@voltro/runtime 0.84.0 → 0.86.0

package/dist/bindEvent.js

@@ -0,0 +1,72 @@
+import { recordEventDelivered as e, recordEventDropped as t } from "./metrics.js";
+import { registerConnectionStream as n } from "./connectionCredentials.js";
+import { boundByCredential as r } from "./credentialBound.js";
+import { Effect as i, Queue as a, Stream as o } from "effect";
+import { ConnectionInfo as s, SubjectService as c, checkGuardsEffect as l, isOpenAccess as u, recheckGuardsEffect as d } from "@voltro/protocol";
+//#region src/bindEvent.ts
+var f = 64, p = 1, m = (e) => e.kind === "gap" ? {
+	_tag: "gap",
+	missed: e.missed,
+	reason: e.reason
+} : {
+	_tag: "event",
+	origin: e.envelope.origin,
+	n: e.envelope.n,
+	emittedAt: e.envelope.emittedAt,
+	payload: e.envelope.payload
+}, h = (e) => {
+	let t = new Map(e ?? []);
+	return (e, n = 0) => {
+		let r = t.get(e.origin) ?? 0;
+		return t.set(e.origin, Math.max(r, e.n)), r === 0 && n === 0 ? 0 : Math.max(0, e.n - r - 1);
+	};
+}, g = (f) => o.unwrap(i.gen(function* () {
+	let p = yield* c, g = yield* s, _ = p.tenantId ?? null, v = f.guards === void 0 ? void 0 : f.guards.filter((e) => !u(e));
+	if (v !== void 0 && v.length > 0 || p.type === "service") {
+		let e = yield* l(p, v ?? [], f.key);
+		if (e) return yield* i.fail(e);
+	}
+	let y = f.bus.deliveryFor(f.event) === "latest", b = yield* a.sliding(f.queueSize ?? (y ? 1 : 64)), x = /* @__PURE__ */ new Map(), S = f.bus.subscribe({
+		tenantId: _,
+		event: f.event,
+		key: f.key,
+		options: f.options,
+		onAttach: (e) => {
+			x = e;
+		},
+		listener: (e) => {
+			i.runSync(a.offer(b, e));
+		}
+	});
+	if (yield* i.addFinalizer(() => i.sync(() => {
+		S();
+	})), g.clientId !== void 0) {
+		let e = n(g.clientId, () => {
+			i.runPromise(a.shutdown(b));
+		});
+		yield* i.addFinalizer(() => i.sync(() => {
+			e();
+		}));
+	}
+	let C = y ? () => 0 : h(x), w = () => d(p, v, f.key), T = o.fromQueue(b).pipe(o.flatMap((e) => o.unwrap(w().pipe(i.map((t) => t ? o.fail(t) : E(e))))));
+	function E(n) {
+		return o.suspend(() => {
+			if (n.kind === "gap") return o.make(m(n));
+			let r = C(n.envelope, n.prior);
+			e(f.event);
+			let i = m(n);
+			if (r === 0) return o.make(i);
+			t(f.event, "buffer", r);
+			let a = {
+				_tag: "gap",
+				missed: r,
+				reason: "buffer"
+			};
+			return o.fromIterable([a, i]);
+		});
+	}
+	let D = { _tag: "attached" };
+	return r(o.concat(o.fromIterable([D]), T), g.credentialExpiresAt, o.fromIterable([D]));
+}));
+//#endregion
+export { f as EVENT_CLIENT_QUEUE_SIZE, p as EVENT_LATEST_QUEUE_SIZE, g as bindEvent, h as makeBufferGapDetector };

package/dist/bootListener.js

@@ -0,0 +1,76 @@
+import { answerProbe as e, probeFor as t, resolveHealth as n } from "./healthProbes.js";
+import { createServer as r } from "node:http";
+//#region src/bootListener.ts
+var i = "no-store", a = "1", o = /* @__PURE__ */ new Set(["ready", "draining"]), s = async (s) => {
+	let c = s.now ?? Date.now, l = {
+		phase: "booting",
+		startedAt: c()
+	}, u, d, f = () => l.phase === "ready", p = () => o.has(l.phase), m = n(s.health, () => f()), h = s.health?.readiness === void 0 ? async () => f() && (d === void 0 || await d()) : m.readiness, g = {
+		...m,
+		readiness: h
+	}, _ = () => ({
+		phase: l.phase,
+		ready: f(),
+		elapsedMs: c() - l.startedAt,
+		...l.tablesTotal === void 0 ? {} : { tablesTotal: l.tablesTotal },
+		...l.error === void 0 ? {} : { error: l.error }
+	}), v = r((n, r) => {
+		let o = n.url ?? "/", s = o.indexOf("?"), c = s === -1 ? o : o.slice(0, s), l = t(g, c);
+		l === void 0 ? u !== void 0 && p() ? u.request(n, r) : (r.writeHead(503, {
+			"content-type": "text/plain",
+			"cache-control": i,
+			"retry-after": a
+		}), r.end("starting")) : e(g, l, _).then((e) => {
+			r.writeHead(e.status, {
+				"content-type": e.contentType,
+				"cache-control": i
+			}), r.end(e.body);
+		});
+	});
+	v.on("upgrade", (e, t, n) => {
+		u !== void 0 && p() ? u.upgrade(e, t, n) : t.end(`HTTP/1.1 503 Service Unavailable\r
+Retry-After: ${a}\r\nCache-Control: no-store\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+	}), await new Promise((e, t) => {
+		let n = (e) => {
+			t(e);
+		};
+		v.once("error", n), v.listen(s.host === void 0 ? { port: s.port } : {
+			port: s.port,
+			host: s.host
+		}, () => {
+			v.removeListener("error", n), e();
+		});
+	});
+	let y = v.address()?.port ?? s.port;
+	return s.log?.info("listening early — probes answer on the app port from here on", { port: y }), {
+		server: v,
+		port: y,
+		get state() {
+			return l;
+		},
+		set: (e) => {
+			l = {
+				...l,
+				...e
+			};
+		},
+		isReady: f,
+		delegate: (e) => {
+			u = e;
+		},
+		setDependencyPing: (e) => {
+			d = e;
+		},
+		close: () => new Promise((e) => {
+			v.listening ? (v.closeAllConnections(), v.close(() => {
+				e();
+			})) : e();
+		})
+	};
+};
+//#endregion
+export { s as bindBootListener };

package/dist/bootRefusal.js

@@ -0,0 +1,7 @@
+//#region src/bootRefusal.ts
+var e = "VoltroBootRefusal", t = (t) => {
+	let n = Error(t);
+	return n.name = e, n;
+}, n = (e) => typeof e == "object" && !!e && e.name === "VoltroBootRefusal";
+//#endregion
+export { e as BOOT_REFUSAL_NAME, t as bootRefusal, n as isBootRefusal };

package/dist/bootStoreCodec.js

@@ -0,0 +1,70 @@
+import { getFieldCipher as e } from "./fieldCipher.js";
+import { upsertDestinationId as t } from "./upsertBinding.js";
+import { decryptFieldsOnRead as n, deserializeArraysOnRead as r, encryptFieldsForWrite as i, encryptFieldsForWriteBatch as a, encryptedColumnsOf as o, getTable as s, jsonPatchAssignments as c, serializeArraysForWrite as l, upsertUpdateValues as u } from "@voltro/database";
+import { createLogger as d } from "@voltro/logger";
+//#region src/bootStoreCodec.ts
+var f = d({ scope: "store.fieldEncryption" }), p = (d, m) => {
+	let h = m, g = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", _ = /* @__PURE__ */ new Set(), v = (e) => {
+		let t = `${e.table}.${e.column}`;
+		_.has(t) || (_.add(t), f.warn("encrypted column degraded to null — could not decrypt with the active key", {
+			table: e.table,
+			column: e.column,
+			reason: e.reason,
+			hint: "VOLTRO_FIELD_DECRYPT_ON_ERROR=null is set — this row was likely encrypted under a different key"
+		}));
+	}, y = (t, n, r) => {
+		let a = s(t), o = h ? l(n, a, h) : n;
+		return i(o, a, e(), r);
+	}, b = (t, i, a) => {
+		let o = s(t), c = n(i, o, e(), {
+			onError: g,
+			...g === "null" ? { warn: v } : {},
+			...a === void 0 ? {} : { rowId: a }
+		});
+		return h ? r(c, o, h) : c;
+	}, x = (e, t, n) => t === null ? null : b(e, [t], n)[0];
+	return {
+		delete: (e, t) => d.delete(e, t),
+		deleteMany: (e, t) => d.deleteMany(e, t),
+		onChange: (e) => d.onChange(e),
+		injectExternalChange: (e) => {
+			d.injectExternalChange(e);
+		},
+		...d.changeScope === void 0 ? {} : { changeScope: d.changeScope },
+		...d.withNamespace === void 0 ? {} : { withNamespace: (e) => p(d.withNamespace(e), m) },
+		...d.raw === void 0 ? {} : { raw: ((...e) => d.raw(...e)) },
+		...d.close === void 0 ? {} : { close: (e) => d.close(e) },
+		...d.ping === void 0 ? {} : { ping: () => d.ping() },
+		query: async (e) => b(e.table, await d.query(e)),
+		insert: async (e, t) => x(e, await d.insert(e, y(e, t))),
+		insertMany: async (t, n) => {
+			let r = s(t), i = h ? n.map((e) => l(e, r, h)) : n, o = a(i, r, e());
+			return b(t, await d.insertMany(t, o));
+		},
+		update: async (e, t, n) => x(e, await d.update(e, t, y(e, n, t)), t),
+		updateMany: async (e, t, n) => {
+			let r = s(e), i = (r === void 0 ? [] : o(r)).filter((e) => t[e] !== void 0 && t[e] !== null);
+			if (i.length > 0) throw Error(`updateMany on the boot store cannot write the .encrypted() column(s) ${i.join(", ")} on "${e}": an encrypted value is bound to its row and a set-based write has no row. Write them through the request-scoped store, or key the write with update(table, id, patch).`);
+			return d.updateMany(e, y(e, t), n);
+		},
+		upsert: async (e, n, r) => {
+			let i = u(r), a = await t(d, e, n, r.conflictColumns);
+			return x(e, await d.upsert(e, y(e, n, a), {
+				...r,
+				...r.updateValues === void 0 ? {} : { updateValues: y(e, i, a) }
+			}), a);
+		},
+		insertIgnore: async (e, t, n) => x(e, await d.insertIgnore(e, y(e, t), n)),
+		insertIgnoreWithOutcome: async (e, t, n) => {
+			let r = await d.insertIgnoreWithOutcome(e, y(e, t), n);
+			return {
+				row: x(e, r.row),
+				outcome: r.outcome
+			};
+		},
+		patchJson: async (e, t, n, r, i) => x(e, await d.patchJson(e, t, n, r, y(e, c(t, n, i), t)), t),
+		transactional: (e) => d.transactional((t) => e(p(t, m)))
+	};
+};
+//#endregion
+export { p as wrapStoreWithBootCodec };

package/dist/businessRules.js

@@ -0,0 +1,67 @@
+import { getTable as e } from "@voltro/database";
+import { BusinessRuleViolation as t } from "@voltro/protocol";
+import { log as n } from "@voltro/logger";
+//#region src/businessRules.ts
+var r = (e) => e.startsWith("_voltro"), i = (e) => {
+	let t = e?.id;
+	return typeof t == "string" ? t : void 0;
+}, a = (e) => {
+	let t = /* @__PURE__ */ new Map(), n = (e, n) => {
+		if (n == null || r(e)) return;
+		let a = i(n);
+		a !== void 0 && t.set(`${e}\u0000${a}`, {
+			table: e,
+			id: a,
+			row: n
+		});
+	};
+	return {
+		tx: new Proxy(e, { get(e, t, r) {
+			if (t === "insert") return async (t, r) => {
+				let i = await e.insert.call(e, t, r);
+				return n(t, i), i;
+			};
+			if (t === "update") return async (t, r, i) => {
+				let a = await e.update.call(e, t, r, i);
+				return n(t, a ?? {
+					...i,
+					id: r
+				}), a;
+			};
+			let i = Reflect.get(e, t, r);
+			return typeof i == "function" ? i.bind(e) : i;
+		} }),
+		drain: () => [...t.values()]
+	};
+}, o = (e) => {
+	if (e !== !0 && e !== void 0) return e === !1 ? {} : e;
+}, s = async (r) => {
+	if (r.touched.length === 0) return;
+	let i = {
+		store: r.store,
+		subject: r.subject
+	};
+	for (let { table: a, row: s } of r.touched) {
+		let r = e(a)?.appliedRules;
+		if (r !== void 0 && r.length !== 0) for (let e of r) {
+			let r = o(await e.predicate(s, i));
+			if (r !== void 0) {
+				if (e.severity === "warning") n.warn("business rule violated (warning)", {
+					rule: e.name,
+					table: a,
+					...r.field === void 0 ? {} : { field: r.field },
+					...r.params === void 0 ? {} : { params: r.params }
+				});
+				else throw new t({
+					rule: e.name,
+					severity: "error",
+					...r.params === void 0 ? {} : { params: r.params },
+					...r.field === void 0 ? {} : { field: r.field },
+					...r.message === void 0 ? {} : { message: r.message }
+				});
+			}
+		}
+	}
+};
+//#endregion
+export { s as evaluateTouchedRules, a as makeRuleCapture };

package/dist/changeClaimsTable.js

@@ -0,0 +1,12 @@
+import { id as e, integer as t, table as n, text as r, timestamp as i } from "@voltro/database";
+//#region src/changeClaimsTable.ts
+var a = n("_voltro_change_claims", {
+	id: e({ prefix: "chclaim" }),
+	scope: r(),
+	key: r(),
+	claimedBy: r(),
+	claimedAt: i(),
+	nextSlot: t().default(0)
+}).unique(["scope", "key"]).index(["claimedAt"]);
+//#endregion
+export { a as _voltroChangeClaimsTable };

package/dist/circuitBreaker.js

@@ -0,0 +1,72 @@
+import { Cause as e, Clock as t, Duration as n, Effect as r, Ref as i, Schema as a } from "effect";
+//#region src/circuitBreaker.ts
+var o = class extends a.TaggedError()("CircuitOpen", {
+	name: a.String,
+	retryAfterMs: a.Number
+}) {}, s = {
+	tag: "closed",
+	failureCount: 0,
+	halfOpenSuccesses: 0,
+	openedAt: 0
+}, c = { make: (a) => r.gen(function* () {
+	let c = a.name ?? "circuit", l = n.toMillis(n.fromInputUnsafe(a.resetTimeout)), u = a.halfOpenSuccessThreshold ?? 1, d = a.isFailure ?? (() => !0), f = yield* i.make(s), p = r.gen(function* () {
+		let e = yield* i.get(f);
+		if (e.tag === "half-open") {
+			let t = e.halfOpenSuccesses + 1;
+			yield* i.set(f, t >= u ? s : {
+				...e,
+				halfOpenSuccesses: t
+			});
+		} else e.failureCount !== 0 && (yield* i.set(f, s));
+	}), m = r.gen(function* () {
+		let e = yield* t.currentTimeMillis, n = yield* i.get(f);
+		if (n.tag === "half-open" || n.tag === "open") {
+			yield* i.set(f, {
+				tag: "open",
+				failureCount: a.failureThreshold,
+				halfOpenSuccesses: 0,
+				openedAt: e
+			});
+			return;
+		}
+		let r = n.failureCount + 1;
+		yield* i.set(f, r >= a.failureThreshold ? {
+			tag: "open",
+			failureCount: r,
+			halfOpenSuccesses: 0,
+			openedAt: e
+		} : {
+			...n,
+			failureCount: r
+		});
+	}), h = r.gen(function* () {
+		let e = yield* i.get(f);
+		if (e.tag !== "open") return null;
+		let n = (yield* t.currentTimeMillis) - e.openedAt;
+		return n >= l ? (yield* i.set(f, {
+			tag: "half-open",
+			failureCount: 0,
+			halfOpenSuccesses: 0,
+			openedAt: e.openedAt
+		}), null) : l - n;
+	}), g = (t) => r.gen(function* () {
+		let n = yield* h;
+		return n === null ? yield* t.pipe(r.tap(() => p), r.tapCause((t) => {
+			if (e.hasInterruptsOnly(t)) return r.void;
+			let n = e.findErrorOption(t), i = n._tag === "Some" ? n.value : void 0;
+			return d(i) ? m : r.void;
+		})) : yield* r.fail(new o({
+			name: c,
+			retryAfterMs: n
+		}));
+	}), _ = ((e) => g(e));
+	return Object.defineProperty(_, "state", {
+		value: i.get(f).pipe(r.map((e) => e.tag)),
+		enumerable: !0
+	}), Object.defineProperty(_, "reset", {
+		value: i.set(f, s),
+		enumerable: !0
+	}), _;
+}) };
+//#endregion
+export { c as CircuitBreaker, o as CircuitOpen };

package/dist/columnOnUpdate.js

@@ -0,0 +1,23 @@
+//#region src/columnOnUpdate.ts
+var e = (e) => {
+	if (!(e.length < 32 || Object.getPrototypeOf(e) !== Array.prototype || Object.getOwnPropertySymbols(e).length > 0 || Object.hasOwn(e, "includes"))) {
+		for (let t = 0; t < e.length; t++) {
+			let n = Object.getOwnPropertyDescriptor(e, String(t));
+			if (n === void 0 || !("value" in n) || typeof n.value != "string") return;
+		}
+		return new Set(e);
+	}
+}, t = (t, n, r, i = []) => {
+	let a = t.tables.get(n)?.onUpdateFields;
+	if (a === void 0 || a.size === 0) return r;
+	let o = { ...r }, s = a.size >= 32 ? e(i) : void 0;
+	for (let [e, t] of a) {
+		if (o[e] !== void 0 || (s?.has(e) ?? i.includes(e))) continue;
+		t !== "now" && (s = void 0);
+		let n = t === "now" ? /* @__PURE__ */ new Date() : t();
+		n === void 0 ? delete o[e] : o[e] = n;
+	}
+	return o;
+};
+//#endregion
+export { t as applyColumnOnUpdate };

package/dist/composeAnalytics.js

@@ -0,0 +1,108 @@
+import { AnalyticsCapabilityNotSupported as e } from "./analyticsSink.js";
+import { Effect as t } from "effect";
+//#region src/composeAnalytics.ts
+var n = "noop", r = () => {
+	let r = (r) => t.fail(new e({
+		provider: n,
+		capability: r
+	}));
+	return {
+		info: {
+			provider: n,
+			capabilities: {
+				track: !0,
+				aggregate: !1,
+				timeseries: !1,
+				topN: !1,
+				mirror: !1
+			}
+		},
+		track: () => t.void,
+		aggregate: () => r("aggregate"),
+		timeseries: () => r("timeseries"),
+		topN: () => r("topN")
+	};
+}, i = (n) => {
+	if (n.length === 0) return r();
+	if (n.length === 1) return n[0];
+	let i = {
+		provider: "compose",
+		capabilities: {
+			track: n.some((e) => e.info.capabilities.track),
+			aggregate: n.some((e) => e.info.capabilities.aggregate),
+			timeseries: n.some((e) => e.info.capabilities.timeseries),
+			topN: n.some((e) => e.info.capabilities.topN),
+			mirror: n.some((e) => e.info.capabilities.mirror)
+		},
+		detail: { members: n.map((e) => e.info) }
+	}, a = (e) => t.forEach(n, (n) => n.track(e).pipe(t.catch((e) => t.logWarning(`analytics-sink ${n.info.provider} track failed`, { err: e }))), {
+		concurrency: "unbounded",
+		discard: !0
+	}), o = (r, i) => {
+		let a = n.find((e) => e.info.capabilities[r]);
+		return a === void 0 ? t.fail(new e({
+			provider: "compose",
+			capability: r
+		})) : i(a);
+	}, s = n.filter((e) => e.mirror !== void 0), c = s.every((e) => {
+		let t = Object.getOwnPropertyDescriptor(e, "mirror");
+		if (t === void 0 || !("value" in t)) return !1;
+		let n = Object.getOwnPropertyDescriptor(t.value, "tables");
+		if (n === void 0 || !("value" in n)) return !1;
+		let r = n.value;
+		if (!Array.isArray(r) || Object.getPrototypeOf(r) !== Array.prototype || r.includes !== Array.prototype.includes || r[Symbol.iterator] !== Array.prototype[Symbol.iterator]) return !1;
+		for (let e = 0; e < r.length; e++) {
+			let t = Object.getOwnPropertyDescriptor(r, String(e));
+			if (t === void 0 || !("value" in t) || typeof t.value != "string") return !1;
+		}
+		return !0;
+	}), l = /* @__PURE__ */ new Map();
+	for (let e of c ? s : []) for (let t of new Set(e.mirror.tables)) {
+		let n = l.get(t);
+		n === void 0 ? l.set(t, [e]) : n.push(e);
+	}
+	let u = (e) => c ? l.get(e) ?? [] : s.filter((t) => t.mirror.tables.includes(e)), d = s.length === 0 ? void 0 : {
+		tables: Array.from(new Set(s.flatMap((e) => e.mirror.tables))),
+		upsert: (e) => t.forEach(u(e.table), (t) => t.mirror.upsert(e), {
+			concurrency: "unbounded",
+			discard: !0
+		}),
+		remove: (e) => t.forEach(u(e.table), (t) => t.mirror.remove(e), {
+			concurrency: "unbounded",
+			discard: !0
+		}),
+		maxVersion: (e) => t.forEach(u(e.table), (t) => t.mirror.maxVersion(e), { concurrency: "unbounded" }).pipe(t.map((e) => {
+			let t = null;
+			for (let n of e) n !== null && (t = Math.max(t ?? -Infinity, n));
+			return t;
+		}))
+	};
+	return {
+		info: i,
+		track: a,
+		aggregate: (e) => o("aggregate", (t) => t.aggregate(e)),
+		timeseries: (e) => o("timeseries", (t) => t.timeseries(e)),
+		topN: (e) => o("topN", (t) => t.topN(e)),
+		...d === void 0 ? {} : { mirror: d }
+	};
+}, a = (e) => {
+	let n = e.filter((e) => e.dispose !== void 0);
+	return {
+		kind: "compose",
+		build: (t) => i(e.map((e) => e.build(t))),
+		tables: e.flatMap((e) => e.tables ?? []),
+		initialize: (n) => t.forEach(e, (e) => e.initialize ? e.initialize(n) : t.void, {
+			concurrency: 1,
+			discard: !0
+		}),
+		...n.length > 0 ? { dispose: (e) => t.forEach(n, (t) => t.dispose(e), {
+			concurrency: 1,
+			discard: !0
+		}) } : {}
+	};
+}, o = {
+	kind: "noop",
+	build: () => r()
+};
+//#endregion
+export { n as NOOP_ANALYTICS_PROVIDER, a as composeAnalytics, i as composeAnalyticsSinks, r as noopAnalytics, o as noopAnalyticsSpec };

package/dist/computedQuery.js

@@ -0,0 +1,4 @@
+//#region src/computedQuery.ts
+var e = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0;
+//#endregion
+export { e as isComputedQuery };

package/dist/connectionBuiltins.js

@@ -0,0 +1,81 @@
+import { beginOAuthConnect as e, forgetCredential as t, listConnectionStates as n, storeCredential as r } from "./connectionVault.js";
+import { ConnectionHandshakeFailed as i, ConnectionKindMismatch as a, ConnectionNotDeclared as o, ConnectionSubjectRequired as s } from "@voltro/protocol";
+//#region src/connectionBuiltins.ts
+var c = (e, t) => {
+	let n = e.request?.subject?.id ?? null;
+	if (n === null || n === "") throw new s({ connectionId: t });
+	return n;
+}, l = (e, t) => {
+	let n = e.registry.get(t);
+	if (n === void 0) throw new o({ connectionId: t });
+	return n;
+}, u = (e) => async (t, r) => {
+	let i = r.request?.subject?.id ?? null;
+	return i === null || i === "" ? e.registry.list().map((e) => ({
+		connectionId: e.id,
+		kind: e.kind,
+		label: e.label ?? e.id,
+		status: "disconnected",
+		accountId: null,
+		accountLabel: null,
+		scopes: [],
+		expiresAt: null,
+		lastError: null,
+		connectedAt: null
+	})) : n(r.store, e.registry, i);
+}, d = (t) => async (n, r) => {
+	let i = l(t, n.connectionId), o = c(r, n.connectionId);
+	if (i.kind !== "oauth2") throw new a({
+		connectionId: n.connectionId,
+		expected: "oauth2",
+		actual: i.kind
+	});
+	return e({
+		store: r.store,
+		definition: i,
+		subjectId: o,
+		tenantId: r.request?.subject?.tenantId ?? null,
+		publicUrl: t.publicUrl,
+		...n.redirectTo === void 0 ? {} : { redirectTo: n.redirectTo }
+	});
+}, f = (e) => async (t, n) => {
+	let o = l(e, t.connectionId), s = c(n, t.connectionId);
+	if (o.kind !== "pat") throw new a({
+		connectionId: t.connectionId,
+		expected: "pat",
+		actual: o.kind
+	});
+	let u = t.token.trim();
+	if (u.length === 0) throw new i({
+		connectionId: t.connectionId,
+		reason: "token is empty",
+		transient: !1
+	});
+	let d;
+	if (o.validate !== void 0) try {
+		d = await o.validate(u);
+	} catch (e) {
+		throw new i({
+			connectionId: t.connectionId,
+			reason: `the provider rejected that token: ${e instanceof Error ? e.message : String(e)}`,
+			transient: !1
+		});
+	}
+	return await r({
+		store: n.store,
+		definition: o,
+		subjectId: s,
+		tenantId: n.request?.subject?.tenantId ?? null,
+		tokens: {
+			accessToken: u,
+			scopes: []
+		},
+		...d === void 0 ? {} : { account: d }
+	}), { ok: !0 };
+}, p = (e) => async (n, r) => {
+	l(e, n.connectionId);
+	let i = c(r, n.connectionId);
+	return { ok: await t(r.store, n.connectionId, i) };
+};
+//#endregion
+export { p as makeDisconnectConnectionExecutor, u as makeListConnectionsExecutor, d as makeStartConnectionExecutor, f as makeSubmitTokenExecutor };

package/dist/connectionCredentials.js

@@ -0,0 +1,66 @@
+//#region src/connectionCredentials.ts
+var e = 36e5, t = Symbol.for("@voltro/runtime/connectionCredentials"), n = globalThis, r = n[t] ??= {
+	overrides: /* @__PURE__ */ new Map(),
+	credentialExpiry: /* @__PURE__ */ new Map(),
+	streamInterrupts: /* @__PURE__ */ new Map()
+}, { overrides: i, credentialExpiry: a, streamInterrupts: o } = r, s = (e, t) => {
+	t === void 0 ? a.delete(e) : a.set(e, t);
+}, c = (e) => a.get(e), l = (e, t) => {
+	i.set(e, {
+		credential: t,
+		touchedAt: Date.now()
+	});
+}, u = (e) => {
+	let t = i.get(e);
+	if (t) return t.touchedAt = Date.now(), t.credential;
+}, d = (e) => {
+	a.delete(e), i.delete(e);
+}, f = (e, t) => {
+	let n = [], r = /* @__PURE__ */ new Set();
+	for (let i of (e ?? "").split(";")) {
+		let e = i.indexOf("=");
+		if (e < 0) continue;
+		let a = i.slice(0, e).trim();
+		if (a === "") continue;
+		let o = t[a];
+		o === void 0 ? n.push([a, i.slice(e + 1).trim()]) : (n.push([a, encodeURIComponent(o)]), r.add(a));
+	}
+	for (let [e, i] of Object.entries(t)) r.has(e) || n.push([e, encodeURIComponent(i)]);
+	return n.map(([e, t]) => `${e}=${t}`).join("; ");
+}, p = (e, t) => {
+	let n = u(e);
+	if (n === void 0) return t;
+	let r = { ...t };
+	if (n.headers !== void 0) for (let [e, t] of Object.entries(n.headers)) {
+		let n = e.toLowerCase();
+		delete r[e], r[n] = t;
+	}
+	if (n.cookies !== void 0) {
+		let e = t.cookie ?? t.Cookie;
+		delete r.Cookie, r.cookie = f(e, n.cookies);
+	}
+	return r;
+};
+r.sweepHandle ??= setInterval(() => {
+	let e = Date.now() - 864e5;
+	for (let [t, n] of i) n.touchedAt < e && i.delete(t);
+}, e), typeof r.sweepHandle == "object" && r.sweepHandle !== null && "unref" in r.sweepHandle && r.sweepHandle.unref();
+var m = (e, t) => {
+	let n = o.get(e);
+	return n || (n = /* @__PURE__ */ new Set(), o.set(e, n)), n.add(t), () => {
+		let n = o.get(e);
+		n && (n.delete(t), n.size === 0 && o.delete(e));
+	};
+}, h = (e) => {
+	let t = o.get(e);
+	if (t) {
+		for (let e of [...t]) try {
+			e();
+		} catch {}
+		o.delete(e);
+	}
+}, g = (e) => o.get(e)?.size ?? 0, _ = () => {
+	i.clear(), a.clear(), o.clear();
+};
+//#endregion
+export { g as _connectionStreamCount, _ as _resetConnectionCredentialsForTest, p as applyConnectionCredential, l as bindConnectionCredential, u as getConnectionCredential, c as getCredentialExpiry, h as interruptConnectionStreams, f as mergeCookieHeader, s as recordCredentialExpiry, m as registerConnectionStream, d as unbindConnection };