@hexok/auth 0.0.0-stage → 0.0.0

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+# @hexok/auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Credential verification for hexok. Install with `npm i @hexok/auth`. It answers two questions: who does this credential prove, and is it still valid. The app answers the third, who that is to the app, in one function it owns.
+
+The package proves an **identity**. The app resolves it to an **actor**. They are two types. The package defines neither. It has no user, organization, role, tenant, scope, `sub`, JWT, cookie, or `Request`.
+
+## Quick start
+
+```ts
+import { OpaqueSessionToken, Sessions, bearerToken, sessionConfig } from '@hexok/auth';
+import { RedisSessionStore } from '@hexok/auth-redis';
+import { z } from 'zod';
+
+const actor = z.object({ organizationId: z.string(), userId: z.string() });
+
+const store = new RedisSessionStore({ redis: env.REDIS_URL, identity: actor, ...sessionConfig(env) });
+await store.start();
+const sessions = new Sessions({ store, token: new OpaqueSessionToken() });
+
+// login, after the app checked the credentials it owns
+const token = await sessions.open({ organizationId, userId });
+
+// every call, at the edge
+const found = await sessions.authenticate(bearerToken(request.headers.get('authorization')));
+if (!found.ok) return unauthorized(); // log found.code, never send it
+await useCase.execute({ actor: found.value }, input);
+
+// logout, at the edge
+await sessions.close(bearerToken(request.headers.get('authorization')));
+```
+
+## Rules
+
+- Only the composition root and the edge import `@hexok/auth`. Use cases receive the app's actor on their context and never import this package. Then the package can be removed: a swap to an identity provider changes the composition root, login, and logout, and no use case.
+- The actor never carries a session id or a token. Logout acts on the credential at the edge.
+- A refusal is for logs. Map every refusal to one wire error, so a caller cannot tell a deleted session from a bad token. The package never picks an HTTP status.
+- Authorization is not here. Roles, permissions, membership, and step-up are checks on the actor, in use-case guards.
+- `Result`, `ok`, and `fail` come from `hexok`, not from this package.
+
+## Authenticator
+
+```ts
+abstract class Authenticator<I, E extends string = AuthRefusal> {
+  authenticate(credential: string | undefined): Promise<Result<I, E>>;
+}
+```
+
+The credential is an opaque string the edge extracted, such as a Bearer token or a cookie value. `undefined` is no credential. A refusal is a `fail` result. A throw is an infrastructure failure, such as a store that does not answer. Let it reach the app's error handling as a server error, not a 401.
+
+| `AuthRefusal` | Meaning |
+| --- | --- |
+| `missing` | No credential. |
+| `invalid` | Malformed, a bad signature, or a token this process does not accept. |
+| `expired` | The token, or the session record, passed its absolute end. |
+| `ended` | The token checks out and its session is gone: logged out, idle, or deleted. |
+
+## Resolving the actor
+
+`resolving` is the seam. It takes an authenticator of identity `I` and the app's function from `I` to its actor `A`, and returns an authenticator of `A`.
+
+```ts
+import { resolving } from '@hexok/auth';
+import { fail, ok } from 'hexok';
+
+const auth = resolving(provider, async (identity) => {
+  const user = await users.bySubject(identity.subject);
+  if (user === undefined) return fail('unknown');
+  return ok({ organizationId: user.organizationId, userId: user.id });
+});
+// Authenticator<Actor, AuthRefusal | 'unknown'>
+```
+
+- A refusal from the authenticator skips the resolver.
+- The resolver names its own refusals, such as `unknown` for a subject with no account or `forbidden` for a service token on a user route.
+- A resolver throw passes through as a throw.
+- When the identity already is the actor, as when a session stores the actor, there is no resolver.
+
+## Sessions
+
+Server-side sessions, for an app that signs its own users in. The store is the authority. A token that names a session the store does not have proves nothing, so logout and expiry are a delete.
+
+```ts
+abstract class SessionStore<I> {
+  open(identity: I): Promise<{ id: string; expiresAt: Date }>;
+  resolve(id: string): Promise<Result<I, 'ended' | 'expired'>>;
+  close(id: string): Promise<void>;
+}
+abstract class SessionToken {
+  issue(id: string, expiresAt: Date): Promise<string>;
+  read(token: string): Promise<Result<string, 'invalid' | 'expired'>>;
+}
+```
+
+`Sessions` puts a store and a token together. It is an `Authenticator` of the stored identity.
+
+| Method | Does |
+| --- | --- |
+| `open(identity)` | Opens a session under a new random id and returns the token. Login calls it after the app checked the credentials. |
+| `authenticate(credential)` | Reads the token, then resolves the session in the store. The identity comes from the store, never from the token. |
+| `close(credential)` | Deletes the session the credential names. A missing or bad credential is already signed out. |
+
+A store keeps two clocks. The idle window slides on every `resolve`. The absolute end never moves. A session ends at whichever comes first. A session id is never reused, and `open` always makes a new one. The store owns the absolute end and hands it to the token as `expiresAt`, so the lifetime is configured once.
+
+Start and stop the store you construct. `Sessions` does not own it.
+
+| Adapter | Package | Use |
+| --- | --- | --- |
+| `RedisSessionStore` | `@hexok/auth-redis` | Shared sessions across processes. |
+| `MemorySessionStore` | this package | Tests and single-process development. A restart ends every session. |
+| `JoseSessionToken` | `@hexok/auth-jose` | A signed JWT that names the session. Checked before the store and bound to an issuer and audience. |
+| `OpaqueSessionToken` | this package | The token is the session id. Tests, and one service where the token never leaves it. |
+
+`MemorySessionStore` takes `{ idleSeconds, absoluteSeconds, now? }`. A record vanishes at the earlier of its two ends, the way a Redis key with a TTL does.
+
+## Static and dev authenticators
+
+`StaticTokenAuthenticator` maps fixed tokens to identities. It fits service tokens and local development. It keeps a SHA-256 of each token, not the token. A blank token in config throws. A static token cannot be revoked except by restarting without it.
+
+```ts
+new StaticTokenAuthenticator({ tokens: [[env.REPORTS_TOKEN, { service: 'reports' }]] });
+```
+
+`DevAuthenticator` answers every call as one configured identity and ignores the credential. With `identity: undefined` it refuses every call, so a deploy that forgets it is closed, not open. Select it by explicit config. Never make it the default.
+
+```ts
+const auth = env.AUTH_MODE === 'dev' ? new DevAuthenticator({ identity: devActor }) : sessions;
+```
+
+## Helpers
+
+`bearerToken(header)` returns the token of an `Authorization: Bearer <token>` header. It returns `undefined` for no header, another scheme, or anything after the token. The scheme is case-insensitive, as RFC 6750 says.
+
+`sessionConfig(env, { prefix? })` reads `AUTH_SESSION_IDLE_SECONDS` (default 1800) and `AUTH_SESSION_ABSOLUTE_SECONDS` (default 28800), or the same names under `prefix`. It takes the environment the app passes. The package never reads `process.env`. A blank value is unset. Idle longer than absolute is refused.
+
+Every config check throws `AuthError.InvalidConfig` once, with every problem in `error.data.problems` and in the message. Secrets are never in either. `assertSessionConfig(config)` runs the same checks on values a store adapter received in code. `invalidConfig(problems)` builds the error for an adapter of your own.
+
+`AuthError.Unauthenticated` is one error for an edge that throws on every refusal.
+
+## Swapping the provider
+
+To move to an identity provider, write an `Authenticator` of that provider's identity in the app. It verifies the provider's token with the provider's SDK, then `resolving` turns that identity into the same actor.
+
+```ts
+class ProviderAuthenticator extends Adapter(Authenticator)<ProviderIdentity> {
+  override async authenticate(credential: string | undefined) {
+    if (credential === undefined) return fail('missing');
+    try {
+      return ok(await provider.verify(credential));
+    } catch {
+      return fail('invalid');
+    }
+  }
+}
+
+const auth = resolving(new ProviderAuthenticator(), toActor);
+```
+
+Login, logout, and the session store go away, because the provider runs them. The edge may change transport, such as from a Bearer header to a cookie. Use cases keep the same actor. To remove this package entirely, the app declares its own port with the same `authenticate` shape. Nothing outside the edge changes.
+
+## Left to the app
+
+- Where credentials are stored and how passwords are checked.
+- The login and logout procedures, and rate limits on login.
+- The transport: header, cookie, or message field. A cookie needs a CSRF defense.
+- Mapping refusals to the wire, and logging them.
+- Authorization.

package/dist/authenticator.d.ts

@@ -0,0 +1,35 @@
+import { type Result } from 'hexok';
+/**
+ * Why a credential proved nothing. It is for logs. The app maps every refusal
+ * to one wire error, so a caller cannot tell a deleted session from a bad token.
+ *
+ * - `missing`: no credential.
+ * - `invalid`: malformed, a bad signature, or a token this process does not accept.
+ * - `expired`: the token, or the session record, passed its absolute end.
+ * - `ended`: the token checks out and its session is gone: logged out, idle, or deleted.
+ */
+export type AuthRefusal = 'missing' | 'invalid' | 'expired' | 'ended';
+declare const Authenticator_base: (abstract new () => {
+    readonly "__#private@#brand": true;
+}) & {
+    readonly token: "Authenticator";
+};
+/**
+ * Turns a credential into the identity it proves, or a refusal.
+ * The credential is an opaque string the edge extracted, such as a Bearer
+ * token or a cookie value. `undefined` is no credential.
+ *
+ * `I` is the identity the adapter proves. Pass it through `resolving` to get
+ * the app's own actor. A refusal is a result. A throw is an infrastructure
+ * failure, such as a store that does not answer.
+ *
+ * ```ts
+ * const found = await authenticator.authenticate(bearerToken(header))
+ * if (!found.ok) throw AuthError.Unauthenticated()
+ * ```
+ */
+export declare abstract class Authenticator<I, E extends string = AuthRefusal> extends Authenticator_base {
+    abstract authenticate(credential: string | undefined): Promise<Result<I, E>>;
+}
+export {};
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../src/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;;;;;;AAEtE;;;;;;;;;;;;;GAaG;AACH,8BAAsB,aAAa,CACjC,CAAC,EACD,CAAC,SAAS,MAAM,GAAG,WAAW,CAC9B,SAAQ,kBAAqB;IAC7B,QAAQ,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC7E"}

package/dist/authenticator.js

@@ -0,0 +1,18 @@
+import { Port } from 'hexok';
+/**
+ * Turns a credential into the identity it proves, or a refusal.
+ * The credential is an opaque string the edge extracted, such as a Bearer
+ * token or a cookie value. `undefined` is no credential.
+ *
+ * `I` is the identity the adapter proves. Pass it through `resolving` to get
+ * the app's own actor. A refusal is a result. A throw is an infrastructure
+ * failure, such as a store that does not answer.
+ *
+ * ```ts
+ * const found = await authenticator.authenticate(bearerToken(header))
+ * if (!found.ok) throw AuthError.Unauthenticated()
+ * ```
+ */
+export class Authenticator extends Port('Authenticator') {
+}
+//# sourceMappingURL=authenticator.js.map

package/dist/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../src/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAe,MAAM,OAAO,CAAC;AAa1C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAgB,aAGpB,SAAQ,IAAI,CAAC,eAAe,CAAC;CAE9B"}

package/dist/bearer.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The token of an `Authorization: Bearer <token>` header, or `undefined` for
+ * no header, another scheme, or anything after the token.
+ *
+ * ```ts
+ * await authenticator.authenticate(bearerToken(request.headers.get('authorization')))
+ * ```
+ */
+export declare function bearerToken(header: string | null | undefined): string | undefined;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAGpB"}

package/dist/bearer.js

@@ -0,0 +1,16 @@
+// RFC 6750 §2.1: "Bearer" 1*SP b64token. The scheme is case-insensitive.
+const BEARER = /^Bearer +([A-Za-z0-9\-._~+/]+=*)$/i;
+/**
+ * The token of an `Authorization: Bearer <token>` header, or `undefined` for
+ * no header, another scheme, or anything after the token.
+ *
+ * ```ts
+ * await authenticator.authenticate(bearerToken(request.headers.get('authorization')))
+ * ```
+ */
+export function bearerToken(header) {
+    if (header === null || header === undefined)
+        return undefined;
+    return BEARER.exec(header)?.[1];
+}
+//# sourceMappingURL=bearer.js.map

package/dist/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../src/bearer.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,MAAM,MAAM,GAAG,oCAAoC,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CACzB,MAAiC;IAEjC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,28 @@
+/** The environment the app read and passed in. The package never reads `process.env`. */
+export type Env = Readonly<Record<string, string | undefined>>;
+/** How long a session lives. Both clocks are seconds. */
+export type SessionConfig = {
+    /** A session unused this long ends. Every authenticated call slides it. */
+    readonly idleSeconds: number;
+    /** A session ends this long after it opened, however busy it is. */
+    readonly absoluteSeconds: number;
+};
+/**
+ * Reads `<prefix>IDLE_SECONDS` (default 1800) and `<prefix>ABSOLUTE_SECONDS`
+ * (default 28800) from `env`. A blank value is unset. Throws
+ * `AuthError.InvalidConfig` naming every bad variable.
+ *
+ * ```ts
+ * const lifetimes = sessionConfig(process.env)
+ * ```
+ */
+export declare function sessionConfig(env: Env, options?: {
+    readonly prefix?: string;
+}): SessionConfig;
+/**
+ * Throws `AuthError.InvalidConfig` unless both clocks are positive whole
+ * seconds and idle is not greater than absolute. Store adapters call it in
+ * their constructor.
+ */
+export declare function assertSessionConfig(config: SessionConfig): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE/D,yDAAyD;AACzD,MAAM,MAAM,aAAa,GAAG;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC,CAAC;AAKF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,GAAG,EACR,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACzC,aAAa,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAW/D"}

package/dist/config.js

@@ -0,0 +1,54 @@
+import { invalidConfig } from './errors.js';
+const DEFAULT_IDLE_SECONDS = 30 * 60;
+const DEFAULT_ABSOLUTE_SECONDS = 8 * 60 * 60;
+/**
+ * Reads `<prefix>IDLE_SECONDS` (default 1800) and `<prefix>ABSOLUTE_SECONDS`
+ * (default 28800) from `env`. A blank value is unset. Throws
+ * `AuthError.InvalidConfig` naming every bad variable.
+ *
+ * ```ts
+ * const lifetimes = sessionConfig(process.env)
+ * ```
+ */
+export function sessionConfig(env, options = {}) {
+    const prefix = options.prefix ?? 'AUTH_SESSION_';
+    const problems = [];
+    const idleSeconds = positiveInteger(env, `${prefix}IDLE_SECONDS`, DEFAULT_IDLE_SECONDS, problems);
+    const absoluteSeconds = positiveInteger(env, `${prefix}ABSOLUTE_SECONDS`, DEFAULT_ABSOLUTE_SECONDS, problems);
+    if (problems.length === 0 && idleSeconds > absoluteSeconds) {
+        problems.push(`${prefix}IDLE_SECONDS: must not be greater than ${prefix}ABSOLUTE_SECONDS.`);
+    }
+    if (problems.length > 0)
+        throw invalidConfig(problems);
+    return { idleSeconds, absoluteSeconds };
+}
+/**
+ * Throws `AuthError.InvalidConfig` unless both clocks are positive whole
+ * seconds and idle is not greater than absolute. Store adapters call it in
+ * their constructor.
+ */
+export function assertSessionConfig(config) {
+    const problems = [];
+    for (const key of ['idleSeconds', 'absoluteSeconds']) {
+        if (!Number.isSafeInteger(config[key]) || config[key] <= 0) {
+            problems.push(`${key}: must be a positive whole number of seconds.`);
+        }
+    }
+    if (problems.length === 0 && config.idleSeconds > config.absoluteSeconds) {
+        problems.push('idleSeconds: must not be greater than absoluteSeconds.');
+    }
+    if (problems.length > 0)
+        throw invalidConfig(problems);
+}
+function positiveInteger(env, name, fallback, problems) {
+    const raw = env[name]?.trim();
+    if (raw === undefined || raw === '')
+        return fallback;
+    const value = /^\d+$/.test(raw) ? Number(raw) : Number.NaN;
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        problems.push(`${name}: must be a positive whole number of seconds.`);
+        return fallback;
+    }
+    return value;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAa5C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAQ,EACR,UAAwC,EAAE;IAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,eAAe,CACjC,GAAG,EACH,GAAG,MAAM,cAAc,EACvB,oBAAoB,EACpB,QAAQ,CACT,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,GAAG,EACH,GAAG,MAAM,kBAAkB,EAC3B,wBAAwB,EACxB,QAAQ,CACT,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,GAAG,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,0CAA0C,MAAM,mBAAmB,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAU,EAAE,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+CAA+C,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACzE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CACtB,GAAQ,EACR,IAAY,EACZ,QAAgB,EAChB,QAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,+CAA+C,CAAC,CAAC;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/dev-authenticator.d.ts

@@ -0,0 +1,27 @@
+import { type Result } from 'hexok';
+import { Authenticator, type AuthRefusal } from './authenticator.js';
+declare const DevAuthenticator_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof Authenticator;
+/**
+ * Answers every call as one configured identity and ignores the credential.
+ * With no identity it refuses every call, so a deploy that forgets to
+ * configure it is closed, not open. Select it by explicit config for local
+ * development. Never make it the default.
+ *
+ * ```ts
+ * const auth = env.AUTH_MODE === 'dev'
+ *   ? new DevAuthenticator({ identity: devActor })
+ *   : sessions
+ * ```
+ */
+export declare class DevAuthenticator<I> extends DevAuthenticator_base<I> {
+    #private;
+    constructor(config: {
+        readonly identity: I | undefined;
+    });
+    authenticate(_credential: string | undefined): Promise<Result<I, AuthRefusal>>;
+}
+export {};
+//# sourceMappingURL=dev-authenticator.d.ts.map

package/dist/dev-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-authenticator.d.ts","sourceRoot":"","sources":["../src/dev-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;;;;;AAErE;;;;;;;;;;;GAWG;AACH,qBAAa,gBAAgB,CAAC,CAAC,CAAE,SAAQ,sBAAuB,CAAC,CAAC;;gBAGpD,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAA;KAAE;IAKzC,YAAY,CACzB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;CAGnC"}

package/dist/dev-authenticator.js

@@ -0,0 +1,25 @@
+import { Adapter, fail, ok } from 'hexok';
+import { Authenticator } from './authenticator.js';
+/**
+ * Answers every call as one configured identity and ignores the credential.
+ * With no identity it refuses every call, so a deploy that forgets to
+ * configure it is closed, not open. Select it by explicit config for local
+ * development. Never make it the default.
+ *
+ * ```ts
+ * const auth = env.AUTH_MODE === 'dev'
+ *   ? new DevAuthenticator({ identity: devActor })
+ *   : sessions
+ * ```
+ */
+export class DevAuthenticator extends Adapter(Authenticator) {
+    #identity;
+    constructor(config) {
+        super();
+        this.#identity = config.identity;
+    }
+    async authenticate(_credential) {
+        return this.#identity === undefined ? fail('invalid') : ok(this.#identity);
+    }
+}
+//# sourceMappingURL=dev-authenticator.js.map

package/dist/dev-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-authenticator.js","sourceRoot":"","sources":["../src/dev-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAoB,SAAQ,OAAO,CAAC,aAAa,CAAI;IACvD,SAAS,CAAgB;IAElC,YAAY,MAA4C;QACtD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnC,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,WAA+B;QAE/B,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/errors.d.ts

@@ -0,0 +1,28 @@
+import { type StandardSchemaV1 } from 'hexok';
+declare const AuthError_base: import("hexok").ErrorsHandle<"auth", {
+    readonly Unauthenticated: {
+        readonly message: "The call did not prove who it is.";
+    };
+    readonly InvalidConfig: {
+        readonly message: "The auth config is not valid.";
+        readonly data: StandardSchemaV1<{
+            problems: readonly string[];
+        }, {
+            problems: readonly string[];
+        }>;
+    };
+}>;
+/**
+ * `Unauthenticated` is for an edge that throws one error for every refusal.
+ * `InvalidConfig` lists every bad setting at once, so a process that fails to
+ * start says why.
+ */
+export declare class AuthError extends AuthError_base {
+}
+/** The `InvalidConfig` error for `list`, with every problem in the message. */
+export declare function invalidConfig(list: readonly string[]): import("hexok").CatalogMember<"auth", "InvalidConfig", `The auth config is not valid:
+  ${string}`, {
+    problems: readonly string[];
+}>;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,gBAAgB,EAAE,MAAM,OAAO,CAAC;;;;;;;;sBAET,SAAS,MAAM,EAAE;;sBAAjB,SAAS,MAAM,EAAE;;;;AAmB9D;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cAM7B;CAAG;AAEL,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;;cAjCR,SAAS,MAAM,EAAE;GAsC7D"}

package/dist/errors.js

@@ -0,0 +1,35 @@
+import { Errors } from 'hexok';
+const problems = {
+    '~standard': {
+        version: 1,
+        vendor: 'hexok-auth',
+        validate(value) {
+            if (typeof value === 'object' &&
+                value !== null &&
+                'problems' in value &&
+                Array.isArray(value.problems) &&
+                value.problems.every((each) => typeof each === 'string')) {
+                return { value: value };
+            }
+            return { issues: [{ message: 'problems must be a list of strings' }] };
+        },
+    },
+};
+/**
+ * `Unauthenticated` is for an edge that throws one error for every refusal.
+ * `InvalidConfig` lists every bad setting at once, so a process that fails to
+ * start says why.
+ */
+export class AuthError extends Errors('auth', {
+    Unauthenticated: { message: 'The call did not prove who it is.' },
+    InvalidConfig: {
+        message: 'The auth config is not valid.',
+        data: problems,
+    },
+}) {
+}
+/** The `InvalidConfig` error for `list`, with every problem in the message. */
+export function invalidConfig(list) {
+    return AuthError.InvalidConfig(`The auth config is not valid:\n  ${list.join('\n  ')}`, { problems: list });
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAyB,MAAM,OAAO,CAAC;AAEtD,MAAM,QAAQ,GAAsD;IAClE,WAAW,EAAE;QACX,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,YAAY;QACpB,QAAQ,CAAC,KAAK;YACZ,IACE,OAAO,KAAK,KAAK,QAAQ;gBACzB,KAAK,KAAK,IAAI;gBACd,UAAU,IAAI,KAAK;gBACnB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAC7B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EACxD,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,KAAwC,EAAE,CAAC;YAC7D,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,EAAE,CAAC;QACzE,CAAC;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,MAAM,EAAE;IAC5C,eAAe,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACjE,aAAa,EAAE;QACb,OAAO,EAAE,+BAA+B;QACxC,IAAI,EAAE,QAAQ;KACf;CACF,CAAC;CAAG;AAEL,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,OAAO,SAAS,CAAC,aAAa,CAC5B,oCAAoC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EACvD,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { Authenticator, type AuthRefusal } from './authenticator.js';
+export { bearerToken } from './bearer.js';
+export { assertSessionConfig, type Env, type SessionConfig, sessionConfig, } from './config.js';
+export { DevAuthenticator } from './dev-authenticator.js';
+export { AuthError, invalidConfig } from './errors.js';
+export { MemorySessionStore } from './memory-session-store.js';
+export { OpaqueSessionToken } from './opaque-session-token.js';
+export { type Resolve, resolving } from './resolving.js';
+export { type OpenedSession, SessionStore, Sessions, SessionToken, } from './sessions.js';
+export { StaticTokenAuthenticator } from './static-token-authenticator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,KAAK,GAAG,EACR,KAAK,aAAa,EAClB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,KAAK,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,KAAK,aAAa,EAClB,YAAY,EACZ,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+export { Authenticator } from './authenticator.js';
+export { bearerToken } from './bearer.js';
+export { assertSessionConfig, sessionConfig, } from './config.js';
+export { DevAuthenticator } from './dev-authenticator.js';
+export { AuthError, invalidConfig } from './errors.js';
+export { MemorySessionStore } from './memory-session-store.js';
+export { OpaqueSessionToken } from './opaque-session-token.js';
+export { resolving } from './resolving.js';
+export { SessionStore, Sessions, SessionToken, } from './sessions.js';
+export { StaticTokenAuthenticator } from './static-token-authenticator.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,mBAAmB,EAGnB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAgB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAEL,YAAY,EACZ,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/memory-session-store.d.ts

@@ -0,0 +1,27 @@
+import { type Result } from 'hexok';
+import { type SessionConfig } from './config.js';
+import { type OpenedSession, SessionStore } from './sessions.js';
+declare const MemorySessionStore_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof SessionStore;
+/**
+ * Sessions in this process's memory, with the same two clocks as a shared
+ * store. A restart ends every session, and another process cannot see them.
+ * Use it in tests and in single-process development only.
+ *
+ * A record vanishes at the earlier of its idle and absolute ends, the way a
+ * Redis key with a TTL does, so `resolve` reports both as `ended`.
+ */
+export declare class MemorySessionStore<I> extends MemorySessionStore_base<I> {
+    #private;
+    constructor(config: SessionConfig & {
+        /** Milliseconds since the epoch. Tests pass a fake clock. */
+        readonly now?: () => number;
+    });
+    open(identity: I): Promise<OpenedSession>;
+    resolve(id: string): Promise<Result<I, 'ended' | 'expired'>>;
+    close(id: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=memory-session-store.d.ts.map

package/dist/memory-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-session-store.d.ts","sourceRoot":"","sources":["../src/memory-session-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AACvD,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;;;;;AAQjE;;;;;;;GAOG;AACH,qBAAa,kBAAkB,CAAC,CAAC,CAAE,SAAQ,wBAAsB,CAAC,CAAC;;gBAO/D,MAAM,EAAE,aAAa,GAAG;QACtB,6DAA6D;QAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;KAC7B;IASY,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAYzC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;IAY5D,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD"}

package/dist/memory-session-store.js

@@ -0,0 +1,52 @@
+import { randomBytes } from 'node:crypto';
+import { Adapter, fail, ok } from 'hexok';
+import { assertSessionConfig } from './config.js';
+import { SessionStore } from './sessions.js';
+/**
+ * Sessions in this process's memory, with the same two clocks as a shared
+ * store. A restart ends every session, and another process cannot see them.
+ * Use it in tests and in single-process development only.
+ *
+ * A record vanishes at the earlier of its idle and absolute ends, the way a
+ * Redis key with a TTL does, so `resolve` reports both as `ended`.
+ */
+export class MemorySessionStore extends Adapter(SessionStore) {
+    #sessions = new Map();
+    #idleMs;
+    #absoluteMs;
+    #now;
+    constructor(config) {
+        super();
+        assertSessionConfig(config);
+        this.#idleMs = config.idleSeconds * 1000;
+        this.#absoluteMs = config.absoluteSeconds * 1000;
+        this.#now = config.now ?? Date.now;
+    }
+    async open(identity) {
+        const id = randomBytes(32).toString('base64url');
+        const now = this.#now();
+        const absoluteEnd = now + this.#absoluteMs;
+        this.#sessions.set(id, {
+            identity,
+            absoluteEnd,
+            idleUntil: Math.min(now + this.#idleMs, absoluteEnd),
+        });
+        return { id, expiresAt: new Date(absoluteEnd) };
+    }
+    async resolve(id) {
+        const entry = this.#sessions.get(id);
+        if (entry === undefined)
+            return fail('ended');
+        const now = this.#now();
+        if (now >= entry.idleUntil) {
+            this.#sessions.delete(id);
+            return fail('ended');
+        }
+        entry.idleUntil = Math.min(now + this.#idleMs, entry.absoluteEnd);
+        return ok(entry.identity);
+    }
+    async close(id) {
+        this.#sessions.delete(id);
+    }
+}
+//# sourceMappingURL=memory-session-store.js.map

package/dist/memory-session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-session-store.js","sourceRoot":"","sources":["../src/memory-session-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AACtE,OAAO,EAAsB,YAAY,EAAE,MAAM,eAAe,CAAC;AAQjE;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAsB,SAAQ,OAAO,CAAC,YAAY,CAAI;IACxD,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,OAAO,CAAS;IAChB,WAAW,CAAS;IACpB,IAAI,CAAe;IAE5B,YACE,MAGC;QAED,KAAK,EAAE,CAAC;QACR,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,QAAW;QAC7B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE;YACrB,QAAQ;YACR,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IAClD,CAAC;IAEQ,KAAK,CAAC,OAAO,CAAC,EAAU;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,EAAU;QAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/opaque-session-token.d.ts

@@ -0,0 +1,18 @@
+import { type Result } from 'hexok';
+import { SessionToken } from './sessions.js';
+declare const OpaqueSessionToken_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof SessionToken;
+/**
+ * The token is the session id itself. The store decides everything, so a
+ * token is only as good as the store's lookup. Use it in tests, and in one
+ * service where the token never leaves that service. A signed token adds a
+ * check before the store and binds the token to an issuer and audience.
+ */
+export declare class OpaqueSessionToken extends OpaqueSessionToken_base {
+    issue(id: string, _expiresAt: Date): Promise<string>;
+    read(token: string): Promise<Result<string, 'invalid' | 'expired'>>;
+}
+export {};
+//# sourceMappingURL=opaque-session-token.d.ts.map

package/dist/opaque-session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque-session-token.d.ts","sourceRoot":"","sources":["../src/opaque-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;;;;;AAK7C;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,uBAAqB;IAC5C,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD,IAAI,CACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;CAIlD"}

package/dist/opaque-session-token.js

@@ -0,0 +1,21 @@
+import { Adapter, fail, ok } from 'hexok';
+import { SessionToken } from './sessions.js';
+// A session id is 43 characters. Anything far longer is not one, and is refused before it reaches a store.
+const MAX_LENGTH = 512;
+/**
+ * The token is the session id itself. The store decides everything, so a
+ * token is only as good as the store's lookup. Use it in tests, and in one
+ * service where the token never leaves that service. A signed token adds a
+ * check before the store and binds the token to an issuer and audience.
+ */
+export class OpaqueSessionToken extends Adapter(SessionToken) {
+    async issue(id, _expiresAt) {
+        return id;
+    }
+    async read(token) {
+        if (token === '' || token.length > MAX_LENGTH)
+            return fail('invalid');
+        return ok(token);
+    }
+}
+//# sourceMappingURL=opaque-session-token.js.map

package/dist/opaque-session-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque-session-token.js","sourceRoot":"","sources":["../src/opaque-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,2GAA2G;AAC3G,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,OAAO,CAAC,YAAY,CAAC;IAClD,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAAgB;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAEQ,KAAK,CAAC,IAAI,CACjB,KAAa;QAEb,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;CACF"}

package/dist/resolving.d.ts

@@ -0,0 +1,23 @@
+import { type Result } from 'hexok';
+import { Authenticator } from './authenticator.js';
+/**
+ * Turns a proven identity into the app's actor, or a refusal the app names,
+ * such as `unknown` for a subject with no account or `forbidden` for a
+ * service token on a user route. A throw is an infrastructure failure.
+ */
+export type Resolve<I, A, R extends string> = (identity: I) => Promise<Result<A, R>>;
+/**
+ * The seam between proving a credential and knowing the caller. The result is
+ * an `Authenticator` of the app's actor `A`. Its refusals are the
+ * authenticator's and the resolver's. A refusal from the authenticator skips
+ * the resolver.
+ *
+ * ```ts
+ * const auth = resolving(sessions, async (identity) => {
+ *   const user = await users.bySubject(identity.subject)
+ *   return user === undefined ? fail('unknown') : ok({ userId: user.id })
+ * })
+ * ```
+ */
+export declare function resolving<I, A, E extends string, R extends string>(authenticator: Authenticator<I, E>, resolve: Resolve<I, A, R>): Authenticator<A, E | R>;
+//# sourceMappingURL=resolving.d.ts.map

package/dist/resolving.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolving.d.ts","sourceRoot":"","sources":["../src/resolving.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAC5C,QAAQ,EAAE,CAAC,KACR,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AA0B3B;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,EAChE,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,EAClC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAEzB"}

package/dist/resolving.js

@@ -0,0 +1,34 @@
+import { Adapter } from 'hexok';
+import { Authenticator } from './authenticator.js';
+class ResolvingAuthenticator extends Adapter(Authenticator) {
+    #authenticator;
+    #resolve;
+    constructor(authenticator, resolve) {
+        super();
+        this.#authenticator = authenticator;
+        this.#resolve = resolve;
+    }
+    async authenticate(credential) {
+        const found = await this.#authenticator.authenticate(credential);
+        if (!found.ok)
+            return found;
+        return this.#resolve(found.value);
+    }
+}
+/**
+ * The seam between proving a credential and knowing the caller. The result is
+ * an `Authenticator` of the app's actor `A`. Its refusals are the
+ * authenticator's and the resolver's. A refusal from the authenticator skips
+ * the resolver.
+ *
+ * ```ts
+ * const auth = resolving(sessions, async (identity) => {
+ *   const user = await users.bySubject(identity.subject)
+ *   return user === undefined ? fail('unknown') : ok({ userId: user.id })
+ * })
+ * ```
+ */
+export function resolving(authenticator, resolve) {
+    return new ResolvingAuthenticator(authenticator, resolve);
+}
+//# sourceMappingURL=resolving.js.map

package/dist/resolving.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolving.js","sourceRoot":"","sources":["../src/resolving.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAWnD,MAAM,sBAKJ,SAAQ,OAAO,CAAC,aAAa,CAAW;IAC/B,cAAc,CAAsB;IACpC,QAAQ,CAAmB;IAEpC,YAAY,aAAkC,EAAE,OAAyB;QACvE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,UAA8B;QAE9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CACvB,aAAkC,EAClC,OAAyB;IAEzB,OAAO,IAAI,sBAAsB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC"}

package/dist/sessions.d.ts

@@ -0,0 +1,79 @@
+import { type Result } from 'hexok';
+import { Authenticator, type AuthRefusal } from './authenticator.js';
+/** A session a store just opened. `expiresAt` is its absolute end. */
+export type OpenedSession = {
+    readonly id: string;
+    readonly expiresAt: Date;
+};
+declare const SessionStore_base: (abstract new () => {
+    readonly "__#private@#brand": true;
+}) & {
+    readonly token: "SessionStore";
+};
+/**
+ * Server-side sessions. The store is the authority: a token that names a
+ * session the store does not have proves nothing.
+ *
+ * A store keeps two clocks. The idle window slides on every `resolve`. The
+ * absolute end never moves. A session ends at whichever comes first.
+ */
+export declare abstract class SessionStore<I> extends SessionStore_base {
+    /** Opens a session for `identity` under a new random id. It never reuses an id. */
+    abstract open(identity: I): Promise<OpenedSession>;
+    /**
+     * The identity of a live session, and slides its idle window, never past
+     * the absolute end. `ended` when no live session has the id. `expired` when
+     * the record outlived its absolute end, which the store then deletes.
+     */
+    abstract resolve(id: string): Promise<Result<I, 'ended' | 'expired'>>;
+    /** Deletes the session. A missing one is already closed. */
+    abstract close(id: string): Promise<void>;
+}
+declare const SessionToken_base: (abstract new () => {
+    readonly "__#private@#brand": true;
+}) & {
+    readonly token: "SessionToken";
+};
+/**
+ * Translates a session id to and from the string the client holds.
+ * It knows nothing about the identity or the store.
+ */
+export declare abstract class SessionToken extends SessionToken_base {
+    /** The token for `id`. `expiresAt` is the session's absolute end. */
+    abstract issue(id: string, expiresAt: Date): Promise<string>;
+    /** The session id `token` names, or why the token is not accepted. */
+    abstract read(token: string): Promise<Result<string, 'invalid' | 'expired'>>;
+}
+declare const Sessions_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof Authenticator;
+/**
+ * Login, logout, and authentication over a store and a token.
+ * It is an `Authenticator` of the stored identity.
+ *
+ * The identity comes from the store, never from the token. Logout acts on the
+ * credential, so the identity never carries a session id. Start and stop the
+ * store you construct. `Sessions` does not own it.
+ *
+ * ```ts
+ * const sessions = new Sessions({ store, token })
+ * const token = await sessions.open({ userId })          // login
+ * const found = await sessions.authenticate(credential)  // each call
+ * await sessions.close(credential)                        // logout
+ * ```
+ */
+export declare class Sessions<I> extends Sessions_base<I> {
+    #private;
+    constructor(deps: {
+        readonly store: SessionStore<I>;
+        readonly token: SessionToken;
+    });
+    /** Opens a session for `identity` and returns the token the client holds. */
+    open(identity: I): Promise<string>;
+    /** Ends the session the credential names. A missing or bad credential is already signed out. */
+    close(credential: string | undefined): Promise<void>;
+    authenticate(credential: string | undefined): Promise<Result<I, AuthRefusal>>;
+}
+export {};
+//# sourceMappingURL=sessions.d.ts.map

package/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAErE,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B,CAAC;;;;;;AAEF;;;;;;GAMG;AACH,8BAAsB,YAAY,CAAC,CAAC,CAAE,SAAQ,iBAAoB;IAChE,mFAAmF;IACnF,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAElD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC,CAAC;IAErE,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAC1C;;;;;;AAED;;;GAGG;AACH,8BAAsB,YAAa,SAAQ,iBAAoB;IAC7D,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAE5D,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;CAC7E;;;;;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,QAAQ,CAAC,CAAC,CAAE,SAAQ,cAAuB,CAAC,CAAC;;gBAI5C,IAAI,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;KAC9B;IAMD,6EAA6E;IACvE,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAKxC,gGAAgG;IAC1F,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAO3C,YAAY,CACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;CAMnC"}

package/dist/sessions.js

@@ -0,0 +1,64 @@
+import { Adapter, fail, Port } from 'hexok';
+import { Authenticator } from './authenticator.js';
+/**
+ * Server-side sessions. The store is the authority: a token that names a
+ * session the store does not have proves nothing.
+ *
+ * A store keeps two clocks. The idle window slides on every `resolve`. The
+ * absolute end never moves. A session ends at whichever comes first.
+ */
+export class SessionStore extends Port('SessionStore') {
+}
+/**
+ * Translates a session id to and from the string the client holds.
+ * It knows nothing about the identity or the store.
+ */
+export class SessionToken extends Port('SessionToken') {
+}
+/**
+ * Login, logout, and authentication over a store and a token.
+ * It is an `Authenticator` of the stored identity.
+ *
+ * The identity comes from the store, never from the token. Logout acts on the
+ * credential, so the identity never carries a session id. Start and stop the
+ * store you construct. `Sessions` does not own it.
+ *
+ * ```ts
+ * const sessions = new Sessions({ store, token })
+ * const token = await sessions.open({ userId })          // login
+ * const found = await sessions.authenticate(credential)  // each call
+ * await sessions.close(credential)                        // logout
+ * ```
+ */
+export class Sessions extends Adapter(Authenticator) {
+    #store;
+    #token;
+    constructor(deps) {
+        super();
+        this.#store = deps.store;
+        this.#token = deps.token;
+    }
+    /** Opens a session for `identity` and returns the token the client holds. */
+    async open(identity) {
+        const session = await this.#store.open(identity);
+        return this.#token.issue(session.id, session.expiresAt);
+    }
+    /** Ends the session the credential names. A missing or bad credential is already signed out. */
+    async close(credential) {
+        if (credential === undefined || credential === '')
+            return;
+        const id = await this.#token.read(credential);
+        if (!id.ok)
+            return;
+        await this.#store.close(id.value);
+    }
+    async authenticate(credential) {
+        if (credential === undefined || credential === '')
+            return fail('missing');
+        const id = await this.#token.read(credential);
+        if (!id.ok)
+            return fail(id.code);
+        return this.#store.resolve(id.value);
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAe,MAAM,OAAO,CAAC;AACzD,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AAQrE;;;;;;GAMG;AACH,MAAM,OAAgB,YAAgB,SAAQ,IAAI,CAAC,cAAc,CAAC;CAajE;AAED;;;GAGG;AACH,MAAM,OAAgB,YAAa,SAAQ,IAAI,CAAC,cAAc,CAAC;CAM9D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,QAAY,SAAQ,OAAO,CAAC,aAAa,CAAI;IAC/C,MAAM,CAAkB;IACxB,MAAM,CAAe;IAE9B,YAAY,IAGX;QACC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,IAAI,CAAC,QAAW;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,KAAK,CAAC,UAA8B;QACxC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO;QAC1D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO;QACnB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,UAA8B;QAE9B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/static-token-authenticator.d.ts

@@ -0,0 +1,25 @@
+import { type Result } from 'hexok';
+import { Authenticator, type AuthRefusal } from './authenticator.js';
+declare const StaticTokenAuthenticator_base: (abstract new (...args: any[]) => {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+}) & typeof Authenticator;
+/**
+ * Fixed tokens, each mapped to an identity. It fits service tokens and local
+ * development. The map is keyed by a SHA-256 of each token, so the raw tokens
+ * are not kept, and a lookup does not compare token strings. A token cannot
+ * be revoked except by restarting without it.
+ *
+ * ```ts
+ * new StaticTokenAuthenticator({ tokens: [[process.env.REPORTS_TOKEN, { service: 'reports' }]] })
+ * ```
+ */
+export declare class StaticTokenAuthenticator<I> extends StaticTokenAuthenticator_base<I> {
+    #private;
+    constructor(config: {
+        readonly tokens: Iterable<readonly [token: string, identity: I]>;
+    });
+    authenticate(credential: string | undefined): Promise<Result<I, AuthRefusal>>;
+}
+export {};
+//# sourceMappingURL=static-token-authenticator.d.ts.map

package/dist/static-token-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-token-authenticator.d.ts","sourceRoot":"","sources":["../src/static-token-authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,MAAM,EAAE,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;;;;;AAGrE;;;;;;;;;GASG;AACH,qBAAa,wBAAwB,CAAC,CAAC,CAAE,SAAQ,8BAAuB,CAAC,CAAC;;gBAG5D,MAAM,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;KAClE;IAYc,YAAY,CACzB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;CAMnC"}

package/dist/static-token-authenticator.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { Adapter, fail, ok } from 'hexok';
+import { Authenticator } from './authenticator.js';
+import { invalidConfig } from './errors.js';
+/**
+ * Fixed tokens, each mapped to an identity. It fits service tokens and local
+ * development. The map is keyed by a SHA-256 of each token, so the raw tokens
+ * are not kept, and a lookup does not compare token strings. A token cannot
+ * be revoked except by restarting without it.
+ *
+ * ```ts
+ * new StaticTokenAuthenticator({ tokens: [[process.env.REPORTS_TOKEN, { service: 'reports' }]] })
+ * ```
+ */
+export class StaticTokenAuthenticator extends Adapter(Authenticator) {
+    #identities = new Map();
+    constructor(config) {
+        super();
+        const problems = [];
+        let index = 0;
+        for (const [token, identity] of config.tokens) {
+            if (token.trim() === '')
+                problems.push(`tokens[${index}]: is blank.`);
+            else
+                this.#identities.set(digest(token), identity);
+            index += 1;
+        }
+        if (problems.length > 0)
+            throw invalidConfig(problems);
+    }
+    async authenticate(credential) {
+        if (credential === undefined || credential === '')
+            return fail('missing');
+        const key = digest(credential);
+        if (!this.#identities.has(key))
+            return fail('invalid');
+        return ok(this.#identities.get(key));
+    }
+}
+function digest(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+//# sourceMappingURL=static-token-authenticator.js.map

package/dist/static-token-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-token-authenticator.js","sourceRoot":"","sources":["../src/static-token-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAe,MAAM,OAAO,CAAC;AACvD,OAAO,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAA4B,SAAQ,OAAO,CAAC,aAAa,CAAI;IAC/D,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;IAE5C,YAAY,MAEX;QACC,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,cAAc,CAAC,CAAC;;gBACjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACnD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,UAA8B;QAE9B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAM,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@hexok/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.0",
+  "description": "Credential verification for hexok: an Authenticator port, sessions, and a seam that resolves the app's own actor.",
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "keywords": [
+    "hexok",
+    "auth",
+    "authentication",
+    "session"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crobinson42/hexok.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://crobinson42.github.io/hexok/",
+  "bugs": {
+    "url": "https://github.com/crobinson42/hexok/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "test": "vitest run",
+    "type-check": "tsc --noEmit -p tsconfig.check.json",
+    "lint": "biome check .",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  },
+  "dependencies": {
+    "hexok": "^2.2.5"
+  }
+}