@voltro/protocol 0.86.0 → 0.88.0

package/dist/session.js

@@ -1,100 +1,101 @@
 import { SubjectIdentity as e, subjectIdentity as t } from "./auth.js";
 import { subjectScopes as n } from "./scopes.js";
 import { SESSION_HEADER_NAME as r, sessionValueFromHeaders as i } from "./sessionHeader.js";
-import { Schema as a } from "effect";
-import { createHmac as o, timingSafeEqual as s } from "node:crypto";
-import { createLogger as c } from "@voltro/logger";
-//#region src/session.ts
-var l = c({ scope: "@voltro/protocol:session" }), u = 2, d = a.Struct({
-	v: a.Literal(2),
+import { applySecretWindows as a, bearerMatches as o, clearSecretWindows as s, drainSecretActivity as c, noteConfigured as l, noteSigned as u, noteSigningLifetime as d, previousAccepted as f, secretFingerprint as p, setSecretWindow as m } from "./secretWindows.js";
+import { Schema as h } from "effect";
+import { createHmac as g, timingSafeEqual as _ } from "node:crypto";
+import { createLogger as v } from "@voltro/logger";
+// src/session.ts
+var y = v({ scope: "@voltro/protocol:session" }), b = 2, x = h.Struct({
+	v: h.Literal(2),
 	subject: e,
-	exp: a.Number,
-	iat: a.Number,
-	kid: a.optional(a.String)
-}), f = "k0", p = "k-previous", m = () => {
+	exp: h.Number,
+	iat: h.Number,
+	kid: h.optional(h.String)
+}), S = "k0", C = "k-previous", w = () => {
 	throw Error("VOLTRO_SESSION_SECRET is not set. It signs and verifies session cookies, and the framework refuses to invent one at this point: a fixed fallback would be readable by anyone with the source, making every session forgeable. `voltro dev` mints a project-local value into .env.local on boot; for a deployment, generate one with `voltro secret generate session`.");
-}, h = () => process.env.VOLTRO_SESSION_SECRET ?? m(), g = () => v() ?? { current: {
-	kid: _(),
-	secret: h()
-} }, _ = () => process.env.VOLTRO_SESSION_KID ?? "k0", v = () => {
+}, T = () => process.env.VOLTRO_SESSION_SECRET ?? w(), E = () => O() ?? { current: {
+	kid: D(),
+	secret: T()
+} }, D = () => process.env.VOLTRO_SESSION_KID ?? "k0", O = () => {
 	let e = process.env.VOLTRO_SESSION_SECRET;
 	if (e === void 0 || e === "") return;
 	let t = {
-		kid: _(),
+		kid: D(),
 		secret: e
 	}, n = process.env.VOLTRO_SESSION_SECRET_PREVIOUS;
-	return n ? {
+	return l("session", e, n), n && f("session", n) ? {
 		current: t,
 		previous: {
 			kid: process.env.VOLTRO_SESSION_KID_PREVIOUS ?? "k-previous",
 			secret: n
 		}
 	} : { current: t };
-}, y = 32, b = (e = process.env) => {
+}, k = 32, A = (e = process.env) => {
 	let t = e.VOLTRO_SESSION_SECRET;
 	if (t === void 0 || t === "") throw Error("VOLTRO_SESSION_SECRET is not set — refusing to serve. It signs session cookies, and there is no fallback: a built-in one would be readable by anyone with the source. Generate one with `voltro secret generate session`. (`voltro dev` mints a project-local value automatically; a deployment needs its own.)");
 	if (t.length < 32) throw Error(`VOLTRO_SESSION_SECRET is only ${t.length} chars — too short for a session secret (need >= 32). This looks like a placeholder. Generate a real one with \`voltro secret generate session\`.`);
-}, x = a.encodeSync(d), S = a.decodeUnknownSync(d), C = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), w = (e) => {
+}, j = h.encodeSync(x), M = h.decodeUnknownSync(x), N = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), P = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, T = 604800, E = .7, D = (e, t) => C(o("sha256", t).update(e).digest()), O = (e) => typeof e == "string" ? {
+}, F = 604800, I = .7, L = (e, t) => N(g("sha256", t).update(e).digest()), R = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, k = (e, r, i = {}) => {
-	let a = O(r);
+} : e, z = (e, r, i = {}) => {
+	let a = R(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
 	let o = n(e);
 	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
-	let s = i.ttlSeconds ?? T, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
+	let s = i.ttlSeconds ?? F, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
 		subject: t(e),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }
-	}, u = C(JSON.stringify(x(l)));
-	return `${u}.${D(u, a.secret)}`;
-}, A = (e, t, n, r) => {
-	let i = o("sha256", n).update(e).digest(), a = w(t);
-	if (a.length !== i.length || !s(a, i)) return null;
+	}, d = N(JSON.stringify(j(l)));
+	return u("session", a.secret, l.exp * 1e3, c * 1e3), `${d}.${L(d, a.secret)}`;
+}, B = (e, t, n, r) => {
+	let i = g("sha256", n).update(e).digest(), a = P(t);
+	if (a.length !== i.length || !_(a, i)) return null;
 	try {
-		let t = w(e).toString("utf8"), n = S(JSON.parse(t));
+		let t = P(e).toString("utf8"), n = M(JSON.parse(t));
 		return n.exp < Math.floor(r() / 1e3) ? null : n;
 	} catch {
 		return null;
 	}
-}, j = (e, t) => {
+}, V = (e, t) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = A(e.slice(0, n), e.slice(n + 1), t, Date.now);
+	let r = B(e.slice(0, n), e.slice(n + 1), t, Date.now);
 	return r ? r.subject : null;
-}, M = (e, t, n = {}) => {
+}, H = (e, t, n = {}) => {
 	if (!e) return null;
 	let r = e.indexOf(".");
 	if (r <= 0 || r === e.length - 1) return null;
 	let i = e.slice(0, r), a = e.slice(r + 1), o = t.previous ? [t.current, t.previous] : [t.current], s = n.now ?? Date.now;
 	for (let e of o) {
-		if (!e.secret) continue;
-		let t = A(i, a, e.secret, s);
-		if (!t) continue;
-		let r = n.renewFraction ?? E, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
+		if (!e.secret || e === t.previous && !f("session", e.secret, s())) continue;
+		let r = B(i, a, e.secret, s);
+		if (!r) continue;
+		let o = n.renewFraction ?? I, c = Math.floor(s() / 1e3), l = r.exp - r.iat, u = r.iat + l * o;
 		return {
-			subject: t.subject,
-			renew: o >= l,
+			subject: r.subject,
+			renew: c >= u,
 			kid: e.kid,
-			exp: t.exp,
-			iat: t.iat
+			exp: r.exp,
+			iat: r.iat
 		};
 	}
 	return null;
-}, N = (e, t) => {
+}, U = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.from(t, "utf8");
-	return n.length === r.length && s(n, r);
-}, P = (e, t, n) => {
+	return n.length === r.length && _(n, r);
+}, W = (e, t, n) => {
 	if (!t || t.length === 0) return n?.openWhenUnset === !0;
 	let r = e.authorization ?? e.Authorization;
-	return !r || !r.startsWith("Bearer ") ? !1 : N(r.slice(7).trim(), t);
-}, F = (e, t) => {
+	return !r || !r.startsWith("Bearer ") ? !1 : U(r.slice(7).trim(), t);
+}, G = (e, t) => {
 	if (e) for (let n of e.split(";")) {
 		let e = n.indexOf("=");
 		if (e < 0 || n.slice(0, e).trim() !== t) continue;
@@ -106,23 +107,22 @@ var l = c({ scope: "@voltro/protocol:session" }), u = 2, d = a.Struct({
 			return r;
 		}
 	}
-}, I = (e, t, n = {}) => {
+}, K = (e, t, n = {}) => {
 	let r = [`${e}=${encodeURIComponent(t)}`];
 	if (r.push(`Path=${n.path ?? "/"}`), n.maxAgeSeconds !== void 0 && r.push(`Max-Age=${n.maxAgeSeconds}`), r.push("HttpOnly"), n.httpOnly === !1) {
 		let e = r.indexOf("HttpOnly");
 		e >= 0 && r.splice(e, 1);
 	}
 	return r.push(`SameSite=${n.sameSite ?? "Lax"}`), (n.secure ?? !0) && r.push("Secure"), n.domain && r.push(`Domain=${n.domain}`), r.join("; ");
-}, L = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", R = (e, t = L) => i(e, t, F), z = (e) => {
-	let t = i(e, L, F);
+}, q = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", J = (e, t = q) => i(e, t, G), Y = (e) => {
+	let t = i(e, q, G);
 	if (!t) return;
-	let n = v();
-	if (!n) V();
-	else return M(t, n)?.exp;
-}, B = !1, V = () => {
-	B || (B = !0, l.error("a `voltro:session` cookie was presented but VOLTRO_SESSION_SECRET is not set — the session cannot be verified, so no credential-expiry bound is imposed and realtime subscriptions on this connection will not be cut off when the session expires. Set VOLTRO_SESSION_SECRET (`voltro secret generate session`); `voltro dev` mints one, `voltro serve` refuses to boot without one.", { cookieName: L }));
-}, H = () => {
-	B = !1;
+	let n = O();
+	if (!n) Z();
+	else return H(t, n)?.exp;
+}, X = !1, Z = () => {
+	X || (X = !0, y.error("a `voltro:session` cookie was presented but VOLTRO_SESSION_SECRET is not set — the session cannot be verified, so no credential-expiry bound is imposed and realtime subscriptions on this connection will not be cut off when the session expires. Set VOLTRO_SESSION_SECRET (`voltro secret generate session`); `voltro dev` mints one, `voltro serve` refuses to boot without one.", { cookieName: q }));
+}, Q = () => {
+	X = !1;
 };
-//#endregion
-export { p as DEFAULT_PREVIOUS_SESSION_KID, f as DEFAULT_SESSION_KID, y as MIN_SESSION_SECRET_LENGTH, L as SESSION_COOKIE_NAME, r as SESSION_HEADER_NAME, u as SESSION_PAYLOAD_VERSION, b as assertProductionSessionSecret, I as buildSetCookie, P as checkBearer, F as readCookie, R as readSessionValue, H as resetSessionSecretWarningLatch, v as resolveOptionalSessionSecrets, h as resolveSessionSecret, g as resolveSessionSecrets, z as sessionExpiryFromHeaders, k as signSession, N as timingSafeStringEqual, j as verifySession, M as verifySessionKeyed };
+export { C as DEFAULT_PREVIOUS_SESSION_KID, S as DEFAULT_SESSION_KID, k as MIN_SESSION_SECRET_LENGTH, q as SESSION_COOKIE_NAME, r as SESSION_HEADER_NAME, b as SESSION_PAYLOAD_VERSION, a as applySecretWindows, A as assertProductionSessionSecret, o as bearerMatches, K as buildSetCookie, W as checkBearer, s as clearSecretWindows, c as drainSecretActivity, l as noteConfigured, u as noteSigned, d as noteSigningLifetime, f as previousAccepted, G as readCookie, J as readSessionValue, Q as resetSessionSecretWarningLatch, O as resolveOptionalSessionSecrets, T as resolveSessionSecret, E as resolveSessionSecrets, p as secretFingerprint, Y as sessionExpiryFromHeaders, m as setSecretWindow, z as signSession, U as timingSafeStringEqual, V as verifySession, H as verifySessionKeyed };

package/dist/sessionHeader.js

@@ -1,7 +1,6 @@
-//#region src/sessionHeader.ts
+// src/sessionHeader.ts
 var e = "x-voltro-session", t = (e, t, n) => {
 	let r = e["x-voltro-session"] ?? e["X-Voltro-Session"];
 	return r !== void 0 && r.length > 0 ? r : n(e.cookie ?? e.Cookie, t);
 };
-//#endregion
 export { e as SESSION_HEADER_NAME, t as sessionValueFromHeaders };

package/dist/ssrfPolicy.js

@@ -0,0 +1,29 @@
+// src/ssrfPolicy.ts
+var e = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, t = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), n = (e, t, n) => n.some((n) => {
+	let r = n.trim().toLowerCase();
+	if (r === "") return !1;
+	let i = t === "" ? e : `${e}:${t}`;
+	return r === e || r === i ? !0 : r.startsWith("*.") ? e.endsWith(r.slice(1)) : !1;
+}), r = (i, a = {}) => {
+	let o;
+	try {
+		o = new URL(i);
+	} catch {
+		return "malformed url";
+	}
+	if (o.protocol !== "http:" && o.protocol !== "https:") return `blocked scheme "${o.protocol}"`;
+	let s = o.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+	if (n(s, o.port, a.allowHosts ?? [])) return null;
+	if (s === "localhost" || s.endsWith(".localhost") || s.endsWith(".internal") || s.endsWith(".local")) return `blocked host "${s}"`;
+	let c = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
+	if (c) {
+		let t = Number(c[1]), n = Number(c[2]);
+		return t > 255 || n > 255 || Number(c[3]) > 255 || Number(c[4]) > 255 ? "malformed ipv4 literal" : e(t, n) ? `blocked private/reserved address ${s}` : null;
+	}
+	if (s.includes(":")) {
+		let e = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(s);
+		return e ? r(`${o.protocol}//${e[1]}`, a) : t(s) ? `blocked private/reserved address ${s}` : null;
+	}
+	return null;
+};
+export { r as ssrfReason };

package/dist/storageAccess.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/storageAccess.ts
+// src/storageAccess.ts
 var t = e.Array(e.String).pipe(e.check(e.isMaxLength(64))), n = e.Struct({
 	owner: e.optional(e.Boolean),
 	roles: e.optional(t),
@@ -10,5 +10,4 @@ var t = e.Array(e.String).pipe(e.check(e.isMaxLength(64))), n = e.Struct({
 	password: e.optional(e.Boolean),
 	guard: e.optional(e.String)
 }), r = e.Array(n).pipe(e.check(e.isMaxLength(32)));
-//#endregion
 export { r as StorageAccessPolicySchema, n as StorageAccessRuleSchema };

package/dist/storeErrors.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/storeErrors.ts
+// src/storeErrors.ts
 var t = class extends e.TaggedError()("TenantScopeViolation", {
 	table: e.String,
 	reason: e.String
@@ -62,5 +62,4 @@ var t = class extends e.TaggedError()("TenantScopeViolation", {
 		}
 	}
 };
-//#endregion
 export { s as ConstraintViolation, r as NoRowFound, o as ServerOnlyColumnWrite, n as StoreOperationFailed, i as TableValidationFailed, a as TenantRowNotFound, t as TenantScopeViolation };

package/dist/storeScreenshots.js

@@ -1,4 +1,4 @@
-//#region src/storeScreenshots.ts
+// src/storeScreenshots.ts
 var e = [
 	"app-store",
 	"play",
@@ -86,5 +86,4 @@ var e = [
 	width: e.viewport.width * e.deviceScaleFactor,
 	height: e.viewport.height * e.deviceScaleFactor
 }), a = (e) => t.filter((t) => t.stores.includes(e));
-//#endregion
 export { t as STORE_SCREENSHOT_PRESETS, n as STORE_SCREENSHOT_PRESET_NAMES, e as STORE_SCREENSHOT_STORES, i as storeScreenshotPixels, r as storeScreenshotPreset, a as storeScreenshotPresetsFor };

package/dist/strictInput.js

@@ -1,6 +1,6 @@
 import { Effect as e, Schema as t, SchemaIssue as n } from "effect";
 import * as r from "effect/SchemaAST";
-//#region src/strictInput.ts
+// src/strictInput.ts
 var i = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
@@ -23,5 +23,4 @@ var i = (e, t) => {
 	let l = i(o, s);
 	return t.make(c(r.ast)).pipe(t.middlewareDecoding((t) => e.catch(t, (t) => e.fail(new n.InvalidValue({ message: `${l}\n${a(t)}` })))));
 };
-//#endregion
 export { i as inputLabel, u as strictInput };

package/dist/subscriptionEvent.js

@@ -1,6 +1,6 @@
 import { rowPatchSchema as e } from "./rowPatch.js";
 import { Schema as t, SchemaGetter as n } from "effect";
-//#region src/subscriptionEvent.ts
+// src/subscriptionEvent.ts
 var r = t.Json.pipe(t.decodeTo(t.Unknown, {
 	decode: n.passthrough({ strict: !1 }),
 	encode: n.transform((e) => JSON.parse(JSON.stringify(e)))
@@ -33,5 +33,4 @@ var r = t.Json.pipe(t.decodeTo(t.Unknown, {
 		default: return t;
 	}
 };
-//#endregion
 export { a as firstEventValue, i as subscriptionEvent };

package/dist/tenantSelection.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/tenantSelection.ts
+// src/tenantSelection.ts
 var t = class extends e.TaggedError()("RequestedTenantRefused", { reason: e.Literals([
 	"target-unavailable",
 	"invalid-target",
@@ -36,5 +36,4 @@ var t = class extends e.TaggedError()("RequestedTenantRefused", { reason: e.Lite
 		}
 	};
 };
-//#endregion
 export { t as RequestedTenantRefused, r as TenantSelectionRefused, n as isTenantSelectable, i as selectSubjectTenant };

package/dist/time.js

@@ -1,7 +1,6 @@
-//#region src/time.ts
+// src/time.ts
 var e = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
 };
-//#endregion
 export { e as tsMs };

package/dist/undo.js

@@ -1,6 +1,6 @@
 import { defineMutation as e, defineQuery as t } from "./procedure.js";
 import { Schema as n } from "effect";
-//#region src/undo.ts
+// src/undo.ts
 var r = "__voltro.undo.log", i = "__voltro.undo.apply", a = "__voltro.undo.redo", o = n.Struct({
 	id: n.String,
 	tag: n.String,
@@ -34,5 +34,4 @@ var r = "__voltro.undo.log", i = "__voltro.undo.apply", a = "__voltro.undo.redo"
 	error: u,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
 });
-//#endregion
 export { i as UNDO_APPLY_TAG, r as UNDO_LOG_TAG, a as UNDO_REDO_TAG, l as UndoConflict, c as UndoForbidden, o as UndoLogEntry, s as UndoNotFound, f as undoApplyDescriptor, d as undoLogQueryDescriptor, p as undoRedoDescriptor };

package/dist/validation.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/validation.ts
+// src/validation.ts
 var t = e.Struct({
 	field: e.String,
 	message: e.String,
@@ -35,5 +35,4 @@ var t = e.Struct({
 	}
 	return [];
 };
-//#endregion
 export { n as ValidationError, r as ValidationErrors, t as ValidationIssue, i as fieldIssuesOf };

package/dist/webSocketGateway.js

@@ -1,10 +1,15 @@
-//#region src/webSocketGateway.ts
+// src/webSocketGateway.ts
 var e = 4001, t = /* @__PURE__ */ new Set(["/rpc", "/ws"]), n = (e) => {
+	if (e.auth === "token") {
+		if (typeof e.verify != "function") throw Error("defineWebSocket: auth: 'token' requires verify(firstFrame, context)");
+		let t = e.verificationTimeoutMs;
+		if (t !== void 0 && (!Number.isSafeInteger(t) || t <= 0 || t > 2147483647)) throw Error("defineWebSocket: verificationTimeoutMs must be a positive safe integer at most 2147483647");
+	} else if (e.verify !== void 0 || e.verificationTimeoutMs !== void 0) throw Error("defineWebSocket: verify and verificationTimeoutMs require auth: 'token'");
+	if (e.limits?.burst !== void 0 && e.limits.maxInboundMessagesPerSecond === void 0) throw Error("defineWebSocket: limits.burst requires limits.maxInboundMessagesPerSecond");
 	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
 	if (t.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
-	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
+	if (e.auth !== "subject" && e.auth !== "public" && e.auth !== "token") throw Error(`defineWebSocket: auth must be 'subject', 'public' or 'token' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
 };
-//#endregion
 export { e as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, n as defineWebSocket };

package/dist/workflow.js

@@ -4,7 +4,7 @@ import { getWorkflowAccess as a } from "./workflowAccess.js";
 import { WorkflowStartTerminalOutcomeSchema as o } from "./workflowStartOutcome.js";
 import { Schema as s } from "effect";
 import { Rpc as c } from "effect/rpc";
-//#region src/workflow.ts
+// src/workflow.ts
 var l = s.Literals([
 	"running",
 	"succeeded",
@@ -293,5 +293,4 @@ var l = s.Literals([
 	output: L,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
 });
-//#endregion
 export { O as WorkflowControlInputSchema, D as WorkflowControlIntentSchema, k as WorkflowControlReadInputSchema, d as WorkflowControlResultSchema, x as WorkflowDomainEventRowSchema, T as WorkflowDomainEventsInputSchema, E as WorkflowEventDeliveriesInputSchema, S as WorkflowEventDeliveryRowSchema, p as WorkflowParentClosePolicySchema, j as WorkflowQueuedCancelInputSchema, f as WorkflowQueuedCancellationResultSchema, A as WorkflowQueuedControlTargetSchema, b as WorkflowRunEventRowSchema, h as WorkflowRunHandleSchema, C as WorkflowRunRefSchema, _ as WorkflowRunRowSchema, u as WorkflowRunSnapshotSchema, l as WorkflowRunStatusSchema, y as WorkflowRunStepRowSchema, w as WorkflowRunTableRefSchema, v as WorkflowRunsInputSchema, F as WorkflowSignalInputSchema, m as WorkflowStartDeferralSchema, I as WorkflowUpdateInputSchema, L as WorkflowUpdateResultSchema, W as workflowCancelDescriptor, P as workflowControlQueryDescriptor, H as workflowDomainEventsQueryDescriptor, U as workflowEventDeliveriesQueryDescriptor, M as workflowQueuedCancelDescriptor, N as workflowQueuedControlQueryDescriptor, G as workflowResumeDescriptor, V as workflowRunEventsQueryDescriptor, R as workflowRunQueryDescriptor, B as workflowRunStepsQueryDescriptor, z as workflowRunsQueryDescriptor, K as workflowSignalDescriptor, g as workflowToRpc, q as workflowUpdateDescriptor };

package/dist/workflowAccess.js

@@ -1,5 +1,5 @@
 import { openAccessSpec as e } from "./scopes.js";
-//#region src/workflowAccess.ts
+// src/workflowAccess.ts
 var t = Symbol.for("@voltro/protocol/workflow-access"), n = {
 	guards: void 0,
 	openAccess: void 0,
@@ -57,5 +57,4 @@ var t = Symbol.for("@voltro/protocol/workflow-access"), n = {
 		controls: t.controls
 	};
 };
-//#endregion
 export { t as WorkflowAccessProperty, i as attachWorkflowAccess, a as getWorkflowAccess, r as resolveWorkflowAccess, o as workflowAccessDescriptor };

package/dist/workflowRestart.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/workflowRestart.ts
+// src/workflowRestart.ts
 var t = e.NonEmptyString.pipe(e.check(e.makeFilter((e) => e.trim().length > 0, { message: "A workflow restart identity must not be blank" }))), n = e.Union([e.Struct({ kind: e.Literal("failed-steps") }), e.Struct({
 	kind: e.Literal("from-step"),
 	stepName: t
@@ -41,5 +41,4 @@ var t = e.NonEmptyString.pipe(e.check(e.makeFilter((e) => e.trim().length > 0, {
 	kind: e.Literal("not-reserved"),
 	reason: e.Literals(["admission", "journal"])
 })]);
-//#endregion
 export { i as WorkflowRestartCommandSchema, o as WorkflowRestartObservationSchema, s as WorkflowRestartResultSchema, n as WorkflowRestartSelectionSchema, r as WorkflowRestartTargetSchema };

package/dist/workflowRetry.js

@@ -1,6 +1,6 @@
 import { WorkflowStartTerminalOutcomeSchema as e } from "./workflowStartOutcome.js";
 import { Schema as t } from "effect";
-//#region src/workflowRetry.ts
+// src/workflowRetry.ts
 var n = t.NonEmptyString.pipe(t.check(t.makeFilter((e) => e.trim().length > 0, { message: "A workflow retry identity must not be blank" }))), r = t.Struct({
 	runId: n,
 	requestId: n
@@ -40,5 +40,4 @@ var n = t.NonEmptyString.pipe(t.check(t.makeFilter((e) => e.trim().length > 0, {
 		failureId: t.NonEmptyString
 	})
 ]);
-//#endregion
 export { i as WorkflowRetryCommandSchema, o as WorkflowRetryObservationSchema, r as WorkflowRetryTargetSchema };

package/dist/workflowStartOutcome.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/workflowStartOutcome.ts
+// src/workflowStartOutcome.ts
 var t = e.Union([
 	e.Struct({
 		kind: e.Literal("dropped"),
@@ -26,5 +26,4 @@ var t = e.Union([
 		failureId: e.NonEmptyString
 	})
 ]);
-//#endregion
 export { t as WorkflowStartTerminalOutcomeSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.86.0",
+  "version": "0.88.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -63,12 +63,14 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/logger": "0.86.0",
-    "jose": "^6.2.12"
+    "@voltro/database": "0.88.0",
+    "@voltro/kv": "0.88.0",
+    "@voltro/logger": "0.88.0",
+    "@voltro/shared": "0.88.0",
+    "jose": "^6.2.13"
   },
   "peerDependencies": {
-    "effect": "4.0.1"
+    "effect": "4.1.0"
   },
   "publishConfig": {
     "access": "public"