@voltro/protocol 0.86.0 → 0.87.0

package/dist/index.js

@@ -1,43 +1,55 @@
 import { applyRowPatch as e, createRowPatchApplier as t, diffRows as n, idToPath as r, isIdKeyed as i, patchCellSchema as a, pathToId as o, rowPatchOpSchema as s, rowPatchSchema as c } from "./rowPatch.js";
 import { firstEventValue as l, subscriptionEvent as u } from "./subscriptionEvent.js";
 import { RequestedTenantRefused as d, TenantSelectionRefused as f, isTenantSelectable as p, selectSubjectTenant as m } from "./tenantSelection.js";
-import { AuthMiddleware as h, ConnectionInfo as g, ConnectionInfoMiddleware as _, DEFAULT_SCOPE_CACHE_MAX_ENTRIES as v, DEFAULT_SCOPE_CACHE_TTL_MS as y, IMPERSONATION_METADATA_KEY as b, Subject as x, SubjectIdentity as S, SubjectService as C, Unauthenticated as w, anonymousSubject as T, applyScopeDecision as E, assertAuthenticated as D, bindSubjectAuthority as O, composeAuthStrategies as k, currentSubjectAuthority as A, hasCallbackRoutes as j, isMachineSubject as M, isServiceSubject as N, isSystemSubject as P, makeScopeCache as F, orderByBearerPrefix as I, rawImpersonationMark as L, reauthorizeSubject as R, scopeCacheKey as z, serviceSubject as B, subjectAuditActorId as V, subjectIdentity as H, systemSubject as U, tenantScopedSubject as W } from "./auth.js";
-import { ADMIN_SCOPE as G, APIKEY_ISSUE_ORG_SCOPE as K, APIKEY_ISSUE_OTHER_SCOPE as q, APIKEY_ISSUE_SELF_SCOPE as J, DEVICES_MANAGE_SCOPE as Y, NoSuchResource as X, ScopeError as Z, advisoryResourceGuardWarning as Q, checkGuards as $, checkGuardsEffect as ee, declaresResourceGuard as te, effectiveScopes as ne, findAdvisoryResourceGuards as re, getPolicyGuardResolver as ie, getResourceScopeResolver as ae, hasEffectiveScope as oe, hasScope as se, isAuthenticatedCheck as ce, isOpenAccess as le, isPolicyCheck as ue, isServiceAccess as de, missingAccessDecision as fe, openAccessSpec as pe, recheckGuardsEffect as me, refreshEffectiveScopes as he, requireScope as ge, resolvePolicyAction as _e, serviceAccessSpec as ve, serviceCallersOf as ye, setEffectiveScopes as be, setEffectiveScopesRefresher as xe, setPolicyGuardResolver as Se, setResourceScopeResolver as Ce, subjectScopes as we } from "./scopes.js";
-import { inputLabel as Te, strictInput as Ee } from "./strictInput.js";
-import { BusinessRuleViolation as De } from "./businessRule.js";
-import { DEFAULT_IN_FLIGHT_LEASE_MS as Oe, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as ke, MutationConnectionRequired as Ae, MutationInFlight as je, beginIdempotent as Me, failIdempotent as Ne, finishIdempotent as Pe, freshFor as Fe, holdIdempotentClaim as Ie, idempotencyScope as Le, memoryIdempotencyStore as Re, wsMutationIdempotencyScope as ze } from "./idempotency.js";
-import { ValidationError as Be, ValidationErrors as Ve, ValidationIssue as He, fieldIssuesOf as Ue } from "./validation.js";
-import { ApprovalDecisionErrors as We, ApprovalErrors as Ge, ApprovalExpired as Ke, ApprovalForbidden as qe, ApprovalNotFound as Je, ApprovalNotPending as Ye, ApprovalRejected as Xe, ApprovalRequired as Ze, ApprovalSelfApproval as Qe, ApprovalUnavailable as $e, PendingApproval as et } from "./approval.js";
-import { REACTIVITY_CHANNEL_PREFIX as tt, declaredReactivityChannelKeys as nt, isReactivityChannel as rt, isReactivityChannelKey as it, normalizeSource as at, publishReactivity as ot, reactivityChannel as st, sourceKeys as ct, undeclaredChannelKeys as lt } from "./reactivityChannel.js";
-import { FRAMEWORK_WIRE_ERRORS as ut, SERVICE_NAME_PATTERN as dt, actionToRpc as ft, defineAction as pt, defineMutation as mt, defineQuery as ht, defineStream as gt, hasAccessDecision as _t, hasEnforcedGuard as vt, isAuthenticatedGuard as yt, isClientReachable as bt, isPolicyGuard as xt, isServiceReachable as St, isWireReachable as Ct, mutationToRpc as wt, normalizeDescriptor as Tt, queryToRpc as Et, streamToRpc as Dt, toRpc as Ot, wireAudienceOf as kt, wireErrorUnion as At, withRpcTag as jt, workflowWireErrorUnion as Mt } from "./procedure.js";
-import { errorMessage as Nt, errorTag as Pt, reportableError as Ft } from "./errorValue.js";
-import { EVENT_ROUTE_SEP as It, EventKeyInvalid as Lt, EventPayloadInvalid as Rt, EventPayloadTooLarge as zt, MAX_EVENT_ENVELOPE_BYTES as Bt, defineEvent as Vt, encodeEventKey as Ht, eventAttached as Ut, eventEnvelope as Wt, eventGap as Gt, eventResumePoint as Kt, eventRoute as qt, eventStreamEvent as Jt, eventSubscribeInput as Yt, eventToRpc as Xt, formatEventRoute as Zt, isEventDescriptor as Qt, parseEventRoute as $t } from "./event.js";
-import { DEV_ACTIVITY_EVENT as en } from "./devActivity.js";
-import { WorkflowAccessProperty as tn, attachWorkflowAccess as nn, getWorkflowAccess as rn, resolveWorkflowAccess as an, workflowAccessDescriptor as on } from "./workflowAccess.js";
-import { compareSurfaces as sn, groupShapeDigests as cn, procedureShapeDigest as ln, schemaShape as un, shapeDigest as dn } from "./schemaShape.js";
-import { ApiUnavailable as fn, isApiUnavailable as pn } from "./serviceCall.js";
-import { checkFrameworkCompat as mn, composeRpcInterceptors as hn, definePlugin as gn, definePluginRoute as _n, definePluginService as vn, pluginInstanceName as yn } from "./plugin.js";
-import { validateOutboxHandlerDefinition as bn } from "./outbox.js";
-import { pluginAlias as xn, pluginSlug as Sn, pluginTag as Cn, registerPluginAliases as wn, resetPluginAliases as Tn } from "./pluginNaming.js";
-import { publishServerError as En, subscribeServerErrors as Dn, withheldServerError as On } from "./serverErrorBus.js";
-import { WorkflowStartTerminalOutcomeSchema as kn } from "./workflowStartOutcome.js";
-import { WorkflowControlInputSchema as An, WorkflowControlIntentSchema as jn, WorkflowControlReadInputSchema as Mn, WorkflowControlResultSchema as Nn, WorkflowDomainEventRowSchema as Pn, WorkflowDomainEventsInputSchema as Fn, WorkflowEventDeliveriesInputSchema as In, WorkflowEventDeliveryRowSchema as Ln, WorkflowParentClosePolicySchema as Rn, WorkflowQueuedCancelInputSchema as zn, WorkflowQueuedCancellationResultSchema as Bn, WorkflowQueuedControlTargetSchema as Vn, WorkflowRunEventRowSchema as Hn, WorkflowRunHandleSchema as Un, WorkflowRunRefSchema as Wn, WorkflowRunRowSchema as Gn, WorkflowRunSnapshotSchema as Kn, WorkflowRunStatusSchema as qn, WorkflowRunStepRowSchema as Jn, WorkflowRunTableRefSchema as Yn, WorkflowRunsInputSchema as Xn, WorkflowSignalInputSchema as Zn, WorkflowStartDeferralSchema as Qn, WorkflowUpdateInputSchema as $n, WorkflowUpdateResultSchema as er, workflowCancelDescriptor as tr, workflowControlQueryDescriptor as nr, workflowDomainEventsQueryDescriptor as rr, workflowEventDeliveriesQueryDescriptor as ir, workflowQueuedCancelDescriptor as ar, workflowQueuedControlQueryDescriptor as or, workflowResumeDescriptor as sr, workflowRunEventsQueryDescriptor as cr, workflowRunQueryDescriptor as lr, workflowRunStepsQueryDescriptor as ur, workflowRunsQueryDescriptor as dr, workflowSignalDescriptor as fr, workflowToRpc as pr, workflowUpdateDescriptor as mr } from "./workflow.js";
-import { WorkflowRetryCommandSchema as hr, WorkflowRetryObservationSchema as gr, WorkflowRetryTargetSchema as _r } from "./workflowRetry.js";
-import { WorkflowRestartCommandSchema as vr, WorkflowRestartObservationSchema as yr, WorkflowRestartResultSchema as br, WorkflowRestartSelectionSchema as xr, WorkflowRestartTargetSchema as Sr } from "./workflowRestart.js";
-import { UNDO_APPLY_TAG as Cr, UNDO_LOG_TAG as wr, UNDO_REDO_TAG as Tr, UndoConflict as Er, UndoForbidden as Dr, UndoLogEntry as Or, UndoNotFound as kr, undoApplyDescriptor as Ar, undoLogQueryDescriptor as jr, undoRedoDescriptor as Mr } from "./undo.js";
-import { ConstraintViolation as Nr, NoRowFound as Pr, ServerOnlyColumnWrite as Fr, StoreOperationFailed as Ir, TableValidationFailed as Lr, TenantRowNotFound as Rr, TenantScopeViolation as zr } from "./storeErrors.js";
-import { APPROVALS_DECIDE_TAG as Br, APPROVALS_PENDING_TAG as Vr, approvalsDecideDescriptor as Hr, approvalsPendingQueryDescriptor as Ur } from "./approvalDescriptors.js";
-import { CONNECTIONS_LIST_TAG as Wr, CONNECTION_DISCONNECT_TAG as Gr, CONNECTION_START_TAG as Kr, CONNECTION_SUBMIT_TOKEN_TAG as qr, ConnectionHandshakeFailed as Jr, ConnectionKind as Yr, ConnectionKindMismatch as Xr, ConnectionNotDeclared as Zr, ConnectionState as Qr, ConnectionStatus as $r, ConnectionSubjectRequired as ei, connectionDisconnectDescriptor as ti, connectionStartDescriptor as ni, connectionSubmitTokenDescriptor as ri, connectionsListQueryDescriptor as ii } from "./connection.js";
-import { tsMs as ai } from "./time.js";
-import { STORE_SCREENSHOT_PRESETS as oi, STORE_SCREENSHOT_PRESET_NAMES as si, STORE_SCREENSHOT_STORES as ci, storeScreenshotPixels as li, storeScreenshotPreset as ui, storeScreenshotPresetsFor as di } from "./storeScreenshots.js";
-import { GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE as fi, defineWebSocket as pi } from "./webSocketGateway.js";
-import { SESSION_HEADER_NAME as mi, sessionValueFromHeaders as hi } from "./sessionHeader.js";
-import { JSONAPI_MEDIA_TYPE as gi, PROBLEM_JSON as _i, REST_PROFILE_NAMES as vi, encodeRestError as yi, encodeRestSuccess as bi, nextLink as xi, problemDetails as Si, problemTypeOf as Ci, resolveRestFormat as wi, restViewSchema as Ti, toSnakeCase as Ei } from "./restFormat.js";
-import { finiteNumberView as Di, jsonSchemaDocumentOf as Oi, jsonSchemaOf as ki, plainJsonSchema as Ai } from "./jsonSchema.js";
-import { PAIRING_HOST as ji, PAIRING_SCHEME as Mi, PAIRING_STORAGE_KEY as Ni, applyPairing as Pi, clearPairing as Fi, pairingLink as Ii, parsePairingLink as Li, readPairing as Ri } from "./pairing.js";
-import { StorageAccessPolicySchema as zi, StorageAccessRuleSchema as Bi } from "./storageAccess.js";
-import { BoundedRing as Vi } from "./boundedRing.js";
+import { AuthMiddleware as h, ConnectionInfo as g, ConnectionInfoMiddleware as _, DEFAULT_SCOPE_CACHE_MAX_ENTRIES as v, DEFAULT_SCOPE_CACHE_TTL_MS as y, IMPERSONATION_METADATA_KEY as b, Subject as x, SubjectIdentity as S, SubjectService as C, Unauthenticated as w, anonymousSubject as T, applyScopeDecision as E, assertAuthenticated as D, bindSubjectAuthority as O, composeAuthStrategies as k, currentSubjectAuthority as A, hasCallbackRoutes as j, isMachineSubject as M, isServiceSubject as N, isSystemSubject as P, makeScopeCache as F, orderByBearerPrefix as I, rawImpersonationMark as L, reauthorizeSubject as R, resolveIdentityAuthority as z, scopeCacheKey as B, serviceSubject as V, subjectAuditActorId as H, subjectIdentity as U, systemSubject as W, tenantScopedSubject as G } from "./auth.js";
+import { ADMIN_SCOPE as K, APIKEY_ISSUE_ORG_SCOPE as q, APIKEY_ISSUE_OTHER_SCOPE as J, APIKEY_ISSUE_SELF_SCOPE as Y, DEVICES_MANAGE_SCOPE as X, NoSuchResource as Z, ScopeError as Q, advisoryResourceGuardWarning as $, checkGuards as ee, checkGuardsEffect as te, declaresResourceGuard as ne, effectiveScopes as re, findAdvisoryResourceGuards as ie, getPolicyGuardResolver as ae, getResourceScopeResolver as oe, hasEffectiveScope as se, hasScope as ce, isAuthenticatedCheck as le, isOpenAccess as ue, isPolicyCheck as de, isServiceAccess as fe, isUpgradedCheck as pe, missingAccessDecision as me, openAccessSpec as he, recheckGuardsEffect as ge, refreshEffectiveScopes as _e, requireScope as ve, resolvePolicyAction as ye, serviceAccessSpec as be, serviceCallersOf as xe, setEffectiveScopes as Se, setEffectiveScopesRefresher as Ce, setPolicyGuardResolver as we, setResourceScopeResolver as Te, subjectScopes as Ee, upgradedGuardShapeError as De } from "./scopes.js";
+import { inputLabel as Oe, strictInput as ke } from "./strictInput.js";
+import { BusinessRuleViolation as Ae } from "./businessRule.js";
+import { DEFAULT_IN_FLIGHT_LEASE_MS as je, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Me, MutationConnectionRequired as Ne, MutationIdempotencyRefused as Pe, MutationInFlight as Fe, beginIdempotent as Ie, failIdempotent as Le, finishIdempotent as Re, freshFor as ze, holdIdempotentClaim as Be, idempotencyScope as Ve, memoryIdempotencyStore as He, wsMutationIdempotencyScope as Ue } from "./idempotency.js";
+import { ValidationError as We, ValidationErrors as Ge, ValidationIssue as Ke, fieldIssuesOf as qe } from "./validation.js";
+import { ApprovalDecisionErrors as Je, ApprovalErrors as Ye, ApprovalExpired as Xe, ApprovalForbidden as Ze, ApprovalNotFound as Qe, ApprovalNotPending as $e, ApprovalRejected as et, ApprovalRequired as tt, ApprovalSelfApproval as nt, ApprovalUnavailable as rt, PendingApproval as it } from "./approval.js";
+import { REACTIVITY_CHANNEL_PREFIX as at, declaredReactivityChannelKeys as ot, isReactivityChannel as st, isReactivityChannelKey as ct, normalizeSource as lt, publishReactivity as ut, reactivityChannel as dt, sourceKeys as ft, undeclaredChannelKeys as pt } from "./reactivityChannel.js";
+import { captureOptionalQuerySources as mt } from "./queryOptionalSources.js";
+import { FRAMEWORK_WIRE_ERRORS as ht, SERVICE_NAME_PATTERN as gt, actionToRpc as _t, defineAction as vt, defineMutation as yt, defineQuery as bt, defineStream as xt, hasAccessDecision as St, hasEnforcedGuard as Ct, isAuthenticatedGuard as wt, isClientReachable as Tt, isPolicyGuard as Et, isServiceReachable as Dt, isUpgradedGuard as Ot, isWireReachable as kt, mutationToRpc as At, normalizeDescriptor as jt, queryToRpc as Mt, requireUpgraded as Nt, streamToRpc as Pt, toRpc as Ft, wireAudienceOf as It, wireErrorUnion as Lt, withRpcTag as Rt, workflowWireErrorUnion as zt } from "./procedure.js";
+import { errorMessage as Bt, errorTag as Vt, reportableError as Ht } from "./errorValue.js";
+import { declaredErrorTags as Ut, errorMemberSchema as Wt } from "./errorSchema.js";
+import { canonicalJson as Gt } from "./canonicalJson.js";
+import { prepareIdempotentInput as Kt } from "./idempotencyInput.js";
+import { EVENT_ROUTE_SEP as qt, EventKeyInvalid as Jt, EventPayloadInvalid as Yt, EventPayloadTooLarge as Xt, EventRpcWorkload as Zt, MAX_EVENT_ENVELOPE_BYTES as Qt, defineEvent as $t, encodeEventKey as en, eventAttached as tn, eventEnvelope as nn, eventGap as rn, eventResumePoint as an, eventRoute as on, eventStreamEvent as sn, eventSubscribeInput as cn, eventToRpc as ln, formatEventRoute as un, isEventDescriptor as dn, parseEventRoute as fn } from "./event.js";
+import { DEV_ACTIVITY_EVENT as pn } from "./devActivity.js";
+import { WorkflowAccessProperty as mn, attachWorkflowAccess as hn, getWorkflowAccess as gn, resolveWorkflowAccess as _n, workflowAccessDescriptor as vn } from "./workflowAccess.js";
+import { compareSurfaces as yn, groupShapeDigests as bn, procedureShapeDigest as xn, schemaShape as Sn, shapeDigest as Cn } from "./schemaShape.js";
+import { parseRevalidateMs as wn } from "./revalidate.js";
+import { ApiUnavailable as Tn, isApiUnavailable as En } from "./serviceCall.js";
+import { API_WORKLOADS as Dn, checkFrameworkCompat as On, composeReplayAuthorityBindings as kn, composeRpcInterceptors as An, definePlugin as jn, definePluginRoute as Mn, definePluginService as Nn, pluginInstanceName as Pn } from "./plugin.js";
+import { PluginPrivacyErasePhaseSchema as Fn, PluginPrivacyFailure as In, createPluginPrivacyRegistry as Ln } from "./pluginPrivacy.js";
+import { PluginAccountMergeFailure as Rn, createPluginAccountMergeRegistry as zn } from "./pluginAccountMerge.js";
+import { validateHttpStreamMaxDuration as Bn } from "./httpStreamMaxDuration.js";
+import { validateOutboxHandlerDefinition as Vn } from "./outbox.js";
+import { pluginAlias as Hn, pluginSlug as Un, pluginTag as Wn, registerPluginAliases as Gn, resetPluginAliases as Kn } from "./pluginNaming.js";
+import { publishServerError as qn, subscribeServerErrors as Jn, withheldServerError as Yn } from "./serverErrorBus.js";
+import { WorkflowStartTerminalOutcomeSchema as Xn } from "./workflowStartOutcome.js";
+import { WorkflowControlInputSchema as Zn, WorkflowControlIntentSchema as Qn, WorkflowControlReadInputSchema as $n, WorkflowControlResultSchema as er, WorkflowDomainEventRowSchema as tr, WorkflowDomainEventsInputSchema as nr, WorkflowEventDeliveriesInputSchema as rr, WorkflowEventDeliveryRowSchema as ir, WorkflowParentClosePolicySchema as ar, WorkflowQueuedCancelInputSchema as or, WorkflowQueuedCancellationResultSchema as sr, WorkflowQueuedControlTargetSchema as cr, WorkflowRunEventRowSchema as lr, WorkflowRunHandleSchema as ur, WorkflowRunRefSchema as dr, WorkflowRunRowSchema as fr, WorkflowRunSnapshotSchema as pr, WorkflowRunStatusSchema as mr, WorkflowRunStepRowSchema as hr, WorkflowRunTableRefSchema as gr, WorkflowRunsInputSchema as _r, WorkflowSignalInputSchema as vr, WorkflowStartDeferralSchema as yr, WorkflowUpdateInputSchema as br, WorkflowUpdateResultSchema as xr, workflowCancelDescriptor as Sr, workflowControlQueryDescriptor as Cr, workflowDomainEventsQueryDescriptor as wr, workflowEventDeliveriesQueryDescriptor as Tr, workflowQueuedCancelDescriptor as Er, workflowQueuedControlQueryDescriptor as Dr, workflowResumeDescriptor as Or, workflowRunEventsQueryDescriptor as kr, workflowRunQueryDescriptor as Ar, workflowRunStepsQueryDescriptor as jr, workflowRunsQueryDescriptor as Mr, workflowSignalDescriptor as Nr, workflowToRpc as Pr, workflowUpdateDescriptor as Fr } from "./workflow.js";
+import { WorkflowRetryCommandSchema as Ir, WorkflowRetryObservationSchema as Lr, WorkflowRetryTargetSchema as Rr } from "./workflowRetry.js";
+import { WorkflowRestartCommandSchema as zr, WorkflowRestartObservationSchema as Br, WorkflowRestartResultSchema as Vr, WorkflowRestartSelectionSchema as Hr, WorkflowRestartTargetSchema as Ur } from "./workflowRestart.js";
+import { UNDO_APPLY_TAG as Wr, UNDO_LOG_TAG as Gr, UNDO_REDO_TAG as Kr, UndoConflict as qr, UndoForbidden as Jr, UndoLogEntry as Yr, UndoNotFound as Xr, undoApplyDescriptor as Zr, undoLogQueryDescriptor as Qr, undoRedoDescriptor as $r } from "./undo.js";
+import { ssrfReason as ei } from "./ssrfPolicy.js";
+import { ConstraintViolation as ti, NoRowFound as ni, ServerOnlyColumnWrite as ri, StoreOperationFailed as ii, TableValidationFailed as ai, TenantRowNotFound as oi, TenantScopeViolation as si } from "./storeErrors.js";
+import { APPROVALS_DECIDE_TAG as ci, APPROVALS_PENDING_TAG as li, approvalsDecideDescriptor as ui, approvalsPendingQueryDescriptor as di } from "./approvalDescriptors.js";
+import { CONNECTIONS_LIST_TAG as fi, CONNECTION_DISCONNECT_TAG as pi, CONNECTION_START_TAG as mi, CONNECTION_SUBMIT_TOKEN_TAG as hi, ConnectionHandshakeFailed as gi, ConnectionKind as _i, ConnectionKindMismatch as vi, ConnectionNotDeclared as yi, ConnectionState as bi, ConnectionStatus as xi, ConnectionSubjectRequired as Si, connectionDisconnectDescriptor as Ci, connectionStartDescriptor as wi, connectionSubmitTokenDescriptor as Ti, connectionsListQueryDescriptor as Ei } from "./connection.js";
+import { tsMs as Di } from "./time.js";
+import { STORE_SCREENSHOT_PRESETS as Oi, STORE_SCREENSHOT_PRESET_NAMES as ki, STORE_SCREENSHOT_STORES as Ai, storeScreenshotPixels as ji, storeScreenshotPreset as Mi, storeScreenshotPresetsFor as Ni } from "./storeScreenshots.js";
+import { GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE as Pi, defineWebSocket as Fi } from "./webSocketGateway.js";
+import { SESSION_HEADER_NAME as Ii, sessionValueFromHeaders as Li } from "./sessionHeader.js";
+import { JSONAPI_MEDIA_TYPE as Ri, PROBLEM_JSON as zi, REST_PROFILE_NAMES as Bi, encodeRestError as Vi, encodeRestSuccess as Hi, nextLink as Ui, problemDetails as Wi, problemTypeOf as Gi, resolveRestFormat as Ki, restViewSchema as qi, toSnakeCase as Ji } from "./restFormat.js";
+import { finiteNumberView as Yi, jsonSchemaDocumentOf as Xi, jsonSchemaOf as Zi, plainJsonSchema as Qi } from "./jsonSchema.js";
+import { PAIRING_HOST as $i, PAIRING_SCHEME as ea, PAIRING_STORAGE_KEY as ta, applyPairing as na, clearPairing as ra, pairingLink as ia, parsePairingLink as aa, readPairing as oa } from "./pairing.js";
+import { apiRoleEndpointUrl as sa, apiRoleProxyBasePath as ca, captureApiRoleEndpoints as la, selectApiRoleEndpoint as ua } from "./apiRoleEndpoints.js";
+import { ApiRoleObservationSchema as da } from "./apiRoleObservation.js";
+import { StorageAccessPolicySchema as fa, StorageAccessRuleSchema as pa } from "./storageAccess.js";
+import { BoundedRing as ma } from "./boundedRing.js";
+import { FORM_CAPTURE_FIELD as ha, FORM_CAPTURE_META_NAME as ga, encodeNativeFormCapture as _a, formCaptureSource as va, readFormCaptureSource as ya } from "./formCapture.js";
 //#region src/index.ts
-var Hi = 2;
+var ba = 2;
 //#endregion
-export { G as ADMIN_SCOPE, K as APIKEY_ISSUE_ORG_SCOPE, q as APIKEY_ISSUE_OTHER_SCOPE, J as APIKEY_ISSUE_SELF_SCOPE, Br as APPROVALS_DECIDE_TAG, Vr as APPROVALS_PENDING_TAG, fn as ApiUnavailable, We as ApprovalDecisionErrors, Ge as ApprovalErrors, Ke as ApprovalExpired, qe as ApprovalForbidden, Je as ApprovalNotFound, Ye as ApprovalNotPending, Xe as ApprovalRejected, Ze as ApprovalRequired, Qe as ApprovalSelfApproval, $e as ApprovalUnavailable, h as AuthMiddleware, Vi as BoundedRing, De as BusinessRuleViolation, Wr as CONNECTIONS_LIST_TAG, Gr as CONNECTION_DISCONNECT_TAG, Kr as CONNECTION_START_TAG, qr as CONNECTION_SUBMIT_TOKEN_TAG, Jr as ConnectionHandshakeFailed, g as ConnectionInfo, _ as ConnectionInfoMiddleware, Yr as ConnectionKind, Xr as ConnectionKindMismatch, Zr as ConnectionNotDeclared, Qr as ConnectionState, $r as ConnectionStatus, ei as ConnectionSubjectRequired, Nr as ConstraintViolation, Oe as DEFAULT_IN_FLIGHT_LEASE_MS, v as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, y as DEFAULT_SCOPE_CACHE_TTL_MS, Y as DEVICES_MANAGE_SCOPE, en as DEV_ACTIVITY_EVENT, It as EVENT_ROUTE_SEP, Lt as EventKeyInvalid, Rt as EventPayloadInvalid, zt as EventPayloadTooLarge, ut as FRAMEWORK_WIRE_ERRORS, fi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, b as IMPERSONATION_METADATA_KEY, gi as JSONAPI_MEDIA_TYPE, Bt as MAX_EVENT_ENVELOPE_BYTES, ke as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, Ae as MutationConnectionRequired, je as MutationInFlight, Pr as NoRowFound, X as NoSuchResource, ji as PAIRING_HOST, Mi as PAIRING_SCHEME, Ni as PAIRING_STORAGE_KEY, _i as PROBLEM_JSON, Hi as PROTOCOL_VERSION, et as PendingApproval, tt as REACTIVITY_CHANNEL_PREFIX, vi as REST_PROFILE_NAMES, d as RequestedTenantRefused, dt as SERVICE_NAME_PATTERN, mi as SESSION_HEADER_NAME, oi as STORE_SCREENSHOT_PRESETS, si as STORE_SCREENSHOT_PRESET_NAMES, ci as STORE_SCREENSHOT_STORES, Z as ScopeError, Fr as ServerOnlyColumnWrite, zi as StorageAccessPolicySchema, Bi as StorageAccessRuleSchema, Ir as StoreOperationFailed, x as Subject, S as SubjectIdentity, C as SubjectService, Lr as TableValidationFailed, Rr as TenantRowNotFound, zr as TenantScopeViolation, f as TenantSelectionRefused, Cr as UNDO_APPLY_TAG, wr as UNDO_LOG_TAG, Tr as UNDO_REDO_TAG, w as Unauthenticated, Er as UndoConflict, Dr as UndoForbidden, Or as UndoLogEntry, kr as UndoNotFound, Be as ValidationError, Ve as ValidationErrors, He as ValidationIssue, tn as WorkflowAccessProperty, An as WorkflowControlInputSchema, jn as WorkflowControlIntentSchema, Mn as WorkflowControlReadInputSchema, Nn as WorkflowControlResultSchema, Pn as WorkflowDomainEventRowSchema, Fn as WorkflowDomainEventsInputSchema, In as WorkflowEventDeliveriesInputSchema, Ln as WorkflowEventDeliveryRowSchema, Rn as WorkflowParentClosePolicySchema, zn as WorkflowQueuedCancelInputSchema, Bn as WorkflowQueuedCancellationResultSchema, Vn as WorkflowQueuedControlTargetSchema, vr as WorkflowRestartCommandSchema, yr as WorkflowRestartObservationSchema, br as WorkflowRestartResultSchema, xr as WorkflowRestartSelectionSchema, Sr as WorkflowRestartTargetSchema, hr as WorkflowRetryCommandSchema, gr as WorkflowRetryObservationSchema, _r as WorkflowRetryTargetSchema, Hn as WorkflowRunEventRowSchema, Un as WorkflowRunHandleSchema, Wn as WorkflowRunRefSchema, Gn as WorkflowRunRowSchema, Kn as WorkflowRunSnapshotSchema, qn as WorkflowRunStatusSchema, Jn as WorkflowRunStepRowSchema, Yn as WorkflowRunTableRefSchema, Xn as WorkflowRunsInputSchema, Zn as WorkflowSignalInputSchema, Qn as WorkflowStartDeferralSchema, kn as WorkflowStartTerminalOutcomeSchema, $n as WorkflowUpdateInputSchema, er as WorkflowUpdateResultSchema, ft as actionToRpc, Q as advisoryResourceGuardWarning, T as anonymousSubject, Pi as applyPairing, e as applyRowPatch, E as applyScopeDecision, Hr as approvalsDecideDescriptor, Ur as approvalsPendingQueryDescriptor, D as assertAuthenticated, nn as attachWorkflowAccess, Me as beginIdempotent, O as bindSubjectAuthority, mn as checkFrameworkCompat, $ as checkGuards, ee as checkGuardsEffect, Fi as clearPairing, sn as compareSurfaces, k as composeAuthStrategies, hn as composeRpcInterceptors, ti as connectionDisconnectDescriptor, ni as connectionStartDescriptor, ri as connectionSubmitTokenDescriptor, ii as connectionsListQueryDescriptor, t as createRowPatchApplier, A as currentSubjectAuthority, nt as declaredReactivityChannelKeys, te as declaresResourceGuard, pt as defineAction, Vt as defineEvent, mt as defineMutation, gn as definePlugin, _n as definePluginRoute, vn as definePluginService, ht as defineQuery, gt as defineStream, pi as defineWebSocket, n as diffRows, ne as effectiveScopes, Ht as encodeEventKey, yi as encodeRestError, bi as encodeRestSuccess, Nt as errorMessage, Pt as errorTag, Ut as eventAttached, Wt as eventEnvelope, Gt as eventGap, Kt as eventResumePoint, qt as eventRoute, Jt as eventStreamEvent, Yt as eventSubscribeInput, Xt as eventToRpc, Ne as failIdempotent, Ue as fieldIssuesOf, re as findAdvisoryResourceGuards, Pe as finishIdempotent, Di as finiteNumberView, l as firstEventValue, Zt as formatEventRoute, Fe as freshFor, ie as getPolicyGuardResolver, ae as getResourceScopeResolver, rn as getWorkflowAccess, cn as groupShapeDigests, _t as hasAccessDecision, j as hasCallbackRoutes, oe as hasEffectiveScope, vt as hasEnforcedGuard, se as hasScope, Ie as holdIdempotentClaim, r as idToPath, Le as idempotencyScope, Te as inputLabel, pn as isApiUnavailable, ce as isAuthenticatedCheck, yt as isAuthenticatedGuard, bt as isClientReachable, Qt as isEventDescriptor, i as isIdKeyed, M as isMachineSubject, le as isOpenAccess, ue as isPolicyCheck, xt as isPolicyGuard, rt as isReactivityChannel, it as isReactivityChannelKey, de as isServiceAccess, St as isServiceReachable, N as isServiceSubject, P as isSystemSubject, p as isTenantSelectable, Ct as isWireReachable, Oi as jsonSchemaDocumentOf, ki as jsonSchemaOf, F as makeScopeCache, Re as memoryIdempotencyStore, fe as missingAccessDecision, wt as mutationToRpc, xi as nextLink, Tt as normalizeDescriptor, at as normalizeSource, pe as openAccessSpec, I as orderByBearerPrefix, Ii as pairingLink, $t as parseEventRoute, Li as parsePairingLink, a as patchCellSchema, o as pathToId, Ai as plainJsonSchema, xn as pluginAlias, yn as pluginInstanceName, Sn as pluginSlug, Cn as pluginTag, Si as problemDetails, Ci as problemTypeOf, ln as procedureShapeDigest, ot as publishReactivity, En as publishServerError, Et as queryToRpc, L as rawImpersonationMark, st as reactivityChannel, Ri as readPairing, R as reauthorizeSubject, me as recheckGuardsEffect, he as refreshEffectiveScopes, wn as registerPluginAliases, Ft as reportableError, ge as requireScope, Tn as resetPluginAliases, _e as resolvePolicyAction, wi as resolveRestFormat, an as resolveWorkflowAccess, Ti as restViewSchema, s as rowPatchOpSchema, c as rowPatchSchema, un as schemaShape, z as scopeCacheKey, m as selectSubjectTenant, ve as serviceAccessSpec, ye as serviceCallersOf, B as serviceSubject, hi as sessionValueFromHeaders, be as setEffectiveScopes, xe as setEffectiveScopesRefresher, Se as setPolicyGuardResolver, Ce as setResourceScopeResolver, dn as shapeDigest, ct as sourceKeys, li as storeScreenshotPixels, ui as storeScreenshotPreset, di as storeScreenshotPresetsFor, Dt as streamToRpc, Ee as strictInput, V as subjectAuditActorId, H as subjectIdentity, we as subjectScopes, Dn as subscribeServerErrors, u as subscriptionEvent, U as systemSubject, W as tenantScopedSubject, Ot as toRpc, Ei as toSnakeCase, ai as tsMs, lt as undeclaredChannelKeys, Ar as undoApplyDescriptor, jr as undoLogQueryDescriptor, Mr as undoRedoDescriptor, bn as validateOutboxHandlerDefinition, kt as wireAudienceOf, At as wireErrorUnion, jt as withRpcTag, On as withheldServerError, on as workflowAccessDescriptor, tr as workflowCancelDescriptor, nr as workflowControlQueryDescriptor, rr as workflowDomainEventsQueryDescriptor, ir as workflowEventDeliveriesQueryDescriptor, ar as workflowQueuedCancelDescriptor, or as workflowQueuedControlQueryDescriptor, sr as workflowResumeDescriptor, cr as workflowRunEventsQueryDescriptor, lr as workflowRunQueryDescriptor, ur as workflowRunStepsQueryDescriptor, dr as workflowRunsQueryDescriptor, fr as workflowSignalDescriptor, pr as workflowToRpc, mr as workflowUpdateDescriptor, Mt as workflowWireErrorUnion, ze as wsMutationIdempotencyScope };
+export { K as ADMIN_SCOPE, q as APIKEY_ISSUE_ORG_SCOPE, J as APIKEY_ISSUE_OTHER_SCOPE, Y as APIKEY_ISSUE_SELF_SCOPE, Dn as API_WORKLOADS, ci as APPROVALS_DECIDE_TAG, li as APPROVALS_PENDING_TAG, da as ApiRoleObservationSchema, Tn as ApiUnavailable, Je as ApprovalDecisionErrors, Ye as ApprovalErrors, Xe as ApprovalExpired, Ze as ApprovalForbidden, Qe as ApprovalNotFound, $e as ApprovalNotPending, et as ApprovalRejected, tt as ApprovalRequired, nt as ApprovalSelfApproval, rt as ApprovalUnavailable, h as AuthMiddleware, ma as BoundedRing, Ae as BusinessRuleViolation, fi as CONNECTIONS_LIST_TAG, pi as CONNECTION_DISCONNECT_TAG, mi as CONNECTION_START_TAG, hi as CONNECTION_SUBMIT_TOKEN_TAG, gi as ConnectionHandshakeFailed, g as ConnectionInfo, _ as ConnectionInfoMiddleware, _i as ConnectionKind, vi as ConnectionKindMismatch, yi as ConnectionNotDeclared, bi as ConnectionState, xi as ConnectionStatus, Si as ConnectionSubjectRequired, ti as ConstraintViolation, je as DEFAULT_IN_FLIGHT_LEASE_MS, v as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, y as DEFAULT_SCOPE_CACHE_TTL_MS, X as DEVICES_MANAGE_SCOPE, pn as DEV_ACTIVITY_EVENT, qt as EVENT_ROUTE_SEP, Jt as EventKeyInvalid, Yt as EventPayloadInvalid, Xt as EventPayloadTooLarge, Zt as EventRpcWorkload, ha as FORM_CAPTURE_FIELD, ga as FORM_CAPTURE_META_NAME, ht as FRAMEWORK_WIRE_ERRORS, Pi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, b as IMPERSONATION_METADATA_KEY, Ri as JSONAPI_MEDIA_TYPE, Qt as MAX_EVENT_ENVELOPE_BYTES, Me as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, Ne as MutationConnectionRequired, Pe as MutationIdempotencyRefused, Fe as MutationInFlight, ni as NoRowFound, Z as NoSuchResource, $i as PAIRING_HOST, ea as PAIRING_SCHEME, ta as PAIRING_STORAGE_KEY, zi as PROBLEM_JSON, ba as PROTOCOL_VERSION, it as PendingApproval, Rn as PluginAccountMergeFailure, Fn as PluginPrivacyErasePhaseSchema, In as PluginPrivacyFailure, at as REACTIVITY_CHANNEL_PREFIX, Bi as REST_PROFILE_NAMES, d as RequestedTenantRefused, gt as SERVICE_NAME_PATTERN, Ii as SESSION_HEADER_NAME, Oi as STORE_SCREENSHOT_PRESETS, ki as STORE_SCREENSHOT_PRESET_NAMES, Ai as STORE_SCREENSHOT_STORES, Q as ScopeError, ri as ServerOnlyColumnWrite, fa as StorageAccessPolicySchema, pa as StorageAccessRuleSchema, ii as StoreOperationFailed, x as Subject, S as SubjectIdentity, C as SubjectService, ai as TableValidationFailed, oi as TenantRowNotFound, si as TenantScopeViolation, f as TenantSelectionRefused, Wr as UNDO_APPLY_TAG, Gr as UNDO_LOG_TAG, Kr as UNDO_REDO_TAG, w as Unauthenticated, qr as UndoConflict, Jr as UndoForbidden, Yr as UndoLogEntry, Xr as UndoNotFound, We as ValidationError, Ge as ValidationErrors, Ke as ValidationIssue, mn as WorkflowAccessProperty, Zn as WorkflowControlInputSchema, Qn as WorkflowControlIntentSchema, $n as WorkflowControlReadInputSchema, er as WorkflowControlResultSchema, tr as WorkflowDomainEventRowSchema, nr as WorkflowDomainEventsInputSchema, rr as WorkflowEventDeliveriesInputSchema, ir as WorkflowEventDeliveryRowSchema, ar as WorkflowParentClosePolicySchema, or as WorkflowQueuedCancelInputSchema, sr as WorkflowQueuedCancellationResultSchema, cr as WorkflowQueuedControlTargetSchema, zr as WorkflowRestartCommandSchema, Br as WorkflowRestartObservationSchema, Vr as WorkflowRestartResultSchema, Hr as WorkflowRestartSelectionSchema, Ur as WorkflowRestartTargetSchema, Ir as WorkflowRetryCommandSchema, Lr as WorkflowRetryObservationSchema, Rr as WorkflowRetryTargetSchema, lr as WorkflowRunEventRowSchema, ur as WorkflowRunHandleSchema, dr as WorkflowRunRefSchema, fr as WorkflowRunRowSchema, pr as WorkflowRunSnapshotSchema, mr as WorkflowRunStatusSchema, hr as WorkflowRunStepRowSchema, gr as WorkflowRunTableRefSchema, _r as WorkflowRunsInputSchema, vr as WorkflowSignalInputSchema, yr as WorkflowStartDeferralSchema, Xn as WorkflowStartTerminalOutcomeSchema, br as WorkflowUpdateInputSchema, xr as WorkflowUpdateResultSchema, _t as actionToRpc, $ as advisoryResourceGuardWarning, T as anonymousSubject, sa as apiRoleEndpointUrl, ca as apiRoleProxyBasePath, na as applyPairing, e as applyRowPatch, E as applyScopeDecision, ui as approvalsDecideDescriptor, di as approvalsPendingQueryDescriptor, D as assertAuthenticated, hn as attachWorkflowAccess, Ie as beginIdempotent, O as bindSubjectAuthority, Gt as canonicalJson, la as captureApiRoleEndpoints, mt as captureOptionalQuerySources, On as checkFrameworkCompat, ee as checkGuards, te as checkGuardsEffect, ra as clearPairing, yn as compareSurfaces, k as composeAuthStrategies, kn as composeReplayAuthorityBindings, An as composeRpcInterceptors, Ci as connectionDisconnectDescriptor, wi as connectionStartDescriptor, Ti as connectionSubmitTokenDescriptor, Ei as connectionsListQueryDescriptor, zn as createPluginAccountMergeRegistry, Ln as createPluginPrivacyRegistry, t as createRowPatchApplier, A as currentSubjectAuthority, Ut as declaredErrorTags, ot as declaredReactivityChannelKeys, ne as declaresResourceGuard, vt as defineAction, $t as defineEvent, yt as defineMutation, jn as definePlugin, Mn as definePluginRoute, Nn as definePluginService, bt as defineQuery, xt as defineStream, Fi as defineWebSocket, n as diffRows, re as effectiveScopes, en as encodeEventKey, _a as encodeNativeFormCapture, Vi as encodeRestError, Hi as encodeRestSuccess, Wt as errorMemberSchema, Bt as errorMessage, Vt as errorTag, tn as eventAttached, nn as eventEnvelope, rn as eventGap, an as eventResumePoint, on as eventRoute, sn as eventStreamEvent, cn as eventSubscribeInput, ln as eventToRpc, Le as failIdempotent, qe as fieldIssuesOf, ie as findAdvisoryResourceGuards, Re as finishIdempotent, Yi as finiteNumberView, l as firstEventValue, va as formCaptureSource, un as formatEventRoute, ze as freshFor, ae as getPolicyGuardResolver, oe as getResourceScopeResolver, gn as getWorkflowAccess, bn as groupShapeDigests, St as hasAccessDecision, j as hasCallbackRoutes, se as hasEffectiveScope, Ct as hasEnforcedGuard, ce as hasScope, Be as holdIdempotentClaim, r as idToPath, Ve as idempotencyScope, Oe as inputLabel, En as isApiUnavailable, le as isAuthenticatedCheck, wt as isAuthenticatedGuard, Tt as isClientReachable, dn as isEventDescriptor, i as isIdKeyed, M as isMachineSubject, ue as isOpenAccess, de as isPolicyCheck, Et as isPolicyGuard, st as isReactivityChannel, ct as isReactivityChannelKey, fe as isServiceAccess, Dt as isServiceReachable, N as isServiceSubject, P as isSystemSubject, p as isTenantSelectable, pe as isUpgradedCheck, Ot as isUpgradedGuard, kt as isWireReachable, Xi as jsonSchemaDocumentOf, Zi as jsonSchemaOf, F as makeScopeCache, He as memoryIdempotencyStore, me as missingAccessDecision, At as mutationToRpc, Ui as nextLink, jt as normalizeDescriptor, lt as normalizeSource, he as openAccessSpec, I as orderByBearerPrefix, ia as pairingLink, fn as parseEventRoute, aa as parsePairingLink, wn as parseRevalidateMs, a as patchCellSchema, o as pathToId, Qi as plainJsonSchema, Hn as pluginAlias, Pn as pluginInstanceName, Un as pluginSlug, Wn as pluginTag, Kt as prepareIdempotentInput, Wi as problemDetails, Gi as problemTypeOf, xn as procedureShapeDigest, ut as publishReactivity, qn as publishServerError, Mt as queryToRpc, L as rawImpersonationMark, dt as reactivityChannel, ya as readFormCaptureSource, oa as readPairing, R as reauthorizeSubject, ge as recheckGuardsEffect, _e as refreshEffectiveScopes, Gn as registerPluginAliases, Ht as reportableError, ve as requireScope, Nt as requireUpgraded, Kn as resetPluginAliases, z as resolveIdentityAuthority, ye as resolvePolicyAction, Ki as resolveRestFormat, _n as resolveWorkflowAccess, qi as restViewSchema, s as rowPatchOpSchema, c as rowPatchSchema, Sn as schemaShape, B as scopeCacheKey, ua as selectApiRoleEndpoint, m as selectSubjectTenant, be as serviceAccessSpec, xe as serviceCallersOf, V as serviceSubject, Li as sessionValueFromHeaders, Se as setEffectiveScopes, Ce as setEffectiveScopesRefresher, we as setPolicyGuardResolver, Te as setResourceScopeResolver, Cn as shapeDigest, ft as sourceKeys, ei as ssrfReason, ji as storeScreenshotPixels, Mi as storeScreenshotPreset, Ni as storeScreenshotPresetsFor, Pt as streamToRpc, ke as strictInput, H as subjectAuditActorId, U as subjectIdentity, Ee as subjectScopes, Jn as subscribeServerErrors, u as subscriptionEvent, W as systemSubject, G as tenantScopedSubject, Ft as toRpc, Ji as toSnakeCase, Di as tsMs, pt as undeclaredChannelKeys, Zr as undoApplyDescriptor, Qr as undoLogQueryDescriptor, $r as undoRedoDescriptor, De as upgradedGuardShapeError, Bn as validateHttpStreamMaxDuration, Vn as validateOutboxHandlerDefinition, It as wireAudienceOf, Lt as wireErrorUnion, Rt as withRpcTag, Yn as withheldServerError, vn as workflowAccessDescriptor, Sr as workflowCancelDescriptor, Cr as workflowControlQueryDescriptor, wr as workflowDomainEventsQueryDescriptor, Tr as workflowEventDeliveriesQueryDescriptor, Er as workflowQueuedCancelDescriptor, Dr as workflowQueuedControlQueryDescriptor, Or as workflowResumeDescriptor, kr as workflowRunEventsQueryDescriptor, Ar as workflowRunQueryDescriptor, jr as workflowRunStepsQueryDescriptor, Mr as workflowRunsQueryDescriptor, Nr as workflowSignalDescriptor, Pr as workflowToRpc, Fr as workflowUpdateDescriptor, zt as workflowWireErrorUnion, Ue as wsMutationIdempotencyScope };

package/dist/inspect.d.ts

@@ -162,7 +162,7 @@ export declare class InvalidReplicaSelection extends Error {
 
 export declare const isInspectCommandRejection: <I>(input: I) => input is I & {
     readonly kind: "rejected";
-    readonly status: 400 | 401 | 403 | 404;
+    readonly status: 400 | 404 | 401 | 403;
     readonly message: string;
 };
 

package/dist/jwt.d.ts

@@ -48,6 +48,13 @@ declare interface AuthStrategy {
 declare interface AuthStrategyInput {
     readonly headers: Readonly<Record<string, string | undefined>>;
     readonly clientId: number;
+    /** HTTP request target, supplied by REST transports. Request selectors may
+     * read an explicit tenant hint here; it is never authentication or authority.
+     * Absent for connection transports and non-HTTP callers. */
+    readonly http?: {
+        readonly path: string;
+        readonly query: string;
+    };
     /**
      * The app's DataStore, for a strategy that must READ to identify the caller.
      *
@@ -291,6 +298,9 @@ declare type StrategyResolution = {
 
 declare const Subject: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"user">;
+    /** A guest has a stable identity but has not linked a registered account.
+     * This identity mark survives session signing; it never grants authority. */
+    readonly kind: Schema.optional<Schema.Literal<"guest">>;
     readonly id: Schema.String;
     readonly tenantId: Schema.String;
     readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;

package/dist/jwt.js

@@ -77,7 +77,7 @@ var i = 36e5, a = /* @__PURE__ */ new Map(), o = (e, n) => {
 	if (e instanceof n.JWSInvalid || e instanceof n.JWTInvalid) return new c("malformed jwt", "malformed");
 	if (e instanceof n.JOSEAlgNotAllowed) return new c("jwt algorithm not allowed", "unsupported_algorithm");
 	let t = e?.message ?? String(e);
-	return /fetch|network|enotfound|econnrefused/i.test(t) ? new c(`jwks unreachable: ${t}`, "jwks_unreachable") : new c(`jwt verify failed: ${t}`, "other");
+	return e instanceof n.JWKSTimeout || /fetch|network|enotfound|econnrefused|JSON Web Key Set/i.test(t) ? new c(`jwks unreachable: ${t}`, "jwks_unreachable") : new c(`jwt verify failed: ${t}`, "other");
 }, v = (t, n, r) => {
 	let i = t.authorization ?? t.Authorization;
 	if (i?.startsWith("Bearer ")) {

package/dist/plugin.js

@@ -1,19 +1,34 @@
 import { Context as e, Layer as t } from "effect";
 //#region src/plugin.ts
-var n = (e) => e, r = (e) => e, i = (e) => {
+var n = Object.freeze([
+	"rpc",
+	"subscriptions",
+	"events",
+	"presence",
+	"workflows",
+	"schedules",
+	"directors",
+	"drainers",
+	"reapers",
+	"retention",
+	"rest",
+	"webhooks",
+	"inspect",
+	"cdc"
+]), r = (e) => e, i = (e) => e, a = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, a = (e) => {
+}, o = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, o = (n, r) => {
+}, s = (n, r) => {
 	let i = e.Service(n);
 	return {
 		Tag: i,
 		Live: t.succeed(i, r)
 	};
-}, s = (e, t, n) => {
+}, c = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : c(n);
+	let r = n === void 0 ? null : l(n);
 	if (!r) return {
 		ok: !0,
 		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
@@ -21,12 +36,12 @@ var n = (e) => e, r = (e) => e, i = (e) => {
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/);
-	for (let i of a) if (!u(i, r)) return {
+	for (let i of a) if (!d(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, c = (e) => {
+}, l = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -34,28 +49,39 @@ var n = (e) => e, r = (e) => e, i = (e) => {
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, l = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, u = (e, t) => {
+}, u = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, d = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = c(e.slice(1));
-		return !n || t.major !== n.major ? !1 : l(t, n) >= 0;
+		let n = l(e.slice(1));
+		return !n || t.major !== n.major ? !1 : u(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = c(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : l(t, n) >= 0;
+		let n = l(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : u(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = c(n[2]);
+		let e = n[1], r = l(n[2]);
 		if (!r) return !1;
-		let i = l(t, r);
+		let i = u(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = c(e);
-	return r ? l(t, r) === 0 : !1;
+	let r = l(e);
+	return r ? u(t, r) === 0 : !1;
+}, f = (e) => {
+	let t = e.flatMap((e) => e.bindReplayAuthority === void 0 ? [] : [e.bindReplayAuthority]);
+	if (t.length !== 0) {
+		if (t.some((e) => typeof e != "function")) throw Error("Invalid replay authority binding");
+		return (e) => {
+			for (let n of t) {
+				let t = n(e);
+				if (t !== void 0) throw t instanceof Promise && t.catch(() => void 0), Error("Replay authority bindings must complete synchronously");
+			}
+		};
+	}
 };
 //#endregion
-export { s as checkFrameworkCompat, a as composeRpcInterceptors, n as definePlugin, r as definePluginRoute, o as definePluginService, i as pluginInstanceName };
+export { n as API_WORKLOADS, c as checkFrameworkCompat, f as composeReplayAuthorityBindings, o as composeRpcInterceptors, r as definePlugin, i as definePluginRoute, s as definePluginService, a as pluginInstanceName };

package/dist/pluginAccountMerge.js

@@ -0,0 +1,88 @@
+import { Effect as e, Schema as t } from "effect";
+//#region src/pluginAccountMerge.ts
+var n = class extends t.TaggedError()("PluginAccountMergeFailure", {
+	code: t.Literals([
+		"invalid_request",
+		"coverage_missing",
+		"hook_failed"
+	]),
+	requestId: t.String,
+	plugin: t.NullOr(t.String),
+	returned: t.Array(t.String),
+	missing: t.Array(t.String)
+}) {}, r = (e) => typeof e == "object" && e && "tableName" in e && typeof e.tableName == "string" ? e.tableName : void 0, i = (t) => {
+	let i = /* @__PURE__ */ new Set(), a = t.map((e) => {
+		if (i.has(e.name)) throw Error("Duplicate account merge plugin instance: " + e.name);
+		i.add(e.name);
+		let t = e.subjectMerge;
+		if ((t !== void 0 || e.onMergeAccounts !== void 0) && (t === void 0 || e.onMergeAccounts === void 0 || t.kinds.length === 0 || t.kinds.some((e) => e !== "user" && e !== "guest") || new Set(t.kinds).size !== t.kinds.length || t.tables.some((e) => typeof e != "string" || !e.trim()) || new Set(t.tables).size !== t.tables.length)) throw Error("Account merge requires a valid declaration and hook: " + e.name);
+		return {
+			name: e.name,
+			tables: (e.extendSchema?.tables ?? []).map(r),
+			declaration: t === void 0 ? void 0 : {
+				tables: [...t.tables],
+				kinds: [...t.kinds]
+			},
+			hook: e.onMergeAccounts
+		};
+	}), o = (e) => {
+		let t = [], n = [];
+		for (let r of a) if (r.declaration?.kinds.includes(e) && r.hook) {
+			t.push({
+				name: r.name,
+				tables: Object.freeze([...r.declaration.tables])
+			});
+			for (let e of r.tables) (e === void 0 || !r.declaration.tables.includes(e)) && n.push(r.name);
+		} else (r.tables.length > 0 || r.declaration !== void 0) && n.push(r.name);
+		return {
+			participants: Object.freeze(t),
+			missing: Object.freeze([...new Set(n)])
+		};
+	};
+	return {
+		coverage: o,
+		mergeInTransaction: (t) => e.gen(function* () {
+			if (![
+				t.requestId,
+				t.tenantId,
+				t.sourceId,
+				t.targetId
+			].every((e) => typeof e == "string" && e.trim().length > 0 && e.length <= 256) || t.sourceKind !== "user" && t.sourceKind !== "guest" || t.sourceId === t.targetId || t.store === void 0) return yield* e.fail(new n({
+				code: "invalid_request",
+				requestId: typeof t.requestId == "string" ? t.requestId.slice(0, 256) : "",
+				plugin: null,
+				returned: [],
+				missing: []
+			}));
+			let r = o(t.sourceKind);
+			if (r.missing.length > 0) return yield* e.fail(new n({
+				code: "coverage_missing",
+				requestId: t.requestId,
+				plugin: null,
+				returned: [],
+				missing: [...r.missing]
+			}));
+			let i = [], s = Object.freeze({
+				requestId: t.requestId,
+				tenantId: t.tenantId,
+				sourceId: t.sourceId,
+				sourceKind: t.sourceKind,
+				targetId: t.targetId,
+				store: t.store
+			});
+			for (let t of r.participants) {
+				let r = a.find((e) => e.name === t.name);
+				yield* e.suspend(() => r.hook(s)).pipe(e.catchCause(() => e.fail(new n({
+					code: "hook_failed",
+					requestId: s.requestId,
+					plugin: t.name,
+					returned: [...i],
+					missing: []
+				})))), i.push(t.name);
+			}
+			return Object.freeze(i);
+		})
+	};
+};
+//#endregion
+export { n as PluginAccountMergeFailure, i as createPluginAccountMergeRegistry };

package/dist/pluginPrivacy.js

@@ -0,0 +1,166 @@
+import { Effect as e, Schema as t } from "effect";
+//#region src/pluginPrivacy.ts
+var n = t.Literals([
+	"prepare",
+	"data",
+	"identity",
+	"finalize"
+]), r = class extends t.TaggedError()("PluginPrivacyFailure", {
+	code: t.Literals([
+		"invalid_request",
+		"coverage_missing",
+		"hook_failed",
+		"unavailable"
+	]),
+	operation: t.Literals(["export", "erase"]),
+	requestId: t.String,
+	plugin: t.NullOr(t.String),
+	completed: t.Array(t.String),
+	missing: t.Array(t.String)
+}) {}, i = (e) => typeof e == "object" && e && "tableName" in e && typeof e.tableName == "string" ? e.tableName : void 0, a = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = (e) => {
+		if (e === null || typeof e == "string" || typeof e == "boolean" || typeof e == "number" && Number.isFinite(e)) return;
+		if (typeof e != "object" || !e || t.has(e)) throw Error("Invalid privacy JSON");
+		let r = Array.isArray(e), i = Object.getPrototypeOf(e);
+		if (r && i !== Array.prototype || !r && i !== Object.prototype && i !== null || Object.getOwnPropertySymbols(e).length !== 0) throw Error("Invalid privacy JSON");
+		t.add(e);
+		let a = Object.getOwnPropertyDescriptors(e);
+		if (r) {
+			let e = a.length?.value;
+			if (typeof e != "number" || Object.keys(a).length !== e + 1) throw Error("Invalid privacy JSON");
+			for (let t = 0; t < e; t++) {
+				let e = a[t];
+				if (!e || !e.enumerable || !("value" in e)) throw Error("Invalid privacy JSON");
+				n(e.value);
+			}
+		} else for (let e of Object.values(a)) {
+			if (!e.enumerable || !("value" in e)) throw Error("Invalid privacy JSON");
+			n(e.value);
+		}
+		t.delete(e);
+	};
+	return n(e), JSON.parse(JSON.stringify(e));
+}, o = (o) => {
+	let s = /* @__PURE__ */ new Set(), c = o.map((e) => {
+		if (s.has(e.name)) throw Error(`Duplicate privacy plugin instance: ${e.name}`);
+		s.add(e.name);
+		let r = e.subjectPrivacy, a = [...e.extendSchema?.tables ?? []].map(i);
+		if (r !== void 0 || e.onErase !== void 0 || e.onExport !== void 0) {
+			if (r === void 0 || e.onErase === void 0 || e.onExport === void 0) throw Error(`Subject privacy requires a declaration and both hooks: ${e.name}`);
+			if (r.kinds.length === 0 || r.kinds.some((e) => e !== "user" && e !== "guest") || new Set(r.kinds).size !== r.kinds.length || r.tables.some((e) => typeof e != "string" || !e.trim()) || new Set(r.tables).size !== r.tables.length || r.erasePhase !== void 0 && !t.is(n)(r.erasePhase)) throw Error(`Invalid subject privacy declaration: ${e.name}`);
+		}
+		return {
+			name: e.name,
+			tables: a,
+			declaration: r === void 0 ? void 0 : {
+				tables: [...r.tables],
+				kinds: [...r.kinds],
+				erasePhase: r.erasePhase ?? "data"
+			},
+			onErase: e.onErase,
+			onExport: e.onExport
+		};
+	});
+	for (let e of ["user", "guest"]) if (c.filter((t) => t.declaration?.erasePhase === "finalize" && t.declaration.kinds.includes(e)).length > 1) throw Error(`Subject privacy allows one completion owner per kind: ${e}`);
+	let l = (e) => {
+		let t = [], n = [];
+		for (let r of c) {
+			let i = r.declaration;
+			(i === void 0 || i.kinds.includes(e)) && (i !== void 0 && t.push({
+				name: r.name,
+				tables: [...i.tables],
+				erasePhase: i.erasePhase
+			}), r.tables.some((e) => e === void 0 || !i?.tables.includes(e)) && n.push(r.name));
+		}
+		return {
+			participants: t,
+			missing: n
+		};
+	}, u = (t, n) => e.gen(function* () {
+		let i = typeof t?.requestId == "string" ? t.requestId : "", a = t?.target;
+		if (!i.trim() || typeof a?.subjectId != "string" || !a.subjectId.trim() || !(a.tenantId === null || typeof a.tenantId == "string" && a.tenantId.trim()) || a.kind !== "user" && a.kind !== "guest") return yield* e.fail(new r({
+			code: "invalid_request",
+			operation: n,
+			requestId: i,
+			plugin: null,
+			completed: [],
+			missing: []
+		}));
+		let o = l(a.kind);
+		return o.missing.length > 0 || o.participants.length === 0 ? yield* e.fail(new r({
+			code: "coverage_missing",
+			operation: n,
+			requestId: i,
+			plugin: null,
+			completed: [],
+			missing: o.missing
+		})) : {
+			requestId: i,
+			target: Object.freeze({
+				subjectId: a.subjectId,
+				tenantId: a.tenantId,
+				kind: a.kind
+			}),
+			context: Object.freeze({
+				requestId: i,
+				tenantId: a.tenantId,
+				kind: a.kind
+			}),
+			participants: o.participants
+		};
+	});
+	return {
+		coverage: l,
+		exportSubject: (t) => e.gen(function* () {
+			let n = yield* u(t, "export"), i = [];
+			for (let t of n.participants) {
+				let o = c.find((e) => e.name === t.name).onExport, s = yield* e.suspend(() => o(n.target.subjectId, n.context)).pipe(e.map(a), e.catchCause(() => e.fail(new r({
+					code: "hook_failed",
+					operation: "export",
+					requestId: n.requestId,
+					plugin: t.name,
+					completed: i.map((e) => e.name),
+					missing: []
+				}))));
+				i.push({
+					name: t.name,
+					data: s
+				});
+			}
+			return {
+				requestId: n.requestId,
+				target: n.target,
+				plugins: i
+			};
+		}),
+		eraseSubject: (t) => e.gen(function* () {
+			let n = yield* u(t, "erase"), i = [], a = [
+				...n.participants.filter((e) => e.erasePhase === "prepare"),
+				...n.participants.filter((e) => e.erasePhase === "data"),
+				...n.participants.filter((e) => e.erasePhase === "identity"),
+				...n.participants.filter((e) => e.erasePhase === "finalize")
+			];
+			for (let t of a) {
+				let a = c.find((e) => e.name === t.name).onErase, o = t.erasePhase === "finalize" ? Object.freeze({
+					...n.context,
+					completed: Object.freeze([...i])
+				}) : n.context;
+				yield* e.suspend(() => a(n.target.subjectId, o)).pipe(e.catchCause(() => e.fail(new r({
+					code: "hook_failed",
+					operation: "erase",
+					requestId: n.requestId,
+					plugin: t.name,
+					completed: [...i],
+					missing: []
+				})))), i.push(t.name);
+			}
+			return {
+				requestId: n.requestId,
+				target: n.target,
+				completed: i
+			};
+		})
+	};
+};
+//#endregion
+export { n as PluginPrivacyErasePhaseSchema, r as PluginPrivacyFailure, o as createPluginPrivacyRegistry };