@grackle-ai/server 0.72.1 → 0.72.3

package/dist/pairing.d.ts

@@ -1,22 +0,0 @@
-/** Start the periodic cleanup timer. Call once on server startup. */
-export declare function startPairingCleanup(): void;
-/** Stop the periodic cleanup timer. */
-export declare function stopPairingCleanup(): void;
-/**
- * Generate a new pairing code.
- *
- * Returns the 6-character uppercase alphanumeric code, or undefined
- * if the maximum number of active codes has been reached.
- */
-export declare function generatePairingCode(): string | undefined;
-/**
- * Attempt to redeem a pairing code. Returns true if the code was valid
- * and has been consumed (burned). Returns false otherwise.
- *
- * @param code - The pairing code to redeem (case-insensitive).
- * @param remoteIp - The remote IP address for rate limiting.
- */
-export declare function redeemPairingCode(code: string, remoteIp: string): boolean;
-/** Clear all pairing codes and rate limits (for testing). */
-export declare function clearPairing(): void;
-//# sourceMappingURL=pairing.d.ts.map

package/dist/pairing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AA4CA,qEAAqE;AACrE,wBAAgB,mBAAmB,IAAI,IAAI,CAmB1C;AAED,uCAAuC;AACvC,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAgCxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuCzE;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,IAAI,IAAI,CAGnC"}

package/dist/pairing.js

@@ -1,136 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { logger } from "./logger.js";
-/** How long a pairing code is valid after generation. */
-const PAIRING_CODE_TTL_MS = 5 * 60 * 1000;
-/** Maximum number of active (unexpired) pairing codes. */
-const MAX_ACTIVE_CODES = 10;
-/** Number of characters in a pairing code. */
-const PAIRING_CODE_LENGTH = 6;
-/** Maximum failed redemption attempts per IP before blocking. */
-const MAX_FAILED_ATTEMPTS = 5;
-/** Duration to block an IP after exceeding failed attempts. */
-const RATE_LIMIT_WINDOW_MS = 60 * 1000;
-/** Duration to block an IP after exceeding the rate limit. */
-const RATE_LIMIT_BLOCK_MS = 5 * 60 * 1000;
-/** Interval at which expired codes and rate-limit entries are cleaned up. */
-const CLEANUP_INTERVAL_MS = 60 * 1000;
-/** Active pairing codes keyed by code string (uppercase). */
-const activeCodes = new Map();
-/** Rate-limit tracking keyed by remote IP. */
-const rateLimits = new Map();
-let cleanupTimer;
-/** Start the periodic cleanup timer. Call once on server startup. */
-export function startPairingCleanup() {
-    if (cleanupTimer) {
-        return;
-    }
-    cleanupTimer = setInterval(() => {
-        const now = Date.now();
-        for (const [code, record] of activeCodes) {
-            if (now > record.expiresAt) {
-                activeCodes.delete(code);
-            }
-        }
-        for (const [ip, record] of rateLimits) {
-            if (now > record.blockedUntil && now - record.firstAttempt > RATE_LIMIT_WINDOW_MS) {
-                rateLimits.delete(ip);
-            }
-        }
-    }, CLEANUP_INTERVAL_MS);
-    // Allow the process to exit even if the timer is still running
-    cleanupTimer.unref();
-}
-/** Stop the periodic cleanup timer. */
-export function stopPairingCleanup() {
-    if (cleanupTimer) {
-        clearInterval(cleanupTimer);
-        cleanupTimer = undefined;
-    }
-}
-/**
- * Generate a new pairing code.
- *
- * Returns the 6-character uppercase alphanumeric code, or undefined
- * if the maximum number of active codes has been reached.
- */
-export function generatePairingCode() {
-    // Purge expired codes first
-    const now = Date.now();
-    for (const [code, record] of activeCodes) {
-        if (now > record.expiresAt) {
-            activeCodes.delete(code);
-        }
-    }
-    if (activeCodes.size >= MAX_ACTIVE_CODES) {
-        logger.warn("Maximum active pairing codes reached (%d)", MAX_ACTIVE_CODES);
-        return undefined;
-    }
-    // Generate a code that doesn't collide with existing ones
-    let code;
-    do {
-        code = randomBytes(4)
-            .toString("base64url")
-            .replace(/[^A-Za-z0-9]/g, "")
-            .slice(0, PAIRING_CODE_LENGTH)
-            .toUpperCase();
-    } while (code.length < PAIRING_CODE_LENGTH || activeCodes.has(code));
-    const record = {
-        code,
-        createdAt: now,
-        expiresAt: now + PAIRING_CODE_TTL_MS,
-    };
-    activeCodes.set(code, record);
-    logger.info({ expiresIn: PAIRING_CODE_TTL_MS / 1000 }, "Generated pairing code");
-    return code;
-}
-/**
- * Attempt to redeem a pairing code. Returns true if the code was valid
- * and has been consumed (burned). Returns false otherwise.
- *
- * @param code - The pairing code to redeem (case-insensitive).
- * @param remoteIp - The remote IP address for rate limiting.
- */
-export function redeemPairingCode(code, remoteIp) {
-    const now = Date.now();
-    const normalised = code.toUpperCase().trim();
-    // Check rate limit
-    const limit = rateLimits.get(remoteIp);
-    if (limit && now < limit.blockedUntil) {
-        logger.warn({ remoteIp }, "Pairing attempt blocked by rate limit");
-        return false;
-    }
-    const record = activeCodes.get(normalised);
-    if (!record || now > record.expiresAt) {
-        // Record failed attempt
-        if (limit) {
-            if (now - limit.firstAttempt > RATE_LIMIT_WINDOW_MS) {
-                // Reset window
-                rateLimits.set(remoteIp, { attempts: 1, firstAttempt: now, blockedUntil: 0 });
-            }
-            else {
-                limit.attempts++;
-                if (limit.attempts >= MAX_FAILED_ATTEMPTS) {
-                    limit.blockedUntil = now + RATE_LIMIT_BLOCK_MS;
-                    logger.warn({ remoteIp, attempts: limit.attempts }, "Rate limit triggered for pairing attempts");
-                }
-            }
-        }
-        else {
-            rateLimits.set(remoteIp, { attempts: 1, firstAttempt: now, blockedUntil: 0 });
-        }
-        if (record && now > record.expiresAt) {
-            activeCodes.delete(normalised);
-        }
-        return false;
-    }
-    // Burn the code — single use
-    activeCodes.delete(normalised);
-    logger.info("Pairing code redeemed");
-    return true;
-}
-/** Clear all pairing codes and rate limits (for testing). */
-export function clearPairing() {
-    activeCodes.clear();
-    rateLimits.clear();
-}
-//# sourceMappingURL=pairing.js.map

package/dist/pairing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,yDAAyD;AACzD,MAAM,mBAAmB,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,0DAA0D;AAC1D,MAAM,gBAAgB,GAAW,EAAE,CAAC;AAEpC,8CAA8C;AAC9C,MAAM,mBAAmB,GAAW,CAAC,CAAC;AAEtC,iEAAiE;AACjE,MAAM,mBAAmB,GAAW,CAAC,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,oBAAoB,GAAW,EAAE,GAAG,IAAI,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,mBAAmB,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,6EAA6E;AAC7E,MAAM,mBAAmB,GAAW,EAAE,GAAG,IAAI,CAAC;AAc9C,6DAA6D;AAC7D,MAAM,WAAW,GAA+B,IAAI,GAAG,EAAyB,CAAC;AAEjF,8CAA8C;AAC9C,MAAM,UAAU,GAAiC,IAAI,GAAG,EAA2B,CAAC;AAEpF,IAAI,YAAwD,CAAC;AAE7D,qEAAqE;AACrE,MAAM,UAAU,mBAAmB;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,oBAAoB,EAAE,CAAC;gBAClF,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxB,+DAA+D;IAC/D,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,kBAAkB;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,4BAA4B;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,gBAAgB,CAAC,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAY,CAAC;IACjB,GAAG,CAAC;QACF,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC;aAClB,QAAQ,CAAC,WAAW,CAAC;aACrB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC;aAC7B,WAAW,EAAE,CAAC;IACnB,CAAC,QAAQ,IAAI,CAAC,MAAM,GAAG,mBAAmB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;IAErE,MAAM,MAAM,GAAkB;QAC5B,IAAI;QACJ,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,mBAAmB;KACrC,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,mBAAmB,GAAG,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7C,mBAAmB;IACnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACtC,wBAAwB;QACxB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,oBAAoB,EAAE,CAAC;gBACpD,eAAe;gBACf,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,QAAQ,IAAI,mBAAmB,EAAE,CAAC;oBAC1C,KAAK,CAAC,YAAY,GAAG,GAAG,GAAG,mBAAmB,CAAC;oBAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,2CAA2C,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACrC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6BAA6B;IAC7B,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,YAAY;IAC1B,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/security-headers.d.ts

@@ -1,17 +0,0 @@
-import type { ServerResponse } from "node:http";
-/**
- * Content Security Policy for the web handler.
- *
- * Covers the React SPA (served from 'self') and server-rendered pages
- * (pairing/authorize) which use inline styles.
- */
-export declare const WEB_CONTENT_SECURITY_POLICY: string;
-/**
- * Set defense-in-depth security headers on every web response.
- *
- * Called at the top of `createWebHandler`'s returned function so that all
- * response paths (static files, HTML pages, JSON APIs, redirects) are covered
- * without modifying each `writeHead` call individually.
- */
-export declare function setSecurityHeaders(res: ServerResponse): void;
-//# sourceMappingURL=security-headers.d.ts.map

package/dist/security-headers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAW9B,CAAC;AAEb;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAI5D"}

package/dist/security-headers.js

@@ -1,31 +0,0 @@
-/**
- * Content Security Policy for the web handler.
- *
- * Covers the React SPA (served from 'self') and server-rendered pages
- * (pairing/authorize) which use inline styles.
- */
-export const WEB_CONTENT_SECURITY_POLICY = [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data:",
-    "font-src 'self'",
-    "connect-src 'self'",
-    "object-src 'none'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-].join("; ");
-/**
- * Set defense-in-depth security headers on every web response.
- *
- * Called at the top of `createWebHandler`'s returned function so that all
- * response paths (static files, HTML pages, JSON APIs, redirects) are covered
- * without modifying each `writeHead` call individually.
- */
-export function setSecurityHeaders(res) {
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    res.setHeader("X-Frame-Options", "DENY");
-    res.setHeader("Content-Security-Policy", WEB_CONTENT_SECURITY_POLICY);
-}
-//# sourceMappingURL=security-headers.js.map

package/dist/security-headers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../src/security-headers.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW;IACjD,oBAAoB;IACpB,mBAAmB;IACnB,kCAAkC;IAClC,sBAAsB;IACtB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,wBAAwB;IACxB,iBAAiB;CAClB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAmB;IACpD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;AACxE,CAAC"}

package/dist/session.d.ts

@@ -1,36 +0,0 @@
-/** Name of the session cookie sent to browsers. */
-export declare const SESSION_COOKIE_NAME: string;
-/** Start the periodic session cleanup timer. Call once on server startup. */
-export declare function startSessionCleanup(): void;
-/** Stop the periodic session cleanup timer. */
-export declare function stopSessionCleanup(): void;
-/**
- * Create a new session and return the Set-Cookie header value.
- *
- * The cookie format is `<sessionId>.<signature>` where the signature
- * is an HMAC-SHA256 of the session ID using the API key as secret.
- *
- * When `options.secure` is true the cookie includes the `Secure` flag,
- * which tells browsers to only send it over HTTPS. This should be
- * enabled when the server is network-accessible (`--allow-network`)
- * behind a TLS-terminating reverse proxy.
- */
-export declare function createSession(apiKey: string, options?: {
-    secure?: boolean;
-}): string;
-/**
- * Parse a raw Cookie header into key-value pairs.
- *
- * Handles the standard `name=value; name2=value2` format.
- */
-export declare function parseCookies(header: string): Record<string, string>;
-/**
- * Validate a session cookie from a raw Cookie header string.
- *
- * Returns true if the cookie contains a valid, non-expired session
- * with a correct HMAC signature.
- */
-export declare function validateSessionCookie(cookieHeader: string, apiKey: string): boolean;
-/** Remove all sessions (useful for testing). */
-export declare function clearSessions(): void;
-//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,EAAE,MAA0B,CAAC;AAqB7D,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,IAAI,CAc1C;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAwBpF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAenE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAwCnF;AAED,gDAAgD;AAChD,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/session.js

@@ -1,143 +0,0 @@
-import { randomBytes, createHmac } from "node:crypto";
-/** Name of the session cookie sent to browsers. */
-export const SESSION_COOKIE_NAME = "grackle_session";
-/** Default session lifetime: 24 hours. */
-const SESSION_TTL_MS = 24 * 60 * 60 * 1000;
-/** Byte length of the random session identifier. */
-const SESSION_ID_BYTES = 32;
-/** Interval at which expired sessions are cleaned up. */
-const SESSION_CLEANUP_INTERVAL_MS = 60 * 1000;
-/** In-memory session store keyed by session ID. */
-const sessions = new Map();
-let cleanupTimer;
-/** Start the periodic session cleanup timer. Call once on server startup. */
-export function startSessionCleanup() {
-    if (cleanupTimer) {
-        return;
-    }
-    cleanupTimer = setInterval(() => {
-        const now = Date.now();
-        for (const [id, record] of sessions) {
-            if (now > record.expiresAt) {
-                sessions.delete(id);
-            }
-        }
-    }, SESSION_CLEANUP_INTERVAL_MS);
-    // Allow the process to exit even if the timer is still running
-    cleanupTimer.unref();
-}
-/** Stop the periodic session cleanup timer. */
-export function stopSessionCleanup() {
-    if (cleanupTimer) {
-        clearInterval(cleanupTimer);
-        cleanupTimer = undefined;
-    }
-}
-/**
- * Create an HMAC-SHA256 signature of a value using the given secret.
- * Returns a hex-encoded string.
- */
-function sign(value, secret) {
-    return createHmac("sha256", secret).update(value).digest("hex");
-}
-/**
- * Create a new session and return the Set-Cookie header value.
- *
- * The cookie format is `<sessionId>.<signature>` where the signature
- * is an HMAC-SHA256 of the session ID using the API key as secret.
- *
- * When `options.secure` is true the cookie includes the `Secure` flag,
- * which tells browsers to only send it over HTTPS. This should be
- * enabled when the server is network-accessible (`--allow-network`)
- * behind a TLS-terminating reverse proxy.
- */
-export function createSession(apiKey, options) {
-    const sessionId = randomBytes(SESSION_ID_BYTES).toString("hex");
-    const now = Date.now();
-    sessions.set(sessionId, {
-        createdAt: now,
-        expiresAt: now + SESSION_TTL_MS,
-    });
-    const signature = sign(sessionId, apiKey);
-    const cookieValue = `${sessionId}.${signature}`;
-    const maxAge = Math.floor(SESSION_TTL_MS / 1000);
-    const parts = [
-        `${SESSION_COOKIE_NAME}=${cookieValue}`,
-        "HttpOnly",
-        "SameSite=Lax",
-        "Path=/",
-        `Max-Age=${maxAge}`,
-    ];
-    if (options?.secure) {
-        parts.push("Secure");
-    }
-    return parts.join("; ");
-}
-/**
- * Parse a raw Cookie header into key-value pairs.
- *
- * Handles the standard `name=value; name2=value2` format.
- */
-export function parseCookies(header) {
-    const result = {};
-    if (!header) {
-        return result;
-    }
-    for (const pair of header.split(";")) {
-        const eqIndex = pair.indexOf("=");
-        if (eqIndex === -1) {
-            continue;
-        }
-        const name = pair.slice(0, eqIndex).trim();
-        const value = pair.slice(eqIndex + 1).trim();
-        result[name] = value;
-    }
-    return result;
-}
-/**
- * Validate a session cookie from a raw Cookie header string.
- *
- * Returns true if the cookie contains a valid, non-expired session
- * with a correct HMAC signature.
- */
-export function validateSessionCookie(cookieHeader, apiKey) {
-    const cookies = parseCookies(cookieHeader);
-    const raw = cookies[SESSION_COOKIE_NAME];
-    if (!raw) {
-        return false;
-    }
-    const dotIndex = raw.lastIndexOf(".");
-    if (dotIndex === -1) {
-        return false;
-    }
-    const sessionId = raw.slice(0, dotIndex);
-    const providedSignature = raw.slice(dotIndex + 1);
-    const expectedSignature = sign(sessionId, apiKey);
-    // Constant-time comparison for the signature
-    if (providedSignature.length !== expectedSignature.length) {
-        return false;
-    }
-    let diff = 0;
-    for (let i = 0; i < expectedSignature.length; i++) {
-        // eslint-disable-next-line no-bitwise
-        diff |= providedSignature.charCodeAt(i) ^ expectedSignature.charCodeAt(i);
-    }
-    if (diff !== 0) {
-        return false;
-    }
-    // Check session exists and hasn't expired
-    const record = sessions.get(sessionId);
-    if (!record) {
-        return false;
-    }
-    if (Date.now() > record.expiresAt) {
-        sessions.delete(sessionId);
-        return false;
-    }
-    return true;
-}
-/** Remove all sessions (useful for testing). */
-export function clearSessions() {
-    sessions.clear();
-}
-//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAW,iBAAiB,CAAC;AAE7D,0CAA0C;AAC1C,MAAM,cAAc,GAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,oDAAoD;AACpD,MAAM,gBAAgB,GAAW,EAAE,CAAC;AAEpC,yDAAyD;AACzD,MAAM,2BAA2B,GAAW,EAAE,GAAG,IAAI,CAAC;AAOtD,mDAAmD;AACnD,MAAM,QAAQ,GAA+B,IAAI,GAAG,EAAyB,CAAC;AAE9E,IAAI,YAAwD,CAAC;AAE7D,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAA8B;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;QACtB,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG,GAAG,cAAc;KAChC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG;QACZ,GAAG,mBAAmB,IAAI,WAAW,EAAE;QACvC,UAAU;QACV,cAAc;QACd,QAAQ;QACR,WAAW,MAAM,EAAE;KACpB,CAAC;IACF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,MAAc;IACxE,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAElD,6CAA6C;IAC7C,IAAI,iBAAiB,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,sCAAsC;QACtC,IAAI,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}