@voltro/protocol 0.1.0

package/dist/rest.js

@@ -0,0 +1,142 @@
+import { s as e } from "./auth-DCE6m7Bo.js";
+import { a as t, i as n, o as r, r as i, t as a } from "./serverErrorBus-C1KVL0dr.js";
+import { Effect as o, Schema as s } from "effect";
+//#region src/publicApi.ts
+var c = (e, t) => t.method ?? (e === "query" ? "GET" : "POST"), l = (e, t) => t.path ?? `/${t.version ?? "v1"}/${e.replace(/\./g, "/")}`, u = (e, t) => {
+	let n = e.publicApi;
+	if (n === void 0) throw Error(`publicApiRoute: descriptor '${e.name}' has no publicApi annotation`);
+	let r = c(e.kind, n), i = l(e.name, n), a = r === "GET" ? "query" : "body", o = s.Struct({ [a]: e.input }), u = (n.scopes ?? []).map((e) => f(e));
+	return p({
+		method: r,
+		path: i,
+		input: o,
+		output: e.output,
+		handler: (e, n) => t(e[a], n),
+		...u.length > 0 ? { guards: u } : {},
+		...n.summary === void 0 ? {} : { summary: n.summary },
+		...n.description === void 0 ? {} : { description: n.description },
+		...n.deprecated === void 0 ? {} : { deprecated: n.deprecated },
+		...n.sunset === void 0 ? {} : { sunset: n.sunset }
+	});
+}, d = (e) => e.filter((e) => e.descriptor.publicApi !== void 0).map((e) => u(e.descriptor, e.invoke)).sort((e, t) => e.path.localeCompare(t.path)), f = (e) => (t) => {
+	let n = t.subject.scopes;
+	if (!(n && (n.includes(e) || n.includes("admin:full")))) return {
+		status: 403,
+		message: `Missing required scope: ${e}`
+	};
+}, p = (e) => e, m = (e, t, n) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t),
+	...n ? { headers: n } : {}
+}), h = (e) => {
+	if (e.length === 0) return;
+	let t = new TextDecoder().decode(e);
+	if (t.trim() !== "") return JSON.parse(t);
+}, g = (e) => {
+	let t = {};
+	for (let [n, r] of new URLSearchParams(e)) t[n] = r;
+	return t;
+}, _ = (e, t) => {
+	let n = e.split("/").filter((e) => e.length > 0), r = t.split("/").filter((e) => e.length > 0), i = {};
+	for (let e = 0; e < n.length; e++) {
+		let t = n[e];
+		if (t !== void 0 && t.startsWith(":")) {
+			let n = r[e];
+			if (n !== void 0) try {
+				i[t.slice(1)] = decodeURIComponent(n);
+			} catch {
+				i[t.slice(1)] = n;
+			}
+		}
+	}
+	return i;
+}, v = (e, t) => ({
+	query: g(e.query),
+	params: t,
+	body: h(e.rawBody)
+}), y = /* @__PURE__ */ new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]), b = (c, l) => {
+	let u = c.input ? s.decodeUnknown(c.input) : void 0, d = s.encode(c.output), f = {};
+	return c.deprecated !== void 0 && (f.Deprecation = "true"), c.sunset !== void 0 && (f.Sunset = c.sunset), {
+		method: "*",
+		path: c.path,
+		handle: async (s) => {
+			if (s.method.toUpperCase() !== c.method) return m(405, {
+				error: "Method Not Allowed",
+				allow: c.method
+			}, {
+				...f,
+				Allow: c.method
+			});
+			if (c.sunset !== void 0) {
+				let e = Date.parse(c.sunset);
+				if (!Number.isNaN(e) && Date.now() >= e) return m(410, {
+					error: "Gone",
+					...c.deprecated === void 0 ? {} : { replacement: c.deprecated }
+				}, f);
+			}
+			let p;
+			if (u) {
+				let e = v(s, _(c.path, s.path)), t = await o.runPromise(u(e).pipe(o.map((e) => ({
+					ok: !0,
+					value: e
+				})), o.catchAll((e) => o.succeed({
+					ok: !1,
+					cause: e
+				}))));
+				if (!t.ok) return m(400, {
+					error: "Invalid request",
+					detail: String(t.cause)
+				}, f);
+				p = t.value;
+			}
+			let h = l.resolveSubject ? await l.resolveSubject(s.headers) : e(s.headers["x-tenant"] ?? null), g = {
+				subject: h,
+				headers: s.headers,
+				store: l.store
+			};
+			if (c.guards) for (let e of c.guards) {
+				let t = await e(g);
+				if (t) return m(t.status, { error: t.message }, f);
+			}
+			let b = l.idempotency, x = b && y.has(c.method) ? s.headers[b.header.toLowerCase()] : void 0, S = b && x ? r(h.tenantId, c.method, c.path) : "";
+			if (b && x) {
+				let e = await i(b.store, S, x, b.ttlMs, Date.now());
+				if (e.kind === "replay") return m(e.response.status, e.response.body, {
+					...f,
+					"Idempotency-Replayed": "true"
+				});
+				if (e.kind === "conflict") return m(409, { error: "A request with this Idempotency-Key is already being processed" }, f);
+			}
+			try {
+				let e = await c.handler(p, g), n = await o.runPromise(d(e));
+				return b && x && await t(b.store, S, x, {
+					status: 200,
+					body: n
+				}, Date.now()), m(200, n, f);
+			} catch (e) {
+				if (b && x && await n(b.store, S, x), typeof e == "object" && e && typeof e.status == "number") {
+					let t = e;
+					return m(t.status, { error: t.message ?? "Error" }, f);
+				}
+				return a({
+					error: e,
+					source: "rest",
+					name: `${c.method} ${c.path}`,
+					fields: { status: 500 }
+				}), m(500, { error: "Internal Server Error" }, f);
+			}
+		}
+	};
+}, x = (e, t = {}) => e.map((e) => b(e, t)), S = async (e, t) => {
+	let n = await e[0].handle(t);
+	for (let r = 1; r < e.length && n.status === 405; r++) n = await e[r].handle(t);
+	return n;
+};
+//#endregion
+export { d as collectPublicApiRoutes, p as defineRestRoute, c as derivePublicMethod, l as derivePublicPath, S as dispatchSharedPath, _ as matchPathParams, u as publicApiRoute, f as requireScope, x as restRoutesToHttpRoutes };

package/dist/session.d.ts

@@ -0,0 +1,262 @@
+import { Schema } from 'effect';
+
+/**
+ * Fail-closed check that a real session secret is configured. Throws a plain
+ * `Error` (a fatal boot condition, not a wire error) when `NODE_ENV` is
+ * `'production'` and `VOLTRO_SESSION_SECRET` is missing, the dev fallback, or
+ * too short. No-op otherwise. Idempotent — safe to call from every prod entry.
+ */
+export declare const assertProductionSessionSecret: (env?: NodeJS.ProcessEnv) => void;
+
+/**
+ * Build a `Set-Cookie` header value. Pure helper — the caller adds it
+ * to the actual HTTP response. Used by the framework's login route
+ * pattern + by user code that wants to set its own cookies during a
+ * mutation/action.
+ */
+export declare const buildSetCookie: (name: string, value: string, options?: SetCookieOptions) => string;
+
+/**
+ * Check an `Authorization: Bearer <token>` header against an expected token.
+ *
+ *   - `expected` unset/empty → `true` (no token configured = open; the caller
+ *     decided not to gate this surface).
+ *   - header absent, or not using the `Bearer ` scheme → `false`.
+ *   - presented token compared to `expected` in CONSTANT TIME.
+ *
+ * `headers` keys may be any casing (`authorization` / `Authorization`).
+ */
+export declare const checkBearer: (headers: Readonly<Record<string, string | undefined>>, expected: string | undefined) => boolean;
+
+/** Key id assigned to `VOLTRO_SESSION_SECRET_PREVIOUS` when no explicit
+ *  `VOLTRO_SESSION_KID_PREVIOUS` is set. The kid is a non-secret label —
+ *  rotation works with just the `_PREVIOUS` secret var. */
+export declare const DEFAULT_PREVIOUS_SESSION_KID: "k-previous";
+
+/** Key id stamped for bare-string secrets / when `VOLTRO_SESSION_KID` is
+ *  unset. Exported so callers building a `SessionSecrets` from a plain
+ *  string produce the same label the resolver would. */
+export declare const DEFAULT_SESSION_KID: "k0";
+
+/** A keyed signing secret. `kid` is stamped into the payload on sign and
+ *  matched on verify; it's an opaque, non-secret label (e.g. `'2026-06'`). */
+export declare interface KeyedSecret {
+    readonly kid: string;
+    readonly secret: string;
+}
+
+/** Minimum length we accept for a production session secret. 32 bytes of
+ *  entropy is the floor for HMAC-SHA256; shorter values are almost always
+ *  hand-typed placeholders, not real secrets. */
+export declare const MIN_SESSION_SECRET_LENGTH: 32;
+
+/**
+ * Read a cookie value by name from a `Cookie:` header string.
+ * Returns undefined if the cookie isn't present.
+ */
+export declare const readCookie: (header: string | undefined, name: string) => string | undefined;
+
+/** Resolve the HMAC session secret with the dev fallback applied. */
+export declare const resolveSessionSecret: () => string;
+
+/**
+ * Resolve the keyed session-secret set for multi-key rotation.
+ *
+ *   - `current` is built from `VOLTRO_SESSION_SECRET` (dev fallback
+ *     applied), keyed `VOLTRO_SESSION_KID` (defaults to `'k0'`).
+ *   - `previous` is built from `VOLTRO_SESSION_SECRET_PREVIOUS`, keyed
+ *     `VOLTRO_SESSION_KID_PREVIOUS` (defaults to `'k-previous'` — the kid
+ *     is a non-secret label, so rotation needs only the secret var).
+ *     During a rotation window you set the new secret as current and move
+ *     the old one into `VOLTRO_SESSION_SECRET_PREVIOUS`; sessions signed
+ *     with the old key keep verifying until they expire, then you drop
+ *     the `_PREVIOUS` var.
+ *
+ * Sign always uses `current`. Verify tries `current` first, then
+ * `previous` if present.
+ */
+export declare const resolveSessionSecrets: () => SessionSecrets;
+
+export declare type SessionPayload = typeof SessionPayload_2.Type;
+
+declare const SessionPayload_2: Schema.Struct<{
+    subject: Schema.Union<[Schema.Struct<{
+        type: Schema.Literal<["user"]>;
+        id: typeof Schema.String;
+        tenantId: typeof Schema.String;
+        scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    }>, Schema.Struct<{
+        type: Schema.Literal<["apiKey"]>;
+        id: typeof Schema.String;
+        tenantId: typeof Schema.String;
+        scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    }>, Schema.Struct<{
+        type: Schema.Literal<["serviceAccount"]>;
+        id: typeof Schema.String;
+        tenantId: typeof Schema.String;
+        scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    }>, Schema.Struct<{
+        type: Schema.Literal<["anonymous"]>;
+        id: typeof Schema.Null;
+        tenantId: Schema.NullOr<typeof Schema.String>;
+    }>, Schema.Struct<{
+        type: Schema.Literal<["system"]>;
+        id: typeof Schema.String;
+        tenantId: typeof Schema.Null;
+        scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    }>]>;
+    /** Unix seconds when this session expires. Verify rejects past expiry. */
+    exp: typeof Schema.Number;
+    /** Unix seconds when this session was issued. Drives sliding-window
+     *  auto-renewal: verify signals a renew once `now - iat` passes the
+     *  renewal threshold (default 70% of the session's lifetime). */
+    iat: typeof Schema.Number;
+    /** Key id of the signing secret. Stamped from the current key on sign;
+     *  read on verify to pick which secret to check first. Absent on
+     *  values minted with a bare-string secret (single-key path). */
+    kid: Schema.optional<typeof Schema.String>;
+}>;
+
+declare type SessionPayload = typeof SessionPayload_2.Type;
+
+/** The resolved secret set: `current` always signs; `previous` is accepted
+ *  on verify during a rotation window. */
+export declare interface SessionSecrets {
+    readonly current: KeyedSecret;
+    readonly previous?: KeyedSecret;
+}
+
+export declare interface SetCookieOptions {
+    /** Cookie path. Default `/`. */
+    readonly path?: string;
+    /** Max-Age in seconds. Omit for a session cookie that clears on
+     *  browser close. Set 0 (or a past date) to delete. */
+    readonly maxAgeSeconds?: number;
+    /** Defaults to true. Block JS access to the cookie. */
+    readonly httpOnly?: boolean;
+    /** Defaults to 'lax'. Use 'strict' for higher-security flows. */
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+    /** Defaults to true. Required when sameSite='none'. */
+    readonly secure?: boolean;
+    /** Cookie domain. Omit to scope to the current host. */
+    readonly domain?: string;
+}
+
+export declare interface SignOptions {
+    /** TTL in seconds. Defaults to 7 days. */
+    readonly ttlSeconds?: number;
+    /** Clock override (epoch milliseconds). Defaults to `Date.now`. A
+     *  testing seam — lets suites mint back-dated sessions to exercise the
+     *  sliding-window renewal without wall-clock sleeps. */
+    readonly now?: () => number;
+}
+
+/**
+ * Mint a signed session cookie value for the given subject. Returns the
+ * value you'd put in `Set-Cookie: <name>=<value>; HttpOnly; SameSite=Lax;
+ * Secure; Path=/; Max-Age=<ttl>`.
+ *
+ * `secret` accepts either a bare string (single-key path — the `kid` is
+ * omitted from the payload) or a `KeyedSecret` (multi-key rotation — the
+ * `kid` is stamped so verify can pick the matching key first).
+ *
+ * The cookie value itself is opaque — clients can read it but can't
+ * forge a new one without the secret. `HttpOnly` blocks JS access for
+ * defence-in-depth; the verify side doesn't care whether the client
+ * could read it.
+ */
+export declare const signSession: (subject: Subject, secret: string | KeyedSecret, options?: SignOptions) => string;
+
+declare const Subject: Schema.Union<[Schema.Struct<{
+    type: Schema.Literal<["user"]>;
+    id: typeof Schema.String;
+    tenantId: typeof Schema.String;
+    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["apiKey"]>;
+    id: typeof Schema.String;
+    tenantId: typeof Schema.String;
+    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["serviceAccount"]>;
+    id: typeof Schema.String;
+    tenantId: typeof Schema.String;
+    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["anonymous"]>;
+    id: typeof Schema.Null;
+    tenantId: Schema.NullOr<typeof Schema.String>;
+}>, Schema.Struct<{
+    type: Schema.Literal<["system"]>;
+    id: typeof Schema.String;
+    tenantId: typeof Schema.Null;
+    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+}>]>;
+
+declare type Subject = typeof Subject.Type;
+
+/**
+ * Constant-time string equality via `timingSafeEqual`. Returns false fast
+ * on a length mismatch (the lengths aren't secret); only equal-length inputs
+ * reach the timing-safe compare, so an attacker can't recover the secret a
+ * byte at a time from the response time.
+ */
+export declare const timingSafeStringEqual: (a: string, b: string) => boolean;
+
+export declare interface VerifyOptions {
+    /** Fraction of [iat, exp] after which `renew` flips true. Default 0.7. */
+    readonly renewFraction?: number;
+    /** Clock override (epoch milliseconds). Defaults to `Date.now`. */
+    readonly now?: () => number;
+}
+
+/** Outcome of a keyed verify. `renew` is true once the session has crossed
+ *  the sliding-window threshold — the caller re-issues the cookie so an
+ *  active user never gets logged out mid-session. */
+export declare interface VerifyResult {
+    readonly subject: Subject;
+    readonly renew: boolean;
+    /** The key id that verified the value (current or previous). */
+    readonly kid: string;
+    /** Unix seconds the verified session expires. */
+    readonly exp: number;
+    /** Unix seconds the verified session was issued. `exp - iat` is the
+     *  session's original lifetime — a renewing caller re-issues with the
+     *  same lifetime rather than resetting to the default TTL. */
+    readonly iat: number;
+}
+
+/**
+ * Verify a session cookie value. Returns the decoded Subject on success,
+ * null on any failure (malformed, signature mismatch, expired). Never
+ * throws — callers shouldn't have to wrap this in try/catch.
+ *
+ * Uses `timingSafeEqual` for the signature comparison so attackers
+ * can't recover bytes one-at-a-time via response-time analysis.
+ *
+ * This is the single-secret entry point and stays a pure
+ * `Subject | null`. Use `verifySessionKeyed` for the multi-key +
+ * sliding-window result shape.
+ */
+export declare const verifySession: (cookieValue: string, secret: string) => Subject | null;
+
+/**
+ * Multi-key + sliding-window verify. Tries `secrets.current` first, then
+ * `secrets.previous` (if present). On success returns the Subject, the
+ * `kid` that verified, and a `renew` flag the caller acts on by
+ * re-issuing the cookie (so the session slides forward while in use).
+ * Returns null on any failure.
+ */
+export declare const verifySessionKeyed: (cookieValue: string, secrets: SessionSecrets, options?: VerifyOptions) => VerifyResult | null;
+
+export declare const VOLTRO_DEV_SESSION_SECRET: "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD";
+
+export { }

package/dist/session.js

@@ -0,0 +1,106 @@
+import { i as e } from "./auth-DCE6m7Bo.js";
+import { Schema as t } from "effect";
+import { createHmac as n, timingSafeEqual as r } from "node:crypto";
+//#region src/session.ts
+var i = t.Struct({
+	subject: e,
+	exp: t.Number,
+	iat: t.Number,
+	kid: t.optional(t.String)
+}), a = "k0", o = "k-previous", s = "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD", c = () => process.env.VOLTRO_SESSION_SECRET ?? "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD", l = () => {
+	let e = {
+		kid: process.env.VOLTRO_SESSION_KID ?? "k0",
+		secret: process.env.VOLTRO_SESSION_SECRET ?? "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD"
+	}, t = process.env.VOLTRO_SESSION_SECRET_PREVIOUS;
+	return t ? {
+		current: e,
+		previous: {
+			kid: process.env.VOLTRO_SESSION_KID_PREVIOUS ?? "k-previous",
+			secret: t
+		}
+	} : { current: e };
+}, u = 32, d = (e = process.env) => {
+	if (e.NODE_ENV !== "production") return;
+	let t = e.VOLTRO_SESSION_SECRET;
+	if (t === void 0 || t === "") throw Error("VOLTRO_SESSION_SECRET is not set. In production the framework refuses to boot rather than sign session cookies with the PUBLIC dev fallback secret (which would let anyone forge any user's session). Set VOLTRO_SESSION_SECRET to a high-entropy value (>= 32 chars). Generate one with `voltro secret generate session`.");
+	if (t === "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD") throw Error("VOLTRO_SESSION_SECRET is set to the built-in dev fallback secret, which is PUBLIC in the framework source. Set a real, high-entropy secret in production. Generate one with `voltro secret generate session`.");
+	if (t.length < 32) throw Error(`VOLTRO_SESSION_SECRET is only ${t.length} chars — too short for a production session secret (need >= 32). This looks like a placeholder. Generate a real one with \`voltro secret generate session\`.`);
+}, f = t.encodeSync(i), p = t.decodeUnknownSync(i), m = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), h = (e) => {
+	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
+	return Buffer.from(t, "base64");
+}, g = 3600 * 24 * 7, _ = .7, v = (e, t) => m(n("sha256", t).update(e).digest()), y = (e) => typeof e == "string" ? {
+	kid: "k0",
+	secret: e
+} : e, b = (e, t, n = {}) => {
+	let r = y(t);
+	if (!r.secret) throw Error("signSession: secret must be a non-empty string");
+	let i = n.ttlSeconds ?? g, a = Math.floor((n.now ?? Date.now)() / 1e3), o = {
+		subject: e,
+		exp: a + i,
+		iat: a,
+		...typeof t == "string" ? {} : { kid: r.kid }
+	}, s = m(JSON.stringify(f(o)));
+	return `${s}.${v(s, r.secret)}`;
+}, x = (e, t, i, a) => {
+	let o = n("sha256", i).update(e).digest(), s = h(t);
+	if (s.length !== o.length || !r(s, o)) return null;
+	try {
+		let t = h(e).toString("utf8"), n = p(JSON.parse(t));
+		return n.exp < Math.floor(a() / 1e3) ? null : n;
+	} catch {
+		return null;
+	}
+}, S = (e, t) => {
+	if (!e || !t) return null;
+	let n = e.indexOf(".");
+	if (n <= 0 || n === e.length - 1) return null;
+	let r = x(e.slice(0, n), e.slice(n + 1), t, Date.now);
+	return r ? r.subject : null;
+}, C = (e, t, n = {}) => {
+	if (!e) return null;
+	let r = e.indexOf(".");
+	if (r <= 0 || r === e.length - 1) return null;
+	let i = e.slice(0, r), a = e.slice(r + 1), o = t.previous ? [t.current, t.previous] : [t.current], s = n.now ?? Date.now;
+	for (let e of o) {
+		if (!e.secret) continue;
+		let t = x(i, a, e.secret, s);
+		if (!t) continue;
+		let r = n.renewFraction ?? _, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
+		return {
+			subject: t.subject,
+			renew: o >= l,
+			kid: e.kid,
+			exp: t.exp,
+			iat: t.iat
+		};
+	}
+	return null;
+}, w = (e, t) => {
+	let n = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
+	return n.length === i.length && r(n, i);
+}, T = (e, t) => {
+	if (!t || t.length === 0) return !0;
+	let n = e.authorization ?? e.Authorization;
+	return !n || !n.startsWith("Bearer ") ? !1 : w(n.slice(7).trim(), t);
+}, E = (e, t) => {
+	if (e) for (let n of e.split(";")) {
+		let e = n.indexOf("=");
+		if (e < 0 || n.slice(0, e).trim() !== t) continue;
+		let r = n.slice(e + 1).trim();
+		r.startsWith("\"") && r.endsWith("\"") && (r = r.slice(1, -1));
+		try {
+			return decodeURIComponent(r);
+		} catch {
+			return r;
+		}
+	}
+}, D = (e, t, n = {}) => {
+	let r = [`${e}=${encodeURIComponent(t)}`];
+	if (r.push(`Path=${n.path ?? "/"}`), n.maxAgeSeconds !== void 0 && r.push(`Max-Age=${n.maxAgeSeconds}`), r.push("HttpOnly"), n.httpOnly === !1) {
+		let e = r.indexOf("HttpOnly");
+		e >= 0 && r.splice(e, 1);
+	}
+	return r.push(`SameSite=${n.sameSite ?? "Lax"}`), (n.secure ?? !0) && r.push("Secure"), n.domain && r.push(`Domain=${n.domain}`), r.join("; ");
+};
+//#endregion
+export { o as DEFAULT_PREVIOUS_SESSION_KID, a as DEFAULT_SESSION_KID, u as MIN_SESSION_SECRET_LENGTH, s as VOLTRO_DEV_SESSION_SECRET, d as assertProductionSessionSecret, D as buildSetCookie, T as checkBearer, E as readCookie, c as resolveSessionSecret, l as resolveSessionSecrets, b as signSession, w as timingSafeStringEqual, S as verifySession, C as verifySessionKeyed };

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@voltro/protocol",
+  "version": "0.1.0",
+  "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./rest": {
+      "types": "./dist/rest.d.ts",
+      "import": "./dist/rest.js",
+      "default": "./dist/rest.js"
+    },
+    "./session": {
+      "types": "./dist/session.d.ts",
+      "import": "./dist/session.js",
+      "default": "./dist/session.js"
+    },
+    "./jwt": {
+      "types": "./dist/jwt.d.ts",
+      "import": "./dist/jwt.js",
+      "default": "./dist/jwt.js"
+    },
+    "./apikey": {
+      "types": "./dist/apikey.d.ts",
+      "import": "./dist/apikey.js",
+      "default": "./dist/apikey.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "dependencies": {
+    "@effect/sql": "^0.51.1",
+    "@voltro/database": "0.1.0",
+    "jose": "^6.2.3"
+  },
+  "peerDependencies": {
+    "@effect/platform": "^0.96.2",
+    "@effect/rpc": "^0.75.1",
+    "effect": "^3.21.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}