@voltro/cli 0.36.0 → 0.37.0

package/dist/dbCommand-CC-qNzpz.js

@@ -0,0 +1,2 @@
+import { s as e } from "./dbCommand-C4UW8cVN.js";
+export { e as runDbCommand };

package/dist/{dev-BSFTgCQ5.js → dev-BV6XNYKf.js}

@@ -1,3 +1,3 @@
-import { c as e, d as t, f as n, i as r, u as i } from "./dev-Dc4cpmRl.js";
+import { c as e, d as t, f as n, i as r, u as i } from "./dev-bwDgSObH.js";
 import "./dialectDriver-CgXnDfec.js";
 export { r as buildStore, e as loadApiConfig, i as loadDiscovered, t as runDev, n as walk };

package/dist/{dev-Dc4cpmRl.js → dev-bwDgSObH.js}

@@ -15,7 +15,7 @@ import { t as gt } from "./manifestBuild-hpPLaGxV.js";
 import { n as _t } from "./cliRuntime-Dh7UDinH.js";
 import { n as vt, t as yt } from "./tsxLoader-EuXmSJ1K.js";
 import { n as bt } from "./agentsMd-mhQMF1bx.js";
-import { a as xt, c as St, o as Ct, r as wt, s as Tt } from "./codegen-CYM3Zqrf.js";
+import { a as xt, c as St, o as Ct, r as wt, s as Tt } from "./codegen-GYYcdpCg.js";
 import { n as Et } from "./mssqlClusterPatch-_4cE_nun.js";
 import { p as Dt } from "./renderModeScan-D7J1B7Kw.js";
 import { i as Ot, n as kt, r as At } from "./webhookDiscovery-D7VaeMlz.js";

package/dist/{doctorCommand-CNFtt3nR.js → doctorCommand-BXyrtN2l.js}

@@ -1,8 +1,8 @@
-import { Bt as e, Rt as t, zt as n } from "./dev-Dc4cpmRl.js";
+import { Bt as e, Rt as t, zt as n } from "./dev-bwDgSObH.js";
 import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-Dybxew86.js";
 import { w as u } from "./frameworkTableAssembly-oMPBKqlE.js";
 import { n as d } from "./pageConvention-cEiRxdab.js";
-import { r as f, u as p } from "./apiBuild-DiE9zcj6.js";
+import { r as f, u as p } from "./apiBuild-DGsShRuF.js";
 import { n as m, r as h, t as g } from "./cliOutput-D1tSBoRM.js";
 import { n as ee, t as te } from "./tsconfigPaths-BWXBWgcl.js";
 import { n as ne, r as re } from "./fileTaxonomy-CJfgOllU.js";
@@ -1245,7 +1245,7 @@ var le = /* @__PURE__ */ new Set([
 	let t = zt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-BSFTgCQ5.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-BV6XNYKf.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
@@ -1333,7 +1333,7 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, J = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-BSFTgCQ5.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-BV6XNYKf.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1417,7 +1417,7 @@ var le = /* @__PURE__ */ new Set([
 }, Jt = async (e) => Xe({
 	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-BSFTgCQ5.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-BV6XNYKf.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1497,7 +1497,7 @@ var le = /* @__PURE__ */ new Set([
 	}
 }, en = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-BV6XNYKf.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1513,7 +1513,7 @@ var le = /* @__PURE__ */ new Set([
 		findings: []
 	};
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-BTA6P3Yr.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-CIPYyNyc.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
 		if (l.length === 0) return t;
 		let u = i({
 			...s,
@@ -1555,7 +1555,7 @@ var le = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js");
+		let { loadApiConfig: t } = await import("./dev-BV6XNYKf.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1571,7 +1571,7 @@ var le = /* @__PURE__ */ new Set([
 }, rn = async (e) => {
 	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-BSFTgCQ5.js");
+		let { loadApiConfig: t } = await import("./dev-BV6XNYKf.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;

package/dist/doctorCommand-C4L61G_L.js

@@ -0,0 +1,2 @@
+import { v as e, y as t } from "./doctorCommand-BXyrtN2l.js";
+export { e as runDoctorCommand, t as runServePreflight };

package/dist/{dormancyCommand-6F6NsJKf.js → dormancyCommand-BDdRRLsa.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-Dc4cpmRl.js";
+import { c as e, i as t } from "./dev-bwDgSObH.js";
 import { n, t as r } from "./cliArgs-D4p8n7EE.js";
 import { r as i } from "./appPort-B_HpJ_ck.js";
 import { resolve as a } from "node:path";

package/dist/{embeddingsCommand-DRRdneJD.js → embeddingsCommand-CjWGcAE6.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-Dc4cpmRl.js";
+import { c as e, i as t } from "./dev-bwDgSObH.js";
 import { Effect as n } from "effect";
 import { embedMany as r } from "@voltro/ai";
 //#region src/embeddingsBackfill.ts

package/dist/{envCommand-TZzcyqZ-.js → envCommand-B_TeG297.js}

@@ -1,4 +1,4 @@
-import { c as e } from "./dev-Dc4cpmRl.js";
+import { c as e } from "./dev-bwDgSObH.js";
 import { at as t, ct as n, lt as r, ot as i } from "./webDev-Dybxew86.js";
 import { join as a } from "node:path";
 import { promises as o } from "node:fs";

package/dist/{evolveCommand-iU35TPjT.js → evolveCommand-D6N-WfA4.js}

@@ -1,6 +1,6 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
-import { t } from "./checkCommand-BhG0gmUD.js";
-import { i as n, n as r } from "./codemodRunner-DjQGrdmg.js";
+import { t } from "./checkCommand-CLPTzYqM.js";
+import { i as n, n as r } from "./codemodRunner-cyqu5oxr.js";
 import { basename as i, join as a, resolve as o } from "node:path";
 import { branchNamespaceName as s, planBranchProvision as c } from "@voltro/database";
 import { readFile as l } from "node:fs/promises";

package/dist/index.js

@@ -1,5 +1,5 @@
-import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-Bp7utV-7.js";
-import { r as o } from "./templates-De8IR5-c.js";
+import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-BwG9A9Vv.js";
+import { r as o } from "./templates-BR-fb4SP.js";
 //#region src/index.ts
 var s = "framework";
 //#endregion

package/dist/{infoCommand-unqisJGp.js → infoCommand-BHKTprrx.js}

@@ -1,5 +1,5 @@
 import { n as e, r as t, t as n } from "./cliOutput-D1tSBoRM.js";
-import { o as r } from "./updateCommand-CwnUK_mf.js";
+import { o as r } from "./updateCommand-9GHHsmDf.js";
 import { join as i, resolve as a } from "node:path";
 import { readFileSync as o, readdirSync as s, statSync as c } from "node:fs";
 //#region src/infoCommand.ts

package/dist/inspectGateHint-BF6608UT.js

@@ -0,0 +1,4 @@
+//#region src/inspectGateHint.ts
+var e = (e) => e === 401 || e === 403, t = (e) => e === 403 ? "The inspect surface rejected the credential. VOLTRO_INSPECT_TOKEN must be set on the SERVER and in this shell, and the two values must match. (This is a framework gate, not a database permission.)" : "The inspect surface is gated and this request carried no credential. Set VOLTRO_INSPECT_TOKEN on the server and in this shell (same value), or pass --token.";
+//#endregion
+export { e as n, t };

package/dist/{metaCommands-7MJfZ5cf.js → metaCommands-CIoQNlaQ.js}

@@ -1,7 +1,7 @@
 import { i as e, n as t, r as n } from "./cliArgs-D4p8n7EE.js";
 import { t as r } from "./cliRuntime-Dh7UDinH.js";
 import { n as i } from "./renderProfile-1OWWAAtx.js";
-import { a, i as o } from "./projectScaffold-LMMtaavR.js";
+import { a, i as o } from "./projectScaffold-DDgWbNLe.js";
 import { t as s } from "./discover-C9XKJDco.js";
 import { basename as c, join as l, relative as u, resolve as d } from "node:path";
 import { createLogger as f } from "@voltro/logger";

package/dist/{migrate-BV7I-ZHZ.js → migrate-RwgUWXfc.js}

@@ -76,7 +76,7 @@ var _ = /* @__PURE__ */ new Set([
 	return t(n);
 }, T = async (e) => {
 	if (e.includes("--create-only")) return s(S(u(e.find((e) => !e.startsWith("-")) ?? process.cwd())), { scope: "voltro:migrate" });
-	let { runDbCommand: t } = await import("./dbCommand-DS4b97Is.js");
+	let { runDbCommand: t } = await import("./dbCommand-CC-qNzpz.js");
 	return t(["apply", ...e]);
 };
 //#endregion

package/dist/{privacyCommand-C-Df56U_.js → privacyCommand-XejDMvmu.js}

@@ -136,11 +136,12 @@ var _ = d({ scope: "voltro:privacy" }), v = /* @__PURE__ */ new Set([
 		let s = a.data.entry;
 		return o(s ?? {}), s?.truncated !== void 0 && s.truncated.length > 0 ? (_.error(`voltro privacy erase: INCOMPLETE — the row cap was hit on ${s.truncated.join(", ")}. Re-run until 'truncated' is absent.`), 1) : 0;
 	}
-}, A = async (e) => {
+}, A = (e) => Object.prototype.hasOwnProperty.call(k, e), j = async (e) => {
 	let [t, ...n] = e;
 	if (t === void 0) return console.error("voltro privacy <subcommand> [args]"), console.error("  scope  [root] [--subject-table <t>] [--depth <n>] [--exclude a,b] [--json]"), console.error("         Derive the DSAR subject graph from the schema — and print what it CANNOT see."), console.error("  export <subjectId> --url <app> [--token <t>] [--out <file>]"), console.error("  erase  <subjectId> --url <app> [--token <t>] [--mode delete|anonymize] --confirm"), console.error("         Both run against the RUNNING app's admin-gated governance endpoint, so the"), console.error("         configured anonymize fields and the erasure log apply."), 1;
+	if (!A(t)) return console.error(`voltro privacy: unknown subcommand '${t}'`), 2;
 	let r = k[t];
-	return r === void 0 ? (console.error(`voltro privacy: unknown subcommand '${t}'`), 2) : r(n);
+	return r(n);
 };
 //#endregion
-export { A as runPrivacyCommand };
+export { j as runPrivacyCommand };

package/dist/{probeCommand-CZfaaUOZ.js → probeCommand-BPEpwT32.js}

@@ -1,11 +1,12 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
 import { n as t, o as n, r, t as i } from "./inspectFetch-EMuhTG_9.js";
-import { ansi as a } from "@voltro/logger";
+import { n as a, t as o } from "./inspectGateHint-BF6608UT.js";
+import { ansi as s } from "@voltro/logger";
 //#region src/probeCommand.ts
-var o = () => {
-	console.log(`${a.bold("voltro probe")} — ask a RUNNING app whether its declared access is enforced
+var c = () => {
+	console.log(`${s.bold("voltro probe")} — ask a RUNNING app whether its declared access is enforced
 
-  ${a.bold("access")}    call every guarded procedure with NO credentials and
+  ${s.bold("access")}    call every guarded procedure with NO credentials and
             report any that answer anyway
 
 Options
@@ -19,9 +20,9 @@ it probes ANONYMOUSLY, so it cannot tell one scope from another. It answers
 exactly one question — does a procedure that DECLARES a guard admit a caller
 that presents nothing? A guard declared and never bound is the failure it finds.
 
-The target must expose the inspect surface: set ${a.bold("VOLTRO_INSPECT_TOKEN")} on the
+The target must expose the inspect surface: set ${s.bold("VOLTRO_INSPECT_TOKEN")} on the
 server and in this shell.`);
-}, s = (e) => e.filter((e) => (e.guards ?? []).some((e) => e.kind !== "open")), c = (e) => {
+}, l = (e) => e.filter((e) => (e.guards ?? []).some((e) => e.kind !== "open")), u = (e) => {
 	if (e.kind === "err") return {
 		verdict: "inconclusive",
 		detail: "transport failure — the app did not answer"
@@ -56,16 +57,16 @@ server and in this shell.`);
 		verdict: "refused",
 		detail: `refused (${a})`
 	};
-}, l = 0, u = (e) => ({
+}, d = 0, f = (e) => ({
 	_tag: "Request",
-	id: String(++l),
+	id: String(++d),
 	tag: e,
 	payload: {},
 	headers: []
-}), d = async (e, t) => {
-	let { verdict: n, detail: r } = c(await i(e, "/rpc", {
+}), p = async (e, t) => {
+	let { verdict: n, detail: r } = u(await i(e, "/rpc", {
 		method: "POST",
-		body: u(t.tag),
+		body: f(t.tag),
 		anonymous: !0
 	}));
 	return {
@@ -74,49 +75,49 @@ server and in this shell.`);
 		verdict: n,
 		detail: r
 	};
-}, f = (t, n, r, i) => {
-	let o = n.filter((e) => e.verdict === "admitted"), s = n.filter((e) => e.verdict === "inconclusive"), c = n.filter((e) => e.verdict === "refused");
+}, m = (t, n, r, i) => {
+	let a = n.filter((e) => e.verdict === "admitted"), o = n.filter((e) => e.verdict === "inconclusive"), c = n.filter((e) => e.verdict === "refused");
 	if (r === "json") e({
 		app: t,
 		probed: n.length,
 		refused: c.length,
-		admitted: o.length,
-		inconclusive: s.length,
+		admitted: a.length,
+		inconclusive: o.length,
 		results: n
 	});
-	else if (n.length === 0) console.log(`${a.yellow("○")} ${t}: no guarded procedure to probe — every route is openAccess or undecided.`), console.log("  Undecided routes are `voltro check`'s finding, not this one's.");
+	else if (n.length === 0) console.log(`${s.yellow("○")} ${t}: no guarded procedure to probe — every route is openAccess or undecided.`), console.log("  Undecided routes are `voltro check`'s finding, not this one's.");
 	else {
-		console.log(`${a.bold(t)}: probed ${n.length} guarded procedure(s) with NO credentials`);
-		for (let e of o) console.log(`  ${a.red("✗")} ${a.bold(e.tag)} — ${e.detail}`);
-		for (let e of s) console.log(`  ${a.yellow("?")} ${e.tag} — ${e.detail}`);
-		console.log(`  ${a.green("✓")} ${c.length} refused · ${a.yellow(String(s.length))} inconclusive · ${a.red(String(o.length))} admitted`);
+		console.log(`${s.bold(t)}: probed ${n.length} guarded procedure(s) with NO credentials`);
+		for (let e of a) console.log(`  ${s.red("✗")} ${s.bold(e.tag)} — ${e.detail}`);
+		for (let e of o) console.log(`  ${s.yellow("?")} ${e.tag} — ${e.detail}`);
+		console.log(`  ${s.green("✓")} ${c.length} refused · ${s.yellow(String(o.length))} inconclusive · ${s.red(String(a.length))} admitted`);
 	}
-	return o.length > 0 ? (r !== "json" && console.error(`\n${a.red("A declared guard did not refuse an anonymous caller.")}\n  The declaration and the behaviour disagree — the guard is on the descriptor and
+	return a.length > 0 ? (r !== "json" && console.error(`\n${s.red("A declared guard did not refuse an anonymous caller.")}\n  The declaration and the behaviour disagree — the guard is on the descriptor and
   nothing enforces it on this path. Check that the procedure is bound through the
-  dispatch spine (not a hand-mounted route), and that its guard list is not empty.`), 1) : i && s.length > 0 ? (r !== "json" && console.error(`\n${a.yellow("--strict:")} ${s.length} procedure(s) could not be judged.\n  Their calls failed before the guard was reached (usually payload validation).
+  dispatch spine (not a hand-mounted route), and that its guard list is not empty.`), 1) : i && o.length > 0 ? (r !== "json" && console.error(`\n${s.yellow("--strict:")} ${o.length} procedure(s) could not be judged.\n  Their calls failed before the guard was reached (usually payload validation).
   That is not evidence of enforcement, so under --strict it is not a pass.`), 1) : 0;
-}, p = async (e) => {
-	let o = t(e);
-	if ("error" in o) return console.error(`voltro probe access: ${o.error}`), 1;
-	let { format: c } = o, { process: l, target: u, rest: p, error: m } = r(o.rest);
-	if (m !== void 0) return console.error(`voltro probe access: ${m}`), 1;
-	let h = p.includes("--strict"), g = await n(l, u);
-	if (g.length === 0) return console.error("voltro probe access: no live api found.\n  This command asks a RUNNING app what it does — there is nothing to ask a source tree.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
-	let _ = 0;
-	for (let e of g) {
+}, h = async (e) => {
+	let c = t(e);
+	if ("error" in c) return console.error(`voltro probe access: ${c.error}`), 1;
+	let { format: u } = c, { process: d, target: f, rest: h, error: g } = r(c.rest);
+	if (g !== void 0) return console.error(`voltro probe access: ${g}`), 1;
+	let _ = h.includes("--strict"), v = await n(d, f);
+	if (v.length === 0) return console.error("voltro probe access: no live api found.\n  This command asks a RUNNING app what it does — there is nothing to ask a source tree.\n  Start one (`voltro dev` / `voltro serve`), or address it directly with --url."), 1;
+	let y = 0;
+	for (let e of v) {
 		let t = await i(e, "/_voltro/inspect/manifest");
 		if (t.kind === "err" || t.status < 200 || t.status >= 300) {
-			console.error(`${a.red("✗")} ${e.name}: could not read the manifest — ${t.kind === "err" ? t.error : `HTTP ${t.status}`}`), t.kind === "ok" && t.status === 401 && console.error("  Set VOLTRO_INSPECT_TOKEN on the server and in this shell."), _ = 1;
+			console.error(`${s.red("✗")} ${e.name}: could not read the manifest — ${t.kind === "err" ? t.error : `HTTP ${t.status}`}`), t.kind === "ok" && a(t.status) && console.error(`  ${o(t.status)}`), y = 1;
 			continue;
 		}
-		let n = s(t.data?.procedures ?? []), r = [];
-		for (let t of n) r.push(await d(e, t));
-		_ = Math.max(_, f(e.name, r, c, h));
+		let n = l(t.data?.procedures ?? []), r = [];
+		for (let t of n) r.push(await p(e, t));
+		y = Math.max(y, m(e.name, r, u, _));
 	}
-	return _;
-}, m = async (e) => {
+	return y;
+}, g = async (e) => {
 	let [t, ...n] = e;
-	return t === void 0 || t === "--help" || t === "-h" ? (o(), +(t === void 0)) : t === "access" ? p(n) : (console.error(`voltro probe: unknown subcommand "${t}" (expected: access)`), 1);
+	return t === void 0 || t === "--help" || t === "-h" ? (c(), +(t === void 0)) : t === "access" ? h(n) : (console.error(`voltro probe: unknown subcommand "${t}" (expected: access)`), 1);
 };
 //#endregion
-export { m as runProbeCommand };
+export { g as runProbeCommand };

package/dist/{projectScaffold-DmzEKHib.js → projectScaffold-CxgtJvlb.js}

@@ -1,2 +1,2 @@
-import { c as e, l as t, s as n } from "./projectScaffold-LMMtaavR.js";
+import { c as e, l as t, s as n } from "./projectScaffold-DDgWbNLe.js";
 export { n as runAddApp, e as runCreateProject, t as runListTemplates };

package/dist/{projectScaffold-LMMtaavR.js → projectScaffold-DDgWbNLe.js}

@@ -1,9 +1,9 @@
-import { a as e, i as t, n, r, t as i } from "./templates-De8IR5-c.js";
+import { a as e, i as t, n, r, t as i } from "./templates-BR-fb4SP.js";
 import { i as a, n as o, t as s } from "./cloudClient-DWL-Hw_T.js";
 import { t as c } from "./cliRuntime-Dh7UDinH.js";
 import { n as l } from "./agentsMd-mhQMF1bx.js";
 import { n as u } from "./addCommand-BNeoeSxe.js";
-import { a as d, n as f, r as p } from "./baselineCommand-DIttzO8A.js";
+import { a as d, n as f, r as p } from "./baselineCommand-C6NMt-oa.js";
 import { basename as m, dirname as h, join as g, resolve as _ } from "node:path";
 import { existsSync as v, mkdirSync as y, promises as b, writeFileSync as x } from "node:fs";
 import { createLogger as S } from "@voltro/logger";

package/dist/{runtimeTrace-D5LJ_N55.js → runtimeTrace-WYV7qYvz.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./apiBuild-DiE9zcj6.js";
+import { n as e } from "./apiBuild-DGsShRuF.js";
 import { join as t, resolve as n, sep as r } from "node:path";
 import { existsSync as i, promises as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";

package/dist/{sdkgen-82xVuvbt.js → sdkgen-TM5sSdf7.js}

@@ -422,7 +422,7 @@ let package = Package(
 		await l.mkdir(o(e), { recursive: !0 }), await l.writeFile(e, n.content, "utf8");
 	}
 }, X = async (e) => {
-	let { offlineManifest: t } = await import("./checkCommand-BTA6P3Yr.js"), { manifest: n } = await t(e);
+	let { offlineManifest: t } = await import("./checkCommand-CIPYyNyc.js"), { manifest: n } = await t(e);
 	return n;
 }, Z = async (e) => {
 	let t = J(await (e.manifestProvider ?? X)(e.root), {

package/dist/{serveCommand-VVGcIMIw.js → serveCommand-CyZsXL1l.js}

@@ -2,7 +2,7 @@ import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
 import { t } from "./frameworkInspectState-CX2250XB.js";
 import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
 import { n as i, t as a } from "./startupRunner-DPGFchOa.js";
-import { $ as o, $t as s, A as c, At as l, B as u, C as d, Ct as ee, D as f, Dt as p, E as te, Et as ne, F as re, Ft as m, G as ie, Gt as ae, H as oe, Ht as se, I as h, It as ce, J as le, Jt as g, K as ue, Kt as de, L as fe, Lt as pe, M as me, Mt as he, N as ge, Nt as _e, O as _, Ot as ve, P as ye, Pt as be, Q as xe, Qt as Se, R as Ce, S as we, St as Te, T as v, Tt as Ee, U as De, Ut as Oe, V as ke, Vt as Ae, W as je, Wt as y, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as b, Zt as Ie, _ as Le, _n as x, _t as Re, an as ze, at as Be, b as Ve, bt as He, c as Ue, cn as We, ct as Ge, dn as S, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gn as $e, gt as et, h as tt, hn as nt, ht as rt, i as C, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as ut, lt as dt, m as ft, mn as pt, mt, nn as ht, nt as gt, o as w, on as _t, ot as T, p as vt, pt as yt, q as bt, qt as E, r as D, rn as xt, rt as St, sn as Ct, st as wt, t as Tt, tn as O, tt as Et, u as Dt, un as Ot, ut as kt, v as At, vn as jt, vt as Mt, w as Nt, wt as Pt, x as Ft, xt as It, y as k, yt as Lt, zt as A } from "./dev-Dc4cpmRl.js";
+import { $ as o, $t as s, A as c, At as l, B as u, C as d, Ct as ee, D as f, Dt as p, E as te, Et as ne, F as re, Ft as m, G as ie, Gt as ae, H as oe, Ht as se, I as h, It as ce, J as le, Jt as g, K as ue, Kt as de, L as fe, Lt as pe, M as me, Mt as he, N as ge, Nt as _e, O as _, Ot as ve, P as ye, Pt as be, Q as xe, Qt as Se, R as Ce, S as we, St as Te, T as v, Tt as Ee, U as De, Ut as Oe, V as ke, Vt as Ae, W as je, Wt as y, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as b, Zt as Ie, _ as Le, _n as x, _t as Re, an as ze, at as Be, b as Ve, bt as He, c as Ue, cn as We, ct as Ge, dn as S, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gn as $e, gt as et, h as tt, hn as nt, ht as rt, i as C, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as ut, lt as dt, m as ft, mn as pt, mt, nn as ht, nt as gt, o as w, on as _t, ot as T, p as vt, pt as yt, q as bt, qt as E, r as D, rn as xt, rt as St, sn as Ct, st as wt, t as Tt, tn as O, tt as Et, u as Dt, un as Ot, ut as kt, v as At, vn as jt, vt as Mt, w as Nt, wt as Pt, x as Ft, xt as It, y as k, yt as Lt, zt as A } from "./dev-bwDgSObH.js";
 import { n as Rt } from "./cliArgs-D4p8n7EE.js";
 import { r as zt } from "./appPort-B_HpJ_ck.js";
 import { at as Bt, nt as Vt, st as Ht } from "./webDev-Dybxew86.js";
@@ -15,7 +15,7 @@ import { h as ln, o as un } from "./inspect-CjTYzAs_.js";
 import { n as dn } from "./mssqlClusterPatch-_4cE_nun.js";
 import { i as fn, n as pn, r as mn, t as hn } from "./webhookDiscovery-D7VaeMlz.js";
 import { t as gn } from "./inspectMetrics-CfdKLh6t.js";
-import { r as _n, u as vn } from "./apiBuild-DiE9zcj6.js";
+import { r as _n, u as vn } from "./apiBuild-DGsShRuF.js";
 import { t as yn } from "./bootTiming-BdyP9nYw.js";
 import { t as bn } from "./dataProfile-dW-PsfLB.js";
 import { basename as xn, join as Sn } from "node:path";

package/dist/serveCommand-qumm7jdF.js

@@ -0,0 +1,2 @@
+import { n as e } from "./serveCommand-CyZsXL1l.js";
+export { e as runServeDispatch };

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
 import { t as e } from "./loadEnv-D9nEOClM.js";
 import { r as t } from "./appModuleLoader-C9r9mxZt.js";
 import { i as n } from "./dialectDriver-CgXnDfec.js";
-import { t as r } from "./serveCommand-VVGcIMIw.js";
+import { t as r } from "./serveCommand-CyZsXL1l.js";
 export { e as loadDotEnv, t as registerAppModules, n as registerDriver, r as runServe };

package/dist/subcommandNames-CKG5Dz3a.js

@@ -0,0 +1,27 @@
+//#region src/subcommandNames.ts
+var e = [
+	"plan",
+	"apply",
+	"branch",
+	"plans",
+	"drift",
+	"squash",
+	"restore-snapshot",
+	"generate",
+	"migrate",
+	"rollback",
+	"status",
+	"files",
+	"rollback-file",
+	"seed",
+	"gc-snapshots",
+	"adopt",
+	"scan-credentials",
+	"encrypt-column"
+], t = [
+	"scope",
+	"export",
+	"erase"
+], n = (e) => `<${e.join("|")}>`;
+//#endregion
+export { t as n, n as r, e as t };

package/dist/{templates-De8IR5-c.js → templates-BR-fb4SP.js}

@@ -4,10 +4,7 @@ import { fileURLToPath as s } from "node:url";
 //#region src/templates.ts
 var c = e(s(import.meta.url)), l = (() => {
 	let n = process.env.VOLTRO_TEMPLATES_DIR;
-	if (n) {
-		let e = t(n, "apps");
-		if (i(e)) return e;
-	}
+	if (n) return t(n, "apps");
 	let a = r(c, "..", "templates", "apps"), o = c;
 	for (let n = 0; n < 12; n++) {
 		for (let e of ["voltro-templates", ".voltro-templates"]) {

package/dist/{test-CI6iDsYc.js → test-DIQ0jlkQ.js}

@@ -79,7 +79,7 @@ var d = l({ scope: "voltro:test" }), f = (e) => {
 }, C = async (e) => {
 	let t = m(e);
 	if (!o(t.root)) return console.error(`voltro test: no such directory: ${t.root}`), 1;
-	let { checkRpcGroupFreshness: n } = await import("./codegen-ChBi_hVa.js"), r = await n(t.root);
+	let { checkRpcGroupFreshness: n } = await import("./codegen-uYrrDzQv.js"), r = await n(t.root);
 	if (r.kind === "stale") return console.error(`voltro test: ${r.file} is stale — ${r.reason}.`), console.error("  The tests would run against the previously generated procedure group, pass, and prove nothing about the descriptors you just edited.\n  Run `voltro codegen` (or boot `voltro dev` once) and try again."), 1;
 	d.info("running vitest", {
 		root: t.root,

package/dist/{updateCommand-CwnUK_mf.js → updateCommand-9GHHsmDf.js}

@@ -1,4 +1,4 @@
-import { n as e, r as t, t as n } from "./codemodRunner-DjQGrdmg.js";
+import { n as e, r as t, t as n } from "./codemodRunner-cyqu5oxr.js";
 import { basename as r, dirname as i, join as a, relative as o, resolve as s } from "node:path";
 import { existsSync as c, readFileSync as l, readdirSync as u, statSync as d, writeFileSync as f } from "node:fs";
 import { totalmem as p } from "node:os";

package/dist/updateCommand-BN0tkl9-.js

@@ -0,0 +1,2 @@
+import { f as e, p as t } from "./updateCommand-9GHHsmDf.js";
+export { e as runApplyCodemods, t as runUpdateCommand };

package/dist/{webhooksCommand-di1CJVzu.js → webhooksCommand-CHWSPk5z.js}

@@ -222,7 +222,7 @@ createVerifier({ secret: [process.env.WEBHOOK_SECRET, process.env.WEBHOOK_SECRET
 		...t === void 0 ? {} : { payload: t }
 	};
 }, S = u({ scope: "voltro:webhooks" }), C = ["--out", "--name"], w = async (e) => {
-	let { walk: t, loadDiscovered: n } = await import("./dev-BSFTgCQ5.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-CrGAfhIG.js");
+	let { walk: t, loadDiscovered: n } = await import("./dev-BV6XNYKf.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-CrGAfhIG.js");
 	return r((await n(await t(e))).events.map((e) => ({
 		file: e.file,
 		descriptor: e.descriptor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -574,6 +574,12 @@
         "title": "A 401 is `code: 'unauthorized'`; the vault's own failure is `'credential_unusable'`",
         "kind": "transform"
       },
+      {
+        "version": "0.37.0",
+        "id": "0.37.0/01_procedure-input-rejects-undeclared-fields",
+        "title": "a procedure input rejects a field it does not declare (it used to drop it)",
+        "kind": "manual"
+      },
       {
         "version": "0.4.0",
         "id": "0.4.0/01_rbac-forbidden-to-scopeerror",
@@ -673,22 +679,22 @@
     "@effect/platform-node": "^0.108.0",
     "@effect/sql": "^0.52.0",
     "@effect/workflow": "^0.19.0",
-    "@voltro/ai": "0.36.0",
-    "@voltro/cache": "0.36.0",
-    "@voltro/data-transfer": "0.36.0",
-    "@voltro/database": "0.36.0",
-    "@voltro/env": "0.36.0",
-    "@voltro/kv": "0.36.0",
-    "@voltro/logger": "0.36.0",
-    "@voltro/plugin-auth": "0.36.0",
-    "@voltro/plugin-broadcast": "0.36.0",
-    "@voltro/plugin-mail": "0.36.0",
-    "@voltro/plugin-storage": "0.36.0",
-    "@voltro/plugin-webhooks": "0.36.0",
-    "@voltro/protocol": "0.36.0",
-    "@voltro/runtime": "0.36.0",
-    "@voltro/serverless": "0.36.0",
-    "@voltro/workflow": "0.36.0",
+    "@voltro/ai": "0.37.0",
+    "@voltro/cache": "0.37.0",
+    "@voltro/data-transfer": "0.37.0",
+    "@voltro/database": "0.37.0",
+    "@voltro/env": "0.37.0",
+    "@voltro/kv": "0.37.0",
+    "@voltro/logger": "0.37.0",
+    "@voltro/plugin-auth": "0.37.0",
+    "@voltro/plugin-broadcast": "0.37.0",
+    "@voltro/plugin-mail": "0.37.0",
+    "@voltro/plugin-storage": "0.37.0",
+    "@voltro/plugin-webhooks": "0.37.0",
+    "@voltro/protocol": "0.37.0",
+    "@voltro/runtime": "0.37.0",
+    "@voltro/serverless": "0.37.0",
+    "@voltro/workflow": "0.37.0",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/AGENTS.md

@@ -707,7 +707,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.36.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.37.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/_index.md

@@ -9,7 +9,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.36.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.37.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/cli.md

@@ -173,6 +173,22 @@ voltro db apply                # execute it (dev)
 # `voltro migrate` is an alias of `db apply` — same differ, shorter name (CI / ops)
 ```
 
+### "I want to encrypt a column that already has rows in it"
+
+Turning on `.encrypted()` needs two things: the cipher, and a migration of the
+rows that are already there. The second has a command — it is easy to miss,
+because nothing about a schema change suggests a data pass is owed.
+
+```bash
+voltro db scan-credentials              # find plaintext secrets, column by column
+voltro db encrypt-column users.apiToken --dry-run
+voltro db encrypt-column users.apiToken --yes
+```
+
+`--key-env` names the key variable if it is not the default; the key must be the
+SAME one the app runs with, or the rows come back undecryptable. `voltro db`
+with no subcommand prints the full list.
+
 ### "I want a clean rebuild"
 
 ```bash

package/templates/agent-docs/data.md

@@ -263,6 +263,36 @@ const { data } = useSubscription('app', 'messages.list', {
 })
 ```
 
+### An undeclared field is refused, not dropped
+
+The input schema is the whole accepted key set. A field it does not declare
+fails the call with a `ParseError` naming the key and listing what was expected:
+
+```
+{ readonly channelId: string; readonly limit: number }
+└─ ["employeeId"]
+   └─ is unexpected, expected: "channelId" | "limit"
+```
+
+It used to be discarded silently, and the reason that is worse than it sounds is
+what a discarded FILTER means. A consumer's layout called a `userSettings.list`
+that declares `userId` with `{ employeeId }`; the payload decoded to `{}`, which
+for a list query is not a narrower filter but the absence of one, and an admin
+was served another user's row.
+
+The decoder cannot tell a projection field from a filter field, so it refuses
+either way. Three consequences worth knowing:
+
+- Nested objects and union members follow the same rule — a stray key inside
+  `{ page: { limit, offset } }` is refused too.
+- `Schema.Struct({})` means "this procedure takes nothing", and a call carrying
+  anything is refused. `Schema.Record(...)` keeps its open key set: there the
+  openness is declared.
+- If a call site legitimately holds more than the procedure declares — a spread
+  of a wider filter object — narrow it at the call site rather than widening the
+  schema. Widening restores the silent drop under a different name: the field is
+  accepted and still does nothing.
+
 ## Descriptor-return vs computed-return
 
 A query executor can return either: