@voltro/cli 0.11.1 → 0.11.3

package/CHANGELOG.md

@@ -39,6 +39,99 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.11.3] — 2026-07-24
+
+### Added
+
+- **@voltro/runtime** — `crud.*` secure-default CRUD handler helpers + `redactColumns` (A1 core). Each returns an executor you export as a `*.query.server.ts` / `*.mutation.server.ts` default — the descriptor (schemas + `guards`) stays hand-written and browser-safe:
+
+  ```ts
+  // accounts.list.query.server.ts
+  import { crud } from '@voltro/runtime'
+  export default crud.list('accounts', { redact: ['apiSecret'] })
+  ```
+
+  They bake in the invariants a hand-rolled CRUD generator kept getting wrong (the leak class was in the HANDLERS, not the schemas):
+
+  - **Tenant scope** — `list` / `getById` read through `ctx.store`, which auto-scopes a `tenant()` table; they never `.unscoped()`, so a cross-tenant read is impossible. - **Redaction** — `redact` columns are stripped from every returned row (a credential / secret / salary a read must never ship), on reads AND on the row a `create` / `update` echoes. `redactColumns(rows, cols)` is exported standalone for a hand-written handler that isn't plain CRUD. - **`getById` returns `null`, never throws** — a reactive getter that throws stalls its shared-WS siblings (pairs with the per-subscription error isolation).
+
+  What they deliberately DON'T do is authorize: a guard runs before the executor, so gating stays on the DESCRIPTOR (`guards: [...]`) — an executor can't gate itself. Keep write descriptors guarded.
+
+  Scope note: this is the browser-safe, codegen-free core. Deriving the descriptor SCHEMAS from a table (to drop the hand-written `Schema.Struct`) is structurally a codegen concern — a table VALUE can't be imported into a browser-loaded descriptor (it drags the store into the bundle; `rowSchema` is server-only for exactly this reason) — so full schema-derivation + a `.crud()` boot audit for the scope/gating discipline are a separate, planned pass. See `plans/framework-a1-defineCrud.md`.
+- **@voltro/runtime** — `ctx.store.links(junctionTable, anchor)` — a diff-based writer for a many-to-many JUNCTION table (A2). It reconciles the links from one anchor row against a target-id list by writing only the DIFFERENCE:
+
+  ```ts
+  await ctx.store.links('post_tags', { postId: post.id }).set(tagIds) // add missing, remove surplus
+  await ctx.store.links('post_tags', { postId: post.id }).add([tagId]) // idempotent
+  await ctx.store.links('post_tags', { postId: post.id }).remove([tagId])
+  await ctx.store.links('post_tags', { postId: post.id }).list()      // current target ids
+  ```
+
+  Why it belongs in the framework rather than every app: a drop-all-then-reinsert `setLinks` loses data when two writers overlap and makes a reactive subscription on the junction churn every row (flicker) even when nothing changed. `links().set()` touches only the rows that actually differ — the added are inserted, the removed deleted, the unchanged left in place — so a reactive consumer sees a change only for what changed, and `set()` returns `{ added, removed }`. `add`/`remove` are likewise idempotent (they read first and act only on the genuine delta).
+
+  `anchor` names the source column and its id (`{ postId: 'p1' }`); the target column is the junction's OTHER `reference()` column, auto-detected. A junction with anything but exactly two reference columns is refused with a message naming what it found — use plain `insertMany`/`deleteMany` for a non-standard junction. The writes go through the normal stamped/tenant-scoped store path, so tenant and audit columns are filled as usual. Additive: a new `links` method on `FluentStore` + the `JunctionLinks` interface.
+- **@voltro/client, @voltro/web** — `useSubscription(..., { initialSnapshot })` — the last mile of "SSR-correct first paint, then live" (A5). Pass the value an SSR loader already fetched with `ctx.query` (read it in the component with `useLoaderData()`) and the subscription shows it at the first paint with `loading: false` — it IS real server data — then swaps to the live stream the instant its first snapshot arrives:
+
+  ```tsx
+  const seed = useLoaderData<Employee>()
+  const { data } = useSubscription('app', 'employees.me', {}, { initialSnapshot: seed })
+  ```
+
+  The SSR markup and the hydration render read the same loader value, so they match (no hydration flicker), and the app no longer hand-builds a seed store to bridge loader data into the first render. This is the difference from `fallback`, whose value never came from the server and so keeps `loading: true`; use exactly one of the two. Like `fallback`, `initialSnapshot` guarantees `data` is present, so the call gets the non-union result and needs no `loading` branch. Additive: a new `initialSnapshot` field on `SubscriptionOptions` + an overload; `@voltro/web` re-exports the client surface.
+- **@voltro/cli** — `apis.<name>.authHeaders` in a web `app.config.ts` — a declarative per-reconnect auth-header resolver, so an authenticated split-origin web app no longer hand-mounts `VoltroRuntimeProvider` just to inject a rotating-token thunk (A4). The framework owns the client mount, the reconnect re-resolve, and the SSR-null case (the resolver runs browser-only — it never fires on the server):
+
+  ```ts
+  // app.config.ts
+  apis: {
+    api: {
+      package: '@app/api',
+      authHeaders: async () => ({ authorization: `Bearer ${await getToken()}` }),
+    },
+  }
+  ```
+
+  Because it's a FUNCTION, the codegen imports it from `app.config.ts` into the client bundle rather than serializing it — so a config that declares `authHeaders` must stay browser-safe (no `node:*` / server-only value imports; a pure env schema is fine, and tree-shakes out). It supersedes a static `headers` on the same api. The provider already resolved a `ResolvableHeaders` thunk fresh per connection generation; this just lets you declare it in config instead of hand-writing a `mount()` call.
+
+---
+
+## [0.11.2] — 2026-07-24
+
+### Added
+
+- **@voltro/i18n** — Two escapes for adopting typed messages (`createTypedMessages`, #16) app-wide (#19):
+
+  - **`t.dynamic(runtimeKey, values?)`** — a first-class escape for a genuinely runtime-computed key, on both `useT` and the `useTFn()` result. It takes a plain string with NO forced ICU args, so it doesn't fight the strict literal-key surface. Until now the natural escape — casting a computed key to the catalog key union — made things WORSE: that union spans placeholder-bearing keys, so the call then demanded a spurious 2nd ICU arg. `t.dynamic` is the documented, discoverable alternative. - **`LooseTFunction`** — the widened `(id: string, values?) => string` signature to type a `t` pass-through across a package boundary that can't import the app catalog, instead of falling back to `(...args: any[]) => string`. A strict `TypedTFunction` is deliberately NOT assignable to it (a narrowed key param can't satisfy a wider one — that would erase the checking); pass `t.dynamic` at the boundary, which IS a `LooseTFunction`.
+
+  Additive: `TypedTFunction<C>` gains a `.dynamic` member (the callable surface is unchanged, so `Parameters<TypedTFunction<C>>[0]` and existing typed call sites still resolve). `createTypedMessages` attaches `.dynamic` in place on the two translate functions — no new per-render closure, so a captured `t`'s identity stays stable.
+- **@voltro/testing, @voltro/database** — `fixtureRow(table, overrides)` (`@voltro/testing`) completes a partial test row so it satisfies the 0.11.1 required-column insert validation — WITHOUT disabling the check. It fills every NOT-NULL, no-default, non-auto-stamped column the payload omits with a schema-typed placeholder (a `oneOf` column takes its first allowed value; a `unique` column gets a distinct value per call so two fixtures don't collide; `timestamp`/`date` get a fixed epoch), then merges your overrides on top (an explicit value always wins). It leaves out exactly what a caller may omit — nullable, defaulted, and framework auto-stamped columns (id / tenant / audit) — and refuses to guess a structured type (`json` / `bytes` / `vector` / `array` / `interval` / `raw`), throwing a message that names the column and says to pass it explicitly.
+
+  The motivating case: 0.11.1 made the in-memory/test store reject the same partial inserts real Postgres always would (correct — it surfaced a latent prod bug), which turned lean fixtures (`insert(users, { id })`, an omitted required FK) into `TableValidationFailed`. The wrong fix is a `validateInserts: false` knob — it re-hides that bug class, and a test store laxer than production is a fake testing itself. `fixtureRow` is the right one: it makes the fixture COMPLETE.
+
+  ```ts
+  await ctx.store.insert('journal_entries', fixtureRow(journalEntries, {
+    tenantId, amount: '100.00',   // the columns THIS test cares about
+  }))                             // entryNumber, postedAt, … auto-filled + unique
+  ```
+
+  It is a runtime filler for the loose `store.insert(name, row)` path (what fixtures use). For COMPILE-time payload typing, use `insertRow` / `upsertRow` from `@voltro/database`. The auto-stamped column set it skips is now exported as `AUTO_FILLED_COLUMNS` from `@voltro/database` — the same list `InferInsertRow` derives its optional columns from, single-sourced so the two can't drift.
+
+### Changed
+
+- **@voltro/cli** — `voltro build` now emits **directly-executable** boot bundles for BOTH app kinds: the web start bundle (`.framework/dist-web/startBundle/startEntry.js`) and the api serve bundle (`.framework/dist-api/serveBundle/serveEntry.js`) each carry a main-guard that boots the app when run as `node <entry>.js`, and stays inert when imported (the `voltro start` / `voltro serve` dev fast paths are unchanged). Production containers can now use `CMD ["node", "…/startEntry.js"]` (or `serveEntry.js`) instead of `pnpm voltro start` / `pnpm voltro serve` — no pnpm process, no `@voltro/cli` bin at runtime — which is what makes `voltro prune-runtime` safe to enable on both: with the self-contained bundle as the real entrypoint, the @vercel/nft trace roots there and legitimately drops `@voltro/cli` and the whole inlined framework tree (a static site's `node_modules` collapses to ~0; a memory api's 146 MB → 11 MB). `prune-runtime` now also roots the trace at the serve bundle. The serve entry chdir's to the app root BEFORE its app-module registry keys are computed from cwd, preserving relocation-safety. Existing `pnpm voltro start` / `pnpm voltro serve` entrypoints keep working. The standalone Dockerfiles gain a build-time boot smoke that fails the build unless the pruned tree reaches ready.
+
+### Fixed
+
+- **@voltro/i18n** — `createTypedMessages` (#16) no longer extracts phantom required vars from a nested plural/select message (#19). For `'{count, plural, one {# day} other {# days total duration}}'`, the type-level `ICUVars` parse was reading a branch's TEXT (`"# days total duration"`) as a bogus required arg name, so `useT('key', { count })` failed to typecheck even though it renders perfectly — and a real var nested inside a branch was dropped. `ICUArgName` now resolves to `never` for any candidate that isn't a valid ICU identifier (`^[A-Za-z0-9_]+$`), so branch text — which contains spaces / `#` / `—` — is never mistaken for a var. Only the top-level arg (`count`) is required, matching what the message actually needs.
+
+  Scope note: a REAL var nested inside a plural branch (`other {# — {discipline}}`) is still not collected, so it reads as not-required rather than wrongly-required — the safe direction. Apps that pluralise in JS over simple `{count}` messages (the Voltro idiom) were already fully typed and are unaffected.
+- **@voltro/database, @voltro/runtime** — `InferInsertRow` (and thus `insertRow` / `upsertRow`, #15) no longer requires a non-nullable DB-generated (`generatedAs`) column (#20). A stored/virtual generated column declared without `.nullable()` and without a default was typed **required**, but MariaDB/Postgres REJECT an explicit value for a generated column — so the type forced the caller to pass a value the database refuses at runtime. `.generatedAs()` now marks the column optional-for-insert exactly like a `.default()` column (the DB supplies it), so it may be omitted; the whole payload guard on every real column stays intact.
+
+  Two runtime halves complete it, so the loose `store.insert(name, row)` path agrees: the required-column validation (`missingRequiredColumns`) skips generated columns — omitting one is correct, never a missing-column error — and the store write path now STRIPS any value a caller supplied for a generated column before the INSERT reaches the dialect (tracked on the schema registry as `generatedColumns`), so a value from an untyped insert can't blow up on MariaDB. A generated column is never caller-supplied; the framework and the DB own it end to end.
+
+  The `.generatedAs()` return type narrows from `this` to `ColumnBuilder<…, true>` (the HasDefault flag) — a purely more-permissive refinement: it only makes the column omittable, so no existing code stops compiling.
+
+---
+
 ## [0.11.1] — 2026-07-23
 
 ### Added
@@ -71,6 +164,8 @@ _Changes staged for the next release accumulate here (rolled up from
 - **@voltro/database, @voltro/runtime** — `store.insert` / `upsert` / `insertIgnore` now raise a clear, typed `TableValidationFailed` naming the column when the payload omits one that is NOT NULL, has no default, and isn't auto-stamped — instead of a raw dialect `SqlError: Failed to execute statement` (`Field '…' doesn't have a default value`) surfaced only on the INSERT path (so it lay dormant until the first row with no existing cache entry). An upsert / insertIgnore whose payload is missing one of its own `conflictColumns` is likewise named at the call (an absent conflict key can't match its target). The check runs AFTER stamping, so auto-id / tenant / audit columns never trip it, and skips nullable, defaulted, and id (`idScheme`) columns — exactly the ones a caller may legitimately omit.
 
   Two pure helpers back it — `missingRequiredColumns(table, row)` and `missingConflictColumns(conflictColumns, row)` (exported from `@voltro/database`). This is the runtime half of the "handler data silently disagrees with the schema" class; a compile-time payload type needs the column DSL to track `hasDefault` at the type level, which is a separate change.
+
+  **Migration impact — behaviour-breaking for lenient test fixtures.** The in-memory/test store now rejects the same partial inserts a real Postgres always would, so it stops being laxer than production — which is the point (it surfaced at least one latent prod bug where a NOT-NULL `text().unique()` column was written without a value). But a fixture that inserted a partial row (`{ id }` parents, an omitted required FK) and passed against the old lenient memory store now throws `TableValidationFailed`. There is no code-level codemod — the fix is fixture DATA: fill the required columns. Use the new `fixtureRow(table, overrides)` helper in `@voltro/testing`, which fills every NOT-NULL-no-default column with a schema-typed placeholder and merges your overrides on top, so a fixture complies without disabling the check. There is deliberately no opt-out to turn the validation off: a test store that accepts rows production rejects is a fake testing itself.
 - **@voltro/database, @voltro/plugin-ai-flows, @voltro/plugin-audit, @voltro/plugin-deactivation, @voltro/plugin-soft-delete** — Compile-time payload typing for writes (#15) — the type-level half that the runtime `TableValidationFailed` guard flagged as a separate change. `insertRow` / `upsertRow` take the TABLE OBJECT (not a string name), so the payload is checked against `InferInsertRow<T>`: every column is required EXCEPT nullable ones, columns with a default, and the framework-filled id/tenant/audit columns. A missing NOT-NULL-no-default column — the exact `lastRefreshedAt` / `teamId` omission from the report — is now a COMPILE error at the call, not a runtime SqlError only on the INSERT path; `upsertRow`'s `conflictColumns` are constrained to the table's own columns too.
 
   import { insertRow } from '@voltro/database' await insertRow(ctx.store, roadmapEpicStats, { teamId, lastRefreshedAt: new Date() })

package/dist/apiBuild-BmPdmhgi.js

@@ -0,0 +1,2 @@
+import { a as e, o as t } from "./apiBuild-zFDv0u8y.js";
+export { e as runApiBuild, t as runServeBundleBuild };

package/dist/{apiBuild-D_kEJTxc.js → apiBuild-zFDv0u8y.js}

@@ -1,5 +1,5 @@
-import { Mt as e } from "./inspectMetrics-BuBwg1yW.js";
-import { d as t, lt as n } from "./dev-zJGsTTNb.js";
+import { Mt as e } from "./inspectMetrics-SRtv8KDy.js";
+import { d as t, lt as n } from "./dev-CGt0PP1f.js";
 import { isAbsolute as r, join as i, relative as a, resolve as o } from "node:path";
 import { createLogger as s } from "@voltro/logger";
 import { existsSync as c, promises as l } from "node:fs";
@@ -153,15 +153,19 @@ const drivers = ${JSON.stringify(t)}\nlet mod\nfor (const d of drivers) {\n  try
 		...c(_) ? { tsconfig: _ } : {}
 	}), y = Object.keys(v.metafile.inputs).map((e) => o(t, e)).filter((e) => e.startsWith(`${t}/`) && !e.includes("/node_modules/") && !e.includes("/.framework/") && m(e)), b = await f(t), x = /* @__PURE__ */ new Set(), S = [
 		"// GENERATED BY `voltro build` — do not edit; overwritten on next build.",
-		"import { join as __join } from 'node:path'",
+		"import { join as __join, dirname as __dirname, resolve as __resolve } from 'node:path'",
+		"import { pathToFileURL as __pathToFileURL, fileURLToPath as __fileURLToPath } from 'node:url'",
 		"import { runServe as __runServe, registerAppModules, registerDriver, loadDotEnv } from '@voltro/cli/serveEntry'",
 		...b.map((e, t) => `import * as __drv${t} from ${JSON.stringify(e)}`),
+		"const __isMain = Boolean(process.argv[1]) && import.meta.url === __pathToFileURL(process.argv[1]).href",
+		"if (__isMain) process.chdir(__resolve(__dirname(__fileURLToPath(import.meta.url)), '..', '..', '..'))",
 		"const __root = process.cwd()",
 		"registerAppModules({",
 		...y.map((e) => `  [__join(__root, ${JSON.stringify(a(t, e))})]: () => import(${JSON.stringify(e)}),`),
 		"})",
 		...b.map((e, t) => `registerDriver(${JSON.stringify(e)}, __drv${t})`),
 		"export const runServe = (args = []) => { loadDotEnv([]); return __runServe(args) }",
+		"if (__isMain) runServe(process.argv.slice(2)).then((c) => process.exit(typeof c === 'number' ? c : 0))",
 		""
 	], w = i(r, "serveEntry.ts");
 	return await l.writeFile(w, S.join("\n"), "utf8"), await n.build({

package/dist/bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { bt as e } from "./inspectMetrics-BuBwg1yW.js";
-import { n as t } from "./commands-BiQsbV50.js";
+import { bt as e } from "./inspectMetrics-SRtv8KDy.js";
+import { n as t } from "./commands-BDGYrBhK.js";
 import { createLogger as n } from "@voltro/logger";
 //#region src/bin.ts
 var r = n({ scope: "voltro:cli" }), i = process.argv.slice(2);

package/dist/{commands-BiQsbV50.js → commands-BDGYrBhK.js}

@@ -1,9 +1,9 @@
-import { At as e, D as t, Dt as n, F as r, Ft as i, It as a, K as o, M as s, Mt as c, N as l, Nt as u, Ot as d, P as f, Pt as p, T as m, a as h, b as g, c as _, d as v, f as y, jt as ee, k as b, kt as te, n as ne, o as re, p as ie, s as ae, u as oe, v as se, w as ce, x as le, y as ue } from "./inspectMetrics-BuBwg1yW.js";
-import { B as de, K as fe, L as pe, R as me, V as he, ct as ge, i as _e, l as ve, n as ye, o as be, p as xe, rt as Se, tt as Ce, ut as we, z as Te } from "./dev-zJGsTTNb.js";
+import { At as e, D as t, Dt as n, F as r, Ft as i, It as a, K as o, M as s, Mt as c, N as l, Nt as u, Ot as d, P as f, Pt as p, T as m, a as h, b as g, c as _, d as v, f as y, jt as ee, k as b, kt as te, n as ne, o as re, p as ie, s as ae, u as oe, v as se, w as ce, x as le, y as ue } from "./inspectMetrics-SRtv8KDy.js";
+import { B as de, K as fe, L as pe, R as me, V as he, ct as ge, i as _e, l as ve, n as ye, o as be, p as xe, rt as Se, tt as Ce, ut as we, z as Te } from "./dev-CGt0PP1f.js";
 import { a as x, c as Ee, i as De, o as Oe, s as ke } from "./devActivity-1WtIVyHc.js";
-import { i as Ae, n as je, s as Me, t as Ne } from "./apiBuild-D_kEJTxc.js";
-import { t as Pe } from "./start-ChN6PO-c.js";
-import { n as Fe, r as Ie } from "./serveCommand-BU454-ay.js";
+import { i as Ae, n as je, s as Me, t as Ne } from "./apiBuild-zFDv0u8y.js";
+import { t as Pe } from "./start-Crl39M38.js";
+import { n as Fe, r as Ie } from "./serveCommand-p6e5Ahgx.js";
 import { basename as S, dirname as C, isAbsolute as Le, join as w, relative as T, resolve as E, sep as Re } from "node:path";
 import { fileURLToPath as ze, pathToFileURL as Be } from "node:url";
 import { FileSystem as Ve } from "@effect/platform";
@@ -282,8 +282,25 @@ external scheduler owns the once-only guarantee.
 	return await N.writeFile(o, [
 		"// GENERATED BY `voltro build` — do not edit; overwritten on next build.",
 		"import { runStartCommand as __run, loadDotEnv } from '@voltro/cli/startEntry'",
+		"import { pathToFileURL, fileURLToPath } from 'node:url'",
+		"import { dirname, resolve } from 'node:path'",
 		"export const runStartCommand = (args = []) => { loadDotEnv([]); return __run(args) }",
 		"export { loadDotEnv }",
+		"",
+		"// DIRECT-INVOKE ENTRY. `node startEntry.js` is the PRODUCTION container command",
+		"// — no `pnpm voltro start` wrapper, so the container never resolves the @voltro/cli",
+		"// bin and `voltro prune-runtime` can drop the CLI (and the whole inlined",
+		"// effect/@voltro/react tree) from the runtime image: the trace roots at THIS",
+		"// self-contained bundle, which is now also the real entrypoint. When this module",
+		"// is IMPORTED instead (bin/voltro.mjs's dev fast path) the guard is inert.",
+		"if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {",
+		"  // Relocation-safe: the app root is 3 dirs up from",
+		"  // .framework/dist-web/startBundle/startEntry.js — chdir there so tryRunStart",
+		"  // resolves the SSR bundle + appConfig from cwd regardless of the launch dir",
+		"  // (WORKDIR already sets it in our image; this makes it robust anywhere).",
+		"  process.chdir(resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', '..'))",
+		"  runStartCommand(process.argv.slice(2)).then((c) => process.exit(typeof c === 'number' ? c : 0))",
+		"}",
 		""
 	].join("\n"), "utf8"), await t.build({
 		entryPoints: [o],
@@ -711,10 +728,10 @@ external scheduler owns the once-only guarantee.
 }, tr = async (e) => {
 	let t = await ae(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-DH13Ysgs.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-D_PGP9Kx.js"), n = await t(e);
 		if (n) {
 			B.info("building api app", { app: n.name ?? "(unnamed)" });
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BGd-BnHq.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BmPdmhgi.js");
 			await t(e);
 			try {
 				await r(e);
@@ -8330,6 +8347,12 @@ image, use \`voltro serverless serve\` from the project root.
 		"dist",
 		"server",
 		"appConfig.js"
+	],
+	[
+		".framework",
+		"dist-api",
+		"serveBundle",
+		"serveEntry.js"
 	]
 ], sp = ["pg", ...Ne.filter((e) => !e.includes("*"))], cp = async (e) => {
 	let t = w(e, "node_modules");

package/dist/{dev-zJGsTTNb.js → dev-CGt0PP1f.js}

@@ -1,4 +1,4 @@
-import { $ as e, A as t, B as n, C as r, Dt as i, E as a, Et as o, G as s, H as c, Lt as l, O as u, Pt as d, Q as f, R as p, U as m, V as h, W as g, X as _, Y as ee, Z as te, _t as ne, at as re, ct as ie, dt as ae, et as v, ft as oe, gt as y, ht as se, it as ce, j as le, kt as ue, l as b, lt as de, mt as fe, nt as pe, ot as me, pt as he, rt as ge, st as _e, t as ve, tt as ye, ut as be, vt as xe, w as Se, xt as Ce, yt as we } from "./inspectMetrics-BuBwg1yW.js";
+import { $ as e, A as t, B as n, C as r, Dt as i, E as a, Et as o, G as s, H as c, Lt as l, O as u, Pt as d, Q as f, R as p, U as m, V as h, W as g, X as _, Y as ee, Z as te, _t as ne, at as re, ct as ie, dt as ae, et as v, ft as oe, gt as y, ht as se, it as ce, j as le, kt as ue, l as b, lt as de, mt as fe, nt as pe, ot as me, pt as he, rt as ge, st as _e, t as ve, tt as ye, ut as be, vt as xe, w as Se, xt as Ce, yt as we } from "./inspectMetrics-SRtv8KDy.js";
 import { i as x, n as Te, t as Ee } from "./startupRunner-DhlX9nqd.js";
 import { r as De } from "./devActivity-1WtIVyHc.js";
 import { t as Oe } from "./frameworkInspectState-CX2250XB.js";

package/dist/dev-D_PGP9Kx.js

@@ -0,0 +1,2 @@
+import { o as e } from "./dev-CGt0PP1f.js";
+export { e as loadApiConfig };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { i as e, n as t, r as n, t as r } from "./commands-BiQsbV50.js";
+import { i as e, n as t, r as n, t as r } from "./commands-BDGYrBhK.js";
 //#region src/index.ts
 var i = "framework";
 //#endregion

package/dist/{inspectMetrics-BuBwg1yW.js → inspectMetrics-SRtv8KDy.js}

@@ -2754,7 +2754,8 @@ import {
 	browserWsUrl: t.url,
 	proxyTarget: void 0,
 	...t.serverUrl ? { serverOrigin: t.serverUrl } : {},
-	...t.headers ? { headers: t.headers } : {}
+	...t.headers ? { headers: t.headers } : {},
+	...t.authHeaders ? { hasAuthHeaders: !0 } : {}
 }), Di = (e, t, n) => {
 	let r = t.transport?.wsPath ?? n.wsPath;
 	return {
@@ -2764,7 +2765,8 @@ import {
 		proxyTarget: `ws://localhost:${n.port}`,
 		...r ? { wsPath: r } : {},
 		...t.serverUrl ? { serverOrigin: t.serverUrl } : {},
-		...t.headers ? { headers: t.headers } : {}
+		...t.headers ? { headers: t.headers } : {},
+		...t.authHeaders ? { hasAuthHeaders: !0 } : {}
 	};
 }, Oi = (e) => {
 	let t = /* @__PURE__ */ new Map();
@@ -2891,9 +2893,11 @@ import {
 		""
 	].join("\n"), u = r(e, "src", "pages"), { pages: d, dirs: f } = await $(u);
 	await rr(u, d);
-	let p = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppGroup`, m = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppDescriptors`, h = n.map((e) => `import { appGroup as ${p(e.name)}, appDescriptors as ${m(e.name)} } from '${e.pkg}/rpcGroup'`), g = n.map((e) => {
+	let p = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppGroup`, m = (e) => `${e.replace(/[^a-zA-Z0-9]/g, "_")}AppDescriptors`, h = n.map((e) => `import { appGroup as ${p(e.name)}, appDescriptors as ${m(e.name)} } from '${e.pkg}/rpcGroup'`);
+	n.some((e) => e.hasAuthHeaders) && (h.push("import __voltroAppConfig from '../app.config'"), h.push("const __voltroAuthHeaders = (__voltroAppConfig as { readonly apis?: Record<string, { readonly authHeaders?: () => Record<string, string> | Promise<Record<string, string>> }> }).apis"));
+	let g = n.map((e) => {
 		let t = [`group: ${p(e.name)}`];
-		return t.push(`descriptors: ${m(e.name)}`), t.push(`wsUrl: ${JSON.stringify(e.browserWsUrl)}`), e.headers && t.push(`headers: ${JSON.stringify(e.headers)}`), `    ${JSON.stringify(e.name)}: { ${t.join(", ")} },`;
+		return t.push(`descriptors: ${m(e.name)}`), t.push(`wsUrl: ${JSON.stringify(e.browserWsUrl)}`), e.hasAuthHeaders ? t.push(`headers: __voltroAuthHeaders?.[${JSON.stringify(e.name)}]?.authHeaders`) : e.headers && t.push(`headers: ${JSON.stringify(e.headers)}`), `    ${JSON.stringify(e.name)}: { ${t.join(", ")} },`;
 	}), _, v, b;
 	if (d.length > 0) {
 		let e = d.map((e) => `  ${JSON.stringify(e.pattern)}: () => import('../src/pages/${e.file}'),`), n = [];

package/dist/{serveCommand-BU454-ay.js → serveCommand-p6e5Ahgx.js}

@@ -1,7 +1,7 @@
-import { kt as e, t } from "./inspectMetrics-BuBwg1yW.js";
-import { $ as n, A as r, C as i, D as a, E as o, F as s, G as c, H as l, I as u, J as d, M as f, N as p, O as ee, P as m, Q as h, S as g, T as te, U as ne, W as re, X as _, Y as ie, Z as ae, _ as oe, at as v, b as se, d as ce, et as y, f as b, g as le, h as ue, i as x, it as de, j as S, k as C, m as fe, n as pe, nt as me, o as w, ot as T, q as he, s as ge, st as _e, t as ve, ut as E, v as ye, w as be, x as xe, y as D } from "./dev-zJGsTTNb.js";
+import { kt as e, t } from "./inspectMetrics-SRtv8KDy.js";
+import { $ as n, A as r, C as i, D as a, E as o, F as s, G as c, H as l, I as u, J as d, M as f, N as p, O as ee, P as m, Q as h, S as g, T as te, U as ne, W as re, X as _, Y as ie, Z as ae, _ as oe, at as v, b as se, d as ce, et as y, f as b, g as le, h as ue, i as x, it as de, j as S, k as C, m as fe, n as pe, nt as me, o as w, ot as T, q as he, s as ge, st as _e, t as ve, ut as E, v as ye, w as be, x as xe, y as D } from "./dev-CGt0PP1f.js";
 import { a as Se, r as Ce } from "./startupRunner-DhlX9nqd.js";
-import { n as we, s as O } from "./apiBuild-D_kEJTxc.js";
+import { n as we, s as O } from "./apiBuild-zFDv0u8y.js";
 import { t as Te } from "./bootTiming-BdyP9nYw.js";
 import { join as Ee } from "node:path";
 import { pathToFileURL as De } from "node:url";

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
-import { bt as e } from "./inspectMetrics-BuBwg1yW.js";
-import { dt as t } from "./dev-zJGsTTNb.js";
+import { bt as e } from "./inspectMetrics-SRtv8KDy.js";
+import { dt as t } from "./dev-CGt0PP1f.js";
 import { a as n } from "./startupRunner-DhlX9nqd.js";
-import { t as r } from "./serveCommand-BU454-ay.js";
+import { t as r } from "./serveCommand-p6e5Ahgx.js";
 export { e as loadDotEnv, n as registerAppModules, t as registerDriver, r as runServe };

package/dist/{start-ChN6PO-c.js → start-Crl39M38.js}

@@ -1,4 +1,4 @@
-import { A as e, C as t, Ct as n, E as r, Et as i, G as a, H as o, I as s, J as c, Mt as l, N as u, O as d, R as ee, St as f, Tt as p, U as m, V as h, W as g, Z as _, _ as v, _t as te, a as y, at as b, b as x, c as ne, f as S, g as re, gt as C, h as w, i as T, j as E, k as D, kt as O, m as k, o as ie, p as ae, q as A, r as oe, s as se, t as ce, v as j, w as le, wt as M, y as N } from "./inspectMetrics-BuBwg1yW.js";
+import { A as e, C as t, Ct as n, E as r, Et as i, G as a, H as o, I as s, J as c, Mt as l, N as u, O as d, R as ee, St as f, Tt as p, U as m, V as h, W as g, Z as _, _ as v, _t as te, a as y, at as b, b as x, c as ne, f as S, g as re, gt as C, h as w, i as T, j as E, k as D, kt as O, m as k, o as ie, p as ae, q as A, r as oe, s as se, t as ce, v as j, w as le, wt as M, y as N } from "./inspectMetrics-SRtv8KDy.js";
 import { t as ue } from "./bootTiming-BdyP9nYw.js";
 import { dirname as P, extname as F, join as I, resolve as L } from "node:path";
 import { fileURLToPath as R, pathToFileURL as de } from "node:url";

package/dist/startEntry.js

@@ -1,3 +1,3 @@
-import { bt as e } from "./inspectMetrics-BuBwg1yW.js";
-import { t } from "./start-ChN6PO-c.js";
+import { bt as e } from "./inspectMetrics-SRtv8KDy.js";
+import { t } from "./start-Crl39M38.js";
 export { e as loadDotEnv, t as runStartCommand };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -62,22 +62,22 @@
     "@effect/platform-node": "^0.107.0",
     "@effect/sql": "^0.51.1",
     "@effect/workflow": "^0.18.2",
-    "@voltro/ai": "0.11.1",
-    "@voltro/cache": "0.11.1",
-    "@voltro/data-transfer": "0.11.1",
-    "@voltro/database": "0.11.1",
-    "@voltro/env": "0.11.1",
-    "@voltro/kv": "0.11.1",
-    "@voltro/logger": "0.11.1",
-    "@voltro/plugin-auth": "0.11.1",
-    "@voltro/plugin-broadcast": "0.11.1",
-    "@voltro/plugin-mail": "0.11.1",
-    "@voltro/plugin-storage": "0.11.1",
-    "@voltro/plugin-webhooks": "0.11.1",
-    "@voltro/protocol": "0.11.1",
-    "@voltro/runtime": "0.11.1",
-    "@voltro/serverless": "0.11.1",
-    "@voltro/workflow": "0.11.1",
+    "@voltro/ai": "0.11.3",
+    "@voltro/cache": "0.11.3",
+    "@voltro/data-transfer": "0.11.3",
+    "@voltro/database": "0.11.3",
+    "@voltro/env": "0.11.3",
+    "@voltro/kv": "0.11.3",
+    "@voltro/logger": "0.11.3",
+    "@voltro/plugin-auth": "0.11.3",
+    "@voltro/plugin-broadcast": "0.11.3",
+    "@voltro/plugin-mail": "0.11.3",
+    "@voltro/plugin-storage": "0.11.3",
+    "@voltro/plugin-webhooks": "0.11.3",
+    "@voltro/protocol": "0.11.3",
+    "@voltro/runtime": "0.11.3",
+    "@voltro/serverless": "0.11.3",
+    "@voltro/workflow": "0.11.3",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/agent-docs/_manifest.json

@@ -53,7 +53,7 @@
       "group": null,
       "description": "How Voltro's reactive data layer works — queries, mutations, actions, streams, all over one WebSocket with typed errors and tracked dependencies.",
       "path": "agent-docs/data.md",
-      "files": 15
+      "files": 16
     },
     {
       "id": "database/advancedqueries",

package/templates/agent-docs/authentication.md

@@ -723,6 +723,28 @@ The strategy above only *verifies* — your browser still has to *send* the toke
 
   This is **required when the api is a separate origin** (the common case — `api.example.com` vs your web origin): there is no shared cookie and no upgrade header, so without `headers` every subscription connects **anonymous** (the shell renders, but user-/tenant-scoped data stays empty). A static object works for non-rotating tokens; never hardcode a secret literal — it ships to the browser.
 
+### Declaratively — `apis.<name>.authHeaders` in `app.config.ts`
+
+Rather than hand-writing a `mount()` entry just to inject the thunk, declare it on the api in `app.config.ts`. The framework owns the client mount, the SSR-null case (the resolver runs browser-only — it never fires on the server), and the re-resolve on every reconnect; you supply only the token function:
+
+```ts
+// app.config.ts
+export default {
+  type: 'web' as const,
+  apis: {
+    api: {
+      package: '@app/api',
+      // Resolved fresh on every (re)connect — a rotating token is pulled anew:
+      authHeaders: async () => ({
+        authorization: `Bearer ${(await supabase.auth.getSession()).data.session?.access_token ?? ''}`,
+      }),
+    },
+  },
+}
+```
+
+`authHeaders` is a **function**, so it is imported from `app.config.ts` into the client bundle rather than serialized — the file must stay browser-safe (no `node:*` / server-only value imports; the env schema and other pure config are fine). It supersedes a static `headers` on the same api. This is the preferred form; reach for a hand-written `mount()` only when you need to wrap the tree in your own provider as well.
+
 ## WorkOS
 
 ```ts

package/templates/agent-docs/data.md

@@ -315,6 +315,8 @@ export default defineExecutor(notesSummary, async (_input, ctx) => {
 
 It's a runtime identity (returns the handler unchanged) — the whole value is the compile check. The Effect error and requirement channels stay inferred; only the success value is constrained. A **descriptor-return** (reactive) executor is allowed through unchecked: the store produces the rows, so a value-level return type can't express the row-vs-`output` check. `defineExecutor` works the same for `defineMutation` / `defineAction` handlers.
 
+> **Composing one executor inside another (e.g. a workflow `step`).** The value `defineExecutor` returns is typed as the `ExecutorReturn` UNION (`Output | Promise | Effect | descriptor-return`), so it has no `.pipe` — you can't feed the wrapped default export straight into another Effect. Export the handler's raw `Effect` separately (a named `export const execute = …`, or import the un-wrapped function) and compose THAT; keep the `defineExecutor`-wrapped default only as the procedure's entry point. The union return is deliberate — it's what lets one helper type every executor shape — so this is a "import the raw effect for composition" convention, not a gap to route around.
+
 ## Auto-optimistic source
 
 `source` also connects query caches to mutation `target` metadata:
@@ -1947,6 +1949,72 @@ When no analytics sink is configured the framework provides the no-op sink: the
 
 
 
+---
+
+<!-- source: en/data/crud.md -->
+## CRUD helpers
+
+_crud.* secure-default handler helpers — tenant-scoped reads, column redaction, and null-not-throw getById, so the CRUD tail of a handler is one honest line._
+
+Most of a plain list / get / create / update / delete handler is the same five lines every time — and getting those lines subtly wrong is how data leaks. The `crud.*` helpers from `@voltro/runtime` give you the **executor** with the secure defaults baked in; you still write the descriptor (schemas + `guards`), which is where the browser-safe wire contract and the authorization live.
+
+```ts
+// accounts.list.query.server.ts
+import { crud } from '@voltro/runtime'
+
+export default crud.list('accounts', { redact: ['apiSecret'] })
+```
+
+```ts
+// accounts.list.query.ts — the descriptor stays hand-written + browser-safe
+import { defineQuery } from '@voltro/protocol'
+import { Schema } from 'effect'
+
+export default defineQuery({
+  name: 'accounts.list',
+  input: Schema.Struct({}),
+  // note: the wire output OMITS apiSecret, so it never reaches the client
+  output: Schema.Array(Schema.Struct({ id: Schema.String, name: Schema.String })),
+})
+```
+
+## What the defaults bake in
+
+- **Tenant scope.** `crud.list` and `crud.getById` read through `ctx.store`, which auto-scopes a `tenant()` table. They never call `.unscoped()`, so a cross-tenant read is impossible through them — `payslips.list` cannot return another tenant's rows.
+- **Redaction.** `redact` names columns stripped from every returned row — a credential, a token hash, a salary that a generated read must never ship. It applies to reads and to the row a `create` / `update` echoes back. Declare the same omission in the descriptor's `output` schema so the column never reaches the client at all; the helper is the runtime guarantee that it doesn't, whatever the schema says.
+- **`getById` returns `null`, never throws.** A reactive getter that throws takes its shared-WebSocket siblings down with it. `crud.getById` resolves `null` for an absent row.
+
+## The helpers
+
+| Helper | Executor it returns |
+|---|---|
+| `crud.list(table, { redact? })` | tenant-scoped list of every row, redacted |
+| `crud.getById(table, { redact? })` | one row by `input.id`, or `null` — redacted |
+| `crud.create(table, { redact? })` | insert `input`; id/tenant/audit auto-stamped; echoes the redacted row |
+| `crud.update(table, { redact? })` | patch `{ id, ...patch }`; returns the updated row or `null` |
+| `crud.remove(table)` | delete `input.id`; returns `{ deleted }` |
+
+`redactColumns(rows, cols)` is exported standalone for a hand-written handler that isn't plain CRUD but still needs to redact declaratively.
+
+## What they deliberately don't do — authorization
+
+A guard runs *before* the executor, so gating lives on the **descriptor**, not the handler — an executor cannot gate itself. Keep every write descriptor guarded:
+
+```ts
+export default defineMutation({
+  name: 'accounts.create',
+  input: AccountInput,
+  output: Account,
+  guards: [requireScope('accounts:write')],   // ← the gate; crud.create does not add one
+})
+```
+
+## Scope — why the schema is still hand-written
+
+These helpers give you the secure **handler**, not schema derivation. Deriving the descriptor's `input`/`output` from the table automatically would need the table VALUE inside the descriptor file — and a descriptor is loaded value-level by the browser client, so importing a table there drags the store and driver into the browser bundle (the boundary guard aborts the boot; `rowSchema` is server-only for exactly this reason). Full schema-derivation, and a boot audit that fails when a `tenant()` table's list reads unscoped or a write goes ungated, are a separate planned pass — the handler defaults above are the part that ships browser-safe today and closes the leak class.
+
+
+
 ---
 
 <!-- source: en/data/subscribers.md -->

package/templates/agent-docs/database/columntypes.md

@@ -208,6 +208,13 @@ const rows = await ctx.store.query(database.people.descriptor)
 rows[0]?.fullName    // → 'Mario Lima'
 ```
 
+**A generated column is never caller-supplied.** It's omitted from the typed insert
+payload — `insertRow(store, people, { firstName, lastName })` compiles with no
+`fullName`, and its type is optional even when the column is NOT nullable and has no
+default (the DB owns the value). If a loose `store.insert` passes one anyway, the
+framework strips it before the INSERT — MariaDB and Postgres both reject an explicit
+value for a generated column, so this keeps that error from reaching the dialect.
+
 ## STORED vs VIRTUAL
 
 `{ stored: true }` (the rare-but-useful case):

package/templates/agent-docs/database/querying.md

@@ -1044,6 +1044,22 @@ The framework deliberately avoids the Prisma / TypeORM "auto-generated junction"
 
 3. **Schema is explicit**. Looking at your `database/` directory tells you exactly which tables exist. No hidden auto-generated tables to chase down at migration time.
 
+## Writing links — `store.links`
+
+Reconciling the set of links from one row (a post's tags, a user's orgs) by hand — read the current rows, work out which to insert and which to delete — is fiddly and easy to get wrong. A drop-all-then-reinsert shortcut loses data when two requests overlap and makes a reactive subscription on the junction churn *every* row even when nothing changed. `ctx.store.links(junctionTable, anchor)` does the diff for you:
+
+```ts
+// anchor names the source column + id; the target column is auto-detected
+await ctx.store.links('org_memberships', { userId: user.id }).set(orgIds)  // reconcile to exactly orgIds
+await ctx.store.links('org_memberships', { userId: user.id }).add([orgId]) // idempotent — no-op if already linked
+await ctx.store.links('org_memberships', { userId: user.id }).remove([orgId])
+const orgIds = await ctx.store.links('org_memberships', { userId: user.id }).list()
+```
+
+`set(targetIds)` writes only the **difference**: the missing links are inserted, the surplus deleted, and links that are already correct are left untouched — so a reactive consumer sees a change only for what actually changed, and it returns `{ added, removed }`. `add` and `remove` read first and act only on the genuine delta, so both are idempotent.
+
+The **target column** is the junction's *other* `reference()` column — the one the anchor doesn't name. A junction with anything but exactly two reference columns is refused (write it by hand with `insertMany` / `deleteMany`). The writes go through the normal store path, so a junction that carries `tenant()` / `audit()` gets those columns stamped as usual. A junction with extra business columns (a membership `role`, a tag `order`) needs those set per row — `links` only manages the two FK columns, so insert those rows directly.
+
 ## SQL shape
 
 The framework emits an INNER JOIN through the junction:

package/templates/agent-docs/deployment.md

@@ -460,9 +460,11 @@ Building an API app produces the bundle, and `voltro serve` boots from it. In **
 
 Because production never transpiles, the serve image needs none of the build toolchain. The framework declares `tsx`, `esbuild`, `vite`, and Tailwind as **optional** dependencies of `@voltro/cli`, and the production Dockerfiles isolate the app with `pnpm --prod --no-optional deploy` — which drops that whole tree (and its native binaries) from the image. A serve image ships only what it runs at runtime: your app, the framework, and the one SQL driver you declared.
 
-**Web apps get the same treatment.** `voltro build` also precompiles the `voltro start` runtime into a **start bundle** (`.framework/dist-web/startBundle/`, framework inlined), and `voltro start` boots from it automatically — so a cold web boot loads one artefact instead of resolving the whole framework graph. This collapses the web `modules` phase the same way the serve bundle does (~17× on a small app in practice), which matters most exactly where it hurts: a scale-from-zero container on a fraction of a vCPU. It is transparent — no config, no separate command, and it travels in `.framework` with everything else the deploy already copies. If the bundle ever fails to build or load, `voltro start` falls back to the ordinary per-module boot: slower, never broken.
+And it shrinks further, the same way a web image does. The serve bundle is directly executable, so the production API container runs it with `node .framework/dist-api/serveBundle/serveEntry.js` — not `pnpm voltro serve` — with no pnpm process and no `@voltro/cli` bin to resolve at boot. That lets `voltro prune-runtime` drop `@voltro/cli` and the whole inlined framework tree from the runtime image too; what stays is the native SQL driver your app actually declared (traced + kept automatically) — a memory-store api's `node_modules` fell from ~146 MB to ~11 MB in a fixture. The serve entry chdir's to the app root before its app-module registry keys are computed, so the pruned, relocated tree still resolves every module.
 
-**And the image itself shrinks.** Because the SSR bundle, the start bundle, and the precompiled config all inline + tree-shake the framework, a booted web app needs from `node_modules` only the runtime-external **native** leaves it actually reaches (a SQL driver an ISR or config path touches) — everything else is already compiled into the bundles. The standalone web Dockerfiles trace the real reachable set (`@vercel/nft`, the same tool behind Next.js `output: standalone`) and drop the rest. It's automatic — a native driver you use is traced and kept, one you don't is dropped, no per-app allow-list — and for a static/SSR marketing site with no native runtime dependency, `node_modules` collapses to nothing: the image is just the base plus `.framework`. On a real marketing app the shipped app tree fell from ~210 MB to ~65 MB. A smaller image is a faster cold pull on a fresh node — the other half of the scale-from-zero latency the boot bundle can't touch.
+**Web apps get the same treatment.** `voltro build` also precompiles the `voltro start` runtime into a **start bundle** (`.framework/dist-web/startBundle/startEntry.js`, framework inlined) — so a cold web boot loads one artefact instead of resolving the whole framework graph. This collapses the web `modules` phase the same way the serve bundle does (~17× on a small app in practice), which matters most exactly where it hurts: a scale-from-zero container on a fraction of a vCPU. In production the container runs that bundle **directly** — `node .framework/dist-web/startBundle/startEntry.js`, not `pnpm voltro start` — so there is no pnpm process and no `@voltro/cli` bin to resolve at boot; the bundle is a self-contained, relocation-safe entrypoint (its main-guard chdir's to the app root so cwd-based resolution holds anywhere). In development `voltro start` imports the same bundle; if it ever fails to build or load, that path falls back to the ordinary per-module boot — slower, never broken.
+
+**And the image itself shrinks — to almost nothing.** Because the SSR bundle, the start bundle, and the precompiled config all inline + tree-shake the framework, *and the production entrypoint is the bundle itself rather than the CLI*, a booted web app needs from `node_modules` only the runtime-external **native** leaves it actually reaches (a SQL driver an ISR or config path touches) — everything else is already compiled into the bundles. `voltro prune-runtime` traces the real reachable set from that entrypoint (`@vercel/nft`, the same tool behind Next.js `output: standalone`) and drops the rest — including `@voltro/cli` and the whole inlined effect/React tree, which nothing at runtime imports any more. It's automatic — a native driver you use is traced and kept, one you don't is dropped, no per-app allow-list — and for a static/SSR marketing site with no native runtime dependency, `node_modules` collapses to **zero** (measured on a fixture: 151 MB → ~0 B): the image is just the node base plus `.framework`. A build-time **boot smoke** then starts the *pruned* tree with the real `node …/startEntry.js` entrypoint and fails the build unless it reaches `start: ready`, so a slimmed image that can't boot never ships. A smaller image is a faster cold pull on a fresh node — the other half of the scale-from-zero latency the boot bundle can't touch.
 
 ## Tiers (Voltro Cloud — coming soon)