@voltro/runtime 0.85.0 → 0.87.0

package/dist/approvals.js

@@ -0,0 +1,262 @@
+import { Effect as e } from "effect";
+import { and as t, eq as n, generateId as r, id as i, inSet as a, registerRetention as o, retentionTtlMsFromEnv as s, table as c, text as l, timestamp as u } from "@voltro/database";
+import { createHash as d, randomUUID as f } from "node:crypto";
+import { ApprovalExpired as p, ApprovalForbidden as m, ApprovalNotFound as h, ApprovalNotPending as g, ApprovalRejected as _, ApprovalRequired as v, ApprovalSelfApproval as y, ApprovalUnavailable as b, canonicalJson as x, checkGuardsEffect as S, isAuthenticatedGuard as C, isPolicyGuard as w, isUpgradedGuard as T, resolvePolicyAction as E, upgradedGuardShapeError as D } from "@voltro/protocol";
+//#region src/approvals.ts
+var O = "_voltro_approvals", k = 864e5, A = c(O, {
+	id: i({ prefix: "apv" }),
+	intentKey: l().maxLength(191),
+	procedure: l(),
+	kind: l(),
+	requestedBy: l().nullable(),
+	tenantId: l().nullable(),
+	payload: l(),
+	approverGuards: l(),
+	approverScopes: l(),
+	reason: l().nullable(),
+	status: l().default("pending"),
+	decidedBy: l().nullable(),
+	decidedAt: u().nullable(),
+	note: l().nullable(),
+	traceId: l().nullable(),
+	requestedAt: u().default("now"),
+	expiresAt: u(),
+	consumedAt: u().nullable()
+}).index(["status", "expiresAt"]).index(["requestedBy"]), j = () => {
+	o({
+		source: "framework",
+		table: O,
+		timeColumn: "requestedAt",
+		ttlMs: s(process.env.VOLTRO_APPROVALS_TTL_HOURS, 720)
+	});
+}, M = (e, t) => e.map((e) => {
+	let n = D(e);
+	if (n) throw n;
+	return C(e) ? { kind: "authenticated" } : T(e) ? { kind: "upgraded" } : w(e) ? {
+		kind: "policy",
+		action: E(e, t),
+		resourceType: e.resourceType,
+		resource: e.resource(t) ?? null
+	} : {
+		kind: "scope",
+		scope: typeof e.scope == "string" ? [e.scope] : [...e.scope],
+		mode: e.mode ?? "all",
+		resource: e.resource?.(t) ?? null
+	};
+}), N = (e) => e.map((e) => e.kind === "authenticated" ? { authenticated: !0 } : e.kind === "upgraded" ? { upgraded: !0 } : e.kind === "policy" ? {
+	action: e.action,
+	resourceType: e.resourceType,
+	resource: () => e.resource ?? void 0
+} : {
+	scope: e.scope,
+	mode: e.mode,
+	...e.resource === null ? {} : { resource: () => e.resource ?? void 0 }
+}), P = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : e.kind === "authenticated" ? ["authenticated"] : e.kind === "upgraded" ? ["upgraded"] : [...e.scope]), F = (e) => {
+	let t = [
+		e.procedure,
+		e.requestedBy ?? "",
+		e.tenantId ?? "",
+		e.payload,
+		e.nonce ?? ""
+	].map((e) => `${e.length}:${e}`).join("");
+	return d("sha256").update(t, "utf8").digest("hex");
+}, I = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), L = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, R = (e) => {
+	try {
+		let t = JSON.parse(String(e ?? "[]"));
+		return Array.isArray(t) ? t : [];
+	} catch {
+		return [];
+	}
+}, z = async (e, t) => (await e.query({
+	table: "_voltro_approvals",
+	predicate: n("intentKey", t),
+	order: []
+}))[0] ?? null, B = async (e, t) => (await e.query({
+	table: "_voltro_approvals",
+	predicate: n("id", t),
+	order: []
+}))[0] ?? null, V = async (e, t, n) => {
+	let r = String(t.intentKey ?? ""), i = r.includes("#") ? r : `${r}#${String(t.id)}`;
+	await e.update(O, String(t.id), {
+		...n,
+		intentKey: i
+	});
+}, H = (e) => {
+	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
+	if (t === null) return null;
+	let n = Number(t[1]);
+	if (!(Number.isFinite(n) && n > 0)) return null;
+	let r = t[2];
+	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
+}, U = (e) => {
+	let i = e.store, a = e.now ?? Date.now, o = e.defaultExpiryMs ?? 864e5;
+	j();
+	let s = (e) => {
+		if (e.expiresIn === void 0) return o;
+		let t = H(e.expiresIn);
+		if (t === null) throw Error(`requiresApproval.expiresIn must be an interval like '4h' / '30m' (got ${JSON.stringify(e.expiresIn)})`);
+		return t;
+	}, c = async (e, t, n) => {
+		let o = M(e.policy.approvers, e.input), c = r({
+			kind: "typeid",
+			prefix: "apv"
+		}, O), l = a();
+		await i.insertIgnore(O, {
+			id: c,
+			intentKey: t,
+			procedure: e.procedure,
+			kind: e.kind,
+			requestedBy: e.subject?.id ?? null,
+			tenantId: e.subject?.tenantId ?? null,
+			payload: n,
+			approverGuards: JSON.stringify(o),
+			approverScopes: JSON.stringify(P(o)),
+			reason: e.policy.reason ?? null,
+			status: "pending",
+			decidedBy: null,
+			decidedAt: null,
+			note: null,
+			traceId: e.traceId ?? null,
+			requestedAt: new Date(l),
+			expiresAt: new Date(l + s(e.policy)),
+			consumedAt: null
+		}, { conflictColumns: ["intentKey"] });
+		let u = await z(i, t);
+		if (u === null) throw new b({
+			procedure: e.procedure,
+			message: "the approval intent was written and could not be read back"
+		});
+		return u;
+	}, l = (e, t) => new v({
+		approvalId: String(e.id),
+		procedure: String(e.procedure),
+		expiresAt: I(e.expiresAt),
+		requiredScopes: P(R(e.approverGuards)),
+		reason: e.reason ?? null,
+		created: t
+	});
+	return { admit: async (e) => {
+		let r = x(e.input), o = F({
+			procedure: e.procedure,
+			requestedBy: e.subject?.id ?? null,
+			tenantId: e.subject?.tenantId ?? null,
+			payload: r,
+			nonce: e.nonce
+		}), s = await z(i, o);
+		if (s === null) throw l(await c(e, o, r), !0);
+		let u = String(s.status ?? "pending"), d = L(s.expiresAt);
+		if ((u === "pending" || u === "approved") && a() > d) throw await V(i, s, { status: "expired" }), new p({
+			approvalId: String(s.id),
+			expiredAt: I(s.expiresAt)
+		});
+		if (u === "pending") throw l(s, !1);
+		if (u === "rejected") throw await V(i, s, {}), new _({
+			approvalId: String(s.id),
+			decidedBy: s.decidedBy ?? null,
+			note: s.note ?? null
+		});
+		if (u === "approved") {
+			if (await i.updateMany("_voltro_approvals", {
+				status: "consumed",
+				consumedAt: new Date(a()),
+				intentKey: `${o}#${String(s.id)}`
+			}, { where: t(n("id", String(s.id)), n("status", "approved")) }) === 1) return;
+			throw s = await z(i, o), s === null ? l(await c(e, o, r), !0) : l(s, !1);
+		}
+		throw await V(i, s, {}), l(await c(e, o, r), !0);
+	} };
+}, W, G = (e) => {
+	W = e;
+}, K = () => W, q = () => {
+	W = void 0;
+}, J = async (e) => {
+	if (e.policy === void 0) return;
+	let t = K();
+	if (t === void 0) throw new b({
+		procedure: e.procedure,
+		message: `${e.procedure} declares \`requiresApproval\` and no approvals gate is installed on this boot path, so the framework cannot record the intent or verify a decision. Refusing the call rather than running it unapproved.`
+	});
+	await t.admit({
+		procedure: e.procedure,
+		kind: e.kind,
+		policy: e.policy,
+		subject: e.subject ?? null,
+		input: e.input,
+		...e.traceId === void 0 ? {} : { traceId: e.traceId }
+	});
+}, Y = async (r, i) => {
+	let a = i.now ?? Date.now, o = await B(r, i.approvalId);
+	if (o === null) throw new h({ approvalId: i.approvalId });
+	let s = String(o.status ?? "pending");
+	if (s !== "pending") throw new g({
+		approvalId: i.approvalId,
+		status: s
+	});
+	if (a() > L(o.expiresAt)) throw await V(r, o, { status: "expired" }), new p({
+		approvalId: i.approvalId,
+		expiredAt: I(o.expiresAt)
+	});
+	let c = i.approver?.id ?? null;
+	if (c === null) throw new m({
+		approvalId: i.approvalId,
+		required: null,
+		message: "an approval decision needs an identified subject — an anonymous caller cannot be the second human"
+	});
+	if (c === (o.requestedBy ?? null)) throw new y({
+		approvalId: i.approvalId,
+		subjectId: c
+	});
+	let l = N(R(o.approverGuards)), u = await e.runPromise(S(i.approver, l, JSON.parse(String(o.payload ?? "null"))));
+	if (u) throw new m({
+		approvalId: i.approvalId,
+		required: "_tag" in u && u._tag === "ScopeError" ? u.required : null,
+		message: u.message
+	});
+	let d = i.decision === "approve" ? "approved" : "rejected";
+	if (await r.updateMany("_voltro_approvals", {
+		status: d,
+		decidedBy: c,
+		decidedAt: new Date(a()),
+		note: i.note ?? null
+	}, { where: t(n("id", i.approvalId), n("status", "pending")) }) !== 1) {
+		let e = await B(r, i.approvalId);
+		throw new g({
+			approvalId: i.approvalId,
+			status: String(e?.status ?? "unknown")
+		});
+	}
+	return {
+		approvalId: i.approvalId,
+		status: d
+	};
+}, X = async (t, n, r) => {
+	let i = n?.id ?? null;
+	if (i === null) return [];
+	let o = r?.now ?? Date.now, s = await t.query({
+		table: O,
+		predicate: a("status", ["pending", "approved"]),
+		order: []
+	}), c = [];
+	for (let t of s) {
+		if (o() > L(t.expiresAt)) continue;
+		let r = R(t.approverGuards), a = (t.requestedBy ?? null) === i, s = a ? "requested" : null;
+		a || await e.runPromise(S(n, N(r), JSON.parse(String(t.payload ?? "null")))) === null && String(t.status) === "pending" && (s = "to-decide"), s !== null && c.push({
+			id: String(t.id),
+			procedure: String(t.procedure),
+			kind: String(t.kind) === "action" ? "action" : "mutation",
+			requestedBy: t.requestedBy ?? null,
+			status: String(t.status ?? "pending"),
+			reason: t.reason ?? null,
+			requiredScopes: P(r),
+			requestedAt: I(t.requestedAt),
+			expiresAt: I(t.expiresAt),
+			decidedBy: t.decidedBy ?? null,
+			decidedAt: t.decidedAt == null ? null : I(t.decidedAt),
+			note: t.note ?? null,
+			relation: s
+		});
+	}
+	return c.sort((e, t) => t.requestedAt.localeCompare(e.requestedAt)).slice(0, r?.limit ?? 50);
+}, Z = () => f();
+//#endregion
+export { O as APPROVALS_TABLE, k as DEFAULT_APPROVAL_EXPIRY_MS, A as _voltroApprovalsTable, F as approvalIntentKey, Z as approvalNonce, x as canonicalJson, q as clearApprovalGate, Y as decideApproval, J as enforceApproval, K as getApprovalGate, G as installApprovalGate, U as makeApprovalGate, H as parseApprovalInterval, X as pendingApprovalsFor, N as rehydrateGuards, P as scopeStringsOf, M as serializeGuards };

package/dist/authMiddlewareLayer.js

@@ -0,0 +1,48 @@
+import { applyConnectionCredential as e, getCredentialExpiry as t, recordCredentialExpiry as n } from "./connectionCredentials.js";
+import { Context as r, Effect as i, Layer as a, Option as o, Schema as s } from "effect";
+import { AuthMiddleware as c, ConnectionInfo as l, ConnectionInfoMiddleware as u, RequestedTenantRefused as d, SubjectService as f, Unauthenticated as p } from "@voltro/protocol";
+import { Rpc as m } from "effect/rpc";
+import { sessionExpiryFromHeaders as h } from "@voltro/protocol/session";
+//#region src/authMiddlewareLayer.ts
+var g = class extends r.Service()("@voltro/runtime/VerifiedCredentialLifetime") {}, _ = (e) => {
+	for (let t of e.requests.values()) if (m.isRpc(t) && [...t.middlewares].some((e) => e.key === c.key || e.key === u.key)) throw Error("withRpcAuthMiddleware requires a group without AuthMiddleware or ConnectionInfoMiddleware; apply the shared pair once");
+	return e.middleware(u).middleware(c);
+}, v = (r) => {
+	let m = /* @__PURE__ */ new WeakSet(), _ = c.of((t, a) => {
+		m.add(a);
+		let { headers: o, client: c, rpc: l } = a;
+		return i.tryPromise({
+			try: async () => {
+				let t = await r.resolveSubject({
+					headers: e(c.id, o),
+					clientId: c.id
+				});
+				return n(c.id, t.credentialExpiresAt), t;
+			},
+			catch: (e) => e
+		}).pipe(i.catch((e) => s.is(s.Union([p, d]))(e) ? i.fail(e) : i.die(e)), i.flatMap((e) => {
+			let t = e.subject;
+			if (t.type !== "service") return i.succeed(e);
+			let n = r.serviceCallersFor?.(l._tag);
+			return n !== void 0 && n.includes(t.service) ? i.succeed(e) : i.fail(new p({ reason: `service '${t.service}' is not a caller of '${l._tag}' — a service credential reaches only the procedures that list it in \`service: { callers }\`` }));
+		}), i.flatMap((e) => i.provideService(t, f, e.subject).pipe(i.provideService(g, {
+			request: a,
+			credentialExpiresAt: e.credentialExpiresAt
+		}))));
+	});
+	return a.mergeAll(a.succeed(c, _), a.succeed(u, u.of((n, r) => i.gen(function* () {
+		let { headers: n, client: a, rpc: s } = r, l = yield* i.serviceOption(g), u = o.filter(l, (e) => e.request === r);
+		if (o.isNone(u) && m.has(r) && [...s.middlewares].some((e) => e.key === c.key)) throw Error("RPC authentication must run before ConnectionInfoMiddleware; compose the group with withRpcAuthMiddleware");
+		let d = o.isSome(u) ? u.value.credentialExpiresAt : t(a.id) ?? h(e(a.id, n)), f = e(a.id, n).cookie, p = n["idempotency-key"], _ = n["voltro-resume-from"], v = n["voltro-reconcile"], y = _ !== void 0 && /^\d+$/.test(_) ? Number(_) : void 0;
+		return {
+			clientId: a.id,
+			...f === void 0 ? {} : { cookieHeader: f },
+			...p ? { idempotencyKey: p } : {},
+			...d === void 0 ? {} : { credentialExpiresAt: d },
+			...y !== void 0 && Number.isSafeInteger(y) ? { resumeFrom: y } : {},
+			...v !== void 0 && /^[a-zA-Z0-9_-]{1,128}$/.test(v) ? { reconcile: v } : {}
+		};
+	}).pipe(i.flatMap((e) => i.provideService(n, l, e))))));
+}, y = (e) => a.succeed(u, u.of((t, { headers: n, client: r }) => i.sync(() => (e(n, r.id), { clientId: r.id })).pipe(i.flatMap((e) => i.provideService(t, l, e)))));
+//#endregion
+export { v as makeAuthMiddlewareLayers, y as observeConnectionHeaders, _ as withRpcAuthMiddleware };

package/dist/bindEvent.js

@@ -0,0 +1,92 @@
+import { recordEventDelivered as e, recordEventDropped as t } from "./metrics.js";
+import { registerConnectionStream as n } from "./connectionCredentials.js";
+import { boundByCredential as r } from "./credentialBound.js";
+import { Effect as i, Queue as a, Stream as o } from "effect";
+import { ConnectionInfo as s, ScopeError as c, SubjectService as l, checkGuardsEffect as u, isOpenAccess as d, recheckGuardsEffect as f } from "@voltro/protocol";
+//#region src/bindEvent.ts
+var p = 64, m = 1, h = (e) => e.kind === "gap" ? {
+	_tag: "gap",
+	missed: e.missed,
+	reason: e.reason
+} : {
+	_tag: "event",
+	origin: e.envelope.origin,
+	n: e.envelope.n,
+	emittedAt: e.envelope.emittedAt,
+	payload: e.envelope.payload
+}, g = (e) => {
+	let t = new Map(e ?? []);
+	return (e, n = 0) => {
+		let r = t.get(e.origin) ?? 0;
+		return t.set(e.origin, Math.max(r, e.n)), r === 0 && n === 0 ? 0 : Math.max(0, e.n - r - 1);
+	};
+}, _ = (p) => o.unwrap(i.gen(function* () {
+	let m = yield* l, _ = yield* s, v = m.tenantId ?? null, y = p.guards === void 0 ? void 0 : p.guards.filter((e) => !d(e));
+	if (y !== void 0 && y.length > 0 || m.type === "service") {
+		let e = yield* u(m, y ?? [], p.key);
+		if (e) return yield* i.fail(e);
+	}
+	let b = p.clientPolicy, x = () => new c({
+		required: p.requiredClientPolicy ?? "event:client-policy",
+		message: "event client access denied"
+	});
+	if (p.requiredClientPolicy !== void 0 && (!b || b.id !== p.requiredClientPolicy) || b !== void 0 && p.requiredClientPolicy === void 0) return yield* i.fail(x());
+	let S = () => ({
+		subject: structuredClone(m),
+		event: p.event,
+		key: structuredClone(p.key)
+	}), C = () => b === void 0 ? i.succeed(!0) : i.suspend(() => b.admit(S())).pipe(i.catch(() => i.succeed(!1)), i.catchDefect(() => i.succeed(!1)), i.map((e) => e === !0)), w = b?.monitor === void 0 ? void 0 : yield* i.suspend(() => b.monitor(S())).pipe(i.catch(() => i.fail(x())), i.catchDefect(() => i.fail(x())));
+	if (!(yield* C())) return yield* i.fail(x());
+	let T = p.bus.deliveryFor(p.event) === "latest", E = yield* a.sliding(p.queueSize ?? (T ? 1 : 64)), D = /* @__PURE__ */ new Map(), O = p.bus.subscribe({
+		tenantId: v,
+		event: p.event,
+		key: p.key,
+		options: p.options,
+		onAttach: (e) => {
+			D = e;
+		},
+		listener: (e) => {
+			i.runSync(a.offer(E, e));
+		}
+	});
+	if (yield* i.addFinalizer(() => i.sync(() => {
+		O();
+	})), _.clientId !== void 0) {
+		let e = n(_.clientId, () => {
+			i.runPromise(a.shutdown(E));
+		});
+		yield* i.addFinalizer(() => i.sync(() => {
+			e();
+		}));
+	}
+	let k = T ? () => 0 : g(D), A = () => f(m, y, p.key), j = o.fromQueue(E).pipe(o.flatMap((e) => o.unwrap(A().pipe(i.map((t) => t ? o.fail(t) : M(e))))), o.ensuring(a.shutdown(E)));
+	function M(e) {
+		if (b === void 0) return N(e);
+		let t = e.kind === "gap" ? C().pipe(i.map((e) => e ? "allow" : "deny")) : i.suspend(() => b.deliver({
+			...S(),
+			payload: structuredClone(e.envelope.payload),
+			emittedAt: e.envelope.emittedAt
+		})).pipe(i.catch(() => i.succeed("deny")), i.catchDefect(() => i.succeed("deny")));
+		return o.unwrap(t.pipe(i.map((t) => t === "allow" ? N(e) : t === "drop" && e.kind !== "gap" ? (k(e.envelope, e.prior), o.empty) : o.fail(x()))));
+	}
+	function N(n) {
+		return o.suspend(() => {
+			if (n.kind === "gap") return o.make(h(n));
+			let r = k(n.envelope, n.prior);
+			e(p.event);
+			let i = h(n);
+			if (r === 0) return o.make(i);
+			t(p.event, "buffer", r);
+			let a = {
+				_tag: "gap",
+				missed: r,
+				reason: "buffer"
+			};
+			return o.fromIterable([a, i]);
+		});
+	}
+	let P = { _tag: "attached" }, F = o.concat(o.fromIterable([P]), j), I = w === void 0 ? F : F.pipe(o.interruptWhen(w.pipe(i.catch(() => i.void), i.catchDefect(() => i.void), i.flatMap(() => i.fail(x())))));
+	return r(I, _.credentialExpiresAt, o.fromIterable([P]));
+}));
+//#endregion
+export { p as EVENT_CLIENT_QUEUE_SIZE, m as EVENT_LATEST_QUEUE_SIZE, _ as bindEvent, g as makeBufferGapDetector };

package/dist/bootListener.js

@@ -0,0 +1,143 @@
+import { answerProbe as e, probeFor as t, resolveHealth as n } from "./healthProbes.js";
+import { trackEngineClient as r } from "./engineClients.js";
+import { createServer as i } from "node:http";
+//#region src/bootListener.ts
+var a = "no-store", o = "1", s = /* @__PURE__ */ new Set(["ready", "draining"]), c = async (c) => {
+	let l = c.now ?? Date.now, u = {
+		phase: "booting",
+		startedAt: l()
+	}, d, f, p = /* @__PURE__ */ new Map(), m = /* @__PURE__ */ new Map(), h, g = () => u.phase === "ready", _ = () => s.has(u.phase), v = n(c.health, () => g()), y = c.health?.readiness === void 0 ? async () => g() && (f === void 0 || await f()) : v.readiness, b = () => {
+		if ((p.size > 0 || h !== void 0) && !g()) return !1;
+		for (let e of p.values()) try {
+			if (e() !== !0) return !1;
+		} catch {
+			return !1;
+		}
+		return !0;
+	}, x = () => {
+		for (let e of m.values()) try {
+			if (e() !== !0) return !1;
+		} catch {
+			return !1;
+		}
+		return !0;
+	}, S = {
+		...v,
+		readiness: async () => b() && await y() && b(),
+		liveness: async () => x() && await v.liveness() && x()
+	}, C = () => ({
+		phase: u.phase,
+		ready: g(),
+		elapsedMs: l() - u.startedAt,
+		...u.tablesTotal === void 0 ? {} : { tablesTotal: u.tablesTotal },
+		...u.error === void 0 ? {} : { error: u.error }
+	}), w = i((n, r) => {
+		let i = n.url ?? "/", s = i.indexOf("?"), c = s === -1 ? i : i.slice(0, s);
+		if (c === "/_voltro/health" && (h !== void 0 || p.size > 0)) {
+			if (n.method !== "GET" && n.method !== "HEAD") {
+				r.writeHead(405, {
+					allow: "GET, HEAD",
+					"cache-control": a
+				}), r.end();
+				return;
+			}
+			e(S, "readiness", C).then((e) => {
+				let t = e.status === 200 && g() && b();
+				r.writeHead(t ? 200 : 503, {
+					"content-type": "application/json",
+					"cache-control": a
+				}), r.end(n.method === "HEAD" ? void 0 : JSON.stringify({
+					...h,
+					phase: u.phase,
+					ready: t
+				}));
+			});
+			return;
+		}
+		let l = t(S, c);
+		l === void 0 ? d !== void 0 && _() ? d.request(n, r) : (r.writeHead(503, {
+			"content-type": "text/plain",
+			"cache-control": a,
+			"retry-after": o
+		}), r.end("starting")) : e(S, l, C).then((e) => {
+			r.writeHead(e.status, {
+				"content-type": e.contentType,
+				"cache-control": a
+			}), r.end(e.body);
+		});
+	});
+	w.on("upgrade", (e, t, n) => {
+		d !== void 0 && _() ? (r(e, t), d.upgrade(e, t, n)) : t.end(`HTTP/1.1 503 Service Unavailable\r
+Retry-After: ${o}\r\nCache-Control: no-store\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+	}), await new Promise((e, t) => {
+		let n = (e) => {
+			t(e);
+		};
+		w.once("error", n), w.listen(c.host === void 0 ? { port: c.port } : {
+			port: c.port,
+			host: c.host
+		}, () => {
+			w.removeListener("error", n), e();
+		});
+	});
+	let T = w.address()?.port ?? c.port;
+	return c.log?.info("listening early — probes answer on the app port from here on", { port: T }), {
+		server: w,
+		port: T,
+		get state() {
+			return u;
+		},
+		set: (e) => {
+			u = {
+				...u,
+				...e
+			};
+		},
+		isReady: g,
+		delegate: (e) => {
+			d = e;
+		},
+		setDependencyPing: (e) => {
+			f = e;
+		},
+		setRoleHealth: (e) => {
+			let t = (e) => {
+				if (!Array.isArray(e) || e.length === 0 || e.length > 64 || e.some((e) => typeof e != "string" || !/^[a-z][a-z0-9._-]{0,63}$/.test(e)) || new Set(e).size !== e.length) throw Error("Invalid role health identity");
+				return Object.freeze([...e]);
+			};
+			h = Object.freeze({
+				roles: t(e.roles),
+				workloads: t(e.workloads)
+			});
+		},
+		addReadinessGate: (e, t) => {
+			if (!/^[a-z][a-z0-9._-]{0,63}$/.test(e) || typeof t != "function") throw Error("Invalid readiness gate");
+			if (p.has(e)) throw Error("Readiness gate is already registered");
+			p.set(e, t);
+			let n = !1;
+			return () => {
+				n || (n = !0, p.get(e) === t && p.delete(e));
+			};
+		},
+		addLivenessGate: (e, t) => {
+			if (!/^[a-z][a-z0-9._-]{0,63}$/.test(e) || typeof t != "function") throw Error("Invalid liveness gate");
+			if (m.has(e)) throw Error("Liveness gate is already registered");
+			m.set(e, t);
+			let n = !1;
+			return () => {
+				n || (n = !0, m.get(e) === t && m.delete(e));
+			};
+		},
+		close: () => new Promise((e) => {
+			w.listening ? (w.closeAllConnections(), w.close(() => {
+				e();
+			})) : e();
+		})
+	};
+};
+//#endregion
+export { c as bindBootListener };

package/dist/bootRefusal.js

@@ -0,0 +1,7 @@
+//#region src/bootRefusal.ts
+var e = "VoltroBootRefusal", t = (t) => {
+	let n = Error(t);
+	return n.name = e, n;
+}, n = (e) => typeof e == "object" && !!e && e.name === "VoltroBootRefusal";
+//#endregion
+export { e as BOOT_REFUSAL_NAME, t as bootRefusal, n as isBootRefusal };

package/dist/bootStoreCodec.js

@@ -0,0 +1,71 @@
+import { getFieldCipher as e } from "./fieldCipher.js";
+import { upsertDestinationId as t } from "./upsertBinding.js";
+import { decryptFieldsOnRead as n, deserializeArraysOnRead as r, encryptFieldsForWrite as i, encryptFieldsForWriteBatch as a, encryptedColumnsOf as o, getTable as s, jsonPatchAssignments as c, refuseIdChangeOfSealedRow as l, serializeArraysForWrite as u, upsertUpdateValues as d } from "@voltro/database";
+import { createLogger as f } from "@voltro/logger";
+//#region src/bootStoreCodec.ts
+var p = f({ scope: "store.fieldEncryption" }), m = (f, h) => {
+	let g = h, _ = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", v = /* @__PURE__ */ new Set(), y = (e) => {
+		let t = `${e.table}.${e.column}`;
+		v.has(t) || (v.add(t), p.warn("encrypted column degraded to null — could not decrypt with the active key", {
+			table: e.table,
+			column: e.column,
+			reason: e.reason,
+			hint: "VOLTRO_FIELD_DECRYPT_ON_ERROR=null is set — this row was likely encrypted under a different key"
+		}));
+	}, b = (t, n, r) => {
+		let a = s(t), o = g ? u(n, a, g) : n;
+		return i(o, a, e(), r);
+	}, x = (t, i, a) => {
+		let o = s(t), c = n(i, o, e(), {
+			onError: _,
+			..._ === "null" ? { warn: y } : {},
+			...a === void 0 ? {} : { rowId: a }
+		});
+		return g ? r(c, o, g) : c;
+	}, S = (e, t, n) => t === null ? null : x(e, [t], n)[0];
+	return {
+		delete: (e, t) => f.delete(e, t),
+		deleteMany: (e, t) => f.deleteMany(e, t),
+		onChange: (e) => f.onChange(e),
+		injectExternalChange: (e) => {
+			f.injectExternalChange(e);
+		},
+		...f.changeScope === void 0 ? {} : { changeScope: f.changeScope },
+		...f.withNamespace === void 0 ? {} : { withNamespace: (e) => m(f.withNamespace(e), h) },
+		...f.raw === void 0 ? {} : { raw: ((...e) => f.raw(...e)) },
+		...f.close === void 0 ? {} : { close: (e) => f.close(e) },
+		...f.ping === void 0 ? {} : { ping: () => f.ping() },
+		query: async (e) => x(e.table, await f.query(e)),
+		...f.integrityQuery === void 0 ? {} : { integrityQuery: async (e) => x(e.table, await f.integrityQuery(e)) },
+		insert: async (e, t) => S(e, await f.insert(e, b(e, t))),
+		insertMany: async (t, n, r) => {
+			let i = s(t), o = g ? n.map((e) => u(e, i, g)) : n, c = a(o, i, e());
+			return x(t, await f.insertMany(t, c, r));
+		},
+		update: async (e, t, n) => S(e, await f.update(e, t, (l(n, s(e), t), b(e, n, t))), t),
+		updateMany: async (e, t, n) => {
+			let r = s(e), i = (r === void 0 ? [] : o(r)).filter((e) => t[e] !== void 0 && t[e] !== null);
+			if (i.length > 0) throw Error(`updateMany on the boot store cannot write the .encrypted() column(s) ${i.join(", ")} on "${e}": an encrypted value is bound to its row and a set-based write has no row. Write them through the request-scoped store, or key the write with update(table, id, patch).`);
+			return f.updateMany(e, b(e, t), n);
+		},
+		upsert: async (e, n, r) => {
+			let i = d(r), a = await t(f, e, n, r.conflictColumns);
+			return S(e, await f.upsert(e, b(e, n, a), {
+				...r,
+				...r.updateValues === void 0 ? {} : { updateValues: b(e, i, a) }
+			}), a);
+		},
+		insertIgnore: async (e, t, n) => S(e, await f.insertIgnore(e, b(e, t), n)),
+		insertIgnoreWithOutcome: async (e, t, n) => {
+			let r = await f.insertIgnoreWithOutcome(e, b(e, t), n);
+			return {
+				row: S(e, r.row),
+				outcome: r.outcome
+			};
+		},
+		patchJson: async (e, t, n, r, i) => S(e, await f.patchJson(e, t, n, r, b(e, c(t, n, i), t)), t),
+		transactional: (e) => f.transactional((t) => e(m(t, h)))
+	};
+};
+//#endregion
+export { m as wrapStoreWithBootCodec };