@adaptive-ds/project-registry 0.2.3

package/dist/session/sessionActorResolve.d.ts

@@ -0,0 +1,5 @@
+import { type PromiseResult } from "#result";
+import type { Actor } from "../access/Actor.js";
+import type { SessionActorResolveOptions } from "./SessionActorResolveOptions.js";
+export declare function sessionActorResolve(id: string, options: SessionActorResolveOptions): PromiseResult<Actor>;
+//# sourceMappingURL=sessionActorResolve.d.ts.map

package/dist/session/sessionActorResolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionActorResolve.d.ts","sourceRoot":"","sources":["../../src/session/sessionActorResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,aAAa,EAAe,MAAM,SAAS,CAAA;AAC1F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAK/C,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AA+BjF,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,aAAa,CAAC,KAAK,CAAC,CAgF/G"}

package/dist/session/sessionActorResolve.js

@@ -0,0 +1,98 @@
+import { createResult, createResultError } from "#result";
+import { preferredUsernameMap } from "../identity/preferredUsernameMap.js";
+import { userRoleResolve } from "../identity/userRoleResolve.js";
+import { clockNowResolve } from "../runtime/clockNowResolve.js";
+import { promiseBoundedRace } from "../runtime/promiseBoundedRace.js";
+import { sessionRecordValidate } from "./sessionRecordValidate.js";
+import { tokenReferenceTokensValidate } from "./tokenReferenceTokensValidate.js";
+function sessionRecordsEqual(left, right) {
+    if (!left.success)
+        return false;
+    const rightR = sessionRecordValidate(right);
+    return (rightR.success &&
+        left.data.id === rightR.data.id &&
+        left.data.subject === rightR.data.subject &&
+        left.data.username === rightR.data.username &&
+        left.data.tokenReference === rightR.data.tokenReference &&
+        left.data.createdAt === rightR.data.createdAt &&
+        left.data.expiresAt === rightR.data.expiresAt);
+}
+function tokenReferencesEqual(left, right) {
+    if (!left.success)
+        return false;
+    const rightR = tokenReferenceTokensValidate(right);
+    return (rightR.success &&
+        left.data.accessToken === rightR.data.accessToken &&
+        left.data.refreshToken === rightR.data.refreshToken &&
+        left.data.expiresAt === rightR.data.expiresAt);
+}
+export async function sessionActorResolve(id, options) {
+    const op = "sessionActorResolve";
+    try {
+        if (typeof id !== "string" || id.length === 0 || id.length > 256) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        const initialNowR = clockNowResolve(options.clock ?? Date.now);
+        if (!initialNowR.success)
+            return createResultError(op, "session identity is unavailable");
+        const sessionR = await promiseBoundedRace(Promise.resolve().then(() => options.sessions.resolve(id)), options);
+        if (!sessionR.success || sessionR.data.success !== true)
+            return createResultError(op, "session identity is unavailable");
+        const sessionRecordR = sessionRecordValidate(sessionR.data.data);
+        if (!sessionRecordR.success || sessionRecordR.data.id !== id) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        const session = sessionRecordR.data;
+        const tokenR = await promiseBoundedRace(Promise.resolve().then(() => options.tokenReferences.resolve(session.tokenReference)), options);
+        if (!tokenR.success || tokenR.data.success !== true)
+            return createResultError(op, "session identity is unavailable");
+        const tokensR = tokenReferenceTokensValidate(tokenR.data.data);
+        if (!tokensR.success)
+            return createResultError(op, "session identity is unavailable");
+        const tokens = tokensR.data;
+        const tokenExpiresAt = tokens.expiresAt;
+        const tokenIsCurrent = () => {
+            const nowR = clockNowResolve(options.clock ?? Date.now);
+            return nowR.success && session.expiresAt > nowR.data && tokenExpiresAt > nowR.data;
+        };
+        if (!tokenIsCurrent()) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        if (typeof options.identityDirectory.userPreferredUsernameResolve !== "function") {
+            return createResultError(op, "session user mapping is unavailable");
+        }
+        const preferredUsernameR = await promiseBoundedRace(Promise.resolve().then(() => options.identityDirectory.userPreferredUsernameResolve(session.subject, tokens.accessToken)), options);
+        if (!preferredUsernameR.success || preferredUsernameR.data.success !== true || !tokenIsCurrent()) {
+            return createResultError(op, "session user mapping is unavailable");
+        }
+        if (preferredUsernameR.data.data !== session.username) {
+            return createResultError(op, "session user mapping is unavailable");
+        }
+        const usernameR = await preferredUsernameMap(preferredUsernameR.data.data, options.posixUsers, options);
+        if (!usernameR.success || !tokenIsCurrent() || usernameR.data !== session.username) {
+            return createResultError(op, "session user mapping is unavailable");
+        }
+        const roleR = await userRoleResolve(session.subject, tokens.accessToken, options.identityDirectory, options);
+        if (!roleR.success || !tokenIsCurrent())
+            return createResultError(op, "current role is unavailable");
+        const currentTokenR = await promiseBoundedRace(Promise.resolve().then(() => options.tokenReferences.resolve(session.tokenReference)), options);
+        if (!currentTokenR.success || currentTokenR.data.success !== true) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        if (!tokenReferencesEqual(tokensR, currentTokenR.data.data) || !tokenIsCurrent()) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        const currentSessionR = await promiseBoundedRace(Promise.resolve().then(() => options.sessions.resolve(id)), options);
+        if (!currentSessionR.success || currentSessionR.data.success !== true) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        if (!sessionRecordsEqual(sessionRecordR, currentSessionR.data.data)) {
+            return createResultError(op, "session identity is unavailable");
+        }
+        return createResult({ subject: session.subject, username: session.username, role: roleR.data });
+    }
+    catch {
+        return createResultError(op, "session identity is unavailable");
+    }
+}
+//# sourceMappingURL=sessionActorResolve.js.map

package/dist/session/sessionActorResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionActorResolve.js","sourceRoot":"","sources":["../../src/session/sessionActorResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAmC,MAAM,SAAS,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,OAAO,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAA;AAEhF,SAAS,mBAAmB,CAAC,IAA2B,EAAE,KAAc;IACtE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO,CACL,MAAM,CAAC,OAAO;QACd,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC3C,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc;QACvD,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAC9C,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAkC,EAAE,KAAc;IAC9E,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC/B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAA;IAClD,OAAO,CACL,MAAM,CAAC,OAAO;QACd,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW;QACjD,IAAI,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAC9C,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAU,EAAE,OAAmC;IACvF,MAAM,EAAE,GAAG,qBAAqB,CAAA;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACjE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9D,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACzF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC1D,OAAO,CACR,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;YACrD,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAA;QACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EACrF,OAAO,CACR,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACpH,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACrF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAA;QAC3B,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAA;QACvC,MAAM,cAAc,GAAG,GAAY,EAAE;YACnC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;YACvD,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,GAAG,IAAI,CAAC,IAAI,CAAA;QACpF,CAAC,CAAA;QACD,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,iBAAiB,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;YACjF,OAAO,iBAAiB,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CACjD,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAC1B,OAAO,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAC5F,EACD,OAAO,CACR,CAAA;QACD,IAAI,CAAC,kBAAkB,CAAC,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjG,OAAO,iBAAiB,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtD,OAAO,iBAAiB,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACvG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnF,OAAO,iBAAiB,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;QAC5G,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAA;QACpG,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAC5C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EACrF,OAAO,CACR,CAAA;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjF,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAC9C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAC1D,OAAO,CACR,CAAA;QACD,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC"}

package/dist/session/sessionCookieClear.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { SessionCookieOptions } from "./SessionCookieOptions.js";
+export declare function sessionCookieClear(options?: SessionCookieOptions): Result<string>;
+//# sourceMappingURL=sessionCookieClear.d.ts.map

package/dist/session/sessionCookieClear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieClear.d.ts","sourceRoot":"","sources":["../../src/session/sessionCookieClear.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAWrE,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,CAOrF"}

package/dist/session/sessionCookieClear.js

@@ -0,0 +1,20 @@
+import { createResult, createResultError } from "#result";
+const defaultCookieName = "__Host-project-registry-session";
+const maximumCookieHeaderLength = 8192;
+function sessionCookieNameResolve(options) {
+    const name = options.name ?? defaultCookieName;
+    if (name.length > 128 || !/^__Host-[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name))
+        return undefined;
+    return name;
+}
+export function sessionCookieClear(options = {}) {
+    const op = "sessionCookieClear";
+    const name = sessionCookieNameResolve(options);
+    if (name === undefined)
+        return createResultError(op, "session cookie name is invalid");
+    const cookie = `${name}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;
+    if (cookie.length > maximumCookieHeaderLength)
+        return createResultError(op, "session cookie is invalid");
+    return createResult(cookie);
+}
+//# sourceMappingURL=sessionCookieClear.js.map

package/dist/session/sessionCookieClear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieClear.js","sourceRoot":"","sources":["../../src/session/sessionCookieClear.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAGtE,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,yBAAyB,GAAG,IAAI,CAAA;AAEtC,SAAS,wBAAwB,CAAC,OAA6B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAA;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAgC,EAAE;IACnE,MAAM,EAAE,GAAG,oBAAoB,CAAA;IAC/B,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,GAAG,IAAI,sDAAsD,CAAA;IAC5E,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACxG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;AAC7B,CAAC"}

package/dist/session/sessionCookieParse.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { SessionCookieOptions } from "./SessionCookieOptions.js";
+export declare function sessionCookieParse(cookieHeader: string | null | undefined, options?: SessionCookieOptions): Result<string>;
+//# sourceMappingURL=sessionCookieParse.d.ts.map

package/dist/session/sessionCookieParse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieParse.d.ts","sourceRoot":"","sources":["../../src/session/sessionCookieParse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAYrE,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,OAAO,GAAE,oBAAyB,GACjC,MAAM,CAAC,MAAM,CAAC,CAyBhB"}

package/dist/session/sessionCookieParse.js

@@ -0,0 +1,42 @@
+import { createResult, createResultError } from "#result";
+const defaultCookieName = "__Host-project-registry-session";
+const maximumCookieHeaderLength = 8192;
+const maximumCookieValueLength = 256;
+function sessionCookieNameResolve(options) {
+    const name = options.name ?? defaultCookieName;
+    if (name.length > 128 || !/^__Host-[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name))
+        return undefined;
+    return name;
+}
+export function sessionCookieParse(cookieHeader, options = {}) {
+    const op = "sessionCookieParse";
+    if (typeof cookieHeader !== "string" || cookieHeader.length > maximumCookieHeaderLength) {
+        return createResultError(op, "session cookie is unavailable");
+    }
+    const name = sessionCookieNameResolve(options);
+    if (name === undefined)
+        return createResultError(op, "session cookie name is invalid");
+    const prefix = `${name}=`;
+    let found;
+    for (const part of cookieHeader.split(";")) {
+        const trimmed = part.trim();
+        if (!trimmed.startsWith(prefix))
+            continue;
+        if (found !== undefined)
+            return createResultError(op, "session cookie is invalid");
+        found = trimmed.slice(prefix.length);
+    }
+    if (found === undefined || found.length === 0 || found.length > maximumCookieValueLength) {
+        return createResultError(op, "session cookie is unavailable");
+    }
+    try {
+        const value = decodeURIComponent(found);
+        if (!/^[A-Za-z0-9_-]{32,256}$/.test(value))
+            return createResultError(op, "session cookie is invalid");
+        return createResult(value);
+    }
+    catch {
+        return createResultError(op, "session cookie is invalid");
+    }
+}
+//# sourceMappingURL=sessionCookieParse.js.map

package/dist/session/sessionCookieParse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieParse.js","sourceRoot":"","sources":["../../src/session/sessionCookieParse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAGtE,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,yBAAyB,GAAG,IAAI,CAAA;AACtC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,SAAS,wBAAwB,CAAC,OAA6B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAA;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAuC,EACvC,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAG,oBAAoB,CAAA;IAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACxF,OAAO,iBAAiB,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACtF,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAA;IACzB,IAAI,KAAyB,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAQ;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAClF,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QACzF,OAAO,iBAAiB,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QACrG,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC"}

package/dist/session/sessionCookieSerialize.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { SessionCookieOptions } from "./SessionCookieOptions.js";
+export declare function sessionCookieSerialize(sessionId: string, options?: SessionCookieOptions): Result<string>;
+//# sourceMappingURL=sessionCookieSerialize.d.ts.map

package/dist/session/sessionCookieSerialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieSerialize.d.ts","sourceRoot":"","sources":["../../src/session/sessionCookieSerialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAYrE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,CAc5G"}

package/dist/session/sessionCookieSerialize.js

@@ -0,0 +1,28 @@
+import { createResult, createResultError } from "#result";
+const defaultCookieName = "__Host-project-registry-session";
+const defaultMaxAgeSeconds = 3600;
+const maximumCookieHeaderLength = 8192;
+function sessionCookieNameResolve(options) {
+    const name = options.name ?? defaultCookieName;
+    if (name.length > 128 || !/^__Host-[A-Za-z0-9!#$%&'*+.^_`|~-]+$/.test(name))
+        return undefined;
+    return name;
+}
+export function sessionCookieSerialize(sessionId, options = {}) {
+    const op = "sessionCookieSerialize";
+    if (typeof sessionId !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(sessionId)) {
+        return createResultError(op, "session cookie value is invalid");
+    }
+    const name = sessionCookieNameResolve(options);
+    const maxAgeSeconds = options.maxAgeSeconds ?? defaultMaxAgeSeconds;
+    if (name === undefined)
+        return createResultError(op, "session cookie name is invalid");
+    if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds < 1 || maxAgeSeconds > 31_536_000) {
+        return createResultError(op, "session cookie lifetime is invalid");
+    }
+    const cookie = `${name}=${encodeURIComponent(sessionId)}; Path=/; Max-Age=${maxAgeSeconds}; HttpOnly; Secure; SameSite=Lax`;
+    if (cookie.length > maximumCookieHeaderLength)
+        return createResultError(op, "session cookie value is invalid");
+    return createResult(cookie);
+}
+//# sourceMappingURL=sessionCookieSerialize.js.map

package/dist/session/sessionCookieSerialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCookieSerialize.js","sourceRoot":"","sources":["../../src/session/sessionCookieSerialize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAGtE,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAC3D,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACjC,MAAM,yBAAyB,GAAG,IAAI,CAAA;AAEtC,SAAS,wBAAwB,CAAC,OAA6B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAA;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7F,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,UAAgC,EAAE;IAC1F,MAAM,EAAE,GAAG,wBAAwB,CAAA;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChF,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAA;IACnE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAA;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,UAAU,EAAE,CAAC;QAC5F,OAAO,iBAAiB,CAAC,EAAE,EAAE,oCAAoC,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC,qBAAqB,aAAa,kCAAkC,CAAA;IAC3H,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAC9G,OAAO,YAAY,CAAC,MAAM,CAAC,CAAA;AAC7B,CAAC"}

package/dist/session/sessionLogout.d.ts

@@ -0,0 +1,8 @@
+import { type PromiseResult } from "#result";
+import type { SessionLogoutOptions } from "./SessionLogoutOptions.js";
+import type { SessionStore } from "./SessionStore.js";
+export declare function sessionLogout(cookieHeader: string | null | undefined, sessions: SessionStore, options?: SessionLogoutOptions): PromiseResult<{
+    setCookie: string;
+    status: "revoked" | "degraded";
+}>;
+//# sourceMappingURL=sessionLogout.d.ts.map

package/dist/session/sessionLogout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLogout.d.ts","sourceRoot":"","sources":["../../src/session/sessionLogout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,aAAa,EAAE,MAAM,SAAS,CAAA;AAE7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAerD,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,oBAAyB,GACjC,aAAa,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAA;CAAE,CAAC,CAiEtE"}

package/dist/session/sessionLogout.js

@@ -0,0 +1,74 @@
+import { createResult, createResultError } from "#result";
+import { promiseBoundedRace } from "../runtime/promiseBoundedRace.js";
+import { sessionCookieClear } from "./sessionCookieClear.js";
+import { sessionCookieParse } from "./sessionCookieParse.js";
+import { sessionRecordValidate } from "./sessionRecordValidate.js";
+function resultIsTrue(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        value.success === true &&
+        value.data === true);
+}
+export async function sessionLogout(cookieHeader, sessions, options = {}) {
+    const cookieR = sessionCookieParse(cookieHeader, options.cookie);
+    if (!cookieR.success || options.csrf === undefined || typeof options.csrfToken !== "string") {
+        return createResultError("sessionLogout", "logout request is unauthorized");
+    }
+    const csrf = options.csrf;
+    const csrfToken = options.csrfToken;
+    const csrfR = await promiseBoundedRace(Promise.resolve().then(() => csrf.validate(cookieR.data, csrfToken)), options);
+    if (!csrfR.success || !resultIsTrue(csrfR.data))
+        return createResultError("sessionLogout", "logout request is unauthorized");
+    const clearR = sessionCookieClear(options.cookie);
+    if (!clearR.success)
+        return clearR;
+    let degraded = false;
+    let tokenReference;
+    try {
+        try {
+            const sessionR = await promiseBoundedRace(Promise.resolve().then(() => sessions.resolve(cookieR.data)), options);
+            if (sessionR.success && sessionR.data.success === true) {
+                const recordR = sessionRecordValidate(sessionR.data.data);
+                if (recordR.success)
+                    tokenReference = recordR.data.tokenReference;
+            }
+        }
+        catch {
+            degraded = true;
+        }
+        try {
+            const revokeCsrfR = await promiseBoundedRace(Promise.resolve().then(() => csrf.revoke(cookieR.data)), options);
+            if (!revokeCsrfR.success || !resultIsTrue(revokeCsrfR.data))
+                degraded = true;
+        }
+        catch {
+            degraded = true;
+        }
+        try {
+            const tokenReferences = options.tokenReferences;
+            if (tokenReference !== undefined && tokenReferences !== undefined) {
+                const reference = tokenReference;
+                const tokenR = await promiseBoundedRace(Promise.resolve().then(() => tokenReferences.remove(reference)), options);
+                if (!tokenR.success || !resultIsTrue(tokenR.data))
+                    degraded = true;
+            }
+        }
+        catch {
+            degraded = true;
+        }
+        try {
+            const revokeR = await promiseBoundedRace(Promise.resolve().then(() => sessions.revoke(cookieR.data)), options);
+            if (!revokeR.success || !resultIsTrue(revokeR.data))
+                degraded = true;
+        }
+        catch {
+            degraded = true;
+        }
+        return createResult({ setCookie: clearR.data, status: degraded ? "degraded" : "revoked" });
+    }
+    catch {
+        return createResult({ setCookie: clearR.data, status: "degraded" });
+    }
+}
+//# sourceMappingURL=sessionLogout.js.map

package/dist/session/sessionLogout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLogout.js","sourceRoot":"","sources":["../../src/session/sessionLogout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAsB,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAGrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAiC,CAAC,OAAO,KAAK,IAAI;QAClD,KAAiC,CAAC,IAAI,KAAK,IAAI,CACjD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAuC,EACvC,QAAsB,EACtB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAChE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC5F,OAAO,iBAAiB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EACpE,OAAO,CACR,CAAA;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7C,OAAO,iBAAiB,CAAC,eAAe,EAAE,gCAAgC,CAAC,CAAA;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAA;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,cAAkC,CAAA;IACtC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAC5D,OAAO,CACR,CAAA;YACD,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACzD,IAAI,OAAO,CAAC,OAAO;oBAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAA;YACnE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EACvD,OAAO,CACR,CAAA;YACD,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAA;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAA;YAC/C,IAAI,cAAc,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,SAAS,GAAG,cAAc,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAC/D,OAAO,CACR,CAAA;gBACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,QAAQ,GAAG,IAAI,CAAA;YACpE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAC3D,OAAO,CACR,CAAA;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAA;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IACrE,CAAC;AACH,CAAC"}

package/dist/session/sessionRecordValidate.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { SessionRecord } from "./SessionRecord.js";
+export declare function sessionRecordValidate(value: unknown): Result<SessionRecord>;
+//# sourceMappingURL=sessionRecordValidate.d.ts.map

package/dist/session/sessionRecordValidate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRecordValidate.d.ts","sourceRoot":"","sources":["../../src/session/sessionRecordValidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAQvD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,CAqC3E"}

package/dist/session/sessionRecordValidate.js

@@ -0,0 +1,44 @@
+import { createResult, createResultError } from "#result";
+import { timeMillisecondsValidate } from "../runtime/timeMillisecondsValidate.js";
+const maximumSessionIdLength = 256;
+const maximumSubjectLength = 256;
+const maximumUsernameLength = 256;
+const maximumTokenReferenceIdLength = 256;
+const sessionRecordKeys = ["id", "subject", "username", "tokenReference", "createdAt", "expiresAt"];
+export function sessionRecordValidate(value) {
+    const op = "sessionRecordValidate";
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return createResultError(op, "session record is invalid");
+    }
+    const session = value;
+    const keys = Object.keys(session);
+    if (keys.length !== sessionRecordKeys.length || keys.some((key) => !sessionRecordKeys.includes(key))) {
+        return createResultError(op, "session record is invalid");
+    }
+    if (typeof session.id !== "string" ||
+        session.id.length === 0 ||
+        session.id.length > maximumSessionIdLength ||
+        typeof session.subject !== "string" ||
+        session.subject.length === 0 ||
+        session.subject.length > maximumSubjectLength ||
+        typeof session.username !== "string" ||
+        session.username.length === 0 ||
+        session.username.length > maximumUsernameLength ||
+        typeof session.tokenReference !== "string" ||
+        session.tokenReference.length === 0 ||
+        session.tokenReference.length > maximumTokenReferenceIdLength ||
+        !timeMillisecondsValidate(session.createdAt) ||
+        !timeMillisecondsValidate(session.expiresAt) ||
+        session.expiresAt <= session.createdAt) {
+        return createResultError(op, "session record is invalid");
+    }
+    return createResult({
+        id: session.id,
+        subject: session.subject,
+        username: session.username,
+        tokenReference: session.tokenReference,
+        createdAt: session.createdAt,
+        expiresAt: session.expiresAt,
+    });
+}
+//# sourceMappingURL=sessionRecordValidate.js.map

package/dist/session/sessionRecordValidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRecordValidate.js","sourceRoot":"","sources":["../../src/session/sessionRecordValidate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAA;AAGjF,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAClC,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAChC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,6BAA6B,GAAG,GAAG,CAAA;AACzC,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;AAEnG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,EAAE,GAAG,uBAAuB,CAAA;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,OAAO,GAAG,KAAgC,CAAA;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrG,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3D,CAAC;IACD,IACE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ;QAC9B,OAAO,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;QACvB,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,sBAAsB;QAC1C,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACnC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,oBAAoB;QAC7C,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,qBAAqB;QAC/C,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;QAC1C,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QACnC,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,6BAA6B;QAC7D,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,EACtC,CAAC;QACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAA;AACJ,CAAC"}

package/dist/session/sessionRequestResolve.d.ts

@@ -0,0 +1,9 @@
+import { type PromiseResult } from "#result";
+import type { SessionCookieOptions } from "./SessionCookieOptions.js";
+import type { SessionRecord } from "./SessionRecord.js";
+import type { SessionStore } from "./SessionStore.js";
+export declare function sessionRequestResolve(cookieHeader: string | null | undefined, sessions: SessionStore, cookieOptions?: SessionCookieOptions, operationOptions?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}): PromiseResult<SessionRecord>;
+//# sourceMappingURL=sessionRequestResolve.d.ts.map

package/dist/session/sessionRequestResolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRequestResolve.d.ts","sourceRoot":"","sources":["../../src/session/sessionRequestResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,SAAS,CAAA;AAE/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIrD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,YAAY,EACtB,aAAa,GAAE,oBAAyB,EACxC,gBAAgB,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAClE,aAAa,CAAC,aAAa,CAAC,CAgB9B"}

package/dist/session/sessionRequestResolve.js

@@ -0,0 +1,23 @@
+import { createResultError } from "#result";
+import { promiseBoundedRace } from "../runtime/promiseBoundedRace.js";
+import { sessionCookieParse } from "./sessionCookieParse.js";
+import { sessionRecordValidate } from "./sessionRecordValidate.js";
+export async function sessionRequestResolve(cookieHeader, sessions, cookieOptions = {}, operationOptions = {}) {
+    const op = "sessionRequestResolve";
+    const cookieR = sessionCookieParse(cookieHeader, cookieOptions);
+    if (!cookieR.success)
+        return createResultError(op, "session is unavailable");
+    try {
+        const sessionR = await promiseBoundedRace(Promise.resolve().then(() => sessions.resolve(cookieR.data)), operationOptions);
+        if (!sessionR.success || sessionR.data.success !== true)
+            return createResultError(op, "session is unavailable");
+        const recordR = sessionRecordValidate(sessionR.data.data);
+        if (!recordR.success || recordR.data.id !== cookieR.data)
+            return createResultError(op, "session is unavailable");
+        return recordR;
+    }
+    catch {
+        return createResultError(op, "session is unavailable");
+    }
+}
+//# sourceMappingURL=sessionRequestResolve.js.map

package/dist/session/sessionRequestResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRequestResolve.js","sourceRoot":"","sources":["../../src/session/sessionRequestResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAIrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAElE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAuC,EACvC,QAAsB,EACtB,gBAAsC,EAAE,EACxC,mBAAiE,EAAE;IAEnE,MAAM,EAAE,GAAG,uBAAuB,CAAA;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;IAC5E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAC5D,gBAAgB,CACjB,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC/G,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAChH,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAA;IACxD,CAAC;AACH,CAAC"}

package/dist/session/sessionStoreCreate.d.ts

@@ -0,0 +1,4 @@
+import type { SessionStore } from "./SessionStore.js";
+import type { SessionStoreOptions } from "./SessionStoreOptions.js";
+export declare function sessionStoreCreate(options: SessionStoreOptions): SessionStore;
+//# sourceMappingURL=sessionStoreCreate.d.ts.map

package/dist/session/sessionStoreCreate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionStoreCreate.d.ts","sourceRoot":"","sources":["../../src/session/sessionStoreCreate.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAkCnE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAsK7E"}