@barcodesdk/session 0.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+Copyright (c) 2026 Vijay Reddy
+
+All rights reserved.
+
+This software is proprietary beta software. Unauthorized copying,
+modification, distribution, or use is prohibited except under a written
+license agreement with the copyright holder.
+
+Third-party notices for bundled dependencies are in NOTICES.md.

package/dist/crypto.d.ts

@@ -0,0 +1,8 @@
+export declare function encodeBase64Url(data: Uint8Array | string): string;
+export declare function decodeBase64Url(value: string): Uint8Array;
+export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+export declare function signHmacSha256(secret: string, data: string): Promise<Uint8Array>;
+export declare function verifyHmacSha256(secret: string, data: string, signature: Uint8Array): Promise<boolean>;
+export declare function decodeJson<T extends Record<string, unknown>>(segment: string): T;
+export declare function encodeJson(value: unknown): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAGA,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAOjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CASzD;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CASvE;AAYD,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,wBAAgB,UAAU,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1D,OAAO,EAAE,MAAM,GACd,CAAC,CAGH;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export type { ClientSessionValidationOptions, MintSessionOptions, ParsedSessionToken, SessionClaims, SessionValidationCode, SessionValidationResult, } from "./types.js";
+export { hasFeatureGrant, mintSessionToken, normalizeClaims, originAllowed, parseSessionToken, verifySessionSignature, } from "./jwt.js";
+export { createSessionNonce, validateClientSession, validateServerSession, } from "./validate.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,8BAA8B,EAC9B,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,242 @@
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function encodeBase64Url(data) {
+  const bytes = typeof data === "string" ? encoder.encode(data) : data;
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function decodeBase64Url(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = normalized.length % 4 === 0 ? "" : "=".repeat(4 - normalized.length % 4);
+  const binary = atob(normalized + padding);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+async function importHmacKey(secret) {
+  return crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function signHmacSha256(secret, data) {
+  const key = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return new Uint8Array(signature);
+}
+async function verifyHmacSha256(secret, data, signature) {
+  const key = await importHmacKey(secret);
+  return crypto.subtle.verify(
+    "HMAC",
+    key,
+    new Uint8Array(signature),
+    encoder.encode(data)
+  );
+}
+function decodeJson(segment) {
+  const bytes = decodeBase64Url(segment);
+  return JSON.parse(decoder.decode(bytes));
+}
+function encodeJson(value) {
+  return encodeBase64Url(JSON.stringify(value));
+}
+const REQUIRED_CLAIMS = [
+  "tenant_id",
+  "allowed_origins",
+  "sdk_major_version",
+  "feature_grants",
+  "exp",
+  "nonce"
+];
+function parseSessionToken(token) {
+  const parts = token.trim().split(".");
+  if (parts.length !== 3) {
+    throw new Error("Session token must contain header, payload, and signature.");
+  }
+  const [encodedHeader, encodedPayload, encodedSignature] = parts;
+  if (!encodedHeader || !encodedPayload || !encodedSignature) {
+    throw new Error("Session token segments are incomplete.");
+  }
+  return {
+    header: decodeJson(encodedHeader),
+    payload: decodeJson(encodedPayload),
+    signature: encodedSignature,
+    signingInput: `${encodedHeader}.${encodedPayload}`
+  };
+}
+function normalizeClaims(payload) {
+  for (const key of REQUIRED_CLAIMS) {
+    if (payload[key] === void 0 || payload[key] === null) {
+      return null;
+    }
+  }
+  if (typeof payload.tenant_id !== "string" || payload.tenant_id.trim() === "") {
+    return null;
+  }
+  if (!Array.isArray(payload.allowed_origins) || payload.allowed_origins.some(
+    (origin) => typeof origin !== "string" || origin.trim() === ""
+  )) {
+    return null;
+  }
+  if (typeof payload.sdk_major_version !== "number" || !Number.isInteger(payload.sdk_major_version) || payload.sdk_major_version < 0) {
+    return null;
+  }
+  if (!Array.isArray(payload.feature_grants) || payload.feature_grants.some(
+    (feature) => typeof feature !== "string" || feature.trim() === ""
+  )) {
+    return null;
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+    return null;
+  }
+  if (typeof payload.nonce !== "string" || payload.nonce.trim() === "") {
+    return null;
+  }
+  const claims = {
+    tenant_id: payload.tenant_id.trim(),
+    allowed_origins: payload.allowed_origins.map(
+      (origin) => typeof origin === "string" ? origin.trim() : ""
+    ),
+    sdk_major_version: payload.sdk_major_version,
+    feature_grants: payload.feature_grants.map(
+      (feature) => typeof feature === "string" ? feature.trim() : ""
+    ),
+    exp: payload.exp,
+    nonce: payload.nonce.trim()
+  };
+  if (typeof payload.iat === "number" && Number.isFinite(payload.iat)) {
+    claims.iat = payload.iat;
+  }
+  return claims;
+}
+async function verifySessionSignature(token, secret) {
+  const parsed = parseSessionToken(token);
+  if (parsed.header.alg !== "HS256") {
+    return false;
+  }
+  const actual = decodeBase64Url(parsed.signature);
+  return verifyHmacSha256(secret, parsed.signingInput, actual);
+}
+async function mintSessionToken(claims, secret, options = {}) {
+  const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const ttlSeconds = options.ttlSeconds ?? 3600;
+  const payload = {
+    tenant_id: claims.tenant_id,
+    allowed_origins: claims.allowed_origins,
+    sdk_major_version: claims.sdk_major_version,
+    feature_grants: claims.feature_grants,
+    nonce: claims.nonce,
+    iat: claims.iat ?? nowSeconds,
+    exp: claims.exp ?? nowSeconds + ttlSeconds
+  };
+  const header = { alg: "HS256", typ: "JWT" };
+  const encodedHeader = encodeJson(header);
+  const encodedPayload = encodeJson(payload);
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = await signHmacSha256(secret, signingInput);
+  const encodedSignature = encodeBase64Url(signature);
+  return `${signingInput}.${encodedSignature}`;
+}
+function originAllowed(origin, allowedOrigins) {
+  const normalized = origin.trim().toLowerCase();
+  return allowedOrigins.some((allowed) => allowed.trim().toLowerCase() === normalized);
+}
+function hasFeatureGrant(claims, feature) {
+  return claims.feature_grants.includes(feature);
+}
+function validateClientSession(token, options = {}) {
+  let parsed;
+  try {
+    parsed = parseSessionToken(token);
+  } catch (error) {
+    return {
+      valid: false,
+      code: "MALFORMED",
+      message: error instanceof Error ? error.message : "Session token is malformed."
+    };
+  }
+  const claims = normalizeClaims(parsed.payload);
+  if (!claims) {
+    return {
+      valid: false,
+      code: "MISSING_CLAIMS",
+      message: "Session token is missing required claims."
+    };
+  }
+  const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const skew = options.clockSkewSeconds ?? 30;
+  if (claims.exp + skew < nowSeconds) {
+    return {
+      valid: false,
+      code: "EXPIRED",
+      message: "Session token has expired.",
+      claims
+    };
+  }
+  if (options.origin) {
+    if (!originAllowed(options.origin, claims.allowed_origins)) {
+      return {
+        valid: false,
+        code: "ORIGIN_MISMATCH",
+        message: "Session token is not valid for this origin.",
+        claims
+      };
+    }
+  }
+  if (options.sdkMajorVersion !== void 0 && claims.sdk_major_version !== options.sdkMajorVersion) {
+    return {
+      valid: false,
+      code: "SDK_MAJOR_MISMATCH",
+      message: "Session token is not valid for this SDK major version.",
+      claims
+    };
+  }
+  return {
+    valid: true,
+    code: "VALID",
+    message: "Session token structure is valid.",
+    claims
+  };
+}
+async function validateServerSession(token, secret, options = {}) {
+  const clientResult = validateClientSession(token, options);
+  if (!clientResult.valid) {
+    return clientResult;
+  }
+  const signatureValid = await verifySessionSignature(token, secret);
+  if (!signatureValid) {
+    return {
+      valid: false,
+      code: "SIGNATURE_INVALID",
+      message: "Session token signature is invalid.",
+      claims: clientResult.claims
+    };
+  }
+  return clientResult;
+}
+function createSessionNonce() {
+  if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
+    return crypto.randomUUID();
+  }
+  return `nonce-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+}
+export {
+  createSessionNonce,
+  hasFeatureGrant,
+  mintSessionToken,
+  normalizeClaims,
+  originAllowed,
+  parseSessionToken,
+  validateClientSession,
+  validateServerSession,
+  verifySessionSignature
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/crypto.ts","../src/jwt.ts","../src/validate.ts"],"sourcesContent":["const encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport function encodeBase64Url(data: Uint8Array | string): string {\n  const bytes = typeof data === \"string\" ? encoder.encode(data) : data;\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nexport function decodeBase64Url(value: string): Uint8Array {\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const padding = normalized.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (normalized.length % 4));\n  const binary = atob(normalized + padding);\n  const bytes = new Uint8Array(binary.length);\n  for (let index = 0; index < binary.length; index += 1) {\n    bytes[index] = binary.charCodeAt(index);\n  }\n  return bytes;\n}\n\nexport function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let diff = 0;\n  for (let index = 0; index < a.length; index += 1) {\n    diff |= a[index]! ^ b[index]!;\n  }\n  return diff === 0;\n}\n\nasync function importHmacKey(secret: string): Promise<CryptoKey> {\n  return crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\", \"verify\"],\n  );\n}\n\nexport async function signHmacSha256(\n  secret: string,\n  data: string,\n): Promise<Uint8Array> {\n  const key = await importHmacKey(secret);\n  const signature = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(data));\n  return new Uint8Array(signature);\n}\n\nexport async function verifyHmacSha256(\n  secret: string,\n  data: string,\n  signature: Uint8Array,\n): Promise<boolean> {\n  const key = await importHmacKey(secret);\n  return crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    new Uint8Array(signature),\n    encoder.encode(data),\n  );\n}\n\nexport function decodeJson<T extends Record<string, unknown>>(\n  segment: string,\n): T {\n  const bytes = decodeBase64Url(segment);\n  return JSON.parse(decoder.decode(bytes)) as T;\n}\n\nexport function encodeJson(value: unknown): string {\n  return encodeBase64Url(JSON.stringify(value));\n}\n","import {\n  decodeBase64Url,\n  decodeJson,\n  encodeBase64Url,\n  encodeJson,\n  signHmacSha256,\n  verifyHmacSha256,\n} from \"./crypto.js\";\nimport type { ParsedSessionToken, SessionClaims } from \"./types.js\";\n\nconst REQUIRED_CLAIMS: Array<keyof SessionClaims> = [\n  \"tenant_id\",\n  \"allowed_origins\",\n  \"sdk_major_version\",\n  \"feature_grants\",\n  \"exp\",\n  \"nonce\",\n];\n\nexport function parseSessionToken(token: string): ParsedSessionToken {\n  const parts = token.trim().split(\".\");\n  if (parts.length !== 3) {\n    throw new Error(\"Session token must contain header, payload, and signature.\");\n  }\n\n  const [encodedHeader, encodedPayload, encodedSignature] = parts;\n  if (!encodedHeader || !encodedPayload || !encodedSignature) {\n    throw new Error(\"Session token segments are incomplete.\");\n  }\n\n  return {\n    header: decodeJson<Record<string, unknown>>(encodedHeader),\n    payload: decodeJson<Record<string, unknown>>(encodedPayload),\n    signature: encodedSignature,\n    signingInput: `${encodedHeader}.${encodedPayload}`,\n  };\n}\n\nexport function normalizeClaims(payload: Record<string, unknown>): SessionClaims | null {\n  for (const key of REQUIRED_CLAIMS) {\n    if (payload[key] === undefined || payload[key] === null) {\n      return null;\n    }\n  }\n\n  if (typeof payload.tenant_id !== \"string\" || payload.tenant_id.trim() === \"\") {\n    return null;\n  }\n\n  if (\n    !Array.isArray(payload.allowed_origins) ||\n    payload.allowed_origins.some(\n      (origin) => typeof origin !== \"string\" || origin.trim() === \"\",\n    )\n  ) {\n    return null;\n  }\n\n  if (\n    typeof payload.sdk_major_version !== \"number\" ||\n    !Number.isInteger(payload.sdk_major_version) ||\n    payload.sdk_major_version < 0\n  ) {\n    return null;\n  }\n\n  if (\n    !Array.isArray(payload.feature_grants) ||\n    payload.feature_grants.some(\n      (feature) => typeof feature !== \"string\" || feature.trim() === \"\",\n    )\n  ) {\n    return null;\n  }\n\n  if (typeof payload.exp !== \"number\" || !Number.isFinite(payload.exp)) {\n    return null;\n  }\n\n  if (typeof payload.nonce !== \"string\" || payload.nonce.trim() === \"\") {\n    return null;\n  }\n\n  const claims: SessionClaims = {\n    tenant_id: payload.tenant_id.trim(),\n    allowed_origins: payload.allowed_origins.map((origin) =>\n      typeof origin === \"string\" ? origin.trim() : \"\",\n    ),\n    sdk_major_version: payload.sdk_major_version,\n    feature_grants: payload.feature_grants.map((feature) =>\n      typeof feature === \"string\" ? feature.trim() : \"\",\n    ),\n    exp: payload.exp,\n    nonce: payload.nonce.trim(),\n  };\n\n  if (typeof payload.iat === \"number\" && Number.isFinite(payload.iat)) {\n    claims.iat = payload.iat;\n  }\n\n  return claims;\n}\n\nexport async function verifySessionSignature(\n  token: string,\n  secret: string,\n): Promise<boolean> {\n  const parsed = parseSessionToken(token);\n  if (parsed.header.alg !== \"HS256\") {\n    return false;\n  }\n  const actual = decodeBase64Url(parsed.signature);\n  return verifyHmacSha256(secret, parsed.signingInput, actual);\n}\n\nexport async function mintSessionToken(\n  claims: Omit<SessionClaims, \"exp\" | \"iat\"> & { exp?: number; iat?: number },\n  secret: string,\n  options: { ttlSeconds?: number; nowSeconds?: number } = {},\n): Promise<string> {\n  const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const ttlSeconds = options.ttlSeconds ?? 3600;\n  const payload: SessionClaims = {\n    tenant_id: claims.tenant_id,\n    allowed_origins: claims.allowed_origins,\n    sdk_major_version: claims.sdk_major_version,\n    feature_grants: claims.feature_grants,\n    nonce: claims.nonce,\n    iat: claims.iat ?? nowSeconds,\n    exp: claims.exp ?? nowSeconds + ttlSeconds,\n  };\n\n  const header = { alg: \"HS256\", typ: \"JWT\" };\n  const encodedHeader = encodeJson(header);\n  const encodedPayload = encodeJson(payload);\n  const signingInput = `${encodedHeader}.${encodedPayload}`;\n  const signature = await signHmacSha256(secret, signingInput);\n  const encodedSignature = encodeBase64Url(signature);\n  return `${signingInput}.${encodedSignature}`;\n}\n\nexport function originAllowed(origin: string, allowedOrigins: string[]): boolean {\n  const normalized = origin.trim().toLowerCase();\n  return allowedOrigins.some((allowed) => allowed.trim().toLowerCase() === normalized);\n}\n\nexport function hasFeatureGrant(\n  claims: SessionClaims,\n  feature: string,\n): boolean {\n  return claims.feature_grants.includes(feature);\n}\n","import {\n  normalizeClaims,\n  originAllowed,\n  parseSessionToken,\n  verifySessionSignature,\n} from \"./jwt.js\";\nimport type {\n  ClientSessionValidationOptions,\n  SessionValidationResult,\n} from \"./types.js\";\n\n/**\n * Client-side session validation for UX gating only (NFR-005).\n * Signature verification requires the server secret and is not performed here.\n */\nexport function validateClientSession(\n  token: string,\n  options: ClientSessionValidationOptions = {},\n): SessionValidationResult {\n  let parsed;\n  try {\n    parsed = parseSessionToken(token);\n  } catch (error) {\n    return {\n      valid: false,\n      code: \"MALFORMED\",\n      message:\n        error instanceof Error ? error.message : \"Session token is malformed.\",\n    };\n  }\n\n  const claims = normalizeClaims(parsed.payload);\n  if (!claims) {\n    return {\n      valid: false,\n      code: \"MISSING_CLAIMS\",\n      message: \"Session token is missing required claims.\",\n    };\n  }\n\n  const nowSeconds =\n    options.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const skew = options.clockSkewSeconds ?? 30;\n  if (claims.exp + skew < nowSeconds) {\n    return {\n      valid: false,\n      code: \"EXPIRED\",\n      message: \"Session token has expired.\",\n      claims,\n    };\n  }\n\n  if (options.origin) {\n    if (!originAllowed(options.origin, claims.allowed_origins)) {\n      return {\n        valid: false,\n        code: \"ORIGIN_MISMATCH\",\n        message: \"Session token is not valid for this origin.\",\n        claims,\n      };\n    }\n  }\n\n  if (\n    options.sdkMajorVersion !== undefined &&\n    claims.sdk_major_version !== options.sdkMajorVersion\n  ) {\n    return {\n      valid: false,\n      code: \"SDK_MAJOR_MISMATCH\",\n      message: \"Session token is not valid for this SDK major version.\",\n      claims,\n    };\n  }\n\n  return {\n    valid: true,\n    code: \"VALID\",\n    message: \"Session token structure is valid.\",\n    claims,\n  };\n}\n\n/** Server-side validation including HMAC signature. */\nexport async function validateServerSession(\n  token: string,\n  secret: string,\n  options: ClientSessionValidationOptions = {},\n): Promise<SessionValidationResult> {\n  const clientResult = validateClientSession(token, options);\n  if (!clientResult.valid) {\n    return clientResult;\n  }\n\n  const signatureValid = await verifySessionSignature(token, secret);\n  if (!signatureValid) {\n    return {\n      valid: false,\n      code: \"SIGNATURE_INVALID\",\n      message: \"Session token signature is invalid.\",\n      claims: clientResult.claims,\n    };\n  }\n\n  return clientResult;\n}\n\nexport function createSessionNonce(): string {\n  if (typeof crypto !== \"undefined\" && \"randomUUID\" in crypto) {\n    return crypto.randomUUID();\n  }\n  return `nonce-${Date.now()}-${Math.random().toString(36).slice(2)}`;\n}\n"],"names":[],"mappings":"AAAA,MAAM,UAAU,IAAI,YAAA;AACpB,MAAM,UAAU,IAAI,YAAA;AAEb,SAAS,gBAAgB,MAAmC;AACjE,QAAM,QAAQ,OAAO,SAAS,WAAW,QAAQ,OAAO,IAAI,IAAI;AAChE,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAChF;AAEO,SAAS,gBAAgB,OAA2B;AACzD,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,UAAU,WAAW,SAAS,MAAM,IAAI,KAAK,IAAI,OAAO,IAAK,WAAW,SAAS,CAAE;AACzF,QAAM,SAAS,KAAK,aAAa,OAAO;AACxC,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACrD,UAAM,KAAK,IAAI,OAAO,WAAW,KAAK;AAAA,EACxC;AACA,SAAO;AACT;AAaA,eAAe,cAAc,QAAoC;AAC/D,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAA;AAAA,IACtB;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EAAA;AAErB;AAEA,eAAsB,eACpB,QACA,MACqB;AACrB,QAAM,MAAM,MAAM,cAAc,MAAM;AACtC,QAAM,YAAY,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,IAAI,CAAC;AAC5E,SAAO,IAAI,WAAW,SAAS;AACjC;AAEA,eAAsB,iBACpB,QACA,MACA,WACkB;AAClB,QAAM,MAAM,MAAM,cAAc,MAAM;AACtC,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA,IAAI,WAAW,SAAS;AAAA,IACxB,QAAQ,OAAO,IAAI;AAAA,EAAA;AAEvB;AAEO,SAAS,WACd,SACG;AACH,QAAM,QAAQ,gBAAgB,OAAO;AACrC,SAAO,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AACzC;AAEO,SAAS,WAAW,OAAwB;AACjD,SAAO,gBAAgB,KAAK,UAAU,KAAK,CAAC;AAC9C;AClEA,MAAM,kBAA8C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,kBAAkB,OAAmC;AACnE,QAAM,QAAQ,MAAM,KAAA,EAAO,MAAM,GAAG;AACpC,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,CAAC,eAAe,gBAAgB,gBAAgB,IAAI;AAC1D,MAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,kBAAkB;AAC1D,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,SAAO;AAAA,IACL,QAAQ,WAAoC,aAAa;AAAA,IACzD,SAAS,WAAoC,cAAc;AAAA,IAC3D,WAAW;AAAA,IACX,cAAc,GAAG,aAAa,IAAI,cAAc;AAAA,EAAA;AAEpD;AAEO,SAAS,gBAAgB,SAAwD;AACtF,aAAW,OAAO,iBAAiB;AACjC,QAAI,QAAQ,GAAG,MAAM,UAAa,QAAQ,GAAG,MAAM,MAAM;AACvD,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAA,MAAW,IAAI;AAC5E,WAAO;AAAA,EACT;AAEA,MACE,CAAC,MAAM,QAAQ,QAAQ,eAAe,KACtC,QAAQ,gBAAgB;AAAA,IACtB,CAAC,WAAW,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EAAA,GAE9D;AACA,WAAO;AAAA,EACT;AAEA,MACE,OAAO,QAAQ,sBAAsB,YACrC,CAAC,OAAO,UAAU,QAAQ,iBAAiB,KAC3C,QAAQ,oBAAoB,GAC5B;AACA,WAAO;AAAA,EACT;AAEA,MACE,CAAC,MAAM,QAAQ,QAAQ,cAAc,KACrC,QAAQ,eAAe;AAAA,IACrB,CAAC,YAAY,OAAO,YAAY,YAAY,QAAQ,WAAW;AAAA,EAAA,GAEjE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,OAAO,SAAS,QAAQ,GAAG,GAAG;AACpE,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAA,MAAW,IAAI;AACpE,WAAO;AAAA,EACT;AAEA,QAAM,SAAwB;AAAA,IAC5B,WAAW,QAAQ,UAAU,KAAA;AAAA,IAC7B,iBAAiB,QAAQ,gBAAgB;AAAA,MAAI,CAAC,WAC5C,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,IAAA;AAAA,IAE/C,mBAAmB,QAAQ;AAAA,IAC3B,gBAAgB,QAAQ,eAAe;AAAA,MAAI,CAAC,YAC1C,OAAO,YAAY,WAAW,QAAQ,SAAS;AAAA,IAAA;AAAA,IAEjD,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ,MAAM,KAAA;AAAA,EAAK;AAG5B,MAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,SAAS,QAAQ,GAAG,GAAG;AACnE,WAAO,MAAM,QAAQ;AAAA,EACvB;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,QACkB;AAClB,QAAM,SAAS,kBAAkB,KAAK;AACtC,MAAI,OAAO,OAAO,QAAQ,SAAS;AACjC,WAAO;AAAA,EACT;AACA,QAAM,SAAS,gBAAgB,OAAO,SAAS;AAC/C,SAAO,iBAAiB,QAAQ,OAAO,cAAc,MAAM;AAC7D;AAEA,eAAsB,iBACpB,QACA,QACA,UAAwD,CAAA,GACvC;AACjB,QAAM,aAAa,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI;AACrE,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,UAAyB;AAAA,IAC7B,WAAW,OAAO;AAAA,IAClB,iBAAiB,OAAO;AAAA,IACxB,mBAAmB,OAAO;AAAA,IAC1B,gBAAgB,OAAO;AAAA,IACvB,OAAO,OAAO;AAAA,IACd,KAAK,OAAO,OAAO;AAAA,IACnB,KAAK,OAAO,OAAO,aAAa;AAAA,EAAA;AAGlC,QAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAA;AACpC,QAAM,gBAAgB,WAAW,MAAM;AACvC,QAAM,iBAAiB,WAAW,OAAO;AACzC,QAAM,eAAe,GAAG,aAAa,IAAI,cAAc;AACvD,QAAM,YAAY,MAAM,eAAe,QAAQ,YAAY;AAC3D,QAAM,mBAAmB,gBAAgB,SAAS;AAClD,SAAO,GAAG,YAAY,IAAI,gBAAgB;AAC5C;AAEO,SAAS,cAAc,QAAgB,gBAAmC;AAC/E,QAAM,aAAa,OAAO,KAAA,EAAO,YAAA;AACjC,SAAO,eAAe,KAAK,CAAC,YAAY,QAAQ,KAAA,EAAO,YAAA,MAAkB,UAAU;AACrF;AAEO,SAAS,gBACd,QACA,SACS;AACT,SAAO,OAAO,eAAe,SAAS,OAAO;AAC/C;ACxIO,SAAS,sBACd,OACA,UAA0C,IACjB;AACzB,MAAI;AACJ,MAAI;AACF,aAAS,kBAAkB,KAAK;AAAA,EAClC,SAAS,OAAO;AACd,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SACE,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAAA;AAAA,EAE/C;AAEA,QAAM,SAAS,gBAAgB,OAAO,OAAO;AAC7C,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,IAAA;AAAA,EAEb;AAEA,QAAM,aACJ,QAAQ,cAAc,KAAK,MAAM,KAAK,IAAA,IAAQ,GAAI;AACpD,QAAM,OAAO,QAAQ,oBAAoB;AACzC,MAAI,OAAO,MAAM,OAAO,YAAY;AAClC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,MACT;AAAA,IAAA;AAAA,EAEJ;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,CAAC,cAAc,QAAQ,QAAQ,OAAO,eAAe,GAAG;AAC1D,aAAO;AAAA,QACL,OAAO;AAAA,QACP,MAAM;AAAA,QACN,SAAS;AAAA,QACT;AAAA,MAAA;AAAA,IAEJ;AAAA,EACF;AAEA,MACE,QAAQ,oBAAoB,UAC5B,OAAO,sBAAsB,QAAQ,iBACrC;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,MACT;AAAA,IAAA;AAAA,EAEJ;AAEA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS;AAAA,IACT;AAAA,EAAA;AAEJ;AAGA,eAAsB,sBACpB,OACA,QACA,UAA0C,CAAA,GACR;AAClC,QAAM,eAAe,sBAAsB,OAAO,OAAO;AACzD,MAAI,CAAC,aAAa,OAAO;AACvB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,MAAM,uBAAuB,OAAO,MAAM;AACjE,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,MACN,SAAS;AAAA,MACT,QAAQ,aAAa;AAAA,IAAA;AAAA,EAEzB;AAEA,SAAO;AACT;AAEO,SAAS,qBAA6B;AAC3C,MAAI,OAAO,WAAW,eAAe,gBAAgB,QAAQ;AAC3D,WAAO,OAAO,WAAA;AAAA,EAChB;AACA,SAAO,SAAS,KAAK,IAAA,CAAK,IAAI,KAAK,OAAA,EAAS,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACnE;"}

package/dist/jwt.d.ts

@@ -0,0 +1,14 @@
+import type { ParsedSessionToken, SessionClaims } from "./types.js";
+export declare function parseSessionToken(token: string): ParsedSessionToken;
+export declare function normalizeClaims(payload: Record<string, unknown>): SessionClaims | null;
+export declare function verifySessionSignature(token: string, secret: string): Promise<boolean>;
+export declare function mintSessionToken(claims: Omit<SessionClaims, "exp" | "iat"> & {
+    exp?: number;
+    iat?: number;
+}, secret: string, options?: {
+    ttlSeconds?: number;
+    nowSeconds?: number;
+}): Promise<string>;
+export declare function originAllowed(origin: string, allowedOrigins: string[]): boolean;
+export declare function hasFeatureGrant(claims: SessionClaims, feature: string): boolean;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAiBnE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,GAAG,IAAI,CA+DtF;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3E,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAET"}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+/** Claims embedded in a signed session JWT (FR-024). */
+export interface SessionClaims {
+    tenant_id: string;
+    allowed_origins: string[];
+    sdk_major_version: number;
+    feature_grants: string[];
+    /** Unix seconds. */
+    exp: number;
+    /** Replay resistance — unique per mint. */
+    nonce: string;
+    /** Unix seconds. */
+    iat?: number;
+}
+export type SessionValidationCode = "VALID" | "MALFORMED" | "MISSING_CLAIMS" | "EXPIRED" | "ORIGIN_MISMATCH" | "SDK_MAJOR_MISMATCH" | "SIGNATURE_INVALID";
+export interface SessionValidationResult {
+    valid: boolean;
+    code: SessionValidationCode;
+    message: string;
+    claims?: SessionClaims;
+}
+export interface ClientSessionValidationOptions {
+    /** Current page origin, e.g. https://app.example.com */
+    origin?: string | null;
+    /** SDK major version compiled into the host app. */
+    sdkMajorVersion?: number;
+    /** Clock skew tolerance in seconds (default 30). */
+    clockSkewSeconds?: number;
+    /** Unix seconds override for tests. */
+    nowSeconds?: number;
+}
+export interface MintSessionOptions {
+    /** TTL from now in seconds (default 3600). */
+    ttlSeconds?: number;
+    /** Unix seconds override for tests. */
+    nowSeconds?: number;
+}
+export interface ParsedSessionToken {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    signature: string;
+    signingInput: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,qBAAqB,GAC7B,OAAO,GACP,WAAW,GACX,gBAAgB,GAChB,SAAS,GACT,iBAAiB,GACjB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/dist/validate.d.ts

@@ -0,0 +1,10 @@
+import type { ClientSessionValidationOptions, SessionValidationResult } from "./types.js";
+/**
+ * Client-side session validation for UX gating only (NFR-005).
+ * Signature verification requires the server secret and is not performed here.
+ */
+export declare function validateClientSession(token: string, options?: ClientSessionValidationOptions): SessionValidationResult;
+/** Server-side validation including HMAC signature. */
+export declare function validateServerSession(token: string, secret: string, options?: ClientSessionValidationOptions): Promise<SessionValidationResult>;
+export declare function createSessionNonce(): string;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,8BAA8B,EAC9B,uBAAuB,EACxB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,8BAAmC,GAC3C,uBAAuB,CA+DzB;AAED,uDAAuD;AACvD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,8BAAmC,GAC3C,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@barcodesdk/session",
+  "version": "0.1.0",
+  "description": "Signed session tokens for Barcode WebSDK commercial distribution",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Vijay Reddy",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vjiayreddy/barcodesdk.git",
+    "directory": "packages/session"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5",
+    "vite": "^6",
+    "vitest": "^3"
+  },
+  "scripts": {
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}