@voltro/protocol 0.69.1 → 0.71.0

package/dist/restFormat-ChSVyufA.js

@@ -0,0 +1,287 @@
+import { Schema as e } from "effect";
+import * as t from "effect/SchemaAST";
+import * as n from "effect/Option";
+//#region src/idempotency.ts
+var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n, r) => r === void 0 ? `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}` : `WS-connection:${JSON.stringify([
+	e ?? null,
+	t ?? null,
+	n,
+	r
+])}`, a = class extends e.TaggedError()("MutationConnectionRequired", { traceId: e.String }) {
+	get message() {
+		return "this mutation requires a live native WebSocket connection";
+	}
+}, o = async (e, t, n, r, i) => {
+	let a = await e.claim(t, n, i, r);
+	return a === "claimed" ? { kind: "fresh" } : a.status === "completed" && a.response ? {
+		kind: "replay",
+		response: a.response
+	} : { kind: "conflict" };
+}, s = (e, t, n, r, i) => e.complete(t, n, r, i), c = (e, t, n) => e.release(t, n), l = () => {
+	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
+	return {
+		get: async (n, r) => e.get(t(n, r)) ?? null,
+		claim: async (n, r, i, a) => {
+			let o = e.get(t(n, r));
+			return o && i - o.createdAt < a ? o : (e.set(t(n, r), {
+				scope: n,
+				key: r,
+				status: "in_flight",
+				response: null,
+				createdAt: i
+			}), "claimed");
+		},
+		complete: async (n, r, i, a) => {
+			e.set(t(n, r), {
+				scope: n,
+				key: r,
+				status: "completed",
+				response: i,
+				createdAt: a
+			});
+		},
+		release: async (n, r) => {
+			e.delete(t(n, r));
+		}
+	};
+}, u = class extends e.TaggedError()("MutationInFlight", {
+	traceId: e.String,
+	retryAfterMs: e.Number
+}) {
+	get message() {
+		return `a request with this idempotency key is still in flight — replay the same key after ${this.retryAfterMs}ms`;
+	}
+}, d = 1e3, f = (e) => typeof e == "object" && !!e && typeof e._tag == "string", p = 64, m = (e, t = 0) => {
+	if (!f(e)) return String(e);
+	if (t >= p) return "…";
+	let n = t + 1, r = (t) => m(e[t], n), i = (t) => Array.isArray(e[t]) ? e[t] : [];
+	switch (e._tag) {
+		case "Transformation": return `T(${r("from")}->${r("to")})`;
+		case "Refinement": return `R(${r("from")})`;
+		case "Suspend": return "S(…)";
+		case "TypeLiteral": {
+			let e = i("propertySignatures").map((e) => {
+				let t = e;
+				return `${String(t.name)}${t.isOptional === !0 ? "?" : ""}:${m(t.type, n)}`;
+			}).join(","), t = i("indexSignatures").map((e) => {
+				let t = e;
+				return `[${m(t.parameter, n)}]:${m(t.type, n)}`;
+			}).join(",");
+			return t === "" ? `{${e}}` : `{${e};${t}}`;
+		}
+		case "Union": return `U(${i("types").map((e) => m(e, n)).join("|")})`;
+		case "TupleType": {
+			let e = i("elements").map((e) => {
+				let t = e;
+				return `${m(t.type, n)}${t.isOptional === !0 ? "?" : ""}`;
+			}).join(","), t = i("rest").map((e) => m(e.type, n)).join(",");
+			return `A(${e}${t === "" ? "" : `...${t}`})`;
+		}
+		case "Declaration": return `D(${i("typeParameters").map((e) => m(e, n)).join(",")})`;
+		default: return String(e);
+	}
+}, h = (e) => {
+	let t = 2166136261;
+	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619) >>> 0;
+	return t.toString(16).padStart(8, "0");
+}, g = (e) => h([
+	m(e.payloadSchema?.ast),
+	m(e.successSchema?.ast),
+	m(e.errorSchema?.ast)
+].join("\0")), _ = (e) => {
+	let t = {}, n = e.requests, r = n instanceof Map ? n.entries() : Array.isArray(n) ? n.map((e, t) => [t, e]) : [];
+	for (let [, e] of r) {
+		if (typeof e != "object" && typeof e != "function" || e === null) continue;
+		let n = e;
+		typeof n._tag == "string" && (t[n._tag] = g(n));
+	}
+	return t;
+}, v = (e, t) => {
+	let n = [], r = [];
+	for (let [i, a] of Object.entries(t)) {
+		let t = e[i];
+		t === void 0 ? r.push(i) : t !== a && n.push(i);
+	}
+	return {
+		differing: n.sort(),
+		missingHere: r.sort()
+	};
+}, y = /* @__PURE__ */ new Set(), b = (e) => {
+	for (let t of y) try {
+		t(e);
+	} catch {}
+}, x = (e) => (y.add(e), () => {
+	y.delete(e);
+}), S = {
+	rpc: {
+		name: "rpc",
+		dates: "epoch-ms",
+		errors: "tagged",
+		envelope: "none",
+		pagination: "body-cursor",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !1
+	},
+	standard: {
+		name: "standard",
+		dates: "iso",
+		errors: "problem-details",
+		envelope: "none",
+		pagination: "link-header",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !0
+	},
+	jsonapi: {
+		name: "jsonapi",
+		dates: "iso",
+		errors: "problem-details",
+		envelope: "jsonapi",
+		pagination: "link-header",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !0
+	}
+}, C = [
+	"rpc",
+	"standard",
+	"jsonapi"
+], w = (e, t = void 0) => {
+	let n = (e) => {
+		if (e?.profile !== void 0) {
+			if (typeof e.profile == "string") {
+				let t = S[e.profile];
+				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${C.join(", ")}, or a RestFormat object`);
+				return t;
+			}
+			return e.profile;
+		}
+	}, r = (e, t) => t === void 0 ? e : {
+		...e,
+		...t.dates === void 0 ? {} : { dates: t.dates },
+		...t.errors === void 0 ? {} : { errors: t.errors },
+		...t.envelope === void 0 ? {} : { envelope: t.envelope },
+		...t.pagination === void 0 ? {} : { pagination: t.pagination },
+		...t.cursorField === void 0 ? {} : { cursorField: t.cursorField },
+		...t.cursorParam === void 0 ? {} : { cursorParam: t.cursorParam },
+		...t.naming === void 0 ? {} : { naming: t.naming },
+		...t.etag === void 0 ? {} : { etag: t.etag }
+	}, i = r(n(e) ?? S.rpc, e);
+	return r(n(t) ?? i, t);
+}, T = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), E = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return e;
+	let n = {};
+	for (let [r, i] of Object.entries(e)) n[t(r)] = i;
+	return n;
+}, D = (e) => n.getOrUndefined(t.getIdentifierAnnotation(e)), O = (n, r) => {
+	if (r.dates === "epoch-ms" && r.naming === "camelCase") return n;
+	let i = /* @__PURE__ */ new Map(), a = (e) => {
+		let t = i.get(e);
+		if (t !== void 0) return t;
+		let n = o(e);
+		return i.set(e, n), n;
+	}, o = (n) => {
+		switch (n._tag) {
+			case "Transformation":
+				if (r.dates === "iso" && D(n) === "DateFromNumber") {
+					let r = e.DateFromString.ast;
+					return new t.Transformation(r.from, r.to, r.transformation, {
+						...r.annotations,
+						...n.annotations,
+						[t.IdentifierAnnotationId]: "DateFromString",
+						[t.JSONSchemaAnnotationId]: {
+							type: "string",
+							format: "date-time"
+						}
+					});
+				}
+				return n;
+			case "Refinement": return new t.Refinement(a(n.from), n.filter, n.annotations);
+			case "Union": return t.Union.make(n.types.map(a), n.annotations);
+			case "TupleType": return new t.TupleType(n.elements.map((e) => new t.OptionalType(a(e.type), e.isOptional, e.annotations)), n.rest.map((e) => new t.Type(a(e.type), e.annotations)), n.isReadonly, n.annotations);
+			case "Suspend": return new t.Suspend(() => a(n.f()), n.annotations);
+			case "TypeLiteral": {
+				let i = n.propertySignatures.map((e) => new t.PropertySignature(e.name, a(e.type), e.isOptional, e.isReadonly, e.annotations)), o = n.indexSignatures.map((e) => new t.IndexSignature(e.parameter, a(e.type), e.isReadonly)), s = new t.TypeLiteral(i, o, n.annotations);
+				if (r.naming !== "snake_case") return s;
+				let c = i.map((e) => typeof e.name == "string" ? T(e.name) : e.name);
+				if (c.every((e, t) => e === i[t].name)) return s;
+				let l = new t.TypeLiteral(i.map((e, n) => new t.PropertySignature(c[n], t.encodedAST(e.type), e.isOptional, e.isReadonly, e.annotations)), o.map((e) => new t.IndexSignature(e.parameter, t.encodedAST(e.type), e.isReadonly)), n.annotations), u = new Map(i.map((e, t) => [String(c[t]), String(e.name)])), d = new Map(i.map((e, t) => [String(e.name), String(c[t])]));
+				return e.transform(e.make(l), e.make(s), {
+					strict: !1,
+					decode: (e) => E(e, (e) => u.get(e) ?? e),
+					encode: (e) => E(e, (e) => d.get(e) ?? e)
+				}).ast;
+			}
+			default: return n;
+		}
+	};
+	return e.make(a(n.ast));
+}, k = (e) => `urn:voltro:error:${e}`, A = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), j = (e) => ({
+	type: k(e.tag),
+	title: A(e.tag),
+	status: e.status,
+	...e.message.length > 0 ? { detail: e.message } : {},
+	...e.fields
+}), M = "application/problem+json; charset=utf-8", N = "application/vnd.api+json; charset=utf-8", P = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
+	body: { errors: [{
+		status: String(t.status),
+		code: t.tag,
+		title: A(t.tag),
+		...t.message.length > 0 ? { detail: t.message } : {},
+		...Object.keys(t.fields).length > 0 ? { meta: t.fields } : {}
+	}] },
+	contentType: N
+} : {
+	body: j(t),
+	contentType: M
+} : { body: {
+	error: t.tag === "InvalidRequest" || t.tag === "InternalServerError" || t.tag === "Unauthorized" || t.tag === "Forbidden" || t.tag === "Gone" || t.tag === "MethodNotAllowed" || t.tag === "Conflict" ? t.message : t.tag,
+	...t.fields
+} } : e.encodeError(t, n), F = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return {
+		cursor: void 0,
+		rest: e
+	};
+	let n = e[t];
+	return typeof n != "string" && typeof n != "number" ? {
+		cursor: void 0,
+		rest: e
+	} : {
+		cursor: String(n),
+		rest: e
+	};
+}, I = (e, t, n) => {
+	let r = new URLSearchParams(e.query);
+	return r.set(n, t), `<${e.path}?${r.toString()}>; rel="next"`;
+}, L = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return e;
+	let { id: n, ...r } = e;
+	return {
+		type: t,
+		...n === void 0 ? {} : { id: String(n) },
+		attributes: r
+	};
+}, R = (e, t, n) => {
+	if (e.encodeSuccess !== void 0) return e.encodeSuccess(t, n);
+	let { cursor: r } = F(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: I(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
+		body: e,
+		...i ? { headers: i } : {},
+		...t ? { contentType: t } : {}
+	});
+	if (e.envelope === "none") return a(t);
+	if (e.envelope === "data") return a({
+		data: t,
+		...r !== void 0 && e.pagination === "link-header" ? { next: r } : {}
+	});
+	let o = n.source ?? n.tag.split(".")[0] ?? "resource", s = Array.isArray(t) ? t : typeof t == "object" && t && Array.isArray(t.items) ? t.items : void 0;
+	return a({
+		data: s === void 0 ? L(t, o) : s.map((e) => L(e, o)),
+		...r === void 0 ? {} : { links: { next: I(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
+	}, N);
+};
+//#endregion
+export { c as C, i as D, l as E, o as S, r as T, m as _, R as a, a as b, k as c, T as d, b as f, g, _ as h, P as i, w as l, v as m, M as n, I as o, x as p, C as r, j as s, N as t, O as u, h as v, s as w, u as x, d as y };

package/dist/{scopes-DVtiKKsm.js → scopes-CW9_LbDO.js}

@@ -20,6 +20,7 @@ var i = n.Record({
 	type: n.Literal("serviceAccount"),
 	id: n.String,
 	tenantId: n.String,
+	auditActorId: n.optionalWith(n.NullOr(n.String), { exact: !0 }),
 	scopes: a,
 	metadata: n.optional(i)
 }), l = n.Struct({
@@ -42,24 +43,31 @@ var i = n.Record({
 	id: null,
 	tenantId: e,
 	...t === void 0 ? {} : { credentialRejected: t }
-}), ee = (e, t = ["admin:full"]) => ({
+}), g = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), te = (e, t) => {
+}), _ = (e) => {
+	if (e.type === "system") return null;
+	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
+	if (e.type !== "apiKey") return e.id;
+	let t = e.metadata?.userId;
+	return typeof t == "string" && t !== "" ? t : e.id;
+}, ee = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
 		id: e.id ?? "system",
 		tenantId: t,
-		scopes: n.scopes ?? ["admin:full"],
+		auditActorId: _(e),
+		scopes: m(e),
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, ne = (e) => typeof e.mountRoutes == "function", C = (e) => Array.isArray(e) ? {
+}, te = (e) => e.type === "system", ne = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, C = (e) => typeof e.mountRoutes == "function", w = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, w = (e, t) => {
+} : e, T = (e, t) => {
 	if (t.kind === "vetoed") throw new k({ reason: `${t.code}: ${t.message}` });
 	if (e.type === "anonymous") return {
 		subject: e,
@@ -88,13 +96,13 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, re = 3e4, ie = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
+}, re = 3e4, ie = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, E = (e = {}) => {
+}, D = (e = {}) => {
 	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
@@ -134,21 +142,21 @@ var i = n.Record({
 }, oe = (e) => typeof e.resolve == "function", se = (e) => {
 	let t = e.authorization ?? e.Authorization;
 	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
-}, D = (e, t) => {
+}, O = (e, t) => {
 	let n = se(t);
 	if (n === void 0) return e;
 	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
 	if (r.length === 0) return e;
 	let i = new Set(r);
 	return [...r, ...e.filter((e) => !i.has(e))];
-}, O = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
+}, ce = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
 	return async (o) => {
 		let s = t?.getStore?.(), c = s === void 0 ? o : {
 			...o,
 			store: s
 		}, l;
-		for (let o of D(e, c.headers)) {
+		for (let o of O(e, c.headers)) {
 			let e = await o.resolve(c);
 			if (e.kind === "matched") {
 				let s = e.subject;
@@ -157,9 +165,9 @@ var i = n.Record({
 						let t = n === void 0 ? {
 							kind: "grant",
 							scopes: []
-						} : C(await n(e.subject, c));
+						} : w(await n(e.subject, c));
 						if (t.kind === "unavailable" || r.length === 0) return t;
-						let i = w(e.subject, t).subject, a = {
+						let i = T(e.subject, t).subject, a = {
 							origin: "request",
 							headers: c.headers,
 							clientId: c.clientId,
@@ -177,7 +185,7 @@ var i = n.Record({
 					}, { decision: l, fresh: u } = a === null ? {
 						decision: await i(),
 						fresh: !0
-					} : await a.resolve(T(e.subject), i);
+					} : await a.resolve(E(e.subject), i);
 					if (l.kind === "vetoed") {
 						let e = `${l.code}: ${l.message}`;
 						throw t?.onStrategyFailed?.({
@@ -192,7 +200,7 @@ var i = n.Record({
 							reason: e
 						}), new k({ reason: e });
 					}
-					let d = w(e.subject, l);
+					let d = T(e.subject, l);
 					u && d.removed.length > 0 && t?.onScopesNarrowed?.({
 						strategyId: o.id,
 						subjectType: e.subject.type,
@@ -245,9 +253,24 @@ var i = n.Record({
 }, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
 	required: n,
 	message: `missing required scope '${n}'`
-})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => e.authenticated === !0, K = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ce = (e) => {
+})), U = (e, t) => {
+	let n;
+	try {
+		n = typeof e.action == "function" ? e.action(t) : e.action;
+	} catch {
+		throw new F({
+			required: e.resourceType,
+			message: "policy action selector failed"
+		});
+	}
+	if (typeof n != "string" || n.trim() === "") throw new F({
+		required: e.resourceType,
+		message: "policy action selector returned no action"
+	});
+	return n;
+}, W = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", G = (e) => typeof e.open == "string", K = (e) => e.authenticated === !0, le = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ue = (e) => {
 	J = e;
-}, le = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], ue = (e) => [
+}, Y = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !W(e) && e.resource !== void 0)).map((e) => e.tag) : [], de = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -261,9 +284,9 @@ var i = n.Record({
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), de = () => J, Y, fe = (e) => {
-	Y = e;
-}, X = () => Y, Z = (e) => new F({
+].join("\n"), fe = () => J, X, pe = (e) => {
+	X = e;
+}, me = () => X, Z = (e) => new F({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
@@ -272,15 +295,15 @@ var i = n.Record({
 }, $ = (e, t, n) => {
 	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
 	for (let n of t) {
-		if (W(n)) continue;
-		if (G(n)) {
+		if (G(n)) continue;
+		if (K(n)) {
 			if (e.id !== null && e.id !== void 0) continue;
 			return Q(e, new F({
 				required: "authenticated",
 				message: "this procedure requires an authenticated caller"
 			}));
 		}
-		if (U(n)) {
+		if (W(n)) {
 			if (B(e, "admin:full")) continue;
 			return Q(e, new F({
 				required: `${n.resourceType}:${n.action}`,
@@ -299,36 +322,42 @@ var i = n.Record({
 		}
 	}
 	return null;
-}, pe = (e, n, r) => {
-	let i = (e) => new F({
-		required: `${n.resourceType}:${n.action}`,
+}, he = (e, n, r) => {
+	let i;
+	try {
+		i = U(n, r);
+	} catch (e) {
+		return t.succeed(e);
+	}
+	let a = (e) => new F({
+		required: `${n.resourceType}:${i}`,
 		message: e
 	});
 	if (B(e, "admin:full")) return t.succeed(null);
-	let a = Y;
-	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
-	let o = n.resource(r);
-	return o === void 0 || o === "" ? t.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => a({
+	let o = X;
+	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
+	let s = n.resource(r);
+	return s === void 0 || s === "" ? t.succeed(a(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => o({
 		subject: e,
-		action: n.action,
+		action: i,
 		resourceType: n.resourceType,
-		resourceId: o
-	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
-}, me = (e, n, r, i) => {
+		resourceId: s
+	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : a(`no '${i}' relation on ${n.resourceType}:${s}`)));
+}, ge = (e, n, r, i) => {
 	if (!n || n.length === 0) return t.succeed($(e, n, i));
 	let a = J;
-	return !n.some(U) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
+	return !n.some(W) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
 		for (let i of n) {
-			if (W(i)) continue;
-			if (G(i)) {
+			if (G(i)) continue;
+			if (K(i)) {
 				if (e.id !== null && e.id !== void 0) continue;
 				return Q(e, new F({
 					required: "authenticated",
 					message: "this procedure requires an authenticated caller"
 				}));
 			}
-			if (U(i)) {
-				let t = yield* pe(e, i, r);
+			if (W(i)) {
+				let t = yield* he(e, i, r);
 				if (t) return t;
 				continue;
 			}
@@ -362,4 +391,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { _ as A, g as B, ce as C, S as D, b as E, h as F, p as G, D as H, w as I, ee as K, A as L, f as M, y as N, ie as O, k as P, O as R, fe as S, x as T, v as U, E as V, T as W, U as _, F as a, H as b, me as c, X as d, de as f, W as g, G as h, M as i, d as j, re as k, z as l, V as m, N as n, ue as o, B as p, te as q, P as r, $ as s, j as t, le as u, Z as v, I as w, R as x, K as y, ne as z };
+export { re as A, C as B, pe as C, b as D, x as E, k as F, E as G, D as H, h as I, g as J, _ as K, T as L, d as M, f as N, S as O, y as P, A as R, R as S, I as T, O as U, te as V, v as W, ee as Y, W as _, F as a, H as b, ge as c, me as d, fe as f, G as g, K as h, M as i, ne as j, ie as k, z as l, V as m, N as n, de as o, B as p, p as q, P as r, $ as s, j as t, Y as u, Z as v, ue as w, U as x, le as y, ce as z };

package/dist/session.d.ts

@@ -162,28 +162,31 @@ declare const SessionPayload_2: Schema.Struct<{
     v: Schema.Literal<[2]>;
     /** WHO, never WHAT-THEY-MAY-DO. `SubjectIdentity` has no `scopes` field. */
     subject: Schema.Union<[Schema.Struct<{
-        id: typeof Schema.String;
         type: Schema.Literal<["user"]>;
+        id: typeof Schema.String;
         tenantId: typeof Schema.String;
         metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
     }>, Schema.Struct<{
-        id: typeof Schema.String;
         type: Schema.Literal<["apiKey"]>;
+        id: typeof Schema.String;
         tenantId: typeof Schema.String;
         metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
     }>, Schema.Struct<{
-        id: typeof Schema.String;
         type: Schema.Literal<["serviceAccount"]>;
+        id: typeof Schema.String;
         tenantId: typeof Schema.String;
         metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+        auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+            exact: true;
+        }>;
     }>, Schema.Struct<{
         type: Schema.Literal<["anonymous"]>;
         id: typeof Schema.Null;
         tenantId: Schema.NullOr<typeof Schema.String>;
         credentialRejected: Schema.optional<typeof Schema.String>;
     }>, Schema.Struct<{
-        id: typeof Schema.String;
         type: Schema.Literal<["system"]>;
+        id: typeof Schema.String;
         tenantId: typeof Schema.Null;
         metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
     }>]>;
@@ -274,6 +277,11 @@ declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["serviceAccount"]>;
     id: typeof Schema.String;
     tenantId: typeof Schema.String;
+    /** Application actor used for audit columns; null means machine work with
+     * no application actor. Identity only, never a permission grant. */
+    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+        exact: true;
+    }>;
     scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>, Schema.Struct<{
@@ -308,20 +316,23 @@ declare const Subject: Schema.Union<[Schema.Struct<{
 declare type Subject = typeof Subject.Type;
 
 declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
-    id: typeof Schema.String;
     type: Schema.Literal<["user"]>;
+    id: typeof Schema.String;
     tenantId: typeof Schema.String;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>, Schema.Struct<{
-    id: typeof Schema.String;
     type: Schema.Literal<["apiKey"]>;
+    id: typeof Schema.String;
     tenantId: typeof Schema.String;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>, Schema.Struct<{
-    id: typeof Schema.String;
     type: Schema.Literal<["serviceAccount"]>;
+    id: typeof Schema.String;
     tenantId: typeof Schema.String;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+        exact: true;
+    }>;
 }>, Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;
@@ -344,8 +355,8 @@ declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
      */
     credentialRejected: Schema.optional<typeof Schema.String>;
 }>, Schema.Struct<{
-    id: typeof Schema.String;
     type: Schema.Literal<["system"]>;
+    id: typeof Schema.String;
     tenantId: typeof Schema.Null;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>]>;

package/dist/session.js

@@ -1,11 +1,11 @@
-import { G as e, M as t, w as n } from "./scopes-DVtiKKsm.js";
+import { N as e, T as t, q as n } from "./scopes-CW9_LbDO.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";
 //#region src/session.ts
 var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 	v: r.Literal(2),
-	subject: t,
+	subject: e,
 	exp: r.Number,
 	iat: r.Number,
 	kid: r.optional(r.String)
@@ -38,14 +38,14 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 }, C = 604800, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, D = (t, r, i = {}) => {
+} : e, D = (e, r, i = {}) => {
 	let a = E(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
-	let o = n(t);
-	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${t.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let o = t(e);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
 	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
-		subject: e(t),
+		subject: n(e),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }