# @voyant-travel/framework

The Voyant framework **BOM** (bill of materials). Its `dependencies` pin the exact
tested **runtime-module set**, so a deployment tracks **one framework version** instead
of a matrix of per-package versions.

```jsonc
// a deployment's package.json
{ "dependencies": { "@voyant-travel/framework": "2.4.0" } }
```

`voyant upgrade` bumps this one version; the pinned runtime set resolves transitively.
The compatibility matrix is resolved *inside* the BOM — the deployment never sees it.

## Why a BOM and not global lockstep

Global lockstep (forcing every runtime package to the same version) requires
**republishing unchanged packages** on every release, and npm fires a publish-notification
email per package → 100+ emails per release. The BOM avoids that: the runtime packages
keep **independent versions** (only *changed* packages republish), and the BOM is the only
package that always tracks "the framework version". A one-line fix → ~3 publishes, not 100+.

## Maintenance

The publish dependency list is derived from the authored standard Operator
distribution and package-owned manifests:

```sh
node scripts/generate-framework-bom.mjs --emit   # regenerate publish dependencies
node scripts/generate-framework-bom.mjs          # check (CI gate) — fails on drift
```

`workspace:*` deps publish as the **exact** current version (pnpm), so the published BOM is
deterministic. Generated dependency metadata is output-only. Resolver admission always uses
selected package records and each package's `voyant.package.v1` metadata.

## Exports

- `@voyant-travel/framework/scheduled-jobs` - graph-neutral scheduled-job
  contract and Node trigger route. Product schedules are declared by their
  owning package manifests.
- `@voyant-travel/framework/deployment-graph` — v1 project/deployment graph
  declarations, resolver diagnostics, and deterministic resolved graph hashing.
- `@voyant-travel/framework/deployment-artifacts` — pure lowering helpers that
  turn a resolved graph into deterministic JSON, artifact manifests, and tiny
  Node runtime entry modules for build/deploy tooling.
- `@voyant-travel/framework/self-host-export` — validated Cloud export-bundle
  input and deterministic self-host projection for external project generators,
  including exact install coordinates/provenance, secret-free projected config,
  and shared migration no-replay/drift policy.

Profile snapshots and their managed runtime/conversion subpaths are no longer
published. Applications author projects through `@voyant-travel/framework/project`
and boot the admitted graph through `@voyant-travel/framework/node-runtime`.