@voltro/protocol 0.63.0 → 0.64.0

package/dist/rest.d.ts

@@ -532,7 +532,10 @@ declare interface PluginHttpRouteResult {
     readonly status: number;
     readonly body?: string | Uint8Array;
     readonly contentType?: string;
-    readonly headers?: Record<string, string>;
+    /** Response headers. A header that repeats — two `Set-Cookie` lines, a
+     *  session and a CSRF cookie from one login — is an ARRAY; `set-cookie`
+     *  arrays become separate lines, every other array joins with `, `. */
+    readonly headers?: Record<string, string | ReadonlyArray<string>>;
     /** Stream the response (SSE) instead of sending `body`. See
      *  {@link PluginHttpRouteStream}. */
     readonly stream?: PluginHttpRouteStream;

package/dist/rest.js

@@ -1,5 +1,5 @@
-import { P as e } from "./scopes-B0kGvAnI.js";
-import { a as t, i as n, o as r, r as i, t as a } from "./serverErrorBus-BeN9pOpY.js";
+import { P as e } from "./scopes-D9t3tYc7.js";
+import { a as t, c as n, o as r, s as i, t as a } from "./serverErrorBus-QQgyq6fV.js";
 import { Effect as o, Schema as s } from "effect";
 //#region src/publicApi.ts
 var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.path ?? `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`, u = (e, t, n) => {
@@ -141,9 +141,9 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 				let t = await e(g);
 				if (t) return x(t.status, { error: t.message }, f);
 			}
-			let v = l.idempotency, S = v && E.has(c.method) ? s.headers[v.header.toLowerCase()] : void 0, C = v && S ? r(h.tenantId, c.method, c.path) : "";
+			let v = l.idempotency, S = v && E.has(c.method) ? s.headers[v.header.toLowerCase()] : void 0, C = v && S ? n(h.tenantId, c.method, c.path) : "";
 			if (v && S) {
-				let e = await i(v.store, C, S, v.ttlMs, Date.now());
+				let e = await t(v.store, C, S, v.ttlMs, Date.now());
 				if (e.kind === "replay") return x(e.response.status, e.response.body, {
 					...f,
 					"Idempotency-Replayed": "true"
@@ -152,7 +152,7 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 			}
 			try {
 				let e = await c.handler(m, g);
-				if (_(e) || y(e)) return v && S && await n(v.store, C, S), y(e) ? {
+				if (_(e) || y(e)) return v && S && await r(v.store, C, S), y(e) ? {
 					status: 200,
 					headers: f,
 					byteStream: e.byteStream,
@@ -162,26 +162,26 @@ var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.
 					headers: f,
 					stream: e.stream
 				};
-				let r = await o.runPromise(d(e));
-				if (v && S && await t(v.store, C, S, {
+				let t = await o.runPromise(d(e));
+				if (v && S && await i(v.store, C, S, {
 					status: 200,
-					body: r
+					body: t
 				}, Date.now()), c.etag === !0 && c.method === "GET") {
-					let e = `W/"${await b(JSON.stringify(r))}"`, t = s.headers["if-none-match"];
-					return t !== void 0 && t.split(",").some((t) => t.trim() === e) ? {
+					let e = `W/"${await b(JSON.stringify(t))}"`, n = s.headers["if-none-match"];
+					return n !== void 0 && n.split(",").some((t) => t.trim() === e) ? {
 						status: 304,
 						headers: {
 							...f,
 							ETag: e
 						}
-					} : x(200, r, {
+					} : x(200, t, {
 						...f,
 						ETag: e
 					});
 				}
-				return x(200, r, f);
+				return x(200, t, f);
 			} catch (e) {
-				if (v && S && await n(v.store, C, S), typeof e == "object" && e && typeof e.status == "number") {
+				if (v && S && await r(v.store, C, S), typeof e == "object" && e && typeof e.status == "number") {
 					let t = e;
 					return x(t.status, { error: t.message ?? "Error" }, f);
 				}

package/dist/{scopes-B0kGvAnI.js → scopes-D9t3tYc7.js}

@@ -33,21 +33,21 @@ var i = n.Record({
 	tenantId: n.Null,
 	scopes: a,
 	metadata: n.optional(i)
-}), ee = n.Union(o, s, c, l, u), d = n.Union(o.omit("scopes"), s.omit("scopes"), c.omit("scopes"), l, u.omit("scopes")), f = (e) => {
+}), d = n.Union(o, s, c, l, u), f = n.Union(o.omit("scopes"), s.omit("scopes"), c.omit("scopes"), l, u.omit("scopes")), p = (e) => {
 	if (e.type === "anonymous") return e;
 	let { scopes: t, ...n } = e;
 	return n;
-}, te = (e) => e.scopes ?? [], p = (e, t) => ({
+}, m = (e) => e.scopes ?? [], h = (e, t) => ({
 	type: "anonymous",
 	id: null,
 	tenantId: e,
 	...t === void 0 ? {} : { credentialRejected: t }
-}), m = (e, t = ["admin:full"]) => ({
+}), ee = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), h = (e, t) => {
+}), te = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
@@ -56,15 +56,16 @@ var i = n.Record({
 		scopes: n.scopes ?? ["admin:full"],
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, C = (e) => typeof e.mountRoutes == "function", w = (e) => Array.isArray(e) ? {
+}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, ne = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, S = (e) => typeof e.mountRoutes == "function", C = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, T = (e, t) => {
+} : e, w = (e, t) => {
+	if (t.kind === "vetoed") throw new k({ reason: `${t.code}: ${t.message}` });
 	if (e.type === "anonymous") return {
 		subject: e,
 		removed: []
 	};
-	let n = te(e);
+	let n = m(e);
 	if (t.kind === "grant") {
 		if (t.scopes.length === 0) return {
 			subject: e,
@@ -87,14 +88,14 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, ne = 3e4, re = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ie = () => {
+}, re = 3e4, ie = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, D = (e = {}) => {
-	let t = e.ttlMs ?? ie() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+}, E = (e = {}) => {
+	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -130,80 +131,108 @@ var i = n.Record({
 			};
 		}
 	};
-}, O = (e) => typeof e.resolve == "function", k = (e, t) => {
-	let n = t?.resolveScopes, r = n === void 0 || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && O(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
-	return async (i) => {
-		let a = t?.getStore?.(), o = a === void 0 ? i : {
-			...i,
-			store: a
-		}, s;
-		for (let i of e) {
-			let e = await i.resolve(o);
+}, D = (e) => typeof e.resolve == "function", O = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && D(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
+	return async (o) => {
+		let s = t?.getStore?.(), c = s === void 0 ? o : {
+			...o,
+			store: s
+		}, l;
+		for (let o of e) {
+			let e = await o.resolve(c);
 			if (e.kind === "matched") {
-				let a = e.subject;
-				if (n !== void 0) {
-					let s = async () => w(await n(e.subject, o)), { decision: c, fresh: l } = r === null ? {
-						decision: await s(),
+				let s = e.subject;
+				if (i) {
+					let i = async () => {
+						let t = n === void 0 ? {
+							kind: "grant",
+							scopes: []
+						} : C(await n(e.subject, c));
+						if (t.kind === "unavailable" || r.length === 0) return t;
+						let i = w(e.subject, t).subject, a = {
+							origin: "request",
+							headers: c.headers,
+							clientId: c.clientId,
+							store: c.store
+						};
+						for (let e of r) {
+							let t = await e(i, a);
+							if (!t.ok) return {
+								kind: "vetoed",
+								code: t.code,
+								message: t.message
+							};
+						}
+						return t;
+					}, { decision: l, fresh: u } = a === null ? {
+						decision: await i(),
 						fresh: !0
-					} : await r.resolve(E(e.subject), s);
-					if (c.kind === "unavailable") {
-						let e = `scope resolution unavailable: ${c.reason}`;
+					} : await a.resolve(T(e.subject), i);
+					if (l.kind === "vetoed") {
+						let e = `${l.code}: ${l.message}`;
 						throw t?.onStrategyFailed?.({
-							strategyId: i.id,
+							strategyId: o.id,
 							reason: e
-						}), new A({ reason: e });
+						}), new k({ reason: e });
 					}
-					let u = T(e.subject, c);
-					l && u.removed.length > 0 && t?.onScopesNarrowed?.({
-						strategyId: i.id,
+					if (l.kind === "unavailable") {
+						let e = `scope resolution unavailable: ${l.reason}`;
+						throw t?.onStrategyFailed?.({
+							strategyId: o.id,
+							reason: e
+						}), new k({ reason: e });
+					}
+					let d = w(e.subject, l);
+					u && d.removed.length > 0 && t?.onScopesNarrowed?.({
+						strategyId: o.id,
 						subjectType: e.subject.type,
 						subjectId: e.subject.id,
-						removed: u.removed,
-						granted: c.scopes
-					}), a = u.subject;
+						removed: d.removed,
+						granted: l.scopes
+					}), s = d.subject;
 				}
-				return e.credentialExpiresAt === void 0 ? { subject: a } : {
-					subject: a,
+				return e.credentialExpiresAt === void 0 ? { subject: s } : {
+					subject: s,
 					credentialExpiresAt: e.credentialExpiresAt
 				};
 			}
 			if (e.kind === "failed") {
 				t?.onStrategyFailed?.({
-					strategyId: i.id,
+					strategyId: o.id,
 					reason: e.reason
-				}), s = e.reason;
+				}), l = e.reason;
 				break;
 			}
 		}
-		let c = (e) => s !== void 0 && e.type === "anonymous" ? {
+		let u = (e) => l !== void 0 && e.type === "anonymous" ? {
 			...e,
-			credentialRejected: s
+			credentialRejected: l
 		} : e;
-		if (t?.fallback) return { subject: c(await t.fallback(o)) };
-		let l = o.headers["x-tenant"] ?? null;
-		if (l === null && t?.anonymousTenantRequired === !0) throw new A({ reason: "tenant required (x-tenant header missing)" });
-		return { subject: c(p(l)) };
+		if (t?.fallback) return { subject: u(await t.fallback(c)) };
+		let d = c.headers["x-tenant"] ?? null;
+		if (d === null && t?.anonymousTenantRequired === !0) throw new k({ reason: "tenant required (x-tenant header missing)" });
+		return { subject: u(h(d)) };
 	};
-}, A = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, j = (e, t) => {
-	if (e.type === "anonymous") throw new A(t === void 0 ? {} : { reason: t });
-}, M = "admin:full", N = "apikeys:issue:self", P = "apikeys:issue:org", F = "apikeys:issue:other", I = class extends n.TaggedError()("ScopeError", {
+}, k = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, A = (e, t) => {
+	if (e.type === "anonymous") throw new k(t === void 0 ? {} : { reason: t });
+}, j = "admin:full", M = "apikeys:issue:self", N = "apikeys:issue:org", P = "apikeys:issue:other", F = class extends n.TaggedError()("ScopeError", {
 	required: n.String,
 	message: n.String
-}) {}, L = (e) => "scopes" in e && e.scopes ? e.scopes : [], R = /* @__PURE__ */ new WeakMap(), z = (e, t) => {
-	typeof e == "object" && e && R.set(e, t);
-}, B = (e) => {
+}) {}, I = (e) => "scopes" in e && e.scopes ? e.scopes : [], L = /* @__PURE__ */ new WeakMap(), R = (e, t) => {
+	typeof e == "object" && e && L.set(e, t);
+}, z = (e) => {
 	if (typeof e == "object" && e) {
-		let t = R.get(e);
+		let t = L.get(e);
 		if (t) return t;
 	}
-	return L(e);
-}, V = (e, t) => {
-	let n = B(e);
+	return I(e);
+}, B = (e, t) => {
+	let n = z(e);
 	return n.includes("admin:full") || n.includes(t);
-}, H = (e, t) => {
-	let n = L(e);
+}, V = (e, t) => {
+	let n = I(e);
 	return n.includes("admin:full") || n.includes(t);
-}, ae = (e, n) => V(e, n) ? t.void : t.fail(new I({
+}, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
 	required: n,
 	message: `missing required scope '${n}'`
 })), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => ({ open: e }), K = (e) => typeof e == "string" ? [e] : e, q, J = (e) => {
@@ -224,29 +253,29 @@ var i = n.Record({
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
 ].join("\n"), ce = () => q, Y, le = (e) => {
 	Y = e;
-}, X = () => Y, Z = (e) => new I({
+}, X = () => Y, Z = (e) => new F({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
 	let n = e.credentialRejected;
-	return n === void 0 ? t : new A({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
+	return n === void 0 ? t : new k({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
 }, $ = (e, t, n) => {
 	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
 	for (let n of t) {
 		if (W(n)) continue;
 		if (U(n)) {
-			if (V(e, "admin:full")) continue;
-			return Q(e, new I({
+			if (B(e, "admin:full")) continue;
+			return Q(e, new F({
 				required: `${n.resourceType}:${n.action}`,
 				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
 			}));
 		}
 		let t = K(n.scope);
 		if (t.length === 0) continue;
-		let r = t.filter((t) => V(e, t));
+		let r = t.filter((t) => B(e, t));
 		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !V(e, t));
-			return Q(e, new I({
+			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !B(e, t));
+			return Q(e, new F({
 				required: r,
 				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
 			}));
@@ -254,11 +283,11 @@ var i = n.Record({
 	}
 	return null;
 }, ue = (e, n, r) => {
-	let i = (e) => new I({
+	let i = (e) => new F({
 		required: `${n.resourceType}:${n.action}`,
 		message: e
 	});
-	if (V(e, "admin:full")) return t.succeed(null);
+	if (B(e, "admin:full")) return t.succeed(null);
 	let a = Y;
 	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
 	let o = n.resource(r);
@@ -283,7 +312,7 @@ var i = n.Record({
 			if (n.length === 0) continue;
 			let o = i.resource ? i.resource(r) : void 0, s = [];
 			for (let r of n) {
-				if (V(e, r)) {
+				if (B(e, r)) {
 					s.push(!0);
 					continue;
 				}
@@ -299,7 +328,7 @@ var i = n.Record({
 			let c = i.mode ?? "all";
 			if (!(c === "any" ? s.some(Boolean) : s.every(Boolean))) {
 				let e = c === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				return new I({
+				return new F({
 					required: e,
 					message: c === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (o === void 0 ? "" : ` on resource '${o}'`)
 				});
@@ -309,4 +338,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { ee as A, D as B, L as C, re as D, S as E, T as F, h as G, E as H, j as I, k as L, y as M, A as N, ne as O, p as P, C as R, J as S, b as T, f as U, v as V, m as W, Z as _, I as a, z as b, de as c, X as d, ce as f, U as g, W as h, N as i, d as j, _ as k, B as l, H as m, P as n, se as o, V as p, F as r, $ as s, M as t, oe as u, G as v, x as w, le as x, ae as y, g as z };
+export { d as A, E as B, I as C, ie as D, ne as E, w as F, te as G, T as H, A as I, O as L, y as M, k as N, re as O, h as P, S as R, J as S, b as T, p as U, v as V, ee as W, Z as _, F as a, R as b, de as c, X as d, ce as f, U as g, W as h, M as i, f as j, _ as k, z as l, V as m, N as n, se as o, B as p, P as r, $ as s, j as t, oe as u, G as v, x as w, le as x, H as y, g as z };

package/dist/{serverErrorBus-BeN9pOpY.js → serverErrorBus-QQgyq6fV.js}

@@ -1,11 +1,12 @@
+import { Schema as e } from "effect";
 //#region src/idempotency.ts
-var e = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, t = (e, t, n) => `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}`, n = async (e, t, n, r, i) => {
+var t = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, n = (e, t, n) => `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}`, r = async (e, t, n, r, i) => {
 	let a = await e.claim(t, n, i, r);
 	return a === "claimed" ? { kind: "fresh" } : a.status === "completed" && a.response ? {
 		kind: "replay",
 		response: a.response
 	} : { kind: "conflict" };
-}, r = (e, t, n, r, i) => e.complete(t, n, r, i), i = (e, t, n) => e.release(t, n), a = () => {
+}, i = (e, t, n, r, i) => e.complete(t, n, r, i), a = (e, t, n) => e.release(t, n), o = () => {
 	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
 	return {
 		get: async (n, r) => e.get(t(n, r)) ?? null,
@@ -32,12 +33,19 @@ var e = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, t = (e, t, n)
 			e.delete(t(n, r));
 		}
 	};
-}, o = /* @__PURE__ */ new Set(), s = (e) => {
-	for (let t of o) try {
+}, s = class extends e.TaggedError()("MutationInFlight", {
+	traceId: e.String,
+	retryAfterMs: e.Number
+}) {
+	get message() {
+		return `a request with this idempotency key is still in flight — replay the same key after ${this.retryAfterMs}ms`;
+	}
+}, c = 1e3, l = /* @__PURE__ */ new Set(), u = (e) => {
+	for (let t of l) try {
 		t(e);
 	} catch {}
-}, c = (e) => (o.add(e), () => {
-	o.delete(e);
+}, d = (e) => (l.add(e), () => {
+	l.delete(e);
 });
 //#endregion
-export { r as a, t as c, i, c as n, e as o, n as r, a as s, s as t };
+export { r as a, t as c, s as i, o as l, d as n, a as o, c as r, i as s, u as t, n as u };

package/dist/session.js

@@ -1,4 +1,4 @@
-import { C as e, U as t, j as n } from "./scopes-B0kGvAnI.js";
+import { C as e, U as t, j as n } from "./scopes-D9t3tYc7.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -59,8 +59,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.63.0",
-    "@voltro/logger": "0.63.0",
+    "@voltro/database": "0.64.0",
+    "@voltro/logger": "0.64.0",
     "jose": "^6.2.8"
   },
   "peerDependencies": {