@voltro/protocol 0.68.0 → 0.69.1

package/dist/rest.d.ts

@@ -1,3 +1,4 @@
+import * as AST from 'effect/SchemaAST';
 import { DataStore } from '@voltro/database';
 import { Schema } from 'effect';
 
@@ -104,6 +105,22 @@ export declare const bytes: (stream: ReadableStream<Uint8Array> | (() => Readabl
     readonly headers?: Readonly<Record<string, string | ReadonlyArray<string>>>;
 }) => RestByteResponse;
 
+/**
+ * Coerce a decoded query-string object toward the ENCODED shape of `input`.
+ * Field by field for a struct; the object is returned unchanged for any other
+ * shape (the schema then decides). Unknown keys pass through untouched.
+ */
+export declare const coerceQueryObject: (query: unknown, input: Schema.Schema.All) => unknown;
+
+/**
+ * Coerce ONE query-string value toward what `ast` (an ENCODED shape) expects.
+ * Only a value that reads unambiguously as the target is converted; anything
+ * else is left for the schema to refuse with its own message. Refinements are
+ * looked through to their base; a union tries each arm and takes the first
+ * that changed the value.
+ */
+export declare const coerceQueryValue: (value: unknown, ast: AST.AST) => unknown;
+
 /**
  * Project every descriptor carrying a `publicApi` annotation into a REST
  * route, in stable (path) order. The boot layer feeds these straight into
@@ -123,6 +140,9 @@ export declare const collectPublicApiRoutes: (entries: ReadonlyArray<PublicApiEn
  */
 declare type DeclaredAccess<Input = unknown> = ReadonlyArray<AnyGuardSpec<Input> | OpenAccessSpec>;
 
+/** The `_tag` literals a descriptor's `error:` union declares (empty for none). */
+export declare const declaredErrorTags: (error: Schema.Schema.All | undefined) => ReadonlySet<string>;
+
 /**
  * Identity helper that fixes the descriptor's types (like `defineAction` /
  * `definePlugin`). Returns its argument unchanged at runtime; exists for
@@ -629,6 +649,16 @@ declare interface PolicyGuardSpec<Input = unknown> {
     readonly resource: (input: Input) => string | undefined;
 }
 
+/**
+ * Translate a handler's failure into the response the projection promised:
+ * a DECLARED typed error becomes a `RestRouteError` with the tag, the fields
+ * and the status `errorStatus` assigns (`422` by default, the status the
+ * OpenAPI projection already documents for a typed error). Anything else is
+ * rethrown for the desugar's shared mapping (`ScopeError` → 403/401, a
+ * `status`-carrying error → itself, the rest → 500).
+ */
+export declare const projectedFailure: (err: unknown, descriptor: PublicApiDescriptor, spec: PublicApiSpec) => unknown;
+
 /** A descriptor kind that can be projected to REST (streams are not, in v1). */
 export declare type PublicApiDescriptor = QueryProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All> | MutationProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All> | ActionProcedureDescriptor<string, Schema.Schema.Any, Schema.Schema.Any, Schema.Schema.All>;
 
@@ -650,11 +680,12 @@ export declare type PublicApiInvoke = (input: unknown, ctx: RestRouteContext) =>
 /**
  * Synthesize the public REST route for ONE descriptor. The descriptor's input
  * schema is wrapped into the REST `{ query }` (GET) / `{ body }` (other) shape
- * the desugar decodes, then handed UNWRAPPED to `invoke`. Output is the
- * descriptor's output schema verbatim (a query is drained to its first snapshot
- * by the serve layer — same as POST /rpc — unless `stream: 'sse'` streams it).
- * `scopes` become
- * `requireScope` guards on top of the handler's own RBAC.
+ * the desugar decodes — for GET behind a query-string coercion — then handed
+ * UNWRAPPED to `invoke`. Output is the descriptor's output schema verbatim (a
+ * query is drained to its first snapshot by the serve layer — same as POST
+ * /rpc — unless `stream: 'sse'` streams it). The guards are
+ * `requireAuthenticated()` unless the descriptor declares `openAccess`, then
+ * one `requireScope` per `scopes` entry, on top of the handler's own RBAC.
  */
 export declare const publicApiRoute: (descriptor: PublicApiDescriptor, invoke: PublicApiInvoke, subscribe?: PublicApiSubscribe) => RestRouteDescriptor<Record<string, unknown>, unknown>;
 
@@ -683,6 +714,17 @@ declare interface PublicApiSpec {
     /** Streaming queries over request/response: 'snapshot' (default — first
      *  snapshot, like POST /rpc) | 'sse' (Server-Sent Events of snapshot+deltas). */
     readonly stream?: 'snapshot' | 'sse';
+    /**
+     * HTTP status per DECLARED typed error tag, for the projection. A typed
+     * error the handler fails with — one of the descriptor's `error:` union —
+     * answers with its tag and fields as the body, and this status; a tag not
+     * listed here answers `422`, the status the OpenAPI projection documents
+     * for a typed error. The framework's own `ScopeError` is mapped
+     * before this (`403`, or `401` for an anonymous caller) and needs no entry.
+     *
+     *     publicApi: { errorStatus: { AccessDeniedError: 403, NotFoundError: 404 } }
+     */
+    readonly errorStatus?: Readonly<Record<string, number>>;
 }
 
 /**

package/dist/rest.js

@@ -1,56 +1,145 @@
-import { F as e, P as t } from "./scopes-C86BDyNJ.js";
+import { F as e, P as t } from "./scopes-DVtiKKsm.js";
 import { c as n, l as r, o as i, s as a, t as o } from "./serverErrorBus-BTnTpMqj.js";
 import { Effect as s, Schema as c } from "effect";
+import * as l from "effect/SchemaAST";
 //#region src/publicApi.ts
-var l = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), u = (e, t) => t.path ?? `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`, d = (e, t, n) => {
+var u = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), d = (e, t) => t.path ?? `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`, f = (e) => {
+	if (l.isUnion(e)) {
+		let t = e.types.filter((e) => !l.isUndefinedKeyword(e));
+		if (t.length === 1) return t[0];
+		if (t.length !== e.types.length) return l.Union.make(t);
+	}
+	return e;
+}, p = /^-?(\d+\.?\d*|\.\d+)(e[+-]?\d+)?$/i, m = (e, t) => {
+	let n = f(t);
+	if (l.isRefinement(n) || l.isTransformation(n)) return m(e, n.from);
+	if (l.isUnion(n)) {
+		for (let t of n.types) {
+			let n = m(e, t);
+			if (n !== e) return n;
+		}
+		return e;
+	}
+	if (l.isTupleType(n)) {
+		let t = Array.isArray(e) ? e : e === void 0 ? void 0 : [e];
+		if (t === void 0) return e;
+		let r = n.rest[0]?.type ?? n.elements[0]?.type;
+		return r === void 0 ? t : t.map((e) => m(e, r));
+	}
+	if (typeof e != "string") return e;
+	if (l.isNumberKeyword(n)) return p.test(e.trim()) ? Number(e) : e;
+	if (l.isBooleanKeyword(n)) return e === "true" || e !== "false" && e;
+	if (l.isLiteral(n)) {
+		let t = n.literal;
+		return typeof t == "number" && p.test(e.trim()) && Number(e) === t || typeof t == "boolean" && String(t) === e ? t : e;
+	}
+	return e;
+}, h = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return e;
+	let n = f(l.encodedAST(t.ast));
+	if (!l.isTypeLiteral(n)) return e;
+	let r = { ...e };
+	for (let e of n.propertySignatures) {
+		let t = String(e.name);
+		t in r && (r[t] = m(r[t], e.type));
+	}
+	return r;
+}, g = (e) => {
+	let t = /* @__PURE__ */ new Set();
+	if (e === void 0) return t;
+	let n = (e) => {
+		if (l.isUnion(e)) {
+			for (let t of e.types) n(t);
+			return;
+		}
+		if (l.isTransformation(e)) {
+			n(e.from), n(e.to);
+			return;
+		}
+		if (l.isRefinement(e)) {
+			n(e.from);
+			return;
+		}
+		if (l.isTypeLiteral(e)) {
+			let n = e.propertySignatures.find((e) => e.name === "_tag");
+			n !== void 0 && l.isLiteral(n.type) && typeof n.type.literal == "string" && t.add(n.type.literal);
+		}
+	};
+	return n(e.ast), t;
+}, _ = (e, t, n) => {
+	if (n !== void 0) try {
+		let r = c.encodeUnknownSync(n)(e);
+		if (typeof r == "object" && r) return {
+			error: t,
+			...r
+		};
+	} catch {}
+	let r = { error: t };
+	for (let [t, n] of Object.entries(e)) t !== "stack" && t !== "_tag" && (r[t] = n);
+	return r;
+}, v = (e, t, n) => {
+	if (typeof e != "object" || !e) return e;
+	let r = e._tag;
+	return typeof r != "string" || r === "ScopeError" || !g(t.error).has(r) ? e : new E(n.errorStatus?.[r] ?? 422, _(e, r, t.error));
+}, y = (e, t, n) => {
 	let r = e.publicApi;
 	if (r === void 0) throw Error(`publicApiRoute: descriptor '${e.name}' has no publicApi annotation`);
-	let i = l(e.kind, r), a = u(e.name, r), o = i === "GET" ? "query" : "body", s = c.Struct({ [o]: e.input }), d = (r.scopes ?? []).map((e) => m(e)), f = r.stream === "sse" && e.kind === "query" && n !== void 0, p = f ? (e, t) => x((r) => n(e[o], t, (e) => {
-		r(S(String(e._tag ?? "message"), e));
-	})) : (e, n) => t(e[o], n);
-	return b({
+	let i = u(e.kind, r), a = d(e.name, r), o = i === "GET" ? "query" : "body", s = c.Struct({ [o]: e.input }), l = i === "GET" ? c.transform(c.Struct({ query: c.Unknown }), s, {
+		strict: !1,
+		decode: (t) => ({ query: h(t.query, e.input) }),
+		encode: (e) => e
+	}) : s, f = [...e.openAccess === void 0 ? [x()] : [], ...(r.scopes ?? []).map((e) => S(e))], p = r.stream === "sse" && e.kind === "query" && n !== void 0, m = p ? (e, t) => k((r) => n(e[o], t, (e) => {
+		r(A(String(e._tag ?? "message"), e));
+	})) : async (n, i) => {
+		try {
+			return await t(n[o], i);
+		} catch (t) {
+			throw v(t, e, r);
+		}
+	};
+	return O({
 		method: i,
 		path: a,
-		input: s,
+		input: l,
 		output: e.output,
-		handler: p,
-		...f ? { streaming: !0 } : {},
-		...d.length > 0 ? { guards: d } : {},
+		handler: m,
+		...p ? { streaming: !0 } : {},
+		guards: f,
 		...r.summary === void 0 ? {} : { summary: r.summary },
 		...r.description === void 0 ? {} : { description: r.description },
 		...r.deprecated === void 0 ? {} : { deprecated: r.deprecated },
 		...r.sunset === void 0 ? {} : { sunset: r.sunset }
 	});
-}, f = (e) => e.filter((e) => e.descriptor.publicApi !== void 0).map((e) => d(e.descriptor, e.invoke, e.subscribe)).sort((e, t) => e.path.localeCompare(t.path)), p = () => (e) => {
+}, b = (e) => e.filter((e) => e.descriptor.publicApi !== void 0).map((e) => y(e.descriptor, e.invoke, e.subscribe)).sort((e, t) => e.path.localeCompare(t.path)), x = () => (e) => {
 	if (e.subject.type === "anonymous") return {
 		status: 401,
 		message: e.subject.credentialRejected ?? "Authentication required"
 	};
-}, m = (e) => (t) => {
+}, S = (e) => (t) => {
 	let n = t.subject.scopes;
 	if (!(n && (n.includes(e) || n.includes("admin:full")))) return {
 		status: 403,
 		message: `Missing required scope: ${e}`
 	};
-}, h = (e) => (t) => {
+}, C = (e) => (t) => {
 	let n = t.subject.scopes;
 	if (!(n && (n.includes("admin:full") || e.some((e) => n.includes(e))))) return {
 		status: 403,
 		message: `Missing required scope: one of ${e.join(", ")}`
 	};
-}, g = (e, t = {}) => ({
+}, w = (e, t = {}) => ({
 	__voltroRestResponse: !0,
 	status: t.status ?? 200,
 	body: e,
 	...t.headers === void 0 ? {} : { headers: t.headers }
-}), _ = (e) => typeof e == "object" && !!e && e.__voltroRestResponse === !0, v = class extends Error {
+}), T = (e) => typeof e == "object" && !!e && e.__voltroRestResponse === !0, E = class extends Error {
 	status;
 	body;
 	headers;
 	constructor(e, t, n) {
 		super(`REST ${e}`), this.name = "RestRouteError", this.status = e, this.body = t, this.headers = n;
 	}
-}, y = (e, t, n) => new v(e, t, n), b = (e) => {
+}, D = (e, t, n) => new E(e, t, n), O = (e) => {
 	if (e.version === void 0) return e;
 	if (!/^v\d+$/.test(e.version)) throw Error(`defineRestRoute(${e.method} ${e.path}): version "${e.version}" must be 'v' followed by digits — 'v1', 'v2', …`);
 	if ((/* @__PURE__ */ RegExp("^/v\\d+(/|$)")).test(e.path)) throw Error(`defineRestRoute(${e.method} ${e.path}): the path already starts with a version segment AND declares version: '${e.version}'. Pick one spelling — either bake the version into the path, or declare version: and keep the path bare ('/customers'). Both would mount '/${e.version}${e.path}', which is never what the author meant.`);
@@ -58,13 +147,13 @@ var l = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), u = (e, t) => t.
 		...e,
 		path: `/${e.version}${e.path}`
 	};
-}, x = (e, t = {}) => ({
+}, k = (e, t = {}) => ({
 	__voltroRestStream: !0,
 	stream: {
 		subscribe: e,
 		...t.keepAliveMs === void 0 ? {} : { keepAliveMs: t.keepAliveMs }
 	}
-}), S = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, C = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, w = (e, t = {}) => ({
+}), A = (e, t) => `event: ${e}\n${(typeof t == "string" ? t : JSON.stringify(t)).split("\n").map((e) => `data: ${e}`).join("\n")}\n\n`, j = (e) => typeof e == "object" && !!e && e.__voltroRestStream === !0, M = (e, t = {}) => ({
 	__voltroRestBytes: !0,
 	byteStream: {
 		stream: e,
@@ -74,23 +163,26 @@ var l = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), u = (e, t) => t.
 	...t.contentType === void 0 ? {} : { contentType: t.contentType },
 	...t.status === void 0 ? {} : { status: t.status },
 	...t.headers === void 0 ? {} : { headers: t.headers }
-}), T = (e) => typeof e == "object" && !!e && e.__voltroRestBytes === !0, E = async (e) => {
+}), N = (e) => typeof e == "object" && !!e && e.__voltroRestBytes === !0, P = async (e) => {
 	let t = await globalThis.crypto.subtle.digest("SHA-1", new TextEncoder().encode(e));
 	return [...new Uint8Array(t)].map((e) => e.toString(16).padStart(2, "0")).join("");
-}, D = (e, t, n) => ({
+}, F = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), O = (e) => {
+}), I = (e) => {
 	if (e.length === 0) return;
 	let t = new TextDecoder().decode(e);
 	if (t.trim() !== "") return JSON.parse(t);
-}, k = (e) => {
+}, L = (e) => {
 	let t = {};
-	for (let [n, r] of new URLSearchParams(e)) t[n] = r;
+	for (let [n, r] of new URLSearchParams(e)) {
+		let e = t[n];
+		e === void 0 ? t[n] = r : Array.isArray(e) ? e.push(r) : t[n] = [e, r];
+	}
 	return t;
-}, A = (e, t) => {
+}, R = (e, t) => {
 	let n = e.split("/").filter((e) => e.length > 0), r = t.split("/").filter((e) => e.length > 0), i = {};
 	for (let e = 0; e < n.length; e++) {
 		let t = n[e];
@@ -104,118 +196,141 @@ var l = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), u = (e, t) => t.
 		}
 	}
 	return i;
-}, j = (e, t) => ({
-	query: k(e.query),
+}, z = (e, t) => ({
+	query: L(e.query),
 	params: t,
-	body: O(e.rawBody)
-}), M = /* @__PURE__ */ new Set([
+	body: I(e.rawBody)
+}), B = /* @__PURE__ */ new Set([
 	"POST",
 	"PUT",
 	"PATCH",
 	"DELETE"
-]), N = (l, u) => {
-	let d = l.input ? c.decodeUnknown(l.input) : void 0, f = c.encode(l.output), p = {}, m = (e) => e.replace(/\/$/, "").split("/").length, h = m(l.path);
-	return l.deprecated !== void 0 && (p.Deprecation = "true"), l.sunset !== void 0 && (p.Sunset = l.sunset), {
+]), V = (e, n, r, i) => {
+	if (e instanceof E) return F(e.status, e.body, {
+		...i,
+		...e.headers
+	});
+	if (typeof e == "object" && e) {
+		let r = e;
+		if (typeof r.status == "number") return F(r.status, { error: typeof r.message == "string" ? r.message : "Error" }, i);
+		if (r._tag === "Unauthenticated" || e instanceof t) return F(401, { error: typeof r.reason == "string" ? r.reason : "Authentication required" }, i);
+		if (r._tag === "ScopeError") return F(n.type === "anonymous" ? 401 : 403, { error: typeof r.message == "string" ? r.message : "Forbidden" }, i);
+	}
+	return o({
+		error: e,
+		source: "rest",
+		name: `${r.method} ${r.path}`,
+		fields: { status: 500 }
+	}), F(500, { error: "Internal Server Error" }, i);
+}, H = (o, l) => {
+	let u = o.input ? c.decodeUnknown(o.input) : void 0, d = c.encode(o.output), f = {}, p = (e) => e.replace(/\/$/, "").split("/").length, m = p(o.path);
+	return o.deprecated !== void 0 && (f.Deprecation = "true"), o.sunset !== void 0 && (f.Sunset = o.sunset), {
 		method: "*",
-		path: l.path,
-		...l.maxBodyBytes === void 0 ? {} : { maxBodyBytes: l.maxBodyBytes },
+		path: o.path,
+		...o.maxBodyBytes === void 0 ? {} : { maxBodyBytes: o.maxBodyBytes },
 		handle: async (c) => {
-			if (!l.path.endsWith("/*") && m(c.path) !== h) return D(404, { error: "Not Found" }, p);
-			let y = c.method.toUpperCase();
-			if (!(y === l.method || y === "HEAD" && l.method === "GET")) return D(405, {
+			if (!o.path.endsWith("/*") && p(c.path) !== m) return F(404, { error: "Not Found" }, f);
+			let h = c.method.toUpperCase();
+			if (!(h === o.method || h === "HEAD" && o.method === "GET")) return F(405, {
 				error: "Method Not Allowed",
-				allow: l.method
+				allow: o.method
 			}, {
-				...p,
-				Allow: l.method
+				...f,
+				Allow: o.method
 			});
-			if (l.sunset !== void 0) {
-				let e = Date.parse(l.sunset);
-				if (!Number.isNaN(e) && Date.now() >= e) return D(410, {
+			if (o.sunset !== void 0) {
+				let e = Date.parse(o.sunset);
+				if (!Number.isNaN(e) && Date.now() >= e) return F(410, {
 					error: "Gone",
-					...l.version === void 0 ? {} : { version: l.version },
-					...l.deprecated === void 0 ? {} : { replacement: l.deprecated }
-				}, p);
+					...o.version === void 0 ? {} : { version: o.version },
+					...o.deprecated === void 0 ? {} : { replacement: o.deprecated }
+				}, f);
 			}
-			let b;
-			if (d) {
-				let e = j(c, A(l.path, c.path)), t = await s.runPromise(d(e).pipe(s.map((e) => ({
+			let g;
+			if (u) {
+				let e = z(c, R(o.path, c.path)), t = await s.runPromise(u(e).pipe(s.map((e) => ({
 					ok: !0,
 					value: e
 				})), s.catchAll((e) => s.succeed({
 					ok: !1,
 					cause: e
 				}))));
-				if (!t.ok) return D(400, {
+				if (!t.ok) return F(400, {
 					error: "Invalid request",
 					detail: String(t.cause)
-				}, p);
-				b = t.value;
+				}, f);
+				g = t.value;
 			}
-			let x;
+			let _;
 			try {
-				x = u.resolveSubject ? await u.resolveSubject(c.headers) : e(c.headers["x-tenant"] ?? null);
+				_ = l.resolveSubject ? await l.resolveSubject(c.headers) : e(c.headers["x-tenant"] ?? null);
 			} catch (e) {
 				if (e instanceof t || typeof e == "object" && e && e._tag === "Unauthenticated") {
 					let t = e.reason;
-					return D(401, { error: t ?? "Authentication required" }, p);
+					return F(401, { error: t ?? "Authentication required" }, f);
 				}
 				throw e;
 			}
-			let S = u.buildContext ? await u.buildContext(x, c.headers) : void 0, w = typeof S == "object" && S && "store" in S ? S.store : u.store, O = {
-				subject: x,
+			let v;
+			try {
+				v = l.buildContext ? await l.buildContext(_, c.headers) : void 0;
+			} catch (e) {
+				return V(e, _, o, f);
+			}
+			let y = typeof v == "object" && v && "store" in v ? v.store : l.store, b = {
+				subject: _,
 				headers: c.headers,
-				store: w,
-				method: y,
+				store: y,
+				method: h,
 				path: c.path,
 				query: c.query,
 				rawBody: c.rawBody,
-				...S === void 0 ? {} : { app: S }
+				...v === void 0 ? {} : { app: v }
 			};
-			if (l.guards) for (let e of l.guards) {
-				let t = await e(O);
-				if (t) return D(t.status, { error: t.message }, p);
+			if (o.guards) for (let e of o.guards) {
+				let t = await e(b);
+				if (t) return F(t.status, { error: t.message }, f);
 			}
-			let k = u.idempotency, N = k && M.has(l.method) ? c.headers[k.header.toLowerCase()] : void 0, P = k && N ? r(x.tenantId, l.method, l.path) : "";
-			if (k && N) {
-				let e = await i(k.store, P, N, k.ttlMs, Date.now());
-				if (e.kind === "replay") return D(e.response.status, e.response.body, {
-					...p,
+			let x = l.idempotency, S = x && B.has(o.method) ? c.headers[x.header.toLowerCase()] : void 0, C = x && S ? r(_.tenantId, o.method, o.path) : "";
+			if (x && S) {
+				let e = await i(x.store, C, S, x.ttlMs, Date.now());
+				if (e.kind === "replay") return F(e.response.status, e.response.body, {
+					...f,
 					"Idempotency-Replayed": "true"
 				});
-				if (e.kind === "conflict") return D(409, { error: "A request with this Idempotency-Key is already being processed" }, p);
+				if (e.kind === "conflict") return F(409, { error: "A request with this Idempotency-Key is already being processed" }, f);
 			}
 			try {
-				let e = await l.handler(b, O);
-				if (C(e) || T(e)) return k && N && await a(k.store, P, N), T(e) ? {
+				let e = await o.handler(g, b);
+				if (j(e) || N(e)) return x && S && await a(x.store, C, S), N(e) ? {
 					status: e.status ?? 200,
 					headers: {
-						...p,
+						...f,
 						...e.headers
 					},
 					byteStream: e.byteStream,
 					...e.contentType === void 0 ? {} : { contentType: e.contentType }
 				} : {
 					status: 200,
-					headers: p,
+					headers: f,
 					stream: e.stream
 				};
-				let t = _(e) ? e : g(e), r = await s.runPromise(f(t.body)), i = {
-					...p,
+				let t = T(e) ? e : w(e), r = await s.runPromise(d(t.body)), i = {
+					...f,
 					...t.headers
 				};
-				if (k && N && await n(k.store, P, N, {
+				if (x && S && await n(x.store, C, S, {
 					status: t.status,
 					body: r
-				}, Date.now()), l.etag === !0 && l.method === "GET") {
-					let e = `W/"${await E(JSON.stringify(r))}"`, n = c.headers["if-none-match"];
+				}, Date.now()), o.etag === !0 && o.method === "GET") {
+					let e = `W/"${await P(JSON.stringify(r))}"`, n = c.headers["if-none-match"];
 					return n !== void 0 && n.split(",").some((t) => t.trim() === e) ? {
 						status: 304,
 						headers: {
-							...p,
+							...f,
 							ETag: e
 						}
-					} : D(t.status, r, {
+					} : F(t.status, r, {
 						...i,
 						ETag: e
 					});
@@ -223,34 +338,21 @@ var l = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), u = (e, t) => t.
 				return t.status === 204 || t.status === 304 ? {
 					status: t.status,
 					headers: i
-				} : D(t.status, r, i);
+				} : F(t.status, r, i);
 			} catch (e) {
-				if (k && N && await a(k.store, P, N), e instanceof v) return D(e.status, e.body, {
-					...p,
-					...e.headers
-				});
-				if (typeof e == "object" && e && typeof e.status == "number") {
-					let t = e;
-					return D(t.status, { error: t.message ?? "Error" }, p);
-				}
-				return o({
-					error: e,
-					source: "rest",
-					name: `${l.method} ${l.path}`,
-					fields: { status: 500 }
-				}), D(500, { error: "Internal Server Error" }, p);
+				return x && S && await a(x.store, C, S), V(e, _, o, f);
 			}
 		}
 	};
-}, P = (e, t = {}) => {
+}, U = (e, t = {}) => {
 	if (t.idempotency !== void 0) {
-		for (let t of e) if (t.streaming === !0 && M.has(t.method)) throw Error(`REST route ${t.method} ${t.path} declares \`streaming: true\` on a method the idempotency binding claims (${[...M].join("/")}). A stream cannot complete an idempotency claim — there is no replayable body to cache — so a retried request would 409 until the claim's TTL. Either serve the stream on GET, or scope the idempotency binding away from this app's streaming routes.`);
+		for (let t of e) if (t.streaming === !0 && B.has(t.method)) throw Error(`REST route ${t.method} ${t.path} declares \`streaming: true\` on a method the idempotency binding claims (${[...B].join("/")}). A stream cannot complete an idempotency claim — there is no replayable body to cache — so a retried request would 409 until the claim's TTL. Either serve the stream on GET, or scope the idempotency binding away from this app's streaming routes.`);
 	}
-	return e.map((e) => N(e, t));
-}, F = async (e, t) => {
+	return e.map((e) => H(e, t));
+}, W = async (e, t) => {
 	let n = await e[0].handle(t);
 	for (let r = 1; r < e.length && n.status === 405; r++) n = await e[r].handle(t);
 	return n;
 };
 //#endregion
-export { v as RestRouteError, w as bytes, f as collectPublicApiRoutes, b as defineRestRoute, l as derivePublicMethod, u as derivePublicPath, F as dispatchSharedPath, T as isRestByteResponse, _ as isRestResponse, C as isRestStreamResponse, A as matchPathParams, d as publicApiRoute, h as requireAnyScope, p as requireAuthenticated, m as requireScope, g as response, y as restError, P as restRoutesToHttpRoutes, x as sse, S as sseFrame };
+export { E as RestRouteError, M as bytes, h as coerceQueryObject, m as coerceQueryValue, b as collectPublicApiRoutes, g as declaredErrorTags, O as defineRestRoute, u as derivePublicMethod, d as derivePublicPath, W as dispatchSharedPath, N as isRestByteResponse, T as isRestResponse, j as isRestStreamResponse, R as matchPathParams, v as projectedFailure, y as publicApiRoute, C as requireAnyScope, x as requireAuthenticated, S as requireScope, w as response, D as restError, U as restRoutesToHttpRoutes, k as sse, A as sseFrame };

package/dist/{scopes-C86BDyNJ.js → scopes-DVtiKKsm.js}

@@ -88,14 +88,14 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, T = 3e4, re = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ie = () => {
+}, re = 3e4, ie = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, D = (e = {}) => {
-	let t = e.ttlMs ?? ie() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+}, E = (e = {}) => {
+	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -131,14 +131,24 @@ var i = n.Record({
 			};
 		}
 	};
-}, ae = (e) => typeof e.resolve == "function", O = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && ae(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
+}, oe = (e) => typeof e.resolve == "function", se = (e) => {
+	let t = e.authorization ?? e.Authorization;
+	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
+}, D = (e, t) => {
+	let n = se(t);
+	if (n === void 0) return e;
+	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
+	if (r.length === 0) return e;
+	let i = new Set(r);
+	return [...r, ...e.filter((e) => !i.has(e))];
+}, O = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
 	return async (o) => {
 		let s = t?.getStore?.(), c = s === void 0 ? o : {
 			...o,
 			store: s
 		}, l;
-		for (let o of e) {
+		for (let o of D(e, c.headers)) {
 			let e = await o.resolve(c);
 			if (e.kind === "matched") {
 				let s = e.subject;
@@ -167,7 +177,7 @@ var i = n.Record({
 					}, { decision: l, fresh: u } = a === null ? {
 						decision: await i(),
 						fresh: !0
-					} : await a.resolve(E(e.subject), i);
+					} : await a.resolve(T(e.subject), i);
 					if (l.kind === "vetoed") {
 						let e = `${l.code}: ${l.message}`;
 						throw t?.onStrategyFailed?.({
@@ -235,9 +245,9 @@ var i = n.Record({
 }, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
 	required: n,
 	message: `missing required scope '${n}'`
-})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => e.authenticated === !0, K = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, oe = (e) => {
+})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => e.authenticated === !0, K = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ce = (e) => {
 	J = e;
-}, se = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], ce = (e) => [
+}, le = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], ue = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -251,9 +261,9 @@ var i = n.Record({
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), le = () => J, Y, X = (e) => {
+].join("\n"), de = () => J, Y, fe = (e) => {
 	Y = e;
-}, ue = () => Y, Z = (e) => new F({
+}, X = () => Y, Z = (e) => new F({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
@@ -289,7 +299,7 @@ var i = n.Record({
 		}
 	}
 	return null;
-}, de = (e, n, r) => {
+}, pe = (e, n, r) => {
 	let i = (e) => new F({
 		required: `${n.resourceType}:${n.action}`,
 		message: e
@@ -304,7 +314,7 @@ var i = n.Record({
 		resourceType: n.resourceType,
 		resourceId: o
 	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
-}, fe = (e, n, r, i) => {
+}, me = (e, n, r, i) => {
 	if (!n || n.length === 0) return t.succeed($(e, n, i));
 	let a = J;
 	return !n.some(U) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
@@ -318,7 +328,7 @@ var i = n.Record({
 				}));
 			}
 			if (U(i)) {
-				let t = yield* de(e, i, r);
+				let t = yield* pe(e, i, r);
 				if (t) return t;
 				continue;
 			}
@@ -352,4 +362,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { _ as A, g as B, oe as C, S as D, b as E, h as F, ee as G, v as H, w as I, te as K, A as L, f as M, y as N, re as O, k as P, O as R, X as S, x as T, E as U, D as V, p as W, U as _, F as a, H as b, fe as c, ue as d, le as f, W as g, G as h, M as i, d as j, T as k, z as l, V as m, N as n, ce as o, B as p, P as r, $ as s, j as t, se as u, Z as v, I as w, R as x, K as y, ne as z };
+export { _ as A, g as B, ce as C, S as D, b as E, h as F, p as G, D as H, w as I, ee as K, A as L, f as M, y as N, ie as O, k as P, O as R, fe as S, x as T, v as U, E as V, T as W, U as _, F as a, H as b, me as c, X as d, de as f, W as g, G as h, M as i, d as j, re as k, z as l, V as m, N as n, ue as o, B as p, te as q, P as r, $ as s, j as t, le as u, Z as v, I as w, R as x, K as y, ne as z };