@voltro/runtime 0.87.0 → 0.89.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (179) hide show
  1. package/CHANGELOG.md +272 -6
  2. package/THIRD-PARTY-NOTICES.md +644 -48
  3. package/dist/aggregate.js +1 -2
  4. package/dist/aggregateExtrema.js +1 -2
  5. package/dist/aggregateIvm.js +1 -2
  6. package/dist/analyticsMirror.js +1 -2
  7. package/dist/analyticsSink.js +1 -2
  8. package/dist/apiKeyUsage.js +1 -2
  9. package/dist/apiKeys.js +1 -2
  10. package/dist/apiKeysWiring.js +1 -2
  11. package/dist/apiRoleBucketSampler.js +1 -2
  12. package/dist/apiRoleWorkloadHistory.js +1 -2
  13. package/dist/apiRoleWorkloadMetrics.js +1 -2
  14. package/dist/apiRoleWorkloadStorage.js +1 -2
  15. package/dist/approvalBuiltins.js +1 -2
  16. package/dist/approvals.js +1 -2
  17. package/dist/authMiddlewareLayer.js +1 -2
  18. package/dist/bindEvent.js +1 -2
  19. package/dist/boot-refusal.d.ts +10 -0
  20. package/dist/{bootRefusal.js → boot-refusal.js} +1 -2
  21. package/dist/bootListener.js +154 -65
  22. package/dist/bootStoreCodec.js +1 -2
  23. package/dist/businessRules.js +1 -2
  24. package/dist/changeClaimsTable.js +1 -2
  25. package/dist/columnOnUpdate.js +1 -2
  26. package/dist/composeAnalytics.js +1 -2
  27. package/dist/computedQuery.js +1 -2
  28. package/dist/computedQueryCache.js +136 -78
  29. package/dist/connectionBuiltins.js +1 -2
  30. package/dist/connectionCredentials.js +1 -2
  31. package/dist/connectionState.js +1 -2
  32. package/dist/connectionVault.js +1 -2
  33. package/dist/connectionsFacade.js +1 -2
  34. package/dist/coordinatedSchedule.js +1 -2
  35. package/dist/crdtHistory.js +1 -2
  36. package/dist/crdtMerge.js +1 -2
  37. package/dist/crdtVersionsTable.js +1 -2
  38. package/dist/credentialBound.js +1 -2
  39. package/dist/crud.js +1 -2
  40. package/dist/dataStore.js +1 -2
  41. package/dist/dataloader.js +1 -2
  42. package/dist/declaredTablesGuard.js +1 -2
  43. package/dist/defineExecutor.js +1 -2
  44. package/dist/dependencyGraph.js +1 -2
  45. package/dist/devices.js +1 -2
  46. package/dist/devicesWiring.js +1 -2
  47. package/dist/dialectReplicationAdapter.js +1 -2
  48. package/dist/dispatcher.js +1 -2
  49. package/dist/effectStore.js +1 -2
  50. package/dist/engineClients.js +1 -2
  51. package/dist/eventBus.js +1 -2
  52. package/dist/eventPublish.js +1 -2
  53. package/dist/events.js +1 -2
  54. package/dist/expectation.js +1 -2
  55. package/dist/expectationEvaluator.js +2 -3
  56. package/dist/experiment.js +1 -2
  57. package/dist/experimentEvaluator.js +1 -2
  58. package/dist/externalizedTasks.js +1 -2
  59. package/dist/fieldCipher.js +1 -2
  60. package/dist/fieldKeyRegistry.js +1 -2
  61. package/dist/fieldKeyRekey.js +1 -2
  62. package/dist/fieldKeyScan.js +1 -2
  63. package/dist/fieldKeyring.js +1 -2
  64. package/dist/fingerprint.js +1 -2
  65. package/dist/finops.js +1 -2
  66. package/dist/finopsAccountant.js +1 -2
  67. package/dist/handlerBody.js +1 -2
  68. package/dist/healthProbes.js +1 -2
  69. package/dist/hotDataStore.js +1 -2
  70. package/dist/hotDataStoreSnapshot.js +1 -2
  71. package/dist/hotDataStoreTables.js +1 -2
  72. package/dist/http-range.js +1 -2
  73. package/dist/httpClientSsrf.js +1 -2
  74. package/dist/httpClientTracing.js +1 -2
  75. package/dist/httpCompression.js +1 -2
  76. package/dist/httpInputStream.js +1 -2
  77. package/dist/httpKeepAlive.js +1 -2
  78. package/dist/httpRouteMounts.js +1 -2
  79. package/dist/idempotencyStore.js +1 -2
  80. package/dist/idleDetector.js +1 -2
  81. package/dist/index.d.ts +22 -2
  82. package/dist/index.js +109 -110
  83. package/dist/insertRequiredColumns.js +1 -2
  84. package/dist/instanceMembership.js +1 -2
  85. package/dist/ivm.js +1 -2
  86. package/dist/kvDataStore.js +1 -2
  87. package/dist/kvFacade.js +1 -2
  88. package/dist/matcher.js +1 -2
  89. package/dist/memoryColumnDefaults.js +1 -2
  90. package/dist/memoryQueryJoins.js +1 -2
  91. package/dist/memorySetOperations.js +1 -2
  92. package/dist/metrics.js +1 -2
  93. package/dist/observability.js +2 -3
  94. package/dist/observedGraph.js +1 -2
  95. package/dist/originGuard.js +1 -2
  96. package/dist/outbox.js +1 -2
  97. package/dist/pluginRefRules.js +1 -2
  98. package/dist/policyGuardResolver.js +1 -2
  99. package/dist/preview.js +1 -2
  100. package/dist/projectedRows.js +1 -2
  101. package/dist/provenance.js +1 -2
  102. package/dist/rangeIndex.js +1 -2
  103. package/dist/rawReadScope.js +2 -3
  104. package/dist/reaction.js +1 -2
  105. package/dist/reactiveConfig.js +1 -2
  106. package/dist/readClassification.js +1 -2
  107. package/dist/readRecorder.js +1 -2
  108. package/dist/readScopePredicate.js +1 -2
  109. package/dist/rebac.js +1 -2
  110. package/dist/rebacInterceptor.js +1 -2
  111. package/dist/registry.js +1 -2
  112. package/dist/relevantFields.js +1 -2
  113. package/dist/replicaHealth.js +1 -2
  114. package/dist/replicaLocality.js +1 -2
  115. package/dist/replicaObservations.js +1 -2
  116. package/dist/replicaSelection.js +1 -2
  117. package/dist/replicatedDataStore.js +1 -2
  118. package/dist/requestLoader.js +1 -2
  119. package/dist/resumeCensus.js +1 -2
  120. package/dist/revalidation.js +1 -2
  121. package/dist/rowFilter.js +1 -2
  122. package/dist/rowStateBytes.js +1 -2
  123. package/dist/rpcBodyCap.js +1 -2
  124. package/dist/rpcConnections.js +1 -2
  125. package/dist/rpcDefectDiagnostics.js +1 -2
  126. package/dist/rpcServer.js +1 -2
  127. package/dist/rpcWorkloadAdmission.js +1 -2
  128. package/dist/runAsSystem.js +1 -2
  129. package/dist/rywPositionStore.js +1 -2
  130. package/dist/schedule.js +1 -2
  131. package/dist/scheduleBackfillRequests.js +1 -2
  132. package/dist/scheduleClaimsTable.js +1 -2
  133. package/dist/scheduleRunsTable.js +1 -2
  134. package/dist/scheduler.js +4 -4
  135. package/dist/schemaRegistry.js +1 -2
  136. package/dist/secretsResolver.js +1 -2
  137. package/dist/securityHeaders.js +1 -2
  138. package/dist/servePipeline.js +198 -183
  139. package/dist/serverOnlyAudit.js +1 -2
  140. package/dist/serverTracer.js +1 -2
  141. package/dist/serviceCredentials.js +1 -2
  142. package/dist/setReadScopes.js +1 -2
  143. package/dist/singleNodeOrchestrator.js +1 -2
  144. package/dist/snapshotValueCodec.js +1 -2
  145. package/dist/sourceResolution.js +1 -2
  146. package/dist/storeMiddleware.js +3 -4
  147. package/dist/storeQuery.js +1 -2
  148. package/dist/storeRead.js +1 -2
  149. package/dist/subscriber.js +1 -2
  150. package/dist/subscriptionOutbox.js +1 -2
  151. package/dist/subscriptionRegistry.js +1 -2
  152. package/dist/subscriptionResume.js +1 -2
  153. package/dist/subscriptionSocketMetrics.js +1 -2
  154. package/dist/systemSubject.js +1 -2
  155. package/dist/tenantScope.js +1 -2
  156. package/dist/tenantSelection.js +1 -2
  157. package/dist/timeline.js +1 -2
  158. package/dist/traceContext.js +1 -2
  159. package/dist/traceSink.js +1 -2
  160. package/dist/traceSpansTable.js +1 -2
  161. package/dist/traceparent.js +1 -2
  162. package/dist/transactionSubject.js +1 -2
  163. package/dist/trustedProxy.js +2 -3
  164. package/dist/undo.js +1 -2
  165. package/dist/undoBuiltins.js +1 -2
  166. package/dist/undoCapture.js +1 -2
  167. package/dist/undoLogTable.js +1 -2
  168. package/dist/upsertBinding.js +1 -2
  169. package/dist/wakeOrchestrator.js +1 -2
  170. package/dist/wakeRegistry.js +1 -2
  171. package/dist/wakeRouter.js +1 -2
  172. package/dist/wakeSupervisor.js +1 -2
  173. package/dist/wakeupsTable.js +1 -2
  174. package/dist/webSocketGatewayRuntime.js +1 -2
  175. package/dist/webhookVerification.js +1 -2
  176. package/dist/wireColumnStrip.js +1 -2
  177. package/dist/workflowReadBuiltins.js +1 -2
  178. package/dist/workflowRuntime.js +1 -2
  179. package/package.json +26 -19
@@ -1,4 +1,4 @@
1
- //#region src/engineClients.ts
1
+ // src/engineClients.ts
2
2
  var e = /* @__PURE__ */ new Map(), t = 0, n = (e) => {
3
3
  let t = /^([a-z]{1,16})\/([0-9A-Za-z.+-]{1,100})(?:; surface=([0-9a-f]{64}))?$/.exec(e.trim());
4
4
  return t ? {
@@ -20,5 +20,4 @@ var e = /* @__PURE__ */ new Map(), t = 0, n = (e) => {
20
20
  e.delete(s);
21
21
  });
22
22
  }, i = () => [...e.values()];
23
- //#endregion
24
23
  export { i as engineClientsSnapshot, n as parseEngineSdkHeader, r as trackEngineClient };
package/dist/eventBus.js CHANGED
@@ -1,7 +1,7 @@
1
1
  import { recordEventDropped as e, recordEventPublished as t, recordEventSubscribers as n } from "./metrics.js";
2
2
  import { eventRoute as r, parseEventRoute as i } from "@voltro/protocol";
3
3
  import { createLogger as a } from "@voltro/logger";
4
- //#region src/eventBus.ts
4
+ // src/eventBus.ts
5
5
  var o = a({ scope: "voltro:events" }), s = 64, c = 3e5, l = 1e4, u = class {
6
6
  routes = /* @__PURE__ */ new Map();
7
7
  origin;
@@ -256,5 +256,4 @@ var o = a({ scope: "voltro:events" }), s = 64, c = 3e5, l = 1e4, u = class {
256
256
  this.routes.clear();
257
257
  }
258
258
  };
259
- //#endregion
260
259
  export { u as EventBus };
@@ -1,6 +1,6 @@
1
1
  import { Context as e, Effect as t, Schema as n } from "effect";
2
2
  import { EventKeyInvalid as r, EventPayloadInvalid as i, EventPayloadTooLarge as a, MAX_EVENT_ENVELOPE_BYTES as o } from "@voltro/protocol";
3
- //#region src/eventPublish.ts
3
+ // src/eventPublish.ts
4
4
  var s = (e) => e instanceof Error ? e.message : String(e), c = (e, c, l, u) => t.gen(function* () {
5
5
  let d = n.encodeEffect(c.key), f = n.encodeEffect(c.payload), p = yield* d(l).pipe(t.mapError((e) => new r({
6
6
  event: c.name,
@@ -45,5 +45,4 @@ var s = (e) => e instanceof Error ? e.message : String(e), c = (e, c, l, u) => t
45
45
  let n;
46
46
  return Object.assign(e, { then: (r, i) => (n ??= t.runPromise(e), n.then(r, i)) });
47
47
  }, d = (e) => ({ publish: (t, n, r) => u(c(e, t, n, r)) });
48
- //#endregion
49
48
  export { l as OutboxEventPublisher, d as makeEventPublisher, c as publishEvent };
package/dist/events.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { boolean as e, eq as t, id as n, json as r, table as i, text as a, timestamp as o } from "@voltro/database";
2
- //#region src/events.ts
2
+ // src/events.ts
3
3
  var s = (e) => {
4
4
  if ("on" in e) {
5
5
  let { on: t, ...n } = e;
@@ -189,5 +189,4 @@ var s = (e) => {
189
189
  };
190
190
  } };
191
191
  };
192
- //#endregion
193
192
  export { m as _voltroWorkflowEventDeliveriesTable, p as _voltroWorkflowEventsTable, c as defineEventTrigger, l as isWorkflowEventTriggerDefinition, h as makeEventsFacade, s as triggerWorkflow };
@@ -1,5 +1,5 @@
1
1
  import { Context as e, Effect as t } from "effect";
2
- //#region src/expectation.ts
2
+ // src/expectation.ts
3
3
  var n = /* @__PURE__ */ new Set([
4
4
  "info",
5
5
  "warn",
@@ -48,5 +48,4 @@ var n = /* @__PURE__ */ new Set([
48
48
  }, a = (e) => typeof e == "object" && !!e && e._voltroExpectation === !0, o = class extends e.Service()("@voltro/ExpectationRegistry") {}, s = (e) => t.gen(function* () {
49
49
  return (yield* o).get(e.name);
50
50
  });
51
- //#endregion
52
51
  export { o as ExpectationRegistry, i as defineExpectation, a as isExpectationDefinition, s as useExpectation };
@@ -1,6 +1,6 @@
1
1
  import { AggregateMaintainer as e } from "./aggregateIvm.js";
2
2
  import { collectProjectedRows as t } from "./projectedRows.js";
3
- //#region src/expectationEvaluator.ts
3
+ // src/expectationEvaluator.ts
4
4
  var n = (e) => {
5
5
  if (e instanceof Date) return e.getTime();
6
6
  if (typeof e == "number" && Number.isFinite(e)) return e;
@@ -287,7 +287,7 @@ var n = (e) => {
287
287
  let t = e ? [] : Array(i.size), n = 0;
288
288
  return i.forEach((r) => {
289
289
  let i = r.state();
290
- (!e || i.status === "violated") && (t[n++] = i);
290
+ e && i.status !== "violated" || (t[n++] = i);
291
291
  }), t;
292
292
  };
293
293
  return {
@@ -304,5 +304,4 @@ var n = (e) => {
304
304
  runTick: d
305
305
  };
306
306
  };
307
- //#endregion
308
307
  export { u as ExpectationEvaluator, d as attachExpectations };
@@ -1,5 +1,5 @@
1
1
  import { Context as e, Effect as t } from "effect";
2
- //#region src/experiment.ts
2
+ // src/experiment.ts
3
3
  var n = "holdout", r = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.stringify(e)}): ${t}`), i = (e) => {
4
4
  if (e == null) return null;
5
5
  if (typeof e == "number") return Number.isFinite(e) ? String(e) : null;
@@ -92,5 +92,4 @@ var n = "holdout", r = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.
92
92
  }, l = (e) => e.holdout > 0 ? [...e.variants.map((e) => e.name), n] : e.variants.map((e) => e.name), u = class extends e.Service()("@voltro/ExperimentRegistry") {}, d = (e) => t.gen(function* () {
93
93
  return (yield* u).get(e.name);
94
94
  });
95
- //#endregion
96
95
  export { u as ExperimentRegistry, n as HOLDOUT_VARIANT, c as assignVariant, a as defineExperiment, s as hashUnitInterval, o as isExperimentDefinition, l as resultVariantNames, d as useExperiment };
@@ -1,7 +1,7 @@
1
1
  import { AggregateMaintainer as e } from "./aggregateIvm.js";
2
2
  import { collectProjectedRows as t } from "./projectedRows.js";
3
3
  import { assignVariant as n, resultVariantNames as r } from "./experiment.js";
4
- //#region src/experimentEvaluator.ts
4
+ // src/experimentEvaluator.ts
5
5
  var i = "__voltro_variant", a = "__voltro_metric", o = class {
6
6
  project;
7
7
  maintainer;
@@ -241,5 +241,4 @@ var i = "__voltro_variant", a = "__voltro_metric", o = class {
241
241
  registered: [...i.keys()]
242
242
  };
243
243
  };
244
- //#endregion
245
244
  export { f as ExperimentEvaluator, p as attachExperiments };
@@ -1,4 +1,4 @@
1
- //#region src/externalizedTasks.ts
1
+ // src/externalizedTasks.ts
2
2
  var e = 6e4, t = (e) => {
3
3
  if (!Number.isFinite(e) || e < 6e4 || e % 6e4 != 0) return;
4
4
  let t = e / 6e4;
@@ -34,5 +34,4 @@ var e = 6e4, t = (e) => {
34
34
  get: (t) => e.get(t),
35
35
  names: () => [...e.keys()].sort()
36
36
  }), o = () => a(/* @__PURE__ */ new Map()), s = (e) => a(i()).register(e), c = (e) => i().get(e), l = () => [...i().keys()].sort();
37
- //#endregion
38
37
  export { e as MIN_EXTERNALIZABLE_INTERVAL_MS, t as cronForInterval, n as externalizationRefusal, c as externalizedTask, l as externalizedTaskNames, o as makeExternalizedTaskRegistry, s as registerExternalizedTask };
@@ -1,7 +1,7 @@
1
1
  import { recordFieldDecrypt as e } from "./metrics.js";
2
2
  import { BOUND_ENCRYPTED_PREFIX as t, ENCRYPTED_PREFIX as n, FIELD_KEY_ID_PATTERN as r, ciphertextKeyId as i, decodeFieldValue as a, encodeFieldValue as o, isEncrypted as s } from "@voltro/database";
3
3
  import { createCipheriv as c, createDecipheriv as l, createHmac as u, randomBytes as d, scryptSync as f } from "node:crypto";
4
- //#region src/fieldCipher.ts
4
+ // src/fieldCipher.ts
5
5
  var p = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : f(e, "voltro:field-encryption:v1", 32), m = (e, t) => {
6
6
  let n = e === "r" ? t?.row : e === "c" ? t?.column : void 0;
7
7
  if (n === void 0) throw Error(e === "r" || e === "c" ? `field cipher: ciphertext is bound to its ${e === "r" ? "row" : "column"} and was read without that binding` : "field cipher: malformed ciphertext");
@@ -126,5 +126,4 @@ var p = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : f(e, "voltro:
126
126
  if (!n) throw Error(`decryptField: ${w}`);
127
127
  return a(n, e, void 0, t);
128
128
  };
129
- //#endregion
130
129
  export { _ as FieldKeyringConfigError, E as decryptField, p as deriveKey, T as encryptField, g as fieldKeyIdOf, C as getFieldCipher, v as isFieldKeyring, h as makeAesCipher, b as makeFieldCipher, y as makeFieldKeyring, S as setFieldCipher };
@@ -1,7 +1,7 @@
1
1
  import { derivedRowId as e, encryptedColumnsOf as t, eq as n, fieldBinding as r, fieldBindingsOf as i, id as a, isEncrypted as o, isNotNull as s, json as c, lt as l, table as u, text as d, timestamp as f } from "@voltro/database";
2
2
  import { randomUUID as p } from "node:crypto";
3
3
  import { hostname as m } from "node:os";
4
- //#region src/fieldKeyRegistry.ts
4
+ // src/fieldKeyRegistry.ts
5
5
  var h = u("_voltro_field_keys", {
6
6
  id: a({ prefix: "fkey" }),
7
7
  keyId: d().maxLength(16).unique(),
@@ -291,5 +291,4 @@ var h = u("_voltro_field_keys", {
291
291
  lacking: l
292
292
  };
293
293
  });
294
- //#endregion
295
294
  export { v as FIELD_KEYS_TABLE, w as FIELD_KEY_HEARTBEAT_MS, S as FIELD_KEY_HOLDERS_TABLE, C as FIELD_KEY_LEASE_MS, y as FIELD_KEY_REPORTS_TABLE, A as FieldKeyringRefusal, g as _voltroFieldKeyHoldersTable, _ as _voltroFieldKeyReportsTable, h as _voltroFieldKeysTable, Z as activateFieldKeyNow, I as checkFieldKeyring, E as fieldKeyHolderId, L as heartbeatFieldKeys, W as readFieldKeyHolders, x as readFieldKeyReports, P as readFieldKeys, b as recordFieldKeyReport, J as registerFieldKey, R as releaseFieldKeyHolder, X as retireFieldKey, z as startFieldKeyHolder, F as verifyFieldKeyring };
@@ -3,7 +3,7 @@ import { Effect as o } from "effect";
3
3
  import { ciphertextKeyId as s, fieldBinding as c, quoteIdent as l } from "@voltro/database";
4
4
  import { SqlClient as u } from "effect/sql";
5
5
  import { STEP_JOURNAL_BINDING as d, WORKFLOW_JOURNAL_BINDING as f } from "@voltro/workflow";
6
- //#region src/fieldKeyRekey.ts
6
+ // src/fieldKeyRekey.ts
7
7
  var p = (e) => {
8
8
  let t = e.renames?.get(e.table), n = t?.columns.get(e.column);
9
9
  return {
@@ -282,5 +282,4 @@ var p = (e) => {
282
282
  unreadableColumns: m
283
283
  };
284
284
  });
285
- //#endregion
286
285
  export { D as nullUnreadableSealedValues, b as openCell, y as rekeyCell, C as rekeySealedValues, T as verifySealedValues };
@@ -3,7 +3,7 @@ import { Effect as n } from "effect";
3
3
  import { ciphertextKeyId as r, encryptedColumnsOf as i, quoteIdent as a } from "@voltro/database";
4
4
  import { SqlClient as o } from "effect/sql";
5
5
  import { introspectSchema as s } from "@voltro/database/sql";
6
- //#region src/fieldKeyScan.ts
6
+ // src/fieldKeyScan.ts
7
7
  var c = /enc:v[12]:[A-Za-z0-9+/=:_-]+/g, l = 500, u = /* @__PURE__ */ new Set(["text", "json"]), d = (e, t, n) => e === "postgres" ? `CAST(${t} AS TEXT)` : n === "json" && (e === "mysql" || e === "mariadb") ? `CAST(${t} AS CHAR)` : t, f = (e) => {
8
8
  let t = e instanceof Error ? e.message : String(e);
9
9
  for (let n = e?.cause; n instanceof Error; n = n.cause) t = n.message;
@@ -132,5 +132,4 @@ var c = /enc:v[12]:[A-Za-z0-9+/=:_-]+/g, l = 500, u = /* @__PURE__ */ new Set(["
132
132
  plaintext: S.reduce((e, t) => e + t.plaintext, 0)
133
133
  };
134
134
  });
135
- //#endregion
136
135
  export { c as ENVELOPE_PATTERN, m as cellText, g as declaredEncryptedColumns, _ as declaredRenames, h as discoverSealedColumns, y as fieldKeyStatus, f as reasonOf };
@@ -1,5 +1,5 @@
1
1
  import { FieldKeyringConfigError as e, deriveKey as t, fieldKeyIdOf as n } from "./fieldCipher.js";
2
- //#region src/fieldKeyring.ts
2
+ // src/fieldKeyring.ts
3
3
  var r = "VOLTRO_FIELD_ENCRYPTION_KEYS", i = "VOLTRO_FIELD_ENCRYPTION_ACTIVE", a = "VOLTRO_FIELD_ENCRYPTION_KEY", o = "VOLTRO_FIELD_ENCRYPTION_KEY_PREVIOUS", s = [
4
4
  r,
5
5
  i,
@@ -73,5 +73,4 @@ var r = "VOLTRO_FIELD_ENCRYPTION_KEYS", i = "VOLTRO_FIELD_ENCRYPTION_ACTIVE", a
73
73
  for (let n = 0; n < t.keys.length; n++) for (let r = n + 1; r < t.keys.length; r++) if (u(t.keys[n].secret, t.keys[r].secret)) throw new e(`field encryption: keys "${t.keys[n].id}" and "${t.keys[r].id}" are the same key — a rotation needs a NEW key, and two ids for one key make every count per key wrong`);
74
74
  if (!n.has(t.active)) throw new e(`field encryption: the active key "${t.active}" is not one of the configured keys (${[...n].join(", ")})`);
75
75
  };
76
- //#endregion
77
76
  export { i as FIELD_ENCRYPTION_ACTIVE_ENV, r as FIELD_ENCRYPTION_KEYS_ENV, a as FIELD_ENCRYPTION_KEY_ENV, o as FIELD_ENCRYPTION_PREVIOUS_KEY_ENV, s as FIELD_KEYRING_ENV_NAMES, d as resolveFieldKeyring };
@@ -1,5 +1,5 @@
1
1
  import { createHash as e } from "node:crypto";
2
- //#region src/fingerprint.ts
2
+ // src/fingerprint.ts
3
3
  var t = (e) => {
4
4
  if (e == null) return null;
5
5
  if (Array.isArray(e)) return e.map(t);
@@ -17,5 +17,4 @@ var t = (e) => {
17
17
  });
18
18
  return e("sha256").update(JSON.stringify(a)).digest("hex").slice(0, 16);
19
19
  };
20
- //#endregion
21
20
  export { t as canonicalize, n as fingerprintFor };
package/dist/finops.js CHANGED
@@ -1,5 +1,5 @@
1
1
  import { Context as e, Effect as t } from "effect";
2
- //#region src/finops.ts
2
+ // src/finops.ts
3
3
  var n = /* @__PURE__ */ new Set([
4
4
  "info",
5
5
  "warn",
@@ -38,5 +38,4 @@ var n = /* @__PURE__ */ new Set([
38
38
  }, s = (e) => typeof e == "object" && !!e && e._voltroCostBudget === !0, c = class extends e.Service()("@voltro/CostRegistry") {}, l = (e, n) => t.gen(function* () {
39
39
  return (yield* c).budget(e.name, n);
40
40
  });
41
- //#endregion
42
41
  export { c as CostRegistry, o as defineCostBudget, s as isCostBudgetDefinition, l as useCostBudget };
@@ -1,4 +1,4 @@
1
- //#region src/finopsAccountant.ts
1
+ // src/finopsAccountant.ts
2
2
  var e = class {
3
3
  total = 0;
4
4
  byUnit = /* @__PURE__ */ new Map();
@@ -212,5 +212,4 @@ var e = class {
212
212
  runTick: u
213
213
  };
214
214
  };
215
- //#endregion
216
215
  export { a as CostAccountant, o as attachFinops };
@@ -1,8 +1,7 @@
1
1
  import { Effect as e } from "effect";
2
- //#region src/handlerBody.ts
2
+ // src/handlerBody.ts
3
3
  function t(t, n) {
4
4
  if (e.isEffect(t)) return n ? n(t) : e.runPromise(t);
5
5
  if (t instanceof Promise) return t;
6
6
  }
7
- //#endregion
8
7
  export { t as settleHandlerBody };
@@ -1,4 +1,4 @@
1
- //#region src/healthProbes.ts
1
+ // src/healthProbes.ts
2
2
  var e = "/internal", t = (t, n) => ({
3
3
  path: (t?.path ?? e).replace(/\/+$/, "") || e,
4
4
  liveness: t?.liveness ?? (() => !0),
@@ -51,5 +51,4 @@ var e = "/internal", t = (t, n) => ({
51
51
  };
52
52
  }
53
53
  };
54
- //#endregion
55
54
  export { r as answerProbe, n as probeFor, t as resolveHealth };
@@ -4,7 +4,7 @@ import { Effect as i, Stream as a } from "effect";
4
4
  import { and as o, eq as s, generateId as c, gt as l, isNull as u, isSqliteFamily as d, or as f, queryFor as p, startsWith as m } from "@voltro/database";
5
5
  import { createHash as h } from "node:crypto";
6
6
  import { HotError as g, applyHotOperations as _, compareHotMembers as v, hotStoreFromRunner as y, validateHotOp as b } from "@voltro/kv/hot/contract";
7
- //#region src/hotDataStore.ts
7
+ // src/hotDataStore.ts
8
8
  var x = n.tableName, S = r.tableName, C = "lock", w = (e) => h("sha256").update(e).digest("hex"), T = (h, T) => {
9
9
  let { namespace: E } = T;
10
10
  if (!E || !E.isWellFormed() || /[{}]/.test(E)) throw new g({
@@ -144,5 +144,4 @@ var x = n.tableName, S = r.tableName, C = "lock", w = (e) => h("sha256").update(
144
144
  persistent: !0
145
145
  });
146
146
  };
147
- //#endregion
148
147
  export { T as dataStoreHotStore };
@@ -1,5 +1,5 @@
1
1
  import { Schema as e } from "effect";
2
- //#region src/hotDataStoreSnapshot.ts
2
+ // src/hotDataStoreSnapshot.ts
3
3
  var t = e.Number.pipe(e.check(e.makeFilter(Number.isFinite))), n = e.Union([
4
4
  e.Struct({
5
5
  kind: e.Literal("fixed"),
@@ -94,5 +94,4 @@ var t = e.Number.pipe(e.check(e.makeFilter(Number.isFinite))), n = e.Union([
94
94
  };
95
95
  }
96
96
  };
97
- //#endregion
98
97
  export { o as decodeHotSnapshot, a as encodeHotSnapshot };
@@ -1,5 +1,5 @@
1
1
  import { id as e, real as t, table as n, text as r } from "@voltro/database";
2
- //#region src/hotDataStoreTables.ts
2
+ // src/hotDataStoreTables.ts
3
3
  var i = n("_voltro_hot_kv", {
4
4
  id: e({ prefix: "hot" }),
5
5
  keyHash: r().maxLength(64),
@@ -14,5 +14,4 @@ var i = n("_voltro_hot_kv", {
14
14
  member: r(),
15
15
  score: t()
16
16
  }).unique("hotMemberHash", ["keyHash", "memberHash"]).index(["keyHash", "score"]).nonReactive(), o = [i, a];
17
- //#endregion
18
17
  export { o as hotDataStoreTables, i as hotKvTable, a as hotZTable };
@@ -1,4 +1,4 @@
1
- //#region src/httpRange.ts
1
+ // src/httpRange.ts
2
2
  var e = { _tag: "ignored" }, t = { _tag: "unsatisfiable" }, n = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+)=(.*)$/s, r = /^(\d*)-(\d*)$/, i = (e) => {
3
3
  let t = e.replace(/^0+(?=\d)/, "");
4
4
  if (t.length > 16) return;
@@ -48,5 +48,4 @@ var e = { _tag: "ignored" }, t = { _tag: "unsatisfiable" }, n = /^([!#$%&'*+.^_`
48
48
  let a = Math.floor(t.lastModifiedMs / 1e3);
49
49
  return a * 1e3 === i && Math.floor(n / 1e3) > a;
50
50
  };
51
- //#endregion
52
51
  export { u as ifRangeAllowsRange, o as parseByteRange, l as parseHttpDate };
@@ -1,7 +1,7 @@
1
1
  import { Effect as e, Layer as t } from "effect";
2
2
  import { ssrfReason as n, ssrfReason as r } from "@voltro/protocol";
3
3
  import { HttpClient as i, HttpClientError as a } from "effect/http";
4
- //#region src/httpClientSsrf.ts
4
+ // src/httpClientSsrf.ts
5
5
  var o = class extends Error {
6
6
  url;
7
7
  reason;
@@ -20,5 +20,4 @@ var o = class extends Error {
20
20
  }));
21
21
  return i.followRedirects(s, r.maxRedirects ?? 5);
22
22
  }));
23
- //#endregion
24
23
  export { o as SsrfBlockedError, s as ssrfGuardHttpClientLayer, r as ssrfReason };
@@ -2,7 +2,7 @@ import { noteCacheVolatile as e } from "./computedQueryCache.js";
2
2
  import { formatTraceparent as t } from "./traceparent.js";
3
3
  import { Effect as n, Layer as r } from "effect";
4
4
  import { HttpClient as i, HttpClientRequest as a } from "effect/http";
5
- //#region src/httpClientTracing.ts
5
+ // src/httpClientTracing.ts
6
6
  var o = r.effect(i.HttpClient, n.map(i.HttpClient, (r) => r.pipe(i.mapRequestEffect((r) => n.sync(() => {
7
7
  e("HttpClient");
8
8
  }).pipe(n.andThen(n.currentSpan), n.map((e) => r.headers.traceparent === void 0 ? a.setHeader(r, "traceparent", t({
@@ -10,5 +10,4 @@ var o = r.effect(i.HttpClient, n.map(i.HttpClient, (r) => r.pipe(i.mapRequestEff
10
10
  spanId: e.spanId,
11
11
  sampled: e.sampled
12
12
  })) : r), n.catch(() => n.succeed(r)))))));
13
- //#endregion
14
13
  export { o as tracingHttpClientLayer };
@@ -1,5 +1,5 @@
1
1
  import { brotliCompressSync as e, constants as t, gzipSync as n } from "node:zlib";
2
- //#region src/httpCompression.ts
2
+ // src/httpCompression.ts
3
3
  var r = 1024, i = [
4
4
  "text/",
5
5
  "application/json",
@@ -72,5 +72,4 @@ var r = 1024, i = [
72
72
  for (let [e, r] of Object.entries(t)) e.toLowerCase() === "vary" ? i(r) : n[e] = r;
73
73
  return r.length > 0 && (n.vary = r.join(", ")), n;
74
74
  };
75
- //#endregion
76
75
  export { r as DEFAULT_COMPRESSION_MIN_BYTES, a as isCompressibleContentType, l as maybeCompress, u as mergeCompressionHeaders, o as negotiateEncoding, c as negotiatedCompression };
@@ -1,4 +1,4 @@
1
- //#region src/httpInputStream.ts
1
+ // src/httpInputStream.ts
2
2
  var e = async (e, t, n, r, i) => {
3
3
  let a = new AbortController(), o, s = !1, c = e.readableEnded, l = e.destroyed && !c, u = !1, d = 0, f = !1, p = !1, m = () => {
4
4
  o?.();
@@ -78,5 +78,4 @@ var e = async (e, t, n, r, i) => {
78
78
  s = !0, b !== void 0 && a.signal.removeEventListener("abort", b), a.abort(), m(), e.off("end", g), e.off("error", h), e.off("aborted", h), e.off("close", _), i.removeEventListener("abort", h), !e.destroyed && !e.readableEnded && e.resume();
79
79
  }
80
80
  };
81
- //#endregion
82
81
  export { e as dispatchHttpInputStream };
@@ -1,4 +1,4 @@
1
- //#region src/httpKeepAlive.ts
1
+ // src/httpKeepAlive.ts
2
2
  var e = 72e3, t = 5e3, n = (e) => typeof e == "number" && Number.isFinite(e) && e > 0 ? Math.floor(e) : void 0, r = (e) => {
3
3
  let r = n(e?.http?.keepAliveTimeoutMs) ?? 72e3, i = n(e?.http?.headersTimeoutMs);
4
4
  return {
@@ -8,5 +8,4 @@ var e = 72e3, t = 5e3, n = (e) => typeof e == "number" && Number.isFinite(e) &&
8
8
  }, i = (e, t) => {
9
9
  e.keepAliveTimeout = t.keepAliveTimeoutMs, e.headersTimeout = t.headersTimeoutMs;
10
10
  };
11
- //#endregion
12
11
  export { e as DEFAULT_KEEP_ALIVE_MS, t as HEADERS_TIMEOUT_MARGIN_MS, i as applyKeepAlive, r as resolveKeepAlive };
@@ -1,6 +1,6 @@
1
1
  import { FindMyWay as e } from "effect/http";
2
2
  import { routeAcceptsPath as t } from "@voltro/protocol/rest";
3
- //#region src/httpRouteMounts.ts
3
+ // src/httpRouteMounts.ts
4
4
  var n = (e) => e.split("/").map((e) => e.startsWith(":") ? ":param" : e).join("/"), r = (e) => {
5
5
  if (e.some((e) => e.method === "*")) return ["*"];
6
6
  let t = /* @__PURE__ */ new Set();
@@ -44,5 +44,4 @@ var n = (e) => e.split("/").map((e) => e.startsWith(":") ? ":param" : e).join("/
44
44
  return n !== void 0 && n.routes.some((n) => t(n, e)) ? n : void 0;
45
45
  };
46
46
  }, o = (e) => a(e.filter((e) => !e.methods.includes("*") && (e.routes.length > 1 || e.routes[0]?.answersOtherMethods === !0)));
47
- //#endregion
48
47
  export { a as makeHttpRouteGroupFinder, o as makeUnmatchedGroupFinder, i as planHttpRouteMounts };
@@ -1,6 +1,6 @@
1
1
  import { and as e, eq as t, generateId as n, lte as r } from "@voltro/database";
2
2
  import { freshFor as i } from "@voltro/protocol";
3
- //#region src/idempotencyStore.ts
3
+ // src/idempotencyStore.ts
4
4
  var a = "_voltro_idempotency", o = () => /* @__PURE__ */ Error("Stored idempotency receipt is invalid"), s = (e) => {
5
5
  if (e === null) return null;
6
6
  try {
@@ -106,5 +106,4 @@ var a = "_voltro_idempotency", o = () => /* @__PURE__ */ Error("Stored idempoten
106
106
  renew: async (e, t) => await o.updateMany(a, { createdAt: new Date(t) }, { where: d(e) }) === 1,
107
107
  release: async (e) => await o.deleteMany(a, { where: d(e) }) === 1
108
108
  });
109
- //#endregion
110
109
  export { f as dataStoreIdempotencyStore };
@@ -1,5 +1,5 @@
1
1
  import { nextWakeup as e } from "./wakeRegistry.js";
2
- //#region src/idleDetector.ts
2
+ // src/idleDetector.ts
3
3
  var t = async (t) => {
4
4
  if (t.signals.connectedClients() > 0 || t.signals.inFlightRequests() > 0 || t.signals.activeWorkflowExecutions() > 0) return !1;
5
5
  let n = (t.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (t.wakeLookaheadMs ?? 3e4), r = await e(t.store);
@@ -17,5 +17,4 @@ var t = async (t) => {
17
17
  }
18
18
  };
19
19
  };
20
- //#endregion
21
20
  export { t as isIdleNow, n as makeIdleGate };
package/dist/index.d.ts CHANGED
@@ -1687,6 +1687,13 @@ export declare interface BindBootListenerOptions {
1687
1687
  readonly host?: string;
1688
1688
  /** The app's `health` block — the prefix and the app's own answers. */
1689
1689
  readonly health?: HealthConfigInput;
1690
+ /** How long a request that arrives while booting waits for the app before
1691
+ * it is answered 503. Absent → `VOLTRO_BOOT_HOLD_MS` (default 30 s); `0`
1692
+ * answers 503 at once. */
1693
+ readonly holdMs?: number;
1694
+ /** How many requests may wait at once; the next one is answered 503.
1695
+ * Absent → `MAX_HELD`. */
1696
+ readonly maxHeld?: number;
1690
1697
  /** Deterministic "now" for `elapsedMs`; tests inject. */
1691
1698
  readonly now?: () => number;
1692
1699
  readonly log?: {
@@ -1879,6 +1886,14 @@ export declare const bindSubscriptionUntyped: (descriptor: QueryDescriptor, disp
1879
1886
 
1880
1887
  export declare const BOOT_REFUSAL_NAME = "VoltroBootRefusal";
1881
1888
 
1889
+ /**
1890
+ * The hold window, from `VOLTRO_BOOT_HOLD_MS` (milliseconds), clamped to
1891
+ * `[0, 5 min]`. `0` turns the hold off — every request that arrives while
1892
+ * booting is answered 503 at once. A non-numeric or negative value falls back
1893
+ * to the default rather than silently disabling the hold.
1894
+ */
1895
+ export declare const bootHoldMsFromEnv: () => number;
1896
+
1882
1897
  export declare interface BootListener {
1883
1898
  /** The bound server — the ONE socket this process serves on. */
1884
1899
  readonly server: Server;
@@ -1889,8 +1904,11 @@ export declare interface BootListener {
1889
1904
  readonly set: (patch: Partial<Omit<BootState, 'startedAt'>>) => void;
1890
1905
  /** Boot complete — the phase alone, never the dependency ping. */
1891
1906
  readonly isReady: () => boolean;
1907
+ /** Requests waiting for the app right now (also `held` on the startup probe). */
1908
+ readonly held: number;
1892
1909
  /** Hand over the real handlers. Consulted only once the phase is `ready`
1893
- * (or `draining`); until then every non-probe request answers 503. */
1910
+ * (or `draining`); until then every non-probe request is held, and the
1911
+ * held ones reach these handlers in arrival order once both are true. */
1894
1912
  readonly delegate: (to: BootListenerDelegate) => void;
1895
1913
  /** The dependency probe readiness consults once ready — a DB `SELECT 1`.
1896
1914
  * Installed by the boot path when its store exists, which is after the
@@ -2412,7 +2430,7 @@ export declare interface CompressionOptions {
2412
2430
  }
2413
2431
 
2414
2432
  /** Why a call is not looked up at all. */
2415
- declare type ComputedCacheBypass = 'input-not-encodable' | 'no-tenant' | 'anonymous-subject';
2433
+ declare type ComputedCacheBypass = 'input-not-encodable' | 'no-tenant' | 'anonymous-subject' | 'subject-not-encodable';
2416
2434
 
2417
2435
  /**
2418
2436
  * The entry one call belongs to — or why it has none.
@@ -12602,6 +12620,8 @@ export declare interface StartupSnapshot {
12602
12620
  readonly elapsedMs: number;
12603
12621
  readonly tablesTotal?: number;
12604
12622
  readonly error?: string;
12623
+ /** Requests waiting for the boot to finish — present only while some do. */
12624
+ readonly held?: number;
12605
12625
  }
12606
12626
 
12607
12627
  /**