@voltro/runtime 0.86.0 → 0.87.0

package/dist/effectStore.js

@@ -35,7 +35,7 @@ var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStor
 }, v = (e) => ({
 	query: ((t) => m("query", t.table, () => e.query(t))),
 	insert: (t, n) => m("insert", t, () => e.insert(t, n)),
-	insertMany: (t, n) => m("insertMany", t, () => e.insertMany(t, n)),
+	insertMany: (t, n, r) => m("insertMany", t, () => e.insertMany(t, n, r)),
 	patchJson: (t, n, r, i, a) => m("patchJson", t, () => e.patchJson(t, n, r, i, a)),
 	update: (t, n, r) => m("update", t, () => e.update(t, n, r)),
 	updateMany: (t, n, r) => m("updateMany", t, () => e.updateMany(t, n, r)),
@@ -66,6 +66,6 @@ var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStor
 	conflictColumns: e.conflictColumns,
 	...e.update === void 0 ? {} : { update: e.update },
 	...e.updateValues === void 0 ? {} : { updateValues: e.updateValues }
-}), x = (e, t, n) => e.insert(t.tableName, n), S = (e, t, n) => e.insertMany(t.tableName, n), C = (e, t, n, r) => e.upsert(t.tableName, n, b(r)), w = (e, t, n, r) => e.upsertWithOutcome(t.tableName, n, b(r)), T = (e, t, n, r) => e.insertIgnoreWithOutcome(t.tableName, n, { conflictColumns: r.conflictColumns });
+}), x = (e, t, n) => e.insert(t.tableName, n), S = (e, t, n, r) => e.insertMany(t.tableName, n, r), C = (e, t, n, r) => e.upsert(t.tableName, n, b(r)), w = (e, t, n, r) => e.upsertWithOutcome(t.tableName, n, b(r)), T = (e, t, n, r) => e.insertIgnoreWithOutcome(t.tableName, n, { conflictColumns: r.conflictColumns });
 //#endregion
 export { u as EffectStore, T as insertIgnoreRowOutcomeEffect, S as insertManyRowsEffect, x as insertRowEffect, y as makeEffectStoreLayer, C as upsertRowEffect, w as upsertRowOutcomeEffect };

package/dist/engineClients.js

@@ -0,0 +1,24 @@
+//#region src/engineClients.ts
+var e = /* @__PURE__ */ new Map(), t = 0, n = (e) => {
+	let t = /^([a-z]{1,16})\/([0-9A-Za-z.+-]{1,100})(?:; surface=([0-9a-f]{64}))?$/.exec(e.trim());
+	return t ? {
+		target: t[1],
+		version: t[2],
+		surface: t[3] ?? null
+	} : null;
+}, r = (r, i) => {
+	let a = r.headers["x-voltro-sdk"];
+	if (typeof a != "string" || e.size >= 1024) return;
+	let o = n(a);
+	if (!o) return;
+	let s = "client-" + String(++t);
+	e.set(s, Object.freeze({
+		id: s,
+		...o,
+		connectedAt: Date.now()
+	})), i.once("close", () => {
+		e.delete(s);
+	});
+}, i = () => [...e.values()];
+//#endregion
+export { i as engineClientsSnapshot, n as parseEngineSdkHeader, r as trackEngineClient };

package/dist/externalizedTasks.js

@@ -16,10 +16,23 @@ var e = 6e4, t = (e) => {
 	if (t !== void 0) return t;
 	let n = /* @__PURE__ */ new Map();
 	return e[r] = n, n;
-}, a = (e) => {
-	i().set(e.name, e);
-}, o = (e) => {
-	i().delete(e);
-}, s = (e) => i().get(e), c = () => [...i().keys()].sort();
+}, a = (e) => Object.freeze({
+	register: (t) => {
+		let n = Object.freeze({
+			name: t.name,
+			intervalMs: t.intervalMs,
+			cron: t.cron,
+			run: t.run
+		});
+		if (e.has(n.name)) throw Error("Externalized task name is already registered: " + n.name);
+		e.set(n.name, n);
+		let r = !1;
+		return () => {
+			r || (r = !0, e.get(n.name) === n && e.delete(n.name));
+		};
+	},
+	get: (t) => e.get(t),
+	names: () => [...e.keys()].sort()
+}), o = () => a(/* @__PURE__ */ new Map()), s = (e) => a(i()).register(e), c = (e) => i().get(e), l = () => [...i().keys()].sort();
 //#endregion
-export { e as MIN_EXTERNALIZABLE_INTERVAL_MS, t as cronForInterval, n as externalizationRefusal, s as externalizedTask, c as externalizedTaskNames, a as registerExternalizedTask, o as unregisterExternalizedTask };
+export { e as MIN_EXTERNALIZABLE_INTERVAL_MS, t as cronForInterval, n as externalizationRefusal, c as externalizedTask, l as externalizedTaskNames, o as makeExternalizedTaskRegistry, s as registerExternalizedTask };

package/dist/fieldCipher.js

@@ -1,61 +1,130 @@
-import { BOUND_ENCRYPTED_PREFIX as e, ENCRYPTED_PREFIX as t, decodeFieldValue as n, encodeFieldValue as r, isEncrypted as i } from "@voltro/database";
-import { createCipheriv as a, createDecipheriv as o, randomBytes as s, scryptSync as c } from "node:crypto";
+import { recordFieldDecrypt as e } from "./metrics.js";
+import { BOUND_ENCRYPTED_PREFIX as t, ENCRYPTED_PREFIX as n, FIELD_KEY_ID_PATTERN as r, ciphertextKeyId as i, decodeFieldValue as a, encodeFieldValue as o, isEncrypted as s } from "@voltro/database";
+import { createCipheriv as c, createDecipheriv as l, createHmac as u, randomBytes as d, scryptSync as f } from "node:crypto";
 //#region src/fieldCipher.ts
-var l = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : c(e, "voltro:field-encryption:v1", 32), u = (e, t) => {
+var p = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : f(e, "voltro:field-encryption:v1", 32), m = (e, t) => {
 	let n = e === "r" ? t?.row : e === "c" ? t?.column : void 0;
 	if (n === void 0) throw Error(e === "r" || e === "c" ? `field cipher: ciphertext is bound to its ${e === "r" ? "row" : "column"} and was read without that binding` : "field cipher: malformed ciphertext");
 	return Buffer.from(n, "utf8");
-}, d = (n) => {
-	if (n.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${n.length}`);
+}, h = (e, i) => {
+	if (e.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${e.length}`);
+	if (i !== void 0 && !r.test(i)) throw Error(`field cipher: "${i}" is not a key id (a short lowercase slug)`);
+	let a = i === void 0 ? "" : `:${i}`;
 	return {
 		encrypt: (r, i) => {
-			let o = s(12), c = a("aes-256-gcm", n, o), l = i === void 0 ? void 0 : i.row === void 0 ? "c" : "r";
-			l !== void 0 && c.setAAD(u(l, i));
-			let d = Buffer.concat([c.update(r, "utf8"), c.final()]), f = c.getAuthTag(), p = `${o.toString("base64")}:${f.toString("base64")}:${d.toString("base64")}`;
-			return l === void 0 ? `${t}${p}` : `${e}${l}:${p}`;
+			let o = d(12), s = c("aes-256-gcm", e, o), l = i === void 0 ? void 0 : i.row === void 0 ? "c" : "r";
+			l !== void 0 && s.setAAD(m(l, i));
+			let u = Buffer.concat([s.update(r, "utf8"), s.final()]), f = s.getAuthTag(), p = `${o.toString("base64")}:${f.toString("base64")}:${u.toString("base64")}`;
+			return l === void 0 ? `${n}${p}${a}` : `${t}${l}:${p}${a}`;
 		},
-		decrypt: (r, i) => {
-			let a = r.startsWith(e), s = r.slice(a ? e.length : t.length).split(":"), c = a ? s.shift() ?? "" : void 0, [l, d, f] = s;
-			if (!l || !d || f === void 0) throw Error("field cipher: malformed ciphertext");
-			let p = o("aes-256-gcm", n, Buffer.from(l, "base64"));
-			return c !== void 0 && p.setAAD(u(c, i)), p.setAuthTag(Buffer.from(d, "base64")), Buffer.concat([p.update(Buffer.from(f, "base64")), p.final()]).toString("utf8");
+		decrypt: (i, a) => {
+			let o = i.startsWith(t), s = i.slice(o ? t.length : n.length).split(":"), c = o ? s.shift() ?? "" : void 0, [u, d, f, ...p] = s;
+			if (!u || !d || f === void 0 || p.length > 1 || p.length === 1 && !r.test(p[0])) throw Error("field cipher: malformed ciphertext");
+			let h = l("aes-256-gcm", e, Buffer.from(u, "base64"));
+			return c !== void 0 && h.setAAD(m(c, a)), h.setAuthTag(Buffer.from(d, "base64")), Buffer.concat([h.update(Buffer.from(f, "base64")), h.final()]).toString("utf8");
 		}
 	};
-}, f = (e, t = []) => {
-	let n = d(l(e)), r = t.filter((t) => t.trim() !== "" && t !== e).map((e) => d(l(e)));
-	if (r.length === 0) return n;
-	let i = (e, t, n) => {
+}, g = (e) => `k${u("sha256", p(e)).update("voltro:field-key-id:v1").digest("hex").slice(0, 10)}`, _ = class extends Error {
+	_tag = "FieldKeyringConfigError";
+	constructor(e) {
+		super(e), this.name = "FieldKeyringConfigError";
+	}
+}, v = (e) => e !== void 0 && typeof e.sealWith == "function" && typeof e.activate == "function", y = (t, n = {}) => {
+	let a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
+	for (let e of t.keys) {
+		if (!r.test(e.id)) throw new _(`field encryption: "${e.id}" is not a key id — use a short lowercase slug (letters, digits, "-", at most 16)`);
+		if (e.secret.trim() === "") throw new _(`field encryption: key "${e.id}" is empty`);
+		if (a.has(e.id)) throw new _(`field encryption: key id "${e.id}" is configured twice`);
+		let t = p(e.secret).toString("hex"), n = o.get(t);
+		if (n !== void 0) throw new _(`field encryption: keys "${n}" and "${e.id}" are the same key — a rotation needs a NEW key, and two ids for one key make every count per key wrong`);
+		a.set(e.id, e.secret), o.set(t, e.id);
+	}
+	if (!a.has(t.active)) throw new _(`field encryption: the active key "${t.active}" is not one of the configured keys (${[...a.keys()].join(", ") || "none"})`);
+	let s = new Map([...a].map(([e, t]) => [e, h(p(t), e)])), c = t.active, l = n.sealOnlyOnceActivated !== !0, u = [], d = () => {
+		u = [[c, s.get(c)], ...[...s].filter(([e]) => e !== c)];
+	};
+	d();
+	let f = (e, t, n) => {
 		try {
 			return e.decrypt(t, n), !0;
 		} catch {
 			return !1;
 		}
+	}, m = (e, t) => {
+		let n = i(e), r = n === void 0 ? void 0 : s.get(n);
+		return r !== void 0 && f(r, e, t) ? n : u.find(([, n]) => n !== r && f(n, e, t))?.[0];
 	};
 	return {
-		encrypt: n.encrypt,
-		decrypt: (e, t) => {
-			try {
-				return n.decrypt(e, t);
-			} catch (n) {
-				for (let n of r) try {
-					return n.decrypt(e, t);
-				} catch {}
-				throw n;
+		get activeKeyId() {
+			return c;
+		},
+		requestedKeyId: t.active,
+		keyIds: u.map(([e]) => e),
+		fingerprints: Object.freeze(Object.fromEntries([...a].map(([e, t]) => [e, g(t)]))),
+		encrypt: (e, t) => {
+			if (!l) throw Error("field cipher: nothing may be sealed before the boot has checked the keys against the database (verifyFieldKeyring decides which key is active) — a write reached an .encrypted() column during boot, before that check");
+			return s.get(c).encrypt(e, t);
+		},
+		sealWith: (e, t, n) => {
+			let r = s.get(e);
+			if (r === void 0) throw Error(`field cipher: this keyring does not hold key "${e}"`);
+			return r.encrypt(t, n);
+		},
+		opensWith: (e, t, n) => {
+			let r = s.get(e);
+			return r !== void 0 && f(r, t, n);
+		},
+		activate: (e) => {
+			if (!s.has(e)) throw Error(`field cipher: cannot activate key "${e}", which this keyring does not hold`);
+			c = e, l = !0, d();
+		},
+		decrypt: (t, n) => {
+			let r = i(t), a = r === void 0 ? void 0 : s.get(r), o = n?.column ?? "unbound";
+			if (r !== void 0 && a === void 0 && u.every(([, e]) => !f(e, t, n))) throw e(r, o, "failed"), Error(`field cipher: the value is sealed under key "${r}", which this keyring does not hold (it holds ${u.map(([e]) => e).join(", ")})`);
+			let c;
+			if (a !== void 0) try {
+				let i = a.decrypt(t, n);
+				return e(r, o, "ok"), i;
+			} catch (e) {
+				c = e;
 			}
+			for (let [r, i] of u) if (i !== a) try {
+				let a = i.decrypt(t, n);
+				return e(r, o, "ok"), a;
+			} catch (e) {
+				c ??= e;
+			}
+			throw e(r ?? "unnamed", o, "failed"), c ?? /* @__PURE__ */ Error("field cipher: malformed ciphertext");
 		},
-		sealedWithPreviousKey: (e, t) => !i(n, e, t) && r.some((n) => i(n, e, t))
+		keyIdOf: m,
+		sealedWithPreviousKey: (e, t) => {
+			let n = m(e, t);
+			return n !== void 0 && n !== c;
+		}
 	};
-}, p, m = (e) => {
-	p = e;
-}, h = () => p, g = "no field cipher registered — set VOLTRO_FIELD_ENCRYPTION_KEY (`voltro secret generate field-encryption`; `voltro dev` mints one), or call setFieldCipher.", _ = (e, t) => {
-	let n = h();
-	if (!n) throw Error(`encryptField: ${g}`);
-	return r(n, e, t);
-}, v = (e, t) => {
-	if (!i(e)) return e;
-	let r = h();
-	if (!r) throw Error(`decryptField: ${g}`);
-	return n(r, e, void 0, t);
+}, b = (e, t = []) => {
+	let n = p(e).toString("hex"), r = [...new Map(t.filter((e) => e.trim() !== "" && p(e).toString("hex") !== n).map((e) => [p(e).toString("hex"), e])).values()];
+	return y({
+		active: g(e),
+		keys: [{
+			id: g(e),
+			secret: e
+		}, ...r.map((e) => ({
+			id: g(e),
+			secret: e
+		}))]
+	});
+}, x, S = (e) => {
+	x = e;
+}, C = () => x, w = "no field cipher registered — set VOLTRO_FIELD_ENCRYPTION_KEY (`voltro secret generate field-encryption`; `voltro dev` mints one), or call setFieldCipher.", T = (e, t) => {
+	let n = C();
+	if (!n) throw Error(`encryptField: ${w}`);
+	return o(n, e, t);
+}, E = (e, t) => {
+	if (!s(e)) return e;
+	let n = C();
+	if (!n) throw Error(`decryptField: ${w}`);
+	return a(n, e, void 0, t);
 };
 //#endregion
-export { v as decryptField, l as deriveKey, _ as encryptField, h as getFieldCipher, d as makeAesCipher, f as makeFieldCipher, m as setFieldCipher };
+export { _ as FieldKeyringConfigError, E as decryptField, p as deriveKey, T as encryptField, g as fieldKeyIdOf, C as getFieldCipher, v as isFieldKeyring, h as makeAesCipher, b as makeFieldCipher, y as makeFieldKeyring, S as setFieldCipher };

package/dist/fieldKeyRegistry.js

@@ -0,0 +1,295 @@
+import { derivedRowId as e, encryptedColumnsOf as t, eq as n, fieldBinding as r, fieldBindingsOf as i, id as a, isEncrypted as o, isNotNull as s, json as c, lt as l, table as u, text as d, timestamp as f } from "@voltro/database";
+import { randomUUID as p } from "node:crypto";
+import { hostname as m } from "node:os";
+//#region src/fieldKeyRegistry.ts
+var h = u("_voltro_field_keys", {
+	id: a({ prefix: "fkey" }),
+	keyId: d().maxLength(16).unique(),
+	state: d().maxLength(16),
+	canary: d().maxLength(160),
+	registeredAt: f().default("now"),
+	activatedAt: f().nullable(),
+	replacedAt: f().nullable(),
+	retiredAt: f().nullable(),
+	requestedAt: f().nullable()
+}), g = u("_voltro_field_key_holders", {
+	id: a({ prefix: "fkh" }),
+	holderId: d().maxLength(128).unique(),
+	keyIds: d().maxLength(512),
+	activeKeyId: d().maxLength(16),
+	heartbeatAt: f(),
+	expiresAt: f()
+}).nonReactive(), _ = u("_voltro_field_key_reports", {
+	id: a({ prefix: "fkrep" }),
+	kind: d().maxLength(16).unique(),
+	reportedAt: f(),
+	report: c()
+}).nonReactive(), v = "_voltro_field_keys", y = "_voltro_field_key_reports", b = async (t, n, r, i = /* @__PURE__ */ new Date()) => {
+	await t.upsert(y, {
+		id: e("fkrep", n),
+		kind: n,
+		reportedAt: i,
+		report: JSON.stringify(r)
+	}, { conflictColumns: ["kind"] });
+}, x = async (e) => {
+	let t = await e.query({
+		table: y,
+		predicate: void 0,
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	}), n = {};
+	for (let e of t) {
+		let t = String(e.kind), r = e.report, i = typeof r == "string" ? JSON.parse(r) : r, a = e.reportedAt instanceof Date ? e.reportedAt : new Date(String(e.reportedAt));
+		t === "status" && (n.status = {
+			reportedAt: a,
+			report: i
+		}), t === "rekey" && (n.rekey = {
+			reportedAt: a,
+			report: i
+		});
+	}
+	return n;
+}, S = "_voltro_field_key_holders", C = 3e4, w = 1e4, T = 10, E = () => `${m().slice(0, 80)}:${process.pid}:${p().replaceAll("-", "").slice(0, 12)}`, D = "voltro:field-key-canary:v1", O = (e) => r(v, "canary", e), k = 3, A = class extends Error {
+	_tag = "FieldKeyringRefusal";
+	constructor(e) {
+		super(e), this.name = "FieldKeyringRefusal";
+	}
+}, j = (e) => ({
+	table: v,
+	predicate: void 0,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...e === void 0 ? {} : { lock: e }
+}), M = (e) => ({
+	keyId: String(e.keyId),
+	state: String(e.state),
+	canary: String(e.canary),
+	registeredAt: N(e.registeredAt),
+	activatedAt: N(e.activatedAt),
+	replacedAt: N(e.replacedAt),
+	retiredAt: N(e.retiredAt),
+	requestedAt: N(e.requestedAt)
+}), N = (e) => e instanceof Date ? e : e == null ? null : new Date(typeof e == "number" ? e : String(e)), P = async (e) => (await e.query(j())).map(M), F = async (t, n, r, i = { holderId: E() }) => {
+	let a = n.requestedKeyId, o = new Set(n.keyIds), s = [], c = await P(t);
+	B(c, n, o, s), await H(t, n, r, s);
+	let l = new Set(c.map((e) => e.keyId)), u = n.keyIds.filter((e) => !l.has(e)), d = c.length === 0;
+	for (let r of u) {
+		let i = d && r === a;
+		await t.insertIgnore(v, {
+			id: e("fkey", r),
+			keyId: r,
+			state: i ? "active" : "pending",
+			canary: n.sealWith(r, D, O(r)),
+			...i ? { activatedAt: /* @__PURE__ */ new Date() } : {}
+		}, { conflictColumns: ["keyId"] });
+	}
+	let f = await G(t, n, i, !0);
+	return f.note !== void 0 && s.push(f.note), {
+		active: f.active,
+		registered: u,
+		...f.activated === void 0 ? {} : { activated: f.activated },
+		...f.waiting === void 0 ? {} : { waiting: f.waiting },
+		notes: s
+	};
+}, I = async (e, t, n) => {
+	let r = [], i = await P(e);
+	B(i, t, new Set(t.keyIds), r), await H(e, t, n, r);
+	let a = i.find((e) => e.state === "active")?.keyId, o = i.find((e) => e.requestedAt !== null && e.state === "pending")?.keyId;
+	return {
+		active: a,
+		...o === void 0 ? {} : { requested: o },
+		notes: r
+	};
+}, L = async (e, t, n) => {
+	let r = await G(e, t, n, !1);
+	return {
+		active: r.active,
+		...r.activated === void 0 ? {} : { activated: r.activated },
+		...r.waiting === void 0 ? {} : { waiting: r.waiting },
+		unheld: !t.keyIds.includes(r.active)
+	};
+}, R = async (e, t) => {
+	await e.deleteMany(S, { where: n("holderId", t) });
+}, z = (e, t, n) => {
+	let r, i = !1, a = "", o = (e, t) => {
+		a !== e && (a = e, t());
+	}, s = async () => {
+		try {
+			let r = await L(e, t, n);
+			r.activated !== void 0 && n.log.info(`field encryption: key "${r.activated.to}" is active now${r.activated.from === void 0 ? "" : ` (replacing "${r.activated.from}")`} — every live process holds it`), r.unheld ? o(`unheld:${r.active}`, () => n.log.error(`field encryption: the database's active key "${r.active}" is not held by this process (it holds ${t.keyIds.join(", ")}) — it missed its heartbeats while the fleet rotated. Values sealed under "${r.active}" cannot be read here; restart it with that key.`)) : r.waiting === void 0 ? a = "" : o(`waiting:${r.waiting.keyId}:${r.waiting.holders.join(",")}`, () => n.log.info(`field encryption: key "${r.waiting.keyId}" waits to become active — ${r.waiting.holders.length} live process(es) do not hold it yet: ${r.waiting.holders.join(", ")}`));
+		} catch (e) {
+			o("failed", () => n.log.warn(`field encryption: key heartbeat failed — ${e instanceof Error ? e.message : String(e)}`));
+		}
+	}, c = setInterval(() => {
+		i || r !== void 0 || (r = s().finally(() => {
+			r = void 0;
+		}));
+	}, n.intervalMs ?? 1e4);
+	return c.unref(), { stop: async () => {
+		i = !0, clearInterval(c), await r, await R(e, n.holderId);
+	} };
+}, B = (e, t, n, r) => {
+	let i = new Map(e.map((e) => [e.keyId, e])), a = (n) => e.find((e) => e.keyId !== n && e.state !== "retired" && t.opensWith(n, e.canary, O(e.keyId)))?.keyId;
+	for (let e of t.keyIds) {
+		let n = i.get(e), o = a(e);
+		if (n !== void 0 && n.state !== "retired" && !t.opensWith(e, n.canary, O(e))) throw new A(`field encryption: the key supplied as "${e}" is not the key this database registered as "${e}"` + (o === void 0 ? "" : ` — it is the key registered as "${o}"`) + `.
+  Values sealed under "${e}" cannot be read with it. Supply the original key under that id;\n  a NEW key needs a new id (\`voltro secret generate field-encryption\` makes a key).`);
+		if (o !== void 0) throw new A(`field encryption: the key supplied as "${e}" is the key this database registered as "${o}".\n  One key under two ids makes every count per key wrong, and a rotation to it is no rotation.
+  Supply it as "${o}" — or, for a rotation, generate a new key (\`voltro secret generate field-encryption\`).`);
+		n?.state === "retired" && r.push(`field encryption: key "${e}" is retired — nothing is sealed under it; it can be removed from the environment`);
+	}
+	V(e, n);
+}, V = (e, t) => {
+	let n = e.filter((e) => (e.state === "active" || e.state === "decrypt-only") && !t.has(e.keyId));
+	if (n.length > 0) {
+		let e = n.map((e) => `"${e.keyId}" (${e.state})`).join(", "), r = n.filter((e) => e.state === "decrypt-only").map((e) => e.keyId);
+		throw new A(`field encryption: this database has values sealed under ${e}, which this process does not hold (it holds ${[...t].join(", ")}).\n  This is what a rollback past a key rotation, a database restored from another environment, or a key
+  removed from VOLTRO_FIELD_ENCRYPTION_KEYS too early look like. Supply the key(s) under their ids.` + (r.length === 0 ? "" : `
+  Keeping a replaced key (${r.join(", ")}) is always fine — it only decrypts. To drop it instead, supply it\n  once more, run \`voltro secret rekey\` (every value moves under the active key), then
+  \`voltro secret retire field-encryption ${r[0]}\`${r.length > 1 ? " (per key)" : ""} — a retired key can leave the environment.`));
+	}
+}, H = async (e, n, r, a) => {
+	for (let c of r) {
+		let r = c;
+		if (typeof r != "object" || !r || typeof r.fields != "object") continue;
+		let l = r.tableName;
+		if (l !== void 0 && l !== "_voltro_field_keys") for (let c of t(r)) {
+			let t = (await e.query({
+				table: l,
+				predicate: s(c),
+				order: [],
+				take: k,
+				skip: void 0,
+				projection: ["id", c]
+			})).filter((e) => o(e[c])), u = t.filter((e) => i(r, c, e.id).every((t) => n.keyIdOf?.(String(e[c]), t) === void 0));
+			if (u.length !== 0) {
+				if (u.length === t.length) throw new A(`field encryption: none of the configured keys (${n.keyIds.join(", ")}) opens the values in ${l}.${c} — ${u.length} of ${u.length} sampled.\n  The configured key is not the one this data was sealed with: a key from another environment, a
+  regenerated key, or data restored from elsewhere. Supply the original key; this refuses at boot
+  rather than failing every read of the column.`);
+				a.push(`field encryption: ${u.length} of ${t.length} sampled values in ${l}.${c} open with no configured key`);
+			}
+		}
+	}
+}, U = () => ({
+	table: S,
+	predicate: void 0,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), W = async (e) => (await e.query(U())).map((e) => ({
+	holderId: String(e.holderId),
+	keyIds: String(e.keyIds).split(",").filter((e) => e !== ""),
+	activeKeyId: String(e.activeKeyId),
+	heartbeatAt: new Date(q(e.heartbeatAt)),
+	expiresAt: new Date(q(e.expiresAt))
+})), G = async (t, r, i, a) => {
+	let o = i.now?.() ?? Date.now(), s = i.leaseMs ?? 3e4, c = r.requestedKeyId, u = await t.transactional(async (t) => {
+		let u = (await t.query(j("update"))).map(M);
+		a && V(u, new Set(r.keyIds));
+		let d = new Date(o), f = u.filter((e) => e.state === "active"), p = f.find((e) => e.keyId === c) ?? [...f].sort((e, t) => (e.activatedAt?.getTime() ?? 0) - (t.activatedAt?.getTime() ?? 0) || e.keyId.localeCompare(t.keyId))[0];
+		for (let e of f) e.keyId !== p?.keyId && await t.updateMany(v, {
+			state: "decrypt-only",
+			replacedAt: d
+		}, { where: n("keyId", e.keyId) });
+		let m, h = u.find((e) => e.requestedAt !== null && e.state === "pending" && e.keyId !== p?.keyId)?.keyId;
+		if (a && p?.keyId !== c) {
+			let e = u.find((e) => e.keyId === c);
+			if (e === void 0) throw new A(`field encryption: key "${c}" was not recorded`);
+			if (e.state === "retired") throw new A(`field encryption: the active key "${c}" is retired — nothing may be sealed under it again.\n  Name another key in VOLTRO_FIELD_ENCRYPTION_ACTIVE${p === void 0 ? "" : ` (the database's active key is "${p.keyId}")`}.`);
+			e.state === "decrypt-only" && p !== void 0 ? m = `field encryption: VOLTRO_FIELD_ENCRYPTION_ACTIVE names "${c}", which was replaced by "${p.keyId}" — new values stay under "${p.keyId}"` : (await K(t, u, c), await t.updateMany(v, { requestedAt: d }, { where: n("keyId", c) }), h = c);
+		}
+		await t.deleteMany(S, { where: l("expiresAt", /* @__PURE__ */ new Date(o - T * s)) });
+		let g = (await t.query(U())).filter((e) => String(e.holderId) !== i.holderId && q(e.expiresAt) > o).map((e) => ({
+			holderId: String(e.holderId),
+			keyIds: String(e.keyIds).split(",")
+		})), _, y;
+		if (h !== void 0) {
+			let e = [...r.keyIds.includes(h) ? [] : [i.holderId], ...g.filter((e) => !e.keyIds.includes(h)).map((e) => e.holderId)].sort();
+			e.length === 0 ? (p !== void 0 && await t.updateMany(v, {
+				state: "decrypt-only",
+				replacedAt: d
+			}, { where: n("keyId", p.keyId) }), await t.updateMany(v, {
+				state: "active",
+				activatedAt: d,
+				requestedAt: null
+			}, { where: n("keyId", h) }), _ = {
+				from: p?.keyId,
+				to: h
+			}, p = u.find((e) => e.keyId === h)) : y = {
+				keyId: h,
+				holders: e
+			};
+		}
+		if (p === void 0) throw new A("field encryption: no key is recorded as active");
+		let b = p.keyId;
+		return await t.upsert(S, {
+			id: e("fkh", i.holderId),
+			holderId: i.holderId,
+			keyIds: r.keyIds.join(","),
+			activeKeyId: r.keyIds.includes(b) ? b : r.activeKeyId,
+			heartbeatAt: d,
+			expiresAt: new Date(o + s)
+		}, { conflictColumns: ["holderId"] }), {
+			active: b,
+			..._ === void 0 ? {} : { activated: _ },
+			...y === void 0 ? {} : { waiting: y },
+			...m === void 0 ? {} : { note: m }
+		};
+	});
+	return r.keyIds.includes(u.active) && r.activate(u.active), u;
+}, K = async (e, t, r) => {
+	for (let i of t) i.requestedAt !== null && i.keyId !== r && await e.updateMany(v, { requestedAt: null }, { where: n("keyId", i.keyId) });
+}, q = (e) => e instanceof Date ? e.getTime() : typeof e == "number" ? e : Date.parse(String(e)), J = async (t, n, r) => {
+	await t.insertIgnore(v, {
+		id: e("fkey", r),
+		keyId: r,
+		state: "pending",
+		canary: n.sealWith(r, D, O(r))
+	}, { conflictColumns: ["keyId"] });
+}, Y = async (e, t) => (await e.query(U())).filter((e) => q(e.expiresAt) > t).map((e) => ({
+	holderId: String(e.holderId),
+	keyIds: String(e.keyIds).split(","),
+	activeKeyId: String(e.activeKeyId)
+})), X = (e, t, r = {}) => e.transactional(async (e) => {
+	let i = r.now?.() ?? Date.now(), a = (await e.query(j("update"))).map(M), o = a.find((e) => e.keyId === t);
+	if (o === void 0) throw new A(`field encryption: "${t}" is not a recorded key (recorded: ${a.map((e) => e.keyId).join(", ") || "none"})`);
+	if (o.state === "retired") return;
+	if (o.state === "active") throw new A(`field encryption: "${t}" is the active key — rotate to another key first (\`voltro secret rotate field-encryption\`)`);
+	let s = (await Y(e, i)).filter((e) => e.activeKeyId === t).map((e) => e.holderId);
+	if (s.length > 0) throw new A(`field encryption: a live process still seals new values under "${t}": ${s.join(", ")} — it adopts the active key on its next heartbeat; try again then`);
+	await e.updateMany(v, {
+		state: "retired",
+		retiredAt: new Date(i),
+		requestedAt: null
+	}, { where: n("keyId", t) });
+}), Z = (e, t, r = {}) => e.transactional(async (e) => {
+	let i = r.now?.() ?? Date.now(), a = new Date(i), o = (await e.query(j("update"))).map(M), s = o.find((e) => e.keyId === t);
+	if (s === void 0) throw new A(`field encryption: "${t}" is not a recorded key (recorded: ${o.map((e) => e.keyId).join(", ") || "none"})`);
+	if (s.state === "retired") throw new A(`field encryption: "${t}" is retired — nothing may be sealed under it again`);
+	let c = o.find((e) => e.state === "active"), l = (await Y(e, i)).filter((e) => !e.keyIds.includes(t)).map((e) => e.holderId).sort();
+	if (c?.keyId === t) return {
+		from: t,
+		to: t,
+		lacking: l
+	};
+	for (let t of o) t.state === "active" && await e.updateMany(v, {
+		state: "decrypt-only",
+		replacedAt: a
+	}, { where: n("keyId", t.keyId) });
+	return await e.updateMany(v, {
+		state: "active",
+		activatedAt: a,
+		requestedAt: null
+	}, { where: n("keyId", t) }), {
+		from: c?.keyId,
+		to: t,
+		lacking: l
+	};
+});
+//#endregion
+export { v as FIELD_KEYS_TABLE, w as FIELD_KEY_HEARTBEAT_MS, S as FIELD_KEY_HOLDERS_TABLE, C as FIELD_KEY_LEASE_MS, y as FIELD_KEY_REPORTS_TABLE, A as FieldKeyringRefusal, g as _voltroFieldKeyHoldersTable, _ as _voltroFieldKeyReportsTable, h as _voltroFieldKeysTable, Z as activateFieldKeyNow, I as checkFieldKeyring, E as fieldKeyHolderId, L as heartbeatFieldKeys, W as readFieldKeyHolders, x as readFieldKeyReports, P as readFieldKeys, b as recordFieldKeyReport, J as registerFieldKey, R as releaseFieldKeyHolder, X as retireFieldKey, z as startFieldKeyHolder, F as verifyFieldKeyring };