@alleyboss/micropay-solana-x402-paywall 2.3.1 → 3.0.0

package/dist/session/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4","SignJWT","jwtVerify"],"mappings":";;;;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,OAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAIC,YAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAMC,eAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAID,YAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.cjs","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}
+{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4","SignJWT","jwtVerify"],"mappings":";;;;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,OAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAIC,YAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAMC,eAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAID,YAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.cjs","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from './types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}

package/dist/session/index.d.cts

@@ -1,4 +1,4 @@
-import { a as SessionConfig, S as SessionData, b as SessionValidation } from '../session-D2IoWAWV.cjs';
+import { S as SessionConfig, a as SessionData, b as SessionValidation } from '../types-BWYQMw03.cjs';
 
 /**
  * Create a new session after successful payment

package/dist/session/index.d.ts

@@ -1,4 +1,4 @@
-import { a as SessionConfig, S as SessionData, b as SessionValidation } from '../session-D2IoWAWV.js';
+import { S as SessionConfig, a as SessionData, b as SessionValidation } from '../types-BWYQMw03.js';
 
 /**
  * Create a new session after successful payment

package/dist/session/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4"],"mappings":";;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,EAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAI,OAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAM,UAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAI,OAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.js","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from '../types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}
+{"version":3,"sources":["../../src/session/core.ts"],"names":["uuidv4"],"mappings":";;;;AAOA,IAAM,wBAAA,GAA2B,GAAA;AAGjC,IAAM,iBAAA,GAAoB,EAAA;AAM1B,SAAS,aAAa,MAAA,EAA4B;AAC9C,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACvC,IAAA,MAAM,IAAI,MAAM,4BAA4B,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,iBAAA,EAAmB;AACnC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,iBAAiB,CAAA,WAAA,CAAa,CAAA;AAAA,EACrF;AACA,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAC1C;AAMA,SAAS,sBAAsB,OAAA,EAA0B;AACrD,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AAEpD,EAAA,MAAM,WAAA,GAAc,+BAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,OAAO,CAAA;AACnC;AAMA,SAAS,kBAAkB,SAAA,EAA4B;AACnD,EAAA,IAAI,CAAC,SAAA,IAAa,OAAO,SAAA,KAAc,UAAU,OAAO,KAAA;AAExD,EAAA,IAAI,SAAA,CAAU,MAAA,GAAS,GAAA,EAAK,OAAO,KAAA;AACnC,EAAA,MAAM,WAAA,GAAc,kBAAA;AACpB,EAAA,OAAO,WAAA,CAAY,KAAK,SAAS,CAAA;AACrC;AAMA,eAAsB,aAAA,CAClB,aAAA,EACA,SAAA,EACA,MAAA,EACA,WAAoB,KAAA,EAC4B;AAEhD,EAAA,IAAI,CAAC,qBAAA,CAAsB,aAAa,CAAA,EAAG;AACvC,IAAA,MAAM,IAAI,MAAM,+BAA+B,CAAA;AAAA,EACnD;AACA,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,CAAC,OAAO,aAAA,IAAiB,MAAA,CAAO,iBAAiB,CAAA,IAAK,MAAA,CAAO,gBAAgB,GAAA,EAAK;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACtE;AAEA,EAAA,MAAM,YAAYA,EAAA,EAAO;AACzB,EAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,EAAA,MAAM,SAAA,GAAY,GAAA,GAAO,MAAA,CAAO,aAAA,GAAgB,IAAA;AAEhD,EAAA,MAAM,OAAA,GAAuB;AAAA,IACzB,EAAA,EAAI,SAAA;AAAA,IACJ,aAAA;AAAA,IACA,gBAAA,EAAkB,CAAC,SAAS,CAAA;AAAA,IAC5B,cAAA,EAAgB,QAAQ,QAAQ,CAAA;AAAA,IAChC,SAAA,EAAW,GAAA;AAAA,IACX;AAAA,GACJ;AAEA,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,GAAA,EAAK,aAAA;AAAA,IACL,GAAA,EAAK,SAAA;AAAA,IACL,UAAU,OAAA,CAAQ,gBAAA;AAAA,IAClB,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,GAAA,EAAK,GAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACT;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAI,OAAA,CAAQ,OAA6C,EACxE,kBAAA,CAAmB,EAAE,GAAA,EAAK,OAAA,EAAS,CAAA,CACnC,aAAY,CACZ,iBAAA,CAAkB,CAAA,EAAG,MAAA,CAAO,aAAa,CAAA,CAAA,CAAG,EAC5C,IAAA,CAAK,YAAA,CAAa,MAAA,CAAO,MAAM,CAAC,CAAA;AAErC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC5B;AAMA,eAAsB,eAAA,CAClB,OACA,MAAA,EAC0B;AAE1B,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACrC,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,EAC1D;AAEA,EAAA,IAAI;AACA,IAAA,MAAM,EAAE,SAAQ,GAAI,MAAM,UAAU,KAAA,EAAO,YAAA,CAAa,MAAM,CAAC,CAAA;AAC/D,IAAA,MAAM,cAAA,GAAiB,OAAA;AAGvB,IAAA,IAAI,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,IAAO,CAAC,eAAe,GAAA,EAAK;AACnE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,2BAAA,EAA4B;AAAA,IAC/D;AAGA,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,IAAI,cAAA,CAAe,MAAM,GAAA,EAAK;AAC1B,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,IACrD;AAGA,IAAA,IAAI,CAAC,qBAAA,CAAsB,cAAA,CAAe,GAAG,CAAA,EAAG;AAC5C,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,sBAAA,EAAuB;AAAA,IAC1D;AAEA,IAAA,MAAM,OAAA,GAAuB;AAAA,MACzB,IAAI,cAAA,CAAe,GAAA;AAAA,MACnB,eAAe,cAAA,CAAe,GAAA;AAAA,MAC9B,gBAAA,EAAkB,MAAM,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA,GAAI,cAAA,CAAe,WAAW,EAAC;AAAA,MACtF,cAAA,EAAgB,OAAA,CAAQ,cAAA,CAAe,QAAQ,CAAA;AAAA,MAC/C,SAAA,EAAW,eAAe,GAAA,IAAO,CAAA;AAAA,MACjC,WAAW,cAAA,CAAe;AAAA,KAC9B;AAEA,IAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAQ;AAAA,EAClC,SAAS,KAAA,EAAO;AAEZ,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,iBAAA,EAAkB;AAAA,EACrD;AACJ;AAMA,eAAsB,mBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACuD;AAEvD,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAG3B,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA,EAAG;AAC9C,IAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAAA,EAC5B;AAGA,EAAA,IAAI,OAAA,CAAQ,gBAAA,CAAiB,MAAA,IAAU,wBAAA,EAA0B;AAC7D,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,MAAM,eAAA,GAAkB,CAAC,GAAG,OAAA,CAAQ,kBAAkB,SAAS,CAAA;AAE/D,EAAA,MAAM,OAAA,GAA6B;AAAA,IAC/B,KAAK,OAAA,CAAQ,aAAA;AAAA,IACb,KAAK,OAAA,CAAQ,EAAA;AAAA,IACb,QAAA,EAAU,eAAA;AAAA,IACV,UAAU,OAAA,CAAQ,cAAA;AAAA,IAClB,KAAK,OAAA,CAAQ,SAAA;AAAA,IACb,KAAK,OAAA,CAAQ;AAAA,GACjB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,IAAI,OAAA,CAAQ,OAA6C,CAAA,CAC3E,kBAAA,CAAmB,EAAE,GAAA,EAAK,SAAS,CAAA,CACnC,IAAA,CAAK,YAAA,CAAa,MAAM,CAAC,CAAA;AAE9B,EAAA,OAAO;AAAA,IACH,KAAA,EAAO,QAAA;AAAA,IACP,OAAA,EAAS,EAAE,GAAG,OAAA,EAAS,kBAAkB,eAAA;AAAgB,GAC7D;AACJ;AAKA,eAAsB,iBAAA,CAClB,KAAA,EACA,SAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,iBAAA,CAAkB,SAAS,CAAA,EAAG;AAC/B,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,KAAA,EAAO,MAAM,CAAA;AACtD,EAAA,IAAI,CAAC,UAAA,CAAW,KAAA,IAAS,CAAC,WAAW,OAAA,EAAS;AAC1C,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,IAAI,UAAA,CAAW,QAAQ,cAAA,EAAgB;AACnC,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,UAAA,CAAW,OAAA,CAAQ,gBAAA,CAAiB,QAAA,CAAS,SAAS,CAAA;AACjE","file":"index.js","sourcesContent":["// Session management with JWT (framework-agnostic core)\n// SECURITY: Uses jose library with HS256, constant-time validation, input sanitization\nimport { SignJWT, jwtVerify } from 'jose';\nimport { v4 as uuidv4 } from 'uuid';\nimport type { SessionData, SessionConfig, SessionValidation, SessionJWTPayload } from './types';\n\n// Maximum articles per session to prevent unbounded growth\nconst MAX_ARTICLES_PER_SESSION = 100;\n\n// Minimum secret length for security\nconst MIN_SECRET_LENGTH = 32;\n\n/**\n * Get the secret key for JWT signing\n * SECURITY: Enforces minimum secret length\n */\nfunction getSecretKey(secret: string): Uint8Array {\n    if (!secret || typeof secret !== 'string') {\n        throw new Error('Session secret is required');\n    }\n    if (secret.length < MIN_SECRET_LENGTH) {\n        throw new Error(`Session secret must be at least ${MIN_SECRET_LENGTH} characters`);\n    }\n    return new TextEncoder().encode(secret);\n}\n\n/**\n * Validate wallet address format (base58, 32-44 chars)\n * SECURITY: Prevents injection via wallet address field\n */\nfunction validateWalletAddress(address: string): boolean {\n    if (!address || typeof address !== 'string') return false;\n    // Solana addresses are base58, typically 32-44 characters\n    const base58Regex = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;\n    return base58Regex.test(address);\n}\n\n/**\n * Validate article ID format\n * SECURITY: Prevents injection via articleId field\n */\nfunction validateArticleId(articleId: string): boolean {\n    if (!articleId || typeof articleId !== 'string') return false;\n    // Allow alphanumeric, hyphens, underscores, max 128 chars\n    if (articleId.length > 128) return false;\n    const safeIdRegex = /^[a-zA-Z0-9_-]+$/;\n    return safeIdRegex.test(articleId);\n}\n\n/**\n * Create a new session after successful payment\n * SECURITY: Validates inputs, enforces limits\n */\nexport async function createSession(\n    walletAddress: string,\n    articleId: string,\n    config: SessionConfig,\n    siteWide: boolean = false\n): Promise<{ token: string; session: SessionData }> {\n    // Input validation\n    if (!validateWalletAddress(walletAddress)) {\n        throw new Error('Invalid wallet address format');\n    }\n    if (!validateArticleId(articleId)) {\n        throw new Error('Invalid article ID format');\n    }\n    if (!config.durationHours || config.durationHours <= 0 || config.durationHours > 720) {\n        throw new Error('Session duration must be between 1 and 720 hours');\n    }\n\n    const sessionId = uuidv4();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt = now + (config.durationHours * 3600);\n\n    const session: SessionData = {\n        id: sessionId,\n        walletAddress,\n        unlockedArticles: [articleId],\n        siteWideUnlock: Boolean(siteWide),\n        createdAt: now,\n        expiresAt,\n    };\n\n    const payload: SessionJWTPayload = {\n        sub: walletAddress,\n        sid: sessionId,\n        articles: session.unlockedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: now,\n        exp: expiresAt,\n    };\n\n    const token = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .setIssuedAt()\n        .setExpirationTime(`${config.durationHours}h`)\n        .sign(getSecretKey(config.secret));\n\n    return { token, session };\n}\n\n/**\n * Validate an existing session token\n * SECURITY: jose library handles timing-safe comparison internally\n */\nexport async function validateSession(\n    token: string,\n    secret: string\n): Promise<SessionValidation> {\n    // Input validation\n    if (!token || typeof token !== 'string') {\n        return { valid: false, reason: 'Invalid token format' };\n    }\n\n    try {\n        const { payload } = await jwtVerify(token, getSecretKey(secret));\n        const sessionPayload = payload as unknown as SessionJWTPayload;\n\n        // Validate required fields exist\n        if (!sessionPayload.sub || !sessionPayload.sid || !sessionPayload.exp) {\n            return { valid: false, reason: 'Malformed session payload' };\n        }\n\n        // Check expiration (jose already checks, but double-check)\n        const now = Math.floor(Date.now() / 1000);\n        if (sessionPayload.exp < now) {\n            return { valid: false, reason: 'Session expired' };\n        }\n\n        // Validate wallet address format from token\n        if (!validateWalletAddress(sessionPayload.sub)) {\n            return { valid: false, reason: 'Invalid session data' };\n        }\n\n        const session: SessionData = {\n            id: sessionPayload.sid,\n            walletAddress: sessionPayload.sub,\n            unlockedArticles: Array.isArray(sessionPayload.articles) ? sessionPayload.articles : [],\n            siteWideUnlock: Boolean(sessionPayload.siteWide),\n            createdAt: sessionPayload.iat ?? 0,\n            expiresAt: sessionPayload.exp,\n        };\n\n        return { valid: true, session };\n    } catch (error) {\n        // SECURITY: Don't expose internal error details\n        return { valid: false, reason: 'Invalid session' };\n    }\n}\n\n/**\n * Add an article to an existing session\n * SECURITY: Enforces article limit to prevent token bloat\n */\nexport async function addArticleToSession(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<{ token: string; session: SessionData } | null> {\n    // Validate article ID\n    if (!validateArticleId(articleId)) {\n        return null;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return null;\n    }\n\n    const session = validation.session;\n\n    // Already unlocked\n    if (session.unlockedArticles.includes(articleId)) {\n        return { token, session };\n    }\n\n    // SECURITY: Enforce maximum articles per session\n    if (session.unlockedArticles.length >= MAX_ARTICLES_PER_SESSION) {\n        return null;\n    }\n\n    const updatedArticles = [...session.unlockedArticles, articleId];\n\n    const payload: SessionJWTPayload = {\n        sub: session.walletAddress,\n        sid: session.id,\n        articles: updatedArticles,\n        siteWide: session.siteWideUnlock,\n        iat: session.createdAt,\n        exp: session.expiresAt,\n    };\n\n    const newToken = await new SignJWT(payload as unknown as Record<string, unknown>)\n        .setProtectedHeader({ alg: 'HS256' })\n        .sign(getSecretKey(secret));\n\n    return {\n        token: newToken,\n        session: { ...session, unlockedArticles: updatedArticles },\n    };\n}\n\n/**\n * Check if an article is unlocked for a session\n */\nexport async function isArticleUnlocked(\n    token: string,\n    articleId: string,\n    secret: string\n): Promise<boolean> {\n    if (!validateArticleId(articleId)) {\n        return false;\n    }\n\n    const validation = await validateSession(token, secret);\n    if (!validation.valid || !validation.session) {\n        return false;\n    }\n\n    if (validation.session.siteWideUnlock) {\n        return true;\n    }\n\n    return validation.session.unlockedArticles.includes(articleId);\n}\n"]}

package/dist/{session-D2IoWAWV.d.cts → types-BWYQMw03.d.cts}

@@ -29,20 +29,5 @@ interface SessionValidation {
     /** Reason for invalid session */
     reason?: string;
 }
-/** JWT payload structure for sessions */
-interface SessionJWTPayload {
-    /** Wallet address (subject) */
-    sub: string;
-    /** Session ID */
-    sid: string;
-    /** Unlocked article IDs */
-    articles: string[];
-    /** Site-wide unlock flag */
-    siteWide: boolean;
-    /** Issued at timestamp */
-    iat: number;
-    /** Expiration timestamp */
-    exp: number;
-}
 
-export type { SessionData as S, SessionConfig as a, SessionValidation as b, SessionJWTPayload as c };
+export type { SessionConfig as S, SessionData as a, SessionValidation as b };

package/dist/{session-D2IoWAWV.d.ts → types-BWYQMw03.d.ts}

@@ -29,20 +29,5 @@ interface SessionValidation {
     /** Reason for invalid session */
     reason?: string;
 }
-/** JWT payload structure for sessions */
-interface SessionJWTPayload {
-    /** Wallet address (subject) */
-    sub: string;
-    /** Session ID */
-    sid: string;
-    /** Unlocked article IDs */
-    articles: string[];
-    /** Site-wide unlock flag */
-    siteWide: boolean;
-    /** Issued at timestamp */
-    iat: number;
-    /** Expiration timestamp */
-    exp: number;
-}
 
-export type { SessionData as S, SessionConfig as a, SessionValidation as b, SessionJWTPayload as c };
+export type { SessionConfig as S, SessionData as a, SessionValidation as b };

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@alleyboss/micropay-solana-x402-paywall",
-    "version": "2.3.1",
-    "description": "Production-ready Solana micropayments library implementing x402 protocol with SPL token support, RPC fallback, priority fees, and versioned transactions",
+    "version": "3.0.0",
+    "description": "Production-ready Solana micropayments library wrapper for official x402 SDK",
     "author": "AlleyBoss",
     "license": "MIT",
     "repository": {
@@ -14,12 +14,8 @@
         "paywall",
         "micropayments",
         "web3",
-        "crypto",
-        "usdc",
-        "spl-token",
-        "nextjs",
-        "priority-fees",
-        "versioned-transactions"
+        "coinbase",
+        "agent-payments"
     ],
     "type": "module",
     "main": "./dist/index.cjs",
@@ -36,64 +32,34 @@
                 "default": "./dist/index.cjs"
             }
         },
-        "./solana": {
+        "./express": {
             "import": {
-                "types": "./dist/solana/index.d.ts",
-                "default": "./dist/solana/index.js"
+                "types": "./dist/express/index.d.ts",
+                "default": "./dist/express/index.js"
             },
             "require": {
-                "types": "./dist/solana/index.d.cts",
-                "default": "./dist/solana/index.cjs"
+                "types": "./dist/express/index.d.cts",
+                "default": "./dist/express/index.cjs"
             }
         },
-        "./session": {
-            "import": {
-                "types": "./dist/session/index.d.ts",
-                "default": "./dist/session/index.js"
-            },
-            "require": {
-                "types": "./dist/session/index.d.cts",
-                "default": "./dist/session/index.cjs"
-            }
-        },
-        "./x402": {
-            "import": {
-                "types": "./dist/x402/index.d.ts",
-                "default": "./dist/x402/index.js"
-            },
-            "require": {
-                "types": "./dist/x402/index.d.cts",
-                "default": "./dist/x402/index.cjs"
-            }
-        },
-        "./store": {
-            "import": {
-                "types": "./dist/store/index.d.ts",
-                "default": "./dist/store/index.js"
-            },
-            "require": {
-                "types": "./dist/store/index.d.cts",
-                "default": "./dist/store/index.cjs"
-            }
-        },
-        "./middleware": {
+        "./agent": {
             "import": {
-                "types": "./dist/middleware/index.d.ts",
-                "default": "./dist/middleware/index.js"
+                "types": "./dist/agent/index.d.ts",
+                "default": "./dist/agent/index.js"
             },
             "require": {
-                "types": "./dist/middleware/index.d.cts",
-                "default": "./dist/middleware/index.cjs"
+                "types": "./dist/agent/index.d.cts",
+                "default": "./dist/agent/index.cjs"
             }
         },
-        "./utils": {
+        "./pricing": {
             "import": {
-                "types": "./dist/utils/index.d.ts",
-                "default": "./dist/utils/index.js"
+                "types": "./dist/pricing/index.d.ts",
+                "default": "./dist/pricing/index.js"
             },
             "require": {
-                "types": "./dist/utils/index.d.cts",
-                "default": "./dist/utils/index.cjs"
+                "types": "./dist/pricing/index.d.cts",
+                "default": "./dist/pricing/index.cjs"
             }
         },
         "./client": {
@@ -106,24 +72,14 @@
                 "default": "./dist/client/index.cjs"
             }
         },
-        "./pricing": {
-            "import": {
-                "types": "./dist/pricing/index.d.ts",
-                "default": "./dist/pricing/index.js"
-            },
-            "require": {
-                "types": "./dist/pricing/index.d.cts",
-                "default": "./dist/pricing/index.cjs"
-            }
-        },
-        "./agent": {
+        "./session": {
             "import": {
-                "types": "./dist/agent/index.d.ts",
-                "default": "./dist/agent/index.js"
+                "types": "./dist/session/index.d.ts",
+                "default": "./dist/session/index.js"
             },
             "require": {
-                "types": "./dist/agent/index.d.cts",
-                "default": "./dist/agent/index.cjs"
+                "types": "./dist/session/index.d.cts",
+                "default": "./dist/session/index.cjs"
             }
         }
     },
@@ -142,6 +98,8 @@
         "prepublishOnly": "npm run test && npm run build"
     },
     "dependencies": {
+        "@x402/core": "^2.1.0",
+        "@x402/svm": "^2.1.0",
         "jose": "^6.1.3",
         "uuid": "^13.0.0"
     },
@@ -150,8 +108,10 @@
     },
     "devDependencies": {
         "@solana/web3.js": "^1.98.4",
+        "@types/express": "^5.0.6",
         "@types/node": "^20",
         "@types/uuid": "^10.0.0",
+        "express": "^5.2.1",
         "tsup": "^8.0.0",
         "typescript": "^5",
         "vitest": "^3.0.0"
@@ -159,4 +119,4 @@
     "engines": {
         "node": ">=18"
     }
-}
+}

package/dist/client-D-dteoJw.d.cts

@@ -1,63 +0,0 @@
-import { Connection } from '@solana/web3.js';
-import { S as SolanaNetwork } from './payment-BGp7eMQl.cjs';
-
-/** Configuration for Solana client */
-interface SolanaClientConfig {
-    /** Network to connect to */
-    network: SolanaNetwork;
-    /** Custom RPC URL (optional) */
-    rpcUrl?: string;
-    /** Tatum.io API key for RPC (optional) */
-    tatumApiKey?: string;
-    /** Enable RPC fallback on errors (default: false) */
-    enableFallback?: boolean;
-    /** Fallback RPC URLs to try on primary failure (optional) */
-    fallbackRpcUrls?: string[];
-}
-/** RPC connection with fallback support */
-interface RpcConnectionWithFallback {
-    /** Primary connection */
-    connection: Connection;
-    /** Fallback connections (if configured) */
-    fallbacks: Connection[];
-    /** Whether fallback is enabled */
-    fallbackEnabled: boolean;
-}
-/**
- * Get or create a Solana connection
- * Uses singleton pattern with network-aware caching
- */
-declare function getConnection(config: SolanaClientConfig): Connection;
-/**
- * Get connection with fallback support
- * Returns both primary and fallback connections for manual failover
- */
-declare function getConnectionWithFallback(config: SolanaClientConfig): RpcConnectionWithFallback;
-/**
- * Execute an RPC call with automatic fallback on failure
- * Only used when fallback is enabled in config
- *
- * @example
- * ```typescript
- * const balance = await withFallback(
- *   config,
- *   (conn) => conn.getBalance(publicKey)
- * );
- * ```
- */
-declare function withFallback<T>(config: SolanaClientConfig, operation: (connection: Connection) => Promise<T>): Promise<T>;
-/**
- * Reset the cached connection
- * Useful for testing or network switching
- */
-declare function resetConnection(): void;
-/**
- * Check if network is mainnet
- */
-declare function isMainnet(network: SolanaNetwork): boolean;
-/**
- * Convert Solana network to x402 network identifier
- */
-declare function toX402Network(network: SolanaNetwork): 'solana-devnet' | 'solana-mainnet';
-
-export { type RpcConnectionWithFallback as R, type SolanaClientConfig as S, getConnectionWithFallback as a, getConnection as g, isMainnet as i, resetConnection as r, toX402Network as t, withFallback as w };

package/dist/client-DfCIRrNG.d.ts

@@ -1,63 +0,0 @@
-import { Connection } from '@solana/web3.js';
-import { S as SolanaNetwork } from './payment-BGp7eMQl.js';
-
-/** Configuration for Solana client */
-interface SolanaClientConfig {
-    /** Network to connect to */
-    network: SolanaNetwork;
-    /** Custom RPC URL (optional) */
-    rpcUrl?: string;
-    /** Tatum.io API key for RPC (optional) */
-    tatumApiKey?: string;
-    /** Enable RPC fallback on errors (default: false) */
-    enableFallback?: boolean;
-    /** Fallback RPC URLs to try on primary failure (optional) */
-    fallbackRpcUrls?: string[];
-}
-/** RPC connection with fallback support */
-interface RpcConnectionWithFallback {
-    /** Primary connection */
-    connection: Connection;
-    /** Fallback connections (if configured) */
-    fallbacks: Connection[];
-    /** Whether fallback is enabled */
-    fallbackEnabled: boolean;
-}
-/**
- * Get or create a Solana connection
- * Uses singleton pattern with network-aware caching
- */
-declare function getConnection(config: SolanaClientConfig): Connection;
-/**
- * Get connection with fallback support
- * Returns both primary and fallback connections for manual failover
- */
-declare function getConnectionWithFallback(config: SolanaClientConfig): RpcConnectionWithFallback;
-/**
- * Execute an RPC call with automatic fallback on failure
- * Only used when fallback is enabled in config
- *
- * @example
- * ```typescript
- * const balance = await withFallback(
- *   config,
- *   (conn) => conn.getBalance(publicKey)
- * );
- * ```
- */
-declare function withFallback<T>(config: SolanaClientConfig, operation: (connection: Connection) => Promise<T>): Promise<T>;
-/**
- * Reset the cached connection
- * Useful for testing or network switching
- */
-declare function resetConnection(): void;
-/**
- * Check if network is mainnet
- */
-declare function isMainnet(network: SolanaNetwork): boolean;
-/**
- * Convert Solana network to x402 network identifier
- */
-declare function toX402Network(network: SolanaNetwork): 'solana-devnet' | 'solana-mainnet';
-
-export { type RpcConnectionWithFallback as R, type SolanaClientConfig as S, getConnectionWithFallback as a, getConnection as g, isMainnet as i, resetConnection as r, toX402Network as t, withFallback as w };

package/dist/memory-Daxkczti.d.cts

@@ -1,29 +0,0 @@
-/** Signature usage record */
-interface SignatureUsage {
-    signature: string;
-    resourceId: string;
-    usedAt: Date;
-    expiresAt: Date;
-    walletAddress?: string;
-}
-/** Interface for tracking payment signature usage */
-interface SignatureStore {
-    hasBeenUsed(signature: string): Promise<boolean>;
-    markAsUsed(signature: string, resourceId: string, expiresAt: Date): Promise<void>;
-    getUsage?(signature: string): Promise<SignatureUsage | null>;
-}
-interface MemoryStoreOptions {
-    /** Default TTL in seconds */
-    defaultTTL?: number;
-    /** Cleanup interval in ms (default: 60000) */
-    cleanupInterval?: number;
-}
-/**
- * Create an in-memory signature store
- * ⚠️ Not suitable for multi-instance deployments (use Redis instead)
- */
-declare function createMemoryStore(options?: MemoryStoreOptions): SignatureStore & {
-    close: () => void;
-};
-
-export { type MemoryStoreOptions as M, type SignatureStore as S, type SignatureUsage as a, createMemoryStore as c };

package/dist/memory-Daxkczti.d.ts

@@ -1,29 +0,0 @@
-/** Signature usage record */
-interface SignatureUsage {
-    signature: string;
-    resourceId: string;
-    usedAt: Date;
-    expiresAt: Date;
-    walletAddress?: string;
-}
-/** Interface for tracking payment signature usage */
-interface SignatureStore {
-    hasBeenUsed(signature: string): Promise<boolean>;
-    markAsUsed(signature: string, resourceId: string, expiresAt: Date): Promise<void>;
-    getUsage?(signature: string): Promise<SignatureUsage | null>;
-}
-interface MemoryStoreOptions {
-    /** Default TTL in seconds */
-    defaultTTL?: number;
-    /** Cleanup interval in ms (default: 60000) */
-    cleanupInterval?: number;
-}
-/**
- * Create an in-memory signature store
- * ⚠️ Not suitable for multi-instance deployments (use Redis instead)
- */
-declare function createMemoryStore(options?: MemoryStoreOptions): SignatureStore & {
-    close: () => void;
-};
-
-export { type MemoryStoreOptions as M, type SignatureStore as S, type SignatureUsage as a, createMemoryStore as c };