@voltro/protocol 0.37.0 → 0.39.0

package/dist/index.d.ts

@@ -2181,6 +2181,21 @@ export declare interface IdempotencyStore {
  *  corrupt the pointer. */
 export declare const idToPath: (id: RowId) => string;
 
+/**
+ * `Subject.metadata` is the APP's bag — opaque to the framework, stored
+ * verbatim — with exactly one reserved key: this one. It carries the mark that
+ * says the session is an impersonated one.
+ *
+ * **Why it lives in protocol and not in `@voltro/plugin-auth`, which mints it.**
+ * Two packages need the answer to "is this session impersonated" and they must
+ * not depend on each other: plugin-auth WRITES the mark, and plugin-audit reads
+ * it to stamp `AuditEvent.impersonation` before redaction runs. A key spelled
+ * out in both is a second definition that no guard is watching — the shape this
+ * repo has been bitten by often enough to have a rule about it. `Subject` is
+ * protocol's type, so its reserved key is protocol's too.
+ */
+export declare const IMPERSONATION_METADATA_KEY: "impersonation";
+
 export declare interface InsertTarget<Input = unknown, Row = unknown, Item = Record<string, unknown>> extends NestedTargetFields<Input> {
     readonly table: string;
     readonly op: 'insert';
@@ -3591,6 +3606,18 @@ export declare const queryToRpc: <Name extends string, Input extends Schema.Sche
     revision: Schema.optional<typeof Schema.Number>;
 }>]>, Schema.Schema.All>, typeof Schema.Never, never>;
 
+/**
+ * The RAW mark, unvalidated, or `null`.
+ *
+ * Deliberately `unknown`: protocol owns the key, not the payload's shape.
+ * `@voltro/plugin-auth` mints the mark and validates it back into an
+ * `ImpersonationMark`; an auditor only needs to copy it out before a redactor
+ * can reach it, and giving protocol an opinion about the fields would make the
+ * shape need to agree in two places again — the exact thing the key moved here
+ * to avoid.
+ */
+export declare const rawImpersonationMark: (subject: Subject) => unknown;
+
 /** The `channel:` namespace. Every channel key starts with it. */
 export declare const REACTIVITY_CHANNEL_PREFIX = "channel:";
 
@@ -4068,7 +4095,7 @@ export declare const streamToRpc: <Name extends string, Input extends Schema.Sch
  * non-struct payload (`Schema.Void`, a scalar) is unaffected — there is no
  * excess property for it to have.
  */
-export declare const strictInput: <S extends Schema.Schema.Any>(input: S) => S;
+export declare const strictInput: <S extends Schema.Schema.Any>(input: S, procedure?: string) => S;
 
 export declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["user"]>;