@voltro/runtime 0.85.0 → 0.87.0

package/dist/fieldKeyRekey.js

@@ -0,0 +1,286 @@
+import { ENVELOPE_PATTERN as e, cellText as t, declaredEncryptedColumns as n, declaredRenames as r, discoverSealedColumns as i, reasonOf as a } from "./fieldKeyScan.js";
+import { Effect as o } from "effect";
+import { ciphertextKeyId as s, fieldBinding as c, quoteIdent as l } from "@voltro/database";
+import { SqlClient as u } from "effect/sql";
+import { STEP_JOURNAL_BINDING as d, WORKFLOW_JOURNAL_BINDING as f } from "@voltro/workflow";
+//#region src/fieldKeyRekey.ts
+var p = (e) => {
+	let t = e.renames?.get(e.table), n = t?.columns.get(e.column);
+	return {
+		tables: t?.previousTable === void 0 ? [e.table] : [e.table, t.previousTable],
+		columns: n === void 0 ? [e.column] : [e.column, n]
+	};
+}, m = (e) => {
+	let t = p(e);
+	return t.tables.length > 1 || t.columns.length > 1;
+}, h = 32, g = (e, t) => {
+	typeof e == "string" && e !== "" && e.length <= 191 && !e.startsWith("enc:") ? t.add(e) : (typeof e == "number" || typeof e == "bigint") && t.add(String(e));
+}, _ = (e) => {
+	let t = /* @__PURE__ */ new Map(), n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		return t;
+	}
+	let r = (e, n, i) => {
+		if (typeof e == "string") {
+			if (!e.startsWith("enc:")) return;
+			let r = /* @__PURE__ */ new Set();
+			for (let e of i) for (let t of Object.values(e)) g(t, r);
+			t.set(e, {
+				key: n,
+				ids: r
+			});
+		} else if (Array.isArray(e)) for (let t of e) r(t, n, i);
+		else if (typeof e == "object" && e) {
+			let t = e;
+			for (let [e, n] of Object.entries(t)) r(n, e, [t, ...i]);
+		}
+	};
+	return r(n, void 0, []), t;
+}, v = (e, t, n) => {
+	if (!e.startsWith("enc:v2:")) return [void 0];
+	let r = n.rowId === void 0 || n.rowId === null ? void 0 : String(n.rowId);
+	if (e.startsWith("enc:v2:c:")) {
+		let e = p(n), t = [
+			...e.tables.flatMap((t) => e.columns.map((e) => c(t, e))),
+			f,
+			d,
+			...[...n.declared].flatMap(([e, t]) => [...t].map((t) => c(e, t)))
+		];
+		return [...new Map(t.map((e) => [e.column, e])).values()];
+	}
+	let i = [], a = /* @__PURE__ */ new Set(), o = (e, t, n) => {
+		if (n === void 0) return;
+		let r = c(e, t, n);
+		r.row === void 0 || a.has(r.row) || (a.add(r.row), i.push(r));
+	}, s = p(n);
+	for (let e of s.tables) for (let t of s.columns) o(e, t, r);
+	let l = /* @__PURE__ */ new Set();
+	for (let e of t?.ids ?? []) l.add(e);
+	for (let e of Object.values(n.row)) g(e, l);
+	let u = [...l].slice(0, h), m = t?.key ?? n.column;
+	for (let [e, t] of n.declared) if (t.has(m)) for (let t of u) o(e, m, t);
+	return i;
+}, y = (t, n, r) => {
+	let i = n.activeKeyId, a = [...new Set(t.match(e) ?? [])];
+	if (a.length === 0) return {
+		text: t,
+		rekeyed: 0,
+		current: 0,
+		unresolved: 0
+	};
+	let o = _(t), l = t, u = 0, d = 0, f = 0, h = m(r), g = (e) => {
+		if (e === void 0 || !h) return e;
+		let t = p(r);
+		return !t.tables.some((n) => t.columns.some((t) => e.column === `${n}:${t}`)) || e.column === `${r.table}:${r.column}` ? e : e.row === void 0 ? c(r.table, r.column) : c(r.table, r.column, r.rowId);
+	};
+	for (let e of a) {
+		let a = t.split(e).length - 1;
+		if (s(e) === i && !h) {
+			d += a;
+			continue;
+		}
+		let c, p = !1;
+		for (let t of v(e, o.get(e), r)) {
+			let r;
+			try {
+				r = n.decrypt(e, t);
+			} catch {
+				continue;
+			}
+			let a = g(t);
+			if (s(e) === i && a === t) {
+				p = !0;
+				break;
+			}
+			c = n.sealWith(i, r, a);
+			break;
+		}
+		p ? d += a : c === void 0 ? f += a : (l = l.split(e).join(c), u += a);
+	}
+	return {
+		text: l,
+		rekeyed: u,
+		current: d,
+		unresolved: f
+	};
+}, b = (t, n, r) => {
+	let i = _(t), a = 0, o = 0;
+	for (let s of t.match(e) ?? []) v(s, i.get(s), r).some((e) => {
+		try {
+			return n.decrypt(s, e), !0;
+		} catch {
+			return !1;
+		}
+	}) ? a += 1 : o += 1;
+	return {
+		opened: a,
+		unopened: o
+	};
+}, x = 200, S = (e, t, n, r, i) => e === "postgres" ? r`CAST(${r(t)} AS TEXT) = ${i}` : e === "mysql" || e === "mariadb" ? n === "json" ? r`CAST(${r(t)} AS CHAR) = ${i}` : r`CAST(${r(t)} AS BINARY) = CAST(${i} AS BINARY)` : e === "mssql" ? r`CAST(${r(t)} AS VARBINARY(MAX)) = CAST(${i} AS VARBINARY(MAX))` : r`${r(t)} = ${i}`, C = (e, t, s, c = {}) => o.gen(function* () {
+	let l = yield* u.SqlClient, d = n(s), f = r(s), { columns: p, unreadable: m } = yield* i(e, d), h = [...m], g = [];
+	for (let n of p) {
+		if (n.found === 0) continue;
+		let r = yield* w(l, e, t, d, f, n, c.dryRun === !0, c.beforeWrite).pipe(o.catch((e) => o.sync(() => {
+			h.push({
+				table: n.table,
+				column: n.column,
+				reason: a(e)
+			});
+		})));
+		r !== void 0 && (g.push(r), c.onProgress?.(r));
+	}
+	return {
+		active: t.activeKeyId,
+		locations: g,
+		unreadable: h
+	};
+}), w = (e, n, r, i, a, s, c, u) => o.gen(function* () {
+	let d = {
+		cells: 0,
+		rekeyed: 0,
+		current: 0,
+		unresolved: 0,
+		changedMeanwhile: 0,
+		unaddressable: 0
+	}, f = s.key, p = n === "postgres" && s.type === "json" ? (yield* e.unsafe(`SELECT data_type AS t FROM information_schema.columns WHERE table_name = '${s.table.replaceAll("'", "''")}' AND column_name = '${s.column.replaceAll("'", "''")}' AND table_schema = current_schema()`).unprepared)[0]?.t : void 0, m = (e) => typeof e == "number" || typeof e == "bigint" ? String(e) : `'${String(e).replaceAll("'", "''")}'`, h = (r, i, a) => o.gen(function* () {
+		u !== void 0 && (yield* u({
+			table: s.table,
+			column: s.column,
+			rowId: r
+		}));
+		let o = p === "jsonb" ? e`CAST(${a} AS JSONB)` : p === "json" ? e`CAST(${a} AS JSON)` : e`${a}`;
+		yield* e`UPDATE ${e(s.table)} SET ${e(s.column)} = ${o} WHERE ${e(f)} = ${r} AND ${S(n, s.column, s.type, e, i)}`;
+		let c = (yield* e.unsafe(`SELECT ${s.asText} AS v FROM ${l(s.table, n)} WHERE ${l(f, n)} = ${m(r)}`).unprepared)[0]?.v;
+		return t(c) === a;
+	}), g = (r) => o.gen(function* () {
+		if (u !== void 0) for (let e of r) yield* u({
+			table: s.table,
+			column: s.column,
+			rowId: e.rowId
+		});
+		let i = (t) => p === "jsonb" ? e`CAST(${t} AS JSONB)` : p === "json" ? e`CAST(${t} AS JSON)` : e`${t}`, a = e.join(" ", !1)(r.map((t) => e`WHEN ${t.rowId} THEN ${i(t.next)}`)), o = e.join(" ", !1)(r.map((t) => e`WHEN ${e(f)} = ${t.rowId} AND ${S(n, s.column, s.type, e, t.text)} THEN 1`));
+		yield* e`UPDATE ${e(s.table)} SET ${e(s.column)} = CASE ${e(f)} ${a} END WHERE ${e(f)} IN ${e.in(r.map((e) => e.rowId))} AND (CASE ${o} ELSE 0 END) = 1`;
+		let c = yield* e.unsafe(`SELECT ${s.asText} AS v, ${l(f, n)} AS k FROM ${l(s.table, n)} WHERE ${l(f, n)} IN (${r.map((e) => m(e.rowId)).join(", ")})`).unprepared, d = new Map(c.map((e) => [String(e.k), t(e.v)]));
+		return r.map((e) => d.get(String(e.rowId)) === e.next);
+	}), _;
+	for (;;) {
+		let n = yield* e.unsafe(s.page(_, x)).unprepared, l = [];
+		for (let e of n) {
+			let n = t(e.__v), { __v: o, __k: u, ...p } = e, m = y(n, r, {
+				table: s.table,
+				column: s.column,
+				rowId: u,
+				row: p,
+				declared: i,
+				renames: a
+			});
+			d.cells += 1, d.current += m.current, d.unresolved += m.unresolved, m.rekeyed !== 0 && (f === void 0 ? d.unaddressable += m.rekeyed : c ? d.rekeyed += m.rekeyed : l.push({
+				rowId: u,
+				text: n,
+				next: m.text,
+				rekeyed: m.rekeyed
+			}));
+		}
+		if (l.length > 0) {
+			let e = yield* g(l).pipe(o.catch(() => o.forEach(l, (e) => h(e.rowId, e.text, e.next))));
+			l.forEach((t, n) => {
+				e[n] === !0 ? d.rekeyed += t.rekeyed : d.changedMeanwhile += 1;
+			});
+		}
+		if (f === void 0 || n.length < x) break;
+		_ = n[n.length - 1].__k;
+	}
+	return {
+		table: s.table,
+		column: s.column,
+		...d
+	};
+}), T = (e, a, s) => o.gen(function* () {
+	let o = yield* u.SqlClient, c = n(s), l = r(s), { columns: d, unreadable: f } = yield* i(e, c), p = [], m = 0;
+	for (let e of d) {
+		if (e.found === 0) continue;
+		let n = 0, r;
+		for (;;) {
+			let i = yield* o.unsafe(e.page(r, x)).unprepared;
+			for (let r of i) {
+				let { __v: i, __k: o, ...s } = r, u = b(t(i), a, {
+					table: e.table,
+					column: e.column,
+					rowId: o,
+					row: s,
+					declared: c,
+					renames: l
+				});
+				m += u.opened, n += u.unopened;
+			}
+			if (e.key === void 0 || i.length < x) break;
+			r = i[i.length - 1].__k;
+		}
+		n > 0 && p.push({
+			table: e.table,
+			column: e.column,
+			count: n
+		});
+	}
+	return {
+		opened: m,
+		unopened: p,
+		unreadable: f
+	};
+}), E = (t) => {
+	let n = t.match(e);
+	return n !== null && n.length === 1 && n[0] === t;
+}, D = (a, s, c) => o.gen(function* () {
+	let o = yield* u.SqlClient, d = n(c), f = r(c), { columns: p, unreadable: m, tables: h } = yield* i(a, d), g = [], _ = [], v = (e, t) => s !== void 0 && b(e, s, t).unopened === 0;
+	for (let n of p) {
+		if (n.found === 0) continue;
+		let r = 0, i = 0, c;
+		for (;;) {
+			let l = yield* o.unsafe(n.page(c, x)).unprepared;
+			for (let c of l) {
+				let l = t(c.__v), { __v: u, __k: p, ...m } = c, h = {
+					table: n.table,
+					column: n.column,
+					rowId: p,
+					row: m,
+					declared: d,
+					renames: f
+				};
+				if (E(l)) {
+					if (v(l, h)) continue;
+					if (n.key === void 0) {
+						i += 1;
+						continue;
+					}
+					yield* o`UPDATE ${o(n.table)} SET ${o(n.column)} = NULL WHERE ${o(n.key)} = ${p} AND ${S(a, n.column, n.type, o, l)}`, r += 1;
+				} else i += s === void 0 ? (l.match(e) ?? []).length : b(l, s, h).unopened;
+			}
+			if (n.key === void 0 || l.length < x) break;
+			c = l[l.length - 1].__k;
+		}
+		r > 0 && g.push({
+			table: n.table,
+			column: n.column,
+			count: r
+		}), i > 0 && _.push({
+			table: n.table,
+			column: n.column,
+			count: i
+		});
+	}
+	let y = new Set(s?.keyIds ?? []), C = (e) => l(e, a), w = [];
+	if (h.has("_voltro_field_keys")) {
+		w = (yield* o.unsafe(`SELECT ${C("keyId")} AS k FROM ${C("_voltro_field_keys")}`).unprepared).map((e) => String(e.k)).filter((e) => !y.has(e));
+		for (let e of w) yield* o`DELETE FROM ${o("_voltro_field_keys")} WHERE ${o("keyId")} = ${e}`;
+	}
+	return h.has("_voltro_field_key_holders") && (yield* o.unsafe(`DELETE FROM ${C("_voltro_field_key_holders")}`).unprepared), {
+		nulled: g,
+		unreadable: _,
+		forgottenKeys: w,
+		unreadableColumns: m
+	};
+});
+//#endregion
+export { D as nullUnreadableSealedValues, b as openCell, y as rekeyCell, C as rekeySealedValues, T as verifySealedValues };

package/dist/fieldKeyScan.js

@@ -0,0 +1,136 @@
+import { FIELD_KEYS_TABLE as e, FIELD_KEY_HOLDERS_TABLE as t } from "./fieldKeyRegistry.js";
+import { Effect as n } from "effect";
+import { ciphertextKeyId as r, encryptedColumnsOf as i, quoteIdent as a } from "@voltro/database";
+import { SqlClient as o } from "effect/sql";
+import { introspectSchema as s } from "@voltro/database/sql";
+//#region src/fieldKeyScan.ts
+var c = /enc:v[12]:[A-Za-z0-9+/=:_-]+/g, l = 500, u = /* @__PURE__ */ new Set(["text", "json"]), d = (e, t, n) => e === "postgres" ? `CAST(${t} AS TEXT)` : n === "json" && (e === "mysql" || e === "mariadb") ? `CAST(${t} AS CHAR)` : t, f = (e) => {
+	let t = e instanceof Error ? e.message : String(e);
+	for (let n = e?.cause; n instanceof Error; n = n.cause) t = n.message;
+	return t;
+}, p = (e) => typeof e == "number" || typeof e == "bigint" ? String(e) : `'${String(e).replaceAll("'", "''")}'`, m = (e) => typeof e == "string" ? e : e instanceof Uint8Array ? new TextDecoder().decode(e) : e == null ? "" : JSON.stringify(e), h = (e, t) => n.gen(function* () {
+	let r = yield* o.SqlClient, i = (t) => a(t, e), c = yield* s(r), l = [], m = [];
+	for (let a of c.tables) {
+		if (a.name === "_voltro_field_keys" || a.name === "_voltro_field_key_holders") continue;
+		let o = a.indexes.find((e) => e.name === `${a.name}_pkey`)?.columns, s = o?.length === 1 ? o[0] : void 0;
+		for (let o of a.columns) {
+			let c = t.get(a.name)?.has(o.name) === !0;
+			if (!c && !u.has(o.type)) continue;
+			let h = d(e, `${i("__t")}.${i(o.name)}`, o.type), g = `${h} LIKE '%enc:v%'`, _ = `${i(a.name)} ${i("__t")}`, v = yield* r.unsafe(`SELECT COUNT(*) AS n FROM ${_} WHERE ${g}`).unprepared.pipe(n.map((e) => Number(e[0]?.n ?? 0)), n.catch((e) => n.sync(() => {
+				m.push({
+					table: a.name,
+					column: o.name,
+					reason: f(e)
+				});
+			})));
+			v === void 0 || v === 0 && !c || l.push({
+				table: a.name,
+				column: o.name,
+				type: o.type,
+				declared: c,
+				key: s,
+				found: v,
+				asText: d(e, i(o.name), o.type),
+				page: (t, n) => {
+					if (s === void 0) return `SELECT ${h} AS ${i("__v")}, ${i("__t")}.* FROM ${_} WHERE ${g}`;
+					let r = `${i("__t")}.${i(s)} AS ${i("__k")}, ${h} AS ${i("__v")}, ${i("__t")}.*`, a = `WHERE ${g}${t === void 0 ? "" : ` AND ${i("__t")}.${i(s)} > ${p(t)}`} ORDER BY ${i("__t")}.${i(s)}`;
+					return e === "mssql" ? `SELECT TOP ${n} ${r} FROM ${_} ${a}` : `SELECT ${r} FROM ${_} ${a} LIMIT ${n}`;
+				}
+			});
+		}
+	}
+	return {
+		columns: l,
+		unreadable: m,
+		tables: new Set(c.tables.map((e) => e.name))
+	};
+}), g = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = n;
+		if (typeof e != "object" || !e || typeof e.fields != "object" || e.tableName === void 0) continue;
+		let r = i(e);
+		r.length > 0 && t.set(e.tableName, new Set(r));
+	}
+	return t;
+}, _ = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = n;
+		if (typeof e != "object" || !e || typeof e.fields != "object" || e.tableName === void 0) continue;
+		let r = /* @__PURE__ */ new Map();
+		for (let t of i(e)) {
+			let n = e.fields[t]?.renamedFrom;
+			n !== void 0 && r.set(t, n);
+		}
+		(e.previousTableName !== void 0 || r.size > 0) && t.set(e.tableName, {
+			...e.previousTableName === void 0 ? {} : { previousTable: e.previousTableName },
+			columns: r
+		});
+	}
+	return t;
+}, v = (e, t, n = 1) => {
+	e[t] = (e[t] ?? 0) + n;
+}, y = (i, s) => n.gen(function* () {
+	let u = yield* o.SqlClient, d = (e) => a(e, i), p = (e) => u.unsafe(e).unprepared, { columns: _, unreadable: y, tables: b } = yield* h(i, g(s)), x = [...y], S = [];
+	for (let e of _) {
+		let t = yield* n.gen(function* () {
+			let t = e.declared ? Number((yield* p(`SELECT COUNT(*) AS n FROM ${d(e.table)} WHERE ${d(e.column)} IS NOT NULL AND ${e.asText} NOT LIKE 'enc:v%'`))[0]?.n ?? 0) : 0, n = {}, i = 0, a = 0, o = (e) => {
+				let t = m(e).match(c) ?? [];
+				t.length > 0 && (a += 1);
+				for (let e of t) {
+					let t = r(e);
+					t === void 0 ? i += 1 : v(n, t);
+				}
+			};
+			if (e.found > 0) {
+				let t;
+				for (;;) {
+					let n = yield* p(e.page(t, l));
+					for (let e of n) o(e.__v);
+					if (e.key === void 0 || n.length < l) break;
+					t = n[n.length - 1].__k;
+				}
+			}
+			return {
+				table: e.table,
+				column: e.column,
+				declared: e.declared,
+				cells: a,
+				byKey: n,
+				unnamed: i,
+				plaintext: t
+			};
+		}).pipe(n.catch((t) => n.sync(() => {
+			x.push({
+				table: e.table,
+				column: e.column,
+				reason: f(t)
+			});
+		})));
+		t !== void 0 && S.push(t);
+	}
+	let C = (e) => e == null ? null : e instanceof Date ? e.toISOString() : String(e), w = b.has("_voltro_field_keys") ? (yield* p(`SELECT ${d("keyId")} AS k, ${d("state")} AS s, ${d("activatedAt")} AS a, ${d("requestedAt")} AS r FROM ${d(e)}`)).map((e) => ({
+		keyId: String(e.k),
+		state: String(e.s),
+		activatedAt: C(e.a),
+		requestedAt: C(e.r)
+	})).sort((e, t) => e.keyId.localeCompare(t.keyId)) : [], T = b.has("_voltro_field_key_holders") ? (yield* p(`SELECT ${d("holderId")} AS h, ${d("keyIds")} AS k, ${d("activeKeyId")} AS a, ${d("expiresAt")} AS e FROM ${d(t)}`)).map((e) => ({
+		holderId: String(e.h),
+		keyIds: String(e.k).split(","),
+		activeKeyId: String(e.a),
+		expiresAt: C(e.e) ?? ""
+	})).sort((e, t) => e.holderId.localeCompare(t.holderId)) : [], E = {};
+	for (let e of S) for (let [t, n] of Object.entries(e.byKey)) v(E, t, n);
+	return S.sort((e, t) => e.table.localeCompare(t.table) || e.column.localeCompare(t.column)), {
+		keys: w,
+		holders: T,
+		locations: S,
+		totals: E,
+		unreadable: x,
+		unnamed: S.reduce((e, t) => e + t.unnamed, 0),
+		plaintext: S.reduce((e, t) => e + t.plaintext, 0)
+	};
+});
+//#endregion
+export { c as ENVELOPE_PATTERN, m as cellText, g as declaredEncryptedColumns, _ as declaredRenames, h as discoverSealedColumns, y as fieldKeyStatus, f as reasonOf };

package/dist/fieldKeyring.js

@@ -0,0 +1,77 @@
+import { FieldKeyringConfigError as e, deriveKey as t, fieldKeyIdOf as n } from "./fieldCipher.js";
+//#region src/fieldKeyring.ts
+var r = "VOLTRO_FIELD_ENCRYPTION_KEYS", i = "VOLTRO_FIELD_ENCRYPTION_ACTIVE", a = "VOLTRO_FIELD_ENCRYPTION_KEY", o = "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS", s = [
+	r,
+	i,
+	a,
+	o
+], c = (e) => e !== void 0 && e.trim() !== "", l = (t) => {
+	let n = t.trim();
+	if (n.startsWith("{")) {
+		let t;
+		try {
+			t = JSON.parse(n);
+		} catch {
+			throw new e(`${r} starts like JSON but is not valid JSON`);
+		}
+		if (typeof t != "object" || !t || Array.isArray(t)) throw new e(`${r} as JSON must be an object of id → key`);
+		return Object.entries(t).map(([t, n]) => {
+			if (typeof n != "string") throw new e(`${r}: key "${t}" is not a string`);
+			return {
+				id: t,
+				secret: n
+			};
+		});
+	}
+	return n.split(",").map((e) => e.trim()).filter((e) => e !== "").map((t) => {
+		let n = t.indexOf("=");
+		if (n <= 0) throw new e(`${r}: every entry is id=key, and one is not`);
+		return {
+			id: t.slice(0, n).trim(),
+			secret: t.slice(n + 1).trim()
+		};
+	});
+}, u = (e, n) => t(e).equals(t(n)), d = (t) => {
+	let s = t[r], d = t[a], p = t[o], m = t[i]?.trim();
+	if (c(s)) {
+		let t = l(s);
+		for (let [n, i] of [[a, d], [o, p]]) if (c(i) && !t.some((e) => u(e.secret, i))) throw new e(`${n} is set beside ${r} but is not one of its keys — put it into ${r} or remove it`);
+		if (t.length === 0) throw new e(`${r} is set but holds no key`);
+		let n = c(d) ? t.find((e) => u(e.secret, d))?.id : void 0, h = c(m) ? m : t.length === 1 ? t[0].id : n;
+		if (h === void 0) throw new e(`${r} holds ${t.length} keys: name the one new values are sealed under in ${i}`);
+		return f({
+			active: h,
+			keys: t
+		}), {
+			active: h,
+			keys: t
+		};
+	}
+	if (!c(d)) {
+		if (c(p)) throw new e(`${o} is set without ${a}`);
+		return;
+	}
+	if (c(p) && u(d, p)) throw new e(`${a} and ${o} are the same key — a rotation needs a NEW key in ${a}`);
+	let h = [{
+		id: n(d),
+		secret: d
+	}, ...c(p) ? [{
+		id: n(p),
+		secret: p
+	}] : []], g = {
+		active: h[0].id,
+		keys: h
+	};
+	return f(g), g;
+}, f = (t) => {
+	let n = /* @__PURE__ */ new Set();
+	for (let r of t.keys) {
+		if (!/^[a-z0-9][a-z0-9-]{0,15}$/.test(r.id)) throw new e(`field encryption: "${r.id}" is not a key id — use a short lowercase slug (letters, digits, "-", at most 16)`);
+		if (n.has(r.id)) throw new e(`field encryption: key id "${r.id}" is configured twice`);
+		n.add(r.id);
+	}
+	for (let n = 0; n < t.keys.length; n++) for (let r = n + 1; r < t.keys.length; r++) if (u(t.keys[n].secret, t.keys[r].secret)) throw new e(`field encryption: keys "${t.keys[n].id}" and "${t.keys[r].id}" are the same key — a rotation needs a NEW key, and two ids for one key make every count per key wrong`);
+	if (!n.has(t.active)) throw new e(`field encryption: the active key "${t.active}" is not one of the configured keys (${[...n].join(", ")})`);
+};
+//#endregion
+export { i as FIELD_ENCRYPTION_ACTIVE_ENV, r as FIELD_ENCRYPTION_KEYS_ENV, a as FIELD_ENCRYPTION_KEY_ENV, o as FIELD_ENCRYPTION_PREVIOUS_KEY_ENV, s as FIELD_KEYRING_ENV_NAMES, d as resolveFieldKeyring };

package/dist/fingerprint.js

@@ -0,0 +1,21 @@
+import { createHash as e } from "node:crypto";
+//#region src/fingerprint.ts
+var t = (e) => {
+	if (e == null) return null;
+	if (Array.isArray(e)) return e.map(t);
+	if (typeof e == "object") {
+		let n = e, r = Object.keys(n).sort(), i = {};
+		for (let e of r) i[e] = t(n[e]);
+		return i;
+	}
+	return e;
+}, n = (n, r, i) => {
+	let a = t({
+		table: n,
+		predicate: r,
+		indexHint: i ?? null
+	});
+	return e("sha256").update(JSON.stringify(a)).digest("hex").slice(0, 16);
+};
+//#endregion
+export { t as canonicalize, n as fingerprintFor };

package/dist/finops.js

@@ -0,0 +1,42 @@
+import { Context as e, Effect as t } from "effect";
+//#region src/finops.ts
+var n = /* @__PURE__ */ new Set([
+	"info",
+	"warn",
+	"critical"
+]), r = /* @__PURE__ */ new Set(["observe", "suspend"]), i = (e, t) => /* @__PURE__ */ Error(`defineCostBudget(${JSON.stringify(e)}): ${t}`), a = (e) => {
+	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
+	if (t === null) return null;
+	let n = Number(t[1]);
+	if (!(Number.isFinite(n) && n > 0)) return null;
+	let r = t[2];
+	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
+}, o = (e) => {
+	let t = e.name;
+	if (typeof t != "string" || t.length === 0) throw Error("defineCostBudget: a non-empty `name` is required");
+	if (!(typeof e.limit == "number" && Number.isFinite(e.limit) && e.limit > 0)) throw i(t, "a positive, finite `limit` is required");
+	if (e.unit !== void 0 && (typeof e.unit != "string" || e.unit.length === 0)) throw i(t, "unit, when present, must be a non-empty string");
+	let o = e.warnAt ?? .8;
+	if (!(typeof o == "number" && o >= 0 && o <= 1)) throw i(t, "warnAt, when present, must be in [0, 1]");
+	let s = null;
+	if (e.window !== void 0 && (s = a(e.window), s === null)) throw i(t, `window must be an interval like '1h' / '24h' (got ${JSON.stringify(e.window)})`);
+	let c = e.severity ?? "warn";
+	if (!n.has(c)) throw i(t, `severity must be one of info | warn | critical (got ${JSON.stringify(c)})`);
+	let l = e.onExceeded ?? "observe";
+	if (!r.has(l)) throw i(t, `onExceeded must be observe | suspend (got ${JSON.stringify(e.onExceeded)})`);
+	return {
+		_voltroCostBudget: !0,
+		name: t,
+		limit: e.limit,
+		unit: e.unit ?? null,
+		warnAt: o,
+		windowMs: s,
+		severity: c,
+		onExceeded: l,
+		...e.description === void 0 ? {} : { description: e.description }
+	};
+}, s = (e) => typeof e == "object" && !!e && e._voltroCostBudget === !0, c = class extends e.Service()("@voltro/CostRegistry") {}, l = (e, n) => t.gen(function* () {
+	return (yield* c).budget(e.name, n);
+});
+//#endregion
+export { c as CostRegistry, o as defineCostBudget, s as isCostBudgetDefinition, l as useCostBudget };