@voltro/runtime 0.85.0 → 0.87.0

package/dist/schemaRegistry.js

@@ -0,0 +1,65 @@
+//#region src/schemaRegistry.ts
+var e = "voltro/audit", t = "voltro/softDelete", n = "voltro/expires", r = "voltro/tenant", i = "voltro/localFirst", a = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = /* @__PURE__ */ new Set();
+		for (let t of n.appliedMixins ?? []) t.id !== void 0 && e.add(t.id);
+		let r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s, c = /* @__PURE__ */ new Set(), l = /* @__PURE__ */ new Set(), u = /* @__PURE__ */ new Set(), d;
+		for (let [e, t] of Object.entries(n.fields)) t.unique && r.add(e), t.type === "id" && (r.add(e), t.idScheme !== void 0 && (d = t.idScheme)), t.defaultFactory !== void 0 && i.set(e, t.defaultFactory), t.computed !== void 0 && a.set(e, t.computed), t.onUpdate !== void 0 && o.set(e, t.onUpdate), t.versionColumn === !0 && (s = e), t.generatedAs !== void 0 && c.add(e), t.crdtManaged === !0 && l.add(e), t.crdtSealed === !0 && u.add(e);
+		let f = n.appliedIndexes ?? [];
+		for (let e of f) {
+			let t = e.fields[0];
+			t !== void 0 && r.add(t);
+		}
+		let p = {
+			tableName: n.tableName,
+			mixinIds: e,
+			fields: new Set(Object.keys(n.fields)),
+			indexedFields: r,
+			compositeIndexes: f.map((e) => ({
+				name: e.name,
+				fields: [...e.fields]
+			})),
+			defaultFactories: i,
+			computedFields: a,
+			...o.size > 0 ? { onUpdateFields: o } : {},
+			...s === void 0 ? {} : { versionColumn: s },
+			generatedColumns: c,
+			crdtColumns: l,
+			sealedColumns: u,
+			...d === void 0 ? {} : { idScheme: d },
+			declaredPrimaryKey: [...n.appliedPrimaryKey ?? []],
+			...n.insertSchema === void 0 ? {} : { insertSchema: n.insertSchema },
+			...n.validatePatchSchema === void 0 ? {} : { validatePatchSchema: n.validatePatchSchema }
+		};
+		t.set(n.tableName, p);
+	}
+	return {
+		tables: t,
+		hasMixin: (e, n) => t.get(e)?.mixinIds.has(n) ?? !1,
+		hasAudit: (e) => t.get(e)?.mixinIds.has("voltro/audit") ?? !1,
+		hasSoftDelete: (e) => t.get(e)?.mixinIds.has("voltro/softDelete") ?? !1,
+		hasExpires: (e) => t.get(e)?.mixinIds.has("voltro/expires") ?? !1,
+		hasTenant: (e) => t.get(e)?.mixinIds.has("voltro/tenant") ?? !1,
+		hasLocalFirst: (e) => t.get(e)?.mixinIds.has("voltro/localFirst") ?? !1,
+		hasField: (e, n) => t.get(e)?.fields.has(n) ?? !1,
+		anyFieldIndexed: (e, n) => {
+			let r = t.get(e);
+			if (r === void 0) return !1;
+			for (let e of n) if (r.indexedFields.has(e)) return !0;
+			return !1;
+		},
+		idScheme: (e) => t.get(e)?.idScheme,
+		declaredPrimaryKey: (e) => t.get(e)?.declaredPrimaryKey ?? c,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? o,
+		computedFields: (e) => t.get(e)?.computedFields ?? s,
+		versionColumn: (e) => t.get(e)?.versionColumn,
+		generatedColumns: (e) => t.get(e)?.generatedColumns ?? l,
+		crdtColumns: (e) => t.get(e)?.crdtColumns ?? u,
+		sealedColumns: (e) => t.get(e)?.sealedColumns ?? u,
+		insertSchema: (e) => t.get(e)?.insertSchema,
+		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
+	};
+}, o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = [], l = /* @__PURE__ */ new Set(), u = /* @__PURE__ */ new Set(), d = a([]);
+//#endregion
+export { e as VOLTRO_AUDIT_MIXIN_ID, n as VOLTRO_EXPIRES_MIXIN_ID, i as VOLTRO_LOCAL_FIRST_MIXIN_ID, t as VOLTRO_SOFT_DELETE_MIXIN_ID, r as VOLTRO_TENANT_MIXIN_ID, d as emptySchemaRegistry, a as makeSchemaRegistry };

package/dist/secretsResolver.js

@@ -0,0 +1,35 @@
+//#region src/secretsResolver.ts
+var e = { get: (e) => Promise.resolve(process.env[e]) }, t = e, n = (e) => {
+	t = e;
+}, r = () => {
+	t = e;
+}, i = async (e) => await t.get(e) ?? process.env[e], a = (e) => process.env[e], o = (e, t = 6e4, n = () => Date.now()) => {
+	let r = /* @__PURE__ */ new Map();
+	return { get: async (i) => {
+		let a = r.get(i);
+		if (a && n() - a.at < t) return a.value;
+		let o = await e.get(i);
+		return r.set(i, {
+			value: o,
+			at: n()
+		}), o;
+	} };
+}, s = (e) => {
+	let t = {
+		accept: "application/json",
+		...e.headers ?? {}
+	};
+	if (e.perKey) return o({ get: async (n) => {
+		let r = await fetch(`${e.url.replace(/\/$/, "")}/${encodeURIComponent(n)}`, { headers: t });
+		if (!r.ok) return;
+		let i = await r.json();
+		return typeof i.value == "string" ? i.value : void 0;
+	} }, e.ttlMs);
+	let n, r = 0, i = e.ttlMs ?? 6e4, a = () => (n !== void 0 && Date.now() - r < i || (r = Date.now(), n = fetch(e.url, { headers: t }).then((e) => e.ok ? e.json() : {}).catch(() => ({}))), n);
+	return { get: async (e) => {
+		let t = (await a())[e];
+		return typeof t == "string" ? t : void 0;
+	} };
+}, c = (t) => t === void 0 || t === "env" || typeof t == "object" && t.kind === "env" ? e : t.kind === "custom" ? t.backend : t.kind === "http" ? s(t) : e;
+//#endregion
+export { o as cachedBackend, e as envSecretsBackend, s as httpSecretsBackend, r as resetSecretsBackend, i as resolveSecret, a as resolveSecretSync, c as resolveSecretsBackend, n as setSecretsBackend };

package/dist/securityHeaders.js

@@ -0,0 +1,33 @@
+//#region src/securityHeaders.ts
+var e = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'", t = "frame-ancestors 'none'; base-uri 'none'; object-src 'none'", n = "max-age=15552000; includeSubDomains", r = /* @__PURE__ */ new Set(["no-referrer"]), i = (e) => {
+	if (e === !1) return !0;
+	let t = e.split(",").map((e) => e.trim().toLowerCase()).filter((e) => e !== ""), n = t[t.length - 1];
+	return n === void 0 || !r.has(n);
+}, a = (e) => {
+	let t = e?.trim().toLowerCase();
+	return t === "off" || t === "default" || t === "strict" ? t : void 0;
+}, o = (e) => {
+	if (e === void 0) return;
+	let t = e.trim();
+	if (t !== "") return t.toLowerCase() !== "off" && t;
+}, s = (e, t = process.env) => {
+	let n = e?.mode ?? a(t.VOLTRO_SECURITY_HEADERS) ?? "default", r = e?.csp ?? o(t.VOLTRO_CSP) ?? "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'";
+	return {
+		mode: n,
+		csp: r,
+		cspHtml: e?.cspHtml ?? o(t.VOLTRO_CSP_HTML) ?? (n === "strict" ? r : "frame-ancestors 'none'; base-uri 'none'; object-src 'none'"),
+		hsts: e?.hsts ?? o(t.VOLTRO_HSTS) ?? "max-age=15552000; includeSubDomains",
+		frameOptions: e?.frameOptions ?? "DENY",
+		referrerPolicy: e?.referrerPolicy ?? "strict-origin-when-cross-origin",
+		contentTypeOptions: e?.contentTypeOptions ?? "nosniff",
+		extra: e?.extra ?? {}
+	};
+}, c = (e, t) => {
+	if (e.mode === "off") return {};
+	let n = (t.contentType ?? "").toLowerCase().includes("text/html") ? e.cspHtml : e.csp, r = {};
+	n !== !1 && (r["content-security-policy"] = n), e.frameOptions !== !1 && (r["x-frame-options"] = e.frameOptions), e.referrerPolicy !== !1 && (r["referrer-policy"] = e.referrerPolicy), e.contentTypeOptions !== !1 && (r["x-content-type-options"] = e.contentTypeOptions), e.hsts !== !1 && t.https && (r["strict-transport-security"] = e.hsts);
+	for (let [t, n] of Object.entries(e.extra)) r[t.toLowerCase()] = n;
+	return r;
+};
+//#endregion
+export { e as API_CSP, n as DEFAULT_HSTS, t as HTML_CSP, r as ORIGIN_NULLING_REFERRER_POLICIES, i as preservesSameOriginHeader, s as resolveSecurityHeaders, c as securityHeadersFor };

package/dist/servePipeline.js

@@ -0,0 +1,374 @@
+import { cachedComputedCall as e, computedCacheKey as t, currentQueryDependencies as n, enterQueryDependencies as r } from "./computedQueryCache.js";
+import { enterReadRecording as i } from "./readRecorder.js";
+import { getRowFilter as a, makeDefaultRefilter as o, resolveRowFilterScope as s } from "./rowFilter.js";
+import { isComputedQuery as c } from "./computedQuery.js";
+import { TX_READ_VERSIONS_KEY as l, isTransactionReadConflict as u } from "./storeMiddleware.js";
+import { evaluateTouchedRules as d, makeRuleCapture as f } from "./businessRules.js";
+import { enforceApproval as p } from "./approvals.js";
+import { observeApiRoleEffect as m } from "./apiRoleWorkloadMetrics.js";
+import { Cause as h, Effect as g, Exit as _, Option as v } from "effect";
+import { isTransientContention as y } from "@voltro/database";
+import { SubjectService as b, checkGuardsEffect as x, currentSubjectAuthority as S, recheckGuardsEffect as C } from "@voltro/protocol";
+import { createLogger as w } from "@voltro/logger";
+//#region src/servePipeline.ts
+var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
+	if (_.isSuccess(e)) return e.value;
+	let t = h.findErrorOption(e.cause);
+	throw v.isSome(t) ? t.value : h.squash(e.cause);
+}), E = (e) => T(e), D = (e, t) => e.pipe(g.provideService(b, t)), O = async (e, t, n, r) => {
+	let i = await g.runPromise(x(t, e.guards, n, {
+		defaultDeny: r === !0,
+		procedure: e.name
+	}));
+	if (i) throw i;
+}, k = async (e, t, n, r) => {
+	e.requiresApproval !== void 0 && await p({
+		procedure: e.name,
+		kind: t,
+		policy: e.requiresApproval,
+		subject: n.subject,
+		input: r,
+		traceId: n.traceId
+	});
+}, A = w({ scope: "voltro:rpc" }), j = async (e) => {
+	if (a() === void 0) return e;
+	let t = await E(s(e.subject, (e) => {
+		A.error("row filter failed to load", {}, e instanceof Error ? e : Error(String(e)));
+	}));
+	return {
+		...e,
+		rowFilter: t
+	};
+}, M = (e) => ({
+	...e.surface === void 0 ? {} : { surface: e.surface },
+	...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
+	...e.remoteAddr === void 0 ? {} : { remoteAddr: e.remoteAddr }
+}), N = (e) => {
+	let t = e.descriptor.target;
+	if (t == null) return [];
+	let n = Array.isArray(t) ? t : [t], r = /* @__PURE__ */ new Set();
+	for (let e of n) {
+		let t = e.table;
+		typeof t == "string" && t.length > 0 && r.add(t);
+	}
+	return [...r];
+}, P = async (e) => {
+	let { store: t, target: n, procedure: r, input: i, output: a } = e;
+	if (n == null) return;
+	let o = Array.isArray(n) ? n : [n];
+	for (let e of o) {
+		let n = e.relations;
+		if (n !== void 0) for (let [o, s] of Object.entries(n)) {
+			let n = s.junction, c = i?.[o];
+			if (c === void 0) continue;
+			if (!Array.isArray(c)) throw Error(`${r}: declared relation '${o}' → '${n}' expects an ARRAY of target ids in input.${o}, got ${typeof c}. Omit the field to leave the links untouched; send [] to clear them.`);
+			let l = a?.id ?? i?.id;
+			if (typeof l != "string" || l.length === 0) throw Error(`${r}: declared relation '${o}' → '${n}' needs the written row's id — neither output.id nor input.id is a string. Return the row (or its id) from the executor.`);
+			let u = t.relationLinks(n, e.table, l), d = u.columns;
+			if (d.anchorColumn !== s.anchorColumn || d.targetColumn !== s.targetColumn) throw Error(`${r}: declared relation '${o}' → '${n}' names columns the junction does not have. Declared { anchorColumn: '${s.anchorColumn}', targetColumn: '${s.targetColumn}' }; '${n}' resolves to { anchorColumn: '${d.anchorColumn}', targetColumn: '${d.targetColumn}' } for anchor table '${e.table}'. The client patches the junction optimistically from THIS declaration, so a wrong pair would show links the write never made — fix the declaration to the pair named here.`);
+			await u.set(c.map((e) => String(e)));
+		}
+	}
+}, F = (e, t) => e === void 0 ? {} : { enqueueOutcome: async (n, r, i) => {
+	let a = e(t);
+	if (a === void 0) throw TypeError("Invocation outcome outbox is unavailable");
+	return a.enqueue(n, r, i);
+} }, I = async (e) => {
+	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
+	try {
+		if (e.interceptor) {
+			let t = g.tryPromise({
+				try: () => e.runExecutor(),
+				catch: (e) => e
+			}), n = e.interceptor(t, {
+				tag: e.name,
+				kind: e.kind,
+				input: e.input,
+				subject: e.requestContext.subject,
+				traceId: e.requestContext.traceId,
+				...e.enqueueOutcome === void 0 ? {} : { enqueueOutcome: e.enqueueOutcome },
+				...e.requestContext.spanId === void 0 ? {} : { spanId: e.requestContext.spanId },
+				...e.target !== void 0 && e.target.length > 0 ? { target: e.target } : {},
+				...M(e.requestContext)
+			}), r = await g.runPromiseExit(n, e.requestContext.signal === void 0 ? void 0 : { signal: e.requestContext.signal });
+			if (_.isSuccess(r)) return r.value;
+			throw h.squash(r.cause);
+		}
+		return await e.runExecutor();
+	} catch (e) {
+		throw r = "error", e;
+	} finally {
+		e.recordMetric?.({
+			kind: "rpc",
+			tag: t,
+			durationMs: Date.now() - n,
+			status: r
+		});
+	}
+}, L = (e) => y(e) || u(e), R = 3, z = (e) => new Promise((t) => setTimeout(t, e)), B = async (e, t) => {
+	let n = t?.delay ?? ((e) => z(e * 20 + Math.floor(Math.random() * 30))), r = t?.attempts ?? 3;
+	for (let t = 1;; t++) try {
+		return await e();
+	} catch (e) {
+		if (t >= r || !L(e)) throw u(e) ? e.conflict : e;
+		await n(t);
+	}
+}, V = (e) => (t, n, r) => I({
+	name: t.descriptor.name,
+	kind: "mutation",
+	input: n,
+	requestContext: r,
+	...F(e.outcomeOutbox, r),
+	target: N(t),
+	...e.interceptor ? { interceptor: e.interceptor } : {},
+	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
+	runExecutor: async () => {
+		let i = Date.now();
+		await q(t, "mutation", { defaultDeny: e.defaultDeny === !0 })(n, r);
+		let a = {
+			...r,
+			subject: S(r.subject)
+		};
+		await k(t.descriptor, "mutation", a, n);
+		let o = await j(a), s = e.resolveStore === void 0 ? e.store : await e.resolveStore(o), c = [], u = [], p = await B(async () => s.transactional(async (a) => {
+			c.length = 0, u.length = 0, a[Symbol.for("@voltro/runtime:tx-fold-releases")] = u, a[l] = /* @__PURE__ */ new Map();
+			let p = t.descriptor.undo?.capture === !1 ? void 0 : e.undoCapture?.(a), m = p ? p.tx : a, h = f(m), _ = e.buildContext(o, h.tx, {
+				committedStore: s,
+				afterCommit: (e) => {
+					c.push(e);
+				}
+			}), v = e.measureSync ? e.measureSync(() => t.executor(n, _)) : t.executor(n, _), y = g.isEffect(v) ? await e.runEffect(D(v, o.subject), _.store) : await v;
+			if (await P({
+				store: _.store,
+				target: t.descriptor.target,
+				procedure: t.descriptor.name,
+				input: n,
+				output: y
+			}), p && await p.persist(_.store, {
+				tag: t.descriptor.name,
+				subject: o.subject,
+				traceId: r.traceId
+			}), await d({
+				touched: h.drain(),
+				store: _.store,
+				subject: o.subject
+			}), e.beforeMutationCommit !== void 0) {
+				let r = N(t), a = e.beforeMutationCommit({
+					tag: t.descriptor.name,
+					kind: "mutation",
+					input: n,
+					output: y,
+					subject: o.subject,
+					traceId: o.traceId,
+					store: _.store,
+					..._.outbox === void 0 ? {} : { outbox: _.outbox },
+					startedAt: i,
+					durationMs: Math.max(0, Date.now() - i),
+					...o.spanId === void 0 ? {} : { spanId: o.spanId },
+					...r.length > 0 ? { target: r } : {},
+					...M(o)
+				});
+				await e.runEffect(D(a, o.subject), _.store);
+			}
+			return y;
+		}), { ...e.replayAttempts === void 0 ? {} : { attempts: e.replayAttempts } });
+		if (u.length > 0) {
+			let t = e.buildContext(o, s, {
+				committedStore: s,
+				afterCommit: () => {}
+			}).store;
+			for (let e of u.splice(0)) await t.update(e.table, e.pk, e.patch);
+		}
+		for (let e of c) await e();
+		return e.settleCacheInvalidations !== void 0 && await e.settleCacheInvalidations(), p;
+	}
+}), H = (e) => (t, n, r, i) => I({
+	name: t.name,
+	kind: "workflow",
+	input: n,
+	requestContext: r,
+	...F(e.outcomeOutbox, r),
+	...e.interceptor ? { interceptor: e.interceptor } : {},
+	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
+	runExecutor: async () => (await O(t, r.subject, n, e.defaultDeny), i())
+}), U = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, W = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, G = (e) => {
+	let t = e.descriptor.source;
+	return t == null ? [] : typeof t == "string" ? [t] : [...t];
+}, K = (e, t, n) => (r) => () => g.runPromise(C(r, e.descriptor.guards, t, {
+	defaultDeny: n === !0,
+	procedure: e.descriptor.name
+})), q = (e, t, n = {}) => async (r, i) => {
+	let a = i.subject;
+	n.bindReplayAuthority?.({
+		tag: e.descriptor.name,
+		kind: t,
+		input: r,
+		subject: a,
+		traceId: i.traceId,
+		...i.surface === void 0 ? {} : { surface: i.surface },
+		...i.publicApi === void 0 ? {} : { publicApi: i.publicApi },
+		...i.remoteAddr === void 0 ? {} : { remoteAddr: i.remoteAddr }
+	});
+	let o = await K(e, r, n.defaultDeny)(a)();
+	if (o) throw o;
+}, J = (e, t) => e.rowFilter !== void 0 || a() === void 0 ? t(e) : g.promise(() => j(e)).pipe(g.flatMap((e) => {
+	let n = t(e);
+	return g.isEffect(n) ? n : g.succeed(n);
+})), Y = (e, t) => X(e, t, /* @__PURE__ */ new Set()), X = (o, s, l) => (u, d) => (f) => {
+	if (f.rowFilter === void 0 && a() !== void 0) return J(f, (e) => X(o, s, l)(u, d)(e));
+	let p = s ?? (f.connection?.transport === "http" ? "rpc" : "subscriptions"), h = (e) => o.workloadMetrics ? o.workloadMetrics.measureSync(p, e) : e(), _ = (e, t) => {
+		let n = o.provideEffect(e, t);
+		return o.workloadMetrics ? m(n, o.workloadMetrics, p) : n;
+	}, v = o.buildContext(f), y = K(u, d, o.defaultDeny)(f.subject), b = async () => {
+		let e = await y();
+		if (e) throw e;
+		let t = {
+			...f,
+			subject: S(f.subject)
+		}, n = o.buildContext(await j(t)), r = h(() => u.executor(d, n)), i = g.isEffect(r) ? await T(_(D(r, t.subject), n.store), f.signal === void 0 ? void 0 : { signal: f.signal }) : U(await Promise.resolve(r)), a = await y();
+		if (a) throw a;
+		return i;
+	}, C = (e, t = n()) => {
+		let r = U(e);
+		if (W(r)) {
+			let e = o.finalize(r, f), t = G(u);
+			if (t.length === 0) return e;
+			let n = e.dependentTables ?? [];
+			return {
+				...e,
+				dependentTables: [.../* @__PURE__ */ new Set([...n, ...t])]
+			};
+		}
+		return {
+			__voltroComputed: !0,
+			value: r,
+			dependentTables: [.../* @__PURE__ */ new Set([...G(u), ...t])],
+			tenantId: f.subject?.tenantId ?? null,
+			recompute: b
+		};
+	}, w = (e, t) => {
+		let n = C(e, t);
+		return c(n) ? g.tryPromise({
+			try: y,
+			catch: (e) => e
+		}).pipe(g.flatMap((e) => e ? g.fail(e) : g.succeed(n))) : n;
+	}, E = (e, t) => {
+		let n = w(e, t);
+		return g.isEffect(n) ? n : g.succeed(n);
+	}, O = () => {
+		let n = o.computedCache, r = u.descriptor.cache;
+		if (n === void 0 || r === void 0 || l.has(u.descriptor.name)) return;
+		let i = n.policyFor(r);
+		if (i === void 0) return;
+		let a = f.subject, s = G(u), c = t({
+			name: u.descriptor.name,
+			codeIdentity: n.codeIdentity,
+			output: u.descriptor.output,
+			input: u.descriptor.input,
+			decodedInput: d,
+			scope: i.scope,
+			subject: a,
+			rowFilter: f.rowFilter,
+			declaredSources: s
+		});
+		if ("bypass" in c) c.bypass === "input-not-encodable" && n.notice(u.descriptor.name, c.bypass, `${u.descriptor.name}: \`cache:\` NOT applied — the input does not encode through its \`input\` schema, so it has no key.`);
+		else return e({
+			cache: n,
+			policy: i,
+			key: c.key,
+			name: u.descriptor.name,
+			sources: s,
+			output: u.descriptor.output,
+			subject: f.subject,
+			rowFilter: f.rowFilter,
+			ctx: v,
+			...f.signal === void 0 ? {} : { signal: f.signal },
+			execute: (e, t) => {
+				let n = h(() => u.executor(d, e));
+				return g.isEffect(n) ? T(_(D(n, t), v.store), f.signal === void 0 ? void 0 : { signal: f.signal }) : Promise.resolve(n);
+			},
+			onDescriptor: () => {
+				l.add(u.descriptor.name);
+			},
+			isDescriptor: (e) => W(U(e)),
+			unwrap: (e) => U(e)
+		}).pipe(g.flatMap(({ value: e, dependencies: t }) => E(e, t)));
+	}, k = () => {
+		i(u.descriptor.name, G(u)), r();
+		let e = O();
+		if (e !== void 0) return e;
+		let t = h(() => u.executor(d, v));
+		return g.isEffect(t) ? _(D(t, f.subject), v.store).pipe(g.flatMap(E)) : t instanceof Promise ? g.promise(() => t).pipe(g.flatMap(E)) : w(t);
+	}, A = () => {
+		let e = u.descriptor.guards;
+		return (!e || e.length === 0) && o.defaultDeny !== !0 && f.subject.type !== "service" ? k() : x(f.subject, e, d, {
+			defaultDeny: o.defaultDeny === !0,
+			procedure: u.descriptor.name
+		}).pipe(g.flatMap((e) => {
+			if (e) return g.fail(e);
+			let t = k();
+			return g.isEffect(t) ? t : g.succeed(t);
+		}));
+	};
+	if (!o.interceptor) return A();
+	let N = g.suspend(() => {
+		let e = A();
+		return g.isEffect(e) ? e : g.succeed(e);
+	});
+	return o.interceptor(N, {
+		tag: u.descriptor.name,
+		kind: "query",
+		input: d,
+		subject: f.subject,
+		traceId: f.traceId,
+		...f.spanId === void 0 ? {} : { spanId: f.spanId },
+		...M(f)
+	});
+}, Z = (e) => async (t, n, r) => {
+	let i = await j(r), a = Y(e, "rpc")(t, n)(i), o = g.isEffect(a) ? await E(a) : a;
+	if (c(o)) return o.value;
+	let s = e.buildContext(i), l = await e.queryRows(o, i, s.store), u = await K(t, n, e.defaultDeny)(i.subject)();
+	if (u) throw u;
+	return l;
+}, Q = (e) => (t, n, r, i) => {
+	let a = !1, s;
+	return (async () => {
+		try {
+			let l = await j(r), u = Y(e, "subscriptions")(t, n)(l), d = g.isEffect(u) ? await E(u) : u, f = (e) => i(e), p = c(d) ? await e.subscribeComputed(d, f, l) : await e.subscribeDescriptor(d, f, l, K(t, n, e.defaultDeny)(l.subject), o(l.subject));
+			a ? p() : s = p;
+		} catch (e) {
+			i({
+				_tag: "error",
+				error: e instanceof Error ? {
+					message: e.message,
+					..."_tag" in e ? { _tag: e._tag } : {}
+				} : e
+			});
+		}
+	})(), () => {
+		a = !0, s?.();
+	};
+}, $ = (e) => (t, n, r) => I({
+	name: t.descriptor.name,
+	kind: "action",
+	input: n,
+	requestContext: r,
+	...F(e.outcomeOutbox, r),
+	target: N(t),
+	...e.interceptor ? { interceptor: e.interceptor } : {},
+	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
+	runExecutor: async () => {
+		await q(t, "action", { defaultDeny: e.defaultDeny === !0 })(n, r);
+		let a = {
+			...r,
+			subject: S(r.subject)
+		};
+		await k(t.descriptor, "action", a, n);
+		let o = e.buildContext(await j(a));
+		i(t.descriptor.name, G(t));
+		let s = e.measureSync ? e.measureSync(() => t.executor(n, o)) : t.executor(n, o), c = g.isEffect(s) ? await e.runEffect(D(s, a.subject), o.store) : await s;
+		return e.settleCacheInvalidations !== void 0 && await e.settleCacheInvalidations(), c;
+	}
+});
+//#endregion
+export { R as DEFAULT_MUTATION_REPLAY_ATTEMPTS, P as applyDeclaredRelations, $ as makeActionRunner, q as makeMutationReplayAdmission, V as makeMutationRunner, Z as makeOneShotQueryRunner, Y as makeQueryDescriptorProducer, K as makeQueryReauthorizer, Q as makeQuerySubscriber, H as makeWorkflowStartRunner, E as runProvidedEffect, B as runWithDeadlockRetry, j as withRowFilter, J as withScopedRequest };

package/dist/serverOnlyAudit.js

@@ -0,0 +1,66 @@
+import { SchemaAST as e } from "effect";
+//#region src/serverOnlyAudit.ts
+var t = (t) => {
+	let n = /* @__PURE__ */ new Set(), r = /* @__PURE__ */ new Set(), i = (t) => {
+		if (!r.has(t)) switch (r.add(t), t.encoding !== void 0 && i(e.toEncoded(t)), t._tag) {
+			case "Objects":
+				for (let e of t.propertySignatures) typeof e.name == "string" && n.add(e.name), i(e.type);
+				for (let e of t.indexSignatures) i(e.type);
+				break;
+			case "Arrays":
+				for (let e of t.elements) i(e);
+				for (let e of t.rest) i(e);
+				break;
+			case "Union":
+				for (let e of t.types) i(e);
+				break;
+			case "Suspend": i(t.thunk());
+		}
+	};
+	return i(t.ast), n;
+}, n = (t) => {
+	let n = /* @__PURE__ */ new Set(), r = /* @__PURE__ */ new Set(), i = (t) => {
+		if (t.encoding !== void 0) return i(e.toEncoded(t));
+		switch (t._tag) {
+			case "Null": return !0;
+			case "Literal": return t.literal === null;
+			case "Union": return t.types.length > 0 && t.types.every(i);
+			case "Suspend": return i(t.thunk());
+			default: return !1;
+		}
+	}, a = (t) => {
+		if (!r.has(t)) switch (r.add(t), t.encoding !== void 0 && a(e.toEncoded(t)), t._tag) {
+			case "Objects":
+				for (let e of t.propertySignatures) typeof e.name == "string" && i(e.type) && n.add(e.name), a(e.type);
+				break;
+			case "Arrays":
+				for (let e of t.elements) a(e);
+				for (let e of t.rest) a(e);
+				break;
+			case "Union":
+				for (let e of t.types) a(e);
+				break;
+			case "Suspend": a(t.thunk());
+		}
+	};
+	return a(t.ast), n;
+}, r = (e, r) => {
+	let i = e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source];
+	if (i.length === 0) return [];
+	let a = t(e.output), o = n(e.output), s = [];
+	for (let t of i) for (let n of r.get(t) ?? []) a.has(n) && !o.has(n) && s.push({
+		query: e.name,
+		table: t,
+		column: n
+	});
+	return s;
+}, i = (e) => {
+	if (e.length !== 0) return `A wire-reachable query exposes a server-only column:\n${e.map((e) => `  • query '${e.query}' output declares '${e.column}' — a .serverOnly() column of '${e.table}'`).join("\n")}\nThree ways out, in order of preference:\n  1. Omit the column from the query's output schema. The crud.* read helpers strip these automatically.\n  2. Keep the KEY but type it \`Schema.Null\` — for a view that must stay wire-compatible (an importer that breaks if the key vanishes) while never sending a value. The audit accepts that, because the schema then PROVES no value can flow instead of promising it. Pair it with a \`hasX\` boolean.\n  3. Drop the .serverOnly() marker, if the column may in fact reach a client.\nNote the audit reads the DECLARED shape, not what your handler emits: a field typed \`string\` that you always set to null still fails, and should — the next edit to that handler is one line away from sending it.`;
+}, a = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
+	query: e.name,
+	table: t
+})) : [], o = (e) => {
+	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
+};
+//#endregion
+export { a as cacheScopeLeaks, o as formatCacheScopeLeaks, i as formatServerOnlyLeaks, t as schemaPropertyNames, r as serverOnlyLeaks };

package/dist/serverTracer.js

@@ -0,0 +1,15 @@
+import { Effect as e, Layer as t } from "effect";
+//#region src/serverTracer.ts
+var n = Symbol.for("@voltro/runtime:serverTracer"), r = (() => {
+	let e = globalThis;
+	return e[n] ??= {};
+})(), i = (e) => {
+	e === void 0 ? delete r.tracer : r.tracer = e;
+}, a = () => r.tracer, o = t.effectDiscard(e.flatMap(e.tracer, (t) => e.sync(() => {
+	i(t);
+}))), s = (t) => {
+	let n = r.tracer;
+	return n === void 0 ? t : e.withTracer(t, n);
+};
+//#endregion
+export { o as publishServerTracerLayer, a as serverTracer, i as setServerTracer, s as withServerTracer };

package/dist/serviceCredentials.js

@@ -0,0 +1,40 @@
+import { createHash as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+import { SERVICE_NAME_PATTERN as r, serviceSubject as i } from "@voltro/protocol";
+//#region src/serviceCredentials.ts
+var a = "vsvc_", o = /^vsvc_[A-Za-z0-9_-]{43}$/, s = () => `${a}${t(32).toString("base64url")}`, c = (e) => o.test(e), l = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/-/g, "_").toUpperCase(), u = (e) => `VOLTRO_SERVICE_CALLER_${l(e)}_TOKEN`, d = (e) => `${u(e)}_NEXT`, f = (e) => `VOLTRO_API_${l(e)}_TOKEN`, p = (e) => `VOLTRO_API_${l(e)}_URL`, m = (e) => {
+	for (let t of Object.keys(e)) if (!r.test(t)) throw Error(`serviceCallers: ${JSON.stringify(t)} is not an app name — letters, digits and dashes, starting with a letter, at most 56 characters. It is the name the calling app binds this api under and the name its procedures list in \`service: { callers }\`.`);
+}, h = (t) => e("sha256").update(t).digest(), g = (e, t) => n(e, h(t)), _ = (e, t) => [e[u(t)], e[d(t)]].filter((e) => typeof e == "string" && e !== ""), v = (e) => {
+	m(e.callers);
+	let t = Object.keys(e.callers), n = e.env ?? (() => process.env);
+	return {
+		id: "voltro-service",
+		claimsBearerPrefix: a,
+		verifyConfig: () => {
+			let e = n(), r = [], i = [];
+			for (let n of t) {
+				let t = _(e, n);
+				t.length === 0 && r.push(u(n));
+				for (let [e, r] of t.entries()) c(r) || i.push(e === 0 ? u(n) : d(n));
+			}
+			if (r.length > 0) throw Error(`serviceCallers: no token for ${r.join(", ")}. Every app listed in \`serviceCallers\` needs the credential it presents. \`voltro dev\` mints one per caller into both apps' \`.env.local\`; in production set the variable to the same value as the caller's \`VOLTRO_API_<NAME>_TOKEN\` (\`voltro secret generate service\` prints a fresh one).`);
+			if (i.length > 0) throw Error(`serviceCallers: ${i.join(", ")} ${i.length === 1 ? "is" : "are"} not a service token (\`${a}\` followed by 43 base64url characters). Generate one with \`voltro secret generate service\` rather than choosing a value by hand.`);
+		},
+		resolve: (e) => {
+			let r = e.headers.authorization ?? e.headers.Authorization;
+			if (r === void 0) return { kind: "skip" };
+			let a = /^Bearer\s+(\S+)$/i.exec(r)?.[1];
+			if (a === void 0 || !a.startsWith("vsvc_")) return { kind: "skip" };
+			let o = h(a), s = n(), c;
+			for (let e of t) for (let t of _(s, e)) g(o, t) && c === void 0 && (c = e);
+			return c === void 0 ? {
+				kind: "failed",
+				reason: "service credential matches no caller in `serviceCallers`"
+			} : {
+				kind: "matched",
+				subject: i(c)
+			};
+		}
+	};
+};
+//#endregion
+export { a as SERVICE_TOKEN_PREFIX, f as apiBindingTokenEnv, p as apiBindingUrlEnv, m as assertServiceCallersConfig, c as isWellFormedServiceToken, s as mintServiceToken, d as serviceCallerNextTokenEnv, v as serviceCallerStrategy, u as serviceCallerTokenEnv, l as serviceEnvSegment };

package/dist/setReadScopes.js

@@ -0,0 +1,28 @@
+//#region src/setReadScopes.ts
+var e = [
+	"crossTenant",
+	"includeDeleted",
+	"includeExpired"
+], t = (t, n) => {
+	let r = (t, i) => {
+		let a = t;
+		for (let t of e) i?.[t] === !0 && a[t] !== !0 && (a = {
+			...a,
+			[t]: !0
+		});
+		let o = a.setOp;
+		if (o === void 0) return n(a);
+		if (o.queries.length < 2) throw Error("A set operation requires at least two inputs");
+		let s = o.queries.map((e) => r(e, a));
+		return s.every((e, t) => e === o.queries[t]) ? a : {
+			...a,
+			setOp: {
+				...o,
+				queries: s
+			}
+		};
+	};
+	return r(t);
+};
+//#endregion
+export { t as mapSetReadScopes };