@demiurgejs/core 0.2.0-beta.3 → 0.2.0-beta.5

package/dist/inspect/command.d.ts

@@ -0,0 +1,28 @@
+import type { ResolvedDemiurgeConfig } from "../config/types";
+/** The exit codes of the `demiurge inspect` command. */
+export declare const INSPECT_EXIT_OK = 0;
+export declare const INSPECT_EXIT_FINDINGS = 1;
+export declare const INSPECT_EXIT_INVALID = 2;
+export type InspectCommandInput = {
+    /** The arguments that follow the command name. */
+    arguments: readonly string[];
+    /** Reads the configuration of the application. */
+    loadConfig: () => Promise<ResolvedDemiurgeConfig>;
+};
+export type InspectCommandResult = {
+    /** The exit code of the command. */
+    exitCode: number;
+    /** The human summary that the command writes to standard error. */
+    stderr: string;
+    /** The JSON document that the command writes to standard output. */
+    stdout: string;
+};
+/**
+ * Runs the `demiurge inspect` command.
+ *
+ * The command reads the route tree, resolves the policy cascade, and returns
+ * one JSON document. The command loads no route module, so it runs no data
+ * loader and no mutation handler.
+ */
+export declare function runInspectCommand(input: InspectCommandInput): Promise<InspectCommandResult>;
+//# sourceMappingURL=command.d.ts.map

package/dist/inspect/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/inspect/command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAe9D,wDAAwD;AACxD,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG;IAChC,kDAAkD;IAClD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAmC/B"}

package/dist/inspect/index.d.ts

@@ -0,0 +1,9 @@
+export { INSPECT_EXIT_FINDINGS, INSPECT_EXIT_INVALID, INSPECT_EXIT_OK, runInspectCommand, } from "./command";
+export type { InspectCommandInput, InspectCommandResult, } from "./command";
+export { redactSecrets, REDACTED_VALUE, serializeInspectionReport, } from "./redact";
+export type { InspectionRedactionResult, InspectionSerializeOptions, } from "./redact";
+export { countErrorFindings, createStaticPolicyReport, findSecretEnvKeys, formatStaticPolicyReportSummary, } from "./report";
+export type { StaticPolicyReportOptions } from "./report";
+export { INSPECTION_PROBLEM_VERSION, STATIC_POLICY_REPORT_VERSION, } from "./types";
+export type { InspectionProblem, InspectionProblemCode, InspectionRedaction, InspectionRedactionReason, InspectionResolution, StaticPolicyReport, StaticPolicyReportSection, StaticRouteKind, StaticRouteReport, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/inspect/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/inspect/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,cAAc,EACd,yBAAyB,GAC1B,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,+BAA+B,GAChC,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/dist/inspect/redact.d.ts

@@ -0,0 +1,35 @@
+import type { InspectionRedaction } from "./types";
+/**
+ * The text that replaces a removed value. A reader sees this marker in place
+ * of the value, and the `redactions` section names the field and the reason.
+ */
+export declare const REDACTED_VALUE = "[redacted]";
+export type InspectionSerializeOptions = {
+    /**
+     * The names of the environment variables that an `env.secret(...)`
+     * declaration produced.
+     */
+    secretEnvKeys?: Iterable<string>;
+    /** The indentation of the JSON output. The default value is 2. */
+    space?: number;
+};
+export type InspectionRedactionResult = {
+    /** The values that this module removed, sorted by path. */
+    redactions: InspectionRedaction[];
+    /** The report without the removed values. */
+    value: unknown;
+};
+/**
+ * Serializes a report and removes each secret value. This function is the one
+ * choke point of ADR 0019.
+ *
+ * The function writes the collected redactions into the `redactions` field of
+ * the report when the report declares that field.
+ */
+export declare function serializeInspectionReport(report: unknown, options?: InspectionSerializeOptions): string;
+/**
+ * Removes each secret value from a report and returns the removed names. The
+ * function does not change the report that the caller supplied.
+ */
+export declare function redactSecrets(report: unknown, options?: InspectionSerializeOptions): InspectionRedactionResult;
+//# sourceMappingURL=redact.d.ts.map

package/dist/inspect/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/inspect/redact.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AACH,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,MAAM,MAAM,0BAA0B,GAAG;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,2DAA2D;IAC3D,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AA+BF;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,EACf,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAKR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,OAAO,GAAE,0BAA+B,GACvC,yBAAyB,CAY3B"}

package/dist/inspect/report.d.ts

@@ -0,0 +1,24 @@
+import type { EnvSchema } from "../security";
+import { type DemiurgeVitePluginOptions } from "../vite/plugin";
+import { type StaticPolicyReport } from "./types";
+export type StaticPolicyReportOptions = {
+    /** The plugin options of the application. */
+    options?: DemiurgeVitePluginOptions;
+    /** The absolute path of the project root. */
+    root: string;
+};
+/**
+ * Builds the static inspection report of an application.
+ *
+ * The function reads the route tree and resolves the policy cascade through
+ * `inspectRoutePolicies`. It loads no route module, so it runs no data loader
+ * and no mutation handler.
+ */
+export declare function createStaticPolicyReport(input: StaticPolicyReportOptions): Promise<StaticPolicyReport>;
+/** Reads the names of the variables that `env.secret(...)` declared. */
+export declare function findSecretEnvKeys(schema: EnvSchema | undefined): string[];
+/** Counts the findings that carry error severity. */
+export declare function countErrorFindings(report: StaticPolicyReport): number;
+/** Writes the human summary that the command sends to standard error. */
+export declare function formatStaticPolicyReportSummary(report: StaticPolicyReport): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/inspect/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/inspect/report.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,SAAS,CAAC;AAEjB,MAAM,MAAM,yBAAyB,GAAG;IACtC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,YAK9D;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,UAG5D;AAED,yEAAyE;AACzE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,kBAAkB,UAYzE"}

package/dist/inspect/types.d.ts

@@ -0,0 +1,102 @@
+import type { HttpMethod } from "../route";
+import type { DocumentCspState, RouteAccessState, StaticPolicyFinding } from "../vite/policy-verification";
+/**
+ * The version of the static policy report. ADR 0019 raises this integer when
+ * the framework removes a field or changes the meaning of a field.
+ */
+export declare const STATIC_POLICY_REPORT_VERSION = 1;
+/**
+ * The version of the problem document that the inspect command writes when it
+ * cannot produce a report.
+ */
+export declare const INSPECTION_PROBLEM_VERSION = 1;
+/**
+ * The origin of one fact in a report. The value `static` states that the build
+ * knows the fact. The value `request` states that only a request supplies it.
+ */
+export type InspectionResolution = "request" | "static";
+/** The rule that removed one value from a report. */
+export type InspectionRedactionReason = 
+/** A cookie holds the value. */
+"cookie-value"
+/** An `env.secret(...)` declaration produced the value. */
+ | "environment-secret"
+/** A session record holds the value. */
+ | "session-record";
+/** One value that the serializer removed from a report. */
+export type InspectionRedaction = {
+    /** The name of the field that held the value. */
+    name: string;
+    /** The dotted path of the field inside the report. */
+    path: string;
+    /** The rule that removed the value. */
+    reason: InspectionRedactionReason;
+};
+/** The named sections of the static policy report. */
+export type StaticPolicyReportSection = "findings" | "redactions" | "request" | "routes";
+/** The kind of route file that the static pass read. */
+export type StaticRouteKind = "attached" | "page" | "resource";
+/**
+ * The statically readable description of one route file.
+ *
+ * Each declared field states what the file itself declares. The framework
+ * resolves the cascade of the route tree and reports the result of the
+ * cascade in the `findings` section.
+ */
+export type StaticRouteReport = {
+    /** The access state that the route file declares. */
+    declaredAccess: RouteAccessState;
+    /** The Content-Security-Policy state that the route file declares. */
+    declaredDocumentCsp: DocumentCspState;
+    /** `true` when the route file declares a document policy. */
+    declaresDocumentPolicy: boolean;
+    /** The path of the route file, relative to the route directory. */
+    file: string;
+    /** The kind of the route file. */
+    kind: StaticRouteKind;
+    /** The HTTP methods that the route file exports. */
+    methods: HttpMethod[];
+    /** The route pattern. An attached file has no pattern. */
+    pattern?: string;
+};
+/**
+ * The report that `demiurge inspect` writes to standard output. Each section
+ * states the resolution of its facts in the `resolutions` record.
+ */
+export type StaticPolicyReport = {
+    /** The static policy findings, sorted by file, export name, and code. */
+    findings: StaticPolicyFinding[];
+    /** The values that the serializer removed. */
+    redactions: InspectionRedaction[];
+    /** The names of the facts that only a request supplies. */
+    request: string[];
+    /** The resolution of each section of the report. */
+    resolutions: Record<StaticPolicyReportSection, InspectionResolution>;
+    /** Every route file under the route directory. */
+    routes: StaticRouteReport[];
+    /** The route directory, relative to the project root. */
+    routesDir: string;
+    /** The version of this report shape. */
+    version: number;
+};
+/** The reason that the inspect command could not produce a report. */
+export type InspectionProblemCode = 
+/** The framework could not read the configuration. */
+"configuration-unreadable"
+/** The command received an invalid argument. */
+ | "invalid-argument";
+/**
+ * The document that the inspect command writes when it cannot produce a
+ * report. The command then exits with code 2.
+ */
+export type InspectionProblem = {
+    /** The stable code of the condition. */
+    code: InspectionProblemCode;
+    /** The description of the condition. */
+    detail: string;
+    /** The short name of the condition. */
+    title: string;
+    /** The version of this problem shape. */
+    version: number;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/inspect/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/inspect/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAExD,qDAAqD;AACrD,MAAM,MAAM,yBAAyB;AACnC,gCAAgC;AAC9B,cAAc;AAChB,2DAA2D;GACzD,oBAAoB;AACtB,wCAAwC;GACtC,gBAAgB,CAAC;AAErB,2DAA2D;AAC3D,MAAM,MAAM,mBAAmB,GAAG;IAChC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,yBAAyB,CAAC;CACnC,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,yBAAyB,GACjC,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,CAAC;AAEb,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,qDAAqD;IACrD,cAAc,EAAE,gBAAgB,CAAC;IACjC,sEAAsE;IACtE,mBAAmB,EAAE,gBAAgB,CAAC;IACtC,6DAA6D;IAC7D,sBAAsB,EAAE,OAAO,CAAC;IAChC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,oDAAoD;IACpD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,yEAAyE;IACzE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,8CAA8C;IAC9C,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACrE,kDAAkD;IAClD,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,qBAAqB;AAC/B,sDAAsD;AACpD,0BAA0B;AAC5B,gDAAgD;GAC9C,kBAAkB,CAAC;AAEvB;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wCAAwC;IACxC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC"}

package/dist/internal/testing.js

@@ -1,12 +1,12 @@
-import { h as n, b as u, y as b, ay as i, n as _, j as r, az as c, H as d, G as h, i as m, aA as R, aB as g, aC as p, aD as f, aE as F } from "../chunks/testing-CRflAw4X.js";
+import { h as u, d as b, L as n, b9 as i, C as _, A as r, ba as c, Z as d, Y as h, z as m, bb as R, bc as g, bd as p, be as f, a as F } from "../chunks/testing-CUwGj2ie.js";
 import "react-dom/server";
-import "../chunks/request-metadata-DaIYq4Ea.js";
+import "../chunks/index-0MNiR_wo.js";
 import "react";
 import "react/jsx-runtime";
 export {
-  n as handleRequestWithManifest,
-  u as unstable_collectStaticRoutePaths,
-  b as unstable_createRouteManifest,
+  u as handleRequestWithManifest,
+  b as unstable_collectStaticRoutePaths,
+  n as unstable_createRouteManifest,
   i as unstable_findPageMatch,
   _ as unstable_findRouteMatch,
   r as unstable_isAttachedFileForRoute,

package/dist/kv/index.d.ts

@@ -2,4 +2,6 @@ export { createKvCacheStore } from "./store";
 export type { EdgeKvListKey, EdgeKvListResult, EdgeKvNamespace, EdgeKvPutOptions, KvCacheStoreOptions, } from "./store";
 export { createKvRateLimitStore } from "./rate-limit-store";
 export type { KvRateLimitStoreOptions } from "./rate-limit-store";
+export { createKvSessionStore } from "./session-store";
+export type { EdgeKvAtomicOperation, EdgeKvSessionNamespace, KvSessionStoreOptions, } from "./session-store";
 //# sourceMappingURL=index.d.ts.map

package/dist/kv/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/kv/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/kv/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC"}

package/dist/kv/index.js

@@ -1,126 +1,223 @@
-const $ = "demiurge:cache:";
-function A(n) {
-  if (!n.namespace || typeof n.namespace.get != "function")
+import { s as R, p as b } from "../chunks/session-store-ChModVcq.js";
+const M = "demiurge:cache:", O = 1e3;
+function T(r) {
+  if (!r.namespace || typeof r.namespace.get != "function")
     throw new Error(
       "Demiurge KV cache store requires an EdgeKvNamespace. Pass a connected KV client matching the get/put/delete/list interface documented on EdgeKvNamespace."
     );
-  const a = n.namespace, d = n.keyPrefix ?? $, g = `${d}entry:`, w = `${d}tag:`, m = `${d}lease:`;
-  function o(e) {
-    return g + e;
+  const t = r.namespace, d = r.keyPrefix ?? M, w = `${d}entry:`, f = `${d}tag:`, c = `${d}lease:`;
+  function s(e) {
+    return w + e;
   }
-  function r(e) {
-    return m + e;
+  function n(e) {
+    return c + e;
   }
-  function l(e, t) {
-    return `${w}${e}:${t}`;
+  function o(e, a) {
+    return `${f}${e}:${a}`;
   }
-  async function s(e) {
-    const t = await a.get(o(e));
-    return t ? JSON.parse(t) : void 0;
+  async function i(e) {
+    const a = await t.get(s(e));
+    return a ? JSON.parse(a) : void 0;
   }
-  async function u(e, t) {
+  async function u(e, a) {
     await Promise.all(
-      t.map((i) => a.delete(l(i, e)))
+      a.map((l) => t.delete(o(l, e)))
     );
   }
-  async function E(e, t, i) {
+  async function y(e, a, l) {
     await Promise.all(
-      t.map(
-        (c) => a.put(l(c, e), "1", { expiration: i })
+      a.map(
+        (p) => t.put(o(p, e), "1", { expiration: l })
       )
     );
   }
-  async function x(e, t) {
-    const i = await s(e);
-    i && await u(e, i.tags);
-    const c = S(t);
-    await a.put(o(e), JSON.stringify(t), { expiration: c }), await E(e, t.tags, c);
+  async function g(e, a) {
+    const l = await i(e);
+    l && await u(e, l.tags);
+    const p = J(a);
+    await t.put(s(e), JSON.stringify(a), { expiration: p }), await y(e, a.tags, p);
   }
   return {
-    async acquireRefreshLease(e, t, i) {
-      return await a.get(r(e)) ? !1 : (await a.put(r(e), t, {
-        expiration: P(i)
+    async acquireRefreshLease(e, a, l) {
+      return await t.get(n(e)) ? !1 : (await t.put(n(e), a, {
+        expiration: $(l)
       }), !0);
     },
     async delete(e) {
-      const t = await s(e);
-      return await a.delete(r(e)), t ? (await u(e, t.tags), await a.delete(o(e)), !0) : !1;
+      const a = await i(e);
+      return await t.delete(n(e)), a ? (await u(e, a.tags), await t.delete(s(e)), !0) : !1;
     },
     async get(e) {
-      return await s(e);
+      return await i(e);
     },
     async invalidateTags(e) {
       if (e.length === 0)
         return 0;
-      const t = /* @__PURE__ */ new Set();
-      let i = 0;
-      for (const c of e) {
-        const y = l(c, "");
-        let p;
+      const a = /* @__PURE__ */ new Set();
+      let l = 0;
+      for (const p of e) {
+        const E = o(p, "");
+        let v;
         do {
-          const h = await a.list({
-            cursor: p,
-            limit: 1e3,
-            prefix: y
+          const h = await t.list({
+            cursor: v,
+            limit: O,
+            prefix: E
           });
-          for (const K of h.keys) {
-            const f = K.name.slice(y.length);
-            if (t.has(f))
+          for (const S of h.keys) {
+            const m = S.name.slice(E.length);
+            if (a.has(m))
               continue;
-            t.add(f);
-            const v = await s(f);
-            if (!v) {
-              await a.delete(K.name);
+            a.add(m);
+            const N = await i(m);
+            if (!N) {
+              await t.delete(S.name);
               continue;
             }
-            await u(f, v.tags), await a.delete(o(f)), await a.delete(r(f)), i += 1;
+            await u(m, N.tags), await t.delete(s(m)), await t.delete(n(m)), l += 1;
           }
-          p = h.list_complete ? void 0 : h.cursor;
-        } while (p);
+          v = h.list_complete ? void 0 : h.cursor;
+        } while (v);
       }
-      return i;
+      return l;
     },
-    async publishRefresh(e, t, i) {
-      return await a.get(r(e)) !== t ? !1 : (await x(e, i), await a.delete(r(e)), !0);
+    async publishRefresh(e, a, l) {
+      return await t.get(n(e)) !== a ? !1 : (await g(e, l), await t.delete(n(e)), !0);
     },
-    async releaseRefreshLease(e, t) {
-      await a.get(r(e)) === t && await a.delete(r(e));
+    async releaseRefreshLease(e, a) {
+      await t.get(n(e)) === a && await t.delete(n(e));
     },
-    async set(e, t) {
-      await x(e, t), await a.delete(r(e));
+    async set(e, a) {
+      await g(e, a), await t.delete(n(e));
     }
   };
 }
-function S(n) {
-  return n.staleUntil === null ? void 0 : P(n.staleUntil);
+function J(r) {
+  return r.staleUntil === null ? void 0 : $(r.staleUntil);
 }
-function P(n) {
-  return Math.ceil(n / 1e3);
+function $(r) {
+  return Math.ceil(r / 1e3);
 }
-const N = "demiurge:rate-limit:";
-function L(n) {
-  if (!n.namespace || typeof n.namespace.get != "function")
+const q = "demiurge:rate-limit:";
+function C(r) {
+  if (!r.namespace || typeof r.namespace.get != "function")
     throw new Error(
       "Demiurge KV rate limit store requires an EdgeKvNamespace. Pass a connected KV client matching the get/put/delete/list interface documented on EdgeKvNamespace."
     );
-  const a = n.namespace, d = n.keyPrefix ?? N;
-  function g(w) {
-    return `${d}${w}`;
+  const t = r.namespace, d = r.keyPrefix ?? q;
+  function w(f) {
+    return `${d}${f}`;
   }
   return {
-    async increment(w, m, o) {
-      const r = g(w), l = await a.get(r), s = l ? JSON.parse(l) : void 0, u = !s || s.resetAt <= o ? { count: 1, resetAt: o + m } : { count: s.count + 1, resetAt: s.resetAt };
-      return await a.put(r, JSON.stringify(u), {
-        expiration: b(u.resetAt)
+    async increment(f, c, s) {
+      const n = w(f), o = await t.get(n), i = o ? JSON.parse(o) : void 0, u = !i || i.resetAt <= s ? { count: 1, resetAt: s + c } : { count: i.count + 1, resetAt: i.resetAt };
+      return await t.put(n, JSON.stringify(u), {
+        expiration: V(u.resetAt)
       }), u;
     }
   };
 }
-function b(n) {
-  return Math.ceil(n / 1e3);
+function V(r) {
+  return Math.ceil(r / 1e3);
+}
+const D = "demiurge:session:";
+function I(r) {
+  if (!r.store || typeof r.store.get != "function")
+    throw new Error(
+      "Demiurge KV session store requires an EdgeKvSessionNamespace. Pass an application-owned KV client as `store`."
+    );
+  if (typeof r.store.atomic != "function")
+    throw new Error(
+      "Demiurge KV session store requires atomic compare-and-swap operations. Adapt the provider transaction API to EdgeKvSessionNamespace.atomic."
+    );
+  const t = r.store, d = R(r.namespace), w = `${r.keyPrefix ?? D}${d}:`, f = (c) => w + c;
+  return {
+    async create(c) {
+      const s = P(c, 0);
+      try {
+        return await t.atomic([x(f(s.id), null, s)]) ? { record: s, status: "stored" } : { status: "conflict" };
+      } catch {
+        return { status: "unavailable" };
+      }
+    },
+    async destroy(c) {
+      const s = f(c), n = await t.get(s);
+      return n === null ? !1 : await t.atomic([{ expected: n, key: s }]);
+    },
+    async read(c, s) {
+      const n = f(c), o = await t.get(n);
+      if (o === null)
+        return;
+      const i = K(o);
+      if (i) {
+        if (A(i) <= s) {
+          await t.atomic([{ expected: o, key: n }]);
+          return;
+        }
+        return i;
+      }
+    },
+    async rotate(c, s, n) {
+      const o = f(c), i = f(s.id), [u, y] = await Promise.all([
+        t.get(o),
+        o === i ? Promise.resolve(null) : t.get(i)
+      ]);
+      if (!u || i !== o && y !== null)
+        return { status: "conflict" };
+      const g = K(u);
+      if (!g || g.version !== n)
+        return { status: "conflict" };
+      const e = P(s, n + 1), a = o === i ? [x(o, u, e)] : [
+        { expected: u, key: o },
+        x(i, null, e)
+      ];
+      try {
+        return await t.atomic(a) ? { record: e, status: "stored" } : { status: "conflict" };
+      } catch {
+        return { status: "unavailable" };
+      }
+    },
+    async update(c, s) {
+      const n = f(c.id), o = await t.get(n), i = o ? K(o) : void 0;
+      if (!i || i.version !== s)
+        return { status: "conflict" };
+      const u = P(c, s + 1);
+      try {
+        return await t.atomic([
+          x(n, o, u)
+        ]) ? { record: u, status: "stored" } : { status: "conflict" };
+      } catch {
+        return { status: "unavailable" };
+      }
+    }
+  };
+}
+function x(r, t, d) {
+  return {
+    expected: t,
+    key: r,
+    write: {
+      options: { expiration: Math.ceil(A(d) / 1e3) },
+      value: JSON.stringify(d)
+    }
+  };
+}
+function K(r) {
+  try {
+    return b(JSON.parse(r));
+  } catch {
+    return;
+  }
+}
+function P(r, t) {
+  return structuredClone({ ...r, version: t });
+}
+function A(r) {
+  return Math.min(r.expiresAt, r.idleExpiresAt ?? r.expiresAt);
 }
 export {
-  A as createKvCacheStore,
-  L as createKvRateLimitStore
+  T as createKvCacheStore,
+  C as createKvRateLimitStore,
+  I as createKvSessionStore
 };
 //# sourceMappingURL=index.js.map