@voltro/runtime 0.86.0 → 0.88.0

package/dist/effectStore.js

@@ -2,7 +2,7 @@ import { Context as e, Effect as t, Exit as n, Layer as r } from "effect";
 import { authoredError as i, describeDriverError as a, wireSafeCause as o } from "@voltro/database";
 import { StoreOperationFailed as s } from "@voltro/protocol";
 import { createLogger as c } from "@voltro/logger";
-//#region src/effectStore.ts
+// src/effectStore.ts
 var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStore") {}, d = {
 	TenantScopeViolation: !0,
 	TenantRowNotFound: !0,
@@ -35,7 +35,7 @@ var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStor
 }, v = (e) => ({
 	query: ((t) => m("query", t.table, () => e.query(t))),
 	insert: (t, n) => m("insert", t, () => e.insert(t, n)),
-	insertMany: (t, n) => m("insertMany", t, () => e.insertMany(t, n)),
+	insertMany: (t, n, r) => m("insertMany", t, () => e.insertMany(t, n, r)),
 	patchJson: (t, n, r, i, a) => m("patchJson", t, () => e.patchJson(t, n, r, i, a)),
 	update: (t, n, r) => m("update", t, () => e.update(t, n, r)),
 	updateMany: (t, n, r) => m("updateMany", t, () => e.updateMany(t, n, r)),
@@ -66,6 +66,5 @@ var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStor
 	conflictColumns: e.conflictColumns,
 	...e.update === void 0 ? {} : { update: e.update },
 	...e.updateValues === void 0 ? {} : { updateValues: e.updateValues }
-}), x = (e, t, n) => e.insert(t.tableName, n), S = (e, t, n) => e.insertMany(t.tableName, n), C = (e, t, n, r) => e.upsert(t.tableName, n, b(r)), w = (e, t, n, r) => e.upsertWithOutcome(t.tableName, n, b(r)), T = (e, t, n, r) => e.insertIgnoreWithOutcome(t.tableName, n, { conflictColumns: r.conflictColumns });
-//#endregion
+}), x = (e, t, n) => e.insert(t.tableName, n), S = (e, t, n, r) => e.insertMany(t.tableName, n, r), C = (e, t, n, r) => e.upsert(t.tableName, n, b(r)), w = (e, t, n, r) => e.upsertWithOutcome(t.tableName, n, b(r)), T = (e, t, n, r) => e.insertIgnoreWithOutcome(t.tableName, n, { conflictColumns: r.conflictColumns });
 export { u as EffectStore, T as insertIgnoreRowOutcomeEffect, S as insertManyRowsEffect, x as insertRowEffect, y as makeEffectStoreLayer, C as upsertRowEffect, w as upsertRowOutcomeEffect };

package/dist/engineClients.js

@@ -0,0 +1,23 @@
+// src/engineClients.ts
+var e = /* @__PURE__ */ new Map(), t = 0, n = (e) => {
+	let t = /^([a-z]{1,16})\/([0-9A-Za-z.+-]{1,100})(?:; surface=([0-9a-f]{64}))?$/.exec(e.trim());
+	return t ? {
+		target: t[1],
+		version: t[2],
+		surface: t[3] ?? null
+	} : null;
+}, r = (r, i) => {
+	let a = r.headers["x-voltro-sdk"];
+	if (typeof a != "string" || e.size >= 1024) return;
+	let o = n(a);
+	if (!o) return;
+	let s = "client-" + String(++t);
+	e.set(s, Object.freeze({
+		id: s,
+		...o,
+		connectedAt: Date.now()
+	})), i.once("close", () => {
+		e.delete(s);
+	});
+}, i = () => [...e.values()];
+export { i as engineClientsSnapshot, n as parseEngineSdkHeader, r as trackEngineClient };

package/dist/eventBus.js

@@ -1,7 +1,7 @@
 import { recordEventDropped as e, recordEventPublished as t, recordEventSubscribers as n } from "./metrics.js";
 import { eventRoute as r, parseEventRoute as i } from "@voltro/protocol";
 import { createLogger as a } from "@voltro/logger";
-//#region src/eventBus.ts
+// src/eventBus.ts
 var o = a({ scope: "voltro:events" }), s = 64, c = 3e5, l = 1e4, u = class {
 	routes = /* @__PURE__ */ new Map();
 	origin;
@@ -256,5 +256,4 @@ var o = a({ scope: "voltro:events" }), s = 64, c = 3e5, l = 1e4, u = class {
 		this.routes.clear();
 	}
 };
-//#endregion
 export { u as EventBus };

package/dist/eventPublish.js

@@ -1,6 +1,6 @@
 import { Context as e, Effect as t, Schema as n } from "effect";
 import { EventKeyInvalid as r, EventPayloadInvalid as i, EventPayloadTooLarge as a, MAX_EVENT_ENVELOPE_BYTES as o } from "@voltro/protocol";
-//#region src/eventPublish.ts
+// src/eventPublish.ts
 var s = (e) => e instanceof Error ? e.message : String(e), c = (e, c, l, u) => t.gen(function* () {
 	let d = n.encodeEffect(c.key), f = n.encodeEffect(c.payload), p = yield* d(l).pipe(t.mapError((e) => new r({
 		event: c.name,
@@ -45,5 +45,4 @@ var s = (e) => e instanceof Error ? e.message : String(e), c = (e, c, l, u) => t
 	let n;
 	return Object.assign(e, { then: (r, i) => (n ??= t.runPromise(e), n.then(r, i)) });
 }, d = (e) => ({ publish: (t, n, r) => u(c(e, t, n, r)) });
-//#endregion
 export { l as OutboxEventPublisher, d as makeEventPublisher, c as publishEvent };

package/dist/events.js

@@ -1,5 +1,5 @@
 import { boolean as e, eq as t, id as n, json as r, table as i, text as a, timestamp as o } from "@voltro/database";
-//#region src/events.ts
+// src/events.ts
 var s = (e) => {
 	if ("on" in e) {
 		let { on: t, ...n } = e;
@@ -189,5 +189,4 @@ var s = (e) => {
 		};
 	} };
 };
-//#endregion
 export { m as _voltroWorkflowEventDeliveriesTable, p as _voltroWorkflowEventsTable, c as defineEventTrigger, l as isWorkflowEventTriggerDefinition, h as makeEventsFacade, s as triggerWorkflow };

package/dist/expectation.js

@@ -1,5 +1,5 @@
 import { Context as e, Effect as t } from "effect";
-//#region src/expectation.ts
+// src/expectation.ts
 var n = /* @__PURE__ */ new Set([
 	"info",
 	"warn",
@@ -48,5 +48,4 @@ var n = /* @__PURE__ */ new Set([
 }, a = (e) => typeof e == "object" && !!e && e._voltroExpectation === !0, o = class extends e.Service()("@voltro/ExpectationRegistry") {}, s = (e) => t.gen(function* () {
 	return (yield* o).get(e.name);
 });
-//#endregion
 export { o as ExpectationRegistry, i as defineExpectation, a as isExpectationDefinition, s as useExpectation };

package/dist/expectationEvaluator.js

@@ -1,6 +1,6 @@
 import { AggregateMaintainer as e } from "./aggregateIvm.js";
 import { collectProjectedRows as t } from "./projectedRows.js";
-//#region src/expectationEvaluator.ts
+// src/expectationEvaluator.ts
 var n = (e) => {
 	if (e instanceof Date) return e.getTime();
 	if (typeof e == "number" && Number.isFinite(e)) return e;
@@ -287,7 +287,7 @@ var n = (e) => {
 		let t = e ? [] : Array(i.size), n = 0;
 		return i.forEach((r) => {
 			let i = r.state();
-			(!e || i.status === "violated") && (t[n++] = i);
+			e && i.status !== "violated" || (t[n++] = i);
 		}), t;
 	};
 	return {
@@ -304,5 +304,4 @@ var n = (e) => {
 		runTick: d
 	};
 };
-//#endregion
 export { u as ExpectationEvaluator, d as attachExpectations };

package/dist/experiment.js

@@ -1,5 +1,5 @@
 import { Context as e, Effect as t } from "effect";
-//#region src/experiment.ts
+// src/experiment.ts
 var n = "holdout", r = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.stringify(e)}): ${t}`), i = (e) => {
 	if (e == null) return null;
 	if (typeof e == "number") return Number.isFinite(e) ? String(e) : null;
@@ -92,5 +92,4 @@ var n = "holdout", r = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.
 }, l = (e) => e.holdout > 0 ? [...e.variants.map((e) => e.name), n] : e.variants.map((e) => e.name), u = class extends e.Service()("@voltro/ExperimentRegistry") {}, d = (e) => t.gen(function* () {
 	return (yield* u).get(e.name);
 });
-//#endregion
 export { u as ExperimentRegistry, n as HOLDOUT_VARIANT, c as assignVariant, a as defineExperiment, s as hashUnitInterval, o as isExperimentDefinition, l as resultVariantNames, d as useExperiment };

package/dist/experimentEvaluator.js

@@ -1,7 +1,7 @@
 import { AggregateMaintainer as e } from "./aggregateIvm.js";
 import { collectProjectedRows as t } from "./projectedRows.js";
 import { assignVariant as n, resultVariantNames as r } from "./experiment.js";
-//#region src/experimentEvaluator.ts
+// src/experimentEvaluator.ts
 var i = "__voltro_variant", a = "__voltro_metric", o = class {
 	project;
 	maintainer;
@@ -241,5 +241,4 @@ var i = "__voltro_variant", a = "__voltro_metric", o = class {
 		registered: [...i.keys()]
 	};
 };
-//#endregion
 export { f as ExperimentEvaluator, p as attachExperiments };

package/dist/externalizedTasks.js

@@ -1,4 +1,4 @@
-//#region src/externalizedTasks.ts
+// src/externalizedTasks.ts
 var e = 6e4, t = (e) => {
 	if (!Number.isFinite(e) || e < 6e4 || e % 6e4 != 0) return;
 	let t = e / 6e4;
@@ -16,10 +16,22 @@ var e = 6e4, t = (e) => {
 	if (t !== void 0) return t;
 	let n = /* @__PURE__ */ new Map();
 	return e[r] = n, n;
-}, a = (e) => {
-	i().set(e.name, e);
-}, o = (e) => {
-	i().delete(e);
-}, s = (e) => i().get(e), c = () => [...i().keys()].sort();
-//#endregion
-export { e as MIN_EXTERNALIZABLE_INTERVAL_MS, t as cronForInterval, n as externalizationRefusal, s as externalizedTask, c as externalizedTaskNames, a as registerExternalizedTask, o as unregisterExternalizedTask };
+}, a = (e) => Object.freeze({
+	register: (t) => {
+		let n = Object.freeze({
+			name: t.name,
+			intervalMs: t.intervalMs,
+			cron: t.cron,
+			run: t.run
+		});
+		if (e.has(n.name)) throw Error("Externalized task name is already registered: " + n.name);
+		e.set(n.name, n);
+		let r = !1;
+		return () => {
+			r || (r = !0, e.get(n.name) === n && e.delete(n.name));
+		};
+	},
+	get: (t) => e.get(t),
+	names: () => [...e.keys()].sort()
+}), o = () => a(/* @__PURE__ */ new Map()), s = (e) => a(i()).register(e), c = (e) => i().get(e), l = () => [...i().keys()].sort();
+export { e as MIN_EXTERNALIZABLE_INTERVAL_MS, t as cronForInterval, n as externalizationRefusal, c as externalizedTask, l as externalizedTaskNames, o as makeExternalizedTaskRegistry, s as registerExternalizedTask };

package/dist/fieldCipher.js

@@ -1,61 +1,129 @@
-import { BOUND_ENCRYPTED_PREFIX as e, ENCRYPTED_PREFIX as t, decodeFieldValue as n, encodeFieldValue as r, isEncrypted as i } from "@voltro/database";
-import { createCipheriv as a, createDecipheriv as o, randomBytes as s, scryptSync as c } from "node:crypto";
-//#region src/fieldCipher.ts
-var l = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : c(e, "voltro:field-encryption:v1", 32), u = (e, t) => {
+import { recordFieldDecrypt as e } from "./metrics.js";
+import { BOUND_ENCRYPTED_PREFIX as t, ENCRYPTED_PREFIX as n, FIELD_KEY_ID_PATTERN as r, ciphertextKeyId as i, decodeFieldValue as a, encodeFieldValue as o, isEncrypted as s } from "@voltro/database";
+import { createCipheriv as c, createDecipheriv as l, createHmac as u, randomBytes as d, scryptSync as f } from "node:crypto";
+// src/fieldCipher.ts
+var p = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : f(e, "voltro:field-encryption:v1", 32), m = (e, t) => {
 	let n = e === "r" ? t?.row : e === "c" ? t?.column : void 0;
 	if (n === void 0) throw Error(e === "r" || e === "c" ? `field cipher: ciphertext is bound to its ${e === "r" ? "row" : "column"} and was read without that binding` : "field cipher: malformed ciphertext");
 	return Buffer.from(n, "utf8");
-}, d = (n) => {
-	if (n.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${n.length}`);
+}, h = (e, i) => {
+	if (e.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${e.length}`);
+	if (i !== void 0 && !r.test(i)) throw Error(`field cipher: "${i}" is not a key id (a short lowercase slug)`);
+	let a = i === void 0 ? "" : `:${i}`;
 	return {
 		encrypt: (r, i) => {
-			let o = s(12), c = a("aes-256-gcm", n, o), l = i === void 0 ? void 0 : i.row === void 0 ? "c" : "r";
-			l !== void 0 && c.setAAD(u(l, i));
-			let d = Buffer.concat([c.update(r, "utf8"), c.final()]), f = c.getAuthTag(), p = `${o.toString("base64")}:${f.toString("base64")}:${d.toString("base64")}`;
-			return l === void 0 ? `${t}${p}` : `${e}${l}:${p}`;
+			let o = d(12), s = c("aes-256-gcm", e, o), l = i === void 0 ? void 0 : i.row === void 0 ? "c" : "r";
+			l !== void 0 && s.setAAD(m(l, i));
+			let u = Buffer.concat([s.update(r, "utf8"), s.final()]), f = s.getAuthTag(), p = `${o.toString("base64")}:${f.toString("base64")}:${u.toString("base64")}`;
+			return l === void 0 ? `${n}${p}${a}` : `${t}${l}:${p}${a}`;
 		},
-		decrypt: (r, i) => {
-			let a = r.startsWith(e), s = r.slice(a ? e.length : t.length).split(":"), c = a ? s.shift() ?? "" : void 0, [l, d, f] = s;
-			if (!l || !d || f === void 0) throw Error("field cipher: malformed ciphertext");
-			let p = o("aes-256-gcm", n, Buffer.from(l, "base64"));
-			return c !== void 0 && p.setAAD(u(c, i)), p.setAuthTag(Buffer.from(d, "base64")), Buffer.concat([p.update(Buffer.from(f, "base64")), p.final()]).toString("utf8");
+		decrypt: (i, a) => {
+			let o = i.startsWith(t), s = i.slice(o ? t.length : n.length).split(":"), c = o ? s.shift() ?? "" : void 0, [u, d, f, ...p] = s;
+			if (!u || !d || f === void 0 || p.length > 1 || p.length === 1 && !r.test(p[0])) throw Error("field cipher: malformed ciphertext");
+			let h = l("aes-256-gcm", e, Buffer.from(u, "base64"));
+			return c !== void 0 && h.setAAD(m(c, a)), h.setAuthTag(Buffer.from(d, "base64")), Buffer.concat([h.update(Buffer.from(f, "base64")), h.final()]).toString("utf8");
 		}
 	};
-}, f = (e, t = []) => {
-	let n = d(l(e)), r = t.filter((t) => t.trim() !== "" && t !== e).map((e) => d(l(e)));
-	if (r.length === 0) return n;
-	let i = (e, t, n) => {
+}, g = (e) => `k${u("sha256", p(e)).update("voltro:field-key-id:v1").digest("hex").slice(0, 10)}`, _ = class extends Error {
+	_tag = "FieldKeyringConfigError";
+	constructor(e) {
+		super(e), this.name = "FieldKeyringConfigError";
+	}
+}, v = (e) => e !== void 0 && typeof e.sealWith == "function" && typeof e.activate == "function", y = (t, n = {}) => {
+	let a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
+	for (let e of t.keys) {
+		if (!r.test(e.id)) throw new _(`field encryption: "${e.id}" is not a key id — use a short lowercase slug (letters, digits, "-", at most 16)`);
+		if (e.secret.trim() === "") throw new _(`field encryption: key "${e.id}" is empty`);
+		if (a.has(e.id)) throw new _(`field encryption: key id "${e.id}" is configured twice`);
+		let t = p(e.secret).toString("hex"), n = o.get(t);
+		if (n !== void 0) throw new _(`field encryption: keys "${n}" and "${e.id}" are the same key — a rotation needs a NEW key, and two ids for one key make every count per key wrong`);
+		a.set(e.id, e.secret), o.set(t, e.id);
+	}
+	if (!a.has(t.active)) throw new _(`field encryption: the active key "${t.active}" is not one of the configured keys (${[...a.keys()].join(", ") || "none"})`);
+	let s = new Map([...a].map(([e, t]) => [e, h(p(t), e)])), c = t.active, l = n.sealOnlyOnceActivated !== !0, u = [], d = () => {
+		u = [[c, s.get(c)], ...[...s].filter(([e]) => e !== c)];
+	};
+	d();
+	let f = (e, t, n) => {
 		try {
 			return e.decrypt(t, n), !0;
 		} catch {
 			return !1;
 		}
+	}, m = (e, t) => {
+		let n = i(e), r = n === void 0 ? void 0 : s.get(n);
+		return r !== void 0 && f(r, e, t) ? n : u.find(([, n]) => n !== r && f(n, e, t))?.[0];
 	};
 	return {
-		encrypt: n.encrypt,
-		decrypt: (e, t) => {
-			try {
-				return n.decrypt(e, t);
-			} catch (n) {
-				for (let n of r) try {
-					return n.decrypt(e, t);
-				} catch {}
-				throw n;
+		get activeKeyId() {
+			return c;
+		},
+		requestedKeyId: t.active,
+		keyIds: u.map(([e]) => e),
+		fingerprints: Object.freeze(Object.fromEntries([...a].map(([e, t]) => [e, g(t)]))),
+		encrypt: (e, t) => {
+			if (!l) throw Error("field cipher: nothing may be sealed before the boot has checked the keys against the database (verifyFieldKeyring decides which key is active) — a write reached an .encrypted() column during boot, before that check");
+			return s.get(c).encrypt(e, t);
+		},
+		sealWith: (e, t, n) => {
+			let r = s.get(e);
+			if (r === void 0) throw Error(`field cipher: this keyring does not hold key "${e}"`);
+			return r.encrypt(t, n);
+		},
+		opensWith: (e, t, n) => {
+			let r = s.get(e);
+			return r !== void 0 && f(r, t, n);
+		},
+		activate: (e) => {
+			if (!s.has(e)) throw Error(`field cipher: cannot activate key "${e}", which this keyring does not hold`);
+			c = e, l = !0, d();
+		},
+		decrypt: (t, n) => {
+			let r = i(t), a = r === void 0 ? void 0 : s.get(r), o = n?.column ?? "unbound";
+			if (r !== void 0 && a === void 0 && u.every(([, e]) => !f(e, t, n))) throw e(r, o, "failed"), Error(`field cipher: the value is sealed under key "${r}", which this keyring does not hold (it holds ${u.map(([e]) => e).join(", ")})`);
+			let c;
+			if (a !== void 0) try {
+				let i = a.decrypt(t, n);
+				return e(r, o, "ok"), i;
+			} catch (e) {
+				c = e;
 			}
+			for (let [r, i] of u) if (i !== a) try {
+				let a = i.decrypt(t, n);
+				return e(r, o, "ok"), a;
+			} catch (e) {
+				c ??= e;
+			}
+			throw e(r ?? "unnamed", o, "failed"), c ?? /* @__PURE__ */ Error("field cipher: malformed ciphertext");
 		},
-		sealedWithPreviousKey: (e, t) => !i(n, e, t) && r.some((n) => i(n, e, t))
+		keyIdOf: m,
+		sealedWithPreviousKey: (e, t) => {
+			let n = m(e, t);
+			return n !== void 0 && n !== c;
+		}
 	};
-}, p, m = (e) => {
-	p = e;
-}, h = () => p, g = "no field cipher registered — set VOLTRO_FIELD_ENCRYPTION_KEY (`voltro secret generate field-encryption`; `voltro dev` mints one), or call setFieldCipher.", _ = (e, t) => {
-	let n = h();
-	if (!n) throw Error(`encryptField: ${g}`);
-	return r(n, e, t);
-}, v = (e, t) => {
-	if (!i(e)) return e;
-	let r = h();
-	if (!r) throw Error(`decryptField: ${g}`);
-	return n(r, e, void 0, t);
+}, b = (e, t = []) => {
+	let n = p(e).toString("hex"), r = [...new Map(t.filter((e) => e.trim() !== "" && p(e).toString("hex") !== n).map((e) => [p(e).toString("hex"), e])).values()];
+	return y({
+		active: g(e),
+		keys: [{
+			id: g(e),
+			secret: e
+		}, ...r.map((e) => ({
+			id: g(e),
+			secret: e
+		}))]
+	});
+}, x, S = (e) => {
+	x = e;
+}, C = () => x, w = "no field cipher registered — set VOLTRO_FIELD_ENCRYPTION_KEY (`voltro secret generate field-encryption`; `voltro dev` mints one), or call setFieldCipher.", T = (e, t) => {
+	let n = C();
+	if (!n) throw Error(`encryptField: ${w}`);
+	return o(n, e, t);
+}, E = (e, t) => {
+	if (!s(e)) return e;
+	let n = C();
+	if (!n) throw Error(`decryptField: ${w}`);
+	return a(n, e, void 0, t);
 };
-//#endregion
-export { v as decryptField, l as deriveKey, _ as encryptField, h as getFieldCipher, d as makeAesCipher, f as makeFieldCipher, m as setFieldCipher };
+export { _ as FieldKeyringConfigError, E as decryptField, p as deriveKey, T as encryptField, g as fieldKeyIdOf, C as getFieldCipher, v as isFieldKeyring, h as makeAesCipher, b as makeFieldCipher, y as makeFieldKeyring, S as setFieldCipher };