@agimon-ai/doompi-core 0.0.1-alpha.70

package/dist/services/contextApiUrls/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/contextApiUrls/index.ts"],"mappings":";;;wBAUgB,cAAc,mBAAmB,UAAU,iBAAiB"}

package/dist/services/contextApiUrls/index.mjs

@@ -0,0 +1,15 @@
+import { API_BASE_PATH, ITEM_ROUTE, KIND_QUERY_PARAM, NAME_QUERY_PARAM, SESSION_QUERY_PARAM } from "../../constants/contextApi.mjs";
+//#region src/services/contextApiUrls/index.ts
+/** The absolute URL a page reads one row's detail through. */
+function itemDetailUrl(sessionId, itemKind, name) {
+	const search = new URLSearchParams({
+		[SESSION_QUERY_PARAM]: sessionId,
+		[KIND_QUERY_PARAM]: itemKind,
+		[NAME_QUERY_PARAM]: name
+	});
+	return `/api/sessions/${encodeURIComponent(sessionId)}/plugin/${API_BASE_PATH}${ITEM_ROUTE}?${search.toString()}`;
+}
+//#endregion
+export { itemDetailUrl };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/contextApiUrls/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/contextApiUrls/index.ts"],"sourcesContent":["import {\n  API_BASE_PATH,\n  SESSION_QUERY_PARAM,\n  ITEM_ROUTE,\n  NAME_QUERY_PARAM,\n  KIND_QUERY_PARAM,\n} from '../../constants/contextApi';\nimport type { ContextItemKind } from '../../types/contextApi';\n\n/** The absolute URL a page reads one row's detail through. */\nexport function itemDetailUrl(sessionId: string, itemKind: ContextItemKind, name: string): string {\n  const search = new URLSearchParams({\n    [SESSION_QUERY_PARAM]: sessionId,\n    [KIND_QUERY_PARAM]: itemKind,\n    [NAME_QUERY_PARAM]: name,\n  });\n  return `/api/sessions/${encodeURIComponent(sessionId)}/plugin/${API_BASE_PATH}${ITEM_ROUTE}?${search.toString()}`;\n}\n"],"mappings":";;;AAUA,SAAgB,cAAc,WAAmB,UAA2B,MAAsB;CAChG,MAAM,SAAS,IAAI,gBAAgB;GAChC,sBAAsB;GACtB,mBAAmB;GACnB,mBAAmB;CACtB,CAAC;CACD,OAAO,iBAAiB,mBAAmB,SAAS,EAAE,UAAU,gBAAgB,WAAW,GAAG,OAAO,SAAS;AAChH"}

package/dist/services/contextContributions/index.cjs

@@ -0,0 +1,79 @@
+//#region src/services/contextContributions/index.ts
+function compareContributions(left, right) {
+	const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;
+	const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+	return left.order - right.order || sourceOrder || idOrder;
+}
+function assertNonEmpty(value, field) {
+	if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);
+}
+function contributionErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Creates the host-owned aggregation service for one Doom session generation. */
+function createDoomContextContributionsService(generation) {
+	if (!generation) throw new Error("Doom context contributions require a session generation.");
+	const contributions = /* @__PURE__ */ new Map();
+	return Object.freeze({
+		generation,
+		register(contribution) {
+			assertNonEmpty(contribution.source, "source");
+			assertNonEmpty(contribution.id, "id");
+			assertNonEmpty(contribution.label, "label");
+			if (!Number.isFinite(contribution.order)) throw new Error("Doom context contribution order must be a finite number.");
+			if (typeof contribution.snapshot !== "function") throw new Error("Doom context contribution snapshot must be a function.");
+			const key = JSON.stringify([contribution.source, contribution.id]);
+			if (contributions.has(key)) throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);
+			const stored = Object.freeze({
+				key,
+				source: contribution.source,
+				id: contribution.id,
+				label: contribution.label,
+				order: contribution.order,
+				snapshot: () => contribution.snapshot()
+			});
+			contributions.set(key, stored);
+			let disposed = false;
+			return Object.freeze({ dispose() {
+				if (disposed) return;
+				disposed = true;
+				if (contributions.get(key) === stored) contributions.delete(key);
+			} });
+		},
+		snapshot() {
+			const entries = [];
+			const errors = [];
+			const ordered = [...contributions.values()].sort(compareContributions);
+			for (const contribution of ordered) {
+				const identity = {
+					source: contribution.source,
+					id: contribution.id,
+					label: contribution.label,
+					order: contribution.order
+				};
+				try {
+					const text = contribution.snapshot();
+					if (text === void 0) continue;
+					if (typeof text !== "string") throw new Error("Snapshot returned a non-string value.");
+					entries.push(Object.freeze({
+						...identity,
+						text
+					}));
+				} catch (error) {
+					errors.push(Object.freeze({
+						...identity,
+						message: contributionErrorMessage(error)
+					}));
+				}
+			}
+			return Object.freeze({
+				entries: Object.freeze(entries),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+//#endregion
+exports.createDoomContextContributionsService = createDoomContextContributionsService;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/contextContributions/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/services/contextContributions/index.ts"],"sourcesContent":["import type {\n  DoomContextContribution,\n  DoomContextContributionEntry,\n  DoomContextContributionError,\n  DoomContextContributionRegistration,\n  DoomContextContributionsService,\n  DoomContextContributionsSnapshot,\n} from '../../schemas/contextContributions';\n\ninterface StoredContribution extends DoomContextContribution {\n  readonly key: string;\n}\n\nfunction compareContributions(left: DoomContextContribution, right: DoomContextContribution): number {\n  const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;\n  const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;\n  return left.order - right.order || sourceOrder || idOrder;\n}\n\nfunction assertNonEmpty(value: string, field: string): void {\n  if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);\n}\n\nfunction contributionErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** Creates the host-owned aggregation service for one Doom session generation. */\nexport function createDoomContextContributionsService(generation: string): DoomContextContributionsService {\n  if (!generation) throw new Error('Doom context contributions require a session generation.');\n\n  const contributions = new Map<string, StoredContribution>();\n  return Object.freeze({\n    generation,\n    register(contribution: DoomContextContribution): DoomContextContributionRegistration {\n      assertNonEmpty(contribution.source, 'source');\n      assertNonEmpty(contribution.id, 'id');\n      assertNonEmpty(contribution.label, 'label');\n      if (!Number.isFinite(contribution.order)) {\n        throw new Error('Doom context contribution order must be a finite number.');\n      }\n      if (typeof contribution.snapshot !== 'function') {\n        throw new Error('Doom context contribution snapshot must be a function.');\n      }\n\n      const key = JSON.stringify([contribution.source, contribution.id]);\n      if (contributions.has(key)) {\n        throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);\n      }\n      const stored: StoredContribution = Object.freeze({\n        key,\n        source: contribution.source,\n        id: contribution.id,\n        label: contribution.label,\n        order: contribution.order,\n        snapshot: () => contribution.snapshot(),\n      });\n      contributions.set(key, stored);\n\n      let disposed = false;\n      return Object.freeze({\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (contributions.get(key) === stored) contributions.delete(key);\n        },\n      });\n    },\n    snapshot(): DoomContextContributionsSnapshot {\n      const entries: DoomContextContributionEntry[] = [];\n      const errors: DoomContextContributionError[] = [];\n      const ordered = [...contributions.values()].sort(compareContributions);\n\n      for (const contribution of ordered) {\n        const identity = {\n          source: contribution.source,\n          id: contribution.id,\n          label: contribution.label,\n          order: contribution.order,\n        };\n        try {\n          const text = contribution.snapshot();\n          if (text === undefined) continue;\n          if (typeof text !== 'string') throw new Error('Snapshot returned a non-string value.');\n          entries.push(Object.freeze({ ...identity, text }));\n        } catch (error) {\n          errors.push(Object.freeze({ ...identity, message: contributionErrorMessage(error) }));\n        }\n      }\n\n      return Object.freeze({ entries: Object.freeze(entries), errors: Object.freeze(errors) });\n    },\n  });\n}\n"],"mappings":";AAaA,SAAS,qBAAqB,MAA+B,OAAwC;CACnG,MAAM,cAAc,KAAK,SAAS,MAAM,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS,IAAI;CACvF,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI;CACnE,OAAO,KAAK,QAAQ,MAAM,SAAS,eAAe;AACpD;AAEA,SAAS,eAAe,OAAe,OAAqB;CAC1D,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM,oBAAoB;AACxG;AAEA,SAAS,yBAAyB,OAAwB;CACxD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAgB,sCAAsC,YAAqD;CACzG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,0DAA0D;CAE3F,MAAM,gCAAgB,IAAI,IAAgC;CAC1D,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,cAA4E;GACnF,eAAe,aAAa,QAAQ,QAAQ;GAC5C,eAAe,aAAa,IAAI,IAAI;GACpC,eAAe,aAAa,OAAO,OAAO;GAC1C,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,GACrC,MAAM,IAAI,MAAM,0DAA0D;GAE5E,IAAI,OAAO,aAAa,aAAa,YACnC,MAAM,IAAI,MAAM,wDAAwD;GAG1E,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,QAAQ,aAAa,EAAE,CAAC;GACjE,IAAI,cAAc,IAAI,GAAG,GACvB,MAAM,IAAI,MAAM,oDAAoD,aAAa,OAAO,GAAG,aAAa,GAAG,EAAE;GAE/G,MAAM,SAA6B,OAAO,OAAO;IAC/C;IACA,QAAQ,aAAa;IACrB,IAAI,aAAa;IACjB,OAAO,aAAa;IACpB,OAAO,aAAa;IACpB,gBAAgB,aAAa,SAAS;GACxC,CAAC;GACD,cAAc,IAAI,KAAK,MAAM;GAE7B,IAAI,WAAW;GACf,OAAO,OAAO,OAAO,EACnB,UAAgB;IACd,IAAI,UAAU;IACd,WAAW;IACX,IAAI,cAAc,IAAI,GAAG,MAAM,QAAQ,cAAc,OAAO,GAAG;GACjE,EACF,CAAC;EACH;EACA,WAA6C;GAC3C,MAAM,UAA0C,CAAC;GACjD,MAAM,SAAyC,CAAC;GAChD,MAAM,UAAU,CAAC,GAAG,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;GAErE,KAAK,MAAM,gBAAgB,SAAS;IAClC,MAAM,WAAW;KACf,QAAQ,aAAa;KACrB,IAAI,aAAa;KACjB,OAAO,aAAa;KACpB,OAAO,aAAa;IACtB;IACA,IAAI;KACF,MAAM,OAAO,aAAa,SAAS;KACnC,IAAI,SAAS,KAAA,GAAW;KACxB,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,uCAAuC;KACrF,QAAQ,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU;KAAK,CAAC,CAAC;IACnD,SAAS,OAAO;KACd,OAAO,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU,SAAS,yBAAyB,KAAK;KAAE,CAAC,CAAC;IACtF;GACF;GAEA,OAAO,OAAO,OAAO;IAAE,SAAS,OAAO,OAAO,OAAO;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACzF;CACF,CAAC;AACH"}

package/dist/services/contextContributions/index.d.cts

@@ -0,0 +1,6 @@
+import { DoomContextContributionsService } from "../../schemas/contextContributions.cjs";
+//#region src/services/contextContributions/index.d.ts
+/** Creates the host-owned aggregation service for one Doom session generation. */
+export declare function createDoomContextContributionsService(generation: string): DoomContextContributionsService;
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/contextContributions/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/contextContributions/index.ts"],"mappings":";;;wBA4BgB,sCAAsC,qBAAqB"}

package/dist/services/contextContributions/index.d.mts

@@ -0,0 +1,6 @@
+import { DoomContextContributionsService } from "../../schemas/contextContributions.mjs";
+//#region src/services/contextContributions/index.d.ts
+/** Creates the host-owned aggregation service for one Doom session generation. */
+export declare function createDoomContextContributionsService(generation: string): DoomContextContributionsService;
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/contextContributions/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/contextContributions/index.ts"],"mappings":";;;wBA4BgB,sCAAsC,qBAAqB"}

package/dist/services/contextContributions/index.mjs

@@ -0,0 +1,79 @@
+//#region src/services/contextContributions/index.ts
+function compareContributions(left, right) {
+	const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;
+	const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+	return left.order - right.order || sourceOrder || idOrder;
+}
+function assertNonEmpty(value, field) {
+	if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);
+}
+function contributionErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Creates the host-owned aggregation service for one Doom session generation. */
+function createDoomContextContributionsService(generation) {
+	if (!generation) throw new Error("Doom context contributions require a session generation.");
+	const contributions = /* @__PURE__ */ new Map();
+	return Object.freeze({
+		generation,
+		register(contribution) {
+			assertNonEmpty(contribution.source, "source");
+			assertNonEmpty(contribution.id, "id");
+			assertNonEmpty(contribution.label, "label");
+			if (!Number.isFinite(contribution.order)) throw new Error("Doom context contribution order must be a finite number.");
+			if (typeof contribution.snapshot !== "function") throw new Error("Doom context contribution snapshot must be a function.");
+			const key = JSON.stringify([contribution.source, contribution.id]);
+			if (contributions.has(key)) throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);
+			const stored = Object.freeze({
+				key,
+				source: contribution.source,
+				id: contribution.id,
+				label: contribution.label,
+				order: contribution.order,
+				snapshot: () => contribution.snapshot()
+			});
+			contributions.set(key, stored);
+			let disposed = false;
+			return Object.freeze({ dispose() {
+				if (disposed) return;
+				disposed = true;
+				if (contributions.get(key) === stored) contributions.delete(key);
+			} });
+		},
+		snapshot() {
+			const entries = [];
+			const errors = [];
+			const ordered = [...contributions.values()].sort(compareContributions);
+			for (const contribution of ordered) {
+				const identity = {
+					source: contribution.source,
+					id: contribution.id,
+					label: contribution.label,
+					order: contribution.order
+				};
+				try {
+					const text = contribution.snapshot();
+					if (text === void 0) continue;
+					if (typeof text !== "string") throw new Error("Snapshot returned a non-string value.");
+					entries.push(Object.freeze({
+						...identity,
+						text
+					}));
+				} catch (error) {
+					errors.push(Object.freeze({
+						...identity,
+						message: contributionErrorMessage(error)
+					}));
+				}
+			}
+			return Object.freeze({
+				entries: Object.freeze(entries),
+				errors: Object.freeze(errors)
+			});
+		}
+	});
+}
+//#endregion
+export { createDoomContextContributionsService };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/contextContributions/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/contextContributions/index.ts"],"sourcesContent":["import type {\n  DoomContextContribution,\n  DoomContextContributionEntry,\n  DoomContextContributionError,\n  DoomContextContributionRegistration,\n  DoomContextContributionsService,\n  DoomContextContributionsSnapshot,\n} from '../../schemas/contextContributions';\n\ninterface StoredContribution extends DoomContextContribution {\n  readonly key: string;\n}\n\nfunction compareContributions(left: DoomContextContribution, right: DoomContextContribution): number {\n  const sourceOrder = left.source < right.source ? -1 : left.source > right.source ? 1 : 0;\n  const idOrder = left.id < right.id ? -1 : left.id > right.id ? 1 : 0;\n  return left.order - right.order || sourceOrder || idOrder;\n}\n\nfunction assertNonEmpty(value: string, field: string): void {\n  if (value.trim().length === 0) throw new Error(`Doom context contribution ${field} must not be empty.`);\n}\n\nfunction contributionErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/** Creates the host-owned aggregation service for one Doom session generation. */\nexport function createDoomContextContributionsService(generation: string): DoomContextContributionsService {\n  if (!generation) throw new Error('Doom context contributions require a session generation.');\n\n  const contributions = new Map<string, StoredContribution>();\n  return Object.freeze({\n    generation,\n    register(contribution: DoomContextContribution): DoomContextContributionRegistration {\n      assertNonEmpty(contribution.source, 'source');\n      assertNonEmpty(contribution.id, 'id');\n      assertNonEmpty(contribution.label, 'label');\n      if (!Number.isFinite(contribution.order)) {\n        throw new Error('Doom context contribution order must be a finite number.');\n      }\n      if (typeof contribution.snapshot !== 'function') {\n        throw new Error('Doom context contribution snapshot must be a function.');\n      }\n\n      const key = JSON.stringify([contribution.source, contribution.id]);\n      if (contributions.has(key)) {\n        throw new Error(`Doom context contribution is already registered: ${contribution.source}/${contribution.id}.`);\n      }\n      const stored: StoredContribution = Object.freeze({\n        key,\n        source: contribution.source,\n        id: contribution.id,\n        label: contribution.label,\n        order: contribution.order,\n        snapshot: () => contribution.snapshot(),\n      });\n      contributions.set(key, stored);\n\n      let disposed = false;\n      return Object.freeze({\n        dispose(): void {\n          if (disposed) return;\n          disposed = true;\n          if (contributions.get(key) === stored) contributions.delete(key);\n        },\n      });\n    },\n    snapshot(): DoomContextContributionsSnapshot {\n      const entries: DoomContextContributionEntry[] = [];\n      const errors: DoomContextContributionError[] = [];\n      const ordered = [...contributions.values()].sort(compareContributions);\n\n      for (const contribution of ordered) {\n        const identity = {\n          source: contribution.source,\n          id: contribution.id,\n          label: contribution.label,\n          order: contribution.order,\n        };\n        try {\n          const text = contribution.snapshot();\n          if (text === undefined) continue;\n          if (typeof text !== 'string') throw new Error('Snapshot returned a non-string value.');\n          entries.push(Object.freeze({ ...identity, text }));\n        } catch (error) {\n          errors.push(Object.freeze({ ...identity, message: contributionErrorMessage(error) }));\n        }\n      }\n\n      return Object.freeze({ entries: Object.freeze(entries), errors: Object.freeze(errors) });\n    },\n  });\n}\n"],"mappings":";AAaA,SAAS,qBAAqB,MAA+B,OAAwC;CACnG,MAAM,cAAc,KAAK,SAAS,MAAM,SAAS,KAAK,KAAK,SAAS,MAAM,SAAS,IAAI;CACvF,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI;CACnE,OAAO,KAAK,QAAQ,MAAM,SAAS,eAAe;AACpD;AAEA,SAAS,eAAe,OAAe,OAAqB;CAC1D,IAAI,MAAM,KAAK,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,MAAM,6BAA6B,MAAM,oBAAoB;AACxG;AAEA,SAAS,yBAAyB,OAAwB;CACxD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;;AAGA,SAAgB,sCAAsC,YAAqD;CACzG,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,0DAA0D;CAE3F,MAAM,gCAAgB,IAAI,IAAgC;CAC1D,OAAO,OAAO,OAAO;EACnB;EACA,SAAS,cAA4E;GACnF,eAAe,aAAa,QAAQ,QAAQ;GAC5C,eAAe,aAAa,IAAI,IAAI;GACpC,eAAe,aAAa,OAAO,OAAO;GAC1C,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,GACrC,MAAM,IAAI,MAAM,0DAA0D;GAE5E,IAAI,OAAO,aAAa,aAAa,YACnC,MAAM,IAAI,MAAM,wDAAwD;GAG1E,MAAM,MAAM,KAAK,UAAU,CAAC,aAAa,QAAQ,aAAa,EAAE,CAAC;GACjE,IAAI,cAAc,IAAI,GAAG,GACvB,MAAM,IAAI,MAAM,oDAAoD,aAAa,OAAO,GAAG,aAAa,GAAG,EAAE;GAE/G,MAAM,SAA6B,OAAO,OAAO;IAC/C;IACA,QAAQ,aAAa;IACrB,IAAI,aAAa;IACjB,OAAO,aAAa;IACpB,OAAO,aAAa;IACpB,gBAAgB,aAAa,SAAS;GACxC,CAAC;GACD,cAAc,IAAI,KAAK,MAAM;GAE7B,IAAI,WAAW;GACf,OAAO,OAAO,OAAO,EACnB,UAAgB;IACd,IAAI,UAAU;IACd,WAAW;IACX,IAAI,cAAc,IAAI,GAAG,MAAM,QAAQ,cAAc,OAAO,GAAG;GACjE,EACF,CAAC;EACH;EACA,WAA6C;GAC3C,MAAM,UAA0C,CAAC;GACjD,MAAM,SAAyC,CAAC;GAChD,MAAM,UAAU,CAAC,GAAG,cAAc,OAAO,CAAC,CAAC,CAAC,KAAK,oBAAoB;GAErE,KAAK,MAAM,gBAAgB,SAAS;IAClC,MAAM,WAAW;KACf,QAAQ,aAAa;KACrB,IAAI,aAAa;KACjB,OAAO,aAAa;KACpB,OAAO,aAAa;IACtB;IACA,IAAI;KACF,MAAM,OAAO,aAAa,SAAS;KACnC,IAAI,SAAS,KAAA,GAAW;KACxB,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,uCAAuC;KACrF,QAAQ,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU;KAAK,CAAC,CAAC;IACnD,SAAS,OAAO;KACd,OAAO,KAAK,OAAO,OAAO;MAAE,GAAG;MAAU,SAAS,yBAAyB,KAAK;KAAE,CAAC,CAAC;IACtF;GACF;GAEA,OAAO,OAAO,OAAO;IAAE,SAAS,OAAO,OAAO,OAAO;IAAG,QAAQ,OAAO,OAAO,MAAM;GAAE,CAAC;EACzF;CACF,CAAC;AACH"}

package/dist/services/deviceAuth/index.cjs

@@ -0,0 +1,125 @@
+const require_index = require("../deviceSessions/index.cjs");
+let node_crypto = require("node:crypto");
+//#region src/services/deviceAuth/index.ts
+/** 256 bits. The token is scanned or set by the server, never typed, so there is no reason to economise. */
+const TOKEN_BYTES = 32;
+const ID_BYTES = 8;
+function digest(token) {
+	return (0, node_crypto.createHash)("sha256").update(token).digest("hex");
+}
+/**
+* Paired sessions, held in memory only.
+*
+* Keyed by digest rather than scanned, so verification is a map lookup and
+* there is no comparison loop for a timing side channel to live in. That is why
+* `timingSafeEqual` does not appear here: there is nothing to compare. If a
+* future change introduces a scan, it will need one.
+*/
+function createDeviceAuth(options) {
+	const now = options.now ?? (() => Date.now());
+	const notice = options.onNotice ?? (() => {});
+	/** Digest to record. The raw token exists only in flight. */
+	const devices = /* @__PURE__ */ new Map();
+	const timers = /* @__PURE__ */ new Map();
+	const clearDeadline = (hash) => {
+		const timer = timers.get(hash);
+		if (timer !== void 0) clearTimeout(timer);
+		timers.delete(hash);
+	};
+	const drop = (hash, reason) => {
+		const record = devices.get(hash);
+		if (record === void 0) return void 0;
+		devices.delete(hash);
+		clearDeadline(hash);
+		options.onDrop?.(record, reason);
+		return record;
+	};
+	const schedule = (hash, record) => {
+		clearDeadline(hash);
+		const deadline = require_index.deviceExpiryAt(record, options.settings());
+		if (deadline === void 0) return;
+		const remaining = deadline - now();
+		if (remaining <= 0) {
+			drop(hash, "expired");
+			return;
+		}
+		const timer = setTimeout(() => {
+			const current = devices.get(hash);
+			if (current === void 0) return;
+			if (require_index.evaluateDevice(current, now(), options.settings()).ok) schedule(hash, current);
+			else drop(hash, "expired");
+		}, Math.min(remaining, 2147483647));
+		timer.unref();
+		timers.set(hash, timer);
+	};
+	return {
+		enrol(input) {
+			const token = (0, node_crypto.randomBytes)(TOKEN_BYTES).toString("base64url");
+			const userAgent = require_index.sanitizeUserAgent(input.userAgent);
+			const at = now();
+			const record = {
+				id: (0, node_crypto.randomBytes)(ID_BYTES).toString("hex"),
+				tokenHash: digest(token),
+				label: require_index.deviceLabelFor(userAgent),
+				userAgent,
+				createdAt: at,
+				lastSeenAt: at
+			};
+			devices.set(record.tokenHash, record);
+			schedule(record.tokenHash, record);
+			notice(`paired ${record.label} (${record.id})`);
+			return {
+				token,
+				record
+			};
+		},
+		verify(token) {
+			if (token === void 0 || token === "") return void 0;
+			const hash = digest(token);
+			const at = now();
+			const verdict = require_index.evaluateDevice(devices.get(hash), at, options.settings());
+			if (!verdict.ok) {
+				if (verdict.reason !== "unknown") drop(hash, "expired");
+				return;
+			}
+			const seen = require_index.touchDevice(verdict.record, at);
+			devices.set(hash, seen);
+			schedule(hash, seen);
+			return seen;
+		},
+		revoke(id) {
+			for (const [hash, record] of devices) {
+				if (record.id !== id) continue;
+				drop(hash, "revoked");
+				notice(`revoked ${record.label} (${record.id})`);
+				return true;
+			}
+			return false;
+		},
+		revokeAll() {
+			const records = [...devices.values()];
+			for (const [hash] of devices) drop(hash, "revoked");
+			if (records.length > 0) notice(`revoked ${String(records.length)} paired device(s)`);
+			return records.length;
+		},
+		list: () => [...devices.values()],
+		reschedule() {
+			for (const [hash, record] of devices) schedule(hash, record);
+		},
+		sweep() {
+			const at = now();
+			const settings = options.settings();
+			let dropped = 0;
+			for (const [hash, record] of devices) {
+				if (require_index.evaluateDevice(record, at, settings).ok) continue;
+				drop(hash, "expired");
+				dropped += 1;
+			}
+			return dropped;
+		}
+	};
+}
+//#endregion
+exports.createDeviceAuth = createDeviceAuth;
+
+//# sourceMappingURL=index.cjs.map

package/dist/services/deviceAuth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":["createHash","deviceExpiryAt","evaluateDevice","randomBytes","sanitizeUserAgent","deviceLabelFor","touchDevice"],"sources":["../../../src/services/deviceAuth/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\n\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport {\n  type DeviceRecord,\n  deviceExpiryAt,\n  deviceLabelFor,\n  evaluateDevice,\n  sanitizeUserAgent,\n  touchDevice,\n} from '../deviceSessions';\n\n/** 256 bits. The token is scanned or set by the server, never typed, so there is no reason to economise. */\nconst TOKEN_BYTES = 32;\nconst ID_BYTES = 8;\n\nexport interface DeviceAuthOptions {\n  /** Read fresh on every check, so a changed toggle takes effect on the next request. */\n  settings: () => RemoteAccessSettings;\n  now?: () => number;\n  onNotice?: (message: string) => void;\n  onDrop?: (record: DeviceRecord, reason: 'revoked' | 'expired') => void;\n}\n\nexport interface EnrolledDevice {\n  /** Returned exactly once, to be sent as the cookie value. Only its digest is retained. */\n  token: string;\n  record: DeviceRecord;\n}\n\nexport interface DeviceAuth {\n  enrol(input: { userAgent: string | undefined }): EnrolledDevice;\n  /** The device this cookie names, or undefined. Bumps last-seen as a side effect. */\n  verify(token: string | undefined): DeviceRecord | undefined;\n  revoke(id: string): boolean;\n  revokeAll(): number;\n  list(): readonly DeviceRecord[];\n  /** Re-arms exact deadlines after expiry settings change. */\n  reschedule(): void;\n  /** Drops what has expired under the current settings. Returns how many went. */\n  sweep(): number;\n}\n\nfunction digest(token: string): string {\n  // No salt and no KDF, deliberately. The input is 256 bits of uniform\n  // randomness, so there is no dictionary to attack and a slow hash would only\n  // add latency to every request. Do not \"fix\" this into bcrypt.\n  return createHash('sha256').update(token).digest('hex');\n}\n\n/**\n * Paired sessions, held in memory only.\n *\n * Keyed by digest rather than scanned, so verification is a map lookup and\n * there is no comparison loop for a timing side channel to live in. That is why\n * `timingSafeEqual` does not appear here: there is nothing to compare. If a\n * future change introduces a scan, it will need one.\n */\nexport function createDeviceAuth(options: DeviceAuthOptions): DeviceAuth {\n  const now = options.now ?? ((): number => Date.now());\n  const notice = options.onNotice ?? ((): void => {});\n  /** Digest to record. The raw token exists only in flight. */\n  const devices = new Map<string, DeviceRecord>();\n  const timers = new Map<string, ReturnType<typeof setTimeout>>();\n\n  const clearDeadline = (hash: string): void => {\n    const timer = timers.get(hash);\n    if (timer !== undefined) clearTimeout(timer);\n    timers.delete(hash);\n  };\n\n  const drop = (hash: string, reason: 'revoked' | 'expired'): DeviceRecord | undefined => {\n    const record = devices.get(hash);\n    if (record === undefined) return undefined;\n    devices.delete(hash);\n    clearDeadline(hash);\n    options.onDrop?.(record, reason);\n    return record;\n  };\n\n  const schedule = (hash: string, record: DeviceRecord): void => {\n    clearDeadline(hash);\n    const deadline = deviceExpiryAt(record, options.settings());\n    if (deadline === undefined) return;\n    const remaining = deadline - now();\n    if (remaining <= 0) {\n      drop(hash, 'expired');\n      return;\n    }\n    const timer = setTimeout(\n      () => {\n        const current = devices.get(hash);\n        if (current === undefined) return;\n        if (evaluateDevice(current, now(), options.settings()).ok) schedule(hash, current);\n        else drop(hash, 'expired');\n      },\n      Math.min(remaining, 2_147_483_647),\n    );\n    timer.unref();\n    timers.set(hash, timer);\n  };\n  return {\n    enrol(input) {\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const userAgent = sanitizeUserAgent(input.userAgent);\n      const at = now();\n      const record: DeviceRecord = {\n        id: randomBytes(ID_BYTES).toString('hex'),\n        tokenHash: digest(token),\n        label: deviceLabelFor(userAgent),\n        userAgent,\n        createdAt: at,\n        lastSeenAt: at,\n      };\n      devices.set(record.tokenHash, record);\n      schedule(record.tokenHash, record);\n      notice(`paired ${record.label} (${record.id})`);\n      return { token, record };\n    },\n\n    verify(token) {\n      if (token === undefined || token === '') return undefined;\n      const hash = digest(token);\n      const at = now();\n      const verdict = evaluateDevice(devices.get(hash), at, options.settings());\n      if (!verdict.ok) {\n        // An expired record is dropped on the way past rather than left to the\n        // sweeper, so a revoked-by-time device stops appearing in the list.\n        if (verdict.reason !== 'unknown') drop(hash, 'expired');\n        return undefined;\n      }\n      const seen = touchDevice(verdict.record, at);\n      devices.set(hash, seen);\n      schedule(hash, seen);\n      return seen;\n    },\n\n    revoke(id) {\n      for (const [hash, record] of devices) {\n        if (record.id !== id) continue;\n        drop(hash, 'revoked');\n        notice(`revoked ${record.label} (${record.id})`);\n        return true;\n      }\n      return false;\n    },\n\n    revokeAll() {\n      const records = [...devices.values()];\n      for (const [hash] of devices) drop(hash, 'revoked');\n      if (records.length > 0) notice(`revoked ${String(records.length)} paired device(s)`);\n      return records.length;\n    },\n\n    list: () => [...devices.values()],\n\n    reschedule() {\n      for (const [hash, record] of devices) schedule(hash, record);\n    },\n    sweep() {\n      const at = now();\n      const settings = options.settings();\n      let dropped = 0;\n      for (const [hash, record] of devices) {\n        if (evaluateDevice(record, at, settings).ok) continue;\n        drop(hash, 'expired');\n        dropped += 1;\n      }\n      return dropped;\n    },\n  };\n}\n"],"mappings":";;;;AAaA,MAAM,cAAc;AACpB,MAAM,WAAW;AA6BjB,SAAS,OAAO,OAAuB;CAIrC,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;;;;;;;;;AAUA,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,SAAS,QAAQ,mBAAyB,CAAC;;CAEjD,MAAM,0BAAU,IAAI,IAA0B;CAC9C,MAAM,yBAAS,IAAI,IAA2C;CAE9D,MAAM,iBAAiB,SAAuB;EAC5C,MAAM,QAAQ,OAAO,IAAI,IAAI;EAC7B,IAAI,UAAU,KAAA,GAAW,aAAa,KAAK;EAC3C,OAAO,OAAO,IAAI;CACpB;CAEA,MAAM,QAAQ,MAAc,WAA4D;EACtF,MAAM,SAAS,QAAQ,IAAI,IAAI;EAC/B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,QAAQ,OAAO,IAAI;EACnB,cAAc,IAAI;EAClB,QAAQ,SAAS,QAAQ,MAAM;EAC/B,OAAO;CACT;CAEA,MAAM,YAAY,MAAc,WAA+B;EAC7D,cAAc,IAAI;EAClB,MAAM,WAAWC,cAAAA,eAAe,QAAQ,QAAQ,SAAS,CAAC;EAC1D,IAAI,aAAa,KAAA,GAAW;EAC5B,MAAM,YAAY,WAAW,IAAI;EACjC,IAAI,aAAa,GAAG;GAClB,KAAK,MAAM,SAAS;GACpB;EACF;EACA,MAAM,QAAQ,iBACN;GACJ,MAAM,UAAU,QAAQ,IAAI,IAAI;GAChC,IAAI,YAAY,KAAA,GAAW;GAC3B,IAAIC,cAAAA,eAAe,SAAS,IAAI,GAAG,QAAQ,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,MAAM,OAAO;QAC5E,KAAK,MAAM,SAAS;EAC3B,GACA,KAAK,IAAI,WAAW,UAAa,CACnC;EACA,MAAM,MAAM;EACZ,OAAO,IAAI,MAAM,KAAK;CACxB;CACA,OAAO;EACL,MAAM,OAAO;GACX,MAAM,SAAA,GAAQC,YAAAA,YAAAA,CAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,YAAYC,cAAAA,kBAAkB,MAAM,SAAS;GACnD,MAAM,KAAK,IAAI;GACf,MAAM,SAAuB;IAC3B,KAAA,GAAID,YAAAA,YAAAA,CAAY,QAAQ,CAAC,CAAC,SAAS,KAAK;IACxC,WAAW,OAAO,KAAK;IACvB,OAAOE,cAAAA,eAAe,SAAS;IAC/B;IACA,WAAW;IACX,YAAY;GACd;GACA,QAAQ,IAAI,OAAO,WAAW,MAAM;GACpC,SAAS,OAAO,WAAW,MAAM;GACjC,OAAO,UAAU,OAAO,MAAM,IAAI,OAAO,GAAG,EAAE;GAC9C,OAAO;IAAE;IAAO;GAAO;EACzB;EAEA,OAAO,OAAO;GACZ,IAAI,UAAU,KAAA,KAAa,UAAU,IAAI,OAAO,KAAA;GAChD,MAAM,OAAO,OAAO,KAAK;GACzB,MAAM,KAAK,IAAI;GACf,MAAM,UAAUH,cAAAA,eAAe,QAAQ,IAAI,IAAI,GAAG,IAAI,QAAQ,SAAS,CAAC;GACxE,IAAI,CAAC,QAAQ,IAAI;IAGf,IAAI,QAAQ,WAAW,WAAW,KAAK,MAAM,SAAS;IACtD;GACF;GACA,MAAM,OAAOI,cAAAA,YAAY,QAAQ,QAAQ,EAAE;GAC3C,QAAQ,IAAI,MAAM,IAAI;GACtB,SAAS,MAAM,IAAI;GACnB,OAAO;EACT;EAEA,OAAO,IAAI;GACT,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS;IACpC,IAAI,OAAO,OAAO,IAAI;IACtB,KAAK,MAAM,SAAS;IACpB,OAAO,WAAW,OAAO,MAAM,IAAI,OAAO,GAAG,EAAE;IAC/C,OAAO;GACT;GACA,OAAO;EACT;EAEA,YAAY;GACV,MAAM,UAAU,CAAC,GAAG,QAAQ,OAAO,CAAC;GACpC,KAAK,MAAM,CAAC,SAAS,SAAS,KAAK,MAAM,SAAS;GAClD,IAAI,QAAQ,SAAS,GAAG,OAAO,WAAW,OAAO,QAAQ,MAAM,EAAE,kBAAkB;GACnF,OAAO,QAAQ;EACjB;EAEA,YAAY,CAAC,GAAG,QAAQ,OAAO,CAAC;EAEhC,aAAa;GACX,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS,SAAS,MAAM,MAAM;EAC7D;EACA,QAAQ;GACN,MAAM,KAAK,IAAI;GACf,MAAM,WAAW,QAAQ,SAAS;GAClC,IAAI,UAAU;GACd,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS;IACpC,IAAIJ,cAAAA,eAAe,QAAQ,IAAI,QAAQ,CAAC,CAAC,IAAI;IAC7C,KAAK,MAAM,SAAS;IACpB,WAAW;GACb;GACA,OAAO;EACT;CACF;AACF"}

package/dist/services/deviceAuth/index.d.cts

@@ -0,0 +1,9 @@
+import { DeviceRecord } from "../deviceSessions/index.cjs";
+//#region src/services/deviceAuth/index.d.ts
+export interface EnrolledDevice {
+  /** Returned exactly once, to be sent as the cookie value. Only its digest is retained. */
+  token: string;
+  record: DeviceRecord;
+}
+//#endregion
+//# sourceMappingURL=index.d.cts.map

package/dist/services/deviceAuth/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/services/deviceAuth/index.ts"],"mappings":";;iBAwBiB;;EAEf;EACA,QAAQ"}

package/dist/services/deviceAuth/index.d.mts

@@ -0,0 +1,9 @@
+import { DeviceRecord } from "../deviceSessions/index.mjs";
+//#region src/services/deviceAuth/index.d.ts
+export interface EnrolledDevice {
+  /** Returned exactly once, to be sent as the cookie value. Only its digest is retained. */
+  token: string;
+  record: DeviceRecord;
+}
+//#endregion
+//# sourceMappingURL=index.d.mts.map

package/dist/services/deviceAuth/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/services/deviceAuth/index.ts"],"mappings":";;iBAwBiB;;EAEf;EACA,QAAQ"}

package/dist/services/deviceAuth/index.mjs

@@ -0,0 +1,125 @@
+import { deviceExpiryAt, deviceLabelFor, evaluateDevice, sanitizeUserAgent, touchDevice } from "../deviceSessions/index.mjs";
+import { createHash, randomBytes } from "node:crypto";
+//#region src/services/deviceAuth/index.ts
+/** 256 bits. The token is scanned or set by the server, never typed, so there is no reason to economise. */
+const TOKEN_BYTES = 32;
+const ID_BYTES = 8;
+function digest(token) {
+	return createHash("sha256").update(token).digest("hex");
+}
+/**
+* Paired sessions, held in memory only.
+*
+* Keyed by digest rather than scanned, so verification is a map lookup and
+* there is no comparison loop for a timing side channel to live in. That is why
+* `timingSafeEqual` does not appear here: there is nothing to compare. If a
+* future change introduces a scan, it will need one.
+*/
+function createDeviceAuth(options) {
+	const now = options.now ?? (() => Date.now());
+	const notice = options.onNotice ?? (() => {});
+	/** Digest to record. The raw token exists only in flight. */
+	const devices = /* @__PURE__ */ new Map();
+	const timers = /* @__PURE__ */ new Map();
+	const clearDeadline = (hash) => {
+		const timer = timers.get(hash);
+		if (timer !== void 0) clearTimeout(timer);
+		timers.delete(hash);
+	};
+	const drop = (hash, reason) => {
+		const record = devices.get(hash);
+		if (record === void 0) return void 0;
+		devices.delete(hash);
+		clearDeadline(hash);
+		options.onDrop?.(record, reason);
+		return record;
+	};
+	const schedule = (hash, record) => {
+		clearDeadline(hash);
+		const deadline = deviceExpiryAt(record, options.settings());
+		if (deadline === void 0) return;
+		const remaining = deadline - now();
+		if (remaining <= 0) {
+			drop(hash, "expired");
+			return;
+		}
+		const timer = setTimeout(() => {
+			const current = devices.get(hash);
+			if (current === void 0) return;
+			if (evaluateDevice(current, now(), options.settings()).ok) schedule(hash, current);
+			else drop(hash, "expired");
+		}, Math.min(remaining, 2147483647));
+		timer.unref();
+		timers.set(hash, timer);
+	};
+	return {
+		enrol(input) {
+			const token = randomBytes(TOKEN_BYTES).toString("base64url");
+			const userAgent = sanitizeUserAgent(input.userAgent);
+			const at = now();
+			const record = {
+				id: randomBytes(ID_BYTES).toString("hex"),
+				tokenHash: digest(token),
+				label: deviceLabelFor(userAgent),
+				userAgent,
+				createdAt: at,
+				lastSeenAt: at
+			};
+			devices.set(record.tokenHash, record);
+			schedule(record.tokenHash, record);
+			notice(`paired ${record.label} (${record.id})`);
+			return {
+				token,
+				record
+			};
+		},
+		verify(token) {
+			if (token === void 0 || token === "") return void 0;
+			const hash = digest(token);
+			const at = now();
+			const verdict = evaluateDevice(devices.get(hash), at, options.settings());
+			if (!verdict.ok) {
+				if (verdict.reason !== "unknown") drop(hash, "expired");
+				return;
+			}
+			const seen = touchDevice(verdict.record, at);
+			devices.set(hash, seen);
+			schedule(hash, seen);
+			return seen;
+		},
+		revoke(id) {
+			for (const [hash, record] of devices) {
+				if (record.id !== id) continue;
+				drop(hash, "revoked");
+				notice(`revoked ${record.label} (${record.id})`);
+				return true;
+			}
+			return false;
+		},
+		revokeAll() {
+			const records = [...devices.values()];
+			for (const [hash] of devices) drop(hash, "revoked");
+			if (records.length > 0) notice(`revoked ${String(records.length)} paired device(s)`);
+			return records.length;
+		},
+		list: () => [...devices.values()],
+		reschedule() {
+			for (const [hash, record] of devices) schedule(hash, record);
+		},
+		sweep() {
+			const at = now();
+			const settings = options.settings();
+			let dropped = 0;
+			for (const [hash, record] of devices) {
+				if (evaluateDevice(record, at, settings).ok) continue;
+				drop(hash, "expired");
+				dropped += 1;
+			}
+			return dropped;
+		}
+	};
+}
+//#endregion
+export { createDeviceAuth };
+
+//# sourceMappingURL=index.mjs.map

package/dist/services/deviceAuth/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../src/services/deviceAuth/index.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\n\nimport type { RemoteAccessSettings } from '../../types/remote';\nimport {\n  type DeviceRecord,\n  deviceExpiryAt,\n  deviceLabelFor,\n  evaluateDevice,\n  sanitizeUserAgent,\n  touchDevice,\n} from '../deviceSessions';\n\n/** 256 bits. The token is scanned or set by the server, never typed, so there is no reason to economise. */\nconst TOKEN_BYTES = 32;\nconst ID_BYTES = 8;\n\nexport interface DeviceAuthOptions {\n  /** Read fresh on every check, so a changed toggle takes effect on the next request. */\n  settings: () => RemoteAccessSettings;\n  now?: () => number;\n  onNotice?: (message: string) => void;\n  onDrop?: (record: DeviceRecord, reason: 'revoked' | 'expired') => void;\n}\n\nexport interface EnrolledDevice {\n  /** Returned exactly once, to be sent as the cookie value. Only its digest is retained. */\n  token: string;\n  record: DeviceRecord;\n}\n\nexport interface DeviceAuth {\n  enrol(input: { userAgent: string | undefined }): EnrolledDevice;\n  /** The device this cookie names, or undefined. Bumps last-seen as a side effect. */\n  verify(token: string | undefined): DeviceRecord | undefined;\n  revoke(id: string): boolean;\n  revokeAll(): number;\n  list(): readonly DeviceRecord[];\n  /** Re-arms exact deadlines after expiry settings change. */\n  reschedule(): void;\n  /** Drops what has expired under the current settings. Returns how many went. */\n  sweep(): number;\n}\n\nfunction digest(token: string): string {\n  // No salt and no KDF, deliberately. The input is 256 bits of uniform\n  // randomness, so there is no dictionary to attack and a slow hash would only\n  // add latency to every request. Do not \"fix\" this into bcrypt.\n  return createHash('sha256').update(token).digest('hex');\n}\n\n/**\n * Paired sessions, held in memory only.\n *\n * Keyed by digest rather than scanned, so verification is a map lookup and\n * there is no comparison loop for a timing side channel to live in. That is why\n * `timingSafeEqual` does not appear here: there is nothing to compare. If a\n * future change introduces a scan, it will need one.\n */\nexport function createDeviceAuth(options: DeviceAuthOptions): DeviceAuth {\n  const now = options.now ?? ((): number => Date.now());\n  const notice = options.onNotice ?? ((): void => {});\n  /** Digest to record. The raw token exists only in flight. */\n  const devices = new Map<string, DeviceRecord>();\n  const timers = new Map<string, ReturnType<typeof setTimeout>>();\n\n  const clearDeadline = (hash: string): void => {\n    const timer = timers.get(hash);\n    if (timer !== undefined) clearTimeout(timer);\n    timers.delete(hash);\n  };\n\n  const drop = (hash: string, reason: 'revoked' | 'expired'): DeviceRecord | undefined => {\n    const record = devices.get(hash);\n    if (record === undefined) return undefined;\n    devices.delete(hash);\n    clearDeadline(hash);\n    options.onDrop?.(record, reason);\n    return record;\n  };\n\n  const schedule = (hash: string, record: DeviceRecord): void => {\n    clearDeadline(hash);\n    const deadline = deviceExpiryAt(record, options.settings());\n    if (deadline === undefined) return;\n    const remaining = deadline - now();\n    if (remaining <= 0) {\n      drop(hash, 'expired');\n      return;\n    }\n    const timer = setTimeout(\n      () => {\n        const current = devices.get(hash);\n        if (current === undefined) return;\n        if (evaluateDevice(current, now(), options.settings()).ok) schedule(hash, current);\n        else drop(hash, 'expired');\n      },\n      Math.min(remaining, 2_147_483_647),\n    );\n    timer.unref();\n    timers.set(hash, timer);\n  };\n  return {\n    enrol(input) {\n      const token = randomBytes(TOKEN_BYTES).toString('base64url');\n      const userAgent = sanitizeUserAgent(input.userAgent);\n      const at = now();\n      const record: DeviceRecord = {\n        id: randomBytes(ID_BYTES).toString('hex'),\n        tokenHash: digest(token),\n        label: deviceLabelFor(userAgent),\n        userAgent,\n        createdAt: at,\n        lastSeenAt: at,\n      };\n      devices.set(record.tokenHash, record);\n      schedule(record.tokenHash, record);\n      notice(`paired ${record.label} (${record.id})`);\n      return { token, record };\n    },\n\n    verify(token) {\n      if (token === undefined || token === '') return undefined;\n      const hash = digest(token);\n      const at = now();\n      const verdict = evaluateDevice(devices.get(hash), at, options.settings());\n      if (!verdict.ok) {\n        // An expired record is dropped on the way past rather than left to the\n        // sweeper, so a revoked-by-time device stops appearing in the list.\n        if (verdict.reason !== 'unknown') drop(hash, 'expired');\n        return undefined;\n      }\n      const seen = touchDevice(verdict.record, at);\n      devices.set(hash, seen);\n      schedule(hash, seen);\n      return seen;\n    },\n\n    revoke(id) {\n      for (const [hash, record] of devices) {\n        if (record.id !== id) continue;\n        drop(hash, 'revoked');\n        notice(`revoked ${record.label} (${record.id})`);\n        return true;\n      }\n      return false;\n    },\n\n    revokeAll() {\n      const records = [...devices.values()];\n      for (const [hash] of devices) drop(hash, 'revoked');\n      if (records.length > 0) notice(`revoked ${String(records.length)} paired device(s)`);\n      return records.length;\n    },\n\n    list: () => [...devices.values()],\n\n    reschedule() {\n      for (const [hash, record] of devices) schedule(hash, record);\n    },\n    sweep() {\n      const at = now();\n      const settings = options.settings();\n      let dropped = 0;\n      for (const [hash, record] of devices) {\n        if (evaluateDevice(record, at, settings).ok) continue;\n        drop(hash, 'expired');\n        dropped += 1;\n      }\n      return dropped;\n    },\n  };\n}\n"],"mappings":";;;;AAaA,MAAM,cAAc;AACpB,MAAM,WAAW;AA6BjB,SAAS,OAAO,OAAuB;CAIrC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;;;;;;;;;AAUA,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,MAAM,QAAQ,cAAsB,KAAK,IAAI;CACnD,MAAM,SAAS,QAAQ,mBAAyB,CAAC;;CAEjD,MAAM,0BAAU,IAAI,IAA0B;CAC9C,MAAM,yBAAS,IAAI,IAA2C;CAE9D,MAAM,iBAAiB,SAAuB;EAC5C,MAAM,QAAQ,OAAO,IAAI,IAAI;EAC7B,IAAI,UAAU,KAAA,GAAW,aAAa,KAAK;EAC3C,OAAO,OAAO,IAAI;CACpB;CAEA,MAAM,QAAQ,MAAc,WAA4D;EACtF,MAAM,SAAS,QAAQ,IAAI,IAAI;EAC/B,IAAI,WAAW,KAAA,GAAW,OAAO,KAAA;EACjC,QAAQ,OAAO,IAAI;EACnB,cAAc,IAAI;EAClB,QAAQ,SAAS,QAAQ,MAAM;EAC/B,OAAO;CACT;CAEA,MAAM,YAAY,MAAc,WAA+B;EAC7D,cAAc,IAAI;EAClB,MAAM,WAAW,eAAe,QAAQ,QAAQ,SAAS,CAAC;EAC1D,IAAI,aAAa,KAAA,GAAW;EAC5B,MAAM,YAAY,WAAW,IAAI;EACjC,IAAI,aAAa,GAAG;GAClB,KAAK,MAAM,SAAS;GACpB;EACF;EACA,MAAM,QAAQ,iBACN;GACJ,MAAM,UAAU,QAAQ,IAAI,IAAI;GAChC,IAAI,YAAY,KAAA,GAAW;GAC3B,IAAI,eAAe,SAAS,IAAI,GAAG,QAAQ,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,MAAM,OAAO;QAC5E,KAAK,MAAM,SAAS;EAC3B,GACA,KAAK,IAAI,WAAW,UAAa,CACnC;EACA,MAAM,MAAM;EACZ,OAAO,IAAI,MAAM,KAAK;CACxB;CACA,OAAO;EACL,MAAM,OAAO;GACX,MAAM,QAAQ,YAAY,WAAW,CAAC,CAAC,SAAS,WAAW;GAC3D,MAAM,YAAY,kBAAkB,MAAM,SAAS;GACnD,MAAM,KAAK,IAAI;GACf,MAAM,SAAuB;IAC3B,IAAI,YAAY,QAAQ,CAAC,CAAC,SAAS,KAAK;IACxC,WAAW,OAAO,KAAK;IACvB,OAAO,eAAe,SAAS;IAC/B;IACA,WAAW;IACX,YAAY;GACd;GACA,QAAQ,IAAI,OAAO,WAAW,MAAM;GACpC,SAAS,OAAO,WAAW,MAAM;GACjC,OAAO,UAAU,OAAO,MAAM,IAAI,OAAO,GAAG,EAAE;GAC9C,OAAO;IAAE;IAAO;GAAO;EACzB;EAEA,OAAO,OAAO;GACZ,IAAI,UAAU,KAAA,KAAa,UAAU,IAAI,OAAO,KAAA;GAChD,MAAM,OAAO,OAAO,KAAK;GACzB,MAAM,KAAK,IAAI;GACf,MAAM,UAAU,eAAe,QAAQ,IAAI,IAAI,GAAG,IAAI,QAAQ,SAAS,CAAC;GACxE,IAAI,CAAC,QAAQ,IAAI;IAGf,IAAI,QAAQ,WAAW,WAAW,KAAK,MAAM,SAAS;IACtD;GACF;GACA,MAAM,OAAO,YAAY,QAAQ,QAAQ,EAAE;GAC3C,QAAQ,IAAI,MAAM,IAAI;GACtB,SAAS,MAAM,IAAI;GACnB,OAAO;EACT;EAEA,OAAO,IAAI;GACT,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS;IACpC,IAAI,OAAO,OAAO,IAAI;IACtB,KAAK,MAAM,SAAS;IACpB,OAAO,WAAW,OAAO,MAAM,IAAI,OAAO,GAAG,EAAE;IAC/C,OAAO;GACT;GACA,OAAO;EACT;EAEA,YAAY;GACV,MAAM,UAAU,CAAC,GAAG,QAAQ,OAAO,CAAC;GACpC,KAAK,MAAM,CAAC,SAAS,SAAS,KAAK,MAAM,SAAS;GAClD,IAAI,QAAQ,SAAS,GAAG,OAAO,WAAW,OAAO,QAAQ,MAAM,EAAE,kBAAkB;GACnF,OAAO,QAAQ;EACjB;EAEA,YAAY,CAAC,GAAG,QAAQ,OAAO,CAAC;EAEhC,aAAa;GACX,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS,SAAS,MAAM,MAAM;EAC7D;EACA,QAAQ;GACN,MAAM,KAAK,IAAI;GACf,MAAM,WAAW,QAAQ,SAAS;GAClC,IAAI,UAAU;GACd,KAAK,MAAM,CAAC,MAAM,WAAW,SAAS;IACpC,IAAI,eAAe,QAAQ,IAAI,QAAQ,CAAC,CAAC,IAAI;IAC7C,KAAK,MAAM,SAAS;IACpB,WAAW;GACb;GACA,OAAO;EACT;CACF;AACF"}