@abloatai/transaction 0.59.2 → 0.61.0

package/dist/sessions/client.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Server-side session issuer.
+ *
+ * This is deliberately separate from `Ablo(...)`: the participant client owns
+ * schema model properties, while this client owns credential issuance and
+ * lifecycle administration. A schema model named `sessions` therefore remains
+ * available as `ablo.sessions` like every other model.
+ */
+import type { CredentialProvider } from '../auth/credentialResult.js';
+import type { Schema, SchemaRecord } from '../schema/schema.js';
+import type { AbloSession, CreateSessionParams, RevokeSessionParams, RotateSessionParams, SessionRevocation, SessionRotation } from './contract.js';
+import { type SessionHandler, type SessionHandlerOptions } from './handler.js';
+export interface SessionsOptions<S extends SchemaRecord> {
+    readonly schema: Schema<S>;
+    readonly apiKey?: string | CredentialProvider | null;
+    readonly baseURL?: string | null;
+    readonly bootstrapBaseUrl?: string;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly dangerouslyAllowBrowser?: boolean;
+}
+export interface SessionsClient<S extends SchemaRecord> {
+    create(params: CreateSessionParams<S>): Promise<AbloSession>;
+    handler<Principal>(options: SessionHandlerOptions<S, Principal>): SessionHandler;
+    revoke(params: RevokeSessionParams): Promise<SessionRevocation>;
+    rotate(params: RotateSessionParams): Promise<SessionRotation>;
+}
+/** Construct the server-side issuer for user and agent sessions. */
+export declare function Sessions<const S extends SchemaRecord>(options: SessionsOptions<S>): SessionsClient<S>;
+//# sourceMappingURL=client.d.ts.map

package/dist/sessions/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/sessions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAiBtE,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EACV,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC3B,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,YAAY;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACrD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,YAAY;IACpD,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7D,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC;IACjF,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC/D;AAED,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,YAAY,EACnD,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,GAC1B,cAAc,CAAC,CAAC,CAAC,CA2DnB"}

package/dist/sessions/client.js

@@ -0,0 +1,69 @@
+/**
+ * Server-side session issuer.
+ *
+ * This is deliberately separate from `Ablo(...)`: the participant client owns
+ * schema model properties, while this client owns credential issuance and
+ * lifecycle administration. A schema model named `sessions` therefore remains
+ * available as `ablo.sessions` like every other model.
+ */
+import { assertBrowserSafety, readProcessEnv, rejectRemovedDatabaseUrlOption, resolveApiKey, resolveApiKeyValue, resolveBaseURL, resolveBootstrapBaseUrl, warnIfCliKeyMismatch, } from '../auth/apiKey.js';
+import { modelWireNames } from '../auth/capability.js';
+import { revokeCapability, rotateCapability, } from '../auth/capabilityLifecycle.js';
+import { AbloAuthenticationError } from '../errors.js';
+import { createSession } from './create.js';
+import { createSessionHandler, } from './handler.js';
+/** Construct the server-side issuer for user and agent sessions. */
+export function Sessions(options) {
+    const env = readProcessEnv();
+    const authInput = { options, env };
+    const configuredApiKey = resolveApiKey(authInput);
+    void warnIfCliKeyMismatch(authInput);
+    rejectRemovedDatabaseUrlOption(options);
+    assertBrowserSafety({
+        apiKey: configuredApiKey,
+        dangerouslyAllowBrowser: options.dangerouslyAllowBrowser,
+    });
+    const baseUrl = resolveBootstrapBaseUrl({
+        url: resolveBaseURL(authInput),
+        bootstrapBaseUrl: options.bootstrapBaseUrl,
+    }).replace(/\/+$/, '');
+    const modelTypenames = modelWireNames(options.schema.models);
+    async function secret() {
+        const apiKey = await resolveApiKeyValue(configuredApiKey);
+        if (!apiKey) {
+            throw new AbloAuthenticationError('Sessions requires a secret (sk_) API key and must be constructed on the backend.', { code: 'apikey_missing' });
+        }
+        return apiKey;
+    }
+    async function create(params) {
+        return createSession(params, {
+            apiKey: await secret(),
+            baseUrl,
+            modelTypenames,
+            ...(options.fetch ? { fetch: options.fetch } : {}),
+        });
+    }
+    return {
+        create,
+        handler: (handlerOptions) => createSessionHandler(create, handlerOptions),
+        async revoke({ id }) {
+            return revokeCapability({
+                apiKey: await secret(),
+                baseUrl,
+                id,
+                ...(options.fetch ? { fetch: options.fetch } : {}),
+            });
+        },
+        async rotate({ id, graceSeconds, ttlSeconds }) {
+            return rotateCapability({
+                apiKey: await secret(),
+                baseUrl,
+                id,
+                ...(graceSeconds !== undefined ? { graceSeconds } : {}),
+                ...(ttlSeconds !== undefined ? { ttlSeconds } : {}),
+                ...(options.fetch ? { fetch: options.fetch } : {}),
+            });
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/sessions/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/sessions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,8BAA8B,EAC9B,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAUvD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,oBAAoB,GAGrB,MAAM,cAAc,CAAC;AAkBtB,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CACtB,OAA2B;IAE3B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAClD,KAAK,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACrC,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACxC,mBAAmB,CAAC;QAClB,MAAM,EAAE,gBAAgB;QACxB,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;KACzD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,GAAG,EAAE,cAAc,CAAC,SAAS,CAAC;QAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7D,KAAK,UAAU,MAAM;QACnB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,kFAAkF,EAClF,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAA8B;QAClD,OAAO,aAAa,CAAC,MAAM,EAAE;YAC3B,MAAM,EAAE,MAAM,MAAM,EAAE;YACtB,OAAO;YACP,cAAc;YACd,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC;QACzE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YACjB,OAAO,gBAAgB,CAAC;gBACtB,MAAM,EAAE,MAAM,MAAM,EAAE;gBACtB,OAAO;gBACP,EAAE;gBACF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE;YAC3C,OAAO,gBAAgB,CAAC;gBACtB,MAAM,EAAE,MAAM,MAAM,EAAE;gBACtB,OAAO;gBACP,EAAE;gBACF,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sessions/contract.d.ts

@@ -0,0 +1,97 @@
+import type { CapabilityCan, CapabilityOperation, EffectiveAuthority } from '../auth/capability.js';
+import type { CredentialEndpointSuccess } from '../auth/credentialEndpointProtocol.js';
+import type { SchemaRecord } from '../schema/schema.js';
+import type { SyncGroupInput } from '../schema/roles.js';
+/** The bearer-bearing part of a session returned by `sessions.create()`. */
+export interface SessionCredential {
+    readonly object: 'session';
+    /** The short-lived `ek_` or `rk_` bearer used by the scoped client. */
+    readonly token: string;
+    /** ISO-8601 hard expiry for this credential. */
+    readonly expiresAt: string;
+}
+/** Result accepted from a session provider or canonical browser mint endpoint. */
+export type SessionProviderResult = SessionCredential | CredentialEndpointSuccess | null;
+/** Re-mints the same logical actor's scoped session for a long-lived client. */
+export type SessionProvider = () => Promise<SessionProviderResult>;
+/** Browser-safe route that mints the signed-in actor's short-lived session. */
+export interface SessionEndpoint {
+    readonly endpoint: string;
+    readonly timeoutMs?: number;
+    readonly allowCrossOrigin?: boolean;
+}
+/** Every supported source for `Ablo({ session })`. */
+export type SessionSource = SessionCredential | SessionProvider | SessionEndpoint;
+/** Public session scope; transport-specific sync naming stays below this boundary. */
+export type SessionScope = Omit<EffectiveAuthority, 'syncGroups'> & {
+    readonly groups: readonly string[];
+};
+export declare function sessionScope(authority: EffectiveAuthority): SessionScope;
+/** A single data operation a scoped session may perform on a model. */
+export type SessionOperation = CapabilityOperation;
+/** Parameters for issuing a short-lived end-user (`ek_`) session. */
+export interface CreateUserSessionParams<S extends SchemaRecord> {
+    readonly user: {
+        readonly id: string;
+    };
+    readonly organizationId?: string;
+    readonly schemaProject?: {
+        readonly organizationId: string;
+        readonly projectId: string;
+    };
+    readonly groups?: readonly SyncGroupInput[];
+    readonly can: CapabilityCan<S>;
+    readonly ttlSeconds?: number;
+    readonly userMeta?: Record<string, unknown>;
+    readonly agent?: never;
+}
+/** Parameters for issuing a short-lived scoped agent (`rk_`) session. */
+export interface CreateAgentSessionParams<S extends SchemaRecord> {
+    readonly agent: {
+        readonly id: string;
+    };
+    readonly onBehalfOf?: {
+        readonly user: {
+            readonly id: string;
+        };
+    };
+    readonly can: CapabilityCan<S>;
+    readonly groups?: readonly SyncGroupInput[];
+    readonly ttlSeconds?: number;
+    readonly userMeta?: Record<string, unknown>;
+    readonly user?: never;
+}
+/** The one typed issuance input; its subject selects user or agent identity. */
+export type CreateSessionParams<S extends SchemaRecord> = CreateUserSessionParams<S> | CreateAgentSessionParams<S>;
+/** A minted session. `token` is the secret the holder presents as its bearer. */
+export interface AbloSession extends SessionCredential {
+    readonly id: string;
+    readonly organizationId: string;
+    readonly scope: SessionScope;
+    readonly userMeta: Record<string, unknown>;
+}
+export interface SessionRevocation {
+    readonly id: string;
+    readonly deleted: true;
+    readonly activeSessionsClosed: number;
+}
+export interface SessionRotation {
+    readonly id: string;
+    readonly token: string;
+    readonly expiresAt: string | null;
+    readonly organizationId: string;
+    readonly scope: SessionScope;
+    readonly rotatedFrom: {
+        readonly id: string;
+        readonly expiresAt: string;
+    };
+}
+export interface RevokeSessionParams {
+    readonly id: string;
+}
+export interface RotateSessionParams {
+    readonly id: string;
+    readonly graceSeconds?: number;
+    readonly ttlSeconds?: number;
+}
+//# sourceMappingURL=contract.d.ts.map

package/dist/sessions/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../src/sessions/contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAC7B,iBAAiB,GACjB,yBAAyB,GACzB,IAAI,CAAC;AAET,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEnE,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,eAAe,GAAG,eAAe,CAAC;AAElF,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,GAAG;IAClE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC;AAEF,wBAAgB,YAAY,CAAC,SAAS,EAAE,kBAAkB,GAAG,YAAY,CAGxE;AAED,uEAAuE;AACvE,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD,qEAAqE;AACrE,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,YAAY;IAC7D,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,YAAY;IAC9D,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,YAAY,IAClD,uBAAuB,CAAC,CAAC,CAAC,GAC1B,wBAAwB,CAAC,CAAC,CAAC,CAAC;AAEhC,iFAAiF;AACjF,MAAM,WAAW,WAAY,SAAQ,iBAAiB;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/sessions/contract.js

@@ -0,0 +1,5 @@
+export function sessionScope(authority) {
+    const { syncGroups, ...scope } = authority;
+    return { ...scope, groups: syncGroups };
+}
+//# sourceMappingURL=contract.js.map

package/dist/sessions/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/sessions/contract.ts"],"names":[],"mappings":"AA0CA,MAAM,UAAU,YAAY,CAAC,SAA6B;IACxD,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC3C,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}

package/dist/{auth/sessionMint.d.ts → sessions/create.d.ts}

@@ -1,11 +1,11 @@
 import type { SchemaRecord } from '../schema/schema.js';
-import type { AbloSession, CreateSessionParams } from '../client/resources/httpResources.js';
+import type { AbloSession, CreateSessionParams } from './contract.js';
 /**
  * The resolved control-plane details a mint needs: a secret key, a base URL,
  * and an optional `fetch`. When `fetch` is omitted, the auth helpers fall back
  * to the runtime's global `fetch`.
  */
-export interface MintSessionContext {
+export interface CreateSessionContext {
     readonly apiKey: string;
     readonly baseUrl: string;
     readonly fetch?: typeof fetch;
@@ -25,5 +25,5 @@ export interface MintSessionContext {
  * Routes the `{ user }` or `{ agent }` request to the matching mint endpoint
  * and reshapes the response into an {@link AbloSession}.
  */
-export declare function mintSession<S extends SchemaRecord>(params: CreateSessionParams<S>, ctx: MintSessionContext): Promise<AbloSession>;
-//# sourceMappingURL=sessionMint.d.ts.map
+export declare function createSession<S extends SchemaRecord>(params: CreateSessionParams<S>, ctx: CreateSessionContext): Promise<AbloSession>;
+//# sourceMappingURL=create.d.ts.map

package/dist/sessions/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/sessions/create.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGtE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,YAAY,EACxD,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAC9B,GAAG,EAAE,oBAAoB,GACxB,OAAO,CAAC,WAAW,CAAC,CAkEtB"}

package/dist/{auth/sessionMint.js → sessions/create.js}

@@ -18,18 +18,19 @@
  *                 registered names.
  *
  * The caller supplies the already-resolved secret key and base URL in
- * {@link MintSessionContext}. Choosing which key to pass — the original secret
+ * {@link CreateSessionContext}. Choosing which key to pass — the original secret
  * key, not a derived key that an earlier exchange may have produced — is the
  * caller's responsibility.
  */
-import { exchangeApiKey, mintUserSessionKey, } from './runtime.js';
-import { capabilityCanSchemaFor, grantedOperations, } from './capability.js';
+import { exchangeApiKey, mintUserSessionKey, } from '../auth/runtime.js';
+import { capabilityCanSchemaFor, grantedOperations, } from '../auth/capability.js';
+import { sessionScope } from './contract.js';
 /**
  * Mints a session token from an already-resolved secret key and base URL.
  * Routes the `{ user }` or `{ agent }` request to the matching mint endpoint
  * and reshapes the response into an {@link AbloSession}.
  */
-export async function mintSession(params, ctx) {
+export async function createSession(params, ctx) {
     const { apiKey, baseUrl } = ctx;
     // Static typing and runtime validation consume the same schema-bound grant
     // contract. This catches JavaScript callers, decoded JSON, and unsafe casts
@@ -43,7 +44,7 @@ export async function mintSession(params, ctx) {
             userId: params.user.id,
             ...(params.organizationId ? { organizationId: params.organizationId } : {}),
             ...(params.schemaProject ? { schemaProject: params.schemaProject } : {}),
-            ...(params.syncGroups ? { syncGroups: [...params.syncGroups] } : {}),
+            ...(params.groups ? { syncGroups: [...params.groups] } : {}),
             operations,
             ttlSeconds: params.ttlSeconds ?? 900,
             ...(ctx.fetch ? { fetch: ctx.fetch } : {}),
@@ -56,7 +57,7 @@ export async function mintSession(params, ctx) {
             organizationId: res.organizationId,
             // The ephemeral mint stores scope on the key row; reshape its flat
             // response into the session resource's scope block.
-            scope: {
+            scope: sessionScope({
                 organizationId: res.organizationId,
                 projectId: res.projectId,
                 branchId: res.branchId,
@@ -65,7 +66,7 @@ export async function mintSession(params, ctx) {
                 participantKind: 'user',
                 participantId: res.participantId,
                 deliveryPartition: res.deliveryPartition,
-            },
+            }),
             userMeta: params.userMeta ?? { id: res.participantId },
         };
     }
@@ -78,7 +79,7 @@ export async function mintSession(params, ctx) {
         participantKind: 'agent',
         participantId: params.agent.id,
         ...(params.onBehalfOf ? { onBehalfOf: params.onBehalfOf } : {}),
-        ...(params.syncGroups ? { syncGroups: [...params.syncGroups] } : {}),
+        ...(params.groups ? { syncGroups: [...params.groups] } : {}),
         operations,
         ttlSeconds: params.ttlSeconds ?? 900,
         ...(params.userMeta ? { userMeta: params.userMeta } : {}),
@@ -90,8 +91,8 @@ export async function mintSession(params, ctx) {
         token: res.token,
         expiresAt: res.expiresAt,
         organizationId: res.organizationId,
-        scope: res.scope,
+        scope: sessionScope(res.scope),
         userMeta: res.userMeta,
     };
 }
-//# sourceMappingURL=sessionMint.js.map
+//# sourceMappingURL=create.js.map

package/dist/sessions/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/sessions/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAuB7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA8B,EAC9B,GAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IAChC,2EAA2E;IAC3E,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC;YACnC,MAAM;YACN,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACtB,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;YACpC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,mEAAmE;YACnE,oDAAoD;YACpD,KAAK,EAAE,YAAY,CAAC;gBAClB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,eAAe,EAAE,MAAM;gBACvB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE;SACvD,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC;QAC/B,MAAM;QACN,OAAO;QACP,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;QAC9B,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,EAAE,EAAE,GAAG,CAAC,YAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC"}

package/dist/sessions/handler.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Server-owned browser session exchange.
+ *
+ * Authentication providers prove who is calling; this boundary converts that
+ * proof into the one Ablo session resource consumed by browser clients. It
+ * owns the HTTP protocol so applications do not repeat origin, cache, status,
+ * or credential-envelope handling in every framework route.
+ */
+import type { SchemaRecord } from '../schema/schema.js';
+import type { AbloSession, CreateSessionParams } from './contract.js';
+export interface SessionHandlerOptions<S extends SchemaRecord, Principal> {
+    /** Verify the application's cookie, bearer, or framework auth session. */
+    authenticate(request: Request): Principal | null | Promise<Principal | null>;
+    /** Derive Ablo identity, groups, and access exclusively on the server. */
+    grant(input: {
+        readonly principal: Principal;
+        readonly request: Request;
+    }): CreateSessionParams<S> | null | Promise<CreateSessionParams<S> | null>;
+}
+export type SessionHandler = (request: Request) => Promise<Response>;
+/** Build a framework-neutral POST handler around one authenticated session grant. */
+export declare function createSessionHandler<S extends SchemaRecord, Principal>(create: (params: CreateSessionParams<S>) => Promise<AbloSession>, options: SessionHandlerOptions<S, Principal>): SessionHandler;
+//# sourceMappingURL=handler.d.ts.map

package/dist/sessions/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/sessions/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,WAAW,EACX,mBAAmB,EACpB,MAAM,eAAe,CAAC;AAOvB,MAAM,WAAW,qBAAqB,CACpC,CAAC,SAAS,YAAY,EACtB,SAAS;IAET,0EAA0E;IAC1E,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE;QACX,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAyBrE,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,YAAY,EAAE,SAAS,EACpE,MAAM,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,EAChE,OAAO,EAAE,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,GAC3C,cAAc,CAiChB"}

package/dist/sessions/handler.js

@@ -0,0 +1,55 @@
+/**
+ * Server-owned browser session exchange.
+ *
+ * Authentication providers prove who is calling; this boundary converts that
+ * proof into the one Ablo session resource consumed by browser clients. It
+ * owns the HTTP protocol so applications do not repeat origin, cache, status,
+ * or credential-envelope handling in every framework route.
+ */
+import { credentialEndpointErrorSchema, credentialEndpointSuccessSchema, } from '../auth/credentialEndpointProtocol.js';
+import { classifyCredentialKind } from '../auth/credentialKind.js';
+const NO_STORE_HEADERS = { 'Cache-Control': 'no-store' };
+function errorResponse(status, code, message) {
+    return Response.json(credentialEndpointErrorSchema.parse({ error: { code, message } }), { status, headers: NO_STORE_HEADERS });
+}
+function isSameOrigin(request) {
+    const origin = request.headers.get('origin');
+    if (!origin)
+        return request.headers.get('sec-fetch-site') !== 'cross-site';
+    try {
+        return new URL(origin).origin === new URL(request.url).origin;
+    }
+    catch {
+        return false;
+    }
+}
+/** Build a framework-neutral POST handler around one authenticated session grant. */
+export function createSessionHandler(create, options) {
+    return async (request) => {
+        if (request.method !== 'POST') {
+            return errorResponse(405, 'method_not_allowed', 'Use POST to create a session.');
+        }
+        if (!isSameOrigin(request)) {
+            return errorResponse(403, 'origin_mismatch', 'Cross-origin session creation rejected.');
+        }
+        const principal = await options.authenticate(request);
+        if (principal === null) {
+            return errorResponse(401, 'session_expired', 'Sign in again.');
+        }
+        const grant = await options.grant({ principal, request });
+        if (grant === null) {
+            return errorResponse(403, 'policy_denied', 'This identity is not authorized.');
+        }
+        const session = await create(grant);
+        const credentialKind = classifyCredentialKind(session.token);
+        if (credentialKind !== 'ephemeral' && credentialKind !== 'restricted') {
+            throw new Error('sessions.create returned a credential that cannot authenticate a session.');
+        }
+        return Response.json(credentialEndpointSuccessSchema.parse({
+            token: session.token,
+            expiresAt: session.expiresAt,
+            credentialKind,
+        }), { headers: NO_STORE_HEADERS });
+    };
+}
+//# sourceMappingURL=handler.js.map

package/dist/sessions/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/sessions/handler.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAiBnE,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,UAAU,EAAW,CAAC;AAElE,SAAS,aAAa,CACpB,MAAc,EACd,IAAY,EACZ,OAAe;IAEf,OAAO,QAAQ,CAAC,IAAI,CAClB,6BAA6B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EACjE,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,YAAY,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAClC,MAAgE,EAChE,OAA4C;IAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,cAAc,KAAK,WAAW,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAClB,+BAA+B,CAAC,KAAK,CAAC;YACpC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc;SACf,CAAC,EACF,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC9B,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/sessions/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Session subsystem.
+ *
+ * Start here and descend into the public contract, issuance, server handler,
+ * source normalization, or credential lifecycle. Transports consume the
+ * normalized access contract and do not reconstruct session policy.
+ */
+export * from './contract.js';
+export * from './client.js';
+export * from './create.js';
+export * from './handler.js';
+export * from './source.js';
+export * from './lifecycle.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/sessions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/sessions/index.js

@@ -0,0 +1,14 @@
+/**
+ * Session subsystem.
+ *
+ * Start here and descend into the public contract, issuance, server handler,
+ * source normalization, or credential lifecycle. Transports consume the
+ * normalized access contract and do not reconstruct session policy.
+ */
+export * from './contract.js';
+export * from './client.js';
+export * from './create.js';
+export * from './handler.js';
+export * from './source.js';
+export * from './lifecycle.js';
+//# sourceMappingURL=index.js.map

package/dist/sessions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/{transport/connection/credentialLifecycle.d.ts → sessions/lifecycle.d.ts}

@@ -1,14 +1,14 @@
 /**
  * Keeps the short-lived access credential fresh. It owns the re-mint hook, a
  * single-flight guard that stops concurrent triggers from minting more than
- * once, and a browser-only proactive refresh — a timer plus an OS-wake listener
- * — that renews the credential ahead of expiry. It reaches the rest of the
+ * once, and proactive refresh — an expiry-aware timer plus a browser OS-wake
+ * listener — that renews the credential ahead of expiry. It reaches the rest of the
  * client only through the small {@link CredentialLifecycleContext} interface,
  * so the two can reference each other without an import cycle.
  */
-import type { RecoveryClass } from '../../errorCodes.js';
-import { type Logger } from '../../logger.js';
-import { type CredentialProvider, type CredentialProviderResult } from '../../auth/credentialResult.js';
+import type { RecoveryClass } from '../errorCodes.js';
+import { type Logger } from '../logger.js';
+import { type CredentialProvider, type CredentialProviderResult } from '../auth/credentialResult.js';
 /**
  * Tri-state outcome of a credential re-mint, mirroring the `getToken`
  * contract (see {@link CredentialLifecycle.refresh}).
@@ -175,4 +175,4 @@ export declare class CredentialLifecycle {
     /** Tear down the proactive credential lifecycle (idempotent). */
     stop(): void;
 }
-//# sourceMappingURL=credentialLifecycle.d.ts.map
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/sessions/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/sessions/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,6BAA6B,CAAC;AAErC;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,eAAe,GAAG,eAAe,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAE/D;0DAC0D;AAC1D,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAErD;;kDAEkD;AAClD,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAE1D,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,QAAY,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQvF;AAUD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC;kEAC8D;IAC9D,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,0EAA0E;IAC1E,cAAc,IAAI,IAAI,CAAC;IACvB;gCAC4B;IAC5B,oBAAoB,IAAI,IAAI,CAAC;CAC9B;AAED,qBAAa,mBAAmB;IAoC5B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IApCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,mBAAmB,CAAoC;IAE/D;6EACyE;IACzE,OAAO,CAAC,yBAAyB,CAAkD;IAEnF;;wDAEoD;IACpD,OAAO,CAAC,2BAA2B,CAA6B;IAEhE;;;0BAGsB;IACtB,OAAO,CAAC,qBAAqB,CAAuB;IAEpD;;;mEAG+D;IAC/D,OAAO,CAAC,iBAAiB,CAA6B;gBAGnC,GAAG,EAAE,0BAA0B,EAC/B,MAAM,GAAE,MAAmB;IAG9C;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,GAAG,IAAI;IAIzD,kFAAkF;IAClF,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO;IAShD;;;;;;;;;;;;;;;OAeG;IACG,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkDlD;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY3F;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAqFhF,iEAAiE;IACjE,IAAI,IAAI,IAAI;CAIb"}

package/dist/{transport/connection/credentialLifecycle.js → sessions/lifecycle.js}

@@ -1,13 +1,13 @@
 /**
  * Keeps the short-lived access credential fresh. It owns the re-mint hook, a
  * single-flight guard that stops concurrent triggers from minting more than
- * once, and a browser-only proactive refresh — a timer plus an OS-wake listener
- * — that renews the credential ahead of expiry. It reaches the rest of the
+ * once, and proactive refresh — an expiry-aware timer plus a browser OS-wake
+ * listener — that renews the credential ahead of expiry. It reaches the rest of the
  * client only through the small {@link CredentialLifecycleContext} interface,
  * so the two can reference each other without an import cycle.
  */
-import { noopLogger } from '../../logger.js';
-import { credentialExpiry, credentialToken, } from '../../auth/credentialResult.js';
+import { noopLogger } from '../logger.js';
+import { credentialExpiry, credentialToken, } from '../auth/credentialResult.js';
 /** The fallback pre-roll interval, and also its ceiling: 10 minutes, which sits
  *  comfortably inside the server's 15-minute default credential lifetime. Used
  *  as-is when the refresher reports no expiry. */
@@ -321,4 +321,4 @@ export class CredentialLifecycle {
         this.credentialLifecycleTeardown = null;
     }
 }
-//# sourceMappingURL=credentialLifecycle.js.map
+//# sourceMappingURL=lifecycle.js.map

package/dist/sessions/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/sessions/lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,UAAU,EAAe,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,gBAAgB,EAChB,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AA8BrC;;kDAEkD;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA0B,EAAE,KAAa;IAC7E,IAAI,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,GAAG,KAAK,CAAC;IACtC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAC1F,CAAC;AAED;8DAC8D;AAC9D,SAAS,oBAAoB,CAAC,SAA6B;IACzD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAmBD,MAAM,OAAO,mBAAmB;IAoCX;IACA;IApCnB;;;;;;;;;;OAUG;IACK,mBAAmB,GAA+B,IAAI,CAAC;IAE/D;6EACyE;IACjE,yBAAyB,GAA6C,IAAI,CAAC;IAEnF;;wDAEoD;IAC5C,2BAA2B,GAAwB,IAAI,CAAC;IAEhE;;;0BAGsB;IACd,qBAAqB,GAAkB,IAAI,CAAC;IAEpD;;;mEAG+D;IACvD,iBAAiB,GAAwB,IAAI,CAAC;IAEtD,YACmB,GAA+B,EAC/B,SAAiB,UAAU;QAD3B,QAAG,GAAH,GAAG,CAA4B;QAC/B,WAAM,GAAN,MAAM,CAAqB;IAC3C,CAAC;IAEJ;;;;OAIG;IACH,YAAY,CAAC,SAAqC;QAChD,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,kFAAkF;IAClF,MAAM,CAAC,MAA+B;QACpC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,qBAAqB,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,OAAO,WAAW,CAAC;QACnC,IAAI,IAAI,CAAC,yBAAyB;YAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC;QAE1E,MAAM,GAAG,GAAG,CAAC,KAAK,IAAuC,EAAE;YACzD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,kEAAkE;oBAClE,mEAAmE;oBACnE,OAAO,eAAe,CAAC;gBACzB,CAAC;gBACD,uEAAuE;gBACvE,iEAAiE;gBACjE,qDAAqD;gBACrD,OAAO,WAAW,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,uEAAuE;gBACvE,uEAAuE;gBACvE,mEAAmE;gBACnE,MAAM,OAAO,GAAI,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3D,qEAAqE;gBACrE,wEAAwE;gBACxE,kEAAkE;gBAClE,iEAAiE;gBACjE,qEAAqE;gBACrE,0CAA0C;gBAC1C,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gGAAgG;wBAC9F,+EAA+E;wBAC/E,uEAAuE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,CAAC,yBAAyB,GAAG,GAAG,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACxC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,OAAiC;QAC3D,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,oEAAoE;YACpE,iDAAiD;YACjD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,+EAA+E;YAC/E,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,6EAA6E;QAC7E,gFAAgF;QAChF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,wBAAwB,CAAC,QAAuB;QACpD,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,0BAA0B;gBAC7B,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,KAAK,gBAAgB;gBACnB,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;gBAChC,OAAO,MAAM,CAAC;YAChB;gBACE,OAAO,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,QAA6B,EAAE,IAAoC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE5B,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,mDAAmD;QACnD,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;YACxC,yEAAyE;YACzE,sEAAsE;YACtE,uEAAuE;YACvE,IAAI,CAAC,mBAAmB,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF,MAAM,SAAS,GAAmB,EAAE,CAAC;QAErC,0EAA0E;QAC1E,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,6EAA6E;QAC7E,gEAAgE;QAChE,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,cAAc;QACd,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI,EAAE,CAAC;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E;YAC3E,yEAAyE;YACzE,2EAA2E;YAC3E,0BAA0B;YAC1B,IAAI,KAAK,GAAyC,IAAI,CAAC;YACvD,MAAM,YAAY,GAAG,GAAS,EAAE;gBAC9B,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB;gBAC7D,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,gEAAgE;oBAChE,oEAAoE;oBACpE,oDAAoD;oBACpD,KAAK,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACV,mEAAmE;gBACnE,mEAAmE;gBAClE,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9C,CAAC,CAAC;YACF,YAAY,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC;YACtC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAClB,IAAI,KAAK,KAAK,IAAI;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxC,KAAK,GAAG,IAAI,CAAC;gBACb,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,sEAAsE;YACtE,yEAAyE;YACzE,0EAA0E;YAC1E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,wEAAwE;YACxE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,IAAI,CAAC,2BAA2B,GAAG,GAAS,EAAE;YAC5C,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI;QACF,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC;IAC1C,CAAC;CACF"}

package/dist/sessions/source.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Runtime lifecycle for a renewable session supplied to `Ablo({ session })`.
+ *
+ * A session provider mints a credential, while this boundary decides when to
+ * reuse it. Keeping that policy here prevents HTTP requests and the WebSocket
+ * bootstrap from independently minting duplicate sessions for the same actor.
+ */
+import type { CredentialProvider, CredentialProviderResult } from '../auth/credentialResult.js';
+import type { SessionProvider, SessionSource } from './contract.js';
+/** Cache one minted session until it approaches expiry; concurrent refreshes share one mint. */
+export declare function cachedSessionProvider(provider: SessionProvider): CredentialProvider;
+/** The one credential input a live transport consumes. */
+export interface SessionAccess {
+    readonly renewable: boolean;
+    credential(): Promise<CredentialProviderResult>;
+}
+/** Normalize a static or renewable session before it reaches a transport. */
+export declare function createSessionAccess(source: SessionSource | null | undefined, credential: () => Promise<CredentialProviderResult>): SessionAccess;
+/** Resolve the public session forms into the credential shape auth consumes. */
+export declare function resolveSessionCredential(source: SessionSource, options: {
+    readonly fetch?: typeof globalThis.fetch;
+    readonly dangerouslyAllowBrowser?: boolean;
+}): string | CredentialProvider;
+//# sourceMappingURL=source.d.ts.map

package/dist/sessions/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/sessions/source.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EACV,eAAe,EAEf,aAAa,EACd,MAAM,eAAe,CAAC;AAevB,gGAAgG;AAChG,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,kBAAkB,CAcnF;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,UAAU,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACjD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,EACxC,UAAU,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,GAClD,aAAa,CAOf;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE;IACP,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC5C,GACA,MAAM,GAAG,kBAAkB,CAmB7B"}

package/dist/sessions/source.js

@@ -0,0 +1,56 @@
+/**
+ * Runtime lifecycle for a renewable session supplied to `Ablo({ session })`.
+ *
+ * A session provider mints a credential, while this boundary decides when to
+ * reuse it. Keeping that policy here prevents HTTP requests and the WebSocket
+ * bootstrap from independently minting duplicate sessions for the same actor.
+ */
+import { AbloValidationError } from '../errors.js';
+import { createEndpointCredentialResolver, isCredentialEndpoint, } from '../auth/credentialEndpoint.js';
+import { protectBrowserCredentialProvider } from '../auth/browserCredentialSafety.js';
+const SESSION_REFRESH_SKEW_MS = 30_000;
+function remainsUsable(session, now) {
+    const expiresAt = Date.parse(session.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt - now > SESSION_REFRESH_SKEW_MS;
+}
+/** Cache one minted session until it approaches expiry; concurrent refreshes share one mint. */
+export function cachedSessionProvider(provider) {
+    let current = null;
+    let refreshing = null;
+    return async () => {
+        if (current && remainsUsable(current, Date.now()))
+            return current;
+        refreshing ??= provider().then((next) => {
+            current = next;
+            return next;
+        }).finally(() => {
+            refreshing = null;
+        });
+        return refreshing;
+    };
+}
+/** Normalize a static or renewable session before it reaches a transport. */
+export function createSessionAccess(source, credential) {
+    return {
+        renewable: typeof source === 'function'
+            || (typeof source === 'object' && source !== null && 'endpoint' in source),
+        credential,
+    };
+}
+/** Resolve the public session forms into the credential shape auth consumes. */
+export function resolveSessionCredential(source, options) {
+    if (typeof source === 'function') {
+        return protectBrowserCredentialProvider(cachedSessionProvider(source), options.dangerouslyAllowBrowser);
+    }
+    if (!('endpoint' in source))
+        return source.token;
+    if (!isCredentialEndpoint(source.endpoint)) {
+        throw new AbloValidationError('`session.endpoint` expects a URL or path such as \'/api/ablo-session\'.', { code: 'invalid_options', param: 'session.endpoint' });
+    }
+    return protectBrowserCredentialProvider(createEndpointCredentialResolver(source.endpoint, {
+        fetch: options.fetch,
+        timeoutMs: source.timeoutMs,
+        allowCrossOrigin: source.allowCrossOrigin,
+    }), options.dangerouslyAllowBrowser);
+}
+//# sourceMappingURL=source.js.map

package/dist/sessions/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/sessions/source.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,gCAAgC,EAChC,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AAEtF,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,SAAS,aAAa,CAAC,OAA6C,EAAE,GAAW;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,GAAG,GAAG,uBAAuB,CAAC;AACjF,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,IAAI,OAAO,GAAgD,IAAI,CAAC;IAChE,IAAI,UAAU,GAA0C,IAAI,CAAC;IAE7D,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC;QAClE,UAAU,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACtC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC;AAQD,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CACjC,MAAwC,EACxC,UAAmD;IAEnD,OAAO;QACL,SAAS,EACP,OAAO,MAAM,KAAK,UAAU;eACzB,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,UAAU,IAAI,MAAM,CAAC;QAC5E,UAAU;KACX,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,OAGC;IAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,gCAAgC,CACrC,qBAAqB,CAAC,MAAM,CAAC,EAC7B,OAAO,CAAC,uBAAuB,CAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACjD,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAC3B,yEAAyE,EACzE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,kBAAkB,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,gCAAgC,CAAC,gCAAgC,CAAC,MAAM,CAAC,QAAQ,EAAE;QACxF,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;KAC1C,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;AACvC,CAAC"}