@voltro/cli 0.31.0 → 0.33.0

package/dist/{commands-CNVVv03h.js → commands-CJfepbm4.js}

@@ -1,18 +1,18 @@
 import { t as e } from "./cliRuntime-Oh517vCV.js";
-import { A as t, Ct as n, D as r, Dt as i, Et as a, F as o, I as s, M as c, N as l, O as u, P as d, R as f, S as p, X as m, Y as h, Z as g, _t as _, a as v, b as y, bt as b, c as ee, d as te, f as ne, gt as re, h as ie, ht as ae, j as oe, m as se, o as ce, p as le, s as ue, u as de, vt as fe, w as pe, x as me, xt as he, yt as ge } from "./inspectMetrics-BeEAnjqw.js";
-import { _ as _e, a as ve, c as ye, d as x, f as be, g as xe, h as Se, i as Ce, l as we, m as Te, n as Ee, o as De, p as Oe, s as ke, t as Ae, u as je, v as S, y as Me } from "./checkCommand-D7r6_pk7.js";
+import { A as t, Ct as n, D as r, Dt as i, Et as a, F as o, I as s, M as c, N as l, O as u, P as d, R as f, S as p, X as m, Y as h, Z as g, _t as _, a as v, b as y, bt as b, c as ee, d as te, f as ne, gt as re, h as ie, ht as ae, j as oe, m as se, o as ce, p as le, s as ue, u as de, vt as fe, w as pe, x as me, xt as he, yt as ge } from "./inspectMetrics-1xzTKAFx.js";
+import { _ as _e, a as ve, c as ye, d as x, f as be, g as xe, h as Se, i as Ce, l as we, m as Te, n as Ee, o as De, p as Oe, s as ke, t as Ae, u as je, v as S, y as Me } from "./checkCommand-xGhRFFg2.js";
 import { s as Ne } from "./seedRunner-Bqxgp7HZ.js";
 import { n as Pe } from "./appModuleLoader-C9r9mxZt.js";
 import { a as C, c as Fe, i as Ie, o as Le, s as Re } from "./devActivity-BhIu6ncs.js";
-import { Gt as ze, It as Be, Vt as Ve, Wt as He, c as Ue, f as We, i as Ge, l as Ke, o as qe, rn as Je, z as Ye } from "./dev-DdQEn2Ia.js";
+import { Kt as ze, Rt as Be, Ut as Ve, an as He, c as Ue, f as We, i as Ge, l as Ke, o as qe, qt as Je, z as Ye } from "./dev-C_P8FLSx.js";
 import { C as Xe, i as Ze, o as Qe } from "./frameworkTableAssembly-BwIrO5nv.js";
 import { D as $e, E as et, N as tt, O as nt, T as rt, a as it, d as at, f as ot, h as st, i as ct, j as lt, k as ut, l as dt, m as ft, r as pt, u as mt } from "./fileConventions-Cof68_BL.js";
-import { i as ht, n as gt, o as _t, s as vt } from "./apiBuild-CLPt-pX6.js";
+import { i as ht, n as gt, o as _t, s as vt } from "./apiBuild-h9VHtnlw.js";
 import { r as yt } from "./appGraph-gQ_6GkQQ.js";
-import { t as bt } from "./start-CI2QdKy9.js";
+import { t as bt } from "./start-C0koT0UO.js";
 import { a as xt, i as St, n as Ct, r as wt, t as Tt } from "./cliArgs-qdZSElM3.js";
-import { n as Et, r as Dt } from "./serveCommand-KsKXXWn4.js";
-import { c as Ot, r as kt, s as At } from "./dbCommand-BH8GAYuf.js";
+import { n as Et, r as Dt } from "./serveCommand-DdaM4Hup.js";
+import { c as Ot, r as kt, s as At } from "./dbCommand-DTLKAfbA.js";
 import { basename as w, dirname as T, isAbsolute as jt, join as E, relative as D, resolve as O, sep as Mt } from "node:path";
 import { fileURLToPath as Nt, pathToFileURL as Pt } from "node:url";
 import { FileSystem as Ft } from "@effect/platform";
@@ -870,10 +870,10 @@ never mint — inspect stays closed until an operator opens it.`);
 }, Kr = async (e) => {
 	let t = await ue(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-DOZVMVfi.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-iiMtlkfs.js"), n = await t(e);
 		if (n) {
 			V.info("building api app", { app: n.name ?? "(unnamed)" });
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BOqL1dlg.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-C-x9YacA.js");
 			await t(e);
 			try {
 				await r(e);
@@ -1092,10 +1092,10 @@ never mint — inspect stays closed until an operator opens it.`);
 	return t.ran ? t.exitCode : (yield* k.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), Jr = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-v9WV8zRi.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-C81QIkiL.js");
 		return e(t);
 	}
-	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await e(qr(n), { scope: "voltro:build" }), i = Je(n);
+	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await e(qr(n), { scope: "voltro:build" }), i = He(n);
 	return i.warning !== void 0 && V.warn(i.warning), r;
 }, Yr = 3, Xr = 50, Zr = 256 * 1024, Qr = (e) => e.reduce((e, t) => e + Buffer.byteLength(t.content, "utf8"), 0), $r = async (e, t) => {
 	let n = Math.max(1, t.maxAttempts ?? Yr), r = t.maxArtifacts ?? Xr, i = t.maxTotalBytes ?? Zr, a = [];
@@ -4447,6 +4447,132 @@ never mint — inspect stays closed until an operator opens it.`);
 			"credential on the Subject — `connectionCredentials(...)` keeps it in the",
 			"framework vault."
 		].join("\n")
+	}),
+	H({
+		version: "0.32.0",
+		id: "0.32.0/01_audit-redacts-outcome",
+		title: "`auditPlugin` now redacts `outcome` by default — opt out if your trail reads it",
+		kind: "manual",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => /auditPlugin\s*\(/.test(e.getFullText())),
+		note: [
+			"`auditPlugin` gained `redactOutcome`, and it DEFAULTS TO `'all'`.",
+			"",
+			"What changes in your `_voltro_audit_log` rows from this version on:",
+			"",
+			"  outcome.value  (on success)  →  { \"__redacted\": \"all\" }",
+			"  outcome.error  (on failure)  →  { \"_tag\": \"<yours>\" }   ← the tag SURVIVES",
+			"  outcome.kind, outcome.durationMs                        ← unchanged",
+			"",
+			"Nothing else moves: the input and subject policies are unchanged, the",
+			"caller still receives the real result, and a `record` predicate still sees",
+			"the live outcome, so a filter keyed on what a call returned keeps working.",
+			"",
+			"WHY: a credential-issuing call has nothing sensitive in its INPUT — the",
+			"secret is the thing it returns. `redactInput` could never reach it. A team",
+			"found four live webhook signing secrets stored in full in this column, with",
+			"both existing redaction options already enabled.",
+			"",
+			"IF YOUR TRAIL IS READ FOR THE RESULT PAYLOAD, opt out explicitly:",
+			"",
+			"    auditPlugin({ sink: 'datastore', redactOutcome: 'none' })",
+			"",
+			"or keep the shape and drop only the sensitive part:",
+			"",
+			"    auditPlugin({ sink: 'datastore', redactOutcome: (e) => summarise(e) })",
+			"",
+			"AND WHILE YOU ARE HERE — the rows already written are not touched by this.",
+			"Run the scan on every environment:",
+			"",
+			"    voltro db scan-credentials",
+			"",
+			"It exits 1 on a hit and 2 when it examined nothing. If it finds something,",
+			"purge the rows AND rotate the credentials — assume anything written to a",
+			"log table has been read."
+		].join("\n")
+	}),
+	H({
+		version: "0.33.0",
+		id: "0.33.0/01_opentelemetry-optional-peer",
+		title: "`@effect/opentelemetry` is now an optional peer — install it if you use tracing",
+		kind: "manual",
+		appliesTo: () => !0,
+		note: [
+			"SKIP THIS if you do not export traces or metrics (no `FRAMEWORK_TRACING`,",
+			"no `FRAMEWORK_METRICS`, no `OTEL_EXPORTER_OTLP_*` endpoint). Nothing changes",
+			"for you, and your `pnpm install` just got 24 lines quieter.",
+			"",
+			"IF YOU DO: `@effect/opentelemetry` is no longer installed for you. Add it:",
+			"",
+			"    pnpm add @effect/opentelemetry",
+			"",
+			"WHY: it was a hard dependency of `@voltro/runtime` and is reached from one",
+			"dynamic import, only when tracing is on. It declares seven non-optional",
+			"OpenTelemetry peers; we supply five. The two we do not are",
+			"`@opentelemetry/sdk-logs` and `@opentelemetry/sdk-trace-web` — and the",
+			"second is the BROWSER tracer, so adding it to a server package to silence",
+			"the warning would have been the wrong direction. So every consumer saw an",
+			"unmet-peer block on every install, for a condition that broke nothing.",
+			"",
+			"The team who reported it read past that block for four releases. A warning",
+			"that is always there is a warning nobody reads, and the next one in the",
+			"block is the one that matters.",
+			"",
+			"IF YOU FORGET: a boot with tracing enabled fails with a message naming this",
+			"exact install line, rather than a bare module-not-found for a package you",
+			"never wrote down. It is a startup failure, not a silent loss of traces —",
+			"losing telemetry quietly would be the worse outcome."
+		].join("\n")
+	}),
+	H({
+		version: "0.33.0",
+		id: "0.33.0/02_coordinated-handle-gained-wake",
+		title: "`CoordinatedScheduleHandle` gained `wake()`, `currentIntervalMs()` and `isArmed()` — update hand-written test doubles",
+		kind: "manual",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes("scheduleCoordinated")),
+		note: [
+			"SKIP THIS unless you STUB `ctx.scheduleCoordinated` in a test. Calling it is",
+			"unchanged — the framework builds the handle, and the effect parameter only",
+			"got wider (it may now return a tick outcome; returning nothing still works",
+			"and still means \"assume there was work\").",
+			"",
+			"IF YOU STUB IT: the handle now has three more members. A minimal double:",
+			"",
+			"    scheduleCoordinated: (name, intervalMs, effect) => {",
+			"      const timer = setInterval(() => { void effect() }, intervalMs)",
+			"      return {",
+			"        name,",
+			"        stop: () => clearInterval(timer),",
+			"        wake: () => { void effect() },",
+			"        currentIntervalMs: () => intervalMs,",
+			"        isArmed: () => true,",
+			"      }",
+			"    }",
+			"",
+			"WHY: a coordinated tick used to run on a fixed interval and write a row into",
+			"`_voltro_schedule_claims` every time it won — whether or not there was any",
+			"work. On a two-replica deployment that had never enqueued anything, two",
+			"framework tasks accounted for 99.3 % of that table: 2 506 rows an hour,",
+			"against 18 from the app's own eight schedules. The table reached 86 214 rows",
+			"and pinned ten connections of a fifteen-slot pooler.",
+			"",
+			"So the interval is a FLOOR now. Return `{ idle: true }` from a tick that",
+			"found nothing and the runner backs off toward `VOLTRO_POLL_CEILING_MS`",
+			"(30 s); add `nextDueInMs` when you already know something is coming, and it",
+			"arms for that instant instead. `wake()` is the other half — wire it to",
+			"whatever announces work (a `store.onChange` on your queue table) and the",
+			"work starts on arrival rather than up to one interval later.",
+			"",
+			"AND IF YOU HAVE A CHANGE CHANNEL, you can stop polling altogether: pass",
+			"`{ disarmWhenIdle: true }` as a fourth argument and an idle tick with",
+			"nothing pending stops the timer — one tick at startup, then only `wake()`.",
+			"Only do that where a peer replica's write reaches your process (Postgres",
+			"LISTEN/NOTIFY, or a broadcast broker); without that a disarmed task sleeps",
+			"through a peer's enqueue and the backoff ceiling is the right choice.",
+			"",
+			"IF YOU DO NOTHING: your task keeps its fixed interval, exactly as before.",
+			"Reporting nothing is the conservative default on purpose — a task that",
+			"cannot tell whether it was idle must not be slowed down on a guess."
+		].join("\n")
 	})
 ], ls = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -5202,7 +5328,7 @@ never mint — inspect stays closed until an operator opens it.`);
 			]
 		});
 		c.push(i), await ic(o, "web"), U.info(`running ${s.length} test file(s)`, { count: s.length });
-		let l = 0, u = He(), d = ze(u);
+		let l = 0, u = ze(), d = Je(u);
 		d !== void 0 && U.warn(d);
 		for (let e of s) {
 			let t = await new Promise((t) => {
@@ -8181,7 +8307,7 @@ replicas = 1
 	return Ne(e);
 }, yf = async (t) => {
 	if (t.includes("--create-only")) return e(gf(O(t.find((e) => !e.startsWith("-")) ?? process.cwd())), { scope: "voltro:migrate" });
-	let { runDbCommand: n } = await import("./dbCommand-BwQ_Jl98.js");
+	let { runDbCommand: n } = await import("./dbCommand-b1gum4td.js");
 	return n(["apply", ...t]);
 }, bf = "voltro-backup-stamp.json", xf = (e) => ({
 	stampVersion: 1,