@voltro/protocol 0.84.0 → 0.86.0

package/dist/boundedRing.js

@@ -0,0 +1,27 @@
+//#region src/boundedRing.ts
+var e = class {
+	slots = [];
+	head = 0;
+	size = 0;
+	capacity;
+	constructor(e) {
+		this.capacity = Number.isNaN(e) ? Infinity : Math.max(0, Math.floor(e));
+	}
+	get length() {
+		return this.size;
+	}
+	get(e) {
+		if (!(!Number.isInteger(e) || e < 0 || e >= this.size)) return this.slots[(this.head + e) % this.capacity];
+	}
+	push(e) {
+		this.capacity !== 0 && (this.size < this.capacity ? (this.slots[(this.head + this.size) % this.capacity] = e, this.size++) : (this.slots[this.head] = e, this.head = (this.head + 1) % this.capacity));
+	}
+	clear() {
+		this.slots.length = 0, this.head = 0, this.size = 0;
+	}
+	*[Symbol.iterator]() {
+		for (let e = 0; e < this.size; e++) yield this.get(e);
+	}
+};
+//#endregion
+export { e as BoundedRing };

package/dist/businessRule.js

@@ -0,0 +1,11 @@
+import { Schema as e } from "effect";
+//#region src/businessRule.ts
+var t = class extends e.TaggedError()("BusinessRuleViolation", {
+	rule: e.String,
+	params: e.optional(e.Record(e.String, e.Unknown)),
+	field: e.optional(e.String),
+	message: e.optional(e.String),
+	severity: e.Literals(["error", "warning"])
+}) {};
+//#endregion
+export { t as BusinessRuleViolation };

package/dist/connection.js

@@ -0,0 +1,73 @@
+import { defineAction as e, defineMutation as t, defineQuery as n } from "./procedure.js";
+import { Schema as r } from "effect";
+//#region src/connection.ts
+var i = "__voltro.connections.list", a = "__voltro.connections.start", o = "__voltro.connections.submitToken", s = "__voltro.connections.disconnect", c = r.Literals(["oauth2", "pat"]), l = r.Literals([
+	"disconnected",
+	"connected",
+	"expired",
+	"revoked",
+	"error"
+]), u = r.Struct({
+	connectionId: r.String,
+	kind: c,
+	label: r.String,
+	status: l,
+	accountId: r.NullOr(r.String),
+	accountLabel: r.NullOr(r.String),
+	scopes: r.Array(r.String),
+	expiresAt: r.NullOr(r.String),
+	lastError: r.NullOr(r.String),
+	connectedAt: r.NullOr(r.String)
+}), d = class extends r.TaggedError()("ConnectionNotDeclared", { connectionId: r.String }) {}, f = class extends r.TaggedError()("ConnectionSubjectRequired", { connectionId: r.String }) {}, p = class extends r.TaggedError()("ConnectionKindMismatch", {
+	connectionId: r.String,
+	expected: c,
+	actual: c
+}) {}, m = class extends r.TaggedError()("ConnectionHandshakeFailed", {
+	connectionId: r.String,
+	reason: r.String,
+	transient: r.Boolean
+}) {
+	get message() {
+		return this.reason;
+	}
+}, h = r.Union([
+	d,
+	f,
+	p,
+	m
+]), g = n({
+	name: i,
+	source: "_voltro_connections",
+	input: r.Struct({}),
+	output: r.Array(u),
+	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
+}), _ = e({
+	name: a,
+	input: r.Struct({
+		connectionId: r.String,
+		redirectTo: r.optional(r.String)
+	}),
+	output: r.Struct({
+		authorizeUrl: r.String,
+		state: r.String
+	}),
+	error: h,
+	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
+}), v = t({
+	name: o,
+	input: r.Struct({
+		connectionId: r.String,
+		token: r.String
+	}),
+	output: r.Struct({ ok: r.Boolean }),
+	error: h,
+	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
+}), y = t({
+	name: s,
+	input: r.Struct({ connectionId: r.String }),
+	output: r.Struct({ ok: r.Boolean }),
+	error: h,
+	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
+});
+//#endregion
+export { i as CONNECTIONS_LIST_TAG, s as CONNECTION_DISCONNECT_TAG, a as CONNECTION_START_TAG, o as CONNECTION_SUBMIT_TOKEN_TAG, m as ConnectionHandshakeFailed, c as ConnectionKind, p as ConnectionKindMismatch, d as ConnectionNotDeclared, u as ConnectionState, l as ConnectionStatus, f as ConnectionSubjectRequired, y as connectionDisconnectDescriptor, _ as connectionStartDescriptor, v as connectionSubmitTokenDescriptor, g as connectionsListQueryDescriptor };

package/dist/devActivity.js

@@ -0,0 +1,4 @@
+//#region src/devActivity.ts
+var e = "voltro:dev-activity";
+//#endregion
+export { e as DEV_ACTIVITY_EVENT };

package/dist/errorValue.js

@@ -0,0 +1,21 @@
+//#region src/errorValue.ts
+var e = (e) => {
+	if (typeof e != "object" || !e) return;
+	let t = e._tag;
+	return typeof t == "string" ? t : void 0;
+}, t = (t) => {
+	if (typeof t == "string") return t;
+	if (typeof t == "object" && t) {
+		let n = t.message;
+		if (typeof n == "string" && n !== "") return n;
+		let r = e(t);
+		if (r !== void 0) return r;
+	}
+	return String(t);
+}, n = (n) => {
+	if (n instanceof Error) return n;
+	let r = Error(t(n), { cause: n });
+	return r.name = e(n) ?? "NonErrorThrown", r;
+};
+//#endregion
+export { t as errorMessage, e as errorTag, n as reportableError };

package/dist/event.js

@@ -0,0 +1,104 @@
+import { RequestedTenantRefused as e } from "./tenantSelection.js";
+import { Unauthenticated as t } from "./auth.js";
+import { NoSuchResource as n, ScopeError as r, declaresResourceGuard as i, isOpenAccess as a, openAccessSpec as o } from "./scopes.js";
+import { strictInput as s } from "./strictInput.js";
+import { hasEnforcedGuard as c } from "./procedure.js";
+import { Schema as l } from "effect";
+import { Rpc as u } from "effect/rpc";
+//#region src/event.ts
+var d = 7500, f = (e) => typeof e == "object" && !!e && e.kind === "event", p = (e) => {
+	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
+	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
+  whitespace and delivers nothing — silently, and only on that broker, so an
+  app that works on Redis stops working when the transport changes.
+  Use a dot for namespacing: "orders.paid".`);
+	if (e.guards !== void 0 && e.guards.length === 0) throw Error(`defineEvent("${e.name}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the event were protected. Omit the field
+  for an unguarded event, or list the scopes that may subscribe.`);
+	if (e.openAccess !== void 0) {
+		if (e.openAccess.trim() === "") throw Error(`defineEvent("${e.name}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
+  subscribe without an authorization check — e.g. \`openAccess: 'public scoreboard,
+  no caller data'\`.`);
+		if (e.guards !== void 0 && e.guards.length > 0) throw Error(`defineEvent("${e.name}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the event is protected AND open. Keep the guards
+  if a subscriber must hold a scope; drop them if anyone may listen.`);
+	}
+	if (e.webhook?.rateLimit !== void 0 && e.webhook.rateLimit.perMinute < 1) throw Error(`defineEvent("${e.name}"): \`webhook.rateLimit.perMinute\` is ${e.webhook.rateLimit.perMinute}, which defers every delivery forever.\n  There is no "unlimited" spelling here — omit \`rateLimit\` for no ceiling.`);
+	if (e.webhook?.version !== void 0 && e.webhook.version < 1) throw Error(`defineEvent("${e.name}"): \`webhook.version\` must be >= 1 (default 1).\n  A subscriber pinned to 1 would read this event as BEHIND its own version,
+  which is the opposite of what a version bump is for.`);
+	if (e.delivery === "latest" && e.webhook !== void 0) throw Error(`defineEvent(${e.name}): \`delivery: 'latest'\` cannot be combined with \`webhook\`.\n  \`latest\` means a superseded delivery did not matter — but a webhook delivery is a
+  durable side effect at a third party, and one already sent cannot be superseded.
+  A high-rate event with an HTTP audience is also 60 deliveries per second per target;
+  the rate limit DEFERS the excess as pending rows, so it grows a table instead of failing.
+  Split them: publish the high-rate event for clients, and publish a separate, coarser
+  event (a summary, a state change) for the outside world.`);
+	return {
+		kind: "event",
+		name: e.name,
+		key: e.key,
+		payload: e.payload,
+		guards: e.openAccess === void 0 ? e.guards : [o(e.openAccess.trim())],
+		openAccess: e.openAccess,
+		rewind: e.rewind,
+		webhook: e.webhook,
+		delivery: e.delivery
+	};
+}, m = (e) => l.Struct({
+	_tag: l.Literal("event"),
+	origin: l.String,
+	n: l.Number,
+	emittedAt: l.Number,
+	payload: e
+}), h = l.Struct({
+	_tag: l.Literal("gap"),
+	missed: l.Number,
+	reason: l.Literals(["buffer", "resume"])
+}), g = l.Struct({ _tag: l.Literal("attached") }), _ = (e) => l.Union([
+	g,
+	m(e),
+	h
+]), v = l.Struct({
+	origin: l.String,
+	n: l.Number
+}), y = (e) => l.Struct({
+	key: e,
+	resume: l.optional(l.Array(v))
+}), b = (o, d) => {
+	let f = o.guards !== void 0 && o.guards.some((e) => !a(e)) ? l.Union([
+		r,
+		t,
+		e
+	]) : l.Union([t, e]), p = i(o.guards) ? l.Union([f, n]) : f, m = d && d.length > 0 ? l.Union([p, ...d]) : p;
+	return u.make(o.name, {
+		payload: s(y(o.key), o.name, c(o.guards)),
+		success: _(o.payload),
+		error: m,
+		stream: !0
+	});
+}, x = class extends l.TaggedError()("EventPayloadInvalid", {
+	event: l.String,
+	message: l.String
+}) {}, S = class extends l.TaggedError()("EventKeyInvalid", {
+	event: l.String,
+	message: l.String
+}) {}, C = class extends l.TaggedError()("EventPayloadTooLarge", {
+	event: l.String,
+	bytes: l.Number,
+	limit: l.Number
+}) {}, w = (e) => {
+	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
+	let t = Object.entries(e), n = 0;
+	for (let e of t) e[1] !== void 0 && (t[n++] = e);
+	return t.length = n, t.sort(([e], [t]) => e < t ? -1 : +(e > t)), JSON.stringify(t);
+}, T = "\0", E = (e, t, n) => [
+	e ?? "~",
+	t,
+	w(n)
+].join("\0"), D = (e) => {
+	let [t = "~", n = "", r = ""] = e.split("\0");
+	return {
+		tenantId: t === "~" ? null : t,
+		event: n,
+		key: r
+	};
+}, O = (e) => e.split("\0").join(" · ");
+//#endregion
+export { T as EVENT_ROUTE_SEP, S as EventKeyInvalid, x as EventPayloadInvalid, C as EventPayloadTooLarge, d as MAX_EVENT_ENVELOPE_BYTES, p as defineEvent, w as encodeEventKey, g as eventAttached, m as eventEnvelope, h as eventGap, v as eventResumePoint, E as eventRoute, _ as eventStreamEvent, y as eventSubscribeInput, b as eventToRpc, O as formatEventRoute, f as isEventDescriptor, D as parseEventRoute };

package/dist/idempotency.js

@@ -0,0 +1,66 @@
+import { Schema as e } from "effect";
+//#region src/idempotency.ts
+var t = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, n = (e, t, n, r) => r === void 0 ? `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}` : `WS-connection:${JSON.stringify([
+	e ?? null,
+	t ?? null,
+	n,
+	r
+])}`, r = class extends e.TaggedError()("MutationConnectionRequired", { traceId: e.String }) {
+	get message() {
+		return "this mutation requires a live native WebSocket connection";
+	}
+}, i = async (e, t, n, r, i, o = a) => {
+	let s = await e.claim(t, n, i, r, o);
+	return s === "claimed" ? { kind: "fresh" } : s.status === "completed" && s.response ? {
+		kind: "replay",
+		response: s.response
+	} : { kind: "conflict" };
+}, a = 3e4, o = (e, t, n, r = a, i = Date.now) => {
+	let o = setInterval(() => {
+		e.renew(t, n, i()).catch(() => {});
+	}, Math.max(1, Math.floor(r / 3)));
+	return o.unref?.(), () => clearInterval(o);
+}, s = (e, t, n, r, i) => e.complete(t, n, r, i), c = (e, t, n) => e.release(t, n), l = () => {
+	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
+	return {
+		get: async (n, r) => e.get(t(n, r)) ?? null,
+		claim: async (n, r, i, a, o) => {
+			let s = e.get(t(n, r));
+			return s && i - s.createdAt < u(s.status, a, o) ? s : (e.set(t(n, r), {
+				scope: n,
+				key: r,
+				status: "in_flight",
+				response: null,
+				createdAt: i
+			}), "claimed");
+		},
+		complete: async (n, r, i, a) => {
+			e.set(t(n, r), {
+				scope: n,
+				key: r,
+				status: "completed",
+				response: i,
+				createdAt: a
+			});
+		},
+		release: async (n, r) => {
+			e.delete(t(n, r));
+		},
+		renew: async (n, r, i) => {
+			let a = e.get(t(n, r));
+			a?.status === "in_flight" && e.set(t(n, r), {
+				...a,
+				createdAt: i
+			});
+		}
+	};
+}, u = (e, t, n) => e === "completed" ? t : Math.min(t, n), d = class extends e.TaggedError()("MutationInFlight", {
+	traceId: e.String,
+	retryAfterMs: e.Number
+}) {
+	get message() {
+		return `a request with this idempotency key is still in flight — replay the same key after ${this.retryAfterMs}ms`;
+	}
+}, f = 1e3;
+//#endregion
+export { a as DEFAULT_IN_FLIGHT_LEASE_MS, f as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, r as MutationConnectionRequired, d as MutationInFlight, i as beginIdempotent, c as failIdempotent, s as finishIdempotent, u as freshFor, o as holdIdempotentClaim, t as idempotencyScope, l as memoryIdempotencyStore, n as wsMutationIdempotencyScope };

package/dist/identity.js

@@ -33,15 +33,11 @@ var a = e({ scope: "voltro:identity" }), o = Symbol.for("@voltro/runtime/process
 	} catch {}
 	return l.version;
 }, m = (e) => {
-	if (l.frozen !== void 0 && l.frozen.bootPath !== e) {
-		a.warn(`process identity was already resolved as ${l.frozen.replicaId} (bootPath=${l.frozen.bootPath}); keeping it rather than becoming ${e}. Call setProcessBootPath before anything reads the identity.`, {
-			resolved: l.frozen.replicaId,
-			was: l.frozen.bootPath,
-			requested: e
-		});
-		return;
-	}
-	l.bootPath = e;
+	l.frozen !== void 0 && l.frozen.bootPath !== e ? a.warn(`process identity was already resolved as ${l.frozen.replicaId} (bootPath=${l.frozen.bootPath}); keeping it rather than becoming ${e}. Call setProcessBootPath before anything reads the identity.`, {
+		resolved: l.frozen.replicaId,
+		was: l.frozen.bootPath,
+		requested: e
+	}) : l.bootPath = e;
 }, h = (e) => {
 	l.appVersion = e, l.frozen !== void 0 && (l.frozen = {
 		...l.frozen,