@voltro/plugin-audit 0.36.0 → 0.37.0

package/CHANGELOG.md

@@ -39,6 +39,96 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.37.0] — 2026-08-13
+
+### ⚠ BREAKING
+
+- **@voltro/protocol, @voltro/runtime, @voltro/cli** — A field a procedure's input schema does not declare now REJECTS the call. It used to be discarded and the call ran with what was left.
+
+  The measurement, from a consumer's root layout:
+
+  ```ts
+  query?.('userSettings.list', { employeeId })
+  ```
+
+  That procedure declares `userId` / `userIdIn`. Effect's default `onExcessProperty: 'ignore'` decoded the payload to `{}` — not reasoned, measured:
+
+  ```ts
+  decodeUnknownSync(Struct({ userId: optional(String) }))({ employeeId: 'e' })  // → {}
+  ```
+
+  An empty input to a LIST query is not a narrower filter, it is the ABSENCE of one. Their admin, signed in as `2d0add2c…`, was served the settings row of `4410c2f8…` — another user's language and theme in the first paint, with nothing in any log to say so.
+
+  **Why refuse rather than warn.** The decoder cannot tell a projection field from a FILTER field, and that asymmetry is the whole risk: dropping an unknown `include` costs a caller some data, dropping an unknown `tenantId` hands them somebody else's. Nothing at decode time distinguishes the two, so the safe direction is the only one available — the same fail-closed reasoning as the row filter's refusal, one layer up. A warning would have to be read by someone, in a log, after the wrong rows were already served.
+
+  The typed loader query that shipped in 0.36.0 closes the same hole for callers we compile. This closes it for the ones we do not: a plain `fetch`, a curl, a still-cached bundle after a field rename, and every untyped caller.
+
+  Three things measured rather than assumed, because none follows from the annotation's name: it propagates into NESTED structs, through every member of a UNION, and leaves a non-struct payload (`Schema.Void`, a scalar) alone.
+
+  **`Schema.Struct({})` needed a filter, and only a real process showed it.** The fixture's `notes.list` declares an empty input; `POST /rpc` with `{ employeeId }` came back `200` with a snapshot, which for twenty minutes read as the whole change having failed. An empty `TypeLiteral` has no property signatures, so Effect has no expected key set for a key to be excess OF — self-consistent, and the wrong answer here, because `input: Schema.Struct({})` is the STRONGEST declaration a procedure can make and it was the one shape that accepted everything. It gets an explicit predicate now; `Schema.Record` keeps its open key set, because there the openness is declared.
+
+  **Verified against a running `voltro serve`, not only in units.** A declared input succeeds and inserts its row; an undeclared field is refused naming the key and the accepted set. The refusal arrives on the channel a payload decode failure ALREADY used — a missing required field produces the same `Die` with a `ParseError` message — so this adds no new error shape for a client to handle, it moves one case onto the channel the sibling case was always on.
+
+  `strictInput` lives in one module and every `Rpc.make` payload in `@voltro/protocol` goes through it — query, mutation, action, stream, event, plus the workflow start on both the server lifter and the browser-loaded rpc group. `strictInput.test.ts` asserts that SET by scanning the source, not the five lifters somebody remembered: a rule applied at the sites you can list is the shape that let `bootStoreCodec` be fixed twice and break a third time.
+
+  **`voltro update` carries you across this** — codemod `0.37.0/01_procedure-input-rejects-undeclared-fields`, a written note. A transform would have to guess which declared field a stray one meant, which is the same guess that produced the defect.
+
+### Added
+
+- **@voltro/plugin-audit** — `redactInput` / `redactOutcome` gained `'shape'`, and `redactSubject` gained `'metadata-shape'`: the payload's STRUCTURE survives, no value from it.
+
+  ```json
+  { "__redacted": { "jiraToken": "string(113)", "attempts": "number" } }
+  ```
+
+  Requested by the consumer who had asked for the redaction one round earlier, and both requests were right. They spent a day on a bug their own audit trail could have ended in seconds — a value arrived as 113 characters where 44 were due, and the row that would have said so read `{"__redacted":"all"}`. `'all'` remains the default on every field; this is opt-in.
+
+  The rules, and the two that are decisions rather than details:
+
+  - A string reports its LENGTH. Never a prefix, never a hash — `enc:v1:` is a prefix and so is the first byte of a private key, so there is no prefix length that is safe for every credential format. - A number, boolean or date reports its TYPE only. A number can BE the secret. - **A key can be the value.** An object keyed by user data puts a datum where a schema name belongs, so a key is reproduced only when it looks like a declared field — a short plain identifier. The first version truncated long keys and documented the weakness instead; this module's own test caught 62 characters of a secret surviving on the first run. A leak with a footnote is still a leak. - **A string's length is a real disclosure, and a small one.** Stated in the docs rather than buried: for a fixed-format credential it carries nothing, for a human-chosen password it is a weak hint. `'all'` stays the default for anyone that matters to.
+
+  The `'shape'` outcome describes the payload it REPLACES — the value on success, the error on failure — rather than the event. Describing the event would report `{ kind, value, durationMs }` and hide the field, which is the failure the option exists to end. An error's `_tag` still survives, as it does under `'all'`.
+
+### Fixed
+
+- **@voltro/cli** — `voltro db --help` listed fifteen of eighteen subcommands. `adopt`, `scan-credentials` and `encrypt-column` shipped and never joined the hand-written string.
+
+  A consumer wrote both halves of that gap into a requirements document, as separate items, neither of them about help text:
+
+  - **`voltro db encrypt-column` "does not exist"** — filed as a feature request, quoting the fifteen names they saw as evidence. It shipped in 0.33.0, and enabling `.encrypted()` on a populated column by hand is exactly the migration they were about to write themselves. - **`scan-credentials` "no longer exists"** — filed as CLOSED, a credential scanner struck off their list as removed. It had not moved.
+
+  A quoted enumeration is read as exhaustive, and the more careful the reader the more thoroughly they act on the missing entry. Same lesson a boot refusal in `procedureAccessGate` had already taught us, in a place nobody thought of as a message.
+
+  The usage line is now GENERATED from the dispatch table's key type (`Record<DbSubcommand, Handler>` in `dbCommand.ts`, names in `subcommandNames.ts`), so a handler with no name or a name with no handler fails to compile. `voltro privacy` is keyed the same way. The prose summary beside it cannot be generated — it carries per-command annotations — so a test asserts it mentions every name, because it carried the identical three omissions and it is what `voltro --help` prints first.
+
+  `subcommandHelpParity.test.ts` also NAMES the six commands whose subcommand menus have no dispatch table behind them (`webhooks`, `evolve`, `new`, `data`, `storage`, `add`). They dispatch through a switch and are unchecked; a silently-unchecked command reads exactly like a checked one.
+- **@voltro/cli** — A 401 or 403 from the inspect surface now names `VOLTRO_INSPECT_TOKEN` and says which side is missing.
+
+  `voltro db plan --against <url>` printed `remote returned 403` and stopped. A consumer read that as a DATABASE permission problem — the natural reading of a 403 from a command whose entire subject is a database — and went looking at grants. The cause is one unset environment variable, which the command reads four lines above the message.
+
+  `voltro probe access` had half of it: it named the variable on 401 and not on 403, while classifying both as `refused`. So the two commands somebody needs during an access migration were the two that would not say what was wrong, and one of them said something misleading instead.
+
+  `inspectGateHint` is shared by both call sites and distinguishes the two statuses, because they call for different actions: a 401 means no credential was sent (set the variable), a 403 means the one sent was not accepted (the two values differ). Both halves of the sentence name the server AND the calling shell — naming one side produces a second failed attempt.
+- **@voltro/cli** — `VOLTRO_TEMPLATES_DIR` is authoritative when set. It used to be a HINT: if the path it named held no `apps/` (or no `baselines/`), both resolvers fell through to the sibling-checkout walk-up and quietly used a different tree — or none.
+
+  A pointer that silently isn't followed is worse than a wrong one. A CI job aimed at the wrong path scaffolded from whatever it happened to find, and a job whose checkout had failed reported an empty template catalogue with nothing connecting that emptiness to the variable it was given. `scripts/lib/docsSite.mjs` states the same rule for `VOLTRO_DOCS_DIR`, and arrived at it the same way: you said where it is; it is not there.
+
+  Behaviourally this only changes the misconfigured case — a correct `VOLTRO_TEMPLATES_DIR` resolved to the same place before and after. What changes is that a wrong one now shows up as "not found, here is the path I was told" at the first thing that reads it, instead of as a different tree three steps later.
+
+  The unbundled resolution order is otherwise untouched: sibling `voltro-templates` → `.voltro-templates` → the bundled `templates/` a published CLI ships.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/plugin-ai-flows** — Two comments in the flow engine cited task records from a plans tracker that has since been deleted. Comment-only; no behavior, no API, nothing a consumer can observe.
+
+  Worth writing down because of HOW it surfaced. The tracker was retired in the META repo, and the gate that went red was in THIS one — `check-stale-task-comments.mjs` resolves a comment's `task #NN` against `../plans`, so deleting a plan document in one repo can only be half a change, and the other half is in a repo the deleting commit never touched.
+
+  Neither comment was WRONG, which is the part that makes the rule earn its keep. The first claims `@voltro/ai` has first-class media generation — true: `generateImage`, `generateSpeech`, `generateVideo` all ship in `packages/ai/src/media.ts`. It now names those three instead of a record number, which is checkable without the deleted document. The second only quoted the retired id inside its own account of a defect (a `"not yet wired (task #35)"` message that outlived the shipped HITL park and misled an audit into filing it as unbuilt); the quote lost the number and kept the whole lesson.
+
+  The check's own failure text is the reasoning: a plan is retired for exactly two reasons — the work shipped, or it was dropped without shipping — and a comment still citing it asserts the second while usually meaning the first.
+
+---
+
 ## [0.36.0] — 2026-08-13
 
 ### ⚠ BREAKING

package/dist/index.d.ts

@@ -325,6 +325,10 @@ export declare interface AuditPluginOptions {
      *
      *   - `'all'` (DEFAULT) — the payload is replaced by `{ __redacted: 'all' }`.
      *     The row still proves a payload existed; it just does not carry it.
+     *   - `'shape'` — the payload's STRUCTURE, no value from it:
+     *     `{ __redacted: { token: 'string(113)', limit: 'number' } }`. See
+     *     `redactionShape.ts` for the rules and for the one real trade (a
+     *     string's LENGTH is disclosed).
      *   - `'none'` — the raw input, verbatim. What every sink did before this
      *     option existed.
      *   - a function — `(event) => unknown`, for field-level control.
@@ -345,13 +349,17 @@ export declare interface AuditPluginOptions {
      * row; leaking a credential is not visible at all. Opt in per app with a
      * function once you know your own inputs.
      */
-    readonly redactInput?: 'all' | 'none' | ((event: AuditEvent) => unknown);
+    readonly redactInput?: 'all' | 'shape' | 'none' | ((event: AuditEvent) => unknown);
     /**
      * What happens to `AuditEvent.subject` before it is handed to the sink.
      *
      *   - `'metadata'` (DEFAULT) — `subject.metadata` is replaced by
      *     `{ __redacted: 'all' }`. `type`, `id`, `tenantId` and `scopes` survive,
      *     which is everything the trail is actually read for.
+     *   - `'metadata-shape'` — the same, but `metadata`'s STRUCTURE survives
+     *     instead of nothing. Useful for the case this whole option exists for:
+     *     seeing THAT a credential-shaped value sits in the bag, and how long it
+     *     is, without recording it.
      *   - `'none'` — the subject verbatim. What every sink did before this option
      *     existed.
      *   - a function — `(subject) => unknown`, for field-level control.
@@ -379,8 +387,18 @@ export declare interface AuditPluginOptions {
      * `resolveScope` still sees the LIVE subject, so a scope derived from
      * `metadata` keeps working — redaction applies to what is STORED, not to what
      * the plugin can compute.
+     *
+     * KNOWN DEBT, on the DEFAULT. An impersonation mark lives in `metadata`, so
+     * under `'metadata'` a durable trail records an impersonated action
+     * indistinguishably from the user's own — the one distinction an audit trail
+     * exists to make. `impersonationAuditRedactor()` plus an always-on grant row
+     * mitigates it, and `'metadata-shape'` narrows it further (the KEY survives,
+     * so the row at least says an impersonation mark was there). Neither is the
+     * fix. The fix is a keep-these-keys option, or a first-class
+     * `AuditEvent.impersonation` field that the redactors cannot reach — because
+     * "who really did this" is not app-controlled metadata, it is the event.
      */
-    readonly redactSubject?: 'metadata' | 'none' | ((subject: Subject) => unknown);
+    readonly redactSubject?: 'metadata' | 'metadata-shape' | 'none' | ((subject: Subject) => unknown);
     /**
      * What happens to `AuditEvent.outcome`'s payload before it is handed to the
      * sink.
@@ -388,6 +406,10 @@ export declare interface AuditPluginOptions {
      *   - `'all'` (DEFAULT) — `outcome.value` on success, and `outcome.error` on
      *     failure, are replaced by `{ __redacted: 'all' }`. `kind`, `durationMs`
      *     and the error's TAG survive, which is what the trail is read for.
+     *   - `'shape'` — the STRUCTURE survives instead of nothing. This is the
+     *     option a consumer asked for after a day spent on a bug their own trail
+     *     could have ended: a value arrived as 113 characters where 44 were due,
+     *     and the row that would have said so read `{"__redacted":"all"}`.
      *   - `'none'` — the outcome verbatim. What every sink did before this
      *     option existed.
      *   - a function — `(event) => unknown`, for field-level control.
@@ -419,7 +441,7 @@ export declare interface AuditPluginOptions {
      * A `record` predicate still sees the LIVE outcome, so a filter that keys on
      * the result keeps working — redaction applies to what is STORED.
      */
-    readonly redactOutcome?: 'all' | 'none' | ((event: AuditEvent) => unknown);
+    readonly redactOutcome?: 'all' | 'shape' | 'none' | ((event: AuditEvent) => unknown);
 }
 
 /** The narrow read surface the entry points need. */

package/dist/index.js

@@ -4,8 +4,26 @@ import { definePlugin as n, pluginInstanceName as r } from "@voltro/protocol";
 import { createLogger as i } from "@voltro/logger";
 import { and as a, eq as o, id as s, integer as c, json as l, registerRetention as u, resolveActorSnapshot as d, retentionTtlMsFromEnv as f, table as p, text as m, timestamp as h } from "@voltro/database";
 import { createHash as g, createHmac as _, randomBytes as v } from "node:crypto";
-//#region src/tableName.ts
-var y = "_voltro_audit_log", b = [
+//#region src/redactionShape.ts
+var y = 4, b = 32, x = 64, S = /^[A-Za-z_$][A-Za-z0-9_$]*$/, C = (e) => e.length <= x && S.test(e) ? e : `<key:string(${e.length})>`, w = (e, t = 0) => {
+	if (e === null) return "null";
+	if (e === void 0) return "undefined";
+	let n = typeof e;
+	if (n === "string") return `string(${e.length})`;
+	if (n === "number" || n === "boolean" || n === "bigint" || n === "symbol" || n === "function") return n;
+	if (e instanceof Date) return "date";
+	if (t >= y) return Array.isArray(e) ? "array(…)" : "object(…)";
+	if (Array.isArray(e)) {
+		let n = e.slice(0, b).map((e) => w(e, t + 1));
+		return e.length > b ? [...n, `…${e.length - b} more`] : n;
+	}
+	if (n === "object") {
+		let n = Object.entries(e), r = {};
+		for (let [e, i] of n.slice(0, b)) r[C(e)] = w(i, t + 1);
+		return n.length > b && (r["…"] = `${n.length - b} more key(s)`), r;
+	}
+	return n;
+}, T = (e) => ({ __redacted: w(e) }), E = "_voltro_audit_log", D = [
 	"tag",
 	"at",
 	"subjectId",
@@ -20,26 +38,26 @@ var y = "_voltro_audit_log", b = [
 	"input",
 	"outcome",
 	"errorTag"
-], x = (e) => {
+], O = (e) => {
 	if (e == null) return "null";
 	if (e instanceof Date) return JSON.stringify(e.toISOString());
 	let t = typeof e;
-	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(x).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${x(t)}`).join(",")}}` : JSON.stringify(String(e));
-}, S = (e) => e instanceof Date ? e.toISOString() : e, C = (e) => x(Object.fromEntries(b.map((t) => [t, S(e[t] ?? null)]))), w = (e) => {
+	return t === "number" || t === "boolean" || t === "string" ? JSON.stringify(e) : t === "bigint" ? JSON.stringify(String(e)) : Array.isArray(e) ? `[${e.map(O).join(",")}]` : t === "object" ? `{${Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t)).map(([e, t]) => `${JSON.stringify(e)}:${O(t)}`).join(",")}}` : JSON.stringify(String(e));
+}, k = (e) => e instanceof Date ? e.toISOString() : e, A = (e) => O(Object.fromEntries(D.map((t) => [t, k(e[t] ?? null)]))), j = (e) => {
 	let t = process.env.VOLTRO_AUDIT_CHAIN_SECRET;
 	return t ? _("sha256", t).update(e, "utf8").digest("hex") : g("sha256").update(e, "utf8").digest("hex");
-}, T = (e, t) => w(JSON.stringify([
+}, M = (e, t) => j(JSON.stringify([
 	t.chainId,
 	t.seq,
 	t.prevHash,
-	C(e)
-])), E = (e = v(12).toString("base64url")) => {
+	A(e)
+])), N = (e = v(12).toString("base64url")) => {
 	let t = 0, n = null;
 	return {
 		chainId: e,
 		link: (r) => {
 			t += 1;
-			let i = T(r, {
+			let i = M(r, {
 				chainId: e,
 				seq: t,
 				prevHash: n
@@ -53,9 +71,9 @@ var y = "_voltro_audit_log", b = [
 			return n = i, a;
 		}
 	};
-}, D = async (e, t = {}) => {
+}, P = async (e, t = {}) => {
 	let n = t.chainId === void 0 ? void 0 : o("chainId", t.chainId), r = await e.query({
-		table: y,
+		table: E,
 		...n ? { predicate: n } : {},
 		order: [{
 			column: "chainId",
@@ -97,7 +115,7 @@ var y = "_voltro_audit_log", b = [
 			chainId: t,
 			seq: l.last + 1,
 			detail: `chain jumps from seq ${l.last} to ${a} — ${a - l.last - 1} row(s) missing`
-		}), l.last = a, l.tip = n), T(e, {
+		}), l.last = a, l.tip = n), M(e, {
 			chainId: t,
 			seq: a,
 			prevHash: o
@@ -117,7 +135,7 @@ var y = "_voltro_audit_log", b = [
 		issues: i,
 		keyed: !!process.env.VOLTRO_AUDIT_CHAIN_SECRET
 	};
-}, O = p(y, {
+}, F = p(E, {
 	id: s({ prefix: "audit" }),
 	tag: m(),
 	at: h(),
@@ -145,7 +163,7 @@ var y = "_voltro_audit_log", b = [
 	"tenantId",
 	"status",
 	"at"
-]).index("byAuditChain", ["chainId", "seq"]), k = [O], A = (e) => ({
+]).index("byAuditChain", ["chainId", "seq"]), I = [F], L = (e) => ({
 	tag: e.tag,
 	at: new Date(e.ts),
 	subjectId: e.subject.id ?? null,
@@ -159,22 +177,22 @@ var y = "_voltro_audit_log", b = [
 	metadata: e.metadata ?? null,
 	input: e.input,
 	outcome: e.outcome,
-	errorTag: e.outcome.kind === "error" ? j(e.outcome.error) : null
-}), j = (e) => {
+	errorTag: e.outcome.kind === "error" ? R(e.outcome.error) : null
+}), R = (e) => {
 	if (typeof e != "object" || !e) return null;
 	let t = e._tag;
 	return typeof t == "string" && t !== "" ? t : null;
-}, M = async (e, t) => e.query({
-	table: y,
+}, z = async (e, t) => e.query({
+	table: E,
 	predicate: o("traceId", t),
 	order: [{
 		column: "at",
 		direction: "asc"
 	}]
-}), N = async (e, t, n = {}) => {
+}), B = async (e, t, n = {}) => {
 	let r = o("subjectId", t);
 	return e.query({
-		table: y,
+		table: E,
 		predicate: n.status === void 0 ? r : a(r, o("status", n.status)),
 		order: [{
 			column: "at",
@@ -182,20 +200,20 @@ var y = "_voltro_audit_log", b = [
 		}],
 		take: n.limit ?? 100
 	});
-}, P = (e) => {
-	let t = E();
+}, V = (e) => {
+	let t = N();
 	return async (n) => {
 		let r = n.actor !== void 0 || typeof e.query != "function" ? n : {
 			...n,
 			actor: await d(e, n.subject.id ?? null, n.subject.type)
 		};
-		await e.insert(y, t.link(A(r)));
+		await e.insert(E, t.link(L(r)));
 	};
-}, F = i({ scope: "@voltro/plugin-audit" }), I = 1e3, L = [], R = () => [...L], z = () => {
-	L.length = 0;
-}, B = (e) => {
-	L.push(e), L.length > I && L.splice(0, L.length - I);
-}, V = (e) => {
+}, H = i({ scope: "@voltro/plugin-audit" }), U = 1e3, W = [], G = () => [...W], K = () => {
+	W.length = 0;
+}, q = (e) => {
+	W.push(e), W.length > U && W.splice(0, W.length - U);
+}, J = (e) => {
 	let t = e.subject.id ? `${e.subject.type}:${e.subject.id}` : e.subject.type, n = e.outcome.kind === "ok" ? "ok" : "error", r = {
 		subject: t,
 		tenant: e.subject.tenantId ?? null,
@@ -203,8 +221,8 @@ var y = "_voltro_audit_log", b = [
 		durationMs: e.outcome.durationMs,
 		traceId: e.traceId
 	};
-	n === "error" ? F.warn(e.tag, r) : F.info(e.tag, r);
-}, H = (e, n) => typeof e == "function" ? (n) => t.suspend(() => {
+	n === "error" ? H.warn(e.tag, r) : H.info(e.tag, r);
+}, Y = (e, n) => typeof e == "function" ? (n) => t.suspend(() => {
 	let r = e(n);
 	return r === void 0 ? t.void : t.isEffect(r) ? r : t.tryPromise({
 		try: () => Promise.resolve(r),
@@ -216,7 +234,7 @@ var y = "_voltro_audit_log", b = [
 		try: () => r(e),
 		catch: (e) => e
 	}) : t.void;
-}) : e === "memory" ? (e) => t.sync(() => B(e)) : (e) => t.sync(() => V(e)), U = (e) => {
+}) : e === "memory" ? (e) => t.sync(() => q(e)) : (e) => t.sync(() => J(e)), X = (e) => {
 	let t = [], n = [], r = (e) => {
 		if (e._tag !== "Empty") {
 			if (e._tag === "Fail") {
@@ -240,42 +258,48 @@ var y = "_voltro_audit_log", b = [
 		}
 	};
 	return r(e), t[0] ?? n[0] ?? e;
-}, W = "@voltro/plugin-audit", G = (e = {}) => {
+}, Z = "@voltro/plugin-audit", Q = (e = {}) => {
 	let i = e.sink === "datastore";
 	i && u({
 		source: "plugin",
-		table: y,
+		table: E,
 		timeColumn: "at",
 		ttlMs: f(process.env.VOLTRO_AUDIT_LOG_TTL_HOURS, 24 * 365)
 	});
-	let a, o = H(e.sink, () => a), s = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), c = s(e.exclude), l = s(e.include), d = (e) => !(c?.test(e) || l && !l.test(e)), p = (t) => {
+	let a, o = Y(e.sink, () => a), s = (e) => e === void 0 || !e.global && !e.sticky ? e : new RegExp(e.source, e.flags.replace(/[gy]/g, "")), c = s(e.exclude), l = s(e.include), d = (e) => !(c?.test(e) || l && !l.test(e)), p = (t) => {
 		let n = e.record ?? "all";
 		return n === "all" ? !0 : n === "errors" ? t.outcome.kind === "error" : n(t);
 	}, m = { __redacted: "all" }, h = (t) => {
 		let n = e.redactInput ?? "all";
-		return n === "none" ? t : {
+		return n === "none" ? t : n === "all" ? {
 			...t,
-			input: n === "all" ? m : n(t)
+			input: m
+		} : n === "shape" ? {
+			...t,
+			input: T(t.input)
+		} : {
+			...t,
+			input: n(t)
 		};
 	}, g = (t) => {
 		let n = e.redactOutcome ?? "all";
 		if (n === "none") return t;
-		let r = n === "all" ? m : n(t), i = t.outcome;
-		if (i.kind === "ok") return {
+		let r = t.outcome, i = n === "all" ? m : n === "shape" ? ((e) => T(e))(r.kind === "ok" ? r.value : r.error) : n(t);
+		if (r.kind === "ok") return {
 			...t,
 			outcome: {
-				...i,
-				value: r
+				...r,
+				value: i
 			}
 		};
-		let a = i.error, o = typeof a == "object" && a ? a._tag : void 0;
+		let a = r.error, o = typeof a == "object" && a ? a._tag : void 0;
 		return {
 			...t,
 			outcome: {
-				...i,
-				error: o === void 0 ? r : {
+				...r,
+				error: o === void 0 ? i : {
 					_tag: o,
-					...r
+					...i
 				}
 			}
 		};
@@ -288,22 +312,22 @@ var y = "_voltro_audit_log", b = [
 		};
 		let r = t.subject;
 		if (r.metadata === void 0) return t;
-		let { metadata: i, ...a } = r;
+		let { metadata: i, ...a } = r, o = n === "metadata-shape" ? T(i) : m;
 		return {
 			...t,
 			subject: {
 				...a,
-				metadata: m
+				metadata: o
 			}
 		};
-	}, v = (e) => p(e) ? o(g(_(h(e)))) : t.void, b = (t) => {
+	}, v = (e) => p(e) ? o(g(_(h(e)))) : t.void, y = (t) => {
 		if (e.resolveScope !== void 0) try {
 			return e.resolveScope(t);
 		} catch {
 			return;
 		}
-	}, x = (e, n) => d(n.tag) ? t.suspend(() => {
-		let r = Date.now(), i = b(n);
+	}, b = (e, n) => d(n.tag) ? t.suspend(() => {
+		let r = Date.now(), i = y(n);
 		return e.pipe(t.tap((e) => v({
 			ts: r,
 			tag: n.tag,
@@ -325,17 +349,17 @@ var y = "_voltro_audit_log", b = [
 			input: n.input,
 			outcome: {
 				kind: "error",
-				error: U(e),
+				error: X(e),
 				durationMs: Date.now() - r
 			}
 		}).pipe(t.catchAllCause(() => t.void))));
-	}) : e, S = x, C = x, w = x;
+	}) : e, x = b, S = b, C = b;
 	return n({
 		name: r({
-			base: W,
+			base: Z,
 			alias: e.alias
 		}),
-		baseName: W,
+		baseName: Z,
 		description: "Records every mutation invocation; ships an audit() schema mixin for row-level metadata.",
 		permissions: [
 			"rpc:intercept:mutation",
@@ -344,15 +368,15 @@ var y = "_voltro_audit_log", b = [
 			...e.recordQueries === !0 ? ["rpc:intercept:query"] : []
 		],
 		...i ? {
-			...e.tables === !1 ? {} : { extendSchema: { tables: k } },
+			...e.tables === !1 ? {} : { extendSchema: { tables: I } },
 			bindDataStore: (e) => {
-				a = P(e);
+				a = V(e);
 			}
 		} : {},
-		interceptMutation: S,
-		interceptAction: C,
-		...e.recordQueries === !0 ? { interceptQuery: w } : {}
+		interceptMutation: x,
+		interceptAction: S,
+		...e.recordQueries === !0 ? { interceptQuery: C } : {}
 	});
 };
 //#endregion
-export { y as AUDIT_LOG_TABLE, e as audit, N as auditBySubject, M as auditByTrace, A as auditEventToRow, O as auditLogTable, k as auditLogTables, G as auditPlugin, T as auditRowHash, z as clearAuditBuffer, P as dataStoreAuditSink, E as makeAuditChain, R as readAuditBuffer, D as verifyAuditChain };
+export { E as AUDIT_LOG_TABLE, e as audit, B as auditBySubject, z as auditByTrace, L as auditEventToRow, F as auditLogTable, I as auditLogTables, Q as auditPlugin, M as auditRowHash, K as clearAuditBuffer, V as dataStoreAuditSink, N as makeAuditChain, G as readAuditBuffer, P as verifyAuditChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-audit",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Audit plugin — ships the `audit()` schema mixin (createdAt/updatedAt/createdBy/updatedBy → Actor) plus an optional mutation interceptor that records every call to a configurable sink (console / memory / custom function).",
   "keywords": [
     "voltro",
@@ -38,9 +38,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.36.0",
-    "@voltro/logger": "0.36.0",
-    "@voltro/protocol": "0.36.0"
+    "@voltro/database": "0.37.0",
+    "@voltro/logger": "0.37.0",
+    "@voltro/protocol": "0.37.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"