@voltro/protocol 0.81.0 → 0.82.0

package/dist/session.js

@@ -1,24 +1,25 @@
-import { L as e, et as t, k as n } from "./scopes-CvU5QBQ4.js";
-import { Schema as r } from "effect";
-import { createHmac as i, timingSafeEqual as a } from "node:crypto";
-import { createLogger as o } from "@voltro/logger";
+import { j as e, nt as t, z as n } from "./scopes-Di756ENh.js";
+import { n as r, t as i } from "./sessionHeader-DriTZhmv.js";
+import { Schema as a } from "effect";
+import { createHmac as o, timingSafeEqual as s } from "node:crypto";
+import { createLogger as c } from "@voltro/logger";
 //#region src/session.ts
-var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
-	v: r.Literal(2),
-	subject: e,
-	exp: r.Number,
-	iat: r.Number,
-	kid: r.optional(r.String)
-}), u = "k0", d = "k-previous", f = () => {
+var l = c({ scope: "@voltro/protocol:session" }), u = 2, d = a.Struct({
+	v: a.Literal(2),
+	subject: n,
+	exp: a.Number,
+	iat: a.Number,
+	kid: a.optional(a.String)
+}), f = "k0", p = "k-previous", m = () => {
 	throw Error("VOLTRO_SESSION_SECRET is not set. It signs and verifies session cookies, and the framework refuses to invent one at this point: a fixed fallback would be readable by anyone with the source, making every session forgeable. `voltro dev` mints a project-local value into .env.local on boot; for a deployment, generate one with `voltro secret generate session`.");
-}, p = () => process.env.VOLTRO_SESSION_SECRET ?? f(), m = () => g() ?? { current: {
-	kid: h(),
-	secret: p()
-} }, h = () => process.env.VOLTRO_SESSION_KID ?? "k0", g = () => {
+}, h = () => process.env.VOLTRO_SESSION_SECRET ?? m(), g = () => v() ?? { current: {
+	kid: _(),
+	secret: h()
+} }, _ = () => process.env.VOLTRO_SESSION_KID ?? "k0", v = () => {
 	let e = process.env.VOLTRO_SESSION_SECRET;
 	if (e === void 0 || e === "") return;
 	let t = {
-		kid: h(),
+		kid: _(),
 		secret: e
 	}, n = process.env.VOLTRO_SESSION_SECRET_PREVIOUS;
 	return n ? {
@@ -28,54 +29,54 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 			secret: n
 		}
 	} : { current: t };
-}, _ = 32, v = (e = process.env) => {
+}, y = 32, b = (e = process.env) => {
 	let t = e.VOLTRO_SESSION_SECRET;
 	if (t === void 0 || t === "") throw Error("VOLTRO_SESSION_SECRET is not set — refusing to serve. It signs session cookies, and there is no fallback: a built-in one would be readable by anyone with the source. Generate one with `voltro secret generate session`. (`voltro dev` mints a project-local value automatically; a deployment needs its own.)");
 	if (t.length < 32) throw Error(`VOLTRO_SESSION_SECRET is only ${t.length} chars — too short for a session secret (need >= 32). This looks like a placeholder. Generate a real one with \`voltro secret generate session\`.`);
-}, y = r.encodeSync(l), b = r.decodeUnknownSync(l), x = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), S = (e) => {
+}, x = a.encodeSync(d), S = a.decodeUnknownSync(d), C = (e) => (typeof e == "string" ? Buffer.from(e, "utf8") : e).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), w = (e) => {
 	let t = e.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - e.length % 4) % 4);
 	return Buffer.from(t, "base64");
-}, C = 604800, w = .7, T = (e, t) => x(i("sha256", t).update(e).digest()), E = (e) => typeof e == "string" ? {
+}, T = 604800, E = .7, D = (e, t) => C(o("sha256", t).update(e).digest()), O = (e) => typeof e == "string" ? {
 	kid: "k0",
 	secret: e
-} : e, D = (e, r, i = {}) => {
-	let a = E(r);
+} : e, k = (n, r, i = {}) => {
+	let a = O(r);
 	if (!a.secret) throw Error("signSession: secret must be a non-empty string");
-	let o = n(e);
-	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${e.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
-	let s = i.ttlSeconds ?? C, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
+	let o = e(n);
+	if (o.length > 0) throw Error(`signSession: refusing to mint a session cookie for a ${n.type} subject carrying ${o.length} scope(s) (${o.slice(0, 5).join(", ")}). A session cookie carries IDENTITY only — authority is resolved per request, so that removing a role takes effect on the session that already exists instead of in up to 7 days. Mint the session from the identity and move the scopes into the auth.resolveScopes resolver, which runs on every request and can be invalidated the moment a role changes.`);
+	let s = i.ttlSeconds ?? T, c = Math.floor((i.now ?? Date.now)() / 1e3), l = {
 		v: 2,
-		subject: t(e),
+		subject: t(n),
 		exp: c + s,
 		iat: c,
 		...typeof r == "string" ? {} : { kid: a.kid }
-	}, u = x(JSON.stringify(y(l)));
-	return `${u}.${T(u, a.secret)}`;
-}, O = (e, t, n, r) => {
-	let o = i("sha256", n).update(e).digest(), s = S(t);
-	if (s.length !== o.length || !a(s, o)) return null;
+	}, u = C(JSON.stringify(x(l)));
+	return `${u}.${D(u, a.secret)}`;
+}, A = (e, t, n, r) => {
+	let i = o("sha256", n).update(e).digest(), a = w(t);
+	if (a.length !== i.length || !s(a, i)) return null;
 	try {
-		let t = S(e).toString("utf8"), n = b(JSON.parse(t));
+		let t = w(e).toString("utf8"), n = S(JSON.parse(t));
 		return n.exp < Math.floor(r() / 1e3) ? null : n;
 	} catch {
 		return null;
 	}
-}, k = (e, t) => {
+}, j = (e, t) => {
 	if (!e || !t) return null;
 	let n = e.indexOf(".");
 	if (n <= 0 || n === e.length - 1) return null;
-	let r = O(e.slice(0, n), e.slice(n + 1), t, Date.now);
+	let r = A(e.slice(0, n), e.slice(n + 1), t, Date.now);
 	return r ? r.subject : null;
-}, A = (e, t, n = {}) => {
+}, M = (e, t, n = {}) => {
 	if (!e) return null;
 	let r = e.indexOf(".");
 	if (r <= 0 || r === e.length - 1) return null;
 	let i = e.slice(0, r), a = e.slice(r + 1), o = t.previous ? [t.current, t.previous] : [t.current], s = n.now ?? Date.now;
 	for (let e of o) {
 		if (!e.secret) continue;
-		let t = O(i, a, e.secret, s);
+		let t = A(i, a, e.secret, s);
 		if (!t) continue;
-		let r = n.renewFraction ?? w, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
+		let r = n.renewFraction ?? E, o = Math.floor(s() / 1e3), c = t.exp - t.iat, l = t.iat + c * r;
 		return {
 			subject: t.subject,
 			renew: o >= l,
@@ -85,14 +86,14 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 		};
 	}
 	return null;
-}, j = (e, t) => {
+}, N = (e, t) => {
 	let n = Buffer.from(e, "utf8"), r = Buffer.from(t, "utf8");
-	return n.length === r.length && a(n, r);
-}, M = (e, t, n) => {
+	return n.length === r.length && s(n, r);
+}, P = (e, t, n) => {
 	if (!t || t.length === 0) return n?.openWhenUnset === !0;
 	let r = e.authorization ?? e.Authorization;
-	return !r || !r.startsWith("Bearer ") ? !1 : j(r.slice(7).trim(), t);
-}, N = (e, t) => {
+	return !r || !r.startsWith("Bearer ") ? !1 : N(r.slice(7).trim(), t);
+}, F = (e, t) => {
 	if (e) for (let n of e.split(";")) {
 		let e = n.indexOf("=");
 		if (e < 0 || n.slice(0, e).trim() !== t) continue;
@@ -104,26 +105,26 @@ var s = o({ scope: "@voltro/protocol:session" }), c = 2, l = r.Struct({
 			return r;
 		}
 	}
-}, P = (e, t, n = {}) => {
+}, I = (e, t, n = {}) => {
 	let r = [`${e}=${encodeURIComponent(t)}`];
 	if (r.push(`Path=${n.path ?? "/"}`), n.maxAgeSeconds !== void 0 && r.push(`Max-Age=${n.maxAgeSeconds}`), r.push("HttpOnly"), n.httpOnly === !1) {
 		let e = r.indexOf("HttpOnly");
 		e >= 0 && r.splice(e, 1);
 	}
 	return r.push(`SameSite=${n.sameSite ?? "Lax"}`), (n.secure ?? !0) && r.push("Secure"), n.domain && r.push(`Domain=${n.domain}`), r.join("; ");
-}, F = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", I = (e) => {
-	let t = N(e.cookie ?? e.Cookie, F);
+}, L = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", R = (e, t = L) => r(e, t, F), z = (e) => {
+	let t = r(e, L, F);
 	if (!t) return;
-	let n = g();
+	let n = v();
 	if (!n) {
-		R();
+		V();
 		return;
 	}
-	return A(t, n)?.exp;
-}, L = !1, R = () => {
-	L || (L = !0, s.error("a `voltro:session` cookie was presented but VOLTRO_SESSION_SECRET is not set — the session cannot be verified, so no credential-expiry bound is imposed and realtime subscriptions on this connection will not be cut off when the session expires. Set VOLTRO_SESSION_SECRET (`voltro secret generate session`); `voltro dev` mints one, `voltro serve` refuses to boot without one.", { cookieName: F }));
-}, z = () => {
-	L = !1;
+	return M(t, n)?.exp;
+}, B = !1, V = () => {
+	B || (B = !0, l.error("a `voltro:session` cookie was presented but VOLTRO_SESSION_SECRET is not set — the session cannot be verified, so no credential-expiry bound is imposed and realtime subscriptions on this connection will not be cut off when the session expires. Set VOLTRO_SESSION_SECRET (`voltro secret generate session`); `voltro dev` mints one, `voltro serve` refuses to boot without one.", { cookieName: L }));
+}, H = () => {
+	B = !1;
 };
 //#endregion
-export { d as DEFAULT_PREVIOUS_SESSION_KID, u as DEFAULT_SESSION_KID, _ as MIN_SESSION_SECRET_LENGTH, F as SESSION_COOKIE_NAME, c as SESSION_PAYLOAD_VERSION, v as assertProductionSessionSecret, P as buildSetCookie, M as checkBearer, N as readCookie, z as resetSessionSecretWarningLatch, g as resolveOptionalSessionSecrets, p as resolveSessionSecret, m as resolveSessionSecrets, I as sessionExpiryFromHeaders, D as signSession, j as timingSafeStringEqual, k as verifySession, A as verifySessionKeyed };
+export { p as DEFAULT_PREVIOUS_SESSION_KID, f as DEFAULT_SESSION_KID, y as MIN_SESSION_SECRET_LENGTH, L as SESSION_COOKIE_NAME, i as SESSION_HEADER_NAME, u as SESSION_PAYLOAD_VERSION, b as assertProductionSessionSecret, I as buildSetCookie, P as checkBearer, F as readCookie, R as readSessionValue, H as resetSessionSecretWarningLatch, v as resolveOptionalSessionSecrets, h as resolveSessionSecret, g as resolveSessionSecrets, z as sessionExpiryFromHeaders, k as signSession, N as timingSafeStringEqual, j as verifySession, M as verifySessionKeyed };

package/dist/sessionHeader-DriTZhmv.js

@@ -0,0 +1,7 @@
+//#region src/sessionHeader.ts
+var e = "x-voltro-session", t = (e, t, n) => {
+	let r = e["x-voltro-session"] ?? e["X-Voltro-Session"];
+	return r !== void 0 && r.length > 0 ? r : n(e.cookie ?? e.Cookie, t);
+};
+//#endregion
+export { t as n, e as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -65,8 +65,8 @@
   "dependencies": {
     "@effect/experimental": "^0.61.1",
     "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.81.0",
-    "@voltro/logger": "0.81.0",
+    "@voltro/database": "0.82.0",
+    "@voltro/logger": "0.82.0",
     "jose": "^6.2.12"
   },
   "peerDependencies": {