@voltro/protocol 0.39.1 → 0.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/CHANGELOG.md +232 -0
  2. package/dist/apikey.d.ts +17 -0
  3. package/dist/index.d.ts +122 -14
  4. package/dist/index.js +419 -412
  5. package/dist/jwt.d.ts +17 -0
  6. package/dist/rest.d.ts +17 -0
  7. package/dist/rest.js +1 -1
  8. package/dist/{auth-CKS3UNnf.js → scopes-B0kGvAnI.js} +169 -160
  9. package/dist/session.d.ts +35 -0
  10. package/dist/session.js +1 -1
  11. package/package.json +3 -3
package/dist/index.js CHANGED
@@ -1,30 +1,30 @@
1
- import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as ee, I as te, L as s, M as ne, N as re, O as ie, P as ae, R as oe, S as se, T as ce, U as le, V as ue, W as de, _ as fe, a as pe, b as me, c as he, d as ge, f as _e, g as ve, h as ye, i as be, j as xe, k as Se, l as Ce, m as we, n as Te, o as Ee, p as De, r as Oe, s as ke, t as Ae, u as je, v as Me, w as Ne, x as Pe, y as Fe, z as Ie } from "./auth-CKS3UNnf.js";
2
- import { a as Le, c as Re, i as ze, n as Be, o as Ve, r as He, s as Ue, t as We } from "./serverErrorBus-BeN9pOpY.js";
3
- import { Context as Ge, Layer as Ke, Schema as c } from "effect";
4
- import { Rpc as l } from "@effect/rpc";
1
+ import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as ee, I as te, L as ne, M as re, N as s, O as ie, P as ae, R as oe, S as se, T as ce, U as le, V as ue, W as de, _ as fe, a as c, b as pe, c as me, d as he, f as ge, g as _e, h as l, i as ve, j as ye, k as be, l as xe, m as Se, n as Ce, o as we, p as Te, r as Ee, s as De, t as Oe, u as ke, v as u, w as Ae, x as je, y as Me, z as Ne } from "./scopes-B0kGvAnI.js";
2
+ import { a as Pe, c as Fe, i as Ie, n as Le, o as Re, r as ze, s as Be, t as Ve } from "./serverErrorBus-BeN9pOpY.js";
3
+ import { Context as He, Layer as Ue, Schema as d } from "effect";
4
+ import { Rpc as f } from "@effect/rpc";
5
5
  //#region src/rowPatch.ts
6
- var qe = c.Union(c.String, c.Number), u = c.Record({
7
- key: c.String,
8
- value: c.Unknown
9
- }).pipe(c.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), d = c.Union(c.Struct({
10
- op: c.Literal("add"),
11
- path: c.String,
12
- value: u
13
- }), c.Struct({
14
- op: c.Literal("replace"),
15
- path: c.String,
16
- value: u
17
- }), c.Struct({
18
- op: c.Literal("remove"),
19
- path: c.String
20
- })), f = c.Struct({
21
- ops: c.Array(d),
22
- order: c.Array(qe)
23
- }), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Je = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
6
+ var We = d.Union(d.String, d.Number), p = d.Record({
7
+ key: d.String,
8
+ value: d.Unknown
9
+ }).pipe(d.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), m = d.Union(d.Struct({
10
+ op: d.Literal("add"),
11
+ path: d.String,
12
+ value: p
13
+ }), d.Struct({
14
+ op: d.Literal("replace"),
15
+ path: d.String,
16
+ value: p
17
+ }), d.Struct({
18
+ op: d.Literal("remove"),
19
+ path: d.String
20
+ })), h = d.Struct({
21
+ ops: d.Array(m),
22
+ order: d.Array(We)
23
+ }), g = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ge = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), _ = (e) => {
24
24
  let t = Object.keys(e).sort(), n = {};
25
25
  for (let r of t) n[r] = e[r];
26
26
  return JSON.stringify(n);
27
- }, Ye = (e, t) => m(e) === m(t), Xe = (e, t) => {
27
+ }, Ke = (e, t) => _(e) === _(t), qe = (e, t) => {
28
28
  let n = /* @__PURE__ */ new Map();
29
29
  for (let t of e) n.set(t.id, t);
30
30
  let r = [], i = [], a = /* @__PURE__ */ new Set();
@@ -33,26 +33,26 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
33
33
  let t = n.get(e.id);
34
34
  t === void 0 ? r.push({
35
35
  op: "add",
36
- path: p(e.id),
36
+ path: g(e.id),
37
37
  value: e
38
- }) : Ye(t, e) || r.push({
38
+ }) : Ke(t, e) || r.push({
39
39
  op: "replace",
40
- path: p(e.id),
40
+ path: g(e.id),
41
41
  value: e
42
42
  });
43
43
  }
44
44
  for (let t of e) a.has(t.id) || r.push({
45
45
  op: "remove",
46
- path: p(t.id)
46
+ path: g(t.id)
47
47
  });
48
48
  return {
49
49
  ops: r,
50
50
  order: i
51
51
  };
52
- }, Ze = (e) => e.every((e) => {
52
+ }, Je = (e) => e.every((e) => {
53
53
  let t = e.id;
54
54
  return typeof t == "string" || typeof t == "number";
55
- }), Qe = (e, t) => {
55
+ }), Ye = (e, t) => {
56
56
  let n = /* @__PURE__ */ new Map();
57
57
  for (let t of e) n.set(t.id, t);
58
58
  for (let e of t.ops) (e.op === "add" || e.op === "replace") && n.set(e.value.id, e.value);
@@ -62,101 +62,104 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
62
62
  t !== void 0 && r.push(t);
63
63
  }
64
64
  return r;
65
- }, h = (e) => c.Union(c.Struct({
66
- _tag: c.Literal("snapshot"),
67
- revision: c.Number,
65
+ }, v = (e) => d.Union(d.Struct({
66
+ _tag: d.Literal("snapshot"),
67
+ revision: d.Number,
68
68
  data: e,
69
- computed: c.optional(c.Boolean)
70
- }), c.Struct({
71
- _tag: c.Literal("delta"),
72
- revision: c.Number,
73
- emittedAt: c.Number,
74
- patch: f
75
- }), c.Struct({
76
- _tag: c.Literal("error"),
77
- error: c.Unknown,
78
- revision: c.optional(c.Number)
79
- })), $e = (e) => {
69
+ computed: d.optional(d.Boolean)
70
+ }), d.Struct({
71
+ _tag: d.Literal("delta"),
72
+ revision: d.Number,
73
+ emittedAt: d.Number,
74
+ patch: h
75
+ }), d.Struct({
76
+ _tag: d.Literal("error"),
77
+ error: d.Unknown,
78
+ revision: d.optional(d.Number)
79
+ })), y = (e, t) => {
80
+ let n = `${e ?? "this procedure"} input`;
81
+ return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
82
+ }, Xe = (e) => {
80
83
  let t = e.ast;
81
84
  return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
82
- }, g = (e, t) => {
83
- let n = e.annotations({
85
+ }, b = (e, t, n) => {
86
+ let r = y(t, n), i = e.annotations({
84
87
  parseOptions: { onExcessProperty: "error" },
85
- parseIssueTitle: () => `${t ?? "this procedure"} input`
88
+ parseIssueTitle: () => r
86
89
  });
87
- return $e(e) ? c.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(n).annotations({ identifier: `${t ?? "this procedure"} input` }) : n;
88
- }, _ = class extends c.TaggedError()("BusinessRuleViolation", {
89
- rule: c.String,
90
- params: c.optional(c.Record({
91
- key: c.String,
92
- value: c.Unknown
90
+ return Xe(e) ? d.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
91
+ }, x = class extends d.TaggedError()("BusinessRuleViolation", {
92
+ rule: d.String,
93
+ params: d.optional(d.Record({
94
+ key: d.String,
95
+ value: d.Unknown
93
96
  })),
94
- field: c.optional(c.String),
95
- message: c.optional(c.String),
96
- severity: c.Literal("error", "warning")
97
- }) {}, v = class extends c.TaggedError()("ApprovalRequired", {
98
- approvalId: c.String,
99
- procedure: c.String,
100
- expiresAt: c.String,
101
- requiredScopes: c.Array(c.String),
102
- reason: c.NullOr(c.String),
103
- created: c.Boolean
104
- }) {}, y = class extends c.TaggedError()("ApprovalNotFound", { approvalId: c.String }) {}, b = class extends c.TaggedError()("ApprovalSelfApproval", {
105
- approvalId: c.String,
106
- subjectId: c.NullOr(c.String)
107
- }) {}, x = class extends c.TaggedError()("ApprovalRejected", {
108
- approvalId: c.String,
109
- decidedBy: c.NullOr(c.String),
110
- note: c.NullOr(c.String)
111
- }) {}, S = class extends c.TaggedError()("ApprovalExpired", {
112
- approvalId: c.String,
113
- expiredAt: c.String
114
- }) {}, C = class extends c.TaggedError()("ApprovalNotPending", {
115
- approvalId: c.String,
116
- status: c.String
117
- }) {}, w = class extends c.TaggedError()("ApprovalForbidden", {
118
- approvalId: c.String,
119
- required: c.NullOr(c.String),
120
- message: c.String
121
- }) {}, T = class extends c.TaggedError()("ApprovalUnavailable", {
122
- procedure: c.String,
123
- message: c.String
124
- }) {}, E = c.Union(v, x, S, T), D = c.Union(y, b, S, C, w, T), O = c.Struct({
125
- id: c.String,
126
- procedure: c.String,
127
- kind: c.Literal("mutation", "action"),
128
- requestedBy: c.NullOr(c.String),
129
- status: c.Literal("pending", "approved", "rejected", "expired", "consumed"),
130
- reason: c.NullOr(c.String),
131
- requiredScopes: c.Array(c.String),
132
- requestedAt: c.String,
133
- expiresAt: c.String,
134
- decidedBy: c.NullOr(c.String),
135
- decidedAt: c.NullOr(c.String),
136
- note: c.NullOr(c.String),
137
- relation: c.Literal("to-decide", "requested")
138
- }), k = "channel:", A = Symbol.for("@voltro/protocol/reactivityChannels"), j = globalThis, M = j[A] ?? (j[A] = /* @__PURE__ */ new Map()), et = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, tt = (e) => {
139
- if (!et.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
97
+ field: d.optional(d.String),
98
+ message: d.optional(d.String),
99
+ severity: d.Literal("error", "warning")
100
+ }) {}, S = class extends d.TaggedError()("ApprovalRequired", {
101
+ approvalId: d.String,
102
+ procedure: d.String,
103
+ expiresAt: d.String,
104
+ requiredScopes: d.Array(d.String),
105
+ reason: d.NullOr(d.String),
106
+ created: d.Boolean
107
+ }) {}, C = class extends d.TaggedError()("ApprovalNotFound", { approvalId: d.String }) {}, w = class extends d.TaggedError()("ApprovalSelfApproval", {
108
+ approvalId: d.String,
109
+ subjectId: d.NullOr(d.String)
110
+ }) {}, T = class extends d.TaggedError()("ApprovalRejected", {
111
+ approvalId: d.String,
112
+ decidedBy: d.NullOr(d.String),
113
+ note: d.NullOr(d.String)
114
+ }) {}, E = class extends d.TaggedError()("ApprovalExpired", {
115
+ approvalId: d.String,
116
+ expiredAt: d.String
117
+ }) {}, D = class extends d.TaggedError()("ApprovalNotPending", {
118
+ approvalId: d.String,
119
+ status: d.String
120
+ }) {}, O = class extends d.TaggedError()("ApprovalForbidden", {
121
+ approvalId: d.String,
122
+ required: d.NullOr(d.String),
123
+ message: d.String
124
+ }) {}, k = class extends d.TaggedError()("ApprovalUnavailable", {
125
+ procedure: d.String,
126
+ message: d.String
127
+ }) {}, A = d.Union(S, T, E, k), j = d.Union(C, w, E, D, O, k), M = d.Struct({
128
+ id: d.String,
129
+ procedure: d.String,
130
+ kind: d.Literal("mutation", "action"),
131
+ requestedBy: d.NullOr(d.String),
132
+ status: d.Literal("pending", "approved", "rejected", "expired", "consumed"),
133
+ reason: d.NullOr(d.String),
134
+ requiredScopes: d.Array(d.String),
135
+ requestedAt: d.String,
136
+ expiresAt: d.String,
137
+ decidedBy: d.NullOr(d.String),
138
+ decidedAt: d.NullOr(d.String),
139
+ note: d.NullOr(d.String),
140
+ relation: d.Literal("to-decide", "requested")
141
+ }), N = "channel:", Ze = Symbol.for("@voltro/protocol/reactivityChannels"), Qe = globalThis, P = Qe[Ze] ?? (Qe[Ze] = /* @__PURE__ */ new Map()), $e = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, et = (e) => {
142
+ if (!$e.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
140
143
  \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
141
- the routing key (\`${k}<name>\`), and an uppercase letter is\n refused because a key that differs only by case reads as one channel and
144
+ the routing key (\`${N}<name>\`), and an uppercase letter is\n refused because a key that differs only by case reads as one channel and
142
145
  routes as two.`);
143
- let t = M.get(e);
146
+ let t = P.get(e);
144
147
  if (t !== void 0) return t;
145
- let n = `${k}${e}`, r = Object.freeze({
148
+ let n = `${N}${e}`, r = Object.freeze({
146
149
  kind: "reactivity-channel",
147
150
  name: e,
148
151
  key: n,
149
152
  toString: () => n
150
153
  });
151
- return M.set(e, r), r;
152
- }, N = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", P = (e) => e.startsWith(k), F = () => new Set([...M.values()].map((e) => e.key)), I = (e) => N(e) ? e.key : e, L = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(I) : [I(e)], nt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(I) : I(e), rt = (e) => {
153
- let t = F(), n = [];
154
- for (let r of e) for (let e of L(r.source)) !P(e) || t.has(e) || n.push({
154
+ return P.set(e, r), r;
155
+ }, tt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", nt = (e) => e.startsWith(N), rt = () => new Set([...P.values()].map((e) => e.key)), F = (e) => tt(e) ? e.key : e, it = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(F) : [F(e)], at = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(F) : F(e), ot = (e) => {
156
+ let t = rt(), n = [];
157
+ for (let r of e) for (let e of it(r.source)) !nt(e) || t.has(e) || n.push({
155
158
  procedure: r.name,
156
159
  key: e
157
160
  });
158
161
  return n;
159
- }, it = (e, t) => {
162
+ }, st = (e, t) => {
160
163
  let n = e?.injectExternalChange;
161
164
  return n !== void 0 && (n.call(e, {
162
165
  table: t.key,
@@ -165,8 +168,8 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
165
168
  old: {},
166
169
  origin: "inline"
167
170
  }), !0);
168
- }, at = (e) => e.internal !== !0, R = (e) => {
169
- if (ot(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n at the call site as if this procedure were protected. Omit the field for an
171
+ }, ct = (e) => e.internal !== !0, I = (e) => {
172
+ if (lt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n at the call site as if this procedure were protected. Omit the field for an
170
173
  unguarded procedure, or list the scopes required to call it.`);
171
174
  let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
172
175
  if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n subscribes to nothing — it serves one snapshot and never updates again,
@@ -183,7 +186,7 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
183
186
  let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
184
187
  if (n.length === 0) return e;
185
188
  throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
186
- }, ot = (e) => {
189
+ }, lt = (e) => {
187
190
  let t = e.requiresApproval;
188
191
  if (t !== void 0) {
189
192
  if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -193,48 +196,48 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
193
196
  human from every other, and the second-pair-of-eyes control would enforce nothing.
194
197
  Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
195
198
  }
196
- }, st = (e) => e.action !== void 0 && e.resourceType !== void 0, ct = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, z = (e, n, r) => {
197
- if (r === void 0) return n;
198
- if (r.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n reviewer reads to decide whether this procedure should really be callable
199
+ }, ut = (e) => e.action !== void 0 && e.resourceType !== void 0, dt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, L = (e, t, n) => {
200
+ if (n === void 0) return t;
201
+ if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n reviewer reads to decide whether this procedure should really be callable
199
202
  without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
200
- if (n !== void 0 && n.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n declaring both says the procedure is protected AND open. Keep the guards if a
203
+ if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n declaring both says the procedure is protected AND open. Keep the guards if a
201
204
  caller must hold a scope; drop them if anyone may call it.`);
202
- return [t(r.trim())];
203
- }, B = (e) => R({
205
+ return [u(n.trim())];
206
+ }, R = (e) => I({
204
207
  kind: "query",
205
208
  name: e.name,
206
209
  input: e.input,
207
210
  output: e.output,
208
- error: e.error ?? c.Never,
209
- source: nt(e.source),
211
+ error: e.error ?? d.Never,
212
+ source: at(e.source),
210
213
  cache: e.cache,
211
- guards: z(e.name, e.guards, e.openAccess),
214
+ guards: L(e.name, e.guards, e.openAccess),
212
215
  openAccess: e.openAccess,
213
216
  publicApi: e.publicApi,
214
217
  exposeAsTool: e.exposeAsTool,
215
218
  internal: e.internal,
216
219
  overridesPlugin: e.overridesPlugin
217
- }), V = (e) => R({
220
+ }), z = (e) => I({
218
221
  kind: "mutation",
219
222
  name: e.name,
220
223
  input: e.input,
221
224
  output: e.output,
222
- error: e.error ?? c.Never,
225
+ error: e.error ?? d.Never,
223
226
  target: e.target,
224
- guards: z(e.name, e.guards, e.openAccess),
227
+ guards: L(e.name, e.guards, e.openAccess),
225
228
  openAccess: e.openAccess,
226
229
  publicApi: e.publicApi,
227
230
  exposeAsTool: e.exposeAsTool,
228
231
  requiresApproval: e.requiresApproval,
229
232
  internal: e.internal,
230
233
  overridesPlugin: e.overridesPlugin
231
- }), H = (e) => R({
234
+ }), B = (e) => I({
232
235
  kind: "action",
233
236
  name: e.name,
234
237
  input: e.input,
235
238
  output: e.output,
236
- error: e.error ?? c.Never,
237
- guards: z(e.name, e.guards, e.openAccess),
239
+ error: e.error ?? d.Never,
240
+ guards: L(e.name, e.guards, e.openAccess),
238
241
  openAccess: e.openAccess,
239
242
  source: e.source,
240
243
  target: e.target,
@@ -243,46 +246,50 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
243
246
  requiresApproval: e.requiresApproval,
244
247
  internal: e.internal,
245
248
  overridesPlugin: e.overridesPlugin
246
- }), lt = (e) => R({
249
+ }), ft = (e) => I({
247
250
  kind: "stream",
248
251
  name: e.name,
249
252
  input: e.input,
250
253
  element: e.element,
251
- error: e.error ?? c.Never,
254
+ error: e.error ?? d.Never,
252
255
  internal: e.internal,
253
256
  overridesPlugin: e.overridesPlugin,
254
- guards: z(e.name, e.guards, e.openAccess),
257
+ guards: L(e.name, e.guards, e.openAccess),
255
258
  openAccess: e.openAccess
256
- }), U = (e, t) => t && t.length > 0 ? c.Union(e, ...t) : e, W = (e, t) => t && t.some((e) => !s(e)) ? c.Union(e, r) : e, ut = (e) => c.Union(e, _), dt = (e, t) => t === void 0 ? e : c.Union(e, E), ft = (e, t) => l.make(e.name, {
257
- payload: g(e.input, e.name),
258
- success: h(e.output),
259
- error: U(W(e.error, e.guards), t),
259
+ }), V = (e, t) => t && t.length > 0 ? d.Union(e, ...t) : e, H = (e) => e !== void 0 && e.some((e) => !l(e)), pt = (e, t) => H(t) ? d.Union(e, c, s) : e, mt = (e) => d.Union(e, x), ht = (e, t) => t === void 0 ? e : d.Union(e, A), U = (e, t) => {
260
+ if (t === "stream") return e.error;
261
+ let n = pt(e.error, e.guards);
262
+ return t === "query" ? n : ht(t === "mutation" ? mt(n) : n, e.requiresApproval);
263
+ }, gt = (e, t) => f.make(e.name, {
264
+ payload: b(e.input, e.name, H(e.guards)),
265
+ success: v(e.output),
266
+ error: V(U(e, "query"), t),
260
267
  stream: !0
261
- }), G = (e, t) => l.make(e.name, {
262
- payload: g(e.input, e.name),
268
+ }), _t = (e, t) => f.make(e.name, {
269
+ payload: b(e.input, e.name, H(e.guards)),
263
270
  success: e.output,
264
- error: U(dt(ut(W(e.error, e.guards)), e.requiresApproval), t)
265
- }), pt = (e, t) => l.make(e.name, {
266
- payload: g(e.input, e.name),
271
+ error: V(U(e, "mutation"), t)
272
+ }), vt = (e, t) => f.make(e.name, {
273
+ payload: b(e.input, e.name, H(e.guards)),
267
274
  success: e.output,
268
- error: U(dt(W(e.error, e.guards), e.requiresApproval), t)
269
- }), mt = (e, t) => l.make(e.name, {
270
- payload: g(e.input, e.name),
275
+ error: V(U(e, "action"), t)
276
+ }), yt = (e, t) => f.make(e.name, {
277
+ payload: b(e.input, e.name, H(e.guards)),
271
278
  success: e.element,
272
- error: U(e.error, t),
279
+ error: V(e.error, t),
273
280
  stream: !0
274
- }), ht = (e) => {
281
+ }), bt = (e) => {
275
282
  if (typeof e != "object" || !e) return;
276
283
  let t = e._tag;
277
284
  return typeof t == "string" ? t : void 0;
278
- }, gt = (e) => {
285
+ }, xt = (e) => {
279
286
  switch (e.kind) {
280
- case "query": return ft(e);
281
- case "mutation": return G(e);
282
- case "action": return pt(e);
283
- case "stream": return mt(e);
287
+ case "query": return gt(e);
288
+ case "mutation": return _t(e);
289
+ case "action": return vt(e);
290
+ case "stream": return yt(e);
284
291
  }
285
- }, _t = (e) => {
292
+ }, St = (e) => {
286
293
  let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
287
294
  if (e.kind === "query") return {
288
295
  kind: "query",
@@ -323,7 +330,7 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
323
330
  ..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
324
331
  }))
325
332
  };
326
- }, vt = 7500, yt = (e) => typeof e == "object" && !!e && e.kind === "event", bt = (e) => {
333
+ }, Ct = 7500, wt = (e) => typeof e == "object" && !!e && e.kind === "event", Tt = (e) => {
327
334
  if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
328
335
  if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n The name is used as a broker subject segment. NATS refuses a subject with
329
336
  whitespace and delivers nothing — silently, and only on that broker, so an
@@ -352,75 +359,75 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
352
359
  name: e.name,
353
360
  key: e.key,
354
361
  payload: e.payload,
355
- guards: e.openAccess === void 0 ? e.guards : [t(e.openAccess.trim())],
362
+ guards: e.openAccess === void 0 ? e.guards : [u(e.openAccess.trim())],
356
363
  openAccess: e.openAccess,
357
364
  rewind: e.rewind,
358
365
  webhook: e.webhook,
359
366
  delivery: e.delivery
360
367
  };
361
- }, xt = (e) => c.Struct({
362
- _tag: c.Literal("event"),
363
- origin: c.String,
364
- n: c.Number,
365
- emittedAt: c.Number,
368
+ }, Et = (e) => d.Struct({
369
+ _tag: d.Literal("event"),
370
+ origin: d.String,
371
+ n: d.Number,
372
+ emittedAt: d.Number,
366
373
  payload: e
367
- }), St = c.Struct({
368
- _tag: c.Literal("gap"),
369
- missed: c.Number,
370
- reason: c.Literal("buffer", "resume")
371
- }), Ct = c.Struct({ _tag: c.Literal("attached") }), wt = (e) => c.Union(Ct, xt(e), St), Tt = c.Struct({
372
- origin: c.String,
373
- n: c.Number
374
- }), Et = (e) => c.Struct({
374
+ }), Dt = d.Struct({
375
+ _tag: d.Literal("gap"),
376
+ missed: d.Number,
377
+ reason: d.Literal("buffer", "resume")
378
+ }), Ot = d.Struct({ _tag: d.Literal("attached") }), kt = (e) => d.Union(Ot, Et(e), Dt), At = d.Struct({
379
+ origin: d.String,
380
+ n: d.Number
381
+ }), jt = (e) => d.Struct({
375
382
  key: e,
376
- resume: c.optional(c.Array(Tt))
377
- }), Dt = (e, t) => {
378
- let n = e.guards !== void 0 && e.guards.some((e) => !s(e)) ? r : c.Never, i = t && t.length > 0 ? c.Union(n, ...t) : n;
379
- return l.make(e.name, {
380
- payload: g(Et(e.key), e.name),
381
- success: wt(e.payload),
382
- error: i,
383
+ resume: d.optional(d.Array(At))
384
+ }), Mt = (e, t) => {
385
+ let n = e.guards !== void 0 && e.guards.some((e) => !l(e)) ? d.Union(c, s) : d.Never, r = t && t.length > 0 ? d.Union(n, ...t) : n;
386
+ return f.make(e.name, {
387
+ payload: b(jt(e.key), e.name, H(e.guards)),
388
+ success: kt(e.payload),
389
+ error: r,
383
390
  stream: !0
384
391
  });
385
- }, Ot = class extends c.TaggedError()("EventPayloadInvalid", {
386
- event: c.String,
387
- message: c.String
388
- }) {}, kt = class extends c.TaggedError()("EventKeyInvalid", {
389
- event: c.String,
390
- message: c.String
391
- }) {}, At = class extends c.TaggedError()("EventPayloadTooLarge", {
392
- event: c.String,
393
- bytes: c.Number,
394
- limit: c.Number
395
- }) {}, jt = (e) => {
392
+ }, Nt = class extends d.TaggedError()("EventPayloadInvalid", {
393
+ event: d.String,
394
+ message: d.String
395
+ }) {}, Pt = class extends d.TaggedError()("EventKeyInvalid", {
396
+ event: d.String,
397
+ message: d.String
398
+ }) {}, Ft = class extends d.TaggedError()("EventPayloadTooLarge", {
399
+ event: d.String,
400
+ bytes: d.Number,
401
+ limit: d.Number
402
+ }) {}, It = (e) => {
396
403
  if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
397
404
  let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
398
405
  return JSON.stringify(t);
399
- }, Mt = "\0", Nt = (e, t, n) => [
406
+ }, Lt = "\0", Rt = (e, t, n) => [
400
407
  e ?? "~",
401
408
  t,
402
- jt(n)
403
- ].join("\0"), Pt = (e) => {
409
+ It(n)
410
+ ].join("\0"), zt = (e) => {
404
411
  let [t = "~", n = "", r = ""] = e.split("\0");
405
412
  return {
406
413
  tenantId: t === "~" ? null : t,
407
414
  event: n,
408
415
  key: r
409
416
  };
410
- }, Ft = (e) => e.split("\0").join(" · "), It = (e) => e, Lt = (e) => e, Rt = (e) => {
417
+ }, Bt = (e) => e.split("\0").join(" · "), Vt = (e) => e, Ht = (e) => e, Ut = (e) => {
411
418
  let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
412
419
  return n !== void 0 && n !== "" ? `${r}#${n}` : r;
413
- }, zt = (e) => {
420
+ }, Wt = (e) => {
414
421
  if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
415
- }, Bt = (e, t) => {
416
- let n = Ge.GenericTag(e);
422
+ }, Gt = (e, t) => {
423
+ let n = He.GenericTag(e);
417
424
  return {
418
425
  Tag: n,
419
- Live: Ke.succeed(n, t)
426
+ Live: Ue.succeed(n, t)
420
427
  };
421
- }, Vt = (e, t, n) => {
428
+ }, Kt = (e, t, n) => {
422
429
  if (!t) return { ok: !0 };
423
- let r = K(n);
430
+ let r = W(n);
424
431
  if (!r) return {
425
432
  ok: !1,
426
433
  reason: `cannot parse runningVersion "${n}"`
@@ -428,12 +435,12 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
428
435
  let i = t.trim();
429
436
  if (i === "*" || i === "") return { ok: !0 };
430
437
  let a = i.split(/\s+/).filter((e) => e.length > 0);
431
- for (let i of a) if (!Ht(i, r)) return {
438
+ for (let i of a) if (!qt(i, r)) return {
432
439
  ok: !1,
433
440
  reason: `plugin "${e}" requires framework ${t}, running ${n}`
434
441
  };
435
442
  return { ok: !0 };
436
- }, K = (e) => {
443
+ }, W = (e) => {
437
444
  let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
438
445
  return t ? {
439
446
  major: Number(t[1]),
@@ -441,275 +448,275 @@ var qe = c.Union(c.String, c.Number), u = c.Record({
441
448
  patch: Number(t[3]),
442
449
  pre: t[4] ?? ""
443
450
  } : null;
444
- }, q = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Ht = (e, t) => {
451
+ }, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, qt = (e, t) => {
445
452
  if (e === "*") return !0;
446
453
  if (e.startsWith("^")) {
447
- let n = K(e.slice(1));
448
- return !n || t.major !== n.major ? !1 : q(t, n) >= 0;
454
+ let n = W(e.slice(1));
455
+ return !n || t.major !== n.major ? !1 : G(t, n) >= 0;
449
456
  }
450
457
  if (e.startsWith("~")) {
451
- let n = K(e.slice(1));
452
- return !n || t.major !== n.major || t.minor !== n.minor ? !1 : q(t, n) >= 0;
458
+ let n = W(e.slice(1));
459
+ return !n || t.major !== n.major || t.minor !== n.minor ? !1 : G(t, n) >= 0;
453
460
  }
454
461
  let n = /^(>=|<=|>|<)(.+)$/.exec(e);
455
462
  if (n) {
456
- let e = n[1], r = K(n[2]);
463
+ let e = n[1], r = W(n[2]);
457
464
  if (!r) return !1;
458
- let i = q(t, r);
465
+ let i = G(t, r);
459
466
  if (e === ">=") return i >= 0;
460
467
  if (e === "<=") return i <= 0;
461
468
  if (e === ">") return i > 0;
462
469
  if (e === "<") return i < 0;
463
470
  }
464
- let r = K(e);
465
- return r ? q(t, r) === 0 : !1;
466
- }, J = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), Ut = c.Literal("cancel", "terminate", "abandon"), Wt = c.Struct({
467
- mode: c.String,
468
- dueAt: c.NullOr(c.Number),
469
- retryAfterMs: c.NullOr(c.Number),
470
- intentId: c.NullOr(c.String)
471
- }), Gt = c.Struct({
472
- id: c.String,
473
- workflowName: c.String,
474
- executionId: c.NullOr(c.String),
475
- status: c.Literal("running", "queued", "dropped", "skipped"),
476
- deferral: c.optional(Wt)
477
- }), Y = c.Struct({
478
- id: c.String,
479
- tag: c.String,
480
- executionId: c.String,
481
- status: J,
482
- payload: c.Unknown,
483
- workflowVersion: c.NullOr(c.String),
484
- workflowPatches: c.NullOr(c.Unknown),
485
- output: c.NullOr(c.Unknown),
486
- subject: c.NullOr(c.Unknown),
487
- source: c.NullOr(c.String),
488
- errorTag: c.NullOr(c.String),
489
- errorMessage: c.NullOr(c.String),
490
- cancelled: c.Boolean,
491
- startedAt: c.Date,
492
- completedAt: c.NullOr(c.Date),
493
- durationMs: c.NullOr(c.Number),
494
- traceId: c.NullOr(c.String),
495
- parentExecutionId: c.NullOr(c.String),
496
- parentClosePolicy: c.NullOr(Ut)
497
- }), Kt = c.Struct({
498
- tag: c.optional(c.String),
499
- status: c.optional(J),
500
- limit: c.optional(c.Number)
501
- }), qt = c.Struct({
502
- id: c.String,
503
- runId: c.String,
504
- stepName: c.String,
505
- attempt: c.Number,
506
- status: c.Literal("running", "succeeded", "failed"),
507
- input: c.NullOr(c.Unknown),
508
- retryPolicy: c.NullOr(c.Unknown),
509
- output: c.NullOr(c.Unknown),
510
- errorTag: c.NullOr(c.String),
511
- errorMessage: c.NullOr(c.String),
512
- errorCause: c.NullOr(c.Unknown),
513
- startedAt: c.Date,
514
- completedAt: c.NullOr(c.Date),
515
- durationMs: c.NullOr(c.Number)
516
- }), Jt = c.Struct({
517
- id: c.String,
518
- runId: c.String,
519
- eventType: c.String,
520
- payload: c.NullOr(c.Unknown),
521
- occurredAt: c.Date,
522
- stepName: c.NullOr(c.String),
523
- attempt: c.NullOr(c.Number)
524
- }), Yt = c.Struct({
525
- id: c.String,
526
- name: c.String,
527
- payload: c.Unknown,
528
- source: c.String,
529
- subject: c.NullOr(c.Unknown),
530
- traceId: c.NullOr(c.String),
531
- occurredAt: c.Date
532
- }), Xt = c.Struct({
533
- id: c.String,
534
- eventId: c.String,
535
- eventName: c.String,
536
- triggerId: c.String,
537
- workflowName: c.String,
538
- executionId: c.NullOr(c.String),
539
- status: c.Literal("starting", "started", "skipped", "failed"),
540
- idempotencyKey: c.String,
541
- skipped: c.Boolean,
542
- errorMessage: c.NullOr(c.String),
543
- createdAt: c.Date,
544
- completedAt: c.NullOr(c.Date)
545
- }), Zt = c.Struct({ id: c.String }), X = c.Struct({ runId: c.String }), Qt = c.Struct({
546
- name: c.optional(c.String),
547
- limit: c.optional(c.Number)
548
- }), $t = c.Struct({ eventId: c.String }), Z = c.Struct({
549
- workflowName: c.String,
550
- executionId: c.String
551
- }), en = c.Struct({
552
- id: c.String,
553
- signalName: c.String,
554
- payload: c.optional(c.Unknown)
555
- }), tn = c.Struct({
556
- id: c.String,
557
- updateName: c.String,
558
- payload: c.optional(c.Unknown),
559
- timeoutMs: c.optional(c.Number)
560
- }), nn = c.Struct({
561
- eventId: c.String,
562
- updateId: c.String,
563
- completedEventId: c.String,
564
- result: c.Unknown
565
- }), rn = B({
471
+ let r = W(e);
472
+ return r ? G(t, r) === 0 : !1;
473
+ }, K = d.Literal("running", "succeeded", "failed", "cancelled", "suspended"), Jt = d.Literal("cancel", "terminate", "abandon"), Yt = d.Struct({
474
+ mode: d.String,
475
+ dueAt: d.NullOr(d.Number),
476
+ retryAfterMs: d.NullOr(d.Number),
477
+ intentId: d.NullOr(d.String)
478
+ }), Xt = d.Struct({
479
+ id: d.String,
480
+ workflowName: d.String,
481
+ executionId: d.NullOr(d.String),
482
+ status: d.Literal("running", "queued", "dropped", "skipped"),
483
+ deferral: d.optional(Yt)
484
+ }), q = d.Struct({
485
+ id: d.String,
486
+ tag: d.String,
487
+ executionId: d.String,
488
+ status: K,
489
+ payload: d.Unknown,
490
+ workflowVersion: d.NullOr(d.String),
491
+ workflowPatches: d.NullOr(d.Unknown),
492
+ output: d.NullOr(d.Unknown),
493
+ subject: d.NullOr(d.Unknown),
494
+ source: d.NullOr(d.String),
495
+ errorTag: d.NullOr(d.String),
496
+ errorMessage: d.NullOr(d.String),
497
+ cancelled: d.Boolean,
498
+ startedAt: d.Date,
499
+ completedAt: d.NullOr(d.Date),
500
+ durationMs: d.NullOr(d.Number),
501
+ traceId: d.NullOr(d.String),
502
+ parentExecutionId: d.NullOr(d.String),
503
+ parentClosePolicy: d.NullOr(Jt)
504
+ }), Zt = d.Struct({
505
+ tag: d.optional(d.String),
506
+ status: d.optional(K),
507
+ limit: d.optional(d.Number)
508
+ }), Qt = d.Struct({
509
+ id: d.String,
510
+ runId: d.String,
511
+ stepName: d.String,
512
+ attempt: d.Number,
513
+ status: d.Literal("running", "succeeded", "failed"),
514
+ input: d.NullOr(d.Unknown),
515
+ retryPolicy: d.NullOr(d.Unknown),
516
+ output: d.NullOr(d.Unknown),
517
+ errorTag: d.NullOr(d.String),
518
+ errorMessage: d.NullOr(d.String),
519
+ errorCause: d.NullOr(d.Unknown),
520
+ startedAt: d.Date,
521
+ completedAt: d.NullOr(d.Date),
522
+ durationMs: d.NullOr(d.Number)
523
+ }), $t = d.Struct({
524
+ id: d.String,
525
+ runId: d.String,
526
+ eventType: d.String,
527
+ payload: d.NullOr(d.Unknown),
528
+ occurredAt: d.Date,
529
+ stepName: d.NullOr(d.String),
530
+ attempt: d.NullOr(d.Number)
531
+ }), en = d.Struct({
532
+ id: d.String,
533
+ name: d.String,
534
+ payload: d.Unknown,
535
+ source: d.String,
536
+ subject: d.NullOr(d.Unknown),
537
+ traceId: d.NullOr(d.String),
538
+ occurredAt: d.Date
539
+ }), tn = d.Struct({
540
+ id: d.String,
541
+ eventId: d.String,
542
+ eventName: d.String,
543
+ triggerId: d.String,
544
+ workflowName: d.String,
545
+ executionId: d.NullOr(d.String),
546
+ status: d.Literal("starting", "started", "skipped", "failed"),
547
+ idempotencyKey: d.String,
548
+ skipped: d.Boolean,
549
+ errorMessage: d.NullOr(d.String),
550
+ createdAt: d.Date,
551
+ completedAt: d.NullOr(d.Date)
552
+ }), nn = d.Struct({ id: d.String }), J = d.Struct({ runId: d.String }), rn = d.Struct({
553
+ name: d.optional(d.String),
554
+ limit: d.optional(d.Number)
555
+ }), an = d.Struct({ eventId: d.String }), Y = d.Struct({
556
+ workflowName: d.String,
557
+ executionId: d.String
558
+ }), on = d.Struct({
559
+ id: d.String,
560
+ signalName: d.String,
561
+ payload: d.optional(d.Unknown)
562
+ }), sn = d.Struct({
563
+ id: d.String,
564
+ updateName: d.String,
565
+ payload: d.optional(d.Unknown),
566
+ timeoutMs: d.optional(d.Number)
567
+ }), cn = d.Struct({
568
+ eventId: d.String,
569
+ updateId: d.String,
570
+ completedEventId: d.String,
571
+ result: d.Unknown
572
+ }), ln = R({
566
573
  name: "__voltro.workflow.run",
567
574
  source: "_voltro_workflow_runs",
568
- input: Zt,
569
- output: c.Array(Y)
570
- }), an = B({
575
+ input: nn,
576
+ output: d.Array(q)
577
+ }), un = R({
571
578
  name: "__voltro.workflow.runs",
572
579
  source: "_voltro_workflow_runs",
573
- input: Kt,
574
- output: c.Array(Y)
575
- }), on = B({
580
+ input: Zt,
581
+ output: d.Array(q)
582
+ }), dn = R({
576
583
  name: "__voltro.workflow.run.steps",
577
584
  source: "_voltro_workflow_run_steps",
578
- input: X,
579
- output: c.Array(qt)
580
- }), sn = B({
585
+ input: J,
586
+ output: d.Array(Qt)
587
+ }), fn = R({
581
588
  name: "__voltro.workflow.run.events",
582
589
  source: "_voltro_workflow_run_events",
583
- input: X,
584
- output: c.Array(Jt)
585
- }), cn = B({
590
+ input: J,
591
+ output: d.Array($t)
592
+ }), pn = R({
586
593
  name: "__voltro.workflow.domainEvents",
587
594
  source: "_voltro_workflow_events",
588
- input: Qt,
589
- output: c.Array(Yt)
590
- }), ln = B({
595
+ input: rn,
596
+ output: d.Array(en)
597
+ }), mn = R({
591
598
  name: "__voltro.workflow.event.deliveries",
592
599
  source: "_voltro_workflow_event_deliveries",
593
- input: $t,
594
- output: c.Array(Xt)
595
- }), un = H({
600
+ input: an,
601
+ output: d.Array(tn)
602
+ }), hn = B({
596
603
  name: "__voltro.workflow.cancel",
597
- input: Z,
598
- output: c.Struct({ ok: c.Boolean })
599
- }), dn = H({
604
+ input: Y,
605
+ output: d.Struct({ ok: d.Boolean })
606
+ }), gn = B({
600
607
  name: "__voltro.workflow.resume",
601
- input: Z,
602
- output: c.Struct({ ok: c.Boolean })
603
- }), fn = H({
608
+ input: Y,
609
+ output: d.Struct({ ok: d.Boolean })
610
+ }), _n = B({
604
611
  name: "__voltro.workflow.signal",
605
- input: en,
606
- output: c.Struct({ eventId: c.String })
607
- }), pn = H({
612
+ input: on,
613
+ output: d.Struct({ eventId: d.String })
614
+ }), vn = B({
608
615
  name: "__voltro.workflow.update",
609
- input: tn,
610
- output: nn
611
- }), mn = "__voltro.undo.log", hn = "__voltro.undo.apply", gn = "__voltro.undo.redo", _n = c.Struct({
612
- id: c.String,
613
- tag: c.String,
614
- label: c.NullOr(c.String),
615
- undone: c.Boolean,
616
- crossesAction: c.Boolean,
617
- createdAt: c.String
618
- }), vn = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, yn = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, bn = class extends c.TaggedError()("UndoConflict", {
619
- invocationId: c.String,
620
- reason: c.Literal("conflict", "action")
621
- }) {}, xn = c.Union(vn, yn, bn), Sn = B({
622
- name: mn,
616
+ input: sn,
617
+ output: cn
618
+ }), yn = "__voltro.undo.log", bn = "__voltro.undo.apply", xn = "__voltro.undo.redo", Sn = d.Struct({
619
+ id: d.String,
620
+ tag: d.String,
621
+ label: d.NullOr(d.String),
622
+ undone: d.Boolean,
623
+ crossesAction: d.Boolean,
624
+ createdAt: d.String
625
+ }), Cn = class extends d.TaggedError()("UndoNotFound", { invocationId: d.String }) {}, wn = class extends d.TaggedError()("UndoForbidden", { invocationId: d.String }) {}, X = class extends d.TaggedError()("UndoConflict", {
626
+ invocationId: d.String,
627
+ reason: d.Literal("conflict", "action")
628
+ }) {}, Tn = d.Union(Cn, wn, X), En = R({
629
+ name: yn,
623
630
  source: "_voltro_undo_log",
624
- input: c.Struct({ limit: c.optional(c.Number) }),
625
- output: c.Array(_n),
631
+ input: d.Struct({ limit: d.optional(d.Number) }),
632
+ output: d.Array(Sn),
626
633
  openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
627
- }), Cn = V({
628
- name: hn,
629
- input: c.Struct({ invocationId: c.String }),
630
- output: c.Struct({ ok: c.Boolean }),
631
- error: xn,
634
+ }), Dn = z({
635
+ name: bn,
636
+ input: d.Struct({ invocationId: d.String }),
637
+ output: d.Struct({ ok: d.Boolean }),
638
+ error: Tn,
632
639
  openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
633
- }), wn = V({
634
- name: gn,
635
- input: c.Struct({ invocationId: c.String }),
636
- output: c.Struct({ ok: c.Boolean }),
637
- error: xn,
640
+ }), On = z({
641
+ name: xn,
642
+ input: d.Struct({ invocationId: d.String }),
643
+ output: d.Struct({ ok: d.Boolean }),
644
+ error: Tn,
638
645
  openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
639
- }), Tn = "__voltro.approvals.pending", En = "__voltro.approvals.decide", Dn = B({
640
- name: Tn,
646
+ }), kn = "__voltro.approvals.pending", An = "__voltro.approvals.decide", jn = R({
647
+ name: kn,
641
648
  source: "_voltro_approvals",
642
- input: c.Struct({ limit: c.optional(c.Number) }),
643
- output: c.Array(O),
649
+ input: d.Struct({ limit: d.optional(d.Number) }),
650
+ output: d.Array(M),
644
651
  openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
645
- }), On = V({
646
- name: En,
647
- input: c.Struct({
648
- approvalId: c.String,
649
- decision: c.Literal("approve", "reject"),
650
- note: c.optional(c.String)
652
+ }), Mn = z({
653
+ name: An,
654
+ input: d.Struct({
655
+ approvalId: d.String,
656
+ decision: d.Literal("approve", "reject"),
657
+ note: d.optional(d.String)
651
658
  }),
652
- output: c.Struct({
653
- approvalId: c.String,
654
- status: c.Literal("approved", "rejected")
659
+ output: d.Struct({
660
+ approvalId: d.String,
661
+ status: d.Literal("approved", "rejected")
655
662
  }),
656
- error: D,
663
+ error: j,
657
664
  openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
658
- }), kn = "__voltro.connections.list", An = "__voltro.connections.start", jn = "__voltro.connections.submitToken", Mn = "__voltro.connections.disconnect", Q = c.Literal("oauth2", "pat"), Nn = c.Literal("disconnected", "connected", "expired", "revoked", "error"), Pn = c.Struct({
659
- connectionId: c.String,
660
- kind: Q,
661
- label: c.String,
662
- status: Nn,
663
- accountId: c.NullOr(c.String),
664
- accountLabel: c.NullOr(c.String),
665
- scopes: c.Array(c.String),
666
- expiresAt: c.NullOr(c.String),
667
- lastError: c.NullOr(c.String),
668
- connectedAt: c.NullOr(c.String)
669
- }), Fn = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, In = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, Ln = class extends c.TaggedError()("ConnectionKindMismatch", {
670
- connectionId: c.String,
671
- expected: Q,
672
- actual: Q
673
- }) {}, Rn = class extends c.TaggedError()("ConnectionHandshakeFailed", {
674
- connectionId: c.String,
675
- reason: c.String,
676
- transient: c.Boolean
677
- }) {}, $ = c.Union(Fn, In, Ln, Rn), zn = B({
678
- name: kn,
665
+ }), Nn = "__voltro.connections.list", Pn = "__voltro.connections.start", Fn = "__voltro.connections.submitToken", In = "__voltro.connections.disconnect", Z = d.Literal("oauth2", "pat"), Ln = d.Literal("disconnected", "connected", "expired", "revoked", "error"), Rn = d.Struct({
666
+ connectionId: d.String,
667
+ kind: Z,
668
+ label: d.String,
669
+ status: Ln,
670
+ accountId: d.NullOr(d.String),
671
+ accountLabel: d.NullOr(d.String),
672
+ scopes: d.Array(d.String),
673
+ expiresAt: d.NullOr(d.String),
674
+ lastError: d.NullOr(d.String),
675
+ connectedAt: d.NullOr(d.String)
676
+ }), zn = class extends d.TaggedError()("ConnectionNotDeclared", { connectionId: d.String }) {}, Bn = class extends d.TaggedError()("ConnectionSubjectRequired", { connectionId: d.String }) {}, Vn = class extends d.TaggedError()("ConnectionKindMismatch", {
677
+ connectionId: d.String,
678
+ expected: Z,
679
+ actual: Z
680
+ }) {}, Q = class extends d.TaggedError()("ConnectionHandshakeFailed", {
681
+ connectionId: d.String,
682
+ reason: d.String,
683
+ transient: d.Boolean
684
+ }) {}, $ = d.Union(zn, Bn, Vn, Q), Hn = R({
685
+ name: Nn,
679
686
  source: "_voltro_connections",
680
- input: c.Struct({}),
681
- output: c.Array(Pn),
687
+ input: d.Struct({}),
688
+ output: d.Array(Rn),
682
689
  openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
683
- }), Bn = H({
684
- name: An,
685
- input: c.Struct({
686
- connectionId: c.String,
687
- redirectTo: c.optional(c.String)
690
+ }), Un = B({
691
+ name: Pn,
692
+ input: d.Struct({
693
+ connectionId: d.String,
694
+ redirectTo: d.optional(d.String)
688
695
  }),
689
- output: c.Struct({
690
- authorizeUrl: c.String,
691
- state: c.String
696
+ output: d.Struct({
697
+ authorizeUrl: d.String,
698
+ state: d.String
692
699
  }),
693
700
  error: $,
694
701
  openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
695
- }), Vn = V({
696
- name: jn,
697
- input: c.Struct({
698
- connectionId: c.String,
699
- token: c.String
702
+ }), Wn = z({
703
+ name: Fn,
704
+ input: d.Struct({
705
+ connectionId: d.String,
706
+ token: d.String
700
707
  }),
701
- output: c.Struct({ ok: c.Boolean }),
708
+ output: d.Struct({ ok: d.Boolean }),
702
709
  error: $,
703
710
  openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
704
- }), Hn = V({
705
- name: Mn,
706
- input: c.Struct({ connectionId: c.String }),
707
- output: c.Struct({ ok: c.Boolean }),
711
+ }), Gn = z({
712
+ name: In,
713
+ input: d.Struct({ connectionId: d.String }),
714
+ output: d.Struct({ ok: d.Boolean }),
708
715
  error: $,
709
716
  openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
710
- }), Un = (e) => {
717
+ }), Kn = (e) => {
711
718
  let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
712
719
  return Number.isNaN(t) ? 0 : t;
713
- }, Wn = 1;
720
+ }, qn = 1;
714
721
  //#endregion
715
- export { n as ADMIN_SCOPE, Ne as APIKEY_ISSUE_ORG_SCOPE, ce as APIKEY_ISSUE_OTHER_SCOPE, i as APIKEY_ISSUE_SELF_SCOPE, En as APPROVALS_DECIDE_TAG, Tn as APPROVALS_PENDING_TAG, D as ApprovalDecisionErrors, E as ApprovalErrors, S as ApprovalExpired, w as ApprovalForbidden, y as ApprovalNotFound, C as ApprovalNotPending, x as ApprovalRejected, v as ApprovalRequired, b as ApprovalSelfApproval, T as ApprovalUnavailable, Ae as AuthMiddleware, _ as BusinessRuleViolation, kn as CONNECTIONS_LIST_TAG, Mn as CONNECTION_DISCONNECT_TAG, An as CONNECTION_START_TAG, jn as CONNECTION_SUBMIT_TOKEN_TAG, Rn as ConnectionHandshakeFailed, Te as ConnectionInfo, Oe as ConnectionInfoMiddleware, Q as ConnectionKind, Ln as ConnectionKindMismatch, Fn as ConnectionNotDeclared, Pn as ConnectionState, Nn as ConnectionStatus, In as ConnectionSubjectRequired, be as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, pe as DEFAULT_SCOPE_CACHE_TTL_MS, Mt as EVENT_ROUTE_SEP, kt as EventKeyInvalid, Ot as EventPayloadInvalid, At as EventPayloadTooLarge, Ee as IMPERSONATION_METADATA_KEY, vt as MAX_EVENT_ENVELOPE_BYTES, Wn as PROTOCOL_VERSION, O as PendingApproval, k as REACTIVITY_CHANNEL_PREFIX, r as ScopeError, ke as Subject, he as SubjectIdentity, Ce as SubjectService, hn as UNDO_APPLY_TAG, mn as UNDO_LOG_TAG, gn as UNDO_REDO_TAG, je as Unauthenticated, bn as UndoConflict, yn as UndoForbidden, _n as UndoLogEntry, vn as UndoNotFound, Z as WorkflowControlInputSchema, Yt as WorkflowDomainEventRowSchema, Qt as WorkflowDomainEventsInputSchema, $t as WorkflowEventDeliveriesInputSchema, Xt as WorkflowEventDeliveryRowSchema, Ut as WorkflowParentClosePolicySchema, Jt as WorkflowRunEventRowSchema, Gt as WorkflowRunHandleSchema, Zt as WorkflowRunRefSchema, Y as WorkflowRunRowSchema, J as WorkflowRunStatusSchema, qt as WorkflowRunStepRowSchema, X as WorkflowRunTableRefSchema, Kt as WorkflowRunsInputSchema, en as WorkflowSignalInputSchema, Wt as WorkflowStartDeferralSchema, tn as WorkflowUpdateInputSchema, nn as WorkflowUpdateResultSchema, pt as actionToRpc, ie as advisoryResourceGuardWarning, ge as anonymousSubject, Qe as applyRowPatch, _e as applyScopeDecision, On as approvalsDecideDescriptor, Dn as approvalsPendingQueryDescriptor, De as assertAuthenticated, He as beginIdempotent, Vt as checkFrameworkCompat, Se as checkGuards, e as checkGuardsEffect, we as composeAuthStrategies, zt as composeRpcInterceptors, Hn as connectionDisconnectDescriptor, Bn as connectionStartDescriptor, Vn as connectionSubmitTokenDescriptor, zn as connectionsListQueryDescriptor, F as declaredReactivityChannelKeys, H as defineAction, bt as defineEvent, V as defineMutation, It as definePlugin, Lt as definePluginRoute, Bt as definePluginService, B as defineQuery, lt as defineStream, Xe as diffRows, xe as effectiveScopes, jt as encodeEventKey, ht as errorTag, Ct as eventAttached, xt as eventEnvelope, St as eventGap, Tt as eventResumePoint, Nt as eventRoute, wt as eventStreamEvent, Et as eventSubscribeInput, Dt as eventToRpc, ze as failIdempotent, ne as findAdvisoryResourceGuards, Le as finishIdempotent, Ft as formatEventRoute, re as getPolicyGuardResolver, ae as getResourceScopeResolver, ct as hasAccessDecision, ye as hasCallbackRoutes, a as hasEffectiveScope, te as hasScope, p as idToPath, Ve as idempotencyScope, yt as isEventDescriptor, Ze as isIdKeyed, s as isOpenAccess, oe as isPolicyCheck, st as isPolicyGuard, N as isReactivityChannel, P as isReactivityChannelKey, ve as isSystemSubject, at as isWireReachable, fe as makeScopeCache, Ue as memoryIdempotencyStore, Ie as missingAccessDecision, G as mutationToRpc, _t as normalizeDescriptor, nt as normalizeSource, t as openAccessSpec, Pt as parseEventRoute, Je as pathToId, Rt as pluginInstanceName, it as publishReactivity, We as publishServerError, ft as queryToRpc, Me as rawImpersonationMark, tt as reactivityChannel, ue as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, Fe as scopeCacheKey, ee as setEffectiveScopes, le as setPolicyGuardResolver, de as setResourceScopeResolver, L as sourceKeys, mt as streamToRpc, g as strictInput, me as subjectIdentity, o as subjectScopes, Be as subscribeServerErrors, h as subscriptionEvent, Pe as systemSubject, se as tenantScopedSubject, gt as toRpc, Un as tsMs, rt as undeclaredChannelKeys, Cn as undoApplyDescriptor, Sn as undoLogQueryDescriptor, wn as undoRedoDescriptor, un as workflowCancelDescriptor, cn as workflowDomainEventsQueryDescriptor, ln as workflowEventDeliveriesQueryDescriptor, dn as workflowResumeDescriptor, sn as workflowRunEventsQueryDescriptor, rn as workflowRunQueryDescriptor, on as workflowRunStepsQueryDescriptor, an as workflowRunsQueryDescriptor, fn as workflowSignalDescriptor, pn as workflowUpdateDescriptor, Re as wsMutationIdempotencyScope };
722
+ export { Oe as ADMIN_SCOPE, Ce as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, ve as APIKEY_ISSUE_SELF_SCOPE, An as APPROVALS_DECIDE_TAG, kn as APPROVALS_PENDING_TAG, j as ApprovalDecisionErrors, A as ApprovalErrors, E as ApprovalExpired, O as ApprovalForbidden, C as ApprovalNotFound, D as ApprovalNotPending, T as ApprovalRejected, S as ApprovalRequired, w as ApprovalSelfApproval, k as ApprovalUnavailable, Ae as AuthMiddleware, x as BusinessRuleViolation, Nn as CONNECTIONS_LIST_TAG, In as CONNECTION_DISCONNECT_TAG, Pn as CONNECTION_START_TAG, Fn as CONNECTION_SUBMIT_TOKEN_TAG, Q as ConnectionHandshakeFailed, ce as ConnectionInfo, i as ConnectionInfoMiddleware, Z as ConnectionKind, Vn as ConnectionKindMismatch, zn as ConnectionNotDeclared, Rn as ConnectionState, Ln as ConnectionStatus, Bn as ConnectionSubjectRequired, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ie as DEFAULT_SCOPE_CACHE_TTL_MS, Lt as EVENT_ROUTE_SEP, Pt as EventKeyInvalid, Nt as EventPayloadInvalid, Ft as EventPayloadTooLarge, be as IMPERSONATION_METADATA_KEY, Ct as MAX_EVENT_ENVELOPE_BYTES, qn as PROTOCOL_VERSION, M as PendingApproval, N as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, e as Subject, ye as SubjectIdentity, re as SubjectService, bn as UNDO_APPLY_TAG, yn as UNDO_LOG_TAG, xn as UNDO_REDO_TAG, s as Unauthenticated, X as UndoConflict, wn as UndoForbidden, Sn as UndoLogEntry, Cn as UndoNotFound, Y as WorkflowControlInputSchema, en as WorkflowDomainEventRowSchema, rn as WorkflowDomainEventsInputSchema, an as WorkflowEventDeliveriesInputSchema, tn as WorkflowEventDeliveryRowSchema, Jt as WorkflowParentClosePolicySchema, $t as WorkflowRunEventRowSchema, Xt as WorkflowRunHandleSchema, nn as WorkflowRunRefSchema, q as WorkflowRunRowSchema, K as WorkflowRunStatusSchema, Qt as WorkflowRunStepRowSchema, J as WorkflowRunTableRefSchema, Zt as WorkflowRunsInputSchema, on as WorkflowSignalInputSchema, Yt as WorkflowStartDeferralSchema, sn as WorkflowUpdateInputSchema, cn as WorkflowUpdateResultSchema, vt as actionToRpc, we as advisoryResourceGuardWarning, ae as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, Mn as approvalsDecideDescriptor, jn as approvalsPendingQueryDescriptor, te as assertAuthenticated, ze as beginIdempotent, Kt as checkFrameworkCompat, De as checkGuards, me as checkGuardsEffect, ne as composeAuthStrategies, Wt as composeRpcInterceptors, Gn as connectionDisconnectDescriptor, Un as connectionStartDescriptor, Wn as connectionSubmitTokenDescriptor, Hn as connectionsListQueryDescriptor, rt as declaredReactivityChannelKeys, B as defineAction, Tt as defineEvent, z as defineMutation, Vt as definePlugin, Ht as definePluginRoute, Gt as definePluginService, R as defineQuery, ft as defineStream, qe as diffRows, xe as effectiveScopes, It as encodeEventKey, bt as errorTag, Ot as eventAttached, Et as eventEnvelope, Dt as eventGap, At as eventResumePoint, Rt as eventRoute, kt as eventStreamEvent, jt as eventSubscribeInput, Mt as eventToRpc, Ie as failIdempotent, ke as findAdvisoryResourceGuards, Pe as finishIdempotent, Bt as formatEventRoute, he as getPolicyGuardResolver, ge as getResourceScopeResolver, dt as hasAccessDecision, oe as hasCallbackRoutes, Te as hasEffectiveScope, H as hasEnforcedGuard, Se as hasScope, g as idToPath, Re as idempotencyScope, y as inputLabel, wt as isEventDescriptor, Je as isIdKeyed, l as isOpenAccess, _e as isPolicyCheck, ut as isPolicyGuard, tt as isReactivityChannel, nt as isReactivityChannelKey, Ne as isSystemSubject, ct as isWireReachable, t as makeScopeCache, Be as memoryIdempotencyStore, fe as missingAccessDecision, _t as mutationToRpc, St as normalizeDescriptor, at as normalizeSource, u as openAccessSpec, zt as parseEventRoute, Ge as pathToId, Ut as pluginInstanceName, st as publishReactivity, Ve as publishServerError, gt as queryToRpc, ue as rawImpersonationMark, et as reactivityChannel, Me as requireScope, m as rowPatchOpSchema, h as rowPatchSchema, ee as scopeCacheKey, pe as setEffectiveScopes, je as setPolicyGuardResolver, se as setResourceScopeResolver, it as sourceKeys, yt as streamToRpc, b as strictInput, le as subjectIdentity, n as subjectScopes, Le as subscribeServerErrors, v as subscriptionEvent, de as systemSubject, o as tenantScopedSubject, xt as toRpc, Kn as tsMs, ot as undeclaredChannelKeys, Dn as undoApplyDescriptor, En as undoLogQueryDescriptor, On as undoRedoDescriptor, U as wireErrorUnion, hn as workflowCancelDescriptor, pn as workflowDomainEventsQueryDescriptor, mn as workflowEventDeliveriesQueryDescriptor, gn as workflowResumeDescriptor, fn as workflowRunEventsQueryDescriptor, ln as workflowRunQueryDescriptor, dn as workflowRunStepsQueryDescriptor, un as workflowRunsQueryDescriptor, _n as workflowSignalDescriptor, vn as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };