@voltro/runtime 0.86.0 → 0.88.0

package/dist/fieldKeyRegistry.js

@@ -0,0 +1,294 @@
+import { derivedRowId as e, encryptedColumnsOf as t, eq as n, fieldBinding as r, fieldBindingsOf as i, id as a, isEncrypted as o, isNotNull as s, json as c, lt as l, table as u, text as d, timestamp as f } from "@voltro/database";
+import { randomUUID as p } from "node:crypto";
+import { hostname as m } from "node:os";
+// src/fieldKeyRegistry.ts
+var h = u("_voltro_field_keys", {
+	id: a({ prefix: "fkey" }),
+	keyId: d().maxLength(16).unique(),
+	state: d().maxLength(16),
+	canary: d().maxLength(160),
+	registeredAt: f().default("now"),
+	activatedAt: f().nullable(),
+	replacedAt: f().nullable(),
+	retiredAt: f().nullable(),
+	requestedAt: f().nullable()
+}), g = u("_voltro_field_key_holders", {
+	id: a({ prefix: "fkh" }),
+	holderId: d().maxLength(128).unique(),
+	keyIds: d().maxLength(512),
+	activeKeyId: d().maxLength(16),
+	heartbeatAt: f(),
+	expiresAt: f()
+}).nonReactive(), _ = u("_voltro_field_key_reports", {
+	id: a({ prefix: "fkrep" }),
+	kind: d().maxLength(16).unique(),
+	reportedAt: f(),
+	report: c()
+}).nonReactive(), v = "_voltro_field_keys", y = "_voltro_field_key_reports", b = async (t, n, r, i = /* @__PURE__ */ new Date()) => {
+	await t.upsert(y, {
+		id: e("fkrep", n),
+		kind: n,
+		reportedAt: i,
+		report: JSON.stringify(r)
+	}, { conflictColumns: ["kind"] });
+}, x = async (e) => {
+	let t = await e.query({
+		table: y,
+		predicate: void 0,
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	}), n = {};
+	for (let e of t) {
+		let t = String(e.kind), r = e.report, i = typeof r == "string" ? JSON.parse(r) : r, a = e.reportedAt instanceof Date ? e.reportedAt : new Date(String(e.reportedAt));
+		t === "status" && (n.status = {
+			reportedAt: a,
+			report: i
+		}), t === "rekey" && (n.rekey = {
+			reportedAt: a,
+			report: i
+		});
+	}
+	return n;
+}, S = "_voltro_field_key_holders", C = 3e4, w = 1e4, T = 10, E = () => `${m().slice(0, 80)}:${process.pid}:${p().replaceAll("-", "").slice(0, 12)}`, D = "voltro:field-key-canary:v1", O = (e) => r(v, "canary", e), k = 3, A = class extends Error {
+	_tag = "FieldKeyringRefusal";
+	constructor(e) {
+		super(e), this.name = "FieldKeyringRefusal";
+	}
+}, j = (e) => ({
+	table: v,
+	predicate: void 0,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0,
+	...e === void 0 ? {} : { lock: e }
+}), M = (e) => ({
+	keyId: String(e.keyId),
+	state: String(e.state),
+	canary: String(e.canary),
+	registeredAt: N(e.registeredAt),
+	activatedAt: N(e.activatedAt),
+	replacedAt: N(e.replacedAt),
+	retiredAt: N(e.retiredAt),
+	requestedAt: N(e.requestedAt)
+}), N = (e) => e instanceof Date ? e : e == null ? null : new Date(typeof e == "number" ? e : String(e)), P = async (e) => (await e.query(j())).map(M), F = async (t, n, r, i = { holderId: E() }) => {
+	let a = n.requestedKeyId, o = new Set(n.keyIds), s = [], c = await P(t);
+	B(c, n, o, s), await H(t, n, r, s);
+	let l = new Set(c.map((e) => e.keyId)), u = n.keyIds.filter((e) => !l.has(e)), d = c.length === 0;
+	for (let r of u) {
+		let i = d && r === a;
+		await t.insertIgnore(v, {
+			id: e("fkey", r),
+			keyId: r,
+			state: i ? "active" : "pending",
+			canary: n.sealWith(r, D, O(r)),
+			...i ? { activatedAt: /* @__PURE__ */ new Date() } : {}
+		}, { conflictColumns: ["keyId"] });
+	}
+	let f = await G(t, n, i, !0);
+	return f.note !== void 0 && s.push(f.note), {
+		active: f.active,
+		registered: u,
+		...f.activated === void 0 ? {} : { activated: f.activated },
+		...f.waiting === void 0 ? {} : { waiting: f.waiting },
+		notes: s
+	};
+}, I = async (e, t, n) => {
+	let r = [], i = await P(e);
+	B(i, t, new Set(t.keyIds), r), await H(e, t, n, r);
+	let a = i.find((e) => e.state === "active")?.keyId, o = i.find((e) => e.requestedAt !== null && e.state === "pending")?.keyId;
+	return {
+		active: a,
+		...o === void 0 ? {} : { requested: o },
+		notes: r
+	};
+}, L = async (e, t, n) => {
+	let r = await G(e, t, n, !1);
+	return {
+		active: r.active,
+		...r.activated === void 0 ? {} : { activated: r.activated },
+		...r.waiting === void 0 ? {} : { waiting: r.waiting },
+		unheld: !t.keyIds.includes(r.active)
+	};
+}, R = async (e, t) => {
+	await e.deleteMany(S, { where: n("holderId", t) });
+}, z = (e, t, n) => {
+	let r, i = !1, a = "", o = (e, t) => {
+		a !== e && (a = e, t());
+	}, s = async () => {
+		try {
+			let r = await L(e, t, n);
+			r.activated !== void 0 && n.log.info(`field encryption: key "${r.activated.to}" is active now${r.activated.from === void 0 ? "" : ` (replacing "${r.activated.from}")`} — every live process holds it`), r.unheld ? o(`unheld:${r.active}`, () => n.log.error(`field encryption: the database's active key "${r.active}" is not held by this process (it holds ${t.keyIds.join(", ")}) — it missed its heartbeats while the fleet rotated. Values sealed under "${r.active}" cannot be read here; restart it with that key.`)) : r.waiting === void 0 ? a = "" : o(`waiting:${r.waiting.keyId}:${r.waiting.holders.join(",")}`, () => n.log.info(`field encryption: key "${r.waiting.keyId}" waits to become active — ${r.waiting.holders.length} live process(es) do not hold it yet: ${r.waiting.holders.join(", ")}`));
+		} catch (e) {
+			o("failed", () => n.log.warn(`field encryption: key heartbeat failed — ${e instanceof Error ? e.message : String(e)}`));
+		}
+	}, c = setInterval(() => {
+		i || r !== void 0 || (r = s().finally(() => {
+			r = void 0;
+		}));
+	}, n.intervalMs ?? 1e4);
+	return c.unref(), { stop: async () => {
+		i = !0, clearInterval(c), await r, await R(e, n.holderId);
+	} };
+}, B = (e, t, n, r) => {
+	let i = new Map(e.map((e) => [e.keyId, e])), a = (n) => e.find((e) => e.keyId !== n && e.state !== "retired" && t.opensWith(n, e.canary, O(e.keyId)))?.keyId;
+	for (let e of t.keyIds) {
+		let n = i.get(e), o = a(e);
+		if (n !== void 0 && n.state !== "retired" && !t.opensWith(e, n.canary, O(e))) throw new A(`field encryption: the key supplied as "${e}" is not the key this database registered as "${e}"` + (o === void 0 ? "" : ` — it is the key registered as "${o}"`) + `.
+  Values sealed under "${e}" cannot be read with it. Supply the original key under that id;\n  a NEW key needs a new id (\`voltro secret generate field-encryption\` makes a key).`);
+		if (o !== void 0) throw new A(`field encryption: the key supplied as "${e}" is the key this database registered as "${o}".\n  One key under two ids makes every count per key wrong, and a rotation to it is no rotation.
+  Supply it as "${o}" — or, for a rotation, generate a new key (\`voltro secret generate field-encryption\`).`);
+		n?.state === "retired" && r.push(`field encryption: key "${e}" is retired — nothing is sealed under it; it can be removed from the environment`);
+	}
+	V(e, n);
+}, V = (e, t) => {
+	let n = e.filter((e) => (e.state === "active" || e.state === "decrypt-only") && !t.has(e.keyId));
+	if (n.length > 0) {
+		let e = n.map((e) => `"${e.keyId}" (${e.state})`).join(", "), r = n.filter((e) => e.state === "decrypt-only").map((e) => e.keyId);
+		throw new A(`field encryption: this database has values sealed under ${e}, which this process does not hold (it holds ${[...t].join(", ")}).\n  This is what a rollback past a key rotation, a database restored from another environment, or a key
+  removed from VOLTRO_FIELD_ENCRYPTION_KEYS too early look like. Supply the key(s) under their ids.` + (r.length === 0 ? "" : `
+  Keeping a replaced key (${r.join(", ")}) is always fine — it only decrypts. To drop it instead, supply it\n  once more, run \`voltro secret rekey\` (every value moves under the active key), then
+  \`voltro secret retire field-encryption ${r[0]}\`${r.length > 1 ? " (per key)" : ""} — a retired key can leave the environment.`));
+	}
+}, H = async (e, n, r, a) => {
+	for (let c of r) {
+		let r = c;
+		if (typeof r != "object" || !r || typeof r.fields != "object") continue;
+		let l = r.tableName;
+		if (l !== void 0 && l !== "_voltro_field_keys") for (let c of t(r)) {
+			let t = (await e.query({
+				table: l,
+				predicate: s(c),
+				order: [],
+				take: k,
+				skip: void 0,
+				projection: ["id", c]
+			})).filter((e) => o(e[c])), u = t.filter((e) => i(r, c, e.id).every((t) => n.keyIdOf?.(String(e[c]), t) === void 0));
+			if (u.length !== 0) {
+				if (u.length === t.length) throw new A(`field encryption: none of the configured keys (${n.keyIds.join(", ")}) opens the values in ${l}.${c} — ${u.length} of ${u.length} sampled.\n  The configured key is not the one this data was sealed with: a key from another environment, a
+  regenerated key, or data restored from elsewhere. Supply the original key; this refuses at boot
+  rather than failing every read of the column.`);
+				a.push(`field encryption: ${u.length} of ${t.length} sampled values in ${l}.${c} open with no configured key`);
+			}
+		}
+	}
+}, U = () => ({
+	table: S,
+	predicate: void 0,
+	order: [],
+	take: void 0,
+	skip: void 0,
+	projection: void 0
+}), W = async (e) => (await e.query(U())).map((e) => ({
+	holderId: String(e.holderId),
+	keyIds: String(e.keyIds).split(",").filter((e) => e !== ""),
+	activeKeyId: String(e.activeKeyId),
+	heartbeatAt: new Date(q(e.heartbeatAt)),
+	expiresAt: new Date(q(e.expiresAt))
+})), G = async (t, r, i, a) => {
+	let o = i.now?.() ?? Date.now(), s = i.leaseMs ?? 3e4, c = r.requestedKeyId, u = await t.transactional(async (t) => {
+		let u = (await t.query(j("update"))).map(M);
+		a && V(u, new Set(r.keyIds));
+		let d = new Date(o), f = u.filter((e) => e.state === "active"), p = f.find((e) => e.keyId === c) ?? [...f].sort((e, t) => (e.activatedAt?.getTime() ?? 0) - (t.activatedAt?.getTime() ?? 0) || e.keyId.localeCompare(t.keyId))[0];
+		for (let e of f) e.keyId !== p?.keyId && await t.updateMany(v, {
+			state: "decrypt-only",
+			replacedAt: d
+		}, { where: n("keyId", e.keyId) });
+		let m, h = u.find((e) => e.requestedAt !== null && e.state === "pending" && e.keyId !== p?.keyId)?.keyId;
+		if (a && p?.keyId !== c) {
+			let e = u.find((e) => e.keyId === c);
+			if (e === void 0) throw new A(`field encryption: key "${c}" was not recorded`);
+			if (e.state === "retired") throw new A(`field encryption: the active key "${c}" is retired — nothing may be sealed under it again.\n  Name another key in VOLTRO_FIELD_ENCRYPTION_ACTIVE${p === void 0 ? "" : ` (the database's active key is "${p.keyId}")`}.`);
+			e.state === "decrypt-only" && p !== void 0 ? m = `field encryption: VOLTRO_FIELD_ENCRYPTION_ACTIVE names "${c}", which was replaced by "${p.keyId}" — new values stay under "${p.keyId}"` : (await K(t, u, c), await t.updateMany(v, { requestedAt: d }, { where: n("keyId", c) }), h = c);
+		}
+		await t.deleteMany(S, { where: l("expiresAt", /* @__PURE__ */ new Date(o - T * s)) });
+		let g = (await t.query(U())).filter((e) => String(e.holderId) !== i.holderId && q(e.expiresAt) > o).map((e) => ({
+			holderId: String(e.holderId),
+			keyIds: String(e.keyIds).split(",")
+		})), _, y;
+		if (h !== void 0) {
+			let e = [...r.keyIds.includes(h) ? [] : [i.holderId], ...g.filter((e) => !e.keyIds.includes(h)).map((e) => e.holderId)].sort();
+			e.length === 0 ? (p !== void 0 && await t.updateMany(v, {
+				state: "decrypt-only",
+				replacedAt: d
+			}, { where: n("keyId", p.keyId) }), await t.updateMany(v, {
+				state: "active",
+				activatedAt: d,
+				requestedAt: null
+			}, { where: n("keyId", h) }), _ = {
+				from: p?.keyId,
+				to: h
+			}, p = u.find((e) => e.keyId === h)) : y = {
+				keyId: h,
+				holders: e
+			};
+		}
+		if (p === void 0) throw new A("field encryption: no key is recorded as active");
+		let b = p.keyId;
+		return await t.upsert(S, {
+			id: e("fkh", i.holderId),
+			holderId: i.holderId,
+			keyIds: r.keyIds.join(","),
+			activeKeyId: r.keyIds.includes(b) ? b : r.activeKeyId,
+			heartbeatAt: d,
+			expiresAt: new Date(o + s)
+		}, { conflictColumns: ["holderId"] }), {
+			active: b,
+			..._ === void 0 ? {} : { activated: _ },
+			...y === void 0 ? {} : { waiting: y },
+			...m === void 0 ? {} : { note: m }
+		};
+	});
+	return r.keyIds.includes(u.active) && r.activate(u.active), u;
+}, K = async (e, t, r) => {
+	for (let i of t) i.requestedAt !== null && i.keyId !== r && await e.updateMany(v, { requestedAt: null }, { where: n("keyId", i.keyId) });
+}, q = (e) => e instanceof Date ? e.getTime() : typeof e == "number" ? e : Date.parse(String(e)), J = async (t, n, r) => {
+	await t.insertIgnore(v, {
+		id: e("fkey", r),
+		keyId: r,
+		state: "pending",
+		canary: n.sealWith(r, D, O(r))
+	}, { conflictColumns: ["keyId"] });
+}, Y = async (e, t) => (await e.query(U())).filter((e) => q(e.expiresAt) > t).map((e) => ({
+	holderId: String(e.holderId),
+	keyIds: String(e.keyIds).split(","),
+	activeKeyId: String(e.activeKeyId)
+})), X = (e, t, r = {}) => e.transactional(async (e) => {
+	let i = r.now?.() ?? Date.now(), a = (await e.query(j("update"))).map(M), o = a.find((e) => e.keyId === t);
+	if (o === void 0) throw new A(`field encryption: "${t}" is not a recorded key (recorded: ${a.map((e) => e.keyId).join(", ") || "none"})`);
+	if (o.state === "retired") return;
+	if (o.state === "active") throw new A(`field encryption: "${t}" is the active key — rotate to another key first (\`voltro secret rotate field-encryption\`)`);
+	let s = (await Y(e, i)).filter((e) => e.activeKeyId === t).map((e) => e.holderId);
+	if (s.length > 0) throw new A(`field encryption: a live process still seals new values under "${t}": ${s.join(", ")} — it adopts the active key on its next heartbeat; try again then`);
+	await e.updateMany(v, {
+		state: "retired",
+		retiredAt: new Date(i),
+		requestedAt: null
+	}, { where: n("keyId", t) });
+}), Z = (e, t, r = {}) => e.transactional(async (e) => {
+	let i = r.now?.() ?? Date.now(), a = new Date(i), o = (await e.query(j("update"))).map(M), s = o.find((e) => e.keyId === t);
+	if (s === void 0) throw new A(`field encryption: "${t}" is not a recorded key (recorded: ${o.map((e) => e.keyId).join(", ") || "none"})`);
+	if (s.state === "retired") throw new A(`field encryption: "${t}" is retired — nothing may be sealed under it again`);
+	let c = o.find((e) => e.state === "active"), l = (await Y(e, i)).filter((e) => !e.keyIds.includes(t)).map((e) => e.holderId).sort();
+	if (c?.keyId === t) return {
+		from: t,
+		to: t,
+		lacking: l
+	};
+	for (let t of o) t.state === "active" && await e.updateMany(v, {
+		state: "decrypt-only",
+		replacedAt: a
+	}, { where: n("keyId", t.keyId) });
+	return await e.updateMany(v, {
+		state: "active",
+		activatedAt: a,
+		requestedAt: null
+	}, { where: n("keyId", t) }), {
+		from: c?.keyId,
+		to: t,
+		lacking: l
+	};
+});
+export { v as FIELD_KEYS_TABLE, w as FIELD_KEY_HEARTBEAT_MS, S as FIELD_KEY_HOLDERS_TABLE, C as FIELD_KEY_LEASE_MS, y as FIELD_KEY_REPORTS_TABLE, A as FieldKeyringRefusal, g as _voltroFieldKeyHoldersTable, _ as _voltroFieldKeyReportsTable, h as _voltroFieldKeysTable, Z as activateFieldKeyNow, I as checkFieldKeyring, E as fieldKeyHolderId, L as heartbeatFieldKeys, W as readFieldKeyHolders, x as readFieldKeyReports, P as readFieldKeys, b as recordFieldKeyReport, J as registerFieldKey, R as releaseFieldKeyHolder, X as retireFieldKey, z as startFieldKeyHolder, F as verifyFieldKeyring };

package/dist/fieldKeyRekey.js

@@ -0,0 +1,285 @@
+import { ENVELOPE_PATTERN as e, cellText as t, declaredEncryptedColumns as n, declaredRenames as r, discoverSealedColumns as i, reasonOf as a } from "./fieldKeyScan.js";
+import { Effect as o } from "effect";
+import { ciphertextKeyId as s, fieldBinding as c, quoteIdent as l } from "@voltro/database";
+import { SqlClient as u } from "effect/sql";
+import { STEP_JOURNAL_BINDING as d, WORKFLOW_JOURNAL_BINDING as f } from "@voltro/workflow";
+// src/fieldKeyRekey.ts
+var p = (e) => {
+	let t = e.renames?.get(e.table), n = t?.columns.get(e.column);
+	return {
+		tables: t?.previousTable === void 0 ? [e.table] : [e.table, t.previousTable],
+		columns: n === void 0 ? [e.column] : [e.column, n]
+	};
+}, m = (e) => {
+	let t = p(e);
+	return t.tables.length > 1 || t.columns.length > 1;
+}, h = 32, g = (e, t) => {
+	typeof e == "string" && e !== "" && e.length <= 191 && !e.startsWith("enc:") ? t.add(e) : (typeof e == "number" || typeof e == "bigint") && t.add(String(e));
+}, _ = (e) => {
+	let t = /* @__PURE__ */ new Map(), n;
+	try {
+		n = JSON.parse(e);
+	} catch {
+		return t;
+	}
+	let r = (e, n, i) => {
+		if (typeof e == "string") {
+			if (!e.startsWith("enc:")) return;
+			let r = /* @__PURE__ */ new Set();
+			for (let e of i) for (let t of Object.values(e)) g(t, r);
+			t.set(e, {
+				key: n,
+				ids: r
+			});
+		} else if (Array.isArray(e)) for (let t of e) r(t, n, i);
+		else if (typeof e == "object" && e) {
+			let t = e;
+			for (let [e, n] of Object.entries(t)) r(n, e, [t, ...i]);
+		}
+	};
+	return r(n, void 0, []), t;
+}, v = (e, t, n) => {
+	if (!e.startsWith("enc:v2:")) return [void 0];
+	let r = n.rowId === void 0 || n.rowId === null ? void 0 : String(n.rowId);
+	if (e.startsWith("enc:v2:c:")) {
+		let e = p(n), t = [
+			...e.tables.flatMap((t) => e.columns.map((e) => c(t, e))),
+			f,
+			d,
+			...[...n.declared].flatMap(([e, t]) => [...t].map((t) => c(e, t)))
+		];
+		return [...new Map(t.map((e) => [e.column, e])).values()];
+	}
+	let i = [], a = /* @__PURE__ */ new Set(), o = (e, t, n) => {
+		if (n === void 0) return;
+		let r = c(e, t, n);
+		r.row === void 0 || a.has(r.row) || (a.add(r.row), i.push(r));
+	}, s = p(n);
+	for (let e of s.tables) for (let t of s.columns) o(e, t, r);
+	let l = /* @__PURE__ */ new Set();
+	for (let e of t?.ids ?? []) l.add(e);
+	for (let e of Object.values(n.row)) g(e, l);
+	let u = [...l].slice(0, h), m = t?.key ?? n.column;
+	for (let [e, t] of n.declared) if (t.has(m)) for (let t of u) o(e, m, t);
+	return i;
+}, y = (t, n, r) => {
+	let i = n.activeKeyId, a = [...new Set(t.match(e) ?? [])];
+	if (a.length === 0) return {
+		text: t,
+		rekeyed: 0,
+		current: 0,
+		unresolved: 0
+	};
+	let o = _(t), l = t, u = 0, d = 0, f = 0, h = m(r), g = (e) => {
+		if (e === void 0 || !h) return e;
+		let t = p(r);
+		return !t.tables.some((n) => t.columns.some((t) => e.column === `${n}:${t}`)) || e.column === `${r.table}:${r.column}` ? e : e.row === void 0 ? c(r.table, r.column) : c(r.table, r.column, r.rowId);
+	};
+	for (let e of a) {
+		let a = t.split(e).length - 1;
+		if (s(e) === i && !h) {
+			d += a;
+			continue;
+		}
+		let c, p = !1;
+		for (let t of v(e, o.get(e), r)) {
+			let r;
+			try {
+				r = n.decrypt(e, t);
+			} catch {
+				continue;
+			}
+			let a = g(t);
+			if (s(e) === i && a === t) {
+				p = !0;
+				break;
+			}
+			c = n.sealWith(i, r, a);
+			break;
+		}
+		p ? d += a : c === void 0 ? f += a : (l = l.split(e).join(c), u += a);
+	}
+	return {
+		text: l,
+		rekeyed: u,
+		current: d,
+		unresolved: f
+	};
+}, b = (t, n, r) => {
+	let i = _(t), a = 0, o = 0;
+	for (let s of t.match(e) ?? []) v(s, i.get(s), r).some((e) => {
+		try {
+			return n.decrypt(s, e), !0;
+		} catch {
+			return !1;
+		}
+	}) ? a += 1 : o += 1;
+	return {
+		opened: a,
+		unopened: o
+	};
+}, x = 200, S = (e, t, n, r, i) => e === "postgres" ? r`CAST(${r(t)} AS TEXT) = ${i}` : e === "mysql" || e === "mariadb" ? n === "json" ? r`CAST(${r(t)} AS CHAR) = ${i}` : r`CAST(${r(t)} AS BINARY) = CAST(${i} AS BINARY)` : e === "mssql" ? r`CAST(${r(t)} AS VARBINARY(MAX)) = CAST(${i} AS VARBINARY(MAX))` : r`${r(t)} = ${i}`, C = (e, t, s, c = {}) => o.gen(function* () {
+	let l = yield* u.SqlClient, d = n(s), f = r(s), { columns: p, unreadable: m } = yield* i(e, d), h = [...m], g = [];
+	for (let n of p) {
+		if (n.found === 0) continue;
+		let r = yield* w(l, e, t, d, f, n, c.dryRun === !0, c.beforeWrite).pipe(o.catch((e) => o.sync(() => {
+			h.push({
+				table: n.table,
+				column: n.column,
+				reason: a(e)
+			});
+		})));
+		r !== void 0 && (g.push(r), c.onProgress?.(r));
+	}
+	return {
+		active: t.activeKeyId,
+		locations: g,
+		unreadable: h
+	};
+}), w = (e, n, r, i, a, s, c, u) => o.gen(function* () {
+	let d = {
+		cells: 0,
+		rekeyed: 0,
+		current: 0,
+		unresolved: 0,
+		changedMeanwhile: 0,
+		unaddressable: 0
+	}, f = s.key, p = n === "postgres" && s.type === "json" ? (yield* e.unsafe(`SELECT data_type AS t FROM information_schema.columns WHERE table_name = '${s.table.replaceAll("'", "''")}' AND column_name = '${s.column.replaceAll("'", "''")}' AND table_schema = current_schema()`).unprepared)[0]?.t : void 0, m = (e) => typeof e == "number" || typeof e == "bigint" ? String(e) : `'${String(e).replaceAll("'", "''")}'`, h = (r, i, a) => o.gen(function* () {
+		u !== void 0 && (yield* u({
+			table: s.table,
+			column: s.column,
+			rowId: r
+		}));
+		let o = p === "jsonb" ? e`CAST(${a} AS JSONB)` : p === "json" ? e`CAST(${a} AS JSON)` : e`${a}`;
+		yield* e`UPDATE ${e(s.table)} SET ${e(s.column)} = ${o} WHERE ${e(f)} = ${r} AND ${S(n, s.column, s.type, e, i)}`;
+		let c = (yield* e.unsafe(`SELECT ${s.asText} AS v FROM ${l(s.table, n)} WHERE ${l(f, n)} = ${m(r)}`).unprepared)[0]?.v;
+		return t(c) === a;
+	}), g = (r) => o.gen(function* () {
+		if (u !== void 0) for (let e of r) yield* u({
+			table: s.table,
+			column: s.column,
+			rowId: e.rowId
+		});
+		let i = (t) => p === "jsonb" ? e`CAST(${t} AS JSONB)` : p === "json" ? e`CAST(${t} AS JSON)` : e`${t}`, a = e.join(" ", !1)(r.map((t) => e`WHEN ${t.rowId} THEN ${i(t.next)}`)), o = e.join(" ", !1)(r.map((t) => e`WHEN ${e(f)} = ${t.rowId} AND ${S(n, s.column, s.type, e, t.text)} THEN 1`));
+		yield* e`UPDATE ${e(s.table)} SET ${e(s.column)} = CASE ${e(f)} ${a} END WHERE ${e(f)} IN ${e.in(r.map((e) => e.rowId))} AND (CASE ${o} ELSE 0 END) = 1`;
+		let c = yield* e.unsafe(`SELECT ${s.asText} AS v, ${l(f, n)} AS k FROM ${l(s.table, n)} WHERE ${l(f, n)} IN (${r.map((e) => m(e.rowId)).join(", ")})`).unprepared, d = new Map(c.map((e) => [String(e.k), t(e.v)]));
+		return r.map((e) => d.get(String(e.rowId)) === e.next);
+	}), _;
+	for (;;) {
+		let n = yield* e.unsafe(s.page(_, x)).unprepared, l = [];
+		for (let e of n) {
+			let n = t(e.__v), { __v: o, __k: u, ...p } = e, m = y(n, r, {
+				table: s.table,
+				column: s.column,
+				rowId: u,
+				row: p,
+				declared: i,
+				renames: a
+			});
+			d.cells += 1, d.current += m.current, d.unresolved += m.unresolved, m.rekeyed !== 0 && (f === void 0 ? d.unaddressable += m.rekeyed : c ? d.rekeyed += m.rekeyed : l.push({
+				rowId: u,
+				text: n,
+				next: m.text,
+				rekeyed: m.rekeyed
+			}));
+		}
+		if (l.length > 0) {
+			let e = yield* g(l).pipe(o.catch(() => o.forEach(l, (e) => h(e.rowId, e.text, e.next))));
+			l.forEach((t, n) => {
+				e[n] === !0 ? d.rekeyed += t.rekeyed : d.changedMeanwhile += 1;
+			});
+		}
+		if (f === void 0 || n.length < x) break;
+		_ = n[n.length - 1].__k;
+	}
+	return {
+		table: s.table,
+		column: s.column,
+		...d
+	};
+}), T = (e, a, s) => o.gen(function* () {
+	let o = yield* u.SqlClient, c = n(s), l = r(s), { columns: d, unreadable: f } = yield* i(e, c), p = [], m = 0;
+	for (let e of d) {
+		if (e.found === 0) continue;
+		let n = 0, r;
+		for (;;) {
+			let i = yield* o.unsafe(e.page(r, x)).unprepared;
+			for (let r of i) {
+				let { __v: i, __k: o, ...s } = r, u = b(t(i), a, {
+					table: e.table,
+					column: e.column,
+					rowId: o,
+					row: s,
+					declared: c,
+					renames: l
+				});
+				m += u.opened, n += u.unopened;
+			}
+			if (e.key === void 0 || i.length < x) break;
+			r = i[i.length - 1].__k;
+		}
+		n > 0 && p.push({
+			table: e.table,
+			column: e.column,
+			count: n
+		});
+	}
+	return {
+		opened: m,
+		unopened: p,
+		unreadable: f
+	};
+}), E = (t) => {
+	let n = t.match(e);
+	return n !== null && n.length === 1 && n[0] === t;
+}, D = (a, s, c) => o.gen(function* () {
+	let o = yield* u.SqlClient, d = n(c), f = r(c), { columns: p, unreadable: m, tables: h } = yield* i(a, d), g = [], _ = [], v = (e, t) => s !== void 0 && b(e, s, t).unopened === 0;
+	for (let n of p) {
+		if (n.found === 0) continue;
+		let r = 0, i = 0, c;
+		for (;;) {
+			let l = yield* o.unsafe(n.page(c, x)).unprepared;
+			for (let c of l) {
+				let l = t(c.__v), { __v: u, __k: p, ...m } = c, h = {
+					table: n.table,
+					column: n.column,
+					rowId: p,
+					row: m,
+					declared: d,
+					renames: f
+				};
+				if (E(l)) {
+					if (v(l, h)) continue;
+					if (n.key === void 0) {
+						i += 1;
+						continue;
+					}
+					yield* o`UPDATE ${o(n.table)} SET ${o(n.column)} = NULL WHERE ${o(n.key)} = ${p} AND ${S(a, n.column, n.type, o, l)}`, r += 1;
+				} else i += s === void 0 ? (l.match(e) ?? []).length : b(l, s, h).unopened;
+			}
+			if (n.key === void 0 || l.length < x) break;
+			c = l[l.length - 1].__k;
+		}
+		r > 0 && g.push({
+			table: n.table,
+			column: n.column,
+			count: r
+		}), i > 0 && _.push({
+			table: n.table,
+			column: n.column,
+			count: i
+		});
+	}
+	let y = new Set(s?.keyIds ?? []), C = (e) => l(e, a), w = [];
+	if (h.has("_voltro_field_keys")) {
+		w = (yield* o.unsafe(`SELECT ${C("keyId")} AS k FROM ${C("_voltro_field_keys")}`).unprepared).map((e) => String(e.k)).filter((e) => !y.has(e));
+		for (let e of w) yield* o`DELETE FROM ${o("_voltro_field_keys")} WHERE ${o("keyId")} = ${e}`;
+	}
+	return h.has("_voltro_field_key_holders") && (yield* o.unsafe(`DELETE FROM ${C("_voltro_field_key_holders")}`).unprepared), {
+		nulled: g,
+		unreadable: _,
+		forgottenKeys: w,
+		unreadableColumns: m
+	};
+});
+export { D as nullUnreadableSealedValues, b as openCell, y as rekeyCell, C as rekeySealedValues, T as verifySealedValues };