@daloyjs/core 0.16.0 → 0.28.0

package/dist/security-schemes.js

@@ -8,6 +8,33 @@
  * Spec reference:
  *   https://spec.openapis.org/oas/v3.1.0#security-scheme-object
  */
+export const REQUIRE_PAYLOAD_AUTH_EXTENSION = "x-daloy-require-payload-auth";
+function markRequirePayloadAuth(scheme, options) {
+    if (options.requirePayloadAuth === true) {
+        scheme[REQUIRE_PAYLOAD_AUTH_EXTENSION] = true;
+    }
+    return scheme;
+}
+export function securitySchemeRequiresPayloadAuth(scheme) {
+    if (!scheme || typeof scheme !== "object")
+        return false;
+    const record = scheme;
+    return (record[REQUIRE_PAYLOAD_AUTH_EXTENSION] === true ||
+        record.requirePayloadAuth === true);
+}
+export function toOpenAPISecurityScheme(scheme) {
+    if (!scheme || typeof scheme !== "object")
+        return scheme;
+    const record = scheme;
+    if (!("requirePayloadAuth" in record))
+        return scheme;
+    const out = { ...record };
+    const requiresPayloadAuth = securitySchemeRequiresPayloadAuth(record);
+    delete out.requirePayloadAuth;
+    if (requiresPayloadAuth)
+        out[REQUIRE_PAYLOAD_AUTH_EXTENSION] = true;
+    return out;
+}
 /**
  * Build an OpenAPI Security Scheme Object for HTTP Bearer authentication
  * (e.g. `Authorization: Bearer <token>`).
@@ -34,7 +61,7 @@ export function httpBearerScheme(options = {}) {
         scheme.bearerFormat = options.bearerFormat;
     if (options.description !== undefined)
         scheme.description = options.description;
-    return scheme;
+    return markRequirePayloadAuth(scheme, options);
 }
 /**
  * Build an OpenAPI Security Scheme Object for HTTP Basic authentication
@@ -48,7 +75,7 @@ export function httpBasicScheme(options = {}) {
     const scheme = { type: "http", scheme: "basic" };
     if (options.description !== undefined)
         scheme.description = options.description;
-    return scheme;
+    return markRequirePayloadAuth(scheme, options);
 }
 /**
  * Build an OpenAPI Security Scheme Object for an API key delivered in a
@@ -78,7 +105,7 @@ export function apiKeyScheme(options) {
     };
     if (options.description !== undefined)
         scheme.description = options.description;
-    return scheme;
+    return markRequirePayloadAuth(scheme, options);
 }
 /**
  * Build an OpenAPI Security Scheme Object for OAuth 2.0. At least one flow
@@ -115,7 +142,7 @@ export function oauth2Scheme(options) {
     const scheme = { type: "oauth2", flows };
     if (options.description !== undefined)
         scheme.description = options.description;
-    return scheme;
+    return markRequirePayloadAuth(scheme, options);
 }
 /**
  * Build an OpenAPI Security Scheme Object for OpenID Connect Discovery.
@@ -137,6 +164,6 @@ export function openIdConnectScheme(options) {
     };
     if (options.description !== undefined)
         scheme.description = options.description;
-    return scheme;
+    return markRequirePayloadAuth(scheme, options);
 }
 //# sourceMappingURL=security-schemes.js.map

package/dist/security-schemes.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../src/security-schemes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqGH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,MAAM,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACnF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CACjB,yEAAyE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB;QAClC,IAAI,EAAE,eAAe;QACrB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../src/security-schemes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAAuC,CAAC;AA6CtF,SAAS,sBAAsB,CAC7B,MAAS,EACT,OAAyC;IAEzC,IAAI,OAAO,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACvC,MAAkC,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,MAAe;IAC/D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,OAAO,CACL,MAAM,CAAC,8BAA8B,CAAC,KAAK,IAAI;QAC/C,MAAM,CAAC,kBAAkB,KAAK,IAAI,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,IAAI,CAAC,CAAC,oBAAoB,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,MAAM,GAAG,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,iCAAiC,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,kBAAkB,CAAC;IAC9B,IAAI,mBAAmB;QAAE,GAAG,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,MAAM,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACnF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CACjB,yEAAyE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GACX,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB;QAClC,IAAI,EAAE,eAAe;QACrB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAChF,OAAO,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/security.d.ts

@@ -110,6 +110,38 @@ export declare const SMUGGLING_SINGLETON_HEADERS: readonly string[];
  * @since 0.15.0
  */
 export declare function assertNoDuplicateSingletonHeaders(headers: Headers): void;
+/**
+ * Minimum acceptable secret length in bytes for HMAC / signing material in
+ * production (Wave 3 boot guard). Matches the OWASP "Secret Management"
+ * cheat sheet floor of 256 bits for symmetric keys.
+ *
+ * @since 0.17.0
+ */
+export declare const MIN_PROD_SECRET_BYTES = 32;
+/**
+ * Lowercased list of well-known weak secret values (defaults, tutorial
+ * placeholders, common bad guesses). Used by {@link assertStrongSecret} to
+ * refuse-to-boot when the developer ships a sample secret to production.
+ *
+ * @since 0.17.0
+ */
+export declare const WEAK_SECRET_STRINGS: readonly string[];
+/**
+ * Throw when `secret` is unfit for production HMAC / signing duty. Used by
+ * Wave 3 boot guards on `session()` / future `jwt()` helpers when the App
+ * runs in production. The check rejects:
+ *
+ * - empty / non-string values;
+ * - exact matches against {@link WEAK_SECRET_STRINGS} (case-insensitive);
+ * - secrets shorter than {@link MIN_PROD_SECRET_BYTES} UTF-8 bytes;
+ * - obvious low-entropy patterns (all identical / sequential characters).
+ *
+ * The thrown `Error` includes the `scope` argument (e.g. `"session"`) so
+ * the developer sees which subsystem rejected the secret.
+ *
+ * @since 0.17.0
+ */
+export declare function assertStrongSecret(secret: unknown, scope: string): void;
 /**
  * Supported HMAC digest algorithms for {@link verifyWebhookSignature} and
  * {@link signWebhookPayload}. SHA-1 is deliberately excluded — it is

package/dist/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAUjC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxE;AAqFD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAID;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,IAAI,MAAM,CAUjC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGvD,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAOxE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA4B/C,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA0BvE;AAqFD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BnB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB"}

package/dist/security.js

@@ -206,6 +206,85 @@ export function assertNoDuplicateSingletonHeaders(headers) {
         }
     }
 }
+/**
+ * Minimum acceptable secret length in bytes for HMAC / signing material in
+ * production (Wave 3 boot guard). Matches the OWASP "Secret Management"
+ * cheat sheet floor of 256 bits for symmetric keys.
+ *
+ * @since 0.17.0
+ */
+export const MIN_PROD_SECRET_BYTES = 32;
+/**
+ * Lowercased list of well-known weak secret values (defaults, tutorial
+ * placeholders, common bad guesses). Used by {@link assertStrongSecret} to
+ * refuse-to-boot when the developer ships a sample secret to production.
+ *
+ * @since 0.17.0
+ */
+export const WEAK_SECRET_STRINGS = Object.freeze([
+    "secret",
+    "secrets",
+    "password",
+    "passw0rd",
+    "changeme",
+    "change-me",
+    "default",
+    "test",
+    "testtest",
+    "example",
+    "placeholder",
+    "replace-this-with-a-strong-secret",
+    "supersecret",
+    "topsecret",
+    "letmein",
+    "your-secret",
+    "your-jwt-secret",
+    "your-session-secret",
+    "your-session-secret-for-production",
+    "it-is-very-secret",
+    "your-secret-key",
+    "very-secret",
+    "do-not-use",
+    "do_not_use",
+    "0000000000000000",
+    "1111111111111111",
+    "aaaaaaaaaaaaaaaa",
+]);
+const WEAK_SECRET_SET = new Set(WEAK_SECRET_STRINGS.map((s) => s.toLowerCase()));
+/**
+ * Throw when `secret` is unfit for production HMAC / signing duty. Used by
+ * Wave 3 boot guards on `session()` / future `jwt()` helpers when the App
+ * runs in production. The check rejects:
+ *
+ * - empty / non-string values;
+ * - exact matches against {@link WEAK_SECRET_STRINGS} (case-insensitive);
+ * - secrets shorter than {@link MIN_PROD_SECRET_BYTES} UTF-8 bytes;
+ * - obvious low-entropy patterns (all identical / sequential characters).
+ *
+ * The thrown `Error` includes the `scope` argument (e.g. `"session"`) so
+ * the developer sees which subsystem rejected the secret.
+ *
+ * @since 0.17.0
+ */
+export function assertStrongSecret(secret, scope) {
+    if (typeof secret !== "string" || secret.length === 0) {
+        throw new Error(`${scope}(): production secret is missing or not a string.`);
+    }
+    const lower = secret.toLowerCase();
+    if (WEAK_SECRET_SET.has(lower)) {
+        throw new Error(`${scope}(): production secret matches a well-known placeholder (${secret.slice(0, 4)}…). ` +
+            `Replace it with a real random value loaded from an env var or secret manager.`);
+    }
+    const bytes = new TextEncoder().encode(secret).byteLength;
+    if (bytes < MIN_PROD_SECRET_BYTES) {
+        throw new Error(`${scope}(): production secret is too short (${bytes} bytes; require >= ${MIN_PROD_SECRET_BYTES}). ` +
+            `Generate one with \`openssl rand -base64 48\` and load it from an env var.`);
+    }
+    // Reject all-identical-character secrets ("aaaaaaaa…", "00000000…").
+    if (/^(.)\1+$/.test(secret)) {
+        throw new Error(`${scope}(): production secret is a single repeated character (${secret[0]}…) — refuse-to-boot.`);
+    }
+}
 const HEX_RE = /^[0-9a-fA-F]+$/;
 const WEBHOOK_HMAC_ALGORITHMS = {
     sha256: { hashName: "SHA-256", signatureBytes: 32 },

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,uBAAuB,GAGzB;IACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;CACpD,CAAC;AAEF,SAAS,uBAAuB,CAC9B,SAAkB;IAElB,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,QAA8B,EAC9B,aAAqB;IAErB,IAAI,SAAS,YAAY,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAElB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ;IACR,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;IACN,UAAU;IACV,SAAS;IACT,aAAa;IACb,mCAAmC;IACnC,aAAa;IACb,WAAW;IACX,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,qBAAqB;IACrB,oCAAoC;IACpC,mBAAmB;IACnB,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAe,EAAE,KAAa;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,mDAAmD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,2DAA2D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACzF,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC;IAC1D,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,uCAAuC,KAAK,sBAAsB,qBAAqB,KAAK;YAClG,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,yDAAyD,MAAM,CAAC,CAAC,CAAC,sBAAsB,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,uBAAuB,GAGzB;IACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;CACpD,CAAC;AAEF,SAAS,uBAAuB,CAC9B,SAAkB;IAElB,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,QAA8B,EAC9B,aAAqB;IAErB,IAAI,SAAS,YAAY,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAElB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/session.d.ts

@@ -15,7 +15,27 @@
  * The module is dependency-free and uses Web Crypto (`crypto.subtle`), so it
  * works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge.
  */
-import type { Hooks } from "./types.js";
+import type { BaseContext, Hooks } from "./types.js";
+/**
+ * Marker stamped on the `Hooks` object returned by {@link session}. Used
+ * by the Wave 3 boot guard so the framework can detect that a session
+ * subsystem is installed and pair it with `csrf()` / a strong production
+ * secret. Third-party session helpers that want to participate in the
+ * guard can stamp the same marker and expose their secrets via
+ * {@link SESSION_SECRETS_MARKER}.
+ *
+ * @since 0.17.0
+ */
+export declare const SESSION_HOOK_MARKER: unique symbol;
+/**
+ * Marker stamped on the `Hooks` object returned by {@link session} that
+ * carries the array of secrets passed to the helper. Used by the Wave 3
+ * boot guard to refuse-to-boot when production secrets are too short or
+ * match a well-known placeholder.
+ *
+ * @since 0.17.0
+ */
+export declare const SESSION_SECRETS_MARKER: unique symbol;
 export interface SessionRecord {
     /** Arbitrary serializable session payload. Mutating this object marks the session dirty. */
     data: Record<string, unknown>;
@@ -134,6 +154,28 @@ export declare class MemorySessionStore implements SessionStore {
  * ```
  */
 export declare function session(opts: SessionOptions): Hooks;
+export interface RotateSessionOptions {
+    /**
+     * Session data keys to watch, or a custom selector. When the watched value
+     * changes during a handler, the helper calls `ctx.state.session.regenerate()`.
+     * Default keys cover common privilege-bearing fields.
+     */
+    watch?: string | readonly string[] | ((ctx: BaseContext<any, any>) => unknown | Promise<unknown>);
+    /** Carry existing data across the regenerated session id. Default: true. */
+    keepData?: boolean;
+}
+/**
+ * Automatically rotate the signed session id when privilege-bearing session
+ * data changes during a handler. Mount after `session()` and before routes
+ * that mutate login / role / scope / tenant state.
+ *
+ * This is a thin guard over `ctx.state.session.regenerate()`, so it inherits
+ * session key-rotation arrays: old cookies verify with any configured secret
+ * and rotated cookies are re-signed with the first/current secret.
+ *
+ * @since 0.23.0
+ */
+export declare function rotateSession(opts?: RotateSessionOptions): Hooks;
 /**
  * Sign an arbitrary string with HMAC-SHA256. Returns `${value}.${sig}` where
  * `sig` is URL-safe base64. Useful for building custom signed cookies or

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAOxC,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,iFAAiF;IACjF,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,iCAAiC;IACjC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAC7C,kDAAkD;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,qDAAqD;IACrD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,OAAO,IAAI,IAAI,CAAC;IAChB,oIAAoI;IACpI,UAAU,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D,CAAC;AAiOF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAUtC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI;IAI7C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAK3C,wCAAwC;IACxC,KAAK,IAAI,IAAI;IAIb,iEAAiE;IACjE,IAAI,IAAI,MAAM;CAGf;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,CA8JnD;AAID;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYzG;AAGD,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAWrD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAExC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,OAAO,MAE3C,CAAC;AAIF,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,iFAAiF;IACjF,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,4FAA4F;IAC5F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,uEAAuE;IACvE,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,iCAAiC;IACjC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAC7C,kDAAkD;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,qDAAqD;IACrD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,OAAO,IAAI,IAAI,CAAC;IAChB,oIAAoI;IACpI,UAAU,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D,CAAC;AAoKF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IAExD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAUtC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI;IAI7C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAK3C,wCAAwC;IACxC,KAAK,IAAI,IAAI;IAIb,iEAAiE;IACjE,IAAI,IAAI,MAAM;CAGf;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,KAAK,CA+KnD;AAID,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,KAAK,CAAC,EACF,MAAM,GACN,SAAS,MAAM,EAAE,GACjB,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0DD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,KAAK,CAyBpE;AAID;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYzG;AAGD,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC"}

package/dist/session.js

@@ -15,12 +15,31 @@
  * The module is dependency-free and uses Web Crypto (`crypto.subtle`), so it
  * works on Node, Bun, Deno, Cloudflare Workers, and Vercel Edge.
  */
+import { assertCookieAttributes, readRequestCookie, serializeClearCookie, serializeCookie, } from "./cookie.js";
 import { timingSafeEqual } from "./security.js";
 const DEFAULT_COOKIE_NAME = "__Host-daloy.sid";
+/**
+ * Marker stamped on the `Hooks` object returned by {@link session}. Used
+ * by the Wave 3 boot guard so the framework can detect that a session
+ * subsystem is installed and pair it with `csrf()` / a strong production
+ * secret. Third-party session helpers that want to participate in the
+ * guard can stamp the same marker and expose their secrets via
+ * {@link SESSION_SECRETS_MARKER}.
+ *
+ * @since 0.17.0
+ */
+export const SESSION_HOOK_MARKER = Symbol.for("daloyjs.session.hook");
+/**
+ * Marker stamped on the `Hooks` object returned by {@link session} that
+ * carries the array of secrets passed to the helper. Used by the Wave 3
+ * boot guard to refuse-to-boot when production secrets are too short or
+ * match a well-known placeholder.
+ *
+ * @since 0.17.0
+ */
+export const SESSION_SECRETS_MARKER = Symbol.for("daloyjs.session.secrets");
 const STATE_KEY = "session";
 const STATE_INTERNAL = "__sessionInternal";
-// ---------- Implementation ----------
-const COOKIE_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 const enc = new TextEncoder();
 function getSubtle() {
     const c = globalThis.crypto;
@@ -68,86 +87,16 @@ function generateSessionId() {
     c.getRandomValues(buf);
     return bytesToBase64Url(buf);
 }
-function validateCookieSegment(kind, value) {
-    if (/[;\r\n\0]/.test(value))
-        throw new Error(`session(): cookieOptions.${kind} contains an invalid character.`);
-}
-function validateCookieOptions(cookieName, opts) {
-    if (!COOKIE_NAME_RE.test(cookieName))
-        throw new Error("session(): cookieName is not a valid cookie name.");
-    if (opts.sameSite !== "Strict" && opts.sameSite !== "Lax" && opts.sameSite !== "None") {
-        throw new Error('session(): cookieOptions.sameSite must be "Strict", "Lax", or "None".');
-    }
-    if (!opts.path.startsWith("/"))
-        throw new Error('session(): cookieOptions.path must start with "/".');
-    validateCookieSegment("path", opts.path);
-    if (opts.domain)
-        validateCookieSegment("domain", opts.domain);
-    if (!Number.isInteger(opts.maxAgeSeconds) || opts.maxAgeSeconds < 0) {
-        throw new Error("session(): cookieOptions.maxAgeSeconds must be a non-negative integer.");
-    }
-    if (cookieName.startsWith("__Host-")) {
-        if (!opts.secure || opts.path !== "/" || opts.domain) {
-            throw new Error('session(): "__Host-" cookie names require secure: true, path: "/", and no domain. ' +
-                "Pass an explicit cookieName or relax cookieOptions to use a non-prefixed cookie.");
-        }
-    }
-    if (opts.sameSite === "None" && !opts.secure) {
-        throw new Error('session(): cookieOptions.sameSite: "None" requires secure: true.');
-    }
-}
-function readCookie(header, name) {
-    if (!header)
-        return null;
-    const parts = header.split(";");
-    for (let i = 0; i < parts.length; i++) {
-        const part = parts[i];
-        const eq = part.indexOf("=");
-        if (eq < 0)
-            continue;
-        const k = part.slice(0, eq).trim();
-        if (k === name) {
-            const v = part.slice(eq + 1).trim();
-            try {
-                return decodeURIComponent(v);
-            }
-            catch {
-                return v;
-            }
-        }
-    }
-    return null;
-}
-function buildSetCookie(name, value, opts) {
-    let s = `${name}=${encodeURIComponent(value)}`;
-    s += `; Path=${opts.path}`;
-    s += `; SameSite=${opts.sameSite}`;
-    if (opts.secure)
-        s += "; Secure";
-    if (opts.httpOnly)
-        s += "; HttpOnly";
-    if (opts.domain)
-        s += `; Domain=${opts.domain}`;
-    if (opts.maxAgeSeconds > 0)
-        s += `; Max-Age=${opts.maxAgeSeconds}`;
-    if (opts.partitioned)
-        s += "; Partitioned";
-    return s;
-}
-function buildClearCookie(name, opts) {
-    let s = `${name}=`;
-    s += `; Path=${opts.path}`;
-    s += `; SameSite=${opts.sameSite}`;
-    if (opts.secure)
-        s += "; Secure";
-    if (opts.httpOnly)
-        s += "; HttpOnly";
-    if (opts.domain)
-        s += `; Domain=${opts.domain}`;
-    s += "; Max-Age=0";
-    if (opts.partitioned)
-        s += "; Partitioned";
-    return s;
+function sessionCookieAttributes(opts) {
+    return {
+        sameSite: opts.sameSite,
+        secure: opts.secure,
+        path: opts.path,
+        domain: opts.domain || undefined,
+        maxAgeSeconds: opts.maxAgeSeconds,
+        partitioned: opts.partitioned,
+        httpOnly: opts.httpOnly,
+    };
 }
 function markDirty(internal) {
     internal.dirty = true;
@@ -275,7 +224,11 @@ export function session(opts) {
         partitioned: cookieOverrides.partitioned ?? false,
         httpOnly: cookieOverrides.httpOnly ?? true,
     };
-    validateCookieOptions(cookieName, cookieOpts);
+    assertCookieAttributes({
+        scope: "session()",
+        name: cookieName,
+        attributes: sessionCookieAttributes(cookieOpts),
+    });
     const ttlSeconds = opts.ttlSeconds ?? 86_400;
     if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
         throw new Error("session(): ttlSeconds must be a positive integer.");
@@ -285,7 +238,7 @@ export function session(opts) {
     const store = opts.store ?? new MemorySessionStore();
     const generator = opts.generator ?? generateSessionId;
     const saveUninitialized = opts.saveUninitialized === true;
-    return {
+    const hooks = {
         async beforeHandle(ctx) {
             const internal = {
                 cookieName,
@@ -304,7 +257,7 @@ export function session(opts) {
                 regenerated: false,
                 created: false,
             };
-            const raw = readCookie(ctx.request.headers.get("cookie"), cookieName);
+            const raw = readRequestCookie(ctx.request.headers.get("cookie"), cookieName);
             internal.hadCookie = raw !== null;
             let data = {};
             let id = null;
@@ -375,7 +328,7 @@ export function session(opts) {
                     await store.destroy(internal.originalId);
                 // Clear stale or malformed client cookies too, not only verified sessions.
                 if (internal.hadCookie) {
-                    res.headers.append("set-cookie", buildClearCookie(internal.cookieName, internal.cookieOpts));
+                    res.headers.append("set-cookie", serializeClearCookie(internal.cookieName, sessionCookieAttributes(internal.cookieOpts)));
                 }
                 return undefined;
             }
@@ -407,10 +360,100 @@ export function session(opts) {
                 return undefined;
             const signer = internal.signers[0];
             const sig = await signer.sign(sid);
-            res.headers.append("set-cookie", buildSetCookie(internal.cookieName, `${sid}.${sig}`, internal.cookieOpts));
+            res.headers.append("set-cookie", serializeCookie(internal.cookieName, `${sid}.${sig}`, sessionCookieAttributes(internal.cookieOpts)));
             return undefined;
         },
     };
+    hooks[SESSION_HOOK_MARKER] = true;
+    hooks[SESSION_SECRETS_MARKER] = secrets.slice();
+    return hooks;
+}
+const ROTATE_SESSION_SNAPSHOT_KEY = "__daloyRotateSessionSnapshot";
+const DEFAULT_ROTATE_SESSION_KEYS = [
+    "userId",
+    "accountId",
+    "tenantId",
+    "role",
+    "roles",
+    "scopes",
+    "permissions",
+    "privileges",
+    "isAdmin",
+];
+function sessionFromContext(ctx) {
+    const value = ctx.state[STATE_KEY];
+    if (!value || typeof value !== "object" || typeof value.regenerate !== "function") {
+        throw new Error("rotateSession(): session() must run before rotateSession().");
+    }
+    return value;
+}
+async function readRotationWatchValue(ctx, watch) {
+    if (typeof watch === "function")
+        return watch(ctx);
+    const sessionCtx = sessionFromContext(ctx);
+    const keys = typeof watch === "string"
+        ? [watch]
+        : Array.isArray(watch)
+            ? watch
+            : DEFAULT_ROTATE_SESSION_KEYS;
+    const out = {};
+    for (const key of keys)
+        out[key] = sessionCtx.data[key];
+    return out;
+}
+function stableSnapshot(value) {
+    if (value === undefined)
+        return "undefined";
+    if (typeof value === "function")
+        return `function:${value.name}`;
+    if (typeof value === "symbol")
+        return String(value);
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableSnapshot).join(",")}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableSnapshot(record[key])}`)
+        .join(",")}}`;
+}
+/**
+ * Automatically rotate the signed session id when privilege-bearing session
+ * data changes during a handler. Mount after `session()` and before routes
+ * that mutate login / role / scope / tenant state.
+ *
+ * This is a thin guard over `ctx.state.session.regenerate()`, so it inherits
+ * session key-rotation arrays: old cookies verify with any configured secret
+ * and rotated cookies are re-signed with the first/current secret.
+ *
+ * @since 0.23.0
+ */
+export function rotateSession(opts = {}) {
+    const keepData = opts.keepData !== false;
+    return {
+        async beforeHandle(ctx) {
+            const sessionCtx = sessionFromContext(ctx);
+            const value = await readRotationWatchValue(ctx, opts.watch);
+            ctx.state[ROTATE_SESSION_SNAPSHOT_KEY] = {
+                id: sessionCtx.id,
+                value: stableSnapshot(value),
+            };
+        },
+        async afterHandle(ctx, result) {
+            const snapshot = ctx.state[ROTATE_SESSION_SNAPSHOT_KEY];
+            if (!snapshot)
+                return result;
+            const sessionCtx = sessionFromContext(ctx);
+            if (sessionCtx.id !== snapshot.id)
+                return result;
+            const value = await readRotationWatchValue(ctx, opts.watch);
+            if (stableSnapshot(value) !== snapshot.value) {
+                await sessionCtx.regenerate({ keepData });
+            }
+            return result;
+        },
+    };
 }
 // ---------- Low-level signing helpers (re-exported for advanced use) ----------
 /**