@voltro/protocol 0.84.0 → 0.86.0

package/README.md

@@ -24,3 +24,17 @@ deliberately short so there is nothing here to drift out of date.
 
 Proprietary. © 2026 Voltro UG. Your use is governed by the
 [Terms of Service](https://voltro.cloud/legal/terms). See the bundled `LICENSE`.
+
+## Request-local tenant selection
+
+`composeAuthStrategies` accepts `requestedTenant` with a fresh `memberships` source.
+An explicit authenticated workspace is checked before scopes and guards, without
+changing the stored selection. Missing hints retain the existing behavior; invalid
+hints and revoked membership fail closed, including during live reauthorization.
+API apps can configure `auth.requestedTenant` with `auth.memberships` in
+`app.config.ts`; dev and compiled serve share the same builder. Clients still
+need consistent transport and SSR workspace context. See the
+[authentication strategies guide](https://voltro.dev/docs/authentication/strategies)
+for its contract and tenant-specific authority requirements.
+
+Request-local selection refusal has wire tag `RequestedTenantRefused`, distinct from credential rejection (`Unauthenticated`). It must not invalidate sibling sessions or trigger credential refresh. HTTP/WebSocket middleware and live reauthorization preserve this distinction.

package/THIRD-PARTY-NOTICES.md

@@ -1,70 +1,14 @@
 # Third-Party Notices — @voltro/protocol
 
-This package depends on the open-source software listed below. Each is the
+This package uses the open-source software listed below. Each is the
 property of its respective copyright holders and is used under the terms of
 its license. This file is provided for attribution; it grants no rights in
 @voltro/protocol itself, which is proprietary (see LICENSE).
 
-Generated from the resolved runtime dependency closure (7 packages).
+Generated from the resolved runtime dependency closure (4 packages).
 
 ---
 
-## @effect/experimental@0.61.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
-## @effect/sql@0.52.1
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2023-present The Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## jose@6.2.12
 
 License: MIT
@@ -93,34 +37,6 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## layerr@3.0.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) 2020 Perry Mitchell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
 ## typeid-js@1.2.0
 
 License: Apache-2.0
@@ -329,14 +245,14 @@ Apache License
    limitations under the License.
 ```
 
-## ulidx@2.4.1
+## ulid@3.0.2
 
 License: MIT
 
 ```
-MIT License
+The MIT License (MIT)
 
-Copyright (c) 2021 Perry Mitchell
+Copyright (c) 2017 Alizain Feerasta
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/apikey.d.ts

@@ -194,33 +194,31 @@ declare type StrategyResolution = {
     readonly reason: string;
 };
 
-declare const Subject: Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["user"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+declare const Subject: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["apiKey"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"apiKey">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["serviceAccount"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
+    readonly type: Schema.Literal<"serviceAccount">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
     /** Application actor used for audit columns; null means machine work with
      * no application actor. Identity only, never a permission grant. */
-    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-        exact: true;
-    }>;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["anonymous"]>;
-    id: typeof Schema.Null;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly type: Schema.Literal<"anonymous">;
+    readonly id: Schema.Null;
+    readonly tenantId: Schema.NullOr<Schema.String>;
     /**
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
@@ -237,21 +235,21 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * must not break an `openAccess` procedure that needs no session at all. The
      * fact travels, and only a guard that actually refuses spends it.
      */
-    credentialRejected: Schema.optional<typeof Schema.String>;
+    readonly credentialRejected: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["system"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"system">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["service"]>;
-    id: typeof Schema.String;
+    readonly type: Schema.Literal<"service">;
+    readonly id: Schema.String;
     /** The calling app's name, as the callee lists it in `serviceCallers`. */
-    service: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly service: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>]>;
 
 declare type Subject = typeof Subject.Type;

package/dist/approval.js

@@ -0,0 +1,64 @@
+import { Schema as e } from "effect";
+//#region src/approval.ts
+var t = class extends e.TaggedError()("ApprovalRequired", {
+	approvalId: e.String,
+	procedure: e.String,
+	expiresAt: e.String,
+	requiredScopes: e.Array(e.String),
+	reason: e.NullOr(e.String),
+	created: e.Boolean
+}) {}, n = class extends e.TaggedError()("ApprovalNotFound", { approvalId: e.String }) {}, r = class extends e.TaggedError()("ApprovalSelfApproval", {
+	approvalId: e.String,
+	subjectId: e.NullOr(e.String)
+}) {}, i = class extends e.TaggedError()("ApprovalRejected", {
+	approvalId: e.String,
+	decidedBy: e.NullOr(e.String),
+	note: e.NullOr(e.String)
+}) {}, a = class extends e.TaggedError()("ApprovalExpired", {
+	approvalId: e.String,
+	expiredAt: e.String
+}) {}, o = class extends e.TaggedError()("ApprovalNotPending", {
+	approvalId: e.String,
+	status: e.String
+}) {}, s = class extends e.TaggedError()("ApprovalForbidden", {
+	approvalId: e.String,
+	required: e.NullOr(e.String),
+	message: e.String
+}) {}, c = class extends e.TaggedError()("ApprovalUnavailable", {
+	procedure: e.String,
+	message: e.String
+}) {}, l = e.Union([
+	t,
+	i,
+	a,
+	c
+]), u = e.Union([
+	n,
+	r,
+	a,
+	o,
+	s,
+	c
+]), d = e.Struct({
+	id: e.String,
+	procedure: e.String,
+	kind: e.Literals(["mutation", "action"]),
+	requestedBy: e.NullOr(e.String),
+	status: e.Literals([
+		"pending",
+		"approved",
+		"rejected",
+		"expired",
+		"consumed"
+	]),
+	reason: e.NullOr(e.String),
+	requiredScopes: e.Array(e.String),
+	requestedAt: e.String,
+	expiresAt: e.String,
+	decidedBy: e.NullOr(e.String),
+	decidedAt: e.NullOr(e.String),
+	note: e.NullOr(e.String),
+	relation: e.Literals(["to-decide", "requested"])
+});
+//#endregion
+export { u as ApprovalDecisionErrors, l as ApprovalErrors, a as ApprovalExpired, s as ApprovalForbidden, n as ApprovalNotFound, o as ApprovalNotPending, i as ApprovalRejected, t as ApprovalRequired, r as ApprovalSelfApproval, c as ApprovalUnavailable, d as PendingApproval };

package/dist/approvalDescriptors.js

@@ -0,0 +1,26 @@
+import { ApprovalDecisionErrors as e, PendingApproval as t } from "./approval.js";
+import { defineMutation as n, defineQuery as r } from "./procedure.js";
+import { Schema as i } from "effect";
+//#region src/approvalDescriptors.ts
+var a = "__voltro.approvals.pending", o = "__voltro.approvals.decide", s = r({
+	name: a,
+	source: "_voltro_approvals",
+	input: i.Struct({ limit: i.optional(i.Number) }),
+	output: i.Array(t),
+	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
+}), c = n({
+	name: o,
+	input: i.Struct({
+		approvalId: i.String,
+		decision: i.Literals(["approve", "reject"]),
+		note: i.optional(i.String)
+	}),
+	output: i.Struct({
+		approvalId: i.String,
+		status: i.Literals(["approved", "rejected"])
+	}),
+	error: e,
+	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
+});
+//#endregion
+export { o as APPROVALS_DECIDE_TAG, a as APPROVALS_PENDING_TAG, c as approvalsDecideDescriptor, s as approvalsPendingQueryDescriptor };

package/dist/auth.js

@@ -0,0 +1,369 @@
+import { RequestedTenantRefused as e, TenantSelectionRefused as t, isTenantSelectable as n, selectSubjectTenant as r } from "./tenantSelection.js";
+import { Context as i, Schema as a, Struct as o } from "effect";
+import { RpcMiddleware as s } from "effect/rpc";
+//#region src/auth.ts
+var c = a.Record(a.String, a.Unknown), l = a.optional(a.Array(a.String)), u = a.Struct({
+	type: a.Literal("user"),
+	id: a.String,
+	tenantId: a.String,
+	scopes: l,
+	metadata: a.optional(c)
+}), d = a.Struct({
+	type: a.Literal("apiKey"),
+	id: a.String,
+	tenantId: a.String,
+	scopes: l,
+	metadata: a.optional(c)
+}), f = a.Struct({
+	type: a.Literal("serviceAccount"),
+	id: a.String,
+	tenantId: a.String,
+	auditActorId: a.optionalKey(a.NullOr(a.String)),
+	scopes: l,
+	metadata: a.optional(c)
+}), p = a.Struct({
+	type: a.Literal("anonymous"),
+	id: a.Null,
+	tenantId: a.NullOr(a.String),
+	credentialRejected: a.optional(a.String)
+}), m = a.Struct({
+	type: a.Literal("system"),
+	id: a.String,
+	tenantId: a.Null,
+	scopes: l,
+	metadata: a.optional(c)
+}), h = a.Struct({
+	type: a.Literal("service"),
+	id: a.String,
+	service: a.String,
+	tenantId: a.Null,
+	scopes: l,
+	metadata: a.optional(c)
+}), g = a.Union([
+	u,
+	d,
+	f,
+	p,
+	m,
+	h
+]), _ = a.Union([
+	u.mapFields(o.omit(["scopes"])),
+	d.mapFields(o.omit(["scopes"])),
+	f.mapFields(o.omit(["scopes"])),
+	p,
+	m.mapFields(o.omit(["scopes"])),
+	h.mapFields(o.omit(["scopes"]))
+]), v = (e) => {
+	if (e.type === "anonymous") return e;
+	let { scopes: t, ...n } = e;
+	return n;
+}, y = (e) => e.scopes ?? [], b = (e, t) => ({
+	type: "anonymous",
+	id: null,
+	tenantId: e,
+	...t === void 0 ? {} : { credentialRejected: t }
+}), x = (e, t = ["admin:full"]) => ({
+	type: "system",
+	id: e,
+	tenantId: null,
+	scopes: t
+}), S = (e) => ({
+	type: "service",
+	id: `service:${e}`,
+	service: e,
+	tenantId: null,
+	scopes: []
+}), C = (e) => e.type === "service", w = (e) => e.type === "system" || e.type === "service", T = (e) => {
+	if (e.type === "system") return null;
+	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
+	if (e.type !== "apiKey") return e.id;
+	let t = e.metadata?.userId;
+	return typeof t == "string" && t !== "" ? t : e.id;
+}, E = (e, t) => {
+	let n = e;
+	return {
+		type: "serviceAccount",
+		id: e.id ?? "system",
+		tenantId: t,
+		auditActorId: T(e),
+		scopes: y(e),
+		...n.metadata === void 0 ? {} : { metadata: n.metadata }
+	};
+}, D = (e) => e.type === "system", O = "impersonation", k = (e) => e.metadata?.impersonation ?? null, A = class extends i.Service()("@voltro/Subject") {}, j = class extends i.Service()("@voltro/ConnectionInfo") {}, M = class extends a.TaggedError()("Unauthenticated", { reason: a.optional(a.String) }) {
+	get message() {
+		return this.reason ?? "Unauthenticated";
+	}
+}, N = class extends s.Service()("@voltro/AuthMiddleware", { error: a.Union([M, e]) }) {}, P = class extends s.Service()("@voltro/ConnectionInfoMiddleware") {}, F = /* @__PURE__ */ new WeakMap(), I = (e, t) => {
+	let n = { ...e };
+	return F.set(n, {
+		current: n,
+		resolve: t
+	}), n;
+}, L = (e) => F.get(e)?.current ?? e, R = async (e, t) => {
+	let n = F.get(e);
+	if (n === void 0) return await t?.(e), e;
+	let r = await n.resolve();
+	if (r.type !== e.type || r.id !== e.id || r.tenantId !== e.tenantId || e.type === "service" && (r.type !== "service" || r.service !== e.service)) throw new M({ reason: "subscription identity or tenant changed; subscribe again" });
+	return F.set(r, {
+		current: r,
+		resolve: n.resolve
+	}), await t?.(r), n.current = r, r;
+}, z = (e) => typeof e.mountRoutes == "function", B = (e) => Array.isArray(e) ? {
+	kind: "grant",
+	scopes: e
+} : e, V = (e, t) => {
+	if (t.kind === "vetoed") throw new M({ reason: `${t.code}: ${t.message}` });
+	if (e.type === "anonymous") return {
+		subject: e,
+		removed: []
+	};
+	let n = y(e);
+	if (t.kind === "grant") {
+		if (t.scopes.length === 0) return {
+			subject: e,
+			removed: []
+		};
+		let r = [.../* @__PURE__ */ new Set([...n, ...t.scopes])];
+		return {
+			subject: {
+				...e,
+				scopes: r
+			},
+			removed: []
+		};
+	}
+	let r = new Set(t.scopes), i = n.filter((e) => !r.has(e));
+	return {
+		subject: {
+			...e,
+			scopes: [...r]
+		},
+		removed: i
+	};
+}, H = 3e4, U = 1e4, W = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, G = () => {
+	if (typeof process > "u") return;
+	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? t : void 0;
+}, K = (e = {}) => {
+	let t = e.ttlMs ?? G() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+		if (i.size <= n) return;
+		let e = r();
+		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
+		for (let e of i.keys()) {
+			if (i.size <= n) break;
+			i.delete(e);
+		}
+	};
+	return {
+		ttlMs: t,
+		invalidate: (e) => {
+			i.delete(e);
+		},
+		invalidateAll: () => {
+			i.clear();
+		},
+		resolve: async (e, n) => {
+			let o = r();
+			if (t > 0) {
+				let t = i.get(e);
+				if (t && t.freshUntil > o) return {
+					decision: t.decision,
+					fresh: !1
+				};
+			}
+			let s = await n();
+			return t > 0 && s.kind !== "unavailable" && (i.set(e, {
+				decision: s,
+				freshUntil: o + t
+			}), a()), {
+				decision: s,
+				fresh: !0
+			};
+		}
+	};
+}, q = (e) => typeof e.resolve == "function", J = (e) => {
+	let t = e.authorization ?? e.Authorization;
+	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
+}, Y = async (e, i, a, o) => {
+	let s;
+	try {
+		s = await a.source(e, i);
+	} catch {
+		throw o("target-unavailable");
+	}
+	if (s === null) return;
+	if (typeof s != "string" || s.trim().length === 0) throw o("invalid-target");
+	if (!n(e)) throw o("subject-has-no-tenant");
+	let c;
+	try {
+		c = await a.memberships(e, i);
+	} catch {
+		throw o("memberships-unavailable");
+	}
+	try {
+		return r(e, s, c);
+	} catch (e) {
+		throw e instanceof t ? o(e.reason) : e;
+	}
+}, X = async (e, i, a, o) => {
+	if (!n(e)) return e;
+	let s = {
+		type: e.type,
+		id: e.id
+	}, c;
+	try {
+		c = await a.store.read(s);
+	} catch (e) {
+		throw o(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (c === null || c === e.tenantId) return e;
+	let l;
+	try {
+		l = await a.memberships(e, i);
+	} catch (e) {
+		throw o(`memberships unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	try {
+		return r(e, c, l);
+	} catch (n) {
+		if (!(n instanceof t)) throw n;
+		try {
+			await a.store.clear(s);
+		} catch (e) {
+			throw o(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+		}
+		return e;
+	}
+}, Z = (e, t) => {
+	let n = J(t);
+	if (n === void 0) return e;
+	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
+	if (r.length === 0) return e;
+	let i = new Set(r);
+	return [...r, ...e.filter((e) => !i.has(e))];
+}, Q = (e, t) => {
+	if (e === "refuse") throw new M({ reason: "anonymous callers are refused" });
+	if (e === "no-tenant") return "";
+	if (e === "header") {
+		if (t === void 0 || t === "") throw new M({ reason: "tenant required (x-tenant header missing)" });
+		return t;
+	}
+	return "tenantId" in e ? e.tenantId : t !== void 0 && t !== "" ? t : e.headerOrTenant;
+}, $ = (t, n) => {
+	let r = n?.resolveScopes, i = n?.subjectGuards ?? [], a = n?.tenantSelection !== void 0 || n?.requestedTenant !== void 0;
+	if (n?.memberships !== void 0 !== a) throw Error("composeAuthStrategies: memberships and tenant selection come together; `memberships` requires `tenantSelection` or `requestedTenant`; each tenant selector requires `memberships` to authorize its target.");
+	let o = n?.memberships !== void 0 && n.tenantSelection !== void 0 ? {
+		memberships: n.memberships,
+		store: n.tenantSelection
+	} : void 0, s = r !== void 0 || i.length > 0, c = !s || n?.scopeCache === !1 ? null : n?.scopeCache !== void 0 && q(n.scopeCache) ? n.scopeCache : K(n?.scopeCache ?? {}), l = async (a) => {
+		let l = n?.getStore?.(), u = l === void 0 ? a : {
+			...a,
+			store: l
+		}, d;
+		for (let a of Z(t, u.headers)) {
+			let t = await a.resolve(u);
+			if (t.kind === "matched") {
+				let l = (e) => (n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: e
+				}), new M({ reason: e })), d = n?.requestedTenant === void 0 || n.memberships === void 0 ? void 0 : await Y(t.subject, u, {
+					source: n.requestedTenant,
+					memberships: n.memberships
+				}, (t) => (n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: `requested tenant refused: ${t}`
+				}), new e({ reason: t })));
+				if (t.subject.type === "service") return { subject: {
+					...t.subject,
+					scopes: []
+				} };
+				let f = d ?? (o === void 0 ? t.subject : await X(t.subject, u, o, l)), p = f;
+				if (s) {
+					let e = async () => {
+						let e = r === void 0 ? {
+							kind: "grant",
+							scopes: []
+						} : B(await r(f, u));
+						if (e.kind === "unavailable" || i.length === 0) return e;
+						let t = V(f, e).subject, n = {
+							origin: "request",
+							headers: u.headers,
+							clientId: u.clientId,
+							store: u.store
+						};
+						for (let e of i) {
+							let r = await e(t, n);
+							if (!r.ok) return {
+								kind: "vetoed",
+								code: r.code,
+								message: r.message
+							};
+						}
+						return e;
+					}, { decision: t, fresh: o } = c === null ? {
+						decision: await e(),
+						fresh: !0
+					} : await c.resolve(W(f), e);
+					if (t.kind === "vetoed") {
+						let e = `${t.code}: ${t.message}`;
+						throw n?.onStrategyFailed?.({
+							strategyId: a.id,
+							reason: e
+						}), new M({ reason: e });
+					}
+					if (t.kind === "unavailable") {
+						let e = `scope resolution unavailable: ${t.reason}`;
+						throw n?.onStrategyFailed?.({
+							strategyId: a.id,
+							reason: e
+						}), new M({ reason: e });
+					}
+					let s = V(f, t);
+					o && s.removed.length > 0 && n?.onScopesNarrowed?.({
+						strategyId: a.id,
+						subjectType: f.type,
+						subjectId: f.id,
+						removed: s.removed,
+						granted: t.scopes
+					}), p = s.subject;
+				}
+				return t.credentialExpiresAt === void 0 ? { subject: p } : {
+					subject: p,
+					credentialExpiresAt: t.credentialExpiresAt
+				};
+			}
+			if (t.kind === "failed") {
+				n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: t.reason
+				}), d = t.reason;
+				break;
+			}
+		}
+		if (n?.fallback) {
+			let e = await n.fallback(u);
+			return { subject: d !== void 0 && e.type === "anonymous" ? {
+				...e,
+				credentialRejected: d
+			} : e };
+		}
+		if (d !== void 0) throw new M({ reason: `credential rejected: ${d}` });
+		return { subject: b(Q(n?.anonymous ?? "no-tenant", u.headers["x-tenant"])) };
+	};
+	return async (e) => {
+		let t = {
+			...e,
+			headers: { ...e.headers }
+		}, n = await l(t), r = I(n.subject, async () => ({ ...(await l(t)).subject }));
+		return {
+			...n,
+			subject: r
+		};
+	};
+}, ee = (e, t) => {
+	if (e.type === "anonymous") throw new M(t === void 0 ? {} : { reason: t });
+};
+//#endregion
+export { N as AuthMiddleware, j as ConnectionInfo, P as ConnectionInfoMiddleware, U as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, H as DEFAULT_SCOPE_CACHE_TTL_MS, O as IMPERSONATION_METADATA_KEY, g as Subject, _ as SubjectIdentity, A as SubjectService, M as Unauthenticated, b as anonymousSubject, V as applyScopeDecision, ee as assertAuthenticated, I as bindSubjectAuthority, $ as composeAuthStrategies, L as currentSubjectAuthority, z as hasCallbackRoutes, w as isMachineSubject, C as isServiceSubject, D as isSystemSubject, K as makeScopeCache, Z as orderByBearerPrefix, k as rawImpersonationMark, R as reauthorizeSubject, W as scopeCacheKey, S as serviceSubject, T as subjectAuditActorId, v as subjectIdentity, x as systemSubject, E as tenantScopedSubject };