@voltro/protocol 0.85.0 → 0.86.0

package/dist/restFormat.js

@@ -0,0 +1,163 @@
+import { Schema as e, SchemaGetter as t, SchemaTransformation as n } from "effect";
+import * as r from "effect/SchemaAST";
+//#region src/restFormat.ts
+var i = {
+	rpc: {
+		name: "rpc",
+		dates: "epoch-ms",
+		errors: "tagged",
+		envelope: "none",
+		pagination: "body-cursor",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !1
+	},
+	standard: {
+		name: "standard",
+		dates: "iso",
+		errors: "problem-details",
+		envelope: "none",
+		pagination: "link-header",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !0
+	},
+	jsonapi: {
+		name: "jsonapi",
+		dates: "iso",
+		errors: "problem-details",
+		envelope: "jsonapi",
+		pagination: "link-header",
+		cursorField: "nextCursor",
+		cursorParam: "cursor",
+		naming: "camelCase",
+		etag: !0
+	}
+}, a = [
+	"rpc",
+	"standard",
+	"jsonapi"
+], o = (e, t = void 0) => {
+	let n = (e) => {
+		if (e?.profile !== void 0) {
+			if (typeof e.profile == "string") {
+				let t = i[e.profile];
+				if (t === void 0) throw Error(`publicApi.profile: unknown profile '${String(e.profile)}' — one of ${a.join(", ")}, or a RestFormat object`);
+				return t;
+			}
+			return e.profile;
+		}
+	}, r = (e, t) => t === void 0 ? e : {
+		...e,
+		...t.dates === void 0 ? {} : { dates: t.dates },
+		...t.errors === void 0 ? {} : { errors: t.errors },
+		...t.envelope === void 0 ? {} : { envelope: t.envelope },
+		...t.pagination === void 0 ? {} : { pagination: t.pagination },
+		...t.cursorField === void 0 ? {} : { cursorField: t.cursorField },
+		...t.cursorParam === void 0 ? {} : { cursorParam: t.cursorParam },
+		...t.naming === void 0 ? {} : { naming: t.naming },
+		...t.etag === void 0 ? {} : { etag: t.etag }
+	}, o = r(n(e) ?? i.rpc, e);
+	return r(n(t) ?? o, t);
+}, s = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z])([A-Z][a-z])/g, "$1_$2").toLowerCase(), c = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return e;
+	let n = {};
+	for (let [r, i] of Object.entries(e)) n[t(r)] = i;
+	return n;
+}, l = (e) => r.isDeclaration(e) && e.encoding !== void 0 && e.annotations?.representation?.id === "effect/schema/Date" && r.isNumber(r.toEncoded(e)), u = e.String.annotate({
+	identifier: "DateFromString",
+	format: "date-time"
+}).pipe(e.decodeTo(e.Date, n.dateFromString)), d = (n, i) => {
+	if (i.dates === "epoch-ms" && i.naming === "camelCase") return n;
+	let a = /* @__PURE__ */ new Map(), o = (e) => {
+		let t = a.get(e);
+		if (t !== void 0) return t;
+		let n = d(e);
+		return a.set(e, n), n;
+	}, d = (n) => {
+		if (i.dates === "iso" && l(n)) return u.annotate(n.annotations ?? {}).ast;
+		if (n.encoding !== void 0) return n;
+		if (r.isUnion(n)) return new r.Union(n.types.map(o), n.options, n.annotations, n.checks, void 0, n.context);
+		if (r.isArrays(n)) return new r.Arrays(n.isMutable, n.elements.map(o), n.rest.map(o), n.annotations, n.checks, void 0, n.context);
+		if (r.isSuspend(n)) return new r.Suspend(() => o(n.thunk()), n.annotations, n.checks, void 0, n.context);
+		if (r.isObjects(n)) {
+			let a = n.propertySignatures.map((e) => new r.PropertySignature(e.name, o(e.type))), l = n.indexSignatures.map((e) => new r.IndexSignature(e.parameter, o(e.type))), u = new r.Objects(a, l, n.annotations, n.checks, void 0, n.context);
+			if (i.naming !== "snake_case") return u;
+			let d = a.map((e) => typeof e.name == "string" ? s(e.name) : e.name);
+			if (d.every((e, t) => e === a[t].name)) return u;
+			let f = new r.Objects(a.map((e, t) => new r.PropertySignature(d[t], r.toEncoded(e.type))), l.map((e) => new r.IndexSignature(e.parameter, r.toEncoded(e.type))), n.annotations, void 0, void 0, n.context), p = new Map(a.map((e, t) => [String(d[t]), String(e.name)])), m = new Map(a.map((e, t) => [String(e.name), String(d[t])]));
+			return e.make(f).pipe(e.decodeTo(e.make(u), {
+				decode: t.transform((e) => c(e, (e) => p.get(e) ?? e)),
+				encode: t.transform((e) => c(e, (e) => m.get(e) ?? e))
+			})).ast;
+		}
+		return n;
+	};
+	return e.make(o(n.ast));
+}, f = (e) => `urn:voltro:error:${e}`, p = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2"), m = (e) => ({
+	type: f(e.tag),
+	title: p(e.tag),
+	status: e.status,
+	...e.message.length > 0 ? { detail: e.message } : {},
+	...e.fields
+}), h = "application/problem+json; charset=utf-8", g = "application/vnd.api+json; charset=utf-8", _ = (e, t, n) => e.encodeError === void 0 ? e.errors === "problem-details" ? e.envelope === "jsonapi" ? {
+	body: { errors: [{
+		status: String(t.status),
+		code: t.tag,
+		title: p(t.tag),
+		...t.message.length > 0 ? { detail: t.message } : {},
+		...Object.keys(t.fields).length > 0 ? { meta: t.fields } : {}
+	}] },
+	contentType: g
+} : {
+	body: m(t),
+	contentType: h
+} : { body: {
+	error: t.tag === "InvalidRequest" || t.tag === "InternalServerError" || t.tag === "Unauthorized" || t.tag === "Forbidden" || t.tag === "Gone" || t.tag === "MethodNotAllowed" || t.tag === "Conflict" ? t.message : t.tag,
+	...t.fields
+} } : e.encodeError(t, n), v = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return {
+		cursor: void 0,
+		rest: e
+	};
+	let n = e[t];
+	return typeof n != "string" && typeof n != "number" ? {
+		cursor: void 0,
+		rest: e
+	} : {
+		cursor: String(n),
+		rest: e
+	};
+}, y = (e, t, n) => {
+	let r = new URLSearchParams(e.query);
+	return r.set(n, t), `<${e.path}?${r.toString()}>; rel="next"`;
+}, b = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) return e;
+	let { id: n, ...r } = e;
+	return {
+		type: t,
+		...n === void 0 ? {} : { id: String(n) },
+		attributes: r
+	};
+}, x = (e, t, n) => {
+	if (e.encodeSuccess !== void 0) return e.encodeSuccess(t, n);
+	let { cursor: r } = v(t, e.cursorField), i = e.pagination === "link-header" && r !== void 0 ? { Link: y(n, r, e.cursorParam) } : void 0, a = (e, t) => ({
+		body: e,
+		...i ? { headers: i } : {},
+		...t ? { contentType: t } : {}
+	});
+	if (e.envelope === "none") return a(t);
+	if (e.envelope === "data") return a({
+		data: t,
+		...r !== void 0 && e.pagination === "link-header" ? { next: r } : {}
+	});
+	let o = n.source ?? n.tag.split(".")[0] ?? "resource", s = Array.isArray(t) ? t : typeof t == "object" && t && Array.isArray(t.items) ? t.items : void 0;
+	return a({
+		data: s === void 0 ? b(t, o) : s.map((e) => b(e, o)),
+		...r === void 0 ? {} : { links: { next: y(n, r, e.cursorParam).replace(/^<|>; rel="next"$/g, "") } }
+	}, g);
+};
+//#endregion
+export { g as JSONAPI_MEDIA_TYPE, h as PROBLEM_JSON, a as REST_PROFILE_NAMES, _ as encodeRestError, x as encodeRestSuccess, y as nextLink, m as problemDetails, f as problemTypeOf, o as resolveRestFormat, d as restViewSchema, s as toSnakeCase };

package/dist/rowEquality.js

@@ -0,0 +1,31 @@
+//#region src/rowEquality.ts
+var e = (e) => e instanceof Uint8Array && Object.getPrototypeOf(e) === Uint8Array.prototype && !("toJSON" in e) && Object.keys(e).length === e.length, t = (e) => {
+	let t = Object.getPrototypeOf(e);
+	return (t === null || t === Object.prototype) && !("toJSON" in e) && !("toJSON" in Object.prototype);
+}, n = (t) => t == null || typeof t == "string" || typeof t == "boolean" || typeof t == "number" || e(t), r = (e, t) => {
+	let n = typeof e == "number" && !Number.isFinite(e) ? null : e, r = typeof t == "number" && !Number.isFinite(t) ? null : t;
+	if (n === r) return !0;
+	if (n instanceof Uint8Array && r instanceof Uint8Array) {
+		if (n.length !== r.length) return !1;
+		for (let e = 0; e < n.length; e++) if (n[e] !== r[e]) return !1;
+		return !0;
+	}
+	return !1;
+}, i = (e, i) => {
+	if (!t(e) || !t(i)) return;
+	let a = Object.keys(e), o = e === i ? a : Object.keys(i);
+	if (a.length !== o.length) return;
+	let s = !0;
+	for (let t = 0; t < a.length; t++) {
+		let o = a[t];
+		if (o === "__proto__" || o in Object.prototype && Object.getOwnPropertyDescriptor(Object.prototype, o)?.set !== void 0) return;
+		let c = Object.getOwnPropertyDescriptor(e, o), l = e === i ? c : Object.getOwnPropertyDescriptor(i, o);
+		if (c === void 0 || l === void 0 || l.enumerable !== !0 || !("value" in c) || !("value" in l)) return;
+		let u = c.value, d = l.value;
+		if (!n(u) || !n(d)) return;
+		r(u, d) || (s = !1);
+	}
+	return s;
+};
+//#endregion
+export { i as flatRowsEqual };

package/dist/rowPatch.js

@@ -0,0 +1,182 @@
+import { flatRowsEqual as e } from "./rowEquality.js";
+import { Result as t, Schema as n, SchemaGetter as r } from "effect";
+import * as i from "effect/encoding/Base64";
+//#region src/rowPatch.ts
+var a = n.Union([n.String, n.Number]), o = (e) => typeof e == "object" && !!e && !Array.isArray(e) && Object.keys(e).length === 1 && typeof e.$bytes == "string", s = n.Unknown.pipe(n.decodeTo(n.Unknown, {
+	decode: r.transform((e) => {
+		if (!o(e)) return e;
+		let n = i.decode(e.$bytes);
+		return t.isSuccess(n) ? n.success : e;
+	}),
+	encode: r.transform((e) => e instanceof Uint8Array ? { $bytes: i.encode(e) } : e instanceof Date ? e.toISOString() : e)
+})), c = n.Record(n.String, s).pipe(n.refine((e) => "id" in e, { message: "patch row must carry an id" })), l = n.Union([
+	n.Struct({
+		op: n.Literal("add"),
+		path: n.String,
+		value: c
+	}),
+	n.Struct({
+		op: n.Literal("replace"),
+		path: n.String,
+		value: c
+	}),
+	n.Struct({
+		op: n.Literal("remove"),
+		path: n.String
+	}),
+	n.Struct({
+		op: n.Literal("mergeCells"),
+		path: n.String,
+		value: n.Record(n.String, s)
+	})
+]), u = n.Struct({
+	ops: n.Array(l),
+	order: n.NullOr(n.Array(a))
+}), d = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, f = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), p = (e) => {
+	let t = Object.keys(e).sort(), n = {};
+	for (let r of t) n[r] = e[r];
+	return JSON.stringify(n);
+}, m = (t, n) => e(t, n) ?? p(t) === p(n), h = (e, t) => {
+	if (e instanceof Uint8Array && t instanceof Uint8Array) {
+		if (e.length !== t.length) return !1;
+		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
+		return !0;
+	}
+	return p({
+		id: 0,
+		v: e
+	}) === p({
+		id: 0,
+		v: t
+	});
+}, g = (e, t, n = {}) => {
+	let r = /* @__PURE__ */ new Map();
+	for (let t of e) r.set(t.id, t);
+	let i = [], a = e.length === t.length && t.every((t, n) => t.id === e[n].id) ? null : [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
+		if (s === void 0 || s.columns.size === 0) return;
+		let n = {}, r = !1;
+		for (let i of s.columns) {
+			if (!(i in t) || h(e[i], t[i])) continue;
+			let a = s.incremental(i, e[i], t[i]);
+			if (a === void 0) return;
+			n[i] = a, r = !0;
+		}
+		if (!r) return;
+		let i = {};
+		for (let [e, n] of Object.entries(t)) s.columns.has(e) || (i[e] = n);
+		return {
+			scalars: i,
+			merges: n
+		};
+	};
+	for (let e of t) {
+		a?.push(e.id), o.add(e.id);
+		let t = r.get(e.id);
+		if (t === void 0) i.push({
+			op: "add",
+			path: d(e.id),
+			value: e
+		});
+		else if (!m(t, e)) {
+			let n = c(t, e);
+			n === void 0 ? i.push({
+				op: "replace",
+				path: d(e.id),
+				value: e
+			}) : (m(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
+				op: "replace",
+				path: d(e.id),
+				value: n.scalars
+			}), i.push({
+				op: "mergeCells",
+				path: d(e.id),
+				value: n.merges
+			}));
+		}
+	}
+	for (let t of e) o.has(t.id) || i.push({
+		op: "remove",
+		path: d(t.id)
+	});
+	return {
+		ops: i,
+		order: a
+	};
+}, _ = (e) => e.every((e) => {
+	let t = e.id;
+	return typeof t == "string" || typeof t == "number";
+}), v = (e, t, n = {}) => {
+	let r = /* @__PURE__ */ new Map();
+	for (let t of e) r.set(t.id, t);
+	return y(e, t, n, r);
+}, y = (e, t, n, r, i) => {
+	let a = /* @__PURE__ */ new Map();
+	for (let e of t.ops) e.op === "mergeCells" && a.set(f(e.path), Object.keys(e.value));
+	for (let e of t.ops) if (e.op === "mergeCells") {
+		let t = f(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
+		if (i === void 0) continue;
+		let o = { ...i };
+		for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
+		r.set(a, o);
+	} else if (e.op === "add" && (t.order !== null || r.has(e.value.id)) && r.set(e.value.id, e.value), e.op === "replace") {
+		let n = r.get(e.value.id), i = (n === void 0 ? [] : a.get(String(e.value.id)) ?? []).filter((t) => !(t in e.value) && t in n);
+		(t.order !== null || n !== void 0) && r.set(e.value.id, i.length === 0 ? e.value : {
+			...e.value,
+			...Object.fromEntries(i.map((e) => [e, n[e]]))
+		});
+	}
+	if (t.order === null && i !== void 0) {
+		let n = e.slice();
+		for (let e of t.ops) {
+			if (e.op === "remove") continue;
+			let t = e.op === "mergeCells" ? f(e.path) : void 0, a = e.op === "mergeCells" ? r.has(t) ? t : Number(t) : e.value.id, o = i.get(a), s = r.get(a);
+			o !== void 0 && s !== void 0 && (n[o] = s);
+		}
+		return n;
+	}
+	let o = [];
+	if (t.order === null) for (let t of e) {
+		let e = r.get(t.id);
+		e !== void 0 && o.push(e);
+	}
+	else for (let e of t.order) {
+		let t = r.get(e);
+		t !== void 0 && o.push(t);
+	}
+	return o;
+}, b = () => {
+	let e, t, n, r = () => {
+		e = void 0, t = void 0, n = void 0;
+	}, i = (e) => {
+		let r = /* @__PURE__ */ new Map(), i = Object.getPrototypeOf(e) === Array.prototype;
+		for (let t = 0; t < e.length; t++) {
+			let n = e[t];
+			r.has(n.id) && (i = !1), r.set(n.id, t);
+		}
+		n = i ? r : void 0, t = i ? void 0 : new Map(e.map((e) => [e.id, e]));
+	};
+	return {
+		reset: r,
+		apply: (a, o, s = {}) => {
+			(a !== e || n === void 0 && t === void 0) && i(a);
+			try {
+				let r = n, c = /* @__PURE__ */ new Map(), l = y(a, o, s, r === void 0 ? t : {
+					get: (e) => {
+						if (c.has(e)) return c.get(e);
+						let t = r.get(e);
+						return t === void 0 ? void 0 : a[t];
+					},
+					has: (e) => c.has(e) || r.has(e),
+					set: (e, t) => {
+						c.set(e, t);
+					}
+				}, r);
+				return (o.order !== null || o.ops.some((e) => e.op === "mergeCells" && "id" in e.value)) && i(l), e = l, l;
+			} catch (e) {
+				throw r(), e;
+			}
+		}
+	};
+};
+//#endregion
+export { v as applyRowPatch, b as createRowPatchApplier, g as diffRows, d as idToPath, _ as isIdKeyed, s as patchCellSchema, f as pathToId, l as rowPatchOpSchema, u as rowPatchSchema };

package/dist/schemaShape.js

@@ -0,0 +1,67 @@
+import { RpcSchema as e } from "effect/rpc";
+//#region src/schemaShape.ts
+var t = (e) => typeof e == "object" && !!e && typeof e._tag == "string", n = 64, r = (e, i = 0) => {
+	if (!t(e)) return String(e);
+	if (i >= n) return "…";
+	let a = i + 1, o = (t) => Array.isArray(e[t]) ? e[t] : [], s = o("encoding").map((e) => r(e.to, a)).join("->"), c = o("checks").length, l = (e) => t(e) && e.context?.isOptional === !0, u = () => {
+		switch (e._tag) {
+			case "Suspend": return "S(…)";
+			case "Objects": {
+				let e = o("propertySignatures").map((e) => {
+					let t = e;
+					return `${String(t.name)}${l(t.type) ? "?" : ""}:${r(t.type, a)}`;
+				}).join(","), t = o("indexSignatures").map((e) => {
+					let t = e;
+					return `[${r(t.parameter, a)}]:${r(t.type, a)}`;
+				}).join(",");
+				return t === "" ? `{${e}}` : `{${e};${t}}`;
+			}
+			case "Union": return `U(${o("types").map((e) => r(e, a)).join("|")})`;
+			case "Arrays": {
+				let e = o("elements").map((e) => `${r(e, a)}${l(e) ? "?" : ""}`).join(","), t = o("rest").map((e) => r(e, a)).join(",");
+				return `A(${e}${t === "" ? "" : `...${t}`})`;
+			}
+			case "Declaration": return `D(${o("typeParameters").map((e) => r(e, a)).join(",")})`;
+			case "Literal": return `L(${String(e.literal)})`;
+			case "Enum": return `E(${o("enums").map((e) => e.map(String).join("=")).join(",")})`;
+			case "TemplateLiteral": return `TL(${o("parts").map((e) => r(e, a)).join(",")})`;
+			case "UniqueSymbol": return `Y(${String(e.symbol)})`;
+			default: return String(e);
+		}
+	}, d = c > 0 ? `R${c}(${u()})` : u();
+	return s === "" ? d : `T(${s}->${d})`;
+}, i = (e) => {
+	let t = 2166136261;
+	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619) >>> 0;
+	return t.toString(16).padStart(8, "0");
+}, a = (t) => {
+	if (t !== void 0 && e.isStreamSchema(t)) {
+		let e = t;
+		return `S(${r(e.success.ast)}|${r(e.error.ast)})`;
+	}
+	return r(t?.ast);
+}, o = (e) => i([
+	r(e.payloadSchema?.ast),
+	a(e.successSchema),
+	r(e.errorSchema?.ast)
+].join("\0")), s = (e) => {
+	let t = {}, n = e.requests, r = n instanceof Map ? n.entries() : Array.isArray(n) ? n.map((e, t) => [t, e]) : [];
+	for (let [, e] of r) {
+		if (typeof e != "object" && typeof e != "function" || e === null) continue;
+		let n = e;
+		typeof n._tag == "string" && (t[n._tag] = o(n));
+	}
+	return t;
+}, c = (e, t) => {
+	let n = [], r = [];
+	for (let [i, a] of Object.entries(t)) {
+		let t = e[i];
+		t === void 0 ? r.push(i) : t !== a && n.push(i);
+	}
+	return {
+		differing: n.sort(),
+		missingHere: r.sort()
+	};
+};
+//#endregion
+export { c as compareSurfaces, s as groupShapeDigests, o as procedureShapeDigest, r as schemaShape, i as shapeDigest };

package/dist/scopes.js

@@ -0,0 +1,240 @@
+import { RequestedTenantRefused as e } from "./tenantSelection.js";
+import { Unauthenticated as t, currentSubjectAuthority as n, reauthorizeSubject as r } from "./auth.js";
+import { Effect as i, Schema as a } from "effect";
+//#region src/scopes.ts
+var o = "admin:full", s = "apikeys:issue:self", c = "apikeys:issue:org", l = "apikeys:issue:other", u = "devices:manage", d = class extends a.TaggedError()("ScopeError", {
+	required: a.String,
+	message: a.String
+}) {}, f = class extends a.TaggedError()("NoSuchResource", {
+	resourceType: a.NullOr(a.String),
+	resourceId: a.String,
+	message: a.String
+}) {}, p = (e) => "scopes" in e && e.scopes ? e.scopes : [], m = /* @__PURE__ */ new WeakMap(), h = /* @__PURE__ */ new WeakMap(), g = (e, t) => {
+	h.set(e, t);
+}, _ = async (e, t) => {
+	let n = h.get(e);
+	n !== void 0 && (await n(t), h.set(t, n));
+}, v = (e, t) => {
+	typeof e == "object" && e && m.set(e, t);
+}, y = (e) => {
+	if (e = n(e), typeof e == "object" && e) {
+		let t = m.get(e);
+		if (t) return t;
+	}
+	return p(e);
+}, b = (e, t) => {
+	let n = y(e);
+	return n.includes("admin:full") || n.includes(t);
+}, x = (e, t) => {
+	let n = p(e);
+	return n.includes("admin:full") || n.includes(t);
+}, S = (e, t) => b(e, t) ? i.void : i.fail(new d({
+	required: t,
+	message: `missing required scope '${t}'`
+})), C = (e, t) => {
+	let n;
+	try {
+		n = typeof e.action == "function" ? e.action(t) : e.action;
+	} catch {
+		throw new d({
+			required: e.resourceType,
+			message: "policy action selector failed"
+		});
+	}
+	if (typeof n != "string" || n.trim() === "") throw new d({
+		required: e.resourceType,
+		message: "policy action selector returned no action"
+	});
+	return n;
+}, w = (e) => (typeof e.action == "string" || typeof e.action == "function") && typeof e.resourceType == "string", T = (e) => e !== void 0 && e.some((e) => w(e) || typeof e.resource == "function"), E = (e) => typeof e.open == "string", D = (e) => Array.isArray(e.service), O = (e) => ({ service: [...e] }), k = (e) => e?.find(D)?.service, A = (e, t) => {
+	let n = k(t);
+	if (e.type === "service") return n !== void 0 && n.includes(e.service) ? null : new d({
+		required: "service-procedure",
+		message: n === void 0 ? `service '${e.service}' may only call procedures that declare it in \`service: { callers }\`` : `service '${e.service}' is not among this procedure's callers [${n.join(", ")}]`
+	});
+	if (n !== void 0) return U(e, new d({
+		required: `service:${n.join("|")}`,
+		message: `this procedure is callable only by the service${n.length === 1 ? "" : "s"} [${n.join(", ")}]`
+	}));
+}, j = (e) => e.authenticated === !0, M = (e) => ({ open: e }), N = (e) => typeof e == "string" ? [e] : e, P, F = (e) => {
+	P = e;
+}, I = (e) => P === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !w(e) && e.resource !== void 0)).map((e) => e.tag) : [], L = (e) => [
+	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
+	...e.slice(0, 10).map((e) => `    ${e}`),
+	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
+	"",
+	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
+	"  but with no resource-scope resolver registered the extractor is advisory and",
+	"  the check runs against the caller's GLOBAL scopes. For an app whose",
+	"  authorization is per-resource, that guard passes callers it should refuse.",
+	"",
+	"  Fix it one of two ways:",
+	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
+	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
+	"    • Drop the `resource` extractor if a global scope check is what you meant."
+].join("\n"), R = () => P, z, B = (e) => {
+	z = e;
+}, V = () => z, H = (e) => new d({
+	required: "access-decision",
+	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
+}), U = (e, n) => {
+	let r = e.credentialRejected;
+	return r === void 0 ? n : new t({ reason: `${r} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${n.message}); the scope is not the problem. Re-authenticate and retry.` });
+}, W = (e) => {
+	let t = Array.isArray(e), n = Object.getPrototypeOf(e);
+	if (t ? n !== Array.prototype : n !== Object.prototype && n !== null) return !1;
+	for (let n of Reflect.ownKeys(e)) if (t && (typeof n != "string" || n !== "length" && !/^(0|[1-9][0-9]*)$/.test(n)) || !("value" in Object.getOwnPropertyDescriptor(e, n))) return !1;
+	return !0;
+}, G = (e, t) => {
+	let n, r = 0, i, a = 0, o;
+	return (s) => {
+		let c = y(e);
+		return (c !== n || c.length !== r) && (n = c, r = c.length, i = void 0, a = 0, o = void 0), i === void 0 && c.length >= 32 && ++a > 1 && (o ??= W(c) && W(e) && W(t) && t.every((e) => W(e) && (!("scope" in e) || typeof e.scope == "string" || W(e.scope))), o && (i = new Set(c))), i === void 0 ? c.includes("admin:full") || c.includes(s) : i.has("admin:full") || i.has(s);
+	};
+}, K = (e, t, n) => {
+	let r = A(e, t);
+	if (r !== void 0) return r;
+	if (!t || t.length === 0) return n?.defaultDeny === !0 ? H(n.procedure) : null;
+	let i = 0, a;
+	for (let n of t) {
+		if (E(n) || D(n)) continue;
+		if (j(n)) {
+			if (e.id !== null && e.id !== void 0) continue;
+			return U(e, new d({
+				required: "authenticated",
+				message: "this procedure requires an authenticated caller"
+			}));
+		}
+		if (w(n)) {
+			if (i++, a === void 0 && (t.length >= 512 || i >= 512) && (a = G(e, t)), a === void 0 ? b(e, "admin:full") : a("admin:full")) continue;
+			return U(e, new d({
+				required: `${n.resourceType}:${n.action}`,
+				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
+			}));
+		}
+		let r = N(n.scope);
+		if (n.resourceOnly === !0) return U(e, new d({
+			required: r[0] ?? "resource",
+			message: "resource-only guard cannot be checked synchronously"
+		}));
+		if (r.length === 0) continue;
+		i += r.length, a === void 0 && (t.length >= 512 || i >= 512) && (a = G(e, t));
+		let o = n.mode ?? "all", s;
+		if (o === "any") {
+			if (a === void 0 ? r.some((t) => b(e, t)) : r.some(a)) continue;
+			s = r[0];
+		} else {
+			let t = a === void 0 ? r.find((t) => !b(e, t)) : r.find((e) => !a(e));
+			if (t === void 0) continue;
+			s = t;
+		}
+		return U(e, new d({
+			required: s,
+			message: o === "any" ? `missing all of required scopes [${r.join(", ")}]` : `missing required scope '${s}'`
+		}));
+	}
+	return null;
+}, q = (e, t, n) => {
+	let r;
+	try {
+		r = C(t, n);
+	} catch (e) {
+		return i.succeed(e);
+	}
+	let a = (e) => new d({
+		required: `${t.resourceType}:${r}`,
+		message: e
+	});
+	if (b(e, "admin:full")) return i.succeed(null);
+	let o = z;
+	if (o === void 0) return i.succeed(a(`no policy resolver registered — cannot authorize '${r}' on '${t.resourceType}'`));
+	let s = t.resource(n);
+	return s === void 0 || s === "" ? i.succeed(a(`input does not identify a '${t.resourceType}' to authorize`)) : i.suspend(() => o({
+		subject: e,
+		action: r,
+		resourceType: t.resourceType,
+		resourceId: s
+	})).pipe(i.catchCause(() => i.succeed(!1)), i.map((n) => J(e, n, t.resourceType, s, () => a(`no '${r}' relation on ${t.resourceType}:${s}`))));
+}, J = (e, t, n, r, i) => t === !0 ? null : t === "missing" && e.id !== null && e.id !== void 0 ? new f({
+	resourceType: n,
+	resourceId: r,
+	message: n === null ? `no such resource '${r}'` : `no such ${n} '${r}'`
+}) : i(), Y = (e, t, n, r) => {
+	let a = A(e, t);
+	if (a !== void 0) return i.succeed(a);
+	if (!t || t.length === 0) return i.succeed(K(e, t, r));
+	let o = P, s = t.some(w), c = t.some((e) => "scope" in e && e.resourceOnly === !0);
+	return !s && !c && (!o || !t.some((e) => e.resource !== void 0)) ? i.succeed(K(e, t, r)) : i.gen(function* () {
+		for (let r of t) {
+			if (E(r) || D(r)) continue;
+			if (j(r)) {
+				if (e.id !== null && e.id !== void 0) continue;
+				return U(e, new d({
+					required: "authenticated",
+					message: "this procedure requires an authenticated caller"
+				}));
+			}
+			if (w(r)) {
+				let t = yield* q(e, r, n);
+				if (t) return t;
+				continue;
+			}
+			let t = N(r.scope);
+			if (t.length === 0) {
+				if (r.resourceOnly === !0) return U(e, new d({
+					required: "resource",
+					message: "resource-only guard requires a non-empty scope list"
+				}));
+				continue;
+			}
+			let a;
+			try {
+				a = r.resource ? r.resource(n) : void 0;
+			} catch (n) {
+				if (r.resourceOnly !== !0) throw n;
+				return U(e, new d({
+					required: t[0],
+					message: "resource selector failed"
+				}));
+			}
+			if (r.resourceOnly === !0 && (o === void 0 || typeof a != "string" || a === "")) return U(e, new d({
+				required: t[0],
+				message: "resource-only guard requires a resolver and a non-empty resource id"
+			}));
+			let s = [], c = !1;
+			for (let n of t) if (r.resourceOnly !== !0 && b(e, n)) s.push(!0);
+			else if (a !== void 0 && o !== void 0) {
+				let t = yield* i.suspend(() => o({
+					subject: e,
+					scope: n,
+					resource: a
+				})).pipe(i.catchCause(() => i.succeed(!1)));
+				t === "missing" && (c = !0), s.push(t === !0);
+			} else s.push(!1);
+			let l = r.mode ?? "all";
+			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
+				let n = l === "any" ? t[0] : t[t.findIndex((e, t) => !s[t])];
+				if (c && a !== void 0) {
+					let t = J(e, "missing", null, a, () => new d({
+						required: n,
+						message: `missing required scope '${n}' on resource '${a}'`
+					}));
+					if (t !== null) return t;
+				}
+				return new d({
+					required: n,
+					message: l === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${n}'` + (a === void 0 ? "" : ` on resource '${a}'`)
+				});
+			}
+		}
+		return null;
+	});
+}, X = (n, o, s, c) => i.tryPromise({
+	try: async () => r(n, (e) => _(n, e)),
+	catch: (e) => e
+}).pipe(i.matchEffect({
+	onFailure: (n) => a.is(t)(n) || a.is(e)(n) ? i.succeed(n) : i.die(n),
+	onSuccess: (e) => Y(e, o, s, c)
+}));
+//#endregion
+export { o as ADMIN_SCOPE, c as APIKEY_ISSUE_ORG_SCOPE, l as APIKEY_ISSUE_OTHER_SCOPE, s as APIKEY_ISSUE_SELF_SCOPE, u as DEVICES_MANAGE_SCOPE, f as NoSuchResource, d as ScopeError, L as advisoryResourceGuardWarning, K as checkGuards, Y as checkGuardsEffect, T as declaresResourceGuard, y as effectiveScopes, I as findAdvisoryResourceGuards, V as getPolicyGuardResolver, R as getResourceScopeResolver, b as hasEffectiveScope, x as hasScope, j as isAuthenticatedCheck, E as isOpenAccess, w as isPolicyCheck, D as isServiceAccess, H as missingAccessDecision, M as openAccessSpec, X as recheckGuardsEffect, _ as refreshEffectiveScopes, S as requireScope, C as resolvePolicyAction, O as serviceAccessSpec, k as serviceCallersOf, v as setEffectiveScopes, g as setEffectiveScopesRefresher, B as setPolicyGuardResolver, F as setResourceScopeResolver, p as subjectScopes };