@voltro/protocol 0.64.0 → 0.66.0

package/dist/{scopes-D9t3tYc7.js → scopes-C86BDyNJ.js}

@@ -56,7 +56,7 @@ var i = n.Record({
 		scopes: n.scopes ?? ["admin:full"],
 		...n.metadata === void 0 ? {} : { metadata: n.metadata }
 	};
-}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, ne = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, S = (e) => typeof e.mountRoutes == "function", C = (e) => Array.isArray(e) ? {
+}, g = (e) => e.type === "system", _ = "impersonation", v = (e) => e.metadata?.impersonation ?? null, y = class extends e.Tag("@voltro/Subject")() {}, b = class extends e.Tag("@voltro/ConnectionInfo")() {}, x = class extends r.Tag()("@voltro/AuthMiddleware", { provides: y }) {}, S = class extends r.Tag()("@voltro/ConnectionInfoMiddleware", { provides: b }) {}, ne = (e) => typeof e.mountRoutes == "function", C = (e) => Array.isArray(e) ? {
 	kind: "grant",
 	scopes: e
 } : e, w = (e, t) => {
@@ -88,14 +88,14 @@ var i = n.Record({
 		},
 		removed: i
 	};
-}, re = 3e4, ie = 1e4, T = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ae = () => {
+}, T = 3e4, re = 1e4, E = (e) => `${e.type}\u0000${e.tenantId ?? ""}\u0000${e.id ?? ""}`, ie = () => {
 	if (typeof process > "u") return;
 	let e = process.env.VOLTRO_AUTH_SCOPE_CACHE_TTL_MS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? t : void 0;
-}, E = (e = {}) => {
-	let t = e.ttlMs ?? ae() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
+}, D = (e = {}) => {
+	let t = e.ttlMs ?? ie() ?? 3e4, n = e.maxEntries ?? 1e4, r = e.now ?? Date.now, i = /* @__PURE__ */ new Map(), a = () => {
 		if (i.size <= n) return;
 		let e = r();
 		for (let [t, n] of i) n.freshUntil <= e && i.delete(t);
@@ -131,8 +131,8 @@ var i = n.Record({
 			};
 		}
 	};
-}, D = (e) => typeof e.resolve == "function", O = (e, t) => {
-	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && D(t.scopeCache) ? t.scopeCache : E(t?.scopeCache ?? {});
+}, ae = (e) => typeof e.resolve == "function", O = (e, t) => {
+	let n = t?.resolveScopes, r = t?.subjectGuards ?? [], i = n !== void 0 || r.length > 0, a = !i || t?.scopeCache === !1 ? null : t?.scopeCache !== void 0 && ae(t.scopeCache) ? t.scopeCache : D(t?.scopeCache ?? {});
 	return async (o) => {
 		let s = t?.getStore?.(), c = s === void 0 ? o : {
 			...o,
@@ -167,7 +167,7 @@ var i = n.Record({
 					}, { decision: l, fresh: u } = a === null ? {
 						decision: await i(),
 						fresh: !0
-					} : await a.resolve(T(e.subject), i);
+					} : await a.resolve(E(e.subject), i);
 					if (l.kind === "vetoed") {
 						let e = `${l.code}: ${l.message}`;
 						throw t?.onStrategyFailed?.({
@@ -235,9 +235,9 @@ var i = n.Record({
 }, H = (e, n) => B(e, n) ? t.void : t.fail(new F({
 	required: n,
 	message: `missing required scope '${n}'`
-})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => ({ open: e }), K = (e) => typeof e == "string" ? [e] : e, q, J = (e) => {
-	q = e;
-}, oe = (e) => q === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], se = (e) => [
+})), U = (e) => typeof e.action == "string" && typeof e.resourceType == "string", W = (e) => typeof e.open == "string", G = (e) => e.authenticated === !0, K = (e) => ({ open: e }), q = (e) => typeof e == "string" ? [e] : e, J, oe = (e) => {
+	J = e;
+}, se = (e) => J === void 0 ? e.filter((e) => (e.guards ?? []).some((e) => !U(e) && e.resource !== void 0)).map((e) => e.tag) : [], ce = (e) => [
 	`${e.length} procedure${e.length === 1 ? "" : "s"} declare a per-resource guard that nothing enforces:`,
 	...e.slice(0, 10).map((e) => `    ${e}`),
 	...e.length > 10 ? [`    … and ${e.length - 10} more`] : [],
@@ -251,9 +251,9 @@ var i = n.Record({
 	"    • setResourceScopeResolver((req) => Effect<boolean>) — answers \"does this",
 	"      subject hold `req.scope` on `req.resource`\" from your own tables.",
 	"    • Drop the `resource` extractor if a global scope check is what you meant."
-].join("\n"), ce = () => q, Y, le = (e) => {
+].join("\n"), le = () => J, Y, X = (e) => {
 	Y = e;
-}, X = () => Y, Z = (e) => new F({
+}, ue = () => Y, Z = (e) => new F({
 	required: "access-decision",
 	message: `${e ?? "this procedure"} declares no access decision: it has neither \`guards:\` nor \`openAccess:\`, and the app runs with \`security.defaultDeny\`. Add the scope(s) a caller must hold (\`guards: [{ scope: '…' }]\`), or declare it open on purpose with \`openAccess: '<why anyone may call this>'\`.`
 }), Q = (e, t) => {
@@ -263,6 +263,13 @@ var i = n.Record({
 	if (!t || t.length === 0) return n?.defaultDeny === !0 ? Z(n.procedure) : null;
 	for (let n of t) {
 		if (W(n)) continue;
+		if (G(n)) {
+			if (e.id !== null && e.id !== void 0) continue;
+			return Q(e, new F({
+				required: "authenticated",
+				message: "this procedure requires an authenticated caller"
+			}));
+		}
 		if (U(n)) {
 			if (B(e, "admin:full")) continue;
 			return Q(e, new F({
@@ -270,7 +277,7 @@ var i = n.Record({
 				message: `relationship guard '${n.action}' on '${n.resourceType}' cannot be checked synchronously`
 			}));
 		}
-		let t = K(n.scope);
+		let t = q(n.scope);
 		if (t.length === 0) continue;
 		let r = t.filter((t) => B(e, t));
 		if (!((n.mode ?? "all") === "any" ? r.length > 0 : r.length === t.length)) {
@@ -282,7 +289,7 @@ var i = n.Record({
 		}
 	}
 	return null;
-}, ue = (e, n, r) => {
+}, de = (e, n, r) => {
 	let i = (e) => new F({
 		required: `${n.resourceType}:${n.action}`,
 		message: e
@@ -297,18 +304,25 @@ var i = n.Record({
 		resourceType: n.resourceType,
 		resourceId: o
 	})).pipe(t.catchAllCause(() => t.succeed(!1)), t.map((e) => e ? null : i(`no '${n.action}' relation on ${n.resourceType}:${o}`)));
-}, de = (e, n, r, i) => {
+}, fe = (e, n, r, i) => {
 	if (!n || n.length === 0) return t.succeed($(e, n, i));
-	let a = q;
+	let a = J;
 	return !n.some(U) && (!a || !n.some((e) => e.resource !== void 0)) ? t.succeed($(e, n, i)) : t.gen(function* () {
 		for (let i of n) {
 			if (W(i)) continue;
+			if (G(i)) {
+				if (e.id !== null && e.id !== void 0) continue;
+				return Q(e, new F({
+					required: "authenticated",
+					message: "this procedure requires an authenticated caller"
+				}));
+			}
 			if (U(i)) {
-				let t = yield* ue(e, i, r);
+				let t = yield* de(e, i, r);
 				if (t) return t;
 				continue;
 			}
-			let n = K(i.scope);
+			let n = q(i.scope);
 			if (n.length === 0) continue;
 			let o = i.resource ? i.resource(r) : void 0, s = [];
 			for (let r of n) {
@@ -338,4 +352,4 @@ var i = n.Record({
 	});
 };
 //#endregion
-export { d as A, E as B, I as C, ie as D, ne as E, w as F, te as G, T as H, A as I, O as L, y as M, k as N, re as O, h as P, S as R, J as S, b as T, p as U, v as V, ee as W, Z as _, F as a, R as b, de as c, X as d, ce as f, U as g, W as h, M as i, f as j, _ as k, z as l, V as m, N as n, se as o, B as p, P as r, $ as s, j as t, oe as u, G as v, x as w, le as x, H as y, g as z };
+export { _ as A, g as B, oe as C, S as D, b as E, h as F, ee as G, v as H, w as I, te as K, A as L, f as M, y as N, re as O, k as P, O as R, X as S, x as T, E as U, D as V, p as W, U as _, F as a, H as b, fe as c, ue as d, le as f, W as g, G as h, M as i, d as j, T as k, z as l, V as m, N as n, ce as o, B as p, P as r, $ as s, j as t, se as u, Z as v, I as w, R as x, K as y, ne as z };

package/dist/{serverErrorBus-QQgyq6fV.js → serverErrorBus-BTnTpMqj.js}

@@ -1,12 +1,21 @@
 import { Schema as e } from "effect";
 //#region src/idempotency.ts
-var t = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, n = (e, t, n) => `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}`, r = async (e, t, n, r, i) => {
+var t = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, n = (e, t, n, r) => r === void 0 ? `${e ?? "(global)"}|${t ?? "(anon)"}|WS|${n}` : `WS-connection:${JSON.stringify([
+	e ?? null,
+	t ?? null,
+	n,
+	r
+])}`, r = class extends e.TaggedError()("MutationConnectionRequired", { traceId: e.String }) {
+	get message() {
+		return "this mutation requires a live native WebSocket connection";
+	}
+}, i = async (e, t, n, r, i) => {
 	let a = await e.claim(t, n, i, r);
 	return a === "claimed" ? { kind: "fresh" } : a.status === "completed" && a.response ? {
 		kind: "replay",
 		response: a.response
 	} : { kind: "conflict" };
-}, i = (e, t, n, r, i) => e.complete(t, n, r, i), a = (e, t, n) => e.release(t, n), o = () => {
+}, a = (e, t, n, r, i) => e.complete(t, n, r, i), o = (e, t, n) => e.release(t, n), s = () => {
 	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${e}\u0000${t}`;
 	return {
 		get: async (n, r) => e.get(t(n, r)) ?? null,
@@ -33,19 +42,19 @@ var t = (e, t, n) => `${e ?? "(global)"}|${t.toUpperCase()}|${n}`, n = (e, t, n)
 			e.delete(t(n, r));
 		}
 	};
-}, s = class extends e.TaggedError()("MutationInFlight", {
+}, c = class extends e.TaggedError()("MutationInFlight", {
 	traceId: e.String,
 	retryAfterMs: e.Number
 }) {
 	get message() {
 		return `a request with this idempotency key is still in flight — replay the same key after ${this.retryAfterMs}ms`;
 	}
-}, c = 1e3, l = /* @__PURE__ */ new Set(), u = (e) => {
-	for (let t of l) try {
+}, l = 1e3, u = /* @__PURE__ */ new Set(), d = (e) => {
+	for (let t of u) try {
 		t(e);
 	} catch {}
-}, d = (e) => (l.add(e), () => {
-	l.delete(e);
+}, f = (e) => (u.add(e), () => {
+	u.delete(e);
 });
 //#endregion
-export { r as a, t as c, s as i, o as l, d as n, a as o, c as r, i as s, u as t, n as u };
+export { c as a, a as c, n as d, r as i, t as l, f as n, i as o, l as r, o as s, d as t, s as u };

package/dist/session.js

@@ -1,11 +1,11 @@
-import { C as e, U as t, j as n } from "./scopes-D9t3tYc7.js";
+import { M as e, W as t, w as n } from "./scopes-C86BDyNJ.js";
 import { Schema as r } from "effect";
 import { createHmac as i, timingSafeEqual as a } from "node:crypto";
 import { createLogger as o } from "@voltro/logger";
 //#region src/session.ts
 var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 	v: r.Literal(2),
-	subject: n,
+	subject: e,
 	exp: r.Number,
 	iat: r.Number,
 	kid: r.optional(r.String)
@@ -38,14 +38,14 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 }, C = 604800, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, D = (n, r, i = {}) => {
+} : e, D = (e, r, i = {}) => {
 	let a = E(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
-	let o = e(n);
-	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${n.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let o = n(e);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
 	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
-		subject: t(n),
+		subject: t(e),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -59,8 +59,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.64.0",
-    "@voltro/logger": "0.64.0",
+    "@voltro/database": "0.66.0",
+    "@voltro/logger": "0.66.0",
     "jose": "^6.2.8"
   },
   "peerDependencies": {