@comfyorg/account-core 1.0.0-alpha.0 → 1.0.0-alpha.1

package/dist/core/lazyIdentity.d.ts

@@ -0,0 +1,31 @@
+/**
+ * An identity port whose real identity is loaded and subscribed only on
+ * `activate()`, so a host can construct the session client at module load
+ * while the identity's module (and the SDK behind it) stays a lazy chunk.
+ */
+import type { AccountIdentity } from './identity.js';
+import type { AccountUser } from './sessionContracts.js';
+/**
+ * Single-owner: one driver calls `activate()` and `deactivate()`; a second
+ * consumer would share and tear down the same activation.
+ */
+export interface LazyIdentity<TUser extends AccountUser> extends AccountIdentity<TUser> {
+    /**
+     * Resolves once the loaded identity has delivered its current user, or at
+     * once when `deactivate()` interrupts the activation; the caller re-checks
+     * its own liveness after the await.
+     */
+    activate: () => Promise<void>;
+    /**
+     * Unsubscribes the real identity, signing subscribers out if it had
+     * delivered a signed-in user.
+     */
+    deactivate: () => void;
+}
+/**
+ * An identity that has already settled signed-out: for a `load` that
+ * legitimately has no source to resolve, so the port still delivers once and
+ * a subscriber reaches signed-out instead of hanging in `pending` forever.
+ */
+export declare function createUnavailableIdentity<TUser extends AccountUser>(): AccountIdentity<TUser>;
+export declare function createLazyIdentity<TUser extends AccountUser>(load: () => Promise<AccountIdentity<TUser>>): LazyIdentity<TUser>;

package/dist/core/lazyIdentity.js

@@ -0,0 +1,96 @@
+import { brandIdentity } from './identity.js';
+/**
+ * An identity that has already settled signed-out: for a `load` that
+ * legitimately has no source to resolve, so the port still delivers once and
+ * a subscriber reaches signed-out instead of hanging in `pending` forever.
+ */
+export function createUnavailableIdentity() {
+    return brandIdentity({
+        onUserChanged: (callback) => {
+            callback(null);
+            return () => undefined;
+        }
+    });
+}
+export function createLazyIdentity(load) {
+    const listeners = new Set();
+    let generation = 0;
+    let activation;
+    let settleActivation;
+    let unsubscribe;
+    let lastDelivered;
+    function deliver(user) {
+        lastDelivered = { user };
+        listeners.forEach((listener) => listener(user));
+    }
+    async function subscribe(started, resolve) {
+        const identity = await load();
+        if (started !== generation)
+            return;
+        unsubscribe = identity.onUserChanged((user) => {
+            if (started !== generation)
+                return;
+            resolve();
+            deliver(user);
+        });
+    }
+    function activate() {
+        if (activation)
+            return activation;
+        const started = ++generation;
+        activation = new Promise((resolve, reject) => {
+            settleActivation = resolve;
+            subscribe(started, resolve).catch((error) => {
+                if (started !== generation)
+                    return;
+                activation = undefined;
+                settleActivation = undefined;
+                // A load that can't produce an identity still owes subscribers an
+                // answer: deliver signed-out so nobody is left waiting on a promise
+                // this activation will never settle. A throwing listener must not
+                // swallow the loader's own error, so reject unconditionally; this
+                // runs inside an unawaited .catch(), so a listener's own exception
+                // is reported rather than left to become an unhandled rejection.
+                try {
+                    deliver(null);
+                }
+                catch (deliverError) {
+                    console.warn('lazyIdentity: a listener threw delivering signed-out after a load failure', deliverError);
+                }
+                finally {
+                    reject(error);
+                }
+            });
+        });
+        return activation;
+    }
+    function deactivate() {
+        if (!activation)
+            return;
+        generation += 1;
+        activation = undefined;
+        settleActivation?.();
+        settleActivation = undefined;
+        unsubscribe?.();
+        unsubscribe = undefined;
+        const wasSignedIn = lastDelivered !== undefined && lastDelivered.user !== null;
+        lastDelivered = undefined;
+        if (!wasSignedIn)
+            return;
+        listeners.forEach((listener) => listener(null));
+    }
+    return {
+        ...brandIdentity({
+            onUserChanged: (listener) => {
+                listeners.add(listener);
+                if (lastDelivered)
+                    listener(lastDelivered.user);
+                return () => {
+                    listeners.delete(listener);
+                };
+            }
+        }),
+        activate,
+        deactivate
+    };
+}

package/dist/core/requestAuth.d.ts

@@ -0,0 +1,30 @@
+import type { WebSession } from './sessionContracts.js';
+export type RequestTarget = 'ingest' | 'resource';
+export type RequestPrincipal = {
+    readonly kind: 'session';
+    readonly session: WebSession;
+} | {
+    readonly kind: 'firebase';
+    readonly getIdToken: () => Promise<string>;
+} | {
+    readonly kind: 'apiKey';
+    readonly apiKey: string;
+};
+export interface RequestAuthInput {
+    readonly target: RequestTarget;
+    readonly method: string;
+    /** Absent means the personal workspace. */
+    readonly workspaceId?: string;
+}
+export interface RequestAuthorization {
+    readonly headers: Readonly<Record<string, string>>;
+    /** Set only for a cookie request, which must carry the session cookie. */
+    readonly credentials?: 'include';
+}
+export type RequestAuthorizer = (principal: RequestPrincipal, input: RequestAuthInput) => Promise<RequestAuthorization>;
+export interface RequestAuthOptions {
+    /** A workspace token for a session principal; minting is the caller's. */
+    readonly getWorkspaceToken: (workspaceId: string | undefined) => Promise<string>;
+}
+export declare const COMFY_CLIENT: string;
+export declare function createRequestAuthorizer({ getWorkspaceToken }: RequestAuthOptions): RequestAuthorizer;

package/dist/core/requestAuth.js

@@ -0,0 +1,41 @@
+/**
+ * Decides the credential headers for one request, and nothing else: callers
+ * send, retry, and track scope. A cookie session authorizes ingest itself;
+ * every other service takes a Bearer workspace token. Firebase and API-key
+ * principals keep the single header they send today, whatever the target.
+ */
+import packageManifest from '../../package.json' with { type: 'json' };
+export const COMFY_CLIENT = `${packageManifest.name}/${packageManifest.version}`;
+const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
+function sessionHeaders(session, { method, workspaceId }) {
+    return {
+        'X-Comfy-Client': COMFY_CLIENT,
+        ...(workspaceId === undefined
+            ? {}
+            : { 'X-Comfy-Workspace-ID': workspaceId }),
+        ...(SAFE_METHODS.has(method.toUpperCase())
+            ? {}
+            : { 'X-CSRF-Token': session.csrfToken })
+    };
+}
+export function createRequestAuthorizer({ getWorkspaceToken }) {
+    return async function authorize(principal, input) {
+        switch (principal.kind) {
+            case 'apiKey':
+                return { headers: { 'X-API-KEY': principal.apiKey } };
+            case 'firebase':
+                return {
+                    headers: { Authorization: `Bearer ${await principal.getIdToken()}` }
+                };
+            case 'session':
+                if (input.target === 'resource') {
+                    const token = await getWorkspaceToken(input.workspaceId);
+                    return { headers: { Authorization: `Bearer ${token}` } };
+                }
+                return {
+                    headers: sessionHeaders(principal.session, input),
+                    credentials: 'include'
+                };
+        }
+    };
+}

package/dist/core/session.d.ts

@@ -53,13 +53,16 @@ export interface SessionClientOptions extends SessionRequestOptions {
     readonly storage: CredentialStorage;
     readonly freshMarginMs?: number;
     readonly refreshScheduler?: RefreshSchedulerOptions;
-    /** Applies to the identity passed at construction; see `AttachIdentityOptions.autoMint`. */
+    /**
+     * When false, an identity event sets the user and publishes without
+     * starting a warm-up mint — for hosts that drive every mint explicitly.
+     */
     readonly autoMint?: boolean;
 }
 /**
- * `pending` is the initial phase, before the attached identity has delivered
- * even once, so a host can tell "Firebase has not answered yet" (pending)
- * from "nobody is signed in" (a delivered null) without wrapping the port.
+ * `pending` is the initial phase, before the identity has delivered even
+ * once, so a host can tell "Firebase has not answered yet" (pending) from
+ * "nobody is signed in" (a delivered null) without wrapping the port.
  */
 export type SessionSnapshot<TUser extends AccountUser = AccountUser> = {
     readonly phase: 'pending';
@@ -83,21 +86,12 @@ export type SessionSnapshot<TUser extends AccountUser = AccountUser> = {
     readonly session: undefined;
     readonly failure: SessionFailure;
 };
-export interface AttachIdentityOptions {
-    /**
-     * When false, an identity event sets the user and publishes without
-     * starting a warm-up mint — for hosts that drive every mint explicitly.
-     */
-    readonly autoMint?: boolean;
-}
 export interface SessionClient<TUser extends AccountUser = AccountUser> {
-    /** @deprecated Transitional Pinia-adapter seam; pass the identity as `createSessionClient`'s second argument instead (FE-2171, PoC #16639). */
-    attachIdentity: (identity: AccountIdentity<TUser>, options?: AttachIdentityOptions) => () => void;
     /**
-     * Detaches the current identity; the persisted credential stays until
-     * `clearStoredCredential`. Not terminal, like a detach: an explicit-user
-     * mint issued after `dispose()` still commits and can re-arm the scheduler
-     * and cross-tab lease, so dispose and then stop calling the client.
+     * Detaches the constructed identity; the persisted credential stays until
+     * `clearStoredCredential`. Not terminal: an explicit-user mint issued after
+     * `dispose()` still commits and can re-arm the scheduler and cross-tab
+     * lease, so dispose and then stop calling the client.
      */
     dispose: () => void;
     getSnapshot: () => SessionSnapshot<TUser>;
@@ -133,7 +127,7 @@ export interface SessionClient<TUser extends AccountUser = AccountUser> {
     invalidate: () => void;
     /**
      * Drops only the persisted copy of the credential. The published session
-     * stays live; a host that must end it detaches or invalidates as well.
+     * stays live; a host that must end it disposes or invalidates as well.
      */
     clearStoredCredential: () => void;
 }

package/dist/core/session.js

@@ -1,5 +1,4 @@
 import { DEFAULT_FRESH_MARGIN_MS, createCredentialCache, decodeAdopted, isCredentialFresh, selectFreshCredential } from './credentialCache.js';
-import { isAccountIdentity } from './identity.js';
 import { abortable, exchangeToken } from './exchange.js';
 import { createMintCoordinator } from './mintCoordinator.js';
 import { createRefreshScheduler } from './refreshScheduler.js';
@@ -28,9 +27,8 @@ const DEFAULT_MINT_TIMEOUT_MS = 15_000;
  * production's default branch.
  */
 export function createSessionClient(clientOptions, identity) {
-    const { exchangeUrl, storage, freshMarginMs = DEFAULT_FRESH_MARGIN_MS } = clientOptions;
+    const { exchangeUrl, storage, freshMarginMs = DEFAULT_FRESH_MARGIN_MS, autoMint = true } = clientOptions;
     let state = initialSessionState();
-    let detachCurrent;
     const listeners = new Set();
     const cache = createCredentialCache(storage);
     const mints = createMintCoordinator();
@@ -245,38 +243,30 @@ export function createSessionClient(clientOptions, identity) {
         }, () => options.now?.() ?? hostNow());
         return result;
     }
-    function subscribeIdentity(port, autoMint) {
-        if (!isAccountIdentity(port)) {
-            throw new Error('the session client needs the identity from @comfyorg/account-core/firebase (or /testing)');
-        }
-        detachCurrent?.();
-        let unsubscribe = () => undefined;
-        const detach = () => {
-            if (detachCurrent !== detach)
-                return;
-            detachCurrent = undefined;
-            unsubscribe();
-            commit({ type: 'identity-detached' });
-        };
-        detachCurrent = detach;
-        unsubscribe = port.onUserChanged((next) => {
-            if (detachCurrent !== detach)
+    function subscribeIdentity(port) {
+        let active = true;
+        const unsubscribe = port.onUserChanged((next) => {
+            if (!active)
                 return;
             commit({ type: 'identity-changed', user: next });
-            if (detachCurrent === detach && next && autoMint) {
+            // A listener may dispose the client or deliver a newer user inside
+            // that publish; either makes state.user no longer this delivery's.
+            if (next && autoMint && state.user === next) {
                 void refreshWith(ensureCore, next);
             }
         });
-        if (detachCurrent !== detach)
+        return () => {
+            if (!active)
+                return;
+            active = false;
             unsubscribe();
-        return detach;
+            commit({ type: 'identity-detached' });
+        };
     }
-    if (identity)
-        subscribeIdentity(identity, clientOptions.autoMint !== false);
+    const detachIdentity = identity ? subscribeIdentity(identity) : undefined;
     return {
-        attachIdentity: (port, attachOptions) => subscribeIdentity(port, attachOptions?.autoMint !== false),
         dispose() {
-            detachCurrent?.();
+            detachIdentity?.();
         },
         getSnapshot,
         subscribe(listener) {

package/dist/core/sessionContracts.d.ts

@@ -85,14 +85,14 @@ export interface MintHandle {
  * (`createWebCrossTabRefreshPort` from `@comfyorg/account-core/web`); tests pass
  * fakes.
  */
-export interface CrossTabRefreshPort {
+export interface CrossTabRefreshPort<Message = AccountCredential> {
     /**
      * Queue for the key's lease. `onAcquired` fires if and when this tab
      * becomes leader; the returned function abandons the request or releases
      * held leadership.
      */
     requestLeadership: (key: string, onAcquired: () => void) => () => void;
-    publishCredential: (key: string, credential: AccountCredential) => void;
+    publishCredential: (key: string, credential: Message) => void;
     /** Messages cross a serialization boundary; the client validates them. */
     onCredential: (key: string, callback: (message: unknown) => void) => () => void;
 }
@@ -132,4 +132,41 @@ export interface RefreshSchedulerOptions {
      */
     readonly onScheduledOutcome?: (report: ScheduledRefreshReport) => void;
 }
+/** The signed-in principal behind the shared `__Host-comfy_session` cookie. */
+export interface WebSessionUser {
+    readonly id: string;
+    readonly email: string;
+    readonly name?: string;
+    readonly emailVerified: boolean;
+    readonly signInProvider?: string;
+}
+export interface WebSession {
+    readonly user: WebSessionUser;
+    readonly csrfToken: string;
+    /** ms since epoch; the sliding idle expiry */
+    readonly expiresAt: number;
+    /** ms since epoch; the hard cap regardless of activity */
+    readonly absoluteExpiresAt: number;
+}
+/**
+ * `SESSION_UNAVAILABLE` is the only transient code: 429, 5xx, network,
+ * abort, and unreadable bodies land there so an outage never reads as a
+ * sign-out. `SESSION_REQUEST_REFUSED` is a request no fresh session can fix.
+ */
+export type WebSessionErrorCode = 'NO_SESSION' | 'SESSION_EXPIRED' | 'SESSION_REVOKED' | 'CSRF_STALE' | 'IDENTITY_CHANGED' | 'WORKSPACE_ACCESS_DENIED' | 'SESSION_REQUEST_REFUSED' | 'SESSION_UNAVAILABLE';
+export interface WebSessionFailure {
+    readonly status: 'error';
+    readonly code: WebSessionErrorCode;
+    readonly retryable: boolean;
+    readonly httpStatus?: number;
+    /** The server's `ErrorResponse.code`, when the body carried one. */
+    readonly serverCode?: string;
+}
+export type WebSessionResult = {
+    readonly status: 'ok';
+    readonly session: WebSession;
+} | WebSessionFailure;
+export type WebSessionCommandResult = {
+    readonly status: 'ok';
+} | WebSessionFailure;
 export {};

package/dist/core/sessionTokenMint.d.ts

@@ -0,0 +1,33 @@
+import type { AccountCredential, WebSession, WebSessionFailure } from './sessionContracts.js';
+export interface SessionTokenMintOptions {
+    /** Ingest API root, e.g. `https://cloud.comfy.org/api`. */
+    readonly apiBaseUrl: string;
+    readonly fetchImpl: typeof fetch;
+    /** The live web session, or undefined when signed out. */
+    readonly getSession: () => WebSession | undefined;
+    readonly now?: () => number;
+    /** Re-mint once a cached token has this long left. Default 60s. */
+    readonly refreshBufferMs?: number;
+}
+export interface SessionTokenFailure extends WebSessionFailure {
+    /** From a 429's `Retry-After`; no request is sent until it passes. */
+    readonly retryAfterMs?: number;
+}
+export type SessionTokenResult = {
+    readonly status: 'ok';
+    readonly credential: AccountCredential;
+} | SessionTokenFailure;
+export declare class SessionTokenError extends Error {
+    readonly failure: SessionTokenFailure;
+    constructor(failure: SessionTokenFailure);
+}
+export interface SessionTokenMint {
+    /** Never throws: every outcome is a result. */
+    readonly mint: (workspaceId?: string) => Promise<SessionTokenResult>;
+    /** Like `mint`, but never serves the cached token; for the one 401 retry. */
+    readonly remint: (workspaceId?: string) => Promise<SessionTokenResult>;
+    /** For `createRequestAuthorizer`; rejects with a `SessionTokenError`. */
+    readonly getWorkspaceToken: (workspaceId?: string) => Promise<string>;
+}
+export declare const DEFAULT_REFRESH_BUFFER_MS = 60000;
+export declare function createSessionTokenMint({ apiBaseUrl, fetchImpl, getSession, now, refreshBufferMs }: SessionTokenMintOptions): SessionTokenMint;

package/dist/core/sessionTokenMint.js

@@ -0,0 +1,205 @@
+/**
+ * Workspace tokens for services that cannot read the session cookie. The
+ * session mints one at `POST /auth/token` on first use, and each token is
+ * reused per (session user, workspace) until it nears expiry. Failures come
+ * back as web-session codes; nothing here retries or signs out.
+ */
+import { zErrorResponse, zExchangeTokenResponse } from '@comfyorg/ingest-types/zod';
+import { isCredentialFresh } from './credentialCache.js';
+import { COMFY_CLIENT } from './requestAuth.js';
+export class SessionTokenError extends Error {
+    failure;
+    constructor(failure) {
+        super(`Workspace token mint failed: ${failure.code}`);
+        this.failure = failure;
+        this.name = 'SessionTokenError';
+    }
+}
+export const DEFAULT_REFRESH_BUFFER_MS = 60_000;
+const MAX_RETRY_AFTER_MS = 10 * 60 * 1000;
+const STATUS_RULES = {
+    401: {
+        byServerCode: {
+            session_expired: 'SESSION_EXPIRED',
+            session_revoked: 'SESSION_REVOKED'
+        },
+        fallback: 'NO_SESSION'
+    },
+    403: {
+        byServerCode: {
+            csrf_invalid: 'CSRF_STALE',
+            workspace_access_denied: 'WORKSPACE_ACCESS_DENIED'
+        },
+        fallback: 'SESSION_REQUEST_REFUSED'
+    }
+};
+const zServerCode = zErrorResponse.pick({ code: true });
+function failure(code, httpStatus, serverCode) {
+    return {
+        status: 'error',
+        code,
+        retryable: code === 'SESSION_UNAVAILABLE',
+        ...(httpStatus === undefined ? {} : { httpStatus }),
+        ...(serverCode === undefined ? {} : { serverCode })
+    };
+}
+async function readJson(response) {
+    try {
+        return await response.json();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Retry-After is delay-seconds or an HTTP-date; either is capped. */
+function retryAfterMs(value, nowMs) {
+    if (value === null)
+        return undefined;
+    const seconds = Number(value);
+    const delayMs = Number.isFinite(seconds)
+        ? seconds * 1000
+        : Date.parse(value) - nowMs;
+    return delayMs > 0 ? Math.min(delayMs, MAX_RETRY_AFTER_MS) : undefined;
+}
+function rateLimited(response, nowMs) {
+    const limited = failure('SESSION_UNAVAILABLE', response.status);
+    const waitMs = retryAfterMs(response.headers.get('Retry-After'), nowMs);
+    return waitMs === undefined ? limited : { ...limited, retryAfterMs: waitMs };
+}
+function codeFor(status, serverCode) {
+    const rule = STATUS_RULES[status];
+    if (rule === undefined)
+        return 'SESSION_REQUEST_REFUSED';
+    return rule.byServerCode[serverCode ?? ''] ?? rule.fallback;
+}
+async function classifyFailure(response, nowMs) {
+    const { status } = response;
+    if (status === 429)
+        return rateLimited(response, nowMs);
+    if (status >= 500)
+        return failure('SESSION_UNAVAILABLE', status);
+    const parsed = zServerCode.safeParse(await readJson(response));
+    const serverCode = parsed.success ? parsed.data.code : undefined;
+    return failure(codeFor(status, serverCode), status, serverCode);
+}
+export function createSessionTokenMint({ apiBaseUrl, fetchImpl, getSession, now = Date.now, refreshBufferMs = DEFAULT_REFRESH_BUFFER_MS }) {
+    const tokenUrl = `${apiBaseUrl.replace(/\/+$/, '')}/auth/token`;
+    /** Keyed by workspace; every entry belongs to `cacheOwner`. */
+    const cache = new Map();
+    const inFlight = new Map();
+    let cacheOwner;
+    /** Bumped on every owner change, so an older owner's answer never lands. */
+    let ownerGeneration = 0;
+    let rateLimit;
+    function adoptOwner(userId) {
+        if (cacheOwner === userId)
+            return;
+        cacheOwner = userId;
+        ownerGeneration += 1;
+        cache.clear();
+        inFlight.clear();
+        rateLimit = undefined;
+    }
+    async function request(session, workspaceId) {
+        let response;
+        try {
+            response = await fetchImpl(tokenUrl, {
+                method: 'POST',
+                credentials: 'include',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Comfy-Client': COMFY_CLIENT,
+                    'X-CSRF-Token': session.csrfToken,
+                    ...(workspaceId === undefined
+                        ? {}
+                        : { 'X-Comfy-Workspace-ID': workspaceId })
+                },
+                body: JSON.stringify(workspaceId === undefined ? {} : { workspace_id: workspaceId })
+            });
+        }
+        catch {
+            return failure('SESSION_UNAVAILABLE');
+        }
+        if (!response.ok)
+            return classifyFailure(response, now());
+        const parsed = zExchangeTokenResponse.safeParse(await readJson(response));
+        const expiresAt = parsed.success
+            ? Date.parse(parsed.data.expires_at)
+            : Number.NaN;
+        if (!parsed.success || parsed.data.token === '' || !(expiresAt > now())) {
+            return failure('SESSION_UNAVAILABLE', response.status);
+        }
+        return {
+            status: 'ok',
+            credential: {
+                token: parsed.data.token,
+                expiresAt: Math.min(expiresAt, session.expiresAt),
+                uid: session.user.id,
+                workspace: parsed.data.workspace,
+                role: parsed.data.role,
+                permissions: parsed.data.permissions
+            }
+        };
+    }
+    function commit(workspaceId, generation, result) {
+        if (generation !== ownerGeneration)
+            return;
+        if (result.status === 'ok') {
+            cache.set(workspaceId, result.credential);
+            return;
+        }
+        if (result.httpStatus === 401)
+            cache.clear();
+        if (result.retryAfterMs !== undefined) {
+            rateLimit = { until: now() + result.retryAfterMs, failure: result };
+        }
+    }
+    async function mint(workspaceId) {
+        const session = getSession();
+        adoptOwner(session?.user.id);
+        if (session === undefined)
+            return failure('NO_SESSION');
+        const userId = session.user.id;
+        // The cache is checked before the backoff on purpose: a caller already
+        // holding a fresh token is still served while new mints wait.
+        const cached = cache.get(workspaceId);
+        if (cached && isCredentialFresh(cached, now(), refreshBufferMs)) {
+            return { status: 'ok', credential: cached };
+        }
+        if (rateLimit && now() < rateLimit.until) {
+            return rateLimit.failure;
+        }
+        const joined = inFlight.get(workspaceId);
+        if (joined)
+            return joined;
+        const generation = ownerGeneration;
+        const running = request(session, workspaceId).then((result) => {
+            if (inFlight.get(workspaceId) === running)
+                inFlight.delete(workspaceId);
+            const current = getSession();
+            if (current === undefined)
+                return failure('NO_SESSION');
+            if (current.user.id !== userId)
+                return failure('IDENTITY_CHANGED');
+            commit(workspaceId, generation, result);
+            return result;
+        });
+        inFlight.set(workspaceId, running);
+        return running;
+    }
+    function remint(workspaceId) {
+        if (!inFlight.has(workspaceId))
+            cache.delete(workspaceId);
+        return mint(workspaceId);
+    }
+    return {
+        mint,
+        remint,
+        async getWorkspaceToken(workspaceId) {
+            const result = await mint(workspaceId);
+            if (result.status === 'ok')
+                return result.credential.token;
+            throw new SessionTokenError(result);
+        }
+    };
+}

package/dist/core/webSession.d.ts

@@ -0,0 +1,25 @@
+import type { WebSessionCommandResult, WebSessionResult } from './sessionContracts.js';
+export type { WebSession, WebSessionCommandResult, WebSessionErrorCode, WebSessionFailure, WebSessionResult, WebSessionUser } from './sessionContracts.js';
+export interface WebSessionOptions {
+    /** Ingest API root, e.g. `https://cloud.comfy.org/api`. */
+    readonly apiBaseUrl: string;
+    readonly fetchImpl: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+export declare function readWebSession(options: WebSessionOptions, { expectedUserId }?: {
+    readonly expectedUserId?: string;
+}): Promise<WebSessionResult>;
+/**
+ * Creates the session, then reads it back for the user and CSRF token. A
+ * failure to produce the proof is the provider's error and propagates.
+ */
+export declare function createWebSession(options: WebSessionOptions, getIdentityProof: () => Promise<string>, { expectedUserId }?: {
+    readonly expectedUserId?: string;
+}): Promise<WebSessionResult>;
+/** Sends no CSRF token: sign-out must work against a dead session. */
+export declare function deleteWebSession(options: WebSessionOptions): Promise<WebSessionCommandResult>;
+/**
+ * Signs the user out of every device. Only a body the contract recognises is
+ * ok: the caller tells the user every device is signed out on that answer.
+ */
+export declare function revokeAllWebSessions(options: WebSessionOptions, csrfToken: string, getIdentityProof: () => Promise<string>): Promise<WebSessionCommandResult>;