@voltro/protocol 0.39.0 → 0.40.0

package/dist/jwt.d.ts

@@ -282,6 +282,23 @@ declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;
     tenantId: Schema.NullOr<typeof Schema.String>;
+    /**
+     * Set when this caller PRESENTED a credential and it was rejected — an
+     * expired token above all. Absent when they presented none.
+     *
+     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * measured the cost: a user's tab outlived their IdP's token lifetime, the
+     * strategy logged `supabase jwt expired`, the caller fell through to
+     * anonymous, and the guard then refused with `missing required scope
+     * 'task:u:o'`. Technically true — an anonymous caller holds no scopes — and
+     * it sent everyone who read it into the permissions system while the problem
+     * was an expired session. They did that round.
+     *
+     * It stays a FALLBACK rather than a hard failure on purpose: a stale cookie
+     * must not break an `openAccess` procedure that needs no session at all. The
+     * fact travels, and only a guard that actually refuses spends it.
+     */
+    credentialRejected: Schema.optional<typeof Schema.String>;
 }>, Schema.Struct<{
     type: Schema.Literal<["system"]>;
     id: typeof Schema.String;

package/dist/rest.d.ts

@@ -893,6 +893,23 @@ declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;
     tenantId: Schema.NullOr<typeof Schema.String>;
+    /**
+     * Set when this caller PRESENTED a credential and it was rejected — an
+     * expired token above all. Absent when they presented none.
+     *
+     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * measured the cost: a user's tab outlived their IdP's token lifetime, the
+     * strategy logged `supabase jwt expired`, the caller fell through to
+     * anonymous, and the guard then refused with `missing required scope
+     * 'task:u:o'`. Technically true — an anonymous caller holds no scopes — and
+     * it sent everyone who read it into the permissions system while the problem
+     * was an expired session. They did that round.
+     *
+     * It stays a FALLBACK rather than a hard failure on purpose: a stale cookie
+     * must not break an `openAccess` procedure that needs no session at all. The
+     * fact travels, and only a guard that actually refuses spends it.
+     */
+    credentialRejected: Schema.optional<typeof Schema.String>;
 }>, Schema.Struct<{
     type: Schema.Literal<["system"]>;
     id: typeof Schema.String;

package/dist/rest.js

@@ -1,4 +1,4 @@
-import { d as e } from "./auth-CKS3UNnf.js";
+import { P as e } from "./scopes-B0kGvAnI.js";
 import { a as t, i as n, o as r, r as i, t as a } from "./serverErrorBus-BeN9pOpY.js";
 import { Effect as o, Schema as s } from "effect";
 //#region src/publicApi.ts

package/dist/{auth-CKS3UNnf.js → scopes-B0kGvAnI.js}

@@ -1,169 +1,53 @@
 import { Context as e, Effect as t, Schema as n } from "effect";
 import { RpcMiddleware as r } from "@effect/rpc";
-//#region src/scopes.ts
-var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "apikeys:issue:other", c = class extends n.TaggedError()("ScopeError", {
-	required: n.String,
-	message: n.String
-}) {}, l = (e) => "scopes" in e && e.scopes ? e.scopes : [], u = /* @__PURE__ */ new WeakMap(), d = (e, t) => {
-	typeof e == "object" && e && u.set(e, t);
-}, f = (e) => {
-	if (typeof e == "object" && e) {
-		let t = u.get(e);
-		if (t) return t;
-	}
-	return l(e);
-}, p = (e, t) => {
-	let n = f(e);
-	return n.includes("admin:full") || n.includes(t);
-}, ee = (e, t) => {
-	let n = l(e);
-	return n.includes("admin:full") || n.includes(t);
-}, te = (e, n) => p(e, n) ? t.void : t.fail(new c({
-	required: n,
-	message: `missing required scope '${n}'`
-})), m = (e) => typeof e.action == "string" && typeof e.resourceType == "string", h = (e) => typeof e.open == "string", ne = (e) => ({ open: e }), g = (e) => typeof e == "string" ? [e] : e, _, v = (e) => {
-	_ = e;
-}, y = (e) => _ === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !m(e) && e.resource !== void 0)).map((e) => e.tag) : [], b = (e) => [
-	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
-	...e.slice(0, 10).map((e) => `    ${e}`),
-	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
-	"",
-	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
-	"  but with no resource-scope resolver registered the extractor is advisory and",
-	"  the check runs against the caller's GLOBAL scopes. For an app whose",
-	"  authorization is per-resource, that guard passes callers it should refuse.",
-	"",
-	"  Fix it one of two ways:",
-	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
-	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
-	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), x = () => _, S, re = (e) => {
-	S = e;
-}, C = () => S, w = (e) => new c({
-	required: "access-decision",
-	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
-}), T = (e, t, n) => {
-	if (!t || t.length === 0) return n?.defaultDeny === !0 ? w(n.procedure) : null;
-	for (let n of t) {
-		if (h(n)) continue;
-		if (m(n)) {
-			if (p(e, "admin:full")) continue;
-			return new c({
-				required: `${n.resourceType}:${n.action}`,
-				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
-			});
-		}
-		let t = g(n.scope);
-		if (t.length === 0) continue;
-		let r = t.filter((t) => p(e, t));
-		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
-			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !p(e, t));
-			return new c({
-				required: r,
-				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
-			});
-		}
-	}
-	return null;
-}, E = (e, n, r) => {
-	let i = (e) => new c({
-		required: `${n.resourceType}:${n.action}`,
-		message: e
-	});
-	if (p(e, "admin:full")) return t.succeed(null);
-	let a = S;
-	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
-	let o = n.resource(r);
-	return o === void 0 || o === "" ? t.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => a({
-		subject: e,
-		action: n.action,
-		resourceType: n.resourceType,
-		resourceId: o
-	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
-}, D = (e, n, r, i) => {
-	if (!n || n.length === 0) return t.succeed(T(e, n, i));
-	let a = _;
-	return !n.some(m) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed(T(e, n, i)) : t.gen(function* () {
-		for (let i of n) {
-			if (h(i)) continue;
-			if (m(i)) {
-				let t = yield* E(e, i, r);
-				if (t) return t;
-				continue;
-			}
-			let n = g(i.scope);
-			if (n.length === 0) continue;
-			let o = i.resource ? i.resource(r) : void 0, s = [];
-			for (let r of n) {
-				if (p(e, r)) {
-					s.push(!0);
-					continue;
-				}
-				if (o !== void 0 && a !== void 0) {
-					let n = yield* t.suspend(() => a({
-						subject: e,
-						scope: r,
-						resource: o
-					})).pipe(t.catchAllCause(() => t.succeed(!1)));
-					s.push(n);
-				} else s.push(!1);
-			}
-			let l = i.mode ?? "all";
-			if (!(l === "any" ? s.some(Boolean) : s.every(Boolean))) {
-				let e = l === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
-				return new c({
-					required: e,
-					message: l === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (o === void 0 ? "" : ` on resource '${o}'`)
-				});
-			}
-		}
-		return null;
-	});
-}, O = n.Record({
+//#region src/auth.ts
+var i = n.Record({
 	key: n.String,
 	value: n.Unknown
-}), k = n.optional(n.Array(n.String)), A = n.Struct({
+}), a = n.optional(n.Array(n.String)), o = n.Struct({
 	type: n.Literal("user"),
 	id: n.String,
 	tenantId: n.String,
-	scopes: k,
-	metadata: n.optional(O)
-}), j = n.Struct({
+	scopes: a,
+	metadata: n.optional(i)
+}), s = n.Struct({
 	type: n.Literal("apiKey"),
 	id: n.String,
 	tenantId: n.String,
-	scopes: k,
-	metadata: n.optional(O)
-}), M = n.Struct({
+	scopes: a,
+	metadata: n.optional(i)
+}), c = n.Struct({
 	type: n.Literal("serviceAccount"),
 	id: n.String,
 	tenantId: n.String,
-	scopes: k,
-	metadata: n.optional(O)
-}), N = n.Struct({
+	scopes: a,
+	metadata: n.optional(i)
+}), l = n.Struct({
 	type: n.Literal("anonymous"),
 	id: n.Null,
-	tenantId: n.NullOr(n.String)
-}), P = n.Struct({
+	tenantId: n.NullOr(n.String),
+	credentialRejected: n.optional(n.String)
+}), u = n.Struct({
 	type: n.Literal("system"),
 	id: n.String,
 	tenantId: n.Null,
-	scopes: k,
-	metadata: n.optional(O)
-}), F = n.Union(A, j, M, N, P), I = n.Union(A.omit("scopes"), j.omit("scopes"), M.omit("scopes"), N, P.omit("scopes")), L = (e) => {
+	scopes: a,
+	metadata: n.optional(i)
+}), ee = n.Union(o, s, c, l, u), d = n.Union(o.omit("scopes"), s.omit("scopes"), c.omit("scopes"), l, u.omit("scopes")), f = (e) => {
 	if (e.type === "anonymous") return e;
 	let { scopes: t, ...n } = e;
 	return n;
-}, R = (e) => e.scopes ?? [], z = (e) => ({
+}, te = (e) => e.scopes ?? [], p = (e, t) => ({
 	type: "anonymous",
 	id: null,
-	tenantId: e
-}), B = (e, t = ["admin:full"]) => ({
+	tenantId: e,
+	...t === void 0 ? {} : { credentialRejected: t }
+}), m = (e, t = ["admin:full"]) => ({
 	type: "system",
 	id: e,
 	tenantId: null,
 	scopes: t
-}), V = (e, t) => {
+}), h = (e, t) => {
 	let n = e;
 	return {
 		type: "serviceAccount",
@@ -172,15 +56,15 @@ var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "ap
 		scopes: n.scopes ?? ["admin:full"],
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, H = (e) => e.type === "system", U = "impersonation", W = (e) => e.metadata?.impersonation ?? null, G = class extends e.Tag("@voltro/Subject")() {}, K = class extends e.Tag("@voltro/ConnectionInfo")() {}, q = class extends r.Tag()("@voltro/AuthMiddleware", { provides: G }) {}, J = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: K }) {}, Y = (e) => typeof e.mountRoutes == "function", ie = (e) => Array.isArray(e) ? {
+}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, C = (e) => typeof e.mountRoutes == "function", w = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
-} : e, X = (e, t) => {
+} : e, T = (e, t) => {
 	if (e.type === "anonymous") return {
 		subject: e,
 		removed: []
 	};
-	let n = R(e);
+	let n = te(e);
 	if (t.kind === "grant") {
 		if (t.scopes.length === 0) return {
 			subject: e,
@@ -203,14 +87,14 @@ var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "ap
 		},
 		removed: i
 	};
-}, ae = 3e4, oe = 1e4, Z = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, se = () => {
+}, ne = 3e4, re = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ie = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, Q = (e = {}) => {
-	let t = e.ttlMs ?? se() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+}, D = (e = {}) => {
+	let t = e.ttlMs ?? ie() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -246,30 +130,30 @@ var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "ap
 			};
 		}
 	};
-}, ce = (e) => typeof e.resolve == "function", le = (e, t) => {
-	let n = t?.resolveScopes, r = n === void 0 || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && ce(t.scopeCache) ? t.scopeCache : Q(t?.scopeCache ?? {});
+}, O = (e) => typeof e.resolve == "function", k = (e, t) => {
+	let n = t?.resolveScopes, r = n === void 0 || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && O(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
 	return async (i) => {
 		let a = t?.getStore?.(), o = a === void 0 ? i : {
 			...i,
 			store: a
-		};
+		}, s;
 		for (let i of e) {
 			let e = await i.resolve(o);
 			if (e.kind === "matched") {
 				let a = e.subject;
 				if (n !== void 0) {
-					let s = async () => ie(await n(e.subject, o)), { decision: c, fresh: l } = r === null ? {
+					let s = async () => w(await n(e.subject, o)), { decision: c, fresh: l } = r === null ? {
 						decision: await s(),
 						fresh: !0
-					} : await r.resolve(Z(e.subject), s);
+					} : await r.resolve(E(e.subject), s);
 					if (c.kind === "unavailable") {
 						let e = `scope resolution unavailable: ${c.reason}`;
 						throw t?.onStrategyFailed?.({
 							strategyId: i.id,
 							reason: e
-						}), new $({ reason: e });
+						}), new A({ reason: e });
 					}
-					let u = X(e.subject, c);
+					let u = T(e.subject, c);
 					l && u.removed.length > 0 && t?.onScopesNarrowed?.({
 						strategyId: i.id,
 						subjectType: e.subject.type,
@@ -287,17 +171,142 @@ var i = "admin:full", a = "apikeys:issue:self", o = "apikeys:issue:org", s = "ap
 				t?.onStrategyFailed?.({
 					strategyId: i.id,
 					reason: e.reason
-				});
+				}), s = e.reason;
 				break;
 			}
 		}
-		if (t?.fallback) return { subject: await t.fallback(o) };
-		let s = o.headers["x-tenant"] ?? null;
-		if (s === null && t?.anonymousTenantRequired === !0) throw new $({ reason: "tenant required (x-tenant header missing)" });
-		return { subject: z(s) };
+		let c = (e) => s !== void 0 && e.type === "anonymous" ? {
+			...e,
+			credentialRejected: s
+		} : e;
+		if (t?.fallback) return { subject: c(await t.fallback(o)) };
+		let l = o.headers["x-tenant"] ?? null;
+		if (l === null && t?.anonymousTenantRequired === !0) throw new A({ reason: "tenant required (x-tenant header missing)" });
+		return { subject: c(p(l)) };
 	};
-}, $ = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, ue = (e, t) => {
-	if (e.type === "anonymous") throw new $(t === void 0 ? {} : { reason: t });
+}, A = class extends n.TaggedError()("Unauthenticated", { reason: n.optional(n.String) }) {}, j = (e, t) => {
+	if (e.type === "anonymous") throw new A(t === void 0 ? {} : { reason: t });
+}, M = "admin:full", N = "apikeys:issue:self", P = "apikeys:issue:org", F = "apikeys:issue:other", I = class extends n.TaggedError()("ScopeError", {
+	required: n.String,
+	message: n.String
+}) {}, L = (e) => "scopes" in e && e.scopes ? e.scopes : [], R = /* @__PURE__ */ new WeakMap(), z = (e, t) => {
+	typeof e == "object" && e && R.set(e, t);
+}, B = (e) => {
+	if (typeof e == "object" && e) {
+		let t = R.get(e);
+		if (t) return t;
+	}
+	return L(e);
+}, V = (e, t) => {
+	let n = B(e);
+	return n.includes("admin:full") || n.includes(t);
+}, H = (e, t) => {
+	let n = L(e);
+	return n.includes("admin:full") || n.includes(t);
+}, ae = (e, n) => V(e, n) ? t.void : t.fail(new I({
+	required: n,
+	message: `missing required scope '${n}'`
+})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => ({ open: e }), K = (e) => typeof e == "string" ? [e] : e, q, J = (e) => {
+	q = e;
+}, oe = (e) => q === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], se = (e) => [
+	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
+	...e.slice(0, 10).map((e) => `    ${e}`),
+	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
+	"",
+	"  `guards: [{ scope, resource }]` reads as \"may you do this to THIS resource\",",
+	"  but with no resource-scope resolver registered the extractor is advisory and",
+	"  the check runs against the caller's GLOBAL scopes. For an app whose",
+	"  authorization is per-resource, that guard passes callers it should refuse.",
+	"",
+	"  Fix it one of two ways:",
+	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
+	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
+	"    • Drop the `resource` extractor if a global scope check is what you meant."
+].join("\n"), ce = () => q, Y, le = (e) => {
+	Y = e;
+}, X = () => Y, Z = (e) => new I({
+	required: "access-decision",
+	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
+}), Q = (e, t) => {
+	let n = e.credentialRejected;
+	return n === void 0 ? t : new A({ reason: `${n} — the request carried a credential and it was REJECTED, so this caller resolved to anonymous. The guard then refused (${t.message}); the scope is not the problem. Re-authenticate and retry.` });
+}, $ = (e, t, n) => {
+	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
+	for (let n of t) {
+		if (W(n)) continue;
+		if (U(n)) {
+			if (V(e, "admin:full")) continue;
+			return Q(e, new I({
+				required: `${n.resourceType}:${n.action}`,
+				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
+			}));
+		}
+		let t = K(n.scope);
+		if (t.length === 0) continue;
+		let r = t.filter((t) => V(e, t));
+		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
+			let r = (n.mode ?? "all") === "any" ? t[0] : t.find((t) => !V(e, t));
+			return Q(e, new I({
+				required: r,
+				message: (n.mode ?? "all") === "any" ? `missing all of required scopes [${t.join(", ")}]` : `missing required scope '${r}'`
+			}));
+		}
+	}
+	return null;
+}, ue = (e, n, r) => {
+	let i = (e) => new I({
+		required: `${n.resourceType}:${n.action}`,
+		message: e
+	});
+	if (V(e, "admin:full")) return t.succeed(null);
+	let a = Y;
+	if (a === void 0) return t.succeed(i(`no policy resolver registered — cannot authorize '${n.action}' on '${n.resourceType}'`));
+	let o = n.resource(r);
+	return o === void 0 || o === "" ? t.succeed(i(`input does not identify a '${n.resourceType}' to authorize`)) : t.suspend(() => a({
+		subject: e,
+		action: n.action,
+		resourceType: n.resourceType,
+		resourceId: o
+	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
+}, de = (e, n, r, i) => {
+	if (!n || n.length === 0) return t.succeed($(e, n, i));
+	let a = q;
+	return !n.some(U) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
+		for (let i of n) {
+			if (W(i)) continue;
+			if (U(i)) {
+				let t = yield* ue(e, i, r);
+				if (t) return t;
+				continue;
+			}
+			let n = K(i.scope);
+			if (n.length === 0) continue;
+			let o = i.resource ? i.resource(r) : void 0, s = [];
+			for (let r of n) {
+				if (V(e, r)) {
+					s.push(!0);
+					continue;
+				}
+				if (o !== void 0 && a !== void 0) {
+					let n = yield* t.suspend(() => a({
+						subject: e,
+						scope: r,
+						resource: o
+					})).pipe(t.catchAllCause(() => t.succeed(!1)));
+					s.push(n);
+				} else s.push(!1);
+			}
+			let c = i.mode ?? "all";
+			if (!(c === "any" ? s.some(Boolean) : s.every(Boolean))) {
+				let e = c === "any" ? n[0] : n[n.findIndex((e, t) => !s[t])];
+				return new I({
+					required: e,
+					message: c === "any" ? `missing all of required scopes [${n.join(", ")}]` : `missing required scope '${e}'` + (o === void 0 ? "" : ` on resource '${o}'`)
+				});
+			}
+		}
+		return null;
+	});
 };
 //#endregion
-export { D as A, ne as B, i as C, c as D, a as E, p as F, l as G, d as H, ee as I, h as L, y as M, C as N, b as O, x as P, m as R, V as S, s as T, re as U, te as V, v as W, Q as _, ae as a, L as b, I as c, z as d, X as f, H as g, Y as h, oe as i, f as j, T as k, G as l, le as m, K as n, U as o, ue as p, J as r, F as s, q as t, $ as u, W as v, o as w, B as x, Z as y, w as z };
+export { ee as A, D as B, L as C, re as D, S as E, T as F, h as G, E as H, j as I, k as L, y as M, A as N, ne as O, p as P, C as R, J as S, b as T, f as U, v as V, m as W, Z as _, I as a, z as b, de as c, X as d, ce as f, U as g, W as h, N as i, d as j, _ as k, B as l, H as m, P as n, se as o, V as p, F as r, $ as s, M as t, oe as u, G as v, x as w, le as x, ae as y, g as z };

package/dist/session.d.ts

@@ -180,6 +180,7 @@ declare const SessionPayload_2: Schema.Struct<{
         type: Schema.Literal<["anonymous"]>;
         id: typeof Schema.Null;
         tenantId: Schema.NullOr<typeof Schema.String>;
+        credentialRejected: Schema.optional<typeof Schema.String>;
     }>, Schema.Struct<{
         id: typeof Schema.String;
         type: Schema.Literal<["system"]>;
@@ -279,6 +280,23 @@ declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;
     tenantId: Schema.NullOr<typeof Schema.String>;
+    /**
+     * Set when this caller PRESENTED a credential and it was rejected — an
+     * expired token above all. Absent when they presented none.
+     *
+     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * measured the cost: a user's tab outlived their IdP's token lifetime, the
+     * strategy logged `supabase jwt expired`, the caller fell through to
+     * anonymous, and the guard then refused with `missing required scope
+     * 'task:u:o'`. Technically true — an anonymous caller holds no scopes — and
+     * it sent everyone who read it into the permissions system while the problem
+     * was an expired session. They did that round.
+     *
+     * It stays a FALLBACK rather than a hard failure on purpose: a stale cookie
+     * must not break an `openAccess` procedure that needs no session at all. The
+     * fact travels, and only a guard that actually refuses spends it.
+     */
+    credentialRejected: Schema.optional<typeof Schema.String>;
 }>, Schema.Struct<{
     type: Schema.Literal<["system"]>;
     id: typeof Schema.String;
@@ -308,6 +326,23 @@ declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["anonymous"]>;
     id: typeof Schema.Null;
     tenantId: Schema.NullOr<typeof Schema.String>;
+    /**
+     * Set when this caller PRESENTED a credential and it was rejected — an
+     * expired token above all. Absent when they presented none.
+     *
+     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * measured the cost: a user's tab outlived their IdP's token lifetime, the
+     * strategy logged `supabase jwt expired`, the caller fell through to
+     * anonymous, and the guard then refused with `missing required scope
+     * 'task:u:o'`. Technically true — an anonymous caller holds no scopes — and
+     * it sent everyone who read it into the permissions system while the problem
+     * was an expired session. They did that round.
+     *
+     * It stays a FALLBACK rather than a hard failure on purpose: a stale cookie
+     * must not break an `openAccess` procedure that needs no session at all. The
+     * fact travels, and only a guard that actually refuses spends it.
+     */
+    credentialRejected: Schema.optional<typeof Schema.String>;
 }>, Schema.Struct<{
     id: typeof Schema.String;
     type: Schema.Literal<["system"]>;

package/dist/session.js

@@ -1,4 +1,4 @@
-import { G as e, b as t, c as n } from "./auth-CKS3UNnf.js";
+import { C as e, U as t, j as n } from "./scopes-B0kGvAnI.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -54,8 +54,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.39.0",
-    "@voltro/logger": "0.39.0",
+    "@voltro/database": "0.40.0",
+    "@voltro/logger": "0.40.0",
     "jose": "^6.2.8"
   },
   "peerDependencies": {