@voltro/runtime 0.86.0 → 0.87.0

package/dist/analyticsSink.js

@@ -1,14 +1,8 @@
-import { Context as e, Effect as t, Option as n, Schema as r } from "effect";
-import { SubjectService as i } from "@voltro/protocol";
+import { Context as e, Effect as t, Option as n } from "effect";
+import { SubjectService as r } from "@voltro/protocol";
+import { AnalyticsCapabilityNotSupported as i, AnalyticsError as a } from "@voltro/kv/analytics";
 //#region src/analyticsSink.ts
-var a = class extends r.TaggedError()("AnalyticsError", {
-	provider: r.String,
-	operation: r.String,
-	cause: r.String
-}) {}, o = class extends r.TaggedError()("AnalyticsCapabilityNotSupported", {
-	provider: r.String,
-	capability: r.String
-}) {}, s = class extends e.Service()("@voltro/AnalyticsSink") {}, c = (e, t) => ({
+var o = class extends e.Service()("@voltro/AnalyticsSink") {}, s = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -27,12 +21,12 @@ var a = class extends r.TaggedError()("AnalyticsError", {
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), l = () => t.gen(function* () {
-	let e = yield* s, r = yield* t.serviceOption(i), a = n.match(r, {
+}), c = () => t.gen(function* () {
+	let e = yield* o, i = yield* t.serviceOption(r), a = n.match(i, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
-	return a === null ? e : c(e, a);
+	return a === null ? e : s(e, a);
 });
 //#endregion
-export { o as AnalyticsCapabilityNotSupported, a as AnalyticsError, s as AnalyticsSink, l as useAnalytics };
+export { i as AnalyticsCapabilityNotSupported, a as AnalyticsError, o as AnalyticsSink, c as useAnalytics };

package/dist/apiKeys.js

@@ -1,7 +1,7 @@
-import { eq as e, generateId as t, inSet as n } from "@voltro/database";
-import { createHash as r, randomBytes as i } from "node:crypto";
+import { and as e, eq as t, generateId as n, inSet as r } from "@voltro/database";
+import { createHash as i, randomBytes as a } from "node:crypto";
 //#region src/apiKeys.ts
-var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8").digest("hex"), c = (e = "voltro_") => `${e}${i(30).toString("base64url")}`, l = (e) => ({
+var o = "_voltro_api_keys", s = "actors", c = (e) => i("sha256").update(e, "utf8").digest("hex"), l = (e = "voltro_") => `${e}${a(30).toString("base64url")}`, u = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -14,41 +14,41 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 	createdBy: e.createdBy ?? null,
 	onBehalfOf: e.onBehalfOf ?? null,
 	...e.metadata == null ? {} : { metadata: e.metadata }
-}), u = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), d = (e, n = {}) => {
-	let r = n.prefix ?? "voltro_", i = n.usage, o = async (n) => {
-		let i = c(r), o = t({
+}), d = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), f = (e, t = {}) => {
+	let r = t.prefix ?? "voltro_", i = t.usage, a = async (t) => {
+		let i = l(r), a = n({
 			kind: "typeid",
 			prefix: "apikey"
-		}, a), l = n.scopes ?? [], u = n.expiresAt == null ? null : n.expiresAt instanceof Date ? n.expiresAt.getTime() : n.expiresAt;
+		}, o), s = t.scopes ?? [], u = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
 		return await e.ensureActor({
-			id: o,
-			displayName: n.name,
-			input: n
+			id: a,
+			displayName: t.name,
+			input: t
 		}), await e.insert({
-			id: o,
-			tenantId: n.tenantId ?? null,
-			name: n.name,
-			onBehalfOf: n.onBehalfOf ?? null,
-			hashedKey: s(i),
+			id: a,
+			tenantId: t.tenantId ?? null,
+			name: t.name,
+			onBehalfOf: t.onBehalfOf ?? null,
+			hashedKey: c(i),
 			keyPrefix: i.slice(0, r.length + 6),
-			scopes: l,
+			scopes: s,
 			lastUsedAt: null,
 			expiresAt: u,
 			revokedAt: null,
-			createdBy: n.createdBy ?? null,
+			createdBy: t.createdBy ?? null,
 			createdAt: Date.now(),
-			...n.metadata == null ? {} : { metadata: n.metadata }
+			...t.metadata == null ? {} : { metadata: t.metadata }
 		}), {
-			id: o,
+			id: a,
 			token: i,
 			keyPrefix: i.slice(0, r.length + 6),
-			name: n.name,
-			tenantId: n.tenantId ?? null,
-			scopes: l
+			name: t.name,
+			tenantId: t.tenantId ?? null,
+			scopes: s
 		};
-	}, d = async (t, n = Date.now()) => {
+	}, s = async (t, n = Date.now()) => {
 		let r = await e.findByHash(t);
-		return !r || !u(r, n) ? null : (i === void 0 ? await e.patch(r.id, { lastUsedAt: n }) : i.touch(r.id, n), {
+		return !r || !d(r, n) ? null : (i === void 0 ? await e.patch(r.id, { lastUsedAt: n }) : i.touch(r.id, n), {
 			id: r.id,
 			tenantId: r.tenantId ?? "",
 			createdBy: r.createdBy ?? null,
@@ -58,16 +58,16 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 		});
 	};
 	return {
-		issue: o,
-		resolveByHash: d,
-		verify: (e, t) => d(s(e), t),
+		issue: a,
+		resolveByHash: s,
+		verify: (e, t) => s(c(e), t),
 		revoke: async (t, n, r = Date.now()) => {
 			let i = await e.findById(t);
 			return !i || (i.tenantId ?? null) !== n ? !1 : (await e.patch(t, { revokedAt: r }), !0);
 		},
 		rotate: async (t, n, r = Date.now()) => {
 			let i = await e.findById(t);
-			return !i || (i.tenantId ?? null) !== n ? null : (await e.patch(t, { revokedAt: r }), o({
+			return !i || (i.tenantId ?? null) !== n ? null : (await e.patch(t, { revokedAt: r }), a({
 				tenantId: i.tenantId,
 				name: i.name,
 				scopes: i.scopes ?? [],
@@ -76,9 +76,9 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 				...i.metadata == null ? {} : { metadata: i.metadata }
 			}));
 		},
-		list: async (t) => (await e.listByTenant(t)).map(l)
+		list: async (t) => (await e.listByTenant(t)).map(u)
 	};
-}, f = () => {
+}, p = () => {
 	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
 	return {
 		actors: t,
@@ -110,56 +110,67 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 			});
 		}
 	};
-}, p = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, m = (e) => ({
+}, m = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, h = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	name: String(e.name),
 	hashedKey: String(e.hashedKey),
 	keyPrefix: String(e.keyPrefix),
 	scopes: e.scopes ?? null,
-	lastUsedAt: p(e.lastUsedAt),
-	expiresAt: p(e.expiresAt),
-	revokedAt: p(e.revokedAt),
+	lastUsedAt: m(e.lastUsedAt),
+	expiresAt: m(e.expiresAt),
+	revokedAt: m(e.revokedAt),
 	createdBy: e.createdBy ?? null,
 	onBehalfOf: e.onBehalfOf ?? null,
-	createdAt: p(e.createdAt) ?? 0,
+	createdAt: m(e.createdAt) ?? 0,
 	...e.metadata == null ? {} : { metadata: e.metadata }
-}), h = async (e) => {
+}), g = async (e, t, n = !1) => await e.query({
+	table: o,
+	predicate: t,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...n ? { lock: "update" } : {}
+}), _ = async (n, r, i) => {
+	let a = await g(n, e(t("id", r), t("tenantId", i)), !0);
+	return a[0] ? h(a[0]) : null;
+}, v = async (e) => {
 	let t = await e.keys();
 	if (t.length === 0) return {
 		keys: 0,
 		planted: 0,
 		failed: []
 	};
-	let r = /* @__PURE__ */ new Set();
+	let n = /* @__PURE__ */ new Set();
 	for (let i = 0; i < t.length; i += 500) {
-		let a = t.slice(i, i + 500).map((e) => e.id), s = await e.store.query({
-			table: o,
-			predicate: n("id", a),
+		let a = t.slice(i, i + 500).map((e) => e.id), o = await e.store.query({
+			table: s,
+			predicate: r("id", a),
 			order: [],
 			take: void 0,
 			skip: void 0,
 			projection: void 0
 		});
-		for (let e of s) typeof e.id == "string" && r.add(e.id);
+		for (let e of o) typeof e.id == "string" && n.add(e.id);
 	}
 	let i = 0, a = [];
-	for (let n of t) if (!r.has(n.id)) try {
+	for (let r of t) if (!n.has(r.id)) try {
 		await e.apiKeyStore.ensureActor({
-			id: n.id,
-			displayName: n.name,
+			id: r.id,
+			displayName: r.name,
 			input: {
-				tenantId: n.tenantId,
-				name: n.name,
-				scopes: n.scopes ?? [],
-				createdBy: n.createdBy,
-				onBehalfOf: n.onBehalfOf ?? null,
-				...n.metadata == null ? {} : { metadata: n.metadata }
+				tenantId: r.tenantId,
+				name: r.name,
+				scopes: r.scopes ?? [],
+				createdBy: r.createdBy,
+				onBehalfOf: r.onBehalfOf ?? null,
+				...r.metadata == null ? {} : { metadata: r.metadata }
 			}
 		}), i++;
 	} catch (e) {
 		a.push({
-			id: n.id,
+			id: r.id,
 			reason: e instanceof Error ? e.message : String(e)
 		});
 	}
@@ -168,7 +179,7 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 		planted: i,
 		failed: a
 	};
-}, g = (e) => async (t, n) => {
+}, y = (e) => async (t, n) => {
 	let r = await e.findById(t);
 	if (r === null) return;
 	let i = r.requestCount ?? 0, a = r.lastUsedAt ?? 0;
@@ -176,15 +187,8 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 		requestCount: i + n.requests,
 		lastUsedAt: Math.max(a, n.lastUsedAt)
 	});
-}, _ = (t, n = {}) => {
-	let r = n.ensureActor, i = async (e) => await t.query({
-		table: a,
-		predicate: e,
-		order: [],
-		take: void 0,
-		skip: void 0,
-		projection: void 0
-	}), s = (e) => {
+}, b = (e, n = {}) => {
+	let r = n.ensureActor, i = (t) => g(e, t), a = (e) => {
 		let t = { ...e };
 		for (let e of [
 			"lastUsedAt",
@@ -195,29 +199,29 @@ var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8
 		return t;
 	};
 	return {
-		ensureActor: r === void 0 ? async (e) => {
-			await t.insertIgnore(o, {
-				id: e.id,
+		ensureActor: r === void 0 ? async (t) => {
+			await e.insertIgnore(s, {
+				id: t.id,
 				kind: "apiKey",
-				displayName: e.displayName
+				displayName: t.displayName
 			}, { conflictColumns: ["id"] });
-		} : (e) => r(e, t),
-		insert: async (e) => {
-			await t.insert(a, s(e));
+		} : (t) => r(t, e),
+		insert: async (t) => {
+			await e.insert(o, a(t));
 		},
-		findByHash: async (t) => {
-			let n = await i(e("hashedKey", t));
-			return n[0] ? m(n[0]) : null;
+		findByHash: async (e) => {
+			let n = await i(t("hashedKey", e));
+			return n[0] ? h(n[0]) : null;
 		},
-		findById: async (t) => {
-			let n = await i(e("id", t));
-			return n[0] ? m(n[0]) : null;
+		findById: async (e) => {
+			let n = await i(t("id", e));
+			return n[0] ? h(n[0]) : null;
 		},
-		listByTenant: async (t) => (await i(t === null ? void 0 : e("tenantId", t))).map(m).filter((e) => t === null || e.tenantId === t),
-		patch: async (e, n) => {
-			await t.update(a, e, s(n));
+		listByTenant: async (e) => (await i(e === null ? void 0 : t("tenantId", e))).map(h).filter((t) => e === null || t.tenantId === e),
+		patch: async (t, n) => {
+			await e.update(o, t, a(n));
 		}
 	};
 };
 //#endregion
-export { o as ACTORS_TABLE, a as API_KEYS_TABLE, _ as dataStoreApiKeyStore, c as generateApiKeyToken, d as makeApiKeyService, g as makeApiKeyUsageFlusher, f as memoryApiKeyStore, h as plantMissingApiKeyActors, s as sha256Hex };
+export { s as ACTORS_TABLE, o as API_KEYS_TABLE, b as dataStoreApiKeyStore, l as generateApiKeyToken, _ as lockApiKeyById, f as makeApiKeyService, y as makeApiKeyUsageFlusher, p as memoryApiKeyStore, v as plantMissingApiKeyActors, c as sha256Hex };

package/dist/apiRoleBucketSampler.js

@@ -0,0 +1,64 @@
+import { API_ROLE_BUCKET_MS as e } from "./apiRoleWorkloadHistory.js";
+import { API_WORKLOADS as t } from "@voltro/protocol";
+//#region src/apiRoleBucketSampler.ts
+var n = (n) => {
+	let r = [...new Set(n.workloads)];
+	if (!n.replicaId || n.replicaId.length > 191 || !n.role || n.role.length > 2080 || n.startedAt < 0 || n.epochNow < 0 || n.monotonicNow < 0 || !r.length || r.some((e) => !t.includes(e)) || !Number.isFinite(n.monotonicNow) || !Number.isSafeInteger(n.epochNow) || !Number.isSafeInteger(n.startedAt) || n.startedAt > n.epochNow) throw Error("Invalid role sampler configuration");
+	let i = n.epochNow - n.monotonicNow, a = (t) => Math.floor(t / e) * e, o = /* @__PURE__ */ new Map(), s = a(n.epochNow), c = n.epochNow, l = 0, u = 0, d = n.monotonicNow, f = (e) => {
+		let t = o.get(e);
+		return t || (t = {
+			from: e,
+			continuous: e >= n.epochNow,
+			seconds: /* @__PURE__ */ new Map()
+		}, o.set(e, t), o.size > 290 && (o.delete(Math.min(...o.keys())), l++)), t;
+	}, p = (t) => ({
+		replicaId: n.replicaId,
+		startedAt: n.startedAt,
+		role: n.role,
+		from: t.from,
+		until: t.from + e,
+		continuous: t.continuous,
+		workloads: Object.fromEntries(r.map((e) => [e, {
+			coverage: "partial",
+			seconds: t.seconds.get(e) ?? 0
+		}]))
+	});
+	return {
+		record(t) {
+			let n = i + t.from, o = i + t.until;
+			if (!r.includes(t.workload) || !Number.isFinite(n) || !Number.isFinite(o) || o <= n || t.from < d || n < s || o - n > 87e6) u++;
+			else {
+				d = t.until;
+				for (let r = a(n); r < o; r += e) {
+					let i = f(r), a = (Math.min(o, r + e) - Math.max(n, r)) / 1e3;
+					i.seconds.set(t.workload, (i.seconds.get(t.workload) ?? 0) + a);
+				}
+			}
+		},
+		advance(t, n) {
+			let r = i + t;
+			if (!Number.isFinite(r) || r < c || !Number.isFinite(n)) return;
+			let o = a(r), u = Math.max(s, o - 290 * e);
+			u > s && (l += (u - s) / e);
+			let d = r - c > 6e4 || Math.abs(n - r) > 1e3;
+			for (let t = u; t < o; t += e) {
+				let e = f(t);
+				d && (e.continuous = !1);
+			}
+			d && (f(o).continuous = !1), s = o, c = r;
+		},
+		pending() {
+			return [...o.values()].filter((t) => t.from + e <= s).sort((e, t) => e.from - t.from).map(p);
+		},
+		acknowledge(e) {
+			e + 3e5 <= s && o.delete(e);
+		},
+		status: () => ({
+			pendingBuckets: [...o.keys()].filter((t) => t + e <= s).length,
+			droppedBuckets: l,
+			rejectedSegments: u
+		})
+	};
+};
+//#endregion
+export { n as makeApiRoleBucketSampler };

package/dist/apiRoleWorkloadHistory.js

@@ -0,0 +1,56 @@
+import { API_WORKLOADS as e } from "@voltro/protocol";
+//#region src/apiRoleWorkloadHistory.ts
+var t = 3e5, n = 864e5, r = (r) => {
+	if (!Number.isSafeInteger(r.startedAt) || r.startedAt < 0 || r.startedAt > r.now || !r.replicaId || !r.role || !Number.isSafeInteger(r.now) || r.now < 864e5) throw Error("Invalid role observation time");
+	let i = Math.floor(r.now / t) * t, a = i - n, o = n / t, s = [...new Set(r.requiredWorkloads)];
+	if (!s.length || s.some((t) => !e.includes(t))) throw Error("Invalid required workloads");
+	let c = (e, t, n = s) => ({
+		from: a,
+		until: i,
+		complete: !1,
+		reason: e,
+		missingBuckets: t,
+		incompleteWorkloads: n,
+		totals: [],
+		splitCandidates: []
+	});
+	if (r.buckets.length > 290) return c("invalid-observation", o);
+	let l = /* @__PURE__ */ new Map();
+	for (let t of r.buckets) {
+		if (t.replicaId !== r.replicaId || t.startedAt !== r.startedAt || t.role !== r.role || !Number.isSafeInteger(t.from) || t.from < 0 || t.from % 3e5 != 0 || t.until !== t.from + 3e5 || typeof t.continuous != "boolean") return c("invalid-observation", o);
+		let n = 0;
+		for (let [r, i] of Object.entries(t.workloads)) {
+			if (!e.includes(r) || !s.includes(r) || !i || !["partial", "complete"].includes(i.coverage) || !Number.isFinite(i.seconds) || i.seconds < 0) return c("invalid-observation", o);
+			n += i.seconds;
+		}
+		if (n > 300) return c("invalid-observation", o);
+		if (!(t.until <= a || t.from >= i)) {
+			if (l.has(t.from)) return c("invalid-observation", o);
+			l.set(t.from, t);
+		}
+	}
+	let u = /* @__PURE__ */ new Set(), d = new Map(s.map((e) => [e, 0]));
+	for (let e of l.values()) for (let t of s) {
+		let n = e.workloads[t];
+		(!e.continuous || e.from < r.startedAt || n?.coverage !== "complete") && u.add(t), n && d.set(t, d.get(t) + n.seconds);
+	}
+	let f = o - l.size;
+	if (f || u.size) return c("incomplete", f, [...u]);
+	let p = [...d.values()].reduce((e, t) => e + t, 0), m = [...d].map(([e, t]) => ({
+		workload: e,
+		seconds: t,
+		share: p === 0 ? 0 : t / p
+	})), h = m.filter((e) => e.share > .3).map((e) => e.workload);
+	return {
+		from: a,
+		until: i,
+		complete: !0,
+		missingBuckets: 0,
+		incompleteWorkloads: [],
+		reason: p === 0 ? "idle" : "observed",
+		totals: m,
+		splitCandidates: h.length >= 2 ? h : []
+	};
+};
+//#endregion
+export { t as API_ROLE_BUCKET_MS, n as API_ROLE_WINDOW_MS, r as assessApiRoleWorkloadWindow };

package/dist/apiRoleWorkloadMetrics.js

@@ -0,0 +1,78 @@
+import { Effect as e, Metric as t, Tracer as n } from "effect";
+import { API_WORKLOADS as r } from "@voltro/protocol";
+//#region src/apiRoleWorkloadMetrics.ts
+var i = t.counter("api_role_workload_seconds_total", { description: "Measured active synchronous loop seconds by selected API role set and workload; excludes asynchronous waits." }), a = (e) => {
+	if (e.length === 0 || e.length > 32 || e.some((e) => !/^[a-z][a-z0-9-]{0,63}$/.test(e))) throw Error("Invalid API metric roles");
+	return [...new Set(e)].sort().join(",");
+}, o = (o, s = {}) => {
+	let c = a(o), l = s.now ?? (() => performance.now()), u = new Map(r.map((e) => [e, i.pipe(t.withAttributes({
+		role: c,
+		workload: e
+	}))])), d = /* @__PURE__ */ new Map(), f = 0, p = [], m = (n, r) => {
+		let i = (r - n.since) / 1e3;
+		if (!(!Number.isFinite(i) || i <= 0)) {
+			try {
+				s.onSegment?.({
+					workload: n.workload,
+					from: n.since,
+					until: r
+				});
+			} catch {
+				f++;
+			}
+			d.set(n.workload, (d.get(n.workload) ?? 0) + i), e.runSync(t.update(u.get(n.workload), i));
+		}
+	}, h = (e) => {
+		if (!u.has(e)) throw Error("Unknown API metric workload");
+		let t = p[p.length - 1];
+		t && m(t, l());
+		let n = {
+			workload: e,
+			since: l()
+		};
+		return p.push(n), n;
+	}, g = (e) => {
+		let t = l();
+		p.pop(), m(e, t);
+		let n = p[p.length - 1];
+		n && (n.since = l());
+	};
+	return {
+		role: c,
+		observationErrors: () => f,
+		observeEffect(t, r) {
+			if (!u.has(r)) throw Error("Unknown API metric workload");
+			return e.withFiber((i) => {
+				let a = i.getRef(n.Tracer), o = n.make({
+					span: (e) => a.span(e),
+					context: (e, t) => {
+						let n = h(r);
+						try {
+							return a.context === void 0 ? e["~effect/Effect/evaluate"](t) : a.context(e, t);
+						} finally {
+							g(n);
+						}
+					}
+				});
+				return t.pipe(e.provideService(n.Tracer, o));
+			});
+		},
+		measureSync(e, t) {
+			let n = h(e);
+			try {
+				return t();
+			} finally {
+				g(n);
+			}
+		},
+		snapshot() {
+			return [...d].map(([e, t]) => ({
+				role: c,
+				workload: e,
+				seconds: t
+			}));
+		}
+	};
+}, s = (e, t, n) => t.observeEffect(e, n);
+//#endregion
+export { a as apiRoleMetricLabel, o as makeApiRoleWorkloadMetrics, s as observeApiRoleEffect };

package/dist/apiRoleWorkloadStorage.js

@@ -0,0 +1,95 @@
+import { API_ROLE_BUCKET_MS as e, API_ROLE_WINDOW_MS as t, assessApiRoleWorkloadWindow as n } from "./apiRoleWorkloadHistory.js";
+//#region src/apiRoleWorkloadStorage.ts
+var r = "_voltro_api_role_workload_buckets", i = 16384, a = (e) => e instanceof Date ? e.getTime() : typeof e == "number" ? e : NaN, o = async (e, t) => {
+	let a = Object.keys(t.workloads);
+	if (n({
+		now: Math.max(864e5, t.until),
+		replicaId: t.replicaId,
+		startedAt: t.startedAt,
+		role: t.role,
+		requiredWorkloads: a,
+		buckets: [t]
+	}).reason === "invalid-observation" || !t.replicaId || t.replicaId.length > 191 || t.role.length > 2080) throw Error("Invalid API role history bucket");
+	let o = JSON.stringify({
+		version: 1,
+		continuous: t.continuous,
+		workloads: t.workloads
+	});
+	if (new TextEncoder().encode(o).byteLength > i) throw Error("API role history payload too large");
+	await e.upsert(r, {
+		replicaId: t.replicaId,
+		startedAt: new Date(t.startedAt),
+		role: t.role,
+		bucketFrom: new Date(t.from),
+		bucketUntil: new Date(t.until),
+		payload: o
+	}, { conflictColumns: [
+		"replicaId",
+		"startedAt",
+		"bucketFrom"
+	] });
+}, s = async (o, s) => {
+	let c = n({
+		...s,
+		buckets: []
+	}), l = (await o.query({
+		table: r,
+		predicate: { and: [
+			{
+				column: "replicaId",
+				op: "eq",
+				value: s.replicaId
+			},
+			{
+				column: "startedAt",
+				op: "eq",
+				value: new Date(s.startedAt)
+			},
+			{
+				column: "role",
+				op: "eq",
+				value: s.role
+			},
+			{
+				column: "bucketFrom",
+				op: "gte",
+				value: new Date(c.from)
+			},
+			{
+				column: "bucketFrom",
+				op: "lt",
+				value: new Date(c.until)
+			}
+		] },
+		order: [{
+			column: "bucketFrom",
+			direction: "asc"
+		}],
+		take: t / e + 1,
+		skip: void 0,
+		projection: void 0
+	})).map((e) => {
+		if (typeof e.payload != "string" || new TextEncoder().encode(e.payload).byteLength > i) throw Error("Invalid API role history payload");
+		let t = JSON.parse(e.payload);
+		if (!t || t.version !== 1 || typeof t.continuous != "boolean" || !t.workloads || typeof t.workloads != "object" || Array.isArray(t.workloads)) throw Error("Invalid API role history payload");
+		return {
+			replicaId: String(e.replicaId),
+			startedAt: a(e.startedAt),
+			role: String(e.role),
+			from: a(e.bucketFrom),
+			until: a(e.bucketUntil),
+			continuous: t.continuous,
+			workloads: t.workloads
+		};
+	}), u = n({
+		...s,
+		buckets: l
+	});
+	if (u.reason === "invalid-observation") throw Error("Invalid API role history observations");
+	return {
+		buckets: l,
+		assessment: u
+	};
+};
+//#endregion
+export { r as API_ROLE_WORKLOAD_BUCKETS_TABLE, s as readApiRoleWorkloadWindow, o as writeApiRoleWorkloadBucket };