltro db encrypt-column integrations.webhookSecret employees.meilisearchKey --yes
+```
+
+It reads `FIELD_ENCRYPTION_KEY` (or `--key-env NAME`) and must be **the same key
+your app runs with** — the one you pass to
+`governancePlugin({ fieldEncryption: { key } })`.
+
+**Order does not matter.** A read returns a non-ciphertext value unchanged, so
+the column may hold a mix while you deploy: run the command before or after the
+release that adds `.encrypted()`, and run it again afterwards to catch anything
+written in between. It skips what is already encrypted, which also means an
+interrupted run is resumed by running it again.
+
+Five things it refuses to do, each of them a way a hand-written `UPDATE` goes
+wrong quietly:
+
+| It checks | Because |
+|---|---|
+| already-ciphertext values are skipped | double encryption cannot be undone without the key history |
+| the value decrypts back before the write | a broken cipher otherwise fails on the first *read*, when the plaintext is gone |
+| the key matches what the column already holds | a *different* key round-trips fine; resuming with one leaves a column readable with neither key alone |
+| the column is wide enough | ciphertext is `49 + 4×ceil(bytes/3)` characters — a 64-char key needs 137, and a `varchar(100)` fails partway through |
+| `--yes` is present | it rewrites a column in place |
+
+The width figure is in **bytes**, not characters: `'ä'.repeat(10)` is 10
+characters and 20 bytes, and encrypts to 77.
+
+No value — plaintext or ciphertext — is ever printed. The report is counts.
+
 ## `.serverOnly()` — never to a client
 
 A THIRD, independent axis. `.sensitive()` / `.safe()` are about **data export

package/templates/agent-docs/database/schema.md

@@ -748,9 +748,11 @@ ctx.store.select('inviteLinks').includeExpired()
 | | where | when |
 | --- | --- | --- |
 | **Invisible to reads** | every dialect | immediately, the instant it passes |
-| **Physically deleted** | postgres only | eventually, by the retention sweep |
+| **Physically deleted** | every dialect | eventually, by the retention sweep |
 
-So an expired row is **invisible everywhere and still present in the database on four of five dialects**. That is the right trade — making visibility depend on the sweep would mean a row that vanished on postgres and kept serving on MariaDB — but it is a surprising one, and it matters: *do not treat an expired row as unreachable*. If the value must actually be gone, delete it, or do not store it in a row at all.
+So an expired row is **invisible immediately and still present in the database for a while**. That is the right trade — making visibility depend on the sweep would mean a row that vanished on postgres and kept serving on MariaDB — but it matters: *do not treat an expired row as unreachable*. If the value must actually be gone, delete it, or do not store it in a row at all.
+
+The second row of that table used to say **postgres only**, and it was accurate: the sweep was registered behind a `dialect !== 'postgres'` early return, so on mariadb, mysql, mssql and sqlite nothing was ever deleted and the boot printed no armed-policies line to say so. What is postgres-specific is the fast set-based DELETE, not the policy — the sweep falls back to a bounded read plus one set-based delete per batch elsewhere. Fixed in 0.33.0; on those dialects the first boot after upgrading will have a backlog to work through.
 
 ## See also