@voltro/protocol 0.85.0 → 0.87.0

package/dist/apiRoleEndpoints.js

@@ -0,0 +1,108 @@
+//#region src/apiRoleEndpoints.ts
+var e = (e, t) => {
+	if (!e || typeof e != "object" || Array.isArray(e) || ![Object.prototype, null].includes(Object.getPrototypeOf(e))) throw Error("Invalid role endpoint object");
+	let n = Object.create(null);
+	for (let r of Reflect.ownKeys(e)) {
+		let i = Object.getOwnPropertyDescriptor(e, r);
+		if (typeof r != "string" || !t.includes(r) || !i.enumerable || !("value" in i)) throw Error("Invalid role endpoint field");
+		n[r] = i.value;
+	}
+	return n;
+}, t = (e, t, n = !1) => {
+	if (!Array.isArray(e) || e.length < +!n || e.length > t || Reflect.ownKeys(e).length !== e.length + 1) throw Error("Invalid role endpoint list");
+	let r = [];
+	for (let t = 0; t < e.length; t++) {
+		let n = Object.getOwnPropertyDescriptor(e, String(t));
+		if (!n?.enumerable || !("value" in n)) throw Error("Invalid role endpoint list item");
+		r.push(n.value);
+	}
+	return r;
+}, n = /^(?:[A-Za-z][A-Za-z0-9_-]*\.)*[A-Za-z][A-Za-z0-9_-]*$/, r = /^(?:[A-Za-z_][A-Za-z0-9_-]*\.)*[A-Za-z_][A-Za-z0-9_-]*$/, i = [
+	"rpc",
+	"subscriptions",
+	"events",
+	"presence",
+	"workflows",
+	"schedules",
+	"directors",
+	"drainers",
+	"reapers",
+	"retention",
+	"rest",
+	"webhooks",
+	"inspect",
+	"cdc"
+], a = (r) => {
+	let a = e(r, [
+		"version",
+		"transport",
+		"roles"
+	]);
+	if (a.version !== 1 || a.transport !== "compose-nginx" && a.transport !== "kubernetes-nginx") throw Error("Unknown role endpoint protocol");
+	let o = /* @__PURE__ */ new Set(), s = t(a.roles, 32, !0).map((r) => {
+		let a = e(r, [
+			"role",
+			"routes",
+			"workloads",
+			"httpPath",
+			"webSocketPath"
+		]), s = a.role;
+		if (typeof s != "string" || !/^[a-z][a-z0-9-]{0,63}$/.test(s) || o.has(s)) throw Error("Invalid or duplicate endpoint role");
+		o.add(s);
+		let c = t(a.workloads, 14).map((e) => {
+			if (typeof e != "string" || !i.includes(e)) throw Error("Unknown endpoint workload");
+			return e;
+		});
+		if (new Set(c).size !== c.length) throw Error("Duplicate endpoint workload");
+		let l = a.routes === null ? null : t(a.routes, 128).map((e) => {
+			if (typeof e != "string" || e.length > 191 || !n.test(e.endsWith(".*") ? e.slice(0, -2) : e)) throw Error("Invalid endpoint tag filter");
+			return e;
+		});
+		if (l && new Set(l).size !== l.length) throw Error("Duplicate endpoint tag filter");
+		let u = "/_voltro/roles/" + s;
+		if (a.webSocketPath !== u + "/ws" || a.httpPath !== (c.includes("rpc") ? u + "/rpc" : null)) throw Error("Role endpoints must use canonical same-origin paths");
+		return Object.freeze({
+			role: s,
+			routes: l && Object.freeze(l),
+			workloads: Object.freeze(c),
+			httpPath: a.httpPath,
+			webSocketPath: a.webSocketPath
+		});
+	});
+	return Object.freeze({
+		version: 1,
+		transport: a.transport,
+		roles: Object.freeze(s)
+	});
+}, o = (e, t, n) => {
+	if (t.length > 191 || !r.test(t) || ![
+		"rpc",
+		"subscriptions",
+		"events"
+	].includes(n)) throw Error("Invalid role endpoint request");
+	let i, a = -1, o = !1;
+	for (let r of e.roles) {
+		if (!r.workloads.includes(n)) continue;
+		let e = r.routes === null ? 0 : Math.max(-1, ...r.routes.map((e) => e.endsWith(".*") ? t.startsWith(e.slice(0, -1)) ? e.length : -1 : e === t ? 1024 + e.length : -1));
+		e > a ? (i = r, a = e, o = !1) : e >= 0 && e === a && (o = !0);
+	}
+	if (!i || o) throw Error(o ? "Ambiguous role endpoint" : "No role endpoint owns this tag and workload");
+	return i;
+}, s = (e) => {
+	if (!/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/.test(e)) throw Error("Invalid role proxy API name");
+	return `/_voltro/role-api/api-${e}/ws`;
+}, c = (e, t, n) => {
+	if (!/^[a-z][a-z0-9-]{0,63}$/.test(t.role) || !["http", "websocket"].includes(n)) throw Error("Invalid role transport");
+	let r = new URL(e);
+	if (![
+		"http:",
+		"https:",
+		"ws:",
+		"wss:"
+	].includes(r.protocol) || r.username || r.password) throw Error("Invalid role endpoint origin");
+	let i = n === "http" ? t.httpPath : t.webSocketPath;
+	if (!i || i !== "/_voltro/roles/" + t.role + (n === "http" ? "/rpc" : "/ws")) throw Error("Missing or noncanonical role transport");
+	return r.protocol = n === "http" ? r.protocol === "https:" || r.protocol === "wss:" ? "https:" : "http:" : r.protocol === "https:" || r.protocol === "wss:" ? "wss:" : "ws:", r.pathname = (/^\/_voltro\/role-api\/api-[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}\/ws$/.test(r.pathname) ? r.pathname.slice(0, -3) : "") + i, r.search = "", r.hash = "", r.toString();
+};
+//#endregion
+export { c as apiRoleEndpointUrl, s as apiRoleProxyBasePath, a as captureApiRoleEndpoints, o as selectApiRoleEndpoint };

package/dist/apiRoleObservation.js

@@ -0,0 +1,68 @@
+import { API_WORKLOADS as e } from "./plugin.js";
+import { Schema as t } from "effect";
+//#region src/apiRoleObservation.ts
+var n = t.Literals(e), r = t.Number.pipe(t.check(t.isFinite()), t.check(t.isGreaterThanOrEqualTo(0))), i = r.pipe(t.check(t.isInt())), a = i.pipe(t.check(t.isLessThanOrEqualTo(864e13))), o = t.Struct({
+	workload: n,
+	seconds: r
+}), s = t.Struct({
+	replicaId: t.NonEmptyString,
+	startedAt: a,
+	role: t.NonEmptyString,
+	workloads: t.Array(n),
+	capturedAt: a,
+	publisher: t.Struct({
+		ready: t.Boolean,
+		stopped: t.Boolean,
+		pendingBuckets: i,
+		droppedBuckets: i,
+		rejectedSegments: i,
+		writeFailures: i,
+		observationErrors: i
+	}),
+	currentMeasuredSeconds: t.Array(t.Struct({
+		role: t.NonEmptyString,
+		workload: n,
+		seconds: r
+	})),
+	history: t.Struct({
+		state: t.Literals([
+			"pending",
+			"available",
+			"unavailable"
+		]),
+		measuredSeconds: t.Array(o),
+		assessment: t.NullOr(t.Struct({
+			from: a,
+			until: a,
+			complete: t.Boolean,
+			missingBuckets: i.pipe(t.check(t.isLessThanOrEqualTo(288))),
+			incompleteWorkloads: t.Array(n),
+			reason: t.Literals([
+				"invalid-observation",
+				"incomplete",
+				"idle",
+				"observed"
+			]),
+			totals: t.Array(t.Struct({
+				workload: n,
+				seconds: r,
+				share: r.pipe(t.check(t.isLessThanOrEqualTo(1)))
+			})),
+			splitCandidates: t.Array(n)
+		}))
+	})
+}).pipe(t.check(t.makeFilter((e) => {
+	let t = (e) => new Set(e).size === e.length, n = (n) => t(n) && n.every((t) => e.workloads.some((e) => e === t));
+	if (!e.workloads.length || !t(e.workloads) || e.startedAt > e.capturedAt || !n(e.currentMeasuredSeconds.map((e) => e.workload)) || e.currentMeasuredSeconds.some((t) => t.role !== e.role) || !n(e.history.measuredSeconds.map((e) => e.workload))) return !1;
+	let r = e.history.assessment;
+	if (e.history.state !== "available") return r === null && e.history.measuredSeconds.length === 0;
+	if (!r || r.until - r.from !== 864e5 || r.until % 3e5 != 0 || r.until > e.capturedAt || !n(r.incompleteWorkloads) || !n(r.splitCandidates) || !n(r.totals.map((e) => e.workload))) return !1;
+	if (!r.complete) return r.totals.length === 0 && r.splitCandidates.length === 0 && ["incomplete", "invalid-observation"].includes(r.reason);
+	if (r.from < e.startedAt || r.missingBuckets !== 0 || r.incompleteWorkloads.length !== 0 || r.totals.length !== e.workloads.length) return !1;
+	let i = r.totals.reduce((e, t) => e + t.seconds, 0);
+	if (i > 86400 || r.reason !== (i === 0 ? "idle" : "observed") || r.totals.some((e) => Math.abs(e.share - (i === 0 ? 0 : e.seconds / i)) > 1e-9)) return !1;
+	let a = r.totals.filter((e) => e.share > .3).map((e) => e.workload), o = a.length >= 2 ? a : [];
+	return o.length === r.splitCandidates.length && o.every((e) => r.splitCandidates.includes(e));
+}, { message: "Inconsistent API role observation" })));
+//#endregion
+export { s as ApiRoleObservationSchema };

package/dist/apikey.d.ts

@@ -129,6 +129,13 @@ declare interface AuthStrategy {
 declare interface AuthStrategyInput {
     readonly headers: Readonly<Record<string, string | undefined>>;
     readonly clientId: number;
+    /** HTTP request target, supplied by REST transports. Request selectors may
+     * read an explicit tenant hint here; it is never authentication or authority.
+     * Absent for connection transports and non-HTTP callers. */
+    readonly http?: {
+        readonly path: string;
+        readonly query: string;
+    };
     /**
      * The app's DataStore, for a strategy that must READ to identify the caller.
      *
@@ -196,6 +203,9 @@ declare type StrategyResolution = {
 
 declare const Subject: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"user">;
+    /** A guest has a stable identity but has not linked a registered account.
+     * This identity mark survives session signing; it never grants authority. */
+    readonly kind: Schema.optional<Schema.Literal<"guest">>;
     readonly id: Schema.String;
     readonly tenantId: Schema.String;
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;

package/dist/approval.js

@@ -0,0 +1,64 @@
+import { Schema as e } from "effect";
+//#region src/approval.ts
+var t = class extends e.TaggedError()("ApprovalRequired", {
+	approvalId: e.String,
+	procedure: e.String,
+	expiresAt: e.String,
+	requiredScopes: e.Array(e.String),
+	reason: e.NullOr(e.String),
+	created: e.Boolean
+}) {}, n = class extends e.TaggedError()("ApprovalNotFound", { approvalId: e.String }) {}, r = class extends e.TaggedError()("ApprovalSelfApproval", {
+	approvalId: e.String,
+	subjectId: e.NullOr(e.String)
+}) {}, i = class extends e.TaggedError()("ApprovalRejected", {
+	approvalId: e.String,
+	decidedBy: e.NullOr(e.String),
+	note: e.NullOr(e.String)
+}) {}, a = class extends e.TaggedError()("ApprovalExpired", {
+	approvalId: e.String,
+	expiredAt: e.String
+}) {}, o = class extends e.TaggedError()("ApprovalNotPending", {
+	approvalId: e.String,
+	status: e.String
+}) {}, s = class extends e.TaggedError()("ApprovalForbidden", {
+	approvalId: e.String,
+	required: e.NullOr(e.String),
+	message: e.String
+}) {}, c = class extends e.TaggedError()("ApprovalUnavailable", {
+	procedure: e.String,
+	message: e.String
+}) {}, l = e.Union([
+	t,
+	i,
+	a,
+	c
+]), u = e.Union([
+	n,
+	r,
+	a,
+	o,
+	s,
+	c
+]), d = e.Struct({
+	id: e.String,
+	procedure: e.String,
+	kind: e.Literals(["mutation", "action"]),
+	requestedBy: e.NullOr(e.String),
+	status: e.Literals([
+		"pending",
+		"approved",
+		"rejected",
+		"expired",
+		"consumed"
+	]),
+	reason: e.NullOr(e.String),
+	requiredScopes: e.Array(e.String),
+	requestedAt: e.String,
+	expiresAt: e.String,
+	decidedBy: e.NullOr(e.String),
+	decidedAt: e.NullOr(e.String),
+	note: e.NullOr(e.String),
+	relation: e.Literals(["to-decide", "requested"])
+});
+//#endregion
+export { u as ApprovalDecisionErrors, l as ApprovalErrors, a as ApprovalExpired, s as ApprovalForbidden, n as ApprovalNotFound, o as ApprovalNotPending, i as ApprovalRejected, t as ApprovalRequired, r as ApprovalSelfApproval, c as ApprovalUnavailable, d as PendingApproval };

package/dist/approvalDescriptors.js

@@ -0,0 +1,26 @@
+import { ApprovalDecisionErrors as e, PendingApproval as t } from "./approval.js";
+import { defineMutation as n, defineQuery as r } from "./procedure.js";
+import { Schema as i } from "effect";
+//#region src/approvalDescriptors.ts
+var a = "__voltro.approvals.pending", o = "__voltro.approvals.decide", s = r({
+	name: a,
+	source: "_voltro_approvals",
+	input: i.Struct({ limit: i.optional(i.Number) }),
+	output: i.Array(t),
+	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
+}), c = n({
+	name: o,
+	input: i.Struct({
+		approvalId: i.String,
+		decision: i.Literals(["approve", "reject"]),
+		note: i.optional(i.String)
+	}),
+	output: i.Struct({
+		approvalId: i.String,
+		status: i.Literals(["approved", "rejected"])
+	}),
+	error: e,
+	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
+});
+//#endregion
+export { o as APPROVALS_DECIDE_TAG, a as APPROVALS_PENDING_TAG, c as approvalsDecideDescriptor, s as approvalsPendingQueryDescriptor };

package/dist/auth.js

@@ -0,0 +1,389 @@
+import { RequestedTenantRefused as e, TenantSelectionRefused as t, isTenantSelectable as n, selectSubjectTenant as r } from "./tenantSelection.js";
+import { Context as i, Schema as a, Struct as o } from "effect";
+import { RpcMiddleware as s } from "effect/rpc";
+//#region src/auth.ts
+var c = a.Record(a.String, a.Unknown), l = a.optional(a.Array(a.String)), u = a.Struct({
+	type: a.Literal("user"),
+	kind: a.optional(a.Literal("guest")),
+	id: a.String,
+	tenantId: a.String,
+	scopes: l,
+	metadata: a.optional(c)
+}), d = a.Struct({
+	type: a.Literal("apiKey"),
+	id: a.String,
+	tenantId: a.String,
+	scopes: l,
+	metadata: a.optional(c)
+}), f = a.Struct({
+	type: a.Literal("serviceAccount"),
+	id: a.String,
+	tenantId: a.String,
+	auditActorId: a.optionalKey(a.NullOr(a.String)),
+	scopes: l,
+	metadata: a.optional(c)
+}), p = a.Struct({
+	type: a.Literal("anonymous"),
+	id: a.Null,
+	tenantId: a.NullOr(a.String),
+	credentialRejected: a.optional(a.String)
+}), m = a.Struct({
+	type: a.Literal("system"),
+	id: a.String,
+	tenantId: a.Null,
+	scopes: l,
+	metadata: a.optional(c)
+}), h = a.Struct({
+	type: a.Literal("service"),
+	id: a.String,
+	service: a.String,
+	tenantId: a.Null,
+	scopes: l,
+	metadata: a.optional(c)
+}), g = a.Union([
+	u,
+	d,
+	f,
+	p,
+	m,
+	h
+]), _ = a.Union([
+	u.mapFields(o.omit(["scopes"])),
+	d.mapFields(o.omit(["scopes"])),
+	f.mapFields(o.omit(["scopes"])),
+	p,
+	m.mapFields(o.omit(["scopes"])),
+	h.mapFields(o.omit(["scopes"]))
+]), v = (e) => {
+	if (e.type === "anonymous") return e;
+	let { scopes: t, ...n } = e;
+	return n;
+}, y = (e) => e.scopes ?? [], b = (e, t) => ({
+	type: "anonymous",
+	id: null,
+	tenantId: e,
+	...t === void 0 ? {} : { credentialRejected: t }
+}), x = (e, t = ["admin:full"]) => ({
+	type: "system",
+	id: e,
+	tenantId: null,
+	scopes: t
+}), S = (e) => ({
+	type: "service",
+	id: `service:${e}`,
+	service: e,
+	tenantId: null,
+	scopes: []
+}), C = (e) => e.type === "service", w = (e) => e.type === "system" || e.type === "service", T = (e) => {
+	if (e.type === "system") return null;
+	if (e.type === "serviceAccount" && e.auditActorId !== void 0) return e.auditActorId;
+	if (e.type !== "apiKey") return e.id;
+	let t = e.metadata?.userId;
+	return typeof t == "string" && t !== "" ? t : e.id;
+}, E = (e, t) => {
+	let n = e;
+	return {
+		type: "serviceAccount",
+		id: e.id ?? "system",
+		tenantId: t,
+		auditActorId: T(e),
+		scopes: y(e),
+		...n.metadata === void 0 ? {} : { metadata: n.metadata }
+	};
+}, D = (e) => e.type === "system", O = "impersonation", k = (e) => e.metadata?.impersonation ?? null, A = class extends i.Service()("@voltro/Subject") {}, j = class extends i.Service()("@voltro/ConnectionInfo") {}, M = class extends a.TaggedError()("Unauthenticated", { reason: a.optional(a.String) }) {
+	get message() {
+		return this.reason ?? "Unauthenticated";
+	}
+}, N = class extends s.Service()("@voltro/AuthMiddleware", { error: a.Union([M, e]) }) {}, P = class extends s.Service()("@voltro/ConnectionInfoMiddleware") {}, F = /* @__PURE__ */ new WeakMap(), I = (e, t) => {
+	let n = { ...e };
+	return F.set(n, {
+		current: n,
+		resolve: t
+	}), n;
+}, L = (e) => F.get(e)?.current ?? e, R = async (e, t) => {
+	let n = F.get(e);
+	if (n === void 0) return await t?.(e), e;
+	let r = await n.resolve();
+	if (r.type !== e.type || r.id !== e.id || r.tenantId !== e.tenantId || e.type === "service" && (r.type !== "service" || r.service !== e.service) || e.type === "user" && (r.type !== "user" || r.kind !== e.kind) || e.type === "serviceAccount" && (r.type !== "serviceAccount" || r.auditActorId !== e.auditActorId)) throw new M({ reason: "request identity or tenant changed; authenticate again" });
+	return F.set(r, {
+		current: r,
+		resolve: n.resolve
+	}), await t?.(r), n.current = r, r;
+}, z = (e) => typeof e.mountRoutes == "function", B = (e) => Array.isArray(e) ? {
+	kind: "grant",
+	scopes: e
+} : e, V = (e, t) => {
+	if (t.kind === "vetoed") throw new M({ reason: `${t.code}: ${t.message}` });
+	if (e.type === "anonymous") return {
+		subject: e,
+		removed: []
+	};
+	let n = y(e);
+	if (t.kind === "grant") {
+		if (t.scopes.length === 0) return {
+			subject: e,
+			removed: []
+		};
+		let r = [.../* @__PURE__ */ new Set([...n, ...t.scopes])];
+		return {
+			subject: {
+				...e,
+				scopes: r
+			},
+			removed: []
+		};
+	}
+	let r = new Set(t.scopes), i = n.filter((e) => !r.has(e));
+	return {
+		subject: {
+			...e,
+			scopes: [...r]
+		},
+		removed: i
+	};
+}, H = async (e, t, n) => {
+	let r = n?.resolveScopes, i = B(r === void 0 ? [] : await r(e, t));
+	if (i.kind === "unavailable") return {
+		kind: "unavailable",
+		reason: i.reason
+	};
+	let a = V(e, i).subject;
+	if (a.type !== "anonymous") for (let e of n?.subjectGuards ?? []) {
+		let n = await e(a, t);
+		if (!n.ok) return {
+			kind: "vetoed",
+			code: n.code,
+			message: n.message
+		};
+	}
+	return {
+		kind: "resolved",
+		subject: a
+	};
+}, U = 3e4, W = 1e4, G = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, K = () => {
+	if (typeof process > "u") return;
+	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? t : void 0;
+}, q = (e = {}) => {
+	let t = e.ttlMs ?? K() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+		if (i.size <= n) return;
+		let e = r();
+		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
+		for (let e of i.keys()) {
+			if (i.size <= n) break;
+			i.delete(e);
+		}
+	};
+	return {
+		ttlMs: t,
+		invalidate: (e) => {
+			i.delete(e);
+		},
+		invalidateAll: () => {
+			i.clear();
+		},
+		resolve: async (e, n) => {
+			let o = r();
+			if (t > 0) {
+				let t = i.get(e);
+				if (t && t.freshUntil > o) return {
+					decision: t.decision,
+					fresh: !1
+				};
+			}
+			let s = await n();
+			return t > 0 && s.kind !== "unavailable" && (i.set(e, {
+				decision: s,
+				freshUntil: o + t
+			}), a()), {
+				decision: s,
+				fresh: !0
+			};
+		}
+	};
+}, J = (e) => typeof e.resolve == "function", Y = (e) => {
+	let t = e.authorization ?? e.Authorization;
+	if (t !== void 0) return /^Bearer\s+(.+)$/i.exec(t.trim())?.[1]?.trim();
+}, X = async (e, i, a, o) => {
+	let s;
+	try {
+		s = await a.source(e, i);
+	} catch {
+		throw o("target-unavailable");
+	}
+	if (s === null) return;
+	if (typeof s != "string" || s.trim().length === 0) throw o("invalid-target");
+	if (!n(e)) throw o("subject-has-no-tenant");
+	let c;
+	try {
+		c = await a.memberships(e, i);
+	} catch {
+		throw o("memberships-unavailable");
+	}
+	try {
+		return r(e, s, c);
+	} catch (e) {
+		throw e instanceof t ? o(e.reason) : e;
+	}
+}, Z = async (e, i, a, o) => {
+	if (!n(e)) return e;
+	let s = {
+		type: e.type,
+		id: e.id
+	}, c;
+	try {
+		c = await a.store.read(s);
+	} catch (e) {
+		throw o(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (c === null || c === e.tenantId) return e;
+	let l;
+	try {
+		l = await a.memberships(e, i);
+	} catch (e) {
+		throw o(`memberships unavailable: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	try {
+		return r(e, c, l);
+	} catch (n) {
+		if (!(n instanceof t)) throw n;
+		try {
+			await a.store.clear(s);
+		} catch (e) {
+			throw o(`tenant selection unavailable: ${e instanceof Error ? e.message : String(e)}`);
+		}
+		return e;
+	}
+}, Q = (e, t) => {
+	let n = Y(t);
+	if (n === void 0) return e;
+	let r = e.filter((e) => e.claimsBearerPrefix !== void 0 && e.claimsBearerPrefix !== "" && n.startsWith(e.claimsBearerPrefix));
+	if (r.length === 0) return e;
+	let i = new Set(r);
+	return [...r, ...e.filter((e) => !i.has(e))];
+}, $ = (e, t) => {
+	if (e === "refuse") throw new M({ reason: "anonymous callers are refused" });
+	if (e === "no-tenant") return "";
+	if (e === "header") {
+		if (t === void 0 || t === "") throw new M({ reason: "tenant required (x-tenant header missing)" });
+		return t;
+	}
+	return "tenantId" in e ? e.tenantId : t !== void 0 && t !== "" ? t : e.headerOrTenant;
+}, ee = (t, n) => {
+	let r = n?.resolveScopes, i = n?.subjectGuards ?? [], a = n?.tenantSelection !== void 0 || n?.requestedTenant !== void 0;
+	if (n?.memberships !== void 0 !== a) throw Error("composeAuthStrategies: memberships and tenant selection come together; `memberships` requires `tenantSelection` or `requestedTenant`; each tenant selector requires `memberships` to authorize its target.");
+	let o = n?.memberships !== void 0 && n.tenantSelection !== void 0 ? {
+		memberships: n.memberships,
+		store: n.tenantSelection
+	} : void 0, s = r !== void 0 || i.length > 0, c = !s || n?.scopeCache === !1 ? null : n?.scopeCache !== void 0 && J(n.scopeCache) ? n.scopeCache : q(n?.scopeCache ?? {}), l = async (a) => {
+		let l = n?.getStore?.(), u = l === void 0 ? a : {
+			...a,
+			store: l
+		}, d;
+		for (let a of Q(t, u.headers)) {
+			let t = await a.resolve(u);
+			if (t.kind === "matched") {
+				let l = (e) => (n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: e
+				}), new M({ reason: e })), d = n?.requestedTenant === void 0 || n.memberships === void 0 ? void 0 : await X(t.subject, u, {
+					source: n.requestedTenant,
+					memberships: n.memberships
+				}, (t) => (n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: `requested tenant refused: ${t}`
+				}), new e({ reason: t })));
+				if (t.subject.type === "service") return { subject: {
+					...t.subject,
+					scopes: []
+				} };
+				let f = d ?? (o === void 0 ? t.subject : await Z(t.subject, u, o, l)), p = f;
+				if (s) {
+					let e = async () => {
+						let e = r === void 0 ? {
+							kind: "grant",
+							scopes: []
+						} : B(await r(f, u));
+						if (e.kind === "unavailable" || i.length === 0) return e;
+						let t = V(f, e).subject, n = {
+							origin: "request",
+							headers: u.headers,
+							clientId: u.clientId,
+							store: u.store
+						};
+						for (let e of i) {
+							let r = await e(t, n);
+							if (!r.ok) return {
+								kind: "vetoed",
+								code: r.code,
+								message: r.message
+							};
+						}
+						return e;
+					}, { decision: t, fresh: o } = c === null ? {
+						decision: await e(),
+						fresh: !0
+					} : await c.resolve(G(f), e);
+					if (t.kind === "vetoed") {
+						let e = `${t.code}: ${t.message}`;
+						throw n?.onStrategyFailed?.({
+							strategyId: a.id,
+							reason: e
+						}), new M({ reason: e });
+					}
+					if (t.kind === "unavailable") {
+						let e = `scope resolution unavailable: ${t.reason}`;
+						throw n?.onStrategyFailed?.({
+							strategyId: a.id,
+							reason: e
+						}), new M({ reason: e });
+					}
+					let s = V(f, t);
+					o && s.removed.length > 0 && n?.onScopesNarrowed?.({
+						strategyId: a.id,
+						subjectType: f.type,
+						subjectId: f.id,
+						removed: s.removed,
+						granted: t.scopes
+					}), p = s.subject;
+				}
+				return t.credentialExpiresAt === void 0 ? { subject: p } : {
+					subject: p,
+					credentialExpiresAt: t.credentialExpiresAt
+				};
+			}
+			if (t.kind === "failed") {
+				n?.onStrategyFailed?.({
+					strategyId: a.id,
+					reason: t.reason
+				}), d = t.reason;
+				break;
+			}
+		}
+		if (n?.fallback) {
+			let e = await n.fallback(u);
+			return { subject: d !== void 0 && e.type === "anonymous" ? {
+				...e,
+				credentialRejected: d
+			} : e };
+		}
+		if (d !== void 0) throw new M({ reason: `credential rejected: ${d}` });
+		return { subject: b($(n?.anonymous ?? "no-tenant", u.headers["x-tenant"])) };
+	};
+	return async (e) => {
+		let t = {
+			...e,
+			headers: { ...e.headers }
+		}, n = await l(t), r = I(n.subject, async () => ({ ...(await l(t)).subject }));
+		return {
+			...n,
+			subject: r
+		};
+	};
+}, te = (e, t) => {
+	if (e.type === "anonymous") throw new M(t === void 0 ? {} : { reason: t });
+};
+//#endregion
+export { N as AuthMiddleware, j as ConnectionInfo, P as ConnectionInfoMiddleware, W as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, U as DEFAULT_SCOPE_CACHE_TTL_MS, O as IMPERSONATION_METADATA_KEY, g as Subject, _ as SubjectIdentity, A as SubjectService, M as Unauthenticated, b as anonymousSubject, V as applyScopeDecision, te as assertAuthenticated, I as bindSubjectAuthority, ee as composeAuthStrategies, L as currentSubjectAuthority, z as hasCallbackRoutes, w as isMachineSubject, C as isServiceSubject, D as isSystemSubject, q as makeScopeCache, Q as orderByBearerPrefix, k as rawImpersonationMark, R as reauthorizeSubject, H as resolveIdentityAuthority, G as scopeCacheKey, S as serviceSubject, T as subjectAuditActorId, v as subjectIdentity, x as systemSubject, E as tenantScopedSubject };