Ironflow v0.51.0

Ironflow v0.51.0 requires the projection runner lease, stops sending store and driver error text to Connect clients, and makes NATS-ingested events land in the environment their subject names. Read the breaking changes before you upgrade: 8 items need action.

Breaking Changes

• The projection runner RPCs PollProjectionEvents, StreamProjectionEvents, SaveProjectionState and AckProjectionEvents need the projection lease and answer failed_precondition without it. Save and Ack refuse SQL projections. Run projections with an SDK runner, which takes the lease (#504)
• ProjectionService.ReportRebuildProgress is removed from the proto, the Go and TypeScript generated code and the Python ironflow.rpc module. The lease holder’s PollProjectionEvents ends a rebuild when the cursor reaches the target. Delete any direct call; read the job with GetRebuildJob (#504)
• An event published to NATS events.ingest.> is stored and dispatched in the environment its subject names. Only functions in that environment start, and waitForEvent and cancelOn see it. A subject that does not resolve to exactly one environment still fails the write. This path never worked before (#582)
• A store fault in CancelRebuild returns internal, not failed_precondition, and in GetRebuildJob returns internal, not not_found. Retry an internal answer; do not treat it as a missing job (#3102)
• A worker’s mistake on the worker stream ends it with a client code, not unknown: failed_precondition for an execution-fence violation, invalid_argument for a bad register, already_exists for a duplicate worker ID. The streaming workers reconnect as before (#3102)
• A deduplicated ResumeRun whose revert also failed returns internal, not already_exists. Inspect the run (#3102)
• PubSubService.Subscribe with a replay over the server limit, and GetTopicStats with a wildcard topic, return invalid_argument, not internal. The browser SDK no longer reconnects in a loop on the first one (#3102)
• @ironflow/node exports Run, ListRunsOptions and ListRunsResult in the shape its client returns, with string timestamps. ListRunsOptions.status no longer accepts "pending". For the Date-based types, import from @ironflow/core (#3043)

Fixes

• A server fault on any Connect RPC sends internal error (ref <id>) and logs the full error with the same ref. Before, PostgreSQL driver text with table, constraint and SQL detail reached the client. Search the server log for the ref (#3102)
• A cancel or timeout that a Connect handler codes itself sends only context canceled or context deadline exceeded, not text that can name the database host and user (#3102)
• The Connect Health database message is connection failed, and /ready reports a JetStream fault as jetstream unhealthy. The server log has the cause (#3102)
• InjectStepOutput no longer sends store text under aborted, and a server-side deadline is logged at warn level with its cause (#3102)
• @ironflow/core, @ironflow/node and @ironflow/browser require zod ^4.6.7. Move an older zod 4 pin to 4.6.7 or later (#2983)

Security

• The embedded dashboard bundles zod 4.6.7. Versions below 4.6.6 have advisory GHSA-mrhx-c7xc-m3w5: validating an oversized constrained collection can exhaust memory (#2983)

Other

• New docs book, What You Can Build: ten Northwind Market scenarios (#3144)
• The platform overview diagrams and code samples are easier to read (#3143, #3142)
• Ironflow Desktop dependency updates ship in the desktop changelog