@voltro/runtime 0.85.0 → 0.86.0

package/dist/undoCapture.js

@@ -0,0 +1,74 @@
+import { eq as e } from "@voltro/database";
+//#region src/undoCapture.ts
+var t = (e = process.env) => {
+	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
+	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
+}, n = (e = process.env) => {
+	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
+	return t !== "off" && t !== "0" && t !== "false";
+}, r = (e) => e.startsWith("_voltro"), i = async (t, n, r) => (await t.query({
+	table: n,
+	predicate: e("id", r),
+	order: []
+}))[0] ?? null, a = (e, t, n = () => /* @__PURE__ */ new Set()) => new Proxy(e, { get(e, a, o) {
+	let s = (e, t) => {
+		if (t === null) return null;
+		let r = n(e);
+		if (r.size === 0) return t;
+		let i = {};
+		for (let [e, n] of Object.entries(t)) r.has(e) || (i[e] = n);
+		return i;
+	};
+	if (a === "insert") return async (n, i) => {
+		let a = await e.insert(n, i);
+		return r(n) || t({
+			table: n,
+			op: "insert",
+			next: a
+		}), a;
+	};
+	if (a === "update") return async (a, o, c) => {
+		let l = n(a), u = Object.keys(c);
+		if (l.size > 0 && u.length > 0 && u.every((e) => l.has(e))) return await e.update(a, o, c);
+		let d = r(a) ? null : s(a, await i(e, a, o)), f = await e.update(a, o, c);
+		return r(a) || t({
+			table: a,
+			op: "update",
+			id: o,
+			prev: d,
+			next: s(a, f)
+		}), f;
+	};
+	if (a === "delete") return async (n, a) => {
+		let o = r(n) ? null : await i(e, n, a), s = await e.delete(n, a);
+		return !r(n) && s && t({
+			table: n,
+			op: "delete",
+			id: a,
+			prev: o
+		}), s;
+	};
+	let c = Reflect.get(e, a, o);
+	return typeof c == "function" ? c.bind(e) : c;
+} }), o = (e, t = () => /* @__PURE__ */ new Set()) => {
+	let n = [];
+	return {
+		tx: a(e, (e) => n.push(e), t),
+		persist: async (e, t) => {
+			if (n.length === 0 || t.tag.startsWith("__voltro")) return;
+			let r = t.subject;
+			await e.insert("_voltro_undo_log", {
+				tag: t.tag,
+				label: t.tag,
+				subjectId: r?.id ?? null,
+				tenantId: r?.tenantId ?? null,
+				traceId: t.traceId ?? null,
+				changes: JSON.stringify(n),
+				crossesAction: !1,
+				undone: !1
+			});
+		}
+	};
+};
+//#endregion
+export { o as makeUndoCapture, t as undoCaptureEnabled, n as undoSurfaceEnabled, a as wrapCaptureStore };

package/dist/undoLogTable.js

@@ -0,0 +1,16 @@
+import { boolean as e, id as t, table as n, text as r, timestamp as i } from "@voltro/database";
+//#region src/undoLogTable.ts
+var a = n("_voltro_undo_log", {
+	id: t({ prefix: "undo" }),
+	tag: r(),
+	label: r().nullable(),
+	subjectId: r().nullable(),
+	tenantId: r().nullable(),
+	traceId: r().nullable(),
+	changes: r().serverOnly(),
+	crossesAction: e().default(!1),
+	undone: e().default(!1),
+	createdAt: i().default("now")
+}).index(["subjectId", "createdAt"]);
+//#endregion
+export { a as _voltroUndoLogTable };

package/dist/upsertBinding.js

@@ -0,0 +1,20 @@
+import { and as e, eq as t } from "@voltro/database";
+//#region src/upsertBinding.ts
+var n = "id", r = async (r, i, a, o) => {
+	let s = o.map((e) => t(e, a[e]));
+	if (s.length === 0) return;
+	let c = (await r.query({
+		table: i,
+		predicate: s.length === 1 ? s[0] : e(...s),
+		order: [],
+		take: 1,
+		skip: void 0,
+		projection: [n]
+	}))[0]?.[n];
+	return c === null ? void 0 : c;
+}, i = async (e, t, i, a) => {
+	let o = await r(e, t, i, a);
+	return o === void 0 ? i[n] : o;
+};
+//#endregion
+export { r as upsertConflictId, i as upsertDestinationId };

package/dist/wakeOrchestrator.js

@@ -0,0 +1,34 @@
+import { dueWakeups as e, releaseWakeup as t, tryClaimWakeup as n } from "./wakeRegistry.js";
+//#region src/wakeOrchestrator.ts
+var r = async (r) => {
+	let i = r.now?.() ?? /* @__PURE__ */ new Date(), a = await e(r.store, i, r.batchLimit ?? 100);
+	if (a.length === 0) return 0;
+	let o = 0;
+	for (let e of a) if (await n(r.store, e)) try {
+		await r.adapter.wake(e), o++;
+	} catch (n) {
+		await t(r.store, e), r.log?.warn("wake: adapter failed — released for retry", {
+			tenantId: e.tenantId,
+			kind: e.kind,
+			refId: e.refId,
+			reason: n instanceof Error ? n.message : String(n)
+		});
+	}
+	return o > 0 && r.log?.info("wake: woke due deployments", { count: o }), o;
+}, i = (e, t = 1e3) => {
+	let n = !1, i, a = async () => {
+		if (!n) {
+			try {
+				await r(e);
+			} catch (t) {
+				e.log?.warn("wake: tick failed", { reason: t instanceof Error ? t.message : String(t) });
+			}
+			n || (i = setTimeout(() => void a(), t));
+		}
+	};
+	return a(), { stop: () => {
+		n = !0, i !== void 0 && clearTimeout(i);
+	} };
+};
+//#endregion
+export { i as runWakeLoop, r as wakeDueOnce };

package/dist/wakeRegistry.js

@@ -0,0 +1,71 @@
+//#region src/wakeRegistry.ts
+var e = "_voltro_wakeups", t = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, n = (e) => ({
+	tenantId: String(e.tenantId),
+	kind: String(e.kind),
+	refId: String(e.refId),
+	wakeAt: e.wakeAt instanceof Date ? e.wakeAt : new Date(String(e.wakeAt)),
+	status: e.status === "fired" ? "fired" : "pending"
+}), r = async (n, r) => {
+	await n.upsert(e, {
+		id: t(r),
+		tenantId: r.tenantId,
+		kind: r.kind,
+		refId: r.refId,
+		wakeAt: r.wakeAt,
+		status: "pending"
+	}, {
+		conflictColumns: ["id"],
+		update: ["wakeAt", "status"]
+	});
+}, i = async (n, r) => n.delete(e, t(r)), a = async (n, r) => await n.update(e, t(r), { status: "fired" }) !== null, o = (e, t) => ({ and: [{
+	column: "id",
+	op: "eq",
+	value: e
+}, {
+	column: "status",
+	op: "eq",
+	value: t
+}] }), s = async (n, r) => await n.updateMany(e, { status: "fired" }, { where: o(t(r), "pending") }) > 0, c = async (n, r) => {
+	await n.updateMany(e, { status: "pending" }, { where: o(t(r), "fired") });
+}, l = {
+	column: "status",
+	op: "eq",
+	value: "pending"
+}, u = async (t, r) => {
+	let i = {
+		table: e,
+		predicate: l,
+		order: [{
+			column: "wakeAt",
+			direction: "asc"
+		}],
+		take: r,
+		skip: void 0,
+		projection: void 0
+	};
+	return (await t.query(i)).map(n);
+}, d = async (e, t, n = 500) => {
+	let r = await u(e, n), i = t.getTime(), a = 0;
+	for (let e of r) e.wakeAt.getTime() <= i && (r[a++] = e);
+	return r.length = a, r;
+}, f = async (e) => (await u(e, 1))[0] ?? null, p = {
+	column: "status",
+	op: "eq",
+	value: "fired"
+}, m = async (t, n = {}) => {
+	let r = {
+		table: e,
+		predicate: p,
+		order: [{
+			column: "wakeAt",
+			direction: "asc"
+		}],
+		take: n.limit ?? 1e3,
+		skip: void 0,
+		projection: void 0
+	}, i = await t.query(r), a = n.firedOlderThan?.getTime(), o = 0;
+	for (let n of i) a !== void 0 && (n.wakeAt instanceof Date ? n.wakeAt : new Date(String(n.wakeAt))).getTime() >= a || await t.delete(e, String(n.id)) && o++;
+	return o;
+};
+//#endregion
+export { i as cancelWakeup, d as dueWakeups, a as markWakeupFired, f as nextWakeup, m as pruneWakeups, r as registerWakeup, c as releaseWakeup, s as tryClaimWakeup };

package/dist/wakeRouter.js

@@ -0,0 +1,63 @@
+import * as e from "node:http";
+//#region src/wakeRouter.ts
+var t = () => {
+	let e = 0, t = 0;
+	return {
+		onRequestStart: () => {
+			e++;
+		},
+		onRequestEnd: () => {
+			e = Math.max(0, e - 1);
+		},
+		onConnect: () => {
+			t++;
+		},
+		onDisconnect: () => {
+			t = Math.max(0, t - 1);
+		},
+		inFlightRequests: () => e,
+		openConnections: () => t
+	};
+}, n = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), r = (t, n, r, i) => new Promise((a, o) => {
+	let s = e.request({
+		host: r,
+		port: i,
+		method: t.method,
+		path: t.url,
+		headers: t.headers
+	}, (e) => {
+		n.writeHead(e.statusCode ?? 502, e.headers), e.pipe(n), e.on("end", a), e.on("error", o);
+	});
+	s.on("error", o), t.pipe(s);
+}), i = (t, n, r, i, a) => new Promise((o, s) => {
+	let c = e.request({
+		host: i,
+		port: a,
+		method: t.method,
+		path: t.url,
+		headers: t.headers
+	});
+	c.on("upgrade", (e, t, i) => {
+		i && i.length > 0 && n.unshift(i), r && r.length > 0 && t.unshift(r), n.write("HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n\r\n"), t.pipe(n), n.pipe(t);
+		let a = () => {
+			t.destroy(), n.destroy(), o();
+		};
+		n.on("close", a), t.on("close", a), t.on("error", s);
+	}), c.on("error", s), c.end();
+}), a = (t) => {
+	let a = n({
+		ensureAwake: () => t.supervisor.start(),
+		...t.onActivity === void 0 ? {} : { onActivity: t.onActivity }
+	}), o = t.activity, s = e.createServer((e, n) => {
+		o?.onRequestStart(), n.on("close", () => o?.onRequestEnd()), a.run(() => r(e, n, t.targetHost, t.targetPort)).catch((e) => {
+			t.log?.warn("wake-router: proxy failed", { reason: e instanceof Error ? e.message : String(e) }), n.headersSent || n.writeHead(502), n.end("wake/proxy failed");
+		});
+	});
+	return s.on("upgrade", (e, n, r) => {
+		o?.onConnect(), n.on("close", () => o?.onDisconnect()), a.run(() => i(e, n, r, t.targetHost, t.targetPort)).catch((e) => {
+			t.log?.warn("wake-router: upgrade proxy failed", { reason: e instanceof Error ? e.message : String(e) }), n.destroy();
+		});
+	}), s;
+};
+//#endregion
+export { t as makeRouterActivity, n as makeWakeGate, a as makeWakeProxyServer };

package/dist/wakeSupervisor.js

@@ -0,0 +1,62 @@
+import { spawn as e } from "node:child_process";
+//#region src/wakeSupervisor.ts
+var t = (e) => ({ wake: async () => {
+	await e.start();
+} }), n = (e) => new Promise((t) => setTimeout(t, e)), r = (t) => {
+	let r = t.fetchImpl ?? fetch, i = t.now ?? Date.now, a = t.sleep ?? n, o = t.spawnImpl ?? e, s = t.startTimeoutMs ?? 3e4, c = t.healthPollMs ?? 200, l = t.stopSignal ?? "SIGTERM", u = t.stopGraceMs ?? 1e4, d, f, p = t.healthCheck ?? ((e) => e.ok), m = async () => {
+		try {
+			let e = await r(t.healthUrl);
+			return p(e);
+		} catch {
+			return !1;
+		}
+	}, h = async () => {
+		t.log?.info("supervisor: starting app", { command: t.command });
+		let e = o(t.command, [...t.args ?? []], {
+			env: {
+				...process.env,
+				...t.env ?? {}
+			},
+			...t.cwd === void 0 ? {} : { cwd: t.cwd },
+			stdio: "inherit"
+		});
+		d = e, e.on("exit", (n) => {
+			d === e && (d = void 0), t.log?.info("supervisor: app exited", { code: n });
+		});
+		let n = i() + s;
+		for (; i() < n;) {
+			if (d === void 0) throw Error("supervisor: app process exited before becoming healthy");
+			if (await m()) {
+				t.log?.info("supervisor: app healthy");
+				return;
+			}
+			await a(c);
+		}
+		throw await g(), Error(`supervisor: app did not become healthy within ${s}ms`);
+	}, g = async () => {
+		let e = d;
+		if (e === void 0) return;
+		d = void 0, t.log?.info("supervisor: stopping app");
+		let n = new Promise((t) => e.once("exit", () => t()));
+		e.kill(l);
+		let r = setTimeout(() => {
+			e.kill("SIGKILL");
+		}, u);
+		try {
+			await n;
+		} finally {
+			clearTimeout(r);
+		}
+	};
+	return {
+		isRunning: () => d !== void 0,
+		start: async () => {
+			d !== void 0 && await m() || (f === void 0 && (f = h().finally(() => {
+				f = void 0;
+			})), await f);
+		},
+		stop: g
+	};
+};
+//#endregion
+export { t as makeProcessAdapter, r as nodeProcessSupervisor };

package/dist/wakeupsTable.js

@@ -0,0 +1,12 @@
+import { id as e, table as t, text as n, timestamp as r } from "@voltro/database";
+//#region src/wakeupsTable.ts
+var i = t("_voltro_wakeups", {
+	id: e({ prefix: "wakeup" }),
+	tenantId: n(),
+	kind: n(),
+	refId: n(),
+	wakeAt: r(),
+	status: n()
+}).index(["status", "wakeAt"]).index(["tenantId"]);
+//#endregion
+export { i as _voltroWakeupsTable };

package/dist/webSocketGatewayRuntime.js

@@ -0,0 +1,114 @@
+import { Effect as e } from "effect";
+import { GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE as t } from "@voltro/protocol";
+import { Socket as n } from "effect/socket";
+//#region src/webSocketGatewayRuntime.ts
+var r = (r, i, a, o, s, c, l) => e.scoped(e.gen(function* () {
+	let u = yield* r.writer, d = yield* e.context(), f = new AbortController(), p = a.limits?.maxMessageBytes ?? 1048576, m = a.limits?.maxPendingBytes ?? 4194304, h = a.limits?.maxPendingMessages ?? 64, g = [], _ = [], v = 0, y, b = 0, x, S, C, w = !1, T = !1, E = () => {
+		let e = x;
+		x = void 0;
+		try {
+			e?.();
+		} catch (e) {
+			l(e);
+		}
+	}, D = (e) => {
+		if (!f.signal.aborted) {
+			f.abort(e), S !== void 0 && clearTimeout(S), g.length = 0, y?.reject(e);
+			for (let t = v; t < _.length; t += 1) _[t]?.reject(e);
+			_.length = 0, v = 0, b = 0, E();
+		}
+	}, O = (t = 1e3, r) => {
+		f.signal.aborted || (D(Error(r ?? "gateway closed")), !(T || i.destroyed) && (T = !0, C = setTimeout(() => i.destroy(), 1e3), C.unref(), w ? e.runPromiseWith(d)(u.write(new n.CloseEvent(t, r))).catch(() => i.destroy()) : i.destroy()));
+	}, k = () => new Promise((e, t) => {
+		if (f.signal.aborted || i.destroyed) {
+			t(/* @__PURE__ */ Error("gateway closed"));
+			return;
+		}
+		let n = () => {
+			t(/* @__PURE__ */ Error("gateway closed"));
+		};
+		f.signal.addEventListener("abort", n, { once: !0 }), i.write(/* @__PURE__ */ new Uint8Array(), (r) => {
+			f.signal.removeEventListener("abort", n), r ? t(r) : e();
+		});
+	}), A = async () => {
+		if (y !== void 0 || f.signal.aborted) return;
+		let t = _[v];
+		if (t) {
+			_[v] = void 0, v += 1, v === _.length ? (_.length = 0, v = 0) : v >= 1024 && v * 2 >= _.length && (_.splice(0, v), v = 0), y = t;
+			try {
+				if (await e.runPromiseWith(d)(u.write(t.data), { signal: f.signal }), await k(), f.signal.aborted) throw Error("gateway closed");
+				t.resolve();
+			} catch (e) {
+				t.reject(e instanceof Error ? e : /* @__PURE__ */ Error("gateway write failed")), O(1011, "gateway write failed");
+			} finally {
+				f.signal.aborted || (b -= t.size), y = void 0, f.signal.aborted || A();
+			}
+		}
+	}, j = (e) => {
+		if (f.signal.aborted) return Promise.reject(/* @__PURE__ */ Error("gateway closed"));
+		let t = typeof e == "string" ? Buffer.byteLength(e) : e.byteLength;
+		if (t > p) return O(1009, "gateway message too large"), Promise.reject(/* @__PURE__ */ Error("gateway message too large"));
+		if (t > m - b || _.length - v + +!!y >= h) return O(1013, "gateway outbound queue exceeded"), Promise.reject(/* @__PURE__ */ Error("gateway outbound queue exceeded"));
+		b += t;
+		let n = new Promise((n, r) => {
+			_.push({
+				data: typeof e == "string" ? e : e.slice(),
+				size: t,
+				resolve: n,
+				reject: r
+			});
+		});
+		return A(), n;
+	}, M = {
+		send: (e) => {
+			j(e).catch(() => {});
+		},
+		sendAsync: j,
+		signal: f.signal,
+		close: O,
+		onMessage: (e) => {
+			f.signal.aborted || g.push(e);
+		},
+		subject: o,
+		headers: s,
+		path: a.path
+	}, N = () => D(/* @__PURE__ */ Error("gateway disconnected")), P = () => O(1011, "gateway transport failed");
+	i.once("close", N), i.once("error", P), yield* e.addFinalizer(() => e.sync(() => {
+		D(/* @__PURE__ */ Error("gateway stopped")), C !== void 0 && clearTimeout(C), i.off("close", N), i.off("error", P), i.destroy();
+	}));
+	let F = (e) => {
+		if (!f.signal.aborted) {
+			if (e.byteLength > p) O(1009, "gateway message too large");
+			else try {
+				for (let t of g) t(e);
+			} catch (e) {
+				l(e), O(1011, "gateway message handler failed");
+			}
+		}
+	}, I = e.sync(() => {
+		if (w = !0, c !== void 0) {
+			let e = c - Date.now();
+			if (e <= 0) {
+				O(t, "credential expired");
+				return;
+			}
+			S = setTimeout(() => O(t, "credential expired"), e), S.unref();
+		}
+		Promise.resolve().then(() => {
+			if (!f.signal.aborted) return a.onConnection(M);
+		}).then((e) => {
+			typeof e == "function" && (x = e), f.signal.aborted && E();
+		}, (e) => {
+			l(e), O(1011, "gateway setup failed");
+		});
+	});
+	yield* e.gen(function* () {
+		let e = yield* r.reader;
+		for (yield* I;;) {
+			let t = yield* e.pull;
+			for (let e of t) F(typeof e == "string" ? new TextEncoder().encode(e) : e);
+		}
+	}).pipe(e.ignore);
+}));
+//#endregion
+export { r as runWebSocketGateway };

package/dist/webhookVerification.js

@@ -0,0 +1,18 @@
+//#region src/webhookVerification.ts
+var e = "voltroWebhookVerification", t = (e) => e === "signature" || e === "provider" || e === "none", n = (n) => {
+	if (typeof n != "function" && (typeof n != "object" || !n)) return;
+	let r = n[e];
+	return t(r) ? r : void 0;
+}, r = class extends Error {
+	path;
+	name = "UnverifiedWebhookRoute";
+	constructor(e) {
+		super(`incoming webhook '${e}' is mounted without declaring how it authenticates its caller. An incoming webhook is a public POST that runs your application code, so the framework refuses to mount one that nothing verifies. Declare it on the descriptor:\n  · provider: stripeWebhookProvider()  — or any provider preset (HMAC + replay window)\n  · signature: { _tag: 'hmac', algorithm: 'hmacSha256', header: 'X-Signature', ... }\n  · verification: 'provider'           — the handler verifies with the provider's own SDK\n  · verification: 'none'               — deliberately public (gateway / IP allow-list owns it)\nA signature-verified webhook also needs its shared secret in VOLTRO_WEBHOOK_SECRET_<ID>; the framework mints no secret for you.`), this.path = e;
+	}
+}, i = (e) => {
+	if (e !== void 0) {
+		for (let [t, i] of e) if (n(i.handle) === void 0) throw new r(t);
+	}
+};
+//#endregion
+export { r as UnverifiedWebhookRoute, e as WEBHOOK_VERIFICATION_PROPERTY, i as assertWebhookRoutesDeclareVerification, n as webhookVerificationOf };

package/dist/wireColumnStrip.js

@@ -0,0 +1,84 @@
+import { getTable as e, readableByColumns as t, serverOnlyColumns as n } from "@voltro/database";
+import { ADMIN_SCOPE as r, effectiveScopes as i, hasEffectiveScope as a } from "@voltro/protocol";
+import { types as o } from "node:util";
+//#region src/wireColumnStrip.ts
+var s = Array.prototype.includes, c = (e) => !o.isProxy(e) && Object.getPrototypeOf(e) === Array.prototype && Object.getOwnPropertyDescriptor(Array.prototype, "includes")?.value === s && Reflect.ownKeys(e).every((t) => {
+	if (typeof t != "string" || t !== "length" && !/^(0|[1-9][0-9]*)$/.test(t)) return !1;
+	let n = Object.getOwnPropertyDescriptor(e, t);
+	return "value" in n && (t === "length" || typeof n.value == "string");
+}), l = (e) => !o.isProxy(e) && (Object.getPrototypeOf(e) === Object.prototype || Object.getPrototypeOf(e) === null) && Reflect.ownKeys(e).every((t) => "value" in Object.getOwnPropertyDescriptor(e, t)), u = (t) => {
+	let r = e(t);
+	return r === void 0 ? [] : n(r);
+}, d = (e, t) => {
+	if (t.length === 0) return e;
+	let n = !1, r = e.map((e) => {
+		let r;
+		for (let n of t) Object.prototype.hasOwnProperty.call(e, n) && (r === void 0 && (r = { ...e }), delete r[n]);
+		return r === void 0 ? e : (n = !0, r);
+	});
+	return n ? r : e;
+}, f = (e, t) => d(t, u(e)), p = (o, s) => {
+	let u = e(o);
+	if (u === void 0) return [];
+	let d = n(u), f = t(u);
+	if (f.length === 0) return d;
+	let p = [...d], m;
+	if (f.length >= 256) {
+		let e = i(s);
+		e.length >= 32 && l(s) && c(e) && f.every((e) => c(e.scopes)) && (m = new Set(e));
+	}
+	let h = m;
+	for (let { column: e, scopes: t } of f) (h === void 0 ? t.some((e) => a(s, e)) : h.has(r) || t.some((e) => h.has(e))) || p.push(e);
+	return p;
+}, m = (e, t, n) => d(t, p(e, n)), h = (e, t) => {
+	if (typeof e != "object" || !e) return e === void 0 || [
+		"string",
+		"number",
+		"boolean"
+	].includes(typeof e);
+	if (o.isProxy(e) || t.has(e)) return !1;
+	if (e instanceof Date) return Object.getPrototypeOf(e) === Date.prototype && Reflect.ownKeys(e).length === 0;
+	let n = Object.getPrototypeOf(e);
+	if (n !== Object.prototype && n !== null && n !== Array.prototype || "toJSON" in e || Array.isArray(e) && ["constructor", "map"].some((t) => Object.hasOwn(e, t))) return !1;
+	t.add(e);
+	try {
+		for (let n of Reflect.ownKeys(e)) {
+			let r = Object.getOwnPropertyDescriptor(e, n);
+			if (r === void 0 || !("value" in r) || r.enumerable && !h(r.value, t)) return !1;
+		}
+		return !0;
+	} finally {
+		t.delete(e);
+	}
+}, g = () => {
+	let e = /* @__PURE__ */ new WeakMap();
+	return (t, n, r) => {
+		let i = p(t, r), a = JSON.stringify([t, i]);
+		if (i.length === 0) return {
+			rows: n,
+			visibilityKey: a
+		};
+		let o = e.get(n);
+		if (o === void 0) {
+			let t = !1;
+			try {
+				t = Array.isArray(n) && h(n, /* @__PURE__ */ new Set());
+			} catch {}
+			o = {
+				eligible: t,
+				policies: /* @__PURE__ */ new Map()
+			}, e.set(n, o);
+		}
+		if (!o.eligible) return {
+			rows: d(n, i),
+			visibilityKey: a
+		};
+		let s = o.policies.get(a);
+		return s === void 0 && (s = d(n, i), o.policies.set(a, s)), {
+			rows: s,
+			visibilityKey: a
+		};
+	};
+};
+//#endregion
+export { g as createDispatchWireStrip, p as forbiddenColumnsForSubject, u as serverOnlyColumnNames, d as stripColumnsFromRows, m as stripForbiddenForWire, f as stripServerOnlyForWire };

package/dist/workflowReadBuiltins.js

@@ -0,0 +1,87 @@
+import { and as e, eq as t } from "@voltro/database";
+import { ADMIN_SCOPE as n, hasEffectiveScope as r } from "@voltro/protocol";
+import { openWorkflowRow as i } from "@voltro/workflow";
+//#region src/workflowReadBuiltins.ts
+var a = (e) => e.request?.subject ?? null, o = (e, t) => {
+	if (typeof e != "object" || !e) return null;
+	let n = e[t];
+	return typeof n == "string" ? n : null;
+}, s = (e, t) => {
+	if (e === null) return !1;
+	if (e.type === "system" || r(e, n)) return !0;
+	if (e.type === "anonymous" || e.id == null) return !1;
+	let i = o(t, "type");
+	if (t == null || i === "system") return !1;
+	let a = o(t, "tenantId");
+	return a === null ? (e.tenantId ?? null) === null && o(t, "id") === e.id : a === (e.tenantId ?? null);
+}, c = (e, t) => {
+	let n = a(e);
+	return t.filter((e) => s(n, e.subject)).map(i);
+}, l = (e, t, n) => Number.isFinite(e) && e !== void 0 ? Math.min(Math.max(Math.floor(e), 1), n) : t, u = (e, t) => ({
+	table: "_voltro_workflow_runs",
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: e,
+	take: t,
+	skip: void 0,
+	projection: void 0
+}), d = async (e, n) => {
+	let r = (await e.store.query(u(t("id", n), 1)))[0];
+	return r !== void 0 && s(a(e), r.subject) ? r : void 0;
+}, f = async (e, n) => {
+	let r = await n.store.query(u(t("id", e.id), 1));
+	return c(n, r.length > 0 ? r : await n.store.query(u(t("executionId", e.id), 1)));
+}, p = async (n, r) => {
+	let i = [...n.tag === void 0 ? [] : [t("tag", n.tag)], ...n.status === void 0 ? [] : [t("status", n.status)]], a = i.length === 0 ? void 0 : i.length === 1 ? i[0] : e(...i);
+	return c(r, await r.store.query(u(a, l(n.limit, 100, 500))));
+}, m = async (e, n) => await d(n, e.runId) === void 0 ? [] : n.store.query({
+	table: "_voltro_workflow_run_steps",
+	order: [{
+		column: "startedAt",
+		direction: "asc"
+	}],
+	predicate: t("runId", e.runId),
+	take: 1e3,
+	skip: void 0,
+	projection: void 0
+}).then((e) => e.map(i)), h = async (e, n) => await d(n, e.runId) === void 0 ? [] : n.store.query({
+	table: "_voltro_workflow_run_events",
+	order: [{
+		column: "occurredAt",
+		direction: "asc"
+	}],
+	predicate: t("runId", e.runId),
+	take: 1e3,
+	skip: void 0,
+	projection: void 0
+}).then((e) => e.map(i)), g = (e, t) => ({
+	table: "_voltro_workflow_events",
+	order: [{
+		column: "occurredAt",
+		direction: "desc"
+	}],
+	predicate: e,
+	take: t,
+	skip: void 0,
+	projection: void 0
+}), _ = async (e, n) => {
+	let r = e.name === void 0 ? void 0 : t("name", e.name);
+	return c(n, await n.store.query(g(r, l(e.limit, 100, 500))));
+}, v = async (e, n) => {
+	let r = (await n.store.query(g(t("id", e.eventId), 1)))[0];
+	return r === void 0 || !s(a(n), r.subject) ? [] : n.store.query({
+		table: "_voltro_workflow_event_deliveries",
+		order: [{
+			column: "createdAt",
+			direction: "asc"
+		}],
+		predicate: t("eventId", e.eventId),
+		take: 500,
+		skip: void 0,
+		projection: void 0
+	});
+};
+//#endregion
+export { _ as workflowDomainEventsExecutor, v as workflowEventDeliveriesExecutor, s as workflowRowVisibleTo, h as workflowRunEventsExecutor, f as workflowRunExecutor, m as workflowRunStepsExecutor, p as workflowRunsExecutor };