@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": minor
+"@objectstack/core": patch
+"@objectstack/service-print": patch
+---
+
+feat(spec): `AuthSessionApi.getSession`'s result declares the fields its in-process readers read
+
+Clause-②: yes (widening)
+
+- **`@objectstack/spec/contracts` — `AuthSessionApi.getSession`'s result gains five optional members**, each declared for a named reader and typed as that reader takes it: `user.email` and `session.id` / `session.token` (read by `resolveAuthzContext`'s session arm in `@objectstack/core`), `user.authGate` as `unknown` (the ADR-0069 posture, which `normalizeAuthGate` validates against the closed posture vocabulary), and `session.impersonatedBy` as `string | null` (read by the print door's `impersonatorOf` in `@objectstack/service-print`). Before this, those reads went through `any` or a cast, so a field better-auth dropped or renamed compiled and read `undefined`. For `impersonatedBy`, that would have silently turned off the impersonation refusal. Every member is optional, so every implementer and caller typechecks unchanged.
+- **`@objectstack/core`**: `resolveAuthzContext`'s session arm reads the session through the declared type instead of `any`. `ResolveAuthzInput.getSession`'s own type is unchanged. Runtime behaviour is unchanged.
+- **`@objectstack/service-print`**: `impersonatorOf` reads `session.impersonatedBy` through the declared type instead of a cast. Runtime behaviour is unchanged.
@@ -63,6 +63,7 @@ import { SystemObjectName } from '@objectstack/spec/system';
 import type { AuthzPosture, TenancyPosture } from '@objectstack/spec/security';
 import { postureEnforcesWall } from '@objectstack/spec/security';
 import { isValueDomainMember } from '@objectstack/spec/shared';
+import type { AuthSessionApi } from '@objectstack/spec/contracts';
 
 import { ApiKeyLifecycleRefusalError, resolveApiKeyAdmission } from './api-key.js';
 import type { ApiKeyLifecyclePolicySource, ApiKeyRefusalReason } from './api-key.js';
@@ -146,6 +147,9 @@ export interface ResolvedAuthzContext {
   authGate?: AuthGate;
 }
 
+/** What an in-process better-auth session read answers, as `AuthSessionApi` declares it. */
+type SessionRead = Awaited<ReturnType<NonNullable<AuthSessionApi['getSession']>>>;
+
 export interface ResolveAuthzInput {
   /** Data engine (ObjectQL) exposing `find(object, { where, limit, context })`. */
   ql: any;
@@ -539,7 +543,9 @@ async function resolveAuthzContextInScope(input: ResolveAuthzInput): Promise<Res
   // 2. Session / Bearer path — fall back when no API key resolved a user.
   if (!userId && typeof input.getSession === 'function') {
     try {
-      const sessionData = await input.getSession(headers);
+      // [#24196] Read as `AuthSessionApi.getSession` declares its answer, so
+      // every field this arm reads is one the contract names for it.
+      const sessionData: SessionRead | null = await input.getSession(headers);
       userId = sessionData?.user?.id ?? sessionData?.session?.userId;
       tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;
       if (userId) {
 
@@ -14,7 +14,7 @@ import {
   userAuthGateSourceOf,
 } from '@objectstack/core';
 import type { ErrorCode } from '@objectstack/spec/api';
-import type { IAuthService, IHttpRequest, IHttpResponse, IHttpServer } from '@objectstack/spec/contracts';
+import type { AuthSessionApi, IAuthService, IHttpRequest, IHttpResponse, IHttpServer } from '@objectstack/spec/contracts';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
 import type { TenancyPosture } from '@objectstack/spec/security';
 import {
@@ -132,10 +132,13 @@ export function registerPrintRoutes(http: IHttpServer, deps: PrintRoutesDeps): v
 }
 
 /** The caller, as the door resolved it: the context, and the session read that admitted it. */
+/** What the auth service's in-process session read answers, as `AuthSessionApi` declares it. */
+type SessionRead = Awaited<ReturnType<NonNullable<AuthSessionApi['getSession']>>>;
+
 interface ResolvedCaller {
   context: ExecutionContext | undefined;
   /** The session payload the auth service returned, when a session (not an API key) admitted the caller. */
-  session: unknown;
+  session: SessionRead;
   authGate: ReturnType<typeof evaluateAuthGate>;
 }
 
@@ -226,9 +229,9 @@ async function resolveCaller(req: IHttpRequest, deps: PrintRoutesDeps): Promise<
     headers.set(name, Array.isArray(value) ? value.join(',') : String(value));
   }
   const auth = deps.getAuth();
-  let sessionRead: unknown;
+  let sessionRead: SessionRead;
   const getSession = auth
-    ? async (h: Headers): Promise<unknown> => {
+    ? async (h: Headers): Promise<SessionRead> => {
         const api = auth.api ?? (await auth.getApi?.());
         sessionRead = await api?.getSession?.(inProcessSessionReadInput(h));
         return sessionRead;
@@ -267,9 +270,8 @@ async function resolveCaller(req: IHttpRequest, deps: PrintRoutesDeps): Promise<
  * plugin writes `impersonatedBy` on the session it mints for an impersonation,
  * and `@objectstack/plugin-auth` stores it as `sys_session.impersonated_by`.
  */
-function impersonatorOf(sessionRead: unknown): string | undefined {
-  const session = (sessionRead as { session?: { impersonatedBy?: unknown } } | null | undefined)?.session;
-  const by = session?.impersonatedBy;
+function impersonatorOf(sessionRead: SessionRead): string | undefined {
+  const by = sessionRead?.session?.impersonatedBy;
   return typeof by === 'string' && by.trim() !== '' ? by : undefined;
 }
 
 
@@ -379,10 +379,41 @@ export interface IAuthService {
  * `cloud-connection-plugin.ts` and `marketplace-install-local-plugin.ts`
  * (twice). `packages/types/src/in-process-session-read.contract.test.ts`
  * holds the helper's return inside this declaration, key for key.
+ *
+ * [#24196] Each result field beyond `user.id`, `session.userId` and
+ * `session.activeOrganizationId` is declared for the reader named on it, typed
+ * as that reader takes it. Read undeclared, through `any` or a cast, a field
+ * better-auth drops or renames compiles and reads `undefined` — for
+ * `impersonatedBy`, an impersonation refusal switched off.
  */
 export interface AuthSessionApi {
     getSession?(input: { headers: unknown; query?: { disableRefresh?: boolean } }): Promise<{
-        user?: { id?: string };
-        session?: { userId?: string; activeOrganizationId?: string };
+        user?: {
+            id?: string;
+            /** Read by `resolveAuthzContext`'s session arm (`@objectstack/core`) onto `ctx.email`. */
+            email?: string;
+            /**
+             * The ADR-0069 posture plugin-auth's `customSession` attaches. Read by
+             * `normalizeAuthGate` (`@objectstack/core`) from `resolveAuthzContext`'s
+             * session arm, which validates it against the closed posture vocabulary,
+             * so it is declared as that reader takes it: unvalidated.
+             */
+            authGate?: unknown;
+        };
+        session?: {
+            userId?: string;
+            activeOrganizationId?: string;
+            /** The session ROW id. Read by `resolveAuthzContext`'s session arm for its dropped-claim log line. */
+            id?: string;
+            /** The session credential. Read by `resolveAuthzContext`'s session arm onto `ctx.accessToken`. */
+            token?: string;
+            /**
+             * The administrator who started an impersonation session (better-auth's
+             * admin plugin; stored as the nullable `sys_session.impersonated_by`).
+             * Read by the print door's `impersonatorOf` (`@objectstack/service-print`),
+             * which refuses a print from an impersonation session.
+             */
+            impersonatedBy?: string | null;
+        };
     } | undefined>;
 }