@voltro/protocol 0.71.1 → 0.73.0

package/dist/inspect.js

@@ -129,6 +129,7 @@ var t = e.String.pipe(e.filter((e) => Number.isFinite(Date.parse(e)))), n = e.St
 			voltro_replica: e.replicaId
 		}
 	}))) };
+	else if (r.length === 1 && i.length === 1) p = i[0].data;
 	else throw Error("This view must compare observations per replica; its values cannot be safely combined.");
 	return {
 		...t,

package/dist/rest.js

@@ -1,4 +1,4 @@
-import { F as e, I as t } from "./scopes-CW9_LbDO.js";
+import { I as e, L as t } from "./scopes-Dj7KCJab.js";
 import { C as n, S as r, T as i, _ as a, a as o, c as s, d as c, f as l, i as u, l as d, n as f, o as p, r as m, s as h, t as g, u as _, v, w as y } from "./restFormat-ChSVyufA.js";
 import { Effect as b, ParseResult as x, Schema as S } from "effect";
 import * as C from "effect/SchemaAST";

package/dist/{scopes-CW9_LbDO.js → scopes-Dj7KCJab.js}

@@ -1,79 +1,108 @@
 import { Context as e, Effect as t, Schema as n } from "effect";
 import { RpcMiddleware as r } from "@effect/rpc";
-//#region src/auth.ts
-var i = n.Record({
+//#region src/tenantSelection.ts
+var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAccount", a = class extends n.TaggedError()("TenantSelectionRefused", {
+	subjectType: n.String,
+	subjectId: n.NullOr(n.String),
+	tenantId: n.String,
+	reason: n.Literal("not-a-member", "subject-has-no-tenant")
+}) {}, o = (e, t, n) => {
+	if (!i(e)) throw new a({
+		subjectType: e.type,
+		subjectId: e.id,
+		tenantId: t,
+		reason: "subject-has-no-tenant"
+	});
+	if (!n.some((e) => e.tenantId === t)) throw new a({
+		subjectType: e.type,
+		subjectId: e.id,
+		tenantId: t,
+		reason: "not-a-member"
+	});
+	return {
+		...e,
+		tenantId: t,
+		metadata: {
+			...e.metadata,
+			memberships: n.map((e) => e.role === void 0 ? { tenantId: e.tenantId } : {
+				tenantId: e.tenantId,
+				role: e.role
+			})
+		}
+	};
+}, s = n.Record({
 	key: n.String,
 	value: n.Unknown
-}), a = n.optional(n.Array(n.String)), o = n.Struct({
+}), c = n.optional(n.Array(n.String)), l = n.Struct({
 	type: n.Literal("user"),
 	id: n.String,
 	tenantId: n.String,
-	scopes: a,
-	metadata: n.optional(i)
-}), s = n.Struct({
+	scopes: c,
+	metadata: n.optional(s)
+}), u = n.Struct({
 	type: n.Literal("apiKey"),
 	id: n.String,
 	tenantId: n.String,
-	scopes: a,
-	metadata: n.optional(i)
-}), c = n.Struct({
+	scopes: c,
+	metadata: n.optional(s)
+}), d = n.Struct({
 	type: n.Literal("serviceAccount"),
 	id: n.String,
 	tenantId: n.String,
 	auditActorId: n.optionalWith(n.NullOr(n.String), { exact: !0 }),
-	scopes: a,
-	metadata: n.optional(i)
-}), l = n.Struct({
+	scopes: c,
+	metadata: n.optional(s)
+}), f = n.Struct({
 	type: n.Literal("anonymous"),
 	id: n.Null,
 	tenantId: n.NullOr(n.String),
 	credentialRejected: n.optional(n.String)
-}), u = n.Struct({
+}), p = n.Struct({
 	type: n.Literal("system"),
 	id: n.String,
 	tenantId: n.Null,
-	scopes: a,
-	metadata: n.optional(i)
-}), d = n.Union(o, s, c, l, u), f = n.Union(o.omit("scopes"), s.omit("scopes"), c.omit("scopes"), l, u.omit("scopes")), p = (e) => {
+	scopes: c,
+	metadata: n.optional(s)
+}), ee = n.Union(l, u, d, f, p), m = n.Union(l.omit("scopes"), u.omit("scopes"), d.omit("scopes"), f, p.omit("scopes")), h = (e) => {
 	if (e.type === "anonymous") return e;
 	let { scopes: t, ...n } = e;
 	return n;
-}, m = (e) => e.scopes ?? [], h = (e, t) => ({
+}, g = (e) => e.scopes ?? [], _ = (e, t) => ({
 	type: "anonymous",
 	id: null,
 	tenantId: e,
 	...t === void 0 ? {} : { credentialRejected: t }
-}), g = (e, t = ["admin:full"]) => ({
+}), te = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), _ = (e) => {
+}), v = (e) => {
 	if (e.type === "system") return null;
 	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
 	if (e.type !== "apiKey") return e.id;
 	let t = e.metadata?.userId;
 	return typeof t == "string" && t !== "" ? t : e.id;
-}, ee = (e, t) => {
+}, ne = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
 		id: e.id ?? "system",
 		tenantId: t,
-		auditActorId: _(e),
-		scopes: m(e),
+		auditActorId: v(e),
+		scopes: g(e),
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, te = (e) => e.type === "system", ne = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, C = (e) => typeof e.mountRoutes == "function", w = (e) => Array.isArray(e) ? {
+}, re = (e) => e.type === "system", ie = "impersonation", ae = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, oe = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, x = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, S = (e) => typeof e.mountRoutes == "function", se = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, T = (e, t) => {
-	if (t.kind === "vetoed") throw new k({ reason: `${t.code}: ${t.message}` });
+} : e, C = (e, t) => {
+	if (t.kind === "vetoed") throw new A({ reason: `${t.code}: ${t.message}` });
 	if (e.type === "anonymous") return {
 		subject: e,
 		removed: []
 	};
-	let n = m(e);
+	let n = g(e);
 	if (t.kind === "grant") {
 		if (t.scopes.length === 0) return {
 			subject: e,
@@ -96,14 +125,14 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, re = 3e4, ie = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
+}, w = 3e4, T = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ce = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
 }, D = (e = {}) => {
-	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+	let t = e.ttlMs ?? ce() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -139,138 +168,179 @@ var i = n.Record({
 			};
 		}
 	};
-}, oe = (e) => typeof e.resolve == "function", se = (e) => {
+}, le = (e) => typeof e.resolve == "function", ue = (e) => {
 	let t = e.authorization ?? e.Authorization;
 	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
+}, de = async (e, t, n, r) => {
+	if (!i(e)) return e;
+	let s = {
+		type: e.type,
+		id: e.id
+	}, c;
+	try {
+		c = await n.store.read(s);
+	} catch (e) {
+		throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (c === null || c === e.tenantId) return e;
+	let l;
+	try {
+		l = await n.memberships(e, t);
+	} catch (e) {
+		throw r(`memberships unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	try {
+		return o(e, c, l);
+	} catch (t) {
+		if (!(t instanceof a)) throw t;
+		try {
+			await n.store.clear(s);
+		} catch (e) {
+			throw r(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+		}
+		return e;
+	}
 }, O = (e, t) => {
-	let n = se(t);
+	let n = ue(t);
 	if (n === void 0) return e;
 	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
 	if (r.length === 0) return e;
 	let i = new Set(r);
 	return [...r, ...e.filter((e) => !i.has(e))];
-}, ce = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && oe(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
-	return async (o) => {
-		let s = t?.getStore?.(), c = s === void 0 ? o : {
-			...o,
-			store: s
-		}, l;
-		for (let o of O(e, c.headers)) {
-			let e = await o.resolve(c);
+}, k = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [];
+	if (t?.memberships === void 0 != (t?.tenantSelection === void 0)) throw Error("composeAuthStrategies: `memberships` and `tenantSelection` come together — a tenant selection is verified against the memberships and read from the store; configure both or neither.");
+	let i = t?.memberships !== void 0 && t.tenantSelection !== void 0 ? {
+		memberships: t.memberships,
+		store: t.tenantSelection
+	} : void 0, a = n !== void 0 || r.length > 0, o = !a || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && le(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
+	return async (s) => {
+		let c = t?.getStore?.(), l = c === void 0 ? s : {
+			...s,
+			store: c
+		}, u;
+		for (let s of O(e, l.headers)) {
+			let e = await s.resolve(l);
 			if (e.kind === "matched") {
-				let s = e.subject;
-				if (i) {
-					let i = async () => {
-						let t = n === void 0 ? {
+				let c = i === void 0 ? e.subject : await de(e.subject, l, i, (e) => (t?.onStrategyFailed?.({
+					strategyId: s.id,
+					reason: e
+				}), new A({ reason: e }))), u = c;
+				if (a) {
+					let e = async () => {
+						let e = n === void 0 ? {
 							kind: "grant",
 							scopes: []
-						} : w(await n(e.subject, c));
-						if (t.kind === "unavailable" || r.length === 0) return t;
-						let i = T(e.subject, t).subject, a = {
+						} : se(await n(c, l));
+						if (e.kind === "unavailable" || r.length === 0) return e;
+						let t = C(c, e).subject, i = {
 							origin: "request",
-							headers: c.headers,
-							clientId: c.clientId,
-							store: c.store
+							headers: l.headers,
+							clientId: l.clientId,
+							store: l.store
 						};
 						for (let e of r) {
-							let t = await e(i, a);
-							if (!t.ok) return {
+							let n = await e(t, i);
+							if (!n.ok) return {
 								kind: "vetoed",
-								code: t.code,
-								message: t.message
+								code: n.code,
+								message: n.message
 							};
 						}
-						return t;
-					}, { decision: l, fresh: u } = a === null ? {
-						decision: await i(),
+						return e;
+					}, { decision: i, fresh: a } = o === null ? {
+						decision: await e(),
 						fresh: !0
-					} : await a.resolve(E(e.subject), i);
-					if (l.kind === "vetoed") {
-						let e = `${l.code}: ${l.message}`;
+					} : await o.resolve(E(c), e);
+					if (i.kind === "vetoed") {
+						let e = `${i.code}: ${i.message}`;
 						throw t?.onStrategyFailed?.({
-							strategyId: o.id,
+							strategyId: s.id,
 							reason: e
-						}), new k({ reason: e });
+						}), new A({ reason: e });
 					}
-					if (l.kind === "unavailable") {
-						let e = `scope resolution unavailable: ${l.reason}`;
+					if (i.kind === "unavailable") {
+						let e = `scope resolution unavailable: ${i.reason}`;
 						throw t?.onStrategyFailed?.({
-							strategyId: o.id,
+							strategyId: s.id,
 							reason: e
-						}), new k({ reason: e });
+						}), new A({ reason: e });
 					}
-					let d = T(e.subject, l);
-					u && d.removed.length > 0 && t?.onScopesNarrowed?.({
-						strategyId: o.id,
-						subjectType: e.subject.type,
-						subjectId: e.subject.id,
+					let d = C(c, i);
+					a && d.removed.length > 0 && t?.onScopesNarrowed?.({
+						strategyId: s.id,
+						subjectType: c.type,
+						subjectId: c.id,
 						removed: d.removed,
-						granted: l.scopes
-					}), s = d.subject;
+						granted: i.scopes
+					}), u = d.subject;
 				}
-				return e.credentialExpiresAt === void 0 ? { subject: s } : {
-					subject: s,
+				return e.credentialExpiresAt === void 0 ? { subject: u } : {
+					subject: u,
 					credentialExpiresAt: e.credentialExpiresAt
 				};
 			}
 			if (e.kind === "failed") {
 				t?.onStrategyFailed?.({
-					strategyId: o.id,
+					strategyId: s.id,
 					reason: e.reason
-				}), l = e.reason;
+				}), u = e.reason;
 				break;
 			}
 		}
-		let u = (e) => l !== void 0 && e.type === "anonymous" ? {
-			...e,
-			credentialRejected: l
-		} : e;
-		if (t?.fallback) return { subject: u(await t.fallback(c)) };
-		let d = c.headers["x-tenant"] ?? null;
-		if (d === null && t?.anonymousTenantRequired === !0) throw new k({ reason: "tenant required (x-tenant header missing)" });
-		return { subject: u(h(d)) };
+		if (t?.fallback) {
+			let e = await t.fallback(l);
+			return { subject: u !== void 0 && e.type === "anonymous" ? {
+				...e,
+				credentialRejected: u
+			} : e };
+		}
+		if (u !== void 0) throw new A({ reason: `credential rejected: ${u}` });
+		if (t?.anonymousTenantId !== void 0) return { subject: _(t.anonymousTenantId) };
+		let d = l.headers["x-tenant"] ?? null;
+		if (d === null && t?.anonymousTenantRequired === !0) throw new A({ reason: "tenant required (x-tenant header missing)" });
+		return { subject: _(d) };
 	};
-}, k = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, A = (e, t) => {
-	if (e.type === "anonymous") throw new k(t === void 0 ? {} : { reason: t });
-}, j = "admin:full", M = "apikeys:issue:self", N = "apikeys:issue:org", P = "apikeys:issue:other", F = class extends n.TaggedError()("ScopeError", {
+}, A = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, j = (e, t) => {
+	if (e.type === "anonymous") throw new A(t === void 0 ? {} : { reason: t });
+}, M = "admin:full", N = "apikeys:issue:self", P = "apikeys:issue:org", F = "apikeys:issue:other", I = "devices:manage", L = class extends n.TaggedError()("ScopeError", {
 	required: n.String,
 	message: n.String
-}) {}, I = (e) => "scopes" in e && e.scopes ? e.scopes : [], L = /* @__PURE__ */ new WeakMap(), R = (e, t) => {
-	typeof e == "object" && e && L.set(e, t);
-}, z = (e) => {
+}) {}, R = (e) => "scopes" in e && e.scopes ? e.scopes : [], z = /* @__PURE__ */ new WeakMap(), B = (e, t) => {
+	typeof e == "object" && e && z.set(e, t);
+}, V = (e) => {
 	if (typeof e == "object" && e) {
-		let t = L.get(e);
+		let t = z.get(e);
 		if (t) return t;
 	}
-	return I(e);
-}, B = (e, t) => {
-	let n = z(e);
+	return R(e);
+}, H = (e, t) => {
+	let n = V(e);
 	return n.includes("admin:full") || n.includes(t);
-}, V = (e, t) => {
-	let n = I(e);
+}, U = (e, t) => {
+	let n = R(e);
 	return n.includes("admin:full") || n.includes(t);
-}, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
+}, fe = (e, n) => H(e, n) ? t.void : t.fail(new L({
 	required: n,
 	message: `missing required scope '${n}'`
-})), U = (e, t) => {
+})), W = (e, t) => {
 	let n;
 	try {
 		n = typeof e.action == "function" ? e.action(t) : e.action;
 	} catch {
-		throw new F({
+		throw new L({
 			required: e.resourceType,
 			message: "policy action selector failed"
 		});
 	}
-	if (typeof n != "string" || n.trim() === "") throw new F({
+	if (typeof n != "string" || n.trim() === "") throw new L({
 		required: e.resourceType,
 		message: "policy action selector returned no action"
 	});
 	return n;
-}, W = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", G = (e) => typeof e.open == "string", K = (e) => e.authenticated === !0, le = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, ue = (e) => {
-	J = e;
-}, Y = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !W(e) && e.resource !== void 0)).map((e) => e.tag) : [], de = (e) => [
+}, G = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", K = (e) => typeof e.open == "string", q = (e) => e.authenticated === !0, pe = (e) => ({ open: e }), J = (e) => typeof e == "string" ? [e] : e, Y, me = (e) => {
+	Y = e;
+}, he = (e) => Y === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !G(e) && e.resource !== void 0)).map((e) => e.tag) : [], ge = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -284,56 +354,56 @@ var i = n.Record({
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), fe = () => J, X, pe = (e) => {
+].join("\n"), _e = () => Y, X, ve = (e) => {
 	X = e;
-}, me = () => X, Z = (e) => new F({
+}, ye = () => X, Z = (e) => new L({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
 	let n = e.credentialRejected;
-	return n === void 0 ? t : new k({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
+	return n === void 0 ? t : new A({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
 }, $ = (e, t, n) => {
 	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
 	for (let n of t) {
-		if (G(n)) continue;
-		if (K(n)) {
+		if (K(n)) continue;
+		if (q(n)) {
 			if (e.id !== null && e.id !== void 0) continue;
-			return Q(e, new F({
+			return Q(e, new L({
 				required: "authenticated",
 				message: "this procedure requires an authenticated caller"
 			}));
 		}
-		if (W(n)) {
-			if (B(e, "admin:full")) continue;
-			return Q(e, new F({
+		if (G(n)) {
+			if (H(e, "admin:full")) continue;
+			return Q(e, new L({
 				required: `${n.resourceType}:${n.action}`,
 				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
 			}));
 		}
-		let t = q(n.scope);
+		let t = J(n.scope);
 		if (t.length === 0) continue;
-		let r = t.filter((t) => B(e, t));
+		let r = t.filter((t) => H(e, t));
 		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !B(e, t));
-			return Q(e, new F({
+			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !H(e, t));
+			return Q(e, new L({
 				required: r,
 				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
 			}));
 		}
 	}
 	return null;
-}, he = (e, n, r) => {
+}, be = (e, n, r) => {
 	let i;
 	try {
-		i = U(n, r);
+		i = W(n, r);
 	} catch (e) {
 		return t.succeed(e);
 	}
-	let a = (e) => new F({
+	let a = (e) => new L({
 		required: `${n.resourceType}:${i}`,
 		message: e
 	});
-	if (B(e, "admin:full")) return t.succeed(null);
+	if (H(e, "admin:full")) return t.succeed(null);
 	let o = X;
 	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
 	let s = n.resource(r);
@@ -343,29 +413,29 @@ var i = n.Record({
 		resourceType: n.resourceType,
 		resourceId: s
 	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : a(`no '${i}' relation on ${n.resourceType}:${s}`)));
-}, ge = (e, n, r, i) => {
+}, xe = (e, n, r, i) => {
 	if (!n || n.length === 0) return t.succeed($(e, n, i));
-	let a = J;
-	return !n.some(W) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
+	let a = Y;
+	return !n.some(G) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
 		for (let i of n) {
-			if (G(i)) continue;
-			if (K(i)) {
+			if (K(i)) continue;
+			if (q(i)) {
 				if (e.id !== null && e.id !== void 0) continue;
-				return Q(e, new F({
+				return Q(e, new L({
 					required: "authenticated",
 					message: "this procedure requires an authenticated caller"
 				}));
 			}
-			if (W(i)) {
-				let t = yield* he(e, i, r);
+			if (G(i)) {
+				let t = yield* be(e, i, r);
 				if (t) return t;
 				continue;
 			}
-			let n = q(i.scope);
+			let n = J(i.scope);
 			if (n.length === 0) continue;
 			let o = i.resource ? i.resource(r) : void 0, s = [];
 			for (let r of n) {
-				if (B(e, r)) {
+				if (H(e, r)) {
 					s.push(!0);
 					continue;
 				}
@@ -381,7 +451,7 @@ var i = n.Record({
 			let c = i.mode ?? "all";
 			if (!(c === "any" ? s.some(Boolean) : s.every(Boolean))) {
 				let e = c === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				return new F({
+				return new L({
 					required: e,
 					message: c === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (o === void 0 ? "" : ` on resource '${o}'`)
 				});
@@ -391,4 +461,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { re as A, C as B, pe as C, b as D, x as E, k as F, E as G, D as H, h as I, g as J, _ as K, T as L, d as M, f as N, S as O, y as P, A as R, R as S, I as T, O as U, te as V, v as W, ee as Y, W as _, F as a, H as b, ge as c, me as d, fe as f, G as g, K as h, M as i, ne as j, ie as k, z as l, V as m, N as n, de as o, B as p, p as q, P as r, $ as s, j as t, Y as u, Z as v, ue as w, U as x, le as y, ce as z };
+export { o as $, T as A, k as B, B as C, oe as D, R as E, y as F, ae as G, re as H, A as I, h as J, E as K, _ as L, ie as M, ee as N, b as O, m as P, i as Q, C as R, W as S, me as T, D as U, S as V, O as W, ne as X, te as Y, a as Z, K as _, I as a, pe as b, $ as c, he as d, ye as f, q as g, U as h, N as i, w as j, x as k, xe as l, H as m, P as n, L as o, _e as p, v as q, F as r, ge as s, M as t, V as u, G as v, ve as w, fe as x, Z as y, j as z };

package/dist/session.js

@@ -1,11 +1,11 @@
-import { N as e, T as t, q as n } from "./scopes-CW9_LbDO.js";
+import { E as e, J as t, P as n } from "./scopes-Dj7KCJab.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";
 //#region src/session.ts
 var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 	v: r.Literal(2),
-	subject: e,
+	subject: n,
 	exp: r.Number,
 	iat: r.Number,
 	kid: r.optional(r.String)
@@ -38,14 +38,14 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 }, C = 604800, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, D = (e, r, i = {}) => {
+} : e, D = (n, r, i = {}) => {
 	let a = E(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
-	let o = t(e);
-	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let o = e(n);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${n.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
 	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
-		subject: n(e),
+		subject: t(n),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.71.1",
+  "version": "0.73.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -63,9 +63,10 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
+    "@effect/experimental": "^0.61.1",
     "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.71.1",
-    "@voltro/logger": "0.71.1",
+    "@voltro/database": "0.73.0",
+    "@voltro/logger": "0.73.0",
     "jose": "^6.2.10"
   },
   "peerDependencies": {