@voltro/protocol 0.11.4 → 0.13.0

package/dist/index.d.ts

@@ -39,6 +39,37 @@ export declare type AnyCheckSpec = GuardCheckSpec | PolicyCheckSpec;
 /** A guard is either a scope check or a relationship check. */
 export declare type AnyGuardSpec<Input = unknown> = GuardSpec<Input> | PolicyGuardSpec<Input>;
 
+export declare const APIKEY_ISSUE_ORG_SCOPE = "apikeys:issue:org";
+
+export declare const APIKEY_ISSUE_OTHER_SCOPE = "apikeys:issue:other";
+
+/**
+ * API-key issuance rights.
+ *
+ * One `admin:full` gate for all key minting was too coarse to express what
+ * products actually need: it means only a full admin can ever mint a key, so a
+ * normal user cannot create their own even narrowly-scoped credential, and an
+ * admin minting one FOR someone is indistinguishable from minting one for
+ * themselves.
+ *
+ * Three separable capabilities instead:
+ *
+ *   `apikeys:issue:self`  - mint a key that acts as ME. The common self-service
+ *                           case; the key can never exceed the holder's own
+ *                           scopes.
+ *   `apikeys:issue:org`   - mint an ORG key: acts as no person, belongs to the
+ *                           organization. A CI credential. Separate because
+ *                           "may create a personal token" and "may create a
+ *                           credential that outlives my account" are genuinely
+ *                           different levels of trust.
+ *   `apikeys:issue:other` - mint a key ON BEHALF OF another user. Admin
+ *                           territory: it is the ability to act as someone
+ *                           else, so it is never implied by the other two.
+ *
+ * `admin:full` satisfies all three, as it does every scope.
+ */
+export declare const APIKEY_ISSUE_SELF_SCOPE = "apikeys:issue:self";
+
 /**
  * Apply a `RowPatch` to `prev`, producing `next`. Exact inverse of
  * `diffRows`: `applyRowPatch(prev, diffRows(prev, next))` deep-equals
@@ -124,6 +155,24 @@ export declare interface AuthStrategy {
      *  in logs + `Subject.metadata.provider`. */
     readonly id: string;
     readonly resolve: (input: AuthStrategyInput) => Promise<StrategyResolution> | StrategyResolution;
+    /**
+     * The bearer-token PREFIX this strategy claims, when it gates on one
+     * (`'sk_'`, `'awb_'`). Declared so a collision is DETECTABLE.
+     *
+     * Two strategies claiming the same prefix is not a harmless duplicate: the
+     * chain is first-match-wins, so whichever runs first decides the Subject —
+     * and if they resolve the same token to different authority, which one
+     * answered decides whether authorization works. A downstream app hit exactly
+     * this and had to pin a test asserting it never sets `apiKeys: true`, because
+     * doing so would append the framework strategy alongside its own on the same
+     * `sk_` prefix, with the framework one resolving without the app's team
+     * binding.
+     *
+     * Optional: a cookie or JWKS strategy claims no prefix and omits it. Only
+     * what is declared can be checked — a strategy that gates on a prefix without
+     * saying so is invisible to the boot check, exactly as before.
+     */
+    readonly claimsBearerPrefix?: string;
 }
 
 /** Per-call input the framework hands every strategy. */
@@ -243,18 +292,6 @@ export declare interface ClientTarget {
     readonly shapeItem?: ((input: Record<string, unknown>, currentOrOptimisticId: unknown) => Record<string, unknown>) | undefined;
 }
 
-/** Compose multiple strategies into a single resolver function. The
- *  composer evaluates them in declaration order; first `matched`
- *  wins; first `failed` short-circuits to anonymous (does NOT fall
- *  through — see StrategyResolution doc).
- *
- *  Apps wrap the return in `AuthMiddleware.of(...)` themselves so they
- *  can inject the connection-override fast-path (`getConnectionSubject`)
- *  ahead of the strategy chain — that path lives in `@voltro/runtime`
- *  and the protocol package stays runtime-agnostic.
- *
- *  Returns an async resolver `(input) => Promise<Subject>`.
- */
 export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrategy>, options?: {
     /** Fallback when no strategy matched. Default: returns the input's
      *  tenant from `x-tenant` header or null. */
@@ -275,6 +312,42 @@ export declare const composeAuthStrategies: (strategies: ReadonlyArray<AuthStrat
      * `fallback` is supplied (the fallback owns that decision).
      */
     readonly anonymousTenantRequired?: boolean;
+    /**
+     * Add scopes to a resolved Subject from a source the strategy could not
+     * see — typically a role stored in the app's own database.
+     *
+     * **The gap this closes.** An app whose authorization is a DB ROLE
+     * (`requireCallerAdmin(ctx)` reading an `employees.role` column) is
+     * invisible to every static analysis the framework has: `voltro check`'s
+     * `rbac/unguarded-mutation` reports its writes as unguarded, and it is
+     * right to — nothing about that authorization is declared. But the
+     * declarative alternative was unusable for them: their subjects come from
+     * an external IdP's JWTs and carry no scopes, so `guards: [{ scope:
+     * 'employee:admin' }]` would lock out every real user. One app measured
+     * 1566 findings it had no way to act on.
+     *
+     * Lifting roles into `subject.scopes` here makes the SAME authorization
+     * declarable — `requireScope('employee:admin')` on the descriptor, visible
+     * in the manifest, checkable by CI. That is the framework's own
+     * scope-vs-filter argument one level up: only what is declared can be
+     * checked.
+     *
+     * **Deliberately narrow: scopes only.** It cannot return a Subject. A hook
+     * that could rewrite `id` or `tenantId` would be a forgery surface — the
+     * same shape as the api-key `metadata.userId` bug, where an app-supplied
+     * bag could overwrite the framework's claim about who a request was. The
+     * strategy owns identity; this owns authority.
+     *
+     * Returned scopes are UNIONED with whatever the strategy already set, so a
+     * resolver cannot silently remove a scope either.
+     *
+     * Runs only on a MATCHED subject — never for anonymous, where there is no
+     * identity to look a role up for. It is on the request path, so cache it
+     * (a per-connection or short-TTL map keyed by subject id); the framework
+     * deliberately does not cache for you, because only the app knows how
+     * quickly a role change must take effect.
+     */
+    readonly resolveScopes?: (subject: Subject, input: AuthStrategyInput) => Promise<ReadonlyArray<string>> | ReadonlyArray<string>;
 }) => ((input: AuthStrategyInput) => Promise<Subject>);
 
 /**
@@ -2222,6 +2295,25 @@ export declare type Target<Input = unknown, Row = unknown> = TargetSpec<Input, R
 
 export declare type TargetSpec<Input = unknown, Row = unknown> = InsertTarget<Input, Row> | UpdateTarget<Input, Row> | DeleteTarget<Input>;
 
+/**
+ * The subject a `storeForTenant(id)` view runs as — the caller's identity,
+ * re-pointed at ONE explicit tenant.
+ *
+ * Lives here, next to the other subject constructors, because BOTH the serve
+ * context builder (`@voltro/cli`) and the test harness (`@voltro/testing`)
+ * must produce the identical subject. When it lived in the CLI, the harness
+ * could not reach it, and `ctx.storeForTenant` was simply absent under test —
+ * a handler that used it had no way to be tested at all.
+ *
+ * The narrowed return type is the point, not decoration: it states at the type
+ * level that this can never hand back a `system` subject, which is the variant
+ * whose null tenant means "all tenants". Producing one here would silently
+ * widen a deliberately narrow view back to every tenant.
+ */
+export declare const tenantScopedSubject: (subject: Subject, tenantId: string) => Extract<Subject, {
+    readonly type: "serviceAccount";
+}>;
+
 export declare const toRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err> | MutationProcedureDescriptor<Name, Input, Output, Err> | ActionProcedureDescriptor<Name, Input, Output, Err> | StreamProcedureDescriptor<Name, Input, Output, Err>) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<[Schema.Struct<{
     _tag: Schema.Literal<["snapshot"]>;
     revision: typeof Schema.Number;
@@ -2449,6 +2541,24 @@ export declare interface VoltroPlugin {
      * dashboard Env panel. Mirror exactly what the plugin reads.
      */
     readonly declaredEnv?: ReadonlyArray<PluginEnvVar>;
+    /**
+     * The authorization scopes this plugin DEFINES for the app — its scope
+     * vocabulary. Distinct from `permissions` above, which is what the plugin
+     * itself asks to be granted.
+     *
+     * `@voltro/plugin-rbac` fills this with every scope its `roles` map grants,
+     * because that map already IS the app's declared vocabulary. The capability
+     * manifest unions these, and `voltro check` compares each handler's required
+     * scopes against the union: a guard demanding a scope no role can grant (a
+     * typo, a rename) makes that procedure permanently uncallable, silently.
+     *
+     * Only declare this when the list is EXHAUSTIVE. A plugin that also grants
+     * scopes from a dynamic source (a custom resolver, per-row ACLs) must leave
+     * it undefined — the check treats "no declared scopes" as "cannot conclude"
+     * and stays dormant, which is the honest outcome. A partial list would flag
+     * correct code, and a check that cries wolf gets ignored.
+     */
+    readonly declaredScopes?: ReadonlyArray<string>;
     /**
      * Optional `effect/Schema` describing the plugin's user-supplied
      * config. When present the framework decodes the operator's config

package/dist/index.js

@@ -1,9 +1,9 @@
-import { C as e, S as t, _ as n, a as r, b as i, c as a, d as o, f as ee, g as te, h as ne, i as re, l as s, m as ie, n as ae, o as oe, p as se, r as ce, s as le, t as ue, u as de, v as fe, w as pe, x as me, y as he } from "./serverErrorBus-B3hDwGoL.js";
-import { a as ge, c as _e, d as ve, f as ye, i as be, l as xe, n as Se, o as Ce, r as we, s as Te, t as Ee, u as De } from "./auth-DCE6m7Bo.js";
-import { Context as Oe, Layer as ke, Schema as c } from "effect";
+import { C as e, D as t, E as n, S as r, T as i, _ as a, a as o, b as ee, c as te, d as ne, f as s, g as re, h as ie, i as ae, l as oe, m as se, n as ce, o as le, p as ue, r as de, s as fe, t as pe, u as me, v as he, w as ge, x as _e, y as ve } from "./serverErrorBus-DhIVDkCi.js";
+import { a as ye, c as be, d as xe, f as Se, i as Ce, l as we, n as Te, o as Ee, p as De, r as Oe, s as ke, t as Ae, u as je } from "./auth-DVrHg739.js";
+import { Context as Me, Layer as Ne, Schema as c } from "effect";
 import { Rpc as l } from "@effect/rpc";
 //#region src/rowPatch.ts
-var Ae = c.Union(c.String, c.Number), u = c.Record({
+var Pe = c.Union(c.String, c.Number), u = c.Record({
 	key: c.String,
 	value: c.Unknown
 }).pipe(c.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), d = c.Union(c.Struct({
@@ -19,12 +19,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	path: c.String
 })), f = c.Struct({
 	ops: c.Array(d),
-	order: c.Array(Ae)
-}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, je = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
+	order: c.Array(Pe)
+}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Fe = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, Me = (e, t) => m(e) === m(t), Ne = (e, t) => {
+}, Ie = (e, t) => m(e) === m(t), Le = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	let r = [], i = [], a = /* @__PURE__ */ new Set();
@@ -35,7 +35,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 			op: "add",
 			path: p(e.id),
 			value: e
-		}) : Me(t, e) || r.push({
+		}) : Ie(t, e) || r.push({
 			op: "replace",
 			path: p(e.id),
 			value: e
@@ -49,10 +49,10 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		ops: r,
 		order: i
 	};
-}, Pe = (e) => e.every((e) => {
+}, Re = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Fe = (e, t) => {
+}), ze = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	for (let e of t.ops) (e.op === "add" || e.op === "replace") && n.set(e.value.id, e.value);
@@ -76,7 +76,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	_tag: c.Literal("error"),
 	error: c.Unknown,
 	revision: c.optional(c.Number)
-})), Ie = (e) => e.action !== void 0 && e.resourceType !== void 0, g = (e) => ({
+})), Be = (e) => e.action !== void 0 && e.resourceType !== void 0, g = (e) => ({
 	kind: "query",
 	name: e.name,
 	input: e.input,
@@ -106,7 +106,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	guards: e.guards,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool
-}), Le = (e) => ({
+}), Ve = (e) => ({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -117,27 +117,27 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	success: h(e.output),
 	error: y(b(e.error, e.guards), t),
 	stream: !0
-}), Re = (e, t) => l.make(e.name, {
+}), S = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
 	error: y(b(e.error, e.guards), t)
-}), ze = (e, t) => l.make(e.name, {
+}), C = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
 	error: y(b(e.error, e.guards), t)
-}), S = (e, t) => l.make(e.name, {
+}), w = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.element,
 	error: y(e.error, t),
 	stream: !0
-}), Be = (e) => {
+}), He = (e) => {
 	switch (e.kind) {
 		case "query": return x(e);
-		case "mutation": return Re(e);
-		case "action": return ze(e);
-		case "stream": return S(e);
+		case "mutation": return S(e);
+		case "action": return C(e);
+		case "stream": return w(e);
 	}
-}, Ve = (e) => {
+}, Ue = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -178,17 +178,17 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, He = (e) => e, Ue = (e) => e, We = (e) => {
+}, We = (e) => e, Ge = (e) => e, Ke = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Ge = (e, t) => {
-	let n = Oe.GenericTag(e);
+}, qe = (e, t) => {
+	let n = Me.GenericTag(e);
 	return {
 		Tag: n,
-		Live: ke.succeed(n, t)
+		Live: Ne.succeed(n, t)
 	};
-}, Ke = (e, t, n) => {
+}, Je = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = C(n);
+	let r = T(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -196,12 +196,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!qe(i, r)) return {
+	for (let i of a) if (!Ye(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, C = (e) => {
+}, T = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -209,38 +209,38 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, w = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, qe = (e, t) => {
+}, E = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Ye = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = C(e.slice(1));
-		return !n || t.major !== n.major ? !1 : w(t, n) >= 0;
+		let n = T(e.slice(1));
+		return !n || t.major !== n.major ? !1 : E(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = C(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : w(t, n) >= 0;
+		let n = T(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : E(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = C(n[2]);
+		let e = n[1], r = T(n[2]);
 		if (!r) return !1;
-		let i = w(t, r);
+		let i = E(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = C(e);
-	return r ? w(t, r) === 0 : !1;
-}, T = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), E = c.Literal("cancel", "terminate", "abandon"), Je = c.Struct({
+	let r = T(e);
+	return r ? E(t, r) === 0 : !1;
+}, D = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), O = c.Literal("cancel", "terminate", "abandon"), Xe = c.Struct({
 	id: c.String,
 	workflowName: c.String,
 	executionId: c.String,
 	status: c.Literal("running")
-}), D = c.Struct({
+}), k = c.Struct({
 	id: c.String,
 	tag: c.String,
 	executionId: c.String,
-	status: T,
+	status: D,
 	payload: c.Unknown,
 	workflowVersion: c.NullOr(c.String),
 	workflowPatches: c.NullOr(c.Unknown),
@@ -255,12 +255,12 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	durationMs: c.NullOr(c.Number),
 	traceId: c.NullOr(c.String),
 	parentExecutionId: c.NullOr(c.String),
-	parentClosePolicy: c.NullOr(E)
-}), O = c.Struct({
+	parentClosePolicy: c.NullOr(O)
+}), A = c.Struct({
 	tag: c.optional(c.String),
-	status: c.optional(T),
+	status: c.optional(D),
 	limit: c.optional(c.Number)
-}), k = c.Struct({
+}), j = c.Struct({
 	id: c.String,
 	runId: c.String,
 	stepName: c.String,
@@ -275,7 +275,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	startedAt: c.Date,
 	completedAt: c.NullOr(c.Date),
 	durationMs: c.NullOr(c.Number)
-}), A = c.Struct({
+}), M = c.Struct({
 	id: c.String,
 	runId: c.String,
 	eventType: c.String,
@@ -283,7 +283,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	occurredAt: c.Date,
 	stepName: c.NullOr(c.String),
 	attempt: c.NullOr(c.Number)
-}), j = c.Struct({
+}), N = c.Struct({
 	id: c.String,
 	name: c.String,
 	payload: c.Unknown,
@@ -291,7 +291,7 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	subject: c.NullOr(c.Unknown),
 	traceId: c.NullOr(c.String),
 	occurredAt: c.Date
-}), M = c.Struct({
+}), P = c.Struct({
 	id: c.String,
 	eventId: c.String,
 	eventName: c.String,
@@ -304,123 +304,123 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 	errorMessage: c.NullOr(c.String),
 	createdAt: c.Date,
 	completedAt: c.NullOr(c.Date)
-}), N = c.Struct({ id: c.String }), P = c.Struct({ runId: c.String }), F = c.Struct({
+}), F = c.Struct({ id: c.String }), I = c.Struct({ runId: c.String }), L = c.Struct({
 	name: c.optional(c.String),
 	limit: c.optional(c.Number)
-}), I = c.Struct({ eventId: c.String }), L = c.Struct({
+}), R = c.Struct({ eventId: c.String }), z = c.Struct({
 	workflowName: c.String,
 	executionId: c.String
-}), R = c.Struct({
+}), Ze = c.Struct({
 	id: c.String,
 	signalName: c.String,
 	payload: c.optional(c.Unknown)
-}), z = c.Struct({
+}), B = c.Struct({
 	id: c.String,
 	updateName: c.String,
 	payload: c.optional(c.Unknown),
 	timeoutMs: c.optional(c.Number)
-}), B = c.Struct({
+}), V = c.Struct({
 	eventId: c.String,
 	updateId: c.String,
 	completedEventId: c.String,
 	result: c.Unknown
-}), Ye = g({
+}), Qe = g({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: N,
-	output: c.Array(D)
-}), Xe = g({
+	input: F,
+	output: c.Array(k)
+}), $e = g({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: O,
-	output: c.Array(D)
-}), Ze = g({
+	input: A,
+	output: c.Array(k)
+}), et = g({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: P,
-	output: c.Array(k)
-}), Qe = g({
+	input: I,
+	output: c.Array(j)
+}), tt = g({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: P,
-	output: c.Array(A)
-}), $e = g({
+	input: I,
+	output: c.Array(M)
+}), nt = g({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: F,
-	output: c.Array(j)
-}), et = g({
+	input: L,
+	output: c.Array(N)
+}), rt = g({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: I,
-	output: c.Array(M)
-}), tt = v({
+	input: R,
+	output: c.Array(P)
+}), it = v({
 	name: "__voltro.workflow.cancel",
-	input: L,
+	input: z,
 	output: c.Struct({ ok: c.Boolean })
-}), nt = v({
+}), at = v({
 	name: "__voltro.workflow.resume",
-	input: L,
+	input: z,
 	output: c.Struct({ ok: c.Boolean })
-}), rt = v({
+}), ot = v({
 	name: "__voltro.workflow.signal",
-	input: R,
+	input: Ze,
 	output: c.Struct({ eventId: c.String })
-}), it = v({
+}), st = v({
 	name: "__voltro.workflow.update",
-	input: z,
-	output: B
-}), at = "__voltro.undo.log", V = "__voltro.undo.apply", H = "__voltro.undo.redo", U = c.Struct({
+	input: B,
+	output: V
+}), H = "__voltro.undo.log", U = "__voltro.undo.apply", W = "__voltro.undo.redo", G = c.Struct({
 	id: c.String,
 	tag: c.String,
 	label: c.NullOr(c.String),
 	undone: c.Boolean,
 	crossesAction: c.Boolean,
 	createdAt: c.String
-}), W = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, G = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, K = class extends c.TaggedError()("UndoConflict", {
+}), K = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, q = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, J = class extends c.TaggedError()("UndoConflict", {
 	invocationId: c.String,
 	reason: c.Literal("conflict", "action")
-}) {}, q = c.Union(W, G, K), ot = g({
-	name: at,
+}) {}, Y = c.Union(K, q, J), ct = g({
+	name: H,
 	source: "_voltro_undo_log",
 	input: c.Struct({ limit: c.optional(c.Number) }),
-	output: c.Array(U)
-}), st = _({
-	name: V,
+	output: c.Array(G)
+}), lt = _({
+	name: U,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: q
-}), ct = _({
-	name: H,
+	error: Y
+}), ut = _({
+	name: W,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: q
-}), J = "__voltro.connections.list", Y = "__voltro.connections.start", X = "__voltro.connections.submitToken", Z = "__voltro.connections.disconnect", Q = c.Literal("oauth2", "pat"), lt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), ut = c.Struct({
+	error: Y
+}), X = "__voltro.connections.list", dt = "__voltro.connections.start", ft = "__voltro.connections.submitToken", pt = "__voltro.connections.disconnect", Z = c.Literal("oauth2", "pat"), mt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), ht = c.Struct({
 	connectionId: c.String,
-	kind: Q,
+	kind: Z,
 	label: c.String,
-	status: lt,
+	status: mt,
 	accountId: c.NullOr(c.String),
 	accountLabel: c.NullOr(c.String),
 	scopes: c.Array(c.String),
 	expiresAt: c.NullOr(c.String),
 	lastError: c.NullOr(c.String),
 	connectedAt: c.NullOr(c.String)
-}), dt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, ft = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, pt = class extends c.TaggedError()("ConnectionKindMismatch", {
+}), gt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, _t = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, vt = class extends c.TaggedError()("ConnectionKindMismatch", {
 	connectionId: c.String,
-	expected: Q,
-	actual: Q
-}) {}, mt = class extends c.TaggedError()("ConnectionHandshakeFailed", {
+	expected: Z,
+	actual: Z
+}) {}, Q = class extends c.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: c.String,
 	reason: c.String,
 	transient: c.Boolean
-}) {}, $ = c.Union(dt, ft, pt, mt), ht = g({
-	name: J,
+}) {}, $ = c.Union(gt, _t, vt, Q), yt = g({
+	name: X,
 	source: "_voltro_connections",
 	input: c.Struct({}),
-	output: c.Array(ut)
-}), gt = v({
-	name: Y,
+	output: c.Array(ht)
+}), bt = v({
+	name: dt,
 	input: c.Struct({
 		connectionId: c.String,
 		redirectTo: c.optional(c.String)
@@ -430,22 +430,22 @@ var Ae = c.Union(c.String, c.Number), u = c.Record({
 		state: c.String
 	}),
 	error: $
-}), _t = _({
-	name: X,
+}), xt = _({
+	name: ft,
 	input: c.Struct({
 		connectionId: c.String,
 		token: c.String
 	}),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), vt = _({
-	name: Z,
+}), St = _({
+	name: pt,
 	input: c.Struct({ connectionId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), yt = (e) => {
+}), Ct = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, bt = 1;
+}, wt = 1;
 //#endregion
-export { a as ADMIN_SCOPE, Ee as AuthMiddleware, J as CONNECTIONS_LIST_TAG, Z as CONNECTION_DISCONNECT_TAG, Y as CONNECTION_START_TAG, X as CONNECTION_SUBMIT_TOKEN_TAG, mt as ConnectionHandshakeFailed, Se as ConnectionInfo, we as ConnectionInfoMiddleware, Q as ConnectionKind, pt as ConnectionKindMismatch, dt as ConnectionNotDeclared, ut as ConnectionState, lt as ConnectionStatus, ft as ConnectionSubjectRequired, bt as PROTOCOL_VERSION, s as ScopeError, be as Subject, ge as SubjectService, V as UNDO_APPLY_TAG, at as UNDO_LOG_TAG, H as UNDO_REDO_TAG, Ce as Unauthenticated, K as UndoConflict, G as UndoForbidden, U as UndoLogEntry, W as UndoNotFound, L as WorkflowControlInputSchema, j as WorkflowDomainEventRowSchema, F as WorkflowDomainEventsInputSchema, I as WorkflowEventDeliveriesInputSchema, M as WorkflowEventDeliveryRowSchema, E as WorkflowParentClosePolicySchema, A as WorkflowRunEventRowSchema, Je as WorkflowRunHandleSchema, N as WorkflowRunRefSchema, D as WorkflowRunRowSchema, T as WorkflowRunStatusSchema, k as WorkflowRunStepRowSchema, P as WorkflowRunTableRefSchema, O as WorkflowRunsInputSchema, R as WorkflowSignalInputSchema, z as WorkflowUpdateInputSchema, B as WorkflowUpdateResultSchema, ze as actionToRpc, de as advisoryResourceGuardWarning, Te as anonymousSubject, Fe as applyRowPatch, _e as assertAuthenticated, ce as beginIdempotent, Ke as checkFrameworkCompat, o as checkGuards, ee as checkGuardsEffect, xe as composeAuthStrategies, We as composeRpcInterceptors, vt as connectionDisconnectDescriptor, gt as connectionStartDescriptor, _t as connectionSubmitTokenDescriptor, ht as connectionsListQueryDescriptor, v as defineAction, _ as defineMutation, He as definePlugin, Ue as definePluginRoute, Ge as definePluginService, g as defineQuery, Le as defineStream, Ne as diffRows, se as effectiveScopes, re as failIdempotent, ie as findAdvisoryResourceGuards, r as finishIdempotent, ne as getPolicyGuardResolver, te as getResourceScopeResolver, De as hasCallbackRoutes, n as hasEffectiveScope, fe as hasScope, p as idToPath, oe as idempotencyScope, Pe as isIdKeyed, he as isPolicyCheck, Ie as isPolicyGuard, ve as isSystemSubject, le as memoryIdempotencyStore, Re as mutationToRpc, Ve as normalizeDescriptor, je as pathToId, ue as publishServerError, x as queryToRpc, i as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, me as setEffectiveScopes, t as setPolicyGuardResolver, e as setResourceScopeResolver, S as streamToRpc, pe as subjectScopes, ae as subscribeServerErrors, h as subscriptionEvent, ye as systemSubject, Be as toRpc, yt as tsMs, st as undoApplyDescriptor, ot as undoLogQueryDescriptor, ct as undoRedoDescriptor, tt as workflowCancelDescriptor, $e as workflowDomainEventsQueryDescriptor, et as workflowEventDeliveriesQueryDescriptor, nt as workflowResumeDescriptor, Qe as workflowRunEventsQueryDescriptor, Ye as workflowRunQueryDescriptor, Ze as workflowRunStepsQueryDescriptor, Xe as workflowRunsQueryDescriptor, rt as workflowSignalDescriptor, it as workflowUpdateDescriptor };
+export { te as ADMIN_SCOPE, oe as APIKEY_ISSUE_ORG_SCOPE, me as APIKEY_ISSUE_OTHER_SCOPE, ne as APIKEY_ISSUE_SELF_SCOPE, Ae as AuthMiddleware, X as CONNECTIONS_LIST_TAG, pt as CONNECTION_DISCONNECT_TAG, dt as CONNECTION_START_TAG, ft as CONNECTION_SUBMIT_TOKEN_TAG, Q as ConnectionHandshakeFailed, Te as ConnectionInfo, Oe as ConnectionInfoMiddleware, Z as ConnectionKind, vt as ConnectionKindMismatch, gt as ConnectionNotDeclared, ht as ConnectionState, mt as ConnectionStatus, _t as ConnectionSubjectRequired, wt as PROTOCOL_VERSION, s as ScopeError, Ce as Subject, ye as SubjectService, U as UNDO_APPLY_TAG, H as UNDO_LOG_TAG, W as UNDO_REDO_TAG, Ee as Unauthenticated, J as UndoConflict, q as UndoForbidden, G as UndoLogEntry, K as UndoNotFound, z as WorkflowControlInputSchema, N as WorkflowDomainEventRowSchema, L as WorkflowDomainEventsInputSchema, R as WorkflowEventDeliveriesInputSchema, P as WorkflowEventDeliveryRowSchema, O as WorkflowParentClosePolicySchema, M as WorkflowRunEventRowSchema, Xe as WorkflowRunHandleSchema, F as WorkflowRunRefSchema, k as WorkflowRunRowSchema, D as WorkflowRunStatusSchema, j as WorkflowRunStepRowSchema, I as WorkflowRunTableRefSchema, A as WorkflowRunsInputSchema, Ze as WorkflowSignalInputSchema, B as WorkflowUpdateInputSchema, V as WorkflowUpdateResultSchema, C as actionToRpc, ue as advisoryResourceGuardWarning, ke as anonymousSubject, ze as applyRowPatch, be as assertAuthenticated, de as beginIdempotent, Je as checkFrameworkCompat, se as checkGuards, ie as checkGuardsEffect, we as composeAuthStrategies, Ke as composeRpcInterceptors, St as connectionDisconnectDescriptor, bt as connectionStartDescriptor, xt as connectionSubmitTokenDescriptor, yt as connectionsListQueryDescriptor, v as defineAction, _ as defineMutation, We as definePlugin, Ge as definePluginRoute, qe as definePluginService, g as defineQuery, Ve as defineStream, Le as diffRows, re as effectiveScopes, ae as failIdempotent, a as findAdvisoryResourceGuards, o as finishIdempotent, he as getPolicyGuardResolver, ve as getResourceScopeResolver, je as hasCallbackRoutes, ee as hasEffectiveScope, _e as hasScope, p as idToPath, le as idempotencyScope, Re as isIdKeyed, r as isPolicyCheck, Be as isPolicyGuard, xe as isSystemSubject, fe as memoryIdempotencyStore, S as mutationToRpc, Ue as normalizeDescriptor, Fe as pathToId, pe as publishServerError, x as queryToRpc, e as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, ge as setEffectiveScopes, i as setPolicyGuardResolver, n as setResourceScopeResolver, w as streamToRpc, t as subjectScopes, ce as subscribeServerErrors, h as subscriptionEvent, Se as systemSubject, De as tenantScopedSubject, He as toRpc, Ct as tsMs, lt as undoApplyDescriptor, ct as undoLogQueryDescriptor, ut as undoRedoDescriptor, it as workflowCancelDescriptor, nt as workflowDomainEventsQueryDescriptor, rt as workflowEventDeliveriesQueryDescriptor, at as workflowResumeDescriptor, tt as workflowRunEventsQueryDescriptor, Qe as workflowRunQueryDescriptor, et as workflowRunStepsQueryDescriptor, $e as workflowRunsQueryDescriptor, ot as workflowSignalDescriptor, st as workflowUpdateDescriptor };

package/dist/jwt.d.ts

@@ -8,6 +8,24 @@ declare interface AuthStrategy {
      *  in logs + `Subject.metadata.provider`. */
     readonly id: string;
     readonly resolve: (input: AuthStrategyInput) => Promise<StrategyResolution> | StrategyResolution;
+    /**
+     * The bearer-token PREFIX this strategy claims, when it gates on one
+     * (`'sk_'`, `'awb_'`). Declared so a collision is DETECTABLE.
+     *
+     * Two strategies claiming the same prefix is not a harmless duplicate: the
+     * chain is first-match-wins, so whichever runs first decides the Subject —
+     * and if they resolve the same token to different authority, which one
+     * answered decides whether authorization works. A downstream app hit exactly
+     * this and had to pin a test asserting it never sets `apiKeys: true`, because
+     * doing so would append the framework strategy alongside its own on the same
+     * `sk_` prefix, with the framework one resolving without the app's team
+     * binding.
+     *
+     * Optional: a cookie or JWKS strategy claims no prefix and omits it. Only
+     * what is declared can be checked — a strategy that gates on a prefix without
+     * saying so is invisible to the boot check, exactly as before.
+     */
+    readonly claimsBearerPrefix?: string;
 }
 
 /** Per-call input the framework hands every strategy. */