@voyant-travel/framework

The Voyant framework BOM (bill of materials). Its dependencies pin the exact tested runtime-module set, so a deployment tracks one framework version instead of a matrix of per-package versions.

// a deployment's package.json
{ "dependencies": { "@voyant-travel/framework": "2.4.0" } }

voyant upgrade bumps this one version; the pinned runtime set resolves transitively. The compatibility matrix is resolved inside the BOM — the deployment never sees it.

Why a BOM and not global lockstep

Global lockstep (forcing every runtime package to the same version) requires republishing unchanged packages on every release, and npm fires a publish-notification email per package → 100+ emails per release. The BOM avoids that: the runtime packages keep independent versions (only changed packages republish), and the BOM is the only package that always tracks "the framework version". A one-line fix → ~3 publishes, not 100+.

Maintenance

The publish dependency list is derived from the authored standard Operator distribution and package-owned manifests:

node scripts/generate-framework-bom.mjs --emit   # regenerate publish dependencies
node scripts/generate-framework-bom.mjs          # check (CI gate) — fails on drift

workspace:* deps publish as the exact current version (pnpm), so the published BOM is deterministic. Generated dependency metadata is output-only. Resolver admission always uses selected package records and each package's voyant.package.v1 metadata.

Exports

• @voyant-travel/framework/scheduled-jobs - graph-neutral scheduled-job contract and Node trigger route. Product schedules are declared by their owning package manifests.
• @voyant-travel/framework/deployment-graph — v1 project/deployment graph declarations, resolver diagnostics, and deterministic resolved graph hashing.
• @voyant-travel/framework/deployment-artifacts — pure lowering helpers that turn a resolved graph into deterministic JSON, artifact manifests, and tiny Node runtime entry modules for build/deploy tooling.
• @voyant-travel/framework/self-host-export — validated Cloud export-bundle input and deterministic self-host projection for external project generators, including exact install coordinates/provenance, secret-free projected config, and shared migration no-replay/drift policy.

Profile snapshots and their managed runtime/conversion subpaths are no longer published. Applications author projects through @voyant-travel/framework/project and boot the admitted graph through @voyant-travel/framework/node-runtime.