@voltro/protocol 0.83.1 → 0.85.0

package/dist/session.d.ts

@@ -170,53 +170,51 @@ export declare type SessionPayload = typeof SessionPayload_2.Type;
 
 declare const SessionPayload_2: Schema.Struct<{
     /** Payload format version. Required and pinned — see the header. */
-    v: Schema.Literal<[2]>;
+    readonly v: Schema.Literal<2>;
     /** WHO, never WHAT-THEY-MAY-DO. `SubjectIdentity` has no `scopes` field. */
-    subject: Schema.Union<[Schema.Struct<{
-        type: Schema.Literal<["user"]>;
-        id: typeof Schema.String;
-        tenantId: typeof Schema.String;
-        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"user">;
+        readonly id: Schema.String;
+        readonly tenantId: Schema.String;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>, Schema.Struct<{
-        type: Schema.Literal<["apiKey"]>;
-        id: typeof Schema.String;
-        tenantId: typeof Schema.String;
-        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+        readonly type: Schema.Literal<"apiKey">;
+        readonly id: Schema.String;
+        readonly tenantId: Schema.String;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>, Schema.Struct<{
-        type: Schema.Literal<["serviceAccount"]>;
-        id: typeof Schema.String;
-        tenantId: typeof Schema.String;
-        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-        auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-            exact: true;
-        }>;
+        readonly type: Schema.Literal<"serviceAccount">;
+        readonly id: Schema.String;
+        readonly tenantId: Schema.String;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
     }>, Schema.Struct<{
-        type: Schema.Literal<["anonymous"]>;
-        id: typeof Schema.Null;
-        tenantId: Schema.NullOr<typeof Schema.String>;
-        credentialRejected: Schema.optional<typeof Schema.String>;
+        readonly type: Schema.Literal<"anonymous">;
+        readonly id: Schema.Null;
+        readonly tenantId: Schema.NullOr<Schema.String>;
+        readonly credentialRejected: Schema.optional<Schema.String>;
     }>, Schema.Struct<{
-        type: Schema.Literal<["system"]>;
-        id: typeof Schema.String;
-        tenantId: typeof Schema.Null;
-        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+        readonly type: Schema.Literal<"system">;
+        readonly id: Schema.String;
+        readonly tenantId: Schema.Null;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
     }>, Schema.Struct<{
-        type: Schema.Literal<["service"]>;
-        id: typeof Schema.String;
-        tenantId: typeof Schema.Null;
-        metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-        service: typeof Schema.String;
+        readonly type: Schema.Literal<"service">;
+        readonly id: Schema.String;
+        readonly tenantId: Schema.Null;
+        readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+        readonly service: Schema.String;
     }>]>;
     /** Unix seconds when this session expires. Verify rejects past expiry. */
-    exp: typeof Schema.Number;
+    readonly exp: Schema.Number;
     /** Unix seconds when this session was issued. Drives sliding-window
      *  auto-renewal: verify signals a renew once `now - iat` passes the
      *  renewal threshold (default 70% of the session's lifetime). */
-    iat: typeof Schema.Number;
+    readonly iat: Schema.Number;
     /** Key id of the signing secret. Stamped from the current key on sign;
      *  read on verify to pick which secret to check first. Absent on
      *  values minted with a bare-string secret (single-key path). */
-    kid: Schema.optional<typeof Schema.String>;
+    readonly kid: Schema.optional<Schema.String>;
 }>;
 
 declare type SessionPayload = typeof SessionPayload_2.Type;
@@ -278,33 +276,31 @@ export declare interface SignOptions {
  */
 export declare const signSession: (subject: Subject | SubjectIdentity, secret: string | KeyedSecret, options?: SignOptions) => string;
 
-declare const Subject: Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["user"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+declare const Subject: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["apiKey"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"apiKey">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["serviceAccount"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
+    readonly type: Schema.Literal<"serviceAccount">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
     /** Application actor used for audit columns; null means machine work with
      * no application actor. Identity only, never a permission grant. */
-    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-        exact: true;
-    }>;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["anonymous"]>;
-    id: typeof Schema.Null;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly type: Schema.Literal<"anonymous">;
+    readonly id: Schema.Null;
+    readonly tenantId: Schema.NullOr<Schema.String>;
     /**
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
@@ -321,47 +317,45 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * must not break an `openAccess` procedure that needs no session at all. The
      * fact travels, and only a guard that actually refuses spends it.
      */
-    credentialRejected: Schema.optional<typeof Schema.String>;
+    readonly credentialRejected: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["system"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"system">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["service"]>;
-    id: typeof Schema.String;
+    readonly type: Schema.Literal<"service">;
+    readonly id: Schema.String;
     /** The calling app's name, as the callee lists it in `serviceCallers`. */
-    service: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    scopes: Schema.optional<Schema.Array$<typeof Schema.String>>;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly service: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly scopes: Schema.optional<Schema.$Array<Schema.String>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>]>;
 
 declare type Subject = typeof Subject.Type;
 
-declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
-    type: Schema.Literal<["user"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+declare const SubjectIdentity: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"user">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["apiKey"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"apiKey">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["serviceAccount"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.String;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    auditActorId: Schema.optionalWith<Schema.NullOr<typeof Schema.String>, {
-        exact: true;
-    }>;
+    readonly type: Schema.Literal<"serviceAccount">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.String;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly auditActorId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["anonymous"]>;
-    id: typeof Schema.Null;
-    tenantId: Schema.NullOr<typeof Schema.String>;
+    readonly type: Schema.Literal<"anonymous">;
+    readonly id: Schema.Null;
+    readonly tenantId: Schema.NullOr<Schema.String>;
     /**
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
@@ -378,18 +372,18 @@ declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
      * must not break an `openAccess` procedure that needs no session at all. The
      * fact travels, and only a guard that actually refuses spends it.
      */
-    credentialRejected: Schema.optional<typeof Schema.String>;
+    readonly credentialRejected: Schema.optional<Schema.String>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["system"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly type: Schema.Literal<"system">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
 }>, Schema.Struct<{
-    type: Schema.Literal<["service"]>;
-    id: typeof Schema.String;
-    tenantId: typeof Schema.Null;
-    metadata: Schema.optional<Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
-    service: typeof Schema.String;
+    readonly type: Schema.Literal<"service">;
+    readonly id: Schema.String;
+    readonly tenantId: Schema.Null;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly service: Schema.String;
 }>]>;
 
 declare type SubjectIdentity = typeof SubjectIdentity.Type;

package/dist/session.js

@@ -1,4 +1,4 @@
-import { j as e, nt as t, z as n } from "./scopes-Di756ENh.js";
+import { j as e, nt as t, z as n } from "./scopes-ClywBij8.js";
 import { n as r, t as i } from "./sessionHeader-DriTZhmv.js";
 import { Schema as a } from "effect";
 import { createHmac as o, timingSafeEqual as s } from "node:crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.83.1",
+  "version": "0.85.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -63,16 +63,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@effect/experimental": "^0.61.1",
-    "@effect/sql": "^0.52.1",
-    "@voltro/database": "0.83.1",
-    "@voltro/logger": "0.83.1",
+    "@voltro/database": "0.85.0",
+    "@voltro/logger": "0.85.0",
     "jose": "^6.2.12"
   },
   "peerDependencies": {
-    "@effect/platform": "^0.97.2",
-    "@effect/rpc": "^0.76.2",
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"