@idp.global/sdk 18.0.0 → 18.1.0

package/dist_ts_relyingparty/classes.rpmodels.d.ts

@@ -0,0 +1,79 @@
+import * as plugins from './plugins.js';
+/**
+ * One browser session of a relying party. The persisted field names, their
+ * types and the index declarations are the ones nevermind.finance has stored
+ * under `SessionDoc` since before this module existed, so its collection is
+ * read and written unchanged.
+ */
+export declare class RelyingPartySessionDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartySessionDoc, RelyingPartySessionDoc> {
+    id: string;
+    /** sha256 of the cookie token; the token itself is never stored */
+    tokenHash: string;
+    /** the application's principal (user) this session acts as */
+    userId: string;
+    createdAt: number;
+    lastSeenAt: number;
+    expiresAt: number;
+    /** absent while the session is valid */
+    revokedAt?: number;
+    /** the provider subject of a provider login; absent for a session the application opened itself */
+    idpSubject?: string;
+    /** the login attempt this session came out of; finalize matches it */
+    loginAttemptId?: string;
+    /** sealed with the session encryption key; only the server ever sees the tokens */
+    sealedAccessToken?: string;
+    sealedRefreshToken?: string;
+    /** when the sealed access token dies, epoch milliseconds; `0` when the provider named no lifetime */
+    accessTokenExpiresAt?: number;
+    /** until when one replica holds the right to rotate this session's tokens, epoch milliseconds */
+    refreshLockUntil?: number;
+}
+/**
+ * One browser's sign-in transaction: the state hash the callback is matched
+ * against, the binding to the browser that started it, the sealed PKCE
+ * verifier and the return path. Consumed exactly once by a conditional update.
+ * Field names and indexes are the ones nevermind.finance stores under
+ * `LoginAttemptDoc`.
+ */
+export declare class RelyingPartyLoginAttemptDoc extends plugins.nosqldb.SmartDataDbDoc<RelyingPartyLoginAttemptDoc, RelyingPartyLoginAttemptDoc> {
+    id: string;
+    /** sha256 of the `state` parameter; the parameter itself is never stored */
+    stateHash: string;
+    /** sha256 of the intent cookie value; binds the callback to the browser that started it */
+    bindingTokenHash: string;
+    sealedPkceVerifier: string;
+    nonce: string;
+    /** same-origin path the browser returns to */
+    returnPath: string;
+    createdAt: number;
+    expiresAt: number;
+    /** absent until the callback consumes the attempt; `null` matches "not consumed" in a filter */
+    consumedAt?: number | null;
+    /** the session the callback created; finalize releases the return path against it */
+    createdSessionId?: string | null;
+}
+export declare const RELYING_PARTY_DEFAULT_COLLECTION_NAMES: {
+    readonly sessions: "IdpRelyingPartySession";
+    readonly loginAttempts: "IdpRelyingPartyLoginAttempt";
+};
+export interface IRelyingPartyModelsOptions {
+    db: plugins.nosqldb.SmartdataDb;
+    /**
+     * The persisted collection names. An application that already stores these
+     * documents names its existing collections here.
+     */
+    collectionNames?: {
+        sessions?: string;
+        loginAttempts?: string;
+    };
+}
+export interface IRelyingPartyModels {
+    readonly Session: typeof RelyingPartySessionDoc;
+    readonly LoginAttempt: typeof RelyingPartyLoginAttemptDoc;
+}
+/**
+ * Binds the two relying-party models to one database. Each call declares its
+ * own model classes, so several databases — and several applications in one
+ * process — never share a binding.
+ */
+export declare const createRelyingPartyModels: (optionsArg: IRelyingPartyModelsOptions) => IRelyingPartyModels;

package/dist_ts_relyingparty/classes.rpmodels.js

@@ -0,0 +1,283 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
+import * as plugins from './plugins.js';
+/**
+ * One browser session of a relying party. The persisted field names, their
+ * types and the index declarations are the ones nevermind.finance has stored
+ * under `SessionDoc` since before this module existed, so its collection is
+ * read and written unchanged.
+ */
+let RelyingPartySessionDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _tokenHash_decorators;
+    let _tokenHash_initializers = [];
+    let _tokenHash_extraInitializers = [];
+    let _userId_decorators;
+    let _userId_initializers = [];
+    let _userId_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _lastSeenAt_decorators;
+    let _lastSeenAt_initializers = [];
+    let _lastSeenAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _revokedAt_decorators;
+    let _revokedAt_initializers = [];
+    let _revokedAt_extraInitializers = [];
+    let _idpSubject_decorators;
+    let _idpSubject_initializers = [];
+    let _idpSubject_extraInitializers = [];
+    let _loginAttemptId_decorators;
+    let _loginAttemptId_initializers = [];
+    let _loginAttemptId_extraInitializers = [];
+    let _sealedAccessToken_decorators;
+    let _sealedAccessToken_initializers = [];
+    let _sealedAccessToken_extraInitializers = [];
+    let _sealedRefreshToken_decorators;
+    let _sealedRefreshToken_initializers = [];
+    let _sealedRefreshToken_extraInitializers = [];
+    let _accessTokenExpiresAt_decorators;
+    let _accessTokenExpiresAt_initializers = [];
+    let _accessTokenExpiresAt_extraInitializers = [];
+    let _refreshLockUntil_decorators;
+    let _refreshLockUntil_initializers = [];
+    let _refreshLockUntil_extraInitializers = [];
+    return class RelyingPartySessionDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _tokenHash_decorators = [plugins.nosqldb.unI()];
+            _userId_decorators = [plugins.nosqldb.svDb(), plugins.nosqldb.index()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _lastSeenAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb()];
+            _revokedAt_decorators = [plugins.nosqldb.svDb()];
+            _idpSubject_decorators = [plugins.nosqldb.svDb()];
+            _loginAttemptId_decorators = [plugins.nosqldb.svDb()];
+            _sealedAccessToken_decorators = [plugins.nosqldb.svDb()];
+            _sealedRefreshToken_decorators = [plugins.nosqldb.svDb()];
+            _accessTokenExpiresAt_decorators = [plugins.nosqldb.svDb()];
+            _refreshLockUntil_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _tokenHash_decorators, { kind: "field", name: "tokenHash", static: false, private: false, access: { has: obj => "tokenHash" in obj, get: obj => obj.tokenHash, set: (obj, value) => { obj.tokenHash = value; } }, metadata: _metadata }, _tokenHash_initializers, _tokenHash_extraInitializers);
+            __esDecorate(null, null, _userId_decorators, { kind: "field", name: "userId", static: false, private: false, access: { has: obj => "userId" in obj, get: obj => obj.userId, set: (obj, value) => { obj.userId = value; } }, metadata: _metadata }, _userId_initializers, _userId_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _lastSeenAt_decorators, { kind: "field", name: "lastSeenAt", static: false, private: false, access: { has: obj => "lastSeenAt" in obj, get: obj => obj.lastSeenAt, set: (obj, value) => { obj.lastSeenAt = value; } }, metadata: _metadata }, _lastSeenAt_initializers, _lastSeenAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _revokedAt_decorators, { kind: "field", name: "revokedAt", static: false, private: false, access: { has: obj => "revokedAt" in obj, get: obj => obj.revokedAt, set: (obj, value) => { obj.revokedAt = value; } }, metadata: _metadata }, _revokedAt_initializers, _revokedAt_extraInitializers);
+            __esDecorate(null, null, _idpSubject_decorators, { kind: "field", name: "idpSubject", static: false, private: false, access: { has: obj => "idpSubject" in obj, get: obj => obj.idpSubject, set: (obj, value) => { obj.idpSubject = value; } }, metadata: _metadata }, _idpSubject_initializers, _idpSubject_extraInitializers);
+            __esDecorate(null, null, _loginAttemptId_decorators, { kind: "field", name: "loginAttemptId", static: false, private: false, access: { has: obj => "loginAttemptId" in obj, get: obj => obj.loginAttemptId, set: (obj, value) => { obj.loginAttemptId = value; } }, metadata: _metadata }, _loginAttemptId_initializers, _loginAttemptId_extraInitializers);
+            __esDecorate(null, null, _sealedAccessToken_decorators, { kind: "field", name: "sealedAccessToken", static: false, private: false, access: { has: obj => "sealedAccessToken" in obj, get: obj => obj.sealedAccessToken, set: (obj, value) => { obj.sealedAccessToken = value; } }, metadata: _metadata }, _sealedAccessToken_initializers, _sealedAccessToken_extraInitializers);
+            __esDecorate(null, null, _sealedRefreshToken_decorators, { kind: "field", name: "sealedRefreshToken", static: false, private: false, access: { has: obj => "sealedRefreshToken" in obj, get: obj => obj.sealedRefreshToken, set: (obj, value) => { obj.sealedRefreshToken = value; } }, metadata: _metadata }, _sealedRefreshToken_initializers, _sealedRefreshToken_extraInitializers);
+            __esDecorate(null, null, _accessTokenExpiresAt_decorators, { kind: "field", name: "accessTokenExpiresAt", static: false, private: false, access: { has: obj => "accessTokenExpiresAt" in obj, get: obj => obj.accessTokenExpiresAt, set: (obj, value) => { obj.accessTokenExpiresAt = value; } }, metadata: _metadata }, _accessTokenExpiresAt_initializers, _accessTokenExpiresAt_extraInitializers);
+            __esDecorate(null, null, _refreshLockUntil_decorators, { kind: "field", name: "refreshLockUntil", static: false, private: false, access: { has: obj => "refreshLockUntil" in obj, get: obj => obj.refreshLockUntil, set: (obj, value) => { obj.refreshLockUntil = value; } }, metadata: _metadata }, _refreshLockUntil_initializers, _refreshLockUntil_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        /** sha256 of the cookie token; the token itself is never stored */
+        tokenHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _tokenHash_initializers, ''));
+        /** the application's principal (user) this session acts as */
+        userId = (__runInitializers(this, _tokenHash_extraInitializers), __runInitializers(this, _userId_initializers, ''));
+        createdAt = (__runInitializers(this, _userId_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        lastSeenAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _lastSeenAt_initializers, 0));
+        expiresAt = (__runInitializers(this, _lastSeenAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** absent while the session is valid */
+        revokedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _revokedAt_initializers, void 0));
+        /** the provider subject of a provider login; absent for a session the application opened itself */
+        idpSubject = (__runInitializers(this, _revokedAt_extraInitializers), __runInitializers(this, _idpSubject_initializers, void 0));
+        /** the login attempt this session came out of; finalize matches it */
+        loginAttemptId = (__runInitializers(this, _idpSubject_extraInitializers), __runInitializers(this, _loginAttemptId_initializers, void 0));
+        /** sealed with the session encryption key; only the server ever sees the tokens */
+        sealedAccessToken = (__runInitializers(this, _loginAttemptId_extraInitializers), __runInitializers(this, _sealedAccessToken_initializers, void 0));
+        sealedRefreshToken = (__runInitializers(this, _sealedAccessToken_extraInitializers), __runInitializers(this, _sealedRefreshToken_initializers, void 0));
+        /** when the sealed access token dies, epoch milliseconds; `0` when the provider named no lifetime */
+        accessTokenExpiresAt = (__runInitializers(this, _sealedRefreshToken_extraInitializers), __runInitializers(this, _accessTokenExpiresAt_initializers, void 0));
+        /** until when one replica holds the right to rotate this session's tokens, epoch milliseconds */
+        refreshLockUntil = (__runInitializers(this, _accessTokenExpiresAt_extraInitializers), __runInitializers(this, _refreshLockUntil_initializers, void 0));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _refreshLockUntil_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartySessionDoc };
+/**
+ * One browser's sign-in transaction: the state hash the callback is matched
+ * against, the binding to the browser that started it, the sealed PKCE
+ * verifier and the return path. Consumed exactly once by a conditional update.
+ * Field names and indexes are the ones nevermind.finance stores under
+ * `LoginAttemptDoc`.
+ */
+let RelyingPartyLoginAttemptDoc = (() => {
+    let _classSuper = plugins.nosqldb.SmartDataDbDoc;
+    let _id_decorators;
+    let _id_initializers = [];
+    let _id_extraInitializers = [];
+    let _stateHash_decorators;
+    let _stateHash_initializers = [];
+    let _stateHash_extraInitializers = [];
+    let _bindingTokenHash_decorators;
+    let _bindingTokenHash_initializers = [];
+    let _bindingTokenHash_extraInitializers = [];
+    let _sealedPkceVerifier_decorators;
+    let _sealedPkceVerifier_initializers = [];
+    let _sealedPkceVerifier_extraInitializers = [];
+    let _nonce_decorators;
+    let _nonce_initializers = [];
+    let _nonce_extraInitializers = [];
+    let _returnPath_decorators;
+    let _returnPath_initializers = [];
+    let _returnPath_extraInitializers = [];
+    let _createdAt_decorators;
+    let _createdAt_initializers = [];
+    let _createdAt_extraInitializers = [];
+    let _expiresAt_decorators;
+    let _expiresAt_initializers = [];
+    let _expiresAt_extraInitializers = [];
+    let _consumedAt_decorators;
+    let _consumedAt_initializers = [];
+    let _consumedAt_extraInitializers = [];
+    let _createdSessionId_decorators;
+    let _createdSessionId_initializers = [];
+    let _createdSessionId_extraInitializers = [];
+    return class RelyingPartyLoginAttemptDoc extends _classSuper {
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _id_decorators = [plugins.nosqldb.unI()];
+            _stateHash_decorators = [plugins.nosqldb.unI()];
+            _bindingTokenHash_decorators = [plugins.nosqldb.unI()];
+            _sealedPkceVerifier_decorators = [plugins.nosqldb.svDb()];
+            _nonce_decorators = [plugins.nosqldb.svDb()];
+            _returnPath_decorators = [plugins.nosqldb.svDb()];
+            _createdAt_decorators = [plugins.nosqldb.svDb()];
+            _expiresAt_decorators = [plugins.nosqldb.svDb()];
+            _consumedAt_decorators = [plugins.nosqldb.svDb()];
+            _createdSessionId_decorators = [plugins.nosqldb.svDb()];
+            __esDecorate(null, null, _id_decorators, { kind: "field", name: "id", static: false, private: false, access: { has: obj => "id" in obj, get: obj => obj.id, set: (obj, value) => { obj.id = value; } }, metadata: _metadata }, _id_initializers, _id_extraInitializers);
+            __esDecorate(null, null, _stateHash_decorators, { kind: "field", name: "stateHash", static: false, private: false, access: { has: obj => "stateHash" in obj, get: obj => obj.stateHash, set: (obj, value) => { obj.stateHash = value; } }, metadata: _metadata }, _stateHash_initializers, _stateHash_extraInitializers);
+            __esDecorate(null, null, _bindingTokenHash_decorators, { kind: "field", name: "bindingTokenHash", static: false, private: false, access: { has: obj => "bindingTokenHash" in obj, get: obj => obj.bindingTokenHash, set: (obj, value) => { obj.bindingTokenHash = value; } }, metadata: _metadata }, _bindingTokenHash_initializers, _bindingTokenHash_extraInitializers);
+            __esDecorate(null, null, _sealedPkceVerifier_decorators, { kind: "field", name: "sealedPkceVerifier", static: false, private: false, access: { has: obj => "sealedPkceVerifier" in obj, get: obj => obj.sealedPkceVerifier, set: (obj, value) => { obj.sealedPkceVerifier = value; } }, metadata: _metadata }, _sealedPkceVerifier_initializers, _sealedPkceVerifier_extraInitializers);
+            __esDecorate(null, null, _nonce_decorators, { kind: "field", name: "nonce", static: false, private: false, access: { has: obj => "nonce" in obj, get: obj => obj.nonce, set: (obj, value) => { obj.nonce = value; } }, metadata: _metadata }, _nonce_initializers, _nonce_extraInitializers);
+            __esDecorate(null, null, _returnPath_decorators, { kind: "field", name: "returnPath", static: false, private: false, access: { has: obj => "returnPath" in obj, get: obj => obj.returnPath, set: (obj, value) => { obj.returnPath = value; } }, metadata: _metadata }, _returnPath_initializers, _returnPath_extraInitializers);
+            __esDecorate(null, null, _createdAt_decorators, { kind: "field", name: "createdAt", static: false, private: false, access: { has: obj => "createdAt" in obj, get: obj => obj.createdAt, set: (obj, value) => { obj.createdAt = value; } }, metadata: _metadata }, _createdAt_initializers, _createdAt_extraInitializers);
+            __esDecorate(null, null, _expiresAt_decorators, { kind: "field", name: "expiresAt", static: false, private: false, access: { has: obj => "expiresAt" in obj, get: obj => obj.expiresAt, set: (obj, value) => { obj.expiresAt = value; } }, metadata: _metadata }, _expiresAt_initializers, _expiresAt_extraInitializers);
+            __esDecorate(null, null, _consumedAt_decorators, { kind: "field", name: "consumedAt", static: false, private: false, access: { has: obj => "consumedAt" in obj, get: obj => obj.consumedAt, set: (obj, value) => { obj.consumedAt = value; } }, metadata: _metadata }, _consumedAt_initializers, _consumedAt_extraInitializers);
+            __esDecorate(null, null, _createdSessionId_decorators, { kind: "field", name: "createdSessionId", static: false, private: false, access: { has: obj => "createdSessionId" in obj, get: obj => obj.createdSessionId, set: (obj, value) => { obj.createdSessionId = value; } }, metadata: _metadata }, _createdSessionId_initializers, _createdSessionId_extraInitializers);
+            if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+        }
+        id = __runInitializers(this, _id_initializers, '');
+        /** sha256 of the `state` parameter; the parameter itself is never stored */
+        stateHash = (__runInitializers(this, _id_extraInitializers), __runInitializers(this, _stateHash_initializers, ''));
+        /** sha256 of the intent cookie value; binds the callback to the browser that started it */
+        bindingTokenHash = (__runInitializers(this, _stateHash_extraInitializers), __runInitializers(this, _bindingTokenHash_initializers, ''));
+        sealedPkceVerifier = (__runInitializers(this, _bindingTokenHash_extraInitializers), __runInitializers(this, _sealedPkceVerifier_initializers, ''));
+        nonce = (__runInitializers(this, _sealedPkceVerifier_extraInitializers), __runInitializers(this, _nonce_initializers, ''));
+        /** same-origin path the browser returns to */
+        returnPath = (__runInitializers(this, _nonce_extraInitializers), __runInitializers(this, _returnPath_initializers, '/'));
+        createdAt = (__runInitializers(this, _returnPath_extraInitializers), __runInitializers(this, _createdAt_initializers, 0));
+        expiresAt = (__runInitializers(this, _createdAt_extraInitializers), __runInitializers(this, _expiresAt_initializers, 0));
+        /** absent until the callback consumes the attempt; `null` matches "not consumed" in a filter */
+        consumedAt = (__runInitializers(this, _expiresAt_extraInitializers), __runInitializers(this, _consumedAt_initializers, void 0));
+        /** the session the callback created; finalize releases the return path against it */
+        createdSessionId = (__runInitializers(this, _consumedAt_extraInitializers), __runInitializers(this, _createdSessionId_initializers, void 0));
+        constructor() {
+            super(...arguments);
+            __runInitializers(this, _createdSessionId_extraInitializers);
+        }
+    };
+})();
+export { RelyingPartyLoginAttemptDoc };
+export const RELYING_PARTY_DEFAULT_COLLECTION_NAMES = {
+    sessions: 'IdpRelyingPartySession',
+    loginAttempts: 'IdpRelyingPartyLoginAttempt',
+};
+/**
+ * Binds the two relying-party models to one database. Each call declares its
+ * own model classes, so several databases — and several applications in one
+ * process — never share a binding.
+ */
+export const createRelyingPartyModels = (optionsArg) => {
+    const db = optionsArg.db;
+    if (!(db instanceof plugins.nosqldb.SmartdataDb)) {
+        throw new Error('createRelyingPartyModels needs a SmartdataDb of @lossless.org/client/nosqldb');
+    }
+    const sessions = optionsArg.collectionNames?.sessions ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.sessions;
+    const loginAttempts = optionsArg.collectionNames?.loginAttempts
+        ?? RELYING_PARTY_DEFAULT_COLLECTION_NAMES.loginAttempts;
+    let BoundSessionDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(() => db, { collectionName: sessions })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartySessionDoc;
+        var BoundSessionDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundSessionDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundSessionDoc = _classThis;
+    })();
+    let BoundLoginAttemptDoc = (() => {
+        let _classDecorators = [plugins.nosqldb.Collection(() => db, { collectionName: loginAttempts })];
+        let _classDescriptor;
+        let _classExtraInitializers = [];
+        let _classThis;
+        let _classSuper = RelyingPartyLoginAttemptDoc;
+        var BoundLoginAttemptDoc = class extends _classSuper {
+            static { _classThis = this; }
+            static {
+                const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+                __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+                BoundLoginAttemptDoc = _classThis = _classDescriptor.value;
+                if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+                __runInitializers(_classThis, _classExtraInitializers);
+            }
+        };
+        return BoundLoginAttemptDoc = _classThis;
+    })();
+    return { Session: BoundSessionDoc, LoginAttempt: BoundLoginAttemptDoc };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5ycG1vZGVscy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJwbW9kZWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4Qzs7Ozs7R0FLRztJQUNVLHNCQUFzQjtzQkFBUyxPQUFPLENBQUMsT0FBTyxDQUFDLGNBQWM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBQTdELHNCQUF1QixTQUFRLFdBQThFOzs7OEJBQ3ZILE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO3FDQUlyQixPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtrQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFDdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUU7cUNBR3ZCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7cUNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3NDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTswQ0FJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NkNBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzhDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtnREFJdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7NENBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO1lBNUN2Qix3SkFBTyxFQUFFLDZCQUFGLEVBQUUsK0VBQWM7WUFJdkIsNktBQU8sU0FBUyw2QkFBVCxTQUFTLDZGQUFjO1lBSzlCLG9LQUFPLE1BQU0sNkJBQU4sTUFBTSx1RkFBYztZQUczQiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFHN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFhO1lBRzlCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUk3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQVU7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFVO1lBSTNCLDRMQUFPLGNBQWMsNkJBQWQsY0FBYyx1R0FBVTtZQUkvQixxTUFBTyxpQkFBaUIsNkJBQWpCLGlCQUFpQiw2R0FBVTtZQUdsQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBVTtZQUluQyw4TUFBTyxvQkFBb0IsNkJBQXBCLG9CQUFvQixtSEFBVTtZQUlyQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBVTs7O1FBN0MxQixFQUFFLDZDQUFXLEVBQUUsRUFBQztRQUV2QixtRUFBbUU7UUFFNUQsU0FBUyxxR0FBVyxFQUFFLEdBQUM7UUFFOUIsOERBQThEO1FBR3ZELE1BQU0seUdBQVcsRUFBRSxHQUFDO1FBR3BCLFNBQVMseUdBQVcsQ0FBQyxHQUFDO1FBR3RCLFVBQVUsNkdBQVcsQ0FBQyxHQUFDO1FBR3ZCLFNBQVMsNkdBQVcsQ0FBQyxHQUFDO1FBRTdCLHdDQUF3QztRQUVqQyxTQUFTLHFIQUFVO1FBRTFCLG1HQUFtRztRQUU1RixVQUFVLHNIQUFVO1FBRTNCLHNFQUFzRTtRQUUvRCxjQUFjLDJIQUFVO1FBRS9CLG1GQUFtRjtRQUU1RSxpQkFBaUIsa0lBQVU7UUFHM0Isa0JBQWtCLHNJQUFVO1FBRW5DLHFHQUFxRztRQUU5RixvQkFBb0IseUlBQVU7UUFFckMsaUdBQWlHO1FBRTFGLGdCQUFnQix1SUFBVTs7Ozs7OztTQS9DdEIsc0JBQXNCO0FBa0RuQzs7Ozs7O0dBTUc7SUFDVSwyQkFBMkI7c0JBQVMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxjQUFjOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O2lCQUFsRSwyQkFBNEIsU0FBUSxXQUF3Rjs7OzhCQUN0SSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtxQ0FJckIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7NENBSXJCLE9BQU8sQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFOzhDQUdyQixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtpQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7c0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFO3FDQUd0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtxQ0FHdEIsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUU7c0NBSXRCLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFOzRDQUl0QixPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRTtZQS9CdkIsd0pBQU8sRUFBRSw2QkFBRixFQUFFLCtFQUFjO1lBSXZCLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYztZQUk5QixrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBYztZQUdyQyx3TUFBTyxrQkFBa0IsNkJBQWxCLGtCQUFrQiwrR0FBYztZQUd2QyxpS0FBTyxLQUFLLDZCQUFMLEtBQUsscUZBQWM7WUFJMUIsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFlO1lBR2hDLDZLQUFPLFNBQVMsNkJBQVQsU0FBUyw2RkFBYTtZQUc3Qiw2S0FBTyxTQUFTLDZCQUFULFNBQVMsNkZBQWE7WUFJN0IsZ0xBQU8sVUFBVSw2QkFBVixVQUFVLCtGQUFpQjtZQUlsQyxrTUFBTyxnQkFBZ0IsNkJBQWhCLGdCQUFnQiwyR0FBaUI7OztRQWhDakMsRUFBRSw2Q0FBVyxFQUFFLEVBQUM7UUFFdkIsNEVBQTRFO1FBRXJFLFNBQVMscUdBQVcsRUFBRSxHQUFDO1FBRTlCLDJGQUEyRjtRQUVwRixnQkFBZ0IsbUhBQVcsRUFBRSxHQUFDO1FBRzlCLGtCQUFrQiw0SEFBVyxFQUFFLEdBQUM7UUFHaEMsS0FBSyxpSEFBVyxFQUFFLEdBQUM7UUFFMUIsOENBQThDO1FBRXZDLFVBQVUseUdBQVcsR0FBRyxHQUFDO1FBR3pCLFNBQVMsNkdBQVcsQ0FBQyxHQUFDO1FBR3RCLFNBQVMsNEdBQVcsQ0FBQyxHQUFDO1FBRTdCLGdHQUFnRztRQUV6RixVQUFVLHNIQUFpQjtRQUVsQyxxRkFBcUY7UUFFOUUsZ0JBQWdCLDZIQUFpQjs7Ozs7OztTQWxDN0IsMkJBQTJCO0FBcUN4QyxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRztJQUNwRCxRQUFRLEVBQUUsd0JBQXdCO0lBQ2xDLGFBQWEsRUFBRSw2QkFBNkI7Q0FDcEMsQ0FBQztBQW1CWDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxVQUFzQyxFQUF1QixFQUFFO0lBQ3RHLE1BQU0sRUFBRSxHQUFHLFVBQVUsQ0FBQyxFQUFFLENBQUM7SUFDekIsSUFBSSxDQUFDLENBQUMsRUFBRSxZQUFZLE9BQU8sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLElBQUksS0FBSyxDQUFDLDhFQUE4RSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxJQUFJLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQztJQUN6RyxNQUFNLGFBQWEsR0FBRyxVQUFVLENBQUMsZUFBZSxFQUFFLGFBQWE7V0FDMUQsc0NBQXNDLENBQUMsYUFBYSxDQUFDO1FBR3BELGVBQWU7Z0NBRHBCLE9BQU8sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsQ0FBQzs7OzswQkFDckMsc0JBQXNCO21DQUE5QixTQUFRLFdBQXNCOzs7O2dCQUFwRCw2S0FBdUQ7OztnQkFBakQsdURBQWU7Ozs7O1FBR2Ysb0JBQW9CO2dDQUR6QixPQUFPLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLEVBQUUsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLENBQUM7Ozs7MEJBQ3JDLDJCQUEyQjt3Q0FBbkMsU0FBUSxXQUEyQjs7OztnQkFBOUQsNktBQWlFOzs7Z0JBQTNELHVEQUFvQjs7Ozs7SUFFMUIsT0FBTyxFQUFFLE9BQU8sRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLG9CQUFvQixFQUFFLENBQUM7QUFDMUUsQ0FBQyxDQUFDIn0=

package/dist_ts_relyingparty/classes.secretbox.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Seals small secrets at rest — the PKCE verifier of a login attempt and the
+ * provider tokens of a session — with AES-256-GCM under a 32-byte deployment
+ * key. The sealed form is `v1:<base64url iv>:<base64url tag>:<base64url
+ * ciphertext>`, the form nevermind.finance has stored since before this module
+ * existed, so its sealed values open here unchanged.
+ */
+export declare class SecretBox {
+    #private;
+    constructor(keyArg: Buffer);
+    seal(plainArg: string): string;
+    /** The plain value, or a throw: another format, another key, or a changed byte. */
+    open(sealedArg: string): string;
+}

package/dist_ts_relyingparty/classes.secretbox.js

@@ -0,0 +1,45 @@
+import * as plugins from './plugins.js';
+/**
+ * The persisted format tag of a sealed value. It names the stored layout of
+ * values that already exist and is read as it is; it is not an API version.
+ */
+const SEALED_FORMAT = 'v1';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+/**
+ * Seals small secrets at rest — the PKCE verifier of a login attempt and the
+ * provider tokens of a session — with AES-256-GCM under a 32-byte deployment
+ * key. The sealed form is `v1:<base64url iv>:<base64url tag>:<base64url
+ * ciphertext>`, the form nevermind.finance has stored since before this module
+ * existed, so its sealed values open here unchanged.
+ */
+export class SecretBox {
+    #key;
+    constructor(keyArg) {
+        if (!Buffer.isBuffer(keyArg) || keyArg.length !== 32) {
+            throw new Error('SecretBox needs a 32 byte key');
+        }
+        this.#key = Buffer.from(keyArg);
+    }
+    seal(plainArg) {
+        const iv = plugins.crypto.randomBytes(IV_LENGTH);
+        const cipher = plugins.crypto.createCipheriv(ALGORITHM, this.#key, iv, { authTagLength: TAG_LENGTH });
+        const ciphertext = Buffer.concat([cipher.update(plainArg, 'utf8'), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return [SEALED_FORMAT, iv.toString('base64url'), tag.toString('base64url'), ciphertext.toString('base64url')].join(':');
+    }
+    /** The plain value, or a throw: another format, another key, or a changed byte. */
+    open(sealedArg) {
+        const [format, ivText, tagText, cipherText] = sealedArg.split(':');
+        if (format !== SEALED_FORMAT || !ivText || !tagText || cipherText === undefined) {
+            throw new Error('Sealed secret has an unknown format');
+        }
+        const decipher = plugins.crypto.createDecipheriv(ALGORITHM, this.#key, Buffer.from(ivText, 'base64url'), {
+            authTagLength: TAG_LENGTH,
+        });
+        decipher.setAuthTag(Buffer.from(tagText, 'base64url'));
+        return Buffer.concat([decipher.update(Buffer.from(cipherText, 'base64url')), decipher.final()]).toString('utf8');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zZWNyZXRib3guanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5zZWNyZXRib3gudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFFeEM7OztHQUdHO0FBQ0gsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDO0FBQzNCLE1BQU0sU0FBUyxHQUFHLGFBQWEsQ0FBQztBQUNoQyxNQUFNLFNBQVMsR0FBRyxFQUFFLENBQUM7QUFDckIsTUFBTSxVQUFVLEdBQUcsRUFBRSxDQUFDO0FBRXRCOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxTQUFTO0lBQ1gsSUFBSSxDQUFTO0lBRXRCLFlBQVksTUFBYztRQUN4QixJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3JELE1BQU0sSUFBSSxLQUFLLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2xDLENBQUM7SUFFTSxJQUFJLENBQUMsUUFBZ0I7UUFDMUIsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFLEVBQUUsYUFBYSxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7UUFDdEcsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDcEYsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxHQUFHLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDMUgsQ0FBQztJQUVELG1GQUFtRjtJQUM1RSxJQUFJLENBQUMsU0FBaUI7UUFDM0IsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbkUsSUFBSSxNQUFNLEtBQUssYUFBYSxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxJQUFJLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNoRixNQUFNLElBQUksS0FBSyxDQUFDLHFDQUFxQyxDQUFDLENBQUM7UUFDekQsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLEVBQUU7WUFDdkcsYUFBYSxFQUFFLFVBQVU7U0FDMUIsQ0FBQyxDQUFDO1FBQ0gsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO1FBQ3ZELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsRUFBRSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNuSCxDQUFDO0NBQ0YifQ==

package/dist_ts_relyingparty/classes.socketbinding.d.ts

@@ -0,0 +1,75 @@
+import * as plugins from './plugins.js';
+import type { RelyingPartySessions } from './classes.relyingpartysessions.js';
+import type { IRelyingPartySession } from './interfaces.js';
+/** The part of a server `TypedSocket` the binding uses. */
+export type TRelyingPartySocketTransport = Pick<plugins.typedsocket.TypedSocket, 'setServerTag' | 'findAllTargetConnectionsByTag'>;
+export type TRelyingPartySocketConnection = plugins.typedsocket.ISmartServeConnectionWrapper;
+/** What a browser connection is pinned to for its whole life; no cookie and no CSRF token is kept. */
+export interface IRelyingPartyPinnedSession {
+    sessionId: string;
+    principalId: string;
+    /** SHA-256 of the CSRF token the registration proved */
+    csrfTokenHash: string;
+}
+export interface IRelyingPartySocketRefusal {
+    code: 'invalid_input' | 'forbidden' | 'unauthorized';
+    status: number;
+}
+export type TRelyingPartySocketRegistration = {
+    registered: true;
+    pinned: IRelyingPartyPinnedSession;
+    expiresAt: number;
+} | {
+    registered: false;
+    refusal: IRelyingPartySocketRefusal;
+};
+export interface IRelyingPartySocketBindingOptions {
+    sessions: RelyingPartySessions;
+    /** the transport typedserver created; `undefined` before the server runs */
+    transport: () => TRelyingPartySocketTransport | undefined;
+    /** the server-owned tag prefix that finds the connections of a session */
+    tagPrefix?: string;
+}
+/**
+ * Binds typed socket connections to relying-party browser sessions. A
+ * connection registers once with the CSRF token of the page; the proof is the
+ * upgrade's own `Origin` and `Cookie` — which only a browser on this origin
+ * sends — plus the token, and the connection is pinned to the session. Every
+ * later request re-validates the session with the same strength as an HTTP
+ * request. Connection limits, rate limits and sweeps belong to the
+ * application's socket gate.
+ */
+export declare class RelyingPartySocketBinding {
+    #private;
+    readonly tagPrefix: string;
+    constructor(optionsArg: IRelyingPartySocketBindingOptions);
+    /** The upgrade headers a connection arrived with. */
+    upgradeOf(connectionArg: TRelyingPartySocketConnection): {
+        origin: string | null;
+        cookie: string | null;
+    };
+    /**
+     * What a registration payload `{ csrfToken }` proves, given the upgrade it
+     * came on. No connection state is touched, so the application decides about
+     * its limits between this answer and `tagConnection`.
+     */
+    resolveBrowserRegistration(payloadArg: unknown, upgradeArg: {
+        origin: string | null;
+        cookie: string | null;
+    }): Promise<TRelyingPartySocketRegistration>;
+    tagOf(sessionIdArg: string): string;
+    /** Tags a connection with its session; throws when the transport is not running or the connection is gone. */
+    tagConnection(connectionArg: TRelyingPartySocketConnection, sessionIdArg: string): void;
+    /**
+     * The pinned session as it stands right now: re-read, live, its principal
+     * active and unchanged, touched under the liveness it was read with. The
+     * browser keeps proving itself with its CSRF token, compared against the
+     * hash the registration kept. Nothing of this is cached.
+     */
+    revalidate(pinnedArg: IRelyingPartyPinnedSession): Promise<{
+        session: IRelyingPartySession;
+        verifyCsrf(candidateArg: unknown): boolean;
+    } | null>;
+    /** The live connections of one session, for closing them when it ends. */
+    connectionsOfSession(sessionIdArg: string): Promise<readonly TRelyingPartySocketConnection[]>;
+}

package/dist_ts_relyingparty/classes.socketbinding.js

@@ -0,0 +1,94 @@
+import * as plugins from './plugins.js';
+import { sha256, timingSafeEqualString } from './helpers.crypto.js';
+/**
+ * Binds typed socket connections to relying-party browser sessions. A
+ * connection registers once with the CSRF token of the page; the proof is the
+ * upgrade's own `Origin` and `Cookie` — which only a browser on this origin
+ * sends — plus the token, and the connection is pinned to the session. Every
+ * later request re-validates the session with the same strength as an HTTP
+ * request. Connection limits, rate limits and sweeps belong to the
+ * application's socket gate.
+ */
+export class RelyingPartySocketBinding {
+    #sessions;
+    #transport;
+    tagPrefix;
+    constructor(optionsArg) {
+        this.#sessions = optionsArg.sessions;
+        this.#transport = optionsArg.transport;
+        this.tagPrefix = optionsArg.tagPrefix ?? 'idp_rp_session:';
+    }
+    /** The upgrade headers a connection arrived with. */
+    upgradeOf(connectionArg) {
+        const headers = connectionArg.peer.context.headers;
+        return { origin: headers.get('origin'), cookie: headers.get('cookie') };
+    }
+    /**
+     * What a registration payload `{ csrfToken }` proves, given the upgrade it
+     * came on. No connection state is touched, so the application decides about
+     * its limits between this answer and `tagConnection`.
+     */
+    async resolveBrowserRegistration(payloadArg, upgradeArg) {
+        if (!payloadArg || typeof payloadArg !== 'object' || !Reflect.has(payloadArg, 'csrfToken')) {
+            return { registered: false, refusal: { code: 'invalid_input', status: 400 } };
+        }
+        if (upgradeArg.origin !== this.#sessions.publicOrigin) {
+            return { registered: false, refusal: { code: 'forbidden', status: 403 } };
+        }
+        const resolved = await this.#sessions.resolveCookieSession(upgradeArg.cookie);
+        if (!resolved) {
+            return { registered: false, refusal: { code: 'unauthorized', status: 401 } };
+        }
+        if (!this.#sessions.validateCsrf(resolved, Reflect.get(payloadArg, 'csrfToken'))) {
+            return { registered: false, refusal: { code: 'forbidden', status: 403 } };
+        }
+        return {
+            registered: true,
+            pinned: {
+                sessionId: resolved.session.id,
+                principalId: resolved.session.principalId,
+                csrfTokenHash: sha256(resolved.csrfToken),
+            },
+            expiresAt: resolved.session.expiresAt,
+        };
+    }
+    tagOf(sessionIdArg) {
+        return this.tagPrefix + sessionIdArg;
+    }
+    /** Tags a connection with its session; throws when the transport is not running or the connection is gone. */
+    tagConnection(connectionArg, sessionIdArg) {
+        const transport = this.#transport();
+        if (!transport) {
+            throw new Error('The socket transport is not running');
+        }
+        transport.setServerTag(connectionArg, this.tagOf(sessionIdArg));
+    }
+    /**
+     * The pinned session as it stands right now: re-read, live, its principal
+     * active and unchanged, touched under the liveness it was read with. The
+     * browser keeps proving itself with its CSRF token, compared against the
+     * hash the registration kept. Nothing of this is cached.
+     */
+    async revalidate(pinnedArg) {
+        const session = await this.#sessions.revalidateSession(pinnedArg.sessionId);
+        if (!session || session.principalId !== pinnedArg.principalId) {
+            return null;
+        }
+        const expectedHash = pinnedArg.csrfTokenHash;
+        return {
+            session,
+            verifyCsrf: (candidateArg) => typeof candidateArg === 'string'
+                && expectedHash.length > 0
+                && timingSafeEqualString(expectedHash, sha256(candidateArg)),
+        };
+    }
+    /** The live connections of one session, for closing them when it ends. */
+    async connectionsOfSession(sessionIdArg) {
+        const transport = this.#transport();
+        if (!transport) {
+            return [];
+        }
+        return transport.findAllTargetConnectionsByTag(this.tagOf(sessionIdArg));
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zb2NrZXRiaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfcmVseWluZ3BhcnR5L2NsYXNzZXMuc29ja2V0YmluZGluZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFvQ3BFOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUMzQixTQUFTLENBQXVCO0lBQ2hDLFVBQVUsQ0FBaUQ7SUFDcEQsU0FBUyxDQUFTO0lBRWxDLFlBQVksVUFBNkM7UUFDdkQsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN2QyxJQUFJLENBQUMsU0FBUyxHQUFHLFVBQVUsQ0FBQyxTQUFTLElBQUksaUJBQWlCLENBQUM7SUFDN0QsQ0FBQztJQUVELHFEQUFxRDtJQUM5QyxTQUFTLENBQUMsYUFBNEM7UUFDM0QsTUFBTSxPQUFPLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO1FBQ25ELE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO0lBQzFFLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLDBCQUEwQixDQUNyQyxVQUFtQixFQUNuQixVQUE0RDtRQUU1RCxJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDM0YsT0FBTyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDZCxPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQy9FLENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNqRixPQUFPLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQzVFLENBQUM7UUFDRCxPQUFPO1lBQ0wsVUFBVSxFQUFFLElBQUk7WUFDaEIsTUFBTSxFQUFFO2dCQUNOLFNBQVMsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQzlCLFdBQVcsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVc7Z0JBQ3pDLGFBQWEsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQzthQUMxQztZQUNELFNBQVMsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVM7U0FDdEMsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsWUFBb0I7UUFDL0IsT0FBTyxJQUFJLENBQUMsU0FBUyxHQUFHLFlBQVksQ0FBQztJQUN2QyxDQUFDO0lBRUQsOEdBQThHO0lBQ3ZHLGFBQWEsQ0FBQyxhQUE0QyxFQUFFLFlBQW9CO1FBQ3JGLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksS0FBSyxDQUFDLHFDQUFxQyxDQUFDLENBQUM7UUFDekQsQ0FBQztRQUNELFNBQVMsQ0FBQyxZQUFZLENBQUMsYUFBYSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsVUFBVSxDQUNyQixTQUFxQztRQUVyQyxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVFLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDOUQsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQztRQUM3QyxPQUFPO1lBQ0wsT0FBTztZQUNQLFVBQVUsRUFBRSxDQUFDLFlBQVksRUFBRSxFQUFFLENBQzNCLE9BQU8sWUFBWSxLQUFLLFFBQVE7bUJBQzdCLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQzttQkFDdkIscUJBQXFCLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztTQUMvRCxDQUFDO0lBQ0osQ0FBQztJQUVELDBFQUEwRTtJQUNuRSxLQUFLLENBQUMsb0JBQW9CLENBQUMsWUFBb0I7UUFDcEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3BDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNmLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUMzRSxDQUFDO0NBQ0YifQ==

package/dist_ts_relyingparty/helpers.cookies.d.ts

@@ -0,0 +1,11 @@
+export interface ICookieOptions {
+    httpOnly?: boolean;
+    maxAgeSeconds?: number;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+    secure?: boolean;
+}
+/** The cookies of a `Cookie` header; the first value of a repeated name wins, an undecodable value is skipped. */
+export declare const parseCookies: (cookieHeaderArg: string | null | undefined) => Map<string, string>;
+/** One `Set-Cookie` value, always `Path=/` and never with a `Domain`, so a `__Host-` name stays valid. */
+export declare const serializeCookie: (nameArg: string, valueArg: string, optionsArg?: ICookieOptions) => string;
+export declare const serializeClearedCookie: (nameArg: string, optionsArg?: Omit<ICookieOptions, "maxAgeSeconds">) => string;