@voltro/protocol 0.87.0 → 0.88.0

package/dist/revalidate.js

@@ -1,4 +1,4 @@
-//#region src/revalidate.ts
+// src/revalidate.ts
 var e = (e) => {
 	if (typeof e == "number" && Number.isFinite(e) && e > 0) return e * 1e3;
 	if (typeof e != "string") return null;
@@ -9,5 +9,4 @@ var e = (e) => {
 	let r = t[2].toLowerCase();
 	return r === "s" || r.startsWith("second") ? n * 1e3 : r === "m" || r.startsWith("minute") ? n * 6e4 : r === "h" || r.startsWith("hour") ? n * 36e5 : r === "d" || r.startsWith("day") ? n * 864e5 : null;
 };
-//#endregion
 export { e as parseRevalidateMs };

package/dist/rowEquality.js

@@ -1,4 +1,4 @@
-//#region src/rowEquality.ts
+// src/rowEquality.ts
 var e = (e) => e instanceof Uint8Array && Object.getPrototypeOf(e) === Uint8Array.prototype && !("toJSON" in e) && Object.keys(e).length === e.length, t = (e) => {
 	let t = Object.getPrototypeOf(e);
 	return (t === null || t === Object.prototype) && !("toJSON" in e) && !("toJSON" in Object.prototype);
@@ -27,5 +27,4 @@ var e = (e) => e instanceof Uint8Array && Object.getPrototypeOf(e) === Uint8Arra
 	}
 	return s;
 };
-//#endregion
 export { i as flatRowsEqual };

package/dist/rowPatch.js

@@ -1,7 +1,7 @@
 import { flatRowsEqual as e } from "./rowEquality.js";
 import { Result as t, Schema as n, SchemaGetter as r } from "effect";
 import * as i from "effect/encoding/Base64";
-//#region src/rowPatch.ts
+// src/rowPatch.ts
 var a = n.Union([n.String, n.Number]), o = (e) => typeof e == "object" && !!e && !Array.isArray(e) && Object.keys(e).length === 1 && typeof e.$bytes == "string", s = n.Unknown.pipe(n.decodeTo(n.Unknown, {
 	decode: r.transform((e) => {
 		if (!o(e)) return e;
@@ -178,5 +178,4 @@ var a = n.Union([n.String, n.Number]), o = (e) => typeof e == "object" && !!e &&
 		}
 	};
 };
-//#endregion
 export { v as applyRowPatch, b as createRowPatchApplier, g as diffRows, d as idToPath, _ as isIdKeyed, s as patchCellSchema, f as pathToId, l as rowPatchOpSchema, u as rowPatchSchema };

package/dist/schemaShape.js

@@ -1,5 +1,5 @@
 import { RpcSchema as e } from "effect/rpc";
-//#region src/schemaShape.ts
+// src/schemaShape.ts
 var t = (e) => typeof e == "object" && !!e && typeof e._tag == "string", n = 64, r = (e, i = 0) => {
 	if (!t(e)) return String(e);
 	if (i >= n) return "…";
@@ -63,5 +63,4 @@ var t = (e) => typeof e == "object" && !!e && typeof e._tag == "string", n = 64,
 		missingHere: r.sort()
 	};
 };
-//#endregion
 export { c as compareSurfaces, s as groupShapeDigests, o as procedureShapeDigest, r as schemaShape, i as shapeDigest };

package/dist/scopes.js

@@ -1,7 +1,7 @@
 import { RequestedTenantRefused as e } from "./tenantSelection.js";
 import { Unauthenticated as t, currentSubjectAuthority as n, reauthorizeSubject as r } from "./auth.js";
 import { Effect as i, Schema as a } from "effect";
-//#region src/scopes.ts
+// src/scopes.ts
 var o = "admin:full", s = "apikeys:issue:self", c = "apikeys:issue:org", l = "apikeys:issue:other", u = "devices:manage", d = class extends a.TaggedError()("ScopeError", {
 	required: a.String,
 	message: a.String
@@ -269,5 +269,4 @@ var o = "admin:full", s = "apikeys:issue:self", c = "apikeys:issue:org", l = "ap
 	onFailure: (n) => a.is(t)(n) || a.is(e)(n) ? i.succeed(n) : i.die(n),
 	onSuccess: (e) => Q(e, o, s, c)
 }));
-//#endregion
 export { o as ADMIN_SCOPE, c as APIKEY_ISSUE_ORG_SCOPE, l as APIKEY_ISSUE_OTHER_SCOPE, s as APIKEY_ISSUE_SELF_SCOPE, u as DEVICES_MANAGE_SCOPE, f as NoSuchResource, d as ScopeError, B as advisoryResourceGuardWarning, Y as checkGuards, Q as checkGuardsEffect, T as declaresResourceGuard, y as effectiveScopes, z as findAdvisoryResourceGuards, W as getPolicyGuardResolver, V as getResourceScopeResolver, b as hasEffectiveScope, x as hasScope, j as isAuthenticatedCheck, E as isOpenAccess, w as isPolicyCheck, D as isServiceAccess, M as isUpgradedCheck, G as missingAccessDecision, F as openAccessSpec, $ as recheckGuardsEffect, _ as refreshEffectiveScopes, S as requireScope, C as resolvePolicyAction, O as serviceAccessSpec, k as serviceCallersOf, v as setEffectiveScopes, g as setEffectiveScopesRefresher, U as setPolicyGuardResolver, R as setResourceScopeResolver, p as subjectScopes, N as upgradedGuardShapeError };

package/dist/secretWindows.js

@@ -1,5 +1,5 @@
 import { createHash as e, createHmac as t, timingSafeEqual as n } from "node:crypto";
-//#region src/secretWindows.ts
+// src/secretWindows.ts
 var r = (e) => t("sha256", e).update("voltro:secret-fingerprint:v1").digest("hex").slice(0, 16), i = Symbol.for("voltro.secretWindows"), a = () => {
 	let e = globalThis;
 	return e[i] ??= {
@@ -67,5 +67,4 @@ var r = (e) => t("sha256", e).update("voltro:secret-fingerprint:v1").digest("hex
 	let c = h(t), l = i !== "" && n(c, h(i)), u = s !== void 0 && s !== "" && s !== i && n(c, h(s));
 	return l ? !0 : !u || !m(e, s) ? !1 : (o(a().presented, e).set(r(s), Date.now()), !0);
 };
-//#endregion
 export { d as applySecretWindows, g as bearerMatches, p as clearSecretWindows, u as drainSecretActivity, l as noteConfigured, s as noteSigned, c as noteSigningLifetime, m as previousAccepted, r as secretFingerprint, f as setSecretWindow };

package/dist/serverErrorBus.js

@@ -1,4 +1,4 @@
-//#region src/serverErrorBus.ts
+// src/serverErrorBus.ts
 var e = (e) => {
 	let t = e.error, n = t instanceof Error ? t.name : typeof t?._tag == "string" ? String(t._tag) : "Error", r = [e.name === void 0 ? e.source : `${e.source} '${e.name}'`, ...typeof e.fields?.runId == "string" ? [`run ${e.fields.runId}`] : []].join(", "), i = /* @__PURE__ */ Error(`[message withheld: ${r} is declared encrypted — read it where the run is shown]`);
 	i.name = n;
@@ -11,5 +11,4 @@ var e = (e) => {
 }, r = (e) => (t.add(e), () => {
 	t.delete(e);
 });
-//#endregion
 export { n as publishServerError, r as subscribeServerErrors, e as withheldServerError };

package/dist/serviceCall.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/serviceCall.ts
+// src/serviceCall.ts
 var t = class extends e.TaggedError()("ApiUnavailable", {
 	api: e.String,
 	tag: e.String,
@@ -10,5 +10,4 @@ var t = class extends e.TaggedError()("ApiUnavailable", {
 	]),
 	message: e.String
 }) {}, n = (e) => typeof e == "object" && !!e && e._tag === "ApiUnavailable";
-//#endregion
 export { t as ApiUnavailable, n as isApiUnavailable };

package/dist/session.js

@@ -5,7 +5,7 @@ import { applySecretWindows as a, bearerMatches as o, clearSecretWindows as s, d
 import { Schema as h } from "effect";
 import { createHmac as g, timingSafeEqual as _ } from "node:crypto";
 import { createLogger as v } from "@voltro/logger";
-//#region src/session.ts
+// src/session.ts
 var y = v({ scope: "@voltro/protocol:session" }), b = 2, x = h.Struct({
 	v: h.Literal(2),
 	subject: e,
@@ -125,5 +125,4 @@ var y = v({ scope: "@voltro/protocol:session" }), b = 2, x = h.Struct({
 }, Q = () => {
 	X = !1;
 };
-//#endregion
 export { C as DEFAULT_PREVIOUS_SESSION_KID, S as DEFAULT_SESSION_KID, k as MIN_SESSION_SECRET_LENGTH, q as SESSION_COOKIE_NAME, r as SESSION_HEADER_NAME, b as SESSION_PAYLOAD_VERSION, a as applySecretWindows, A as assertProductionSessionSecret, o as bearerMatches, K as buildSetCookie, W as checkBearer, s as clearSecretWindows, c as drainSecretActivity, l as noteConfigured, u as noteSigned, d as noteSigningLifetime, f as previousAccepted, G as readCookie, J as readSessionValue, Q as resetSessionSecretWarningLatch, O as resolveOptionalSessionSecrets, T as resolveSessionSecret, E as resolveSessionSecrets, p as secretFingerprint, Y as sessionExpiryFromHeaders, m as setSecretWindow, z as signSession, U as timingSafeStringEqual, V as verifySession, H as verifySessionKeyed };

package/dist/sessionHeader.js

@@ -1,7 +1,6 @@
-//#region src/sessionHeader.ts
+// src/sessionHeader.ts
 var e = "x-voltro-session", t = (e, t, n) => {
 	let r = e["x-voltro-session"] ?? e["X-Voltro-Session"];
 	return r !== void 0 && r.length > 0 ? r : n(e.cookie ?? e.Cookie, t);
 };
-//#endregion
 export { e as SESSION_HEADER_NAME, t as sessionValueFromHeaders };

package/dist/ssrfPolicy.js

@@ -1,4 +1,4 @@
-//#region src/ssrfPolicy.ts
+// src/ssrfPolicy.ts
 var e = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, t = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), n = (e, t, n) => n.some((n) => {
 	let r = n.trim().toLowerCase();
 	if (r === "") return !1;
@@ -26,5 +26,4 @@ var e = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t
 	}
 	return null;
 };
-//#endregion
 export { r as ssrfReason };

package/dist/storageAccess.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/storageAccess.ts
+// src/storageAccess.ts
 var t = e.Array(e.String).pipe(e.check(e.isMaxLength(64))), n = e.Struct({
 	owner: e.optional(e.Boolean),
 	roles: e.optional(t),
@@ -10,5 +10,4 @@ var t = e.Array(e.String).pipe(e.check(e.isMaxLength(64))), n = e.Struct({
 	password: e.optional(e.Boolean),
 	guard: e.optional(e.String)
 }), r = e.Array(n).pipe(e.check(e.isMaxLength(32)));
-//#endregion
 export { r as StorageAccessPolicySchema, n as StorageAccessRuleSchema };

package/dist/storeErrors.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/storeErrors.ts
+// src/storeErrors.ts
 var t = class extends e.TaggedError()("TenantScopeViolation", {
 	table: e.String,
 	reason: e.String
@@ -62,5 +62,4 @@ var t = class extends e.TaggedError()("TenantScopeViolation", {
 		}
 	}
 };
-//#endregion
 export { s as ConstraintViolation, r as NoRowFound, o as ServerOnlyColumnWrite, n as StoreOperationFailed, i as TableValidationFailed, a as TenantRowNotFound, t as TenantScopeViolation };

package/dist/storeScreenshots.js

@@ -1,4 +1,4 @@
-//#region src/storeScreenshots.ts
+// src/storeScreenshots.ts
 var e = [
 	"app-store",
 	"play",
@@ -86,5 +86,4 @@ var e = [
 	width: e.viewport.width * e.deviceScaleFactor,
 	height: e.viewport.height * e.deviceScaleFactor
 }), a = (e) => t.filter((t) => t.stores.includes(e));
-//#endregion
 export { t as STORE_SCREENSHOT_PRESETS, n as STORE_SCREENSHOT_PRESET_NAMES, e as STORE_SCREENSHOT_STORES, i as storeScreenshotPixels, r as storeScreenshotPreset, a as storeScreenshotPresetsFor };

package/dist/strictInput.js

@@ -1,6 +1,6 @@
 import { Effect as e, Schema as t, SchemaIssue as n } from "effect";
 import * as r from "effect/SchemaAST";
-//#region src/strictInput.ts
+// src/strictInput.ts
 var i = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
@@ -23,5 +23,4 @@ var i = (e, t) => {
 	let l = i(o, s);
 	return t.make(c(r.ast)).pipe(t.middlewareDecoding((t) => e.catch(t, (t) => e.fail(new n.InvalidValue({ message: `${l}\n${a(t)}` })))));
 };
-//#endregion
 export { i as inputLabel, u as strictInput };

package/dist/subscriptionEvent.js

@@ -1,6 +1,6 @@
 import { rowPatchSchema as e } from "./rowPatch.js";
 import { Schema as t, SchemaGetter as n } from "effect";
-//#region src/subscriptionEvent.ts
+// src/subscriptionEvent.ts
 var r = t.Json.pipe(t.decodeTo(t.Unknown, {
 	decode: n.passthrough({ strict: !1 }),
 	encode: n.transform((e) => JSON.parse(JSON.stringify(e)))
@@ -33,5 +33,4 @@ var r = t.Json.pipe(t.decodeTo(t.Unknown, {
 		default: return t;
 	}
 };
-//#endregion
 export { a as firstEventValue, i as subscriptionEvent };

package/dist/tenantSelection.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/tenantSelection.ts
+// src/tenantSelection.ts
 var t = class extends e.TaggedError()("RequestedTenantRefused", { reason: e.Literals([
 	"target-unavailable",
 	"invalid-target",
@@ -36,5 +36,4 @@ var t = class extends e.TaggedError()("RequestedTenantRefused", { reason: e.Lite
 		}
 	};
 };
-//#endregion
 export { t as RequestedTenantRefused, r as TenantSelectionRefused, n as isTenantSelectable, i as selectSubjectTenant };

package/dist/time.js

@@ -1,7 +1,6 @@
-//#region src/time.ts
+// src/time.ts
 var e = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
 };
-//#endregion
 export { e as tsMs };

package/dist/undo.js

@@ -1,6 +1,6 @@
 import { defineMutation as e, defineQuery as t } from "./procedure.js";
 import { Schema as n } from "effect";
-//#region src/undo.ts
+// src/undo.ts
 var r = "__voltro.undo.log", i = "__voltro.undo.apply", a = "__voltro.undo.redo", o = n.Struct({
 	id: n.String,
 	tag: n.String,
@@ -34,5 +34,4 @@ var r = "__voltro.undo.log", i = "__voltro.undo.apply", a = "__voltro.undo.redo"
 	error: u,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
 });
-//#endregion
 export { i as UNDO_APPLY_TAG, r as UNDO_LOG_TAG, a as UNDO_REDO_TAG, l as UndoConflict, c as UndoForbidden, o as UndoLogEntry, s as UndoNotFound, f as undoApplyDescriptor, d as undoLogQueryDescriptor, p as undoRedoDescriptor };

package/dist/validation.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/validation.ts
+// src/validation.ts
 var t = e.Struct({
 	field: e.String,
 	message: e.String,
@@ -35,5 +35,4 @@ var t = e.Struct({
 	}
 	return [];
 };
-//#endregion
 export { n as ValidationError, r as ValidationErrors, t as ValidationIssue, i as fieldIssuesOf };

package/dist/webSocketGateway.js

@@ -1,4 +1,4 @@
-//#region src/webSocketGateway.ts
+// src/webSocketGateway.ts
 var e = 4001, t = /* @__PURE__ */ new Set(["/rpc", "/ws"]), n = (e) => {
 	if (e.auth === "token") {
 		if (typeof e.verify != "function") throw Error("defineWebSocket: auth: 'token' requires verify(firstFrame, context)");
@@ -12,5 +12,4 @@ var e = 4001, t = /* @__PURE__ */ new Set(["/rpc", "/ws"]), n = (e) => {
 	if (e.auth !== "subject" && e.auth !== "public" && e.auth !== "token") throw Error(`defineWebSocket: auth must be 'subject', 'public' or 'token' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
 };
-//#endregion
 export { e as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, n as defineWebSocket };

package/dist/workflow.js

@@ -4,7 +4,7 @@ import { getWorkflowAccess as a } from "./workflowAccess.js";
 import { WorkflowStartTerminalOutcomeSchema as o } from "./workflowStartOutcome.js";
 import { Schema as s } from "effect";
 import { Rpc as c } from "effect/rpc";
-//#region src/workflow.ts
+// src/workflow.ts
 var l = s.Literals([
 	"running",
 	"succeeded",
@@ -293,5 +293,4 @@ var l = s.Literals([
 	output: L,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
 });
-//#endregion
 export { O as WorkflowControlInputSchema, D as WorkflowControlIntentSchema, k as WorkflowControlReadInputSchema, d as WorkflowControlResultSchema, x as WorkflowDomainEventRowSchema, T as WorkflowDomainEventsInputSchema, E as WorkflowEventDeliveriesInputSchema, S as WorkflowEventDeliveryRowSchema, p as WorkflowParentClosePolicySchema, j as WorkflowQueuedCancelInputSchema, f as WorkflowQueuedCancellationResultSchema, A as WorkflowQueuedControlTargetSchema, b as WorkflowRunEventRowSchema, h as WorkflowRunHandleSchema, C as WorkflowRunRefSchema, _ as WorkflowRunRowSchema, u as WorkflowRunSnapshotSchema, l as WorkflowRunStatusSchema, y as WorkflowRunStepRowSchema, w as WorkflowRunTableRefSchema, v as WorkflowRunsInputSchema, F as WorkflowSignalInputSchema, m as WorkflowStartDeferralSchema, I as WorkflowUpdateInputSchema, L as WorkflowUpdateResultSchema, W as workflowCancelDescriptor, P as workflowControlQueryDescriptor, H as workflowDomainEventsQueryDescriptor, U as workflowEventDeliveriesQueryDescriptor, M as workflowQueuedCancelDescriptor, N as workflowQueuedControlQueryDescriptor, G as workflowResumeDescriptor, V as workflowRunEventsQueryDescriptor, R as workflowRunQueryDescriptor, B as workflowRunStepsQueryDescriptor, z as workflowRunsQueryDescriptor, K as workflowSignalDescriptor, g as workflowToRpc, q as workflowUpdateDescriptor };

package/dist/workflowAccess.js

@@ -1,5 +1,5 @@
 import { openAccessSpec as e } from "./scopes.js";
-//#region src/workflowAccess.ts
+// src/workflowAccess.ts
 var t = Symbol.for("@voltro/protocol/workflow-access"), n = {
 	guards: void 0,
 	openAccess: void 0,
@@ -57,5 +57,4 @@ var t = Symbol.for("@voltro/protocol/workflow-access"), n = {
 		controls: t.controls
 	};
 };
-//#endregion
 export { t as WorkflowAccessProperty, i as attachWorkflowAccess, a as getWorkflowAccess, r as resolveWorkflowAccess, o as workflowAccessDescriptor };

package/dist/workflowRestart.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/workflowRestart.ts
+// src/workflowRestart.ts
 var t = e.NonEmptyString.pipe(e.check(e.makeFilter((e) => e.trim().length > 0, { message: "A workflow restart identity must not be blank" }))), n = e.Union([e.Struct({ kind: e.Literal("failed-steps") }), e.Struct({
 	kind: e.Literal("from-step"),
 	stepName: t
@@ -41,5 +41,4 @@ var t = e.NonEmptyString.pipe(e.check(e.makeFilter((e) => e.trim().length > 0, {
 	kind: e.Literal("not-reserved"),
 	reason: e.Literals(["admission", "journal"])
 })]);
-//#endregion
 export { i as WorkflowRestartCommandSchema, o as WorkflowRestartObservationSchema, s as WorkflowRestartResultSchema, n as WorkflowRestartSelectionSchema, r as WorkflowRestartTargetSchema };

package/dist/workflowRetry.js

@@ -1,6 +1,6 @@
 import { WorkflowStartTerminalOutcomeSchema as e } from "./workflowStartOutcome.js";
 import { Schema as t } from "effect";
-//#region src/workflowRetry.ts
+// src/workflowRetry.ts
 var n = t.NonEmptyString.pipe(t.check(t.makeFilter((e) => e.trim().length > 0, { message: "A workflow retry identity must not be blank" }))), r = t.Struct({
 	runId: n,
 	requestId: n
@@ -40,5 +40,4 @@ var n = t.NonEmptyString.pipe(t.check(t.makeFilter((e) => e.trim().length > 0, {
 		failureId: t.NonEmptyString
 	})
 ]);
-//#endregion
 export { i as WorkflowRetryCommandSchema, o as WorkflowRetryObservationSchema, r as WorkflowRetryTargetSchema };

package/dist/workflowStartOutcome.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/workflowStartOutcome.ts
+// src/workflowStartOutcome.ts
 var t = e.Union([
 	e.Struct({
 		kind: e.Literal("dropped"),
@@ -26,5 +26,4 @@ var t = e.Union([
 		failureId: e.NonEmptyString
 	})
 ]);
-//#endregion
 export { t as WorkflowStartTerminalOutcomeSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -63,14 +63,14 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.87.0",
-    "@voltro/kv": "0.87.0",
-    "@voltro/logger": "0.87.0",
-    "@voltro/shared": "0.87.0",
-    "jose": "^6.2.12"
+    "@voltro/database": "0.88.0",
+    "@voltro/kv": "0.88.0",
+    "@voltro/logger": "0.88.0",
+    "@voltro/shared": "0.88.0",
+    "jose": "^6.2.13"
   },
   "peerDependencies": {
-    "effect": "4.0.1"
+    "effect": "4.1.0"
   },
   "publishConfig": {
     "access": "public"