@voltro/runtime 0.52.0 → 0.54.0

package/dist/index.d.ts

@@ -69,6 +69,7 @@ import { RetentionSource } from '@voltro/database';
 import { RetentionSpec } from '@voltro/database';
 import { retentionTtlMsFromEnv } from '@voltro/database';
 import { Row } from '@voltro/database';
+import { RowPatch } from '@voltro/protocol';
 import { Rpc } from '@effect/rpc';
 import { RpcGroup } from '@effect/rpc';
 import { RpcInterceptor } from '@voltro/protocol';
@@ -97,6 +98,8 @@ import { TenantRowNotFound } from '@voltro/protocol';
 import { TenantScopeViolation } from '@voltro/protocol';
 import { Tracer } from 'effect';
 import { Unauthenticated } from '@voltro/protocol';
+import { ValidationError } from '@voltro/protocol';
+import { ValidationErrors } from '@voltro/protocol';
 import { WebSocketGatewayRoute } from '@voltro/protocol';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
 import { WorkflowRunHandle } from '@voltro/protocol';
@@ -151,6 +154,28 @@ export declare interface ActivitySignals {
     readonly activeWorkflowExecutions: () => number;
 }
 
+/**
+ * Adopt a detached subscription for a resuming client at `fromRevision`.
+ * Undefined — identity unknown, entry dead (an error/revocation while
+ * offline), or the revision does not chain — means: subscribe fresh, send a
+ * snapshot. A failed adoption EXPIRES the entry: its ring cannot serve this
+ * client and keeping a half-dead entry around only risks a second caller
+ * adopting state the first one invalidated.
+ */
+export declare const adoptDetached: (identity: ResumeIdentity, fromRevision: number, now?: number, tunables?: ResumeTunables) => AdoptedSubscription | undefined;
+
+export declare interface AdoptedSubscription {
+    /** The deltas the client missed, in order — replay before going live. */
+    readonly deltas: ReadonlyArray<{
+        readonly revision: number;
+        readonly emittedAt: number;
+        readonly patch: RowPatch;
+    }>;
+    /** Redirect this to the new stream to go live on the SAME revision line. */
+    readonly sink: ResumeSink;
+    readonly unsubscribe: () => void;
+}
+
 export declare interface AggregateContext {
     /** Read-side store for source queries. Note: the build function
      *  runs OUTSIDE any per-request subject, so the auto-stamping a
@@ -808,6 +833,15 @@ export declare interface AnalyticsTopEntry {
     readonly value: number;
 }
 
+/**
+ * Answer a `resumeFrom` for this identity. `fromRevision` is the last
+ * revision the CLIENT materialised. Only revisions inside
+ * [baseRevision, headRevision] chain; everything else — unknown key, aged
+ * ring, a revision the ring no longer covers, a revision AHEAD of the head
+ * (a client from a different life) — is a snapshot.
+ */
+export declare const answerResume: (identity: ResumeIdentity, fromRevision: number, now?: number, tunables?: ResumeTunables) => ResumeAnswer;
+
 declare type AnyRow = Record<string, unknown>;
 
 declare type AnyRow_2 = Record<string, unknown>;
@@ -990,6 +1024,10 @@ export declare interface AppContext {
      *  `ctx.access.has(scope)` / `yield* ctx.access.require(scope)` instead of
      *  reaching into `ctx.request.subject.scopes`. Always present. */
     readonly access: AppAccess;
+    /** Typed server-side field validation — `yield* ctx.validation.fail('email',
+     *  'validation.emailTaken')` routes to the form field that submitted it.
+     *  Always present. */
+    readonly validation: AppValidation;
     /** Cache — always present (memory backend by default). Use
      *  `ctx.cache.wrap(key, { ttlMs, tags }, () => expensive())` to cache
      *  derived work; tagged entries auto-invalidate when a mutation writes a
@@ -1074,6 +1112,28 @@ export declare interface AppContext {
  */
 export declare const applyConnectionCredential: (clientId: number, headers: Record<string, string | undefined>) => Record<string, string | undefined>;
 
+/**
+ * Reconcile a mutation target's declared junction `relations:` against the
+ * input — INSIDE the mutation's transaction, through `ctx.store`, so the
+ * links ride the same undo capture, rule evaluation and rollback as the
+ * mutation's own writes.
+ *
+ * Semantics that must not drift:
+ * - an ABSENT input field touches nothing (absent ≠ empty);
+ * - an empty array is the explicit clear;
+ * - a non-array value is a refusal naming the field — silently ignoring it
+ *   would read as "saved" while the links stayed stale;
+ * - the row id is `output.id`, else `input.id`; with neither the declaration
+ *   is unusable and says so.
+ */
+export declare const applyDeclaredRelations: (params: {
+    readonly store: RelationLinksStore;
+    readonly target: MutationLike["descriptor"]["target"];
+    readonly procedure: string;
+    readonly input: unknown;
+    readonly output: unknown;
+}) => Promise<void>;
+
 /**
  * Pure helper backing `ctx.store.applyDefined`. Picks the listed keys from
  * `input` whose value is not `undefined`, so a PATCH sets exactly the fields
@@ -1220,6 +1280,35 @@ export declare interface AppSupervisor {
     stop: () => Promise<void>;
 }
 
+/** Typed server-side FIELD validation — the executor half of form error
+ *  routing. Each helper fails the procedure with a wire `ValidationError`
+ *  (auto-merged into every mutation's and action's error union), which the
+ *  form binding routes to `errors[field]` instead of `submitError`. */
+export declare interface AppValidation {
+    /** Fail with ONE field error. `message` is a message id
+     *  (`'validation.emailTaken'`) resolved by the client's validation catalog.
+     *
+     *      if (await emailTaken(input.email)) {
+     *        return yield* ctx.validation.fail('email', 'validation.emailTaken')
+     *      }
+     */
+    readonly fail: (field: string, message: string, params?: Record<string, unknown>) => Effect.Effect<never, ValidationError>;
+    /** Fail with several field errors in one round trip. Refuses an empty
+     *  list — a failure with nothing to show is a bug at the call site. */
+    readonly failAll: (issues: ReadonlyArray<{
+        readonly field: string;
+        readonly message: string;
+        readonly params?: Record<string, unknown>;
+    }>) => Effect.Effect<never, ValidationErrors>;
+    /** Guard form: succeed when `condition` holds, else fail the field. */
+    readonly require: (condition: boolean, field: string, message: string, params?: Record<string, unknown>) => Effect.Effect<void, ValidationError>;
+}
+
+/** The ONE `ctx.validation` value. Pure and subject-free, so a single shared
+ *  instance serves every context — request, schedule, workflow, test — and
+ *  the builders cannot each assemble a drifting copy. */
+export declare const appValidation: AppValidation;
+
 /** Effect-style guard for handlers — throws the typed {@link AccessDenied} on a
  *  deny so it surfaces to the client typed. */
 export declare const assertCan: (subject: RebacSubject, action: string, resource: RebacResource, deps: CanDeps) => void;
@@ -1623,7 +1712,14 @@ reauthorize?: (subject: Subject) => () => Promise<unknown>,
  */
 refilter?: (subject: Subject) => () => Promise<RowFilterScope>) => Stream.Stream<SubscriptionEvent<T>, never, SubjectService | ConnectionInfo>;
 
-export declare const bindSubscriptionUntyped: (descriptor: QueryDescriptor, dispatcher: Dispatcher, context: RuntimeContext, indexHint: MatcherIndexHint | undefined, label: string, cacheBinding: SnapshotCacheBinding | undefined, reauthorize: (() => Promise<unknown>) | undefined, refilter?: (() => Promise<RowFilterScope>) | undefined) => Stream.Stream<SubscriptionEvent<ReadonlyArray<Row>>, never, never>;
+export declare const bindSubscriptionUntyped: (descriptor: QueryDescriptor, dispatcher: Dispatcher, context: RuntimeContext, indexHint: MatcherIndexHint | undefined, label: string, cacheBinding: SnapshotCacheBinding | undefined, reauthorize: (() => Promise<unknown>) | undefined, refilter?: (() => Promise<RowFilterScope>) | undefined, backpressure?: {
+    readonly maxBufferedBytes: number;
+    readonly overrunAfterMs: number;
+    readonly oversizedEventBytes: number;
+}, resume?: {
+    readonly input: unknown;
+    readonly fromRevision?: number;
+}) => Stream.Stream<SubscriptionEvent<ReadonlyArray<Row>>, never, never>;
 
 export declare interface BrandedScheduleDefinition extends ScheduleDefinition {
     readonly [SCHEDULE_BRAND]: true;
@@ -1760,6 +1856,8 @@ export declare interface CandidateShape {
     readonly windowed?: boolean;
 }
 
+export declare const canonicalInputKey: (input: unknown) => string;
+
 /* Excluded from this release type: canonicalize */
 
 /**
@@ -2542,6 +2640,8 @@ export declare const counter: (name: string, description?: string) => Metric.Met
  */
 export declare const countRunningWorkflows: (store: DataStore) => Promise<number>;
 
+export declare const crdtCompactMaxBytes: () => number;
+
 /**
  * Every firing instant of `def` in `(from, to]`, oldest first, bounded by
  * `cap + 1` entries.
@@ -2819,6 +2919,8 @@ export declare const DEFAULT_CLAIM_BUCKET_MS = 60000;
 
 export declare const DEFAULT_COMPRESSION_MIN_BYTES = 1024;
 
+export declare const DEFAULT_CRDT_COMPACT_MAX_BYTES: number;
+
 /**
  * How many subscribers one change event is delivered to CONCURRENTLY.
  *
@@ -2857,6 +2959,10 @@ export declare const DEFAULT_RAW_READ_TRACKING_LIMIT = 32;
 
 export declare const DEFAULT_REFRESH_SKEW_MS = 60000;
 
+export declare const DEFAULT_RESUME_MAX_DELTAS = 256;
+
+export declare const DEFAULT_RESUME_WINDOW_MS = 60000;
+
 /**
  * Retry policy applied to `load` when a filter does not specify one: three
  * attempts total (the initial call plus two retries), backing off exponentially
@@ -2869,6 +2975,14 @@ export declare const DEFAULT_REFRESH_SKEW_MS = 60000;
  */
 export declare const DEFAULT_ROW_FILTER_RETRY: Schedule.Schedule<unknown, unknown>;
 
+/** Defaults, overridable via `app.config.ts` `reactive.socket.*` (+ env) —
+ *  resolved by the boot paths' tunables resolver. */
+export declare const DEFAULT_SOCKET_MAX_BUFFERED_BYTES = 1048576;
+
+export declare const DEFAULT_SOCKET_OVERRUN_AFTER_MS = 10000;
+
+export declare const DEFAULT_SOCKET_OVERSIZED_EVENT_BYTES = 262144;
+
 /**
  * The message of an UNDECLARED throw, bounded, with nothing else attached.
  *
@@ -3074,6 +3188,17 @@ export declare const deliveredRowCount: (value: unknown) => number;
  */
 export declare const deriveKey: (passphrase: string) => Buffer;
 
+/**
+ * Detach a live subscription for possible resume. The sink is redirected to
+ * ring-recording only; after the window the subscription is truly
+ * unsubscribed. If an entry already sits under this identity (an older
+ * incarnation), it is expired first — one identity, one detached entry.
+ */
+export declare const detachForResume: (identity: ResumeIdentity, handle: {
+    readonly sink: ResumeSink;
+    readonly unsubscribe: () => void;
+}, tunables?: ResumeTunables, now?: () => number) => void;
+
 export { DialectReplicationAdapter }
 
 /** Field-level diff for one change. Insert → every field `undefined→value`;
@@ -3180,7 +3305,12 @@ export declare class Dispatcher {
     /** Re-run the query's `guards:` before every delivery — see
      *  `ActiveSubscription.reauthorize`. Omitted for unguarded queries. */
     reauthorize?: () => Promise<unknown>, 
-    /** Re-resolve row visibility per delivery — see `ActiveSubscription.refilter`. */
+    /** Re-resolve row visibility per delivery — see `ActiveSubscription.refilter`.
+     *
+     *  Optional ONLY in the sense that an app with no registered row filter has
+     *  nothing to resolve; it is not the caller's choice. Omitting it while a
+     *  filter IS registered throws below, because the read would then ignore the
+     *  filter entirely. Build it with `makeDefaultRefilter(subject)`. */
     refilter?: () => Promise<RowFilterScope>): Promise<() => void>;
     /**
      * Tear a subscription down because it can no longer be served CORRECTLY
@@ -3254,6 +3384,10 @@ export declare class Dispatcher {
 
 export declare interface DispatcherDependencies {
     readonly store: DataStore;
+    /** CRDT columns per table (schemaRegistry.crdtColumns). Feeds the
+     *  downstream lane: crdt cells diff as incremental mergeCells ops.
+     *  Absent → no crdt tables (tests, embedders) — plain full-value diffs. */
+    readonly crdtColumnsOf?: (table: string) => ReadonlySet<string>;
     /** Optional sink for per-delivery timing. `voltro dev` wires this into
      *  the trace buffer so the dashboards show each data transfer's latency.
      *  No-op when absent (tests, embedders that don't trace). */
@@ -3489,6 +3623,8 @@ export declare const evaluateTouchedRules: (params: {
     readonly subject: unknown;
 }) => Promise<void>;
 
+declare type Event_2 = SubscriptionEvent<ReadonlyArray<Row>>;
+
 /**
  * How many deliveries one client may fall behind before the oldest are dropped.
  *
@@ -4411,6 +4547,14 @@ export declare interface FluentStore extends Omit<MutationStore, 'update' | 'del
      *     await ctx.store.links('post_tags', { postId: post.id }).set(tagIds)
      */
     links(junctionTable: string, anchor: Readonly<Record<string, string>>): JunctionLinks;
+    /**
+     * `links(...)` with the anchor COLUMN derived from the anchored TABLE: the
+     * junction's reference column that points at `anchorTable` becomes the
+     * source. Exactly one column may qualify — a self-junction (both columns
+     * referencing the same table) is refused with the fix, never guessed.
+     * This is what a mutation target's declared `relations:` resolves through.
+     */
+    relationLinks(junctionTable: string, anchorTable: string, anchorId: string): JunctionLinks;
     /**
      * Execute a query descriptor and return the matching rows — TYPED.
      *
@@ -5417,6 +5561,25 @@ export declare const makeCoordinatedScheduler: (deps: CoordinatedScheduleDeps) =
  */
 export declare const makeDataLoader: (deps: LoaderDeps) => DataLoader;
 
+/**
+ * The per-delivery refilter EVERY subscribing transport must hand the
+ * dispatcher — the one that re-resolves this subject's visibility before each
+ * delivery instead of freezing it at subscribe.
+ *
+ * It lives here, beside the registration it reads, because it was a private
+ * helper of the WebSocket entrypoint and the transports that did not import it
+ * did not filter at all. `dispatcher.subscribe` resolves visibility itself and
+ * treats an absent refilter as "this app has no filter", so a transport that
+ * simply omitted the argument read the UNFILTERED descriptor — on the initial
+ * snapshot and on every delta. The SSE and gRPC projections omitted it.
+ *
+ * Returning `undefined` when no filter is registered is the fast path, not an
+ * opt-out: it is what keeps a filterless app free of a per-delivery await, and
+ * `dispatcher.subscribe` refuses the ambiguous case (nothing passed WHILE a
+ * filter is registered) rather than reading it as this one.
+ */
+export declare const makeDefaultRefilter: (subject: Subject, onError?: (error: unknown) => void) => (() => Promise<RowFilterScope>) | undefined;
+
 /** `__voltro.connections.disconnect` — forget the caller's credential. */
 export declare const makeDisconnectConnectionExecutor: (deps: ConnectionBuiltinDeps) => (input: {
     readonly connectionId: string;
@@ -5626,6 +5789,8 @@ export declare const makeSubmitTokenExecutor: (deps: ConnectionBuiltinDeps) => (
     readonly ok: boolean;
 }>;
 
+export declare const makeSubscriptionOutbox: (options: SubscriptionBackpressureOptions) => SubscriptionOutbox;
+
 /**
  * The factory the serve entrypoints inject into `makeMutationRunner`'s
  * `undoCapture` dep. Collects changes from the wrapped tx; `persist` writes ONE
@@ -5633,7 +5798,7 @@ export declare const makeSubmitTokenExecutor: (deps: ConnectionBuiltinDeps) => (
  * mutation's transaction. The changes are JSON-serialized into a TEXT column —
  * dialect-uniform, no json codec on the path.
  */
-export declare const makeUndoCapture: (rawTx: DataStore) => {
+export declare const makeUndoCapture: (rawTx: DataStore, crdtColumnsOf?: (table: string) => ReadonlySet<string>) => {
     tx: DataStore;
     persist: (store: unknown, meta: {
         readonly tag: string;
@@ -5922,8 +6087,10 @@ export declare interface MutationLike {
         readonly requiresApproval?: AnyApprovalPolicy | undefined;
         readonly target?: {
             readonly table: string;
+            readonly relations?: Readonly<Record<string, string>> | undefined;
         } | ReadonlyArray<{
             readonly table: string;
+            readonly relations?: Readonly<Record<string, string>> | undefined;
         }> | undefined;
     };
     executor(input: unknown, ctx: unknown): unknown;
@@ -6629,6 +6796,16 @@ export declare const publishEvent: <Name extends string, Key extends Schema.Sche
     readonly deferred: boolean;
 }, EventPublishError>;
 
+/**
+ * A Layer that publishes whatever tracer is in scope when it is built.
+ *
+ * Provided immediately INSIDE the tracer layer at boot, so it captures the
+ * configured tracer rather than the default one. With tracing off it captures
+ * Effect's no-op tracer, which is the correct answer — detached work then
+ * behaves exactly as in-request work does.
+ */
+export declare const publishServerTracerLayer: Layer.Layer<never, never, never>;
+
 /**
  * The two scopes, composed once, for every path that finalises a descriptor.
  *
@@ -6690,9 +6867,23 @@ export declare interface QueryProducerDeps<D> {
 }
 
 export declare interface QuerySubscriberDeps<D> extends QueryProducerDeps<D> {
-    /** Open a dispatcher subscription for a finalized descriptor. */
-    readonly subscribeDescriptor: (descriptor: D, emit: (event: unknown) => void, context: ServeRequestContext) => Promise<() => void>;
-    /** Open a dispatcher subscription for a COMPUTED query (re-runs on source change). */
+    /**
+     * Open a dispatcher subscription for a finalized descriptor.
+     *
+     * `reauthorize` and `refilter` are REQUIRED parameters of this callback, not
+     * optional extras, and the requirement is the guard: they used to be
+     * `dispatcher.subscribe`'s trailing optional arguments, this callback simply
+     * did not pass them, and the dispatcher reads their absence as "this query is
+     * unguarded and this app has no row filter". So the SSE and gRPC projections
+     * re-ran no guard and read the UNFILTERED descriptor — initial snapshot and
+     * every delta — while the WebSocket path (which goes through
+     * `bindSubscription`) did both. Threading them through the signature makes the
+     * next transport unable to repeat that by omission.
+     */
+    readonly subscribeDescriptor: (descriptor: D, emit: (event: unknown) => void, context: ServeRequestContext, reauthorize: (() => Promise<unknown>) | undefined, refilter: (() => Promise<RowFilterScope>) | undefined) => Promise<() => void>;
+    /** Open a dispatcher subscription for a COMPUTED query (re-runs on source change).
+     *  A computed query re-runs its HANDLER per change, so guards and the row
+     *  filter are re-applied by that re-run — it needs no separate pair. */
     readonly subscribeComputed: (computed: ComputedQuery, emit: (event: unknown) => void, context: ServeRequestContext) => Promise<() => void>;
 }
 
@@ -6869,6 +7060,25 @@ export declare interface ReactiveConfigInput {
      * warning to name a later one.
      */
     readonly rawReadTrackingLimit?: number;
+    /**
+     * Subscription socket backpressure (plan 01 P1). A slow or dead consumer no
+     * longer retains every event: updates COALESCE onto the newest state while
+     * the socket is blocked, and a consumer persistently over the buffer
+     * threshold is closed with a typed `SubscriptionOverrun` (it re-subscribes
+     * for a fresh snapshot). Resolved by the CLI's `reactiveTunables.ts`; env
+     * overrides win: `VOLTRO_REACTIVE_MAX_BUFFERED_BYTES` /
+     * `VOLTRO_REACTIVE_OVERRUN_AFTER_MS` / `VOLTRO_REACTIVE_OVERSIZED_EVENT_BYTES`.
+     */
+    readonly socket?: {
+        /** Estimated pending bytes per subscription above which a persistently
+         *  blocked consumer is overrun-closed. Default 1 MiB. */
+        readonly maxBufferedBytes?: number;
+        /** How long the pending state must stay over the threshold before the
+         *  terminal close. Default 10_000 ms. */
+        readonly overrunAfterMs?: number;
+        /** Per-event WARN threshold (telemetry, NOT a cap). Default 256 KiB. */
+        readonly oversizedEventBytes?: number;
+    };
 }
 
 export declare interface ReactiveEnv {
@@ -6884,6 +7094,16 @@ export declare type ReactiveReturn<D extends ExecutorDescriptor> = D extends {
     readonly descriptor: QueryDescriptor;
 } : never;
 
+export declare interface ReactiveSocketTunables {
+    readonly maxBufferedBytes: number;
+    readonly overrunAfterMs: number;
+    readonly oversizedEventBytes: number;
+}
+
+/** The resolved tunables, or the defaults when no boot path has set any
+ *  (unit tests, a bare library use). */
+export declare const reactiveSocketTunables: () => ReactiveSocketTunables;
+
 export declare interface ReadClassification {
     /** Tables whose ROWS can reach the caller: the queried table and its joins. */
     readonly composed: ReadonlySet<string>;
@@ -6970,6 +7190,8 @@ export declare interface RebacSubject {
     readonly scopes?: ReadonlyArray<string>;
 }
 
+export declare const recordCoalesced: (label: string, collapsed: number) => void;
+
 export declare const recordCredentialExpiry: (clientId: number, exp: number | undefined) => void;
 
 /** What the framework emit-seams (servePipeline / rpcServer / plugin wrappers)
@@ -6996,6 +7218,15 @@ export declare const recordEventPublished: (event: string) => void;
 /** Subscriber attached (+1) or detached (-1). */
 export declare const recordEventSubscribers: (event: string, delta: number) => void;
 
+/**
+ * Record one emitted event into the identity's ring. Snapshots RESET the ring
+ * (the snapshot's revision becomes the new replay base — a client holding an
+ * older revision is outside the chain); deltas append. An error event drops
+ * the ring: whatever state the client holds, the safe answer after an error
+ * is a fresh snapshot.
+ */
+export declare const recordForResume: (identity: ResumeIdentity, event: SubscriptionEvent<unknown>, now?: number, tunables?: ResumeTunables) => void;
+
 /**
  * A store that notes every read and changes nothing else.
  *
@@ -7006,6 +7237,10 @@ export declare const recordEventSubscribers: (event: string, delta: number) => v
  */
 export declare const recordingStore: (store: DataStore) => DataStore;
 
+export declare const recordOverrun: (label: string) => void;
+
+export declare const recordOversized: (label: string) => void;
+
 /**
  * Record a raw read, opening a scope for the rest of this execution context if
  * none is open yet.
@@ -7296,6 +7531,13 @@ export declare interface RegistryTableLike {
  *  request was. */
 export declare const rehydrateGuards: (serialized: ReadonlyArray<SerializedGuard>) => ReadonlyArray<AnyGuardSpec>;
 
+/** The store slice `applyDeclaredRelations` needs. */
+declare interface RelationLinksStore {
+    relationLinks(junctionTable: string, anchorTable: string, anchorId: string): {
+        set(targetIds: ReadonlyArray<string>): Promise<unknown>;
+    };
+}
+
 /** A relationship tuple — `subjectId` has `relation` on `<resourceType>:<resourceId>`.
  *  In practice these are rows in a relation table; the engine takes them as data. */
 export declare interface RelationTuple {
@@ -7481,15 +7723,24 @@ export declare const resetComputedQueryCacheWarnings: () => void;
 /** Test/dev-only — clear ALL per-connection state. Don't call from app code. */
 export declare const _resetConnectionCredentialsForTest: () => void;
 
+/** Test seam — expire everything immediately. */
+export declare const resetDetachedForTest: () => void;
+
 /** Test seams for the tag-cache guard — the cache is module-private otherwise. */
 export declare const resetEventMetricTagCacheForTests: () => void;
 
 /** Drop everything recorded. For tests; not called by the runtime. */
 export declare const resetObservedGraph: () => void;
 
+/** Test seam. */
+export declare const resetResumeRingsForTest: () => void;
+
 /** Reset to the env default (tests). */
 export declare const resetSecretsBackend: () => void;
 
+/** Test seam. */
+export declare const resetSubscriptionSocketMetrics: () => void;
+
 /**
  * The client address to rate-limit, geo-block and audit by.
  *
@@ -7808,6 +8059,46 @@ export declare const restrictingReadsEffect: <A, E, R>(effect: Effect.Effect<A,
 /** The full ordered list of result variants for a definition, holdout last. */
 export declare const resultVariantNames: (def: ExperimentDefinition) => ReadonlyArray<string>;
 
+export declare type ResumeAnswer = 
+/** The client's revision chains: replay these deltas in order. */
+    {
+    readonly kind: 'deltas';
+    readonly deltas: ReadonlyArray<RingDelta>;
+}
+/** Outside the window / unknown identity / gap — send a snapshot,
+*  `resumed: false`. */
+| {
+    readonly kind: 'snapshot';
+};
+
+/**
+ * The identity a ring is recorded under — and the identity a resume must
+ * present to read it back. `subjectId`/`tenantId` are part of the KEY, so a
+ * login/logout/tenant-switch between disconnect and resume simply misses the
+ * ring and falls back to a snapshot (`resumed: false`) — the blank-on-auth
+ * doctrine, enforced structurally rather than checked.
+ */
+export declare interface ResumeIdentity {
+    readonly label: string;
+    /** Canonicalised query input (JSON with sorted keys). */
+    readonly inputKey: string;
+    readonly subjectId: string;
+    readonly tenantId: string;
+}
+
+export declare const resumeKeyOf: (identity: ResumeIdentity) => string;
+
+export declare interface ResumeSink {
+    current: (event: SubscriptionEvent<unknown>) => void;
+}
+
+export declare interface ResumeTunables {
+    readonly windowMs: number;
+    readonly maxDeltas: number;
+}
+
+export declare const resumeTunables: () => ResumeTunables;
+
 export { RetentionConflict }
 
 export { RetentionSource }
@@ -7882,6 +8173,12 @@ export declare const revokedIds: (before: ReadonlyArray<{
     readonly id: string;
 }>) => ReadonlyArray<string>;
 
+declare interface RingDelta {
+    readonly revision: number;
+    readonly emittedAt: number;
+    readonly patch: RowPatch;
+}
+
 /**
  * Live traffic the router fronts — read by idle detection (the orchestrator
  * can't see the app's HTTP/WS load directly when it's scaled to zero, but
@@ -7974,8 +8271,71 @@ export declare interface RowFilter<Ctx = unknown> {
      * the handler still carries the check the filter was meant to replace.
      */
     readonly onLoadError?: 'fail' | 'deny';
+    /**
+     * The ONLY tables this filter may narrow. Optional; declaring it buys
+     * delta-resume back for every subscription whose source is not in the set.
+     *
+     * WHY IT EXISTS. A subscription whose row set is re-resolved per delivery
+     * must not replay deltas on reconnect — the answer can change while the
+     * socket is down (a membership ends) and a wrong replay leaks rows. But the
+     * question the framework could ask was only "is a filter registered at
+     * all?", so ONE registration disabled delta-resume for the whole process. A
+     * deployment measured a filter narrowing 4 tables costing the feature on all
+     * 173 of their query descriptors, 55 of whose source tables it never touches.
+     *
+     * WHY A DECLARATION RATHER THAN A PROBE. Resolving the scope at subscribe
+     * and treating `predicate(ctx, source) === undefined` as safe is cheaper and
+     * unsound: the predicate is a function of freshly loaded context, so a table
+     * it does not narrow now may be narrowed on the next delivery — which is the
+     * entire reason the refilter is per-delivery. A static list is a promise
+     * about every future resolution.
+     *
+     * IT IS VERIFIED, not trusted. Returning a predicate for a table outside
+     * this set raises {@link RowFilterDeclarationViolated} at the read that did
+     * it — the request fails and a subscription is revoked, rather than serving
+     * rows under a resume grant the declaration no longer earns. An undeclared
+     * filter (this field absent) keeps the conservative behaviour: no resume
+     * anywhere, no verification.
+     *
+     *     setRowFilter({
+     *       load, predicate,
+     *       tables: ['bookmarks', 'recentSearches', 'todoSchedules', 'todoTags'],
+     *     })
+     */
+    readonly tables?: ReadonlyArray<string>;
+}
+
+/**
+ * A row filter narrowed a table its `tables:` declaration does not list.
+ *
+ * Fail-closed by construction: the declaration is what the framework hands
+ * delta-resume, so a filter that quietly narrows beyond it would have rings
+ * recorded for a table whose visibility CAN change — the leak the exclusion
+ * exists to prevent. Raised at the read that violated it, naming the table and
+ * the fix, rather than degrading to an unfiltered or empty answer.
+ */
+export declare class RowFilterDeclarationViolated extends RowFilterDeclarationViolated_base {
 }
 
+declare const RowFilterDeclarationViolated_base: Schema.TaggedErrorClass<RowFilterDeclarationViolated, "RowFilterDeclarationViolated", {
+    readonly _tag: Schema.tag<"RowFilterDeclarationViolated">;
+} & {
+    /** The table the predicate narrowed. */
+    table: typeof Schema.String;
+    /** The declared set, for the message. */
+    declared: Schema.Array$<typeof Schema.String>;
+}>;
+
+/**
+ * Could the registered filter narrow ANY of `tables`?
+ *
+ * The question delta-resume asks before recording a ring. Answers `true`
+ * whenever it cannot prove otherwise — no declaration means the framework does
+ * not know which tables the predicate may reach, and "unknown" must read as
+ * "yes" or the exclusion stops protecting anything.
+ */
+export declare const rowFilterMayNarrow: (tables: ReadonlyArray<string>) => boolean;
+
 /**
  * Is a row filter registered right now — asked by a path about to serve an
  * UNFILTERED read.
@@ -8097,9 +8457,16 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
      * http app, so it fires on EVERY request — inspect, webhooks, AND the
      * rpc websocket upgrade — before auth/routing. A non-null return
      * short-circuits with that response (e.g. a rate-limit 429 / geo-block
-     * 451). Absent → no wrapper. Fail-OPEN: a throwing interceptor is
-     * swallowed and the request continues, so a buggy shield can't take
-     * the whole listener down.
+     * 451). Absent → no wrapper.
+     *
+     * FAIL-CLOSED: a throwing interceptor answers 500 and logs, it does NOT
+     * let the request through. The composed chain is where security gates
+     * live (an IP shield, a tenant fence — anything a plugin mounts
+     * pre-auth), and a gate that crashes open has silently stopped
+     * guarding while still reading as installed. An interceptor that must
+     * not take the listener down with its own dependency owns that
+     * decision itself — plugin-ratelimit's httpShield catches its store
+     * failure and degrades to "unlimited, loudly" rather than throwing.
      */
     readonly pluginHttpInterceptor?: HttpRequestInterceptor;
     /**
@@ -8968,6 +9335,12 @@ export declare interface ServeRequestContext {
     readonly subject: unknown;
     readonly traceId: string;
     readonly spanId?: string;
+    /**
+     * Caller-side cancellation (the gRPC deadline / client-cancel path).
+     * Honoured at the ONE place the executor effect runs to a promise, so an
+     * exceeded deadline INTERRUPTS the server work — not merely the response.
+     */
+    readonly signal?: AbortSignal;
     /**
      * Row-level visibility for this request, resolved by `withRowFilter` and read
      * by the context builder when it wraps the store.
@@ -9025,13 +9398,26 @@ export declare type ServeRpcInterceptor = (base: Effect.Effect<unknown, unknown,
     readonly target?: ReadonlyArray<string>;
 }) => Effect.Effect<unknown, unknown, never>;
 
+/** The published tracer, or `undefined` when tracing is off / no server booted. */
+export declare const serverTracer: () => Tracer.Tracer | undefined;
+
+export declare const setBufferedBytes: (label: string, bytes: number) => void;
+
 /** Register the process-wide connection resolver (or clear with `undefined`).
  *  Called by the CLI at boot; tests call it directly. */
 export declare const setConnectionResolver: (resolver: ConnectionResolver | undefined) => void;
 
+/** Boot/test override — the slot `wireCrdtTunables` writes. `null` restores
+ *  env/default resolution. */
+export declare const setCrdtCompactMaxBytes: (maxBytes: number | null) => void;
+
 /** Register the field cipher (or clear with `undefined`). */
 export declare const setFieldCipher: (cipher: FieldCipher | undefined) => void;
 
+export declare const setReactiveSocketTunables: (tunables: ReactiveSocketTunables | null) => void;
+
+export declare const setResumeTunables: (tunables: ResumeTunables | null) => void;
+
 /**
  * Boot-path wiring. `null` clears (shutdown). Registering `null` vs never
  * registering are deliberately the SAME state — a call before boot wiring and
@@ -9048,6 +9434,9 @@ export declare const setRowFilter: <Ctx>(filter: RowFilter<Ctx> | undefined) =>
 /** Install the process-wide secrets backend (called once at boot). */
 export declare const setSecretsBackend: (backend: SecretsBackend) => void;
 
+/** Publish the server's tracer. Called once, from inside the provided scope. */
+export declare const setServerTracer: (tracer: Tracer.Tracer | undefined) => void;
+
 /** Install the finding sink. `undefined` turns recording back off. */
 export declare const setSourceGapSink: (fn: ((finding: string) => void) | undefined) => void;
 
@@ -9160,7 +9549,10 @@ export declare interface SnapshotCacheBinding {
     readonly swrMs: number | undefined;
 }
 
-/** Snapshot the whole registry, normalized to `MetricSample[]`. */
+/** Snapshot the whole registry, normalized to `MetricSample[]` — plus the
+ *  socket-backpressure counters (`subscriptionSocketMetrics.ts`), appended
+ *  HERE so every reader (Prometheus exporter, inspect Metrics panel) sees
+ *  one derivation and the two cannot diverge. */
 export declare const snapshotMetrics: Effect.Effect<ReadonlyArray<MetricSample>>;
 
 /** Eager snapshot for sync callers (the inspect endpoint). */
@@ -9425,6 +9817,22 @@ export declare interface SubscriberDefinition {
     readonly handler: SubscribeHandler;
 }
 
+export declare interface SubscriptionBackpressureOptions {
+    /** Estimated pending bytes above which a persistently-blocked consumer is
+     *  overrun-closed. `reactive.socket.maxBufferedBytes` / env override. */
+    readonly maxBufferedBytes: number;
+    /** How long the pending state must stay over the threshold (with the pump
+     *  blocked) before the terminal close. */
+    readonly overrunAfterMs: number;
+    /** Per-event WARN threshold — telemetry for oversized snapshots/deltas.
+     *  Deliberately NOT a cap: measurability is the goal. */
+    readonly oversizedEventBytes: number;
+    /** Query tag for logs + metrics. */
+    readonly label: string;
+    readonly now?: () => number;
+    readonly warn?: (message: string, fields: Record<string, unknown>) => void;
+}
+
 /**
  * Timing of ONE subscription delivery (the initial snapshot, or a delta
  * pushed on a change). The duration is the real produce→push latency:
@@ -9460,6 +9868,29 @@ export declare interface SubscriptionDeliveryRecord {
     readonly rowCount: number;
 }
 
+export declare interface SubscriptionOutbox {
+    /** SYNC push from the dispatcher's emit callback. */
+    readonly push: (event: Event_2) => void;
+    /** Pump side: resolves with the next event to hand into the stream —
+     *  coalesced when more than one push landed since the last take — or null
+     *  once the outbox is closed and drained. */
+    readonly take: () => Promise<Event_2 | null>;
+    /** True once the overrun policy fired (the error event has been queued;
+     *  the stream ends after it drains). */
+    readonly overrun: () => boolean;
+    readonly close: () => void;
+}
+
+/** The wire shape of the terminal overrun error — documented in
+ *  wire-protocol.md. The client surfaces it as the entry's `error` and
+ *  re-subscribes for a fresh snapshot. */
+export declare interface SubscriptionOverrunError {
+    readonly _tag: 'SubscriptionOverrun';
+    readonly message: string;
+    readonly bufferedBytes: number;
+    readonly maxBufferedBytes: number;
+}
+
 export declare type SubscriptionRecord = {
     readonly id: string;
     readonly table: string;
@@ -9520,6 +9951,35 @@ export declare interface SubscriptionSnapshot {
     readonly subscriberCount: number;
 }
 
+/**
+ * The counters as `MetricSample`s — appended by `snapshotMetrics`
+ * (metrics.ts), which is the ONE derivation both the Prometheus exporter and
+ * the inspect Metrics panel read. Same input → the two cannot diverge.
+ */
+export declare const subscriptionSocketMetricSamples: () => ReadonlyArray< MetricSample>;
+
+export declare interface SubscriptionSocketMetricsSnapshot {
+    /** Sum + per-label current pending bytes across live subscriptions. */
+    readonly bufferedBytes: {
+        readonly total: number;
+        readonly byLabel: Readonly<Record<string, number>>;
+    };
+    readonly coalescedTotal: {
+        readonly total: number;
+        readonly byLabel: Readonly<Record<string, number>>;
+    };
+    readonly overrunTotal: {
+        readonly total: number;
+        readonly byLabel: Readonly<Record<string, number>>;
+    };
+    readonly oversizedTotal: {
+        readonly total: number;
+        readonly byLabel: Readonly<Record<string, number>>;
+    };
+}
+
+export declare const subscriptionSocketMetricsSnapshot: () => SubscriptionSocketMetricsSnapshot;
+
 /** Drop handshake grants past their TTL. Wired into the boot retention sweep;
  *  a grant is worthless the moment it expires and keeping them turns a hot
  *  table into an audit liability. */
@@ -10390,24 +10850,6 @@ export declare const webhookVerificationOf: (handle: unknown) => WebhookVerifica
  */
 export declare type WhereOp = '=' | '!=' | '<>' | '>' | '>=' | '<' | '<=' | 'in' | 'contains' | 'startsWith' | 'fts';
 
-/**
- * Resolve this request's row-filter scope. A no-op (same object back) when the
- * app registered no filter, so an app that uses none pays nothing.
- *
- * Every runner calls this before building a context. A read path that skipped
- * it would have no row-level security and would look exactly like one that
- * does — which is why it lives in the shared spine rather than in each
- * entrypoint.
- *
- * REJECTS with the raw `RowFilterUnavailable` (via `runProvidedEffect`, not
- * `Effect.runPromise`) when the filter's `onLoadError` is the default `'fail'`
- * and `load` failed every retry. Raw, so the rpc encoder matches it against the
- * descriptor's `error:` schema and the client gets the tag instead of an opaque
- * defect — the same treatment `enforceGuards` gives a `ScopeError`. Proceeding
- * with an unresolved filter is not an option here: the context builder would
- * receive `rowFilter: undefined`, which means "this app registered no filter"
- * and would silently serve the request UNFILTERED.
- */
 export declare const withRowFilter: <R extends ServeRequestContext>(request: R) => Promise<R>;
 
 /**
@@ -10432,6 +10874,16 @@ export declare const withRowFilter: <R extends ServeRequestContext>(request: R)
  */
 export declare const withScopedRequest: <R extends ServeRequestContext, A>(requestContext: R, body: (scoped: R) => A | Effect.Effect<A, unknown, never>) => A | Effect.Effect<A, unknown, never>;
 
+/**
+ * Run detached work under the server's tracer, so a span it opens is exported
+ * rather than created and dropped.
+ *
+ * A no-op when nothing is published (a unit test, an embedder, a process with no
+ * rpc server) — never a second tracer, never a throw. The alternative to this
+ * function is not "a different tracer", it is silence.
+ */
+export declare const withServerTracer: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+
 /**
  * What the gate decided. `passthrough` is the common case — no controls
  * declared — and is distinct from `start` so the facade can skip the commit
@@ -10937,7 +11389,7 @@ export declare interface WorkflowWaitOptions {
  * calls (incl. multi-table within one mutation) are. A mutation that writes via
  * a bulk helper simply produces no undo entry (documented).
  */
-export declare const wrapCaptureStore: (tx: DataStore, collect: (c: ForwardChange) => void) => DataStore;
+export declare const wrapCaptureStore: (tx: DataStore, collect: (c: ForwardChange) => void, crdtColumnsOf?: (table: string) => ReadonlySet<string>) => DataStore;
 
 /**
  * Wrap a raw `DataStore` with the storage codec only — `.encrypted()` columns