@voltro/runtime 0.84.0 → 0.86.0

package/dist/schemaRegistry.js

@@ -0,0 +1,65 @@
+//#region src/schemaRegistry.ts
+var e = "voltro/audit", t = "voltro/softDelete", n = "voltro/expires", r = "voltro/tenant", i = "voltro/localFirst", a = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = /* @__PURE__ */ new Set();
+		for (let t of n.appliedMixins ?? []) t.id !== void 0 && e.add(t.id);
+		let r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s, c = /* @__PURE__ */ new Set(), l = /* @__PURE__ */ new Set(), u = /* @__PURE__ */ new Set(), d;
+		for (let [e, t] of Object.entries(n.fields)) t.unique && r.add(e), t.type === "id" && (r.add(e), t.idScheme !== void 0 && (d = t.idScheme)), t.defaultFactory !== void 0 && i.set(e, t.defaultFactory), t.computed !== void 0 && a.set(e, t.computed), t.onUpdate !== void 0 && o.set(e, t.onUpdate), t.versionColumn === !0 && (s = e), t.generatedAs !== void 0 && c.add(e), t.crdtManaged === !0 && l.add(e), t.crdtSealed === !0 && u.add(e);
+		let f = n.appliedIndexes ?? [];
+		for (let e of f) {
+			let t = e.fields[0];
+			t !== void 0 && r.add(t);
+		}
+		let p = {
+			tableName: n.tableName,
+			mixinIds: e,
+			fields: new Set(Object.keys(n.fields)),
+			indexedFields: r,
+			compositeIndexes: f.map((e) => ({
+				name: e.name,
+				fields: [...e.fields]
+			})),
+			defaultFactories: i,
+			computedFields: a,
+			...o.size > 0 ? { onUpdateFields: o } : {},
+			...s === void 0 ? {} : { versionColumn: s },
+			generatedColumns: c,
+			crdtColumns: l,
+			sealedColumns: u,
+			...d === void 0 ? {} : { idScheme: d },
+			declaredPrimaryKey: [...n.appliedPrimaryKey ?? []],
+			...n.insertSchema === void 0 ? {} : { insertSchema: n.insertSchema },
+			...n.validatePatchSchema === void 0 ? {} : { validatePatchSchema: n.validatePatchSchema }
+		};
+		t.set(n.tableName, p);
+	}
+	return {
+		tables: t,
+		hasMixin: (e, n) => t.get(e)?.mixinIds.has(n) ?? !1,
+		hasAudit: (e) => t.get(e)?.mixinIds.has("voltro/audit") ?? !1,
+		hasSoftDelete: (e) => t.get(e)?.mixinIds.has("voltro/softDelete") ?? !1,
+		hasExpires: (e) => t.get(e)?.mixinIds.has("voltro/expires") ?? !1,
+		hasTenant: (e) => t.get(e)?.mixinIds.has("voltro/tenant") ?? !1,
+		hasLocalFirst: (e) => t.get(e)?.mixinIds.has("voltro/localFirst") ?? !1,
+		hasField: (e, n) => t.get(e)?.fields.has(n) ?? !1,
+		anyFieldIndexed: (e, n) => {
+			let r = t.get(e);
+			if (r === void 0) return !1;
+			for (let e of n) if (r.indexedFields.has(e)) return !0;
+			return !1;
+		},
+		idScheme: (e) => t.get(e)?.idScheme,
+		declaredPrimaryKey: (e) => t.get(e)?.declaredPrimaryKey ?? c,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? o,
+		computedFields: (e) => t.get(e)?.computedFields ?? s,
+		versionColumn: (e) => t.get(e)?.versionColumn,
+		generatedColumns: (e) => t.get(e)?.generatedColumns ?? l,
+		crdtColumns: (e) => t.get(e)?.crdtColumns ?? u,
+		sealedColumns: (e) => t.get(e)?.sealedColumns ?? u,
+		insertSchema: (e) => t.get(e)?.insertSchema,
+		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
+	};
+}, o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = [], l = /* @__PURE__ */ new Set(), u = /* @__PURE__ */ new Set(), d = a([]);
+//#endregion
+export { e as VOLTRO_AUDIT_MIXIN_ID, n as VOLTRO_EXPIRES_MIXIN_ID, i as VOLTRO_LOCAL_FIRST_MIXIN_ID, t as VOLTRO_SOFT_DELETE_MIXIN_ID, r as VOLTRO_TENANT_MIXIN_ID, d as emptySchemaRegistry, a as makeSchemaRegistry };

package/dist/secretsResolver.js

@@ -0,0 +1,35 @@
+//#region src/secretsResolver.ts
+var e = { get: (e) => Promise.resolve(process.env[e]) }, t = e, n = (e) => {
+	t = e;
+}, r = () => {
+	t = e;
+}, i = async (e) => await t.get(e) ?? process.env[e], a = (e) => process.env[e], o = (e, t = 6e4, n = () => Date.now()) => {
+	let r = /* @__PURE__ */ new Map();
+	return { get: async (i) => {
+		let a = r.get(i);
+		if (a && n() - a.at < t) return a.value;
+		let o = await e.get(i);
+		return r.set(i, {
+			value: o,
+			at: n()
+		}), o;
+	} };
+}, s = (e) => {
+	let t = {
+		accept: "application/json",
+		...e.headers ?? {}
+	};
+	if (e.perKey) return o({ get: async (n) => {
+		let r = await fetch(`${e.url.replace(/\/$/, "")}/${encodeURIComponent(n)}`, { headers: t });
+		if (!r.ok) return;
+		let i = await r.json();
+		return typeof i.value == "string" ? i.value : void 0;
+	} }, e.ttlMs);
+	let n, r = 0, i = e.ttlMs ?? 6e4, a = () => (n !== void 0 && Date.now() - r < i || (r = Date.now(), n = fetch(e.url, { headers: t }).then((e) => e.ok ? e.json() : {}).catch(() => ({}))), n);
+	return { get: async (e) => {
+		let t = (await a())[e];
+		return typeof t == "string" ? t : void 0;
+	} };
+}, c = (t) => t === void 0 || t === "env" || typeof t == "object" && t.kind === "env" ? e : t.kind === "custom" ? t.backend : t.kind === "http" ? s(t) : e;
+//#endregion
+export { o as cachedBackend, e as envSecretsBackend, s as httpSecretsBackend, r as resetSecretsBackend, i as resolveSecret, a as resolveSecretSync, c as resolveSecretsBackend, n as setSecretsBackend };

package/dist/securityHeaders.js

@@ -0,0 +1,33 @@
+//#region src/securityHeaders.ts
+var e = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'", t = "frame-ancestors 'none'; base-uri 'none'; object-src 'none'", n = "max-age=15552000; includeSubDomains", r = /* @__PURE__ */ new Set(["no-referrer"]), i = (e) => {
+	if (e === !1) return !0;
+	let t = e.split(",").map((e) => e.trim().toLowerCase()).filter((e) => e !== ""), n = t[t.length - 1];
+	return n === void 0 || !r.has(n);
+}, a = (e) => {
+	let t = e?.trim().toLowerCase();
+	return t === "off" || t === "default" || t === "strict" ? t : void 0;
+}, o = (e) => {
+	if (e === void 0) return;
+	let t = e.trim();
+	if (t !== "") return t.toLowerCase() !== "off" && t;
+}, s = (e, t = process.env) => {
+	let n = e?.mode ?? a(t.VOLTRO_SECURITY_HEADERS) ?? "default", r = e?.csp ?? o(t.VOLTRO_CSP) ?? "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+	return {
+		mode: n,
+		csp: r,
+		cspHtml: e?.cspHtml ?? o(t.VOLTRO_CSP_HTML) ?? (n === "strict" ? r : "frame-ancestors 'none'; base-uri 'none'; object-src 'none'"),
+		hsts: e?.hsts ?? o(t.VOLTRO_HSTS) ?? "max-age=15552000; includeSubDomains",
+		frameOptions: e?.frameOptions ?? "DENY",
+		referrerPolicy: e?.referrerPolicy ?? "strict-origin-when-cross-origin",
+		contentTypeOptions: e?.contentTypeOptions ?? "nosniff",
+		extra: e?.extra ?? {}
+	};
+}, c = (e, t) => {
+	if (e.mode === "off") return {};
+	let n = (t.contentType ?? "").toLowerCase().includes("text/html") ? e.cspHtml : e.csp, r = {};
+	n !== !1 && (r["content-security-policy"] = n), e.frameOptions !== !1 && (r["x-frame-options"] = e.frameOptions), e.referrerPolicy !== !1 && (r["referrer-policy"] = e.referrerPolicy), e.contentTypeOptions !== !1 && (r["x-content-type-options"] = e.contentTypeOptions), e.hsts !== !1 && t.https && (r["strict-transport-security"] = e.hsts);
+	for (let [t, n] of Object.entries(e.extra)) r[t.toLowerCase()] = n;
+	return r;
+};
+//#endregion
+export { e as API_CSP, n as DEFAULT_HSTS, t as HTML_CSP, r as ORIGIN_NULLING_REFERRER_POLICIES, i as preservesSameOriginHeader, s as resolveSecurityHeaders, c as securityHeadersFor };

package/dist/servePipeline.js

@@ -0,0 +1,305 @@
+import { enterReadRecording as e } from "./readRecorder.js";
+import { getRowFilter as t, makeDefaultRefilter as n, resolveRowFilterScope as r } from "./rowFilter.js";
+import { isComputedQuery as i } from "./computedQuery.js";
+import { TX_READ_VERSIONS_KEY as a, isTransactionReadConflict as o } from "./storeMiddleware.js";
+import { evaluateTouchedRules as s, makeRuleCapture as c } from "./businessRules.js";
+import { enforceApproval as l } from "./approvals.js";
+import { Cause as u, Effect as d, Exit as f, Option as p } from "effect";
+import { isTransientContention as m } from "@voltro/database";
+import { SubjectService as h, checkGuardsEffect as g, currentSubjectAuthority as _, recheckGuardsEffect as v } from "@voltro/protocol";
+import { createLogger as y } from "@voltro/logger";
+//#region src/servePipeline.ts
+var b = (e, t) => d.runPromiseExit(e, t).then((e) => {
+	if (f.isSuccess(e)) return e.value;
+	let t = u.findErrorOption(e.cause);
+	throw p.isSome(t) ? t.value : u.squash(e.cause);
+}), x = (e) => b(e), S = (e, t) => e.pipe(d.provideService(h, t)), C = async (e, t, n, r) => {
+	let i = await d.runPromise(g(t, e.guards, n, {
+		defaultDeny: r === !0,
+		procedure: e.name
+	}));
+	if (i) throw i;
+}, w = async (e, t, n, r) => {
+	e.requiresApproval !== void 0 && await l({
+		procedure: e.name,
+		kind: t,
+		policy: e.requiresApproval,
+		subject: n.subject,
+		input: r,
+		traceId: n.traceId
+	});
+}, T = y({ scope: "voltro:rpc" }), E = async (e) => {
+	if (t() === void 0) return e;
+	let n = await x(r(e.subject, (e) => {
+		T.error("row filter failed to load", {}, e instanceof Error ? e : Error(String(e)));
+	}));
+	return {
+		...e,
+		rowFilter: n
+	};
+}, D = (e) => ({
+	...e.surface === void 0 ? {} : { surface: e.surface },
+	...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
+	...e.remoteAddr === void 0 ? {} : { remoteAddr: e.remoteAddr }
+}), O = (e) => {
+	let t = e.descriptor.target;
+	if (t == null) return [];
+	let n = Array.isArray(t) ? t : [t], r = /* @__PURE__ */ new Set();
+	for (let e of n) {
+		let t = e.table;
+		typeof t == "string" && t.length > 0 && r.add(t);
+	}
+	return [...r];
+}, k = async (e) => {
+	let { store: t, target: n, procedure: r, input: i, output: a } = e;
+	if (n == null) return;
+	let o = Array.isArray(n) ? n : [n];
+	for (let e of o) {
+		let n = e.relations;
+		if (n !== void 0) for (let [o, s] of Object.entries(n)) {
+			let n = s.junction, c = i?.[o];
+			if (c === void 0) continue;
+			if (!Array.isArray(c)) throw Error(`${r}: declared relation '${o}' → '${n}' expects an ARRAY of target ids in input.${o}, got ${typeof c}. Omit the field to leave the links untouched; send [] to clear them.`);
+			let l = a?.id ?? i?.id;
+			if (typeof l != "string" || l.length === 0) throw Error(`${r}: declared relation '${o}' → '${n}' needs the written row's id — neither output.id nor input.id is a string. Return the row (or its id) from the executor.`);
+			let u = t.relationLinks(n, e.table, l), d = u.columns;
+			if (d.anchorColumn !== s.anchorColumn || d.targetColumn !== s.targetColumn) throw Error(`${r}: declared relation '${o}' → '${n}' names columns the junction does not have. Declared { anchorColumn: '${s.anchorColumn}', targetColumn: '${s.targetColumn}' }; '${n}' resolves to { anchorColumn: '${d.anchorColumn}', targetColumn: '${d.targetColumn}' } for anchor table '${e.table}'. The client patches the junction optimistically from THIS declaration, so a wrong pair would show links the write never made — fix the declaration to the pair named here.`);
+			await u.set(c.map((e) => String(e)));
+		}
+	}
+}, A = (e, t) => e === void 0 ? {} : { enqueueOutcome: async (n, r, i) => {
+	let a = e(t);
+	if (a === void 0) throw TypeError("Invocation outcome outbox is unavailable");
+	return a.enqueue(n, r, i);
+} }, j = async (e) => {
+	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
+	try {
+		if (e.interceptor) {
+			let t = d.tryPromise({
+				try: () => e.runExecutor(),
+				catch: (e) => e
+			}), n = e.interceptor(t, {
+				tag: e.name,
+				kind: e.kind,
+				input: e.input,
+				subject: e.requestContext.subject,
+				traceId: e.requestContext.traceId,
+				...e.enqueueOutcome === void 0 ? {} : { enqueueOutcome: e.enqueueOutcome },
+				...e.requestContext.spanId === void 0 ? {} : { spanId: e.requestContext.spanId },
+				...e.target !== void 0 && e.target.length > 0 ? { target: e.target } : {},
+				...D(e.requestContext)
+			}), r = await d.runPromiseExit(n, e.requestContext.signal === void 0 ? void 0 : { signal: e.requestContext.signal });
+			if (f.isSuccess(r)) return r.value;
+			throw u.squash(r.cause);
+		}
+		return await e.runExecutor();
+	} catch (e) {
+		throw r = "error", e;
+	} finally {
+		e.recordMetric?.({
+			kind: "rpc",
+			tag: t,
+			durationMs: Date.now() - n,
+			status: r
+		});
+	}
+}, M = (e) => m(e) || o(e), N = 3, P = (e) => new Promise((t) => setTimeout(t, e)), F = async (e, t) => {
+	let n = t?.delay ?? ((e) => P(e * 20 + Math.floor(Math.random() * 30))), r = t?.attempts ?? 3;
+	for (let t = 1;; t++) try {
+		return await e();
+	} catch (e) {
+		if (t >= r || !M(e)) throw o(e) ? e.conflict : e;
+		await n(t);
+	}
+}, I = (e) => (t, n, r) => j({
+	name: t.descriptor.name,
+	kind: "mutation",
+	input: n,
+	requestContext: r,
+	...A(e.outcomeOutbox, r),
+	target: O(t),
+	...e.interceptor ? { interceptor: e.interceptor } : {},
+	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
+	runExecutor: async () => {
+		let i = Date.now();
+		await C(t.descriptor, r.subject, n, e.defaultDeny), await w(t.descriptor, "mutation", r, n);
+		let o = await E(r), l = e.resolveStore === void 0 ? e.store : await e.resolveStore(o), u = [], f = [], p = await F(async () => l.transactional(async (p) => {
+			u.length = 0, f.length = 0, p[Symbol.for("@voltro/runtime:tx-fold-releases")] = f, p[a] = /* @__PURE__ */ new Map();
+			let m = e.undoCapture?.(p), h = m ? m.tx : p, g = c(h), _ = e.buildContext(o, g.tx, {
+				committedStore: l,
+				afterCommit: (e) => {
+					u.push(e);
+				}
+			}), v = t.executor(n, _), y = d.isEffect(v) ? await e.runEffect(S(v, r.subject), _.store) : await v;
+			if (await k({
+				store: _.store,
+				target: t.descriptor.target,
+				procedure: t.descriptor.name,
+				input: n,
+				output: y
+			}), m && await m.persist(_.store, {
+				tag: t.descriptor.name,
+				subject: r.subject,
+				traceId: r.traceId
+			}), await s({
+				touched: g.drain(),
+				store: _.store,
+				subject: r.subject
+			}), e.beforeMutationCommit !== void 0) {
+				let a = O(t), s = e.beforeMutationCommit({
+					tag: t.descriptor.name,
+					kind: "mutation",
+					input: n,
+					output: y,
+					subject: o.subject,
+					traceId: o.traceId,
+					store: _.store,
+					..._.outbox === void 0 ? {} : { outbox: _.outbox },
+					startedAt: i,
+					durationMs: Math.max(0, Date.now() - i),
+					...o.spanId === void 0 ? {} : { spanId: o.spanId },
+					...a.length > 0 ? { target: a } : {},
+					...D(o)
+				});
+				await e.runEffect(S(s, r.subject), _.store);
+			}
+			return y;
+		}), { ...e.replayAttempts === void 0 ? {} : { attempts: e.replayAttempts } });
+		if (f.length > 0) {
+			let t = e.buildContext(o, l, {
+				committedStore: l,
+				afterCommit: () => {}
+			}).store;
+			for (let e of f.splice(0)) await t.update(e.table, e.pk, e.patch);
+		}
+		for (let e of u) await e();
+		return p;
+	}
+}), L = (e) => (t, n, r, i) => j({
+	name: t.name,
+	kind: "workflow",
+	input: n,
+	requestContext: r,
+	...A(e.outcomeOutbox, r),
+	...e.interceptor ? { interceptor: e.interceptor } : {},
+	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
+	runExecutor: async () => (await C(t, r.subject, n, e.defaultDeny), i())
+}), R = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, z = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, B = (e) => {
+	let t = e.descriptor.source;
+	return t == null ? [] : typeof t == "string" ? [t] : [...t];
+}, V = (e, t, n) => (r) => () => d.runPromise(v(r, e.descriptor.guards, t, {
+	defaultDeny: n === !0,
+	procedure: e.descriptor.name
+})), H = (e, n) => e.rowFilter !== void 0 || t() === void 0 ? n(e) : d.promise(() => E(e)).pipe(d.flatMap((e) => {
+	let t = n(e);
+	return d.isEffect(t) ? t : d.succeed(t);
+})), U = (n) => (r, a) => (o) => {
+	if (o.rowFilter === void 0 && t() !== void 0) return H(o, (e) => U(n)(r, a)(e));
+	let s = n.buildContext(o), c = V(r, a, n.defaultDeny)(o.subject), l = async () => {
+		let e = await c();
+		if (e) throw e;
+		let t = {
+			...o,
+			subject: _(o.subject)
+		}, i = n.buildContext(await E(t)), s = r.executor(a, i), l = d.isEffect(s) ? await b(n.provideEffect(S(s, t.subject), i.store), o.signal === void 0 ? void 0 : { signal: o.signal }) : R(await Promise.resolve(s)), u = await c();
+		if (u) throw u;
+		return l;
+	}, u = (e) => {
+		let t = R(e);
+		if (z(t)) {
+			let e = n.finalize(t, o), i = B(r);
+			if (i.length === 0) return e;
+			let a = e.dependentTables ?? [];
+			return {
+				...e,
+				dependentTables: [.../* @__PURE__ */ new Set([...a, ...i])]
+			};
+		}
+		return {
+			__voltroComputed: !0,
+			value: t,
+			dependentTables: B(r),
+			tenantId: o.subject?.tenantId ?? null,
+			recompute: l
+		};
+	}, f = (e) => {
+		let t = u(e);
+		return i(t) ? d.tryPromise({
+			try: c,
+			catch: (e) => e
+		}).pipe(d.flatMap((e) => e ? d.fail(e) : d.succeed(t))) : t;
+	}, p = (e) => {
+		let t = f(e);
+		return d.isEffect(t) ? t : d.succeed(t);
+	}, m = () => {
+		e(r.descriptor.name, B(r));
+		let t = r.executor(a, s);
+		return d.isEffect(t) ? n.provideEffect(S(t, o.subject), s.store).pipe(d.flatMap(p)) : t instanceof Promise ? d.promise(() => t).pipe(d.flatMap(p)) : f(t);
+	}, h = () => {
+		let e = r.descriptor.guards;
+		return (!e || e.length === 0) && n.defaultDeny !== !0 && o.subject.type !== "service" ? m() : g(o.subject, e, a, {
+			defaultDeny: n.defaultDeny === !0,
+			procedure: r.descriptor.name
+		}).pipe(d.flatMap((e) => {
+			if (e) return d.fail(e);
+			let t = m();
+			return d.isEffect(t) ? t : d.succeed(t);
+		}));
+	};
+	if (!n.interceptor) return h();
+	let v = d.suspend(() => {
+		let e = h();
+		return d.isEffect(e) ? e : d.succeed(e);
+	});
+	return n.interceptor(v, {
+		tag: r.descriptor.name,
+		kind: "query",
+		input: a,
+		subject: o.subject,
+		traceId: o.traceId,
+		...o.spanId === void 0 ? {} : { spanId: o.spanId },
+		...D(o)
+	});
+}, W = (e) => async (t, n, r) => {
+	let a = await E(r), o = U(e)(t, n)(a), s = d.isEffect(o) ? await x(o) : o;
+	if (i(s)) return s.value;
+	let c = e.buildContext(a), l = await e.queryRows(s, a, c.store), u = await V(t, n, e.defaultDeny)(a.subject)();
+	if (u) throw u;
+	return l;
+}, G = (e) => (t, r, a, o) => {
+	let s = !1, c;
+	return (async () => {
+		try {
+			let l = await E(a), u = U(e)(t, r)(l), f = d.isEffect(u) ? await x(u) : u, p = (e) => o(e), m = i(f) ? await e.subscribeComputed(f, p, l) : await e.subscribeDescriptor(f, p, l, V(t, r, e.defaultDeny)(l.subject), n(l.subject));
+			s ? m() : c = m;
+		} catch (e) {
+			o({
+				_tag: "error",
+				error: e instanceof Error ? {
+					message: e.message,
+					..."_tag" in e ? { _tag: e._tag } : {}
+				} : e
+			});
+		}
+	})(), () => {
+		s = !0, c?.();
+	};
+}, K = (t) => (n, r, i) => j({
+	name: n.descriptor.name,
+	kind: "action",
+	input: r,
+	requestContext: i,
+	...A(t.outcomeOutbox, i),
+	target: O(n),
+	...t.interceptor ? { interceptor: t.interceptor } : {},
+	...t.recordMetric ? { recordMetric: t.recordMetric } : {},
+	runExecutor: async () => {
+		await C(n.descriptor, i.subject, r, t.defaultDeny), await w(n.descriptor, "action", i, r);
+		let a = t.buildContext(await E(i));
+		e(n.descriptor.name, B(n));
+		let o = n.executor(r, a);
+		return d.isEffect(o) ? t.runEffect(S(o, i.subject), a.store) : o;
+	}
+});
+//#endregion
+export { N as DEFAULT_MUTATION_REPLAY_ATTEMPTS, k as applyDeclaredRelations, K as makeActionRunner, I as makeMutationRunner, W as makeOneShotQueryRunner, U as makeQueryDescriptorProducer, V as makeQueryReauthorizer, G as makeQuerySubscriber, L as makeWorkflowStartRunner, x as runProvidedEffect, F as runWithDeadlockRetry, E as withRowFilter, H as withScopedRequest };

package/dist/serverOnlyAudit.js

@@ -0,0 +1,66 @@
+import { SchemaAST as e } from "effect";
+//#region src/serverOnlyAudit.ts
+var t = (t) => {
+	let n = /* @__PURE__ */ new Set(), r = /* @__PURE__ */ new Set(), i = (t) => {
+		if (!r.has(t)) switch (r.add(t), t.encoding !== void 0 && i(e.toEncoded(t)), t._tag) {
+			case "Objects":
+				for (let e of t.propertySignatures) typeof e.name == "string" && n.add(e.name), i(e.type);
+				for (let e of t.indexSignatures) i(e.type);
+				break;
+			case "Arrays":
+				for (let e of t.elements) i(e);
+				for (let e of t.rest) i(e);
+				break;
+			case "Union":
+				for (let e of t.types) i(e);
+				break;
+			case "Suspend": i(t.thunk());
+		}
+	};
+	return i(t.ast), n;
+}, n = (t) => {
+	let n = /* @__PURE__ */ new Set(), r = /* @__PURE__ */ new Set(), i = (t) => {
+		if (t.encoding !== void 0) return i(e.toEncoded(t));
+		switch (t._tag) {
+			case "Null": return !0;
+			case "Literal": return t.literal === null;
+			case "Union": return t.types.length > 0 && t.types.every(i);
+			case "Suspend": return i(t.thunk());
+			default: return !1;
+		}
+	}, a = (t) => {
+		if (!r.has(t)) switch (r.add(t), t.encoding !== void 0 && a(e.toEncoded(t)), t._tag) {
+			case "Objects":
+				for (let e of t.propertySignatures) typeof e.name == "string" && i(e.type) && n.add(e.name), a(e.type);
+				break;
+			case "Arrays":
+				for (let e of t.elements) a(e);
+				for (let e of t.rest) a(e);
+				break;
+			case "Union":
+				for (let e of t.types) a(e);
+				break;
+			case "Suspend": a(t.thunk());
+		}
+	};
+	return a(t.ast), n;
+}, r = (e, r) => {
+	let i = e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source];
+	if (i.length === 0) return [];
+	let a = t(e.output), o = n(e.output), s = [];
+	for (let t of i) for (let n of r.get(t) ?? []) a.has(n) && !o.has(n) && s.push({
+		query: e.name,
+		table: t,
+		column: n
+	});
+	return s;
+}, i = (e) => {
+	if (e.length !== 0) return `A wire-reachable query exposes a server-only column:\n${e.map((e) => `  • query '${e.query}' output declares '${e.column}' — a .serverOnly() column of '${e.table}'`).join("\n")}\nThree ways out, in order of preference:\n  1. Omit the column from the query's output schema. The crud.* read helpers strip these automatically.\n  2. Keep the KEY but type it \`Schema.Null\` — for a view that must stay wire-compatible (an importer that breaks if the key vanishes) while never sending a value. The audit accepts that, because the schema then PROVES no value can flow instead of promising it. Pair it with a \`hasX\` boolean.\n  3. Drop the .serverOnly() marker, if the column may in fact reach a client.\nNote the audit reads the DECLARED shape, not what your handler emits: a field typed \`string\` that you always set to null still fails, and should — the next edit to that handler is one line away from sending it.`;
+}, a = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
+	query: e.name,
+	table: t
+})) : [], o = (e) => {
+	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
+};
+//#endregion
+export { a as cacheScopeLeaks, o as formatCacheScopeLeaks, i as formatServerOnlyLeaks, t as schemaPropertyNames, r as serverOnlyLeaks };

package/dist/serverTracer.js

@@ -0,0 +1,15 @@
+import { Effect as e, Layer as t } from "effect";
+//#region src/serverTracer.ts
+var n = Symbol.for("@voltro/runtime:serverTracer"), r = (() => {
+	let e = globalThis;
+	return e[n] ??= {};
+})(), i = (e) => {
+	e === void 0 ? delete r.tracer : r.tracer = e;
+}, a = () => r.tracer, o = t.effectDiscard(e.flatMap(e.tracer, (t) => e.sync(() => {
+	i(t);
+}))), s = (t) => {
+	let n = r.tracer;
+	return n === void 0 ? t : e.withTracer(t, n);
+};
+//#endregion
+export { o as publishServerTracerLayer, a as serverTracer, i as setServerTracer, s as withServerTracer };

package/dist/serviceCredentials.js

@@ -0,0 +1,40 @@
+import { createHash as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+import { SERVICE_NAME_PATTERN as r, serviceSubject as i } from "@voltro/protocol";
+//#region src/serviceCredentials.ts
+var a = "vsvc_", o = /^vsvc_[A-Za-z0-9_-]{43}$/, s = () => `${a}${t(32).toString("base64url")}`, c = (e) => o.test(e), l = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/-/g, "_").toUpperCase(), u = (e) => `VOLTRO_SERVICE_CALLER_${l(e)}_TOKEN`, d = (e) => `${u(e)}_NEXT`, f = (e) => `VOLTRO_API_${l(e)}_TOKEN`, p = (e) => `VOLTRO_API_${l(e)}_URL`, m = (e) => {
+	for (let t of Object.keys(e)) if (!r.test(t)) throw Error(`serviceCallers: ${JSON.stringify(t)} is not an app name — letters, digits and dashes, starting with a letter, at most 56 characters. It is the name the calling app binds this api under and the name its procedures list in \`service: { callers }\`.`);
+}, h = (t) => e("sha256").update(t).digest(), g = (e, t) => n(e, h(t)), _ = (e, t) => [e[u(t)], e[d(t)]].filter((e) => typeof e == "string" && e !== ""), v = (e) => {
+	m(e.callers);
+	let t = Object.keys(e.callers), n = e.env ?? (() => process.env);
+	return {
+		id: "voltro-service",
+		claimsBearerPrefix: a,
+		verifyConfig: () => {
+			let e = n(), r = [], i = [];
+			for (let n of t) {
+				let t = _(e, n);
+				t.length === 0 && r.push(u(n));
+				for (let [e, r] of t.entries()) c(r) || i.push(e === 0 ? u(n) : d(n));
+			}
+			if (r.length > 0) throw Error(`serviceCallers: no token for ${r.join(", ")}. Every app listed in \`serviceCallers\` needs the credential it presents. \`voltro dev\` mints one per caller into both apps' \`.env.local\`; in production set the variable to the same value as the caller's \`VOLTRO_API_<NAME>_TOKEN\` (\`voltro secret generate service\` prints a fresh one).`);
+			if (i.length > 0) throw Error(`serviceCallers: ${i.join(", ")} ${i.length === 1 ? "is" : "are"} not a service token (\`${a}\` followed by 43 base64url characters). Generate one with \`voltro secret generate service\` rather than choosing a value by hand.`);
+		},
+		resolve: (e) => {
+			let r = e.headers.authorization ?? e.headers.Authorization;
+			if (r === void 0) return { kind: "skip" };
+			let a = /^Bearer\s+(\S+)$/i.exec(r)?.[1];
+			if (a === void 0 || !a.startsWith("vsvc_")) return { kind: "skip" };
+			let o = h(a), s = n(), c;
+			for (let e of t) for (let t of _(s, e)) g(o, t) && c === void 0 && (c = e);
+			return c === void 0 ? {
+				kind: "failed",
+				reason: "service credential matches no caller in `serviceCallers`"
+			} : {
+				kind: "matched",
+				subject: i(c)
+			};
+		}
+	};
+};
+//#endregion
+export { a as SERVICE_TOKEN_PREFIX, f as apiBindingTokenEnv, p as apiBindingUrlEnv, m as assertServiceCallersConfig, c as isWellFormedServiceToken, s as mintServiceToken, d as serviceCallerNextTokenEnv, v as serviceCallerStrategy, u as serviceCallerTokenEnv, l as serviceEnvSegment };

package/dist/singleNodeOrchestrator.js

@@ -0,0 +1,91 @@
+import { pruneWakeups as e } from "./wakeRegistry.js";
+import { wakeDueOnce as t } from "./wakeOrchestrator.js";
+import { makeProcessAdapter as n } from "./wakeSupervisor.js";
+import { isIdleNow as r, makeIdleGate as i } from "./idleDetector.js";
+import { makeRouterActivity as a, makeWakeProxyServer as o } from "./wakeRouter.js";
+//#region src/singleNodeOrchestrator.ts
+var s = async (e) => {
+	try {
+		return (await e.query({
+			table: "_voltro_workflow_runs",
+			predicate: {
+				column: "status",
+				op: "eq",
+				value: "running"
+			},
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: ["id"]
+		})).length;
+	} catch {
+		return 0;
+	}
+}, c = async (e) => {
+	let i = n(e.supervisor), a = await t({
+		store: e.store,
+		adapter: i,
+		...e.now === void 0 ? {} : { now: e.now },
+		...e.log === void 0 ? {} : { log: e.log }
+	});
+	a > 0 && e.idleGate.reset();
+	let o = await r({
+		store: e.store,
+		signals: e.signals,
+		...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
+		...e.now === void 0 ? {} : { now: e.now }
+	}), s = !1;
+	return e.idleGate.update(o) && e.supervisor.isRunning() && (e.log?.info("orchestrator: idle grace elapsed — scaling app to zero"), await e.supervisor.stop(), e.idleGate.reset(), s = !0), {
+		woke: a,
+		stopped: s
+	};
+}, l = async (t) => {
+	let n = i(t.idleGraceMs ?? 6e4), r = t.tickMs ?? 1e3, l = a(), u = 0, d = t.signals === void 0, f = t.signals ?? {
+		connectedClients: () => l.openConnections(),
+		inFlightRequests: () => l.inFlightRequests(),
+		activeWorkflowExecutions: () => u
+	}, p = o({
+		supervisor: t.supervisor,
+		targetHost: t.targetHost,
+		targetPort: t.targetPort,
+		onActivity: () => {
+			n.reset();
+		},
+		activity: l,
+		...t.log === void 0 ? {} : { log: t.log }
+	}), m = await new Promise((e, n) => {
+		p.once("error", n), p.listen(t.publicPort, t.publicHost ?? "0.0.0.0", () => {
+			let n = p.address();
+			e(typeof n == "object" && n ? n.port : t.publicPort);
+		});
+	});
+	t.log?.info("orchestrator: router listening", { port: m });
+	let h = !1, g, _ = t.firedRetentionMs ?? 6e5, v = 0, y = async () => {
+		if (!h) {
+			try {
+				if (d && (u = await s(t.store)), await c({
+					store: t.store,
+					supervisor: t.supervisor,
+					signals: f,
+					idleGate: n,
+					...t.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: t.wakeLookaheadMs },
+					...t.log === void 0 ? {} : { log: t.log }
+				}), v++ % 60 == 0) {
+					let n = await e(t.store, { firedOlderThan: new Date(Date.now() - _) });
+					n > 0 && t.log?.info("orchestrator: pruned fired wakeups", { count: n });
+				}
+			} catch (e) {
+				t.log?.warn("orchestrator: tick failed", { reason: e instanceof Error ? e.message : String(e) });
+			}
+			h || (g = setTimeout(() => void y(), r));
+		}
+	};
+	return y(), {
+		port: m,
+		stop: async () => {
+			h = !0, g !== void 0 && clearTimeout(g), await new Promise((e) => p.close(() => e()));
+		}
+	};
+};
+//#endregion
+export { s as countRunningWorkflows, c as runOrchestratorTick, l as runSingleNodeOrchestrator };