@voltro/runtime 0.86.0 → 0.88.0

package/dist/apiRoleWorkloadStorage.js

@@ -0,0 +1,94 @@
+import { API_ROLE_BUCKET_MS as e, API_ROLE_WINDOW_MS as t, assessApiRoleWorkloadWindow as n } from "./apiRoleWorkloadHistory.js";
+// src/apiRoleWorkloadStorage.ts
+var r = "_voltro_api_role_workload_buckets", i = 16384, a = (e) => e instanceof Date ? e.getTime() : typeof e == "number" ? e : NaN, o = async (e, t) => {
+	let a = Object.keys(t.workloads);
+	if (n({
+		now: Math.max(864e5, t.until),
+		replicaId: t.replicaId,
+		startedAt: t.startedAt,
+		role: t.role,
+		requiredWorkloads: a,
+		buckets: [t]
+	}).reason === "invalid-observation" || !t.replicaId || t.replicaId.length > 191 || t.role.length > 2080) throw Error("Invalid API role history bucket");
+	let o = JSON.stringify({
+		version: 1,
+		continuous: t.continuous,
+		workloads: t.workloads
+	});
+	if (new TextEncoder().encode(o).byteLength > i) throw Error("API role history payload too large");
+	await e.upsert(r, {
+		replicaId: t.replicaId,
+		startedAt: new Date(t.startedAt),
+		role: t.role,
+		bucketFrom: new Date(t.from),
+		bucketUntil: new Date(t.until),
+		payload: o
+	}, { conflictColumns: [
+		"replicaId",
+		"startedAt",
+		"bucketFrom"
+	] });
+}, s = async (o, s) => {
+	let c = n({
+		...s,
+		buckets: []
+	}), l = (await o.query({
+		table: r,
+		predicate: { and: [
+			{
+				column: "replicaId",
+				op: "eq",
+				value: s.replicaId
+			},
+			{
+				column: "startedAt",
+				op: "eq",
+				value: new Date(s.startedAt)
+			},
+			{
+				column: "role",
+				op: "eq",
+				value: s.role
+			},
+			{
+				column: "bucketFrom",
+				op: "gte",
+				value: new Date(c.from)
+			},
+			{
+				column: "bucketFrom",
+				op: "lt",
+				value: new Date(c.until)
+			}
+		] },
+		order: [{
+			column: "bucketFrom",
+			direction: "asc"
+		}],
+		take: t / e + 1,
+		skip: void 0,
+		projection: void 0
+	})).map((e) => {
+		if (typeof e.payload != "string" || new TextEncoder().encode(e.payload).byteLength > i) throw Error("Invalid API role history payload");
+		let t = JSON.parse(e.payload);
+		if (!t || t.version !== 1 || typeof t.continuous != "boolean" || !t.workloads || typeof t.workloads != "object" || Array.isArray(t.workloads)) throw Error("Invalid API role history payload");
+		return {
+			replicaId: String(e.replicaId),
+			startedAt: a(e.startedAt),
+			role: String(e.role),
+			from: a(e.bucketFrom),
+			until: a(e.bucketUntil),
+			continuous: t.continuous,
+			workloads: t.workloads
+		};
+	}), u = n({
+		...s,
+		buckets: l
+	});
+	if (u.reason === "invalid-observation") throw Error("Invalid API role history observations");
+	return {
+		buckets: l,
+		assessment: u
+	};
+};
+export { r as API_ROLE_WORKLOAD_BUCKETS_TABLE, s as readApiRoleWorkloadWindow, o as writeApiRoleWorkloadBucket };

package/dist/approvalBuiltins.js

@@ -1,10 +1,9 @@
 import { decideApproval as e, pendingApprovalsFor as t } from "./approvals.js";
-//#region src/approvalBuiltins.ts
+// src/approvalBuiltins.ts
 var n = (e) => e.request?.subject ?? null, r = async (e, r) => t(r.store, n(r), { limit: e.limit ?? 50 }), i = async (t, r) => e(r.store, {
 	approvalId: t.approvalId,
 	decision: t.decision,
 	approver: n(r),
 	...t.note === void 0 ? {} : { note: t.note }
 });
-//#endregion
 export { r as approvalsPendingExecutor, i as decideApprovalInvocation };

package/dist/approvals.js

@@ -1,9 +1,9 @@
 import { Effect as e } from "effect";
 import { and as t, eq as n, generateId as r, id as i, inSet as a, registerRetention as o, retentionTtlMsFromEnv as s, table as c, text as l, timestamp as u } from "@voltro/database";
 import { createHash as d, randomUUID as f } from "node:crypto";
-import { ApprovalExpired as p, ApprovalForbidden as m, ApprovalNotFound as h, ApprovalNotPending as g, ApprovalRejected as _, ApprovalRequired as v, ApprovalSelfApproval as y, ApprovalUnavailable as b, checkGuardsEffect as x, isAuthenticatedGuard as S, isPolicyGuard as C, resolvePolicyAction as w } from "@voltro/protocol";
-//#region src/approvals.ts
-var T = "_voltro_approvals", E = 864e5, D = c(T, {
+import { ApprovalExpired as p, ApprovalForbidden as m, ApprovalNotFound as h, ApprovalNotPending as g, ApprovalRejected as _, ApprovalRequired as v, ApprovalSelfApproval as y, ApprovalUnavailable as b, canonicalJson as x, checkGuardsEffect as S, isAuthenticatedGuard as C, isPolicyGuard as w, isUpgradedGuard as T, resolvePolicyAction as E, upgradedGuardShapeError as D } from "@voltro/protocol";
+// src/approvals.ts
+var O = "_voltro_approvals", k = 864e5, A = c(O, {
 	id: i({ prefix: "apv" }),
 	intentKey: l().maxLength(191),
 	procedure: l(),
@@ -22,24 +22,28 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 	requestedAt: u().default("now"),
 	expiresAt: u(),
 	consumedAt: u().nullable()
-}).index(["status", "expiresAt"]).index(["requestedBy"]), O = () => {
+}).index(["status", "expiresAt"]).index(["requestedBy"]), j = () => {
 	o({
 		source: "framework",
-		table: T,
+		table: O,
 		timeColumn: "requestedAt",
 		ttlMs: s(process.env.VOLTRO_APPROVALS_TTL_HOURS, 720)
 	});
-}, k = (e, t) => e.map((e) => S(e) ? { kind: "authenticated" } : C(e) ? {
-	kind: "policy",
-	action: w(e, t),
-	resourceType: e.resourceType,
-	resource: e.resource(t) ?? null
-} : {
-	kind: "scope",
-	scope: typeof e.scope == "string" ? [e.scope] : [...e.scope],
-	mode: e.mode ?? "all",
-	resource: e.resource?.(t) ?? null
-}), A = (e) => e.map((e) => e.kind === "authenticated" ? { authenticated: !0 } : e.kind === "policy" ? {
+}, M = (e, t) => e.map((e) => {
+	let n = D(e);
+	if (n) throw n;
+	return C(e) ? { kind: "authenticated" } : T(e) ? { kind: "upgraded" } : w(e) ? {
+		kind: "policy",
+		action: E(e, t),
+		resourceType: e.resourceType,
+		resource: e.resource(t) ?? null
+	} : {
+		kind: "scope",
+		scope: typeof e.scope == "string" ? [e.scope] : [...e.scope],
+		mode: e.mode ?? "all",
+		resource: e.resource?.(t) ?? null
+	};
+}), N = (e) => e.map((e) => e.kind === "authenticated" ? { authenticated: !0 } : e.kind === "upgraded" ? { upgraded: !0 } : e.kind === "policy" ? {
 	action: e.action,
 	resourceType: e.resourceType,
 	resource: () => e.resource ?? void 0
@@ -47,18 +51,7 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 	scope: e.scope,
 	mode: e.mode,
 	...e.resource === null ? {} : { resource: () => e.resource ?? void 0 }
-}), j = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : e.kind === "authenticated" ? ["authenticated"] : [...e.scope]), M = (e) => {
-	let t = (e) => {
-		if (Array.isArray(e)) return e.map(t);
-		if (typeof e == "object" && e) {
-			let n = e, r = Object.create(null);
-			for (let e of Object.keys(n).sort()) r[e] = t(n[e]);
-			return r;
-		}
-		return e;
-	};
-	return JSON.stringify(t(e) ?? null);
-}, N = (e) => {
+}), P = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : e.kind === "authenticated" ? ["authenticated"] : e.kind === "upgraded" ? ["upgraded"] : [...e.scope]), F = (e) => {
 	let t = [
 		e.procedure,
 		e.requestedBy ?? "",
@@ -67,48 +60,48 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 		e.nonce ?? ""
 	].map((e) => `${e.length}:${e}`).join("");
 	return d("sha256").update(t, "utf8").digest("hex");
-}, P = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), F = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, I = (e) => {
+}, I = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), L = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, R = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, L = async (e, t) => (await e.query({
+}, z = async (e, t) => (await e.query({
 	table: "_voltro_approvals",
 	predicate: n("intentKey", t),
 	order: []
-}))[0] ?? null, R = async (e, t) => (await e.query({
+}))[0] ?? null, B = async (e, t) => (await e.query({
 	table: "_voltro_approvals",
 	predicate: n("id", t),
 	order: []
-}))[0] ?? null, z = async (e, t, n) => {
+}))[0] ?? null, V = async (e, t, n) => {
 	let r = String(t.intentKey ?? ""), i = r.includes("#") ? r : `${r}#${String(t.id)}`;
-	await e.update(T, String(t.id), {
+	await e.update(O, String(t.id), {
 		...n,
 		intentKey: i
 	});
-}, B = (e) => {
+}, H = (e) => {
 	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
 	if (t === null) return null;
 	let n = Number(t[1]);
 	if (!(Number.isFinite(n) && n > 0)) return null;
 	let r = t[2];
 	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
-}, V = (e) => {
+}, U = (e) => {
 	let i = e.store, a = e.now ?? Date.now, o = e.defaultExpiryMs ?? 864e5;
-	O();
+	j();
 	let s = (e) => {
 		if (e.expiresIn === void 0) return o;
-		let t = B(e.expiresIn);
+		let t = H(e.expiresIn);
 		if (t === null) throw Error(`requiresApproval.expiresIn must be an interval like '4h' / '30m' (got ${JSON.stringify(e.expiresIn)})`);
 		return t;
 	}, c = async (e, t, n) => {
-		let o = k(e.policy.approvers, e.input), c = r({
+		let o = M(e.policy.approvers, e.input), c = r({
 			kind: "typeid",
 			prefix: "apv"
-		}, T), l = a();
-		await i.insertIgnore(T, {
+		}, O), l = a();
+		await i.insertIgnore(O, {
 			id: c,
 			intentKey: t,
 			procedure: e.procedure,
@@ -117,7 +110,7 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 			tenantId: e.subject?.tenantId ?? null,
 			payload: n,
 			approverGuards: JSON.stringify(o),
-			approverScopes: JSON.stringify(j(o)),
+			approverScopes: JSON.stringify(P(o)),
 			reason: e.policy.reason ?? null,
 			status: "pending",
 			decidedBy: null,
@@ -128,7 +121,7 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 			expiresAt: new Date(l + s(e.policy)),
 			consumedAt: null
 		}, { conflictColumns: ["intentKey"] });
-		let u = await L(i, t);
+		let u = await z(i, t);
 		if (u === null) throw new b({
 			procedure: e.procedure,
 			message: "the approval intent was written and could not be read back"
@@ -137,27 +130,27 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 	}, l = (e, t) => new v({
 		approvalId: String(e.id),
 		procedure: String(e.procedure),
-		expiresAt: P(e.expiresAt),
-		requiredScopes: j(I(e.approverGuards)),
+		expiresAt: I(e.expiresAt),
+		requiredScopes: P(R(e.approverGuards)),
 		reason: e.reason ?? null,
 		created: t
 	});
 	return { admit: async (e) => {
-		let r = M(e.input), o = N({
+		let r = x(e.input), o = F({
 			procedure: e.procedure,
 			requestedBy: e.subject?.id ?? null,
 			tenantId: e.subject?.tenantId ?? null,
 			payload: r,
 			nonce: e.nonce
-		}), s = await L(i, o);
+		}), s = await z(i, o);
 		if (s === null) throw l(await c(e, o, r), !0);
-		let u = String(s.status ?? "pending"), d = F(s.expiresAt);
-		if ((u === "pending" || u === "approved") && a() > d) throw await z(i, s, { status: "expired" }), new p({
+		let u = String(s.status ?? "pending"), d = L(s.expiresAt);
+		if ((u === "pending" || u === "approved") && a() > d) throw await V(i, s, { status: "expired" }), new p({
 			approvalId: String(s.id),
-			expiredAt: P(s.expiresAt)
+			expiredAt: I(s.expiresAt)
 		});
 		if (u === "pending") throw l(s, !1);
-		if (u === "rejected") throw await z(i, s, {}), new _({
+		if (u === "rejected") throw await V(i, s, {}), new _({
 			approvalId: String(s.id),
 			decidedBy: s.decidedBy ?? null,
 			note: s.note ?? null
@@ -168,17 +161,17 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 				consumedAt: new Date(a()),
 				intentKey: `${o}#${String(s.id)}`
 			}, { where: t(n("id", String(s.id)), n("status", "approved")) }) === 1) return;
-			throw s = await L(i, o), s === null ? l(await c(e, o, r), !0) : l(s, !1);
+			throw s = await z(i, o), s === null ? l(await c(e, o, r), !0) : l(s, !1);
 		}
-		throw await z(i, s, {}), l(await c(e, o, r), !0);
+		throw await V(i, s, {}), l(await c(e, o, r), !0);
 	} };
-}, H, U = (e) => {
-	H = e;
-}, W = () => H, G = () => {
-	H = void 0;
-}, K = async (e) => {
+}, W, G = (e) => {
+	W = e;
+}, K = () => W, q = () => {
+	W = void 0;
+}, J = async (e) => {
 	if (e.policy === void 0) return;
-	let t = W();
+	let t = K();
 	if (t === void 0) throw new b({
 		procedure: e.procedure,
 		message: `${e.procedure} declares \`requiresApproval\` and no approvals gate is installed on this boot path, so the framework cannot record the intent or verify a decision. Refusing the call rather than running it unapproved.`
@@ -191,17 +184,17 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 		input: e.input,
 		...e.traceId === void 0 ? {} : { traceId: e.traceId }
 	});
-}, q = async (r, i) => {
-	let a = i.now ?? Date.now, o = await R(r, i.approvalId);
+}, Y = async (r, i) => {
+	let a = i.now ?? Date.now, o = await B(r, i.approvalId);
 	if (o === null) throw new h({ approvalId: i.approvalId });
 	let s = String(o.status ?? "pending");
 	if (s !== "pending") throw new g({
 		approvalId: i.approvalId,
 		status: s
 	});
-	if (a() > F(o.expiresAt)) throw await z(r, o, { status: "expired" }), new p({
+	if (a() > L(o.expiresAt)) throw await V(r, o, { status: "expired" }), new p({
 		approvalId: i.approvalId,
-		expiredAt: P(o.expiresAt)
+		expiredAt: I(o.expiresAt)
 	});
 	let c = i.approver?.id ?? null;
 	if (c === null) throw new m({
@@ -213,7 +206,7 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 		approvalId: i.approvalId,
 		subjectId: c
 	});
-	let l = A(I(o.approverGuards)), u = await e.runPromise(x(i.approver, l, JSON.parse(String(o.payload ?? "null"))));
+	let l = N(R(o.approverGuards)), u = await e.runPromise(S(i.approver, l, JSON.parse(String(o.payload ?? "null"))));
 	if (u) throw new m({
 		approvalId: i.approvalId,
 		required: "_tag" in u && u._tag === "ScopeError" ? u.required : null,
@@ -226,7 +219,7 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 		decidedAt: new Date(a()),
 		note: i.note ?? null
 	}, { where: t(n("id", i.approvalId), n("status", "pending")) }) !== 1) {
-		let e = await R(r, i.approvalId);
+		let e = await B(r, i.approvalId);
 		throw new g({
 			approvalId: i.approvalId,
 			status: String(e?.status ?? "unknown")
@@ -236,34 +229,33 @@ var T = "_voltro_approvals", E = 864e5, D = c(T, {
 		approvalId: i.approvalId,
 		status: d
 	};
-}, J = async (t, n, r) => {
+}, X = async (t, n, r) => {
 	let i = n?.id ?? null;
 	if (i === null) return [];
 	let o = r?.now ?? Date.now, s = await t.query({
-		table: T,
+		table: O,
 		predicate: a("status", ["pending", "approved"]),
 		order: []
 	}), c = [];
 	for (let t of s) {
-		if (o() > F(t.expiresAt)) continue;
-		let r = I(t.approverGuards), a = (t.requestedBy ?? null) === i, s = a ? "requested" : null;
-		a || await e.runPromise(x(n, A(r), JSON.parse(String(t.payload ?? "null")))) === null && String(t.status) === "pending" && (s = "to-decide"), s !== null && c.push({
+		if (o() > L(t.expiresAt)) continue;
+		let r = R(t.approverGuards), a = (t.requestedBy ?? null) === i, s = a ? "requested" : null;
+		a || await e.runPromise(S(n, N(r), JSON.parse(String(t.payload ?? "null")))) === null && String(t.status) === "pending" && (s = "to-decide"), s !== null && c.push({
 			id: String(t.id),
 			procedure: String(t.procedure),
 			kind: String(t.kind) === "action" ? "action" : "mutation",
 			requestedBy: t.requestedBy ?? null,
 			status: String(t.status ?? "pending"),
 			reason: t.reason ?? null,
-			requiredScopes: j(r),
-			requestedAt: P(t.requestedAt),
-			expiresAt: P(t.expiresAt),
+			requiredScopes: P(r),
+			requestedAt: I(t.requestedAt),
+			expiresAt: I(t.expiresAt),
 			decidedBy: t.decidedBy ?? null,
-			decidedAt: t.decidedAt == null ? null : P(t.decidedAt),
+			decidedAt: t.decidedAt == null ? null : I(t.decidedAt),
 			note: t.note ?? null,
 			relation: s
 		});
 	}
 	return c.sort((e, t) => t.requestedAt.localeCompare(e.requestedAt)).slice(0, r?.limit ?? 50);
-}, Y = () => f();
-//#endregion
-export { T as APPROVALS_TABLE, E as DEFAULT_APPROVAL_EXPIRY_MS, D as _voltroApprovalsTable, N as approvalIntentKey, Y as approvalNonce, M as canonicalJson, G as clearApprovalGate, q as decideApproval, K as enforceApproval, W as getApprovalGate, U as installApprovalGate, V as makeApprovalGate, B as parseApprovalInterval, J as pendingApprovalsFor, A as rehydrateGuards, j as scopeStringsOf, k as serializeGuards };
+}, Z = () => f();
+export { O as APPROVALS_TABLE, k as DEFAULT_APPROVAL_EXPIRY_MS, A as _voltroApprovalsTable, F as approvalIntentKey, Z as approvalNonce, x as canonicalJson, q as clearApprovalGate, Y as decideApproval, J as enforceApproval, K as getApprovalGate, G as installApprovalGate, U as makeApprovalGate, H as parseApprovalInterval, X as pendingApprovalsFor, N as rehydrateGuards, P as scopeStringsOf, M as serializeGuards };

package/dist/authMiddlewareLayer.js

@@ -3,7 +3,7 @@ import { Context as r, Effect as i, Layer as a, Option as o, Schema as s } from
 import { AuthMiddleware as c, ConnectionInfo as l, ConnectionInfoMiddleware as u, RequestedTenantRefused as d, SubjectService as f, Unauthenticated as p } from "@voltro/protocol";
 import { Rpc as m } from "effect/rpc";
 import { sessionExpiryFromHeaders as h } from "@voltro/protocol/session";
-//#region src/authMiddlewareLayer.ts
+// src/authMiddlewareLayer.ts
 var g = class extends r.Service()("@voltro/runtime/VerifiedCredentialLifetime") {}, _ = (e) => {
 	for (let t of e.requests.values()) if (m.isRpc(t) && [...t.middlewares].some((e) => e.key === c.key || e.key === u.key)) throw Error("withRpcAuthMiddleware requires a group without AuthMiddleware or ConnectionInfoMiddleware; apply the shared pair once");
 	return e.middleware(u).middleware(c);
@@ -33,15 +33,15 @@ var g = class extends r.Service()("@voltro/runtime/VerifiedCredentialLifetime")
 	return a.mergeAll(a.succeed(c, _), a.succeed(u, u.of((n, r) => i.gen(function* () {
 		let { headers: n, client: a, rpc: s } = r, l = yield* i.serviceOption(g), u = o.filter(l, (e) => e.request === r);
 		if (o.isNone(u) && m.has(r) && [...s.middlewares].some((e) => e.key === c.key)) throw Error("RPC authentication must run before ConnectionInfoMiddleware; compose the group with withRpcAuthMiddleware");
-		let d = o.isSome(u) ? u.value.credentialExpiresAt : t(a.id) ?? h(e(a.id, n)), f = n["idempotency-key"], p = n["voltro-resume-from"], _ = n["voltro-reconcile"], v = p !== void 0 && /^\d+$/.test(p) ? Number(p) : void 0;
+		let d = o.isSome(u) ? u.value.credentialExpiresAt : t(a.id) ?? h(e(a.id, n)), f = e(a.id, n).cookie, p = n["idempotency-key"], _ = n["voltro-resume-from"], v = n["voltro-reconcile"], y = _ !== void 0 && /^\d+$/.test(_) ? Number(_) : void 0;
 		return {
 			clientId: a.id,
-			...f ? { idempotencyKey: f } : {},
+			...f === void 0 ? {} : { cookieHeader: f },
+			...p ? { idempotencyKey: p } : {},
 			...d === void 0 ? {} : { credentialExpiresAt: d },
-			...v !== void 0 && Number.isSafeInteger(v) ? { resumeFrom: v } : {},
-			..._ !== void 0 && /^[a-zA-Z0-9_-]{1,128}$/.test(_) ? { reconcile: _ } : {}
+			...y !== void 0 && Number.isSafeInteger(y) ? { resumeFrom: y } : {},
+			...v !== void 0 && /^[a-zA-Z0-9_-]{1,128}$/.test(v) ? { reconcile: v } : {}
 		};
 	}).pipe(i.flatMap((e) => i.provideService(n, l, e))))));
-};
-//#endregion
-export { v as makeAuthMiddlewareLayers, _ as withRpcAuthMiddleware };
+}, y = (e) => a.succeed(u, u.of((t, { headers: n, client: r }) => i.sync(() => (e(n, r.id), { clientId: r.id })).pipe(i.flatMap((e) => i.provideService(t, l, e)))));
+export { v as makeAuthMiddlewareLayers, y as observeConnectionHeaders, _ as withRpcAuthMiddleware };

package/dist/bindEvent.js

@@ -2,9 +2,9 @@ import { recordEventDelivered as e, recordEventDropped as t } from "./metrics.js
 import { registerConnectionStream as n } from "./connectionCredentials.js";
 import { boundByCredential as r } from "./credentialBound.js";
 import { Effect as i, Queue as a, Stream as o } from "effect";
-import { ConnectionInfo as s, SubjectService as c, checkGuardsEffect as l, isOpenAccess as u, recheckGuardsEffect as d } from "@voltro/protocol";
-//#region src/bindEvent.ts
-var f = 64, p = 1, m = (e) => e.kind === "gap" ? {
+import { ConnectionInfo as s, ScopeError as c, SubjectService as l, checkGuardsEffect as u, isOpenAccess as d, recheckGuardsEffect as f } from "@voltro/protocol";
+// src/bindEvent.ts
+var p = 64, m = 1, h = (e) => e.kind === "gap" ? {
 	_tag: "gap",
 	missed: e.missed,
 	reason: e.reason
@@ -14,49 +14,69 @@ var f = 64, p = 1, m = (e) => e.kind === "gap" ? {
 	n: e.envelope.n,
 	emittedAt: e.envelope.emittedAt,
 	payload: e.envelope.payload
-}, h = (e) => {
+}, g = (e) => {
 	let t = new Map(e ?? []);
 	return (e, n = 0) => {
 		let r = t.get(e.origin) ?? 0;
 		return t.set(e.origin, Math.max(r, e.n)), r === 0 && n === 0 ? 0 : Math.max(0, e.n - r - 1);
 	};
-}, g = (f) => o.unwrap(i.gen(function* () {
-	let p = yield* c, g = yield* s, _ = p.tenantId ?? null, v = f.guards === void 0 ? void 0 : f.guards.filter((e) => !u(e));
-	if (v !== void 0 && v.length > 0 || p.type === "service") {
-		let e = yield* l(p, v ?? [], f.key);
+}, _ = (p) => o.unwrap(i.gen(function* () {
+	let m = yield* l, _ = yield* s, v = m.tenantId ?? null, y = p.guards === void 0 ? void 0 : p.guards.filter((e) => !d(e));
+	if (y !== void 0 && y.length > 0 || m.type === "service") {
+		let e = yield* u(m, y ?? [], p.key);
 		if (e) return yield* i.fail(e);
 	}
-	let y = f.bus.deliveryFor(f.event) === "latest", b = yield* a.sliding(f.queueSize ?? (y ? 1 : 64)), x = /* @__PURE__ */ new Map(), S = f.bus.subscribe({
-		tenantId: _,
-		event: f.event,
-		key: f.key,
-		options: f.options,
+	let b = p.clientPolicy, x = () => new c({
+		required: p.requiredClientPolicy ?? "event:client-policy",
+		message: "event client access denied"
+	});
+	if (p.requiredClientPolicy !== void 0 && (!b || b.id !== p.requiredClientPolicy) || b !== void 0 && p.requiredClientPolicy === void 0) return yield* i.fail(x());
+	let S = () => ({
+		subject: structuredClone(m),
+		event: p.event,
+		key: structuredClone(p.key)
+	}), C = () => b === void 0 ? i.succeed(!0) : i.suspend(() => b.admit(S())).pipe(i.catch(() => i.succeed(!1)), i.catchDefect(() => i.succeed(!1)), i.map((e) => e === !0)), w = b?.monitor === void 0 ? void 0 : yield* i.suspend(() => b.monitor(S())).pipe(i.catch(() => i.fail(x())), i.catchDefect(() => i.fail(x())));
+	if (!(yield* C())) return yield* i.fail(x());
+	let T = p.bus.deliveryFor(p.event) === "latest", E = yield* a.sliding(p.queueSize ?? (T ? 1 : 64)), D = /* @__PURE__ */ new Map(), O = p.bus.subscribe({
+		tenantId: v,
+		event: p.event,
+		key: p.key,
+		options: p.options,
 		onAttach: (e) => {
-			x = e;
+			D = e;
 		},
 		listener: (e) => {
-			i.runSync(a.offer(b, e));
+			i.runSync(a.offer(E, e));
 		}
 	});
 	if (yield* i.addFinalizer(() => i.sync(() => {
-		S();
-	})), g.clientId !== void 0) {
-		let e = n(g.clientId, () => {
-			i.runPromise(a.shutdown(b));
+		O();
+	})), _.clientId !== void 0) {
+		let e = n(_.clientId, () => {
+			i.runPromise(a.shutdown(E));
 		});
 		yield* i.addFinalizer(() => i.sync(() => {
 			e();
 		}));
 	}
-	let C = y ? () => 0 : h(x), w = () => d(p, v, f.key), T = o.fromQueue(b).pipe(o.flatMap((e) => o.unwrap(w().pipe(i.map((t) => t ? o.fail(t) : E(e))))));
-	function E(n) {
+	let k = T ? () => 0 : g(D), A = () => f(m, y, p.key), j = o.fromQueue(E).pipe(o.flatMap((e) => o.unwrap(A().pipe(i.map((t) => t ? o.fail(t) : M(e))))), o.ensuring(a.shutdown(E)));
+	function M(e) {
+		if (b === void 0) return N(e);
+		let t = e.kind === "gap" ? C().pipe(i.map((e) => e ? "allow" : "deny")) : i.suspend(() => b.deliver({
+			...S(),
+			payload: structuredClone(e.envelope.payload),
+			emittedAt: e.envelope.emittedAt
+		})).pipe(i.catch(() => i.succeed("deny")), i.catchDefect(() => i.succeed("deny")));
+		return o.unwrap(t.pipe(i.map((t) => t === "allow" ? N(e) : t === "drop" && e.kind !== "gap" ? (k(e.envelope, e.prior), o.empty) : o.fail(x()))));
+	}
+	function N(n) {
 		return o.suspend(() => {
-			if (n.kind === "gap") return o.make(m(n));
-			let r = C(n.envelope, n.prior);
-			e(f.event);
-			let i = m(n);
+			if (n.kind === "gap") return o.make(h(n));
+			let r = k(n.envelope, n.prior);
+			e(p.event);
+			let i = h(n);
 			if (r === 0) return o.make(i);
-			t(f.event, "buffer", r);
+			t(p.event, "buffer", r);
 			let a = {
 				_tag: "gap",
 				missed: r,
@@ -65,8 +85,7 @@ var f = 64, p = 1, m = (e) => e.kind === "gap" ? {
 			return o.fromIterable([a, i]);
 		});
 	}
-	let D = { _tag: "attached" };
-	return r(o.concat(o.fromIterable([D]), T), g.credentialExpiresAt, o.fromIterable([D]));
+	let P = { _tag: "attached" }, F = o.concat(o.fromIterable([P]), j), I = w === void 0 ? F : F.pipe(o.interruptWhen(w.pipe(i.catch(() => i.void), i.catchDefect(() => i.void), i.flatMap(() => i.fail(x())))));
+	return r(I, _.credentialExpiresAt, o.fromIterable([P]));
 }));
-//#endregion
-export { f as EVENT_CLIENT_QUEUE_SIZE, p as EVENT_LATEST_QUEUE_SIZE, g as bindEvent, h as makeBufferGapDetector };
+export { p as EVENT_CLIENT_QUEUE_SIZE, m as EVENT_LATEST_QUEUE_SIZE, _ as bindEvent, g as makeBufferGapDetector };

package/dist/boot-refusal.d.ts

@@ -0,0 +1,10 @@
+export declare const BOOT_REFUSAL_NAME = "VoltroBootRefusal";
+
+/** An error the boot path raised on purpose. The launcher prints its message
+ *  once and exits 1 instead of degrading to a fallback path or printing a
+ *  stack. */
+export declare const bootRefusal: (message: string) => Error;
+
+export declare const isBootRefusal: (error: unknown) => boolean;
+
+export { }

package/dist/{bootRefusal.js → boot-refusal.js}

@@ -1,7 +1,6 @@
-//#region src/bootRefusal.ts
+// src/bootRefusal.ts
 var e = "VoltroBootRefusal", t = (t) => {
 	let n = Error(t);
 	return n.name = e, n;
 }, n = (e) => typeof e == "object" && !!e && e.name === "VoltroBootRefusal";
-//#endregion
 export { e as BOOT_REFUSAL_NAME, t as bootRefusal, n as isBootRefusal };