@voltro/protocol 0.70.0 → 0.71.0

package/dist/{restFormat-Bnngx-zI.js → restFormat-ChSVyufA.js}

@@ -51,13 +51,68 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 	get message() {
 		return `a request with this idempotency key is still in flight — replay the same key after ${this.retryAfterMs}ms`;
 	}
-}, d = 1e3, f = /* @__PURE__ */ new Set(), p = (e) => {
-	for (let t of f) try {
+}, d = 1e3, f = (e) => typeof e == "object" && !!e && typeof e._tag == "string", p = 64, m = (e, t = 0) => {
+	if (!f(e)) return String(e);
+	if (t >= p) return "…";
+	let n = t + 1, r = (t) => m(e[t], n), i = (t) => Array.isArray(e[t]) ? e[t] : [];
+	switch (e._tag) {
+		case "Transformation": return `T(${r("from")}->${r("to")})`;
+		case "Refinement": return `R(${r("from")})`;
+		case "Suspend": return "S(…)";
+		case "TypeLiteral": {
+			let e = i("propertySignatures").map((e) => {
+				let t = e;
+				return `${String(t.name)}${t.isOptional === !0 ? "?" : ""}:${m(t.type, n)}`;
+			}).join(","), t = i("indexSignatures").map((e) => {
+				let t = e;
+				return `[${m(t.parameter, n)}]:${m(t.type, n)}`;
+			}).join(",");
+			return t === "" ? `{${e}}` : `{${e};${t}}`;
+		}
+		case "Union": return `U(${i("types").map((e) => m(e, n)).join("|")})`;
+		case "TupleType": {
+			let e = i("elements").map((e) => {
+				let t = e;
+				return `${m(t.type, n)}${t.isOptional === !0 ? "?" : ""}`;
+			}).join(","), t = i("rest").map((e) => m(e.type, n)).join(",");
+			return `A(${e}${t === "" ? "" : `...${t}`})`;
+		}
+		case "Declaration": return `D(${i("typeParameters").map((e) => m(e, n)).join(",")})`;
+		default: return String(e);
+	}
+}, h = (e) => {
+	let t = 2166136261;
+	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619) >>> 0;
+	return t.toString(16).padStart(8, "0");
+}, g = (e) => h([
+	m(e.payloadSchema?.ast),
+	m(e.successSchema?.ast),
+	m(e.errorSchema?.ast)
+].join("\0")), _ = (e) => {
+	let t = {}, n = e.requests, r = n instanceof Map ? n.entries() : Array.isArray(n) ? n.map((e, t) => [t, e]) : [];
+	for (let [, e] of r) {
+		if (typeof e != "object" && typeof e != "function" || e === null) continue;
+		let n = e;
+		typeof n._tag == "string" && (t[n._tag] = g(n));
+	}
+	return t;
+}, v = (e, t) => {
+	let n = [], r = [];
+	for (let [i, a] of Object.entries(t)) {
+		let t = e[i];
+		t === void 0 ? r.push(i) : t !== a && n.push(i);
+	}
+	return {
+		differing: n.sort(),
+		missingHere: r.sort()
+	};
+}, y = /* @__PURE__ */ new Set(), b = (e) => {
+	for (let t of y) try {
 		t(e);
 	} catch {}
-}, m = (e) => (f.add(e), () => {
-	f.delete(e);
-}), h = {
+}, x = (e) => (y.add(e), () => {
+	y.delete(e);
+}), S = {
 	rpc: {
 		name: "rpc",
 		dates: "epoch-ms",
@@ -91,16 +146,16 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		naming: "camelCase",
 		etag: !0
 	}
-}, g = [
+}, C = [
 	"rpc",
 	"standard",
 	"jsonapi"
-], _ = (e, t = void 0) => {
+], w = (e, t = void 0) => {
 	let n = (e) => {
 		if (e?.profile !== void 0) {
 			if (typeof e.profile == "string") {
-				let t = h[e.profile];
-				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${g.join(", ")}, or a RestFormat object`);
+				let t = S[e.profile];
+				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${C.join(", ")}, or a RestFormat object`);
 				return t;
 			}
 			return e.profile;
@@ -115,14 +170,14 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		...t.cursorParam === void 0 ? {} : { cursorParam: t.cursorParam },
 		...t.naming === void 0 ? {} : { naming: t.naming },
 		...t.etag === void 0 ? {} : { etag: t.etag }
-	}, i = r(n(e) ?? h.rpc, e);
+	}, i = r(n(e) ?? S.rpc, e);
 	return r(n(t) ?? i, t);
-}, v = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), y = (e, t) => {
+}, T = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), E = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return e;
 	let n = {};
 	for (let [r, i] of Object.entries(e)) n[t(r)] = i;
 	return n;
-}, b = (e) => n.getOrUndefined(t.getIdentifierAnnotation(e)), x = (n, r) => {
+}, D = (e) => n.getOrUndefined(t.getIdentifierAnnotation(e)), O = (n, r) => {
 	if (r.dates === "epoch-ms" && r.naming === "camelCase") return n;
 	let i = /* @__PURE__ */ new Map(), a = (e) => {
 		let t = i.get(e);
@@ -132,7 +187,7 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 	}, o = (n) => {
 		switch (n._tag) {
 			case "Transformation":
-				if (r.dates === "iso" && b(n) === "DateFromNumber") {
+				if (r.dates === "iso" && D(n) === "DateFromNumber") {
 					let r = e.DateFromString.ast;
 					return new t.Transformation(r.from, r.to, r.transformation, {
 						...r.annotations,
@@ -150,43 +205,43 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 			case "TupleType": return new t.TupleType(n.elements.map((e) => new t.OptionalType(a(e.type), e.isOptional, e.annotations)), n.rest.map((e) => new t.Type(a(e.type), e.annotations)), n.isReadonly, n.annotations);
 			case "Suspend": return new t.Suspend(() => a(n.f()), n.annotations);
 			case "TypeLiteral": {
-				let i = n.propertySignatures.map((e) => new t.PropertySignature(e.name, a(e.type), e.isOptional, e.isReadonly, e.annotations)), o = new t.TypeLiteral(i, n.indexSignatures, n.annotations);
-				if (r.naming !== "snake_case") return o;
-				let s = i.map((e) => typeof e.name == "string" ? v(e.name) : e.name);
-				if (s.every((e, t) => e === i[t].name)) return o;
-				let c = new t.TypeLiteral(i.map((e, n) => new t.PropertySignature(s[n], t.encodedAST(e.type), e.isOptional, e.isReadonly, e.annotations)), n.indexSignatures, n.annotations), l = new Map(i.map((e, t) => [String(s[t]), String(e.name)])), u = new Map(i.map((e, t) => [String(e.name), String(s[t])]));
-				return e.transform(e.make(c), e.make(o), {
+				let i = n.propertySignatures.map((e) => new t.PropertySignature(e.name, a(e.type), e.isOptional, e.isReadonly, e.annotations)), o = n.indexSignatures.map((e) => new t.IndexSignature(e.parameter, a(e.type), e.isReadonly)), s = new t.TypeLiteral(i, o, n.annotations);
+				if (r.naming !== "snake_case") return s;
+				let c = i.map((e) => typeof e.name == "string" ? T(e.name) : e.name);
+				if (c.every((e, t) => e === i[t].name)) return s;
+				let l = new t.TypeLiteral(i.map((e, n) => new t.PropertySignature(c[n], t.encodedAST(e.type), e.isOptional, e.isReadonly, e.annotations)), o.map((e) => new t.IndexSignature(e.parameter, t.encodedAST(e.type), e.isReadonly)), n.annotations), u = new Map(i.map((e, t) => [String(c[t]), String(e.name)])), d = new Map(i.map((e, t) => [String(e.name), String(c[t])]));
+				return e.transform(e.make(l), e.make(s), {
 					strict: !1,
-					decode: (e) => y(e, (e) => l.get(e) ?? e),
-					encode: (e) => y(e, (e) => u.get(e) ?? e)
+					decode: (e) => E(e, (e) => u.get(e) ?? e),
+					encode: (e) => E(e, (e) => d.get(e) ?? e)
 				}).ast;
 			}
 			default: return n;
 		}
 	};
 	return e.make(a(n.ast));
-}, S = (e) => `urn:voltro:error:${e}`, C = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), w = (e) => ({
-	type: S(e.tag),
-	title: C(e.tag),
+}, k = (e) => `urn:voltro:error:${e}`, A = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), j = (e) => ({
+	type: k(e.tag),
+	title: A(e.tag),
 	status: e.status,
 	...e.message.length > 0 ? { detail: e.message } : {},
 	...e.fields
-}), T = "application/problem+json; charset=utf-8", E = "application/vnd.api+json; charset=utf-8", D = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
+}), M = "application/problem+json; charset=utf-8", N = "application/vnd.api+json; charset=utf-8", P = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
 	body: { errors: [{
 		status: String(t.status),
 		code: t.tag,
-		title: C(t.tag),
+		title: A(t.tag),
 		...t.message.length > 0 ? { detail: t.message } : {},
 		...Object.keys(t.fields).length > 0 ? { meta: t.fields } : {}
 	}] },
-	contentType: E
+	contentType: N
 } : {
-	body: w(t),
-	contentType: T
+	body: j(t),
+	contentType: M
 } : { body: {
 	error: t.tag === "InvalidRequest" || t.tag === "InternalServerError" || t.tag === "Unauthorized" || t.tag === "Forbidden" || t.tag === "Gone" || t.tag === "MethodNotAllowed" || t.tag === "Conflict" ? t.message : t.tag,
 	...t.fields
-} } : e.encodeError(t, n), O = (e, t) => {
+} } : e.encodeError(t, n), F = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return {
 		cursor: void 0,
 		rest: e
@@ -199,10 +254,10 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		cursor: String(n),
 		rest: e
 	};
-}, k = (e, t, n) => {
+}, I = (e, t, n) => {
 	let r = new URLSearchParams(e.query);
 	return r.set(n, t), `<${e.path}?${r.toString()}>; rel="next"`;
-}, A = (e, t) => {
+}, L = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return e;
 	let { id: n, ...r } = e;
 	return {
@@ -210,9 +265,9 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		...n === void 0 ? {} : { id: String(n) },
 		attributes: r
 	};
-}, j = (e, t, n) => {
+}, R = (e, t, n) => {
 	if (e.encodeSuccess !== void 0) return e.encodeSuccess(t, n);
-	let { cursor: r } = O(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: k(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
+	let { cursor: r } = F(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: I(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
 		body: e,
 		...i ? { headers: i } : {},
 		...t ? { contentType: t } : {}
@@ -224,9 +279,9 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 	});
 	let o = n.source ?? n.tag.split(".")[0] ?? "resource", s = Array.isArray(t) ? t : typeof t == "object" && t && Array.isArray(t.items) ? t.items : void 0;
 	return a({
-		data: s === void 0 ? A(t, o) : s.map((e) => A(e, o)),
-		...r === void 0 ? {} : { links: { next: k(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
-	}, E);
+		data: s === void 0 ? L(t, o) : s.map((e) => L(e, o)),
+		...r === void 0 ? {} : { links: { next: I(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
+	}, N);
 };
 //#endregion
-export { i as S, o as _, j as a, r as b, S as c, v as d, p as f, u as g, a as h, D as i, _ as l, d as m, T as n, k as o, m as p, g as r, w as s, E as t, x as u, c as v, l as x, s as y };
+export { c as C, i as D, l as E, o as S, r as T, m as _, R as a, a as b, k as c, T as d, b as f, g, _ as h, P as i, w as l, v as m, M as n, I as o, x as p, C as r, j as s, N as t, O as u, h as v, s as w, u as x, d as y };

package/dist/{scopes-DVtiKKsm.js → scopes-CW9_LbDO.js}

@@ -20,6 +20,7 @@ var i = n.Record({
 	type: n.Literal("serviceAccount"),
 	id: n.String,
 	tenantId: n.String,
+	auditActorId: n.optionalWith(n.NullOr(n.String), { exact: !0 }),
 	scopes: a,
 	metadata: n.optional(i)
 }), l = n.Struct({
@@ -42,24 +43,31 @@ var i = n.Record({
 	id: null,
 	tenantId: e,
 	...t === void 0 ? {} : { credentialRejected: t }
-}), ee = (e, t = ["admin:full"]) => ({
+}), g = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), te = (e, t) => {
+}), _ = (e) => {
+	if (e.type === "system") return null;
+	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
+	if (e.type !== "apiKey") return e.id;
+	let t = e.metadata?.userId;
+	return typeof t == "string" && t !== "" ? t : e.id;
+}, ee = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
 		id: e.id ?? "system",
 		tenantId: t,
-		scopes: n.scopes ?? ["admin:full"],
+		auditActorId: _(e),
+		scopes: m(e),
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, ne = (e) => typeof e.mountRoutes == "function", C = (e) => Array.isArray(e) ? {
+}, te = (e) => e.type === "system", ne = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, C = (e) => typeof e.mountRoutes == "function", w = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, w = (e, t) => {
+} : e, T = (e, t) => {
 	if (t.kind === "vetoed") throw new k({ reason: `${t.code}: ${t.message}` });
 	if (e.type === "anonymous") return {
 		subject: e,
@@ -88,13 +96,13 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, re = 3e4, ie = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
+}, re = 3e4, ie = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, E = (e = {}) => {
+}, D = (e = {}) => {
 	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
@@ -134,21 +142,21 @@ var i = n.Record({
 }, oe = (e) => typeof e.resolve == "function", se = (e) => {
 	let t = e.authorization ?? e.Authorization;
 	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
-}, D = (e, t) => {
+}, O = (e, t) => {
 	let n = se(t);
 	if (n === void 0) return e;
 	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
 	if (r.length === 0) return e;
 	let i = new Set(r);
 	return [...r, ...e.filter((e) => !i.has(e))];
-}, O = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
+}, ce = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
 	return async (o) => {
 		let s = t?.getStore?.(), c = s === void 0 ? o : {
 			...o,
 			store: s
 		}, l;
-		for (let o of D(e, c.headers)) {
+		for (let o of O(e, c.headers)) {
 			let e = await o.resolve(c);
 			if (e.kind === "matched") {
 				let s = e.subject;
@@ -157,9 +165,9 @@ var i = n.Record({
 						let t = n === void 0 ? {
 							kind: "grant",
 							scopes: []
-						} : C(await n(e.subject, c));
+						} : w(await n(e.subject, c));
 						if (t.kind === "unavailable" || r.length === 0) return t;
-						let i = w(e.subject, t).subject, a = {
+						let i = T(e.subject, t).subject, a = {
 							origin: "request",
 							headers: c.headers,
 							clientId: c.clientId,
@@ -177,7 +185,7 @@ var i = n.Record({
 					}, { decision: l, fresh: u } = a === null ? {
 						decision: await i(),
 						fresh: !0
-					} : await a.resolve(T(e.subject), i);
+					} : await a.resolve(E(e.subject), i);
 					if (l.kind === "vetoed") {
 						let e = `${l.code}: ${l.message}`;
 						throw t?.onStrategyFailed?.({
@@ -192,7 +200,7 @@ var i = n.Record({
 							reason: e
 						}), new k({ reason: e });
 					}
-					let d = w(e.subject, l);
+					let d = T(e.subject, l);
 					u && d.removed.length > 0 && t?.onScopesNarrowed?.({
 						strategyId: o.id,
 						subjectType: e.subject.type,
@@ -245,9 +253,24 @@ var i = n.Record({
 }, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
 	required: n,
 	message: `missing required scope '${n}'`
-})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => e.authenticated === !0, K = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ce = (e) => {
+})), U = (e, t) => {
+	let n;
+	try {
+		n = typeof e.action == "function" ? e.action(t) : e.action;
+	} catch {
+		throw new F({
+			required: e.resourceType,
+			message: "policy action selector failed"
+		});
+	}
+	if (typeof n != "string" || n.trim() === "") throw new F({
+		required: e.resourceType,
+		message: "policy action selector returned no action"
+	});
+	return n;
+}, W = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", G = (e) => typeof e.open == "string", K = (e) => e.authenticated === !0, le = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ue = (e) => {
 	J = e;
-}, le = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], ue = (e) => [
+}, Y = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !W(e) && e.resource !== void 0)).map((e) => e.tag) : [], de = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -261,9 +284,9 @@ var i = n.Record({
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), de = () => J, Y, fe = (e) => {
-	Y = e;
-}, X = () => Y, Z = (e) => new F({
+].join("\n"), fe = () => J, X, pe = (e) => {
+	X = e;
+}, me = () => X, Z = (e) => new F({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
@@ -272,15 +295,15 @@ var i = n.Record({
 }, $ = (e, t, n) => {
 	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
 	for (let n of t) {
-		if (W(n)) continue;
-		if (G(n)) {
+		if (G(n)) continue;
+		if (K(n)) {
 			if (e.id !== null && e.id !== void 0) continue;
 			return Q(e, new F({
 				required: "authenticated",
 				message: "this procedure requires an authenticated caller"
 			}));
 		}
-		if (U(n)) {
+		if (W(n)) {
 			if (B(e, "admin:full")) continue;
 			return Q(e, new F({
 				required: `${n.resourceType}:${n.action}`,
@@ -299,36 +322,42 @@ var i = n.Record({
 		}
 	}
 	return null;
-}, pe = (e, n, r) => {
-	let i = (e) => new F({
-		required: `${n.resourceType}:${n.action}`,
+}, he = (e, n, r) => {
+	let i;
+	try {
+		i = U(n, r);
+	} catch (e) {
+		return t.succeed(e);
+	}
+	let a = (e) => new F({
+		required: `${n.resourceType}:${i}`,
 		message: e
 	});
 	if (B(e, "admin:full")) return t.succeed(null);
-	let a = Y;
-	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
-	let o = n.resource(r);
-	return o === void 0 || o === "" ? t.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => a({
+	let o = X;
+	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
+	let s = n.resource(r);
+	return s === void 0 || s === "" ? t.succeed(a(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => o({
 		subject: e,
-		action: n.action,
+		action: i,
 		resourceType: n.resourceType,
-		resourceId: o
-	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
-}, me = (e, n, r, i) => {
+		resourceId: s
+	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : a(`no '${i}' relation on ${n.resourceType}:${s}`)));
+}, ge = (e, n, r, i) => {
 	if (!n || n.length === 0) return t.succeed($(e, n, i));
 	let a = J;
-	return !n.some(U) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
+	return !n.some(W) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
 		for (let i of n) {
-			if (W(i)) continue;
-			if (G(i)) {
+			if (G(i)) continue;
+			if (K(i)) {
 				if (e.id !== null && e.id !== void 0) continue;
 				return Q(e, new F({
 					required: "authenticated",
 					message: "this procedure requires an authenticated caller"
 				}));
 			}
-			if (U(i)) {
-				let t = yield* pe(e, i, r);
+			if (W(i)) {
+				let t = yield* he(e, i, r);
 				if (t) return t;
 				continue;
 			}
@@ -362,4 +391,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { _ as A, g as B, ce as C, S as D, b as E, h as F, p as G, D as H, w as I, ee as K, A as L, f as M, y as N, ie as O, k as P, O as R, fe as S, x as T, v as U, E as V, T as W, U as _, F as a, H as b, me as c, X as d, de as f, W as g, G as h, M as i, d as j, re as k, z as l, V as m, N as n, ue as o, B as p, te as q, P as r, $ as s, j as t, le as u, Z as v, I as w, R as x, K as y, ne as z };
+export { re as A, C as B, pe as C, b as D, x as E, k as F, E as G, D as H, h as I, g as J, _ as K, T as L, d as M, f as N, S as O, y as P, A as R, R as S, I as T, O as U, te as V, v as W, ee as Y, W as _, F as a, H as b, ge as c, me as d, fe as f, G as g, K as h, M as i, ne as j, ie as k, z as l, V as m, N as n, de as o, B as p, p as q, P as r, $ as s, j as t, Y as u, Z as v, ue as w, U as x, le as y, ce as z };

package/dist/session.d.ts

@@ -176,6 +176,9 @@ declare const SessionPayload_2: Schema.Struct<{
         id: typeof Schema.String;
         tenantId: typeof Schema.String;
         metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+        auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+            exact: true;
+        }>;
     }>, Schema.Struct<{
         type: Schema.Literal<["anonymous"]>;
         id: typeof Schema.Null;
@@ -274,6 +277,11 @@ declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["serviceAccount"]>;
     id: typeof Schema.String;
     tenantId: typeof Schema.String;
+    /** Application actor used for audit columns; null means machine work with
+     * no application actor. Identity only, never a permission grant. */
+    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+        exact: true;
+    }>;
     scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
 }>, Schema.Struct<{
@@ -322,6 +330,9 @@ declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
     id: typeof Schema.String;
     tenantId: typeof Schema.String;
     metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
+        exact: true;
+    }>;
 }>, Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;

package/dist/session.js

@@ -1,11 +1,11 @@
-import { G as e, M as t, w as n } from "./scopes-DVtiKKsm.js";
+import { N as e, T as t, q as n } from "./scopes-CW9_LbDO.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";
 //#region src/session.ts
 var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 	v: r.Literal(2),
-	subject: t,
+	subject: e,
 	exp: r.Number,
 	iat: r.Number,
 	kid: r.optional(r.String)
@@ -38,14 +38,14 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 }, C = 604800, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, D = (t, r, i = {}) => {
+} : e, D = (e, r, i = {}) => {
 	let a = E(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
-	let o = n(t);
-	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${t.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let o = t(e);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
 	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
-		subject: e(t),
+		subject: n(e),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.70.0",
+  "version": "0.71.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -48,7 +48,12 @@
       "import": "./dist/identity.js",
       "default": "./dist/identity.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./inspect": {
+      "types": "./dist/inspect.d.ts",
+      "import": "./dist/inspect.js",
+      "default": "./dist/inspect.js"
+    }
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -59,8 +64,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.70.0",
-    "@voltro/logger": "0.70.0",
+    "@voltro/database": "0.71.0",
+    "@voltro/logger": "0.71.0",
     "jose": "^6.2.10"
   },
   "peerDependencies": {