@voltro/runtime 0.87.0 → 0.89.0

package/dist/computedQueryCache.js

@@ -5,39 +5,39 @@ import { buildSubjectKey as i } from "./rywPositionStore.js";
 import { runWithRoutingContext as a } from "./replicatedDataStore.js";
 import { Effect as o, Option as s, Schema as c } from "effect";
 import { createHash as l } from "node:crypto";
-import { parseRevalidateMs as u, schemaShape as d, shapeDigest as f } from "@voltro/protocol";
-import { AsyncLocalStorage as p } from "node:async_hooks";
-//#region src/computedQueryCache.ts
-var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
-	let e = globalThis, t = e[m];
+import { Unauthenticated as u, currentSubjectAuthority as d, effectiveScopes as f, parseRevalidateMs as p, schemaShape as m, setEffectiveScopes as h, shapeDigest as g } from "@voltro/protocol";
+import { AsyncLocalStorage as _ } from "node:async_hooks";
+// src/computedQueryCache.ts
+var v = Symbol.for("@voltro/runtime:computed-query-cache-capture"), y = () => {
+	let e = globalThis, t = e[v];
 	return t === void 0 && (t = {
-		storage: new p(),
+		storage: new _(),
 		installed: !1
-	}, e[m] = t), t;
-}, g = () => {
-	h().installed = !0;
-}, _ = () => h().installed, v = () => {
-	h().installed = !1;
-}, y = (e) => {
-	let t = h().storage.getStore();
+	}, e[v] = t), t;
+}, b = () => {
+	y().installed = !0;
+}, x = () => y().installed, S = () => {
+	y().installed = !1;
+}, C = (e) => {
+	let t = y().storage.getStore();
 	if (t === void 0) return;
 	let { composed: n, restricting: i } = r(e, !1);
 	for (let e of n) t.tables.add(e);
 	for (let e of i) t.tables.add(e);
-}, b = Symbol.for("@voltro/runtime:query-dependencies"), x = () => {
-	let e = globalThis, t = e[b];
-	return t === void 0 && (t = { storage: new p() }, e[b] = t), t;
-}, S = () => {
-	x().storage.enterWith(/* @__PURE__ */ new Set());
-}, C = () => [...x().storage.getStore() ?? []], w = (e) => {
-	x().storage.getStore()?.add(e), h().storage.getStore()?.tables.add(e);
-}, T = (e) => {
-	h().storage.getStore()?.volatile.add(e);
-}, E = (e, t) => h().storage.run(e, t), D = () => ({
+}, w = Symbol.for("@voltro/runtime:query-dependencies"), T = () => {
+	let e = globalThis, t = e[w];
+	return t === void 0 && (t = { storage: new _() }, e[w] = t), t;
+}, E = () => {
+	T().storage.enterWith(/* @__PURE__ */ new Set());
+}, D = () => [...T().storage.getStore() ?? []], O = (e) => {
+	T().storage.getStore()?.add(e), y().storage.getStore()?.tables.add(e);
+}, k = (e) => {
+	y().storage.getStore()?.volatile.add(e);
+}, A = (e, t) => y().storage.run(e, t), j = () => ({
 	tables: /* @__PURE__ */ new Set(),
 	caller: /* @__PURE__ */ new Set(),
 	volatile: /* @__PURE__ */ new Set()
-}), O = /* @__PURE__ */ new Set([
+}), M = /* @__PURE__ */ new Set([
 	"connections",
 	"apis",
 	"kv",
@@ -48,27 +48,70 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 	"outbox",
 	"transaction",
 	"storeForTenant"
-]), k = /* @__PURE__ */ new Set(["access", "connectionState"]), A = (e, t, n) => new Proxy(e, { get(e, r) {
+]), N = /* @__PURE__ */ new Set(["access", "connectionState"]), P = (e, t, n) => new Proxy(e, { get(e, r) {
 	return typeof r == "string" && !t.has(r) && n.caller.add(`subject.${r}`), Reflect.get(e, r, e);
-} }), j = (e, t, n) => {
-	let r = e.request, i = r === void 0 ? void 0 : new Proxy(r, { get(e, r) {
-		return r === "subject" ? t : ((r === "clientId" || r === "cookieHeader") && n.caller.add(`request.${r}`), Reflect.get(e, r, e));
+} }), F = (e, t, n, r = !1) => {
+	let i = e.request, a = i === void 0 ? void 0 : new Proxy(i, { get(e, r) {
+		return r === "subject" ? t : (typeof r == "string" && n.caller.add(`request.${r}`), Reflect.get(e, r, e));
 	} });
 	return new Proxy(e, { get(e, t) {
-		if (t === "request" && i !== void 0) return i;
-		typeof t == "string" && (O.has(t) && n.volatile.add(`ctx.${t}`), k.has(t) && n.caller.add(`ctx.${t}`));
-		let r = Reflect.get(e, t, e);
-		return typeof r == "function" ? r.bind(e) : r;
+		if (t === "request" && a !== void 0) return a;
+		typeof t == "string" && (M.has(t) && n.volatile.add(`ctx.${t}`), N.has(t) && !(r && t === "access") && n.caller.add(`ctx.${t}`));
+		let i = Reflect.get(e, t, e);
+		return typeof i == "function" ? i.bind(e) : i;
 	} });
-}, M = /* @__PURE__ */ new WeakMap(), N = (e) => {
-	let t = M.get(e);
-	return t === void 0 && (t = c.toCodecJson(e), M.set(e, t)), t;
-}, P = /* @__PURE__ */ new WeakMap(), F = (e) => {
+}, I = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = (e, r) => {
+		if (r > 64) throw Error("subject claims too deep");
+		if (e === void 0) return ["undefined"];
+		if (e === null || typeof e == "string" || typeof e == "boolean") return e;
+		if (typeof e == "number" && Number.isFinite(e)) return ["number", Object.is(e, -0) ? "-0" : e];
+		if (typeof e != "object" || !e || t.has(e)) throw Error("non-data subject claim");
+		let i = Object.getPrototypeOf(e);
+		if (!Array.isArray(e) && i !== Object.prototype && i !== null) throw Error("non-data subject claim");
+		if (Object.getOwnPropertySymbols(e).length > 0) throw Error("symbol subject claim");
+		t.add(e);
+		try {
+			if (Array.isArray(e)) {
+				if (i !== Array.prototype || Object.keys(e).length !== e.length || Object.getOwnPropertyNames(e).length !== e.length + 1) throw Error("non-data subject array");
+				return ["array", Array.from({ length: e.length }, (t, i) => {
+					let a = Object.getOwnPropertyDescriptor(e, String(i));
+					if (a === void 0 || !("value" in a)) throw Error("non-data subject array");
+					return n(a.value, r + 1);
+				})];
+			}
+			if (Object.getOwnPropertyNames(e).length !== Object.keys(e).length) throw Error("hidden subject claim");
+			return ["object", Object.keys(e).sort().map((t) => {
+				let i = Object.getOwnPropertyDescriptor(e, t);
+				if (i === void 0 || !("value" in i)) throw Error("accessor subject claim");
+				return [t, n(i.value, r + 1)];
+			})];
+		} finally {
+			t.delete(e);
+		}
+	};
+	try {
+		n(e, 0);
+		let t = e, r = "scopes" in t && t.scopes !== void 0 ? { scopes: [...new Set(t.scopes)].sort() } : {}, i = n({
+			subject: {
+				...e,
+				...r
+			},
+			effective: [...new Set(f(t))].sort()
+		}, 0);
+		return l("sha256").update(JSON.stringify(i)).digest("base64url");
+	} catch {
+		return;
+	}
+}, L = /* @__PURE__ */ new WeakMap(), R = (e) => {
+	let t = L.get(e);
+	return t === void 0 && (t = c.toCodecJson(e), L.set(e, t)), t;
+}, z = /* @__PURE__ */ new WeakMap(), B = (e) => {
 	if (e === void 0) return "none";
-	let t = P.get(e);
-	return t === void 0 && (t = f(d(e.ast)), P.set(e, t)), t;
-}, I = (t) => {
-	let n = t.input === void 0 ? s.some(t.decodedInput) : c.encodeUnknownOption(N(t.input))(t.decodedInput);
+	let t = z.get(e);
+	return t === void 0 && (t = g(m(e.ast)), z.set(e, t)), t;
+}, V = (t) => {
+	let n = t.input === void 0 ? s.some(t.decodedInput) : c.encodeUnknownOption(R(t.input))(t.decodedInput);
 	if (s.isNone(n)) return { bypass: "input-not-encodable" };
 	let r;
 	if (t.scope === "global") r = "g";
@@ -77,13 +120,15 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 		r = `t:${t.subject.tenantId}`;
 	} else {
 		if (t.subject.type === "anonymous" || t.subject.id == null || t.subject.id === "") return { bypass: "anonymous-subject" };
-		r = `s:${t.subject.id}`;
+		let e = I(t.subject);
+		if (e === void 0) return { bypass: "subject-not-encodable" };
+		r = `s:${e}`;
 	}
 	let i = t.rowFilter === void 0 ? [] : [...t.declaredSources].sort().map((n) => [n, e(t.rowFilter(n) ?? null)]), a;
 	try {
 		a = JSON.stringify([
 			t.codeIdentity,
-			F(t.output),
+			B(t.output),
 			e(n.value),
 			i
 		]);
@@ -92,15 +137,11 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 	}
 	let o = l("sha256").update(a).digest("base64url");
 	return { key: `cq:${t.name}:${o}:${r}` };
-}, L = (e) => {
+}, H = (e) => {
 	if (e.aborted) return { refused: {
 		reason: "aborted",
 		detail: []
 	} };
-	if (e.cacheScope !== "subject" && e.scope.caller.size > 0) return { refused: {
-		reason: "caller",
-		detail: [...e.scope.caller].sort()
-	} };
 	if (!e.volatileAllowed && e.scope.volatile.size > 0) return { refused: {
 		reason: "volatile",
 		detail: [...e.scope.volatile].sort()
@@ -120,7 +161,7 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 			detail: r
 		} };
 	}
-	let r = e.output === void 0 ? s.some(e.value) : c.encodeUnknownOption(N(e.output))(e.value);
+	let r = e.output === void 0 ? s.some(e.value) : c.encodeUnknownOption(R(e.output))(e.value);
 	if (s.isNone(r)) return { refused: {
 		reason: "output-not-encodable",
 		detail: []
@@ -134,17 +175,20 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 			detail: []
 		} };
 	}
-	return i > e.maxEntryBytes ? { refused: {
+	return e.scope.caller.size > 0 ? { refused: {
+		reason: "caller",
+		detail: [...e.scope.caller].sort()
+	} } : i > e.maxEntryBytes ? { refused: {
 		reason: "oversized",
 		detail: [`${i} bytes`]
 	} } : { store: {
 		stored: r.value,
 		tags: [...n].sort()
 	} };
-}, R = (e, t) => e === void 0 ? s.some(t) : c.decodeUnknownOption(N(e))(t), z = (e, t) => {
+}, U = (e, t) => e === void 0 ? s.some(t) : c.decodeUnknownOption(R(e))(t), W = (e, t) => {
 	let n = t.detail.join(", ");
 	switch (t.reason) {
-		case "caller": return `${e}: \`cache:\` result NOT kept — the handler read ${n}, which its cache scope does not key on, so the value is specific to this caller. Use \`scope: 'subject'\`, or derive the result without reading the caller (declare access in \`guards:\`; a membership the handler READS through ctx.store is fine — it becomes a dependency).`;
+		case "caller": return `${e}: \`cache:\` result NOT kept — the handler read ${n}, which its cache scope does not key on. Use \`scope: 'subject'\` for subject claims and effective scopes, or declare access in \`guards:\`. Connection state, client ids and cookie headers are never keyed; keep those reads outside cached queries. Membership rows read through ctx.store become invalidation dependencies.`;
 		case "volatile": return `${e}: \`cache:\` result NOT kept — the handler used ${n}, which no table write invalidates. Declare \`cache: { …, volatile: true }\` to accept the ttl as the bound on that staleness, or drop \`cache:\`.`;
 		case "undeclared-raw-read": return `${e}: \`cache:\` result NOT kept — a raw read declares no tables, so no write could invalidate it: ${n}. Declare them: ctx.store.raw(fragment, { dependsOn: ['…'] }).`;
 		case "row-filter-outside-source": return `${e}: \`cache:\` result NOT kept — the registered row filter restricts ${n}, which the query reads but does not declare in \`source:\`. Add it to \`source:\` so the entry is keyed by what this caller may see there.`;
@@ -152,20 +196,35 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 		case "oversized": return `${e}: \`cache:\` result NOT kept — ${n} exceeds the cache's maxEntryBytes.`;
 		case "aborted": return `${e}: \`cache:\` result NOT kept — the subscription closed while it was computed.`;
 	}
-}, B = (e) => {
-	let r = o.suspend(() => {
-		let r = D(), s = new Set(e.policy.scope === "tenant" ? ["tenantId"] : []), c = e.policy.scope === "subject" ? e.subject : A(e.subject, s, r), l = j(e.ctx, c, r), u = [], d = e.subject.id ?? "anonymous", f = {
-			subjectKey: i(d, void 0),
+}, G = () => new u({ reason: "request authority changed while reading a cached query; authenticate again" }), K = (e) => {
+	let r = I(e.subject), s = o.suspend(() => {
+		let s = j(), c = e.policy.scope === "subject", l = new Set(c ? [
+			...Object.keys(e.subject),
+			"id",
+			"type",
+			"tenantId",
+			"scopes",
+			"metadata",
+			"kind",
+			"service",
+			"auditActorId"
+		] : e.policy.scope === "tenant" ? ["tenantId"] : []), u = P(e.subject, l, s), p = f(e.subject);
+		h(u, c ? p : new Proxy(p, { get(e, t, n) {
+			return s.caller.add("subject.scopes"), Reflect.get(e, t, n);
+		} }));
+		let m = F(e.ctx, u, s, c), g = [], _ = e.subject.id ?? "anonymous", v = {
+			subjectKey: i(_, void 0),
 			forcePrimary: !0
 		};
 		return o.tryPromise({
-			try: () => E(r, () => a(f, () => n(async () => {
-				let n = await e.execute(l, c);
-				return u = t(), n;
+			try: () => A(s, () => a(v, () => n(async () => {
+				let n = await e.execute(m, u);
+				if (r !== I(d(e.subject))) throw G();
+				return g = t(), n;
 			}))),
 			catch: (e) => e
 		}).pipe(o.map((t) => {
-			let n = new Set(e.sources), i = (e) => [...new Set(e)].filter((e) => !n.has(e)).sort();
+			let n = new Set(e.sources), r = (e) => [...new Set(e)].filter((e) => !n.has(e)).sort();
 			if (e.isDescriptor(t)) return e.onDescriptor(), {
 				value: {
 					value: t,
@@ -173,11 +232,11 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 				},
 				notApplicable: !0
 			};
-			let a = L({
-				scope: r,
+			let i = H({
+				scope: s,
 				cacheScope: e.policy.scope,
 				volatileAllowed: e.policy.volatile,
-				rawReads: u,
+				rawReads: g,
 				declaredSources: e.sources,
 				rowFilter: e.rowFilter,
 				output: e.output,
@@ -185,47 +244,46 @@ var m = Symbol.for("@voltro/runtime:computed-query-cache-capture"), h = () => {
 				maxEntryBytes: e.cache.maxEntryBytes,
 				aborted: e.signal?.aborted === !0
 			});
-			if ("refused" in a) return a.refused.reason !== "aborted" && e.cache.notice(e.name, a.refused.reason, z(e.name, a.refused)), { value: {
+			if ("refused" in i) return i.refused.reason !== "aborted" && e.cache.notice(e.name, i.refused.reason, W(e.name, i.refused)), { value: {
 				value: t,
-				dependencies: i(r.tables)
+				dependencies: r(s.tables)
 			} };
-			let o = i(a.store.tags);
+			let a = r(i.store.tags);
 			return {
 				value: {
 					value: t,
-					dependencies: o
+					dependencies: a
 				},
 				store: {
 					stored: {
-						v: a.store.stored,
-						d: o
+						v: i.store.stored,
+						d: a
 					},
-					tags: a.store.tags
+					tags: i.store.tags
 				}
 			};
-		}));
+		}), o.flatMap((t) => r === I(d(e.subject)) ? o.succeed(t) : o.fail(G())));
 	});
 	return e.cache.wrapDynamic(e.key, {
 		ttlMs: e.policy.ttlMs,
 		...e.policy.swrMs === void 0 ? {} : { swrMs: e.policy.swrMs },
 		...e.cache.leaseMs === void 0 ? {} : { leaseMs: e.cache.leaseMs },
 		label: e.name
-	}, r, (t) => o.succeed(V(e.output, t))).pipe(o.map(({ value: e }) => e));
-}, V = (e, t) => {
+	}, s, (t) => o.succeed(q(e.output, t))).pipe(o.map(({ value: e }) => e));
+}, q = (e, t) => {
 	if (typeof t != "object" || !t || !("v" in t) || !("d" in t)) return s.none();
 	let n = t;
-	return !Array.isArray(n.d) || !n.d.every((e) => typeof e == "string") ? s.none() : s.map(R(e, n.v), (e) => ({
+	return !Array.isArray(n.d) || !n.d.every((e) => typeof e == "string") ? s.none() : s.map(U(e, n.v), (e) => ({
 		value: e,
 		dependencies: n.d
 	}));
-}, H = (e) => {
-	let t = u(e.ttl);
+}, J = (e) => {
+	let t = p(e.ttl);
 	if (t !== null) return {
 		ttlMs: t,
-		swrMs: e.swr === void 0 ? void 0 : u(e.swr) ?? void 0,
+		swrMs: e.swr === void 0 ? void 0 : p(e.swr) ?? void 0,
 		scope: e.scope,
 		volatile: e.volatile === !0
 	};
 };
-//#endregion
-export { B as cachedComputedCall, I as computedCacheKey, _ as computedQueryCacheCaptureInstalled, C as currentQueryDependencies, L as decideComputedStore, R as decodeComputedStored, z as describeComputedRefusal, S as enterQueryDependencies, g as installComputedQueryCacheCapture, D as newComputedCaptureScope, y as noteCacheRead, T as noteCacheVolatile, w as noteDependency, j as observedContext, A as observedSubject, H as queryCachePolicy, v as resetComputedQueryCacheCaptureForTests, E as runWithComputedCapture };
+export { K as cachedComputedCall, G as computedAuthorityRefusal, V as computedCacheKey, x as computedQueryCacheCaptureInstalled, I as computedSubjectIdentity, D as currentQueryDependencies, H as decideComputedStore, U as decodeComputedStored, W as describeComputedRefusal, E as enterQueryDependencies, b as installComputedQueryCacheCapture, j as newComputedCaptureScope, C as noteCacheRead, k as noteCacheVolatile, O as noteDependency, F as observedContext, P as observedSubject, J as queryCachePolicy, S as resetComputedQueryCacheCaptureForTests, A as runWithComputedCapture };

package/dist/connectionBuiltins.js

@@ -1,6 +1,6 @@
 import { beginOAuthConnect as e, forgetCredential as t, listConnectionStates as n, storeCredential as r } from "./connectionVault.js";
 import { ConnectionHandshakeFailed as i, ConnectionKindMismatch as a, ConnectionNotDeclared as o, ConnectionSubjectRequired as s } from "@voltro/protocol";
-//#region src/connectionBuiltins.ts
+// src/connectionBuiltins.ts
 var c = (e, t) => {
 	let n = e.request?.subject?.id ?? null;
 	if (n === null || n === "") throw new s({ connectionId: t });
@@ -77,5 +77,4 @@ var c = (e, t) => {
 	let i = c(r, n.connectionId);
 	return { ok: await t(r.store, n.connectionId, i) };
 };
-//#endregion
 export { p as makeDisconnectConnectionExecutor, u as makeListConnectionsExecutor, d as makeStartConnectionExecutor, f as makeSubmitTokenExecutor };

package/dist/connectionCredentials.js

@@ -1,4 +1,4 @@
-//#region src/connectionCredentials.ts
+// src/connectionCredentials.ts
 var e = 36e5, t = Symbol.for("@voltro/runtime/connectionCredentials"), n = globalThis, r = n[t] ??= {
 	overrides: /* @__PURE__ */ new Map(),
 	credentialExpiry: /* @__PURE__ */ new Map(),
@@ -62,5 +62,4 @@ var m = (e, t) => {
 }, g = (e) => o.get(e)?.size ?? 0, _ = () => {
 	i.clear(), a.clear(), o.clear();
 };
-//#endregion
 export { g as _connectionStreamCount, _ as _resetConnectionCredentialsForTest, p as applyConnectionCredential, l as bindConnectionCredential, u as getConnectionCredential, c as getCredentialExpiry, h as interruptConnectionStreams, f as mergeCookieHeader, s as recordCredentialExpiry, m as registerConnectionStream, d as unbindConnection };

package/dist/connectionState.js

@@ -1,4 +1,4 @@
-//#region src/connectionState.ts
+// src/connectionState.ts
 var e = Symbol.for("@voltro/runtime/connectionState"), t = globalThis, n = t[e] ??= /* @__PURE__ */ new WeakMap(), r = (e, t) => {
 	let r = n.get(e);
 	if (r === void 0 && !e.signal.aborted) {
@@ -30,5 +30,4 @@ var e = Symbol.for("@voltro/runtime/connectionState"), t = globalThis, n = t[e]
 		})
 	};
 };
-//#endregion
 export { r as makeConnectionState };

package/dist/connectionVault.js

@@ -2,7 +2,7 @@ import { decryptField as e, encryptField as t, getFieldCipher as n } from "./fie
 import { and as r, eq as i, fieldBinding as a, generateId as o, id as s, json as c, lte as l, table as u, text as d, timestamp as f } from "@voltro/database";
 import { ConnectionHandshakeFailed as p } from "@voltro/protocol";
 import { createLogger as m } from "@voltro/logger";
-//#region src/connectionVault.ts
+// src/connectionVault.ts
 var h = m({ scope: "voltro:connections" }), g = "_voltro_connections", _ = {
 	kind: "typeid",
 	prefix: "conn"
@@ -406,5 +406,4 @@ var h = m({ scope: "voltro:connections" }), g = "_voltro_connections", _ = {
 	for (let t of n) await e.delete("_voltro_connection_grants", t.id) && r++;
 	return r;
 };
-//#endregion
 export { g as CONNECTIONS_TABLE, y as CONNECTION_GRANTS_TABLE, z as ConnectionNotConnected, L as DEFAULT_REFRESH_SKEW_MS, X as GRANT_TTL_MS, R as REFRESH_LEASE_MS, b as _voltroConnectionGrantsTable, v as _voltroConnectionsTable, C as assertConnectionCipherConfigured, ae as beginOAuthConnect, U as clearConnectionRefreshFlights, oe as completeOAuthConnect, Z as connectionCallbackPath, S as connectionLabel, ne as defineConnection, F as exchangeAuthorizationCode, j as forgetCredential, M as listConnectionStates, w as makeConnectionRegistry, x as oauthCredentialValue, O as projectConnectionState, I as refreshAccessToken, K as resolveConnection, $ as resolveRedirectUri, Q as sanitizeRedirectTo, A as storeCredential, se as sweepExpiredGrants };

package/dist/connectionsFacade.js

@@ -1,6 +1,6 @@
 import { noteCacheVolatile as e } from "./computedQueryCache.js";
 import { ConnectionNotConnected as t, listConnectionStates as n, resolveConnection as r } from "./connectionVault.js";
-//#region src/connectionsFacade.ts
+// src/connectionsFacade.ts
 var i, a = (e) => {
 	i = e;
 }, o = () => i, s = (e, t) => {
@@ -52,5 +52,4 @@ var i, a = (e) => {
 		})) : n(i.store, i.registry, a)
 	};
 };
-//#endregion
 export { o as getConnectionResolver, c as makeConnectionResolver, l as makeConnectionsFacade, s as resolveConnectionForSubject, a as setConnectionResolver };

package/dist/coordinatedSchedule.js

@@ -1,5 +1,5 @@
 import { cronForInterval as e, externalizationRefusal as t, registerExternalizedTask as n } from "./externalizedTasks.js";
-//#region src/coordinatedSchedule.ts
+// src/coordinatedSchedule.ts
 var r = (e) => {
 	if (e === void 0) return null;
 	let t = e.nextDueInMs;
@@ -141,5 +141,4 @@ var r = (e) => {
 	...e.externalizeTask === void 0 ? {} : { externalize: e.externalizeTask(t) },
 	...i?.disarmWhenIdle === void 0 ? {} : { disarmWhenIdle: i.disarmWhenIdle }
 });
-//#endregion
 export { o as DEFAULT_MAX_IDLE_INTERVAL_MS, a as inspectCoordinatedSchedule, u as makeCoordinatedScheduler, l as nextDelay, s as readPollCeilingMs, c as scheduleCoordinated };

package/dist/crdtHistory.js

@@ -3,7 +3,7 @@ import { CRDT_VERSIONS_TABLE as o } from "./crdtVersionsTable.js";
 import { and as s, eq as c } from "@voltro/database";
 import { ValidationError as l } from "@voltro/protocol";
 import { crdtSchemaVersionOf as u, decodeSealedLog as d, defaultCrdtBackend as f, emptyCrdtState as p, latestCrdtSchemaVersion as m, sealedLogEpoch as h } from "@voltro/local-first";
-//#region src/crdtHistory.ts
+// src/crdtHistory.ts
 var g = (e, t, n, r) => e.query({
 	table: t,
 	predicate: n,
@@ -134,5 +134,4 @@ var g = (e, t, n, r) => e.query({
 		migrated: o
 	};
 };
-//#endregion
 export { T as crdtCellStats, S as listCrdtVersions, E as migrateCrdtColumn, w as prepareSealedCrdtRestore, C as restoreCrdtVersion, x as snapshotCrdt };

package/dist/crdtMerge.js

@@ -1,6 +1,6 @@
 import { ValidationError as e } from "@voltro/protocol";
 import { applyCrdtMigrations as t, applySealedFrame as n, defaultCrdtBackend as r, emptyCrdtState as i, mergeCrdtStates as a, setDefaultCrdtBackend as o } from "@voltro/local-first";
-//#region src/crdtMerge.ts
+// src/crdtMerge.ts
 var s = 524288, c = Symbol.for("@voltro/runtime:crdt-compact-max-bytes"), l = (e) => {
 	let t = globalThis;
 	t[c] = e;
@@ -175,5 +175,4 @@ var s = 524288, c = Symbol.for("@voltro/runtime:crdt-compact-max-bytes"), l = (e
 }, k = (e) => {
 	o(e);
 }, A = (e, t) => v().migrations?.[e]?.[t] ?? [];
-//#endregion
 export { s as DEFAULT_CRDT_COMPACT_MAX_BYTES, m as DEFAULT_CRDT_MAX_DOCUMENT_BYTES, p as DEFAULT_CRDT_MAX_UPDATE_BYTES, h as DEFAULT_CRDT_REBASE_MAX_BYTES, O as applySealedWrite, C as assertCrdtUpdateAdmissible, u as crdtCompactMaxBytes, f as crdtFoldCell, d as crdtIncrementalCell, x as crdtMaxDocumentBytes, b as crdtMaxUpdateBytes, A as crdtMigrationsFor, S as crdtRebaseMaxBytes, D as describeCrdtState, T as mergeCrdtColumnsIntoPatch, E as patchTouchesCrdt, _ as setCrdtAdmission, k as setCrdtBackend, l as setCrdtCompactMaxBytes };

package/dist/crdtVersionsTable.js

@@ -1,5 +1,5 @@
 import { bytes as e, id as t, table as n, text as r, timestamp as i } from "@voltro/database";
-//#region src/crdtVersionsTable.ts
+// src/crdtVersionsTable.ts
 var a = "_voltro_crdt_versions", o = n(a, {
 	id: t({ prefix: "crdtv" }),
 	tableName: r(),
@@ -21,5 +21,4 @@ var a = "_voltro_crdt_versions", o = n(a, {
 	"columnName",
 	"createdAt"
 ]);
-//#endregion
 export { a as CRDT_VERSIONS_TABLE, o as _voltroCrdtVersionsTable };

package/dist/credentialBound.js

@@ -1,5 +1,5 @@
 import { Duration as e, Effect as t, Ref as n, Stream as r } from "effect";
-//#region src/credentialBound.ts
+// src/credentialBound.ts
 var i = (i, a, o, s) => {
 	if (a === void 0) return i;
 	let c = a * 1e3 - Date.now();
@@ -8,5 +8,4 @@ var i = (i, a, o, s) => {
 		return r.concat(r.interruptWhen(i, o), r.unwrap(n.get(a).pipe(t.map((e) => e ? s : r.empty))));
 	}));
 };
-//#endregion
 export { i as boundByCredential };

package/dist/crud.js

@@ -1,6 +1,6 @@
 import { getTable as e, serverOnlyColumns as t } from "@voltro/database";
 import { ServerOnlyColumnWrite as n } from "@voltro/protocol";
-//#region src/crud.ts
+// src/crud.ts
 var r = (e, t) => {
 	if (t === void 0 || t.length === 0) return e;
 	let n = { ...e };
@@ -68,5 +68,4 @@ var r = (e, t) => {
 	count: (e, t = {}) => async (n, r) => s(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
 	remove: (e) => async (t, n) => ({ deleted: await n.store.delete(e, t.id) })
 };
-//#endregion
 export { u as crud, o as redactColumns };

package/dist/dataStore.js

@@ -4,7 +4,7 @@ import { applyMemoryColumnDefaults as i } from "./memoryColumnDefaults.js";
 import { Effect as a } from "effect";
 import { applyJsonPatch as o, attachEagerLoads as s, attributionFields as c, collectSubqueries as l, compareDecimal as u, emitCommittedChanges as d, evaluatePredicate as f, externalChangeEvent as p, getTable as m, hasEagerLoads as h, isTableReactive as g, jsonPatchAssignments as _, preparePredicate as v, raiseChangeListenerCeiling as y, requireTable as b, rowKeyColumns as x, settleTransactionExit as S, stampGeneratedId as C, transactionRetrySchedule as w, upsertUpdatePatch as T, upsertUpdateValues as E } from "@voltro/database";
 import { EventEmitter as D } from "node:events";
-//#region src/dataStore.ts
+// src/dataStore.ts
 var O = (e, t, n, r = m(n)?.fields) => t.length === 0 ? e : [...e].sort((e, n) => {
 	for (let i of t) {
 		let t = e[i.column], a = n[i.column];
@@ -708,5 +708,4 @@ var O = (e, t, n, r = m(n)?.fields) => t.length === 0 ? e : [...e].sort((e, n) =
 		this.settled || (this.settled = !0, this.overlay.clear(), this.tombstones.clear(), this.events.length = 0);
 	}
 };
-//#endregion
 export { q as InMemoryDataStore };

package/dist/dataloader.js

@@ -1,5 +1,5 @@
 import { inSet as e } from "@voltro/database";
-//#region src/dataloader.ts
+// src/dataloader.ts
 var t = () => {
 	let e, t;
 	return {
@@ -57,5 +57,4 @@ var t = () => {
 		loadMany: (e, t) => l(e, t)
 	};
 };
-//#endregion
 export { r as makeDataLoader };

package/dist/declaredTablesGuard.js

@@ -1,4 +1,4 @@
-//#region src/declaredTablesGuard.ts
+// src/declaredTablesGuard.ts
 var e = class extends Error {
 	table;
 	operation;
@@ -45,5 +45,4 @@ var e = class extends Error {
 		...n.storedTables === void 0 ? {} : { storedTables: () => n.storedTables() }
 	};
 };
-//#endregion
 export { e as UndeclaredTableAccess, t as guardUndeclaredTables };

package/dist/defineExecutor.js

@@ -1,4 +1,3 @@
-//#region src/defineExecutor.ts
+// src/defineExecutor.ts
 var e = (e, t) => t;
-//#endregion
 export { e as defineExecutor };

package/dist/dependencyGraph.js

@@ -1,5 +1,5 @@
 import { collectSubqueries as e, getRelations as t } from "@voltro/database";
-//#region src/dependencyGraph.ts
+// src/dependencyGraph.ts
 var n = (e) => {
 	let t = /* @__PURE__ */ new Set();
 	return r(e, t), t;
@@ -28,5 +28,4 @@ var n = (e) => {
 		}
 	}
 };
-//#endregion
 export { n as resolveDependentTables };

package/dist/devices.js

@@ -1,6 +1,6 @@
 import { and as e, eq as t, generateId as n } from "@voltro/database";
 import { createHash as r, randomBytes as i } from "node:crypto";
-//#region src/devices.ts
+// src/devices.ts
 var a = "_voltro_devices", o = "actors", s = (e) => r("sha256").update(e, "utf8").digest("hex"), c = (e = "dev_") => {
 	let t = e.replace(/_+$/, "");
 	return {
@@ -224,5 +224,4 @@ var a = "_voltro_devices", o = "actors", s = (e) => r("sha256").update(e, "utf8"
 		claim: async (r, i, o, s) => await n.updateMany(a, v(s), { where: e(t("id", r), t(i, o)) }) === 1
 	};
 };
-//#endregion
 export { a as DEVICES_TABLE, y as dataStoreDeviceStore, c as deviceTokenPrefixes, p as makeDeviceService, m as memoryDeviceStore, s as sha256HexOf };

package/dist/devicesWiring.js

@@ -2,7 +2,7 @@ import { deviceTokenPrefixes as e, sha256HexOf as t } from "./devices.js";
 import { Schema as n } from "effect";
 import { ADMIN_SCOPE as r, DEVICES_MANAGE_SCOPE as i, ScopeError as a, Unauthenticated as o } from "@voltro/protocol";
 import { defineRestRoute as s, requireAnyScope as c } from "@voltro/protocol/rest";
-//#region src/devicesWiring.ts
+// src/devicesWiring.ts
 var l = (n, r = {}) => {
 	let i = e(r.prefix);
 	return {
@@ -164,5 +164,4 @@ var l = (n, r = {}) => {
 		})
 	];
 };
-//#endregion
 export { f as deviceManagementRoutes, l as frameworkDeviceStrategy };

package/dist/dialectReplicationAdapter.js

@@ -1,4 +1,4 @@
-//#region src/dialectReplicationAdapter.ts
+// src/dialectReplicationAdapter.ts
 var e = () => {
 	let e = {
 		primary: 0,
@@ -25,5 +25,4 @@ var e = () => {
 		}
 	};
 };
-//#endregion
 export { e as memoryReplicationAdapter };

package/dist/dispatcher.js

@@ -15,7 +15,7 @@ import { committedChangeBatchOf as _ } from "@voltro/database";
 import { createHash as v, randomUUID as y } from "node:crypto";
 import { diffRows as b, isIdKeyed as x } from "@voltro/protocol";
 import { createLogger as S } from "@voltro/logger";
-//#region src/dispatcher.ts
+// src/dispatcher.ts
 var C = /* @__PURE__ */ new Set(), w = S({ scope: "voltro:dispatcher" }), T = (e) => Array.isArray(e) ? e.length : e == null ? 0 : 1, E = (e, n) => ({
 	...e,
 	key: `${e.key}:${v("sha256").update(JSON.stringify(t(n))).digest("base64url")}`
@@ -518,5 +518,4 @@ var C = /* @__PURE__ */ new Set(), w = S({ scope: "voltro:dispatcher" }), T = (e
 	for (let n = 0; n < e.length; n++) if (JSON.stringify(e[n]) !== JSON.stringify(t[n])) return !1;
 	return !0;
 };
-//#endregion
 export { j as Dispatcher, T as deliveredRowCount, E as snapshotEntryFor };

package/dist/effectStore.js

@@ -2,7 +2,7 @@ import { Context as e, Effect as t, Exit as n, Layer as r } from "effect";
 import { authoredError as i, describeDriverError as a, wireSafeCause as o } from "@voltro/database";
 import { StoreOperationFailed as s } from "@voltro/protocol";
 import { createLogger as c } from "@voltro/logger";
-//#region src/effectStore.ts
+// src/effectStore.ts
 var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStore") {}, d = {
 	TenantScopeViolation: !0,
 	TenantRowNotFound: !0,
@@ -67,5 +67,4 @@ var l = c({ scope: "store" }), u = class extends e.Service()("@voltro/EffectStor
 	...e.update === void 0 ? {} : { update: e.update },
 	...e.updateValues === void 0 ? {} : { updateValues: e.updateValues }
 }), x = (e, t, n) => e.insert(t.tableName, n), S = (e, t, n, r) => e.insertMany(t.tableName, n, r), C = (e, t, n, r) => e.upsert(t.tableName, n, b(r)), w = (e, t, n, r) => e.upsertWithOutcome(t.tableName, n, b(r)), T = (e, t, n, r) => e.insertIgnoreWithOutcome(t.tableName, n, { conflictColumns: r.conflictColumns });
-//#endregion
 export { u as EffectStore, T as insertIgnoreRowOutcomeEffect, S as insertManyRowsEffect, x as insertRowEffect, y as makeEffectStoreLayer, C as upsertRowEffect, w as upsertRowOutcomeEffect };