@voltro/cli 0.36.0 → 0.37.0

package/CHANGELOG.md

@@ -39,6 +39,96 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.37.0] — 2026-08-13
+
+### ⚠ BREAKING
+
+- **@voltro/protocol, @voltro/runtime, @voltro/cli** — A field a procedure's input schema does not declare now REJECTS the call. It used to be discarded and the call ran with what was left.
+
+  The measurement, from a consumer's root layout:
+
+  ```ts
+  query?.('userSettings.list', { employeeId })
+  ```
+
+  That procedure declares `userId` / `userIdIn`. Effect's default `onExcessProperty: 'ignore'` decoded the payload to `{}` — not reasoned, measured:
+
+  ```ts
+  decodeUnknownSync(Struct({ userId: optional(String) }))({ employeeId: 'e' })  // → {}
+  ```
+
+  An empty input to a LIST query is not a narrower filter, it is the ABSENCE of one. Their admin, signed in as `2d0add2c…`, was served the settings row of `4410c2f8…` — another user's language and theme in the first paint, with nothing in any log to say so.
+
+  **Why refuse rather than warn.** The decoder cannot tell a projection field from a FILTER field, and that asymmetry is the whole risk: dropping an unknown `include` costs a caller some data, dropping an unknown `tenantId` hands them somebody else's. Nothing at decode time distinguishes the two, so the safe direction is the only one available — the same fail-closed reasoning as the row filter's refusal, one layer up. A warning would have to be read by someone, in a log, after the wrong rows were already served.
+
+  The typed loader query that shipped in 0.36.0 closes the same hole for callers we compile. This closes it for the ones we do not: a plain `fetch`, a curl, a still-cached bundle after a field rename, and every untyped caller.
+
+  Three things measured rather than assumed, because none follows from the annotation's name: it propagates into NESTED structs, through every member of a UNION, and leaves a non-struct payload (`Schema.Void`, a scalar) alone.
+
+  **`Schema.Struct({})` needed a filter, and only a real process showed it.** The fixture's `notes.list` declares an empty input; `POST /rpc` with `{ employeeId }` came back `200` with a snapshot, which for twenty minutes read as the whole change having failed. An empty `TypeLiteral` has no property signatures, so Effect has no expected key set for a key to be excess OF — self-consistent, and the wrong answer here, because `input: Schema.Struct({})` is the STRONGEST declaration a procedure can make and it was the one shape that accepted everything. It gets an explicit predicate now; `Schema.Record` keeps its open key set, because there the openness is declared.
+
+  **Verified against a running `voltro serve`, not only in units.** A declared input succeeds and inserts its row; an undeclared field is refused naming the key and the accepted set. The refusal arrives on the channel a payload decode failure ALREADY used — a missing required field produces the same `Die` with a `ParseError` message — so this adds no new error shape for a client to handle, it moves one case onto the channel the sibling case was always on.
+
+  `strictInput` lives in one module and every `Rpc.make` payload in `@voltro/protocol` goes through it — query, mutation, action, stream, event, plus the workflow start on both the server lifter and the browser-loaded rpc group. `strictInput.test.ts` asserts that SET by scanning the source, not the five lifters somebody remembered: a rule applied at the sites you can list is the shape that let `bootStoreCodec` be fixed twice and break a third time.
+
+  **`voltro update` carries you across this** — codemod `0.37.0/01_procedure-input-rejects-undeclared-fields`, a written note. A transform would have to guess which declared field a stray one meant, which is the same guess that produced the defect.
+
+### Added
+
+- **@voltro/plugin-audit** — `redactInput` / `redactOutcome` gained `'shape'`, and `redactSubject` gained `'metadata-shape'`: the payload's STRUCTURE survives, no value from it.
+
+  ```json
+  { "__redacted": { "jiraToken": "string(113)", "attempts": "number" } }
+  ```
+
+  Requested by the consumer who had asked for the redaction one round earlier, and both requests were right. They spent a day on a bug their own audit trail could have ended in seconds — a value arrived as 113 characters where 44 were due, and the row that would have said so read `{"__redacted":"all"}`. `'all'` remains the default on every field; this is opt-in.
+
+  The rules, and the two that are decisions rather than details:
+
+  - A string reports its LENGTH. Never a prefix, never a hash — `enc:v1:` is a prefix and so is the first byte of a private key, so there is no prefix length that is safe for every credential format. - A number, boolean or date reports its TYPE only. A number can BE the secret. - **A key can be the value.** An object keyed by user data puts a datum where a schema name belongs, so a key is reproduced only when it looks like a declared field — a short plain identifier. The first version truncated long keys and documented the weakness instead; this module's own test caught 62 characters of a secret surviving on the first run. A leak with a footnote is still a leak. - **A string's length is a real disclosure, and a small one.** Stated in the docs rather than buried: for a fixed-format credential it carries nothing, for a human-chosen password it is a weak hint. `'all'` stays the default for anyone that matters to.
+
+  The `'shape'` outcome describes the payload it REPLACES — the value on success, the error on failure — rather than the event. Describing the event would report `{ kind, value, durationMs }` and hide the field, which is the failure the option exists to end. An error's `_tag` still survives, as it does under `'all'`.
+
+### Fixed
+
+- **@voltro/cli** — `voltro db --help` listed fifteen of eighteen subcommands. `adopt`, `scan-credentials` and `encrypt-column` shipped and never joined the hand-written string.
+
+  A consumer wrote both halves of that gap into a requirements document, as separate items, neither of them about help text:
+
+  - **`voltro db encrypt-column` "does not exist"** — filed as a feature request, quoting the fifteen names they saw as evidence. It shipped in 0.33.0, and enabling `.encrypted()` on a populated column by hand is exactly the migration they were about to write themselves. - **`scan-credentials` "no longer exists"** — filed as CLOSED, a credential scanner struck off their list as removed. It had not moved.
+
+  A quoted enumeration is read as exhaustive, and the more careful the reader the more thoroughly they act on the missing entry. Same lesson a boot refusal in `procedureAccessGate` had already taught us, in a place nobody thought of as a message.
+
+  The usage line is now GENERATED from the dispatch table's key type (`Record<DbSubcommand, Handler>` in `dbCommand.ts`, names in `subcommandNames.ts`), so a handler with no name or a name with no handler fails to compile. `voltro privacy` is keyed the same way. The prose summary beside it cannot be generated — it carries per-command annotations — so a test asserts it mentions every name, because it carried the identical three omissions and it is what `voltro --help` prints first.
+
+  `subcommandHelpParity.test.ts` also NAMES the six commands whose subcommand menus have no dispatch table behind them (`webhooks`, `evolve`, `new`, `data`, `storage`, `add`). They dispatch through a switch and are unchecked; a silently-unchecked command reads exactly like a checked one.
+- **@voltro/cli** — A 401 or 403 from the inspect surface now names `VOLTRO_INSPECT_TOKEN` and says which side is missing.
+
+  `voltro db plan --against <url>` printed `remote returned 403` and stopped. A consumer read that as a DATABASE permission problem — the natural reading of a 403 from a command whose entire subject is a database — and went looking at grants. The cause is one unset environment variable, which the command reads four lines above the message.
+
+  `voltro probe access` had half of it: it named the variable on 401 and not on 403, while classifying both as `refused`. So the two commands somebody needs during an access migration were the two that would not say what was wrong, and one of them said something misleading instead.
+
+  `inspectGateHint` is shared by both call sites and distinguishes the two statuses, because they call for different actions: a 401 means no credential was sent (set the variable), a 403 means the one sent was not accepted (the two values differ). Both halves of the sentence name the server AND the calling shell — naming one side produces a second failed attempt.
+- **@voltro/cli** — `VOLTRO_TEMPLATES_DIR` is authoritative when set. It used to be a HINT: if the path it named held no `apps/` (or no `baselines/`), both resolvers fell through to the sibling-checkout walk-up and quietly used a different tree — or none.
+
+  A pointer that silently isn't followed is worse than a wrong one. A CI job aimed at the wrong path scaffolded from whatever it happened to find, and a job whose checkout had failed reported an empty template catalogue with nothing connecting that emptiness to the variable it was given. `scripts/lib/docsSite.mjs` states the same rule for `VOLTRO_DOCS_DIR`, and arrived at it the same way: you said where it is; it is not there.
+
+  Behaviourally this only changes the misconfigured case — a correct `VOLTRO_TEMPLATES_DIR` resolved to the same place before and after. What changes is that a wrong one now shows up as "not found, here is the path I was told" at the first thing that reads it, instead of as a different tree three steps later.
+
+  The unbundled resolution order is otherwise untouched: sibling `voltro-templates` → `.voltro-templates` → the bundled `templates/` a published CLI ships.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/plugin-ai-flows** — Two comments in the flow engine cited task records from a plans tracker that has since been deleted. Comment-only; no behavior, no API, nothing a consumer can observe.
+
+  Worth writing down because of HOW it surfaced. The tracker was retired in the META repo, and the gate that went red was in THIS one — `check-stale-task-comments.mjs` resolves a comment's `task #NN` against `../plans`, so deleting a plan document in one repo can only be half a change, and the other half is in a repo the deleting commit never touched.
+
+  Neither comment was WRONG, which is the part that makes the rule earn its keep. The first claims `@voltro/ai` has first-class media generation — true: `generateImage`, `generateSpeech`, `generateVideo` all ship in `packages/ai/src/media.ts`. It now names those three instead of a record number, which is checkable without the deleted document. The second only quoted the retired id inside its own account of a defect (a `"not yet wired (task #35)"` message that outlived the shipped HITL park and misled an audit into filing it as unbuilt); the quote lost the number and kept the whole lesson.
+
+  The check's own failure text is the reasoning: a plan is retired for exactly two reasons — the work shipped, or it was dropped without shipping — and a comment still citing it asserts the second while usually meaning the first.
+
+---
+
 ## [0.36.0] — 2026-08-13
 
 ### ⚠ BREAKING

package/dist/apiBuild-D0f6hYbH.js

@@ -0,0 +1,2 @@
+import { c as e, l as t } from "./apiBuild-DGsShRuF.js";
+export { e as runApiBuild, t as runServeBundleBuild };

package/dist/{apiBuild-DiE9zcj6.js → apiBuild-DGsShRuF.js}

@@ -1,4 +1,4 @@
-import { f as e } from "./dev-Dc4cpmRl.js";
+import { f as e } from "./dev-bwDgSObH.js";
 import { ut as t } from "./webDev-Dybxew86.js";
 import { t as n } from "./dialectDriver-CgXnDfec.js";
 import { dirname as r, isAbsolute as i, join as a, relative as o, resolve as s } from "node:path";

package/dist/{baselineCommand-DIttzO8A.js → baselineCommand-C6NMt-oa.js}

@@ -6,10 +6,7 @@ import { createLogger as d } from "@voltro/logger";
 //#region src/baselineCommand.ts
 var f = r(u(import.meta.url)), p = d({ scope: "voltro:baseline" }), m = (() => {
 	let e = process.env.VOLTRO_TEMPLATES_DIR;
-	if (e) {
-		let t = i(e, "baselines");
-		if (s(t)) return t;
-	}
+	if (e) return i(e, "baselines");
 	let t = o(f, "..", "templates", "baselines"), n = f;
 	for (let e = 0; e < 12; e++) {
 		for (let e of ["voltro-templates", ".voltro-templates"]) {

package/dist/baselineCommand-Cfw2Afwm.js

@@ -0,0 +1,2 @@
+import { o as e } from "./baselineCommand-C6NMt-oa.js";
+export { e as runBaselineCommand };

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as e } from "./commands-Bp7utV-7.js";
+import { r as e } from "./commands-BwG9A9Vv.js";
 import { a as t } from "./nodeEnvironment-cGFAj1J8.js";
 import { t as n } from "./loadEnv-D9nEOClM.js";
 import { n as r } from "./cliError-BmdYnghb.js";

package/dist/{build-DBe6c7qC.js → build-CiFA-E19.js}

@@ -1,8 +1,8 @@
-import { pn as e } from "./dev-Dc4cpmRl.js";
+import { pn as e } from "./dev-bwDgSObH.js";
 import { D as t, G as n, K as r, O as i, S as a, W as o, Y as s, a as c, b as l, d as u, f as d, k as f, s as p, st as m, ut as h, v as g, x as _, y as v } from "./webDev-Dybxew86.js";
 import { t as y } from "./cliRuntime-Dh7UDinH.js";
 import { a as b } from "./renderModeScan-D7J1B7Kw.js";
-import { i as x, o as S, s as C } from "./apiBuild-DiE9zcj6.js";
+import { i as x, o as S, s as C } from "./apiBuild-DGsShRuF.js";
 import { n as w } from "./renderProfile-1OWWAAtx.js";
 import { dirname as T, join as E, resolve as D } from "node:path";
 import { existsSync as O, promises as k } from "node:fs";
@@ -461,13 +461,13 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 	].join("\n"), b = E(o, "ssrEntry.ts");
 	return await k.writeFile(b, y, "utf8"), b;
 }, G = async (e) => {
-	let { checkRpcGroupFreshness: t } = await import("./codegen-ChBi_hVa.js"), n = await t(e);
+	let { checkRpcGroupFreshness: t } = await import("./codegen-uYrrDzQv.js"), n = await t(e);
 	if (n.kind === "fresh") return;
 	n.kind === "stale" && F.info("rpcGroup.generated.ts is stale — regenerating", {
 		file: n.file,
 		reason: n.reason
 	});
-	let { regenerateRpcGroup: r } = await import("./codegenCommand-DH-8ZXzR.js"), i = await r(e);
+	let { regenerateRpcGroup: r } = await import("./codegenCommand-BxS3sCeJ.js"), i = await r(e);
 	if (i.kind === "refused") {
 		F.warn("could not regenerate the rpc group — building against what is on disk", { reason: i.reason });
 		return;
@@ -479,10 +479,10 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 }, K = async (e) => {
 	let t = await u(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-BV6XNYKf.js"), n = await t(e);
 		if (n) {
 			F.info("building api app", { app: n.name ?? "(unnamed)" }), await G(e);
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-ZEZnCXn2.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-D0f6hYbH.js");
 			await t(e);
 			try {
 				await r(e);
@@ -701,7 +701,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 	return t.ran ? t.exitCode : (yield* j.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), J = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-82xVuvbt.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-TM5sSdf7.js");
 		return e(t);
 	}
 	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await y(q(n), { scope: "voltro:build" }), i = e(n);

package/dist/{checkCommand-BTA6P3Yr.js → checkCommand-CIPYyNyc.js}

@@ -1,2 +1,2 @@
-import { n as e, r as t, t as n } from "./checkCommand-BhG0gmUD.js";
+import { n as e, r as t, t as n } from "./checkCommand-CLPTzYqM.js";
 export { n as offlineManifest, e as runCheckCommand, t as toInput };

package/dist/{checkCommand-BhG0gmUD.js → checkCommand-CLPTzYqM.js}

@@ -1,10 +1,10 @@
 import { t as e } from "./cliArgs-D4p8n7EE.js";
-import { c as t, i as n } from "./codegen-CYM3Zqrf.js";
+import { c as t, i as n } from "./codegen-GYYcdpCg.js";
 import { r } from "./appGraph-KGDPTuTy.js";
 import { n as i } from "./cliOutput-D1tSBoRM.js";
 import { n as a, o, r as s, t as c } from "./inspectFetch-EMuhTG_9.js";
 import { r as l } from "./fileTaxonomy-CJfgOllU.js";
-import { x as u } from "./doctorCommand-CNFtt3nR.js";
+import { x as u } from "./doctorCommand-BXyrtN2l.js";
 import { resolve as d } from "node:path";
 import { readdirSync as f, statSync as p } from "node:fs";
 //#region src/observedDiff.ts
@@ -141,7 +141,7 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
 }).join("\n"), C = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-BSFTgCQ5.js"), { buildRpcEntry: i } = await import("./manifestBuild-COkJoyAr.js"), { buildCapabilityManifest: a } = await import("./inspect-P4pxoMaV.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-BV6XNYKf.js"), { buildRpcEntry: i } = await import("./manifestBuild-COkJoyAr.js"), { buildCapabilityManifest: a } = await import("./inspect-P4pxoMaV.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),

package/dist/{cloudCmd-Cvv5HGaZ.js → cloudCmd-NQSwe_Qk.js}

@@ -1,7 +1,7 @@
 import { a as e, t } from "./cliArgs-D4p8n7EE.js";
 import { a as n, i as r, n as i, r as a, t as o } from "./cloudClient-DWL-Hw_T.js";
 import { n as s } from "./cliOutput-D1tSBoRM.js";
-import { d as c, f as l, o as u } from "./projectScaffold-LMMtaavR.js";
+import { d as c, f as l, o as u } from "./projectScaffold-DDgWbNLe.js";
 import { basename as d, join as f, resolve as p } from "node:path";
 import { promises as m } from "node:fs";
 import { ansi as h } from "@voltro/logger";

package/dist/{codegen-CYM3Zqrf.js → codegen-GYYcdpCg.js}

@@ -323,7 +323,7 @@ ${o.join("\n\n")}\n`);
 		let t = H(e.rpcTag), n = A(e);
 		return e.kind === "query" ? `export const ${t} = queryToRpc(${n}${S})` : e.kind === "mutation" ? `export const ${t} = mutationToRpc(${n}${S})` : e.kind === "action" ? `export const ${t} = actionToRpc(${n}${S})` : e.kind === "stream" ? `export const ${t} = streamToRpc(${n}${S})` : e.kind === "event" ? `export const ${t} = eventToRpc(${n}${S})` : [
 			`export const ${t} = Rpc.make('${e.rpcTag}', {`,
-			`  payload: ${n}.payloadSchema,`,
+			`  payload: strictInput(${n}.payloadSchema),`,
 			"  success: WorkflowRunHandleSchema,",
 			`  error:   ${n}.errorSchema,`,
 			"})"
@@ -357,7 +357,7 @@ ${o.join("\n\n")}\n`);
 		...B.map((e) => `  ${e},`),
 		...D
 	].join("\n"), U = ["queryToRpc"];
-	(O.some((e) => e.kind === "mutation") || h.some((e) => e.kind === "mutation")) && U.push("mutationToRpc"), (O.some((e) => e.kind === "action") || F || p || h.some((e) => e.kind === "action")) && U.push("actionToRpc"), O.some((e) => e.kind === "stream") && U.push("streamToRpc"), O.some((e) => e.kind === "event") && U.push("eventToRpc"), F && U.push("WorkflowRunHandleSchema", "workflowCancelDescriptor", "workflowDomainEventsQueryDescriptor", "workflowEventDeliveriesQueryDescriptor", "workflowResumeDescriptor", "workflowRunEventsQueryDescriptor", "workflowRunQueryDescriptor", "workflowRunsQueryDescriptor", "workflowRunStepsQueryDescriptor", "workflowSignalDescriptor", "workflowUpdateDescriptor"), c && U.push("mutationToRpc", "undoLogQueryDescriptor", "undoApplyDescriptor", "undoRedoDescriptor"), R && U.push("mutationToRpc", "approvalsPendingQueryDescriptor", "approvalsDecideDescriptor"), l && U.push("mutationToRpc", "actionToRpc", "connectionsListQueryDescriptor", "connectionStartDescriptor", "connectionSubmitTokenDescriptor", "connectionDisconnectDescriptor"), (O.some((e) => e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream") || p || F || c || R || l || C) && U.push("normalizeDescriptor");
+	(O.some((e) => e.kind === "mutation") || h.some((e) => e.kind === "mutation")) && U.push("mutationToRpc"), (O.some((e) => e.kind === "action") || F || p || h.some((e) => e.kind === "action")) && U.push("actionToRpc"), O.some((e) => e.kind === "stream") && U.push("streamToRpc"), O.some((e) => e.kind === "event") && U.push("eventToRpc"), F && U.push("strictInput", "WorkflowRunHandleSchema", "workflowCancelDescriptor", "workflowDomainEventsQueryDescriptor", "workflowEventDeliveriesQueryDescriptor", "workflowResumeDescriptor", "workflowRunEventsQueryDescriptor", "workflowRunQueryDescriptor", "workflowRunsQueryDescriptor", "workflowRunStepsQueryDescriptor", "workflowSignalDescriptor", "workflowUpdateDescriptor"), c && U.push("mutationToRpc", "undoLogQueryDescriptor", "undoApplyDescriptor", "undoRedoDescriptor"), R && U.push("mutationToRpc", "approvalsPendingQueryDescriptor", "approvalsDecideDescriptor"), l && U.push("mutationToRpc", "actionToRpc", "connectionsListQueryDescriptor", "connectionStartDescriptor", "connectionSubmitTokenDescriptor", "connectionDisconnectDescriptor"), (O.some((e) => e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream") || p || F || c || R || l || C) && U.push("normalizeDescriptor");
 	let J = [...new Set(U)].sort(), Y = [...O.filter((e) => e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream").map((e) => [e.rpcTag, A(e)]), ...s.flatMap((e) => [[`${e.name}.send`, `${y(e)}.send`], [`${e.name}.messages`, `${y(e)}.messages`]])], X = [
 		...F ? [
 			["__voltro.workflow.run", "workflowRunQueryDescriptor"],

package/dist/codegen-uYrrDzQv.js

@@ -0,0 +1,2 @@
+import { t as e } from "./codegen-GYYcdpCg.js";
+export { e as checkRpcGroupFreshness };

package/dist/{codegenCommand-DH-8ZXzR.js → codegenCommand-BxS3sCeJ.js}

@@ -1,5 +1,5 @@
-import { l as e, z as t } from "./dev-Dc4cpmRl.js";
-import { r as n } from "./codegen-CYM3Zqrf.js";
+import { l as e, z as t } from "./dev-bwDgSObH.js";
+import { r as n } from "./codegen-GYYcdpCg.js";
 import { basename as r, relative as i, resolve as a } from "node:path";
 //#region src/codegenCommand.ts
 var o = async (i) => {

package/dist/{codemodRunner-DjQGrdmg.js → codemodRunner-cyqu5oxr.js}

@@ -5080,7 +5080,23 @@ var x = (e, t, n) => {
 	kind: "manual",
 	appliesTo: () => !0,
 	note: (/* @__PURE__ */ "The set of framework tables your app DECLARES is hashed into the schema(fingerprint. A pre-deploy `voltro db apply` records that hash; every serving(container recomputes it and refuses to boot if it differs. Until this release(three RUNTIME flags fed into that set:((    CDC=0                       removed `_voltro_cdc_offsets`(    VOLTRO_UNDO=on              added   `_voltro_undo_log`(    VOLTRO_TRACING_PERSIST=all  added   `_voltro_traces`((All three read as pure runtime knobs, so they tend to live on the PODS and(not on the pre-upgrade migrate Job — which is a green migrate followed by(every pod in CrashLoopBackOff. This was reported against a Helm deployment(where `CDC: \"0\"` was in all three overlays' pod blocks and none of their(jobs; it had been latent for months and would have fired on the next deploy.((WHAT YOU MUST DO — only if you set one of these to turn a table ON in(production:((  * `VOLTRO_UNDO=on` in production  → add to app.config.ts:(        export default { schema: { undo: true }, … }(  * `VOLTRO_TRACING_PERSIST` keeping trace history in production → add:(        export default { schema: { traces: true }, … }((    Without the declaration, `voltro serve` now REFUSES to boot and names the(    field. That refusal is the point: before, the same configuration either(    wrote to a table nobody created or produced a fingerprint the migrate job(    could not reproduce.((    Turning capture OFF still needs no declaration and never will — a declared(    table nobody writes to is harmless. Only turning it ON is a schema claim.((WHAT HAPPENS WITHOUT ANY ACTION:((  * On mariadb or mssql you will see ONE additive `create-table` in your next(    plan: `_voltro_cdc_offsets` is now declared by the DIALECT rather than by(    `CDC`, so it exists whether or not that process drives CDC. It is an(    offsets table — a handful of rows — and the alternative was leaving a(    runtime flag able to split your fleet.(  * On postgres/sqlite nothing changes: those dialects have no offsets table.((AND ONE THING WORTH DOING ANYWAY: if you are upgrading a deployment that has(a separate migrate job, diff that job's `env:` against your pods' once. The(framework can now guarantee its OWN tables do not depend on a runtime flag;(it cannot make the same guarantee for a plugin's `extendSchema.tables`, which(is app code and may read anything. A `prod-mismatch` refusal now prints which(tables this process decided and from which input, so the comparison is quick.".split("(")).join("\n")
-}), q = "session_expired", J = [
+}), q = "session_expired", Jr = C({
+	version: "0.35.1",
+	id: "0.35.1/01_unauthorized-replaces-session-expired",
+	title: "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
+	kind: "transform",
+	appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes(q)),
+	transform: ({ project: e, log: t }) => {
+		let n = [];
+		for (let t of e.getSourceFiles()) {
+			if (!t.getFullText().includes(q)) continue;
+			let e = !1;
+			for (let n of t.getDescendantsOfKind(11)) n.getLiteralValue() === q && (n.setLiteralValue("unauthorized"), e = !0);
+			e && n.push(t.getFilePath());
+		}
+		n.length !== 0 && t(`rewrote '${q}' to 'unauthorized' in ${n.length} file(s).\n  A 401 now means only "the credential was refused" — expired, revoked, wrong\n  scope and MALFORMED all produce that status, and the old name asserted the\n  first one. If a rewritten branch was meant to catch a credential your\n  CONNECTION VAULT could not produce (no grant, revoked grant, failed refresh),\n  change it to 'credential_unusable' — that is the code the vault raises, and it\n  is the one where re-auth is genuinely the right action.\n  A health check that logs the user out on this code should read 'unauthorized'\n  as "ask again", not as "the session is gone".\n` + n.map((e) => `    ${e}`).join("\n"));
+	}
+}), Yr = /\(\s*\{[^}]*\.\.\./, Xr = /\bquery\??\.?\(\s*['"`]/, J = [
 	ge,
 	_e,
 	ye,
@@ -5181,22 +5197,65 @@ var x = (e, t, n) => {
 	Wr,
 	Kr,
 	qr,
+	Jr,
 	C({
-		version: "0.35.1",
-		id: "0.35.1/01_unauthorized-replaces-session-expired",
-		title: "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
-		kind: "transform",
-		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => e.getFullText().includes(q)),
-		transform: ({ project: e, log: t }) => {
-			let n = [];
-			for (let t of e.getSourceFiles()) {
-				if (!t.getFullText().includes(q)) continue;
-				let e = !1;
-				for (let n of t.getDescendantsOfKind(11)) n.getLiteralValue() === q && (n.setLiteralValue("unauthorized"), e = !0);
-				e && n.push(t.getFilePath());
-			}
-			n.length !== 0 && t(`rewrote '${q}' to 'unauthorized' in ${n.length} file(s).\n  A 401 now means only "the credential was refused" — expired, revoked, wrong\n  scope and MALFORMED all produce that status, and the old name asserted the\n  first one. If a rewritten branch was meant to catch a credential your\n  CONNECTION VAULT could not produce (no grant, revoked grant, failed refresh),\n  change it to 'credential_unusable' — that is the code the vault raises, and it\n  is the one where re-auth is genuinely the right action.\n  A health check that logs the user out on this code should read 'unauthorized'\n  as "ask again", not as "the session is gone".\n` + n.map((e) => `    ${e}`).join("\n"));
-		}
+		version: "0.37.0",
+		id: "0.37.0/01_procedure-input-rejects-undeclared-fields",
+		title: "a procedure input rejects a field it does not declare (it used to drop it)",
+		kind: "manual",
+		appliesTo: ({ project: e }) => e.getSourceFiles().some((e) => {
+			let t = e.getFullText();
+			return Yr.test(t) || Xr.test(t) || w("query").test(t);
+		}),
+		note: [
+			"A procedure call whose input carries a field the schema does not declare",
+			"now fails with a ParseError naming the field. Before this release the",
+			"field was DISCARDED and the call ran with what was left.",
+			"",
+			"The measurement that caused it — a consumer's root layout:",
+			"",
+			"    query?.('userSettings.list', { employeeId })",
+			"",
+			"That procedure declares `userId` / `userIdIn`. The payload decoded to `{}`,",
+			"which for a LIST query is not a narrower filter — it is NO filter. An admin",
+			"was served a different user's settings row, and nothing logged anything.",
+			"",
+			"WHAT TO DO",
+			"",
+			"1. Run your test suite and your app against a dev build. A wrong field now",
+			"   surfaces as a ParseError that NAMES the key and lists the accepted ones,",
+			"   so each one is a one-line read rather than an investigation.",
+			"",
+			"2. Look at every SPREAD into a procedure input:",
+			"",
+			"       await api.orders.list({ ...filters, limit })",
+			"",
+			"   This is the construct the change is aimed at. The keys come from a value,",
+			"   so nobody reading the call site can see what is being sent — which is",
+			"   exactly the condition under which a stray key survived unnoticed.",
+			"",
+			"3. If a spread legitimately carries more than the procedure declares, narrow",
+			"   it at the call site (`{ status: filters.status, limit }`) rather than",
+			"   widening the input schema. Widening restores the silent drop under a",
+			"   different name: the field is accepted and still does nothing.",
+			"",
+			"WHAT DOES NOT CHANGE",
+			"",
+			"  • A DECLARED field, including every optional one, decodes exactly as",
+			"    before. An empty input to a procedure that declares none is still fine.",
+			"  • Nested objects and union members follow the same rule — that is the",
+			"    point, since a filter object one level down is the commoner spelling.",
+			"  • A non-object input (a scalar, a void input) is unaffected; there is no",
+			"    excess property for it to have.",
+			"",
+			"WHY IT IS NOT A WARNING",
+			"",
+			"The decoder cannot tell a projection field from a FILTER field. Dropping an",
+			"unknown `include` costs a caller some data; dropping an unknown `tenantId`",
+			"hands them somebody else's. Since nothing at decode time distinguishes the",
+			"two, the only safe direction is to refuse — and a warning would have to be",
+			"read by someone, in a log, after the wrong rows were already served."
+		].join("\n")
 	})
 ], Y = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -5210,12 +5269,12 @@ var x = (e, t, n) => {
 	".turbo",
 	".cache",
 	".output"
-]), Jr = () => [...[...Y].map((e) => `**/${e}/**`), "**/.voltro-*/**"], X = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, Z = /\.(?:tsx?|jsx?|mjs|cjs)$/, Yr = (e) => m(e).replace(Z, ""), Xr = (e) => {
+]), Zr = () => [...[...Y].map((e) => `**/${e}/**`), "**/.voltro-*/**"], X = /(?:from|import)\s*\(?\s*['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\)/g, Z = /\.(?:tsx?|jsx?|mjs|cjs)$/, Qr = (e) => m(e).replace(Z, ""), $r = (e) => {
 	let t = e.split("/").filter((e) => e.length > 0).pop();
 	if (t === void 0 || t === "." || t === "..") return;
 	let n = t.replace(Z, "");
 	return n.length > 0 ? n : void 0;
-}, Zr = (e) => {
+}, ei = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e;
@@ -5226,55 +5285,55 @@ var x = (e, t, n) => {
 		}
 		X.lastIndex = 0;
 		for (let r = X.exec(e); r !== null; r = X.exec(e)) {
-			let e = Xr(r[1] ?? r[2] ?? "");
+			let e = $r(r[1] ?? r[2] ?? "");
 			if (e === void 0) continue;
 			let i = t.get(e);
 			i === void 0 ? t.set(e, /* @__PURE__ */ new Set([n])) : i.add(n);
 		}
 	}
 	return t;
-}, Qr = (e, t) => {
+}, ti = (e, t) => {
 	let n = new Set(e);
-	for (let r of e) for (let e of [Yr(r), m(h(r))]) {
+	for (let r of e) for (let e of [Qr(r), m(h(r))]) {
 		let r = t.get(e);
 		if (r !== void 0) for (let e of r) n.add(e);
 	}
 	return n;
-}, $r = [
+}, ni = [
 	"**/*.ts",
 	"**/*.tsx",
 	"!**/node_modules/**",
 	"!**/dist/**",
 	"!**/.framework/**",
 	"!**/*.d.ts"
-], Q = (e, t, n = ni) => {
+], Q = (e, t, n = ai) => {
 	let r = /* @__PURE__ */ new Set();
-	for (let e of t) for (let t of e.scope ?? $r) r.add(t);
+	for (let e of t) for (let t of e.scope ?? ni) r.add(t);
 	let i = n(e);
 	if (i !== void 0) {
-		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => ti(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => ti(e.slice(1))), a = [...Y], o = [];
+		let t = [...r].filter((e) => !e.startsWith("!")).map((e) => ii(e)), n = [...r].filter((e) => e.startsWith("!")).map((e) => ii(e.slice(1))), a = [...Y], o = [];
 		for (let r of i) {
 			if (a.some((e) => r === e || r.startsWith(`${e}/`) || r.includes(`/${e}/`)) || !t.some((e) => e(r)) || n.some((e) => e(r))) continue;
 			let i = g(e, r);
 			v(i) && o.push(i);
 		}
-		return ei(o.length, e), o;
+		return ri(o.length, e), o;
 	}
 	let a = oe([...r], {
 		cwd: e,
 		absolute: !0,
 		expandDirectories: !1,
 		followSymbolicLinks: !1,
-		ignore: [...Jr()]
+		ignore: [...Zr()]
 	});
-	return ei(a.length, e), a;
-}, ei = (e, t) => {
-	let n = ri();
+	return ri(a.length, e), a;
+}, ri = (e, t) => {
+	let n = oi();
 	if (!(e <= n)) throw Error(`voltro update: the codemod scan matched ${e} files under ${t}, past the ${n} ceiling.\n  Every matched file is parsed into one ts-morph project, so the heap needed grows with\n  this number — past the ceiling it runs out of memory, and V8 aborts without naming a\n  limit, which is why this stops here instead. Three ways out, in order:\n    • put non-source directories in .gitignore (inside a git repo the scan then never\n      sees them at all — a build cache, a data dump, a virtualenv),\n    • run \`voltro update\` from the app directory rather than the workspace root, or\n    • take one codemod at a time: \`voltro update --dry-run\` lists the ids, then\n      \`voltro update --codemods-only --only <id>\` runs a single one.\n  If every one of those files really is source this pass must rewrite, raise the ceiling\n  with VOLTRO_CODEMOD_MAX_FILES and give node room: NODE_OPTIONS=--max-old-space-size=8192.`);
-}, ti = (e) => {
+}, ii = (e) => {
 	let t = e.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*\//g, "\0").replace(/\*\*/g, ".*").replace(/\*/g, "[^/]*").replace(/\u0000/g, "(?:.*/)?").replace(/\\\{([^}]*)\\\}/g, (e, t) => `(?:${t.split(",").join("|")})`);
 	return (e) => RegExp(`^${t}$`).test(e);
-}, ni = (e) => {
+}, ai = (e) => {
 	try {
 		let t = re("git", [
 			"ls-files",
@@ -5295,7 +5354,7 @@ var x = (e, t, n) => {
 	} catch {
 		return;
 	}
-}, ri = () => {
+}, oi = () => {
 	let e = Number(process.env.VOLTRO_CODEMOD_MAX_FILES);
 	return Number.isInteger(e) && e > 0 ? e : 2e4;
 }, $ = (e, t) => {
@@ -5305,7 +5364,7 @@ var x = (e, t, n) => {
 		if (t !== 0) return t;
 	}
 	return 0;
-}, ii = (e, t, n = J) => n.filter((n) => $(e, n.version) < 0 && $(n.version, t) <= 0).slice().sort(he), ai = (e, t, n = () => {}) => {
+}, si = (e, t, n = J) => n.filter((n) => $(e, n.version) < 0 && $(n.version, t) <= 0).slice().sort(he), ci = (e, t, n = () => {}) => {
 	let r = [], i = [], a = [];
 	for (let o of t) {
 		if (!(!o.appliesTo || o.appliesTo({ project: e }))) {
@@ -5351,8 +5410,8 @@ var x = (e, t, n) => {
 		manual: i,
 		skipped: a
 	};
-}, oi = async (e) => {
-	let t = e.log ?? (() => {}), n = ii(e.from, e.to, e.codemods ?? J), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
+}, li = async (e) => {
+	let t = e.log ?? (() => {}), n = si(e.from, e.to, e.codemods ?? J), r = e.only === void 0 || e.only.length === 0 ? n : (() => {
 		let t = n.filter((t) => e.only.includes(t.id)), r = e.only.filter((e) => !n.some((t) => t.id === e));
 		if (r.length > 0) throw Error(`voltro update --only: no codemod in ${e.from} → ${e.to} has id ${r.map((e) => `"${e}"`).join(", ")}.\n  Available for this jump:\n${n.map((e) => `    ${e.id}`).join("\n")}`);
 		return t;
@@ -5371,15 +5430,15 @@ var x = (e, t, n) => {
 			baseUrl: i.baseUrl,
 			paths: i.paths
 		} }
-	}), o, s = Q(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? Zr(Q(e.root, [{
+	}), o, s = Q(e.root, r), c = r.filter((e) => e.needsImporters === !0 && e.scope !== void 0), l = [], u = [], d = [], p = c.length > 0 ? ei(Q(e.root, [{
 		...c[0],
-		scope: $r
+		scope: ni
 	}])) : void 0;
 	for (let n of r) {
 		if (c.includes(n)) {
 			let r = a(), i = Q(e.root, [n]);
-			for (let e of Qr(i, p)) v(e) && r.addSourceFileAtPath(e);
-			let s = ai(r, [n], t);
+			for (let e of ti(i, p)) v(e) && r.addSourceFileAtPath(e);
+			let s = ci(r, [n], t);
 			e.dryRun || await r.save(), l.push(...s.applied), u.push(...s.manual), d.push(...s.skipped), o = void 0;
 			continue;
 		}
@@ -5388,7 +5447,7 @@ var x = (e, t, n) => {
 			for (let t of s) v(t) && e.addSourceFileAtPath(t);
 			return e;
 		})();
-		let r = ai(o, [n], t);
+		let r = ci(o, [n], t);
 		e.dryRun || await o.save(), l.push(...r.applied), u.push(...r.manual), d.push(...r.skipped);
 	}
 	return {
@@ -5398,4 +5457,4 @@ var x = (e, t, n) => {
 	};
 };
 //#endregion
-export { C as i, oi as n, Y as r, $ as t };
+export { C as i, li as n, Y as r, $ as t };