@voltro/protocol 0.24.0 → 0.26.0

package/dist/rest.d.ts

@@ -31,6 +31,28 @@ declare interface ActionProcedureDescriptor<Name extends string, Input extends S
     readonly exposeAsTool: ExposeAsTool | undefined;
     /** True when the procedure is kept OFF the wire — no client-group entry and no
      *  route in dev or serve. See `internal` on the definer's options. */
+    /**
+     * Replace a PLUGIN route that answers to this same tag.
+     *
+     * Without it, a user route and a plugin route sharing a tag is a hard error,
+     * and correctly so — two handlers behind one name is not a thing a caller can
+     * reason about. But refusing is the wrong answer when the app deliberately
+     * wants its own version: the two escapes available otherwise are to rename
+     * your procedure (so the split runs along "who built it" rather than along a
+     * domain boundary) or to `alias` the whole plugin away (same, one level up).
+     * For a frontend developer that is the worst possible partition.
+     *
+     * A reporter wanted exactly this: adopt `@voltro/plugin-notifications`, whose
+     * surface is richer than theirs, add `archive`/`unarchive` beside it — which
+     * already composes, since the collision check compares FULL tags and not
+     * prefixes — and replace `markRead`, because theirs maintains archive state.
+     *
+     * Explicit, never inferred. Silently letting the app win would mean a plugin
+     * upgrade that adds a route could shadow an app procedure with no diff to
+     * read; declaring it makes the intent reviewable and puts the override in the
+     * file that performs it.
+     */
+    readonly overridesPlugin: boolean | undefined;
     readonly internal: boolean | undefined;
 }
 
@@ -209,6 +231,28 @@ declare interface MutationProcedureDescriptor<Name extends string, Input extends
     readonly exposeAsTool: ExposeAsTool | undefined;
     /** True when the procedure is kept OFF the wire — no client-group entry and no
      *  route in dev or serve. See `internal` on the definer's options. */
+    /**
+     * Replace a PLUGIN route that answers to this same tag.
+     *
+     * Without it, a user route and a plugin route sharing a tag is a hard error,
+     * and correctly so — two handlers behind one name is not a thing a caller can
+     * reason about. But refusing is the wrong answer when the app deliberately
+     * wants its own version: the two escapes available otherwise are to rename
+     * your procedure (so the split runs along "who built it" rather than along a
+     * domain boundary) or to `alias` the whole plugin away (same, one level up).
+     * For a frontend developer that is the worst possible partition.
+     *
+     * A reporter wanted exactly this: adopt `@voltro/plugin-notifications`, whose
+     * surface is richer than theirs, add `archive`/`unarchive` beside it — which
+     * already composes, since the collision check compares FULL tags and not
+     * prefixes — and replace `markRead`, because theirs maintains archive state.
+     *
+     * Explicit, never inferred. Silently letting the app win would mean a plugin
+     * upgrade that adds a route could shadow an app procedure with no diff to
+     * read; declaring it makes the intent reviewable and puts the override in the
+     * file that performs it.
+     */
+    readonly overridesPlugin: boolean | undefined;
     readonly internal: boolean | undefined;
 }
 
@@ -517,6 +561,28 @@ declare interface QueryProcedureDescriptor<Name extends string, Input extends Sc
     readonly exposeAsTool: ExposeAsTool | undefined;
     /** True when the procedure is kept OFF the wire — no client-group entry and no
      *  route in dev or serve. See `internal` on the definer's options. */
+    /**
+     * Replace a PLUGIN route that answers to this same tag.
+     *
+     * Without it, a user route and a plugin route sharing a tag is a hard error,
+     * and correctly so — two handlers behind one name is not a thing a caller can
+     * reason about. But refusing is the wrong answer when the app deliberately
+     * wants its own version: the two escapes available otherwise are to rename
+     * your procedure (so the split runs along "who built it" rather than along a
+     * domain boundary) or to `alias` the whole plugin away (same, one level up).
+     * For a frontend developer that is the worst possible partition.
+     *
+     * A reporter wanted exactly this: adopt `@voltro/plugin-notifications`, whose
+     * surface is richer than theirs, add `archive`/`unarchive` beside it — which
+     * already composes, since the collision check compares FULL tags and not
+     * prefixes — and replace `markRead`, because theirs maintains archive state.
+     *
+     * Explicit, never inferred. Silently letting the app win would mean a plugin
+     * upgrade that adds a route could shadow an app procedure with no diff to
+     * read; declaring it makes the intent reviewable and puts the override in the
+     * file that performs it.
+     */
+    readonly overridesPlugin: boolean | undefined;
     readonly internal: boolean | undefined;
 }
 

package/dist/session.d.ts

@@ -108,6 +108,33 @@ export declare const resolveSessionSecret: () => string;
  */
 export declare const resolveSessionSecrets: () => SessionSecrets;
 
+/**
+ * The cookie the framework's own session strategy writes and reads.
+ *
+ * Exported and single-sourced because two readers now need it — the auth
+ * strategy in `dev.ts` and `sessionExpiryFromHeaders` below. Two copies of one
+ * env expression is the "derived twice" shape: both sites look correct and
+ * they disagree the moment someone sets the variable.
+ */
+export declare const SESSION_COOKIE_NAME: string;
+
+/**
+ * The verified expiry of the session cookie in `headers`, in unix SECONDS, or
+ * `undefined` when there is no session or it does not verify.
+ *
+ * It VERIFIES rather than decoding. An unverified read would be worse than
+ * nothing here: the value bounds how long a subscription may live, so a client
+ * that could forge a far-future `exp` would lift exactly the ceiling this
+ * exists to impose. The cost is one HMAC check on a call that already carries
+ * the cookie.
+ *
+ * A SHARED builder on purpose. `voltro dev` and `voltro serve` assemble their
+ * middleware independently, and a value derived twice is the shape this repo
+ * has been bitten by — dev and serve agreeing on a field while disagreeing on
+ * what it contains. Both call this.
+ */
+export declare const sessionExpiryFromHeaders: (headers: Record<string, string | undefined>) => number | undefined;
+
 export declare type SessionPayload = typeof SessionPayload_2.Type;
 
 declare const SessionPayload_2: Schema.Struct<{

package/dist/session.js

@@ -106,6 +106,11 @@ var i = t.Struct({
 		e >= 0 && r.splice(e, 1);
 	}
 	return r.push(`SameSite=${n.sameSite ?? "Lax"}`), (n.secure ?? !0) && r.push("Secure"), n.domain && r.push(`Domain=${n.domain}`), r.join("; ");
+}, A = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", j = (e) => {
+	let t = O(e.cookie ?? e.Cookie, A);
+	if (!t) return;
+	let n = d();
+	if (n) return T(t, n)?.exp;
 };
 //#endregion
-export { o as DEFAULT_PREVIOUS_SESSION_KID, a as DEFAULT_SESSION_KID, f as MIN_SESSION_SECRET_LENGTH, p as assertProductionSessionSecret, k as buildSetCookie, D as checkBearer, O as readCookie, d as resolveOptionalSessionSecrets, c as resolveSessionSecret, l as resolveSessionSecrets, S as signSession, E as timingSafeStringEqual, w as verifySession, T as verifySessionKeyed };
+export { o as DEFAULT_PREVIOUS_SESSION_KID, a as DEFAULT_SESSION_KID, f as MIN_SESSION_SECRET_LENGTH, A as SESSION_COOKIE_NAME, p as assertProductionSessionSecret, k as buildSetCookie, D as checkBearer, O as readCookie, d as resolveOptionalSessionSecrets, c as resolveSessionSecret, l as resolveSessionSecrets, j as sessionExpiryFromHeaders, S as signSession, E as timingSafeStringEqual, w as verifySession, T as verifySessionKeyed };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -53,7 +53,7 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.24.0",
+    "@voltro/database": "0.26.0",
     "jose": "^6.2.4"
   },
   "peerDependencies": {