@voltro/runtime 0.85.0 → 0.86.0

package/dist/dataloader.js

@@ -0,0 +1,61 @@
+import { inSet as e } from "@voltro/database";
+//#region src/dataloader.ts
+var t = () => {
+	let e, t;
+	return {
+		promise: new Promise((n, r) => {
+			e = n, t = r;
+		}),
+		resolve: e,
+		reject: t
+	};
+}, n = (e) => {
+	Promise.resolve().then(e);
+}, r = (r) => {
+	let i = r.schedule ?? n, a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = async (t) => {
+		let n = s.get(t);
+		if (n === void 0) return;
+		s.delete(t);
+		let i = [...n.keys()];
+		try {
+			let s = await r.store.query({
+				table: t,
+				predicate: e("id", i),
+				order: [],
+				take: void 0,
+				skip: void 0,
+				projection: void 0
+			}), c = new Map(s.map((e) => [String(e.id), e])), l = a.get(t) ?? /* @__PURE__ */ new Map();
+			a.set(t, l);
+			for (let [e, r] of n) {
+				let n = c.get(e) ?? null;
+				l.set(e, n), o.get(t)?.delete(e), r.resolve(n);
+			}
+		} catch (e) {
+			for (let [r, i] of n) o.get(t)?.delete(r), i.reject(e);
+		} finally {
+			o.get(t)?.size === 0 && o.delete(t);
+		}
+	}, l = (e, n) => {
+		if (n.length === 0) return Promise.resolve([]);
+		let r = a.get(e), l = !1, u = n.map((n) => {
+			if (r?.has(n)) return Promise.resolve(r.get(n) ?? null);
+			let i = o.get(e), a = i?.get(n);
+			if (a !== void 0) return a.promise;
+			i === void 0 && (i = /* @__PURE__ */ new Map(), o.set(e, i));
+			let c = t();
+			i.set(n, c);
+			let u = s.get(e);
+			return u === void 0 && (u = /* @__PURE__ */ new Map(), s.set(e, u), l = !0), u.set(n, c), c.promise;
+		}), d = Promise.all(u);
+		return l && i(() => {
+			c(e);
+		}), d;
+	};
+	return {
+		load: async (e, t) => (await l(e, [t]))[0] ?? null,
+		loadMany: (e, t) => l(e, t)
+	};
+};
+//#endregion
+export { r as makeDataLoader };

package/dist/declaredTablesGuard.js

@@ -0,0 +1,48 @@
+//#region src/declaredTablesGuard.ts
+var e = class extends Error {
+	table;
+	operation;
+	_tag = "UndeclaredTableAccess";
+	constructor(e, t) {
+		super(`store.${t}('${e}'): this app does not declare a table '${e}'. A table another app owns is reached through that app — bind it under \`apis:\` and call its \`service:\` procedures — never through its tables. If the table is this app's own, declare it with \`table()\` (or add the plugin that declares it).`), this.table = e, this.operation = t, this.name = "UndeclaredTableAccess";
+	}
+}, t = (n, r) => {
+	let i = (t, n) => {
+		if (!r(t)) throw new e(t, n);
+	}, a = (e, t) => {
+		for (let n of e) i(n, t);
+	};
+	return {
+		query: async (e) => (i(e.table, "query"), n.query(e)),
+		insert: async (e, t) => (i(e, "insert"), n.insert(e, t)),
+		insertMany: async (e, t) => (i(e, "insertMany"), n.insertMany(e, t)),
+		patchJson: async (e, t, r, a, o) => (i(e, "patchJson"), n.patchJson(e, t, r, a, o)),
+		update: async (e, t, r) => (i(e, "update"), n.update(e, t, r)),
+		updateMany: async (e, t, r) => (i(e, "updateMany"), n.updateMany(e, t, r)),
+		delete: async (e, t) => (i(e, "delete"), n.delete(e, t)),
+		deleteMany: async (e, t) => (i(e, "deleteMany"), n.deleteMany(e, t)),
+		upsert: async (e, t, r) => (i(e, "upsert"), n.upsert(e, t, r)),
+		insertIgnore: async (e, t, r) => (i(e, "insertIgnore"), n.insertIgnore(e, t, r)),
+		insertIgnoreWithOutcome: async (e, t, r) => (i(e, "insertIgnoreWithOutcome"), n.insertIgnoreWithOutcome(e, t, r)),
+		transactional: (e) => n.transactional((n) => e(t(n, r))),
+		onChange: (e) => n.onChange(e),
+		injectExternalChange: (e) => {
+			n.injectExternalChange(e);
+		},
+		...n.changeScope === void 0 ? {} : { changeScope: n.changeScope },
+		...n.onChangeStreamGap === void 0 ? {} : { onChangeStreamGap: (e) => n.onChangeStreamGap(e) },
+		...n.upsertWithOutcome === void 0 ? {} : { upsertWithOutcome: async (e, t, r) => (i(e, "upsertWithOutcome"), n.upsertWithOutcome(e, t, r)) },
+		...n.withNamespace === void 0 ? {} : { withNamespace: (e) => t(n.withNamespace(e), r) },
+		...n.raw === void 0 ? {} : { raw: ((...e) => n.raw(...e)) },
+		...n.close === void 0 ? {} : { close: (e) => n.close(e) },
+		...n.ping === void 0 ? {} : { ping: () => n.ping() },
+		...n.emptyTables === void 0 ? {} : { emptyTables: async (e) => (a(e, "emptyTables"), n.emptyTables(e)) },
+		...n.incomingForeignKeys === void 0 ? {} : { incomingForeignKeys: (e) => n.incomingForeignKeys(e) },
+		...n.savepoint === void 0 ? {} : { savepoint: ((e) => n.savepoint(e)) },
+		...n.refreshChangeCaptureExclusions === void 0 ? {} : { refreshChangeCaptureExclusions: () => n.refreshChangeCaptureExclusions() },
+		...n.run === void 0 ? {} : { run: ((e) => n.run(e)) },
+		...n.storedTables === void 0 ? {} : { storedTables: () => n.storedTables() }
+	};
+};
+//#endregion
+export { e as UndeclaredTableAccess, t as guardUndeclaredTables };

package/dist/defineExecutor.js

@@ -0,0 +1,4 @@
+//#region src/defineExecutor.ts
+var e = (e, t) => t;
+//#endregion
+export { e as defineExecutor };

package/dist/dependencyGraph.js

@@ -0,0 +1,32 @@
+import { collectSubqueries as e, getRelations as t } from "@voltro/database";
+//#region src/dependencyGraph.ts
+var n = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	return r(e, t), t;
+}, r = (t, n) => {
+	n.add(t.table);
+	for (let e of t.dependentTables ?? []) n.add(e);
+	for (let i of t.joins ?? []) {
+		n.add(i.table);
+		for (let t of e(i.on)) r(t.descriptor, n);
+	}
+	for (let i of [t.predicate, t.having]) if (i) for (let t of e(i)) r(t.descriptor, n);
+	if (t.eager !== void 0 && i(t.table, t.eager, n), t.setOp !== void 0) for (let e of t.setOp.queries) r(e, n);
+	if (t.ctes !== void 0) for (let e of t.ctes) r(e.descriptor, n);
+}, i = (e, n, r) => {
+	let a = t(e);
+	if (a !== void 0) for (let [e, t] of Object.entries(n)) {
+		let n = a[e];
+		if (n === void 0) continue;
+		let o = t === !0 ? {} : t;
+		if (n.kind === "manyToMany") {
+			let e = n.through().tableName, t = n.target().tableName;
+			r.add(e), r.add(t), o.with !== void 0 && i(t, o.with, r);
+		} else {
+			let e = n.target().tableName;
+			r.add(e), o.with !== void 0 && i(e, o.with, r);
+		}
+	}
+};
+//#endregion
+export { n as resolveDependentTables };

package/dist/devices.js

@@ -0,0 +1,228 @@
+import { and as e, eq as t, generateId as n } from "@voltro/database";
+import { createHash as r, randomBytes as i } from "node:crypto";
+//#region src/devices.ts
+var a = "_voltro_devices", o = "actors", s = (e) => r("sha256").update(e, "utf8").digest("hex"), c = (e = "dev_") => {
+	let t = e.replace(/_+$/, "");
+	return {
+		access: `${t}_`,
+		refresh: `${t}r_`,
+		pairing: `${t}p_`
+	};
+}, l = 900, u = 2592e3, d = 600, f = (e) => ({
+	id: e.id,
+	name: e.name,
+	tenantId: e.tenantId,
+	scopes: e.scopes ?? [],
+	generation: e.generation,
+	pairedAt: e.pairedAt,
+	lastSeenAt: e.lastSeenAt,
+	accessExpiresAt: e.accessExpiresAt,
+	revokedAt: e.revokedAt,
+	revokedReason: e.revokedReason,
+	createdAt: e.createdAt,
+	createdBy: e.createdBy,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), p = (e, t = {}) => {
+	let r = c(t.prefix), o = (t.accessTtlSeconds ?? l) * 1e3, p = (t.refreshTtlSeconds ?? u) * 1e3, m = (t.pairingTtlSeconds ?? d) * 1e3, h = (e, t) => `${e}${i(t).toString("base64url")}`, g = async (t, n, i, a, c) => {
+		let l = h(r.access, 30), u = h(r.refresh, 40), d = t.generation + 1, f = a + o, m = a + p;
+		return await e.claim(t.id, n, i, {
+			accessHash: s(l),
+			accessExpiresAt: f,
+			refreshHash: s(u),
+			refreshExpiresAt: m,
+			generation: d,
+			lastSeenAt: a,
+			...c
+		}) ? {
+			deviceId: t.id,
+			accessToken: l,
+			accessExpiresAt: f,
+			refreshToken: u,
+			refreshExpiresAt: m,
+			generation: d
+		} : null;
+	};
+	return {
+		pair: async (t) => {
+			let i = n({
+				kind: "typeid",
+				prefix: "device"
+			}, a), o = h(r.pairing, 12), c = Date.now(), l = c + m, u = t.scopes ?? [];
+			return await e.ensureActor({
+				id: i,
+				displayName: t.name
+			}), await e.insert({
+				id: i,
+				tenantId: t.tenantId,
+				name: t.name,
+				scopes: u,
+				pairingHash: s(o),
+				pairingExpiresAt: l,
+				accessHash: null,
+				accessExpiresAt: null,
+				refreshHash: null,
+				refreshExpiresAt: null,
+				previousRefreshHash: null,
+				generation: 0,
+				pairedAt: null,
+				lastSeenAt: null,
+				revokedAt: null,
+				revokedReason: null,
+				createdBy: t.createdBy ?? null,
+				createdAt: c,
+				...t.metadata == null ? {} : { metadata: t.metadata }
+			}), {
+				id: i,
+				name: t.name,
+				tenantId: t.tenantId,
+				scopes: u,
+				pairingCode: o,
+				pairingExpiresAt: l
+			};
+		},
+		exchange: async (t, n = Date.now()) => {
+			if (!t.startsWith(r.pairing)) return null;
+			let i = s(t), a = await e.findByPairingHash(i);
+			return a === null || a.revokedAt !== null || a.pairedAt !== null || a.pairingExpiresAt === null || a.pairingExpiresAt <= n ? null : g(a, "pairingHash", i, n, {
+				pairingHash: null,
+				pairingExpiresAt: null,
+				pairedAt: n
+			});
+		},
+		rotate: async (t, n = Date.now()) => {
+			if (!t.startsWith(r.refresh)) return null;
+			let i = s(t), a = await e.findByRefreshHash(i);
+			if (a === null) {
+				let t = await e.findByPreviousRefreshHash(i);
+				return t !== null && t.revokedAt === null && await e.patch(t.id, {
+					revokedAt: n,
+					revokedReason: "refresh-replay"
+				}), null;
+			}
+			return a.revokedAt !== null || a.pairedAt === null || a.refreshExpiresAt === null || a.refreshExpiresAt <= n ? null : g(a, "refreshHash", i, n, { previousRefreshHash: i });
+		},
+		resolveAccess: async (t, n = Date.now()) => {
+			let r = await e.findByAccessHash(t);
+			return r === null || r.revokedAt !== null || r.pairedAt === null || r.accessExpiresAt === null || r.accessExpiresAt <= n ? null : {
+				id: r.id,
+				tenantId: r.tenantId,
+				name: r.name,
+				scopes: r.scopes ?? [],
+				generation: r.generation,
+				accessExpiresAt: r.accessExpiresAt,
+				...r.metadata == null ? {} : { metadata: r.metadata }
+			};
+		},
+		revoke: async (t, n, r = Date.now()) => {
+			let i = await e.findById(t);
+			return i === null || i.tenantId !== n ? !1 : (i.revokedAt === null && await e.patch(t, {
+				revokedAt: r,
+				revokedReason: "revoked"
+			}), !0);
+		},
+		list: async (t) => (await e.listByTenant(t)).map(f)
+	};
+}, m = () => {
+	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map(), n = (t) => async (n) => [...e.values()].find((e) => e[t] === n) ?? null;
+	return {
+		actors: t,
+		insert: async (t) => {
+			e.set(t.id, t);
+		},
+		findById: async (t) => e.get(t) ?? null,
+		findByPairingHash: n("pairingHash"),
+		findByAccessHash: n("accessHash"),
+		findByRefreshHash: n("refreshHash"),
+		findByPreviousRefreshHash: n("previousRefreshHash"),
+		listByTenant: async (t) => {
+			let n = [...e.values()], r = 0;
+			for (let e of n) e.tenantId === t && (n[r++] = e);
+			return n.length = r, n;
+		},
+		patch: async (t, n) => {
+			let r = e.get(t);
+			r && e.set(t, {
+				...r,
+				...n
+			});
+		},
+		claim: async (t, n, r, i) => {
+			let a = e.get(t);
+			return !a || a[n] !== r ? !1 : (e.set(t, {
+				...a,
+				...i
+			}), !0);
+		},
+		ensureActor: async (e) => {
+			t.has(e.id) || t.set(e.id, e);
+		}
+	};
+}, h = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : new Date(String(e)).getTime(), g = (e) => ({
+	id: String(e.id),
+	tenantId: String(e.tenantId),
+	name: String(e.name),
+	scopes: e.scopes ?? null,
+	pairingHash: e.pairingHash ?? null,
+	pairingExpiresAt: h(e.pairingExpiresAt),
+	accessHash: e.accessHash ?? null,
+	accessExpiresAt: h(e.accessExpiresAt),
+	refreshHash: e.refreshHash ?? null,
+	refreshExpiresAt: h(e.refreshExpiresAt),
+	previousRefreshHash: e.previousRefreshHash ?? null,
+	generation: Number(e.generation ?? 0),
+	pairedAt: h(e.pairedAt),
+	lastSeenAt: h(e.lastSeenAt),
+	revokedAt: h(e.revokedAt),
+	revokedReason: e.revokedReason ?? null,
+	createdBy: e.createdBy ?? null,
+	createdAt: h(e.createdAt) ?? 0,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), _ = [
+	"pairingExpiresAt",
+	"accessExpiresAt",
+	"refreshExpiresAt",
+	"pairedAt",
+	"lastSeenAt",
+	"revokedAt",
+	"createdAt"
+], v = (e) => {
+	let t = { ...e };
+	for (let e of _) typeof t[e] == "number" && (t[e] = new Date(t[e]));
+	return t;
+}, y = (n) => {
+	let r = async (e) => await n.query({
+		table: a,
+		predicate: e,
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	}), i = async (e) => {
+		let t = await r(e);
+		return t[0] ? g(t[0]) : null;
+	};
+	return {
+		ensureActor: async (e) => {
+			await n.insertIgnore(o, {
+				id: e.id,
+				kind: "serviceAccount",
+				displayName: e.displayName
+			}, { conflictColumns: ["id"] });
+		},
+		insert: async (e) => {
+			await n.insert(a, v(e));
+		},
+		findById: (e) => i(t("id", e)),
+		findByPairingHash: (e) => i(t("pairingHash", e)),
+		findByAccessHash: (e) => i(t("accessHash", e)),
+		findByRefreshHash: (e) => i(t("refreshHash", e)),
+		findByPreviousRefreshHash: (e) => i(t("previousRefreshHash", e)),
+		listByTenant: async (e) => (await r(t("tenantId", e))).map(g),
+		patch: async (e, t) => {
+			await n.update(a, e, v(t));
+		},
+		claim: async (r, i, o, s) => await n.updateMany(a, v(s), { where: e(t("id", r), t(i, o)) }) === 1
+	};
+};
+//#endregion
+export { a as DEVICES_TABLE, y as dataStoreDeviceStore, c as deviceTokenPrefixes, p as makeDeviceService, m as memoryDeviceStore, s as sha256HexOf };

package/dist/devicesWiring.js

@@ -0,0 +1,168 @@
+import { deviceTokenPrefixes as e, sha256HexOf as t } from "./devices.js";
+import { Schema as n } from "effect";
+import { ADMIN_SCOPE as r, DEVICES_MANAGE_SCOPE as i, ScopeError as a, Unauthenticated as o } from "@voltro/protocol";
+import { defineRestRoute as s, requireAnyScope as c } from "@voltro/protocol/rest";
+//#region src/devicesWiring.ts
+var l = (n, r = {}) => {
+	let i = e(r.prefix);
+	return {
+		id: "voltro-device",
+		claimsBearerPrefix: i.access,
+		resolve: async (e) => {
+			let r = e.headers.authorization ?? e.headers.Authorization;
+			if (!r) return { kind: "skip" };
+			let a = /^Bearer\s+(.+)$/i.exec(r.trim());
+			if (!a) return { kind: "skip" };
+			let o = a[1].trim();
+			if (!o.startsWith(i.access)) return { kind: "skip" };
+			let s = await n.resolveAccess(t(o), Date.now());
+			return s === null ? {
+				kind: "failed",
+				reason: "unknown, expired or revoked device token"
+			} : {
+				kind: "matched",
+				subject: {
+					type: "serviceAccount",
+					id: s.id,
+					tenantId: s.tenantId,
+					auditActorId: null,
+					scopes: s.scopes,
+					metadata: {
+						...s.metadata ?? {},
+						provider: "voltro-device",
+						device: {
+							name: s.name,
+							generation: s.generation
+						}
+					}
+				},
+				credentialExpiresAt: s.accessExpiresAt
+			};
+		}
+	};
+}, u = (e) => {
+	let t = e.subject;
+	return {
+		id: t.id ?? null,
+		tenantId: t.tenantId ?? null,
+		scopes: t.scopes ?? []
+	};
+}, d = n.Struct({
+	deviceId: n.String,
+	accessToken: n.String,
+	accessExpiresAt: n.Number,
+	refreshToken: n.String,
+	refreshExpiresAt: n.Number,
+	generation: n.Number
+}), f = (e, t = "/v1/devices") => {
+	let l = n.Struct({
+		id: n.String,
+		name: n.String,
+		tenantId: n.String,
+		scopes: n.Array(n.String),
+		generation: n.Number,
+		pairedAt: n.NullOr(n.Number),
+		lastSeenAt: n.NullOr(n.Number),
+		accessExpiresAt: n.NullOr(n.Number),
+		revokedAt: n.NullOr(n.Number),
+		revokedReason: n.NullOr(n.String),
+		createdAt: n.Number,
+		createdBy: n.NullOr(n.String),
+		metadata: n.optional(n.NullOr(n.Record(n.String, n.Unknown)))
+	}), f = c([r, i]);
+	return [
+		s({
+			method: "POST",
+			path: `${t}/pair`,
+			summary: "Pair a device: create it and return its one-time pairing code.",
+			guards: [f],
+			input: n.Struct({ body: n.Struct({
+				name: n.String,
+				scopes: n.optional(n.Array(n.String)),
+				metadata: n.optional(n.NullOr(n.Record(n.String, n.Unknown)))
+			}) }),
+			output: n.Struct({
+				id: n.String,
+				pairingCode: n.String,
+				pairingExpiresAt: n.Number
+			}),
+			handler: async (t, n) => {
+				let o = t.body, s = u(n);
+				if (s.tenantId === null || s.tenantId === "") throw new a({
+					required: i,
+					message: "a device is paired into the caller's tenant, and this caller has none"
+				});
+				let c = new Set(s.scopes), l = o.scopes ?? [];
+				if (!c.has(r)) {
+					let e = l.filter((e) => !c.has(e));
+					if (e.length > 0) throw new a({
+						required: String(e[0]),
+						message: `cannot pair a device with scopes you do not hold: ${e.join(", ")}`
+					});
+				}
+				let d = await e.pair({
+					tenantId: s.tenantId,
+					name: o.name,
+					scopes: l,
+					createdBy: s.id,
+					...o.metadata === void 0 ? {} : { metadata: o.metadata }
+				});
+				return {
+					id: d.id,
+					pairingCode: d.pairingCode,
+					pairingExpiresAt: d.pairingExpiresAt
+				};
+			}
+		}),
+		s({
+			method: "POST",
+			path: `${t}/exchange`,
+			summary: "Exchange a pairing code for the first access + refresh token pair (once).",
+			input: n.Struct({ body: n.Struct({ pairingCode: n.String }) }),
+			output: d,
+			handler: async (t) => {
+				let n = await e.exchange(t.body.pairingCode);
+				if (n === null) throw new o({ reason: "pairing code unknown, expired or already exchanged" });
+				return n;
+			}
+		}),
+		s({
+			method: "POST",
+			path: `${t}/rotate`,
+			summary: "Rotate: a refresh token for a new access + refresh pair. A replayed refresh token revokes the device.",
+			input: n.Struct({ body: n.Struct({ refreshToken: n.String }) }),
+			output: d,
+			handler: async (t) => {
+				let n = await e.rotate(t.body.refreshToken);
+				if (n === null) throw new o({ reason: "refresh token unknown, expired, revoked or replayed" });
+				return n;
+			}
+		}),
+		s({
+			method: "GET",
+			path: t,
+			summary: "List the caller tenant's devices (no secrets).",
+			guards: [f],
+			input: n.Struct({}),
+			output: n.Struct({ devices: n.Array(l) }),
+			handler: async (t, n) => {
+				let r = u(n).tenantId;
+				return { devices: r === null || r === "" ? [] : [...await e.list(r)] };
+			}
+		}),
+		s({
+			method: "POST",
+			path: `${t}/revoke`,
+			summary: "Revoke a device by id.",
+			guards: [f],
+			input: n.Struct({ body: n.Struct({ id: n.String }) }),
+			output: n.Struct({ ok: n.Boolean }),
+			handler: async (t, n) => {
+				let r = u(n).tenantId;
+				return { ok: r === null || r === "" ? !1 : await e.revoke(t.body.id, r) };
+			}
+		})
+	];
+};
+//#endregion
+export { f as deviceManagementRoutes, l as frameworkDeviceStrategy };

package/dist/dialectReplicationAdapter.js

@@ -0,0 +1,29 @@
+//#region src/dialectReplicationAdapter.ts
+var e = () => {
+	let e = {
+		primary: 0,
+		lagByReplica: /* @__PURE__ */ new Map()
+	};
+	return {
+		adapter: {
+			async capturePrimaryPosition(t) {
+				return String(e.primary);
+			},
+			async probeReplicaPosition(t) {
+				let n = e.lagByReplica.get(t) ?? 0;
+				return String(Math.max(0, e.primary - n));
+			},
+			compare(e, t) {
+				return Number(t) >= Number(e) ? "caught-up" : "behind";
+			}
+		},
+		bumpPrimary() {
+			e.primary += 1;
+		},
+		setLag(t, n) {
+			e.lagByReplica.set(t, n);
+		}
+	};
+};
+//#endregion
+export { e as memoryReplicationAdapter };