@voltro/runtime 0.85.0 → 0.87.0

package/dist/businessRules.js

@@ -0,0 +1,67 @@
+import { getTable as e } from "@voltro/database";
+import { BusinessRuleViolation as t } from "@voltro/protocol";
+import { log as n } from "@voltro/logger";
+//#region src/businessRules.ts
+var r = (e) => e.startsWith("_voltro"), i = (e) => {
+	let t = e?.id;
+	return typeof t == "string" ? t : void 0;
+}, a = (e) => {
+	let t = /* @__PURE__ */ new Map(), n = (e, n) => {
+		if (n == null || r(e)) return;
+		let a = i(n);
+		a !== void 0 && t.set(`${e}\u0000${a}`, {
+			table: e,
+			id: a,
+			row: n
+		});
+	};
+	return {
+		tx: new Proxy(e, { get(e, t, r) {
+			if (t === "insert") return async (t, r) => {
+				let i = await e.insert.call(e, t, r);
+				return n(t, i), i;
+			};
+			if (t === "update") return async (t, r, i) => {
+				let a = await e.update.call(e, t, r, i);
+				return n(t, a ?? {
+					...i,
+					id: r
+				}), a;
+			};
+			let i = Reflect.get(e, t, r);
+			return typeof i == "function" ? i.bind(e) : i;
+		} }),
+		drain: () => [...t.values()]
+	};
+}, o = (e) => {
+	if (e !== !0 && e !== void 0) return e === !1 ? {} : e;
+}, s = async (r) => {
+	if (r.touched.length === 0) return;
+	let i = {
+		store: r.store,
+		subject: r.subject
+	};
+	for (let { table: a, row: s } of r.touched) {
+		let r = e(a)?.appliedRules;
+		if (r !== void 0 && r.length !== 0) for (let e of r) {
+			let r = o(await e.predicate(s, i));
+			if (r !== void 0) {
+				if (e.severity === "warning") n.warn("business rule violated (warning)", {
+					rule: e.name,
+					table: a,
+					...r.field === void 0 ? {} : { field: r.field },
+					...r.params === void 0 ? {} : { params: r.params }
+				});
+				else throw new t({
+					rule: e.name,
+					severity: "error",
+					...r.params === void 0 ? {} : { params: r.params },
+					...r.field === void 0 ? {} : { field: r.field },
+					...r.message === void 0 ? {} : { message: r.message }
+				});
+			}
+		}
+	}
+};
+//#endregion
+export { s as evaluateTouchedRules, a as makeRuleCapture };

package/dist/changeClaimsTable.js

@@ -0,0 +1,12 @@
+import { id as e, integer as t, table as n, text as r, timestamp as i } from "@voltro/database";
+//#region src/changeClaimsTable.ts
+var a = n("_voltro_change_claims", {
+	id: e({ prefix: "chclaim" }),
+	scope: r(),
+	key: r(),
+	claimedBy: r(),
+	claimedAt: i(),
+	nextSlot: t().default(0)
+}).unique(["scope", "key"]).index(["claimedAt"]);
+//#endregion
+export { a as _voltroChangeClaimsTable };

package/dist/circuitBreaker.js

@@ -0,0 +1 @@
+export { CircuitBreaker, CircuitOpen } from "@voltro/shared";

package/dist/columnOnUpdate.js

@@ -0,0 +1,23 @@
+//#region src/columnOnUpdate.ts
+var e = (e) => {
+	if (!(e.length < 32 || Object.getPrototypeOf(e) !== Array.prototype || Object.getOwnPropertySymbols(e).length > 0 || Object.hasOwn(e, "includes"))) {
+		for (let t = 0; t < e.length; t++) {
+			let n = Object.getOwnPropertyDescriptor(e, String(t));
+			if (n === void 0 || !("value" in n) || typeof n.value != "string") return;
+		}
+		return new Set(e);
+	}
+}, t = (t, n, r, i = []) => {
+	let a = t.tables.get(n)?.onUpdateFields;
+	if (a === void 0 || a.size === 0) return r;
+	let o = { ...r }, s = a.size >= 32 ? e(i) : void 0;
+	for (let [e, t] of a) {
+		if (o[e] !== void 0 || (s?.has(e) ?? i.includes(e))) continue;
+		t !== "now" && (s = void 0);
+		let n = t === "now" ? /* @__PURE__ */ new Date() : t();
+		n === void 0 ? delete o[e] : o[e] = n;
+	}
+	return o;
+};
+//#endregion
+export { t as applyColumnOnUpdate };

package/dist/composeAnalytics.js

@@ -0,0 +1,129 @@
+import { AnalyticsCapabilityNotSupported as e } from "./analyticsSink.js";
+import { Effect as t } from "effect";
+//#region src/composeAnalytics.ts
+var n = "noop", r = () => {
+	let r = (r) => t.fail(new e({
+		provider: n,
+		capability: r
+	}));
+	return {
+		info: {
+			provider: n,
+			capabilities: {
+				track: !0,
+				aggregate: !1,
+				timeseries: !1,
+				topN: !1,
+				mirror: !1
+			}
+		},
+		track: () => t.void,
+		aggregate: () => r("aggregate"),
+		timeseries: () => r("timeseries"),
+		topN: () => r("topN")
+	};
+}, i = (n) => {
+	if (n.length === 0) return r();
+	if (n.length === 1) return n[0];
+	let i = {
+		provider: "compose",
+		capabilities: {
+			track: n.some((e) => e.info.capabilities.track),
+			aggregate: n.some((e) => e.info.capabilities.aggregate),
+			timeseries: n.some((e) => e.info.capabilities.timeseries),
+			topN: n.some((e) => e.info.capabilities.topN),
+			mirror: n.some((e) => e.info.capabilities.mirror)
+		},
+		detail: { members: n.map((e) => e.info) }
+	}, a = (e) => t.forEach(n, (n) => n.track(e).pipe(t.catch((e) => t.logWarning(`analytics-sink ${n.info.provider} track failed`, { err: e }))), {
+		concurrency: "unbounded",
+		discard: !0
+	}), o = (r, i) => {
+		let a = n.find((e) => e.info.capabilities[r]);
+		return a === void 0 ? t.fail(new e({
+			provider: "compose",
+			capability: r
+		})) : i(a);
+	}, s = n.filter((e) => e.mirror !== void 0), c = s.every((e) => {
+		let t = Object.getOwnPropertyDescriptor(e, "mirror");
+		if (t === void 0 || !("value" in t)) return !1;
+		let n = Object.getOwnPropertyDescriptor(t.value, "tables");
+		if (n === void 0 || !("value" in n)) return !1;
+		let r = n.value;
+		if (!Array.isArray(r) || Object.getPrototypeOf(r) !== Array.prototype || r.includes !== Array.prototype.includes || r[Symbol.iterator] !== Array.prototype[Symbol.iterator]) return !1;
+		for (let e = 0; e < r.length; e++) {
+			let t = Object.getOwnPropertyDescriptor(r, String(e));
+			if (t === void 0 || !("value" in t) || typeof t.value != "string") return !1;
+		}
+		return !0;
+	}), l = /* @__PURE__ */ new Map();
+	for (let e of c ? s : []) for (let t of new Set(e.mirror.tables)) {
+		let n = l.get(t);
+		n === void 0 ? l.set(t, [e]) : n.push(e);
+	}
+	let u = (e) => c ? l.get(e) ?? [] : s.filter((t) => t.mirror.tables.includes(e)), d = s.length === 0 ? void 0 : {
+		tables: Array.from(new Set(s.flatMap((e) => e.mirror.tables))),
+		upsert: (e) => t.forEach(u(e.table), (t) => t.mirror.upsert(e), {
+			concurrency: "unbounded",
+			discard: !0
+		}),
+		remove: (e) => t.forEach(u(e.table), (t) => t.mirror.remove(e), {
+			concurrency: "unbounded",
+			discard: !0
+		}),
+		maxVersion: (e) => t.forEach(u(e.table), (t) => t.mirror.maxVersion(e), { concurrency: "unbounded" }).pipe(t.map((e) => {
+			let t = null;
+			for (let n of e) n !== null && (t = Math.max(t ?? -Infinity, n));
+			return t;
+		}))
+	};
+	return {
+		info: i,
+		track: a,
+		aggregate: (e) => o("aggregate", (t) => t.aggregate(e)),
+		timeseries: (e) => o("timeseries", (t) => t.timeseries(e)),
+		topN: (e) => o("topN", (t) => t.topN(e)),
+		...d === void 0 ? {} : { mirror: d }
+	};
+}, a = (e) => {
+	let n = [...e], r, a, o = () => t.suspend(() => t.forEach([...r ?? []].reverse(), (e) => e.released ? t.void : (e.released = !0, e.spec.dispose === void 0 ? t.void : t.suspend(() => e.spec.dispose(e.sink)).pipe(t.catchCause(() => t.logWarning("analytics member teardown failed")))), {
+		concurrency: 1,
+		discard: !0
+	})), s = () => t.promise(() => a ??= t.runPromise(o())), c = (e) => {
+		if (r !== void 0) throw Error("An analytics composite belongs to one app owner");
+		r = [];
+		for (let t of n) {
+			if (t.sql === "required" && e === void 0) throw Error("Analytics member requires SQL");
+			let n = t.sql === "required" ? t.build(e) : t.build();
+			r.push({
+				spec: t,
+				sink: n,
+				released: !1
+			});
+		}
+		return i(r.map((e) => e.sink));
+	}, l = {
+		kind: "compose",
+		tables: n.flatMap((e) => e.tables ?? []),
+		initialize: () => t.suspend(() => r === void 0 ? t.die(/* @__PURE__ */ Error("Build analytics members before initialization")) : t.forEach(r, (e) => e.spec.initialize === void 0 ? t.void : t.suspend(() => e.spec.initialize(e.sink)), {
+			concurrency: 1,
+			discard: !0
+		}).pipe(t.onError(s))),
+		...n.some((e) => e.dispose !== void 0) ? { dispose: s } : {}
+	};
+	return n.some((e) => e.sql === "required") ? {
+		...l,
+		sql: "required",
+		build: (e) => c(e)
+	} : {
+		...l,
+		sql: "none",
+		build: () => c()
+	};
+}, o = {
+	kind: "noop",
+	sql: "none",
+	build: () => r()
+};
+//#endregion
+export { n as NOOP_ANALYTICS_PROVIDER, a as composeAnalytics, i as composeAnalyticsSinks, r as noopAnalytics, o as noopAnalyticsSpec };

package/dist/computedQuery.js

@@ -0,0 +1,4 @@
+//#region src/computedQuery.ts
+var e = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0;
+//#endregion
+export { e as isComputedQuery };

package/dist/computedQueryCache.js

@@ -0,0 +1,231 @@
+import { canonicalize as e } from "./fingerprint.js";
+import { currentRawReads as t, runWithRawReadScope as n } from "./rawReadScope.js";
+import { classifyRead as r } from "./readClassification.js";
+import { buildSubjectKey as i } from "./rywPositionStore.js";
+import { runWithRoutingContext as a } from "./replicatedDataStore.js";
+import { Effect as o, Option as s, Schema as c } from "effect";
+import { createHash as l } from "node:crypto";
+import { parseRevalidateMs as u, schemaShape as d, shapeDigest as f } from "@voltro/protocol";
+import { AsyncLocalStorage as p } from "node:async_hooks";
+//#region src/computedQueryCache.ts
+var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
+	let e = globalThis, t = e[m];
+	return t === void 0 && (t = {
+		storage: new p(),
+		installed: !1
+	}, e[m] = t), t;
+}, g = () => {
+	h().installed = !0;
+}, _ = () => h().installed, v = () => {
+	h().installed = !1;
+}, y = (e) => {
+	let t = h().storage.getStore();
+	if (t === void 0) return;
+	let { composed: n, restricting: i } = r(e, !1);
+	for (let e of n) t.tables.add(e);
+	for (let e of i) t.tables.add(e);
+}, b = Symbol.for("@voltro/runtime:query-dependencies"), x = () => {
+	let e = globalThis, t = e[b];
+	return t === void 0 && (t = { storage: new p() }, e[b] = t), t;
+}, S = () => {
+	x().storage.enterWith(/* @__PURE__ */ new Set());
+}, C = () => [...x().storage.getStore() ?? []], w = (e) => {
+	x().storage.getStore()?.add(e), h().storage.getStore()?.tables.add(e);
+}, T = (e) => {
+	h().storage.getStore()?.volatile.add(e);
+}, E = (e, t) => h().storage.run(e, t), D = () => ({
+	tables: /* @__PURE__ */ new Set(),
+	caller: /* @__PURE__ */ new Set(),
+	volatile: /* @__PURE__ */ new Set()
+}), O = /* @__PURE__ */ new Set([
+	"connections",
+	"apis",
+	"kv",
+	"cache",
+	"webhooks",
+	"workflows",
+	"events",
+	"outbox",
+	"transaction",
+	"storeForTenant"
+]), k = /* @__PURE__ */ new Set(["access", "connectionState"]), A = (e, t, n) => new Proxy(e, { get(e, r) {
+	return typeof r == "string" && !t.has(r) && n.caller.add(`subject.${r}`), Reflect.get(e, r, e);
+} }), j = (e, t, n) => {
+	let r = e.request, i = r === void 0 ? void 0 : new Proxy(r, { get(e, r) {
+		return r === "subject" ? t : ((r === "clientId" || r === "cookieHeader") && n.caller.add(`request.${r}`), Reflect.get(e, r, e));
+	} });
+	return new Proxy(e, { get(e, t) {
+		if (t === "request" && i !== void 0) return i;
+		typeof t == "string" && (O.has(t) && n.volatile.add(`ctx.${t}`), k.has(t) && n.caller.add(`ctx.${t}`));
+		let r = Reflect.get(e, t, e);
+		return typeof r == "function" ? r.bind(e) : r;
+	} });
+}, M = /* @__PURE__ */ new WeakMap(), N = (e) => {
+	let t = M.get(e);
+	return t === void 0 && (t = c.toCodecJson(e), M.set(e, t)), t;
+}, P = /* @__PURE__ */ new WeakMap(), F = (e) => {
+	if (e === void 0) return "none";
+	let t = P.get(e);
+	return t === void 0 && (t = f(d(e.ast)), P.set(e, t)), t;
+}, I = (t) => {
+	let n = t.input === void 0 ? s.some(t.decodedInput) : c.encodeUnknownOption(N(t.input))(t.decodedInput);
+	if (s.isNone(n)) return { bypass: "input-not-encodable" };
+	let r;
+	if (t.scope === "global") r = "g";
+	else if (t.scope === "tenant") {
+		if (t.subject.tenantId == null) return { bypass: "no-tenant" };
+		r = `t:${t.subject.tenantId}`;
+	} else {
+		if (t.subject.type === "anonymous" || t.subject.id == null || t.subject.id === "") return { bypass: "anonymous-subject" };
+		r = `s:${t.subject.id}`;
+	}
+	let i = t.rowFilter === void 0 ? [] : [...t.declaredSources].sort().map((n) => [n, e(t.rowFilter(n) ?? null)]), a;
+	try {
+		a = JSON.stringify([
+			t.codeIdentity,
+			F(t.output),
+			e(n.value),
+			i
+		]);
+	} catch {
+		return { bypass: "input-not-encodable" };
+	}
+	let o = l("sha256").update(a).digest("base64url");
+	return { key: `cq:${t.name}:${o}:${r}` };
+}, L = (e) => {
+	if (e.aborted) return { refused: {
+		reason: "aborted",
+		detail: []
+	} };
+	if (e.cacheScope !== "subject" && e.scope.caller.size > 0) return { refused: {
+		reason: "caller",
+		detail: [...e.scope.caller].sort()
+	} };
+	if (!e.volatileAllowed && e.scope.volatile.size > 0) return { refused: {
+		reason: "volatile",
+		detail: [...e.scope.volatile].sort()
+	} };
+	let t = e.rawReads.filter((e) => e.dependsOn.length === 0).map((e) => e.sql);
+	if (t.length > 0) return { refused: {
+		reason: "undeclared-raw-read",
+		detail: t
+	} };
+	let n = new Set(e.declaredSources);
+	for (let t of e.scope.tables) n.add(t);
+	for (let t of e.rawReads) for (let e of t.dependsOn) n.add(e);
+	if (e.rowFilter !== void 0) {
+		let t = new Set(e.declaredSources), r = [...n].filter((n) => !t.has(n) && e.rowFilter(n) !== void 0).sort();
+		if (r.length > 0) return { refused: {
+			reason: "row-filter-outside-source",
+			detail: r
+		} };
+	}
+	let r = e.output === void 0 ? s.some(e.value) : c.encodeUnknownOption(N(e.output))(e.value);
+	if (s.isNone(r)) return { refused: {
+		reason: "output-not-encodable",
+		detail: []
+	} };
+	let i;
+	try {
+		i = Buffer.byteLength(JSON.stringify(r.value) ?? "", "utf8");
+	} catch {
+		return { refused: {
+			reason: "output-not-encodable",
+			detail: []
+		} };
+	}
+	return i > e.maxEntryBytes ? { refused: {
+		reason: "oversized",
+		detail: [`${i} bytes`]
+	} } : { store: {
+		stored: r.value,
+		tags: [...n].sort()
+	} };
+}, R = (e, t) => e === void 0 ? s.some(t) : c.decodeUnknownOption(N(e))(t), z = (e, t) => {
+	let n = t.detail.join(", ");
+	switch (t.reason) {
+		case "caller": return `${e}: \`cache:\` result NOT kept — the handler read ${n}, which its cache scope does not key on, so the value is specific to this caller. Use \`scope: 'subject'\`, or derive the result without reading the caller (declare access in \`guards:\`; a membership the handler READS through ctx.store is fine — it becomes a dependency).`;
+		case "volatile": return `${e}: \`cache:\` result NOT kept — the handler used ${n}, which no table write invalidates. Declare \`cache: { …, volatile: true }\` to accept the ttl as the bound on that staleness, or drop \`cache:\`.`;
+		case "undeclared-raw-read": return `${e}: \`cache:\` result NOT kept — a raw read declares no tables, so no write could invalidate it: ${n}. Declare them: ctx.store.raw(fragment, { dependsOn: ['…'] }).`;
+		case "row-filter-outside-source": return `${e}: \`cache:\` result NOT kept — the registered row filter restricts ${n}, which the query reads but does not declare in \`source:\`. Add it to \`source:\` so the entry is keyed by what this caller may see there.`;
+		case "output-not-encodable": return `${e}: \`cache:\` result NOT kept — the value does not encode through the query's \`output\` schema.`;
+		case "oversized": return `${e}: \`cache:\` result NOT kept — ${n} exceeds the cache's maxEntryBytes.`;
+		case "aborted": return `${e}: \`cache:\` result NOT kept — the subscription closed while it was computed.`;
+	}
+}, B = (e) => {
+	let r = o.suspend(() => {
+		let r = D(), s = new Set(e.policy.scope === "tenant" ? ["tenantId"] : []), c = e.policy.scope === "subject" ? e.subject : A(e.subject, s, r), l = j(e.ctx, c, r), u = [], d = e.subject.id ?? "anonymous", f = {
+			subjectKey: i(d, void 0),
+			forcePrimary: !0
+		};
+		return o.tryPromise({
+			try: () => E(r, () => a(f, () => n(async () => {
+				let n = await e.execute(l, c);
+				return u = t(), n;
+			}))),
+			catch: (e) => e
+		}).pipe(o.map((t) => {
+			let n = new Set(e.sources), i = (e) => [...new Set(e)].filter((e) => !n.has(e)).sort();
+			if (e.isDescriptor(t)) return e.onDescriptor(), {
+				value: {
+					value: t,
+					dependencies: []
+				},
+				notApplicable: !0
+			};
+			let a = L({
+				scope: r,
+				cacheScope: e.policy.scope,
+				volatileAllowed: e.policy.volatile,
+				rawReads: u,
+				declaredSources: e.sources,
+				rowFilter: e.rowFilter,
+				output: e.output,
+				value: e.unwrap(t),
+				maxEntryBytes: e.cache.maxEntryBytes,
+				aborted: e.signal?.aborted === !0
+			});
+			if ("refused" in a) return a.refused.reason !== "aborted" && e.cache.notice(e.name, a.refused.reason, z(e.name, a.refused)), { value: {
+				value: t,
+				dependencies: i(r.tables)
+			} };
+			let o = i(a.store.tags);
+			return {
+				value: {
+					value: t,
+					dependencies: o
+				},
+				store: {
+					stored: {
+						v: a.store.stored,
+						d: o
+					},
+					tags: a.store.tags
+				}
+			};
+		}));
+	});
+	return e.cache.wrapDynamic(e.key, {
+		ttlMs: e.policy.ttlMs,
+		...e.policy.swrMs === void 0 ? {} : { swrMs: e.policy.swrMs },
+		...e.cache.leaseMs === void 0 ? {} : { leaseMs: e.cache.leaseMs },
+		label: e.name
+	}, r, (t) => o.succeed(V(e.output, t))).pipe(o.map(({ value: e }) => e));
+}, V = (e, t) => {
+	if (typeof t != "object" || !t || !("v" in t) || !("d" in t)) return s.none();
+	let n = t;
+	return !Array.isArray(n.d) || !n.d.every((e) => typeof e == "string") ? s.none() : s.map(R(e, n.v), (e) => ({
+		value: e,
+		dependencies: n.d
+	}));
+}, H = (e) => {
+	let t = u(e.ttl);
+	if (t !== null) return {
+		ttlMs: t,
+		swrMs: e.swr === void 0 ? void 0 : u(e.swr) ?? void 0,
+		scope: e.scope,
+		volatile: e.volatile === !0
+	};
+};
+//#endregion
+export { B as cachedComputedCall, I as computedCacheKey, _ as computedQueryCacheCaptureInstalled, C as currentQueryDependencies, L as decideComputedStore, R as decodeComputedStored, z as describeComputedRefusal, S as enterQueryDependencies, g as installComputedQueryCacheCapture, D as newComputedCaptureScope, y as noteCacheRead, T as noteCacheVolatile, w as noteDependency, j as observedContext, A as observedSubject, H as queryCachePolicy, v as resetComputedQueryCacheCaptureForTests, E as runWithComputedCapture };

package/dist/connectionBuiltins.js

@@ -0,0 +1,81 @@
+import { beginOAuthConnect as e, forgetCredential as t, listConnectionStates as n, storeCredential as r } from "./connectionVault.js";
+import { ConnectionHandshakeFailed as i, ConnectionKindMismatch as a, ConnectionNotDeclared as o, ConnectionSubjectRequired as s } from "@voltro/protocol";
+//#region src/connectionBuiltins.ts
+var c = (e, t) => {
+	let n = e.request?.subject?.id ?? null;
+	if (n === null || n === "") throw new s({ connectionId: t });
+	return n;
+}, l = (e, t) => {
+	let n = e.registry.get(t);
+	if (n === void 0) throw new o({ connectionId: t });
+	return n;
+}, u = (e) => async (t, r) => {
+	let i = r.request?.subject?.id ?? null;
+	return i === null || i === "" ? e.registry.list().map((e) => ({
+		connectionId: e.id,
+		kind: e.kind,
+		label: e.label ?? e.id,
+		status: "disconnected",
+		accountId: null,
+		accountLabel: null,
+		scopes: [],
+		expiresAt: null,
+		lastError: null,
+		connectedAt: null
+	})) : n(r.store, e.registry, i);
+}, d = (t) => async (n, r) => {
+	let i = l(t, n.connectionId), o = c(r, n.connectionId);
+	if (i.kind !== "oauth2") throw new a({
+		connectionId: n.connectionId,
+		expected: "oauth2",
+		actual: i.kind
+	});
+	return e({
+		store: r.store,
+		definition: i,
+		subjectId: o,
+		tenantId: r.request?.subject?.tenantId ?? null,
+		publicUrl: t.publicUrl,
+		...n.redirectTo === void 0 ? {} : { redirectTo: n.redirectTo }
+	});
+}, f = (e) => async (t, n) => {
+	let o = l(e, t.connectionId), s = c(n, t.connectionId);
+	if (o.kind !== "pat") throw new a({
+		connectionId: t.connectionId,
+		expected: "pat",
+		actual: o.kind
+	});
+	let u = t.token.trim();
+	if (u.length === 0) throw new i({
+		connectionId: t.connectionId,
+		reason: "token is empty",
+		transient: !1
+	});
+	let d;
+	if (o.validate !== void 0) try {
+		d = await o.validate(u);
+	} catch (e) {
+		throw new i({
+			connectionId: t.connectionId,
+			reason: `the provider rejected that token: ${e instanceof Error ? e.message : String(e)}`,
+			transient: !1
+		});
+	}
+	return await r({
+		store: n.store,
+		definition: o,
+		subjectId: s,
+		tenantId: n.request?.subject?.tenantId ?? null,
+		tokens: {
+			accessToken: u,
+			scopes: []
+		},
+		...d === void 0 ? {} : { account: d }
+	}), { ok: !0 };
+}, p = (e) => async (n, r) => {
+	l(e, n.connectionId);
+	let i = c(r, n.connectionId);
+	return { ok: await t(r.store, n.connectionId, i) };
+};
+//#endregion
+export { p as makeDisconnectConnectionExecutor, u as makeListConnectionsExecutor, d as makeStartConnectionExecutor, f as makeSubmitTokenExecutor };

package/dist/connectionCredentials.js

@@ -0,0 +1,66 @@
+//#region src/connectionCredentials.ts
+var e = 36e5, t = Symbol.for("@voltro/runtime/connectionCredentials"), n = globalThis, r = n[t] ??= {
+	overrides: /* @__PURE__ */ new Map(),
+	credentialExpiry: /* @__PURE__ */ new Map(),
+	streamInterrupts: /* @__PURE__ */ new Map()
+}, { overrides: i, credentialExpiry: a, streamInterrupts: o } = r, s = (e, t) => {
+	t === void 0 ? a.delete(e) : a.set(e, t);
+}, c = (e) => a.get(e), l = (e, t) => {
+	i.set(e, {
+		credential: t,
+		touchedAt: Date.now()
+	});
+}, u = (e) => {
+	let t = i.get(e);
+	if (t) return t.touchedAt = Date.now(), t.credential;
+}, d = (e) => {
+	a.delete(e), i.delete(e);
+}, f = (e, t) => {
+	let n = [], r = /* @__PURE__ */ new Set();
+	for (let i of (e ?? "").split(";")) {
+		let e = i.indexOf("=");
+		if (e < 0) continue;
+		let a = i.slice(0, e).trim();
+		if (a === "") continue;
+		let o = t[a];
+		o === void 0 ? n.push([a, i.slice(e + 1).trim()]) : (n.push([a, encodeURIComponent(o)]), r.add(a));
+	}
+	for (let [e, i] of Object.entries(t)) r.has(e) || n.push([e, encodeURIComponent(i)]);
+	return n.map(([e, t]) => `${e}=${t}`).join("; ");
+}, p = (e, t) => {
+	let n = u(e);
+	if (n === void 0) return t;
+	let r = { ...t };
+	if (n.headers !== void 0) for (let [e, t] of Object.entries(n.headers)) {
+		let n = e.toLowerCase();
+		delete r[e], r[n] = t;
+	}
+	if (n.cookies !== void 0) {
+		let e = t.cookie ?? t.Cookie;
+		delete r.Cookie, r.cookie = f(e, n.cookies);
+	}
+	return r;
+};
+r.sweepHandle ??= setInterval(() => {
+	let e = Date.now() - 864e5;
+	for (let [t, n] of i) n.touchedAt < e && i.delete(t);
+}, e), typeof r.sweepHandle == "object" && r.sweepHandle !== null && "unref" in r.sweepHandle && r.sweepHandle.unref();
+var m = (e, t) => {
+	let n = o.get(e);
+	return n || (n = /* @__PURE__ */ new Set(), o.set(e, n)), n.add(t), () => {
+		let n = o.get(e);
+		n && (n.delete(t), n.size === 0 && o.delete(e));
+	};
+}, h = (e) => {
+	let t = o.get(e);
+	if (t) {
+		for (let e of [...t]) try {
+			e();
+		} catch {}
+		o.delete(e);
+	}
+}, g = (e) => o.get(e)?.size ?? 0, _ = () => {
+	i.clear(), a.clear(), o.clear();
+};
+//#endregion
+export { g as _connectionStreamCount, _ as _resetConnectionCredentialsForTest, p as applyConnectionCredential, l as bindConnectionCredential, u as getConnectionCredential, c as getCredentialExpiry, h as interruptConnectionStreams, f as mergeCookieHeader, s as recordCredentialExpiry, m as registerConnectionStream, d as unbindConnection };

package/dist/connectionState.js

@@ -0,0 +1,34 @@
+//#region src/connectionState.ts
+var e = Symbol.for("@voltro/runtime/connectionState"), t = globalThis, n = t[e] ??= /* @__PURE__ */ new WeakMap(), r = (e, t) => {
+	let r = n.get(e);
+	if (r === void 0 && !e.signal.aborted) {
+		r = /* @__PURE__ */ new Map(), n.set(e, r);
+		let t = r;
+		e.signal.addEventListener("abort", () => {
+			t.clear(), n.delete(e);
+		}, { once: !0 });
+	}
+	let i = r, a = (n) => {
+		let r = () => {
+			!e.signal.aborted && i !== void 0 && n(i);
+		};
+		t === void 0 ? r() : t(async () => {
+			r();
+		});
+	};
+	return {
+		get: (t) => e.signal.aborted ? void 0 : structuredClone(i?.get(t)),
+		has: (t) => !e.signal.aborted && i?.has(t) === !0,
+		set: (e, t) => {
+			let n = structuredClone(t);
+			a((t) => {
+				t.set(e, n);
+			});
+		},
+		delete: (e) => a((t) => {
+			t.delete(e);
+		})
+	};
+};
+//#endregion
+export { r as makeConnectionState };