@voltro/cli 0.39.0 → 0.39.1

package/CHANGELOG.md

@@ -39,6 +39,58 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.39.1] — 2026-08-16
+
+### Fixed
+
+- **@voltro/runtime, @voltro/cli** — An app-registered tuple source is no longer replaced by the framework default.
+
+  Both boot paths carried this comment, verbatim:
+
+  > An app whose relationships live in its own tables overrides with > `setTupleSource`.
+
+  and then called `setTupleSource(default)` **unconditionally**. That call runs AFTER the app's startups — `runBootLifecycle` at `dev.ts:3910` and `serveCommand.ts:869`, against the registration at `dev.ts:4065` and `serveApi.ts:937` — and `setTupleSource` is last-write-wins. So the framework won every time: an app registering its own source in a `*.startup.tsx`, which is what the docs tell it to do, had it silently replaced.
+
+  The consequence is not subtle. Every relationship guard would then be answered from `_voltro_rebac_tuples` — empty, for exactly the app that keeps its relations in its own tables — so every guard DENIES, fail-closed, with a `no tuple source` warning that never fires because a source *is* registered: the wrong one.
+
+  The comment was not wrong about the design; it described the design while the code removed it. Same shape as the `DORMANCY_WAKEUP_TENANT` scar — equal by value at both call sites, so nothing could fail, and the comment was the only place the intent survived.
+
+  `registerDefaultTupleSource` fills the gap only when nobody else did, and returns whether it acted so the boot can say which source is live instead of leaving an operator to guess. `setTupleSource` itself is unchanged: an app calling it twice still gets the second one, because narrowing that would trade one silent surprise for another.
+
+  Found while re-checking a consumer's claim that a different item was still open. It was not — but it sits beside this, and this is the one that would have bitten them. Pinned in both directions: a unit test for the registrar, and a source guard asserting neither boot path installs `loadResourceTuples` through `setTupleSource` again. Red-verified by restoring the original line.
+- **@voltro/cli** — `voltro doctor` no longer reports "scope vocabulary: none found" when it could not read the config at all.
+
+  A consumer HAD configured `doctor.scopeVocabulary` and still read `none found`. The cause was not their vocabulary: `app.config.ts` could not be imported outside their pod — an auth strategy demands its secret while the config is evaluated — so the vocabulary was never read. Inside the pod the message disappears and the rule runs.
+
+  "You have no vocabulary" and "I could not look" are different states, and only the first is a statement about their app. This section already made exactly that distinction one member earlier — its own comment reads **DORMANT AND CLEAN MUST NOT PRINT THE SAME** — and then collapsed the third.
+
+  The signal existed and was not connected. `offlineManifest` deliberately survives an unimportable config (a doctor run must not die on one), so the empty vocabulary arrived looking like a real absence, while the same failure was reported a hundred lines earlier under plugin tables. The consumer read the section about scopes and searched at the wrong end — which is the correct way to read a report.
+
+  The rule now probes importability before claiming an absence, and says so:
+
+  ```
+  •  scope vocabulary: NOT EVALUATED — `app.config.ts` could not be imported.
+     This is not a statement about your scopes: the rule never got to read them.
+     … The same import failure is reported above for plugin tables; both sections
+     have this one cause.
+  ```
+
+  The dormant case keeps its own wording, so a quiet run on an app that genuinely publishes no vocabulary is not relabelled as a broken config.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/cache, @voltro/kv** — The RESP TTL tests in `@voltro/cache` and `@voltro/kv` stopped measuring the machine. Test-only; no product code changed.
+
+  Both wrote a key with `ttlMs: 150`, asserted it was still there, then slept 300 ms and asserted it was gone. The second half is fine — waiting LONGER only strengthens "it expired". The first half was a race: the write and the read are two round-trips, so on a loaded runner the key legitimately expired before the liveness assertion, and the test reported a defect that was not there. It failed exactly that way on a release gate, in the keydb engine, while passing locally with 24/24 green.
+
+  Now: a 2 s window, so liveness has real headroom rather than 150 ms of it, and the expiry is awaited as a CONDITION (`awaitGone` polls) rather than as a duration. Idle machines finish in about the TTL; loaded ones take as long as they need; a key that never expires still fails, because the ceiling is a failure mode and not a timing assumption.
+
+  Fixed in BOTH packages in one change. The two files carried the identical construction, and this repo's standing lesson is that a fix landing in one copy of a duplicated shape leaves the other one broken — `@voltro/kv` had not failed yet, which is a statement about luck rather than about the test.
+
+  `@voltro/kv`'s header also pointed at `../cache/test/docker-compose.yml` for bringing the engines up. That path does not exist; there is one compose file, at the repo root.
+
+---
+
 ## [0.39.0] — 2026-08-16
 
 ### Added

package/dist/apiBuild-BmR_bIxN.js

@@ -0,0 +1,2 @@
+import { c as e, l as t } from "./apiBuild-D9FB13_2.js";
+export { e as runApiBuild, t as runServeBundleBuild };

package/dist/{apiBuild-DGalUk9v.js → apiBuild-D9FB13_2.js}

@@ -1,4 +1,4 @@
-import { f as e } from "./dev-gqpnzVhI.js";
+import { f as e } from "./dev-3mgc8c-H.js";
 import { ut as t } from "./webDev-CTpSY-e_.js";
 import { t as n } from "./dialectDriver-czCHYpeH.js";
 import { dirname as r, isAbsolute as i, join as a, relative as o, resolve as s } from "node:path";

package/dist/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { r as e } from "./commands-BD9eBRY3.js";
+import { r as e } from "./commands-D6aW_6AR.js";
 import { a as t } from "./nodeEnvironment-cGFAj1J8.js";
 import { t as n } from "./loadEnv-D9nEOClM.js";
 import { n as r } from "./cliError-BmdYnghb.js";

package/dist/{build-CfF6t0UM.js → build-DORV5mLM.js}

@@ -1,8 +1,8 @@
-import { hn as e } from "./dev-gqpnzVhI.js";
+import { hn as e } from "./dev-3mgc8c-H.js";
 import { D as t, G as n, K as r, O as i, S as a, W as o, Y as s, a as c, b as l, d as u, f as d, k as f, s as p, st as m, ut as h, v as g, x as _, y as v } from "./webDev-CTpSY-e_.js";
 import { t as y } from "./cliRuntime-Dh7UDinH.js";
 import { a as b } from "./renderModeScan-D7J1B7Kw.js";
-import { i as x, o as S, s as C } from "./apiBuild-DGalUk9v.js";
+import { i as x, o as S, s as C } from "./apiBuild-D9FB13_2.js";
 import { n as w } from "./renderProfile-1OWWAAtx.js";
 import { dirname as T, join as E, resolve as D } from "node:path";
 import { existsSync as O, promises as k } from "node:fs";
@@ -474,7 +474,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 		file: n.file,
 		reason: n.reason
 	});
-	let { regenerateRpcGroup: r } = await import("./codegenCommand-W7SDdiAQ.js"), i = await r(e);
+	let { regenerateRpcGroup: r } = await import("./codegenCommand-CxOyKmc1.js"), i = await r(e);
 	if (i.kind === "refused") {
 		F.warn("could not regenerate the rpc group — building against what is on disk", { reason: i.reason });
 		return;
@@ -486,10 +486,10 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 }, K = async (e) => {
 	let t = await u(e);
 	if (!t) {
-		let { loadApiConfig: t } = await import("./dev-alhkKoEX.js"), n = await t(e);
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js"), n = await t(e);
 		if (n) {
 			F.info("building api app", { app: n.name ?? "(unnamed)" }), await G(e);
-			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-2GvK8CUB.js");
+			let { runApiBuild: t, runServeBundleBuild: r } = await import("./apiBuild-BmR_bIxN.js");
 			await t(e);
 			try {
 				await r(e);
@@ -708,7 +708,7 @@ var N = A({ scope: "voltro:build" }), P = async (e) => {
 	return t.ran ? t.exitCode : (yield* j.logError("no web app found at this path", { hint: "looked for app.config.ts with `type: 'web'`" }), 1);
 }), J = async (t) => {
 	if (t.includes("--target")) {
-		let { runSdkBuildCommand: e } = await import("./sdkgen-C4roLErM.js");
+		let { runSdkBuildCommand: e } = await import("./sdkgen-C8zz10-X.js");
 		return e(t);
 	}
 	let n = t.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await y(q(n), { scope: "voltro:build" }), i = e(n);

package/dist/{checkCommand-CBtynBKW.js → checkCommand-Bf6oMao4.js}

@@ -4,7 +4,7 @@ import { r } from "./appGraph-KGDPTuTy.js";
 import { n as i } from "./cliOutput-D1tSBoRM.js";
 import { n as a, o, r as s, t as c } from "./inspectFetch-EMuhTG_9.js";
 import { r as l } from "./fileTaxonomy-CJfgOllU.js";
-import { x as u } from "./doctorCommand-Bvs-BQrM.js";
+import { x as u } from "./doctorCommand-oLuzc-aC.js";
 import { resolve as d } from "node:path";
 import { readdirSync as f, statSync as p } from "node:fs";
 //#region src/observedDiff.ts
@@ -141,12 +141,12 @@ var m = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, h = /* @__PUR
 	let t = e.severity === "error" ? "✗ error" : "⚠ warn", n = e.file ? ` (${e.file})` : "";
 	return `${t}  ${e.rule}  ${e.node}${n}\n    ${e.breaks.join("; ")}\n    fix: ${e.fix}`;
 }).join("\n"), C = async (e) => {
-	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-alhkKoEX.js"), { buildRpcEntry: i } = await import("./manifestBuild-j0n109tt.js"), { buildCapabilityManifest: a } = await import("./inspect-DUze25t0.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
+	let { walk: t, loadDiscovered: n, loadApiConfig: r } = await import("./dev-CjJAasDs.js"), { buildRpcEntry: i } = await import("./manifestBuild-j0n109tt.js"), { buildCapabilityManifest: a } = await import("./inspect-DUze25t0.js"), { relative: o } = await import("node:path"), s = await n(await t(e)), c = (t, n, r) => i(t, n, o(e, r)), l = [
 		...s.queries.map((e) => c(e.descriptor, "query", e.file)),
 		...s.mutations.map((e) => c(e.descriptor, "mutation", e.file)),
 		...s.actions.map((e) => c(e.descriptor, "action", e.file)),
 		...s.streams.map((e) => c(e.descriptor, "stream", e.file))
-	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-YyVe32Cb.js"), d = await u({ root: e }).catch((e) => (console.warn(`\n⚠  plugin tables could not be collected — this report is INCOMPLETE.\n   ${e instanceof Error ? e.message.split("\n")[0] : String(e)}\n`), [])), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
+	], { assembleFrameworkTables: u } = await import("./frameworkTableAssembly-DgylYh9_.js"), d = await u({ root: e }).catch((e) => (console.warn(`\n⚠  plugin tables could not be collected — this report is INCOMPLETE.\n   ${e instanceof Error ? e.message.split("\n")[0] : String(e)}\n`), [])), f = new Set(s.tables.map((e) => e.tableName)), p = [...[...f].map((e) => ({ name: e })), ...d.map((e) => e.tableName).filter((e) => !f.has(e)).map((e) => ({
 		name: e,
 		framework: !0
 	}))], m = await r(e).then((e) => e?.plugins ?? []).catch(() => []);

package/dist/{checkCommand-BV56Pcc1.js → checkCommand-D9qK_gtA.js}

@@ -1,2 +1,2 @@
-import { n as e, r as t, t as n } from "./checkCommand-CBtynBKW.js";
+import { n as e, r as t, t as n } from "./checkCommand-Bf6oMao4.js";
 export { n as offlineManifest, e as runCheckCommand, t as toInput };

package/dist/{codegenCommand-W7SDdiAQ.js → codegenCommand-CxOyKmc1.js}

@@ -1,4 +1,4 @@
-import { l as e, z as t } from "./dev-gqpnzVhI.js";
+import { l as e, z as t } from "./dev-3mgc8c-H.js";
 import { rt as n } from "./webDev-CTpSY-e_.js";
 import { r } from "./codegen-CbpGCWLG.js";
 import { basename as i, join as a, relative as o, resolve as s } from "node:path";

package/dist/{commands-BD9eBRY3.js → commands-D6aW_6AR.js}

@@ -91,7 +91,7 @@ var c = () => {
 		name: "dev",
 		summary: "Start the local development server (auto-discovers routes / mutations).",
 		status: "wired",
-		run: (e) => import("./dev-alhkKoEX.js").then((t) => t.runDev(e)),
+		run: (e) => import("./dev-CjJAasDs.js").then((t) => t.runDev(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro dev", "boot the app in the current directory"], ["voltro dev apps/acme/api", "boot a specific app"]],
@@ -109,7 +109,7 @@ var c = () => {
 		name: "dashboard",
 		summary: "Serve the DevTools dashboard standalone (from @voltro/dashboard). Targets via VOLTRO_DASHBOARD_APPS; --port to override.",
 		status: "wired",
-		run: (e) => import("./dashboardCommand-7qGylm0F.js").then((t) => t.runDashboardCommand(e)),
+		run: (e) => import("./dashboardCommand-CwTZh-XZ.js").then((t) => t.runDashboardCommand(e)),
 		help: {
 			usage: "[--port <n>]",
 			flags: [["--port <n>", "port to serve the dashboard on"]],
@@ -121,7 +121,7 @@ var c = () => {
 		name: "check",
 		summary: "Verify the app graph (blast-radius checks) against a running api; LLM-shaped --json diagnostics. Flags: --json, --process <p>, --diff removeTable:<name>.",
 		status: "wired",
-		run: (e) => import("./checkCommand-BV56Pcc1.js").then((t) => t.runCheckCommand(e)),
+		run: (e) => import("./checkCommand-D9qK_gtA.js").then((t) => t.runCheckCommand(e)),
 		help: {
 			usage: "[--json] [--offline] [--process <name>] [--diff removeTable:<name>]",
 			flags: [
@@ -155,7 +155,7 @@ var c = () => {
 		name: "webhooks",
 		summary: "Outbound-webhook artefacts. `consumer` generates the ZERO-DEPENDENCY Standard-Webhooks verification package a subscriber installs, from this app's own declared events; `events` lists the events a subscriber can register for. Usage: voltro webhooks <consumer|events> [path] [--out <dir>] [--name <pkg>] [--json].",
 		status: "wired",
-		run: (e) => import("./webhooksCommand-BVvOtZ1B.js").then((t) => t.runWebhooksCommand(e)),
+		run: (e) => import("./webhooksCommand-EccPZQZ4.js").then((t) => t.runWebhooksCommand(e)),
 		help: {
 			usage: "<consumer|events> [path] [--out <dir>] [--name <pkg>] [--json]",
 			flags: [
@@ -171,7 +171,7 @@ var c = () => {
 		name: "evolve",
 		summary: "Schema-evolution copilot: propose an observed-graph-driven codemod + a branch-verified backfill for a schema change (rename/retype/split/drop a column, rename a table). Dry-run by default; --write applies. Usage: voltro evolve rename-column <table>.<col> --to <newName> [--write] [--json].",
 		status: "wired",
-		run: (e) => import("./evolveCommand-C4-NlFbd.js").then((t) => t.runEvolveCommand(e)),
+		run: (e) => import("./evolveCommand-CWhBoe_P.js").then((t) => t.runEvolveCommand(e)),
 		help: {
 			usage: "<rename-column|rename-table|retype-column|split-column|drop-column> <target> [--to <new>] [--write]",
 			flags: [
@@ -188,7 +188,7 @@ var c = () => {
 		name: "codegen",
 		summary: "Emit rpcGroup.generated.ts from discovered route / mutation descriptors.",
 		status: "wired",
-		run: (e) => import("./codegenCommand-W7SDdiAQ.js").then((t) => t.runCodegenCommand(e)),
+		run: (e) => import("./codegenCommand-CxOyKmc1.js").then((t) => t.runCodegenCommand(e)),
 		help: {
 			usage: "[app]",
 			examples: [["voltro codegen", "regenerate rpcGroup.generated.ts for the app in the cwd"]],
@@ -280,7 +280,7 @@ var c = () => {
 		name: "env",
 		summary: "Inspect/sync the typed-env manifest. Subcommands: check (default), sync (.env.example), types (env.generated.d.ts for CI tsc), turbo.",
 		status: "wired",
-		run: (e) => import("./envCommand-B1-Zm85H.js").then((t) => t.runEnvCommand(e)),
+		run: (e) => import("./envCommand-CAkSgBbh.js").then((t) => t.runEnvCommand(e)),
 		help: {
 			usage: "[check|sync|types|turbo] [--force]",
 			flags: [["--force", "overwrite the generated file instead of refusing on a conflict"]],
@@ -309,12 +309,12 @@ var c = () => {
 		run: async (e) => {
 			let t = e.find((e) => !e.startsWith("-")) ?? process.cwd();
 			if (e.includes("--preflight")) {
-				let { runServePreflight: e } = await import("./doctorCommand-CVXfRrng.js");
+				let { runServePreflight: e } = await import("./doctorCommand-Cghssndo.js");
 				return e(a(t), !0);
 			}
 			let { tryRunWebServe: n } = await import("./webDev-id3I5PvG.js"), r = await n(a(t));
 			if (!r.ran) {
-				let { runServeDispatch: t } = await import("./serveCommand-CNR0gI9V.js");
+				let { runServeDispatch: t } = await import("./serveCommand-CW-goXvh.js");
 				return t(e);
 			}
 			return r.exitCode;
@@ -342,13 +342,13 @@ var c = () => {
 		handlesHelp: !0,
 		summary: "Preflight an app for production: the precompiled serve bundle, hand-rolled primitives (naming the shipped one), @voltro/* version skew, executors with no access check, `.serverOnly()` leaks, and junction-FK gaps.",
 		status: "wired",
-		run: (e) => import("./doctorCommand-CVXfRrng.js").then((t) => t.runDoctorCommand(e))
+		run: (e) => import("./doctorCommand-Cghssndo.js").then((t) => t.runDoctorCommand(e))
 	},
 	{
 		name: "build",
 		summary: "Production build for a web app (vite build + per-page SSG pre-render).",
 		status: "wired",
-		run: (e) => import("./build-CfF6t0UM.js").then((t) => t.runBuildCommand(e)),
+		run: (e) => import("./build-DORV5mLM.js").then((t) => t.runBuildCommand(e)),
 		help: {
 			usage: "[app] [--target <t>]",
 			flags: [["--target <t>", "build target"]],
@@ -364,7 +364,7 @@ var c = () => {
 		name: "prune-runtime",
 		summary: "Trim a deployed web tree’s node_modules to the reachable runtime set (standalone image slimming).",
 		status: "wired",
-		run: (e) => import("./runtimeTrace-DzZOCd94.js").then((t) => t.runPruneRuntimeCommand(e)),
+		run: (e) => import("./runtimeTrace-gNXeLf6H.js").then((t) => t.runPruneRuntimeCommand(e)),
 		hidden: !0
 	},
 	{
@@ -382,7 +382,7 @@ var c = () => {
 		name: "dormancy",
 		summary: "Single-node scale-to-zero: front the API with a wake-orchestrator that stops the app when idle and brings it back on a request or a due wakeup (cron/workflow). Needs a SQL store. Flags: --port, --app-port, --idle-grace-ms, --tick-ms.",
 		status: "wired",
-		run: (e) => import("./dormancyCommand-B-PPHc9Q.js").then((t) => t.runDormancyCommand(e)),
+		run: (e) => import("./dormancyCommand-Bxe4WtHU.js").then((t) => t.runDormancyCommand(e)),
 		help: {
 			usage: "[app] [--port <n>] [--app-port <n>] [--idle-grace-ms <n>] [--tick-ms <n>]",
 			flags: [
@@ -469,7 +469,7 @@ var c = () => {
 		name: "data",
 		summary: "Export/import + backup/restore of app data. Logical (rows + optional assets): export <dir> [--tenant <id>|--tables a,b] [--assets] [--compression zstd|gzip|none] [--consistency live|snapshot]; import <dir> [--assets] [--no-verify]. Native (rows ONLY — no blobs): backup <dir> / restore <dir> (pg_dump/mariadb-dump/…). Resumable; typed-NDJSON; content-addressed assets on the logical path.",
 		status: "wired",
-		run: (e) => import("./dataCommand-C_F2DYxe.js").then((t) => t.runDataCommand(e)),
+		run: (e) => import("./dataCommand-Cc9RiLQZ.js").then((t) => t.runDataCommand(e)),
 		help: {
 			usage: "<export|import|backup|restore> <dir> [options]",
 			flags: [
@@ -537,7 +537,7 @@ var c = () => {
 		name: "embeddings",
 		summary: "Embeddings tooling. Subcommand: backfill <table> --text <field> --vector <field> [--model <m>] [--model-field <f>] [--batch <n>] [--dry-run] — (re)embed rows the vectorEmbedding() mixin missed.",
 		status: "wired",
-		run: (e) => import("./embeddingsCommand-OKY6XjUf.js").then((t) => t.runEmbeddingsCommand(e)),
+		run: (e) => import("./embeddingsCommand-CyNQkFIc.js").then((t) => t.runEmbeddingsCommand(e)),
 		help: {
 			usage: "backfill <table> --text <field> --vector <field> [--model <m>] [--batch <n>] [--dry-run]",
 			flags: [

package/dist/{dashboardCommand-7qGylm0F.js → dashboardCommand-CwTZh-XZ.js}

@@ -1,4 +1,4 @@
-import { d as e } from "./dev-gqpnzVhI.js";
+import { d as e } from "./dev-3mgc8c-H.js";
 import { P as t, j as n } from "./webDev-CTpSY-e_.js";
 import { t as r } from "./start-ft_KzFTd.js";
 import { join as i } from "node:path";

package/dist/{dataCommand-C_F2DYxe.js → dataCommand-Cc9RiLQZ.js}

@@ -1,5 +1,5 @@
 import { t as e } from "./cliError-BmdYnghb.js";
-import { c as t, i as n, o as r } from "./dev-gqpnzVhI.js";
+import { c as t, i as n, o as r } from "./dev-3mgc8c-H.js";
 import { n as i, t as a } from "./cliArgs-D4p8n7EE.js";
 import { r as o } from "./dialectDriver-czCHYpeH.js";
 import { t as s } from "./dataProfile-dW-PsfLB.js";

package/dist/{dev-gqpnzVhI.js → dev-3mgc8c-H.js}

@@ -37,7 +37,7 @@ import { ADMISSIONS_TABLE as hr, EVENTS_TABLE as gr, PAUSES_TABLE as _r, Workflo
 import { makeClusterCronLayer as qr, parseShardLockMode as Jr, pollWorkflowStorage as Yr, redriveFailedRun as Xr, resolveRunnerIdentity as Zr, resolveRunnerStorage as Qr, resumeRunFromStep as $r, workflowEngineLayer as ei } from "@voltro/workflow/cluster";
 import { appToolDecision as ti, loadAgentMessages as ni, runAgentTurn as ri } from "@voltro/ai";
 import { actorsTable as ii, allRegisteredTables as ai, and as oi, auditAllTableIndexes as si, bindResidentStore as ci, connectionIdentity as li, contains as ui, drainIdentifierWarnings as di, encryptedColumnsOf as fi, ensureTableRegistered as pi, eq as z, formatIndexAuditIssue as mi, gte as hi, inSet as gi, isEmptyRelationsSpec as _i, isEncrypted as vi, isNotNull as yi, isNull as bi, isSqliteFamily as xi, lt as Si, lte as Ci, notInSubquery as wi, or as Ti, registerCoreTables as Ei, registerDiscoveredRelations as Di, resolveTenantNamespace as Oi, runWithWriteAttribution as ki, serverOnlyColumns as Ai, setResidencyConfig as ji, startsWith as Mi, validateRegisteredRelations as Ni, walkLeaves as Pi } from "@voltro/database";
-import { AggregateError as Fi, AggregateMaintainer as Ii, AggregateNotFound as Li, AggregateRegistry as Ri, AggregateStale as zi, AnalyticsSink as Bi, CostRegistry as Vi, DEFAULT_APPROVAL_EXPIRY_MS as Hi, DORMANCY_WAKEUP_TENANT as Ui, Dispatcher as Wi, EventBus as Gi, ExpectationRegistry as Ki, ExperimentRegistry as qi, InMemoryDataStore as Ji, InstanceMembership as Yi, NO_ROW_FILTER as Xi, OUTBOX_TABLE as Zi, ReactionRateLimiter as Qi, ReplicatedDataStore as $i, SYSTEM_SUBJECT as B, actingUserId as ea, apiKeyManagementRoutes as ta, applyPluginRefRules as na, applyUndoInvocation as ra, approvalsPendingExecutor as ia, assertConnectionCipherConfigured as aa, attachAnalyticsMirror as oa, attachExpectations as sa, attachExperiments as ca, attachFinops as la, awaitServerListening as ua, bindEvent as da, bindMutation as fa, bindStream as pa, bindSubscription as ma, buildTracingLayer as ha, cacheScopeLeaks as ga, cancelWakeup as _a, collectPluginRefRules as va, compileCron as ya, completeOAuthConnect as ba, cronOccurrences as xa, dataStoreApiKeyStore as Sa, dataStoreIdempotencyStore as Ca, decideApprovalInvocation as wa, defineSchedule as Ta, drainOutbox as Ea, enableGraphObservation as Da, enterRequestLoader as V, extractDbCause as Oa, formatCacheScopeLeaks as ka, formatServerOnlyLeaks as Aa, formatUnresolvedSources as ja, frameworkApiKeyStrategy as Ma, getFieldCipher as Na, getResourcePolicy as Pa, getTimelineRecorder as Fa, installApprovalGate as Ia, installPolicyGuardResolver as La, isAggregateDefinition as Ra, isCostBudgetDefinition as za, isEmptyTenantScopedRead as Ba, isExpectationDefinition as Va, isExperimentDefinition as Ha, isOrglessUserSubject as Ua, isScheduleDefinition as Wa, isWorkflowEventTriggerDefinition as Ga, listRetentionConflicts as Ka, listRetentions as H, loadResourceTuples as qa, localityAwareSelector as Ja, makeActionRunner as Ya, makeAdvisoryLockCoordinator as Xa, makeApiKeyService as Za, makeApiKeyUsageBuffer as Qa, makeApiKeyUsageFlusher as $a, makeAppAccess as eo, makeApprovalGate as to, makeAsyncKv as no, makeAuthMiddlewareLayers as ro, makeBufferingSpanProcessor as io, makeConnectionRegistry as ao, makeConnectionResolver as oo, makeConnectionsFacade as so, makeCoordinatedScheduler as co, makeDataLoader as lo, makeDisconnectConnectionExecutor as uo, makeEffectStoreLayer as fo, makeEventPublisher as po, makeEventsFacade as mo, makeLazyWorkflowFacade as ho, makeListConnectionsExecutor as go, makeMutationOutputCodec as _o, makeMutationRunner as vo, makeOneShotQueryRunner as yo, makeOutboxFacade as bo, makePostCommitWorkflowFacade as xo, makeQueryDescriptorProducer as So, makeQueryFinalizer as Co, makeQueryReauthorizer as wo, makeQuerySubscriber as To, makeSchemaRegistry as Eo, makeStartConnectionExecutor as Do, makeSubmitTokenExecutor as Oo, makeUndoCapture as ko, makeWorkflowFacade as Ao, makeWorkflowFacadeWithCallerContext as jo, makeWorkflowLayers as Mo, memoryRywPositionStore as No, nextFiring as Po, noopAnalytics as Fo, noopAnalyticsSpec as Io, observedGraph as Lo, onProcessShutdown as U, parseApprovalInterval as Ro, powerOfTwoSelector as zo, recordSubscriptionDelivery as Bo, recordTimelineEvent as Vo, recordWorkflowRun as Ho, redisRywPositionStore as Uo, redoUndoInvocation as Wo, registerRetention as W, registerWakeup as Go, resolveCurrentRegion as Ko, resolveSecretsBackend as qo, retentionTtlMsFromEnv as G, runProvidedEffect as Jo, runReaction as Yo, sanitizeRedirectTo as Xo, serverOnlyLeaks as Zo, setConnectionResolver as K, setSecretsBackend as Qo, setSystemStoreHandle as $o, setTupleSource as es, settleHandlerBody as ts, singleCoordinator as ns, ssrfGuardHttpClientLayer as rs, startRpcServer as is, startScheduler as as, stripForbiddenForWire as os, sweepRetention as ss, tracingHttpClientLayer as cs, undoCaptureEnabled as ls, undoLogExecutor as us, undoSurfaceEnabled as ds, unresolvedSources as fs, withScopedRequest as ps, wrapStoreWithBootCodec as ms, wrapStoreWithMixinBehaviour as hs } from "@voltro/runtime";
+import { AggregateError as Fi, AggregateMaintainer as Ii, AggregateNotFound as Li, AggregateRegistry as Ri, AggregateStale as zi, AnalyticsSink as Bi, CostRegistry as Vi, DEFAULT_APPROVAL_EXPIRY_MS as Hi, DORMANCY_WAKEUP_TENANT as Ui, Dispatcher as Wi, EventBus as Gi, ExpectationRegistry as Ki, ExperimentRegistry as qi, InMemoryDataStore as Ji, InstanceMembership as Yi, NO_ROW_FILTER as Xi, OUTBOX_TABLE as Zi, ReactionRateLimiter as Qi, ReplicatedDataStore as $i, SYSTEM_SUBJECT as B, actingUserId as ea, apiKeyManagementRoutes as ta, applyPluginRefRules as na, applyUndoInvocation as ra, approvalsPendingExecutor as ia, assertConnectionCipherConfigured as aa, attachAnalyticsMirror as oa, attachExpectations as sa, attachExperiments as ca, attachFinops as la, awaitServerListening as ua, bindEvent as da, bindMutation as fa, bindStream as pa, bindSubscription as ma, buildTracingLayer as ha, cacheScopeLeaks as ga, cancelWakeup as _a, collectPluginRefRules as va, compileCron as ya, completeOAuthConnect as ba, cronOccurrences as xa, dataStoreApiKeyStore as Sa, dataStoreIdempotencyStore as Ca, decideApprovalInvocation as wa, defineSchedule as Ta, drainOutbox as Ea, enableGraphObservation as Da, enterRequestLoader as V, extractDbCause as Oa, formatCacheScopeLeaks as ka, formatServerOnlyLeaks as Aa, formatUnresolvedSources as ja, frameworkApiKeyStrategy as Ma, getFieldCipher as Na, getResourcePolicy as Pa, getTimelineRecorder as Fa, installApprovalGate as Ia, installPolicyGuardResolver as La, isAggregateDefinition as Ra, isCostBudgetDefinition as za, isEmptyTenantScopedRead as Ba, isExpectationDefinition as Va, isExperimentDefinition as Ha, isOrglessUserSubject as Ua, isScheduleDefinition as Wa, isWorkflowEventTriggerDefinition as Ga, listRetentionConflicts as Ka, listRetentions as H, loadResourceTuples as qa, localityAwareSelector as Ja, makeActionRunner as Ya, makeAdvisoryLockCoordinator as Xa, makeApiKeyService as Za, makeApiKeyUsageBuffer as Qa, makeApiKeyUsageFlusher as $a, makeAppAccess as eo, makeApprovalGate as to, makeAsyncKv as no, makeAuthMiddlewareLayers as ro, makeBufferingSpanProcessor as io, makeConnectionRegistry as ao, makeConnectionResolver as oo, makeConnectionsFacade as so, makeCoordinatedScheduler as co, makeDataLoader as lo, makeDisconnectConnectionExecutor as uo, makeEffectStoreLayer as fo, makeEventPublisher as po, makeEventsFacade as mo, makeLazyWorkflowFacade as ho, makeListConnectionsExecutor as go, makeMutationOutputCodec as _o, makeMutationRunner as vo, makeOneShotQueryRunner as yo, makeOutboxFacade as bo, makePostCommitWorkflowFacade as xo, makeQueryDescriptorProducer as So, makeQueryFinalizer as Co, makeQueryReauthorizer as wo, makeQuerySubscriber as To, makeSchemaRegistry as Eo, makeStartConnectionExecutor as Do, makeSubmitTokenExecutor as Oo, makeUndoCapture as ko, makeWorkflowFacade as Ao, makeWorkflowFacadeWithCallerContext as jo, makeWorkflowLayers as Mo, memoryRywPositionStore as No, nextFiring as Po, noopAnalytics as Fo, noopAnalyticsSpec as Io, observedGraph as Lo, onProcessShutdown as U, parseApprovalInterval as Ro, powerOfTwoSelector as zo, recordSubscriptionDelivery as Bo, recordTimelineEvent as Vo, recordWorkflowRun as Ho, redisRywPositionStore as Uo, redoUndoInvocation as Wo, registerDefaultTupleSource as Go, registerRetention as W, registerWakeup as Ko, resolveCurrentRegion as qo, resolveSecretsBackend as Jo, retentionTtlMsFromEnv as G, runProvidedEffect as Yo, runReaction as Xo, sanitizeRedirectTo as Zo, serverOnlyLeaks as Qo, setConnectionResolver as K, setSecretsBackend as $o, setSystemStoreHandle as es, settleHandlerBody as ts, singleCoordinator as ns, ssrfGuardHttpClientLayer as rs, startRpcServer as is, startScheduler as as, stripForbiddenForWire as os, sweepRetention as ss, tracingHttpClientLayer as cs, undoCaptureEnabled as ls, undoLogExecutor as us, undoSurfaceEnabled as ds, unresolvedSources as fs, withScopedRequest as ps, wrapStoreWithBootCodec as ms, wrapStoreWithMixinBehaviour as hs } from "@voltro/runtime";
 import { isEnvContract as gs } from "@voltro/env";
 import { SESSION_COOKIE_NAME as _s, readCookie as vs, resolveOptionalSessionSecrets as ys, verifySessionKeyed as bs } from "@voltro/protocol/session";
 import { randomBytes as xs, randomUUID as Ss } from "node:crypto";
@@ -1294,7 +1294,7 @@ var $s = (e) => {
 	};
 }, Tl = (e) => ({
 	status: 302,
-	headers: { location: Xo(e.startsWith("/") ? e : `/${e}`) },
+	headers: { location: Zo(e.startsWith("/") ? e : `/${e}`) },
 	body: ""
 }), El = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, Dl = class extends Error {
 	constructor(e) {
@@ -1791,7 +1791,7 @@ var $s = (e) => {
 		...e
 	}), l = t.onChange((e) => {
 		let t = s.get(e.table);
-		if (t !== void 0) for (let { reaction: n, log: r } of t) Yo(n, e, c()).then((t) => {
+		if (t !== void 0) for (let { reaction: n, log: r } of t) Xo(n, e, c()).then((t) => {
 			t === "acted" && r.info("reaction: acted", {
 				table: e.table,
 				op: e.op
@@ -6644,7 +6644,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		let n = Ai(t);
 		n.length > 0 && v.set(e, n);
 	}
-	let ee = v.size === 0 ? [] : r.flatMap((e) => Zo({
+	let ee = v.size === 0 ? [] : r.flatMap((e) => Qo({
 		name: e.descriptor.name,
 		output: e.descriptor.output,
 		source: e.descriptor.source
@@ -6819,7 +6819,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		}
 	}
 	ee ||= No();
-	let y = ig(m.length), b = Ko(), C = b && y.length > 0 ? Ja({
+	let y = ig(m.length), b = qo(), C = b && y.length > 0 ? Ja({
 		currentRegion: b,
 		replicaRegions: ag(g, y),
 		inner: zo()
@@ -6957,7 +6957,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		commandHint: "`voltro dev`"
 	});
 	let ht = A.length > 0 || Ze.length > 0, j = await Zh(n), gt = Gc(j?.http ?? {});
-	Qo(qo(j?.secrets));
+	$o(Jo(j?.secrets));
 	let _t = gc(gs(j?.env) ? j.env : void 0, n);
 	_t.minted.length > 0 && _t.file !== void 0 && (Z.warn(`minted ${_t.minted.length} project secret(s) into ${zt(n, _t.file)} — unique to this project, gitignored. Your DEPLOYMENT needs its own values (\`voltro secret generate\`).`, {
 		keys: _t.minted,
@@ -7356,7 +7356,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		bi();
 	});
 	let Si = Eo(P);
-	$o({
+	es({
 		dataStore: R,
 		schemaRegistry: Si
 	});
@@ -7423,7 +7423,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 	}
 	ji.length > 0 && (Oi.info("discovered subscribers", { subscribers: ji.map((e) => `${e.id}@${e.definition.table}`) }), Mi = _l(ji, R, Oi, Si, Ni.bus)), Mi && U(() => {
 		Mi();
-	}), La(), es((e) => qa(R, e.subjectId, e.resourceType, e.resourceId));
+	}), La(), Go((e) => qa(R, e.subjectId, e.resourceType, e.resourceId)) || Z.info("policy guards: using the app-registered tuple source");
 	let Fi, Ii = Z.child("outbox"), Li = T.filter((e) => ze.test(e)), zi = Li.length > 0 ? await yl(Li, Ii) : [], Bi = jt(T.filter((e) => Ie.test(e)).length, qe) ? [...zi, {
 		file: "<framework>/webhooks",
 		id: "voltro-webhook-emit",
@@ -7705,7 +7705,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		userLayers: ko.length,
 		pluginLayers: No.length
 	});
-	let Uo = (e, t) => Jo(e.pipe(F.provide(fo(t)), F.provide(zo), F.provide(gt)));
+	let Uo = (e, t) => Yo(e.pipe(F.provide(fo(t)), F.provide(zo), F.provide(gt)));
 	if ((process.env.VOLTRO_INDEX_AUDIT ?? "on") !== "off") {
 		let e = si(P), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
 		for (let n of e) Z.warn("\n" + mi(n, {
@@ -7732,19 +7732,19 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 	}
 	let W = (process.env.VOLTRO_TENANT_ISOLATION ?? j?.tenancy?.isolation) === "namespace";
 	W && Z.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
-	let Ko = $(j), G = W && Ko !== "memory" ? await (async () => {
-		let e = await S(Ko);
+	let qo = $(j), G = W && qo !== "memory" ? await (async () => {
+		let e = await S(qo);
 		return zc({
 			tables: ai(),
 			sqlLayer: e.makeSqlLayer(Q()),
-			dialect: Ko,
+			dialect: qo,
 			options: { retryFilter: e.retryFilter },
 			log: {
 				info: (e, t) => Z.info(e, t),
 				error: (e, t, n) => Z.error(e, t ?? {}, n)
 			}
 		});
-	})() : void 0, Yo = await Ch({
+	})() : void 0, Xo = await Ch({
 		input: j?.tenancy?.residency,
 		namespaceIsolationOn: W,
 		makeStoreForUrl: (e, t) => tg(j, $n, ne(Q(), t)),
@@ -7753,15 +7753,15 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 			warn: (e, t) => Z.warn(e, t)
 		}
 	});
-	Yo !== void 0 && U(async () => {
-		await Yo.close();
+	Xo !== void 0 && U(async () => {
+		await Xo.close();
 	});
-	let Xo = Uc({
+	let Zo = Uc({
 		store: R,
 		schemaRegistry: Si,
 		cache: Rr,
 		kv: Zr,
-		...Yo === void 0 ? {} : { resolveResidentStore: Yo.resolveStore },
+		...Xo === void 0 ? {} : { resolveResidentStore: Xo.resolveStore },
 		...Fi === void 0 ? {} : { webhooksService: Fi },
 		...V === void 0 ? {} : { workflowsProxy: V },
 		eventTriggers: Ze,
@@ -7771,7 +7771,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		...Hi === void 0 ? {} : { outbox: { nudge: Hi.nudge } },
 		...ar.active ? { connections: { registry: ar.registry } } : {},
 		eventBus: Ni.bus
-	}), Zo = async () => {
+	}), Qo = async () => {
 		if (Ei.length === 0) return;
 		let e = process.env.HOSTNAME ?? `pid-${process.pid}`, t;
 		da ? t = ns : aa === "cluster" ? (Z.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = ns) : aa === "advisoryLock" ? B === "memory" ? (Z.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = ns) : t = Xa(R, e, {
@@ -7786,7 +7786,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 			replicaId: e,
 			armSelf: !da,
 			dormancy: j?.dormancy ?? "always-on",
-			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => Xo({
+			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => Zo({
 				subject: n,
 				traceId: e
 			}, R, void 0, `schedule:${t}`),
@@ -7852,14 +7852,14 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 	}, ys = Lt(), bs = Pf(j?.plugins ?? [], ys), xs = bs.mutation, Ss = bs.action, Cs = bs.query, ws = zl(v), Ts = vo({
 		store: R,
 		defaultDeny: ws,
-		buildContext: (e, t, n) => Xo(e, t, n),
+		buildContext: (e, t, n) => Zo(e, t, n),
 		runEffect: (e, t) => Uo(e, t),
 		...xs ? { interceptor: xs } : {},
 		recordMetric: (e) => ys.record(e),
 		undoCapture: pf()
 	}), Es = Ya({
 		defaultDeny: ws,
-		buildContext: (e) => Xo(e),
+		buildContext: (e) => Zo(e),
 		runEffect: (e, t) => Uo(e, t),
 		...Ss ? { interceptor: Ss } : {},
 		recordMetric: (e) => ys.record(e)
@@ -7874,7 +7874,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		}
 	}), Ps = {
 		defaultDeny: ws,
-		buildContext: (e) => Xo(e),
+		buildContext: (e) => Zo(e),
 		finalize: (e, t) => Ds(e, t.subject),
 		provideEffect: (e, t) => e.pipe(F.provide(fo(t)), F.provide(zo), F.provide(gt)),
 		...Cs ? { interceptor: Cs } : {}
@@ -7900,7 +7900,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 	for (let e of xo) {
 		let t = `stream.${e.descriptor.name}`;
 		K[e.descriptor.name] = (n) => pa((t) => ps(t, (t) => {
-			let r = Xo(t), i = e.executor(n, r);
+			let r = Zo(t), i = e.executor(n, r);
 			return F.isEffect(i) ? i.pipe(F.provide(fo(r.store)), F.provide(zo), F.provide(gt)) : typeof i == "object" && i && typeof i.then == "function" ? F.promise(() => i) : i;
 		}), t);
 	}
@@ -8021,11 +8021,11 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 			source: "workflow-rpc"
 		}).start(e.definition.name, t);
 	}, t, `workflow.${e.definition.name}`);
-	let Bs = (e, t) => Xo({
+	let Bs = (e, t) => Zo({
 		subject: e.subject,
 		traceId: e.traceId
 	}, R, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), Vs = Uf(j?.plugins ?? [], ys), Hs = Hr, Us = (e, t) => w.emit(e, t), Gs = j?.dormancy === "sleep" ? {
-		register: (e, t, n) => Go(R, {
+		register: (e, t, n) => Ko(R, {
 			tenantId: n ?? Ui,
 			kind: "workflow",
 			refId: e,
@@ -8832,7 +8832,7 @@ ${r.join("\n")}\n  A consumer with no producer waits forever and looks exactly l
 		port: C,
 		ws: `ws://localhost:${C}/ws`,
 		store: J
-	}), Ce?.set({ phase: "ready" }), process.send?.({ type: cl }), process.channel?.unref(), J === "postgres" && Z.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await Zo();
+	}), Ce?.set({ phase: "ready" }), process.send?.({ type: cl }), process.channel?.unref(), J === "postgres" && Z.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await Qo();
 	try {
 		await Nt({
 			id: ae,

package/dist/{dev-alhkKoEX.js → dev-CjJAasDs.js}

@@ -1,3 +1,3 @@
-import { c as e, d as t, f as n, i as r, u as i } from "./dev-gqpnzVhI.js";
+import { c as e, d as t, f as n, i as r, u as i } from "./dev-3mgc8c-H.js";
 import "./dialectDriver-czCHYpeH.js";
 export { r as buildStore, e as loadApiConfig, i as loadDiscovered, t as runDev, n as walk };

package/dist/doctorCommand-Cghssndo.js

@@ -0,0 +1,2 @@
+import { v as e, y as t } from "./doctorCommand-oLuzc-aC.js";
+export { e as runDoctorCommand, t as runServePreflight };