@voltro/runtime 0.66.1 → 0.68.0

package/dist/index.d.ts

@@ -1751,6 +1751,7 @@ export declare const bindSubscriptionUntyped: (descriptor: QueryDescriptor, disp
 }, resume?: {
     readonly input: unknown;
     readonly fromRevision?: number;
+    readonly reconcile?: string;
 }) => Stream.Stream<SubscriptionEvent<ReadonlyArray<Row>>, never, never>;
 
 export declare interface BrandedScheduleDefinition extends ScheduleDefinition {
@@ -3431,7 +3432,7 @@ export declare class Dispatcher {
      *  nothing to resolve; it is not the caller's choice. Omitting it while a
      *  filter IS registered throws below, because the read would then ignore the
      *  filter entirely. Build it with `makeDefaultRefilter(subject)`. */
-    refilter?: () => Promise<RowFilterScope>): Promise<() => void>;
+    refilter?: () => Promise<RowFilterScope>, readFromPrimary?: boolean): Promise<() => void>;
     /**
      * Tear a subscription down because it can no longer be served CORRECTLY
      * mid-stream — authorization was withdrawn, or row visibility became
@@ -4757,6 +4758,12 @@ export declare interface FleetMergeResult<T> {
      *
      * Empty when no membership is wired: with no roster there is no evidence of
      * departure, and assuming it would empty a single-process answer.
+     *
+     * A row is departed only when it is BOTH unrostered AND older than the
+     * freshness window. Roster-absence alone is not evidence — a membership view
+     * is per-process, so replicas sharing a database but no bus each hold a roster
+     * of one, and the earlier rule had two live replicas calling each other gone
+     * while reporting an age of under two seconds.
      */
     readonly departed: ReadonlyArray<{
         readonly replicaId: string;
@@ -6813,6 +6820,43 @@ export declare interface OrchestratorTickDeps {
     readonly log?: WakeOrchestratorLogger;
 }
 
+/**
+ * Referrer policies that make a browser send `Origin: null` on a SAME-ORIGIN
+ * state-changing request — which `classifyRequestOrigin` refuses as opaque.
+ *
+ * This is not a lint about tidiness. `no-referrer` was the default here, and
+ * under it every no-JS `<form method="post">` in every Voltro app answered 403,
+ * on both boot paths, for every user. Two security defaults, each defensible
+ * alone, cancelling each other: we asked the browser to withhold provenance and
+ * then refused the request for lacking it.
+ *
+ * Measured in a real headless chromium against a bare `node:http` server —
+ * ONE header changed between the rows, nothing else:
+ *
+ *   Referrer-Policy: (none)                          → Origin: http://127.0.0.1:45412
+ *   Referrer-Policy: no-referrer                     → Origin: null        ← and no Referer
+ *   Referrer-Policy: strict-origin-when-cross-origin → Origin: http://127.0.0.1:45412
+ *   Referrer-Policy: same-origin                     → Origin: http://127.0.0.1:45412
+ *
+ * It is the Fetch spec's behaviour, not a chromium quirk: when appending the
+ * `Origin` header, a request whose referrer policy is `no-referrer` serialises
+ * its origin as `null`. `origin-when-cross-origin`'s sibling `unsafe-url` does
+ * not, so the set below is exactly the two that null it unconditionally.
+ *
+ * `same-origin` is NOT in the set — it preserves the Origin for same-origin
+ * requests — but it is also not the default, because it nulls the Origin for a
+ * legitimate CROSS-origin post to an allowlisted api, which is precisely the
+ * split-deployment `VOLTRO_ALLOWED_ORIGINS` exists to permit.
+ * `strict-origin-when-cross-origin` nulls it only on an https→http downgrade,
+ * which is the one case where withholding it is the point. It is also what every
+ * current browser does with no header at all, so it surprises nobody.
+ *
+ * The second casualty of `no-referrer` is in the same request: the Referer is
+ * gone too, and `/form/*` reads it to decide where the PRG redirect and the 422
+ * re-render go back to.
+ */
+export declare const ORIGIN_NULLING_REFERRER_POLICIES: ReadonlySet<string>;
+
 export declare type OriginDecision = {
     readonly allowed: true;
     readonly reason: 'guard-off' | 'same-origin' | 'loopback' | 'allowlisted' | 'no-browser-origin';
@@ -6944,7 +6988,7 @@ export declare interface OutboxFacade {
 export declare interface OutboxFacadeDeps {
     /** The REQUEST's store. Inside a mutation this is the transactional view —
      *  which is what makes the enqueue atomic with the domain write. */
-    readonly store: Pick<DataStore, 'insert' | 'query' | 'update'>;
+    readonly store: Pick<DataStore, 'insert' | 'query' | 'updateMany'>;
     readonly subject: Subject;
     readonly traceId: string | null;
     /** Nudge the drain worker once the transaction commits. Optional: without
@@ -7107,6 +7151,15 @@ export declare type PluginScheduleCoordinated = (name: string, intervalMs: numbe
 
 export declare const powerOfTwoSelector: (options?: P2COptions) => ReplicaSelector;
 
+/**
+ * Whether a `Referrer-Policy` value leaves the `Origin` header intact on a
+ * same-origin state-changing request.
+ *
+ * Reads the LAST supported token, which is what a browser honours: the header
+ * is a fallback list, and every token after a supported one still overrides it.
+ */
+export declare const preservesSameOriginHeader: (value: string | false) => boolean;
+
 export declare interface PreviewDiff {
     readonly rows: ReadonlyArray<RowDiff>;
     readonly summary: {
@@ -7566,8 +7619,9 @@ export declare interface ReactiveConfigInput {
 }
 
 export declare interface ReactiveEnv {
-    readonly VOLTRO_REACTIVE_DELIVERY_CONCURRENCY?: string;
-    readonly VOLTRO_RAW_READ_TRACKING_LIMIT?: string;
+    readonly [key: string]: string | undefined;
+    readonly VOLTRO_REACTIVE_DELIVERY_CONCURRENCY?: string | undefined;
+    readonly VOLTRO_RAW_READ_TRACKING_LIMIT?: string | undefined;
 }
 
 /** A reactive query returns a builder descriptor instead of a value; the store
@@ -7618,7 +7672,7 @@ export declare interface ReadClassification {
  * pathology the backoff exists to remove.
  */
 export declare const readPollCeilingMs: (env?: {
-    readonly VOLTRO_POLL_CEILING_MS?: string;
+    readonly [key: string]: string | undefined;
 }) => number;
 
 /** Is anything listening? Call sites skip their work when nothing is. */
@@ -9040,6 +9094,20 @@ export declare interface RpcServerOptions<Rpcs extends Rpc.Any> {
      * runtime capability so clients replay only when the deployed server proves
      * the same key will be deduplicated. */
     readonly mutationReplay?: boolean;
+    /**
+     * Publish per-rpc-tag SCHEMA SHAPE digests alongside the capabilities, so a
+     * connecting client can tell whether the copy of the api client it loaded is
+     * the one this server binds.
+     *
+     * Dev only, and set by `voltro dev` alone. The staleness it detects is a
+     * pre-bundled browser chunk that Vite did not re-optimize; `voltro serve`
+     * ships a built bundle where that cannot arise, and there a rolling deploy
+     * would make a transient mismatch NORMAL — reporting it would be noise on
+     * exactly the path where noise is expensive. So this is a deliberate
+     * dev/serve asymmetry rather than an oversight, which is the distinction the
+     * boot-path parity rule asks for.
+     */
+    readonly publishSurfaceDigest?: boolean;
     /** Non-sensitive fleet identity written on the rpc WebSocket open/close
      *  records. Defaults to the process identity resolver (POD_NAME/HOSTNAME).
      *  Embedders may state it explicitly when they own process identity. */
@@ -9356,6 +9424,11 @@ export declare const runWithRequestLoader: <T>(loader: DataLoader, fn: () => T)
  */
 export declare const runWithRoutingContext: <T>(ctx: RoutingContext, work: () => T) => T;
 
+/** Start EXECUTION inside the routing scope, not merely Effect construction.
+ *  Capture the caller's runtime so services, tracing and logging survive; the
+ *  async canceller interrupts the child when the requesting fiber is stopped. */
+export declare const runWithRoutingContextEffect: <A, E, R>(ctx: RoutingContext, effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+
 /** Run `fn` with the given trace context active for the duration of its
  *  (sync + awaited-async) execution. */
 export declare const runWithTraceContext: <T>(ctx: LogTraceContext, fn: () => T) => T;