@voltro/protocol 0.11.3 → 0.12.0

package/dist/index.js

@@ -1,9 +1,9 @@
-import { C as e, S as t, _ as n, a as r, b as i, c as a, d as o, f as ee, g as te, h as ne, i as re, l as s, m as ie, n as ae, o as oe, p as se, r as ce, s as le, t as ue, u as de, v as fe, w as pe, x as me, y as he } from "./serverErrorBus-B3hDwGoL.js";
-import { a as ge, c as _e, d as ve, f as ye, i as be, l as xe, n as Se, o as Ce, r as we, s as Te, t as Ee, u as De } from "./auth-DCE6m7Bo.js";
-import { Context as Oe, Layer as ke, Schema as c } from "effect";
+import { C as e, D as t, E as n, S as r, T as i, _ as a, a as o, b as ee, c as te, d as ne, f as s, g as re, h as ie, i as ae, l as oe, m as se, n as ce, o as le, p as ue, r as de, s as fe, t as pe, u as me, v as he, w as ge, x as _e, y as ve } from "./serverErrorBus-DhIVDkCi.js";
+import { a as ye, c as be, d as xe, f as Se, i as Ce, l as we, n as Te, o as Ee, p as De, r as Oe, s as ke, t as Ae, u as je } from "./auth-S3cnL6Tz.js";
+import { Context as Me, Layer as Ne, Schema as c } from "effect";
 import { Rpc as l } from "@effect/rpc";
 //#region src/rowPatch.ts
-var Ae = c.Union(c.String, c.Number), u = c.Record({
+var Pe = c.Union(c.String, c.Number), u = c.Record({
 	key: c.String,
 	value: c.Unknown
 }).pipe(c.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), d = c.Union(c.Struct({
@@ -19,12 +19,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	path: c.String
 })), f = c.Struct({
 	ops: c.Array(d),
-	order: c.Array(Ae)
-}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, je = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
+	order: c.Array(Pe)
+}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Fe = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, Me = (e, t) => m(e) === m(t), Ne = (e, t) => {
+}, Ie = (e, t) => m(e) === m(t), Le = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	let r = [], i = [], a = /* @__PURE__ */ new Set();
@@ -35,7 +35,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 			op: "add",
 			path: p(e.id),
 			value: e
-		}) : Me(t, e) || r.push({
+		}) : Ie(t, e) || r.push({
 			op: "replace",
 			path: p(e.id),
 			value: e
@@ -49,10 +49,10 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		ops: r,
 		order: i
 	};
-}, Pe = (e) => e.every((e) => {
+}, Re = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Fe = (e, t) => {
+}), ze = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	for (let e of t.ops) (e.op === "add" || e.op === "replace") && n.set(e.value.id, e.value);
@@ -76,7 +76,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	_tag: c.Literal("error"),
 	error: c.Unknown,
 	revision: c.optional(c.Number)
-})), Ie = (e) => e.action !== void 0 && e.resourceType !== void 0, g = (e) => ({
+})), Be = (e) => e.action !== void 0 && e.resourceType !== void 0, g = (e) => ({
 	kind: "query",
 	name: e.name,
 	input: e.input,
@@ -106,7 +106,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	guards: e.guards,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool
-}), Le = (e) => ({
+}), Ve = (e) => ({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -117,27 +117,27 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	success: h(e.output),
 	error: y(b(e.error, e.guards), t),
 	stream: !0
-}), Re = (e, t) => l.make(e.name, {
+}), S = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
 	error: y(b(e.error, e.guards), t)
-}), ze = (e, t) => l.make(e.name, {
+}), C = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
 	error: y(b(e.error, e.guards), t)
-}), S = (e, t) => l.make(e.name, {
+}), w = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.element,
 	error: y(e.error, t),
 	stream: !0
-}), Be = (e) => {
+}), He = (e) => {
 	switch (e.kind) {
 		case "query": return x(e);
-		case "mutation": return Re(e);
-		case "action": return ze(e);
-		case "stream": return S(e);
+		case "mutation": return S(e);
+		case "action": return C(e);
+		case "stream": return w(e);
 	}
-}, Ve = (e) => {
+}, Ue = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -178,17 +178,17 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, He = (e) => e, Ue = (e) => e, We = (e) => {
+}, We = (e) => e, Ge = (e) => e, Ke = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Ge = (e, t) => {
-	let n = Oe.GenericTag(e);
+}, qe = (e, t) => {
+	let n = Me.GenericTag(e);
 	return {
 		Tag: n,
-		Live: ke.succeed(n, t)
+		Live: Ne.succeed(n, t)
 	};
-}, Ke = (e, t, n) => {
+}, Je = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = C(n);
+	let r = T(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -196,12 +196,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!qe(i, r)) return {
+	for (let i of a) if (!Ye(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, C = (e) => {
+}, T = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -209,38 +209,38 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, w = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, qe = (e, t) => {
+}, E = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Ye = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = C(e.slice(1));
-		return !n || t.major !== n.major ? !1 : w(t, n) >= 0;
+		let n = T(e.slice(1));
+		return !n || t.major !== n.major ? !1 : E(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = C(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : w(t, n) >= 0;
+		let n = T(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : E(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = C(n[2]);
+		let e = n[1], r = T(n[2]);
 		if (!r) return !1;
-		let i = w(t, r);
+		let i = E(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = C(e);
-	return r ? w(t, r) === 0 : !1;
-}, T = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), E = c.Literal("cancel", "terminate", "abandon"), Je = c.Struct({
+	let r = T(e);
+	return r ? E(t, r) === 0 : !1;
+}, D = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), O = c.Literal("cancel", "terminate", "abandon"), Xe = c.Struct({
 	id: c.String,
 	workflowName: c.String,
 	executionId: c.String,
 	status: c.Literal("running")
-}), D = c.Struct({
+}), k = c.Struct({
 	id: c.String,
 	tag: c.String,
 	executionId: c.String,
-	status: T,
+	status: D,
 	payload: c.Unknown,
 	workflowVersion: c.NullOr(c.String),
 	workflowPatches: c.NullOr(c.Unknown),
@@ -255,12 +255,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	durationMs: c.NullOr(c.Number),
 	traceId: c.NullOr(c.String),
 	parentExecutionId: c.NullOr(c.String),
-	parentClosePolicy: c.NullOr(E)
-}), O = c.Struct({
+	parentClosePolicy: c.NullOr(O)
+}), A = c.Struct({
 	tag: c.optional(c.String),
-	status: c.optional(T),
+	status: c.optional(D),
 	limit: c.optional(c.Number)
-}), k = c.Struct({
+}), j = c.Struct({
 	id: c.String,
 	runId: c.String,
 	stepName: c.String,
@@ -275,7 +275,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	startedAt: c.Date,
 	completedAt: c.NullOr(c.Date),
 	durationMs: c.NullOr(c.Number)
-}), A = c.Struct({
+}), M = c.Struct({
 	id: c.String,
 	runId: c.String,
 	eventType: c.String,
@@ -283,7 +283,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	occurredAt: c.Date,
 	stepName: c.NullOr(c.String),
 	attempt: c.NullOr(c.Number)
-}), j = c.Struct({
+}), N = c.Struct({
 	id: c.String,
 	name: c.String,
 	payload: c.Unknown,
@@ -291,7 +291,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	subject: c.NullOr(c.Unknown),
 	traceId: c.NullOr(c.String),
 	occurredAt: c.Date
-}), M = c.Struct({
+}), P = c.Struct({
 	id: c.String,
 	eventId: c.String,
 	eventName: c.String,
@@ -304,123 +304,123 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	errorMessage: c.NullOr(c.String),
 	createdAt: c.Date,
 	completedAt: c.NullOr(c.Date)
-}), N = c.Struct({ id: c.String }), P = c.Struct({ runId: c.String }), F = c.Struct({
+}), F = c.Struct({ id: c.String }), I = c.Struct({ runId: c.String }), L = c.Struct({
 	name: c.optional(c.String),
 	limit: c.optional(c.Number)
-}), I = c.Struct({ eventId: c.String }), L = c.Struct({
+}), R = c.Struct({ eventId: c.String }), z = c.Struct({
 	workflowName: c.String,
 	executionId: c.String
-}), R = c.Struct({
+}), Ze = c.Struct({
 	id: c.String,
 	signalName: c.String,
 	payload: c.optional(c.Unknown)
-}), z = c.Struct({
+}), B = c.Struct({
 	id: c.String,
 	updateName: c.String,
 	payload: c.optional(c.Unknown),
 	timeoutMs: c.optional(c.Number)
-}), B = c.Struct({
+}), V = c.Struct({
 	eventId: c.String,
 	updateId: c.String,
 	completedEventId: c.String,
 	result: c.Unknown
-}), Ye = g({
+}), Qe = g({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: N,
-	output: c.Array(D)
-}), Xe = g({
+	input: F,
+	output: c.Array(k)
+}), $e = g({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: O,
-	output: c.Array(D)
-}), Ze = g({
+	input: A,
+	output: c.Array(k)
+}), et = g({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: P,
-	output: c.Array(k)
-}), Qe = g({
+	input: I,
+	output: c.Array(j)
+}), tt = g({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: P,
-	output: c.Array(A)
-}), $e = g({
+	input: I,
+	output: c.Array(M)
+}), nt = g({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: F,
-	output: c.Array(j)
-}), et = g({
+	input: L,
+	output: c.Array(N)
+}), rt = g({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: I,
-	output: c.Array(M)
-}), tt = v({
+	input: R,
+	output: c.Array(P)
+}), it = v({
 	name: "__voltro.workflow.cancel",
-	input: L,
+	input: z,
 	output: c.Struct({ ok: c.Boolean })
-}), nt = v({
+}), at = v({
 	name: "__voltro.workflow.resume",
-	input: L,
+	input: z,
 	output: c.Struct({ ok: c.Boolean })
-}), rt = v({
+}), ot = v({
 	name: "__voltro.workflow.signal",
-	input: R,
+	input: Ze,
 	output: c.Struct({ eventId: c.String })
-}), it = v({
+}), st = v({
 	name: "__voltro.workflow.update",
-	input: z,
-	output: B
-}), at = "__voltro.undo.log", V = "__voltro.undo.apply", H = "__voltro.undo.redo", U = c.Struct({
+	input: B,
+	output: V
+}), H = "__voltro.undo.log", U = "__voltro.undo.apply", W = "__voltro.undo.redo", G = c.Struct({
 	id: c.String,
 	tag: c.String,
 	label: c.NullOr(c.String),
 	undone: c.Boolean,
 	crossesAction: c.Boolean,
 	createdAt: c.String
-}), W = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, G = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, K = class extends c.TaggedError()("UndoConflict", {
+}), K = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, q = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, J = class extends c.TaggedError()("UndoConflict", {
 	invocationId: c.String,
 	reason: c.Literal("conflict", "action")
-}) {}, q = c.Union(W, G, K), ot = g({
-	name: at,
+}) {}, Y = c.Union(K, q, J), ct = g({
+	name: H,
 	source: "_voltro_undo_log",
 	input: c.Struct({ limit: c.optional(c.Number) }),
-	output: c.Array(U)
-}), st = _({
-	name: V,
+	output: c.Array(G)
+}), lt = _({
+	name: U,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: q
-}), ct = _({
-	name: H,
+	error: Y
+}), ut = _({
+	name: W,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: q
-}), J = "__voltro.connections.list", Y = "__voltro.connections.start", X = "__voltro.connections.submitToken", Z = "__voltro.connections.disconnect", Q = c.Literal("oauth2", "pat"), lt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), ut = c.Struct({
+	error: Y
+}), X = "__voltro.connections.list", dt = "__voltro.connections.start", ft = "__voltro.connections.submitToken", pt = "__voltro.connections.disconnect", Z = c.Literal("oauth2", "pat"), mt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), ht = c.Struct({
 	connectionId: c.String,
-	kind: Q,
+	kind: Z,
 	label: c.String,
-	status: lt,
+	status: mt,
 	accountId: c.NullOr(c.String),
 	accountLabel: c.NullOr(c.String),
 	scopes: c.Array(c.String),
 	expiresAt: c.NullOr(c.String),
 	lastError: c.NullOr(c.String),
 	connectedAt: c.NullOr(c.String)
-}), dt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, ft = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, pt = class extends c.TaggedError()("ConnectionKindMismatch", {
+}), gt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, _t = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, vt = class extends c.TaggedError()("ConnectionKindMismatch", {
 	connectionId: c.String,
-	expected: Q,
-	actual: Q
-}) {}, mt = class extends c.TaggedError()("ConnectionHandshakeFailed", {
+	expected: Z,
+	actual: Z
+}) {}, Q = class extends c.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: c.String,
 	reason: c.String,
 	transient: c.Boolean
-}) {}, $ = c.Union(dt, ft, pt, mt), ht = g({
-	name: J,
+}) {}, $ = c.Union(gt, _t, vt, Q), yt = g({
+	name: X,
 	source: "_voltro_connections",
 	input: c.Struct({}),
-	output: c.Array(ut)
-}), gt = v({
-	name: Y,
+	output: c.Array(ht)
+}), bt = v({
+	name: dt,
 	input: c.Struct({
 		connectionId: c.String,
 		redirectTo: c.optional(c.String)
@@ -430,22 +430,22 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		state: c.String
 	}),
 	error: $
-}), _t = _({
-	name: X,
+}), xt = _({
+	name: ft,
 	input: c.Struct({
 		connectionId: c.String,
 		token: c.String
 	}),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), vt = _({
-	name: Z,
+}), St = _({
+	name: pt,
 	input: c.Struct({ connectionId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), yt = (e) => {
+}), Ct = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, bt = 1;
+}, wt = 1;
 //#endregion
-export { a as ADMIN_SCOPE, Ee as AuthMiddleware, J as CONNECTIONS_LIST_TAG, Z as CONNECTION_DISCONNECT_TAG, Y as CONNECTION_START_TAG, X as CONNECTION_SUBMIT_TOKEN_TAG, mt as ConnectionHandshakeFailed, Se as ConnectionInfo, we as ConnectionInfoMiddleware, Q as ConnectionKind, pt as ConnectionKindMismatch, dt as ConnectionNotDeclared, ut as ConnectionState, lt as ConnectionStatus, ft as ConnectionSubjectRequired, bt as PROTOCOL_VERSION, s as ScopeError, be as Subject, ge as SubjectService, V as UNDO_APPLY_TAG, at as UNDO_LOG_TAG, H as UNDO_REDO_TAG, Ce as Unauthenticated, K as UndoConflict, G as UndoForbidden, U as UndoLogEntry, W as UndoNotFound, L as WorkflowControlInputSchema, j as WorkflowDomainEventRowSchema, F as WorkflowDomainEventsInputSchema, I as WorkflowEventDeliveriesInputSchema, M as WorkflowEventDeliveryRowSchema, E as WorkflowParentClosePolicySchema, A as WorkflowRunEventRowSchema, Je as WorkflowRunHandleSchema, N as WorkflowRunRefSchema, D as WorkflowRunRowSchema, T as WorkflowRunStatusSchema, k as WorkflowRunStepRowSchema, P as WorkflowRunTableRefSchema, O as WorkflowRunsInputSchema, R as WorkflowSignalInputSchema, z as WorkflowUpdateInputSchema, B as WorkflowUpdateResultSchema, ze as actionToRpc, de as advisoryResourceGuardWarning, Te as anonymousSubject, Fe as applyRowPatch, _e as assertAuthenticated, ce as beginIdempotent, Ke as checkFrameworkCompat, o as checkGuards, ee as checkGuardsEffect, xe as composeAuthStrategies, We as composeRpcInterceptors, vt as connectionDisconnectDescriptor, gt as connectionStartDescriptor, _t as connectionSubmitTokenDescriptor, ht as connectionsListQueryDescriptor, v as defineAction, _ as defineMutation, He as definePlugin, Ue as definePluginRoute, Ge as definePluginService, g as defineQuery, Le as defineStream, Ne as diffRows, se as effectiveScopes, re as failIdempotent, ie as findAdvisoryResourceGuards, r as finishIdempotent, ne as getPolicyGuardResolver, te as getResourceScopeResolver, De as hasCallbackRoutes, n as hasEffectiveScope, fe as hasScope, p as idToPath, oe as idempotencyScope, Pe as isIdKeyed, he as isPolicyCheck, Ie as isPolicyGuard, ve as isSystemSubject, le as memoryIdempotencyStore, Re as mutationToRpc, Ve as normalizeDescriptor, je as pathToId, ue as publishServerError, x as queryToRpc, i as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, me as setEffectiveScopes, t as setPolicyGuardResolver, e as setResourceScopeResolver, S as streamToRpc, pe as subjectScopes, ae as subscribeServerErrors, h as subscriptionEvent, ye as systemSubject, Be as toRpc, yt as tsMs, st as undoApplyDescriptor, ot as undoLogQueryDescriptor, ct as undoRedoDescriptor, tt as workflowCancelDescriptor, $e as workflowDomainEventsQueryDescriptor, et as workflowEventDeliveriesQueryDescriptor, nt as workflowResumeDescriptor, Qe as workflowRunEventsQueryDescriptor, Ye as workflowRunQueryDescriptor, Ze as workflowRunStepsQueryDescriptor, Xe as workflowRunsQueryDescriptor, rt as workflowSignalDescriptor, it as workflowUpdateDescriptor };
+export { te as ADMIN_SCOPE, oe as APIKEY_ISSUE_ORG_SCOPE, me as APIKEY_ISSUE_OTHER_SCOPE, ne as APIKEY_ISSUE_SELF_SCOPE, Ae as AuthMiddleware, X as CONNECTIONS_LIST_TAG, pt as CONNECTION_DISCONNECT_TAG, dt as CONNECTION_START_TAG, ft as CONNECTION_SUBMIT_TOKEN_TAG, Q as ConnectionHandshakeFailed, Te as ConnectionInfo, Oe as ConnectionInfoMiddleware, Z as ConnectionKind, vt as ConnectionKindMismatch, gt as ConnectionNotDeclared, ht as ConnectionState, mt as ConnectionStatus, _t as ConnectionSubjectRequired, wt as PROTOCOL_VERSION, s as ScopeError, Ce as Subject, ye as SubjectService, U as UNDO_APPLY_TAG, H as UNDO_LOG_TAG, W as UNDO_REDO_TAG, Ee as Unauthenticated, J as UndoConflict, q as UndoForbidden, G as UndoLogEntry, K as UndoNotFound, z as WorkflowControlInputSchema, N as WorkflowDomainEventRowSchema, L as WorkflowDomainEventsInputSchema, R as WorkflowEventDeliveriesInputSchema, P as WorkflowEventDeliveryRowSchema, O as WorkflowParentClosePolicySchema, M as WorkflowRunEventRowSchema, Xe as WorkflowRunHandleSchema, F as WorkflowRunRefSchema, k as WorkflowRunRowSchema, D as WorkflowRunStatusSchema, j as WorkflowRunStepRowSchema, I as WorkflowRunTableRefSchema, A as WorkflowRunsInputSchema, Ze as WorkflowSignalInputSchema, B as WorkflowUpdateInputSchema, V as WorkflowUpdateResultSchema, C as actionToRpc, ue as advisoryResourceGuardWarning, ke as anonymousSubject, ze as applyRowPatch, be as assertAuthenticated, de as beginIdempotent, Je as checkFrameworkCompat, se as checkGuards, ie as checkGuardsEffect, we as composeAuthStrategies, Ke as composeRpcInterceptors, St as connectionDisconnectDescriptor, bt as connectionStartDescriptor, xt as connectionSubmitTokenDescriptor, yt as connectionsListQueryDescriptor, v as defineAction, _ as defineMutation, We as definePlugin, Ge as definePluginRoute, qe as definePluginService, g as defineQuery, Ve as defineStream, Le as diffRows, re as effectiveScopes, ae as failIdempotent, a as findAdvisoryResourceGuards, o as finishIdempotent, he as getPolicyGuardResolver, ve as getResourceScopeResolver, je as hasCallbackRoutes, ee as hasEffectiveScope, _e as hasScope, p as idToPath, le as idempotencyScope, Re as isIdKeyed, r as isPolicyCheck, Be as isPolicyGuard, xe as isSystemSubject, fe as memoryIdempotencyStore, S as mutationToRpc, Ue as normalizeDescriptor, Fe as pathToId, pe as publishServerError, x as queryToRpc, e as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, ge as setEffectiveScopes, i as setPolicyGuardResolver, n as setResourceScopeResolver, w as streamToRpc, t as subjectScopes, ce as subscribeServerErrors, h as subscriptionEvent, Se as systemSubject, De as tenantScopedSubject, He as toRpc, Ct as tsMs, lt as undoApplyDescriptor, ct as undoLogQueryDescriptor, ut as undoRedoDescriptor, it as workflowCancelDescriptor, nt as workflowDomainEventsQueryDescriptor, rt as workflowEventDeliveriesQueryDescriptor, at as workflowResumeDescriptor, tt as workflowRunEventsQueryDescriptor, Qe as workflowRunQueryDescriptor, et as workflowRunStepsQueryDescriptor, $e as workflowRunsQueryDescriptor, ot as workflowSignalDescriptor, st as workflowUpdateDescriptor };

package/dist/rest.d.ts

@@ -160,6 +160,8 @@ declare interface InsertTarget<Input = unknown, Row = unknown, Item = Record<str
     readonly shapeItem?: ((input: Input, optimisticId: string) => Item) | undefined;
 }
 
+export declare const isRestStreamResponse: (v: unknown) => v is RestStreamResponse;
+
 /** Extract `:name` path params by aligning the route PATTERN with the request
  *  path segment-by-segment (`/projects/:project/deploy` + `/projects/acme/deploy`
  *  → `{ project: 'acme' }`). `PluginHttpRouteRequest` carries no matched params,
@@ -254,6 +256,27 @@ declare interface PluginHttpRouteResult {
     readonly body?: string | Uint8Array;
     readonly contentType?: string;
     readonly headers?: Record<string, string>;
+    /** Stream the response (SSE) instead of sending `body`. See
+     *  {@link PluginHttpRouteStream}. */
+    readonly stream?: PluginHttpRouteStream;
+}
+
+/**
+ * A long-lived Server-Sent-Events body. When a route result carries this, the
+ * serve layer streams the response until the client disconnects instead of
+ * sending a buffered body — `body` is ignored.
+ *
+ * `subscribe` receives an `emit` that takes ONE already-SSE-framed chunk (e.g.
+ * `` `event: snapshot\ndata: ${json}\n\n` ``) and MUST return an unsubscribe
+ * function. The serve layer runs that unsubscribe when the client goes away, so
+ * whatever the route opened (a dispatcher subscription, an interval) is released
+ * — a stream route that leaks its subscription leaks it per connection.
+ */
+declare interface PluginHttpRouteStream {
+    readonly subscribe: (emit: (chunk: string) => void) => () => void;
+    /** Keep-alive comment interval in ms (default 15000; `0` disables). Without
+     *  it an idle SSE connection is dropped by proxies after ~30–60s. */
+    readonly keepAliveMs?: number;
 }
 
 /**
@@ -293,6 +316,9 @@ export declare type PublicApiDescriptor = QueryProcedureDescriptor<string, Schem
 export declare interface PublicApiEntry {
     readonly descriptor: PublicApiDescriptor;
     readonly invoke: PublicApiInvoke;
+    /** Live-subscription binding, required for a `stream: 'sse'` query. Absent →
+     *  the route serves the first snapshot as JSON instead of streaming. */
+    readonly subscribe?: PublicApiSubscribe;
 }
 
 /** The bound executor a public route runs — the real rpc handler, invoked
@@ -305,11 +331,12 @@ export declare type PublicApiInvoke = (input: unknown, ctx: RestRouteContext) =>
  * Synthesize the public REST route for ONE descriptor. The descriptor's input
  * schema is wrapped into the REST `{ query }` (GET) / `{ body }` (other) shape
  * the desugar decodes, then handed UNWRAPPED to `invoke`. Output is the
- * descriptor's output schema verbatim (a streaming query is drained to its
- * first snapshot by the serve layer — same as POST /rpc). `scopes` become
+ * descriptor's output schema verbatim (a query is drained to its first snapshot
+ * by the serve layer — same as POST /rpc — unless `stream: 'sse'` streams it).
+ * `scopes` become
  * `requireScope` guards on top of the handler's own RBAC.
  */
-export declare const publicApiRoute: (descriptor: PublicApiDescriptor, invoke: PublicApiInvoke) => RestRouteDescriptor<Record<string, unknown>, unknown>;
+export declare const publicApiRoute: (descriptor: PublicApiDescriptor, invoke: PublicApiInvoke, subscribe?: PublicApiSubscribe) => RestRouteDescriptor<Record<string, unknown>, unknown>;
 
 declare interface PublicApiSpec {
     /** Derived by kind when omitted: query→GET, mutation/action→POST. */
@@ -338,6 +365,18 @@ declare interface PublicApiSpec {
     readonly stream?: 'snapshot' | 'sse';
 }
 
+/**
+ * Open a live subscription for a `stream: 'sse'` query — the streaming
+ * counterpart to {@link PublicApiInvoke}. `emit` takes ONE subscription event
+ * (the initial `snapshot`, then each `delta`); the returned unsubscribe runs
+ * when the HTTP client disconnects. Supplied by the boot layer, which owns the
+ * dispatcher; this module only frames the events as SSE.
+ */
+export declare type PublicApiSubscribe = (input: unknown, ctx: RestRouteContext, emit: (event: {
+    readonly _tag: string;
+    readonly [k: string]: unknown;
+}) => void) => () => void;
+
 /**
  * Server-side snapshot caching for a query (see `defineQuery`). When set,
  * the dispatcher caches the initial snapshot result and auto-invalidates it
@@ -386,6 +425,18 @@ declare interface QueryProcedureDescriptor<Name extends string, Input extends Sc
     readonly exposeAsTool: ExposeAsTool | undefined;
 }
 
+/**
+ * Passes when the subject holds ANY of `scopes` (or `admin:full`).
+ *
+ * For a route whose permitted callers differ by REQUEST SHAPE rather than by
+ * route — issuing an api key for yourself, for the org, or on behalf of someone
+ * else are three different rights on one endpoint. The guard establishes "may
+ * mint something"; the handler decides which, because only the body says which
+ * was asked for. Splitting them into three routes instead would move a decision
+ * that depends on the body into the URL, where a client could pick.
+ */
+export declare const requireAnyScope: (scopes: ReadonlyArray<string>) => RestGuard;
+
 /**
  * Guard that requires the resolved subject to carry `scope`. Anonymous /
  * scope-less subjects are rejected with `403`. The blanket admin scope
@@ -448,6 +499,15 @@ export declare interface RestRouteDescriptor<I, O> {
      *  `410 Gone` with a replacement pointer. */
     readonly sunset?: string;
     readonly guards?: ReadonlyArray<RestGuard>;
+    /**
+     * This route STREAMS (Server-Sent Events) rather than resolving one value — its
+     * handler returns `sse(...)`. Declared on the descriptor, not left implicit in
+     * the handler, so anything that INSPECTS routes without running them (the
+     * OpenAPI generator, the inspect manifest) can tell a stream from a buffered
+     * response. A spec that documents a stream as `application/json` is worse than
+     * no spec, because clients are generated from it.
+     */
+    readonly streaming?: boolean;
 }
 
 export declare interface RestRouteExample {
@@ -488,6 +548,36 @@ export declare interface RestServeBindings {
     };
 }
 
+/**
+ * What a REST handler returns to stream its response instead of resolving one
+ * value: `sse((emit) => unsubscribe)`. The route's schema `output` is not used
+ * for a stream (each frame is framed as it is produced), and everything the
+ * desugar does BEFORE the handler — method gate, sunset, input decode, guards,
+ * subject resolution — still applies.
+ */
+export declare interface RestStreamResponse {
+    readonly __voltroRestStream: true;
+    readonly stream: PluginHttpRouteStream;
+}
+
+/**
+ * Build a streaming (Server-Sent Events) handler result. `subscribe` gets an
+ * `emit` for one already-framed SSE chunk and MUST return an unsubscribe, which
+ * the serve layer runs on client disconnect.
+ *
+ *     handler: () => sse((emit) => {
+ *       const stop = watch((row) => emit(sseFrame('change', row)))
+ *       return stop
+ *     })
+ */
+export declare const sse: (subscribe: (emit: (chunk: string) => void) => () => void, options?: {
+    readonly keepAliveMs?: number;
+}) => RestStreamResponse;
+
+/** Frame ONE SSE event. Newlines in `data` are split across `data:` lines, as
+ *  the protocol requires — a raw `\n` inside one would truncate the event. */
+export declare const sseFrame: (event: string, data: unknown) => string;
+
 declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["user"]>;
     id: typeof Schema.String;