@voltro/cli 0.42.0 → 0.43.0

package/dist/{dormancyCommand-CUKhRmGG.js → dormancyCommand-D1DKnYce.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-D4l_YOzI.js";
+import { c as e, i as t } from "./dev-B2rZfqxw.js";
 import { n, t as r } from "./cliArgs-D4p8n7EE.js";
 import { r as i } from "./appPort-B_HpJ_ck.js";
 import { resolve as a } from "node:path";

package/dist/{embeddingsCommand-Db-iQM3l.js → embeddingsCommand-1sZRBKlM.js}

@@ -1,4 +1,4 @@
-import { c as e, i as t } from "./dev-D4l_YOzI.js";
+import { c as e, i as t } from "./dev-B2rZfqxw.js";
 import { Effect as n } from "effect";
 import { embedMany as r } from "@voltro/ai";
 //#region src/embeddingsBackfill.ts

package/dist/{envCommand-DQ_URZq9.js → envCommand-7qjlQgLD.js}

@@ -1,5 +1,5 @@
-import { c as e } from "./dev-D4l_YOzI.js";
-import { _t as t, gt as n, mt as r, pt as i } from "./webDev-Dk8lFUzf.js";
+import { c as e } from "./dev-B2rZfqxw.js";
+import { _t as t, gt as n, mt as r, pt as i } from "./webDev-101csg6Q.js";
 import { join as a } from "node:path";
 import { promises as o } from "node:fs";
 import { createLogger as s } from "@voltro/logger";

package/dist/{evolveCommand-CghRPrGO.js → evolveCommand-D5opB48I.js}

@@ -1,6 +1,6 @@
 import { n as e } from "./cliOutput-D1tSBoRM.js";
-import { t } from "./checkCommand-DWL2_PPR.js";
-import { i as n, n as r } from "./codemodRunner-sFuWDETH.js";
+import { t } from "./checkCommand-DDxwJCja.js";
+import { i as n, n as r } from "./codemodRunner-Cnnz4-I7.js";
 import { basename as i, join as a, resolve as o } from "node:path";
 import { branchNamespaceName as s, planBranchProvision as c } from "@voltro/database";
 import { readFile as l } from "node:fs/promises";

package/dist/index.js

@@ -1,4 +1,4 @@
-import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-DoTClnSk.js";
+import { a as e, i as t, n, o as r, r as i, t as a } from "./commands-CbQcuWsE.js";
 import { r as o } from "./templates-BR-fb4SP.js";
 //#region src/index.ts
 var s = "framework";

package/dist/{infoCommand-BCs_ZFnl.js → infoCommand-Bs_8RU22.js}

@@ -1,5 +1,5 @@
 import { n as e, r as t, t as n } from "./cliOutput-D1tSBoRM.js";
-import { o as r } from "./updateCommand-HZQVBU3T.js";
+import { o as r } from "./updateCommand-CrI9B4d7.js";
 import { join as i, resolve as a } from "node:path";
 import { readFileSync as o, readdirSync as s, statSync as c } from "node:fs";
 //#region src/infoCommand.ts

package/dist/{runtimeTrace-jFKvOPBz.js → runtimeTrace-Wmi7V-wN.js}

@@ -1,4 +1,4 @@
-import { n as e } from "./apiBuild-B_iH24qf.js";
+import { n as e } from "./apiBuild-DF0f69Gf.js";
 import { join as t, resolve as n, sep as r } from "node:path";
 import { existsSync as i, promises as a } from "node:fs";
 import { createLogger as o } from "@voltro/logger";

package/dist/{sdkgen-COQqHB9V.js → sdkgen-DbTFGCjg.js}

@@ -422,7 +422,7 @@ let package = Package(
 		await l.mkdir(o(e), { recursive: !0 }), await l.writeFile(e, n.content, "utf8");
 	}
 }, X = async (e) => {
-	let { offlineManifest: t } = await import("./checkCommand-B2RWrpWi.js"), { manifest: n } = await t(e);
+	let { offlineManifest: t } = await import("./checkCommand-DBpTSK8d.js"), { manifest: n } = await t(e);
 	return n;
 }, Z = async (e) => {
 	let t = J(await (e.manifestProvider ?? X)(e.root), {

package/dist/{serveCommand-C512kzZA.js → serveCommand-C8xzYCwa.js}

@@ -3,10 +3,10 @@ import { t } from "./frameworkInspectState-CX2250XB.js";
 import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
 import { t as i } from "./bootRefusal-pgvDxlrU.js";
 import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
-import { $ as s, $t as ee, A as c, At as l, B as u, C as te, Ct as d, D as ne, Dt as f, E as re, Et as p, F as ie, Ft as m, G as h, Gt as ae, H as oe, I as se, It as ce, J as le, Jt as g, K as ue, Kt as _, L as de, Lt as fe, M as pe, Mt as v, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as Se, Rt as y, S as Ce, Sn as we, St as Te, T as Ee, Tt as De, U as Oe, Ut as b, V as ke, Vt as Ae, W as je, Wt as Me, X as Ne, Xt as Pe, Y as Fe, Yt as Ie, Z as Le, Zt as x, _ as Re, _n as ze, _t as S, an as Be, at as C, b as Ve, bn as He, bt as Ue, c as We, cn as w, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as T, fn as E, ft as Xe, g as Ze, gn as Qe, gt as $e, h as et, ht as tt, i as nt, in as rt, it, j as at, jt as ot, k as st, kt as ct, ln as D, lt, m as ut, mn as dt, mt as O, nn as k, nt as ft, o as A, on as pt, ot as mt, p as ht, pn as gt, pt as _t, q as vt, qt as yt, r as bt, rn as xt, rt as St, sn as Ct, st as wt, t as Tt, tn as Et, tt as Dt, u as Ot, un as kt, ut as At, v as jt, vn as j, vt as M, w as N, wt as Mt, x as Nt, xn as Pt, xt as Ft, y as It, yn as Lt, yt as Rt, zt } from "./dev-D4l_YOzI.js";
+import { $ as s, $t as ee, A as c, At as l, B as u, C as te, Ct as d, D as ne, Dt as f, E as re, Et as p, F as ie, Ft as m, G as h, Gt as ae, H as oe, I as se, It as ce, J as le, Jt as g, K as ue, Kt as _, L as de, Lt as fe, M as pe, Mt as v, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as Se, Rt as y, S as Ce, Sn as we, St as Te, T as Ee, Tt as De, U as Oe, Ut as b, V as ke, Vt as Ae, W as je, Wt as Me, X as Ne, Xt as Pe, Y as Fe, Yt as Ie, Z as Le, Zt as x, _ as Re, _n as ze, _t as S, an as Be, at as C, b as Ve, bn as He, bt as Ue, c as We, cn as w, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as T, fn as E, ft as Xe, g as Ze, gn as Qe, gt as $e, h as et, ht as tt, i as nt, in as rt, it, j as at, jt as ot, k as st, kt as ct, ln as D, lt, m as ut, mn as dt, mt as O, nn as k, nt as ft, o as A, on as pt, ot as mt, p as ht, pn as gt, pt as _t, q as vt, qt as yt, r as bt, rn as xt, rt as St, sn as Ct, st as wt, t as Tt, tn as Et, tt as Dt, u as Ot, un as kt, ut as At, v as jt, vn as j, vt as M, w as N, wt as Mt, x as Nt, xn as Pt, xt as Ft, y as It, yn as Lt, yt as Rt, zt } from "./dev-B2rZfqxw.js";
 import { n as Bt } from "./cliArgs-D4p8n7EE.js";
 import { r as Vt } from "./appPort-B_HpJ_ck.js";
-import { ht as Ht, pt as P } from "./webDev-Dk8lFUzf.js";
+import { ht as Ht, pt as P } from "./webDev-101csg6Q.js";
 import { r as F } from "./dialectDriver-czCHYpeH.js";
 import { i as Ut, n as Wt } from "./connectionConfig-Bk9IC7D0.js";
 import { c as Gt, n as Kt, o as qt } from "./seedRunner-IdHEprqf.js";
@@ -16,7 +16,7 @@ import { h as un, o as dn } from "./inspect-B7U7Cl_Z.js";
 import { n as fn } from "./mssqlClusterPatch-_4cE_nun.js";
 import { i as pn, n as mn, r as hn, t as gn } from "./webhookDiscovery-CphsQe59.js";
 import { t as _n } from "./inspectMetrics-CfdKLh6t.js";
-import { r as vn, u as yn } from "./apiBuild-B_iH24qf.js";
+import { r as vn, u as yn } from "./apiBuild-DF0f69Gf.js";
 import { t as bn } from "./bootTiming-BdyP9nYw.js";
 import { t as xn } from "./dataProfile-Cm0YVKSy.js";
 import { basename as Sn, join as Cn } from "node:path";
@@ -1702,7 +1702,7 @@ var ji = () => Math.max(500, Math.floor(Yr() * .6)), Mi = (e) => new Promise((t)
 		schemaRegistry: Ue,
 		tenantScopedTables: _.tenantScopedTables,
 		softDeleteScopedTables: _.softDeleteScopedTables,
-		dataTransferSnapshot: Hn(x),
+		dataTransferSnapshot: Hn(x, h),
 		dataTransferDialect: h,
 		...Gr === void 0 ? {} : { ensureTenantProvisioned: Gr.ensure },
 		...qr === void 0 ? {} : { resolveResidentStore: qr.resolveStore },

package/dist/serveCommand-CGNTXafv.js

@@ -0,0 +1,2 @@
+import { n as e } from "./serveCommand-C8xzYCwa.js";
+export { e as runServeDispatch };

package/dist/serveEntry.js

@@ -1,5 +1,5 @@
 import { t as e } from "./loadEnv-D9nEOClM.js";
 import { r as t } from "./appModuleLoader-C9r9mxZt.js";
 import { i as n } from "./dialectDriver-czCHYpeH.js";
-import { t as r } from "./serveCommand-C512kzZA.js";
+import { t as r } from "./serveCommand-C8xzYCwa.js";
 export { e as loadDotEnv, t as registerAppModules, n as registerDriver, r as runServe };

package/dist/{start-fifc0xpW.js → start-BAlGcjF5.js}

@@ -1,3 +1,3 @@
 import "./renderModeScan-D7J1B7Kw.js";
-import { t as e } from "./start-BjcuFME_.js";
+import { t as e } from "./start-Ds3xyn8R.js";
 export { e as runStartCommand };

package/dist/{start-BjcuFME_.js → start-Ds3xyn8R.js}

@@ -1,6 +1,6 @@
 import { i as e, t } from "./nodeEnvironment-cGFAj1J8.js";
 import { r as n } from "./appPort-B_HpJ_ck.js";
-import { A as r, C as i, D as a, E as o, F as s, H as c, I as l, J as ee, L as u, M as d, N as f, O as te, P as p, R as m, S as h, T as ne, V as g, W as re, X as _, Y as v, Z as y, a as b, b as x, d as S, f as C, ht as w, i as ie, j as T, k as E, n as D, nt as O, q as k, s as ae, tt as A, vt as j, x as oe, y as M, z as se } from "./webDev-Dk8lFUzf.js";
+import { A as r, C as i, D as a, E as o, F as s, H as c, I as l, J as ee, L as u, M as d, N as f, O as te, P as p, R as m, S as h, T as ne, V as g, W as re, X as _, Y as v, Z as y, a as b, b as x, d as S, f as C, ht as w, i as ie, j as T, k as E, n as D, nt as O, q as k, s as ae, tt as A, vt as j, x as oe, y as M, z as se } from "./webDev-101csg6Q.js";
 import { o as N, t as P } from "./connectionConfig-Bk9IC7D0.js";
 import { A as F, D as I, a as ce, h as le, j as ue, k as de } from "./inspect-B7U7Cl_Z.js";
 import { a as fe, c as L, d as pe, f as R, l as me, p as he, u as ge } from "./renderModeScan-D7J1B7Kw.js";

package/dist/startEntry.js

@@ -1,3 +1,3 @@
 import { t as e } from "./loadEnv-D9nEOClM.js";
-import { t } from "./start-BjcuFME_.js";
+import { t } from "./start-Ds3xyn8R.js";
 export { e as loadDotEnv, t as runStartCommand };

package/dist/startup.d.ts

@@ -22,7 +22,7 @@ import { SyncLogger } from '@voltro/logger';
  * So the race protected the shape we discourage and penalised the shape we
  * teach — and the penalised one includes `searchBackfill`, our own example,
  * which awaits a full-table query plus an index backfill and is the likeliest
- * thing in the box to exceed two seconds. Slow AND failing put a consumer back
+ * thing in the box to exceed two seconds. Slow AND failing put a deployment back
  * in exactly the silent state this file was fixed for.
  *
  * 60 seconds because the number now has one job: turn "hangs forever" into

package/dist/updateCommand-BvkKlV7D.js

@@ -0,0 +1,2 @@
+import { f as e, p as t } from "./updateCommand-CrI9B4d7.js";
+export { e as runApplyCodemods, t as runUpdateCommand };

package/dist/{updateCommand-HZQVBU3T.js → updateCommand-CrI9B4d7.js}

@@ -1,4 +1,4 @@
-import { n as e, r as t, t as n } from "./codemodRunner-sFuWDETH.js";
+import { n as e, r as t, t as n } from "./codemodRunner-Cnnz4-I7.js";
 import { basename as r, dirname as i, join as a, relative as o, resolve as s } from "node:path";
 import { existsSync as c, readFileSync as l, readdirSync as u, statSync as d, writeFileSync as f } from "node:fs";
 import { totalmem as p } from "node:os";

package/dist/{webDev-Dk8lFUzf.js → webDev-101csg6Q.js}

@@ -401,7 +401,7 @@ __installPublicEnv(publicEnvValues)
 		"   same version at release — so this combination was never built or tested",
 		"   as a set. It is not a judgement about whether they are compatible.",
 		"",
-		"   Nothing else will tell you. A consumer carried a package two releases",
+		"   Nothing else will tell you. A deployment carried a package two releases",
 		"   behind through `tsc`, 19 317 tests, `voltro doctor` exit 0 in four apps",
 		"   and three production builds, all green. None of those checks is ABOUT",
 		"   version agreement.",
@@ -2326,7 +2326,7 @@ The wrapper is what carries \`match\`, and what lets \`voltro doctor\` report wh
 				"  const published = document.documentElement.lang",
 				"  if (published && I18N_SUPPORTED.includes(published)) return published",
 				"  // No published locale (a page served by something else, or an",
-				"  // attribute a consumer overwrote): fall back to the cookie, which",
+				"  // attribute a deployment overwrote): fall back to the cookie, which",
 				"  // both halves can read, and never to a client-only signal.",
 				"  return resolveLocale({",
 				"    cookieHeader: document.cookie,",

package/dist/webDev-BLKBO34K.js

@@ -0,0 +1,2 @@
+import { _ as e, y as t } from "./webDev-101csg6Q.js";
+export { e as tryRunWebServe, t as walkPagesTree };

package/dist/{webhooksCommand-D7ZpH7w0.js → webhooksCommand-BXUP5YjW.js}

@@ -222,7 +222,7 @@ createVerifier({ secret: [process.env.WEBHOOK_SECRET, process.env.WEBHOOK_SECRET
 		...t === void 0 ? {} : { payload: t }
 	};
 }, S = u({ scope: "voltro:webhooks" }), C = ["--out", "--name"], w = async (e) => {
-	let { walk: t, loadDiscovered: n } = await import("./dev-DuqBJC7g.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-il9ti-HE.js");
+	let { walk: t, loadDiscovered: n } = await import("./dev-D0E5x2Ue.js"), { outgoingFromEvents: r } = await import("./webhookDiscovery-il9ti-HE.js");
 	return r((await n(await t(e))).events.map((e) => ({
 		file: e.file,
 		descriptor: e.descriptor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/cli",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "The `voltro` CLI — dev server, codegen, migrations, project scaffolding, agent-docs seeding, and production serve.",
   "keywords": [
     "voltro",
@@ -628,6 +628,12 @@
         "title": "`middleware.ts` exports `defineMiddleware(...)` and can say where it runs",
         "kind": "transform"
       },
+      {
+        "version": "0.43.0",
+        "id": "0.43.0/01_dangling-reference-to-rows-refused",
+        "title": "`DanglingReferenceError` → `RowsRefusedError` (named for the outcome, not a guessed cause)",
+        "kind": "transform"
+      },
       {
         "version": "0.5.0",
         "id": "0.5.0/01_one-terminal-exactly-one",
@@ -715,22 +721,22 @@
     "@effect/platform-node": "^0.108.0",
     "@effect/sql": "^0.52.0",
     "@effect/workflow": "^0.19.0",
-    "@voltro/ai": "0.42.0",
-    "@voltro/cache": "0.42.0",
-    "@voltro/data-transfer": "0.42.0",
-    "@voltro/database": "0.42.0",
-    "@voltro/env": "0.42.0",
-    "@voltro/kv": "0.42.0",
-    "@voltro/logger": "0.42.0",
-    "@voltro/plugin-auth": "0.42.0",
-    "@voltro/plugin-broadcast": "0.42.0",
-    "@voltro/plugin-mail": "0.42.0",
-    "@voltro/plugin-storage": "0.42.0",
-    "@voltro/plugin-webhooks": "0.42.0",
-    "@voltro/protocol": "0.42.0",
-    "@voltro/runtime": "0.42.0",
-    "@voltro/serverless": "0.42.0",
-    "@voltro/workflow": "0.42.0",
+    "@voltro/ai": "0.43.0",
+    "@voltro/cache": "0.43.0",
+    "@voltro/data-transfer": "0.43.0",
+    "@voltro/database": "0.43.0",
+    "@voltro/env": "0.43.0",
+    "@voltro/kv": "0.43.0",
+    "@voltro/logger": "0.43.0",
+    "@voltro/plugin-auth": "0.43.0",
+    "@voltro/plugin-broadcast": "0.43.0",
+    "@voltro/plugin-mail": "0.43.0",
+    "@voltro/plugin-storage": "0.43.0",
+    "@voltro/plugin-webhooks": "0.43.0",
+    "@voltro/protocol": "0.43.0",
+    "@voltro/runtime": "0.43.0",
+    "@voltro/serverless": "0.43.0",
+    "@voltro/workflow": "0.43.0",
     "chokidar": "^5.0.0",
     "ioredis": "^5.11.1",
     "tinyglobby": "^0.2.17",

package/templates/AGENTS.md

@@ -707,7 +707,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.42.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.43.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/_index.md

@@ -9,7 +9,7 @@ each plugin's own README.
 
 | Topic | Open | Summary |
 |---|---|---|
-| **What's new in 0.42.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
+| **What's new in 0.43.0** | `node_modules/@voltro/cli/templates/agent-docs/whats-new.md` | Everything that changed in this version. Read it before hand-rolling something the framework may now ship. |
 | AI | `node_modules/@voltro/cli/templates/agent-docs/ai.md` | How Voltro treats AI — agents, tools, streaming, RAG — all primitives over the same WebSocket as the rest of the framework. |
 | Authentication | `node_modules/@voltro/cli/templates/agent-docs/authentication.md` | How @voltro/plugin-auth wires password + session-cookie auth across api + web, plus the pluggable identity-strategy protocol. |
 | Caching | `node_modules/@voltro/cli/templates/agent-docs/caching.md` | Voltro's caching layer (@voltro/cache) — an always-on memory default, swappable Redis-compatible backends, a low-level wrap primitive, and automatic query-result invalidation. |

package/templates/agent-docs/authentication.md

@@ -2166,7 +2166,7 @@ enforcing nothing while looking like it does.
 **A guard naming an unregistered `resourceType` refuses the BOOT.** Denying is
 correct per call and useless as a deployment outcome: the app comes up green and
 every guarded procedure is down, with a log line per refused call as the only
-sign. A consumer put a number on it — 39 procedures, team settings through role
+sign. A deployment put a number on it — 39 procedures, team settings through role
 administration. So the two facts are compared once, after the startups have run,
 and a missing registration names the type and the procedures that demanded it.
 The commonest cause is a typo: the `resourceType` in a guard and the one in

package/templates/agent-docs/cli.md

@@ -1690,7 +1690,7 @@ It covers both halves of the stack:
 | client | `data === undefined` / `!data` on a subscription result | branch on `loading` (and `idle`, if you pass `skip`) |
 
 The subscription rule **resolves the binding** rather than matching text, and
-that distinction is the reason this scanner parses at all. A consumer migrating
+that distinction is the reason this scanner parses at all. A deployment migrating
 these call sites wrote a regex codemod for the same job, and it rewrote a
 `summary === undefined` check inside a child component where `summary` was a
 PROP. Their compiler happened to catch it, because that name was out of scope
@@ -3777,7 +3777,7 @@ you ran it keeps the module graph it loaded at boot, so it goes on executing the
 previous version indefinitely — and against a `.framework` directory that has
 since been rewritten.
 
-That mix is worse than either version alone. A consumer lost half an hour to a
+That mix is worse than either version alone. A deployment lost half an hour to a
 pod whose api had started before the upgrade: it served requests, reported
 healthy, and returned no SSR at all, because the running process held the old
 modules while the build output on disk was new.

package/templates/agent-docs/data.md

@@ -275,7 +275,7 @@ fails the call with a `ParseError` naming the key and listing what was expected:
 ```
 
 It used to be discarded silently, and the reason that is worse than it sounds is
-what a discarded FILTER means. A consumer's layout called a `userSettings.list`
+what a discarded FILTER means. A deployment's layout called a `userSettings.list`
 that declares `userId` with `{ employeeId }`; the payload decoded to `{}`, which
 for a list query is not a narrower filter but the absence of one, and an admin
 was served another user's row.
@@ -2294,7 +2294,7 @@ export default (input, ctx) => Effect.gen(function* () {
 
 **Inside a mutation it fires on COMMIT, and not at all on rollback.** That is not a nicety: a display reacting to a game start the database rolled back happens on every constraint violation, every deadlock retry, every guard that fails *after* the publish line. Outside a transaction it fires immediately.
 
-Three typed errors reach the **producer**, so a mismatch is one failing call rather than every consumer's handler breaking on a field that is not there: `EventPayloadInvalid`, `EventKeyInvalid`, `EventPayloadTooLarge`.
+Three typed errors reach the **producer**, so a mismatch is one failing call rather than every deployment's handler breaking on a field that is not there: `EventPayloadInvalid`, `EventKeyInvalid`, `EventPayloadTooLarge`.
 
 `EventPayloadTooLarge` fires at **7,500 bytes** for the encoded envelope (event
 name + key + payload, as JSON). The ceiling is not arbitrary and it is not a
@@ -2631,7 +2631,7 @@ delivery matters drops the ones in between; choosing `each` for a per-frame
 stream makes a slow client work through a backlog to reach a state it could have
 had immediately, and report a "loss" that was never one.
 
-The test: **would a consumer be wrong to miss one?**
+The test: **would a deployment be wrong to miss one?**
 
 <Callout type="warn">
 `delivery: 'latest'` cannot be combined with `webhook`, and the declaration is
@@ -2654,7 +2654,7 @@ separate, coarser one for the outside world.
   publishing at 10–20Hz is usually indistinguishable to a human and an order of
   magnitude cheaper.
 
-The honest rule: **use an event when a consumer would be wrong to miss one.** If
+The honest rule: **use an event when a deployment would be wrong to miss one.** If
 missing one is fine because the next one supersedes it, either declare
 `delivery: 'latest'` or model it as state — a table, or a value the client
 replaces.
@@ -4756,23 +4756,25 @@ declared it anyway, that is harmless — the union is the same either way.
 
 ## Framework-shipped error variants
 
-`@voltro/protocol` exports exactly two tagged errors. The rest of your typed errors are ones you declare yourself (above) or ones a plugin / the runtime contributes.
+`@voltro/protocol` exports the framework's own tagged errors. The rest of your typed errors are ones you declare yourself (above) or ones a plugin contributes.
+
+**Import them from `@voltro/protocol`, not from `@voltro/runtime`** — even the store errors the runtime raises. A descriptor that declares one in `error:` is loaded value-level by the web client (the `RpcClient` needs every procedure's Schema), and `@voltro/runtime` is server-only, so a descriptor importing from it is refused at boot by the browser-safety guard. `@voltro/runtime` re-exports them for server code, which never sees the difference.
 
 | Variant | From | When |
 |---|---|---|
 | `ScopeError` | `@voltro/protocol` | `requireScope(subject, scope)` failed — `{ required, message }`. |
 | `Unauthenticated` | `@voltro/protocol` | The resolved Subject is anonymous but a signed-in caller was required — optional `{ reason }`. |
-| `TenantScopeViolation` | `@voltro/runtime` | A tenant-scoped `EffectStore` write had no authenticated subject. |
-| `TenantRowNotFound` | `@voltro/runtime` | A keyed-by-id write (`store.update(t, id, …)`, `delete`, `hardDelete`, `patchJson`) on a `tenant()` table found no such row **in the caller's tenant**. Raised identically whether the row is missing or belongs to another tenant — the distinction would be a cross-tenant existence oracle. |
-| `ServerOnlyColumnWrite` | `@voltro/runtime` | A `crud.create` / `crud.update` input tried to set a [`.serverOnly()`](/docs/database/sensitivity) column — `{ table, columns }`. |
-| `StoreOperationFailed` | `@voltro/runtime` | The underlying store operation failed (transient). |
-| `TableValidationFailed` | `@voltro/runtime` | A `table().validate(Schema)` row check rejected the write. |
-| `ConstraintViolation` | `@voltro/runtime` | The database refused the write on a foreign key / unique / NOT NULL / CHECK — `{ kind, table, operation, constraint?, column? }`. See below. |
+| `TenantScopeViolation` | `@voltro/protocol` | A tenant-scoped `EffectStore` write had no authenticated subject. |
+| `TenantRowNotFound` | `@voltro/protocol` | A keyed-by-id write (`store.update(t, id, …)`, `delete`, `hardDelete`, `patchJson`) on a `tenant()` table found no such row **in the caller's tenant**. Raised identically whether the row is missing or belongs to another tenant — the distinction would be a cross-tenant existence oracle. |
+| `ServerOnlyColumnWrite` | `@voltro/protocol` | A `crud.create` / `crud.update` input tried to set a [`.serverOnly()`](/docs/database/sensitivity) column — `{ table, columns }`. |
+| `StoreOperationFailed` | `@voltro/protocol` | The underlying store operation failed (transient). |
+| `TableValidationFailed` | `@voltro/protocol` | A `table().validate(Schema)` row check rejected the write. |
+| `ConstraintViolation` | `@voltro/protocol` | The database refused the write on a foreign key / unique / NOT NULL / CHECK — `{ kind, table, operation, constraint?, column? }`. See below. |
 | `CacheError` | `@voltro/cache` | A cache backend op failed — `{ operation, key, cause }`. |
 | `RateLimited` | `@voltro/plugin-ratelimit` | The limiter rejected the call — `{ limit, retryAfterMs, resetAtMs }`. |
 | `TenantMismatch` | `@voltro/plugin-multitenancy` | `assertOwnTenant(input.tenantId, subject)` rejected a cross-tenant write. |
 
-Each plugin that ships an error (`RateLimited`, `EntitlementExceeded`, `StorageError`, `MailError`, …) merges it into every procedure's wire-error union, so the client decodes it typed without you adding it to each `error:`. To surface a runtime store error to the client, add it to the descriptor's `error:` union yourself (e.g. `error: Schema.Union(TenantScopeViolation, StoreOperationFailed, MyDomainError)`).
+Each plugin that ships an error (`RateLimited`, `EntitlementExceeded`, `StorageError`, `MailError`, …) merges it into every procedure's wire-error union, so the client decodes it typed without you adding it to each `error:`. To surface a store error to the client, add it to the descriptor's `error:` union yourself (e.g. `error: Schema.Union(TenantScopeViolation, StoreOperationFailed, MyDomainError)`).
 
 All carry `_tag` + typed payloads, all narrow correctly on the client.
 

package/templates/agent-docs/database/migrations.md

@@ -1707,7 +1707,7 @@ The cloud dashboard surfaces per-env state with a multi-env tab in the [cloud UI
 
 ## Rehearsing a migration against real data
 
-The strongest check on this pipeline is not that each command exits 0 — it is that **no row moved that you did not ask to move**. A consumer running a MariaDB cutover built this loop and it caught three defects the framework's own suite did not; the method is theirs, written up here because the next person should not have to invent it.
+The strongest check on this pipeline is not that each command exits 0 — it is that **no row moved that you did not ask to move**. This loop was built for a MariaDB cutover and caught three defects the framework's own suite did not, which is why it is written up here.
 
 1. **Restore a backup into a throwaway database.**
 

package/templates/agent-docs/internationalization.md

@@ -91,7 +91,7 @@ import { LOCALE_COOKIE, THEME_COOKIE } from '@voltro/i18n'
 
 Import them rather than retyping `'voltro:locale'`. A cookie name the framework READS and your app WRITES is a public API, and it is the only kind where both sides can disagree without anything failing: nothing throws, no page breaks, the resolver simply finds nothing and falls back to `Accept-Language`. The symptom is a preference that stops working for the subset of users whose browser language differs from their choice — the least likely thing anyone tests.
 
-> Until 0.31.0 the only package exporting these was `@voltro/ui-shadcn`, and `voltro doctor` told you to import from there. An app on this package and not on the shadcn kit had no constant to reach for, and would have had to adopt a UI kit for two strings. Reported by a consumer, who added that the rule "does not fire for us, and we think that is correct-by-accident".
+> Until 0.31.0 the only package exporting these was `@voltro/ui-shadcn`, and `voltro doctor` told you to import from there. An app on this package and not on the shadcn kit had no constant to reach for, and would have had to adopt a UI kit for two strings. Reported by a deployment, who added that the rule "does not fire for us, and we think that is correct-by-accident".
 
 ## `Could not find required 'intl' object` during SSR
 
@@ -106,7 +106,7 @@ holds 2 live copies of @voltro/i18n bound to
 2 distinct react-intl instances.
 ```
 
-**Do not use `pnpm ls` to rule this out.** It enumerates versions ON DISK; the failure is module INSTANCES in a running process, and one file loaded down two paths is two instances. A consumer reported a 500 on every SSR page with exactly one version of each installed — they were right, and the check we had published could not observe the cause. If the count says one of each, it is a framework bug and the diagnosis says so.
+**Do not use `pnpm ls` to rule this out.** It enumerates versions ON DISK; the failure is module INSTANCES in a running process, and one file loaded down two paths is two instances. A deployment reported a 500 on every SSR page with exactly one version of each installed — they were right, and the check we had published could not observe the cause. If the count says one of each, it is a framework bug and the diagnosis says so.
 
 The framework keeps both packages on one SSR instance by bundling them together (`ssr.noExternal`) and deduping them, in `voltro dev`, `voltro build` and `voltro start` alike. The remaining way to get a second copy is in your own code: building a provider from `react-intl` **directly** rather than from `@voltro/i18n`.
 

package/templates/agent-docs/observability.md

@@ -227,7 +227,7 @@ The in-memory ring always keeps EVERY span for live debugging. SEPARATELY, on po
 - **Default OFF in production, `interesting` in dev.** `voltro dev` (not `NODE_ENV=production`) persists only "interesting" spans. `voltro serve` / `voltro start` default `NODE_ENV=production` when it's unset, so they persist NOTHING and **`_voltro_traces` is not even created** — use OTLP in prod. An explicit `NODE_ENV` is never overridden.
 - **`VOLTRO_TRACING_PERSIST`** = `off` | `errors` | `interesting` | `all` (overrides the env default everywhere). `interesting` = error + slow + per-trace root spans, MINUS the high-volume subscription delivery (snapshot/delta) spans, MINUS the framework's own background-task reads. `errors` = error spans only. `all` = every non-delivery span. `off` = no persistence and no table.
 
-  **Why background tasks are excluded from "slow".** The framework polls four of its own tables on a timer (`_voltro_schedule_claims`, `_voltro_workflow_pending`, `_voltro_workflow_pauses`, `_voltro_ai_inferences`). Those reads are slow exactly when the database is under pressure — which is when persisting them costs the most. A consumer measured the loop closing on itself: `_voltro_traces` at 476 571 rows / 335 MB, writing ~11 INSERTs/s onto the same 15-slot pooler the app read through, 99 % of it framework poller spans. Pool pressure makes the spans slow, slow spans are "interesting", persisting them costs pool. They are still kept when they ERROR, and `all` mode still keeps everything. A request-path framework table like `_voltro_api_keys` is NOT excluded — a slow lookup there is a real user waiting.
+  **Why background tasks are excluded from "slow".** The framework polls four of its own tables on a timer (`_voltro_schedule_claims`, `_voltro_workflow_pending`, `_voltro_workflow_pauses`, `_voltro_ai_inferences`). Those reads are slow exactly when the database is under pressure — which is when persisting them costs the most. A deployment measured the loop closing on itself: `_voltro_traces` at 476 571 rows / 335 MB, writing ~11 INSERTs/s onto the same 15-slot pooler the app read through, 99 % of it framework poller spans. Pool pressure makes the spans slow, slow spans are "interesting", persisting them costs pool. They are still kept when they ERROR, and `all` mode still keeps everything. A request-path framework table like `_voltro_api_keys` is NOT excluded — a slow lookup there is a real user waiting.
 - **`VOLTRO_TRACING_SLOW_MS`** (default `500`) — the "slow" threshold used by `interesting`.
 - **`VOLTRO_TRACING_PERSIST_DELIVERY`** (default off) — also persist the subscription delivery spans (the firehose; rarely wanted).
 - **`VOLTRO_TRACING_SAMPLE`** (`0`–`1`, default `1`) — per-*trace* sampling (a kept trace keeps all its eligible spans; errors are never sampled out). `=0` with no explicit mode means off.

package/templates/agent-docs/plugins/openapi.md

@@ -73,7 +73,7 @@ Per procedure kind:
 - **stream** → the `element` Schema is documented as a streaming response (`application/x-ndjson`, one element per line) — **not** faked as a single JSON value.
 - The procedure's **typed error channel** (its `Schema.TaggedError` union) becomes a `422` response referencing the error schema; a procedure with no declared error documents only `200` + `500`.
 
-Mixing rpc + REST in one spec is fine — the rpc operations are grouped under the `rpc` tag and flagged `x-voltro-rpc`, so a consumer can tell them apart from real REST routes. `procedures` is opt-in: omit it to keep the spec REST-only.
+Mixing rpc + REST in one spec is fine — the rpc operations are grouped under the `rpc` tag and flagged `x-voltro-rpc`, so a deployment can tell them apart from real REST routes. `procedures` is opt-in: omit it to keep the spec REST-only.
 
 ## Access control
 

package/templates/agent-docs/plugins/versioning.md

@@ -58,7 +58,7 @@ If 41 surprises you, `exclude` is the knob. The retention sweep (`VOLTRO_ROW_HIS
 
 Versioning records **row changes, not domain events**. One entry per row per write, named by *table*. If your product has a user-facing audit feature whose entries are named after an aggregate root — one `Team` event for a call that writes `teams` + `roles` + `userTeams` + `userTeamRoles` — this is the layer **underneath** that, not a replacement for it.
 
-The distinction is worth reading before you plan a migration onto it. A consumer with 331 hand-written audit calls set out to delete them all in favour of this tap and found three hours in that the grain is different: a table-keyed tap does not produce an aggregate-keyed trail with better coverage, it produces a *different artifact*. Their conclusion — and ours — is that the two compose:
+The distinction is worth reading before you plan a migration onto it. A migration off hundreds of hand-written audit calls onto this tap runs into the same wall a few hours in: the grain is different. A table-keyed tap does not produce an aggregate-keyed trail with better coverage, it produces a *different artifact*. The two compose:
 
 - **versioning** answers "what did row R look like before, and after" — for every write, whether or not anyone remembered to record it;
 - an **aggregate trail** (the [audit sink](/docs/plugins/audit), one row per mutation invocation) answers "what business operation happened, to which entity, and did it succeed";

package/templates/agent-docs/plugins/webhooks.md

@@ -211,7 +211,7 @@ means equality; an object names an operator. `eq`, `in`, `gt`, `gte`, `lt`, `lte
 — those six and nothing else. **An unsupported operator falls through to `===`
 and therefore matches nothing.**
 
-**This was typed `Readonly<Record<string, unknown>>` and it cost a consumer a
+**This was typed `Readonly<Record<string, unknown>>` and it cost a deployment a
 feature for a year.** They wrote in a code comment that the filter was key-path
 equality and could not express "id is one of these", refused that capability in
 their own API with a typed error, and shipped it — while `in` had been supported

package/templates/agent-docs/plugins.md

@@ -1120,7 +1120,7 @@ store.onChange((event) => {
 ```
 
   Why this exists: two framework tasks polled permanently-empty queues on a
-  consumer's deployment and wrote **2 506 claim rows an hour** between them,
+  deployment's deployment and wrote **2 506 claim rows an hour** between them,
   against 18 from the app's own eight schedules. A fixed interval has no way to
   learn that a queue is empty. Without a `wake()` source the ceiling is your
   worst-case latency, so a task whose arrivals cannot announce themselves should

package/templates/agent-docs/routing.md

@@ -1058,7 +1058,7 @@ that look like they answer the same question do not:
   branches on the ABSENCE OF A FUNCTION, which says nothing about why it is
   absent and breaks the moment anything else becomes conditional.
 - **`headers` is `{}` in the browser, not `undefined`** — so `if (ctx.headers)`
-  is TRUE on both paths. A consumer wrote exactly that check and it silently did
+  is TRUE on both paths. A deployment wrote exactly that check and it silently did
   nothing.
 
 ```ts

package/templates/agent-docs/scheduling.md

@@ -363,7 +363,7 @@ Losers don't write a run row — at scale that would be N−1 noise rows per fir
     and a plugin's over a framework default.
 ```
 
-Through 0.32.0 this was a silent last-write-wins: a consumer's 1-hour bound was replaced one second later by the framework's default, their startup went on logging `bounded to 1h` at every boot, and they found it by counting rows. Note the direction — the loser is chosen by WHO registered, not by which TTL is narrower. "Narrower wins" would let a framework default we tighten in a later release silently start deleting your data faster than you asked for.
+Through 0.32.0 this was a silent last-write-wins: a deployment's 1-hour bound was replaced one second later by the framework's default, the startup went on logging `bounded to 1h` at every boot, and it was found by counting rows. Note the direction — the loser is chosen by WHO registered, not by which TTL is narrower. "Narrower wins" would let a framework default we tighten in a later release silently start deleting your data faster than you asked for.
 
 ## `cluster`
 

package/templates/agent-docs/security.md

@@ -59,7 +59,7 @@ payload therefore answers with a decode error, not a `ScopeError` — and readin
 that as "the guard is not applied" is the wrong conclusion in the dangerous
 direction.
 
-A consumer reached exactly that conclusion while auditing a guard, and flipped
+That conclusion is easy to reach while auditing a guard, and flipped
 back the moment they sent a complete payload. So a guarded procedure says it in
 the failure:
 
@@ -107,7 +107,7 @@ yield* enrich(userSuppliedUrl).pipe(
 
 Two things worth knowing if you are upgrading from a version before this was a failure:
 
-- **It used to be a defect** (`Effect.die`), so code that handled it did so with `Effect.catchAllDefect`. That arm no longer fires. If you also have an `Effect.mapError` above it, the rejection now reaches `mapError` FIRST — and a delivery that classified an SSRF block as *terminal* in the defect arm will be reclassified as whatever `mapError` returns. A consumer hit exactly this: a permanent condition became retryable and burned the full backoff budget re-attempting a request that can never succeed. Nothing in the type system can see that, because the error channel already carried `HttpClientError`.
+- **It used to be a defect** (`Effect.die`), so code that handled it did so with `Effect.catchAllDefect`. That arm no longer fires. If you also have an `Effect.mapError` above it, the rejection now reaches `mapError` FIRST — and a delivery that classified an SSRF block as *terminal* in the defect arm will be reclassified as whatever `mapError` returns. A deployment hit exactly this: a permanent condition became retryable and burned the full backoff budget re-attempting a request that can never succeed. Nothing in the type system can see that, because the error channel already carried `HttpClientError`.
 - **`description` names the policy** (`SSRF policy: blocked private/reserved address …`), which is what you want in a log line; the `cause` is what you want in a branch.
 
 ### Allowing a target on purpose

package/templates/agent-docs/templates/apibackends.md

@@ -992,7 +992,7 @@ export default async ({ store, log, onShutdown, id }: StartupContext) => {
   log.info(`startup '${id}': warming order-fulfillment caches`)
 
   // Example long-lived resource: a heartbeat interval. Replace with a real
-  // warm-up (preload a dashboard cache, open a consumer, …).
+  // warm-up (preload a dashboard cache, open a deployment, …).
   const timer = setInterval(() => {
     void store // `store` is the already-migrated DataStore, ready to use.
   }, 60_000)