@voltro/runtime 0.26.0 → 0.28.0

package/dist/index.d.ts

@@ -957,7 +957,7 @@ export declare const applyInverses: (store: UndoApplyStore, ops: ReadonlyArray<I
  * finds nothing — an orphan rule firing on a row nobody references is the
  * normal case, not an error.
  */
-export declare const applyPluginRefRules: (store: PluginRefStore, rules: ReadonlyArray<PluginRefRule>, change: PluginRefChange) => Promise<ReadonlyArray<{
+export declare const applyPluginRefRules: (store: PluginRefStore, rules: ReadonlyArray<PluginRefRule>, change: ChangeEvent) => Promise<ReadonlyArray<{
     readonly rule: PluginRefRule;
     readonly affected: number;
 }>>;
@@ -1151,15 +1151,6 @@ export declare interface BeginOAuthResult {
     readonly state: string;
 }
 
-/**
- * Override the subject for an active connection. Called from the
- * `auth.signin` (or any "I just authenticated this caller") handler
- * after the credential check passes. Future calls on the same
- * connection see the new subject via the AuthMiddleware fast-path.
- *
- * Emits to all `onBind` listeners synchronously so subscription
- * registries can re-scope active subscriptions.
- */
 export declare const bindConnectionSubject: (clientId: number, subject: Subject) => void;
 
 /**
@@ -1532,12 +1523,18 @@ export declare const clearSystemStoreHandle: () => void;
  */
 export declare const collectPluginRefRules: (tables: ReadonlyArray<{
     readonly name: string;
-    readonly columns: Record<string, unknown>;
-}>, specOf: (column: unknown) => {
-    target: () => unknown;
-    orphanPolicy: PluginRefOrphanPolicy;
-    onSoftDelete: boolean;
-} | undefined, registered: ReadonlySet<string>) => ReadonlyArray<PluginRefRule>;
+    /** The DECLARED references, carried on the built table. Reading the column
+     *  bag instead does not work: `table()` materialises builders into plain
+     *  field descriptors, so the spec is gone by the time anyone can ask. That
+     *  is how this collector silently produced ZERO rules while its own wiring
+     *  test — which only checked that it was CALLED — stayed green. */
+    readonly appliedPluginRefs?: ReadonlyArray<{
+        readonly column: string;
+        readonly target: () => unknown;
+        readonly orphanPolicy: PluginRefOrphanPolicy;
+        readonly onSoftDelete: boolean;
+    }>;
+}>, registered: ReadonlySet<string>) => ReadonlyArray<PluginRefRule>;
 
 /** Parse + return the compiled `Cron` for a definition. Throws the
  *  same way `defineSchedule` validated — callers that already hold a
@@ -2943,6 +2940,8 @@ export declare const getConnectionResolver: () => ConnectionResolver | undefined
 /** Look up the override for a connection. Returns `undefined` if no override is set. */
 export declare const getConnectionSubject: (clientId: number) => Subject | undefined;
 
+export declare const getCredentialExpiry: (clientId: number) => number | undefined;
+
 /** The registered field cipher, if any. The store middleware reads this. */
 export declare const getFieldCipher: () => FieldCipher | undefined;
 
@@ -3348,7 +3347,7 @@ export declare const isScheduleDefinition: (v: unknown) => v is BrandedScheduleD
  * The transition matters, not the value: a row that was already deleted and is
  * updated again must not re-fire the rule.
  */
-export declare const isSoftDelete: (change: PluginRefChange) => boolean;
+export declare const isSoftDelete: (change: ChangeEvent) => boolean;
 
 /** A freshly issued key — `token` is shown ONCE and never stored in clear. */
 export declare interface IssuedApiKey {
@@ -3783,6 +3782,10 @@ export declare const makeProcessAdapter: (supervisor: AppSupervisor) => WakeAdap
  */
 export declare const makeQueryDescriptorProducer: <D>(deps: QueryProducerDeps<D>) => (query: MutationLike, input: unknown) => (requestContext: ServeRequestContext) => D | ComputedQuery | Effect.Effect<D | ComputedQuery, unknown, never>;
 
+export declare const makeQueryFinalizer: (options: QueryFinalizeOptions) => ((descriptor: QueryDescriptor, subject: {
+    readonly tenantId?: string | null;
+}) => QueryDescriptor);
+
 /**
  * Build the per-subscription authorization re-check.
  *
@@ -4557,18 +4560,6 @@ export declare const payloadPropertyNames: (schema: Schema.Schema.Any) => {
     readonly optional: ReadonlyArray<string>;
 };
 
-/** A change as the post-commit channel reports it. */
-export declare interface PluginRefChange {
-    readonly table: string;
-    readonly op: 'insert' | 'update' | 'delete';
-    readonly rowId: string;
-    readonly tenantId?: string | null;
-    /** The row before, when there was one — used to spot a soft delete. */
-    readonly old?: Record<string, unknown> | null;
-    /** The row after, when there is one. */
-    readonly new?: Record<string, unknown> | null;
-}
-
 /** One resolved rule: "when <targetTable> loses a row, do <policy> to <table.column>". */
 export declare interface PluginRefRule {
     readonly table: string;
@@ -4716,6 +4707,43 @@ export declare const publishEvent: <Name extends string, Key extends Schema.Sche
     readonly deferred: boolean;
 }, EventPublishError>;
 
+/**
+ * The two scopes, composed once, for every path that finalises a descriptor.
+ *
+ * **The primitives above were extracted so there is "no second copy that could
+ * drift" — and then the COMPOSITION became the second copy.** `voltro dev`
+ * wrapped them in a local helper; `serveApi` inlined the same pair in the other
+ * spelling. They agreed, which is the dangerous state: nothing kept them
+ * agreeing, and adding a third scoping concern would have landed in whichever
+ * file the author had open.
+ *
+ * That is the shape this repo has shipped seven times and the one a
+ * source-reading parity guard cannot see — both paths supply something, both
+ * look right at their own call site, and they disagree about content. The fix is
+ * not detection. It is having one function, so the disagreement has nowhere to
+ * live.
+ *
+ * `observe` is where the paths are ALLOWED to differ: `voltro dev` warns about
+ * an org-less subject, an empty tenant scope and a non-indexed predicate, and
+ * production does not want any of that on the hot path. A hook that cannot
+ * change the descriptor keeps the difference to the part that is genuinely
+ * dev-only. It receives a COPY of the descriptor: a hook that could rewrite the
+ * query would let the two paths disagree again through the one seam built to
+ * stop them.
+ */
+export declare interface QueryFinalizeOptions {
+    readonly tenantScopedTables: ReadonlySet<string>;
+    readonly softDeleteScopedTables: ReadonlySet<string>;
+    readonly observe?: {
+        /** Before scoping — sees what the handler asked for. */
+        readonly beforeScope?: (descriptor: QueryDescriptor, subject: {
+            readonly tenantId?: string | null;
+        }) => void;
+        /** After scoping — sees what will actually run. */
+        readonly afterScope?: (descriptor: QueryDescriptor) => void;
+    };
+}
+
 /** A typed builder or its descriptor — the single-row terminals accept either,
  *  so a call site never has to reach for `.descriptor` just to use them. */
 export declare type QueryLike<R = Row_5> = QueryDescriptor<R> | {
@@ -4873,6 +4901,8 @@ export declare interface RebacSubject {
     readonly scopes?: ReadonlyArray<string>;
 }
 
+export declare const recordCredentialExpiry: (clientId: number, exp: number | undefined) => void;
+
 /** What the framework emit-seams (servePipeline / rpcServer / plugin wrappers)
  *  hand to the registry. A flat, transport-agnostic sample shape the
  *  recording callbacks can build without touching Effect. */
@@ -5770,7 +5800,7 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
  * Exported separately from the execution so the matching is testable without a
  * store: which rules fire is the part with the edge cases.
  */
-export declare const rulesFor: (rules: ReadonlyArray<PluginRefRule>, change: PluginRefChange) => ReadonlyArray<PluginRefRule>;
+export declare const rulesFor: (rules: ReadonlyArray<PluginRefRule>, change: ChangeEvent) => ReadonlyArray<PluginRefRule>;
 
 /**
  * Run `fn` with `SubjectService` bound to a `system` subject and a