create-feltdb 0.7.4 → 0.8.0

package/dist/cli.js

@@ -10,7 +10,7 @@ import readline from 'readline';
 import { spawn, spawnSync } from 'child_process';
 import { createProject } from './create.js';
 import { FELTDB_PACKAGE_VERSION } from './package-versions.js';
-import { configureManagedAccount } from './managed-account.js';
+import { configureManagedAccount, finalizeManagedProvisioning } from './managed-account.js';
 import { localFeltdbExecutable } from './development-handoff.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 function parseArgs(args) {
@@ -331,9 +331,18 @@ Learn more: https://github.com/rkendel1/feltdb`);
         }
         console.log('\n✅ FeltDB application created successfully!\n');
         const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+        if (options.runtime === 'managed' && !shouldInstall) {
+            throw new Error('Managed provisioning requires dependency installation so the initial revision can be built, published, promoted, and verified. Remove --no-install.');
+        }
         if (shouldInstall) {
             console.log(`📦 Installing application, Studio${options.webllm ? ', and local WebLLM app builder' : ''} dependencies...\n`);
             await run(npm, ['install'], projectDir);
+            if (options.runtime === 'managed') {
+                console.log('\n☁️  Publishing and verifying the initial managed revision...\n');
+                await run(localFeltdbExecutable(projectDir), ['publish', '--yes', '--approve-destructive-changes'], projectDir);
+                const finalized = await finalizeManagedProvisioning({ projectDir });
+                console.log(`✓ Managed runtime verified at revision ${finalized.revisionId}`);
+            }
         }
         if (shouldStart) {
             if (!shouldInstall) {

package/dist/create.js

@@ -198,7 +198,7 @@ ${hasAgents ? `  agent WorkspaceAssistant {
     const runtimeOptions = runtime === 'browser'
         ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', browser: true }"
         : runtime === 'managed'
-            ? "{ namespace: import.meta.env.VITE_FELTDB_MANAGED_NAMESPACE || import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || import.meta.env.VITE_FELTDB_URL || '', token: import.meta.env.VITE_FELTDB_MANAGED_API_KEY || import.meta.env.VITE_FELTDB_API_KEY || '', applicationId: import.meta.env.VITE_FELTDB_MANAGED_APPLICATION_ID, environment: import.meta.env.VITE_FELTDB_MANAGED_ENVIRONMENT || 'production' } }"
+            ? "{ namespace: '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || '', applicationId: import.meta.env.VITE_FELTDB_MANAGED_APPLICATION_ID, environment: 'production' } }"
             : runtime === 'self-hosted'
                 ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_URL || 'http://localhost:7700', token: import.meta.env.VITE_FELTDB_API_KEY || '' } }"
                 : "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', memory: true }";
@@ -1234,8 +1234,7 @@ main().catch(console.error);
     const envExample = `# FeltDB Configuration
 # Copy this file to .env.local and update the values
 
-# API Key for authenticating with FeltDB servers
-# Leave empty for browser runtime; required for authenticated self-hosted and managed runtimes
+# API key for authenticated self-hosted browser access
 VITE_FELTDB_API_KEY=
 
 # FeltDB Server URL (self-hosted or managed runtime)
@@ -1243,13 +1242,10 @@ VITE_FELTDB_URL=http://localhost:7700
 
 # Managed example: https://runtime.your-app.feltdb.com
 VITE_FELTDB_MANAGED_URL=
-VITE_FELTDB_MANAGED_API_KEY=
+VITE_FELTDB_MANAGED_APPLICATION_ID=
 # Server/control-plane only. Never rename with a VITE_ prefix.
 FELTDB_MANAGED_CONTROL_API_KEY=
-VITE_FELTDB_MANAGED_TENANT_ID=
-VITE_FELTDB_MANAGED_APPLICATION_ID=
-VITE_FELTDB_MANAGED_NAMESPACE=
-VITE_FELTDB_MANAGED_ENVIRONMENT=production
+FELTDB_TOKEN=
 
 # Override the default self-hosted container image
 # By default the server image is built locally from the bundled source.
@@ -1388,7 +1384,7 @@ The self-hosted instance runs on \`http://localhost:7700\` by default.
 }
 \`\`\`
 
-Managed mode uses the same application API with a FeltDB-hosted endpoint. The CLI creates \`.env.local\` with \`VITE_FELTDB_MANAGED_URL\` and \`VITE_FELTDB_MANAGED_API_KEY\` after account setup. Studio uses that same connection for state, health, operations, and API-key administration.
+Managed mode uses the same application API with a FeltDB-hosted endpoint. The CLI writes only the public URL and application ID plus separate server-only publish and runtime credentials. Tenant, namespace, environment, and active revision are discovered deployment metadata under \`.feltdb/managed.json\`.
 
 ## Vector Search Status
 
@@ -1657,7 +1653,7 @@ FeltDB runs through a dedicated server with Docker Compose and persistent data v
 
 ### Managed Runtime
 
-FeltDB provides the runtime endpoint, durable storage, synchronization, and background workload infrastructure. The CLI configures \`VITE_FELTDB_MANAGED_URL\` and \`VITE_FELTDB_MANAGED_API_KEY\` in \`.env.local\`.
+FeltDB provides the runtime endpoint, durable storage, synchronization, and background workload infrastructure. The CLI configures the public \`VITE_FELTDB_MANAGED_*\` identity, separate server-only control and data-plane credentials, and the promoted revision in \`.env.local\`. The browser API-key value stays empty because browser users receive short-lived actor sessions.
 
 ## Configuration
 
@@ -1687,12 +1683,14 @@ Create a \`.env.local\` file (copy from \`.env.example\`):
 \`\`\`
 VITE_FELTDB_API_KEY=your_api_key_here
 VITE_FELTDB_URL=http://localhost:7700
-VITE_FELTDB_MANAGED_API_KEY=your_managed_api_key_here
 VITE_FELTDB_MANAGED_URL=https://api.feltdb.com
+VITE_FELTDB_MANAGED_APPLICATION_ID=your_application_id
+FELTDB_MANAGED_CONTROL_API_KEY=your_server_only_control_key
+FELTDB_TOKEN=your_server_only_application_data_key
 VITE_FELTDB_WEBSOCKET_URL=ws://localhost:7700
 \`\`\`
 
-These are required when connecting to an authenticated self-hosted or managed FeltDB instance.
+Never expose \`FELTDB_MANAGED_CONTROL_API_KEY\` or \`FELTDB_TOKEN\` through a \`VITE_\` variable. Managed browser access uses \`db.auth.signUp()\` and \`db.auth.signIn()\`; the active revision is discovered rather than configured.
 
 ## Development
 

package/dist/managed-account.js

@@ -1,5 +1,20 @@
 import fs from 'fs';
 import path from 'path';
+function loadEnvironment(file) {
+    const values = {};
+    for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const separator = line.indexOf('=');
+        if (separator > 0)
+            values[line.slice(0, separator)] = line.slice(separator + 1);
+    }
+    return values;
+}
+function managedStateFile(projectDir) {
+    return path.join(projectDir, '.feltdb', 'managed.json');
+}
 async function responseJson(response, fallback) {
     const body = await response.json().catch(() => ({}));
     if (!response.ok)
@@ -47,7 +62,8 @@ export async function configureManagedAccount(options) {
         method: 'POST', headers,
         body: JSON.stringify({
             id: `${options.applicationName}-control`,
-            namespace: options.namespace,
+            namespace: application.namespace || options.namespace,
+            application_id: application.id,
             scopes: [
                 'application:read', 'application:write', 'application:revision:create',
                 'application:revision:read', 'application:revision:promote',
@@ -57,19 +73,67 @@ export async function configureManagedAccount(options) {
     }), 'Could not create the managed control-plane key');
     if (!controlKey.secret)
         throw new Error('Managed key service did not return the control-plane credential');
+    const dataKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
+        method: 'POST', headers,
+        body: JSON.stringify({
+            id: `${options.applicationName}-runtime`,
+            namespace: application.namespace || options.namespace,
+            application_id: application.id,
+            scopes: [
+                'application:read', 'application:revision:read',
+                'state:read', 'state:write', 'events:read',
+                'workflows:run', 'agents:run', 'capabilities:run',
+            ],
+        }),
+    }), 'Could not create the managed application data key');
+    if (!dataKey.secret)
+        throw new Error('Managed key service did not return the application data credential');
+    try {
+        await responseJson(await request(`${apiUrl}/api/applications/${encodeURIComponent(application.id)}/revisions`, {
+            headers: { Authorization: `Bearer ${controlKey.secret}` },
+        }), 'Managed control-plane credential was created but is not accepted by the managed API');
+    }
+    catch (error) {
+        await Promise.allSettled([controlKey.id, dataKey.id].filter(Boolean).map(id => request(`${sessionOrigin}/api/keys/${encodeURIComponent(id)}`, { method: 'DELETE', headers })));
+        throw error;
+    }
     const environment = [
         '# Generated by create-feltdb managed setup. Do not commit this file.',
         `VITE_FELTDB_MANAGED_URL=${apiUrl}`,
-        '# Browser authentication uses short-lived actor sessions; no long-lived data key is embedded.',
-        'VITE_FELTDB_MANAGED_API_KEY=',
+        `VITE_FELTDB_MANAGED_APPLICATION_ID=${application.id}`,
         '# Control-plane credential. Never prefix this with VITE_ or expose it to browser code.',
         `FELTDB_MANAGED_CONTROL_API_KEY=${controlKey.secret}`,
-        `VITE_FELTDB_MANAGED_TENANT_ID=${tenant.id}`,
-        `VITE_FELTDB_MANAGED_APPLICATION_ID=${application.id}`,
-        `VITE_FELTDB_MANAGED_NAMESPACE=${application.namespace || options.namespace}`,
-        'VITE_FELTDB_MANAGED_ENVIRONMENT=production',
+        '# Server/deployment data-plane credential. Never prefix this with VITE_.',
+        `FELTDB_TOKEN=${dataKey.secret}`,
         '',
     ].join('\n');
     fs.writeFileSync(path.join(options.projectDir, '.env.local'), environment, { mode: 0o600 });
+    fs.mkdirSync(path.dirname(managedStateFile(options.projectDir)), { recursive: true });
+    fs.writeFileSync(managedStateFile(options.projectDir), `${JSON.stringify({
+        url: apiUrl,
+        tenantId: tenant.id,
+        applicationId: application.id,
+        namespace: application.namespace || options.namespace,
+        environment: 'production',
+    }, null, 2)}\n`, { mode: 0o600 });
     return { tenant, application, apiUrl };
 }
+export async function finalizeManagedProvisioning(options) {
+    const publishedFile = path.join(options.projectDir, '.feltdb', 'last-published.json');
+    if (!fs.existsSync(publishedFile))
+        throw new Error('Managed provisioning did not produce .feltdb/last-published.json');
+    const published = JSON.parse(fs.readFileSync(publishedFile, 'utf8'));
+    if (!published.revisionId)
+        throw new Error('Managed provisioning did not promote an application revision');
+    const environmentFile = path.join(options.projectDir, '.env.local');
+    const environment = loadEnvironment(environmentFile);
+    const managedFile = managedStateFile(options.projectDir);
+    const managed = JSON.parse(fs.readFileSync(managedFile, 'utf8'));
+    const request = options.fetchImpl || fetch;
+    const discovery = await responseJson(await request(`${managed.url}/v1/application?application_id=${encodeURIComponent(managed.applicationId)}&environment=${encodeURIComponent(managed.environment)}`, { headers: { Authorization: `Bearer ${environment.FELTDB_TOKEN}` } }), 'Managed application data credential is not accepted by the promoted runtime');
+    if (discovery.revision_id !== published.revisionId) {
+        throw new Error('Managed runtime revision does not match the revision promoted during provisioning');
+    }
+    fs.writeFileSync(managedFile, `${JSON.stringify({ ...managed, revisionId: published.revisionId }, null, 2)}\n`, { mode: 0o600 });
+    return { revisionId: published.revisionId };
+}

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.7.4';
+export const FELTDB_PACKAGE_VERSION = '0.8.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/application.rs

@@ -272,6 +272,9 @@ pub struct ApplicationManifest {
     pub agents: Vec<AgentDefinition>,
     #[serde(default)]
     pub capabilities: Vec<CapabilityBinding>,
+    /// Resolved, provider-neutral module semantic contracts. Secret values are forbidden.
+    #[serde(default)]
+    pub modules: Vec<serde_json::Value>,
     #[serde(default)]
     pub connections: Vec<ConnectionBinding>,
     #[serde(default)]
@@ -313,6 +316,7 @@ impl ApplicationManifest {
             schedules: vec![],
             agents: vec![],
             capabilities: vec![],
+            modules: vec![],
             connections: vec![],
             policies: vec![],
             ui: UiApplicationModel::default(),
@@ -733,6 +737,11 @@ pub fn validate_manifest(
             }
         }
     }
+    for (index, module) in manifest.modules.iter().enumerate() {
+        if contains_plaintext_secret(module) || module.get("value").is_some() {
+            issues.push(issue("security", format!("modules.{index}"), "module contracts may declare secret requirements but never secret values"));
+        }
+    }
     for environment in &manifest.environments {
         if environment.configuration.iter().any(|(key, value)| {
             matches!(
@@ -868,6 +877,7 @@ fn sorted(mut manifest: ApplicationManifest) -> ApplicationManifest {
         agent.capabilities.sort();
     }
     sort_name!(manifest.capabilities);
+    manifest.modules.sort_by(|a, b| a.get("id").and_then(Value::as_str).cmp(&b.get("id").and_then(Value::as_str)));
     sort_name!(manifest.connections);
     sort_name!(manifest.policies);
     sort_name!(manifest.ui.bindings);

package/dist/server-source/crates/feltdb/src/lib.rs

@@ -246,7 +246,8 @@ use serde_json::Value;
 use sha2::{Digest, Sha256};
 use std::any::type_name;
 use std::collections::hash_map::DefaultHasher;
-use std::collections::{HashMap, HashSet};
+use std::collections::{BTreeMap, HashMap, HashSet};
+use std::ops::Bound::{Excluded, Unbounded};
 use std::fmt::{Display, Formatter};
 use std::fs::{self, OpenOptions};
 use std::hash::{Hash, Hasher};
@@ -315,7 +316,7 @@ pub struct FeltDb {
 #[allow(dead_code)] // Reserved runtime subsystems are initialized before their public APIs land.
 struct Inner {
     path: PathBuf,
-    rows: HashMap<String, HashMap<String, StoredRow>>,
+    rows: HashMap<String, BTreeMap<String, StoredRow>>,
     key_counters: HashMap<String, u64>,
     query_count_by_type: HashMap<String, usize>,
     adaptive_indexes: HashSet<String>,
@@ -1721,6 +1722,23 @@ impl FeltDb {
             .unwrap_or_default())
     }
 
+    /// Traverse one collection in immutable record-key order without materializing it.
+    pub fn list_collection_page(&self, capability: &str, after: Option<&str>, limit: usize) -> Result<Vec<StoredRow>> {
+        let inner = self.inner.lock().expect("lock poisoned");
+        let Some(rows) = inner.rows.get(capability) else { return Ok(vec![]) };
+        let values: Box<dyn Iterator<Item = &StoredRow>> = match after {
+            Some(key) => Box::new(rows.range::<str, _>((Excluded(key), Unbounded)).map(|(_, row)| row)),
+            None => Box::new(rows.values()),
+        };
+        Ok(values.filter(|row| !row.deleted).take(limit).cloned().collect())
+    }
+
+    /// Fetch one live collection record without materializing collection state.
+    pub fn get_collection_record(&self, capability: &str, key: &str) -> Result<Option<StoredRow>> {
+        let inner = self.inner.lock().expect("lock poisoned");
+        Ok(inner.rows.get(capability).and_then(|rows| rows.get(key)).filter(|row| !row.deleted).cloned())
+    }
+
     /// Subscribe to canonical mutation events.
     pub fn subscribe_changes(&self) -> broadcast::Receiver<ChangeEvent> {
         self.event_tx.subscribe()

package/dist/server-source/crates/feltdb-server/src/app_state.rs

@@ -1,10 +1,10 @@
+use serde_json::Value;
 use std::path::PathBuf;
 use std::{
     collections::HashMap,
     sync::{atomic::AtomicU64, Arc},
     time::Instant,
 };
-use serde_json::Value;
 
 #[derive(Clone)]
 pub struct BoundedQueryCursor {
@@ -16,34 +16,22 @@ pub struct BoundedQueryCursor {
     pub created_at: u64,
 }
 
+use crate::{
+    application_contract::ApplicationContractStore, artifacts::ArtifactStore, audit::AuditLog,
+    auth::KeyStore, causal::CausalStore, clock::LeaseClock, cluster::ClusterStore,
+    connections::ConnectionStore, content::ContentStore, identity::IdentityStore,
+    leases::LeaseStore, metrics::Metrics, portable_bundle::BundleStore, principals::PrincipalStore,
+    providers::ProviderStore, releases::ReleaseStore, sessions::SessionVerifier,
+    tenancy::TenancyStore,
+};
 use feltdb::{
-    FeltDb,
     application::ApplicationStore,
+    application_runtime::RuntimeStore,
     authorization::{GrantSigner, GrantStore},
     sync_contract::SyncStore,
-    workload::WorkloadStore,
     worker_mesh::WorkerMeshStore,
-    application_runtime::RuntimeStore,
-};
-use crate::{
-    artifacts::ArtifactStore,
-    audit::AuditLog,
-    auth::KeyStore,
-    causal::CausalStore,
-    cluster::ClusterStore,
-    connections::ConnectionStore,
-    content::ContentStore,
-    identity::IdentityStore,
-    leases::LeaseStore,
-    metrics::Metrics,
-    portable_bundle::BundleStore,
-    principals::PrincipalStore,
-    providers::ProviderStore,
-    releases::ReleaseStore,
-    sessions::SessionVerifier,
-    tenancy::TenancyStore,
-    application_contract::ApplicationContractStore,
-    clock::LeaseClock,
+    workload::WorkloadStore,
+    FeltDb,
 };
 
 #[derive(Clone)]

package/dist/server-source/crates/feltdb-server/src/application_contract.rs

@@ -283,10 +283,18 @@ impl ApplicationContractStore {
                     confidence: 0.0,
                     evidence_required: vec!["contract evidence".into()],
                     suggested_questions: vec![match p {
-                        "actors" => "Who will use this application, and what roles do they have?".into(),
-                        "entities" => "What information or records should the application keep track of?".into(),
+                        "actors" => {
+                            "Who will use this application, and what roles do they have?".into()
+                        }
+                        "entities" => {
+                            "What information or records should the application keep track of?"
+                                .into()
+                        }
                         "actions" => "What should people be able to do with those records?".into(),
-                        "permissions" => "Who can view, create, edit, delete, or administer this information?".into(),
+                        "permissions" => {
+                            "Who can view, create, edit, delete, or administer this information?"
+                                .into()
+                        }
                         _ => format!("What should FeltDB understand about {p}?"),
                     }],
                     candidate_resolutions: vec![],

package/dist/server-source/crates/feltdb-server/src/authenticated_principal.rs

@@ -154,7 +154,6 @@ fn now() -> u64 {
         .as_secs()
 }
 
-
 #[cfg(test)]
 mod tests {
     use super::*;

package/dist/server-source/crates/feltdb-server/src/certification_harness.rs

@@ -224,10 +224,7 @@ impl CertificationHarness {
 
     /// Gets the count of tests in a category.
     pub fn test_count(&self, category: TestCategory) -> usize {
-        self.results
-            .get(&category)
-            .map(|v| v.len())
-            .unwrap_or(0)
+        self.results.get(&category).map(|v| v.len()).unwrap_or(0)
     }
 
     /// Gets all failed tests.
@@ -439,13 +436,10 @@ mod tests {
 
     #[test]
     fn test_execution_plan_builder() {
-        let plan = TestExecutionPlan::new(
-            TestSuiteDefinition::standard(),
-            TestEnvironment::Local,
-        )
-        .with_parallel()
-        .with_timeout(600)
-        .with_retry(3);
+        let plan = TestExecutionPlan::new(TestSuiteDefinition::standard(), TestEnvironment::Local)
+            .with_parallel()
+            .with_timeout(600)
+            .with_retry(3);
 
         assert!(plan.parallel_execution);
         assert_eq!(plan.timeout_secs, 600);
@@ -480,19 +474,18 @@ mod tests {
     fn test_environment_strings() {
         assert_eq!(TestEnvironment::Local.as_str(), "local");
         assert_eq!(TestEnvironment::ManagedStaging.as_str(), "managed_staging");
-        assert_eq!(TestEnvironment::ManagedProduction.as_str(), "managed_production");
+        assert_eq!(
+            TestEnvironment::ManagedProduction.as_str(),
+            "managed_production"
+        );
     }
 
     #[test]
     fn certification_report_serialization() {
         let mut harness = CertificationHarness::new(TestEnvironment::Local);
 
-        let result = TestResult::new(
-            "test_1".into(),
-            TestCategory::Operations,
-            "test_1".into(),
-        )
-        .passed(50);
+        let result =
+            TestResult::new("test_1".into(), TestCategory::Operations, "test_1".into()).passed(50);
 
         harness.record_result(result);
 
@@ -512,11 +505,19 @@ mod tests {
 
         for i in 0..3 {
             let result = if i == 1 {
-                TestResult::new(format!("test_{}", i), TestCategory::Authorization, format!("test_{}", i))
-                    .failed("test failed".into(), 50)
+                TestResult::new(
+                    format!("test_{}", i),
+                    TestCategory::Authorization,
+                    format!("test_{}", i),
+                )
+                .failed("test failed".into(), 50)
             } else {
-                TestResult::new(format!("test_{}", i), TestCategory::Authorization, format!("test_{}", i))
-                    .passed(50)
+                TestResult::new(
+                    format!("test_{}", i),
+                    TestCategory::Authorization,
+                    format!("test_{}", i),
+                )
+                .passed(50)
             };
             harness.record_result(result);
         }

package/dist/server-source/crates/feltdb-server/src/delegation_token.rs

@@ -132,10 +132,7 @@ impl DelegationTokenIssuer {
         let payload = self.canonicalize_for_signing(&token)?;
         let signature = self.sign(&payload)?;
 
-        Ok(DelegationToken {
-            signature,
-            ..token
-        })
+        Ok(DelegationToken { signature, ..token })
     }
 
     /// Canonicalizes token for consistent signing/verification.
@@ -180,11 +177,7 @@ impl DelegationTokenIssuer {
 
 impl DelegationTokenValidator {
     /// Creates a new token validator.
-    pub fn new(
-        expected_issuer: String,
-        expected_audience: String,
-        shared_secret: Vec<u8>,
-    ) -> Self {
+    pub fn new(expected_issuer: String, expected_audience: String, shared_secret: Vec<u8>) -> Self {
         Self {
             expected_issuer,
             expected_audience,
@@ -316,8 +309,7 @@ mod tests {
     fn issue_and_validate_delegation_token() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let token = issuer
             .issue(
@@ -337,8 +329,7 @@ mod tests {
     fn reject_expired_token() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let mut token = issuer
             .issue(
@@ -450,8 +441,7 @@ mod tests {
     fn tampering_invalidates_signature() {
         let secret = test_shared_secret();
         let issuer = DelegationTokenIssuer::new("sherpa".into(), secret.clone());
-        let validator =
-            DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
+        let validator = DelegationTokenValidator::new("sherpa".into(), "feltdb".into(), secret);
 
         let mut token = issuer
             .issue(

package/dist/server-source/crates/feltdb-server/src/durable_operations.rs

@@ -114,10 +114,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         if ops.contains_key(&operation_id) {
-            return Err(format!(
-                "operation already exists: {}",
-                operation_id
-            ));
+            return Err(format!("operation already exists: {}", operation_id));
         }
 
         let now = now();
@@ -158,7 +155,8 @@ impl DurableOperationStore {
             .ok_or(format!("operation not found: {}", operation_id))?;
 
         // Can only claim Pending or Unknown operations
-        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown {
+        if operation.state != OperationState::Pending && operation.state != OperationState::Unknown
+        {
             return Err(format!(
                 "cannot claim operation in state {:?}",
                 operation.state
@@ -339,7 +337,8 @@ impl DurableOperationStore {
         }
 
         // Must be in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot fail operation in state {:?}",
                 operation.state
@@ -356,10 +355,7 @@ impl DurableOperationStore {
     }
 
     /// Marks an operation as Unknown (when lease expires).
-    pub fn mark_unknown(
-        &self,
-        operation_id: &str,
-    ) -> Result<DurableOperation, String> {
+    pub fn mark_unknown(&self, operation_id: &str) -> Result<DurableOperation, String> {
         let mut ops = self
             .operations
             .write()
@@ -372,7 +368,8 @@ impl DurableOperationStore {
         let now = now();
 
         // Can only mark Unknown if in Claimed or Running state
-        if operation.state != OperationState::Claimed && operation.state != OperationState::Running {
+        if operation.state != OperationState::Claimed && operation.state != OperationState::Running
+        {
             return Err(format!(
                 "cannot mark Unknown operation in state {:?}",
                 operation.state
@@ -484,9 +481,7 @@ impl DurableOperationStore {
             .map_err(|_| "store lock poisoned".to_string())?;
 
         let before_len = ops.len();
-        ops.retain(|_, op| {
-            !(op.state == OperationState::Completed && op.updated_at < cutoff_time)
-        });
+        ops.retain(|_, op| !(op.state == OperationState::Completed && op.updated_at < cutoff_time));
         let after_len = ops.len();
 
         Ok(before_len - after_len)
@@ -755,9 +750,7 @@ mod tests {
             .claim_operation("op_123", "worker_1".into(), 60)
             .expect("claim failed");
 
-        let unknown = store
-            .mark_unknown("op_123")
-            .expect("mark unknown failed");
+        let unknown = store.mark_unknown("op_123").expect("mark unknown failed");
         assert_eq!(unknown.state, OperationState::Unknown);
 
         let reconciled = store
@@ -826,9 +819,7 @@ mod tests {
             )
             .expect("create failed");
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 2);
     }
 
@@ -915,9 +906,7 @@ mod tests {
             .expect("cleanup failed");
         assert_eq!(deleted, 1);
 
-        let ops = store
-            .list_operations("tenant_prod")
-            .expect("list failed");
+        let ops = store.list_operations("tenant_prod").expect("list failed");
         assert_eq!(ops.len(), 1);
         assert_eq!(ops[0].operation_id, "op_pending");
     }
@@ -978,11 +967,7 @@ mod tests {
             .expect("start failed");
 
         store
-            .complete_operation(
-                "op_123",
-                "worker_1",
-                serde_json::json!({"result": "done"}),
-            )
+            .complete_operation("op_123", "worker_1", serde_json::json!({"result": "done"}))
             .expect("complete failed");
 
         let final_op = store.get_operation("op_123").expect("get failed");