@contractspec/lib.ai-agent 7.0.6 → 7.0.10

package/dist/node/session/index.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,

package/dist/node/session/store.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,