@c9up/ream 0.1.3

package/dist/services/server.js

@@ -0,0 +1,32 @@
+/**
+ * Server singleton service — proxy to the Ignitor's Server instance.
+ *
+ * Usage in start/kernel.ts:
+ *   import server from '@c9up/ream/services/server'
+ *   server.errorHandler(() => import('#exceptions/handler'))
+ *   server.use([() => import('#middleware/logging')])
+ */
+let instance;
+/** @internal Set the server instance (called by Ignitor). */
+export function setServer(server) {
+    instance = server;
+}
+/** @internal Get the server instance directly. */
+export function getServer() {
+    return instance;
+}
+const server = new Proxy({}, {
+    get(_target, prop) {
+        if (!instance) {
+            throw new Error('Server accessed before initialization. ' +
+                'Ensure your kernel files are loaded as preloads in reamrc.ts.');
+        }
+        // Bind methods to the real instance so private-field access inside
+        // them resolves against the underlying class brand — passing the
+        // Proxy as `this` breaks `#field` writes (Proxy isn't branded).
+        const value = Reflect.get(instance, prop, instance);
+        return typeof value === 'function' ? value.bind(instance) : value;
+    },
+});
+export default server;
+//# sourceMappingURL=server.js.map

package/dist/services/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/services/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,IAAI,QAA4B,CAAA;AAEhC,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,QAAQ,GAAG,MAAM,CAAA;AACnB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,MAAM,GAAW,IAAI,KAAK,CAAC,EAAY,EAAE;IAC7C,GAAG,CAAC,OAAO,EAAE,IAAI;QACf,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,yCAAyC;gBACvC,+DAA+D,CAClE,CAAA;QACH,CAAC;QACD,mEAAmE;QACnE,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;QACnD,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACnE,CAAC;CACF,CAAC,CAAA;AAEF,eAAe,MAAM,CAAA"}

package/dist/session/Session.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Session — server-side session management.
+ *
+ * Like AdonisJS Session:
+ *   session.get('key')
+ *   session.put('key', value)
+ *   session.flash('success', 'Saved!')
+ *   session.forget('key')
+ *
+ * Backed by pluggable drivers (cookie, memory, redis).
+ */
+export interface SessionDriver {
+    read(sessionId: string): Promise<Record<string, unknown>>;
+    write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>;
+    destroy(sessionId: string): Promise<void>;
+    touch(sessionId: string, ttl: number): Promise<void>;
+}
+export interface SessionConfig {
+    driver: string;
+    cookieName?: string;
+    maxAge?: number;
+    clearWithBrowser?: boolean;
+    /**
+     * When true, re-emit Set-Cookie on every response so the cookie's `maxAge`
+     * window slides forward on each request. Active users won't be logged out
+     * mid-session; the trade-off is a `Vary: Cookie` side-channel on every
+     * response (defeats shared HTTP caches). Default `false` to preserve cache
+     * behaviour. Express-session and AdonisJS expose the same toggle.
+     */
+    rolling?: boolean;
+}
+export declare class Session {
+    #private;
+    constructor(sessionId: string, data?: Record<string, unknown>);
+    /** Current session id. Mutated by `regenerate()`. */
+    get sessionId(): string;
+    /**
+     * Rotate the session id while preserving the data. The standard mitigation
+     * for session-fixation (CWE-384): call this whenever a privilege boundary
+     * is crossed — login, role change, sensitive-action confirmation. Warden's
+     * `SessionStrategy.login()` calls it automatically before writing the
+     * authenticated user id.
+     *
+     * The new id takes effect inside this Session instance immediately so
+     * subsequent `session.get()` / `session.put()` see the same data under
+     * the new id. The SessionMiddleware sees `wasRegenerated() === true` on
+     * the way out and migrates the driver storage + emits a new Set-Cookie.
+     */
+    regenerate(): void;
+    /** @internal — read by SessionMiddleware to detect a mid-request rotation. */
+    wasRegenerated(): boolean;
+    /** @internal — the id captured at request arrival; used to destroy the old driver entry post-regenerate. */
+    originalSessionId(): string;
+    /** Get a session value. */
+    get<T = unknown>(key: string, defaultValue?: T): T;
+    /** Set a session value. */
+    put(key: string, value: unknown): void;
+    /** Check if a key exists. */
+    has(key: string): boolean;
+    /** Get all session data. */
+    all(): Record<string, unknown>;
+    /** Remove a key. */
+    forget(key: string): void;
+    /** Get and remove a key. */
+    pull<T = unknown>(key: string, defaultValue?: T): T;
+    /** Clear all session data. */
+    clear(): void;
+    /** Increment a numeric value. */
+    increment(key: string, amount?: number): void;
+    /** Decrement a numeric value. */
+    decrement(key: string, amount?: number): void;
+    /** Set flash data (available only on the next request). */
+    flash(key: string, value: unknown): void;
+    /** Flash all current input. */
+    flashAll(input: Record<string, unknown>): void;
+    /** Flash only specific keys. */
+    flashOnly(input: Record<string, unknown>, keys: string[]): void;
+    /** Flash all except specific keys. */
+    flashExcept(input: Record<string, unknown>, keys: string[]): void;
+    /** Get a flashed value from the previous request. */
+    flashMessages(): Record<string, unknown>;
+    /** Get a specific flash message from the previous request. */
+    old<T = unknown>(key: string, defaultValue?: T): T;
+    /** Serialize for storage. Includes flash data for next request. */
+    toJSON(): Record<string, unknown>;
+    isDirty(): boolean;
+}
+//# sourceMappingURL=Session.d.ts.map

package/dist/session/Session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/session/Session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACrD;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAmBD,qBAAa,OAAO;;gBAeN,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAajE,qDAAqD;IACrD,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;;;;;OAWG;IACH,UAAU,IAAI,IAAI;IAMlB,8EAA8E;IAC9E,cAAc,IAAI,OAAO;IAIzB,4GAA4G;IAC5G,iBAAiB,IAAI,MAAM;IAI3B,2BAA2B;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IASlD,2BAA2B;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAKtC,6BAA6B;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,4BAA4B;IAC5B,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI9B,oBAAoB;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKzB,4BAA4B;IAC5B,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAMnD,8BAA8B;IAC9B,KAAK,IAAI,IAAI;IAKb,iCAAiC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,IAAI;IAKxC,iCAAiC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,IAAI;IAMxC,2DAA2D;IAC3D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAKxC,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAO9C,gCAAgC;IAChC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI;IAO/D,sCAAsC;IACtC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI;IAQjE,qDAAqD;IACrD,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAIxC,8DAA8D;IAC9D,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC;IAWlD,mEAAmE;IACnE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAQjC,OAAO,IAAI,OAAO;CAGnB"}

package/dist/session/Session.js

@@ -0,0 +1,186 @@
+/**
+ * Session — server-side session management.
+ *
+ * Like AdonisJS Session:
+ *   session.get('key')
+ *   session.put('key', value)
+ *   session.flash('success', 'Saved!')
+ *   session.forget('key')
+ *
+ * Backed by pluggable drivers (cookie, memory, redis).
+ */
+/**
+ * Generate a fresh session ID. Format mirrors AdonisJS / express-session —
+ * 32 bytes of base64url entropy (~256 bits). Defined here so `regenerate()`
+ * can pick a new id without bringing in a driver dependency.
+ */
+function generateSessionId() {
+    const bytes = new Uint8Array(32);
+    // `crypto.getRandomValues` is a Node ≥ 19 builtin AND the standard browser
+    // API; same call site works on both runtimes without a polyfill.
+    crypto.getRandomValues(bytes);
+    let str = '';
+    for (let i = 0; i < bytes.length; i++) {
+        str += String.fromCharCode(bytes[i] ?? 0);
+    }
+    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+export class Session {
+    #data = {};
+    #flashData = {};
+    #previousFlash = {};
+    #dirty = false;
+    #sessionId;
+    /**
+     * The session id active when the request arrived, captured at construction.
+     * The middleware uses this on the way out to migrate driver storage
+     * (`driver.write(newId)` + `driver.destroy(oldId)`) when the application
+     * called `regenerate()` mid-request.
+     */
+    #originalSessionId;
+    #regenerated = false;
+    constructor(sessionId, data = {}) {
+        this.#sessionId = sessionId;
+        this.#originalSessionId = sessionId;
+        this.#data = { ...data };
+        const flash = data.__flash;
+        this.#previousFlash =
+            typeof flash === 'object' && flash !== null && !Array.isArray(flash)
+                ? // biome-ignore lint/suspicious/noExplicitAny: flash narrowed to non-null non-array object; branded as Record for key access
+                    flash
+                : {};
+        delete this.#data.__flash;
+    }
+    /** Current session id. Mutated by `regenerate()`. */
+    get sessionId() {
+        return this.#sessionId;
+    }
+    /**
+     * Rotate the session id while preserving the data. The standard mitigation
+     * for session-fixation (CWE-384): call this whenever a privilege boundary
+     * is crossed — login, role change, sensitive-action confirmation. Warden's
+     * `SessionStrategy.login()` calls it automatically before writing the
+     * authenticated user id.
+     *
+     * The new id takes effect inside this Session instance immediately so
+     * subsequent `session.get()` / `session.put()` see the same data under
+     * the new id. The SessionMiddleware sees `wasRegenerated() === true` on
+     * the way out and migrates the driver storage + emits a new Set-Cookie.
+     */
+    regenerate() {
+        this.#sessionId = generateSessionId();
+        this.#regenerated = true;
+        this.#dirty = true;
+    }
+    /** @internal — read by SessionMiddleware to detect a mid-request rotation. */
+    wasRegenerated() {
+        return this.#regenerated;
+    }
+    /** @internal — the id captured at request arrival; used to destroy the old driver entry post-regenerate. */
+    originalSessionId() {
+        return this.#originalSessionId;
+    }
+    /** Get a session value. */
+    get(key, defaultValue) {
+        if (key in this.#data) {
+            // biome-ignore lint/suspicious/noExplicitAny: session data stored as unknown; caller brands the value type via T
+            return this.#data[key];
+        }
+        // biome-ignore lint/suspicious/noExplicitAny: generic default — caller brands the value type via T
+        return defaultValue;
+    }
+    /** Set a session value. */
+    put(key, value) {
+        this.#data[key] = value;
+        this.#dirty = true;
+    }
+    /** Check if a key exists. */
+    has(key) {
+        return key in this.#data;
+    }
+    /** Get all session data. */
+    all() {
+        return { ...this.#data };
+    }
+    /** Remove a key. */
+    forget(key) {
+        delete this.#data[key];
+        this.#dirty = true;
+    }
+    /** Get and remove a key. */
+    pull(key, defaultValue) {
+        const value = this.get(key, defaultValue);
+        this.forget(key);
+        return value;
+    }
+    /** Clear all session data. */
+    clear() {
+        this.#data = {};
+        this.#dirty = true;
+    }
+    /** Increment a numeric value. */
+    increment(key, amount = 1) {
+        const current = this.get(key) ?? 0;
+        this.put(key, current + amount);
+    }
+    /** Decrement a numeric value. */
+    decrement(key, amount = 1) {
+        this.increment(key, -amount);
+    }
+    // ─── Flash data ───────────────────────────────────────────
+    /** Set flash data (available only on the next request). */
+    flash(key, value) {
+        this.#flashData[key] = value;
+        this.#dirty = true;
+    }
+    /** Flash all current input. */
+    flashAll(input) {
+        for (const [k, v] of Object.entries(input)) {
+            this.#flashData[k] = v;
+        }
+        this.#dirty = true;
+    }
+    /** Flash only specific keys. */
+    flashOnly(input, keys) {
+        for (const k of keys) {
+            if (k in input)
+                this.#flashData[k] = input[k];
+        }
+        this.#dirty = true;
+    }
+    /** Flash all except specific keys. */
+    flashExcept(input, keys) {
+        const keySet = new Set(keys);
+        for (const [k, v] of Object.entries(input)) {
+            if (!keySet.has(k))
+                this.#flashData[k] = v;
+        }
+        this.#dirty = true;
+    }
+    /** Get a flashed value from the previous request. */
+    flashMessages() {
+        return { ...this.#previousFlash };
+    }
+    /** Get a specific flash message from the previous request. */
+    old(key, defaultValue) {
+        if (key in this.#previousFlash) {
+            // biome-ignore lint/suspicious/noExplicitAny: flash data stored as unknown; caller brands the value type via T
+            return this.#previousFlash[key];
+        }
+        // biome-ignore lint/suspicious/noExplicitAny: generic default — caller brands the value type via T
+        return defaultValue;
+    }
+    // ─── Serialization ────────────────────────────────────────
+    /** Serialize for storage. Includes flash data for next request. */
+    toJSON() {
+        const result = { ...this.#data };
+        if (Object.keys(this.#flashData).length > 0) {
+            result.__flash = this.#flashData;
+        }
+        return result;
+    }
+    isDirty() {
+        return this.#dirty;
+    }
+}
+//# sourceMappingURL=Session.js.map

package/dist/session/Session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.js","sourceRoot":"","sources":["../../src/session/Session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAwBH;;;;GAIG;AACH,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,OAAO,OAAO;IAClB,KAAK,GAA4B,EAAE,CAAA;IACnC,UAAU,GAA4B,EAAE,CAAA;IACxC,cAAc,GAA4B,EAAE,CAAA;IAC5C,MAAM,GAAG,KAAK,CAAA;IACd,UAAU,CAAQ;IAClB;;;;;OAKG;IACM,kBAAkB,CAAQ;IACnC,YAAY,GAAG,KAAK,CAAA;IAEpB,YAAY,SAAiB,EAAE,OAAgC,EAAE;QAC/D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;QAC3B,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAA;QACnC,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,CAAA;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAA;QAC1B,IAAI,CAAC,cAAc;YACjB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClE,CAAC,CAAC,4HAA4H;oBAC3H,KAAwC;gBAC3C,CAAC,CAAC,EAAE,CAAA;QACR,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAA;IAC3B,CAAC;IAED,qDAAqD;IACrD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAA;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,8EAA8E;IAC9E,cAAc;QACZ,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,4GAA4G;IAC5G,iBAAiB;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAA;IAChC,CAAC;IAED,2BAA2B;IAC3B,GAAG,CAAc,GAAW,EAAE,YAAgB;QAC5C,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,iHAAiH;YACjH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAA;QACpC,CAAC;QACD,mGAAmG;QACnG,OAAO,YAAwB,CAAA;IACjC,CAAC;IAED,2BAA2B;IAC3B,GAAG,CAAC,GAAW,EAAE,KAAc;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,6BAA6B;IAC7B,GAAG,CAAC,GAAW;QACb,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAA;IAC1B,CAAC;IAED,4BAA4B;IAC5B,GAAG;QACD,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,oBAAoB;IACpB,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAc,GAAW,EAAE,YAAgB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAI,GAAG,EAAE,YAAY,CAAC,CAAA;QAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8BAA8B;IAC9B,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;QACf,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,iCAAiC;IACjC,SAAS,CAAC,GAAW,EAAE,MAAM,GAAG,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAS,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,CAAA;IACjC,CAAC;IAED,iCAAiC;IACjC,SAAS,CAAC,GAAW,EAAE,MAAM,GAAG,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,6DAA6D;IAE7D,2DAA2D;IAC3D,KAAK,CAAC,GAAW,EAAE,KAAc;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,+BAA+B;IAC/B,QAAQ,CAAC,KAA8B;QACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,gCAAgC;IAChC,SAAS,CAAC,KAA8B,EAAE,IAAc;QACtD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,sCAAsC;IACtC,WAAW,CAAC,KAA8B,EAAE,IAAc;QACxD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,qDAAqD;IACrD,aAAa;QACX,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACnC,CAAC;IAED,8DAA8D;IAC9D,GAAG,CAAc,GAAW,EAAE,YAAgB;QAC5C,IAAI,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,+GAA+G;YAC/G,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAa,CAAA;QAC7C,CAAC;QACD,mGAAmG;QACnG,OAAO,YAAwB,CAAA;IACjC,CAAC;IAED,6DAA6D;IAE7D,mEAAmE;IACnE,MAAM;QACJ,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;CACF"}

package/dist/session/SessionMiddleware.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Session middleware — initializes session on each request.
+ *
+ * Reads session ID from cookie, loads data via driver, attaches to ctx,
+ * and writes back after the handler runs.
+ */
+import type { HttpContext } from '../http/HttpContext.js';
+import type { SessionConfig } from './Session.js';
+export default class SessionMiddleware {
+    #private;
+    constructor(config?: SessionConfig & {
+        secret?: string;
+    });
+    handle(ctx: HttpContext, next: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=SessionMiddleware.d.ts.map

package/dist/session/SessionMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionMiddleware.d.ts","sourceRoot":"","sources":["../../src/session/SessionMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAGzD,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,cAAc,CAAA;AAWhE,MAAM,CAAC,OAAO,OAAO,iBAAiB;;gBAKxB,MAAM,CAAC,EAAE,aAAa,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAwBlD,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;CAiGzD"}

package/dist/session/SessionMiddleware.js

@@ -0,0 +1,132 @@
+/**
+ * Session middleware — initializes session on each request.
+ *
+ * Reads session ID from cookie, loads data via driver, attaches to ctx,
+ * and writes back after the handler runs.
+ */
+import { randomBytes } from 'node:crypto';
+import { CookieDriver } from './drivers/CookieDriver.js';
+import { MemoryDriver } from './drivers/MemoryDriver.js';
+import { Session } from './Session.js';
+export default class SessionMiddleware {
+    #driver;
+    #cookieDriver = null;
+    #config;
+    constructor(config) {
+        this.#config = {
+            driver: config?.driver ?? 'memory',
+            cookieName: config?.cookieName ?? 'ream_session',
+            maxAge: config?.maxAge ?? 7200,
+            clearWithBrowser: config?.clearWithBrowser ?? false,
+            rolling: config?.rolling ?? false,
+        };
+        if (this.#config.driver === 'cookie') {
+            if (!config?.secret) {
+                throw new Error('Cookie session driver requires a secret. Set session.secret in your config.');
+            }
+            this.#cookieDriver = new CookieDriver(config.secret);
+            this.#driver = this.#cookieDriver;
+        }
+        else if (this.#config.driver === 'memory') {
+            this.#driver = new MemoryDriver();
+        }
+        else {
+            throw new Error(`Unknown session driver: ${this.#config.driver}`);
+        }
+    }
+    async handle(ctx, next) {
+        const cookieName = this.#config.cookieName;
+        const maxAge = this.#config.maxAge;
+        const rolling = this.#config.rolling;
+        const isProduction = process.env.NODE_ENV === 'production';
+        // Read session ID from cookie — pre-parsed by the Rust HyperServer.
+        let sessionId = ctx.request.cookie(cookieName);
+        const hadIncomingCookie = sessionId !== null;
+        // Cookie driver: the cookie value IS the session data (encrypted)
+        if (this.#cookieDriver) {
+            const data = await this.#driver.read(sessionId ?? '');
+            sessionId = sessionId ?? generateSessionId();
+            const session = new Session(sessionId, data);
+            ctx.store.set('session', session);
+            await next();
+            // Default: only emit Set-Cookie if the session was actually modified —
+            // sending a cookie on every response defeats HTTP caching, leaks state
+            // to CDNs, and creates a privacy side-channel (response varies even for
+            // read-only GETs).
+            // Rolling mode: re-emit on every response with an existing session so
+            // the cookie maxAge window slides forward (active users don't time out
+            // mid-session). Caller opts in via SessionConfig.rolling.
+            const shouldEmit = session.isDirty() || (rolling && hadIncomingCookie);
+            if (shouldEmit) {
+                const encoded = this.#cookieDriver.encode(session.toJSON());
+                ctx.response.cookie(cookieName, encoded, {
+                    maxAge: this.#config.clearWithBrowser ? undefined : maxAge,
+                    path: '/',
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    secure: isProduction,
+                });
+            }
+            return;
+        }
+        // Server-side drivers (memory, redis)
+        if (!sessionId) {
+            sessionId = generateSessionId();
+        }
+        const data = await this.#driver.read(sessionId);
+        const session = new Session(sessionId, data);
+        ctx.store.set('session', session);
+        await next();
+        // Session-fixation mitigation: if the handler called `session.regenerate()`
+        // (typically via Warden's SessionStrategy.login), the session id has been
+        // rotated. Migrate the driver storage atomically — write under the new
+        // id first, then destroy the old entry so a crash between calls leaves
+        // the user with a valid session under one of the two ids rather than
+        // none. The cookie below picks up `session.sessionId` which already
+        // returns the new value.
+        const regenerated = session.wasRegenerated();
+        const isNew = !hadIncomingCookie;
+        if (regenerated) {
+            const originalId = session.originalSessionId();
+            const currentId = session.sessionId;
+            await this.#driver.write(currentId, session.toJSON(), maxAge);
+            // Best-effort: a destroy failure leaves a stale entry that TTL will
+            // sweep, but should not crash the request. The new session is already
+            // live under `currentId`.
+            try {
+                await this.#driver.destroy(originalId);
+            }
+            catch {
+                // benign — TTL will reclaim it.
+            }
+        }
+        else if (session.isDirty()) {
+            await this.#driver.write(sessionId, session.toJSON(), maxAge);
+        }
+        else if (!isNew) {
+            await this.#driver.touch(sessionId, maxAge);
+        }
+        // Emit Set-Cookie only when there is server-side state worth
+        // pinning to the browser: the session was modified (isDirty → we
+        // just wrote it), regenerated (rotated id post-login), or rolling
+        // mode is sliding an existing session's window. A brand-new but
+        // CLEAN anonymous request gets NO cookie — otherwise every first
+        // read-only GET hands out a persistent tracking id that points at
+        // no server-side row (touch() is a no-op without a backing entry),
+        // defeats HTTP caching, and leaks a Set-Cookie to CDNs. This mirrors
+        // the cookie-driver path above (which already omits `isNew`).
+        if (session.isDirty() || regenerated || (rolling && hadIncomingCookie)) {
+            ctx.response.cookie(cookieName, session.sessionId, {
+                maxAge: this.#config.clearWithBrowser ? undefined : maxAge,
+                path: '/',
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: isProduction,
+            });
+        }
+    }
+}
+function generateSessionId() {
+    return randomBytes(24).toString('base64url');
+}
+//# sourceMappingURL=SessionMiddleware.js.map

package/dist/session/SessionMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionMiddleware.js","sourceRoot":"","sources":["../../src/session/SessionMiddleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAUtC,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC,OAAO,CAAe;IACtB,aAAa,GAAwB,IAAI,CAAA;IACzC,OAAO,CAAuB;IAE9B,YAAY,MAA4C;QACtD,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ;YAClC,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,cAAc;YAChD,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI;YAC9B,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,KAAK;YACnD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK;SAClC,CAAA;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAA;YACH,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,aAAa,CAAA;QACnC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,EAAE,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAgB,EAAE,IAAyB;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAA;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAA;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;QACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;QAE1D,oEAAoE;QACpE,IAAI,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,iBAAiB,GAAG,SAAS,KAAK,IAAI,CAAA;QAE5C,kEAAkE;QAClE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;YACrD,SAAS,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;YAEjC,MAAM,IAAI,EAAE,CAAA;YAEZ,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,mBAAmB;YACnB,sEAAsE;YACtE,uEAAuE;YACvE,0DAA0D;YAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAA;YACtE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC3D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE;oBACvC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;oBAC1D,IAAI,EAAE,GAAG;oBACT,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;iBACrB,CAAC,CAAA;YACJ,CAAC;YACD,OAAM;QACR,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,iBAAiB,EAAE,CAAA;QACjC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAEjC,MAAM,IAAI,EAAE,CAAA;QAEZ,4EAA4E;QAC5E,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAA;QAC5C,MAAM,KAAK,GAAG,CAAC,iBAAiB,CAAA;QAChC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAA;YAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,0BAA0B;YAC1B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QAC/D,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;QAED,6DAA6D;QAC7D,iEAAiE;QACjE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,WAAW,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;gBACjD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBAC1D,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,YAAY;aACrB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;CACF;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC9C,CAAC"}

package/dist/session/drivers/CookieDriver.d.ts

@@ -0,0 +1,17 @@
+import type { SessionDriver } from '../Session.js';
+/**
+ * Cookie session driver — stores session data in an encrypted cookie (AES-256-GCM).
+ * Stateless on the server. Limited by cookie size (~4KB).
+ * Requires a secret for encryption.
+ */
+export declare class CookieDriver implements SessionDriver {
+    private signer;
+    constructor(secret: string);
+    read(sessionId: string): Promise<Record<string, unknown>>;
+    write(_sessionId: string, _data: Record<string, unknown>, _ttl: number): Promise<void>;
+    destroy(_sessionId: string): Promise<void>;
+    touch(_sessionId: string, _ttl: number): Promise<void>;
+    /** Encode session data for cookie storage (encrypted). */
+    encode(data: Record<string, unknown>): string;
+}
+//# sourceMappingURL=CookieDriver.d.ts.map

package/dist/session/drivers/CookieDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CookieDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;;GAIG;AACH,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,MAAM,CAAc;gBAEhB,MAAM,EAAE,MAAM;IASpB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAWzD,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;CAG9C"}

package/dist/session/drivers/CookieDriver.js

@@ -0,0 +1,42 @@
+import { CookieSigner } from '../../security/CookieSigner.js';
+/**
+ * Cookie session driver — stores session data in an encrypted cookie (AES-256-GCM).
+ * Stateless on the server. Limited by cookie size (~4KB).
+ * Requires a secret for encryption.
+ */
+export class CookieDriver {
+    signer;
+    constructor(secret) {
+        if (!secret) {
+            throw new Error('CookieDriver requires a secret for session encryption. Set session.secret in your config.');
+        }
+        this.signer = new CookieSigner(secret);
+    }
+    async read(sessionId) {
+        if (!sessionId)
+            return {};
+        const decrypted = this.signer.decrypt(sessionId);
+        if (!decrypted)
+            return {};
+        try {
+            return JSON.parse(decrypted);
+        }
+        catch {
+            return {};
+        }
+    }
+    async write(_sessionId, _data, _ttl) {
+        // Cookie driver writes via the response cookie — handled by middleware
+    }
+    async destroy(_sessionId) {
+        // Cookie deletion handled by middleware setting maxAge=0
+    }
+    async touch(_sessionId, _ttl) {
+        // Cookie renewal handled by middleware
+    }
+    /** Encode session data for cookie storage (encrypted). */
+    encode(data) {
+        return this.signer.encrypt(JSON.stringify(data));
+    }
+}
+//# sourceMappingURL=CookieDriver.js.map

package/dist/session/drivers/CookieDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CookieDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/CookieDriver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAG7D;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAc;IAE5B,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,KAA8B,EAAE,IAAY;QAC1E,uEAAuE;IACzE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,yDAAyD;IAC3D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,IAAY;QAC1C,uCAAuC;IACzC,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,IAA6B;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAClD,CAAC;CACF"}

package/dist/session/drivers/MemoryDriver.d.ts

@@ -0,0 +1,9 @@
+import type { SessionDriver } from '../Session.js';
+export declare class MemoryDriver implements SessionDriver {
+    private store;
+    read(sessionId: string): Promise<Record<string, unknown>>;
+    write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void>;
+    destroy(sessionId: string): Promise<void>;
+    touch(sessionId: string, ttl: number): Promise<void>;
+}
+//# sourceMappingURL=MemoryDriver.d.ts.map

package/dist/session/drivers/MemoryDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MemoryDriver.d.ts","sourceRoot":"","sources":["../../../src/session/drivers/MemoryDriver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CAAC,KAAK,CAA+E;IAEtF,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASzD,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM3D"}

package/dist/session/drivers/MemoryDriver.js

@@ -0,0 +1,24 @@
+export class MemoryDriver {
+    store = new Map();
+    async read(sessionId) {
+        const entry = this.store.get(sessionId);
+        if (!entry || entry.expiresAt < Date.now()) {
+            this.store.delete(sessionId);
+            return {};
+        }
+        return { ...entry.data };
+    }
+    async write(sessionId, data, ttl) {
+        this.store.set(sessionId, { data, expiresAt: Date.now() + ttl * 1000 });
+    }
+    async destroy(sessionId) {
+        this.store.delete(sessionId);
+    }
+    async touch(sessionId, ttl) {
+        const entry = this.store.get(sessionId);
+        if (entry) {
+            entry.expiresAt = Date.now() + ttl * 1000;
+        }
+    }
+}
+//# sourceMappingURL=MemoryDriver.js.map

package/dist/session/drivers/MemoryDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MemoryDriver.js","sourceRoot":"","sources":["../../../src/session/drivers/MemoryDriver.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,YAAY;IACf,KAAK,GAAsE,IAAI,GAAG,EAAE,CAAA;IAE5F,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC5B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,GAAW;QACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,GAAW;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAA;QAC3C,CAAC;IACH,CAAC;CACF"}

package/dist/storage/S3Driver.d.ts

@@ -0,0 +1,27 @@
+/**
+ * S3Driver — S3-compatible cloud storage (AWS S3, Cloudflare R2, MinIO).
+ *
+ * Uses fetch API — no external SDK dependency.
+ * Implements the StorageDriver interface.
+ *
+ * @implements MISS-24
+ */
+import type { StorageDriver } from './StorageManager.js';
+export interface S3Config {
+    bucket: string;
+    region?: string;
+    endpoint?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    publicUrl?: string;
+}
+export declare class S3Driver implements StorageDriver {
+    #private;
+    constructor(config: S3Config);
+    put(filePath: string, content: Buffer | string): Promise<void>;
+    get(filePath: string): Promise<Buffer | null>;
+    delete(filePath: string): Promise<boolean>;
+    exists(filePath: string): Promise<boolean>;
+    url(filePath: string): string;
+}
+//# sourceMappingURL=S3Driver.d.ts.map

package/dist/storage/S3Driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3Driver.d.ts","sourceRoot":"","sources":["../../src/storage/S3Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AA4BxD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,QAAS,YAAW,aAAa;;gBAIhC,MAAM,EAAE,QAAQ;IAKtB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa7C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAShD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAuE9B"}