@voltro/runtime 0.86.0 → 0.88.0

package/README.md

@@ -20,7 +20,50 @@ Installation, guides, the full API reference, and examples all live in the
 **[Voltro documentation](https://docs.voltro.dev/docs/intro/getting-started)** — the single source of truth. This README is
 deliberately short so there is nothing here to drift out of date.
 
+## Transactional API-key checks
+
+`lockApiKeyById(store, id, tenantId)` reads a key within its expected tenant
+with a native locking query and the regular API-key codec. Supply an existing
+write transaction after the application's lifecycle fences. The helper returns
+an internal row; the caller still verifies the bearer and current ownership,
+expiry, revocation and scopes. See the
+[API-key guide](https://docs.voltro.dev/docs/configuration/api-keys#transactional-key-checks).
+
 ## License
 
 Proprietary. © 2026 Voltro UG. Your use is governed by the
 [Terms of Service](https://voltro.cloud/legal/terms). See the bundled `LICENSE`.
+
+
+Mutation replay codecs validate the stored wire output against the declared
+current schema. They never return raw values after a codec failure or attach the
+stored payload to decoding errors. If a successful executor cannot encode its
+output, the binder records a completed refusal receipt without that payload;
+replay refuses instead of rerunning the effect to reconstruct output. This does
+not make business writes and idempotency persistence one atomic transaction.
+
+RPC and REST retain the original claim identity through receipt settlement.
+Late renewal, completion or cleanup cannot affect a replacement claim or delete
+an already completed receipt. Receipt ownership does not stop a prior remote
+business operation; durable intent and resource fencing remain necessary.
+
+Keyed mutations capture their actual declared input schema before waiting and
+bind receipts to that input plus authenticated identity. A changed or missing
+binding refuses without reconstructing business effects. MutationCodec and
+makeMutationCodec(inputSchema, outputSchema, admit) provide the shared contract. This
+binding does not replace current resource authorization or durable business intent.
+
+Persisted receipt metadata is decoded strictly before replay or lease expiry.
+Unknown states, invalid timestamps/fingerprints and inconsistent response states
+refuse without deleting the receipt or reconstructing the operation. Completed
+Void responses may omit their encoded body. This is corruption refusal, not
+proof of safe recovery or current authorization.
+
+Native RPC receipt admission refreshes authentication and declared guards before
+lookup and after its wait. Supply `makeMutationReplayAdmission(procedure, kind,
+{ defaultDeny, bindReplayAuthority })` as the codec's required third argument.
+Pure plugin refresher bindings do not execute business interceptors on replay.
+Fresh runners recheck after interceptor waits and build context from the fresh
+subject. Successful fresh self-revocation is acknowledged without a subsequent
+reauthentication that would discard its result. REST uses the same pure authority composer and guard primitives around its
+rate-limit/storage waits. Handler-only policies remain domain responsibilities.