@voltro/i18n 0.11.0 → 0.11.2

package/CHANGELOG.md

@@ -39,6 +39,96 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.11.2] — 2026-07-24
+
+### Added
+
+- **@voltro/i18n** — Two escapes for adopting typed messages (`createTypedMessages`, #16) app-wide (#19):
+
+  - **`t.dynamic(runtimeKey, values?)`** — a first-class escape for a genuinely runtime-computed key, on both `useT` and the `useTFn()` result. It takes a plain string with NO forced ICU args, so it doesn't fight the strict literal-key surface. Until now the natural escape — casting a computed key to the catalog key union — made things WORSE: that union spans placeholder-bearing keys, so the call then demanded a spurious 2nd ICU arg. `t.dynamic` is the documented, discoverable alternative. - **`LooseTFunction`** — the widened `(id: string, values?) => string` signature to type a `t` pass-through across a package boundary that can't import the app catalog, instead of falling back to `(...args: any[]) => string`. A strict `TypedTFunction` is deliberately NOT assignable to it (a narrowed key param can't satisfy a wider one — that would erase the checking); pass `t.dynamic` at the boundary, which IS a `LooseTFunction`.
+
+  Additive: `TypedTFunction<C>` gains a `.dynamic` member (the callable surface is unchanged, so `Parameters<TypedTFunction<C>>[0]` and existing typed call sites still resolve). `createTypedMessages` attaches `.dynamic` in place on the two translate functions — no new per-render closure, so a captured `t`'s identity stays stable.
+- **@voltro/testing, @voltro/database** — `fixtureRow(table, overrides)` (`@voltro/testing`) completes a partial test row so it satisfies the 0.11.1 required-column insert validation — WITHOUT disabling the check. It fills every NOT-NULL, no-default, non-auto-stamped column the payload omits with a schema-typed placeholder (a `oneOf` column takes its first allowed value; a `unique` column gets a distinct value per call so two fixtures don't collide; `timestamp`/`date` get a fixed epoch), then merges your overrides on top (an explicit value always wins). It leaves out exactly what a caller may omit — nullable, defaulted, and framework auto-stamped columns (id / tenant / audit) — and refuses to guess a structured type (`json` / `bytes` / `vector` / `array` / `interval` / `raw`), throwing a message that names the column and says to pass it explicitly.
+
+  The motivating case: 0.11.1 made the in-memory/test store reject the same partial inserts real Postgres always would (correct — it surfaced a latent prod bug), which turned lean fixtures (`insert(users, { id })`, an omitted required FK) into `TableValidationFailed`. The wrong fix is a `validateInserts: false` knob — it re-hides that bug class, and a test store laxer than production is a fake testing itself. `fixtureRow` is the right one: it makes the fixture COMPLETE.
+
+  ```ts
+  await ctx.store.insert('journal_entries', fixtureRow(journalEntries, {
+    tenantId, amount: '100.00',   // the columns THIS test cares about
+  }))                             // entryNumber, postedAt, … auto-filled + unique
+  ```
+
+  It is a runtime filler for the loose `store.insert(name, row)` path (what fixtures use). For COMPILE-time payload typing, use `insertRow` / `upsertRow` from `@voltro/database`. The auto-stamped column set it skips is now exported as `AUTO_FILLED_COLUMNS` from `@voltro/database` — the same list `InferInsertRow` derives its optional columns from, single-sourced so the two can't drift.
+
+### Changed
+
+- **@voltro/cli** — `voltro build` now emits **directly-executable** boot bundles for BOTH app kinds: the web start bundle (`.framework/dist-web/startBundle/startEntry.js`) and the api serve bundle (`.framework/dist-api/serveBundle/serveEntry.js`) each carry a main-guard that boots the app when run as `node <entry>.js`, and stays inert when imported (the `voltro start` / `voltro serve` dev fast paths are unchanged). Production containers can now use `CMD ["node", "…/startEntry.js"]` (or `serveEntry.js`) instead of `pnpm voltro start` / `pnpm voltro serve` — no pnpm process, no `@voltro/cli` bin at runtime — which is what makes `voltro prune-runtime` safe to enable on both: with the self-contained bundle as the real entrypoint, the @vercel/nft trace roots there and legitimately drops `@voltro/cli` and the whole inlined framework tree (a static site's `node_modules` collapses to ~0; a memory api's 146 MB → 11 MB). `prune-runtime` now also roots the trace at the serve bundle. The serve entry chdir's to the app root BEFORE its app-module registry keys are computed from cwd, preserving relocation-safety. Existing `pnpm voltro start` / `pnpm voltro serve` entrypoints keep working. The standalone Dockerfiles gain a build-time boot smoke that fails the build unless the pruned tree reaches ready.
+
+### Fixed
+
+- **@voltro/i18n** — `createTypedMessages` (#16) no longer extracts phantom required vars from a nested plural/select message (#19). For `'{count, plural, one {# day} other {# days total duration}}'`, the type-level `ICUVars` parse was reading a branch's TEXT (`"# days total duration"`) as a bogus required arg name, so `useT('key', { count })` failed to typecheck even though it renders perfectly — and a real var nested inside a branch was dropped. `ICUArgName` now resolves to `never` for any candidate that isn't a valid ICU identifier (`^[A-Za-z0-9_]+$`), so branch text — which contains spaces / `#` / `—` — is never mistaken for a var. Only the top-level arg (`count`) is required, matching what the message actually needs.
+
+  Scope note: a REAL var nested inside a plural branch (`other {# — {discipline}}`) is still not collected, so it reads as not-required rather than wrongly-required — the safe direction. Apps that pluralise in JS over simple `{count}` messages (the Voltro idiom) were already fully typed and are unaffected.
+- **@voltro/database, @voltro/runtime** — `InferInsertRow` (and thus `insertRow` / `upsertRow`, #15) no longer requires a non-nullable DB-generated (`generatedAs`) column (#20). A stored/virtual generated column declared without `.nullable()` and without a default was typed **required**, but MariaDB/Postgres REJECT an explicit value for a generated column — so the type forced the caller to pass a value the database refuses at runtime. `.generatedAs()` now marks the column optional-for-insert exactly like a `.default()` column (the DB supplies it), so it may be omitted; the whole payload guard on every real column stays intact.
+
+  Two runtime halves complete it, so the loose `store.insert(name, row)` path agrees: the required-column validation (`missingRequiredColumns`) skips generated columns — omitting one is correct, never a missing-column error — and the store write path now STRIPS any value a caller supplied for a generated column before the INSERT reaches the dialect (tracked on the schema registry as `generatedColumns`), so a value from an untyped insert can't blow up on MariaDB. A generated column is never caller-supplied; the framework and the DB own it end to end.
+
+  The `.generatedAs()` return type narrows from `this` to `ColumnBuilder<…, true>` (the HasDefault flag) — a purely more-permissive refinement: it only makes the column omittable, so no existing code stops compiling.
+
+---
+
+## [0.11.1] — 2026-07-23
+
+### Added
+
+- **@voltro/runtime** — `defineExecutor(descriptor, fn)` type-checks a query/mutation/action handler's return against the descriptor's `output` schema Type — so returning a `number` where `output` is `timestampMs` (Type = `Date`) is a COMPILE error at the handler, not a runtime encode failure that Dies the subscription. The gap it closes: the executor is a separate default export whose return was never tied to `output`, so a handler that builds a plain object with a leftover `.getTime()` compiled green and only threw `Expected DateFromSelf, actual 1784…` at encode time — invisible while a nullable date was null, exploding the instant it became non-null.
+
+  Opt-in and zero-cost: it's a runtime identity (returns `fn` unchanged, so the codegen wires it exactly as the bare default export), and the compile check is the whole value. Wrap the handler and import the descriptor into its `*.server.ts`:
+
+  ```ts
+  export default defineExecutor(getRoadmapsByYear, (input, ctx) => …)
+  ```
+
+  The Effect error and requirement channels stay inferred from the handler; only the success value is constrained. A reactive query that returns a `{ descriptor }` builder is allowed through unchecked — the store produces its rows, so a value-level return type can't express that row-vs-output check.
+- **@voltro/database, @voltro/runtime** — An `.encrypted()` column that can't be decrypted with the active key now fails as a typed, readable `FieldDecryptionError` naming the `table.column`, instead of a raw `Error: field cipher: malformed ciphertext` with no context. It carries a `_tag` (the same tagged shape `storeErrors` uses, so `Effect.catchTag` matches), and never includes the ciphertext. The common trigger is restoring a prod/staging snapshot into a dev DB whose `VOLTRO_FIELD_ENCRYPTION_KEY` differs.
+
+  New dev/migration escape hatch: `VOLTRO_FIELD_DECRYPT_ON_ERROR=null` degrades an undecryptable column to `null` (with one deduped warning per `table.column`, scope `store.fieldEncryption`) instead of letting one bad row nuke the whole read — its readable siblings still decrypt. Default stays `'throw'`; never set `null` in production, where a key mismatch must fail loud. `decryptFieldsOnRead` gains an optional `{ onError, warn }` argument (additive); the raw throw is replaced by the typed one, which existing `catch (e: Error)` handlers still catch.
+- **@voltro/i18n** — `assertCatalogParity({ en, de })` checks every locale uses the SAME ICU `{var}` set per key. `defineLocale` enforces KEY parity but not PLACEHOLDER parity — a translation that drops or renames a `{var}` (`'Published on {date}'` → `'Veröffentlicht'`) compiles and boots, then throws `The intl string context variable "date" was not provided` only in that locale, only when the message renders. Call it in a test or at boot; it throws listing every drift (or warns with `onMismatch: 'warn'`). Plural argument names are extracted; a plural's inner `{# item}` branches are not mistaken for placeholders.
+- **@voltro/i18n** — `createTypedMessages<typeof en>()` binds a catalog's LITERAL message types to `useT` / `useTFn` / `<T>`, so a missing ICU placeholder is a COMPILE error instead of a runtime throw at format time. Until now `defineCatalog` / `defineLocale` enforced key PARITY across locales, but the call site `t('key', values)` was untyped — a message like `'Published on {date}'` called as `t('roadmap.publishedAt')` (or via the `t('key').replace('{{date}}', …)` idiom from other i18n systems) threw `The intl string context variable "date" was not provided` only when it rendered. Now `useT('roadmap.publishedAt')` demands `{ date }` at compile time, and a wrong/missing key is caught too.
+
+  Opt-in and purely additive: call `createTypedMessages` once with your base catalog (`as const`) and re-export the returned `useT`/`useTFn`/`T`; the bare hooks keep their existing loose signatures. Scope: simple `{name}` and single-argument `{count, number}` forms are extracted; messages with nested inline ICU (`{n, plural, one {…} other {…}}` / `select`) accept a loose values bag rather than a wrong strict one — apps that pluralise in JS over simple `{count}` messages stay fully typed. `<T>` gets a typed key with loose values, because its rich-text `<tag>` renderers can't be modelled by `{var}` extraction.
+- **@voltro/plugin-ai-flows** — An AI-flow `MediaGenerator` (and the `makeMediaGenerator` persistence seam) now receives the run it executes within — `run: { runId, tenantId }` — resolved from the durable run row rather than the caller subject. This is what a resume needs: a BOOTSTRAP/crash resume runs under a tenant-less `SYSTEM_SUBJECT`, so a host that persists artifacts per tenant could not read the tenant from `ctx.request.subject` (it isn't there) and would either fail closed or, under an old anonymous fallback, write into the wrong tenant. The engine already loads the run row (for `ownerId`); it now reads `tenantId` from the same row and hands it down to both the deterministic and agentic media steps, and `MediaPersist.put` / `ingestUrl` forward it to `storage.put` / `ingestUrl` so persistence continues in the run's own tenant on replay.
+
+  Additive: `run` is appended to the generator/persist arguments, so a host that ignores it keeps compiling; the tenant is simply available when it doesn't. No `@voltro/web` change — the engine is server-only and not re-exported to the browser surface.
+- **@voltro/client, @voltro/web** — A sequence step's `undo` now receives the accumulated context as a second argument — `undo: (result, ctx) => …` — alongside the step's own result. An inverse usually needs an id from an EARLIER step as well as this one's (`deleteJiraDraftTicket({ jiraKey: created.key, draftId: ctx.draft.id })`), and until now the only way to reach it was to re-return that id from the step purely so the undo could read it back. `ctx` is typed as of the step's definition — the steps before it, the same context `covers` and `when` already see — so a later step's result is deliberately not visible (it is rolled back before this one).
+
+  Additive, not breaking: `StepUndo<Result>` became `StepUndo<Result, Ctx = Record<string, unknown>>` with the context parameter defaulted and appended, so a named `StepUndo<T>` still resolves and an existing single-argument `undo: (r) => …` stays assignable. `@voltro/web` re-exports the client surface, which is why it moves too.
+- **@voltro/cli** — SSR `ctx.query` now has a first-class, server-only api origin for split web/api deployments (#18). Previously, a `renderMode:'ssr'` page reloaded in a split deployment 500'd: the web pod's `POST <origin>/rpc` fell back to the DEV proxy target (`http://localhost:4000`), which nothing serves in production → `ECONNREFUSED` buried in a render error. Browser-reachability and SSR-reachability were conflated into the one `url` field.
+
+  New `apis.<name>.serverUrl` (and env overrides `VOLTRO_API_ORIGIN_<NAME>` / `VOLTRO_API_ORIGIN`) set the origin the WEB POD uses for SSR — the api's internal cluster DNS (`http://api.<ns>.svc.cluster.local`) — distinct from the browser's relative wsPath, and NEVER emitted into the browser bundle. Resolution: env > `serverUrl` > (dev only) the vite proxy target > an external api's absolute url. Under `voltro start` a package api with none resolves to `undefined` and the loader query FAILS LOUD naming the api and the config to set — it never dials the dev localhost port. A transport failure is wrapped naming the api and the origin attempted, instead of a bare `fetch failed`.
+- **@voltro/database, @voltro/runtime** — `store.insert` / `upsert` / `insertIgnore` now raise a clear, typed `TableValidationFailed` naming the column when the payload omits one that is NOT NULL, has no default, and isn't auto-stamped — instead of a raw dialect `SqlError: Failed to execute statement` (`Field '…' doesn't have a default value`) surfaced only on the INSERT path (so it lay dormant until the first row with no existing cache entry). An upsert / insertIgnore whose payload is missing one of its own `conflictColumns` is likewise named at the call (an absent conflict key can't match its target). The check runs AFTER stamping, so auto-id / tenant / audit columns never trip it, and skips nullable, defaulted, and id (`idScheme`) columns — exactly the ones a caller may legitimately omit.
+
+  Two pure helpers back it — `missingRequiredColumns(table, row)` and `missingConflictColumns(conflictColumns, row)` (exported from `@voltro/database`). This is the runtime half of the "handler data silently disagrees with the schema" class; a compile-time payload type needs the column DSL to track `hasDefault` at the type level, which is a separate change.
+
+  **Migration impact — behaviour-breaking for lenient test fixtures.** The in-memory/test store now rejects the same partial inserts a real Postgres always would, so it stops being laxer than production — which is the point (it surfaced at least one latent prod bug where a NOT-NULL `text().unique()` column was written without a value). But a fixture that inserted a partial row (`{ id }` parents, an omitted required FK) and passed against the old lenient memory store now throws `TableValidationFailed`. There is no code-level codemod — the fix is fixture DATA: fill the required columns. Use the new `fixtureRow(table, overrides)` helper in `@voltro/testing`, which fills every NOT-NULL-no-default column with a schema-typed placeholder and merges your overrides on top, so a fixture complies without disabling the check. There is deliberately no opt-out to turn the validation off: a test store that accepts rows production rejects is a fake testing itself.
+- **@voltro/database, @voltro/plugin-ai-flows, @voltro/plugin-audit, @voltro/plugin-deactivation, @voltro/plugin-soft-delete** — Compile-time payload typing for writes (#15) — the type-level half that the runtime `TableValidationFailed` guard flagged as a separate change. `insertRow` / `upsertRow` take the TABLE OBJECT (not a string name), so the payload is checked against `InferInsertRow<T>`: every column is required EXCEPT nullable ones, columns with a default, and the framework-filled id/tenant/audit columns. A missing NOT-NULL-no-default column — the exact `lastRefreshedAt` / `teamId` omission from the report — is now a COMPILE error at the call, not a runtime SqlError only on the INSERT path; `upsertRow`'s `conflictColumns` are constrained to the table's own columns too.
+
+  import { insertRow } from '@voltro/database' await insertRow(ctx.store, roadmapEpicStats, { teamId, lastRefreshedAt: new Date() })
+
+  Enabled by a type-level default flag: `ColumnDefinition` / `ColumnBuilder` gained a third `HasDefault` parameter that `.default()` narrows to `true`. It defaults to `boolean`, so every existing `ColumnDefinition<unknown>` (mixins, query builder, migrate, plugins) is unaffected — the only golden churn is the additive third parameter rendering (e.g. an audit mixin's defaulted `createdAt` now shows `ColumnDefinition<Date, "timestamp", true>`). The string-keyed `store.insert` / `upsert` are unchanged; the typed seam is opt-in.
+- **@voltro/runtime, @voltro/cli** — `voltro dev` now warns, once per tenant-scoped table, when a request reads it with the empty-string tenant sentinel — an authenticated subject that has no resolved org (`tenantId === ''`). The auto-merged tenant filter becomes `eq('tenantId', '')`, which matches no real row, so every such read returns empty WITH NO ERROR — indistinguishable, from the response alone, between "no such row", "filtered by an empty tenant", and "auth half-resolved". The warning names the cause and the fix. `voltro serve` deliberately stays silent (a prod diagnostic on every scoped read is noise). The decision is a pure predicate, `isEmptyTenantScopedRead`, exported from `@voltro/runtime` so it is unit-tested apart from the 6k-line dev boot; `applyTenantScope` itself stays pure.
+- **@voltro/runtime, @voltro/cli** — `voltro dev` now warns once, the first time an authenticated subject resolves with NO active org (a `user` carrying the empty-string tenant sentinel) — "authenticated, but no active org → all tenant-scoped reads will be empty". Broader and earlier than the per-table empty-tenant read warning: it catches the whole class at the door instead of on a specific read. Backed by the pure `isOrglessUserSubject` predicate in `@voltro/runtime`; dev owns the one-time log.
+- **@voltro/cli** — `voltro start` (web) now reports boot timing, matching `voltro serve`. It always logs a structured `start: ready in <n>ms` line (with `bootMs`), counted from PROCESS start so the module-graph load — the phase that dominates a scale-to-zero cold start — is included instead of being missed by a mid-boot baseline; the banner's `bootMs` uses the same total. Under `VOLTRO_BOOT_TIMING=1` the line also carries a per-phase `phases` breakdown (`modules`, `config`, `scan`, `provider`, `routes`, `cdc`, `ready`). Because the total is a structured log record, it is retrievable from the container's `/_voltro/inspect/logs` endpoint, not only from stdout.
+- **@voltro/cli** — Production web images are now self-contained and dramatically smaller. `voltro build` makes every runtime artefact framework-inlined + tree-shaken — the SSR bundle (vite `noExternal: true`), the start bundle, and the precompiled `appConfig` — so a booted `voltro start` needs from `node_modules` only the runtime-external NATIVE leaves it actually reaches (a SQL driver an ISR/config path touches). A new hidden `voltro prune-runtime <deploy-dir>` command (`@vercel/nft`, a new build-time optionalDependency) traces the real reachable set from those bundles + the app's installed native leaves and drops the rest — the whole `@voltro`/effect/react tree that's now dead weight. The standalone web Dockerfiles run it after `pnpm --prod deploy`; for a static/SSR site with no native runtime dep, `node_modules` collapses to nothing. Measured on a real marketing app: the app tree drops from ~210 MB to ~65 MB (node_modules ~145 MB → 0) and still boots + renders. Fully automatic — a used native driver is traced + kept, an unused one dropped, no per-app allow-list — and non-fatal: any trace failure keeps the fuller tree (a bigger image, never a broken one). The appConfig `@voltro/*` imports are now inlined (were external); this is safe because `runEnvGate` consumes the env schema structurally (`isEnvContract` duck-types `{ vars }`, no `instanceof`/Symbol), so a schema built by the config's inlined `@voltro/env` still validates.
+- **@voltro/cli** — `voltro build` now precompiles the web START runtime into a single bundle (`.framework/dist-web/startBundle/startEntry.js`, framework inlined) — the web counterpart to the api serve bundle. `bin/voltro.mjs`'s `voltro start` fast path prefers it, so a cold scale-from-zero web boot loads ONE artefact instead of resolving the whole `@voltro`/effect module graph. Measured on the web-spa-shell fixture: the `modules` boot phase collapses from ~1130 ms to ~67 ms (~17×), directly cutting the phase measured to dominate a scale-to-zero web cold start. Non-fatal — if the bundle build or its import fails, `voltro start` falls back to the per-module CLI entry (correct, just slower). No app or Dockerfile change is needed; the bundle rides in `.framework`, which `pnpm deploy` already copies.
+
+### Fixed
+
+- **@voltro/runtime** — An undeclared infra error no longer reaches the browser as an `ExitEncoded` schema-tree dump (a wall of text that leaks internals and no client can pattern-match). `FieldDecryptionError` — a `.encrypted()` column that can't be decrypted with the active key — now collapses to a generic `InternalError` on both the unary and the subscription paths (it was previously only `SqlError` / `ResultLengthMismatch`, and only on the unary path). Its message names an internal `table.column`, so this also stops that leak; the real cause is logged server-side with the traceId. `TableValidationFailed` is deliberately left through — its summary/issues are meant to be shown to a user. Typed app errors are untouched.
+- **@voltro/cli** — Security: the `/_voltro/inspect/logs` endpoint no longer bypasses the inspect gate. It dumps the process LogBuffer (request URLs + error payloads), but it returned early — above the `isInspectDisabled` / `VOLTRO_INSPECT_TOKEN` checks — so `VOLTRO_INSPECT=off` closed the manifest and metrics (503) while leaving the log buffer publicly readable, and a configured `VOLTRO_INSPECT_TOKEN` was ignored for it. The gate now lives inside `handleLogsRequest`, single-sourced across the three call sites (`voltro start` / `voltro dev` / the web-dev server) that each drifted (start ungated, dev gated nothing, web-dev gated disabled-but-not-token): disabled → 503, missing/bad bearer → 401.
+
+---
+
 ## [0.11.0] — 2026-07-22
 
 ### ⚠ BREAKING

package/dist/index.d.ts

@@ -3,6 +3,28 @@ import { FormattedMessage } from 'react-intl';
 import { IntlConfig } from 'react-intl';
 import { ReactNode } from 'react';
 
+/**
+ * Assert every locale uses the SAME ICU `{var}` set per key. `defineLocale`
+ * enforces KEY parity, but not PLACEHOLDER parity — a translation that drops or
+ * renames a `{var}` (`'Published on {date}'` → `'Veröffentlicht'`) compiles and
+ * boots, then throws `The intl string context variable "date" was not provided`
+ * ONLY in that locale, only when that message renders. This catches it up front.
+ *
+ * Call it in a test or at boot over your catalog map:
+ *
+ *     import en from './locales/en'
+ *     import de from './locales/de'
+ *     assertCatalogParity({ en, de })   // throws listing every drift
+ *
+ * Keys missing from a non-base locale are left to `defineLocale` (this only
+ * compares the placeholder sets of keys present in both). `baseLocale` defaults
+ * to the first entry; `onMismatch: 'warn'` logs instead of throwing.
+ */
+export declare const assertCatalogParity: (catalogs: Record<string, MessageCatalog>, options?: {
+    readonly baseLocale?: string;
+    readonly onMismatch?: "throw" | "warn";
+}) => void;
+
 export declare type CatalogLoader = () => Promise<CatalogModule>;
 
 /** A locale's catalog module. Supports both `export default` and a bare map. */
@@ -10,6 +32,15 @@ export declare type CatalogModule = MessageCatalog | {
     readonly default: MessageCatalog;
 };
 
+/**
+ * Bind the typed message API to a catalog's literal types. Almost pure type
+ * refinement: the runtime is `useT` / `useTFn` / `<T>` with a `.dynamic` escape
+ * attached to the two translate functions (a runtime-computed-key sink) — no
+ * other behaviour change and no per-call cost. See the module header for the
+ * call-once pattern and scope.
+ */
+export declare const createTypedMessages: <C extends MessageCatalog>() => TypedMessages<C>;
+
 export declare type DateInput = Date | number | string;
 
 /**
@@ -61,6 +92,27 @@ declare interface I18nProviderProps {
     readonly children: ReactNode;
 }
 
+/** The declared NAME of an ICU argument: the identifier before the first comma
+ *  (`{count, number}` → `count`), or the whole body for a bare `{name}` — but
+ *  only when it is a real identifier, else `never` (see `ValidICUName`). */
+declare type ICUArgName<Body extends string> = Body extends `${infer Name},${string}` ? ValidICUName<Trim<Name>> : ValidICUName<Trim<Body>>;
+
+/** The characters a real ICU argument name is made of — `[A-Za-z0-9_]`. */
+declare type ICUIdentChar = 'a' | 'b' | 'c' | 'd' | 'e' | 'f' | 'g' | 'h' | 'i' | 'j' | 'k' | 'l' | 'm' | 'n' | 'o' | 'p' | 'q' | 'r' | 's' | 't' | 'u' | 'v' | 'w' | 'x' | 'y' | 'z' | 'A' | 'B' | 'C' | 'D' | 'E' | 'F' | 'G' | 'H' | 'I' | 'J' | 'K' | 'L' | 'M' | 'N' | 'O' | 'P' | 'Q' | 'R' | 'S' | 'T' | 'U' | 'V' | 'W' | 'X' | 'Y' | 'Z' | '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' | '_';
+
+/**
+ * The union of ICU placeholder names in a message template literal — `never`
+ * when it has none, or when the message type is a non-literal `string` (the
+ * untyped-catalog fallback). Simple `{var}` and top-level `{var, type}` only;
+ * nested ICU is out of scope (see the module header).
+ */
+export declare type ICUVars<S extends string> = string extends S ? never : S extends `${string}{${infer Body}}${infer Rest}` ? ICUArgName<Body> | ICUVars<Rest> : never;
+
+/** `true` iff every character of `S` is an ICU identifier char (and `S` is
+ *  non-empty). A candidate with a space, `#`, `—`, `{`, etc. fails — that is how
+ *  a plural/select BRANCH's text (`"# days total duration"`) is rejected. */
+declare type IsICUIdentifier<S extends string> = S extends '' ? false : S extends `${infer C}${infer Rest}` ? C extends ICUIdentChar ? Rest extends '' ? true : IsICUIdentifier<Rest> : false : false;
+
 export declare interface LazyCatalogs<L extends string = string> {
     /** Locales this app declares, in declaration order. */
     readonly locales: ReadonlyArray<L>;
@@ -100,6 +152,21 @@ declare interface LazyI18nProviderProps {
     readonly children: ReactNode;
 }
 
+/**
+ * A widened translate signature: a plain-string key with an optional loose
+ * values bag. It is what a cross-package / catalog-less boundary should type its
+ * `t` pass-through param as, instead of falling back to `(...args: any[]) => string`.
+ *
+ * A `TypedTFunction` is NOT directly assignable to this — its key param is
+ * NARROWED to the catalog's literal keys, and a narrower parameter is not
+ * assignable to a wider one (contravariance). That is deliberate: silently
+ * letting the strict `t` satisfy a `(key: string) => string` sink would erase the
+ * checking the strict surface exists for. Pass `t.dynamic` at such a boundary —
+ * it IS a `LooseTFunction` — or, inside code that CAN import the catalog, type the
+ * param `TypedTFunction<C>` and keep it strict.
+ */
+export declare type LooseTFunction = (id: string, values?: Readonly<Record<string, MessageValue>>) => string;
+
 /**
  * Build a children-to-tree wrapper that mounts `<I18nProvider>` with
  * the supplied locale + catalog. The framework's SSG pipeline calls
@@ -116,8 +183,20 @@ declare interface LazyI18nProviderProps {
  */
 export declare const makeSsgWrap: (locale: string, messages: MessageCatalog, defaultLocale: string) => ((children: ReactNode) => ReactNode);
 
+/**
+ * The positional `values` a message key requires: none for a plain message, a
+ * required record for one with placeholders, and a loose optional bag when the
+ * catalog value is a non-literal `string` (so an untyped catalog still works).
+ */
+export declare type MessageArgs<Msg extends string> = string extends Msg ? [values?: Readonly<Record<string, MessageValue>>] : ICUVars<Msg> extends never ? [] : [values: {
+    readonly [K in ICUVars<Msg>]: MessageValue;
+}];
+
 export declare type MessageCatalog = Readonly<Record<string, string>>;
 
+/** The value types an ICU placeholder accepts. */
+export declare type MessageValue = string | number | boolean | Date | null | undefined;
+
 /**
  * Pick the catalog for a locale OUTSIDE React — for `meta({ locale })` and other
  * non-hook call sites that resolve a message for an ARBITRARY locale, where
@@ -166,6 +245,36 @@ declare type TProps = Omit<ComponentProps<typeof FormattedMessage>, 'id'> & {
     readonly id: string;
 };
 
+declare type Trim<S extends string> = S extends ` ${infer R}` ? Trim<R> : S extends `${infer R} ` ? Trim<R> : S;
+
+export declare interface TypedMessages<C extends MessageCatalog> {
+    /** `useT(id, …values)` — a string, with the key and ICU params type-checked. */
+    readonly useT: TypedTFunction<C>;
+    /** The captured-once function form; same typing as `useT`. */
+    readonly useTFn: () => TypedTFunction<C>;
+    /** `<T id=… />` with a catalog-typed key (values stay loose for rich text). */
+    readonly T: (props: TypedTProps<C>) => ReactNode;
+}
+
+/** The typed key + params surface of a bound catalog, plus a `dynamic` escape for
+ *  a runtime-computed key. */
+export declare type TypedTFunction<C extends MessageCatalog> = (<K extends keyof C & string>(id: K, ...args: MessageArgs<C[K]>) => string) & {
+    /**
+     * Escape hatch for a genuinely runtime-computed key — `t.dynamic(`p.${x}`)`.
+     * Takes a plain string with NO forced ICU args, so it does not fight the strict
+     * literal-key surface. This is the documented, discoverable alternative to
+     * casting a computed key to the full `keyof C` union (which would wrongly demand
+     * a 2nd ICU arg, because that union spans placeholder-bearing keys).
+     */
+    readonly dynamic: LooseTFunction;
+};
+
+/** `<T>` prop shape: a catalog-typed `id` with react-intl's own (loose) values —
+ *  `<T>` supports rich-text tag renderers that `{var}` extraction can't model. */
+export declare type TypedTProps<C extends MessageCatalog> = Omit<ComponentProps<typeof FormattedMessage>, 'id'> & {
+    readonly id: keyof C & string;
+};
+
 /** Convenience: currency formatting with the ISO code up front. */
 export declare const useFormatCurrency: (currency: string) => ((value: number, options?: Intl.NumberFormatOptions) => string);
 
@@ -234,4 +343,10 @@ export declare const useT: (id: string, values?: Record<string, string | number
  */
 export declare const useTFn: () => (id: string, values?: Record<string, string | number | boolean | Date | null | undefined>) => string;
 
+/** A validated ICU arg name, or `never` when the candidate isn't a real
+ *  identifier. This is the guard that keeps the type-level parse from emitting a
+ *  plural/select branch's TEXT as a phantom required var — an ICU arg name can't
+ *  contain spaces/`#`/`—`, so anything that does is dropped. */
+declare type ValidICUName<S extends string> = IsICUIdentifier<S> extends true ? S : never;
+
 export { }

package/dist/index.js

@@ -93,14 +93,49 @@ var l = ({ locale: e, messages: n, defaultLocale: i, silenceMissingTranslations:
 		r,
 		i
 	]);
-}, w = (e) => e, T = () => (e) => e, E = (e, t, n) => e[t ?? n] ?? e[n], D = (e) => "default" in e && typeof e.default == "object" ? e.default : e, O = (e, t) => {
+}, w = (e) => e, T = () => (e) => e, E = (e, t, n) => e[t ?? n] ?? e[n], D = /\{\s*([A-Za-z0-9_]+)/g, O = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of e.matchAll(D)) t.add(n[1]);
+	return t;
+}, k = (e, t) => {
+	let n = Object.keys(e);
+	if (n.length < 2) return;
+	let r = t?.baseLocale ?? n[0], i = e[r] ?? {}, a = [];
+	for (let [t, o] of Object.entries(i)) {
+		let i = O(o);
+		for (let o of n) {
+			if (o === r) continue;
+			let n = e[o]?.[t];
+			if (n === void 0) continue;
+			let s = O(n), c = [...i].filter((e) => !s.has(e)), l = [...s].filter((e) => !i.has(e));
+			if (c.length > 0 || l.length > 0) {
+				let e = [c.length > 0 ? `missing {${c.join("}, {")}}` : "", l.length > 0 ? `unexpected {${l.join("}, {")}}` : ""].filter(Boolean);
+				a.push(`${o} '${t}': ${e.join("; ")} (base ${r} has {${[...i].join("}, {")}})`);
+			}
+		}
+	}
+	if (a.length === 0) return;
+	let o = `i18n placeholder parity — a translation dropped or renamed an ICU {var}; it would throw only in that locale, only when the message renders:\n  ${a.join("\n  ")}`;
+	if (t?.onMismatch === "warn") {
+		console.warn(o);
+		return;
+	}
+	throw Error(o);
+}, A = (e) => {
+	let t = e;
+	return t.dynamic === void 0 && (t.dynamic = (t, n) => e(t, n)), t;
+}, j = () => ({
+	useT: A((e, t) => d(e, t)),
+	useTFn: (() => A(m())),
+	T: u
+}), M = (e) => "default" in e && typeof e.default == "object" ? e.default : e, N = (e, t) => {
 	let n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (n) => n && n in e ? n : t, a = (t) => {
 		let a = i(t), o = n.get(a);
 		if (o) return Promise.resolve(o);
 		let s = r.get(a);
 		if (s) return s;
 		let c = e[a], l = c().then((e) => {
-			let t = D(e);
+			let t = M(e);
 			return n.set(a, t), r.delete(a), t;
 		}).catch((e) => {
 			throw r.delete(a), e;
@@ -116,7 +151,7 @@ var l = ({ locale: e, messages: n, defaultLocale: i, silenceMissingTranslations:
 			a(e).catch(() => {});
 		}
 	};
-}, k = ({ catalogs: e, locale: t, fallback: n = null, silenceMissingTranslations: i, children: a }) => {
+}, P = ({ catalogs: e, locale: t, fallback: n = null, silenceMissingTranslations: i, children: a }) => {
 	let [s, u] = c(() => e.peek(t));
 	return o(() => {
 		let n = e.peek(t);
@@ -137,7 +172,7 @@ var l = ({ locale: e, messages: n, defaultLocale: i, silenceMissingTranslations:
 		...i === void 0 ? {} : { silenceMissingTranslations: i },
 		children: a
 	}) : n;
-}, A = (e, t, n) => (r) => i(l, {
+}, F = (e, t, n) => (r) => i(l, {
 	locale: e,
 	messages: t,
 	defaultLocale: n,
@@ -145,4 +180,4 @@ var l = ({ locale: e, messages: n, defaultLocale: i, silenceMissingTranslations:
 	children: r
 });
 //#endregion
-export { l as I18nProvider, k as LazyI18nProvider, u as T, w as defineCatalog, O as defineCatalogs, T as defineLocale, A as makeSsgWrap, E as pickCatalog, h as plural, S as useFormatCurrency, v as useFormatDate, x as useFormatNumber, C as useFormatters, f as useLocale, p as useMessages, g as usePlural, b as useRelativeTime, d as useT, m as useTFn };
+export { l as I18nProvider, P as LazyI18nProvider, u as T, k as assertCatalogParity, j as createTypedMessages, w as defineCatalog, N as defineCatalogs, T as defineLocale, F as makeSsgWrap, E as pickCatalog, h as plural, S as useFormatCurrency, v as useFormatDate, x as useFormatNumber, C as useFormatters, f as useLocale, p as useMessages, g as usePlural, b as useRelativeTime, d as useT, m as useTFn };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/i18n",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Voltro's i18n layer — thin opinionated wrap over react-intl. Provides the framework's locale-resolution conventions (voltro:lang cookie + Accept-Language fallback), a typed message-catalog helper, and a slim provider component. Power users can import directly from react-intl for advanced APIs.",
   "keywords": [
     "voltro",