@hexclave/shared 1.0.41 → 1.0.43

package/dist/esm/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","names":[],"sources":["../../src/sessions.ts"],"sourcesContent":["import * as jose from 'jose';\nimport { InferType } from 'yup';\nimport { accessTokenPayloadSchema } from './schema-fields';\nimport { HexclaveAssertionError, throwErr } from \"./utils/errors\";\nimport { runAsynchronously, wait } from './utils/promises';\nimport { Store } from \"./utils/stores\";\n\n\nexport type AccessTokenPayload = InferType<typeof accessTokenPayloadSchema>;\n\nfunction decodeAccessTokenIfValid(token: string): AccessTokenPayload | null {\n  try {\n    const payload = jose.decodeJwt(token);\n    return accessTokenPayloadSchema.validateSync(payload);\n  } catch (e) {\n    return null;\n  }\n}\n\nexport class AccessToken {\n  static createIfValid(token: string): AccessToken | null {\n    const payload = decodeAccessTokenIfValid(token);\n    if (!payload) return null;\n    return new AccessToken(token);\n  }\n\n  private constructor(\n    public readonly token: string,\n  ) {\n    if (token === \"undefined\") {\n      throw new HexclaveAssertionError(\"Access token is the string 'undefined'; it's unlikely this is the correct value. They're supposed to be unguessable!\");\n    }\n  }\n\n  get payload() {\n    return decodeAccessTokenIfValid(this.token) ?? throwErr(\"Invalid access token in payload (should've been validated in createIfValid)\", { token: this.token });\n  }\n\n  get expiresAt(): Date {\n    const { exp } = this.payload;\n    if (exp === undefined) return new Date(8640000000000000);  // max date value\n    return new Date(exp * 1000);\n  }\n\n  get issuedAt(): Date {\n    const { iat } = this.payload;\n    return new Date(iat * 1000);\n  }\n\n  /**\n   * @returns The number of milliseconds until the access token expires, or 0 if it has already expired.\n   */\n  get expiresInMillis(): number {\n    return Math.max(0, this.expiresAt.getTime() - Date.now());\n  }\n\n  get issuedMillisAgo(): number {\n    return Math.max(0, Date.now() - this.issuedAt.getTime());\n  }\n\n  isExpired(): boolean {\n    return this.expiresInMillis <= 0;\n  }\n}\n\nexport class RefreshToken {\n  constructor(\n    public readonly token: string,\n  ) {\n    if (token === \"undefined\") {\n      throw new HexclaveAssertionError(\"Refresh token is the string 'undefined'; it's unlikely this is the correct value. They're supposed to be unguessable!\");\n    }\n  }\n}\n\n/**\n * An InternalSession represents a user's session, which may or may not be valid. It may contain an access token, a refresh token, or both.\n *\n * A session never changes which user or session it belongs to, but the tokens in it may change over time.\n */\nexport class InternalSession {\n  /**\n  * Each session has a session key that depends on the tokens inside. If the session has a refresh token, the session key depends only on the refresh token. If the session does not have a refresh token, the session key depends only on the access token.\n  *\n  * Multiple Session objects may have the same session key, which implies that they represent the same session by the same user. Furthermore, a session's key never changes over the lifetime of a session object.\n  *\n  * This is useful for caching and indexing sessions.\n  */\n  public readonly sessionKey: string;\n\n  /**\n   * An access token that is not known to be invalid (ie. may be valid, but may have expired).\n   */\n  private _accessToken: Store<AccessToken | null>;\n  private readonly _refreshToken: RefreshToken | null;\n\n  /**\n   * Whether the session as a whole is known to be invalid (ie. both access and refresh tokens are invalid). Used as a cache to avoid making multiple requests to the server (sessions never go back to being valid after being invalidated).\n   *\n   * It is possible for the access token to be invalid but the refresh token to be valid, in which case the session is\n   * still valid (just needs a refresh). It is also possible for the access token to be valid but the refresh token to\n   * be invalid, in which case the session is also valid (eg. if the refresh token is null because the user only passed\n   * in an access token, eg. in a server-side request handler).\n   */\n  private _knownToBeInvalid = new Store<boolean>(false);\n\n  private _refreshPromise: Promise<AccessToken | null> | null = null;\n\n  constructor(private readonly _options: {\n    refreshAccessTokenCallback(refreshToken: RefreshToken): Promise<AccessToken | null>,\n    refreshToken: string | null,\n    accessToken?: string | null,\n  }) {\n    this._accessToken = new Store(_options.accessToken ? AccessToken.createIfValid(_options.accessToken) : null);\n    this._refreshToken = _options.refreshToken ? new RefreshToken(_options.refreshToken) : null;\n    if (_options.accessToken === null && _options.refreshToken === null) {\n      // this session is already invalid\n      this._knownToBeInvalid.set(true);\n    }\n    this.sessionKey = InternalSession.calculateSessionKey({ accessToken: _options.accessToken ?? null, refreshToken: _options.refreshToken });\n  }\n\n  static calculateSessionKey(ofTokens: { refreshToken: string | null, accessToken?: string | null }): string {\n    if (ofTokens.refreshToken) {\n      return `refresh-${ofTokens.refreshToken}`;\n    } else if (ofTokens.accessToken) {\n      // Access-only sessions (no refresh token) are keyed by the underlying session's `refresh_token_id`, not the\n      // access token string: access tokens get re-minted frequently, and keying by the raw token would spawn a new\n      // session (and cold-invalidate every session-scoped cache) on each refresh. Falls back to the raw token if\n      // the JWT can't be decoded.\n      const refreshTokenId = decodeAccessTokenIfValid(ofTokens.accessToken)?.refresh_token_id;\n      if (refreshTokenId) {\n        return `access-session-${refreshTokenId}`;\n      }\n      return `access-${ofTokens.accessToken}`;\n    } else {\n      return \"not-logged-in\";\n    }\n  }\n\n  isKnownToBeInvalid() {\n    return this._knownToBeInvalid.get();\n  }\n\n  /**\n   * Marks the session object as invalid, meaning that the refresh and access tokens can no longer be used. There is no\n   * way out of this state, and the session object will never return valid tokens again.\n   */\n  markInvalid() {\n    this._accessToken.set(null);\n    this._knownToBeInvalid.set(true);\n  }\n\n  onInvalidate(callback: () => void): { unsubscribe: () => void } {\n    return this._knownToBeInvalid.onChange(() => callback());\n  }\n\n  getRefreshToken(): RefreshToken | null {\n    if (this.isKnownToBeInvalid()) return null;\n    return this._refreshToken;\n  }\n\n  /**\n   * Returns the access token if it is found in the cache and not expired yet, or null otherwise. Never fetches new tokens.\n   */\n  getAccessTokenIfNotExpiredYet(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): AccessToken | null {\n    if (minMillisUntilExpiration > 45_000) {\n      throw new Error(`Required access token expiry ${minMillisUntilExpiration}ms is too long; access tokens are too short to be used for more than 45s`);\n    }\n    if (maxMillisSinceIssued !== null && maxMillisSinceIssued < 15_000) {\n      throw new Error(`Required access token issuance ${maxMillisSinceIssued}ms is too short; assume that access token generation can take at least 15s`);\n    }\n\n    const accessToken = this._getPotentiallyInvalidAccessTokenIfAvailable();\n    if (!accessToken || accessToken.expiresInMillis < minMillisUntilExpiration) return null;\n    if (maxMillisSinceIssued !== null && accessToken.issuedMillisAgo > maxMillisSinceIssued) return null;\n    return accessToken;\n  }\n\n  /**\n   * Returns the access token if it is found in the cache, fetching it otherwise.\n   *\n   * This is usually the function you want to call to get an access token. Either set `minMillisUntilExpiration` to a reasonable value, or catch errors that occur if it expires, and call `markAccessTokenExpired` to mark the token as expired if so (after which a call to this function will always refetch the token).\n   *\n   * @returns null if the session is known to be invalid, cached tokens if they exist in the cache and the access token hasn't expired yet (the refresh token might still be invalid), or new tokens otherwise.\n   */\n  async getOrFetchLikelyValidTokens(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): Promise<{ accessToken: AccessToken, refreshToken: RefreshToken | null } | null> {\n    // fast path to save a roundtrip to the server if the session is known to be invalid\n    if (this.isKnownToBeInvalid()) return null;\n\n    const accessToken = this.getAccessTokenIfNotExpiredYet(minMillisUntilExpiration, maxMillisSinceIssued);\n    if (!accessToken) {\n      const newTokens = await this.fetchNewTokens();\n      const expiresInMillis = newTokens?.accessToken.expiresInMillis;\n      const issuedMillisAgo = newTokens?.accessToken.issuedMillisAgo;\n      if (expiresInMillis !== undefined && expiresInMillis < minMillisUntilExpiration) {\n        throw new HexclaveAssertionError(`Required access token expiry ${minMillisUntilExpiration}ms is too long; access tokens are too short when they're generated (${expiresInMillis}ms)`);\n      }\n      if (maxMillisSinceIssued !== null && issuedMillisAgo !== undefined && issuedMillisAgo > maxMillisSinceIssued) {\n        throw new HexclaveAssertionError(`Required access token issuance ${maxMillisSinceIssued}ms is too short; access token issuance is too slow (${issuedMillisAgo}ms)`);\n      }\n      return newTokens;\n    }\n    return { accessToken, refreshToken: this.getRefreshToken() };\n  }\n\n  /**\n   * Fetches new tokens that are, at the time of fetching, guaranteed to be valid.\n   *\n   * The newly generated tokens are short-lived, so it's good practice not to rely on their validity (if possible). However, this function is useful in some cases where you only want to pass access tokens to a service, and you want to make sure said access token has the longest possible lifetime.\n   *\n   * In most cases, you should prefer `getOrFetchLikelyValidTokens`.\n   *\n   * @returns null if the session is known to be invalid, or new tokens otherwise (which, at the time of fetching, are guaranteed to be valid).\n   */\n  async fetchNewTokens(): Promise<{ accessToken: AccessToken, refreshToken: RefreshToken | null } | null> {\n    const accessToken = await this._getNewlyFetchedAccessToken();\n    return accessToken ? { accessToken, refreshToken: this._refreshToken } : null;\n  }\n\n  /**\n   * Installs a freshly obtained token pair's access token into this session in place, keeping the session object\n   * (and therefore every session-scoped cache) stable instead of constructing a new InternalSession. No-op if the\n   * session is invalid, the access token can't be decoded, it's unchanged, or the pair doesn't map to this session\n   * (so a foreign token can never be written into this object's cache); never clears an existing token.\n   */\n  updateAccessToken(tokens: { accessToken: string | null, refreshToken: string | null }) {\n    if (this._knownToBeInvalid.get()) return;\n    if (!tokens.accessToken) return;\n    const newAccessToken = AccessToken.createIfValid(tokens.accessToken);\n    if (!newAccessToken) return;\n    // Self-enforce the \"a session never changes which session it belongs to\" invariant: only install a token pair\n    // that maps to this same session key (validated against the incoming pair, not this session's existing tokens).\n    if (InternalSession.calculateSessionKey(tokens) !== this.sessionKey) return;\n    if (this._accessToken.get()?.token === newAccessToken.token) return;\n    this._accessToken.set(newAccessToken);\n  }\n\n  /**\n   * Manually mark the access token as expired, even if the date on its payload may still be valid.\n   *\n   * You don't usually have to call this function anymore, but you may want to call suggestAccessTokenExpired\n   * to hint that the access token should be refreshed as its data may have changed, if possible.\n   */\n  markAccessTokenExpired(accessToken?: AccessToken) {\n    if (!accessToken || this._accessToken.get()?.token === accessToken.token) {\n      this._accessToken.set(null);\n    }\n  }\n\n  /**\n   * Strongly suggests that the access token should be refreshed as its data may have changed, although it's up to this\n   * implementation to decide whether or when the access token will be refreshed.\n   *\n   * This is particularly useful when the data associated with the access token may have changed for example due to an\n   * update to the user's profile.\n   *\n   * The current implementation marks the access token as expired if and only if a refresh token is available (regardless of\n   * whether the refresh token is actually valid or not), although this is not a guarantee and subject to change.\n   *\n   * If you need a stronger guarantee of revoking an access token, use markAccessTokenExpired instead.\n   */\n  suggestAccessTokenExpired(): void {\n    if (this._refreshToken) {\n      this.markAccessTokenExpired();\n    }\n  }\n\n  startRefreshingAccessToken(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): { unsubscribe: () => void } {\n    let canceled = false;\n    runAsynchronously(async () => {\n      while (!canceled) {\n        const tokens = await this.getOrFetchLikelyValidTokens(minMillisUntilExpiration, maxMillisSinceIssued);\n        if (!tokens) return;  // session is invalid, stop refreshing\n        const nextRefreshIn = Math.min(\n          tokens.accessToken.expiresInMillis - minMillisUntilExpiration,\n          (maxMillisSinceIssued ?? Infinity) - tokens.accessToken.issuedMillisAgo,\n        );\n        await wait(Math.max(1, nextRefreshIn));\n      }\n    });\n    return {\n      unsubscribe: () => {\n        canceled = true;\n      },\n    };\n  }\n\n  /**\n   * Note that a callback invocation with `null` does not mean the session has been invalidated; the access token may just have expired. Use `onInvalidate` to detect invalidation.\n   */\n  onAccessTokenChange(callback: (newAccessToken: AccessToken | null) => void): { unsubscribe: () => void } {\n    return this._accessToken.onChange(callback);\n  }\n\n  /**\n   * @returns An access token, which may be expired or expire soon, or null if it is known to be invalid.\n   */\n  private _getPotentiallyInvalidAccessTokenIfAvailable(): AccessToken | null {\n    if (this.isKnownToBeInvalid()) return null;\n\n    const accessToken = this._accessToken.get();\n    if (accessToken && !accessToken.isExpired()) return accessToken;\n\n    return null;\n  }\n\n  /**\n   * You should prefer `_getOrFetchPotentiallyInvalidAccessToken` in almost all cases.\n   *\n   * @returns A newly fetched access token (never read from cache), or null if the session either does not represent a user or the session is invalid.\n   */\n  private async _getNewlyFetchedAccessToken(): Promise<AccessToken | null> {\n    if (!this._refreshToken) return null;\n    if (this._knownToBeInvalid.get()) return null;\n\n    if (!this._refreshPromise) {\n      this._refreshAndSetRefreshPromise(this._refreshToken);\n    }\n    return await this._refreshPromise;\n  }\n\n  private _refreshAndSetRefreshPromise(refreshToken: RefreshToken) {\n    let refreshPromise: Promise<AccessToken | null> = this._options.refreshAccessTokenCallback(refreshToken).then((accessToken) => {\n      if (refreshPromise === this._refreshPromise) {\n        this._refreshPromise = null;\n        this._accessToken.set(accessToken);\n        if (!accessToken) {\n          this.markInvalid();\n        }\n      }\n      return accessToken;\n    });\n    this._refreshPromise = refreshPromise;\n  }\n}\n"],"mappings":";;;;;;;AAUA,SAAS,yBAAyB,OAA0C;AAC1E,KAAI;EACF,MAAM,UAAU,KAAK,UAAU,MAAM;AACrC,SAAO,yBAAyB,aAAa,QAAQ;UAC9C,GAAG;AACV,SAAO;;;AAIX,IAAa,cAAb,MAAa,YAAY;CACvB,OAAO,cAAc,OAAmC;AAEtD,MAAI,CADY,yBAAyB,MAAM,CACjC,QAAO;AACrB,SAAO,IAAI,YAAY,MAAM;;CAG/B,AAAQ,YACN,AAAgB,OAChB;EADgB;AAEhB,MAAI,UAAU,YACZ,OAAM,IAAI,uBAAuB,uHAAuH;;CAI5J,IAAI,UAAU;AACZ,SAAO,yBAAyB,KAAK,MAAM,IAAI,SAAS,+EAA+E,EAAE,OAAO,KAAK,OAAO,CAAC;;CAG/J,IAAI,YAAkB;EACpB,MAAM,EAAE,QAAQ,KAAK;AACrB,MAAI,QAAQ,OAAW,wBAAO,IAAI,KAAK,OAAiB;AACxD,yBAAO,IAAI,KAAK,MAAM,IAAK;;CAG7B,IAAI,WAAiB;EACnB,MAAM,EAAE,QAAQ,KAAK;AACrB,yBAAO,IAAI,KAAK,MAAM,IAAK;;;;;CAM7B,IAAI,kBAA0B;AAC5B,SAAO,KAAK,IAAI,GAAG,KAAK,UAAU,SAAS,GAAG,KAAK,KAAK,CAAC;;CAG3D,IAAI,kBAA0B;AAC5B,SAAO,KAAK,IAAI,GAAG,KAAK,KAAK,GAAG,KAAK,SAAS,SAAS,CAAC;;CAG1D,YAAqB;AACnB,SAAO,KAAK,mBAAmB;;;AAInC,IAAa,eAAb,MAA0B;CACxB,YACE,AAAgB,OAChB;EADgB;AAEhB,MAAI,UAAU,YACZ,OAAM,IAAI,uBAAuB,wHAAwH;;;;;;;;AAU/J,IAAa,kBAAb,MAAa,gBAAgB;CA4B3B,YAAY,AAAiB,UAI1B;EAJ0B;2BAJD,IAAI,MAAe,MAAM;yBAES;AAO5D,OAAK,eAAe,IAAI,MAAM,SAAS,cAAc,YAAY,cAAc,SAAS,YAAY,GAAG,KAAK;AAC5G,OAAK,gBAAgB,SAAS,eAAe,IAAI,aAAa,SAAS,aAAa,GAAG;AACvF,MAAI,SAAS,gBAAgB,QAAQ,SAAS,iBAAiB,KAE7D,MAAK,kBAAkB,IAAI,KAAK;AAElC,OAAK,aAAa,gBAAgB,oBAAoB;GAAE,aAAa,SAAS,eAAe;GAAM,cAAc,SAAS;GAAc,CAAC;;CAG3I,OAAO,oBAAoB,UAAgF;AACzG,MAAI,SAAS,aACX,QAAO,WAAW,SAAS;WAClB,SAAS,aAAa;GAK/B,MAAM,iBAAiB,yBAAyB,SAAS,YAAY,EAAE;AACvE,OAAI,eACF,QAAO,kBAAkB;AAE3B,UAAO,UAAU,SAAS;QAE1B,QAAO;;CAIX,qBAAqB;AACnB,SAAO,KAAK,kBAAkB,KAAK;;;;;;CAOrC,cAAc;AACZ,OAAK,aAAa,IAAI,KAAK;AAC3B,OAAK,kBAAkB,IAAI,KAAK;;CAGlC,aAAa,UAAmD;AAC9D,SAAO,KAAK,kBAAkB,eAAe,UAAU,CAAC;;CAG1D,kBAAuC;AACrC,MAAI,KAAK,oBAAoB,CAAE,QAAO;AACtC,SAAO,KAAK;;;;;CAMd,8BAA8B,0BAAkC,sBAAyD;AACvH,MAAI,2BAA2B,KAC7B,OAAM,IAAI,MAAM,gCAAgC,yBAAyB,0EAA0E;AAErJ,MAAI,yBAAyB,QAAQ,uBAAuB,KAC1D,OAAM,IAAI,MAAM,kCAAkC,qBAAqB,4EAA4E;EAGrJ,MAAM,cAAc,KAAK,8CAA8C;AACvE,MAAI,CAAC,eAAe,YAAY,kBAAkB,yBAA0B,QAAO;AACnF,MAAI,yBAAyB,QAAQ,YAAY,kBAAkB,qBAAsB,QAAO;AAChG,SAAO;;;;;;;;;CAUT,MAAM,4BAA4B,0BAAkC,sBAAsH;AAExL,MAAI,KAAK,oBAAoB,CAAE,QAAO;EAEtC,MAAM,cAAc,KAAK,8BAA8B,0BAA0B,qBAAqB;AACtG,MAAI,CAAC,aAAa;GAChB,MAAM,YAAY,MAAM,KAAK,gBAAgB;GAC7C,MAAM,kBAAkB,WAAW,YAAY;GAC/C,MAAM,kBAAkB,WAAW,YAAY;AAC/C,OAAI,oBAAoB,UAAa,kBAAkB,yBACrD,OAAM,IAAI,uBAAuB,gCAAgC,yBAAyB,sEAAsE,gBAAgB,KAAK;AAEvL,OAAI,yBAAyB,QAAQ,oBAAoB,UAAa,kBAAkB,qBACtF,OAAM,IAAI,uBAAuB,kCAAkC,qBAAqB,sDAAsD,gBAAgB,KAAK;AAErK,UAAO;;AAET,SAAO;GAAE;GAAa,cAAc,KAAK,iBAAiB;GAAE;;;;;;;;;;;CAY9D,MAAM,iBAAkG;EACtG,MAAM,cAAc,MAAM,KAAK,6BAA6B;AAC5D,SAAO,cAAc;GAAE;GAAa,cAAc,KAAK;GAAe,GAAG;;;;;;;;CAS3E,kBAAkB,QAAqE;AACrF,MAAI,KAAK,kBAAkB,KAAK,CAAE;AAClC,MAAI,CAAC,OAAO,YAAa;EACzB,MAAM,iBAAiB,YAAY,cAAc,OAAO,YAAY;AACpE,MAAI,CAAC,eAAgB;AAGrB,MAAI,gBAAgB,oBAAoB,OAAO,KAAK,KAAK,WAAY;AACrE,MAAI,KAAK,aAAa,KAAK,EAAE,UAAU,eAAe,MAAO;AAC7D,OAAK,aAAa,IAAI,eAAe;;;;;;;;CASvC,uBAAuB,aAA2B;AAChD,MAAI,CAAC,eAAe,KAAK,aAAa,KAAK,EAAE,UAAU,YAAY,MACjE,MAAK,aAAa,IAAI,KAAK;;;;;;;;;;;;;;CAgB/B,4BAAkC;AAChC,MAAI,KAAK,cACP,MAAK,wBAAwB;;CAIjC,2BAA2B,0BAAkC,sBAAkE;EAC7H,IAAI,WAAW;AACf,oBAAkB,YAAY;AAC5B,UAAO,CAAC,UAAU;IAChB,MAAM,SAAS,MAAM,KAAK,4BAA4B,0BAA0B,qBAAqB;AACrG,QAAI,CAAC,OAAQ;IACb,MAAM,gBAAgB,KAAK,IACzB,OAAO,YAAY,kBAAkB,2BACpC,wBAAwB,YAAY,OAAO,YAAY,gBACzD;AACD,UAAM,KAAK,KAAK,IAAI,GAAG,cAAc,CAAC;;IAExC;AACF,SAAO,EACL,mBAAmB;AACjB,cAAW;KAEd;;;;;CAMH,oBAAoB,UAAqF;AACvG,SAAO,KAAK,aAAa,SAAS,SAAS;;;;;CAM7C,AAAQ,+CAAmE;AACzE,MAAI,KAAK,oBAAoB,CAAE,QAAO;EAEtC,MAAM,cAAc,KAAK,aAAa,KAAK;AAC3C,MAAI,eAAe,CAAC,YAAY,WAAW,CAAE,QAAO;AAEpD,SAAO;;;;;;;CAQT,MAAc,8BAA2D;AACvE,MAAI,CAAC,KAAK,cAAe,QAAO;AAChC,MAAI,KAAK,kBAAkB,KAAK,CAAE,QAAO;AAEzC,MAAI,CAAC,KAAK,gBACR,MAAK,6BAA6B,KAAK,cAAc;AAEvD,SAAO,MAAM,KAAK;;CAGpB,AAAQ,6BAA6B,cAA4B;EAC/D,IAAI,iBAA8C,KAAK,SAAS,2BAA2B,aAAa,CAAC,MAAM,gBAAgB;AAC7H,OAAI,mBAAmB,KAAK,iBAAiB;AAC3C,SAAK,kBAAkB;AACvB,SAAK,aAAa,IAAI,YAAY;AAClC,QAAI,CAAC,YACH,MAAK,aAAa;;AAGtB,UAAO;IACP;AACF,OAAK,kBAAkB"}
+{"version":3,"file":"sessions.js","names":[],"sources":["../../src/sessions.ts"],"sourcesContent":["import * as jose from 'jose';\nimport { InferType } from 'yup';\nimport { accessTokenPayloadSchema } from './schema-fields';\nimport { HexclaveAssertionError, throwErr } from \"./utils/errors\";\nimport { runAsynchronously, wait } from './utils/promises';\nimport { Store } from \"./utils/stores\";\n\n\nexport type AccessTokenPayload = InferType<typeof accessTokenPayloadSchema>;\n\nfunction decodeAccessTokenIfValid(token: string): AccessTokenPayload | null {\n  try {\n    const payload = jose.decodeJwt(token);\n    return accessTokenPayloadSchema.validateSync(payload);\n  } catch (e) {\n    return null;\n  }\n}\n\nexport class AccessToken {\n  static createIfValid(token: string): AccessToken | null {\n    const payload = decodeAccessTokenIfValid(token);\n    if (!payload) return null;\n    return new AccessToken(token);\n  }\n\n  private constructor(\n    public readonly token: string,\n  ) {\n    if (token === \"undefined\") {\n      throw new HexclaveAssertionError(\"Access token is the string 'undefined'; it's unlikely this is the correct value. They're supposed to be unguessable!\");\n    }\n  }\n\n  get payload() {\n    return decodeAccessTokenIfValid(this.token) ?? throwErr(\"Invalid access token in payload (should've been validated in createIfValid)\", { token: this.token });\n  }\n\n  get expiresAt(): Date {\n    const { exp } = this.payload;\n    if (exp === undefined) return new Date(8640000000000000);  // max date value\n    return new Date(exp * 1000);\n  }\n\n  get issuedAt(): Date {\n    const { iat } = this.payload;\n    return new Date(iat * 1000);\n  }\n\n  /**\n   * @returns The number of milliseconds until the access token expires, or 0 if it has already expired.\n   */\n  get expiresInMillis(): number {\n    return Math.max(0, this.expiresAt.getTime() - Date.now());\n  }\n\n  get issuedMillisAgo(): number {\n    return Math.max(0, Date.now() - this.issuedAt.getTime());\n  }\n\n  isExpired(): boolean {\n    return this.expiresInMillis <= 0;\n  }\n}\n\nexport class RefreshToken {\n  constructor(\n    public readonly token: string,\n  ) {\n    if (token === \"undefined\") {\n      throw new HexclaveAssertionError(\"Refresh token is the string 'undefined'; it's unlikely this is the correct value. They're supposed to be unguessable!\");\n    }\n  }\n}\n\n/**\n * An InternalSession represents a user's session, which may or may not be valid. It may contain an access token, a refresh token, or both.\n *\n * A session never changes which user or session it belongs to, but the tokens in it may change over time.\n */\nexport class InternalSession {\n  /**\n  * Each session has a session key that depends on the tokens inside. If the session has a refresh token, the session key depends only on the refresh token. If the session does not have a refresh token, the session key depends only on the access token.\n  *\n  * Multiple Session objects may have the same session key, which implies that they represent the same session by the same user. Furthermore, a session's key never changes over the lifetime of a session object.\n  *\n  * This is useful for caching and indexing sessions.\n  */\n  public readonly sessionKey: string;\n\n  /**\n   * An access token that is not known to be invalid (ie. may be valid, but may have expired).\n   */\n  private _accessToken: Store<AccessToken | null>;\n  private readonly _refreshToken: RefreshToken | null;\n\n  /**\n   * Whether the session as a whole is known to be invalid (ie. both access and refresh tokens are invalid). Used as a cache to avoid making multiple requests to the server (sessions never go back to being valid after being invalidated).\n   *\n   * It is possible for the access token to be invalid but the refresh token to be valid, in which case the session is\n   * still valid (just needs a refresh). It is also possible for the access token to be valid but the refresh token to\n   * be invalid, in which case the session is also valid (eg. if the refresh token is null because the user only passed\n   * in an access token, eg. in a server-side request handler).\n   */\n  private _knownToBeInvalid = new Store<boolean>(false);\n\n  private _refreshPromise: Promise<AccessToken | null> | null = null;\n\n  constructor(private readonly _options: {\n    refreshAccessTokenCallback(refreshToken: RefreshToken): Promise<AccessToken | null>,\n    refreshToken: string | null,\n    accessToken?: string | null,\n  }) {\n    this._accessToken = new Store(_options.accessToken ? AccessToken.createIfValid(_options.accessToken) : null);\n    this._refreshToken = _options.refreshToken ? new RefreshToken(_options.refreshToken) : null;\n    if (_options.accessToken === null && _options.refreshToken === null) {\n      // this session is already invalid\n      this._knownToBeInvalid.set(true);\n    }\n    this.sessionKey = InternalSession.calculateSessionKey({ accessToken: _options.accessToken ?? null, refreshToken: _options.refreshToken });\n  }\n\n  static calculateSessionKey(ofTokens: { refreshToken: string | null, accessToken?: string | null }): string {\n    if (ofTokens.refreshToken) {\n      return `refresh-${ofTokens.refreshToken}`;\n    } else if (ofTokens.accessToken) {\n      // Access-only sessions (no refresh token) are keyed by the underlying session's `refresh_token_id`, not the\n      // access token string: access tokens get re-minted frequently, and keying by the raw token would spawn a new\n      // session (and cold-invalidate every session-scoped cache) on each refresh. Falls back to the raw token if\n      // the JWT can't be decoded.\n      const refreshTokenId = decodeAccessTokenIfValid(ofTokens.accessToken)?.refresh_token_id;\n      if (refreshTokenId) {\n        return `access-session-${refreshTokenId}`;\n      }\n      return `access-${ofTokens.accessToken}`;\n    } else {\n      return \"not-logged-in\";\n    }\n  }\n\n  isKnownToBeInvalid() {\n    return this._knownToBeInvalid.get();\n  }\n\n  /**\n   * Marks the session object as invalid, meaning that the refresh and access tokens can no longer be used. There is no\n   * way out of this state, and the session object will never return valid tokens again.\n   */\n  markInvalid() {\n    this._accessToken.set(null);\n    this._knownToBeInvalid.set(true);\n  }\n\n  onInvalidate(callback: () => void): { unsubscribe: () => void } {\n    return this._knownToBeInvalid.onChange(() => callback());\n  }\n\n  getRefreshToken(): RefreshToken | null {\n    if (this.isKnownToBeInvalid()) return null;\n    return this._refreshToken;\n  }\n\n  /**\n   * Returns the access token if it is found in the cache and not expired yet, or null otherwise. Never fetches new tokens.\n   */\n  getAccessTokenIfNotExpiredYet(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): AccessToken | null {\n    if (minMillisUntilExpiration > 45_000) {\n      throw new Error(`Required access token expiry ${minMillisUntilExpiration}ms is too long; access tokens are too short to be used for more than 45s`);\n    }\n    if (maxMillisSinceIssued !== null && maxMillisSinceIssued < 15_000) {\n      throw new Error(`Required access token issuance ${maxMillisSinceIssued}ms is too short; assume that access token generation can take at least 15s`);\n    }\n\n    const accessToken = this._getPotentiallyInvalidAccessTokenIfAvailable();\n    if (!accessToken || accessToken.expiresInMillis < minMillisUntilExpiration) return null;\n    if (maxMillisSinceIssued !== null && accessToken.issuedMillisAgo > maxMillisSinceIssued) return null;\n    return accessToken;\n  }\n\n  /**\n   * Returns the access token if it is found in the cache, fetching it otherwise.\n   *\n   * This is usually the function you want to call to get an access token. Either set `minMillisUntilExpiration` to a reasonable value, or catch errors that occur if it expires, and call `markAccessTokenExpired` to mark the token as expired if so (after which a call to this function will always refetch the token).\n   *\n   * @returns null if the session is known to be invalid, cached tokens if they exist in the cache and the access token hasn't expired yet (the refresh token might still be invalid), or new tokens otherwise.\n   */\n  async getOrFetchLikelyValidTokens(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): Promise<{ accessToken: AccessToken, refreshToken: RefreshToken | null } | null> {\n    // fast path to save a roundtrip to the server if the session is known to be invalid\n    if (this.isKnownToBeInvalid()) return null;\n\n    const accessToken = this.getAccessTokenIfNotExpiredYet(minMillisUntilExpiration, maxMillisSinceIssued);\n    if (!accessToken) {\n      const newTokens = await this.fetchNewTokens();\n      const expiresInMillis = newTokens?.accessToken.expiresInMillis;\n      const issuedMillisAgo = newTokens?.accessToken.issuedMillisAgo;\n      if (expiresInMillis !== undefined && expiresInMillis < minMillisUntilExpiration) {\n        throw new HexclaveAssertionError(`Required access token expiry ${minMillisUntilExpiration}ms is too long; access tokens are too short when they're generated (${expiresInMillis}ms)`);\n      }\n      if (maxMillisSinceIssued !== null && issuedMillisAgo !== undefined && issuedMillisAgo > maxMillisSinceIssued) {\n        throw new HexclaveAssertionError(`Required access token issuance ${maxMillisSinceIssued}ms is too short; access token issuance is too slow (${issuedMillisAgo}ms)`);\n      }\n      return newTokens;\n    }\n    return { accessToken, refreshToken: this.getRefreshToken() };\n  }\n\n  /**\n   * Fetches new tokens that are, at the time of fetching, guaranteed to be valid.\n   *\n   * The newly generated tokens are short-lived, so it's good practice not to rely on their validity (if possible). However, this function is useful in some cases where you only want to pass access tokens to a service, and you want to make sure said access token has the longest possible lifetime.\n   *\n   * In most cases, you should prefer `getOrFetchLikelyValidTokens`.\n   *\n   * @returns null if the session is known to be invalid, or new tokens otherwise (which, at the time of fetching, are guaranteed to be valid).\n   */\n  async fetchNewTokens(): Promise<{ accessToken: AccessToken, refreshToken: RefreshToken | null } | null> {\n    const accessToken = await this._getNewlyFetchedAccessToken();\n    return accessToken ? { accessToken, refreshToken: this._refreshToken } : null;\n  }\n\n  /**\n   * Installs a freshly obtained token pair's access token into this session in place, keeping the session object\n   * (and therefore every session-scoped cache) stable instead of constructing a new InternalSession. No-op if the\n   * session is invalid, the access token can't be decoded, it's unchanged, or the pair doesn't map to this session\n   * (so a foreign token can never be written into this object's cache); never clears an existing token.\n   */\n  updateAccessToken(tokens: { accessToken: string | null, refreshToken: string | null }) {\n    if (this._knownToBeInvalid.get()) return;\n    if (!tokens.accessToken) return;\n    const newAccessToken = AccessToken.createIfValid(tokens.accessToken);\n    if (!newAccessToken) return;\n    // Self-enforce the \"a session never changes which session it belongs to\" invariant: only install a token pair\n    // that maps to this same session key (validated against the incoming pair, not this session's existing tokens).\n    if (InternalSession.calculateSessionKey(tokens) !== this.sessionKey) return;\n    if (this._accessToken.get()?.token === newAccessToken.token) return;\n    this._accessToken.set(newAccessToken);\n  }\n\n  /**\n   * Manually mark the access token as expired, even if the date on its payload may still be valid.\n   *\n   * You don't usually have to call this function anymore, but you may want to call suggestAccessTokenExpired\n   * to hint that the access token should be refreshed as its data may have changed, if possible.\n   */\n  markAccessTokenExpired(accessToken?: AccessToken) {\n    if (!accessToken || this._accessToken.get()?.token === accessToken.token) {\n      this._accessToken.set(null);\n    }\n  }\n\n  /**\n   * Strongly suggests that the access token should be refreshed as its data may have changed, although it's up to this\n   * implementation to decide whether or when the access token will be refreshed.\n   *\n   * This is particularly useful when the data associated with the access token may have changed for example due to an\n   * update to the user's profile.\n   *\n   * The current implementation marks the access token as expired if and only if a refresh token is available (regardless of\n   * whether the refresh token is actually valid or not), although this is not a guarantee and subject to change.\n   *\n   * If you need a stronger guarantee of revoking an access token, use markAccessTokenExpired instead.\n   */\n  suggestAccessTokenExpired(): void {\n    if (this._refreshToken) {\n      this.markAccessTokenExpired();\n    }\n  }\n\n  startRefreshingAccessToken(minMillisUntilExpiration: number, maxMillisSinceIssued: number | null): { unsubscribe: () => void } {\n    let canceled = false;\n    runAsynchronously(async () => {\n      while (!canceled) {\n        const tokens = await this.getOrFetchLikelyValidTokens(minMillisUntilExpiration, maxMillisSinceIssued);\n        if (!tokens) return;  // session is invalid, stop refreshing\n        const nextRefreshIn = Math.min(\n          tokens.accessToken.expiresInMillis - minMillisUntilExpiration,\n          (maxMillisSinceIssued ?? Infinity) - tokens.accessToken.issuedMillisAgo,\n        );\n        await wait(Math.max(1, nextRefreshIn));\n      }\n    });\n    return {\n      unsubscribe: () => {\n        canceled = true;\n      },\n    };\n  }\n\n  /**\n   * Note that a callback invocation with `null` does not mean the session has been invalidated; the access token may just have expired. Use `onInvalidate` to detect invalidation.\n   */\n  onAccessTokenChange(callback: (newAccessToken: AccessToken | null) => void): { unsubscribe: () => void } {\n    return this._accessToken.onChange(callback);\n  }\n\n  /**\n   * @returns An access token, which may be expired or expire soon, or null if it is known to be invalid.\n   */\n  private _getPotentiallyInvalidAccessTokenIfAvailable(): AccessToken | null {\n    if (this.isKnownToBeInvalid()) return null;\n\n    const accessToken = this._accessToken.get();\n    if (accessToken && !accessToken.isExpired()) return accessToken;\n\n    return null;\n  }\n\n  /**\n   * You should prefer `_getOrFetchPotentiallyInvalidAccessToken` in almost all cases.\n   *\n   * @returns A newly fetched access token (never read from cache), or null if the session either does not represent a user or the session is invalid.\n   */\n  private async _getNewlyFetchedAccessToken(): Promise<AccessToken | null> {\n    if (!this._refreshToken) return null;\n    if (this._knownToBeInvalid.get()) return null;\n\n    if (!this._refreshPromise) {\n      this._refreshAndSetRefreshPromise(this._refreshToken);\n    }\n    return await this._refreshPromise;\n  }\n\n  private _refreshAndSetRefreshPromise(refreshToken: RefreshToken) {\n    let refreshPromise: Promise<AccessToken | null> = this._options.refreshAccessTokenCallback(refreshToken).then((accessToken) => {\n      if (refreshPromise === this._refreshPromise) {\n        this._refreshPromise = null;\n        this._accessToken.set(accessToken);\n        if (!accessToken) {\n          this.markInvalid();\n        }\n      }\n      return accessToken;\n    });\n    this._refreshPromise = refreshPromise;\n  }\n}\n"],"mappings":";;;;;;AAUA,SAAS,yBAAyB,OAA0C;CAC1E,IAAI;EACF,MAAM,UAAU,KAAK,UAAU,KAAK;EACpC,OAAO,yBAAyB,aAAa,OAAO;CACtD,SAAS,GAAG;EACV,OAAO;CACT;AACF;AAEA,IAAa,cAAb,MAAa,YAAY;CACvB,OAAO,cAAc,OAAmC;EAEtD,IAAI,CADY,yBAAyB,KAC9B,GAAG,OAAO;EACrB,OAAO,IAAI,YAAY,KAAK;CAC9B;CAEA,YACE,OACA;EADgB,KAAA,QAAA;EAEhB,IAAI,UAAU,aACZ,MAAM,IAAI,uBAAuB,sHAAsH;CAE3J;CAEA,IAAI,UAAU;EACZ,OAAO,yBAAyB,KAAK,KAAK,KAAK,SAAS,+EAA+E,EAAE,OAAO,KAAK,MAAM,CAAC;CAC9J;CAEA,IAAI,YAAkB;EACpB,MAAM,EAAE,QAAQ,KAAK;EACrB,IAAI,QAAQ,KAAA,GAAW,uBAAO,IAAI,KAAK,MAAgB;EACvD,uBAAO,IAAI,KAAK,MAAM,GAAI;CAC5B;CAEA,IAAI,WAAiB;EACnB,MAAM,EAAE,QAAQ,KAAK;EACrB,uBAAO,IAAI,KAAK,MAAM,GAAI;CAC5B;;;;CAKA,IAAI,kBAA0B;EAC5B,OAAO,KAAK,IAAI,GAAG,KAAK,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;CAC1D;CAEA,IAAI,kBAA0B;EAC5B,OAAO,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,SAAS,QAAQ,CAAC;CACzD;CAEA,YAAqB;EACnB,OAAO,KAAK,mBAAmB;CACjC;AACF;AAEA,IAAa,eAAb,MAA0B;CACxB,YACE,OACA;EADgB,KAAA,QAAA;EAEhB,IAAI,UAAU,aACZ,MAAM,IAAI,uBAAuB,uHAAuH;CAE5J;AACF;;;;;;AAOA,IAAa,kBAAb,MAAa,gBAAgB;CA4B3B,YAAY,UAIT;EAJ0B,KAAA,WAAA;2BAJD,IAAI,MAAe,KAAK;yBAEU;EAO5D,KAAK,eAAe,IAAI,MAAM,SAAS,cAAc,YAAY,cAAc,SAAS,WAAW,IAAI,IAAI;EAC3G,KAAK,gBAAgB,SAAS,eAAe,IAAI,aAAa,SAAS,YAAY,IAAI;EACvF,IAAI,SAAS,gBAAgB,QAAQ,SAAS,iBAAiB,MAE7D,KAAK,kBAAkB,IAAI,IAAI;EAEjC,KAAK,aAAa,gBAAgB,oBAAoB;GAAE,aAAa,SAAS,eAAe;GAAM,cAAc,SAAS;EAAa,CAAC;CAC1I;CAEA,OAAO,oBAAoB,UAAgF;EACzG,IAAI,SAAS,cACX,OAAO,WAAW,SAAS;OACtB,IAAI,SAAS,aAAa;GAK/B,MAAM,iBAAiB,yBAAyB,SAAS,WAAW,CAAC,EAAE;GACvE,IAAI,gBACF,OAAO,kBAAkB;GAE3B,OAAO,UAAU,SAAS;EAC5B,OACE,OAAO;CAEX;CAEA,qBAAqB;EACnB,OAAO,KAAK,kBAAkB,IAAI;CACpC;;;;;CAMA,cAAc;EACZ,KAAK,aAAa,IAAI,IAAI;EAC1B,KAAK,kBAAkB,IAAI,IAAI;CACjC;CAEA,aAAa,UAAmD;EAC9D,OAAO,KAAK,kBAAkB,eAAe,SAAS,CAAC;CACzD;CAEA,kBAAuC;EACrC,IAAI,KAAK,mBAAmB,GAAG,OAAO;EACtC,OAAO,KAAK;CACd;;;;CAKA,8BAA8B,0BAAkC,sBAAyD;EACvH,IAAI,2BAA2B,MAC7B,MAAM,IAAI,MAAM,gCAAgC,yBAAyB,yEAAyE;EAEpJ,IAAI,yBAAyB,QAAQ,uBAAuB,MAC1D,MAAM,IAAI,MAAM,kCAAkC,qBAAqB,2EAA2E;EAGpJ,MAAM,cAAc,KAAK,6CAA6C;EACtE,IAAI,CAAC,eAAe,YAAY,kBAAkB,0BAA0B,OAAO;EACnF,IAAI,yBAAyB,QAAQ,YAAY,kBAAkB,sBAAsB,OAAO;EAChG,OAAO;CACT;;;;;;;;CASA,MAAM,4BAA4B,0BAAkC,sBAAsH;EAExL,IAAI,KAAK,mBAAmB,GAAG,OAAO;EAEtC,MAAM,cAAc,KAAK,8BAA8B,0BAA0B,oBAAoB;EACrG,IAAI,CAAC,aAAa;GAChB,MAAM,YAAY,MAAM,KAAK,eAAe;GAC5C,MAAM,kBAAkB,WAAW,YAAY;GAC/C,MAAM,kBAAkB,WAAW,YAAY;GAC/C,IAAI,oBAAoB,KAAA,KAAa,kBAAkB,0BACrD,MAAM,IAAI,uBAAuB,gCAAgC,yBAAyB,sEAAsE,gBAAgB,IAAI;GAEtL,IAAI,yBAAyB,QAAQ,oBAAoB,KAAA,KAAa,kBAAkB,sBACtF,MAAM,IAAI,uBAAuB,kCAAkC,qBAAqB,sDAAsD,gBAAgB,IAAI;GAEpK,OAAO;EACT;EACA,OAAO;GAAE;GAAa,cAAc,KAAK,gBAAgB;EAAE;CAC7D;;;;;;;;;;CAWA,MAAM,iBAAkG;EACtG,MAAM,cAAc,MAAM,KAAK,4BAA4B;EAC3D,OAAO,cAAc;GAAE;GAAa,cAAc,KAAK;EAAc,IAAI;CAC3E;;;;;;;CAQA,kBAAkB,QAAqE;EACrF,IAAI,KAAK,kBAAkB,IAAI,GAAG;EAClC,IAAI,CAAC,OAAO,aAAa;EACzB,MAAM,iBAAiB,YAAY,cAAc,OAAO,WAAW;EACnE,IAAI,CAAC,gBAAgB;EAGrB,IAAI,gBAAgB,oBAAoB,MAAM,MAAM,KAAK,YAAY;EACrE,IAAI,KAAK,aAAa,IAAI,CAAC,EAAE,UAAU,eAAe,OAAO;EAC7D,KAAK,aAAa,IAAI,cAAc;CACtC;;;;;;;CAQA,uBAAuB,aAA2B;EAChD,IAAI,CAAC,eAAe,KAAK,aAAa,IAAI,CAAC,EAAE,UAAU,YAAY,OACjE,KAAK,aAAa,IAAI,IAAI;CAE9B;;;;;;;;;;;;;CAcA,4BAAkC;EAChC,IAAI,KAAK,eACP,KAAK,uBAAuB;CAEhC;CAEA,2BAA2B,0BAAkC,sBAAkE;EAC7H,IAAI,WAAW;EACf,kBAAkB,YAAY;GAC5B,OAAO,CAAC,UAAU;IAChB,MAAM,SAAS,MAAM,KAAK,4BAA4B,0BAA0B,oBAAoB;IACpG,IAAI,CAAC,QAAQ;IACb,MAAM,gBAAgB,KAAK,IACzB,OAAO,YAAY,kBAAkB,2BACpC,wBAAwB,YAAY,OAAO,YAAY,eAC1D;IACA,MAAM,KAAK,KAAK,IAAI,GAAG,aAAa,CAAC;GACvC;EACF,CAAC;EACD,OAAO,EACL,mBAAmB;GACjB,WAAW;EACb,EACF;CACF;;;;CAKA,oBAAoB,UAAqF;EACvG,OAAO,KAAK,aAAa,SAAS,QAAQ;CAC5C;;;;CAKA,+CAA2E;EACzE,IAAI,KAAK,mBAAmB,GAAG,OAAO;EAEtC,MAAM,cAAc,KAAK,aAAa,IAAI;EAC1C,IAAI,eAAe,CAAC,YAAY,UAAU,GAAG,OAAO;EAEpD,OAAO;CACT;;;;;;CAOA,MAAc,8BAA2D;EACvE,IAAI,CAAC,KAAK,eAAe,OAAO;EAChC,IAAI,KAAK,kBAAkB,IAAI,GAAG,OAAO;EAEzC,IAAI,CAAC,KAAK,iBACR,KAAK,6BAA6B,KAAK,aAAa;EAEtD,OAAO,MAAM,KAAK;CACpB;CAEA,6BAAqC,cAA4B;EAC/D,IAAI,iBAA8C,KAAK,SAAS,2BAA2B,YAAY,CAAC,CAAC,MAAM,gBAAgB;GAC7H,IAAI,mBAAmB,KAAK,iBAAiB;IAC3C,KAAK,kBAAkB;IACvB,KAAK,aAAa,IAAI,WAAW;IACjC,IAAI,CAAC,aACH,KAAK,YAAY;GAErB;GACA,OAAO;EACT,CAAC;EACD,KAAK,kBAAkB;CACzB;AACF"}

package/dist/esm/sessions.test.js

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "vitest";
 import { InternalSession } from "./sessions.js";
-
 //#region src/sessions.test.ts
 /**
 * Builds a decodable (unsigned) access-token JWT with a valid payload. `refreshTokenId` controls the
@@ -172,7 +171,7 @@ describe("InternalSession#updateAccessToken", () => {
 		expect(currentToken(session)).toBe(initial);
 	});
 });
-
 //#endregion
-export {  };
+export {};
+
 //# sourceMappingURL=sessions.test.js.map

package/dist/esm/sessions.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.test.js","names":[],"sources":["../../src/sessions.test.ts"],"sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { InternalSession } from \"./sessions\";\n\n/**\n * Builds a decodable (unsigned) access-token JWT with a valid payload. `refreshTokenId` controls the\n * `refresh_token_id` claim (the session identifier); `iatOffsetSeconds` lets two tokens for the same session\n * differ as strings while sharing a `refresh_token_id`.\n */\nfunction createAccessTokenString(refreshTokenId: string, options?: { iatOffsetSeconds?: number, sub?: string }): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000) + (options?.iatOffsetSeconds ?? 0);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: options?.sub ?? \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createAccessOnlySession(accessToken: string): InternalSession {\n  return new InternalSession({\n    refreshAccessTokenCallback: async () => null,\n    refreshToken: null,\n    accessToken,\n  });\n}\n\nconst currentToken = (session: InternalSession) => session.getAccessTokenIfNotExpiredYet(20_000, null)?.token;\n\ndescribe(\"InternalSession.calculateSessionKey\", () => {\n  it(\"keys by the refresh token when one is present (ignoring any access token)\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: \"rt-abc\" })).toBe(\"refresh-rt-abc\");\n    expect(InternalSession.calculateSessionKey({ refreshToken: \"rt-abc\", accessToken: createAccessTokenString(\"rtid-1\") }))\n      .toBe(\"refresh-rt-abc\");\n  });\n\n  it(\"returns not-logged-in when neither token is present\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null })).toBe(\"not-logged-in\");\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: null })).toBe(\"not-logged-in\");\n  });\n\n  it(\"keys an access-only session by its refresh_token_id\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-1\") }))\n      .toBe(\"access-session-rtid-1\");\n  });\n\n  it(\"is stable across re-minted access tokens for the same session (the regression this fixes)\", () => {\n    const first = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 0 });\n    const second = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 });\n    expect(second).not.toBe(first);\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: second }))\n      .toBe(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: first }));\n  });\n\n  it(\"distinguishes access-only sessions with different refresh_token_ids\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-1\") }))\n      .not.toBe(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-2\") }));\n  });\n\n  it(\"falls back to the raw token when the access token can't be decoded\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: \"not-a-jwt\" })).toBe(\"access-not-a-jwt\");\n  });\n});\n\ndescribe(\"InternalSession#updateAccessToken\", () => {\n  it(\"installs a fresh token for the same access-only session in place\", () => {\n    const initial = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 0 });\n    const refreshed = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 });\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: refreshed, refreshToken: null });\n    expect(currentToken(session)).toBe(refreshed);\n    // identity is unchanged — same session key, same object\n    expect(session.sessionKey).toBe(\"access-session-rtid-1\");\n  });\n\n  it(\"rejects a token pair belonging to a different access-only session\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const foreign = createAccessTokenString(\"rtid-2\", { sub: \"other-user\" });\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: foreign, refreshToken: null });\n    expect(currentToken(session)).toBe(initial);\n  });\n\n  it(\"is a no-op for an unchanged, null, or undecodable token\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: initial, refreshToken: null });\n    session.updateAccessToken({ accessToken: null, refreshToken: null });\n    session.updateAccessToken({ accessToken: \"not-a-jwt\", refreshToken: null });\n    expect(currentToken(session)).toBe(initial);\n  });\n\n  it(\"never revives an invalidated session\", () => {\n    const session = createAccessOnlySession(createAccessTokenString(\"rtid-1\"));\n    session.markInvalid();\n\n    session.updateAccessToken({ accessToken: createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 }), refreshToken: null });\n    expect(session.isKnownToBeInvalid()).toBe(true);\n    expect(currentToken(session)).toBeUndefined();\n  });\n\n  it(\"updates a refresh-token-backed session's access token in place when the refresh token matches\", () => {\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async () => null,\n      refreshToken: \"rt-abc\",\n      accessToken: createAccessTokenString(\"rtid-1\"),\n    });\n    const refreshed = createAccessTokenString(\"rtid-2\", { iatOffsetSeconds: 1 });\n\n    session.updateAccessToken({ accessToken: refreshed, refreshToken: \"rt-abc\" });\n    expect(currentToken(session)).toBe(refreshed);\n    expect(session.sessionKey).toBe(\"refresh-rt-abc\");\n  });\n\n  it(\"rejects a token pair carrying a different refresh token for a refresh-backed session\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async () => null,\n      refreshToken: \"rt-abc\",\n      accessToken: initial,\n    });\n\n    session.updateAccessToken({ accessToken: createAccessTokenString(\"rtid-2\"), refreshToken: \"rt-other\" });\n    expect(currentToken(session)).toBe(initial);\n  });\n});\n"],"mappings":";;;;;;;;;AAQA,SAAS,wBAAwB,gBAAwB,SAA+D;CACtH,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,SAAS,YAAY;CAC3F,MAAM,aAAa,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,IAAI,SAAS,oBAAoB;AACjF,QAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;GAAO,CAAC;EACnC,OAAO;GACL,KAAK,SAAS,OAAO;GACrB,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;GACpB,CAAC;EACF;EACD,CAAC,KAAK,IAAI;;AAGb,SAAS,wBAAwB,aAAsC;AACrE,QAAO,IAAI,gBAAgB;EACzB,4BAA4B,YAAY;EACxC,cAAc;EACd;EACD,CAAC;;AAGJ,MAAM,gBAAgB,YAA6B,QAAQ,8BAA8B,KAAQ,KAAK,EAAE;AAExG,SAAS,6CAA6C;AACpD,IAAG,mFAAmF;AACpF,SAAO,gBAAgB,oBAAoB,EAAE,cAAc,UAAU,CAAC,CAAC,CAAC,KAAK,iBAAiB;AAC9F,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAU,aAAa,wBAAwB,SAAS;GAAE,CAAC,CAAC,CACpH,KAAK,iBAAiB;GACzB;AAEF,IAAG,6DAA6D;AAC9D,SAAO,gBAAgB,oBAAoB,EAAE,cAAc,MAAM,CAAC,CAAC,CAAC,KAAK,gBAAgB;AACzF,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;GAAM,CAAC,CAAC,CAAC,KAAK,gBAAgB;GAC5G;AAEF,IAAG,6DAA6D;AAC9D,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,SAAS;GAAE,CAAC,CAAC,CAChH,KAAK,wBAAwB;GAChC;AAEF,IAAG,mGAAmG;EACpG,MAAM,QAAQ,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;EACxE,MAAM,SAAS,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;AACzE,SAAO,OAAO,CAAC,IAAI,KAAK,MAAM;AAC9B,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;GAAQ,CAAC,CAAC,CACrF,KAAK,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;GAAO,CAAC,CAAC;GACxF;AAEF,IAAG,6EAA6E;AAC9E,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,SAAS;GAAE,CAAC,CAAC,CAChH,IAAI,KAAK,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,SAAS;GAAE,CAAC,CAAC;GACxH;AAEF,IAAG,4EAA4E;AAC7E,SAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;GAAa,CAAC,CAAC,CAAC,KAAK,mBAAmB;GACtH;EACF;AAEF,SAAS,2CAA2C;AAClD,IAAG,0EAA0E;EAC3E,MAAM,UAAU,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;EAC1E,MAAM,YAAY,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;EAC5E,MAAM,UAAU,wBAAwB,QAAQ;AAEhD,UAAQ,kBAAkB;GAAE,aAAa;GAAW,cAAc;GAAM,CAAC;AACzE,SAAO,aAAa,QAAQ,CAAC,CAAC,KAAK,UAAU;AAE7C,SAAO,QAAQ,WAAW,CAAC,KAAK,wBAAwB;GACxD;AAEF,IAAG,2EAA2E;EAC5E,MAAM,UAAU,wBAAwB,SAAS;EACjD,MAAM,UAAU,wBAAwB,UAAU,EAAE,KAAK,cAAc,CAAC;EACxE,MAAM,UAAU,wBAAwB,QAAQ;AAEhD,UAAQ,kBAAkB;GAAE,aAAa;GAAS,cAAc;GAAM,CAAC;AACvE,SAAO,aAAa,QAAQ,CAAC,CAAC,KAAK,QAAQ;GAC3C;AAEF,IAAG,iEAAiE;EAClE,MAAM,UAAU,wBAAwB,SAAS;EACjD,MAAM,UAAU,wBAAwB,QAAQ;AAEhD,UAAQ,kBAAkB;GAAE,aAAa;GAAS,cAAc;GAAM,CAAC;AACvE,UAAQ,kBAAkB;GAAE,aAAa;GAAM,cAAc;GAAM,CAAC;AACpE,UAAQ,kBAAkB;GAAE,aAAa;GAAa,cAAc;GAAM,CAAC;AAC3E,SAAO,aAAa,QAAQ,CAAC,CAAC,KAAK,QAAQ;GAC3C;AAEF,IAAG,8CAA8C;EAC/C,MAAM,UAAU,wBAAwB,wBAAwB,SAAS,CAAC;AAC1E,UAAQ,aAAa;AAErB,UAAQ,kBAAkB;GAAE,aAAa,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;GAAE,cAAc;GAAM,CAAC;AAC1H,SAAO,QAAQ,oBAAoB,CAAC,CAAC,KAAK,KAAK;AAC/C,SAAO,aAAa,QAAQ,CAAC,CAAC,eAAe;GAC7C;AAEF,IAAG,uGAAuG;EACxG,MAAM,UAAU,IAAI,gBAAgB;GAClC,4BAA4B,YAAY;GACxC,cAAc;GACd,aAAa,wBAAwB,SAAS;GAC/C,CAAC;EACF,MAAM,YAAY,wBAAwB,UAAU,EAAE,kBAAkB,GAAG,CAAC;AAE5E,UAAQ,kBAAkB;GAAE,aAAa;GAAW,cAAc;GAAU,CAAC;AAC7E,SAAO,aAAa,QAAQ,CAAC,CAAC,KAAK,UAAU;AAC7C,SAAO,QAAQ,WAAW,CAAC,KAAK,iBAAiB;GACjD;AAEF,IAAG,8FAA8F;EAC/F,MAAM,UAAU,wBAAwB,SAAS;EACjD,MAAM,UAAU,IAAI,gBAAgB;GAClC,4BAA4B,YAAY;GACxC,cAAc;GACd,aAAa;GACd,CAAC;AAEF,UAAQ,kBAAkB;GAAE,aAAa,wBAAwB,SAAS;GAAE,cAAc;GAAY,CAAC;AACvG,SAAO,aAAa,QAAQ,CAAC,CAAC,KAAK,QAAQ;GAC3C;EACF"}
+{"version":3,"file":"sessions.test.js","names":[],"sources":["../../src/sessions.test.ts"],"sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { InternalSession } from \"./sessions\";\n\n/**\n * Builds a decodable (unsigned) access-token JWT with a valid payload. `refreshTokenId` controls the\n * `refresh_token_id` claim (the session identifier); `iatOffsetSeconds` lets two tokens for the same session\n * differ as strings while sharing a `refresh_token_id`.\n */\nfunction createAccessTokenString(refreshTokenId: string, options?: { iatOffsetSeconds?: number, sub?: string }): string {\n  const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString(\"base64url\");\n  const nowSeconds = Math.floor(Date.now() / 1000) + (options?.iatOffsetSeconds ?? 0);\n  return [\n    encode({ alg: \"none\", typ: \"JWT\" }),\n    encode({\n      sub: options?.sub ?? \"user-id\",\n      exp: nowSeconds + 60,\n      iat: nowSeconds,\n      iss: \"https://api.example.test\",\n      aud: \"project-id\",\n      project_id: \"project-id\",\n      branch_id: \"main\",\n      refresh_token_id: refreshTokenId,\n      role: \"authenticated\",\n      name: null,\n      email: null,\n      email_verified: false,\n      selected_team_id: null,\n      signed_up_at: nowSeconds,\n      is_anonymous: false,\n      is_restricted: false,\n      restricted_reason: null,\n      requires_totp_mfa: false,\n    }),\n    \"\",\n  ].join(\".\");\n}\n\nfunction createAccessOnlySession(accessToken: string): InternalSession {\n  return new InternalSession({\n    refreshAccessTokenCallback: async () => null,\n    refreshToken: null,\n    accessToken,\n  });\n}\n\nconst currentToken = (session: InternalSession) => session.getAccessTokenIfNotExpiredYet(20_000, null)?.token;\n\ndescribe(\"InternalSession.calculateSessionKey\", () => {\n  it(\"keys by the refresh token when one is present (ignoring any access token)\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: \"rt-abc\" })).toBe(\"refresh-rt-abc\");\n    expect(InternalSession.calculateSessionKey({ refreshToken: \"rt-abc\", accessToken: createAccessTokenString(\"rtid-1\") }))\n      .toBe(\"refresh-rt-abc\");\n  });\n\n  it(\"returns not-logged-in when neither token is present\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null })).toBe(\"not-logged-in\");\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: null })).toBe(\"not-logged-in\");\n  });\n\n  it(\"keys an access-only session by its refresh_token_id\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-1\") }))\n      .toBe(\"access-session-rtid-1\");\n  });\n\n  it(\"is stable across re-minted access tokens for the same session (the regression this fixes)\", () => {\n    const first = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 0 });\n    const second = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 });\n    expect(second).not.toBe(first);\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: second }))\n      .toBe(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: first }));\n  });\n\n  it(\"distinguishes access-only sessions with different refresh_token_ids\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-1\") }))\n      .not.toBe(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: createAccessTokenString(\"rtid-2\") }));\n  });\n\n  it(\"falls back to the raw token when the access token can't be decoded\", () => {\n    expect(InternalSession.calculateSessionKey({ refreshToken: null, accessToken: \"not-a-jwt\" })).toBe(\"access-not-a-jwt\");\n  });\n});\n\ndescribe(\"InternalSession#updateAccessToken\", () => {\n  it(\"installs a fresh token for the same access-only session in place\", () => {\n    const initial = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 0 });\n    const refreshed = createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 });\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: refreshed, refreshToken: null });\n    expect(currentToken(session)).toBe(refreshed);\n    // identity is unchanged — same session key, same object\n    expect(session.sessionKey).toBe(\"access-session-rtid-1\");\n  });\n\n  it(\"rejects a token pair belonging to a different access-only session\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const foreign = createAccessTokenString(\"rtid-2\", { sub: \"other-user\" });\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: foreign, refreshToken: null });\n    expect(currentToken(session)).toBe(initial);\n  });\n\n  it(\"is a no-op for an unchanged, null, or undecodable token\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const session = createAccessOnlySession(initial);\n\n    session.updateAccessToken({ accessToken: initial, refreshToken: null });\n    session.updateAccessToken({ accessToken: null, refreshToken: null });\n    session.updateAccessToken({ accessToken: \"not-a-jwt\", refreshToken: null });\n    expect(currentToken(session)).toBe(initial);\n  });\n\n  it(\"never revives an invalidated session\", () => {\n    const session = createAccessOnlySession(createAccessTokenString(\"rtid-1\"));\n    session.markInvalid();\n\n    session.updateAccessToken({ accessToken: createAccessTokenString(\"rtid-1\", { iatOffsetSeconds: 1 }), refreshToken: null });\n    expect(session.isKnownToBeInvalid()).toBe(true);\n    expect(currentToken(session)).toBeUndefined();\n  });\n\n  it(\"updates a refresh-token-backed session's access token in place when the refresh token matches\", () => {\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async () => null,\n      refreshToken: \"rt-abc\",\n      accessToken: createAccessTokenString(\"rtid-1\"),\n    });\n    const refreshed = createAccessTokenString(\"rtid-2\", { iatOffsetSeconds: 1 });\n\n    session.updateAccessToken({ accessToken: refreshed, refreshToken: \"rt-abc\" });\n    expect(currentToken(session)).toBe(refreshed);\n    expect(session.sessionKey).toBe(\"refresh-rt-abc\");\n  });\n\n  it(\"rejects a token pair carrying a different refresh token for a refresh-backed session\", () => {\n    const initial = createAccessTokenString(\"rtid-1\");\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async () => null,\n      refreshToken: \"rt-abc\",\n      accessToken: initial,\n    });\n\n    session.updateAccessToken({ accessToken: createAccessTokenString(\"rtid-2\"), refreshToken: \"rt-other\" });\n    expect(currentToken(session)).toBe(initial);\n  });\n});\n"],"mappings":";;;;;;;;AAQA,SAAS,wBAAwB,gBAAwB,SAA+D;CACtH,MAAM,UAAU,UAAmB,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW;CAC1F,MAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,SAAS,oBAAoB;CACjF,OAAO;EACL,OAAO;GAAE,KAAK;GAAQ,KAAK;EAAM,CAAC;EAClC,OAAO;GACL,KAAK,SAAS,OAAO;GACrB,KAAK,aAAa;GAClB,KAAK;GACL,KAAK;GACL,KAAK;GACL,YAAY;GACZ,WAAW;GACX,kBAAkB;GAClB,MAAM;GACN,MAAM;GACN,OAAO;GACP,gBAAgB;GAChB,kBAAkB;GAClB,cAAc;GACd,cAAc;GACd,eAAe;GACf,mBAAmB;GACnB,mBAAmB;EACrB,CAAC;EACD;CACF,CAAC,CAAC,KAAK,GAAG;AACZ;AAEA,SAAS,wBAAwB,aAAsC;CACrE,OAAO,IAAI,gBAAgB;EACzB,4BAA4B,YAAY;EACxC,cAAc;EACd;CACF,CAAC;AACH;AAEA,MAAM,gBAAgB,YAA6B,QAAQ,8BAA8B,KAAQ,IAAI,CAAC,EAAE;AAExG,SAAS,6CAA6C;CACpD,GAAG,mFAAmF;EACpF,OAAO,gBAAgB,oBAAoB,EAAE,cAAc,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,gBAAgB;EAC7F,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAU,aAAa,wBAAwB,QAAQ;EAAE,CAAC,CAAC,CAAC,CACpH,KAAK,gBAAgB;CAC1B,CAAC;CAED,GAAG,6DAA6D;EAC9D,OAAO,gBAAgB,oBAAoB,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe;EACxF,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;EAAK,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe;CAC7G,CAAC;CAED,GAAG,6DAA6D;EAC9D,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,QAAQ;EAAE,CAAC,CAAC,CAAC,CAChH,KAAK,uBAAuB;CACjC,CAAC;CAED,GAAG,mGAAmG;EACpG,MAAM,QAAQ,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;EACvE,MAAM,SAAS,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;EACxE,OAAO,MAAM,CAAC,CAAC,IAAI,KAAK,KAAK;EAC7B,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;EAAO,CAAC,CAAC,CAAC,CACrF,KAAK,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;EAAM,CAAC,CAAC;CACzF,CAAC;CAED,GAAG,6EAA6E;EAC9E,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,QAAQ;EAAE,CAAC,CAAC,CAAC,CAChH,IAAI,KAAK,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa,wBAAwB,QAAQ;EAAE,CAAC,CAAC;CACzH,CAAC;CAED,GAAG,4EAA4E;EAC7E,OAAO,gBAAgB,oBAAoB;GAAE,cAAc;GAAM,aAAa;EAAY,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB;CACvH,CAAC;AACH,CAAC;AAED,SAAS,2CAA2C;CAClD,GAAG,0EAA0E;EAC3E,MAAM,UAAU,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;EACzE,MAAM,YAAY,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;EAC3E,MAAM,UAAU,wBAAwB,OAAO;EAE/C,QAAQ,kBAAkB;GAAE,aAAa;GAAW,cAAc;EAAK,CAAC;EACxE,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;EAE5C,OAAO,QAAQ,UAAU,CAAC,CAAC,KAAK,uBAAuB;CACzD,CAAC;CAED,GAAG,2EAA2E;EAC5E,MAAM,UAAU,wBAAwB,QAAQ;EAChD,MAAM,UAAU,wBAAwB,UAAU,EAAE,KAAK,aAAa,CAAC;EACvE,MAAM,UAAU,wBAAwB,OAAO;EAE/C,QAAQ,kBAAkB;GAAE,aAAa;GAAS,cAAc;EAAK,CAAC;EACtE,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO;CAC5C,CAAC;CAED,GAAG,iEAAiE;EAClE,MAAM,UAAU,wBAAwB,QAAQ;EAChD,MAAM,UAAU,wBAAwB,OAAO;EAE/C,QAAQ,kBAAkB;GAAE,aAAa;GAAS,cAAc;EAAK,CAAC;EACtE,QAAQ,kBAAkB;GAAE,aAAa;GAAM,cAAc;EAAK,CAAC;EACnE,QAAQ,kBAAkB;GAAE,aAAa;GAAa,cAAc;EAAK,CAAC;EAC1E,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO;CAC5C,CAAC;CAED,GAAG,8CAA8C;EAC/C,MAAM,UAAU,wBAAwB,wBAAwB,QAAQ,CAAC;EACzE,QAAQ,YAAY;EAEpB,QAAQ,kBAAkB;GAAE,aAAa,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;GAAG,cAAc;EAAK,CAAC;EACzH,OAAO,QAAQ,mBAAmB,CAAC,CAAC,CAAC,KAAK,IAAI;EAC9C,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,cAAc;CAC9C,CAAC;CAED,GAAG,uGAAuG;EACxG,MAAM,UAAU,IAAI,gBAAgB;GAClC,4BAA4B,YAAY;GACxC,cAAc;GACd,aAAa,wBAAwB,QAAQ;EAC/C,CAAC;EACD,MAAM,YAAY,wBAAwB,UAAU,EAAE,kBAAkB,EAAE,CAAC;EAE3E,QAAQ,kBAAkB;GAAE,aAAa;GAAW,cAAc;EAAS,CAAC;EAC5E,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;EAC5C,OAAO,QAAQ,UAAU,CAAC,CAAC,KAAK,gBAAgB;CAClD,CAAC;CAED,GAAG,8FAA8F;EAC/F,MAAM,UAAU,wBAAwB,QAAQ;EAChD,MAAM,UAAU,IAAI,gBAAgB;GAClC,4BAA4B,YAAY;GACxC,cAAc;GACd,aAAa;EACf,CAAC;EAED,QAAQ,kBAAkB;GAAE,aAAa,wBAAwB,QAAQ;GAAG,cAAc;EAAW,CAAC;EACtG,OAAO,aAAa,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO;CAC5C,CAAC;AACH,CAAC"}

package/dist/esm/utils/analytics-clickmap-overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics-clickmap-overlay.d.ts","names":[],"sources":["../../../src/utils/analytics-clickmap-overlay.tsx"],"mappings":";;AAYA;;;;;AACA;;;;;cADa,kCAAA;AAAA,cACA,mCAAA;AAAA,cACA,oCAAA"}
+{"version":3,"file":"analytics-clickmap-overlay.d.ts","names":[],"sources":["../../../src/utils/analytics-clickmap-overlay.tsx"],"mappings":";;AAYA;;;;AAA+C;AAC/C;;;;AAAgD;cADnC,kCAAA;AAAA,cACA,mCAAA;AAAA,cACA,oCAAA"}

package/dist/esm/utils/analytics-clickmap-overlay.js

@@ -13,7 +13,7 @@
 const CLICKMAP_OVERLAY_TOKEN_STORAGE_KEY = "hexclave-clickmap-token";
 const CLICKMAP_OVERLAY_RESUME_STORAGE_KEY = "hexclave-clickmap-resume";
 const CLICKMAP_OVERLAY_TOKEN_UPDATED_EVENT = "hexclave:clickmap-token-updated";
-
 //#endregion
 export { CLICKMAP_OVERLAY_RESUME_STORAGE_KEY, CLICKMAP_OVERLAY_TOKEN_STORAGE_KEY, CLICKMAP_OVERLAY_TOKEN_UPDATED_EVENT };
+
 //# sourceMappingURL=analytics-clickmap-overlay.js.map

package/dist/esm/utils/api-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.d.ts","names":[],"sources":["../../../src/utils/api-keys.tsx"],"mappings":";;;;;;;;;;;KA6BK,aAAA;EACH,EAAA;EACA,MAAA;EACA,QAAA;EACA,cAAA;EACA,MAAA;EACA,QAAA;EACA,IAAA;AAAA;AAAA,iBAwDc,QAAA,CAAS,MAAA;AAAA,iBAIT,mBAAA,CAAoB,OAAA,EAAS,IAAA,CAAK,aAAA;AAAA,iBAOlC,kBAAA,CAAmB,MAAA,WAAiB,aAAA"}
+{"version":3,"file":"api-keys.d.ts","names":[],"sources":["../../../src/utils/api-keys.tsx"],"mappings":";;;;;;;;;;;KA6BK,aAAA;EACH,EAAA;EACA,MAAA;EACA,QAAA;EACA,cAAA;EACA,MAAA;EACA,QAAA;EACA,IAAA;AAAA;AAAA,iBAwDc,QAAA,CAAS,MAAc;AAAA,iBAIvB,mBAAA,CAAoB,OAAA,EAAS,IAAI,CAAC,aAAA;AAAA,iBAOlC,kBAAA,CAAmB,MAAA,WAAiB,aAAa"}

package/dist/esm/utils/api-keys.js

@@ -2,7 +2,6 @@ import crc32 from "crc/crc32";
 import { getBase32CharacterFromIndex } from "./bytes.js";
 import { generateSecureRandomString } from "./crypto.js";
 import { HexclaveAssertionError } from "./errors.js";
-
 //#region src/utils/api-keys.tsx
 const STACK_AUTH_MARKER = "574ck4u7h";
 const API_KEY_LENGTHS = {
@@ -71,7 +70,7 @@ function parseProjectApiKey(secret) {
 		type
 	};
 }
-
 //#endregion
 export { createProjectApiKey, isApiKey, parseProjectApiKey };
+
 //# sourceMappingURL=api-keys.js.map

package/dist/esm/utils/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","names":[],"sources":["../../../src/utils/api-keys.tsx"],"sourcesContent":["import crc32 from 'crc/crc32';\nimport { getBase32CharacterFromIndex } from \"./bytes\";\nimport { generateSecureRandomString } from \"./crypto\";\nimport { HexclaveAssertionError } from \"./errors\";\n\n\nconst STACK_AUTH_MARKER = \"574ck4u7h\";\n\n// API key part lengths\nconst API_KEY_LENGTHS = {\n  SECRET_PART: 45,\n  ID_PART: 32,\n  TYPE_PART: 4,\n  SCANNER: 1,\n  MARKER: 9,\n  CHECKSUM: 8,\n} as const;\n\n/**\n * An api key has the following format:\n * <prefix_without_underscores>_<secret_part_45_chars><id_part_32_chars><type_user_or_team_4_chars><scanner_and_marker_10_chars><checksum_8_chars>\n *\n * The scanner and marker is a base32 character that is used to determine if the api key is a public or private key\n * and if it is a cloud or self-hosted key.\n *\n * The checksum is a crc32 checksum of the api key encoded in hex.\n *\n */\n\ntype ProjectApiKey = {\n  id: string,\n  prefix: string,\n  isPublic: boolean,\n  isCloudVersion: boolean,\n  secret: string,\n  checksum: string,\n  type: \"user\" | \"team\",\n}\n\n\nfunction createChecksumSync(checksummablePart: string): string {\n  const data = new TextEncoder().encode(checksummablePart);\n  const calculated_checksum = crc32(data.buffer);\n  return calculated_checksum.toString(16).padStart(8, \"0\");\n}\n\nfunction createApiKeyParts(options: Pick<ProjectApiKey, \"id\" | \"isPublic\" | \"isCloudVersion\" | \"type\">) {\n  const { id, isPublic, isCloudVersion, type } = options;\n  const prefix = isPublic ? \"pk\" : \"sk\";\n  const scannerFlag = (isCloudVersion ? 0 : 1) + (isPublic ? 2 : 0) + (/* version */ 0);\n\n  const secretPart = generateSecureRandomString();\n  const idPart = id.replace(/-/g, \"\");\n  const scannerAndMarker = getBase32CharacterFromIndex(scannerFlag).toLowerCase() + STACK_AUTH_MARKER;\n  const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerAndMarker}`;\n\n  return { checksummablePart, idPart, prefix, scannerAndMarker, type };\n}\n\n\nfunction parseApiKeyParts(secret: string) {\n  const regex = new RegExp(\n    `^([a-zA-Z0-9_]+)_` + // prefix\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SECRET_PART}})` + // secretPart\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.ID_PART}})` + // idPart\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.TYPE_PART}})` + // type\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SCANNER}})` + // scanner\n    `(${STACK_AUTH_MARKER})` + // marker\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.CHECKSUM}})$` // checksum\n  );\n\n  const match = secret.match(regex);\n  if (!match) {\n    throw new HexclaveAssertionError(\"Invalid API key format\");\n  }\n\n  const [, prefix, secretPart, idPart, type, scannerFlag, marker, checksum] = match;\n\n  const isCloudVersion = parseInt(scannerFlag, 32) % 2 === 0;\n  const isPublic = (parseInt(scannerFlag, 32) & 2) !== 0;\n\n  const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerFlag}${marker}`;\n  const restored_id = idPart.replace(/(.{8})(.{4})(.{4})(.{4})(.{12})/, \"$1-$2-$3-$4-$5\");\n\n  if (![\"user\", \"team\"].includes(type)) {\n    throw new HexclaveAssertionError(\"Invalid type\");\n  }\n\n  return { checksummablePart, checksum, id: restored_id, isCloudVersion, isPublic, prefix, type: type as \"user\" | \"team\" };\n}\n\n\nexport function isApiKey(secret: string): boolean {\n  return secret.includes(\"_\") && secret.includes(STACK_AUTH_MARKER);\n}\n\nexport function createProjectApiKey(options: Pick<ProjectApiKey, \"id\" | \"isPublic\" | \"isCloudVersion\" | \"type\">): string {\n  const { checksummablePart } = createApiKeyParts(options);\n  const checksum = createChecksumSync(checksummablePart);\n  return `${checksummablePart}${checksum}`;\n}\n\n\nexport function parseProjectApiKey(secret: string): ProjectApiKey {\n  const { checksummablePart, checksum, id, isCloudVersion, isPublic, prefix, type } = parseApiKeyParts(secret);\n  const calculated_checksum = createChecksumSync(checksummablePart);\n\n  if (calculated_checksum !== checksum) {\n    throw new HexclaveAssertionError(\"Checksum mismatch\");\n  }\n\n  return {\n    id,\n    prefix,\n    isPublic,\n    isCloudVersion,\n    secret,\n    checksum,\n    type,\n  };\n}\n\n"],"mappings":";;;;;;AAMA,MAAM,oBAAoB;AAG1B,MAAM,kBAAkB;CACtB,aAAa;CACb,SAAS;CACT,WAAW;CACX,SAAS;CACT,QAAQ;CACR,UAAU;CACX;AAwBD,SAAS,mBAAmB,mBAAmC;AAG7D,QAD4B,MADf,IAAI,aAAa,CAAC,OAAO,kBAAkB,CACjB,OAAO,CACnB,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI;;AAG1D,SAAS,kBAAkB,SAA6E;CACtG,MAAM,EAAE,IAAI,UAAU,gBAAgB,SAAS;CAC/C,MAAM,SAAS,WAAW,OAAO;CACjC,MAAM,eAAe,iBAAiB,IAAI,MAAM,WAAW,IAAI,KAAoB;CAEnF,MAAM,aAAa,4BAA4B;CAC/C,MAAM,SAAS,GAAG,QAAQ,MAAM,GAAG;CACnC,MAAM,mBAAmB,4BAA4B,YAAY,CAAC,aAAa,GAAG;AAGlF,QAAO;EAAE,mBAFiB,GAAG,OAAO,GAAG,aAAa,SAAS,OAAO;EAExC;EAAQ;EAAQ;EAAkB;EAAM;;AAItE,SAAS,iBAAiB,QAAgB;CACxC,MAAM,QAAQ,IAAI,OAChB,kCACiB,gBAAgB,YAAY,kBAC5B,gBAAgB,QAAQ,kBACxB,gBAAgB,UAAU,kBAC1B,gBAAgB,QAAQ,KACrC,kBAAkB,iBACL,gBAAgB,SAAS,KAC3C;CAED,MAAM,QAAQ,OAAO,MAAM,MAAM;AACjC,KAAI,CAAC,MACH,OAAM,IAAI,uBAAuB,yBAAyB;CAG5D,MAAM,GAAG,QAAQ,YAAY,QAAQ,MAAM,aAAa,QAAQ,YAAY;CAE5E,MAAM,iBAAiB,SAAS,aAAa,GAAG,GAAG,MAAM;CACzD,MAAM,YAAY,SAAS,aAAa,GAAG,GAAG,OAAO;CAErD,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,SAAS,OAAO,cAAc;CAClF,MAAM,cAAc,OAAO,QAAQ,mCAAmC,iBAAiB;AAEvF,KAAI,CAAC,CAAC,QAAQ,OAAO,CAAC,SAAS,KAAK,CAClC,OAAM,IAAI,uBAAuB,eAAe;AAGlD,QAAO;EAAE;EAAmB;EAAU,IAAI;EAAa;EAAgB;EAAU;EAAc;EAAyB;;AAI1H,SAAgB,SAAS,QAAyB;AAChD,QAAO,OAAO,SAAS,IAAI,IAAI,OAAO,SAAS,kBAAkB;;AAGnE,SAAgB,oBAAoB,SAAqF;CACvH,MAAM,EAAE,sBAAsB,kBAAkB,QAAQ;AAExD,QAAO,GAAG,oBADO,mBAAmB,kBAAkB;;AAKxD,SAAgB,mBAAmB,QAA+B;CAChE,MAAM,EAAE,mBAAmB,UAAU,IAAI,gBAAgB,UAAU,QAAQ,SAAS,iBAAiB,OAAO;AAG5G,KAF4B,mBAAmB,kBAAkB,KAErC,SAC1B,OAAM,IAAI,uBAAuB,oBAAoB;AAGvD,QAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACD"}
+{"version":3,"file":"api-keys.js","names":[],"sources":["../../../src/utils/api-keys.tsx"],"sourcesContent":["import crc32 from 'crc/crc32';\nimport { getBase32CharacterFromIndex } from \"./bytes\";\nimport { generateSecureRandomString } from \"./crypto\";\nimport { HexclaveAssertionError } from \"./errors\";\n\n\nconst STACK_AUTH_MARKER = \"574ck4u7h\";\n\n// API key part lengths\nconst API_KEY_LENGTHS = {\n  SECRET_PART: 45,\n  ID_PART: 32,\n  TYPE_PART: 4,\n  SCANNER: 1,\n  MARKER: 9,\n  CHECKSUM: 8,\n} as const;\n\n/**\n * An api key has the following format:\n * <prefix_without_underscores>_<secret_part_45_chars><id_part_32_chars><type_user_or_team_4_chars><scanner_and_marker_10_chars><checksum_8_chars>\n *\n * The scanner and marker is a base32 character that is used to determine if the api key is a public or private key\n * and if it is a cloud or self-hosted key.\n *\n * The checksum is a crc32 checksum of the api key encoded in hex.\n *\n */\n\ntype ProjectApiKey = {\n  id: string,\n  prefix: string,\n  isPublic: boolean,\n  isCloudVersion: boolean,\n  secret: string,\n  checksum: string,\n  type: \"user\" | \"team\",\n}\n\n\nfunction createChecksumSync(checksummablePart: string): string {\n  const data = new TextEncoder().encode(checksummablePart);\n  const calculated_checksum = crc32(data.buffer);\n  return calculated_checksum.toString(16).padStart(8, \"0\");\n}\n\nfunction createApiKeyParts(options: Pick<ProjectApiKey, \"id\" | \"isPublic\" | \"isCloudVersion\" | \"type\">) {\n  const { id, isPublic, isCloudVersion, type } = options;\n  const prefix = isPublic ? \"pk\" : \"sk\";\n  const scannerFlag = (isCloudVersion ? 0 : 1) + (isPublic ? 2 : 0) + (/* version */ 0);\n\n  const secretPart = generateSecureRandomString();\n  const idPart = id.replace(/-/g, \"\");\n  const scannerAndMarker = getBase32CharacterFromIndex(scannerFlag).toLowerCase() + STACK_AUTH_MARKER;\n  const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerAndMarker}`;\n\n  return { checksummablePart, idPart, prefix, scannerAndMarker, type };\n}\n\n\nfunction parseApiKeyParts(secret: string) {\n  const regex = new RegExp(\n    `^([a-zA-Z0-9_]+)_` + // prefix\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SECRET_PART}})` + // secretPart\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.ID_PART}})` + // idPart\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.TYPE_PART}})` + // type\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.SCANNER}})` + // scanner\n    `(${STACK_AUTH_MARKER})` + // marker\n    `([a-zA-Z0-9_]{${API_KEY_LENGTHS.CHECKSUM}})$` // checksum\n  );\n\n  const match = secret.match(regex);\n  if (!match) {\n    throw new HexclaveAssertionError(\"Invalid API key format\");\n  }\n\n  const [, prefix, secretPart, idPart, type, scannerFlag, marker, checksum] = match;\n\n  const isCloudVersion = parseInt(scannerFlag, 32) % 2 === 0;\n  const isPublic = (parseInt(scannerFlag, 32) & 2) !== 0;\n\n  const checksummablePart = `${prefix}_${secretPart}${idPart}${type}${scannerFlag}${marker}`;\n  const restored_id = idPart.replace(/(.{8})(.{4})(.{4})(.{4})(.{12})/, \"$1-$2-$3-$4-$5\");\n\n  if (![\"user\", \"team\"].includes(type)) {\n    throw new HexclaveAssertionError(\"Invalid type\");\n  }\n\n  return { checksummablePart, checksum, id: restored_id, isCloudVersion, isPublic, prefix, type: type as \"user\" | \"team\" };\n}\n\n\nexport function isApiKey(secret: string): boolean {\n  return secret.includes(\"_\") && secret.includes(STACK_AUTH_MARKER);\n}\n\nexport function createProjectApiKey(options: Pick<ProjectApiKey, \"id\" | \"isPublic\" | \"isCloudVersion\" | \"type\">): string {\n  const { checksummablePart } = createApiKeyParts(options);\n  const checksum = createChecksumSync(checksummablePart);\n  return `${checksummablePart}${checksum}`;\n}\n\n\nexport function parseProjectApiKey(secret: string): ProjectApiKey {\n  const { checksummablePart, checksum, id, isCloudVersion, isPublic, prefix, type } = parseApiKeyParts(secret);\n  const calculated_checksum = createChecksumSync(checksummablePart);\n\n  if (calculated_checksum !== checksum) {\n    throw new HexclaveAssertionError(\"Checksum mismatch\");\n  }\n\n  return {\n    id,\n    prefix,\n    isPublic,\n    isCloudVersion,\n    secret,\n    checksum,\n    type,\n  };\n}\n\n"],"mappings":";;;;;AAMA,MAAM,oBAAoB;AAG1B,MAAM,kBAAkB;CACtB,aAAa;CACb,SAAS;CACT,WAAW;CACX,SAAS;CACT,QAAQ;CACR,UAAU;AACZ;AAwBA,SAAS,mBAAmB,mBAAmC;CAG7D,OAD4B,MADf,IAAI,YAAY,CAAC,CAAC,OAAO,iBACD,CAAC,CAAC,MACd,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG;AACzD;AAEA,SAAS,kBAAkB,SAA6E;CACtG,MAAM,EAAE,IAAI,UAAU,gBAAgB,SAAS;CAC/C,MAAM,SAAS,WAAW,OAAO;CACjC,MAAM,eAAe,iBAAiB,IAAI,MAAM,WAAW,IAAI,KAAoB;CAEnF,MAAM,aAAa,2BAA2B;CAC9C,MAAM,SAAS,GAAG,QAAQ,MAAM,EAAE;CAClC,MAAM,mBAAmB,4BAA4B,WAAW,CAAC,CAAC,YAAY,IAAI;CAGlF,OAAO;EAAE,mBAAA,GAFoB,OAAO,GAAG,aAAa,SAAS,OAAO;EAExC;EAAQ;EAAQ;EAAkB;CAAK;AACrE;AAGA,SAAS,iBAAiB,QAAgB;CACxC,MAAM,QAAQ,IAAI,OAChB,kCACiB,gBAAgB,YAAY,kBAC5B,gBAAgB,QAAQ,kBACxB,gBAAgB,UAAU,kBAC1B,gBAAgB,QAAQ,KACrC,kBAAkB,iBACL,gBAAgB,SAAS,IAC5C;CAEA,MAAM,QAAQ,OAAO,MAAM,KAAK;CAChC,IAAI,CAAC,OACH,MAAM,IAAI,uBAAuB,wBAAwB;CAG3D,MAAM,GAAG,QAAQ,YAAY,QAAQ,MAAM,aAAa,QAAQ,YAAY;CAE5E,MAAM,iBAAiB,SAAS,aAAa,EAAE,IAAI,MAAM;CACzD,MAAM,YAAY,SAAS,aAAa,EAAE,IAAI,OAAO;CAErD,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,SAAS,OAAO,cAAc;CAClF,MAAM,cAAc,OAAO,QAAQ,mCAAmC,gBAAgB;CAEtF,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,SAAS,IAAI,GACjC,MAAM,IAAI,uBAAuB,cAAc;CAGjD,OAAO;EAAE;EAAmB;EAAU,IAAI;EAAa;EAAgB;EAAU;EAAc;CAAwB;AACzH;AAGA,SAAgB,SAAS,QAAyB;CAChD,OAAO,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,iBAAiB;AAClE;AAEA,SAAgB,oBAAoB,SAAqF;CACvH,MAAM,EAAE,sBAAsB,kBAAkB,OAAO;CAEvD,OAAO,GAAG,oBADO,mBAAmB,iBACC;AACvC;AAGA,SAAgB,mBAAmB,QAA+B;CAChE,MAAM,EAAE,mBAAmB,UAAU,IAAI,gBAAgB,UAAU,QAAQ,SAAS,iBAAiB,MAAM;CAG3G,IAF4B,mBAAmB,iBAEzB,MAAM,UAC1B,MAAM,IAAI,uBAAuB,mBAAmB;CAGtD,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/esm/utils/arrays.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arrays.d.ts","names":[],"sources":["../../../src/utils/arrays.tsx"],"mappings":";iBAEgB,aAAA,0BAAA,CAAwC,GAAA,EAAK,CAAA,EAAG,IAAA,YAAgB,IAAA,IAAQ,CAAA;AAAA,iBAcxE,SAAA,0BAAA,CAAoC,GAAA,EAAK,CAAA,YAAa,CAAA;AAAA,iBAStD,cAAA,CAAe,CAAA,kBAAmB,CAAA;;;;iBAuBlC,aAAA,GAAA,CAAiB,GAAA,WAAc,CAAA,IAAK,SAAA,GAAY,IAAA,EAAM,CAAA;AAAA,iBActD,OAAA,kBAAA,CACd,GAAA,EAAK,QAAA,CAAS,CAAA,GACd,GAAA,GAAM,IAAA,EAAM,CAAA,KAAM,CAAA,GACjB,GAAA,CAAI,CAAA,EAAG,CAAA;AAAA,iBA4BM,KAAA,CAAM,YAAA;AAAA,iBACN,KAAA,CAAM,cAAA,UAAwB,YAAA;AAAA,iBAC9B,KAAA,CAAM,cAAA,UAAwB,YAAA,UAAsB,IAAA;AAAA,iBAwBpD,UAAA,CAAW,GAAA,kBAAqB,CAAA;AAAA,iBAchC,WAAA,CAAY,GAAA,kBAAqB,CAAA;AAAA,iBAajC,OAAA,GAAA,CAAW,GAAA,WAAc,CAAA,KAAM,CAAA;AAAA,iBAgC/B,YAAA,MAAA,CAAmB,IAAA,WAAe,CAAA,IAAK,IAAA,WAAe,CAAA,MAAO,CAAA,EAAG,CAAA;AAAA,iBAYhE,MAAA,GAAA,CAAU,GAAA,WAAc,CAAA,KAAM,CAAA;AAAA,iBAe9B,SAAA,GAAA,CAAa,GAAA,WAAc,CAAA,IAAK,IAAA,WAAe,CAAA;AAAA,iBAmB/C,aAAA,CAAc,GAAA,YAAe,GAAA;AAAA,iBAG7B,aAAA,CAAc,GAAA,YAAe,GAAA;AAAA,iBAG7B,cAAA,CAAe,GAAA,YAAe,GAAA;AAAA,iBAG9B,aAAA,CAAc,GAAA,YAAe,GAAA"}
+{"version":3,"file":"arrays.d.ts","names":[],"sources":["../../../src/utils/arrays.tsx"],"mappings":";iBAEgB,aAAA,2BAAwC,GAAA,EAAK,CAAA,EAAG,IAAA,YAAgB,IAAA,IAAQ,CAAC;AAAA,iBAczE,SAAA,2BAAoC,GAAA,EAAK,CAAA,YAAa,CAAC;AAAA,iBASvD,cAAA,CAAe,CAAA,kBAAmB,CAAiB;;;;iBAuBnD,aAAA,IAAiB,GAAA,WAAc,CAAA,IAAK,SAAA,GAAY,IAAA,EAAM,CAAC;AAAA,iBAcvD,OAAA,mBACd,GAAA,EAAK,QAAA,CAAS,CAAA,GACd,GAAA,GAAM,IAAA,EAAM,CAAA,KAAM,CAAA,GACjB,GAAA,CAAI,CAAA,EAAG,CAAA;AAAA,iBA4BM,KAAA,CAAM,YAAoB;AAAA,iBAC1B,KAAA,CAAM,cAAA,UAAwB,YAAoB;AAAA,iBAClD,KAAA,CAAM,cAAA,UAAwB,YAAA,UAAsB,IAAA;AAAA,iBAwBpD,UAAA,CAAW,GAAA,kBAAqB,CAAS;AAAA,iBAczC,WAAA,CAAY,GAAA,kBAAqB,CAAS;AAAA,iBAa1C,OAAA,IAAW,GAAA,WAAc,CAAA,KAAM,CAAC;AAAA,iBAgChC,YAAA,OAAmB,IAAA,WAAe,CAAA,IAAK,IAAA,WAAe,CAAA,MAAO,CAAA,EAAG,CAAA;AAAA,iBAYhE,MAAA,IAAU,GAAA,WAAc,CAAA,KAAM,CAAC;AAAA,iBAe/B,SAAA,IAAa,GAAA,WAAc,CAAA,IAAK,IAAA,WAAe,CAAC;AAAA,iBAmBhD,aAAA,CAAc,GAAA,YAAe,GAAG;AAAA,iBAGhC,aAAA,CAAc,GAAA,YAAe,GAAG;AAAA,iBAGhC,cAAA,CAAe,GAAA,YAAe,GAAG;AAAA,iBAGjC,aAAA,CAAc,GAAA,YAAe,GAAG"}