@voltro/protocol 0.81.0 → 0.83.0

package/dist/{restFormat-CzdGVkuB.js → restFormat-EZ8k9ZcQ.js}

@@ -118,13 +118,18 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		differing: n.sort(),
 		missingHere: r.sort()
 	};
-}, S = /* @__PURE__ */ new Set(), C = (e) => {
-	for (let t of S) try {
+}, S = (e) => {
+	let t = e.error, n = t instanceof Error ? t.name : typeof t?._tag == "string" ? String(t._tag) : "Error", r = [e.name === void 0 ? e.source : `${e.source} '${e.name}'`, ...typeof e.fields?.runId == "string" ? [`run ${e.fields.runId}`] : []].join(", "), i = /* @__PURE__ */ Error(`[message withheld: ${r} is declared encrypted — read it where the run is shown]`);
+	i.name = n;
+	let a = t instanceof Error && typeof t.stack == "string" ? t.stack : "", o = a.search(/^\s+at /m);
+	return i.stack = `${n}: ${i.message}${o === -1 ? "" : `\n${a.slice(o)}`}`, i;
+}, C = /* @__PURE__ */ new Set(), w = (e) => {
+	for (let t of C) try {
 		t(e);
 	} catch {}
-}, w = (e) => (S.add(e), () => {
-	S.delete(e);
-}), T = {
+}, T = (e) => (C.add(e), () => {
+	C.delete(e);
+}), E = {
 	rpc: {
 		name: "rpc",
 		dates: "epoch-ms",
@@ -158,16 +163,16 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		naming: "camelCase",
 		etag: !0
 	}
-}, E = [
+}, D = [
 	"rpc",
 	"standard",
 	"jsonapi"
-], D = (e, t = void 0) => {
+], O = (e, t = void 0) => {
 	let n = (e) => {
 		if (e?.profile !== void 0) {
 			if (typeof e.profile == "string") {
-				let t = T[e.profile];
-				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${E.join(", ")}, or a RestFormat object`);
+				let t = E[e.profile];
+				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${D.join(", ")}, or a RestFormat object`);
 				return t;
 			}
 			return e.profile;
@@ -182,14 +187,14 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		...t.cursorParam === void 0 ? {} : { cursorParam: t.cursorParam },
 		...t.naming === void 0 ? {} : { naming: t.naming },
 		...t.etag === void 0 ? {} : { etag: t.etag }
-	}, i = r(n(e) ?? T.rpc, e);
+	}, i = r(n(e) ?? E.rpc, e);
 	return r(n(t) ?? i, t);
-}, O = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), k = (e, t) => {
+}, k = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), A = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return e;
 	let n = {};
 	for (let [r, i] of Object.entries(e)) n[t(r)] = i;
 	return n;
-}, A = (e) => n.getOrUndefined(t.getIdentifierAnnotation(e)), j = (n, r) => {
+}, j = (e) => n.getOrUndefined(t.getIdentifierAnnotation(e)), M = (n, r) => {
 	if (r.dates === "epoch-ms" && r.naming === "camelCase") return n;
 	let i = /* @__PURE__ */ new Map(), a = (e) => {
 		let t = i.get(e);
@@ -199,7 +204,7 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 	}, o = (n) => {
 		switch (n._tag) {
 			case "Transformation":
-				if (r.dates === "iso" && A(n) === "DateFromNumber") {
+				if (r.dates === "iso" && j(n) === "DateFromNumber") {
 					let r = e.DateFromString.ast;
 					return new t.Transformation(r.from, r.to, r.transformation, {
 						...r.annotations,
@@ -219,41 +224,41 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 			case "TypeLiteral": {
 				let i = n.propertySignatures.map((e) => new t.PropertySignature(e.name, a(e.type), e.isOptional, e.isReadonly, e.annotations)), o = n.indexSignatures.map((e) => new t.IndexSignature(e.parameter, a(e.type), e.isReadonly)), s = new t.TypeLiteral(i, o, n.annotations);
 				if (r.naming !== "snake_case") return s;
-				let c = i.map((e) => typeof e.name == "string" ? O(e.name) : e.name);
+				let c = i.map((e) => typeof e.name == "string" ? k(e.name) : e.name);
 				if (c.every((e, t) => e === i[t].name)) return s;
 				let l = new t.TypeLiteral(i.map((e, n) => new t.PropertySignature(c[n], t.encodedAST(e.type), e.isOptional, e.isReadonly, e.annotations)), o.map((e) => new t.IndexSignature(e.parameter, t.encodedAST(e.type), e.isReadonly)), n.annotations), u = new Map(i.map((e, t) => [String(c[t]), String(e.name)])), d = new Map(i.map((e, t) => [String(e.name), String(c[t])]));
 				return e.transform(e.make(l), e.make(s), {
 					strict: !1,
-					decode: (e) => k(e, (e) => u.get(e) ?? e),
-					encode: (e) => k(e, (e) => d.get(e) ?? e)
+					decode: (e) => A(e, (e) => u.get(e) ?? e),
+					encode: (e) => A(e, (e) => d.get(e) ?? e)
 				}).ast;
 			}
 			default: return n;
 		}
 	};
 	return e.make(a(n.ast));
-}, M = (e) => `urn:voltro:error:${e}`, N = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), P = (e) => ({
-	type: M(e.tag),
-	title: N(e.tag),
+}, N = (e) => `urn:voltro:error:${e}`, P = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), F = (e) => ({
+	type: N(e.tag),
+	title: P(e.tag),
 	status: e.status,
 	...e.message.length > 0 ? { detail: e.message } : {},
 	...e.fields
-}), F = "application/problem+json; charset=utf-8", I = "application/vnd.api+json; charset=utf-8", L = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
+}), I = "application/problem+json; charset=utf-8", L = "application/vnd.api+json; charset=utf-8", R = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
 	body: { errors: [{
 		status: String(t.status),
 		code: t.tag,
-		title: N(t.tag),
+		title: P(t.tag),
 		...t.message.length > 0 ? { detail: t.message } : {},
 		...Object.keys(t.fields).length > 0 ? { meta: t.fields } : {}
 	}] },
-	contentType: I
+	contentType: L
 } : {
-	body: P(t),
-	contentType: F
+	body: F(t),
+	contentType: I
 } : { body: {
 	error: t.tag === "InvalidRequest" || t.tag === "InternalServerError" || t.tag === "Unauthorized" || t.tag === "Forbidden" || t.tag === "Gone" || t.tag === "MethodNotAllowed" || t.tag === "Conflict" ? t.message : t.tag,
 	...t.fields
-} } : e.encodeError(t, n), R = (e, t) => {
+} } : e.encodeError(t, n), z = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return {
 		cursor: void 0,
 		rest: e
@@ -266,10 +271,10 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		cursor: String(n),
 		rest: e
 	};
-}, z = (e, t, n) => {
+}, B = (e, t, n) => {
 	let r = new URLSearchParams(e.query);
 	return r.set(n, t), `<${e.path}?${r.toString()}>; rel="next"`;
-}, B = (e, t) => {
+}, V = (e, t) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) return e;
 	let { id: n, ...r } = e;
 	return {
@@ -277,9 +282,9 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 		...n === void 0 ? {} : { id: String(n) },
 		attributes: r
 	};
-}, V = (e, t, n) => {
+}, H = (e, t, n) => {
 	if (e.encodeSuccess !== void 0) return e.encodeSuccess(t, n);
-	let { cursor: r } = R(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: z(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
+	let { cursor: r } = z(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: B(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
 		body: e,
 		...i ? { headers: i } : {},
 		...t ? { contentType: t } : {}
@@ -291,9 +296,9 @@ var r = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, i = (e, t, n,
 	});
 	let o = n.source ?? n.tag.split(".")[0] ?? "resource", s = Array.isArray(t) ? t : typeof t == "object" && t && Array.isArray(t.items) ? t.items : void 0;
 	return a({
-		data: s === void 0 ? B(t, o) : s.map((e) => B(e, o)),
-		...r === void 0 ? {} : { links: { next: z(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
-	}, I);
+		data: s === void 0 ? V(t, o) : s.map((e) => V(e, o)),
+		...r === void 0 ? {} : { links: { next: B(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
+	}, L);
 };
 //#endregion
-export { i as A, o as C, c as D, f as E, r as O, p as S, l as T, _, V as a, m as b, M as c, O as d, C as f, y as g, b as h, L as i, d as k, D as l, x as m, F as n, z as o, w as p, E as r, P as s, I as t, j as u, v, u as w, a as x, s as y };
+export { d as A, p as C, f as D, l as E, c as O, a as S, u as T, y as _, H as a, s as b, N as c, k as d, w as f, b as g, x as h, R as i, i as j, r as k, O as l, S as m, I as n, B as o, T as p, D as r, F as s, L as t, M as u, _ as v, o as w, m as x, v as y };

package/dist/{scopes-CvU5QBQ4.js → scopes-Di756ENh.js}

@@ -70,55 +70,55 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 	tenantId: n.Null,
 	scopes: c,
 	metadata: n.optional(s)
-}), ee = n.Union(l, u, d, f, p, m), te = n.Union(l.omit("scopes"), u.omit("scopes"), d.omit("scopes"), f, p.omit("scopes"), m.omit("scopes")), h = (e) => {
+}), ee = n.Union(l, u, d, f, p, m), te = n.Union(l.omit("scopes"), u.omit("scopes"), d.omit("scopes"), f, p.omit("scopes"), m.omit("scopes")), ne = (e) => {
 	if (e.type === "anonymous") return e;
 	let { scopes: t, ...n } = e;
 	return n;
-}, g = (e) => e.scopes ?? [], _ = (e, t) => ({
+}, h = (e) => e.scopes ?? [], g = (e, t) => ({
 	type: "anonymous",
 	id: null,
 	tenantId: e,
 	...t === void 0 ? {} : { credentialRejected: t }
-}), ne = (e, t = ["admin:full"]) => ({
+}), re = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), re = (e) => ({
+}), ie = (e) => ({
 	type: "service",
 	id: `service:${e}`,
 	service: e,
 	tenantId: null,
 	scopes: []
-}), ie = (e) => e.type === "service", ae = (e) => e.type === "system" || e.type === "service", v = (e) => {
+}), ae = (e) => e.type === "service", oe = (e) => e.type === "system" || e.type === "service", _ = (e) => {
 	if (e.type === "system") return null;
 	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
 	if (e.type !== "apiKey") return e.id;
 	let t = e.metadata?.userId;
 	return typeof t == "string" && t !== "" ? t : e.id;
-}, y = (e, t) => {
+}, v = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
 		id: e.id ?? "system",
 		tenantId: t,
-		auditActorId: v(e),
-		scopes: g(e),
+		auditActorId: _(e),
+		scopes: h(e),
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, b = (e) => e.type === "system", oe = "impersonation", se = (e) => e.metadata?.impersonation ?? null, x = class extends e.Tag("@voltro/Subject")() {}, S = class extends e.Tag("@voltro/ConnectionInfo")() {}, C = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, ce = class extends r.Tag()("@voltro/AuthMiddleware", {
-	provides: x,
-	failure: C
-}) {}, le = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: S }) {}, ue = (e) => typeof e.mountRoutes == "function", de = (e) => Array.isArray(e) ? {
+}, se = (e) => e.type === "system", ce = "impersonation", le = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, ue = class extends r.Tag()("@voltro/AuthMiddleware", {
+	provides: y,
+	failure: x
+}) {}, de = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, fe = (e) => typeof e.mountRoutes == "function", pe = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, w = (e, t) => {
-	if (t.kind === "vetoed") throw new C({ reason: `${t.code}: ${t.message}` });
+} : e, S = (e, t) => {
+	if (t.kind === "vetoed") throw new x({ reason: `${t.code}: ${t.message}` });
 	if (e.type === "anonymous") return {
 		subject: e,
 		removed: []
 	};
-	let n = g(e);
+	let n = h(e);
 	if (t.kind === "grant") {
 		if (t.scopes.length === 0) return {
 			subject: e,
@@ -141,14 +141,14 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 		},
 		removed: i
 	};
-}, fe = 3e4, pe = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, me = () => {
+}, me = 3e4, he = 1e4, C = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ge = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, E = (e = {}) => {
-	let t = e.ttlMs ?? me() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+}, w = (e = {}) => {
+	let t = e.ttlMs ?? ge() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -184,10 +184,10 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 			};
 		}
 	};
-}, he = (e) => typeof e.resolve == "function", ge = (e) => {
+}, _e = (e) => typeof e.resolve == "function", ve = (e) => {
 	let t = e.authorization ?? e.Authorization;
 	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
-}, _e = async (e, t, n, r) => {
+}, ye = async (e, t, n, r) => {
 	if (!i(e)) return e;
 	let s = {
 		type: e.type,
@@ -216,44 +216,52 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 		}
 		return e;
 	}
-}, D = (e, t) => {
-	let n = ge(t);
+}, T = (e, t) => {
+	let n = ve(t);
 	if (n === void 0) return e;
 	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
 	if (r.length === 0) return e;
 	let i = new Set(r);
 	return [...r, ...e.filter((e) => !i.has(e))];
-}, O = (e, t) => {
+}, be = (e, t) => {
+	if (e === "refuse") throw new x({ reason: "anonymous callers are refused" });
+	if (e === "no-tenant") return "";
+	if (e === "header") {
+		if (t === void 0 || t === "") throw new x({ reason: "tenant required (x-tenant header missing)" });
+		return t;
+	}
+	return "tenantId" in e ? e.tenantId : t !== void 0 && t !== "" ? t : e.headerOrTenant;
+}, E = (e, t) => {
 	let n = t?.resolveScopes, r = t?.subjectGuards ?? [];
 	if (t?.memberships === void 0 != (t?.tenantSelection === void 0)) throw Error("composeAuthStrategies: `memberships` and `tenantSelection` come together — a tenant selection is verified against the memberships and read from the store; configure both or neither.");
 	let i = t?.memberships !== void 0 && t.tenantSelection !== void 0 ? {
 		memberships: t.memberships,
 		store: t.tenantSelection
-	} : void 0, a = n !== void 0 || r.length > 0, o = !a || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && he(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
+	} : void 0, a = n !== void 0 || r.length > 0, o = !a || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && _e(t.scopeCache) ? t.scopeCache : w(t?.scopeCache ?? {});
 	return async (s) => {
 		let c = t?.getStore?.(), l = c === void 0 ? s : {
 			...s,
 			store: c
 		}, u;
-		for (let s of D(e, l.headers)) {
+		for (let s of T(e, l.headers)) {
 			let e = await s.resolve(l);
 			if (e.kind === "matched") {
 				if (e.subject.type === "service") return { subject: {
 					...e.subject,
 					scopes: []
 				} };
-				let c = i === void 0 ? e.subject : await _e(e.subject, l, i, (e) => (t?.onStrategyFailed?.({
+				let c = i === void 0 ? e.subject : await ye(e.subject, l, i, (e) => (t?.onStrategyFailed?.({
 					strategyId: s.id,
 					reason: e
-				}), new C({ reason: e }))), u = c;
+				}), new x({ reason: e }))), u = c;
 				if (a) {
 					let e = async () => {
 						let e = n === void 0 ? {
 							kind: "grant",
 							scopes: []
-						} : de(await n(c, l));
+						} : pe(await n(c, l));
 						if (e.kind === "unavailable" || r.length === 0) return e;
-						let t = w(c, e).subject, i = {
+						let t = S(c, e).subject, i = {
 							origin: "request",
 							headers: l.headers,
 							clientId: l.clientId,
@@ -271,22 +279,22 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 					}, { decision: i, fresh: a } = o === null ? {
 						decision: await e(),
 						fresh: !0
-					} : await o.resolve(T(c), e);
+					} : await o.resolve(C(c), e);
 					if (i.kind === "vetoed") {
 						let e = `${i.code}: ${i.message}`;
 						throw t?.onStrategyFailed?.({
 							strategyId: s.id,
 							reason: e
-						}), new C({ reason: e });
+						}), new x({ reason: e });
 					}
 					if (i.kind === "unavailable") {
 						let e = `scope resolution unavailable: ${i.reason}`;
 						throw t?.onStrategyFailed?.({
 							strategyId: s.id,
 							reason: e
-						}), new C({ reason: e });
+						}), new x({ reason: e });
 					}
-					let d = w(c, i);
+					let d = S(c, i);
 					a && d.removed.length > 0 && t?.onScopesNarrowed?.({
 						strategyId: s.id,
 						subjectType: c.type,
@@ -315,62 +323,63 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 				credentialRejected: u
 			} : e };
 		}
-		if (u !== void 0) throw new C({ reason: `credential rejected: ${u}` });
-		if (t?.anonymousTenantId !== void 0) return { subject: _(t.anonymousTenantId) };
-		let d = l.headers["x-tenant"] ?? t?.anonymousTenantDefault ?? null;
-		if (d === null && t?.anonymousTenantRequired === !0) throw new C({ reason: "tenant required (x-tenant header missing)" });
-		return { subject: _(d) };
+		if (u !== void 0) throw new x({ reason: `credential rejected: ${u}` });
+		return { subject: g(be(t?.anonymous ?? "no-tenant", l.headers["x-tenant"])) };
 	};
-}, k = (e, t) => {
-	if (e.type === "anonymous") throw new C(t === void 0 ? {} : { reason: t });
-}, A = "admin:full", j = "apikeys:issue:self", M = "apikeys:issue:org", N = "apikeys:issue:other", P = "devices:manage", F = class extends n.TaggedError()("ScopeError", {
+}, D = (e, t) => {
+	if (e.type === "anonymous") throw new x(t === void 0 ? {} : { reason: t });
+}, O = "admin:full", k = "apikeys:issue:self", A = "apikeys:issue:org", j = "apikeys:issue:other", M = "devices:manage", N = class extends n.TaggedError()("ScopeError", {
 	required: n.String,
 	message: n.String
-}) {}, I = (e) => "scopes" in e && e.scopes ? e.scopes : [], L = /* @__PURE__ */ new WeakMap(), ve = (e, t) => {
-	typeof e == "object" && e && L.set(e, t);
-}, R = (e) => {
+}) {}, P = class extends n.TaggedError()("NoSuchResource", {
+	resourceType: n.NullOr(n.String),
+	resourceId: n.String,
+	message: n.String
+}) {}, F = (e) => "scopes" in e && e.scopes ? e.scopes : [], I = /* @__PURE__ */ new WeakMap(), xe = (e, t) => {
+	typeof e == "object" && e && I.set(e, t);
+}, L = (e) => {
 	if (typeof e == "object" && e) {
-		let t = L.get(e);
+		let t = I.get(e);
 		if (t) return t;
 	}
-	return I(e);
-}, z = (e, t) => {
-	let n = R(e);
+	return F(e);
+}, R = (e, t) => {
+	let n = L(e);
 	return n.includes("admin:full") || n.includes(t);
-}, ye = (e, t) => {
-	let n = I(e);
+}, Se = (e, t) => {
+	let n = F(e);
 	return n.includes("admin:full") || n.includes(t);
-}, be = (e, n) => z(e, n) ? t.void : t.fail(new F({
+}, Ce = (e, n) => R(e, n) ? t.void : t.fail(new N({
 	required: n,
 	message: `missing required scope '${n}'`
-})), B = (e, t) => {
+})), z = (e, t) => {
 	let n;
 	try {
 		n = typeof e.action == "function" ? e.action(t) : e.action;
 	} catch {
-		throw new F({
+		throw new N({
 			required: e.resourceType,
 			message: "policy action selector failed"
 		});
 	}
-	if (typeof n != "string" || n.trim() === "") throw new F({
+	if (typeof n != "string" || n.trim() === "") throw new N({
 		required: e.resourceType,
 		message: "policy action selector returned no action"
 	});
 	return n;
-}, V = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", H = (e) => typeof e.open == "string", U = (e) => Array.isArray(e.service), xe = (e) => ({ service: [...e] }), W = (e) => e?.find(U)?.service, G = (e, t) => {
-	let n = W(t);
-	if (e.type === "service") return n !== void 0 && n.includes(e.service) ? null : new F({
+}, B = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", we = (e) => e !== void 0 && e.some((e) => B(e) || typeof e.resource == "function"), V = (e) => typeof e.open == "string", H = (e) => Array.isArray(e.service), Te = (e) => ({ service: [...e] }), U = (e) => e?.find(H)?.service, W = (e, t) => {
+	let n = U(t);
+	if (e.type === "service") return n !== void 0 && n.includes(e.service) ? null : new N({
 		required: "service-procedure",
 		message: n === void 0 ? `service '${e.service}' may only call procedures that declare it in \`service: { callers }\`` : `service '${e.service}' is not among this procedure's callers [${n.join(", ")}]`
 	});
-	if (n !== void 0) return Q(e, new F({
+	if (n !== void 0) return Z(e, new N({
 		required: `service:${n.join("|")}`,
 		message: `this procedure is callable only by the service${n.length === 1 ? "" : "s"} [${n.join(", ")}]`
 	}));
-}, K = (e) => e.authenticated === !0, Se = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, Ce = (e) => {
-	J = e;
-}, we = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !V(e) && e.resource !== void 0)).map((e) => e.tag) : [], Te = (e) => [
+}, G = (e) => e.authenticated === !0, Ee = (e) => ({ open: e }), K = (e) => typeof e == "string" ? [e] : e, q, De = (e) => {
+	q = e;
+}, Oe = (e) => q === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !B(e) && e.resource !== void 0)).map((e) => e.tag) : [], ke = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -384,59 +393,59 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), Ee = () => J, Y, X = (e) => {
-	Y = e;
-}, De = () => Y, Z = (e) => new F({
+].join("\n"), Ae = () => q, J, je = (e) => {
+	J = e;
+}, Y = () => J, X = (e) => new N({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
-}), Q = (e, t) => {
+}), Z = (e, t) => {
 	let n = e.credentialRejected;
-	return n === void 0 ? t : new C({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
-}, $ = (e, t, n) => {
-	let r = G(e, t);
+	return n === void 0 ? t : new x({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
+}, Q = (e, t, n) => {
+	let r = W(e, t);
 	if (r !== void 0) return r;
-	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
+	if (!t || t.length === 0) return n?.defaultDeny === !0 ? X(n.procedure) : null;
 	for (let n of t) {
-		if (H(n) || U(n)) continue;
-		if (K(n)) {
+		if (V(n) || H(n)) continue;
+		if (G(n)) {
 			if (e.id !== null && e.id !== void 0) continue;
-			return Q(e, new F({
+			return Z(e, new N({
 				required: "authenticated",
 				message: "this procedure requires an authenticated caller"
 			}));
 		}
-		if (V(n)) {
-			if (z(e, "admin:full")) continue;
-			return Q(e, new F({
+		if (B(n)) {
+			if (R(e, "admin:full")) continue;
+			return Z(e, new N({
 				required: `${n.resourceType}:${n.action}`,
 				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
 			}));
 		}
-		let t = q(n.scope);
+		let t = K(n.scope);
 		if (t.length === 0) continue;
-		let r = t.filter((t) => z(e, t));
+		let r = t.filter((t) => R(e, t));
 		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !z(e, t));
-			return Q(e, new F({
+			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !R(e, t));
+			return Z(e, new N({
 				required: r,
 				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
 			}));
 		}
 	}
 	return null;
-}, Oe = (e, n, r) => {
+}, Me = (e, n, r) => {
 	let i;
 	try {
-		i = B(n, r);
+		i = z(n, r);
 	} catch (e) {
 		return t.succeed(e);
 	}
-	let a = (e) => new F({
+	let a = (e) => new N({
 		required: `${n.resourceType}:${i}`,
 		message: e
 	});
-	if (z(e, "admin:full")) return t.succeed(null);
-	let o = Y;
+	if (R(e, "admin:full")) return t.succeed(null);
+	let o = J;
 	if (o === void 0) return t.succeed(a(`no policy resolver registered — cannot authorize '${i}' on '${n.resourceType}'`));
 	let s = n.resource(r);
 	return s === void 0 || s === "" ? t.succeed(a(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => o({
@@ -444,32 +453,36 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 		action: i,
 		resourceType: n.resourceType,
 		resourceId: s
-	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : a(`no '${i}' relation on ${n.resourceType}:${s}`)));
-}, ke = (e, n, r, i) => {
-	let a = G(e, n);
+	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((t) => $(e, t, n.resourceType, s, () => a(`no '${i}' relation on ${n.resourceType}:${s}`))));
+}, $ = (e, t, n, r, i) => t === !0 ? null : t === "missing" && e.id !== null && e.id !== void 0 ? new P({
+	resourceType: n,
+	resourceId: r,
+	message: n === null ? `no such resource '${r}'` : `no such ${n} '${r}'`
+}) : i(), Ne = (e, n, r, i) => {
+	let a = W(e, n);
 	if (a !== void 0) return t.succeed(a);
-	if (!n || n.length === 0) return t.succeed($(e, n, i));
-	let o = J;
-	return !n.some(V) && (!o || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
+	if (!n || n.length === 0) return t.succeed(Q(e, n, i));
+	let o = q;
+	return !n.some(B) && (!o || !n.some((e) => e.resource !== void 0)) ? t.succeed(Q(e, n, i)) : t.gen(function* () {
 		for (let i of n) {
-			if (H(i) || U(i)) continue;
-			if (K(i)) {
+			if (V(i) || H(i)) continue;
+			if (G(i)) {
 				if (e.id !== null && e.id !== void 0) continue;
-				return Q(e, new F({
+				return Z(e, new N({
 					required: "authenticated",
 					message: "this procedure requires an authenticated caller"
 				}));
 			}
-			if (V(i)) {
-				let t = yield* Oe(e, i, r);
+			if (B(i)) {
+				let t = yield* Me(e, i, r);
 				if (t) return t;
 				continue;
 			}
-			let n = q(i.scope);
+			let n = K(i.scope);
 			if (n.length === 0) continue;
-			let a = i.resource ? i.resource(r) : void 0, s = [];
+			let a = i.resource ? i.resource(r) : void 0, s = [], c = !1;
 			for (let r of n) {
-				if (z(e, r)) {
+				if (R(e, r)) {
 					s.push(!0);
 					continue;
 				}
@@ -479,15 +492,22 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 						scope: r,
 						resource: a
 					})).pipe(t.catchAllCause(() => t.succeed(!1)));
-					s.push(n);
+					n === "missing" && (c = !0), s.push(n === !0);
 				} else s.push(!1);
 			}
-			let c = i.mode ?? "all";
-			if (!(c === "any" ? s.some(Boolean) : s.every(Boolean))) {
-				let e = c === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				return new F({
-					required: e,
-					message: c === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (a === void 0 ? "" : ` on resource '${a}'`)
+			let l = i.mode ?? "all";
+			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
+				let t = l === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
+				if (c && a !== void 0) {
+					let n = $(e, "missing", null, a, () => new N({
+						required: t,
+						message: `missing required scope '${t}' on resource '${a}'`
+					}));
+					if (n !== null) return n;
+				}
+				return new N({
+					required: t,
+					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${t}'` + (a === void 0 ? "" : ` on resource '${a}'`)
 				});
 			}
 		}
@@ -495,4 +515,4 @@ var i = (e) => e.type === "user" || e.type === "apiKey" || e.type === "serviceAc
 	});
 };
 //#endregion
-export { v as $, ce as A, _ as B, B as C, X as D, ve as E, oe as F, ae as G, k as H, ee as I, E as J, ie as K, te as L, le as M, pe as N, Ce as O, fe as P, re as Q, x as R, be as S, W as T, O as U, w as V, ue as W, se as X, D as Y, T as Z, H as _, P as a, o as at, Z as b, $ as c, we as d, h as et, De as f, K as g, ye as h, j as i, i as it, S as j, I as k, ke as l, z as m, M as n, y as nt, F as o, Ee as p, b as q, N as r, a as rt, Te as s, A as t, ne as tt, R as u, V as v, xe as w, Se as x, U as y, C as z };
+export { C as $, De as A, y as B, Ee as C, U as D, Te as E, he as F, E as G, g as H, me as I, ae as J, fe as K, ce as L, ue as M, b as N, xe as O, de as P, le as Q, ee as R, X as S, z as T, S as U, x as V, D as W, w as X, se as Y, T as Z, Se as _, M as a, a as at, B as b, ke as c, we as d, ie as et, L as f, R as g, Ae as h, k as i, v as it, F as j, je as k, Q as l, Y as m, A as n, ne as nt, P as o, i as ot, Oe as p, oe as q, j as r, re as rt, N as s, o as st, O as t, _ as tt, Ne as u, G as v, Ce as w, H as x, V as y, te as z };

package/dist/session.d.ts

@@ -74,6 +74,14 @@ export declare const MIN_SESSION_SECRET_LENGTH: 32;
  */
 export declare const readCookie: (header: string | undefined, name: string) => string | undefined;
 
+/**
+ * The session value this request presents — the `x-voltro-session` header a
+ * cookie-less client (React Native, a desktop shell) sets on every rpc frame,
+ * or the session cookie a browser carries. See `./sessionHeader.ts` for why
+ * it is a dedicated header and why the header wins.
+ */
+export declare const readSessionValue: (headers: Readonly<Record<string, string | undefined>>, cookieName?: string) => string | undefined;
+
 /**
  * Reset the once-per-process warning latch. Tests only — the latch is what
  * makes the diagnostic readable in production and unobservable in a second
@@ -125,6 +133,9 @@ export declare const resolveSessionSecrets: () => SessionSecrets;
  */
 export declare const SESSION_COOKIE_NAME: string;
 
+/** The request header carrying a framework session value outside a cookie. */
+export declare const SESSION_HEADER_NAME: "x-voltro-session";
+
 /**
  * The session payload format this build mints and accepts.
  *