@voltro/cli 0.39.0 → 0.39.1

package/dist/{doctorCommand-Bvs-BQrM.js → doctorCommand-oLuzc-aC.js}

@@ -1,8 +1,8 @@
-import { Bt as e, Ht as t, Vt as n } from "./dev-gqpnzVhI.js";
+import { Bt as e, Ht as t, Vt as n } from "./dev-3mgc8c-H.js";
 import { $ as r, Q as i, X as a, Z as o, s, t as c, y as l } from "./webDev-CTpSY-e_.js";
 import { w as u } from "./frameworkTableAssembly-oMPBKqlE.js";
 import { n as d } from "./pageConvention-cEiRxdab.js";
-import { r as f, u as p } from "./apiBuild-DGalUk9v.js";
+import { r as f, u as p } from "./apiBuild-D9FB13_2.js";
 import { n as m, r as h, t as g } from "./cliOutput-D1tSBoRM.js";
 import { n as _, t as ee } from "./tsconfigPaths-BWXBWgcl.js";
 import { n as te, r as ne } from "./fileTaxonomy-CJfgOllU.js";
@@ -1249,7 +1249,7 @@ var ce = /* @__PURE__ */ new Set([
 	let t = zt.get(e);
 	if (t !== void 0) return t;
 	let n = (async () => {
-		let { walk: t, loadDiscovered: n } = await import("./dev-alhkKoEX.js"), r = await t(e);
+		let { walk: t, loadDiscovered: n } = await import("./dev-CjJAasDs.js"), r = await t(e);
 		return {
 			files: r,
 			discovered: await n(r)
@@ -1337,7 +1337,7 @@ var ce = /* @__PURE__ */ new Set([
 	}
 }, J = async (r) => {
 	try {
-		let { loadApiConfig: i } = await import("./dev-alhkKoEX.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
+		let { loadApiConfig: i } = await import("./dev-CjJAasDs.js"), { discovered: a } = await U(r), o = n(await i(r)), s = {
 			queries: a.queries,
 			mutations: a.mutations,
 			actions: a.actions,
@@ -1421,7 +1421,7 @@ var ce = /* @__PURE__ */ new Set([
 }, Jt = async (e) => Ye({
 	hasWorkflows: async () => (await U(e)).discovered.workflows.length > 0,
 	openStore: async () => {
-		let { loadApiConfig: t, buildStore: n } = await import("./dev-alhkKoEX.js"), r = await t(e);
+		let { loadApiConfig: t, buildStore: n } = await import("./dev-CjJAasDs.js"), r = await t(e);
 		if (r === null) throw Error("no app.config.ts in this directory");
 		let i = await n(r, void 0);
 		return {
@@ -1501,7 +1501,7 @@ var ce = /* @__PURE__ */ new Set([
 	}
 }, en = async (e) => {
 	try {
-		let { loadApiConfig: t } = await import("./dev-alhkKoEX.js"), n = (await t(e))?.doctor?.scopeVocabulary;
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js"), n = (await t(e))?.doctor?.scopeVocabulary;
 		if (typeof n != "string") return [];
 		let [r, i] = n.split("#");
 		if (r === void 0 || i === void 0) return [];
@@ -1511,14 +1511,23 @@ var ce = /* @__PURE__ */ new Set([
 		return [];
 	}
 }, Q = async (e) => {
-	let t = {
+	let t = (e) => ({
 		evaluated: !1,
+		notEvaluated: e,
 		vocabularySize: 0,
 		findings: []
-	};
+	});
 	try {
-		let { offlineManifest: n, toInput: r } = await import("./checkCommand-BV56Pcc1.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
-		if (l.length === 0) return t;
+		let { offlineManifest: n, toInput: r } = await import("./checkCommand-D9qK_gtA.js"), { buildAppGraph: i, checkAppGraph: a } = await import("./appGraph-zuMGKVYX.js"), o = await n(e), s = r(o.manifest, o.tables), c = await en(e), l = [.../* @__PURE__ */ new Set([...s.scopes ?? [], ...c])];
+		if (l.length === 0) {
+			try {
+				let { loadAppSchemaInputs: t } = await import("./frameworkTableAssembly-DgylYh9_.js");
+				await t(e);
+			} catch {
+				return t("app-not-importable");
+			}
+			return t("no-vocabulary");
+		}
 		let u = i({
 			...s,
 			scopes: l
@@ -1534,12 +1543,16 @@ var ce = /* @__PURE__ */ new Set([
 			}))
 		};
 	} catch {
-		return t;
+		return t("app-not-importable");
 	}
 }, tn = async (e) => {
-	let { findings: t, evaluated: n } = await Q(e);
+	let { findings: t, evaluated: n, notEvaluated: r } = await Q(e);
 	if (!n) {
-		console.log(""), console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
+		if (console.log(""), r === "app-not-importable") {
+			console.log("•  scope vocabulary: NOT EVALUATED — `app.config.ts` could not be imported."), console.log("   This is not a statement about your scopes: the rule never got to read"), console.log("   them. The commonest cause is a config that demands its environment while"), console.log("   it is evaluated — an auth strategy reading a secret, say — so it imports"), console.log("   inside the container and not on a workstation."), console.log(""), console.log("   Run doctor where that environment exists, or make the config importable"), console.log("   without it. The same import failure is reported above for plugin tables;"), console.log("   both sections have this one cause.");
+			return;
+		}
+		console.log("•  scope vocabulary: none found — the unknown-scope rule did NOT run."), console.log("   It compares each procedure's required scopes against the scopes your"), console.log("   roles actually grant, and needs somewhere to read that set from."), console.log("   `@voltro/plugin-rbac` publishes it from its `roles` map; an app doing"), console.log("   RBAC without the plugin can point at its own:"), console.log(""), console.log("     // app.config.ts"), console.log("     doctor: { scopeVocabulary: './lib/teamRoles.ts#ALL_TEAM_SCOPES' }"), console.log(""), console.log("   Until then this section is NOT a clean bill of health — a procedure"), console.log("   requiring a scope no role grants is uncallable by everyone, and"), console.log("   nothing here would have told you.");
 		return;
 	}
 	if (t.length !== 0) {
@@ -1559,7 +1572,7 @@ var ce = /* @__PURE__ */ new Set([
 	if (n === void 0 || r.length === 0) return;
 	let i = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-alhkKoEX.js");
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js");
 		i = (await t(e))?.locales ?? [];
 	} catch {
 		return;
@@ -1575,7 +1588,7 @@ var ce = /* @__PURE__ */ new Set([
 }, rn = async (e) => {
 	let { discovered: t } = await U(e), n = [];
 	try {
-		let { loadApiConfig: t } = await import("./dev-alhkKoEX.js");
+		let { loadApiConfig: t } = await import("./dev-CjJAasDs.js");
 		n = ((await t(e))?.plugins ?? []).map((e) => {
 			let t = (e.extendSchema?.tables ?? []).map((e) => {
 				let t = e;

package/dist/{dormancyCommand-B-PPHc9Q.js → dormancyCommand-Bxe4WtHU.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-gqpnzVhI.js";
+import { c as e, i as t } from "./dev-3mgc8c-H.js";
 import { n, t as r } from "./cliArgs-D4p8n7EE.js";
 import { r as i } from "./appPort-B_HpJ_ck.js";
 import { resolve as a } from "node:path";

package/dist/{embeddingsCommand-OKY6XjUf.js → embeddingsCommand-CyNQkFIc.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-gqpnzVhI.js";
+import { c as e, i as t } from "./dev-3mgc8c-H.js";
 import { Effect as n } from "effect";
 import { embedMany as r } from "@voltro/ai";
 //#region src/embeddingsBackfill.ts

package/dist/{envCommand-B1-Zm85H.js → envCommand-CAkSgBbh.js}

@@ -1,4 +1,4 @@
-import { c as e } from "./dev-gqpnzVhI.js";
+import { c as e } from "./dev-3mgc8c-H.js";
 import { at as t, ct as n, lt as r, ot as i } from "./webDev-CTpSY-e_.js";
 import { join as a } from "node:path";
 import { promises as o } from "node:fs";

package/dist/{evolveCommand-C4-NlFbd.js → evolveCommand-CWhBoe_P.js}

@@ -1,5 +1,5 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
-import { t } from "./checkCommand-CBtynBKW.js";
+import { t } from "./checkCommand-Bf6oMao4.js";
 import { i as n, n as r } from "./codemodRunner-D-jTyvWo.js";
 import { basename as i, join as a, resolve as o } from "node:path";
 import { branchNamespaceName as s, planBranchProvision as c } from "@voltro/database";

package/dist/frameworkTableAssembly-DgylYh9_.js

@@ -0,0 +1,2 @@
+import { c as e, n as t } from "./frameworkTableAssembly-oMPBKqlE.js";
+export { t as assembleFrameworkTables, e as loadAppSchemaInputs };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-BD9eBRY3.js";
+import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-D6aW_6AR.js";
 import { r as o } from "./templates-BR-fb4SP.js";
 //#region src/index.ts
 var s = "framework";

package/dist/{runtimeTrace-DzZOCd94.js → runtimeTrace-gNXeLf6H.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./apiBuild-DGalUk9v.js";
+import { n as e } from "./apiBuild-D9FB13_2.js";
 import { join as t, resolve as n, sep as r } from "node:path";
 import { existsSync as i, promises as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";

package/dist/{sdkgen-C4roLErM.js → sdkgen-C8zz10-X.js}

@@ -422,7 +422,7 @@ let package = Package(
 		await l.mkdir(o(e), { recursive: !0 }), await l.writeFile(e, n.content, "utf8");
 	}
 }, X = async (e) => {
-	let { offlineManifest: t } = await import("./checkCommand-BV56Pcc1.js"), { manifest: n } = await t(e);
+	let { offlineManifest: t } = await import("./checkCommand-D9qK_gtA.js"), { manifest: n } = await t(e);
 	return n;
 }, Z = async (e) => {
 	let t = J(await (e.manifestProvider ?? X)(e.root), {

package/dist/{serveCommand-B6TATyCj.js → serveCommand-BpK8-m1N.js}

@@ -3,7 +3,7 @@ import { t } from "./frameworkInspectState-CX2250XB.js";
 import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
 import { t as i } from "./bootRefusal-pgvDxlrU.js";
 import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
-import { $ as s, $t as c, A as l, At as u, B as d, C as f, Ct as p, D as ee, Dt as te, E as ne, Et as m, F as re, Ft as h, G as g, Gt as ie, H as ae, I as oe, It as se, J as ce, Jt as _, K as le, Kt as v, L as ue, Lt as de, M as fe, Mt as y, N as pe, Nt as me, O as he, Ot as ge, P as _e, Pt as ve, Q as ye, Qt as be, R as xe, Rt as b, S as Se, Sn as Ce, St as we, T as Te, Tt as Ee, U as De, Ut as x, V as Oe, Vt as ke, W as Ae, Wt as je, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as Ie, Zt as S, _ as Le, _n as Re, _t as C, an as ze, at as Be, b as Ve, bn as He, bt as Ue, c as We, cn as w, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as Xe, fn as Ze, ft as Qe, g as $e, gn as et, gt as tt, h as nt, ht as rt, i as it, in as at, it as ot, j as st, jt as ct, k as lt, kt as ut, ln as T, lt as dt, m as ft, mn as pt, mt as E, nn as D, nt as mt, o as O, on as ht, ot as gt, p as _t, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as Tt, st as Et, t as Dt, tn as Ot, tt as kt, u as At, un as jt, ut as Mt, v as Nt, vn as k, vt as A, w as j, wt as Pt, x as Ft, xn as It, xt as Lt, y as Rt, yn as zt, yt as Bt, zt as Vt } from "./dev-gqpnzVhI.js";
+import { $ as s, $t as c, A as l, At as u, B as d, C as f, Ct as p, D as ee, Dt as te, E as ne, Et as m, F as re, Ft as h, G as g, Gt as ie, H as ae, I as oe, It as se, J as ce, Jt as _, K as le, Kt as v, L as ue, Lt as de, M as fe, Mt as y, N as pe, Nt as me, O as he, Ot as ge, P as _e, Pt as ve, Q as ye, Qt as be, R as xe, Rt as b, S as Se, Sn as Ce, St as we, T as Te, Tt as Ee, U as De, Ut as x, V as Oe, Vt as ke, W as Ae, Wt as je, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as Ie, Zt as S, _ as Le, _n as Re, _t as C, an as ze, at as Be, b as Ve, bn as He, bt as Ue, c as We, cn as w, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as Xe, fn as Ze, ft as Qe, g as $e, gn as et, gt as tt, h as nt, ht as rt, i as it, in as at, it as ot, j as st, jt as ct, k as lt, kt as ut, ln as T, lt as dt, m as ft, mn as pt, mt as E, nn as D, nt as mt, o as O, on as ht, ot as gt, p as _t, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as Tt, st as Et, t as Dt, tn as Ot, tt as kt, u as At, un as jt, ut as Mt, v as Nt, vn as k, vt as A, w as j, wt as Pt, x as Ft, xn as It, xt as Lt, y as Rt, yn as zt, yt as Bt, zt as Vt } from "./dev-3mgc8c-H.js";
 import { n as Ht } from "./cliArgs-D4p8n7EE.js";
 import { r as Ut } from "./appPort-B_HpJ_ck.js";
 import { at as Wt, st as M } from "./webDev-CTpSY-e_.js";
@@ -16,7 +16,7 @@ import { h as fn, o as pn } from "./inspect-B7U7Cl_Z.js";
 import { n as mn } from "./mssqlClusterPatch-_4cE_nun.js";
 import { i as hn, n as gn, r as _n, t as vn } from "./webhookDiscovery-CphsQe59.js";
 import { t as yn } from "./inspectMetrics-CfdKLh6t.js";
-import { r as bn, u as xn } from "./apiBuild-DGalUk9v.js";
+import { r as bn, u as xn } from "./apiBuild-D9FB13_2.js";
 import { t as Sn } from "./bootTiming-BdyP9nYw.js";
 import { t as Cn } from "./dataProfile-dW-PsfLB.js";
 import { basename as wn, join as Tn } from "node:path";
@@ -29,7 +29,7 @@ import { SqlClient as Vn } from "@effect/sql";
 import { declaredSnapshot as Hn, describeOutcome as Un, pendingFileMigrationIds as Wn, runPlannedMigrations as Gn } from "@voltro/database/sql";
 import { RpcGroup as Kn } from "@effect/rpc";
 import { allRegisteredTables as qn, and as Jn, connectionIdentity as Yn, ensureTableRegistered as Xn, eq as G, or as K } from "@voltro/database";
-import { AggregateRegistry as Zn, CostRegistry as Qn, DORMANCY_WAKEUP_TENANT as $n, Dispatcher as er, ExpectationRegistry as tr, ExperimentRegistry as q, apiKeyManagementRoutes as nr, attachAnalyticsMirror as rr, attachExpectations as ir, attachExperiments as ar, attachFinops as or, awaitServerListening as sr, bindMutation as J, bindStream as cr, bindSubscription as Y, buildTracingLayer as lr, cancelWakeup as ur, compileCron as dr, dataStoreApiKeyStore as fr, formatServerOnlyLeaks as pr, formatUnresolvedSources as mr, frameworkApiKeyStrategy as hr, getResourcePolicy as gr, installPolicyGuardResolver as _r, loadResourceTuples as vr, makeActionRunner as yr, makeAdvisoryLockCoordinator as br, makeApiKeyService as xr, makeApiKeyUsageBuffer as Sr, makeApiKeyUsageFlusher as Cr, makeAsyncKv as wr, makeAuthMiddlewareLayers as Tr, makeCoordinatedScheduler as Er, makeEffectStoreLayer as Dr, makeLazyWorkflowFacade as Or, makeMutationOutputCodec as kr, makeMutationRunner as Ar, makeOneShotQueryRunner as jr, makeQueryDescriptorProducer as Mr, makeQueryFinalizer as Nr, makeQueryReauthorizer as Pr, makeQuerySubscriber as Fr, makeSchemaRegistry as Ir, makeWorkflowFacade as Lr, makeWorkflowFacadeWithCallerContext as Rr, makeWorkflowLayers as X, noopKv as zr, onProcessShutdown as Br, recordSubscriptionDelivery as Vr, recordWorkflowRun as Hr, registerWakeup as Ur, resolveSecretsBackend as Wr, runProvidedEffect as Gr, setSecretsBackend as Kr, setSystemStoreHandle as qr, setTupleSource as Jr, shutdownGraceMsFromEnv as Z, singleCoordinator as Yr, startRpcServer as Xr, startScheduler as Zr, stripForbiddenForWire as Qr, undoCaptureEnabled as $r, unresolvedSources as ei, withScopedRequest as ti, workflowToRpc as ni, wrapStoreWithBootCodec as ri } from "@voltro/runtime";
+import { AggregateRegistry as Zn, CostRegistry as Qn, DORMANCY_WAKEUP_TENANT as $n, Dispatcher as er, ExpectationRegistry as tr, ExperimentRegistry as q, apiKeyManagementRoutes as nr, attachAnalyticsMirror as rr, attachExpectations as ir, attachExperiments as ar, attachFinops as or, awaitServerListening as sr, bindMutation as J, bindStream as cr, bindSubscription as Y, buildTracingLayer as lr, cancelWakeup as ur, compileCron as dr, dataStoreApiKeyStore as fr, formatServerOnlyLeaks as pr, formatUnresolvedSources as mr, frameworkApiKeyStrategy as hr, getResourcePolicy as gr, installPolicyGuardResolver as _r, loadResourceTuples as vr, makeActionRunner as yr, makeAdvisoryLockCoordinator as br, makeApiKeyService as xr, makeApiKeyUsageBuffer as Sr, makeApiKeyUsageFlusher as Cr, makeAsyncKv as wr, makeAuthMiddlewareLayers as Tr, makeCoordinatedScheduler as Er, makeEffectStoreLayer as Dr, makeLazyWorkflowFacade as Or, makeMutationOutputCodec as kr, makeMutationRunner as Ar, makeOneShotQueryRunner as jr, makeQueryDescriptorProducer as Mr, makeQueryFinalizer as Nr, makeQueryReauthorizer as Pr, makeQuerySubscriber as Fr, makeSchemaRegistry as Ir, makeWorkflowFacade as Lr, makeWorkflowFacadeWithCallerContext as Rr, makeWorkflowLayers as X, noopKv as zr, onProcessShutdown as Br, recordSubscriptionDelivery as Vr, recordWorkflowRun as Hr, registerDefaultTupleSource as Ur, registerWakeup as Wr, resolveSecretsBackend as Gr, runProvidedEffect as Kr, setSecretsBackend as qr, setSystemStoreHandle as Jr, shutdownGraceMsFromEnv as Z, singleCoordinator as Yr, startRpcServer as Xr, startScheduler as Zr, stripForbiddenForWire as Qr, undoCaptureEnabled as $r, unresolvedSources as ei, withScopedRequest as ti, workflowToRpc as ni, wrapStoreWithBootCodec as ri } from "@voltro/runtime";
 import { appStorageProvider as ii, fromNodeReadable as ai, getObjectStream as oi, putObjectStream as si, toNodeReadable as ci } from "@voltro/plugin-storage";
 import { isEnvContract as li } from "@voltro/env";
 import { assertProductionSessionSecret as ui } from "@voltro/protocol/session";
@@ -301,7 +301,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 	Vt(e.appProcedures ?? e.discovered, {
 		defaultDeny: e.security?.defaultDeny ?? !0,
 		commandHint: "`voltro serve`"
-	}), qr({
+	}), Jr({
 		dataStore: e.store,
 		schemaRegistry: e.schemaRegistry
 	});
@@ -371,7 +371,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 		});
 		Se.set(t, { handle: r });
 	}
-	_r(), Jr((t) => vr(e.store, t.subjectId, t.resourceType, t.resourceId));
+	_r(), Ur((t) => vr(e.store, t.subjectId, t.resourceType, t.resourceId)) || F({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
 	let Ce = [], we = [...e.discovered.outboxHandlers ?? [], ...gn((b?.outgoing.length ?? 0) + (b?.incoming.length ?? 0) + (b?.providers.length ?? 0), []) ? [{
 		file: "<framework>/webhooks",
 		id: "voltro-webhook-emit",
@@ -430,7 +430,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 		return (e.baseLayer ? r.pipe(U.provide(e.baseLayer)) : r).pipe(U.provide(Ve)).pipe(U.provide(He)).pipe(U.provide(We)).pipe(U.provide(Ke));
 	}, Ye = (e, t) => {
 		let n = Je(e, t);
-		return Gr(n);
+		return Kr(n);
 	}, Xe = yn(), Ze = bt(e.plugins ?? [], Xe), Qe = d({
 		plugins: e.plugins ?? [],
 		metrics: Xe,
@@ -728,7 +728,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 			I(Rn)
 		] : []
 	], Dt = Kn.make(...wt).middleware(On).middleware(kn), kt = Tr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? $n, jt = e.dormancy === "sleep" ? {
-		register: (t, n, r) => Ur(e.store, {
+		register: (t, n, r) => Wr(e.store, {
 			tenantId: r ?? At,
 			kind: "workflow",
 			refId: t,
@@ -1180,7 +1180,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 	});
 	for (let e of re.warnings) $.warn(e);
 	let h = re.port;
-	Kr(Wr(m?.secrets)), await M({
+	qr(Gr(m?.secrets)), await M({
 		rawEnv: m?.env,
 		appType: "api",
 		root: d,
@@ -1608,7 +1608,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 		}),
 		inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e),
 		inspectResumeWorkflowRunFromStep: (e) => Z.resumeWorkflowRunFromStep(e)
-	}, Gr = (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace", qr = Gr && g !== "memory" ? await (async () => {
+	}, Wr = (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace", Kr = Wr && g !== "memory" ? await (async () => {
 		let e = await N(g);
 		return T({
 			tables: S,
@@ -1622,7 +1622,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 		});
 	})() : void 0, Jr = await ft({
 		input: m?.tenancy?.residency,
-		namespaceIsolationOn: Gr,
+		namespaceIsolationOn: Wr,
 		makeStoreForUrl: (e, t) => it(m, void 0, Gt(O(), t)),
 		log: {
 			info: (e, t) => $.info(e, t),
@@ -1698,7 +1698,7 @@ var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t)
 		softDeleteScopedTables: v.softDeleteScopedTables,
 		dataTransferSnapshot: Hn(S),
 		dataTransferDialect: g,
-		...qr === void 0 ? {} : { ensureTenantProvisioned: qr.ensure },
+		...Kr === void 0 ? {} : { ensureTenantProvisioned: Kr.ensure },
 		...Jr === void 0 ? {} : { resolveResidentStore: Jr.resolveStore },
 		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
 		resolveSubject: (e, t) => Ln({

package/dist/serveCommand-CW-goXvh.js

@@ -0,0 +1,2 @@
+import { n as e } from "./serveCommand-BpK8-m1N.js";
+export { e as runServeDispatch };

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
 import { t as e } from "./loadEnv-D9nEOClM.js";
 import { r as t } from "./appModuleLoader-C9r9mxZt.js";
 import { i as n } from "./dialectDriver-czCHYpeH.js";
-import { t as r } from "./serveCommand-B6TATyCj.js";
+import { t as r } from "./serveCommand-BpK8-m1N.js";
 export { e as loadDotEnv, t as registerAppModules, n as registerDriver, r as runServe };

package/dist/{webhooksCommand-BVvOtZ1B.js → webhooksCommand-EccPZQZ4.js}

@@ -222,7 +222,7 @@ createVerifier({ secret: [process.env.WEBHOOK_SECRET, process.env.WEBHOOK_SECRET
 		...t === void 0 ? {} : { payload: t }
 	};
 }, S = u({ scope: "voltro:webhooks" }), C = ["--out", "--name"], w = async (e) => {
-	let { walk: t, loadDiscovered: n } = await import("./dev-alhkKoEX.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-il9ti-HE.js");
+	let { walk: t, loadDiscovered: n } = await import("./dev-CjJAasDs.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-il9ti-HE.js");
 	return r((await n(await t(e))).events.map((e) => ({
 		file: e.file,
 		descriptor: e.descriptor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.39.0",
+  "version": "0.39.1",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -697,22 +697,22 @@
     "@effect/platform-node": "^0.108.0",
     "@effect/sql": "^0.52.0",
     "@effect/workflow": "^0.19.0",
-    "@voltro/ai": "0.39.0",
-    "@voltro/cache": "0.39.0",
-    "@voltro/data-transfer": "0.39.0",
-    "@voltro/database": "0.39.0",
-    "@voltro/env": "0.39.0",
-    "@voltro/kv": "0.39.0",
-    "@voltro/logger": "0.39.0",
-    "@voltro/plugin-auth": "0.39.0",
-    "@voltro/plugin-broadcast": "0.39.0",
-    "@voltro/plugin-mail": "0.39.0",
-    "@voltro/plugin-storage": "0.39.0",
-    "@voltro/plugin-webhooks": "0.39.0",
-    "@voltro/protocol": "0.39.0",
-    "@voltro/runtime": "0.39.0",
-    "@voltro/serverless": "0.39.0",
-    "@voltro/workflow": "0.39.0",
+    "@voltro/ai": "0.39.1",
+    "@voltro/cache": "0.39.1",
+    "@voltro/data-transfer": "0.39.1",
+    "@voltro/database": "0.39.1",
+    "@voltro/env": "0.39.1",
+    "@voltro/kv": "0.39.1",
+    "@voltro/logger": "0.39.1",
+    "@voltro/plugin-auth": "0.39.1",
+    "@voltro/plugin-broadcast": "0.39.1",
+    "@voltro/plugin-mail": "0.39.1",
+    "@voltro/plugin-storage": "0.39.1",
+    "@voltro/plugin-webhooks": "0.39.1",
+    "@voltro/protocol": "0.39.1",
+    "@voltro/runtime": "0.39.1",
+    "@voltro/serverless": "0.39.1",
+    "@voltro/workflow": "0.39.1",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/AGENTS.md

@@ -707,7 +707,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.39.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.39.1** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/_index.md

@@ -9,7 +9,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.39.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.39.1** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/authentication.md

@@ -2143,10 +2143,19 @@ setTupleSource((req) =>
   loadResourceTuples(store, req.subjectId, req.resourceType, req.resourceId))
 ```
 
-`voltro dev` / `voltro serve` register exactly this default for you, reading
-`_voltro_rebac_tuples`. Register your own when your relationships already live
-in your own tables — a `teamMembers` row is a relation; you should not have to
-copy it into a framework table to authorize against it.
+`voltro dev` / `voltro serve` register this default for you, reading
+`_voltro_rebac_tuples` — **but only if you registered nothing**. Register your
+own when your relationships already live in your own tables: a `teamMembers` row
+is a relation; you should not have to copy it into a framework table to authorize
+against it. Yours wins, wherever you register it (`app.config.ts` or a
+`*.startup.tsx`), and the boot says so:
+
+```
+policy guards: using the app-registered tuple source
+```
+
+That line is worth knowing, because its absence is the diagnosis when your own
+source is not being consulted.
 
 **Every unanswerable case denies.** No tuple source registered, no policy for
 that `resourceType`, an input that doesn't identify a resource, a tuple source