@demiurgejs/core 0.2.0-beta.3 → 0.2.0-beta.5

package/dist/security/exceptions.d.ts

@@ -0,0 +1,29 @@
+import type { BodySizeException, BodySizeValue, ContentSecurityPolicy, CspException, CsrfException, CsrfPolicy, CsrfPolicyOptions, RequestSecurityPolicy, RoutePolicy, SecurityException, SecurityPolicy } from "./types";
+/**
+ * Reports if a declaration is a typed security exception.
+ *
+ * An exception carries a `reason` and a `value`. No policy object of the
+ * framework uses both names, so the two fields identify the shape.
+ */
+export declare function isSecurityException(value: unknown): value is SecurityException<unknown>;
+/** Returns the Content-Security-Policy that a document declaration selects. */
+export declare function resolveCsp(csp: SecurityPolicy["csp"]): ContentSecurityPolicy | false | undefined;
+/** Returns the exception of a document declaration, or `undefined`. */
+export declare function getCspException(csp: SecurityPolicy["csp"]): CspException | undefined;
+/** Returns the CSRF policy that a route declaration selects. */
+export declare function resolveCsrf(csrf: CsrfPolicy | undefined): true | false | CsrfPolicyOptions | undefined;
+/** Returns the exception of a CSRF declaration, or `undefined`. */
+export declare function getCsrfException(csrf: CsrfPolicy | undefined): CsrfException | undefined;
+/** Returns the request body limit that a route declaration selects. */
+export declare function resolveMaxBodySize(maxBodySize: RequestSecurityPolicy["maxBodySize"]): BodySizeValue | undefined;
+/** Returns the exception of a body limit declaration, or `undefined`. */
+export declare function getBodySizeException(maxBodySize: RequestSecurityPolicy["maxBodySize"]): BodySizeException | undefined;
+/**
+ * Adds the declaring file to each exception of one policy file.
+ *
+ * The framework merges the policy cascade into one policy, and the merge
+ * keeps no file name. This function stamps the file before the merge, so the
+ * audit can report the source of each exception.
+ */
+export declare function attachExceptionSource(policy: RoutePolicy | undefined, source: string | undefined): RoutePolicy | undefined;
+//# sourceMappingURL=exceptions.d.ts.map

package/dist/security/exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/security/exceptions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACf,MAAM,SAAS,CAAC;AAEjB;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAMrC;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GACzB,qBAAqB,GAAG,KAAK,GAAG,SAAS,CAM3C;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAC7B,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,GACzB,YAAY,GAAG,SAAS,CAG1B;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CACzB,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,IAAI,GAAG,KAAK,GAAG,iBAAiB,GAAG,SAAS,CAM9C;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,GAAG,SAAS,GAC3B,aAAa,GAAG,SAAS,CAG3B;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,qBAAqB,CAAC,aAAa,CAAC,GAChD,aAAa,GAAG,SAAS,CAO3B;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,qBAAqB,CAAC,aAAa,CAAC,GAChD,iBAAiB,GAAG,SAAS,CAK/B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,GAAG,SAAS,CAazB"}

package/dist/security/finding-codes.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The diagnostic code vocabulary of Demiurge.
+ *
+ * ADR 0018 gives the build verifier and the runtime audit one vocabulary. A
+ * code names one condition. The build verifier reports a subset of the codes,
+ * because the build cannot read a value that only a request supplies.
+ */
+export type SecurityFindingCode = 
+/** The route inherits no access declaration. */
+"access-declaration-missing"
+/** The route runs each inherited authorization hook. */
+ | "access-authorized"
+/** An access exception removed each inherited authorization hook. */
+ | "access-exception"
+/** The route declares public access. */
+ | "access-public"
+/** The CORS policy is invalid. */
+ | "cors-invalid"
+/** The CORS policy names a method that the route does not serve. */
+ | "cors-method-unavailable"
+/** The document accepts no Content-Security-Policy. */
+ | "csp-disabled"
+/** A document script needs a nonce for the effective script-src policy. */
+ | "csp-script-missing-nonce"
+/** The effective script-src policy blocks a document script. */
+ | "csp-script-src-blocked"
+/** The route accepts no CSRF check for an unsafe method. */
+ | "csrf-disabled"
+/** The route inherits no document policy. */
+ | "document-policy-missing"
+/** The rate limit policy is invalid. */
+ | "rate-limit-invalid"
+/** The unsafe route declares no rate limit. */
+ | "rate-limit-missing"
+/** Trusted Types report-only mode has no deliverable target. */
+ | "report-only-target-missing"
+/** The route raises the inherited request body limit. */
+ | "request-body-limit-raised"
+/** Google Tag Manager is a wide trust boundary. */
+ | "script-gtm-wide-trust-boundary"
+/** A third-party script declares no integrity hash. */
+ | "script-integrity-missing"
+/** A third-party script declares no purpose. */
+ | "script-purpose-missing"
+/** A third-party script runs before the application is interactive. */
+ | "script-third-party-before-interactive"
+/** A security exception states no reason. */
+ | "security-exception-reason-missing"
+/** The security headers failed to render. */
+ | "security-header-render-failed";
+/**
+ * The codes that the build verifier reports. Each code is a member of
+ * `SecurityFindingCode`.
+ */
+export type StaticPolicyFindingCode = Extract<SecurityFindingCode, "access-declaration-missing" | "cors-invalid" | "cors-method-unavailable" | "document-policy-missing" | "rate-limit-invalid" | "security-exception-reason-missing" | "security-header-render-failed">;
+//# sourceMappingURL=finding-codes.d.ts.map

package/dist/security/finding-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-codes.d.ts","sourceRoot":"","sources":["../../src/security/finding-codes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB;AAC7B,gDAAgD;AAC9C,4BAA4B;AAC9B,wDAAwD;GACtD,mBAAmB;AACrB,qEAAqE;GACnE,kBAAkB;AACpB,wCAAwC;GACtC,eAAe;AACjB,kCAAkC;GAChC,cAAc;AAChB,oEAAoE;GAClE,yBAAyB;AAC3B,uDAAuD;GACrD,cAAc;AAChB,2EAA2E;GACzE,0BAA0B;AAC5B,gEAAgE;GAC9D,wBAAwB;AAC1B,4DAA4D;GAC1D,eAAe;AACjB,6CAA6C;GAC3C,yBAAyB;AAC3B,wCAAwC;GACtC,oBAAoB;AACtB,+CAA+C;GAC7C,oBAAoB;AACtB,gEAAgE;GAC9D,4BAA4B;AAC9B,yDAAyD;GACvD,2BAA2B;AAC7B,mDAAmD;GACjD,gCAAgC;AAClC,uDAAuD;GACrD,0BAA0B;AAC5B,gDAAgD;GAC9C,wBAAwB;AAC1B,uEAAuE;GACrE,uCAAuC;AACzC,6CAA6C;GAC3C,mCAAmC;AACrC,6CAA6C;GAC3C,+BAA+B,CAAC;AAEpC;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC3C,mBAAmB,EACjB,4BAA4B,GAC5B,cAAc,GACd,yBAAyB,GACzB,yBAAyB,GACzB,oBAAoB,GACpB,mCAAmC,GACnC,+BAA+B,CAClC,CAAC"}

package/dist/security/index.d.ts

@@ -1,23 +1,34 @@
 export { auditScriptDependencies, createSecurityAudit, } from "./audit";
+export { authorizeRoute, defineAuthorization, mergeRouteAccess, permitsRequest, resolveRouteAccess, } from "./authorization";
 export { applyCorsHeaders, createCorsHeaders, createCorsPreflightResponse, validateCorsPolicy, } from "./cors";
 export { createSecureCookie, readSecureCookie, secureCookieName, validateSecureCookie, } from "./cookies";
 export type { CookieIssue, CookieIssueCode, CookieSameSite, CookieScope, SecureCookieDeclaration, SecureCookieDefinition, } from "./cookies";
+export { createEncryptedCookieSession, createSignedCookieSession, } from "./cookie-session";
+export type { CookieSession, CookieSessionCreateOptions, CookieSessionManager, CookieSessionOptions, SessionCookieDefinition, SessionCookieKey, } from "./cookie-session";
 export { createCsrfCookie, createCsrfToken, enforceCsrfProtection, issueCsrfToken, parseCookieHeader, } from "./csrf";
 export type { CsrfCookieOptions, IssuedCsrfToken } from "./csrf";
 export { applyFetchMetadataVary, checkFetchMetadata, enforceFetchMetadataPolicy, } from "./fetch-metadata";
 export type { FetchMetadataEnforcement } from "./fetch-metadata";
 export { EnvValidationError, defineEnvSchema, env, validateEnv, } from "./env";
+export { deserializeEnvSchema, readEnv, resetEnvironment as unstable_resetEnvironment, serializeEnvSchema, startEnvironment as unstable_startEnvironment, } from "./env-startup";
+export type { EnvStartupOptions, EnvStartupResult, } from "./env-startup";
 export { createSecurityHeaders, cspNonce, cspHash, defineRoutePolicy, defineSecurityPolicy, mergeRoutePolicies, mergeRouteSecurityPolicies, mergeSecurityPolicies, security, } from "./policy";
 export { createMemoryRateLimitStore, enforceRateLimit, parseRateLimitWindow, validateRateLimitPolicy, } from "./rate-limit";
+export { createMemorySessionStore, parseSessionRecord, serializeSessionNamespace, } from "./session-store";
+export { createSessionManager, SessionStoreConflictError, SessionStoreUnavailableError, } from "./session-manager";
+export type { ServerSession, SessionManager, SessionManagerOptions, } from "./session-manager";
+export type { MemorySessionStoreOptions, SessionData, SessionNamespace, SessionPrimitive, SessionRecord, SessionStore, SessionStoreCandidate, SessionStoreWriteResult, } from "./session-store";
 export { createSecurityReportHandler, } from "./report";
-export { enforceAllowedMethods, enforceRequestSecurity, parseBodySize, } from "./request";
+export { DEFAULT_MAX_BODY_SIZE, enforceAllowedMethods, enforceRequestSecurity, parseBodySize, } from "./request";
 export { validateUploads, } from "./upload";
 export { validateRouteModules } from "./verification";
 export type { RouteModuleVerificationOptions } from "./verification";
 export { checkWebSocketOrigin, enforceWebSocketOrigin, } from "./websocket";
-export type { ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, FetchMetadataCheck, FetchMetadataDestination, FetchMetadataPolicy, FetchMetadataPolicyOptions, FetchMetadataReason, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityAuditOptions, ScriptDependencyAuditOptions, RequestSecurityPolicy, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
+export type { AuthorizationDecision, AuthorizationDenial, AuthorizationDenialStatus, ContentSecurityPolicy, CorsPolicy, CorsRequestContext, CorsResponseOptions, CsrfPolicy, CspHashAlgorithm, CspDirectiveValue, CspDirectiveReplacement, CspSource, CspSourceDirective, FetchMetadataCheck, FetchMetadataDestination, FetchMetadataPolicy, FetchMetadataPolicyOptions, FetchMetadataReason, BodySizeException, BodySizeValue, CspException, CsrfException, CsrfPolicyOptions, MemoryRateLimitStoreOptions, RateLimitKey, RateLimitPolicy, RateLimitResult, RateLimitStore, ReferrerPolicy, ReportingEndpointUrl, ReportingEndpoints, SecurityAudit, SecurityAuditFinding, SecurityException, SecurityExceptionOrigin, SecurityAuditOptions, ScriptDependencyAuditOptions, MergedRoutePolicy, RequestSecurityPolicy, ResolvedRouteAccess, RouteAccessException, RouteAccessPolicy, RouteAccessSource, RouteAuthorizationEntry, RouteAuthorizationHook, RoutePolicy, RouteSecurityNeeds, RouteSecurityPolicy, SecurityHeadersOptions, SecurityHeaderPolicy, SecurityPolicy, SecurityPreset, StrictTransportSecurityPolicy, TrustedTypesPolicy, } from "./types";
+export type { SecurityFindingCode, StaticPolicyFindingCode, } from "./finding-codes";
+export { attachExceptionSource, getBodySizeException, getCspException, getCsrfException, isSecurityException, resolveCsp, resolveCsrf, resolveMaxBodySize, } from "./exceptions";
 export type { UploadFilePolicy, UploadPolicy, UploadValidationIssue, UploadValidationResult, } from "./upload";
-export type { EnvSchema, EnvSource, EnvValidationIssue, EnvVariable, InferEnvSchema, } from "./env";
+export type { EnvSchema, EnvSchemaDescriptor, EnvSource, EnvValidationIssue, EnvVariable, EnvVariableDescriptor, EnvVariableKind, InferEnvSchema, } from "./env";
 export type { SecurityReportContext, SecurityReportHandlerOptions, SecurityReportPayload, } from "./report";
 export type { WebSocketOriginCheck, WebSocketOriginPolicy, } from "./websocket";
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,GAAG,EACH,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,cAAc,GACf,MAAM,OAAO,CAAC;AACf,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,GAAG,EACH,WAAW,GACZ,MAAM,OAAO,CAAC;AACf,OAAO,EACL,oBAAoB,EACpB,OAAO,EACP,gBAAgB,IAAI,yBAAyB,EAC7C,kBAAkB,EAClB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,QAAQ,EACR,OAAO,EACP,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,aAAa,EACb,cAAc,EACd,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,yBAAyB,EACzB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,OAAO,CAAC;AACf,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,UAAU,CAAC;AAClB,YAAY,EACV,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/security/policy.d.ts

@@ -1,4 +1,4 @@
-import type { CspHashAlgorithm, RoutePolicy, RouteSecurityPolicy, SecurityHeadersOptions, SecurityPolicy, SecurityPreset } from "./types";
+import type { CspHashAlgorithm, MergedRoutePolicy, RoutePolicy, RouteSecurityPolicy, SecurityHeadersOptions, SecurityPolicy, SecurityPreset } from "./types";
 export declare const cspNonce: "'nonce-{nonce}'";
 export declare const security: {
     api(options?: SecurityPolicy): SecurityPolicy;
@@ -10,10 +10,7 @@ export declare const security: {
 export declare function defineSecurityPolicy(policy: SecurityPolicy): SecurityPolicy;
 export declare function defineRoutePolicy(policy: RoutePolicy): RoutePolicy;
 export declare function mergeSecurityPolicies(...policies: Array<SecurityPolicy | false | undefined>): SecurityPolicy;
-export declare function mergeRoutePolicies(...policies: Array<RoutePolicy | false | undefined>): {
-    document: SecurityPolicy | undefined;
-    security?: RouteSecurityPolicy;
-};
+export declare function mergeRoutePolicies(...policies: Array<RoutePolicy | false | undefined>): MergedRoutePolicy;
 export declare function mergeRouteSecurityPolicies(...policies: Array<RouteSecurityPolicy | false | undefined>): RouteSecurityPolicy;
 export declare function cspHash(source: string, algorithm?: CspHashAlgorithm): Promise<string>;
 export declare function createSecurityHeaders(policy: SecurityPolicy, options?: SecurityHeadersOptions): Headers;

package/dist/security/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/security/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,gBAAgB,EAGhB,WAAW,EAEX,mBAAmB,EACnB,sBAAsB,EAEtB,cAAc,EACd,cAAc,EAGf,MAAM,SAAS,CAAC;AAKjB,eAAO,MAAM,QAAQ,mBAAmC,CAAC;AAyCzD,eAAO,MAAM,QAAQ;kBACN,cAAc;iBAQd,cAAc,YAAW,cAAc;qBAepC,cAAc;qBASd,cAAc;kCASD,cAAc;CAW5C,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,kBAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,eAEpD;AAED,wBAAgB,qBAAqB,CACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC,kBASvD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,QAAQ,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;;;EAiBpD;AAED,wBAAgB,0BAA0B,CACxC,GAAG,QAAQ,EAAE,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,SAAS,CAAC,uBAe5D;AAyFD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,gBAA2B,mBAQvC;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,WAsCrC;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GAAG,KAAK,GAAG,SAAS,WAY3C;AAED,wBAAgB,cAAc,WAK7B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/security/policy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,gBAAgB,EAGhB,iBAAiB,EACjB,WAAW,EAEX,mBAAmB,EACnB,sBAAsB,EAEtB,cAAc,EACd,cAAc,EAGf,MAAM,SAAS,CAAC;AAKjB,eAAO,MAAM,QAAQ,mBAAmC,CAAC;AAyCzD,eAAO,MAAM,QAAQ;kBACN,cAAc;iBAQd,cAAc,YAAW,cAAc;qBAepC,cAAc;qBASd,cAAc;kCASD,cAAc;CAW5C,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,kBAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,eAEpD;AAED,wBAAgB,qBAAqB,CACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,cAAc,GAAG,KAAK,GAAG,SAAS,CAAC,kBASvD;AAED,wBAAgB,kBAAkB,CAChC,GAAG,QAAQ,EAAE,KAAK,CAAC,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC,GAClD,iBAAiB,CAqBnB;AAED,wBAAgB,0BAA0B,CACxC,GAAG,QAAQ,EAAE,KAAK,CAAC,mBAAmB,GAAG,KAAK,GAAG,SAAS,CAAC,uBAe5D;AA2FD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,gBAA2B,mBAQvC;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,WAsCrC;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,GAAG,KAAK,GAAG,SAAS,WAc3C;AAED,wBAAgB,cAAc,WAK7B"}

package/dist/security/report.d.ts

@@ -1,7 +1,8 @@
+import type { BodySizeValue } from "./types";
 type MaybePromise<T> = Promise<T> | T;
 export type SecurityReportPayload = unknown;
 export type SecurityReportHandlerOptions = {
-    maxBodySize?: number | `${number}${"b" | "gb" | "kb" | "mb"}`;
+    maxBodySize?: BodySizeValue;
     onReport?: (report: SecurityReportPayload, context: SecurityReportContext) => MaybePromise<void>;
 };
 export type SecurityReportContext = {

package/dist/security/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/security/report.ts"],"names":[],"mappings":"AAMA,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE5C,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,CAAC,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAC9D,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,qBAAqB,KAC3B,YAAY,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,IAEC,SAAS,OAAO,uBAqD5D"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../src/security/report.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,KAAK,YAAY,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEtC,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE5C,MAAM,MAAM,4BAA4B,GAAG;IACzC,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,EAAE,CACT,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,qBAAqB,KAC3B,YAAY,CAAC,IAAI,CAAC,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,IAEC,SAAS,OAAO,uBAqD5D"}

package/dist/security/request.d.ts

@@ -1,5 +1,6 @@
 import type { HttpMethod } from "../route/types";
 import type { RequestSecurityPolicy } from "./types";
+export declare const DEFAULT_MAX_BODY_SIZE: "1mb";
 export declare function enforceRequestSecurity(policy: RequestSecurityPolicy | undefined, request: Request, method: HttpMethod): Response | null;
 export declare class RequestBodyTooLargeError extends Error {
     constructor();

package/dist/security/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAUrD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,mBAmCnB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,WAoDjB;AAED,wBAAgB,2BAA2B,aAE1C;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,MAAM,EAAE,UAAU,mBAgBnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UA2BnD"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/security/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAcrD,eAAO,MAAM,qBAAqB,EAAG,KAAc,CAAC;AAEpD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,mBA+BnB;AAED,qBAAa,wBAAyB,SAAQ,KAAK;;CAKlD;AAED,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,OAAO,EAAE,OAAO,WAoDjB;AAED,wBAAgB,2BAA2B,aAE1C;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,MAAM,EAAE,UAAU,mBAgBnB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,UA2BnD"}

package/dist/security/session-manager.d.ts

@@ -0,0 +1,32 @@
+import type { CookieSessionCreateOptions, SessionCookieDefinition, SessionCookieKey } from "./cookie-session";
+import type { SessionData, SessionRecord, SessionStore } from "./session-store";
+export type SessionManagerOptions<TData extends SessionData> = {
+    absoluteExpirationMs?: number;
+    cookie?: SessionCookieDefinition;
+    idleExpirationMs?: false | number;
+    keys: readonly SessionCookieKey[];
+    now?: () => number;
+    randomBytes?: (length: number) => Uint8Array;
+    renewal?: boolean;
+    store: SessionStore<TData>;
+};
+export type ServerSession<TData extends SessionData> = {
+    commit: () => Promise<readonly string[]>;
+    create: (data: TData, options?: CookieSessionCreateOptions) => Promise<SessionRecord<TData>>;
+    destroy: () => Promise<void>;
+    get: () => SessionRecord<TData> | undefined;
+    rotate: (data?: TData) => Promise<SessionRecord<TData>>;
+    update: (data: TData) => Promise<SessionRecord<TData>>;
+};
+export type SessionManager<TData extends SessionData> = {
+    cookieName: string;
+    open: (request: Request) => Promise<ServerSession<TData>>;
+};
+export declare class SessionStoreConflictError extends Error {
+    constructor(operation: string);
+}
+export declare class SessionStoreUnavailableError extends Error {
+    constructor(operation: string);
+}
+export declare function createSessionManager<TData extends SessionData>(input: SessionManagerOptions<TData>): SessionManager<TData>;
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/security/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/security/session-manager.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,YAAY,EAEb,MAAM,iBAAiB,CAAC;AAKzB,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,WAAW,IAAI;IAC7D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,gBAAgB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAClC,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IAC7C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,WAAW,IAAI;IACrD,MAAM,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,EAAE,CACN,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,0BAA0B,KACjC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,WAAW,IAAI;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC3D,CAAC;AAEF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,SAAS,EAAE,MAAM;CAM9B;AAED,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,SAAS,EAAE,MAAM;CAM9B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,SAAS,WAAW,EAC5D,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAClC,cAAc,CAAC,KAAK,CAAC,CAkKvB"}

package/dist/security/session-store.d.ts

@@ -0,0 +1,51 @@
+export type SessionPrimitive = boolean | null | number | string;
+export type SessionData = SessionPrimitive | {
+    readonly [key: string]: SessionData;
+} | readonly SessionData[];
+export type SessionNamespace = {
+    app: string;
+    environment: string;
+    schemaVersion: number | string;
+};
+export type SessionRecord<TData extends SessionData = SessionData> = {
+    createdAt: number;
+    data: TData;
+    expiresAt: number;
+    id: string;
+    idleExpiresAt?: number;
+    version: number;
+};
+export type SessionStoreCandidate<TData extends SessionData = SessionData> = Omit<SessionRecord<TData>, "version">;
+export type SessionStoreWriteResult<TData extends SessionData = SessionData> = {
+    record: SessionRecord<TData>;
+    status: "stored";
+} | {
+    status: "conflict";
+} | {
+    status: "unavailable";
+};
+type MaybePromise<T> = T | Promise<T>;
+export type SessionStore<TData extends SessionData = SessionData> = {
+    create: (candidate: SessionStoreCandidate<TData>) => MaybePromise<SessionStoreWriteResult<TData>>;
+    destroy: (id: string) => MaybePromise<boolean>;
+    read: (id: string, now: number) => MaybePromise<SessionRecord<TData> | undefined>;
+    rotate: (currentId: string, candidate: SessionStoreCandidate<TData>, expectedVersion: number) => MaybePromise<SessionStoreWriteResult<TData>>;
+    update: (candidate: SessionStoreCandidate<TData>, expectedVersion: number) => MaybePromise<SessionStoreWriteResult<TData>>;
+};
+export type MemorySessionStoreOptions<TData extends SessionData = SessionData> = {
+    entries?: Map<string, SessionRecord<TData>>;
+    namespace: SessionNamespace;
+};
+export declare function createMemorySessionStore<TData extends SessionData = SessionData>(options: MemorySessionStoreOptions<TData>): SessionStore<TData>;
+/**
+ * Validates that an untrusted parsed value conforms to the `SessionRecord`
+ * envelope before it is trusted as a session. Backend session stores read
+ * raw JSON from shared infrastructure (KV, Redis) that a corrupted entry,
+ * manual edit, or deployment version skew could have produced, so the shape
+ * must be proven rather than assumed. Mirrors the validation cookie-session
+ * applies to its own decoded payloads.
+ */
+export declare function parseSessionRecord<TData extends SessionData = SessionData>(value: unknown): SessionRecord<TData> | undefined;
+export declare function serializeSessionNamespace(namespace: SessionNamespace): string;
+export {};
+//# sourceMappingURL=session-store.d.ts.map

package/dist/security/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/security/session-store.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,MAAM,WAAW,GACnB,gBAAgB,GAChB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,GACvC,SAAS,WAAW,EAAE,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IACvE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;AAExC,MAAM,MAAM,uBAAuB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IACvE;IAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AAE9B,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI;IAClE,MAAM,EAAE,CACN,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,KACpC,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,EAAE,CACJ,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,KACR,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,EAAE,CACN,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,EACvC,eAAe,EAAE,MAAM,KACpB,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,CACN,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,EACvC,eAAe,EAAE,MAAM,KACpB,YAAY,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,yBAAyB,CACnC,KAAK,SAAS,WAAW,GAAG,WAAW,IACrC;IACF,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,gBAAgB,CAAC;CAC7B,CAAC;AAEF,wBAAgB,wBAAwB,CACtC,KAAK,SAAS,WAAW,GAAG,WAAW,EACvC,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAkEhE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,EACxE,KAAK,EAAE,OAAO,GACb,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,CAiBlC;AAkCD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,UAsBpE"}

package/dist/security/testing.d.ts

@@ -0,0 +1,10 @@
+import type { SessionData, SessionNamespace, SessionStore } from "./session-store";
+type MaybePromise<T> = T | Promise<T>;
+export type SessionStoreFactory<TData extends SessionData = SessionData> = (namespace: SessionNamespace) => MaybePromise<SessionStore<TData>>;
+type ContractData = {
+    authenticated: boolean;
+    name: string;
+};
+export declare function verifySessionStoreContract(createStore: SessionStoreFactory<ContractData>): Promise<void>;
+export {};
+//# sourceMappingURL=testing.d.ts.map

package/dist/security/testing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../src/security/testing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,gBAAgB,EAEhB,YAAY,EAEb,MAAM,iBAAiB,CAAC;AAEzB,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,WAAW,GAAG,WAAW,IAAI,CACzE,SAAS,EAAE,gBAAgB,KACxB,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvC,KAAK,YAAY,GAAG;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,mBAAmB,CAAC,YAAY,CAAC,iBAsJ/C"}

package/dist/security/testing.js

@@ -0,0 +1,145 @@
+async function S(o) {
+  const t = `${Date.now()}-${Math.random()}`, n = {
+    app: `contract-${t}`,
+    environment: "test",
+    schemaVersion: 1
+  }, m = {
+    ...n,
+    environment: "isolated"
+  }, a = await o(n), l = await o(n), f = await o(m), r = Date.now(), i = p(`session-${t}`, r, {
+    authenticated: !1,
+    name: "alpha"
+  }), d = p(`rotated-${t}`, r, {
+    authenticated: !0,
+    name: "alpha"
+  });
+  try {
+    e(
+      await a.read(i.id, r) === void 0,
+      "read() must return undefined for a missing identifier"
+    );
+    const x = await a.create(i);
+    s(x, "create() must store a missing identifier"), b(
+      await l.read(i.id, r),
+      { ...i, version: 0 },
+      "create() must make a record available to another store instance"
+    ), e(
+      (await a.create(i)).status === "conflict",
+      "create() must report a conflict for an existing identifier"
+    ), e(
+      await f.read(i.id, r) === void 0,
+      "a namespace must not read another namespace's record"
+    );
+    const g = await f.create({
+      ...i,
+      data: { authenticated: !1, name: "isolated" }
+    });
+    s(
+      g,
+      "create() must allow the same identifier in another namespace"
+    );
+    const $ = {
+      ...i,
+      data: { authenticated: !0, name: "beta" }
+    }, h = await l.update($, 0);
+    s(h, "update() must replace the expected version"), e(
+      h.record.version === 1,
+      "update() must increment the stored version"
+    ), e(
+      (await a.update(i, 0)).status === "conflict",
+      "update() must reject an obsolete version"
+    );
+    const w = await Promise.all([
+      a.rotate(i.id, d, 1),
+      l.rotate(
+        i.id,
+        { ...d, id: `${d.id}-competitor` },
+        1
+      )
+    ]);
+    e(
+      w.filter((u) => u.status === "stored").length === 1,
+      "only one concurrent rotation can succeed"
+    ), e(
+      w.filter((u) => u.status === "conflict").length === 1,
+      "one concurrent rotation must report a conflict"
+    ), e(
+      await a.read(i.id, r) === void 0,
+      "rotation must invalidate the previous identifier"
+    );
+    const c = w.find(
+      (u) => u.status === "stored"
+    );
+    s(c, "rotation must return its stored record"), e(
+      c.record.version === 2,
+      "rotation must increment the stored version"
+    ), e(
+      await l.destroy(c.record.id),
+      "destroy() must remove an existing identifier"
+    ), e(
+      await a.read(c.record.id, r) === void 0,
+      "destroy() must revoke a session for another store instance"
+    ), e(
+      !await a.destroy(c.record.id),
+      "destroy() must report a missing identifier"
+    );
+    const v = p(`expired-${t}`, r, {
+      authenticated: !1,
+      name: "expired"
+    }, -1);
+    s(
+      await a.create(v),
+      "create() must accept a record before read-time expiration checks"
+    ), e(
+      await a.read(v.id, r) === void 0,
+      "read() must not return an absolutely expired record"
+    );
+    const y = {
+      ...p(`idle-${t}`, r, {
+        authenticated: !1,
+        name: "idle"
+      }),
+      idleExpiresAt: r - 1
+    };
+    s(
+      await a.create(y),
+      "create() must accept a record with idle expiration"
+    ), e(
+      await a.read(y.id, r) === void 0,
+      "read() must not return an idle-expired record"
+    );
+  } finally {
+    await Promise.all([
+      a.destroy(i.id),
+      a.destroy(d.id),
+      a.destroy(`${d.id}-competitor`),
+      f.destroy(i.id)
+    ]);
+  }
+}
+function p(o, t, n, m = 6e4) {
+  return {
+    createdAt: t,
+    data: n,
+    expiresAt: t + m,
+    id: o,
+    idleExpiresAt: t + m
+  };
+}
+function s(o, t) {
+  e(o?.status === "stored", t);
+}
+function b(o, t, n) {
+  e(
+    JSON.stringify(o) === JSON.stringify(t),
+    n
+  );
+}
+function e(o, t) {
+  if (!o)
+    throw new Error(`Session store contract failed: ${t}.`);
+}
+export {
+  S as verifySessionStoreContract
+};
+//# sourceMappingURL=testing.js.map

package/dist/security/testing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testing.js","sources":["../../src/security/testing.ts"],"sourcesContent":["import type {\n  SessionData,\n  SessionNamespace,\n  SessionRecord,\n  SessionStore,\n  SessionStoreCandidate,\n} from \"./session-store\";\n\ntype MaybePromise<T> = T | Promise<T>;\n\nexport type SessionStoreFactory<TData extends SessionData = SessionData> = (\n  namespace: SessionNamespace,\n) => MaybePromise<SessionStore<TData>>;\n\ntype ContractData = {\n  authenticated: boolean;\n  name: string;\n};\n\nexport async function verifySessionStoreContract(\n  createStore: SessionStoreFactory<ContractData>,\n) {\n  const token = `${Date.now()}-${Math.random()}`;\n  const namespace = {\n    app: `contract-${token}`,\n    environment: \"test\",\n    schemaVersion: 1,\n  } satisfies SessionNamespace;\n  const isolatedNamespace = {\n    ...namespace,\n    environment: \"isolated\",\n  } satisfies SessionNamespace;\n  const store = await createStore(namespace);\n  const secondReplica = await createStore(namespace);\n  const isolatedStore = await createStore(isolatedNamespace);\n  const now = Date.now();\n  const original = candidate(`session-${token}`, now, {\n    authenticated: false,\n    name: \"alpha\",\n  });\n  const rotated = candidate(`rotated-${token}`, now, {\n    authenticated: true,\n    name: \"alpha\",\n  });\n\n  try {\n    assert(\n      await store.read(original.id, now) === undefined,\n      \"read() must return undefined for a missing identifier\",\n    );\n\n    const created = await store.create(original);\n    assertStored(created, \"create() must store a missing identifier\");\n    assertRecord(\n      await secondReplica.read(original.id, now),\n      { ...original, version: 0 },\n      \"create() must make a record available to another store instance\",\n    );\n\n    assert(\n      (await store.create(original)).status === \"conflict\",\n      \"create() must report a conflict for an existing identifier\",\n    );\n    assert(\n      await isolatedStore.read(original.id, now) === undefined,\n      \"a namespace must not read another namespace's record\",\n    );\n\n    const isolatedCreated = await isolatedStore.create({\n      ...original,\n      data: { authenticated: false, name: \"isolated\" },\n    });\n    assertStored(\n      isolatedCreated,\n      \"create() must allow the same identifier in another namespace\",\n    );\n\n    const updatedCandidate = {\n      ...original,\n      data: { authenticated: true, name: \"beta\" },\n    } satisfies SessionStoreCandidate<ContractData>;\n    const updated = await secondReplica.update(updatedCandidate, 0);\n    assertStored(updated, \"update() must replace the expected version\");\n    assert(\n      updated.record.version === 1,\n      \"update() must increment the stored version\",\n    );\n    assert(\n      (await store.update(original, 0)).status === \"conflict\",\n      \"update() must reject an obsolete version\",\n    );\n\n    const rotations = await Promise.all([\n      store.rotate(original.id, rotated, 1),\n      secondReplica.rotate(\n        original.id,\n        { ...rotated, id: `${rotated.id}-competitor` },\n        1,\n      ),\n    ]);\n    assert(\n      rotations.filter((result) => result.status === \"stored\").length === 1,\n      \"only one concurrent rotation can succeed\",\n    );\n    assert(\n      rotations.filter((result) => result.status === \"conflict\").length === 1,\n      \"one concurrent rotation must report a conflict\",\n    );\n    assert(\n      await store.read(original.id, now) === undefined,\n      \"rotation must invalidate the previous identifier\",\n    );\n\n    const successfulRotation = rotations.find(\n      (result) => result.status === \"stored\",\n    );\n    assertStored(successfulRotation, \"rotation must return its stored record\");\n    assert(\n      successfulRotation.record.version === 2,\n      \"rotation must increment the stored version\",\n    );\n    assert(\n      await secondReplica.destroy(successfulRotation.record.id),\n      \"destroy() must remove an existing identifier\",\n    );\n    assert(\n      await store.read(successfulRotation.record.id, now) === undefined,\n      \"destroy() must revoke a session for another store instance\",\n    );\n    assert(\n      !await store.destroy(successfulRotation.record.id),\n      \"destroy() must report a missing identifier\",\n    );\n\n    const expired = candidate(`expired-${token}`, now, {\n      authenticated: false,\n      name: \"expired\",\n    }, -1);\n    assertStored(\n      await store.create(expired),\n      \"create() must accept a record before read-time expiration checks\",\n    );\n    assert(\n      await store.read(expired.id, now) === undefined,\n      \"read() must not return an absolutely expired record\",\n    );\n\n    const idleExpired = {\n      ...candidate(`idle-${token}`, now, {\n        authenticated: false,\n        name: \"idle\",\n      }),\n      idleExpiresAt: now - 1,\n    };\n    assertStored(\n      await store.create(idleExpired),\n      \"create() must accept a record with idle expiration\",\n    );\n    assert(\n      await store.read(idleExpired.id, now) === undefined,\n      \"read() must not return an idle-expired record\",\n    );\n  } finally {\n    await Promise.all([\n      store.destroy(original.id),\n      store.destroy(rotated.id),\n      store.destroy(`${rotated.id}-competitor`),\n      isolatedStore.destroy(original.id),\n    ]);\n  }\n}\n\nfunction candidate(\n  id: string,\n  now: number,\n  data: ContractData,\n  expirationOffset = 60_000,\n): SessionStoreCandidate<ContractData> {\n  return {\n    createdAt: now,\n    data,\n    expiresAt: now + expirationOffset,\n    id,\n    idleExpiresAt: now + expirationOffset,\n  };\n}\n\nfunction assertStored<TData extends SessionData>(\n  result:\n    | Awaited<ReturnType<SessionStore<TData>[\"create\"]>>\n    | undefined,\n  requirement: string,\n): asserts result is { record: SessionRecord<TData>; status: \"stored\" } {\n  assert(result?.status === \"stored\", requirement);\n}\n\nfunction assertRecord<TData extends SessionData>(\n  actual: SessionRecord<TData> | undefined,\n  expected: SessionRecord<TData>,\n  requirement: string,\n) {\n  assert(\n    JSON.stringify(actual) === JSON.stringify(expected),\n    requirement,\n  );\n}\n\nfunction assert(condition: boolean, requirement: string): asserts condition {\n  if (!condition) {\n    throw new Error(`Session store contract failed: ${requirement}.`);\n  }\n}\n"],"names":["verifySessionStoreContract","createStore","token","namespace","isolatedNamespace","store","secondReplica","isolatedStore","now","original","candidate","rotated","assert","created","assertStored","assertRecord","isolatedCreated","updatedCandidate","updated","rotations","result","successfulRotation","expired","idleExpired","id","data","expirationOffset","requirement","actual","expected","condition"],"mappings":"AAmBA,eAAsBA,EACpBC,GACA;AACA,QAAMC,IAAQ,GAAG,KAAK,IAAA,CAAK,IAAI,KAAK,QAAQ,IACtCC,IAAY;AAAA,IAChB,KAAK,YAAYD,CAAK;AAAA,IACtB,aAAa;AAAA,IACb,eAAe;AAAA,EAAA,GAEXE,IAAoB;AAAA,IACxB,GAAGD;AAAA,IACH,aAAa;AAAA,EAAA,GAETE,IAAQ,MAAMJ,EAAYE,CAAS,GACnCG,IAAgB,MAAML,EAAYE,CAAS,GAC3CI,IAAgB,MAAMN,EAAYG,CAAiB,GACnDI,IAAM,KAAK,IAAA,GACXC,IAAWC,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,IAClD,eAAe;AAAA,IACf,MAAM;AAAA,EAAA,CACP,GACKG,IAAUD,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,IACjD,eAAe;AAAA,IACf,MAAM;AAAA,EAAA,CACP;AAED,MAAI;AACF,IAAAI;AAAA,MACE,MAAMP,EAAM,KAAKI,EAAS,IAAID,CAAG,MAAM;AAAA,MACvC;AAAA,IAAA;AAGF,UAAMK,IAAU,MAAMR,EAAM,OAAOI,CAAQ;AAC3C,IAAAK,EAAaD,GAAS,0CAA0C,GAChEE;AAAA,MACE,MAAMT,EAAc,KAAKG,EAAS,IAAID,CAAG;AAAA,MACzC,EAAE,GAAGC,GAAU,SAAS,EAAA;AAAA,MACxB;AAAA,IAAA,GAGFG;AAAA,OACG,MAAMP,EAAM,OAAOI,CAAQ,GAAG,WAAW;AAAA,MAC1C;AAAA,IAAA,GAEFG;AAAA,MACE,MAAML,EAAc,KAAKE,EAAS,IAAID,CAAG,MAAM;AAAA,MAC/C;AAAA,IAAA;AAGF,UAAMQ,IAAkB,MAAMT,EAAc,OAAO;AAAA,MACjD,GAAGE;AAAA,MACH,MAAM,EAAE,eAAe,IAAO,MAAM,WAAA;AAAA,IAAW,CAChD;AACD,IAAAK;AAAA,MACEE;AAAA,MACA;AAAA,IAAA;AAGF,UAAMC,IAAmB;AAAA,MACvB,GAAGR;AAAA,MACH,MAAM,EAAE,eAAe,IAAM,MAAM,OAAA;AAAA,IAAO,GAEtCS,IAAU,MAAMZ,EAAc,OAAOW,GAAkB,CAAC;AAC9D,IAAAH,EAAaI,GAAS,4CAA4C,GAClEN;AAAA,MACEM,EAAQ,OAAO,YAAY;AAAA,MAC3B;AAAA,IAAA,GAEFN;AAAA,OACG,MAAMP,EAAM,OAAOI,GAAU,CAAC,GAAG,WAAW;AAAA,MAC7C;AAAA,IAAA;AAGF,UAAMU,IAAY,MAAM,QAAQ,IAAI;AAAA,MAClCd,EAAM,OAAOI,EAAS,IAAIE,GAAS,CAAC;AAAA,MACpCL,EAAc;AAAA,QACZG,EAAS;AAAA,QACT,EAAE,GAAGE,GAAS,IAAI,GAAGA,EAAQ,EAAE,cAAA;AAAA,QAC/B;AAAA,MAAA;AAAA,IACF,CACD;AACD,IAAAC;AAAA,MACEO,EAAU,OAAO,CAACC,MAAWA,EAAO,WAAW,QAAQ,EAAE,WAAW;AAAA,MACpE;AAAA,IAAA,GAEFR;AAAA,MACEO,EAAU,OAAO,CAACC,MAAWA,EAAO,WAAW,UAAU,EAAE,WAAW;AAAA,MACtE;AAAA,IAAA,GAEFR;AAAA,MACE,MAAMP,EAAM,KAAKI,EAAS,IAAID,CAAG,MAAM;AAAA,MACvC;AAAA,IAAA;AAGF,UAAMa,IAAqBF,EAAU;AAAA,MACnC,CAACC,MAAWA,EAAO,WAAW;AAAA,IAAA;AAEhC,IAAAN,EAAaO,GAAoB,wCAAwC,GACzET;AAAA,MACES,EAAmB,OAAO,YAAY;AAAA,MACtC;AAAA,IAAA,GAEFT;AAAA,MACE,MAAMN,EAAc,QAAQe,EAAmB,OAAO,EAAE;AAAA,MACxD;AAAA,IAAA,GAEFT;AAAA,MACE,MAAMP,EAAM,KAAKgB,EAAmB,OAAO,IAAIb,CAAG,MAAM;AAAA,MACxD;AAAA,IAAA,GAEFI;AAAA,MACE,CAAC,MAAMP,EAAM,QAAQgB,EAAmB,OAAO,EAAE;AAAA,MACjD;AAAA,IAAA;AAGF,UAAMC,IAAUZ,EAAU,WAAWR,CAAK,IAAIM,GAAK;AAAA,MACjD,eAAe;AAAA,MACf,MAAM;AAAA,IAAA,GACL,EAAE;AACL,IAAAM;AAAA,MACE,MAAMT,EAAM,OAAOiB,CAAO;AAAA,MAC1B;AAAA,IAAA,GAEFV;AAAA,MACE,MAAMP,EAAM,KAAKiB,EAAQ,IAAId,CAAG,MAAM;AAAA,MACtC;AAAA,IAAA;AAGF,UAAMe,IAAc;AAAA,MAClB,GAAGb,EAAU,QAAQR,CAAK,IAAIM,GAAK;AAAA,QACjC,eAAe;AAAA,QACf,MAAM;AAAA,MAAA,CACP;AAAA,MACD,eAAeA,IAAM;AAAA,IAAA;AAEvB,IAAAM;AAAA,MACE,MAAMT,EAAM,OAAOkB,CAAW;AAAA,MAC9B;AAAA,IAAA,GAEFX;AAAA,MACE,MAAMP,EAAM,KAAKkB,EAAY,IAAIf,CAAG,MAAM;AAAA,MAC1C;AAAA,IAAA;AAAA,EAEJ,UAAA;AACE,UAAM,QAAQ,IAAI;AAAA,MAChBH,EAAM,QAAQI,EAAS,EAAE;AAAA,MACzBJ,EAAM,QAAQM,EAAQ,EAAE;AAAA,MACxBN,EAAM,QAAQ,GAAGM,EAAQ,EAAE,aAAa;AAAA,MACxCJ,EAAc,QAAQE,EAAS,EAAE;AAAA,IAAA,CAClC;AAAA,EACH;AACF;AAEA,SAASC,EACPc,GACAhB,GACAiB,GACAC,IAAmB,KACkB;AACrC,SAAO;AAAA,IACL,WAAWlB;AAAA,IACX,MAAAiB;AAAA,IACA,WAAWjB,IAAMkB;AAAA,IACjB,IAAAF;AAAA,IACA,eAAehB,IAAMkB;AAAA,EAAA;AAEzB;AAEA,SAASZ,EACPM,GAGAO,GACsE;AACtE,EAAAf,EAAOQ,GAAQ,WAAW,UAAUO,CAAW;AACjD;AAEA,SAASZ,EACPa,GACAC,GACAF,GACA;AACA,EAAAf;AAAA,IACE,KAAK,UAAUgB,CAAM,MAAM,KAAK,UAAUC,CAAQ;AAAA,IAClDF;AAAA,EAAA;AAEJ;AAEA,SAASf,EAAOkB,GAAoBH,GAAwC;AAC1E,MAAI,CAACG;AACH,UAAM,IAAI,MAAM,kCAAkCH,CAAW,GAAG;AAEpE;"}