@voltro/protocol 0.33.0 → 0.35.0

package/dist/session.js

@@ -1,22 +1,24 @@
-import { i as e } from "./auth-CXMrvPyX.js";
-import { Schema as t } from "effect";
-import { createHmac as n, timingSafeEqual as r } from "node:crypto";
+import { U as e, s as t, v as n } from "./auth-B6YZuSBr.js";
+import { Schema as r } from "effect";
+import { createHmac as i, timingSafeEqual as a } from "node:crypto";
+import { createLogger as o } from "@voltro/logger";
 //#region src/session.ts
-var i = t.Struct({
-	subject: e,
-	exp: t.Number,
-	iat: t.Number,
-	kid: t.optional(t.String)
-}), a = "k0", o = "k-previous", s = () => {
+var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
+	v: r.Literal(2),
+	subject: t,
+	exp: r.Number,
+	iat: r.Number,
+	kid: r.optional(r.String)
+}), u = "k0", d = "k-previous", f = () => {
 	throw Error("VOLTRO_SESSION_SECRET is not set. It signs and verifies session cookies, and the framework refuses to invent one at this point: a fixed fallback would be readable by anyone with the source, making every session forgeable. `voltro dev` mints a project-local value into .env.local on boot; for a deployment, generate one with `voltro secret generate session`.");
-}, c = () => process.env.VOLTRO_SESSION_SECRET ?? s(), l = () => d() ?? { current: {
-	kid: u(),
-	secret: c()
-} }, u = () => process.env.VOLTRO_SESSION_KID ?? "k0", d = () => {
+}, p = () => process.env.VOLTRO_SESSION_SECRET ?? f(), m = () => g() ?? { current: {
+	kid: h(),
+	secret: p()
+} }, h = () => process.env.VOLTRO_SESSION_KID ?? "k0", g = () => {
 	let e = process.env.VOLTRO_SESSION_SECRET;
 	if (e === void 0 || e === "") return;
 	let t = {
-		kid: u(),
+		kid: h(),
 		secret: e
 	}, n = process.env.VOLTRO_SESSION_SECRET_PREVIOUS;
 	return n ? {
@@ -26,51 +28,54 @@ var i = t.Struct({
 			secret: n
 		}
 	} : { current: t };
-}, f = 32, p = (e = process.env) => {
+}, _ = 32, v = (e = process.env) => {
 	let t = e.VOLTRO_SESSION_SECRET;
 	if (t === void 0 || t === "") throw Error("VOLTRO_SESSION_SECRET is not set — refusing to serve. It signs session cookies, and there is no fallback: a built-in one would be readable by anyone with the source. Generate one with `voltro secret generate session`. (`voltro dev` mints a project-local value automatically; a deployment needs its own.)");
 	if (t.length < 32) throw Error(`VOLTRO_SESSION_SECRET is only ${t.length} chars — too short for a session secret (need >= 32). This looks like a placeholder. Generate a real one with \`voltro secret generate session\`.`);
-}, m = t.encodeSync(i), h = t.decodeUnknownSync(i), g = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), _ = (e) => {
+}, y = r.encodeSync(l), b = r.decodeUnknownSync(l), x = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), S = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, v = 3600 * 24 * 7, y = .7, b = (e, t) => g(n("sha256", t).update(e).digest()), x = (e) => typeof e == "string" ? {
+}, C = 3600 * 24 * 7, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, S = (e, t, n = {}) => {
-	let r = x(t);
-	if (!r.secret) throw Error("signSession: secret must be a non-empty string");
-	let i = n.ttlSeconds ?? v, a = Math.floor((n.now ?? Date.now)() / 1e3), o = {
-		subject: e,
-		exp: a + i,
-		iat: a,
-		...typeof t == "string" ? {} : { kid: r.kid }
-	}, s = g(JSON.stringify(m(o)));
-	return `${s}.${b(s, r.secret)}`;
-}, C = (e, t, i, a) => {
-	let o = n("sha256", i).update(e).digest(), s = _(t);
-	if (s.length !== o.length || !r(s, o)) return null;
+} : e, D = (t, r, i = {}) => {
+	let a = E(r);
+	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
+	let o = e(t);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${t.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
+		v: 2,
+		subject: n(t),
+		exp: c + s,
+		iat: c,
+		...typeof r == "string" ? {} : { kid: a.kid }
+	}, u = x(JSON.stringify(y(l)));
+	return `${u}.${T(u, a.secret)}`;
+}, O = (e, t, n, r) => {
+	let o = i("sha256", n).update(e).digest(), s = S(t);
+	if (s.length !== o.length || !a(s, o)) return null;
 	try {
-		let t = _(e).toString("utf8"), n = h(JSON.parse(t));
-		return n.exp < Math.floor(a() / 1e3) ? null : n;
+		let t = S(e).toString("utf8"), n = b(JSON.parse(t));
+		return n.exp < Math.floor(r() / 1e3) ? null : n;
 	} catch {
 		return null;
 	}
-}, w = (e, t) => {
+}, k = (e, t) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = C(e.slice(0, n), e.slice(n + 1), t, Date.now);
+	let r = O(e.slice(0, n), e.slice(n + 1), t, Date.now);
 	return r ? r.subject : null;
-}, T = (e, t, n = {}) => {
+}, A = (e, t, n = {}) => {
 	if (!e) return null;
 	let r = e.indexOf(".");
 	if (r <= 0 || r === e.length - 1) return null;
 	let i = e.slice(0, r), a = e.slice(r + 1), o = t.previous ? [t.current, t.previous] : [t.current], s = n.now ?? Date.now;
 	for (let e of o) {
 		if (!e.secret) continue;
-		let t = C(i, a, e.secret, s);
+		let t = O(i, a, e.secret, s);
 		if (!t) continue;
-		let r = n.renewFraction ?? y, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
+		let r = n.renewFraction ?? w, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
 		return {
 			subject: t.subject,
 			renew: o >= l,
@@ -80,14 +85,14 @@ var i = t.Struct({
 		};
 	}
 	return null;
-}, E = (e, t) => {
-	let n = Buffer.from(e, "utf8"), i = Buffer.from(t, "utf8");
-	return n.length === i.length && r(n, i);
-}, D = (e, t, n) => {
+}, j = (e, t) => {
+	let n = Buffer.from(e, "utf8"), r = Buffer.from(t, "utf8");
+	return n.length === r.length && a(n, r);
+}, M = (e, t, n) => {
 	if (!t || t.length === 0) return n?.openWhenUnset === !0;
 	let r = e.authorization ?? e.Authorization;
-	return !r || !r.startsWith("Bearer ") ? !1 : E(r.slice(7).trim(), t);
-}, O = (e, t) => {
+	return !r || !r.startsWith("Bearer ") ? !1 : j(r.slice(7).trim(), t);
+}, N = (e, t) => {
 	if (e) for (let n of e.split(";")) {
 		let e = n.indexOf("=");
 		if (e < 0 || n.slice(0, e).trim() !== t) continue;
@@ -99,18 +104,26 @@ var i = t.Struct({
 			return r;
 		}
 	}
-}, k = (e, t, n = {}) => {
+}, P = (e, t, n = {}) => {
 	let r = [`${e}=${encodeURIComponent(t)}`];
 	if (r.push(`Path=${n.path ?? "/"}`), n.maxAgeSeconds !== void 0 && r.push(`Max-Age=${n.maxAgeSeconds}`), r.push("HttpOnly"), n.httpOnly === !1) {
 		let e = r.indexOf("HttpOnly");
 		e >= 0 && r.splice(e, 1);
 	}
 	return r.push(`SameSite=${n.sameSite ?? "Lax"}`), (n.secure ?? !0) && r.push("Secure"), n.domain && r.push(`Domain=${n.domain}`), r.join("; ");
-}, A = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", j = (e) => {
-	let t = O(e.cookie ?? e.Cookie, A);
+}, F = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", I = (e) => {
+	let t = N(e.cookie ?? e.Cookie, F);
 	if (!t) return;
-	let n = d();
-	if (n) return T(t, n)?.exp;
+	let n = g();
+	if (!n) {
+		R();
+		return;
+	}
+	return A(t, n)?.exp;
+}, L = !1, R = () => {
+	L || (L = !0, s.error("a `voltro:session` cookie was presented but VOLTRO_SESSION_SECRET is not set — the session cannot be verified, so no credential-expiry bound is imposed and realtime subscriptions on this connection will not be cut off when the session expires. Set VOLTRO_SESSION_SECRET (`voltro secret generate session`); `voltro dev` mints one, `voltro serve` refuses to boot without one.", { cookieName: F }));
+}, z = () => {
+	L = !1;
 };
 //#endregion
-export { o as DEFAULT_PREVIOUS_SESSION_KID, a as DEFAULT_SESSION_KID, f as MIN_SESSION_SECRET_LENGTH, A as SESSION_COOKIE_NAME, p as assertProductionSessionSecret, k as buildSetCookie, D as checkBearer, O as readCookie, d as resolveOptionalSessionSecrets, c as resolveSessionSecret, l as resolveSessionSecrets, j as sessionExpiryFromHeaders, S as signSession, E as timingSafeStringEqual, w as verifySession, T as verifySessionKeyed };
+export { d as DEFAULT_PREVIOUS_SESSION_KID, u as DEFAULT_SESSION_KID, _ as MIN_SESSION_SECRET_LENGTH, F as SESSION_COOKIE_NAME, c as SESSION_PAYLOAD_VERSION, v as assertProductionSessionSecret, P as buildSetCookie, M as checkBearer, N as readCookie, z as resetSessionSecretWarningLatch, g as resolveOptionalSessionSecrets, p as resolveSessionSecret, m as resolveSessionSecrets, I as sessionExpiryFromHeaders, D as signSession, j as timingSafeStringEqual, k as verifySession, A as verifySessionKeyed };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -54,7 +54,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.33.0",
+    "@voltro/database": "0.35.0",
+    "@voltro/logger": "0.35.0",
     "jose": "^6.2.4"
   },
   "peerDependencies": {

package/dist/auth-CXMrvPyX.js

@@ -1,90 +0,0 @@
-import { Context as e, Schema as t } from "effect";
-import { RpcMiddleware as n } from "@effect/rpc";
-//#region src/auth.ts
-var r = t.Record({
-	key: t.String,
-	value: t.Unknown
-}), i = t.optional(t.Array(t.String)), a = t.Struct({
-	type: t.Literal("user"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), o = t.Struct({
-	type: t.Literal("apiKey"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), s = t.Struct({
-	type: t.Literal("serviceAccount"),
-	id: t.String,
-	tenantId: t.String,
-	scopes: i,
-	metadata: t.optional(r)
-}), c = t.Struct({
-	type: t.Literal("anonymous"),
-	id: t.Null,
-	tenantId: t.NullOr(t.String)
-}), l = t.Struct({
-	type: t.Literal("system"),
-	id: t.String,
-	tenantId: t.Null,
-	scopes: i,
-	metadata: t.optional(r)
-}), u = t.Union(a, o, s, c, l), d = (e) => ({
-	type: "anonymous",
-	id: null,
-	tenantId: e
-}), f = (e, t = ["admin:full"]) => ({
-	type: "system",
-	id: e,
-	tenantId: null,
-	scopes: t
-}), p = (e, t) => {
-	let n = e;
-	return {
-		type: "serviceAccount",
-		id: e.id ?? "system",
-		tenantId: t,
-		scopes: n.scopes ?? ["admin:full"],
-		...n.metadata === void 0 ? {} : { metadata: n.metadata }
-	};
-}, m = (e) => e.type === "system", h = class extends e.Tag("@voltro/Subject")() {}, g = class extends e.Tag("@voltro/ConnectionInfo")() {}, _ = class extends n.Tag()("@voltro/AuthMiddleware", { provides: h }) {}, v = class extends n.Tag()("@voltro/ConnectionInfoMiddleware", { provides: g }) {}, y = (e) => typeof e.mountRoutes == "function", b = (e, t) => {
-	if (t.length === 0) return e;
-	let n = [.../* @__PURE__ */ new Set([...e.scopes ?? [], ...t])];
-	return {
-		...e,
-		scopes: n
-	};
-}, x = (e, t) => async (n) => {
-	let r = t?.getStore?.(), i = r === void 0 ? n : {
-		...n,
-		store: r
-	};
-	for (let n of e) {
-		let e = await n.resolve(i);
-		if (e.kind === "matched") {
-			let n = t?.resolveScopes === void 0 ? e.subject : b(e.subject, await t.resolveScopes(e.subject, i));
-			return e.credentialExpiresAt === void 0 ? { subject: n } : {
-				subject: n,
-				credentialExpiresAt: e.credentialExpiresAt
-			};
-		}
-		if (e.kind === "failed") {
-			t?.onStrategyFailed?.({
-				strategyId: n.id,
-				reason: e.reason
-			});
-			break;
-		}
-	}
-	if (t?.fallback) return { subject: await t.fallback(i) };
-	let a = i.headers["x-tenant"] ?? null;
-	if (a === null && t?.anonymousTenantRequired === !0) throw new S({ reason: "tenant required (x-tenant header missing)" });
-	return { subject: d(a) };
-}, S = class extends t.TaggedError()("Unauthenticated", { reason: t.optional(t.String) }) {}, C = (e, t) => {
-	if (e.type === "anonymous") throw new S(t === void 0 ? {} : { reason: t });
-};
-//#endregion
-export { h as a, C as c, m as d, f, u as i, x as l, g as n, S as o, p, v as r, d as s, _ as t, y as u };

package/dist/serverErrorBus-C3JTqgIc.js

@@ -1,157 +0,0 @@
-import { Effect as e, Schema as t } from "effect";
-//#region src/scopes.ts
-var n = "admin:full", r = "apikeys:issue:self", i = "apikeys:issue:org", a = "apikeys:issue:other", o = class extends t.TaggedError()("ScopeError", {
-	required: t.String,
-	message: t.String
-}) {}, s = (e) => "scopes" in e && e.scopes ? e.scopes : [], c = /* @__PURE__ */ new WeakMap(), l = (e, t) => {
-	typeof e == "object" && e && c.set(e, t);
-}, u = (e) => {
-	if (typeof e == "object" && e) {
-		let t = c.get(e);
-		if (t) return t;
-	}
-	return s(e);
-}, d = (e, t) => {
-	let n = u(e);
-	return n.includes("admin:full") || n.includes(t);
-}, f = (e, t) => {
-	let n = s(e);
-	return n.includes("admin:full") || n.includes(t);
-}, p = (t, n) => d(t, n) ? e.void : e.fail(new o({
-	required: n,
-	message: `missing required scope '${n}'`
-})), m = (e) => typeof e.action == "string" && typeof e.resourceType == "string", h = (e) => typeof e == "string" ? [e] : e, g, _ = (e) => {
-	g = e;
-}, v = (e) => g === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !m(e) && e.resource !== void 0)).map((e) => e.tag) : [], y = (e) => [
-	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
-	...e.slice(0, 10).map((e) => `    ${e}`),
-	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
-	"",
-	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
-	"  but with no resource-scope resolver registered the extractor is advisory and",
-	"  the check runs against the caller's GLOBAL scopes. For an app whose",
-	"  authorization is per-resource, that guard passes callers it should refuse.",
-	"",
-	"  Fix it one of two ways:",
-	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
-	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
-	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), b = () => g, x, S = (e) => {
-	x = e;
-}, C = () => x, w = (e, t) => {
-	if (!t || t.length === 0) return null;
-	for (let n of t) {
-		if (m(n)) {
-			if (d(e, "admin:full")) continue;
-			return new o({
-				required: `${n.resourceType}:${n.action}`,
-				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
-			});
-		}
-		let t = h(n.scope);
-		if (t.length === 0) continue;
-		let r = t.filter((t) => d(e, t));
-		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !d(e, t));
-			return new o({
-				required: r,
-				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
-			});
-		}
-	}
-	return null;
-}, T = (t, n, r) => {
-	let i = (e) => new o({
-		required: `${n.resourceType}:${n.action}`,
-		message: e
-	});
-	if (d(t, "admin:full")) return e.succeed(null);
-	let a = x;
-	if (a === void 0) return e.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
-	let s = n.resource(r);
-	return s === void 0 || s === "" ? e.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : e.suspend(() => a({
-		subject: t,
-		action: n.action,
-		resourceType: n.resourceType,
-		resourceId: s
-	})).pipe(e.catchAllCause(() => e.succeed(!1)), e.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${s}`)));
-}, E = (t, n, r) => {
-	if (!n || n.length === 0) return e.succeed(null);
-	let i = g;
-	return !n.some(m) && (!i || !n.some((e) => e.resource !== void 0)) ? e.succeed(w(t, n)) : e.gen(function* () {
-		for (let a of n) {
-			if (m(a)) {
-				let e = yield* T(t, a, r);
-				if (e) return e;
-				continue;
-			}
-			let n = h(a.scope);
-			if (n.length === 0) continue;
-			let s = a.resource ? a.resource(r) : void 0, c = [];
-			for (let r of n) {
-				if (d(t, r)) {
-					c.push(!0);
-					continue;
-				}
-				if (s !== void 0 && i !== void 0) {
-					let n = yield* e.suspend(() => i({
-						subject: t,
-						scope: r,
-						resource: s
-					})).pipe(e.catchAllCause(() => e.succeed(!1)));
-					c.push(n);
-				} else c.push(!1);
-			}
-			let l = a.mode ?? "all";
-			if (!(l === "any" ? c.some(Boolean) : c.every(Boolean))) {
-				let e = l === "any" ? n[0] : n[n.findIndex((e, t) => !c[t])];
-				return new o({
-					required: e,
-					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (s === void 0 ? "" : ` on resource '${s}'`)
-				});
-			}
-		}
-		return null;
-	});
-}, D = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, O = (e, t, n) => `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}`, k = async (e, t, n, r, i) => {
-	let a = await e.claim(t, n, i, r);
-	return a === "claimed" ? { kind: "fresh" } : a.status === "completed" && a.response ? {
-		kind: "replay",
-		response: a.response
-	} : { kind: "conflict" };
-}, A = (e, t, n, r, i) => e.complete(t, n, r, i), j = (e, t, n) => e.release(t, n), M = () => {
-	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
-	return {
-		get: async (n, r) => e.get(t(n, r)) ?? null,
-		claim: async (n, r, i, a) => {
-			let o = e.get(t(n, r));
-			return o && i - o.createdAt < a ? o : (e.set(t(n, r), {
-				scope: n,
-				key: r,
-				status: "in_flight",
-				response: null,
-				createdAt: i
-			}), "claimed");
-		},
-		complete: async (n, r, i, a) => {
-			e.set(t(n, r), {
-				scope: n,
-				key: r,
-				status: "completed",
-				response: i,
-				createdAt: a
-			});
-		},
-		release: async (n, r) => {
-			e.delete(t(n, r));
-		}
-	};
-}, N = /* @__PURE__ */ new Set(), P = (e) => {
-	for (let t of N) try {
-		t(e);
-	} catch {}
-}, F = (e) => (N.add(e), () => {
-	N.delete(e);
-});
-//#endregion
-export { m as C, _ as D, S as E, s as O, f as S, l as T, u as _, A as a, b, O as c, a as d, r as f, E as g, w as h, j as i, n as l, y as m, F as n, D as o, o as p, k as r, M as s, P as t, i as u, v, p as w, d as x, C as y };