@voltro/cli 0.35.0 → 0.37.0

package/dist/serveCommand-qumm7jdF.js

@@ -0,0 +1,2 @@
+import { n as e } from "./serveCommand-CyZsXL1l.js";
+export { e as runServeDispatch };

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
 import { t as e } from "./loadEnv-D9nEOClM.js";
 import { r as t } from "./appModuleLoader-C9r9mxZt.js";
 import { i as n } from "./dialectDriver-CgXnDfec.js";
-import { t as r } from "./serveCommand-iwlUBNS1.js";
+import { t as r } from "./serveCommand-CyZsXL1l.js";
 export { e as loadDotEnv, t as registerAppModules, n as registerDriver, r as runServe };

package/dist/subcommandNames-CKG5Dz3a.js

@@ -0,0 +1,27 @@
+//#region src/subcommandNames.ts
+var e = [
+	"plan",
+	"apply",
+	"branch",
+	"plans",
+	"drift",
+	"squash",
+	"restore-snapshot",
+	"generate",
+	"migrate",
+	"rollback",
+	"status",
+	"files",
+	"rollback-file",
+	"seed",
+	"gc-snapshots",
+	"adopt",
+	"scan-credentials",
+	"encrypt-column"
+], t = [
+	"scope",
+	"export",
+	"erase"
+], n = (e) => `<${e.join("|")}>`;
+//#endregion
+export { t as n, n as r, e as t };

package/dist/{templates-De8IR5-c.js → templates-BR-fb4SP.js}

@@ -4,10 +4,7 @@ import { fileURLToPath as s } from "node:url";
 //#region src/templates.ts
 var c = e(s(import.meta.url)), l = (() => {
 	let n = process.env.VOLTRO_TEMPLATES_DIR;
-	if (n) {
-		let e = t(n, "apps");
-		if (i(e)) return e;
-	}
+	if (n) return t(n, "apps");
 	let a = r(c, "..", "templates", "apps"), o = c;
 	for (let n = 0; n < 12; n++) {
 		for (let e of ["voltro-templates", ".voltro-templates"]) {

package/dist/{test-CI6iDsYc.js → test-DIQ0jlkQ.js}

@@ -79,7 +79,7 @@ var d = l({ scope: "voltro:test" }), f = (e) => {
 }, C = async (e) => {
 	let t = m(e);
 	if (!o(t.root)) return console.error(`voltro test: no such directory: ${t.root}`), 1;
-	let { checkRpcGroupFreshness: n } = await import("./codegen-ChBi_hVa.js"), r = await n(t.root);
+	let { checkRpcGroupFreshness: n } = await import("./codegen-uYrrDzQv.js"), r = await n(t.root);
 	if (r.kind === "stale") return console.error(`voltro test: ${r.file} is stale — ${r.reason}.`), console.error("  The tests would run against the previously generated procedure group, pass, and prove nothing about the descriptors you just edited.\n  Run `voltro codegen` (or boot `voltro dev` once) and try again."), 1;
 	d.info("running vitest", {
 		root: t.root,

package/dist/{updateCommand-x0pI_x-B.js → updateCommand-9GHHsmDf.js}

@@ -1,4 +1,4 @@
-import { n as e, r as t, t as n } from "./codemodRunner-BnFq3Fgu.js";
+import { n as e, r as t, t as n } from "./codemodRunner-cyqu5oxr.js";
 import { basename as r, dirname as i, join as a, relative as o, resolve as s } from "node:path";
 import { existsSync as c, readFileSync as l, readdirSync as u, statSync as d, writeFileSync as f } from "node:fs";
 import { totalmem as p } from "node:os";

package/dist/updateCommand-BN0tkl9-.js

@@ -0,0 +1,2 @@
+import { f as e, p as t } from "./updateCommand-9GHHsmDf.js";
+export { e as runApplyCodemods, t as runUpdateCommand };

package/dist/{webhooksCommand-DlAgS2Iw.js → webhooksCommand-CHWSPk5z.js}

@@ -222,7 +222,7 @@ createVerifier({ secret: [process.env.WEBHOOK_SECRET, process.env.WEBHOOK_SECRET
 		...t === void 0 ? {} : { payload: t }
 	};
 }, S = u({ scope: "voltro:webhooks" }), C = ["--out", "--name"], w = async (e) => {
-	let { walk: t, loadDiscovered: n } = await import("./dev-D2BikO7a.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-CrGAfhIG.js");
+	let { walk: t, loadDiscovered: n } = await import("./dev-BV6XNYKf.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-CrGAfhIG.js");
 	return r((await n(await t(e))).events.map((e) => ({
 		file: e.file,
 		descriptor: e.descriptor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -568,6 +568,18 @@
         "title": "The declared schema no longer reads `CDC` / `VOLTRO_UNDO` / `VOLTRO_TRACING_PERSIST`",
         "kind": "manual"
       },
+      {
+        "version": "0.35.1",
+        "id": "0.35.1/01_unauthorized-replaces-session-expired",
+        "title": "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
+        "kind": "transform"
+      },
+      {
+        "version": "0.37.0",
+        "id": "0.37.0/01_procedure-input-rejects-undeclared-fields",
+        "title": "a procedure input rejects a field it does not declare (it used to drop it)",
+        "kind": "manual"
+      },
       {
         "version": "0.4.0",
         "id": "0.4.0/01_rbac-forbidden-to-scopeerror",
@@ -667,22 +679,22 @@
     "@effect/platform-node": "^0.108.0",
     "@effect/sql": "^0.52.0",
     "@effect/workflow": "^0.19.0",
-    "@voltro/ai": "0.35.0",
-    "@voltro/cache": "0.35.0",
-    "@voltro/data-transfer": "0.35.0",
-    "@voltro/database": "0.35.0",
-    "@voltro/env": "0.35.0",
-    "@voltro/kv": "0.35.0",
-    "@voltro/logger": "0.35.0",
-    "@voltro/plugin-auth": "0.35.0",
-    "@voltro/plugin-broadcast": "0.35.0",
-    "@voltro/plugin-mail": "0.35.0",
-    "@voltro/plugin-storage": "0.35.0",
-    "@voltro/plugin-webhooks": "0.35.0",
-    "@voltro/protocol": "0.35.0",
-    "@voltro/runtime": "0.35.0",
-    "@voltro/serverless": "0.35.0",
-    "@voltro/workflow": "0.35.0",
+    "@voltro/ai": "0.37.0",
+    "@voltro/cache": "0.37.0",
+    "@voltro/data-transfer": "0.37.0",
+    "@voltro/database": "0.37.0",
+    "@voltro/env": "0.37.0",
+    "@voltro/kv": "0.37.0",
+    "@voltro/logger": "0.37.0",
+    "@voltro/plugin-auth": "0.37.0",
+    "@voltro/plugin-broadcast": "0.37.0",
+    "@voltro/plugin-mail": "0.37.0",
+    "@voltro/plugin-storage": "0.37.0",
+    "@voltro/plugin-webhooks": "0.37.0",
+    "@voltro/protocol": "0.37.0",
+    "@voltro/runtime": "0.37.0",
+    "@voltro/serverless": "0.37.0",
+    "@voltro/workflow": "0.37.0",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/AGENTS.md

@@ -707,7 +707,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.35.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.37.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/_index.md

@@ -9,7 +9,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.35.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.37.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/cli.md

@@ -173,6 +173,22 @@ voltro db apply                # execute it (dev)
 # `voltro migrate` is an alias of `db apply` — same differ, shorter name (CI / ops)
 ```
 
+### "I want to encrypt a column that already has rows in it"
+
+Turning on `.encrypted()` needs two things: the cipher, and a migration of the
+rows that are already there. The second has a command — it is easy to miss,
+because nothing about a schema change suggests a data pass is owed.
+
+```bash
+voltro db scan-credentials              # find plaintext secrets, column by column
+voltro db encrypt-column users.apiToken --dry-run
+voltro db encrypt-column users.apiToken --yes
+```
+
+`--key-env` names the key variable if it is not the default; the key must be the
+SAME one the app runs with, or the rows come back undecryptable. `voltro db`
+with no subcommand prints the full list.
+
 ### "I want a clean rebuild"
 
 ```bash
@@ -3677,6 +3693,28 @@ Codemods that span multiple versions run in order (e.g. upgrading `0.2.0 → 0.4
 
 Use `voltro db apply` (the declarative diff), not `voltro db migrate` (the imperative file-runner) — only the former reconciles framework tables. If your app also ships `migrations/*.migration.ts`, `voltro db migrate .` runs both halves and is what refusal 4 above asks your pre-deploy job for.
 
+## Restart every process — a running one keeps the OLD modules
+
+`voltro update` changes what is on disk. A process that was already running when
+you ran it keeps the module graph it loaded at boot, so it goes on executing the
+previous version indefinitely — and against a `.framework` directory that has
+since been rewritten.
+
+That mix is worse than either version alone. A consumer lost half an hour to a
+pod whose api had started before the upgrade: it served requests, reported
+healthy, and returned no SSR at all, because the running process held the old
+modules while the build output on disk was new.
+
+Restart every process after an update, including ones you did not deploy:
+
+```sh
+kubectl rollout restart deploy/api deploy/web   # or: docker compose up -d --force-recreate
+```
+
+`voltro dev` reloads itself, so a development machine is not affected. Anything
+long-running is — a `voltro serve` / `voltro start` container, a worker, a
+process a supervisor kept alive across the upgrade.
+
 ## After the update — the checklist
 
 ```bash

package/templates/agent-docs/data.md

@@ -263,6 +263,36 @@ const { data } = useSubscription('app', 'messages.list', {
 })
 ```
 
+### An undeclared field is refused, not dropped
+
+The input schema is the whole accepted key set. A field it does not declare
+fails the call with a `ParseError` naming the key and listing what was expected:
+
+```
+{ readonly channelId: string; readonly limit: number }
+└─ ["employeeId"]
+   └─ is unexpected, expected: "channelId" | "limit"
+```
+
+It used to be discarded silently, and the reason that is worse than it sounds is
+what a discarded FILTER means. A consumer's layout called a `userSettings.list`
+that declares `userId` with `{ employeeId }`; the payload decoded to `{}`, which
+for a list query is not a narrower filter but the absence of one, and an admin
+was served another user's row.
+
+The decoder cannot tell a projection field from a filter field, so it refuses
+either way. Three consequences worth knowing:
+
+- Nested objects and union members follow the same rule — a stray key inside
+  `{ page: { limit, offset } }` is refused too.
+- `Schema.Struct({})` means "this procedure takes nothing", and a call carrying
+  anything is refused. `Schema.Record(...)` keeps its open key set: there the
+  openness is declared.
+- If a call site legitimately holds more than the procedure declares — a spread
+  of a wider filter object — narrow it at the call site rather than widening the
+  schema. Widening restores the silent drop under a different name: the field is
+  accepted and still does nothing.
+
 ## Descriptor-return vs computed-return
 
 A query executor can return either:

package/templates/agent-docs/database/misc.md

@@ -330,6 +330,39 @@ Precedence, exactly:
 3. **`.safe()`** on an encrypted column suppresses the implied secret and copies
    it verbatim — say this only when you have genuinely reviewed the plaintext.
 
+## Which stores decrypt — every one the framework hands you
+
+The codec is applied by the store, so "which store" is the whole question. All
+three of these decrypt on read and encrypt on write:
+
+| store | where you get it |
+| --- | --- |
+| `ctx.store` | inside a handler |
+| the boot store | an auth strategy, a plugin HTTP route, `bindDataStore` |
+| a transaction view | inside `store.transactional(...)` |
+
+The boot store is deliberately NOT the request-scoped one — it has no resolved
+Subject, so it carries no tenant scope, no soft-delete filter, no audit stamping
+and no row filter. It does carry the **storage codec**, because that needs no
+Subject: it is how a declared column is spelled on disk versus in JS.
+
+That split is worth knowing because getting it wrong is silent. Ciphertext is a
+string. It compares, concatenates, renders and logs without complaint, so a
+value read through a store that skipped the codec fails somewhere else entirely
+— a team sent `enc:v1:…` upstream as a bearer token, got a 401, and spent a day
+inside their auth code. If a value that should be plaintext arrives as
+`enc:v1:…`, the question is which store produced it, not whether the column is
+declared correctly.
+
+A store you construct yourself from a driver has no codec. If you need one —
+a migration script, a maintenance task — wrap it:
+
+```ts
+import { wrapStoreWithBootCodec } from '@voltro/runtime'
+
+const store = wrapStoreWithBootCodec(rawDriverStore, 'postgres')
+```
+
 ## Encrypting a column that already has rows
 
 `.encrypted()` encrypts on **write**. Adding it to a populated column converts

package/templates/agent-docs/plugins/audit.md

@@ -327,6 +327,52 @@ surfaces where the READ is the sensitive act — a GDPR export, a salary view
 usually together with `include` so it stays targeted.
 
 
+## Reading a redacted row — `'shape'`
+
+`redactInput`, `redactOutcome` and `redactSubject` default to removing the
+payload entirely (`{ "__redacted": "all" }`). That is the right default and it
+is unreadable on purpose.
+
+`'shape'` is the middle option: the payload's STRUCTURE, no value from it.
+
+```ts
+auditPlugin({ redactOutcome: 'shape', redactInput: 'shape' })
+```
+
+```json
+{ "__redacted": { "jiraToken": "string(113)", "attempts": "number" } }
+```
+
+It exists because a team spent a day on a bug their own trail could have ended
+in seconds: a value arrived as 113 characters where 44 were due, and the row
+that would have said so read `{"__redacted":"all"}`. They had asked for that
+redaction one round earlier, and both requests were right.
+
+What it discloses, and what it never does:
+
+| | |
+| --- | --- |
+| a string | its LENGTH — `string(113)`. Never a prefix, never a hash |
+| a number, a boolean, a date | its TYPE only. A number can BE the secret |
+| a declared field name | survives — `jiraToken` |
+| a key that is not an identifier | described, not reproduced — `<key:string(36)>` |
+| depth / breadth | capped, and the shape says where it stopped |
+
+Two of those are worth a sentence each.
+
+**A key can be the value.** An object keyed by user data (`{ "user@example.com":
+… }`) puts a datum where a schema name belongs, so a key is reproduced only when
+it looks like a declared field: a plain short identifier. A legitimate key that
+is not one (`content-type`) loses its name and keeps its shape.
+
+**A string's length is a real disclosure, and a small one.** For a fixed-format
+credential it carries nothing — every token of a given kind is the same length.
+For a human-chosen password it is a weak hint. If that matters in your threat
+model, `'all'` is the default and stays available.
+
+`redactSubject` spells its variant `'metadata-shape'`, because its default
+(`'metadata'`) already names the field it acts on.
+
 ## Scoping the trail — `scope`
 
 ```ts