@voltro/runtime 0.85.0 → 0.87.0

package/dist/apiKeys.js

@@ -0,0 +1,227 @@
+import { and as e, eq as t, generateId as n, inSet as r } from "@voltro/database";
+import { createHash as i, randomBytes as a } from "node:crypto";
+//#region src/apiKeys.ts
+var o = "_voltro_api_keys", s = "actors", c = (e) => i("sha256").update(e, "utf8").digest("hex"), l = (e = "voltro_") => `${e}${a(30).toString("base64url")}`, u = (e) => ({
+	id: e.id,
+	name: e.name,
+	keyPrefix: e.keyPrefix,
+	tenantId: e.tenantId,
+	scopes: e.scopes ?? [],
+	lastUsedAt: e.lastUsedAt,
+	expiresAt: e.expiresAt,
+	revokedAt: e.revokedAt,
+	createdAt: e.createdAt,
+	createdBy: e.createdBy ?? null,
+	onBehalfOf: e.onBehalfOf ?? null,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), d = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), f = (e, t = {}) => {
+	let r = t.prefix ?? "voltro_", i = t.usage, a = async (t) => {
+		let i = l(r), a = n({
+			kind: "typeid",
+			prefix: "apikey"
+		}, o), s = t.scopes ?? [], u = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
+		return await e.ensureActor({
+			id: a,
+			displayName: t.name,
+			input: t
+		}), await e.insert({
+			id: a,
+			tenantId: t.tenantId ?? null,
+			name: t.name,
+			onBehalfOf: t.onBehalfOf ?? null,
+			hashedKey: c(i),
+			keyPrefix: i.slice(0, r.length + 6),
+			scopes: s,
+			lastUsedAt: null,
+			expiresAt: u,
+			revokedAt: null,
+			createdBy: t.createdBy ?? null,
+			createdAt: Date.now(),
+			...t.metadata == null ? {} : { metadata: t.metadata }
+		}), {
+			id: a,
+			token: i,
+			keyPrefix: i.slice(0, r.length + 6),
+			name: t.name,
+			tenantId: t.tenantId ?? null,
+			scopes: s
+		};
+	}, s = async (t, n = Date.now()) => {
+		let r = await e.findByHash(t);
+		return !r || !d(r, n) ? null : (i === void 0 ? await e.patch(r.id, { lastUsedAt: n }) : i.touch(r.id, n), {
+			id: r.id,
+			tenantId: r.tenantId ?? "",
+			createdBy: r.createdBy ?? null,
+			onBehalfOf: r.onBehalfOf ?? null,
+			scopes: r.scopes ?? [],
+			...r.metadata == null ? {} : { metadata: r.metadata }
+		});
+	};
+	return {
+		issue: a,
+		resolveByHash: s,
+		verify: (e, t) => s(c(e), t),
+		revoke: async (t, n, r = Date.now()) => {
+			let i = await e.findById(t);
+			return !i || (i.tenantId ?? null) !== n ? !1 : (await e.patch(t, { revokedAt: r }), !0);
+		},
+		rotate: async (t, n, r = Date.now()) => {
+			let i = await e.findById(t);
+			return !i || (i.tenantId ?? null) !== n ? null : (await e.patch(t, { revokedAt: r }), a({
+				tenantId: i.tenantId,
+				name: i.name,
+				scopes: i.scopes ?? [],
+				createdBy: i.createdBy,
+				onBehalfOf: i.onBehalfOf ?? null,
+				...i.metadata == null ? {} : { metadata: i.metadata }
+			}));
+		},
+		list: async (t) => (await e.listByTenant(t)).map(u)
+	};
+}, p = () => {
+	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
+	return {
+		actors: t,
+		ensureActor: async (e) => {
+			t.has(e.id) || t.set(e.id, {
+				id: e.id,
+				kind: "apiKey",
+				displayName: e.displayName
+			});
+		},
+		insert: async (t) => {
+			e.set(t.id, t);
+		},
+		findByHash: async (t) => {
+			for (let n of e.values()) if (n.hashedKey === t) return n;
+			return null;
+		},
+		findById: async (t) => e.get(t) ?? null,
+		listByTenant: async (t) => {
+			let n = [...e.values()], r = 0;
+			for (let e of n) e.tenantId === t && (n[r++] = e);
+			return n.length = r, n;
+		},
+		patch: async (t, n) => {
+			let r = e.get(t);
+			r && e.set(t, {
+				...r,
+				...n
+			});
+		}
+	};
+}, m = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, h = (e) => ({
+	id: String(e.id),
+	tenantId: e.tenantId ?? null,
+	name: String(e.name),
+	hashedKey: String(e.hashedKey),
+	keyPrefix: String(e.keyPrefix),
+	scopes: e.scopes ?? null,
+	lastUsedAt: m(e.lastUsedAt),
+	expiresAt: m(e.expiresAt),
+	revokedAt: m(e.revokedAt),
+	createdBy: e.createdBy ?? null,
+	onBehalfOf: e.onBehalfOf ?? null,
+	createdAt: m(e.createdAt) ?? 0,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), g = async (e, t, n = !1) => await e.query({
+	table: o,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...n ? { lock: "update" } : {}
+}), _ = async (n, r, i) => {
+	let a = await g(n, e(t("id", r), t("tenantId", i)), !0);
+	return a[0] ? h(a[0]) : null;
+}, v = async (e) => {
+	let t = await e.keys();
+	if (t.length === 0) return {
+		keys: 0,
+		planted: 0,
+		failed: []
+	};
+	let n = /* @__PURE__ */ new Set();
+	for (let i = 0; i < t.length; i += 500) {
+		let a = t.slice(i, i + 500).map((e) => e.id), o = await e.store.query({
+			table: s,
+			predicate: r("id", a),
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		});
+		for (let e of o) typeof e.id == "string" && n.add(e.id);
+	}
+	let i = 0, a = [];
+	for (let r of t) if (!n.has(r.id)) try {
+		await e.apiKeyStore.ensureActor({
+			id: r.id,
+			displayName: r.name,
+			input: {
+				tenantId: r.tenantId,
+				name: r.name,
+				scopes: r.scopes ?? [],
+				createdBy: r.createdBy,
+				onBehalfOf: r.onBehalfOf ?? null,
+				...r.metadata == null ? {} : { metadata: r.metadata }
+			}
+		}), i++;
+	} catch (e) {
+		a.push({
+			id: r.id,
+			reason: e instanceof Error ? e.message : String(e)
+		});
+	}
+	return {
+		keys: t.length,
+		planted: i,
+		failed: a
+	};
+}, y = (e) => async (t, n) => {
+	let r = await e.findById(t);
+	if (r === null) return;
+	let i = r.requestCount ?? 0, a = r.lastUsedAt ?? 0;
+	await e.patch(t, {
+		requestCount: i + n.requests,
+		lastUsedAt: Math.max(a, n.lastUsedAt)
+	});
+}, b = (e, n = {}) => {
+	let r = n.ensureActor, i = (t) => g(e, t), a = (e) => {
+		let t = { ...e };
+		for (let e of [
+			"lastUsedAt",
+			"expiresAt",
+			"revokedAt",
+			"createdAt"
+		]) e in t && typeof t[e] == "number" && (t[e] = new Date(t[e]));
+		return t;
+	};
+	return {
+		ensureActor: r === void 0 ? async (t) => {
+			await e.insertIgnore(s, {
+				id: t.id,
+				kind: "apiKey",
+				displayName: t.displayName
+			}, { conflictColumns: ["id"] });
+		} : (t) => r(t, e),
+		insert: async (t) => {
+			await e.insert(o, a(t));
+		},
+		findByHash: async (e) => {
+			let n = await i(t("hashedKey", e));
+			return n[0] ? h(n[0]) : null;
+		},
+		findById: async (e) => {
+			let n = await i(t("id", e));
+			return n[0] ? h(n[0]) : null;
+		},
+		listByTenant: async (e) => (await i(e === null ? void 0 : t("tenantId", e))).map(h).filter((t) => e === null || t.tenantId === e),
+		patch: async (t, n) => {
+			await e.update(o, t, a(n));
+		}
+	};
+};
+//#endregion
+export { s as ACTORS_TABLE, o as API_KEYS_TABLE, b as dataStoreApiKeyStore, l as generateApiKeyToken, _ as lockApiKeyById, f as makeApiKeyService, y as makeApiKeyUsageFlusher, p as memoryApiKeyStore, v as plantMissingApiKeyActors, c as sha256Hex };

package/dist/apiKeysWiring.js

@@ -0,0 +1,114 @@
+import { Schema as e } from "effect";
+import { ADMIN_SCOPE as t, APIKEY_ISSUE_ORG_SCOPE as n, APIKEY_ISSUE_OTHER_SCOPE as r, APIKEY_ISSUE_SELF_SCOPE as i, ScopeError as a } from "@voltro/protocol";
+import { defineRestRoute as o, requireAnyScope as s, requireScope as c } from "@voltro/protocol/rest";
+import { apiKeyStrategy as l } from "@voltro/protocol/apikey";
+//#region src/apiKeysWiring.ts
+var u = (e, t = {}) => l({
+	id: "voltro-apikey",
+	...t.prefix ? { prefix: t.prefix } : {},
+	resolveKey: (t) => e.resolveByHash(t)
+}), d = (e) => {
+	let t = e.subject;
+	return {
+		id: t.id ?? null,
+		tenantId: t.tenantId ?? null,
+		scopes: t.scopes ?? []
+	};
+}, f = (l, u = "/v1/api-keys") => {
+	let f = e.Struct({
+		id: e.String,
+		name: e.String,
+		keyPrefix: e.String,
+		tenantId: e.NullOr(e.String),
+		scopes: e.Array(e.String),
+		lastUsedAt: e.NullOr(e.Number),
+		expiresAt: e.NullOr(e.Number),
+		revokedAt: e.NullOr(e.Number),
+		createdAt: e.Number,
+		createdBy: e.NullOr(e.String),
+		onBehalfOf: e.NullOr(e.String),
+		metadata: e.optional(e.NullOr(e.Record(e.String, e.Unknown)))
+	});
+	return [
+		o({
+			method: "POST",
+			path: `${u}/issue`,
+			summary: "Issue an API key (the token is returned ONCE).",
+			guards: [s([
+				t,
+				i,
+				n,
+				r
+			])],
+			input: e.Struct({ body: e.Struct({
+				name: e.String,
+				scopes: e.optional(e.Array(e.String)),
+				expiresInDays: e.optional(e.Number),
+				onBehalfOf: e.optional(e.NullOr(e.String))
+			}) }),
+			output: e.Struct({
+				id: e.String,
+				token: e.String,
+				keyPrefix: e.String
+			}),
+			handler: async (e, o) => {
+				let s = e.body, c = d(o), u = new Set(c.scopes), f = (e) => u.has(t) || u.has(e), p = s.onBehalfOf === void 0 ? c.id : s.onBehalfOf;
+				if (p === null) {
+					if (!f(n)) throw new a({
+						required: n,
+						message: "not allowed to issue an organization key"
+					});
+				} else if (p !== c.id) {
+					if (!f(r)) throw new a({
+						required: r,
+						message: "not allowed to issue a key on behalf of another user"
+					});
+				} else if (!f(i)) throw new a({
+					required: i,
+					message: "not allowed to issue an api key"
+				});
+				let m = s.scopes ?? [...u];
+				if (!u.has(t)) {
+					let e = m.filter((e) => !u.has(e));
+					if (e.length > 0) throw new a({
+						required: String(e[0]),
+						message: `cannot issue a key with scopes you do not hold: ${e.join(", ")}`
+					});
+				}
+				let h = await l.issue({
+					tenantId: c.tenantId,
+					name: s.name,
+					scopes: m,
+					...s.expiresInDays ? { expiresAt: Date.now() + s.expiresInDays * 864e5 } : {},
+					createdBy: c.id,
+					onBehalfOf: p
+				});
+				return {
+					id: h.id,
+					token: h.token,
+					keyPrefix: h.keyPrefix
+				};
+			}
+		}),
+		o({
+			method: "GET",
+			path: u,
+			summary: "List the caller tenant's API keys (no secrets).",
+			guards: [c(t)],
+			input: e.Struct({}),
+			output: e.Struct({ keys: e.Array(f) }),
+			handler: async (e, t) => ({ keys: [...await l.list(d(t).tenantId)] })
+		}),
+		o({
+			method: "POST",
+			path: `${u}/revoke`,
+			summary: "Revoke an API key by id.",
+			guards: [c(t)],
+			input: e.Struct({ body: e.Struct({ id: e.String }) }),
+			output: e.Struct({ ok: e.Boolean }),
+			handler: async (e, t) => ({ ok: await l.revoke(e.body.id, d(t).tenantId) })
+		})
+	];
+};
+//#endregion
+export { f as apiKeyManagementRoutes, u as frameworkApiKeyStrategy };

package/dist/apiRoleBucketSampler.js

@@ -0,0 +1,64 @@
+import { API_ROLE_BUCKET_MS as e } from "./apiRoleWorkloadHistory.js";
+import { API_WORKLOADS as t } from "@voltro/protocol";
+//#region src/apiRoleBucketSampler.ts
+var n = (n) => {
+	let r = [...new Set(n.workloads)];
+	if (!n.replicaId || n.replicaId.length > 191 || !n.role || n.role.length > 2080 || n.startedAt < 0 || n.epochNow < 0 || n.monotonicNow < 0 || !r.length || r.some((e) => !t.includes(e)) || !Number.isFinite(n.monotonicNow) || !Number.isSafeInteger(n.epochNow) || !Number.isSafeInteger(n.startedAt) || n.startedAt > n.epochNow) throw Error("Invalid role sampler configuration");
+	let i = n.epochNow - n.monotonicNow, a = (t) => Math.floor(t / e) * e, o = /* @__PURE__ */ new Map(), s = a(n.epochNow), c = n.epochNow, l = 0, u = 0, d = n.monotonicNow, f = (e) => {
+		let t = o.get(e);
+		return t || (t = {
+			from: e,
+			continuous: e >= n.epochNow,
+			seconds: /* @__PURE__ */ new Map()
+		}, o.set(e, t), o.size > 290 && (o.delete(Math.min(...o.keys())), l++)), t;
+	}, p = (t) => ({
+		replicaId: n.replicaId,
+		startedAt: n.startedAt,
+		role: n.role,
+		from: t.from,
+		until: t.from + e,
+		continuous: t.continuous,
+		workloads: Object.fromEntries(r.map((e) => [e, {
+			coverage: "partial",
+			seconds: t.seconds.get(e) ?? 0
+		}]))
+	});
+	return {
+		record(t) {
+			let n = i + t.from, o = i + t.until;
+			if (!r.includes(t.workload) || !Number.isFinite(n) || !Number.isFinite(o) || o <= n || t.from < d || n < s || o - n > 87e6) u++;
+			else {
+				d = t.until;
+				for (let r = a(n); r < o; r += e) {
+					let i = f(r), a = (Math.min(o, r + e) - Math.max(n, r)) / 1e3;
+					i.seconds.set(t.workload, (i.seconds.get(t.workload) ?? 0) + a);
+				}
+			}
+		},
+		advance(t, n) {
+			let r = i + t;
+			if (!Number.isFinite(r) || r < c || !Number.isFinite(n)) return;
+			let o = a(r), u = Math.max(s, o - 290 * e);
+			u > s && (l += (u - s) / e);
+			let d = r - c > 6e4 || Math.abs(n - r) > 1e3;
+			for (let t = u; t < o; t += e) {
+				let e = f(t);
+				d && (e.continuous = !1);
+			}
+			d && (f(o).continuous = !1), s = o, c = r;
+		},
+		pending() {
+			return [...o.values()].filter((t) => t.from + e <= s).sort((e, t) => e.from - t.from).map(p);
+		},
+		acknowledge(e) {
+			e + 3e5 <= s && o.delete(e);
+		},
+		status: () => ({
+			pendingBuckets: [...o.keys()].filter((t) => t + e <= s).length,
+			droppedBuckets: l,
+			rejectedSegments: u
+		})
+	};
+};
+//#endregion
+export { n as makeApiRoleBucketSampler };

package/dist/apiRoleWorkloadHistory.js

@@ -0,0 +1,56 @@
+import { API_WORKLOADS as e } from "@voltro/protocol";
+//#region src/apiRoleWorkloadHistory.ts
+var t = 3e5, n = 864e5, r = (r) => {
+	if (!Number.isSafeInteger(r.startedAt) || r.startedAt < 0 || r.startedAt > r.now || !r.replicaId || !r.role || !Number.isSafeInteger(r.now) || r.now < 864e5) throw Error("Invalid role observation time");
+	let i = Math.floor(r.now / t) * t, a = i - n, o = n / t, s = [...new Set(r.requiredWorkloads)];
+	if (!s.length || s.some((t) => !e.includes(t))) throw Error("Invalid required workloads");
+	let c = (e, t, n = s) => ({
+		from: a,
+		until: i,
+		complete: !1,
+		reason: e,
+		missingBuckets: t,
+		incompleteWorkloads: n,
+		totals: [],
+		splitCandidates: []
+	});
+	if (r.buckets.length > 290) return c("invalid-observation", o);
+	let l = /* @__PURE__ */ new Map();
+	for (let t of r.buckets) {
+		if (t.replicaId !== r.replicaId || t.startedAt !== r.startedAt || t.role !== r.role || !Number.isSafeInteger(t.from) || t.from < 0 || t.from % 3e5 != 0 || t.until !== t.from + 3e5 || typeof t.continuous != "boolean") return c("invalid-observation", o);
+		let n = 0;
+		for (let [r, i] of Object.entries(t.workloads)) {
+			if (!e.includes(r) || !s.includes(r) || !i || !["partial", "complete"].includes(i.coverage) || !Number.isFinite(i.seconds) || i.seconds < 0) return c("invalid-observation", o);
+			n += i.seconds;
+		}
+		if (n > 300) return c("invalid-observation", o);
+		if (!(t.until <= a || t.from >= i)) {
+			if (l.has(t.from)) return c("invalid-observation", o);
+			l.set(t.from, t);
+		}
+	}
+	let u = /* @__PURE__ */ new Set(), d = new Map(s.map((e) => [e, 0]));
+	for (let e of l.values()) for (let t of s) {
+		let n = e.workloads[t];
+		(!e.continuous || e.from < r.startedAt || n?.coverage !== "complete") && u.add(t), n && d.set(t, d.get(t) + n.seconds);
+	}
+	let f = o - l.size;
+	if (f || u.size) return c("incomplete", f, [...u]);
+	let p = [...d.values()].reduce((e, t) => e + t, 0), m = [...d].map(([e, t]) => ({
+		workload: e,
+		seconds: t,
+		share: p === 0 ? 0 : t / p
+	})), h = m.filter((e) => e.share > .3).map((e) => e.workload);
+	return {
+		from: a,
+		until: i,
+		complete: !0,
+		missingBuckets: 0,
+		incompleteWorkloads: [],
+		reason: p === 0 ? "idle" : "observed",
+		totals: m,
+		splitCandidates: h.length >= 2 ? h : []
+	};
+};
+//#endregion
+export { t as API_ROLE_BUCKET_MS, n as API_ROLE_WINDOW_MS, r as assessApiRoleWorkloadWindow };

package/dist/apiRoleWorkloadMetrics.js

@@ -0,0 +1,78 @@
+import { Effect as e, Metric as t, Tracer as n } from "effect";
+import { API_WORKLOADS as r } from "@voltro/protocol";
+//#region src/apiRoleWorkloadMetrics.ts
+var i = t.counter("api_role_workload_seconds_total", { description: "Measured active synchronous loop seconds by selected API role set and workload; excludes asynchronous waits." }), a = (e) => {
+	if (e.length === 0 || e.length > 32 || e.some((e) => !/^[a-z][a-z0-9-]{0,63}$/.test(e))) throw Error("Invalid API metric roles");
+	return [...new Set(e)].sort().join(",");
+}, o = (o, s = {}) => {
+	let c = a(o), l = s.now ?? (() => performance.now()), u = new Map(r.map((e) => [e, i.pipe(t.withAttributes({
+		role: c,
+		workload: e
+	}))])), d = /* @__PURE__ */ new Map(), f = 0, p = [], m = (n, r) => {
+		let i = (r - n.since) / 1e3;
+		if (!(!Number.isFinite(i) || i <= 0)) {
+			try {
+				s.onSegment?.({
+					workload: n.workload,
+					from: n.since,
+					until: r
+				});
+			} catch {
+				f++;
+			}
+			d.set(n.workload, (d.get(n.workload) ?? 0) + i), e.runSync(t.update(u.get(n.workload), i));
+		}
+	}, h = (e) => {
+		if (!u.has(e)) throw Error("Unknown API metric workload");
+		let t = p[p.length - 1];
+		t && m(t, l());
+		let n = {
+			workload: e,
+			since: l()
+		};
+		return p.push(n), n;
+	}, g = (e) => {
+		let t = l();
+		p.pop(), m(e, t);
+		let n = p[p.length - 1];
+		n && (n.since = l());
+	};
+	return {
+		role: c,
+		observationErrors: () => f,
+		observeEffect(t, r) {
+			if (!u.has(r)) throw Error("Unknown API metric workload");
+			return e.withFiber((i) => {
+				let a = i.getRef(n.Tracer), o = n.make({
+					span: (e) => a.span(e),
+					context: (e, t) => {
+						let n = h(r);
+						try {
+							return a.context === void 0 ? e["~effect/Effect/evaluate"](t) : a.context(e, t);
+						} finally {
+							g(n);
+						}
+					}
+				});
+				return t.pipe(e.provideService(n.Tracer, o));
+			});
+		},
+		measureSync(e, t) {
+			let n = h(e);
+			try {
+				return t();
+			} finally {
+				g(n);
+			}
+		},
+		snapshot() {
+			return [...d].map(([e, t]) => ({
+				role: c,
+				workload: e,
+				seconds: t
+			}));
+		}
+	};
+}, s = (e, t, n) => t.observeEffect(e, n);
+//#endregion
+export { a as apiRoleMetricLabel, o as makeApiRoleWorkloadMetrics, s as observeApiRoleEffect };

package/dist/apiRoleWorkloadStorage.js

@@ -0,0 +1,95 @@
+import { API_ROLE_BUCKET_MS as e, API_ROLE_WINDOW_MS as t, assessApiRoleWorkloadWindow as n } from "./apiRoleWorkloadHistory.js";
+//#region src/apiRoleWorkloadStorage.ts
+var r = "_voltro_api_role_workload_buckets", i = 16384, a = (e) => e instanceof Date ? e.getTime() : typeof e == "number" ? e : NaN, o = async (e, t) => {
+	let a = Object.keys(t.workloads);
+	if (n({
+		now: Math.max(864e5, t.until),
+		replicaId: t.replicaId,
+		startedAt: t.startedAt,
+		role: t.role,
+		requiredWorkloads: a,
+		buckets: [t]
+	}).reason === "invalid-observation" || !t.replicaId || t.replicaId.length > 191 || t.role.length > 2080) throw Error("Invalid API role history bucket");
+	let o = JSON.stringify({
+		version: 1,
+		continuous: t.continuous,
+		workloads: t.workloads
+	});
+	if (new TextEncoder().encode(o).byteLength > i) throw Error("API role history payload too large");
+	await e.upsert(r, {
+		replicaId: t.replicaId,
+		startedAt: new Date(t.startedAt),
+		role: t.role,
+		bucketFrom: new Date(t.from),
+		bucketUntil: new Date(t.until),
+		payload: o
+	}, { conflictColumns: [
+		"replicaId",
+		"startedAt",
+		"bucketFrom"
+	] });
+}, s = async (o, s) => {
+	let c = n({
+		...s,
+		buckets: []
+	}), l = (await o.query({
+		table: r,
+		predicate: { and: [
+			{
+				column: "replicaId",
+				op: "eq",
+				value: s.replicaId
+			},
+			{
+				column: "startedAt",
+				op: "eq",
+				value: new Date(s.startedAt)
+			},
+			{
+				column: "role",
+				op: "eq",
+				value: s.role
+			},
+			{
+				column: "bucketFrom",
+				op: "gte",
+				value: new Date(c.from)
+			},
+			{
+				column: "bucketFrom",
+				op: "lt",
+				value: new Date(c.until)
+			}
+		] },
+		order: [{
+			column: "bucketFrom",
+			direction: "asc"
+		}],
+		take: t / e + 1,
+		skip: void 0,
+		projection: void 0
+	})).map((e) => {
+		if (typeof e.payload != "string" || new TextEncoder().encode(e.payload).byteLength > i) throw Error("Invalid API role history payload");
+		let t = JSON.parse(e.payload);
+		if (!t || t.version !== 1 || typeof t.continuous != "boolean" || !t.workloads || typeof t.workloads != "object" || Array.isArray(t.workloads)) throw Error("Invalid API role history payload");
+		return {
+			replicaId: String(e.replicaId),
+			startedAt: a(e.startedAt),
+			role: String(e.role),
+			from: a(e.bucketFrom),
+			until: a(e.bucketUntil),
+			continuous: t.continuous,
+			workloads: t.workloads
+		};
+	}), u = n({
+		...s,
+		buckets: l
+	});
+	if (u.reason === "invalid-observation") throw Error("Invalid API role history observations");
+	return {
+		buckets: l,
+		assessment: u
+	};
+};
+//#endregion
+export { r as API_ROLE_WORKLOAD_BUCKETS_TABLE, s as readApiRoleWorkloadWindow, o as writeApiRoleWorkloadBucket };

package/dist/approvalBuiltins.js

@@ -0,0 +1,10 @@
+import { decideApproval as e, pendingApprovalsFor as t } from "./approvals.js";
+//#region src/approvalBuiltins.ts
+var n = (e) => e.request?.subject ?? null, r = async (e, r) => t(r.store, n(r), { limit: e.limit ?? 50 }), i = async (t, r) => e(r.store, {
+	approvalId: t.approvalId,
+	decision: t.decision,
+	approver: n(r),
+	...t.note === void 0 ? {} : { note: t.note }
+});
+//#endregion
+export { r as approvalsPendingExecutor, i as decideApprovalInvocation };