@voltro/runtime 0.87.0 → 0.89.0

package/dist/servePipeline.js

@@ -1,28 +1,28 @@
-import { cachedComputedCall as e, computedCacheKey as t, currentQueryDependencies as n, enterQueryDependencies as r } from "./computedQueryCache.js";
-import { enterReadRecording as i } from "./readRecorder.js";
-import { getRowFilter as a, makeDefaultRefilter as o, resolveRowFilterScope as s } from "./rowFilter.js";
-import { isComputedQuery as c } from "./computedQuery.js";
-import { TX_READ_VERSIONS_KEY as l, isTransactionReadConflict as u } from "./storeMiddleware.js";
-import { evaluateTouchedRules as d, makeRuleCapture as f } from "./businessRules.js";
-import { enforceApproval as p } from "./approvals.js";
-import { observeApiRoleEffect as m } from "./apiRoleWorkloadMetrics.js";
-import { Cause as h, Effect as g, Exit as _, Option as v } from "effect";
-import { isTransientContention as y } from "@voltro/database";
-import { SubjectService as b, checkGuardsEffect as x, currentSubjectAuthority as S, recheckGuardsEffect as C } from "@voltro/protocol";
-import { createLogger as w } from "@voltro/logger";
-//#region src/servePipeline.ts
-var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
-	if (_.isSuccess(e)) return e.value;
-	let t = h.findErrorOption(e.cause);
-	throw v.isSome(t) ? t.value : h.squash(e.cause);
-}), E = (e) => T(e), D = (e, t) => e.pipe(g.provideService(b, t)), O = async (e, t, n, r) => {
-	let i = await g.runPromise(x(t, e.guards, n, {
+import { cachedComputedCall as e, computedAuthorityRefusal as t, computedCacheKey as n, computedSubjectIdentity as r, currentQueryDependencies as i, enterQueryDependencies as a } from "./computedQueryCache.js";
+import { enterReadRecording as o } from "./readRecorder.js";
+import { getRowFilter as s, makeDefaultRefilter as c, resolveRowFilterScope as l } from "./rowFilter.js";
+import { isComputedQuery as u } from "./computedQuery.js";
+import { TX_READ_VERSIONS_KEY as d, isTransactionReadConflict as f } from "./storeMiddleware.js";
+import { evaluateTouchedRules as p, makeRuleCapture as m } from "./businessRules.js";
+import { enforceApproval as h } from "./approvals.js";
+import { observeApiRoleEffect as g } from "./apiRoleWorkloadMetrics.js";
+import { Cause as _, Effect as v, Exit as y, Option as b } from "effect";
+import { isTransientContention as x } from "@voltro/database";
+import { SubjectService as S, checkGuardsEffect as C, currentSubjectAuthority as w, recheckGuardsEffect as T } from "@voltro/protocol";
+import { createLogger as E } from "@voltro/logger";
+// src/servePipeline.ts
+var D = (e, t) => v.runPromiseExit(e, t).then((e) => {
+	if (y.isSuccess(e)) return e.value;
+	let t = _.findErrorOption(e.cause);
+	throw b.isSome(t) ? t.value : _.squash(e.cause);
+}), O = (e) => D(e), k = (e, t) => e.pipe(v.provideService(S, t)), A = async (e, t, n, r) => {
+	let i = await v.runPromise(C(t, e.guards, n, {
 		defaultDeny: r === !0,
 		procedure: e.name
 	}));
 	if (i) throw i;
-}, k = async (e, t, n, r) => {
-	e.requiresApproval !== void 0 && await p({
+}, j = async (e, t, n, r) => {
+	e.requiresApproval !== void 0 && await h({
 		procedure: e.name,
 		kind: t,
 		policy: e.requiresApproval,
@@ -30,20 +30,20 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 		input: r,
 		traceId: n.traceId
 	});
-}, A = w({ scope: "voltro:rpc" }), j = async (e) => {
-	if (a() === void 0) return e;
-	let t = await E(s(e.subject, (e) => {
-		A.error("row filter failed to load", {}, e instanceof Error ? e : Error(String(e)));
+}, M = E({ scope: "voltro:rpc" }), N = async (e) => {
+	if (s() === void 0) return e;
+	let t = await O(l(e.subject, (e) => {
+		M.error("row filter failed to load", {}, e instanceof Error ? e : Error(String(e)));
 	}));
 	return {
 		...e,
 		rowFilter: t
 	};
-}, M = (e) => ({
+}, P = (e) => ({
 	...e.surface === void 0 ? {} : { surface: e.surface },
 	...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
 	...e.remoteAddr === void 0 ? {} : { remoteAddr: e.remoteAddr }
-}), N = (e) => {
+}), F = (e) => {
 	let t = e.descriptor.target;
 	if (t == null) return [];
 	let n = Array.isArray(t) ? t : [t], r = /* @__PURE__ */ new Set();
@@ -52,7 +52,7 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 		typeof t == "string" && t.length > 0 && r.add(t);
 	}
 	return [...r];
-}, P = async (e) => {
+}, I = async (e) => {
 	let { store: t, target: n, procedure: r, input: i, output: a } = e;
 	if (n == null) return;
 	let o = Array.isArray(n) ? n : [n];
@@ -69,15 +69,15 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 			await u.set(c.map((e) => String(e)));
 		}
 	}
-}, F = (e, t) => e === void 0 ? {} : { enqueueOutcome: async (n, r, i) => {
+}, L = (e, t) => e === void 0 ? {} : { enqueueOutcome: async (n, r, i) => {
 	let a = e(t);
 	if (a === void 0) throw TypeError("Invocation outcome outbox is unavailable");
 	return a.enqueue(n, r, i);
-} }, I = async (e) => {
+} }, R = async (e) => {
 	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
 	try {
 		if (e.interceptor) {
-			let t = g.tryPromise({
+			let t = v.tryPromise({
 				try: () => e.runExecutor(),
 				catch: (e) => e
 			}), n = e.interceptor(t, {
@@ -89,10 +89,10 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 				...e.enqueueOutcome === void 0 ? {} : { enqueueOutcome: e.enqueueOutcome },
 				...e.requestContext.spanId === void 0 ? {} : { spanId: e.requestContext.spanId },
 				...e.target !== void 0 && e.target.length > 0 ? { target: e.target } : {},
-				...M(e.requestContext)
-			}), r = await g.runPromiseExit(n, e.requestContext.signal === void 0 ? void 0 : { signal: e.requestContext.signal });
-			if (_.isSuccess(r)) return r.value;
-			throw h.squash(r.cause);
+				...P(e.requestContext)
+			}), r = await v.runPromiseExit(n, e.requestContext.signal === void 0 ? void 0 : { signal: e.requestContext.signal });
+			if (y.isSuccess(r)) return r.value;
+			throw _.squash(r.cause);
 		}
 		return await e.runExecutor();
 	} catch (e) {
@@ -105,99 +105,99 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 			status: r
 		});
 	}
-}, L = (e) => y(e) || u(e), R = 3, z = (e) => new Promise((t) => setTimeout(t, e)), B = async (e, t) => {
-	let n = t?.delay ?? ((e) => z(e * 20 + Math.floor(Math.random() * 30))), r = t?.attempts ?? 3;
+}, z = (e) => x(e) || f(e), B = 3, V = (e) => new Promise((t) => setTimeout(t, e)), H = async (e, t) => {
+	let n = t?.delay ?? ((e) => V(e * 20 + Math.floor(Math.random() * 30))), r = t?.attempts ?? 3;
 	for (let t = 1;; t++) try {
 		return await e();
 	} catch (e) {
-		if (t >= r || !L(e)) throw u(e) ? e.conflict : e;
+		if (t >= r || !z(e)) throw f(e) ? e.conflict : e;
 		await n(t);
 	}
-}, V = (e) => (t, n, r) => I({
+}, U = (e) => (t, n, r) => R({
 	name: t.descriptor.name,
 	kind: "mutation",
 	input: n,
 	requestContext: r,
-	...F(e.outcomeOutbox, r),
-	target: N(t),
+	...L(e.outcomeOutbox, r),
+	target: F(t),
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
 		let i = Date.now();
-		await q(t, "mutation", { defaultDeny: e.defaultDeny === !0 })(n, r);
+		await Y(t, "mutation", { defaultDeny: e.defaultDeny === !0 })(n, r);
 		let a = {
 			...r,
-			subject: S(r.subject)
+			subject: w(r.subject)
 		};
-		await k(t.descriptor, "mutation", a, n);
-		let o = await j(a), s = e.resolveStore === void 0 ? e.store : await e.resolveStore(o), c = [], u = [], p = await B(async () => s.transactional(async (a) => {
-			c.length = 0, u.length = 0, a[Symbol.for("@voltro/runtime:tx-fold-releases")] = u, a[l] = /* @__PURE__ */ new Map();
-			let p = t.descriptor.undo?.capture === !1 ? void 0 : e.undoCapture?.(a), m = p ? p.tx : a, h = f(m), _ = e.buildContext(o, h.tx, {
+		await j(t.descriptor, "mutation", a, n);
+		let o = await N(a), s = e.resolveStore === void 0 ? e.store : await e.resolveStore(o), c = [], l = [], u = await H(async () => s.transactional(async (a) => {
+			c.length = 0, l.length = 0, a[Symbol.for("@voltro/runtime:tx-fold-releases")] = l, a[d] = /* @__PURE__ */ new Map();
+			let u = t.descriptor.undo?.capture === !1 ? void 0 : e.undoCapture?.(a), f = u ? u.tx : a, h = m(f), g = e.buildContext(o, h.tx, {
 				committedStore: s,
 				afterCommit: (e) => {
 					c.push(e);
 				}
-			}), v = e.measureSync ? e.measureSync(() => t.executor(n, _)) : t.executor(n, _), y = g.isEffect(v) ? await e.runEffect(D(v, o.subject), _.store) : await v;
-			if (await P({
-				store: _.store,
+			}), _ = e.measureSync ? e.measureSync(() => t.executor(n, g)) : t.executor(n, g), y = v.isEffect(_) ? await e.runEffect(k(_, o.subject), g.store) : await _;
+			if (await I({
+				store: g.store,
 				target: t.descriptor.target,
 				procedure: t.descriptor.name,
 				input: n,
 				output: y
-			}), p && await p.persist(_.store, {
+			}), u && await u.persist(g.store, {
 				tag: t.descriptor.name,
 				subject: o.subject,
 				traceId: r.traceId
-			}), await d({
+			}), await p({
 				touched: h.drain(),
-				store: _.store,
+				store: g.store,
 				subject: o.subject
 			}), e.beforeMutationCommit !== void 0) {
-				let r = N(t), a = e.beforeMutationCommit({
+				let r = F(t), a = e.beforeMutationCommit({
 					tag: t.descriptor.name,
 					kind: "mutation",
 					input: n,
 					output: y,
 					subject: o.subject,
 					traceId: o.traceId,
-					store: _.store,
-					..._.outbox === void 0 ? {} : { outbox: _.outbox },
+					store: g.store,
+					...g.outbox === void 0 ? {} : { outbox: g.outbox },
 					startedAt: i,
 					durationMs: Math.max(0, Date.now() - i),
 					...o.spanId === void 0 ? {} : { spanId: o.spanId },
 					...r.length > 0 ? { target: r } : {},
-					...M(o)
+					...P(o)
 				});
-				await e.runEffect(D(a, o.subject), _.store);
+				await e.runEffect(k(a, o.subject), g.store);
 			}
 			return y;
 		}), { ...e.replayAttempts === void 0 ? {} : { attempts: e.replayAttempts } });
-		if (u.length > 0) {
+		if (l.length > 0) {
 			let t = e.buildContext(o, s, {
 				committedStore: s,
 				afterCommit: () => {}
 			}).store;
-			for (let e of u.splice(0)) await t.update(e.table, e.pk, e.patch);
+			for (let e of l.splice(0)) await t.update(e.table, e.pk, e.patch);
 		}
 		for (let e of c) await e();
-		return e.settleCacheInvalidations !== void 0 && await e.settleCacheInvalidations(), p;
+		return e.settleCacheInvalidations !== void 0 && await e.settleCacheInvalidations(), u;
 	}
-}), H = (e) => (t, n, r, i) => I({
+}), W = (e) => (t, n, r, i) => R({
 	name: t.name,
 	kind: "workflow",
 	input: n,
 	requestContext: r,
-	...F(e.outcomeOutbox, r),
+	...L(e.outcomeOutbox, r),
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
-	runExecutor: async () => (await O(t, r.subject, n, e.defaultDeny), i())
-}), U = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, W = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, G = (e) => {
+	runExecutor: async () => (await A(t, r.subject, n, e.defaultDeny), i())
+}), G = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, K = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, q = (e) => {
 	let t = e.descriptor.source;
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
-}, K = (e, t, n) => (r) => () => g.runPromise(C(r, e.descriptor.guards, t, {
+}, J = (e, t, n) => (r) => () => v.runPromise(T(r, e.descriptor.guards, t, {
 	defaultDeny: n === !0,
 	procedure: e.descriptor.name
-})), q = (e, t, n = {}) => async (r, i) => {
+})), Y = (e, t, n = {}) => async (r, i) => {
 	let a = i.subject;
 	n.bindReplayAuthority?.({
 		tag: e.descriptor.name,
@@ -209,133 +209,149 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 		...i.publicApi === void 0 ? {} : { publicApi: i.publicApi },
 		...i.remoteAddr === void 0 ? {} : { remoteAddr: i.remoteAddr }
 	});
-	let o = await K(e, r, n.defaultDeny)(a)();
+	let o = await J(e, r, n.defaultDeny)(a)();
 	if (o) throw o;
-}, J = (e, t) => e.rowFilter !== void 0 || a() === void 0 ? t(e) : g.promise(() => j(e)).pipe(g.flatMap((e) => {
+}, X = (e, t) => e.rowFilter !== void 0 || s() === void 0 ? t(e) : v.promise(() => N(e)).pipe(v.flatMap((e) => {
 	let n = t(e);
-	return g.isEffect(n) ? n : g.succeed(n);
-})), Y = (e, t) => X(e, t, /* @__PURE__ */ new Set()), X = (o, s, l) => (u, d) => (f) => {
-	if (f.rowFilter === void 0 && a() !== void 0) return J(f, (e) => X(o, s, l)(u, d)(e));
-	let p = s ?? (f.connection?.transport === "http" ? "rpc" : "subscriptions"), h = (e) => o.workloadMetrics ? o.workloadMetrics.measureSync(p, e) : e(), _ = (e, t) => {
-		let n = o.provideEffect(e, t);
-		return o.workloadMetrics ? m(n, o.workloadMetrics, p) : n;
-	}, v = o.buildContext(f), y = K(u, d, o.defaultDeny)(f.subject), b = async () => {
-		let e = await y();
+	return v.isEffect(n) ? n : v.succeed(n);
+})), Z = (e, t) => Q(e, t, /* @__PURE__ */ new Set()), Q = (c, l, d) => (f, p) => (m) => {
+	if (m.rowFilter === void 0 && s() !== void 0) return X(m, (e) => Q(c, l, d)(f, p)(e));
+	let h = l ?? (m.connection?.transport === "http" ? "rpc" : "subscriptions"), _ = (e) => c.workloadMetrics ? c.workloadMetrics.measureSync(h, e) : e(), y = (e, t) => {
+		let n = c.provideEffect(e, t);
+		return c.workloadMetrics ? g(n, c.workloadMetrics, h) : n;
+	}, b = c.buildContext(m), x = J(f, p, c.defaultDeny)(m.subject), S = async () => {
+		let e = await x();
 		if (e) throw e;
 		let t = {
-			...f,
-			subject: S(f.subject)
-		}, n = o.buildContext(await j(t)), r = h(() => u.executor(d, n)), i = g.isEffect(r) ? await T(_(D(r, t.subject), n.store), f.signal === void 0 ? void 0 : { signal: f.signal }) : U(await Promise.resolve(r)), a = await y();
+			...m,
+			subject: w(m.subject)
+		}, n = c.buildContext(await N(t)), r = _(() => f.executor(p, n)), i = v.isEffect(r) ? await D(y(k(r, t.subject), n.store), m.signal === void 0 ? void 0 : { signal: m.signal }) : G(await Promise.resolve(r)), a = await x();
 		if (a) throw a;
 		return i;
-	}, C = (e, t = n()) => {
-		let r = U(e);
-		if (W(r)) {
-			let e = o.finalize(r, f), t = G(u);
+	}, T = (e, t = i()) => {
+		let n = G(e);
+		if (K(n)) {
+			let e = c.finalize(n, m), t = q(f);
 			if (t.length === 0) return e;
-			let n = e.dependentTables ?? [];
+			let r = e.dependentTables ?? [];
 			return {
 				...e,
-				dependentTables: [.../* @__PURE__ */ new Set([...n, ...t])]
+				dependentTables: [.../* @__PURE__ */ new Set([...r, ...t])]
 			};
 		}
 		return {
 			__voltroComputed: !0,
-			value: r,
-			dependentTables: [.../* @__PURE__ */ new Set([...G(u), ...t])],
-			tenantId: f.subject?.tenantId ?? null,
-			recompute: b
+			value: n,
+			dependentTables: [.../* @__PURE__ */ new Set([...q(f), ...t])],
+			tenantId: m.subject?.tenantId ?? null,
+			recompute: S
 		};
-	}, w = (e, t) => {
-		let n = C(e, t);
-		return c(n) ? g.tryPromise({
-			try: y,
-			catch: (e) => e
-		}).pipe(g.flatMap((e) => e ? g.fail(e) : g.succeed(n))) : n;
 	}, E = (e, t) => {
-		let n = w(e, t);
-		return g.isEffect(n) ? n : g.succeed(n);
-	}, O = () => {
-		let n = o.computedCache, r = u.descriptor.cache;
-		if (n === void 0 || r === void 0 || l.has(u.descriptor.name)) return;
-		let i = n.policyFor(r);
-		if (i === void 0) return;
-		let a = f.subject, s = G(u), c = t({
-			name: u.descriptor.name,
-			codeIdentity: n.codeIdentity,
-			output: u.descriptor.output,
-			input: u.descriptor.input,
-			decodedInput: d,
-			scope: i.scope,
-			subject: a,
-			rowFilter: f.rowFilter,
-			declaredSources: s
-		});
-		if ("bypass" in c) c.bypass === "input-not-encodable" && n.notice(u.descriptor.name, c.bypass, `${u.descriptor.name}: \`cache:\` NOT applied — the input does not encode through its \`input\` schema, so it has no key.`);
-		else return e({
-			cache: n,
-			policy: i,
-			key: c.key,
-			name: u.descriptor.name,
-			sources: s,
-			output: u.descriptor.output,
-			subject: f.subject,
-			rowFilter: f.rowFilter,
-			ctx: v,
-			...f.signal === void 0 ? {} : { signal: f.signal },
-			execute: (e, t) => {
-				let n = h(() => u.executor(d, e));
-				return g.isEffect(n) ? T(_(D(n, t), v.store), f.signal === void 0 ? void 0 : { signal: f.signal }) : Promise.resolve(n);
-			},
-			onDescriptor: () => {
-				l.add(u.descriptor.name);
+		let n = T(e, t);
+		return u(n) ? v.tryPromise({
+			try: x,
+			catch: (e) => e
+		}).pipe(v.flatMap((e) => e ? v.fail(e) : v.succeed(n))) : n;
+	}, O = (e, t) => {
+		let n = E(e, t);
+		return v.isEffect(n) ? n : v.succeed(n);
+	}, A = () => {
+		let i = c.computedCache, a = f.descriptor.cache;
+		if (i === void 0 || a === void 0 || d.has(f.descriptor.name)) return;
+		let o = i.policyFor(a);
+		if (o !== void 0) return v.tryPromise({
+			try: async () => {
+				let e = await x();
+				if (e) throw e;
+				return N({
+					...m,
+					subject: w(m.subject)
+				});
 			},
-			isDescriptor: (e) => W(U(e)),
-			unwrap: (e) => U(e)
-		}).pipe(g.flatMap(({ value: e, dependencies: t }) => E(e, t)));
-	}, k = () => {
-		i(u.descriptor.name, G(u)), r();
-		let e = O();
+			catch: (e) => e
+		}).pipe(v.flatMap((a) => {
+			let s = a.subject, l = c.buildContext(a), u = r(s), h = q(f), g = n({
+				name: f.descriptor.name,
+				codeIdentity: i.codeIdentity,
+				output: f.descriptor.output,
+				input: f.descriptor.input,
+				decodedInput: p,
+				scope: o.scope,
+				subject: s,
+				rowFilter: a.rowFilter,
+				declaredSources: h
+			});
+			return "bypass" in g ? (g.bypass === "input-not-encodable" && i.notice(f.descriptor.name, g.bypass, `${f.descriptor.name}: \`cache:\` NOT applied — the input does not encode through its \`input\` schema, so it has no key.`), g.bypass === "subject-not-encodable" && i.notice(f.descriptor.name, g.bypass, `${f.descriptor.name}: \`cache:\` NOT applied — the subject contains claims that cannot be keyed as data. Keep subject claims as plain data, or drop \`cache:\`.`), v.tryPromise({
+				try: S,
+				catch: (e) => e
+			}).pipe(v.flatMap((e) => O(e)))) : e({
+				cache: i,
+				policy: o,
+				key: g.key,
+				name: f.descriptor.name,
+				sources: h,
+				output: f.descriptor.output,
+				subject: s,
+				rowFilter: a.rowFilter,
+				ctx: l,
+				...m.signal === void 0 ? {} : { signal: m.signal },
+				execute: (e, t) => {
+					let n = _(() => f.executor(p, e));
+					return v.isEffect(n) ? D(y(k(n, t), l.store), m.signal === void 0 ? void 0 : { signal: m.signal }) : Promise.resolve(n);
+				},
+				onDescriptor: () => {
+					d.add(f.descriptor.name);
+				},
+				isDescriptor: (e) => K(G(e)),
+				unwrap: (e) => G(e)
+			}).pipe(v.flatMap(({ value: e, dependencies: t }) => O(e, t)), v.flatMap((e) => {
+				let n = r(w(m.subject));
+				return u === n ? v.succeed(e) : v.fail(t());
+			}));
+		}));
+	}, j = () => {
+		o(f.descriptor.name, q(f)), a();
+		let e = A();
 		if (e !== void 0) return e;
-		let t = h(() => u.executor(d, v));
-		return g.isEffect(t) ? _(D(t, f.subject), v.store).pipe(g.flatMap(E)) : t instanceof Promise ? g.promise(() => t).pipe(g.flatMap(E)) : w(t);
-	}, A = () => {
-		let e = u.descriptor.guards;
-		return (!e || e.length === 0) && o.defaultDeny !== !0 && f.subject.type !== "service" ? k() : x(f.subject, e, d, {
-			defaultDeny: o.defaultDeny === !0,
-			procedure: u.descriptor.name
-		}).pipe(g.flatMap((e) => {
-			if (e) return g.fail(e);
-			let t = k();
-			return g.isEffect(t) ? t : g.succeed(t);
+		let t = _(() => f.executor(p, b));
+		return v.isEffect(t) ? y(k(t, m.subject), b.store).pipe(v.flatMap(O)) : t instanceof Promise ? v.promise(() => t).pipe(v.flatMap(O)) : E(t);
+	}, M = () => {
+		let e = f.descriptor.guards;
+		return (!e || e.length === 0) && c.defaultDeny !== !0 && m.subject.type !== "service" ? j() : C(m.subject, e, p, {
+			defaultDeny: c.defaultDeny === !0,
+			procedure: f.descriptor.name
+		}).pipe(v.flatMap((e) => {
+			if (e) return v.fail(e);
+			let t = j();
+			return v.isEffect(t) ? t : v.succeed(t);
 		}));
 	};
-	if (!o.interceptor) return A();
-	let N = g.suspend(() => {
-		let e = A();
-		return g.isEffect(e) ? e : g.succeed(e);
+	if (!c.interceptor) return M();
+	let F = v.suspend(() => {
+		let e = M();
+		return v.isEffect(e) ? e : v.succeed(e);
 	});
-	return o.interceptor(N, {
-		tag: u.descriptor.name,
+	return c.interceptor(F, {
+		tag: f.descriptor.name,
 		kind: "query",
-		input: d,
-		subject: f.subject,
-		traceId: f.traceId,
-		...f.spanId === void 0 ? {} : { spanId: f.spanId },
-		...M(f)
+		input: p,
+		subject: m.subject,
+		traceId: m.traceId,
+		...m.spanId === void 0 ? {} : { spanId: m.spanId },
+		...P(m)
 	});
-}, Z = (e) => async (t, n, r) => {
-	let i = await j(r), a = Y(e, "rpc")(t, n)(i), o = g.isEffect(a) ? await E(a) : a;
-	if (c(o)) return o.value;
-	let s = e.buildContext(i), l = await e.queryRows(o, i, s.store), u = await K(t, n, e.defaultDeny)(i.subject)();
-	if (u) throw u;
-	return l;
-}, Q = (e) => (t, n, r, i) => {
-	let a = !1, s;
+}, $ = (e) => async (t, n, r) => {
+	let i = await N(r), a = Z(e, "rpc")(t, n)(i), o = v.isEffect(a) ? await O(a) : a;
+	if (u(o)) return o.value;
+	let s = e.buildContext(i), c = await e.queryRows(o, i, s.store), l = await J(t, n, e.defaultDeny)(i.subject)();
+	if (l) throw l;
+	return c;
+}, ee = (e) => (t, n, r, i) => {
+	let a = !1, o;
 	return (async () => {
 		try {
-			let l = await j(r), u = Y(e, "subscriptions")(t, n)(l), d = g.isEffect(u) ? await E(u) : u, f = (e) => i(e), p = c(d) ? await e.subscribeComputed(d, f, l) : await e.subscribeDescriptor(d, f, l, K(t, n, e.defaultDeny)(l.subject), o(l.subject));
-			a ? p() : s = p;
+			let s = await N(r), l = Z(e, "subscriptions")(t, n)(s), d = v.isEffect(l) ? await O(l) : l, f = (e) => i(e), p = u(d) ? await e.subscribeComputed(d, f, s) : await e.subscribeDescriptor(d, f, s, J(t, n, e.defaultDeny)(s.subject), c(s.subject));
+			a ? p() : o = p;
 		} catch (e) {
 			i({
 				_tag: "error",
@@ -346,29 +362,28 @@ var T = (e, t) => g.runPromiseExit(e, t).then((e) => {
 			});
 		}
 	})(), () => {
-		a = !0, s?.();
+		a = !0, o?.();
 	};
-}, $ = (e) => (t, n, r) => I({
+}, te = (e) => (t, n, r) => R({
 	name: t.descriptor.name,
 	kind: "action",
 	input: n,
 	requestContext: r,
-	...F(e.outcomeOutbox, r),
-	target: N(t),
+	...L(e.outcomeOutbox, r),
+	target: F(t),
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await q(t, "action", { defaultDeny: e.defaultDeny === !0 })(n, r);
-		let a = {
+		await Y(t, "action", { defaultDeny: e.defaultDeny === !0 })(n, r);
+		let i = {
 			...r,
-			subject: S(r.subject)
+			subject: w(r.subject)
 		};
-		await k(t.descriptor, "action", a, n);
-		let o = e.buildContext(await j(a));
-		i(t.descriptor.name, G(t));
-		let s = e.measureSync ? e.measureSync(() => t.executor(n, o)) : t.executor(n, o), c = g.isEffect(s) ? await e.runEffect(D(s, a.subject), o.store) : await s;
+		await j(t.descriptor, "action", i, n);
+		let a = e.buildContext(await N(i));
+		o(t.descriptor.name, q(t));
+		let s = e.measureSync ? e.measureSync(() => t.executor(n, a)) : t.executor(n, a), c = v.isEffect(s) ? await e.runEffect(k(s, i.subject), a.store) : await s;
 		return e.settleCacheInvalidations !== void 0 && await e.settleCacheInvalidations(), c;
 	}
 });
-//#endregion
-export { R as DEFAULT_MUTATION_REPLAY_ATTEMPTS, P as applyDeclaredRelations, $ as makeActionRunner, q as makeMutationReplayAdmission, V as makeMutationRunner, Z as makeOneShotQueryRunner, Y as makeQueryDescriptorProducer, K as makeQueryReauthorizer, Q as makeQuerySubscriber, H as makeWorkflowStartRunner, E as runProvidedEffect, B as runWithDeadlockRetry, j as withRowFilter, J as withScopedRequest };
+export { B as DEFAULT_MUTATION_REPLAY_ATTEMPTS, I as applyDeclaredRelations, te as makeActionRunner, Y as makeMutationReplayAdmission, U as makeMutationRunner, $ as makeOneShotQueryRunner, Z as makeQueryDescriptorProducer, J as makeQueryReauthorizer, ee as makeQuerySubscriber, W as makeWorkflowStartRunner, O as runProvidedEffect, H as runWithDeadlockRetry, N as withRowFilter, X as withScopedRequest };

package/dist/serverOnlyAudit.js

@@ -1,5 +1,5 @@
 import { SchemaAST as e } from "effect";
-//#region src/serverOnlyAudit.ts
+// src/serverOnlyAudit.ts
 var t = (t) => {
 	let n = /* @__PURE__ */ new Set(), r = /* @__PURE__ */ new Set(), i = (t) => {
 		if (!r.has(t)) switch (r.add(t), t.encoding !== void 0 && i(e.toEncoded(t)), t._tag) {
@@ -62,5 +62,4 @@ var t = (t) => {
 })) : [], o = (e) => {
 	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
 };
-//#endregion
 export { a as cacheScopeLeaks, o as formatCacheScopeLeaks, i as formatServerOnlyLeaks, t as schemaPropertyNames, r as serverOnlyLeaks };

package/dist/serverTracer.js

@@ -1,5 +1,5 @@
 import { Effect as e, Layer as t } from "effect";
-//#region src/serverTracer.ts
+// src/serverTracer.ts
 var n = Symbol.for("@voltro/runtime:serverTracer"), r = (() => {
 	let e = globalThis;
 	return e[n] ??= {};
@@ -11,5 +11,4 @@ var n = Symbol.for("@voltro/runtime:serverTracer"), r = (() => {
 	let n = r.tracer;
 	return n === void 0 ? t : e.withTracer(t, n);
 };
-//#endregion
 export { o as publishServerTracerLayer, a as serverTracer, i as setServerTracer, s as withServerTracer };

package/dist/serviceCredentials.js

@@ -1,6 +1,6 @@
 import { createHash as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
 import { SERVICE_NAME_PATTERN as r, serviceSubject as i } from "@voltro/protocol";
-//#region src/serviceCredentials.ts
+// src/serviceCredentials.ts
 var a = "vsvc_", o = /^vsvc_[A-Za-z0-9_-]{43}$/, s = () => `${a}${t(32).toString("base64url")}`, c = (e) => o.test(e), l = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/-/g, "_").toUpperCase(), u = (e) => `VOLTRO_SERVICE_CALLER_${l(e)}_TOKEN`, d = (e) => `${u(e)}_NEXT`, f = (e) => `VOLTRO_API_${l(e)}_TOKEN`, p = (e) => `VOLTRO_API_${l(e)}_URL`, m = (e) => {
 	for (let t of Object.keys(e)) if (!r.test(t)) throw Error(`serviceCallers: ${JSON.stringify(t)} is not an app name — letters, digits and dashes, starting with a letter, at most 56 characters. It is the name the calling app binds this api under and the name its procedures list in \`service: { callers }\`.`);
 }, h = (t) => e("sha256").update(t).digest(), g = (e, t) => n(e, h(t)), _ = (e, t) => [e[u(t)], e[d(t)]].filter((e) => typeof e == "string" && e !== ""), v = (e) => {
@@ -36,5 +36,4 @@ var a = "vsvc_", o = /^vsvc_[A-Za-z0-9_-]{43}$/, s = () => `${a}${t(32).toString
 		}
 	};
 };
-//#endregion
 export { a as SERVICE_TOKEN_PREFIX, f as apiBindingTokenEnv, p as apiBindingUrlEnv, m as assertServiceCallersConfig, c as isWellFormedServiceToken, s as mintServiceToken, d as serviceCallerNextTokenEnv, v as serviceCallerStrategy, u as serviceCallerTokenEnv, l as serviceEnvSegment };

package/dist/setReadScopes.js

@@ -1,4 +1,4 @@
-//#region src/setReadScopes.ts
+// src/setReadScopes.ts
 var e = [
 	"crossTenant",
 	"includeDeleted",
@@ -24,5 +24,4 @@ var e = [
 	};
 	return r(t);
 };
-//#endregion
 export { t as mapSetReadScopes };

package/dist/singleNodeOrchestrator.js

@@ -3,7 +3,7 @@ import { wakeDueOnce as t } from "./wakeOrchestrator.js";
 import { makeProcessAdapter as n } from "./wakeSupervisor.js";
 import { isIdleNow as r, makeIdleGate as i } from "./idleDetector.js";
 import { makeRouterActivity as a, makeWakeProxyServer as o } from "./wakeRouter.js";
-//#region src/singleNodeOrchestrator.ts
+// src/singleNodeOrchestrator.ts
 var s = async (e) => {
 	try {
 		return (await e.query({
@@ -87,5 +87,4 @@ var s = async (e) => {
 		}
 	};
 };
-//#endregion
 export { s as countRunningWorkflows, c as runOrchestratorTick, l as runSingleNodeOrchestrator };

package/dist/snapshotValueCodec.js

@@ -1,4 +1,4 @@
-//#region src/snapshotValueCodec.ts
+// src/snapshotValueCodec.ts
 var e = "\0", t = `${e}d`, n = `${e}n`, r = `${e}b`, i = `${e}o`, a = 1, o = (e) => {
 	if (typeof e != "object" || !e) return !1;
 	let t = Object.getPrototypeOf(e);
@@ -42,5 +42,4 @@ var e = "\0", t = `${e}d`, n = `${e}n`, r = `${e}b`, i = `${e}o`, a = 1, o = (e)
 		return;
 	}
 };
-//#endregion
 export { u as decodeSnapshotValue, l as encodeSnapshotValue };

package/dist/sourceResolution.js

@@ -1,5 +1,5 @@
 import { captureOptionalQuerySources as e, declaredReactivityChannelKeys as t, isReactivityChannelKey as n, sourceKeys as r } from "@voltro/protocol";
-//#region src/sourceResolution.ts
+// src/sourceResolution.ts
 var i = (e, t) => {
 	let n, r = 0;
 	for (let i of t) {
@@ -48,5 +48,4 @@ symptom is silence, and silence is what this surface exists to eliminate.
 A \`source:\` is a STRING, so \`tsc\` cannot see a stale one and a rename leaves it
 behind quietly.` + r;
 };
-//#endregion
 export { o as formatUnresolvedSources, a as unresolvedSources };