@voltro/runtime 0.85.0 → 0.86.0

package/dist/apiKeys.js

@@ -0,0 +1,223 @@
+import { eq as e, generateId as t, inSet as n } from "@voltro/database";
+import { createHash as r, randomBytes as i } from "node:crypto";
+//#region src/apiKeys.ts
+var a = "_voltro_api_keys", o = "actors", s = (e) => r("sha256").update(e, "utf8").digest("hex"), c = (e = "voltro_") => `${e}${i(30).toString("base64url")}`, l = (e) => ({
+	id: e.id,
+	name: e.name,
+	keyPrefix: e.keyPrefix,
+	tenantId: e.tenantId,
+	scopes: e.scopes ?? [],
+	lastUsedAt: e.lastUsedAt,
+	expiresAt: e.expiresAt,
+	revokedAt: e.revokedAt,
+	createdAt: e.createdAt,
+	createdBy: e.createdBy ?? null,
+	onBehalfOf: e.onBehalfOf ?? null,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), u = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), d = (e, n = {}) => {
+	let r = n.prefix ?? "voltro_", i = n.usage, o = async (n) => {
+		let i = c(r), o = t({
+			kind: "typeid",
+			prefix: "apikey"
+		}, a), l = n.scopes ?? [], u = n.expiresAt == null ? null : n.expiresAt instanceof Date ? n.expiresAt.getTime() : n.expiresAt;
+		return await e.ensureActor({
+			id: o,
+			displayName: n.name,
+			input: n
+		}), await e.insert({
+			id: o,
+			tenantId: n.tenantId ?? null,
+			name: n.name,
+			onBehalfOf: n.onBehalfOf ?? null,
+			hashedKey: s(i),
+			keyPrefix: i.slice(0, r.length + 6),
+			scopes: l,
+			lastUsedAt: null,
+			expiresAt: u,
+			revokedAt: null,
+			createdBy: n.createdBy ?? null,
+			createdAt: Date.now(),
+			...n.metadata == null ? {} : { metadata: n.metadata }
+		}), {
+			id: o,
+			token: i,
+			keyPrefix: i.slice(0, r.length + 6),
+			name: n.name,
+			tenantId: n.tenantId ?? null,
+			scopes: l
+		};
+	}, d = async (t, n = Date.now()) => {
+		let r = await e.findByHash(t);
+		return !r || !u(r, n) ? null : (i === void 0 ? await e.patch(r.id, { lastUsedAt: n }) : i.touch(r.id, n), {
+			id: r.id,
+			tenantId: r.tenantId ?? "",
+			createdBy: r.createdBy ?? null,
+			onBehalfOf: r.onBehalfOf ?? null,
+			scopes: r.scopes ?? [],
+			...r.metadata == null ? {} : { metadata: r.metadata }
+		});
+	};
+	return {
+		issue: o,
+		resolveByHash: d,
+		verify: (e, t) => d(s(e), t),
+		revoke: async (t, n, r = Date.now()) => {
+			let i = await e.findById(t);
+			return !i || (i.tenantId ?? null) !== n ? !1 : (await e.patch(t, { revokedAt: r }), !0);
+		},
+		rotate: async (t, n, r = Date.now()) => {
+			let i = await e.findById(t);
+			return !i || (i.tenantId ?? null) !== n ? null : (await e.patch(t, { revokedAt: r }), o({
+				tenantId: i.tenantId,
+				name: i.name,
+				scopes: i.scopes ?? [],
+				createdBy: i.createdBy,
+				onBehalfOf: i.onBehalfOf ?? null,
+				...i.metadata == null ? {} : { metadata: i.metadata }
+			}));
+		},
+		list: async (t) => (await e.listByTenant(t)).map(l)
+	};
+}, f = () => {
+	let e = /* @__PURE__ */ new Map(), t = /* @__PURE__ */ new Map();
+	return {
+		actors: t,
+		ensureActor: async (e) => {
+			t.has(e.id) || t.set(e.id, {
+				id: e.id,
+				kind: "apiKey",
+				displayName: e.displayName
+			});
+		},
+		insert: async (t) => {
+			e.set(t.id, t);
+		},
+		findByHash: async (t) => {
+			for (let n of e.values()) if (n.hashedKey === t) return n;
+			return null;
+		},
+		findById: async (t) => e.get(t) ?? null,
+		listByTenant: async (t) => {
+			let n = [...e.values()], r = 0;
+			for (let e of n) e.tenantId === t && (n[r++] = e);
+			return n.length = r, n;
+		},
+		patch: async (t, n) => {
+			let r = e.get(t);
+			r && e.set(t, {
+				...r,
+				...n
+			});
+		}
+	};
+}, p = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, m = (e) => ({
+	id: String(e.id),
+	tenantId: e.tenantId ?? null,
+	name: String(e.name),
+	hashedKey: String(e.hashedKey),
+	keyPrefix: String(e.keyPrefix),
+	scopes: e.scopes ?? null,
+	lastUsedAt: p(e.lastUsedAt),
+	expiresAt: p(e.expiresAt),
+	revokedAt: p(e.revokedAt),
+	createdBy: e.createdBy ?? null,
+	onBehalfOf: e.onBehalfOf ?? null,
+	createdAt: p(e.createdAt) ?? 0,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), h = async (e) => {
+	let t = await e.keys();
+	if (t.length === 0) return {
+		keys: 0,
+		planted: 0,
+		failed: []
+	};
+	let r = /* @__PURE__ */ new Set();
+	for (let i = 0; i < t.length; i += 500) {
+		let a = t.slice(i, i + 500).map((e) => e.id), s = await e.store.query({
+			table: o,
+			predicate: n("id", a),
+			order: [],
+			take: void 0,
+			skip: void 0,
+			projection: void 0
+		});
+		for (let e of s) typeof e.id == "string" && r.add(e.id);
+	}
+	let i = 0, a = [];
+	for (let n of t) if (!r.has(n.id)) try {
+		await e.apiKeyStore.ensureActor({
+			id: n.id,
+			displayName: n.name,
+			input: {
+				tenantId: n.tenantId,
+				name: n.name,
+				scopes: n.scopes ?? [],
+				createdBy: n.createdBy,
+				onBehalfOf: n.onBehalfOf ?? null,
+				...n.metadata == null ? {} : { metadata: n.metadata }
+			}
+		}), i++;
+	} catch (e) {
+		a.push({
+			id: n.id,
+			reason: e instanceof Error ? e.message : String(e)
+		});
+	}
+	return {
+		keys: t.length,
+		planted: i,
+		failed: a
+	};
+}, g = (e) => async (t, n) => {
+	let r = await e.findById(t);
+	if (r === null) return;
+	let i = r.requestCount ?? 0, a = r.lastUsedAt ?? 0;
+	await e.patch(t, {
+		requestCount: i + n.requests,
+		lastUsedAt: Math.max(a, n.lastUsedAt)
+	});
+}, _ = (t, n = {}) => {
+	let r = n.ensureActor, i = async (e) => await t.query({
+		table: a,
+		predicate: e,
+		order: [],
+		take: void 0,
+		skip: void 0,
+		projection: void 0
+	}), s = (e) => {
+		let t = { ...e };
+		for (let e of [
+			"lastUsedAt",
+			"expiresAt",
+			"revokedAt",
+			"createdAt"
+		]) e in t && typeof t[e] == "number" && (t[e] = new Date(t[e]));
+		return t;
+	};
+	return {
+		ensureActor: r === void 0 ? async (e) => {
+			await t.insertIgnore(o, {
+				id: e.id,
+				kind: "apiKey",
+				displayName: e.displayName
+			}, { conflictColumns: ["id"] });
+		} : (e) => r(e, t),
+		insert: async (e) => {
+			await t.insert(a, s(e));
+		},
+		findByHash: async (t) => {
+			let n = await i(e("hashedKey", t));
+			return n[0] ? m(n[0]) : null;
+		},
+		findById: async (t) => {
+			let n = await i(e("id", t));
+			return n[0] ? m(n[0]) : null;
+		},
+		listByTenant: async (t) => (await i(t === null ? void 0 : e("tenantId", t))).map(m).filter((e) => t === null || e.tenantId === t),
+		patch: async (e, n) => {
+			await t.update(a, e, s(n));
+		}
+	};
+};
+//#endregion
+export { o as ACTORS_TABLE, a as API_KEYS_TABLE, _ as dataStoreApiKeyStore, c as generateApiKeyToken, d as makeApiKeyService, g as makeApiKeyUsageFlusher, f as memoryApiKeyStore, h as plantMissingApiKeyActors, s as sha256Hex };

package/dist/apiKeysWiring.js

@@ -0,0 +1,114 @@
+import { Schema as e } from "effect";
+import { ADMIN_SCOPE as t, APIKEY_ISSUE_ORG_SCOPE as n, APIKEY_ISSUE_OTHER_SCOPE as r, APIKEY_ISSUE_SELF_SCOPE as i, ScopeError as a } from "@voltro/protocol";
+import { defineRestRoute as o, requireAnyScope as s, requireScope as c } from "@voltro/protocol/rest";
+import { apiKeyStrategy as l } from "@voltro/protocol/apikey";
+//#region src/apiKeysWiring.ts
+var u = (e, t = {}) => l({
+	id: "voltro-apikey",
+	...t.prefix ? { prefix: t.prefix } : {},
+	resolveKey: (t) => e.resolveByHash(t)
+}), d = (e) => {
+	let t = e.subject;
+	return {
+		id: t.id ?? null,
+		tenantId: t.tenantId ?? null,
+		scopes: t.scopes ?? []
+	};
+}, f = (l, u = "/v1/api-keys") => {
+	let f = e.Struct({
+		id: e.String,
+		name: e.String,
+		keyPrefix: e.String,
+		tenantId: e.NullOr(e.String),
+		scopes: e.Array(e.String),
+		lastUsedAt: e.NullOr(e.Number),
+		expiresAt: e.NullOr(e.Number),
+		revokedAt: e.NullOr(e.Number),
+		createdAt: e.Number,
+		createdBy: e.NullOr(e.String),
+		onBehalfOf: e.NullOr(e.String),
+		metadata: e.optional(e.NullOr(e.Record(e.String, e.Unknown)))
+	});
+	return [
+		o({
+			method: "POST",
+			path: `${u}/issue`,
+			summary: "Issue an API key (the token is returned ONCE).",
+			guards: [s([
+				t,
+				i,
+				n,
+				r
+			])],
+			input: e.Struct({ body: e.Struct({
+				name: e.String,
+				scopes: e.optional(e.Array(e.String)),
+				expiresInDays: e.optional(e.Number),
+				onBehalfOf: e.optional(e.NullOr(e.String))
+			}) }),
+			output: e.Struct({
+				id: e.String,
+				token: e.String,
+				keyPrefix: e.String
+			}),
+			handler: async (e, o) => {
+				let s = e.body, c = d(o), u = new Set(c.scopes), f = (e) => u.has(t) || u.has(e), p = s.onBehalfOf === void 0 ? c.id : s.onBehalfOf;
+				if (p === null) {
+					if (!f(n)) throw new a({
+						required: n,
+						message: "not allowed to issue an organization key"
+					});
+				} else if (p !== c.id) {
+					if (!f(r)) throw new a({
+						required: r,
+						message: "not allowed to issue a key on behalf of another user"
+					});
+				} else if (!f(i)) throw new a({
+					required: i,
+					message: "not allowed to issue an api key"
+				});
+				let m = s.scopes ?? [...u];
+				if (!u.has(t)) {
+					let e = m.filter((e) => !u.has(e));
+					if (e.length > 0) throw new a({
+						required: String(e[0]),
+						message: `cannot issue a key with scopes you do not hold: ${e.join(", ")}`
+					});
+				}
+				let h = await l.issue({
+					tenantId: c.tenantId,
+					name: s.name,
+					scopes: m,
+					...s.expiresInDays ? { expiresAt: Date.now() + s.expiresInDays * 864e5 } : {},
+					createdBy: c.id,
+					onBehalfOf: p
+				});
+				return {
+					id: h.id,
+					token: h.token,
+					keyPrefix: h.keyPrefix
+				};
+			}
+		}),
+		o({
+			method: "GET",
+			path: u,
+			summary: "List the caller tenant's API keys (no secrets).",
+			guards: [c(t)],
+			input: e.Struct({}),
+			output: e.Struct({ keys: e.Array(f) }),
+			handler: async (e, t) => ({ keys: [...await l.list(d(t).tenantId)] })
+		}),
+		o({
+			method: "POST",
+			path: `${u}/revoke`,
+			summary: "Revoke an API key by id.",
+			guards: [c(t)],
+			input: e.Struct({ body: e.Struct({ id: e.String }) }),
+			output: e.Struct({ ok: e.Boolean }),
+			handler: async (e, t) => ({ ok: await l.revoke(e.body.id, d(t).tenantId) })
+		})
+	];
+};
+//#endregion
+export { f as apiKeyManagementRoutes, u as frameworkApiKeyStrategy };

package/dist/approvalBuiltins.js

@@ -0,0 +1,10 @@
+import { decideApproval as e, pendingApprovalsFor as t } from "./approvals.js";
+//#region src/approvalBuiltins.ts
+var n = (e) => e.request?.subject ?? null, r = async (e, r) => t(r.store, n(r), { limit: e.limit ?? 50 }), i = async (t, r) => e(r.store, {
+	approvalId: t.approvalId,
+	decision: t.decision,
+	approver: n(r),
+	...t.note === void 0 ? {} : { note: t.note }
+});
+//#endregion
+export { r as approvalsPendingExecutor, i as decideApprovalInvocation };

package/dist/approvals.js

@@ -0,0 +1,269 @@
+import { Effect as e } from "effect";
+import { and as t, eq as n, generateId as r, id as i, inSet as a, registerRetention as o, retentionTtlMsFromEnv as s, table as c, text as l, timestamp as u } from "@voltro/database";
+import { createHash as d, randomUUID as f } from "node:crypto";
+import { ApprovalExpired as p, ApprovalForbidden as m, ApprovalNotFound as h, ApprovalNotPending as g, ApprovalRejected as _, ApprovalRequired as v, ApprovalSelfApproval as y, ApprovalUnavailable as b, checkGuardsEffect as x, isAuthenticatedGuard as S, isPolicyGuard as C, resolvePolicyAction as w } from "@voltro/protocol";
+//#region src/approvals.ts
+var T = "_voltro_approvals", E = 864e5, D = c(T, {
+	id: i({ prefix: "apv" }),
+	intentKey: l().maxLength(191),
+	procedure: l(),
+	kind: l(),
+	requestedBy: l().nullable(),
+	tenantId: l().nullable(),
+	payload: l(),
+	approverGuards: l(),
+	approverScopes: l(),
+	reason: l().nullable(),
+	status: l().default("pending"),
+	decidedBy: l().nullable(),
+	decidedAt: u().nullable(),
+	note: l().nullable(),
+	traceId: l().nullable(),
+	requestedAt: u().default("now"),
+	expiresAt: u(),
+	consumedAt: u().nullable()
+}).index(["status", "expiresAt"]).index(["requestedBy"]), O = () => {
+	o({
+		source: "framework",
+		table: T,
+		timeColumn: "requestedAt",
+		ttlMs: s(process.env.VOLTRO_APPROVALS_TTL_HOURS, 720)
+	});
+}, k = (e, t) => e.map((e) => S(e) ? { kind: "authenticated" } : C(e) ? {
+	kind: "policy",
+	action: w(e, t),
+	resourceType: e.resourceType,
+	resource: e.resource(t) ?? null
+} : {
+	kind: "scope",
+	scope: typeof e.scope == "string" ? [e.scope] : [...e.scope],
+	mode: e.mode ?? "all",
+	resource: e.resource?.(t) ?? null
+}), A = (e) => e.map((e) => e.kind === "authenticated" ? { authenticated: !0 } : e.kind === "policy" ? {
+	action: e.action,
+	resourceType: e.resourceType,
+	resource: () => e.resource ?? void 0
+} : {
+	scope: e.scope,
+	mode: e.mode,
+	...e.resource === null ? {} : { resource: () => e.resource ?? void 0 }
+}), j = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : e.kind === "authenticated" ? ["authenticated"] : [...e.scope]), M = (e) => {
+	let t = (e) => {
+		if (Array.isArray(e)) return e.map(t);
+		if (typeof e == "object" && e) {
+			let n = e, r = Object.create(null);
+			for (let e of Object.keys(n).sort()) r[e] = t(n[e]);
+			return r;
+		}
+		return e;
+	};
+	return JSON.stringify(t(e) ?? null);
+}, N = (e) => {
+	let t = [
+		e.procedure,
+		e.requestedBy ?? "",
+		e.tenantId ?? "",
+		e.payload,
+		e.nonce ?? ""
+	].map((e) => `${e.length}:${e}`).join("");
+	return d("sha256").update(t, "utf8").digest("hex");
+}, P = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), F = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, I = (e) => {
+	try {
+		let t = JSON.parse(String(e ?? "[]"));
+		return Array.isArray(t) ? t : [];
+	} catch {
+		return [];
+	}
+}, L = async (e, t) => (await e.query({
+	table: "_voltro_approvals",
+	predicate: n("intentKey", t),
+	order: []
+}))[0] ?? null, R = async (e, t) => (await e.query({
+	table: "_voltro_approvals",
+	predicate: n("id", t),
+	order: []
+}))[0] ?? null, z = async (e, t, n) => {
+	let r = String(t.intentKey ?? ""), i = r.includes("#") ? r : `${r}#${String(t.id)}`;
+	await e.update(T, String(t.id), {
+		...n,
+		intentKey: i
+	});
+}, B = (e) => {
+	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
+	if (t === null) return null;
+	let n = Number(t[1]);
+	if (!(Number.isFinite(n) && n > 0)) return null;
+	let r = t[2];
+	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
+}, V = (e) => {
+	let i = e.store, a = e.now ?? Date.now, o = e.defaultExpiryMs ?? 864e5;
+	O();
+	let s = (e) => {
+		if (e.expiresIn === void 0) return o;
+		let t = B(e.expiresIn);
+		if (t === null) throw Error(`requiresApproval.expiresIn must be an interval like '4h' / '30m' (got ${JSON.stringify(e.expiresIn)})`);
+		return t;
+	}, c = async (e, t, n) => {
+		let o = k(e.policy.approvers, e.input), c = r({
+			kind: "typeid",
+			prefix: "apv"
+		}, T), l = a();
+		await i.insertIgnore(T, {
+			id: c,
+			intentKey: t,
+			procedure: e.procedure,
+			kind: e.kind,
+			requestedBy: e.subject?.id ?? null,
+			tenantId: e.subject?.tenantId ?? null,
+			payload: n,
+			approverGuards: JSON.stringify(o),
+			approverScopes: JSON.stringify(j(o)),
+			reason: e.policy.reason ?? null,
+			status: "pending",
+			decidedBy: null,
+			decidedAt: null,
+			note: null,
+			traceId: e.traceId ?? null,
+			requestedAt: new Date(l),
+			expiresAt: new Date(l + s(e.policy)),
+			consumedAt: null
+		}, { conflictColumns: ["intentKey"] });
+		let u = await L(i, t);
+		if (u === null) throw new b({
+			procedure: e.procedure,
+			message: "the approval intent was written and could not be read back"
+		});
+		return u;
+	}, l = (e, t) => new v({
+		approvalId: String(e.id),
+		procedure: String(e.procedure),
+		expiresAt: P(e.expiresAt),
+		requiredScopes: j(I(e.approverGuards)),
+		reason: e.reason ?? null,
+		created: t
+	});
+	return { admit: async (e) => {
+		let r = M(e.input), o = N({
+			procedure: e.procedure,
+			requestedBy: e.subject?.id ?? null,
+			tenantId: e.subject?.tenantId ?? null,
+			payload: r,
+			nonce: e.nonce
+		}), s = await L(i, o);
+		if (s === null) throw l(await c(e, o, r), !0);
+		let u = String(s.status ?? "pending"), d = F(s.expiresAt);
+		if ((u === "pending" || u === "approved") && a() > d) throw await z(i, s, { status: "expired" }), new p({
+			approvalId: String(s.id),
+			expiredAt: P(s.expiresAt)
+		});
+		if (u === "pending") throw l(s, !1);
+		if (u === "rejected") throw await z(i, s, {}), new _({
+			approvalId: String(s.id),
+			decidedBy: s.decidedBy ?? null,
+			note: s.note ?? null
+		});
+		if (u === "approved") {
+			if (await i.updateMany("_voltro_approvals", {
+				status: "consumed",
+				consumedAt: new Date(a()),
+				intentKey: `${o}#${String(s.id)}`
+			}, { where: t(n("id", String(s.id)), n("status", "approved")) }) === 1) return;
+			throw s = await L(i, o), s === null ? l(await c(e, o, r), !0) : l(s, !1);
+		}
+		throw await z(i, s, {}), l(await c(e, o, r), !0);
+	} };
+}, H, U = (e) => {
+	H = e;
+}, W = () => H, G = () => {
+	H = void 0;
+}, K = async (e) => {
+	if (e.policy === void 0) return;
+	let t = W();
+	if (t === void 0) throw new b({
+		procedure: e.procedure,
+		message: `${e.procedure} declares \`requiresApproval\` and no approvals gate is installed on this boot path, so the framework cannot record the intent or verify a decision. Refusing the call rather than running it unapproved.`
+	});
+	await t.admit({
+		procedure: e.procedure,
+		kind: e.kind,
+		policy: e.policy,
+		subject: e.subject ?? null,
+		input: e.input,
+		...e.traceId === void 0 ? {} : { traceId: e.traceId }
+	});
+}, q = async (r, i) => {
+	let a = i.now ?? Date.now, o = await R(r, i.approvalId);
+	if (o === null) throw new h({ approvalId: i.approvalId });
+	let s = String(o.status ?? "pending");
+	if (s !== "pending") throw new g({
+		approvalId: i.approvalId,
+		status: s
+	});
+	if (a() > F(o.expiresAt)) throw await z(r, o, { status: "expired" }), new p({
+		approvalId: i.approvalId,
+		expiredAt: P(o.expiresAt)
+	});
+	let c = i.approver?.id ?? null;
+	if (c === null) throw new m({
+		approvalId: i.approvalId,
+		required: null,
+		message: "an approval decision needs an identified subject — an anonymous caller cannot be the second human"
+	});
+	if (c === (o.requestedBy ?? null)) throw new y({
+		approvalId: i.approvalId,
+		subjectId: c
+	});
+	let l = A(I(o.approverGuards)), u = await e.runPromise(x(i.approver, l, JSON.parse(String(o.payload ?? "null"))));
+	if (u) throw new m({
+		approvalId: i.approvalId,
+		required: "_tag" in u && u._tag === "ScopeError" ? u.required : null,
+		message: u.message
+	});
+	let d = i.decision === "approve" ? "approved" : "rejected";
+	if (await r.updateMany("_voltro_approvals", {
+		status: d,
+		decidedBy: c,
+		decidedAt: new Date(a()),
+		note: i.note ?? null
+	}, { where: t(n("id", i.approvalId), n("status", "pending")) }) !== 1) {
+		let e = await R(r, i.approvalId);
+		throw new g({
+			approvalId: i.approvalId,
+			status: String(e?.status ?? "unknown")
+		});
+	}
+	return {
+		approvalId: i.approvalId,
+		status: d
+	};
+}, J = async (t, n, r) => {
+	let i = n?.id ?? null;
+	if (i === null) return [];
+	let o = r?.now ?? Date.now, s = await t.query({
+		table: T,
+		predicate: a("status", ["pending", "approved"]),
+		order: []
+	}), c = [];
+	for (let t of s) {
+		if (o() > F(t.expiresAt)) continue;
+		let r = I(t.approverGuards), a = (t.requestedBy ?? null) === i, s = a ? "requested" : null;
+		a || await e.runPromise(x(n, A(r), JSON.parse(String(t.payload ?? "null")))) === null && String(t.status) === "pending" && (s = "to-decide"), s !== null && c.push({
+			id: String(t.id),
+			procedure: String(t.procedure),
+			kind: String(t.kind) === "action" ? "action" : "mutation",
+			requestedBy: t.requestedBy ?? null,
+			status: String(t.status ?? "pending"),
+			reason: t.reason ?? null,
+			requiredScopes: j(r),
+			requestedAt: P(t.requestedAt),
+			expiresAt: P(t.expiresAt),
+			decidedBy: t.decidedBy ?? null,
+			decidedAt: t.decidedAt == null ? null : P(t.decidedAt),
+			note: t.note ?? null,
+			relation: s
+		});
+	}
+	return c.sort((e, t) => t.requestedAt.localeCompare(e.requestedAt)).slice(0, r?.limit ?? 50);
+}, Y = () => f();
+//#endregion
+export { T as APPROVALS_TABLE, E as DEFAULT_APPROVAL_EXPIRY_MS, D as _voltroApprovalsTable, N as approvalIntentKey, Y as approvalNonce, M as canonicalJson, G as clearApprovalGate, q as decideApproval, K as enforceApproval, W as getApprovalGate, U as installApprovalGate, V as makeApprovalGate, B as parseApprovalInterval, J as pendingApprovalsFor, A as rehydrateGuards, j as scopeStringsOf, k as serializeGuards };

package/dist/authMiddlewareLayer.js

@@ -0,0 +1,47 @@
+import { applyConnectionCredential as e, getCredentialExpiry as t, recordCredentialExpiry as n } from "./connectionCredentials.js";
+import { Context as r, Effect as i, Layer as a, Option as o, Schema as s } from "effect";
+import { AuthMiddleware as c, ConnectionInfo as l, ConnectionInfoMiddleware as u, RequestedTenantRefused as d, SubjectService as f, Unauthenticated as p } from "@voltro/protocol";
+import { Rpc as m } from "effect/rpc";
+import { sessionExpiryFromHeaders as h } from "@voltro/protocol/session";
+//#region src/authMiddlewareLayer.ts
+var g = class extends r.Service()("@voltro/runtime/VerifiedCredentialLifetime") {}, _ = (e) => {
+	for (let t of e.requests.values()) if (m.isRpc(t) && [...t.middlewares].some((e) => e.key === c.key || e.key === u.key)) throw Error("withRpcAuthMiddleware requires a group without AuthMiddleware or ConnectionInfoMiddleware; apply the shared pair once");
+	return e.middleware(u).middleware(c);
+}, v = (r) => {
+	let m = /* @__PURE__ */ new WeakSet(), _ = c.of((t, a) => {
+		m.add(a);
+		let { headers: o, client: c, rpc: l } = a;
+		return i.tryPromise({
+			try: async () => {
+				let t = await r.resolveSubject({
+					headers: e(c.id, o),
+					clientId: c.id
+				});
+				return n(c.id, t.credentialExpiresAt), t;
+			},
+			catch: (e) => e
+		}).pipe(i.catch((e) => s.is(s.Union([p, d]))(e) ? i.fail(e) : i.die(e)), i.flatMap((e) => {
+			let t = e.subject;
+			if (t.type !== "service") return i.succeed(e);
+			let n = r.serviceCallersFor?.(l._tag);
+			return n !== void 0 && n.includes(t.service) ? i.succeed(e) : i.fail(new p({ reason: `service '${t.service}' is not a caller of '${l._tag}' — a service credential reaches only the procedures that list it in \`service: { callers }\`` }));
+		}), i.flatMap((e) => i.provideService(t, f, e.subject).pipe(i.provideService(g, {
+			request: a,
+			credentialExpiresAt: e.credentialExpiresAt
+		}))));
+	});
+	return a.mergeAll(a.succeed(c, _), a.succeed(u, u.of((n, r) => i.gen(function* () {
+		let { headers: n, client: a, rpc: s } = r, l = yield* i.serviceOption(g), u = o.filter(l, (e) => e.request === r);
+		if (o.isNone(u) && m.has(r) && [...s.middlewares].some((e) => e.key === c.key)) throw Error("RPC authentication must run before ConnectionInfoMiddleware; compose the group with withRpcAuthMiddleware");
+		let d = o.isSome(u) ? u.value.credentialExpiresAt : t(a.id) ?? h(e(a.id, n)), f = n["idempotency-key"], p = n["voltro-resume-from"], _ = n["voltro-reconcile"], v = p !== void 0 && /^\d+$/.test(p) ? Number(p) : void 0;
+		return {
+			clientId: a.id,
+			...f ? { idempotencyKey: f } : {},
+			...d === void 0 ? {} : { credentialExpiresAt: d },
+			...v !== void 0 && Number.isSafeInteger(v) ? { resumeFrom: v } : {},
+			..._ !== void 0 && /^[a-zA-Z0-9_-]{1,128}$/.test(_) ? { reconcile: _ } : {}
+		};
+	}).pipe(i.flatMap((e) => i.provideService(n, l, e))))));
+};
+//#endregion
+export { v as makeAuthMiddlewareLayers, _ as withRpcAuthMiddleware };