@knpkv/browser-pairing 0.2.0 → 0.3.0

package/README.md

@@ -1,7 +1,16 @@
 # @knpkv/browser-pairing
 
 Typed, redacted browser-pairing credentials and transport primitives. Product
-packages keep their own persistence, authorization, and route policy.
+packages keep their own persistence, persisted authorization, and route policy.
+
+`@knpkv/browser-pairing/owner-session` is the one shared policy: the Owner
+Session of a single-operator loopback web app. It issues the session, CSRF
+(`writes: "csrf"`) and bootstrap credentials, authorizes requests by session
+cookie, Origin, Fetch Metadata and CSRF token, and serves `POST /auth/bootstrap`.
+The service and its bootstrap response carry credentials; the session cookie is
+the only value it sets on the browser. Applications keep their API middleware,
+map `OwnerSessionUnauthorizedError` to 401 and `OwnerSessionForbiddenError` to
+403, and pass the origin a browser request must carry. See ADR-0008.
 
 `PairingCode`, `SessionToken`, and `CsrfToken` are distinct branded roles over
 the same validated credential encoding. Consumers must issue and decode the

package/dist/owner-session.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Who may talk to a single-operator loopback web app.
+ *
+ * **Mental model**
+ *
+ * - **One process, one operator.** The server binds a loopback address and mints a session token for
+ *   itself at startup. There is no user table and no login: the person who can read the terminal is
+ *   the person who gets in.
+ * - **The URL is the handshake.** A bootstrap code rides in a fragment the browser never sends
+ *   upstream and is spent the first time it is exchanged for the session cookie. Codes come from
+ *   {@link OwnerSessionService.mintBootstrapCode}, only once the server is listening; a newer code
+ *   replaces an unspent one and reopens an exchange that guesses had closed.
+ * - **A read needs the cookie and must not be a browser cross-origin request; a write also needs the
+ *   expected origin and the CSRF header.** Another page in the same browser can make the browser send
+ *   a cookie, but Fetch Metadata keeps that page from starting reads without an Origin. An app with
+ *   `writes: "none"` issues no CSRF token and refuses every unsafe method.
+ *
+ * Applications keep their HTTP API middleware and wire errors; they map
+ * {@link OwnerSessionUnauthorizedError} to 401 and {@link OwnerSessionForbiddenError} to 403.
+ * Multi-session, persisted authorization (Control Center) is out of scope.
+ *
+ * @module
+ */
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+import { HttpRouter, HttpServerRequest } from "effect/http";
+import type { BrowserPairingError } from "./crypto.js";
+import type { CsrfToken, PairingCode } from "./schema.js";
+import { CredentialCookieError } from "./schema.js";
+/**
+ * The one origin other than the bound server that may be advertised: the Vite dev server that
+ * proxies the API and the bootstrap exchange.
+ */
+export declare const devPublicOrigin = "http://localhost:5173";
+declare const OwnerSessionUnauthorizedError_base: Schema.Class<OwnerSessionUnauthorizedError, Schema.TaggedStruct<"OwnerSessionUnauthorizedError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The session cookie or bootstrap code is missing, wrong, spent, or expired. Maps to 401. */
+export declare class OwnerSessionUnauthorizedError extends OwnerSessionUnauthorizedError_base {
+}
+declare const OwnerSessionForbiddenError_base: Schema.Class<OwnerSessionForbiddenError, Schema.TaggedStruct<"OwnerSessionForbiddenError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The credential is right but the request did not come from the owner's page. Maps to 403. */
+export declare class OwnerSessionForbiddenError extends OwnerSessionForbiddenError_base {
+}
+declare const UnsafeLoopbackAddressError_base: Schema.Class<UnsafeLoopbackAddressError, Schema.TaggedStruct<"UnsafeLoopbackAddressError", {
+    readonly address: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A hostname or origin is not a plain HTTP loopback address. */
+export declare class UnsafeLoopbackAddressError extends UnsafeLoopbackAddressError_base {
+}
+/** Hostnames a loopback web app may bind. */
+export declare const LoopbackHostname: Schema.Literals<readonly ["127.0.0.1", "localhost", "::1"]>;
+export type LoopbackHostname = typeof LoopbackHostname.Type;
+/** Whether a URL hostname (which brackets IPv6) names the loopback interface. */
+export declare const isLoopbackHostname: (hostname: string) => boolean;
+/** Refuse to bind anything a peer on the network could reach. */
+export declare const requireLoopbackHostname: (hostname: string) => Effect.Effect<"127.0.0.1" | "::1" | "localhost", UnsafeLoopbackAddressError, never>;
+/** The HTTP origin for a bound loopback server, without a trailing slash. */
+export declare const loopbackOrigin: (hostname: string, port: number) => string;
+/** Validate an origin as plain HTTP on loopback with no path, query, or fragment. */
+export declare const requireLoopbackOrigin: (origin: string) => Effect.Effect<string, UnsafeLoopbackAddressError, never>;
+/** The origin to advertise: the bound server, or the dev server that proxies to it. */
+export declare const resolvePublicOrigin: (configuredOrigin: string | undefined, authorityOrigin: string) => Effect.Effect<string, UnsafeLoopbackAddressError, never>;
+/**
+ * The URL to open. The code rides in the fragment, which browsers do not send to servers and
+ * proxies do not log; the page strips it from the address bar once it has been spent.
+ */
+export declare const bootstrapUrl: (origin: string, code: Redacted.Redacted<PairingCode>) => string;
+export interface OwnerSessionOptions {
+    /** Product name used in refusal messages, such as `"jcf-web"`. */
+    readonly product: string;
+    readonly cookieName: string;
+    /** `"csrf"` issues a CSRF token and admits same-origin writes; `"none"` refuses every unsafe method. */
+    readonly writes: "csrf" | "none";
+    /** Appended to the expiry refusal, such as `"restart jcf-web for a fresh URL"`. */
+    readonly freshUrlHint: string;
+    /** The origin this server considers itself to be. A request's Host header is never authoritative. */
+    readonly authorityOrigin: string;
+    /** The origin a browser request must carry: the authority, or a dev proxy that preserves Origin. */
+    readonly browserOrigin: string;
+}
+/** What a request presents. {@link OwnerSessionService.authorizeHttp} reads it from the HTTP request. */
+export interface OwnerRequest {
+    readonly credential: string;
+    readonly csrfToken: string | undefined;
+    readonly fetchSite: string | undefined;
+    readonly method: string;
+    readonly origin: string | undefined;
+}
+export interface BootstrapRequest {
+    readonly authorization: string | undefined;
+    readonly origin: string | undefined;
+}
+/** Whether writes are possible, and the token they need when they are. Credential-bearing: holds the `CsrfToken`. */
+export type WritePolicy = {
+    readonly _tag: "Csrf";
+    readonly token: Redacted.Redacted<CsrfToken>;
+} | {
+    readonly _tag: "ReadOnly";
+};
+/**
+ * One process's Owner Session. Credential-bearing: it holds the `CsrfToken`, serializes the
+ * `SessionToken` into {@link OwnerSessionService.sessionCookie}, and mints `PairingCode`s; the
+ * session token and bootstrap state themselves stay private.
+ */
+export interface OwnerSessionService {
+    readonly authorityOrigin: string;
+    readonly browserOrigin: string;
+    readonly cookieName: string;
+    readonly writes: WritePolicy;
+    /** The `Set-Cookie` value carrying the session token. */
+    readonly sessionCookie: string;
+    /** Mint a one-time code, usable for a minute. Call only once the server is listening. */
+    readonly mintBootstrapCode: Effect.Effect<Redacted.Redacted<PairingCode>, BrowserPairingError>;
+    readonly authorizeRequest: (request: OwnerRequest) => Effect.Effect<void, OwnerSessionUnauthorizedError | OwnerSessionForbiddenError>;
+    /**
+     * {@link OwnerSessionService.authorizeRequest} for the current HTTP request, given the session
+     * cookie's value. API middleware maps the two errors onto the app's 401 and 403.
+     */
+    readonly authorizeHttp: (credential: string) => Effect.Effect<void, OwnerSessionUnauthorizedError | OwnerSessionForbiddenError, HttpServerRequest.HttpServerRequest>;
+    /** Spend a bootstrap code. Succeeds at most once per minted code. */
+    readonly authorizeBootstrap: (request: BootstrapRequest) => Effect.Effect<void, OwnerSessionUnauthorizedError | OwnerSessionForbiddenError>;
+}
+declare const OwnerSession_base: Context.ServiceClass<OwnerSession, "@knpkv/browser-pairing/OwnerSession", OwnerSessionService>;
+export declare class OwnerSession extends OwnerSession_base {
+}
+/**
+ * Build an owner session with fresh tokens. No bootstrap code exists until
+ * {@link OwnerSessionService.mintBootstrapCode} runs.
+ */
+export declare const make: (options: OwnerSessionOptions) => Effect.Effect<OwnerSessionService, BrowserPairingError | CredentialCookieError | UnsafeLoopbackAddressError, Crypto.Crypto>;
+export declare const layer: (options: OwnerSessionOptions) => Layer.Layer<OwnerSession, BrowserPairingError | CredentialCookieError | UnsafeLoopbackAddressError, Crypto.Crypto>;
+/**
+ * The one route outside the authenticated API: `POST /auth/bootstrap` spends a code for the session
+ * cookie, answering `{ csrfToken }` when writes are allowed and `{}` otherwise.
+ */
+export declare const BootstrapRouter: Layer.Layer<never, never, HttpRouter.HttpRouter | OwnerSession | HttpRouter.Request<"Error", import("effect/http/HttpBody").HttpBodyError>>;
+export {};
+//# sourceMappingURL=owner-session.d.ts.map

package/dist/owner-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-session.d.ts","sourceRoot":"","sources":["../src/owner-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAS,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAO,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAsB,MAAM,aAAa,CAAA;AAE/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAA6B,WAAW,EAAgB,MAAM,aAAa,CAAA;AAClG,OAAO,EAAE,qBAAqB,EAAsD,MAAM,aAAa,CAAA;AAkBvG;;;GAGG;AACH,eAAO,MAAM,eAAe,0BAA0B,CAAA;;;;AAEtD,8FAA8F;AAC9F,qBAAa,6BAA8B,SAAQ,kCAGlD;CAAG;;;;AAEJ,+FAA+F;AAC/F,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;;;;;AAEJ,iEAAiE;AACjE,qBAAa,0BAA2B,SAAQ,+BAG/C;CAAG;AAEJ,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,6DAAqD,CAAA;AAClF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,OAC8C,CAAA;AAEpG,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,aAAc,MAAM,wFAKrD,CAAA;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,KAAG,MACH,CAAA;AAE7D,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,8EAoBjC,CAAA;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,6HAa/B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAY,MAAM,QAAQ,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAG,MACW,CAAA;AAE/F,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wGAAwG;IACxG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,qGAAqG;IACrG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,oGAAoG;IACpG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,yGAAyG;AACzG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CACpC;AAED,qHAAqH;AACrH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAA;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,CACzB,OAAO,EAAE,YAAY,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,GAAG,0BAA0B,CAAC,CAAA;IACpF;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CACtB,UAAU,EAAE,MAAM,KACf,MAAM,CAAC,MAAM,CAChB,IAAI,EACJ,6BAA6B,GAAG,0BAA0B,EAC1D,iBAAiB,CAAC,iBAAiB,CACpC,CAAA;IACD,qEAAqE;IACrE,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,OAAO,EAAE,gBAAgB,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,GAAG,0BAA0B,CAAC,CAAA;CACrF;;AAED,qBAAa,YAAa,SAAQ,iBAEjC;CAAG;AA8JJ;;;GAGG;AACH,eAAO,MAAM,IAAI,+JA4Bf,CAAA;AAEF,eAAO,MAAM,KAAK,YAAa,mBAAmB,uHAA8C,CAAA;AAEhG;;;GAGG;AACH,eAAO,MAAM,eAAe,6IAwB3B,CAAA"}

package/dist/owner-session.js

@@ -0,0 +1,254 @@
+/**
+ * Who may talk to a single-operator loopback web app.
+ *
+ * **Mental model**
+ *
+ * - **One process, one operator.** The server binds a loopback address and mints a session token for
+ *   itself at startup. There is no user table and no login: the person who can read the terminal is
+ *   the person who gets in.
+ * - **The URL is the handshake.** A bootstrap code rides in a fragment the browser never sends
+ *   upstream and is spent the first time it is exchanged for the session cookie. Codes come from
+ *   {@link OwnerSessionService.mintBootstrapCode}, only once the server is listening; a newer code
+ *   replaces an unspent one and reopens an exchange that guesses had closed.
+ * - **A read needs the cookie and must not be a browser cross-origin request; a write also needs the
+ *   expected origin and the CSRF header.** Another page in the same browser can make the browser send
+ *   a cookie, but Fetch Metadata keeps that page from starting reads without an Origin. An app with
+ *   `writes: "none"` issues no CSRF token and refuses every unsafe method.
+ *
+ * Applications keep their HTTP API middleware and wire errors; they map
+ * {@link OwnerSessionUnauthorizedError} to 401 and {@link OwnerSessionForbiddenError} to 403.
+ * Multi-session, persisted authorization (Control Center) is out of scope.
+ *
+ * @module
+ */
+import { Clock, Context, Crypto, Effect, Layer, Redacted, Ref, Schema } from "effect";
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { credentialValuesEqual, expiresAt, issueCsrfToken, issuePairingCode, issueSessionToken } from "./crypto.js";
+import { CredentialCookieError, decideOneTimeCredential, serializeCredentialCookie } from "./schema.js";
+/** How long a minted bootstrap URL stays usable. Long enough to click, short enough to forget. */
+const BOOTSTRAP_LIFETIME_MILLIS = 60_000;
+/**
+ * Failed bootstrap exchanges before the exchange closes, until a new code is minted.
+ *
+ * The code is high-entropy, so this is not what makes guessing hard — it is what stops a process
+ * that is being guessed at from staying open all afternoon.
+ */
+const MAX_BOOTSTRAP_FAILURES = 5;
+/** Methods that only read. They need the session, but no origin and no CSRF token. */
+const safeMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+const fetchSites = new Set(["cross-site", "none", "same-origin", "same-site"]);
+/**
+ * The one origin other than the bound server that may be advertised: the Vite dev server that
+ * proxies the API and the bootstrap exchange.
+ */
+export const devPublicOrigin = "http://localhost:5173";
+/** The session cookie or bootstrap code is missing, wrong, spent, or expired. Maps to 401. */
+export class OwnerSessionUnauthorizedError extends Schema.TaggedError()("OwnerSessionUnauthorizedError", { message: Schema.String }) {
+}
+/** The credential is right but the request did not come from the owner's page. Maps to 403. */
+export class OwnerSessionForbiddenError extends Schema.TaggedError()("OwnerSessionForbiddenError", { message: Schema.String }) {
+}
+/** A hostname or origin is not a plain HTTP loopback address. */
+export class UnsafeLoopbackAddressError extends Schema.TaggedError()("UnsafeLoopbackAddressError", { address: Schema.String, message: Schema.String }) {
+}
+/** Hostnames a loopback web app may bind. */
+export const LoopbackHostname = Schema.Literals(["127.0.0.1", "localhost", "::1"]);
+/** Whether a URL hostname (which brackets IPv6) names the loopback interface. */
+export const isLoopbackHostname = (hostname) => hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+/** Refuse to bind anything a peer on the network could reach. */
+export const requireLoopbackHostname = (hostname) => Schema.decodeUnknownEffect(LoopbackHostname)(hostname).pipe(Effect.mapError(() => new UnsafeLoopbackAddressError({ address: hostname, message: "Server may only listen on a loopback hostname" })));
+/** The HTTP origin for a bound loopback server, without a trailing slash. */
+export const loopbackOrigin = (hostname, port) => `http://${hostname === "::1" ? "[::1]" : hostname}:${port}`;
+/** Validate an origin as plain HTTP on loopback with no path, query, or fragment. */
+export const requireLoopbackOrigin = Effect.fn("OwnerSession.requireLoopbackOrigin")(function* (origin) {
+    const url = yield* Effect.try({
+        try: () => new URL(origin),
+        catch: () => new UnsafeLoopbackAddressError({ address: origin, message: "Not a valid HTTP origin" })
+    });
+    if (url.protocol !== "http:" ||
+        !isLoopbackHostname(url.hostname) ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "") {
+        return yield* new UnsafeLoopbackAddressError({
+            address: origin,
+            message: "Origin must be HTTP on a loopback host, without a path, query, or fragment"
+        });
+    }
+    return url.origin;
+});
+/** The origin to advertise: the bound server, or the dev server that proxies to it. */
+export const resolvePublicOrigin = Effect.fn("OwnerSession.resolvePublicOrigin")(function* (configuredOrigin, authorityOrigin) {
+    const authority = yield* requireLoopbackOrigin(authorityOrigin);
+    if (configuredOrigin === undefined)
+        return authority;
+    const configured = yield* requireLoopbackOrigin(configuredOrigin);
+    if (configured !== authority && configured !== devPublicOrigin) {
+        return yield* new UnsafeLoopbackAddressError({
+            address: configuredOrigin,
+            message: "Public origin must be the bound server or its dev proxy"
+        });
+    }
+    return configured;
+});
+/**
+ * The URL to open. The code rides in the fragment, which browsers do not send to servers and
+ * proxies do not log; the page strips it from the address bar once it has been spent.
+ */
+export const bootstrapUrl = (origin, code) => `${origin.replace(/\/+$/u, "")}/#bootstrap_token=${encodeURIComponent(Redacted.value(code))}`;
+export class OwnerSession extends Context.Service()("@knpkv/browser-pairing/OwnerSession") {
+}
+const isCredentialCookieError = Schema.is(CredentialCookieError);
+const bearerToken = (authorization) => authorization !== undefined && authorization.startsWith("Bearer ")
+    ? authorization.slice("Bearer ".length)
+    : undefined;
+const requestFromHttp = (request, credential) => ({
+    credential,
+    csrfToken: request.headers["x-csrf-token"],
+    fetchSite: request.headers["sec-fetch-site"],
+    method: request.method,
+    origin: request.headers.origin
+});
+const makeService = (options, ownerToken, sessionCookie, writes, cryptoService, bootstrap, attempts) => {
+    const { browserOrigin, product } = options;
+    const unauthorized = (message) => new OwnerSessionUnauthorizedError({ message });
+    const forbidden = (message) => new OwnerSessionForbiddenError({ message });
+    const authorizeRequest = Effect.fn("OwnerSession.authorizeRequest")(function* (request) {
+        if (credentialValuesEqual(request.credential, Redacted.value(ownerToken)) !== true) {
+            return yield* unauthorized("Missing or invalid owner session");
+        }
+        const sameOrigin = request.origin !== undefined && request.origin === browserOrigin;
+        if (request.origin !== undefined && !sameOrigin) {
+            return yield* forbidden(`Request origin does not match this ${product} server`);
+        }
+        if (request.fetchSite !== undefined && !fetchSites.has(request.fetchSite)) {
+            return yield* forbidden("Request carries invalid browser site metadata");
+        }
+        if (request.fetchSite === "cross-site" ||
+            (!sameOrigin && (request.fetchSite === "same-site" || request.fetchSite === "none"))) {
+            return yield* forbidden(`Browser request is not from this ${product} page`);
+        }
+        // An explicit client such as curl carries neither Origin nor Fetch Metadata and remains allowed:
+        // it still has to present the process-scoped session cookie. Browser-marked cross-origin reads
+        // are rejected before their handler can start work.
+        if (safeMethods.has(request.method.toUpperCase()))
+            return;
+        if (writes._tag === "ReadOnly")
+            return yield* forbidden("This server only answers reads");
+        if (!sameOrigin)
+            return yield* forbidden(`Mutation origin does not match this ${product} server`);
+        const csrfMatches = request.csrfToken !== undefined &&
+            credentialValuesEqual(request.csrfToken, Redacted.value(writes.token)) === true;
+        if (!csrfMatches)
+            return yield* forbidden("Missing or invalid CSRF token");
+    });
+    const authorizeBootstrap = Effect.fn("OwnerSession.authorizeBootstrap")(function* (request) {
+        if (request.origin !== browserOrigin) {
+            return yield* forbidden(`Bootstrap origin does not match this ${product} server`);
+        }
+        const supplied = bearerToken(request.authorization);
+        const current = yield* Ref.get(bootstrap);
+        // Counted before the code is even compared, so a burst of parallel guesses cannot all pass the
+        // check together and then be counted afterwards.
+        const admit = Ref.modify(attempts, (state) => {
+            if (state.failedAttempts + state.inFlight >= MAX_BOOTSTRAP_FAILURES)
+                return ["unavailable", state];
+            const matches = supplied !== undefined && current !== undefined &&
+                credentialValuesEqual(supplied, Redacted.value(current.token)) === true;
+            if (!matches) {
+                return ["invalid", {
+                        failedAttempts: Math.min(MAX_BOOTSTRAP_FAILURES, state.failedAttempts + 1),
+                        inFlight: state.inFlight
+                    }];
+            }
+            return ["accepted", { ...state, inFlight: state.inFlight + 1 }];
+        }).pipe(Effect.flatMap((admission) => admission === "unavailable"
+            ? Effect.fail(unauthorized("Bootstrap is closed until a new code is minted"))
+            : admission === "invalid"
+                ? Effect.fail(unauthorized("Missing or invalid bootstrap token"))
+                : Effect.void));
+        return yield* Effect.acquireUseRelease(admit, () => Effect.gen(function* () {
+            const now = yield* Clock.currentTimeMillis;
+            // Spent only if it is still the code that was compared: a newer mint replaced it otherwise.
+            const decision = yield* Ref.modify(bootstrap, (code) => {
+                if (code === undefined || current === undefined || code.token !== current.token) {
+                    return ["consumed", code];
+                }
+                const next = decideOneTimeCredential({ consumedAt: code.available ? null : 0, expiresAt: code.expiresAt, revokedAt: null }, now);
+                return [next, next === "accepted" ? { ...code, available: false } : code];
+            });
+            if (decision === "accepted")
+                return;
+            return yield* unauthorized(decision === "expired"
+                ? `Bootstrap token has expired — ${options.freshUrlHint}`
+                : decision === "consumed"
+                    ? "Bootstrap token has already been used"
+                    : "Bootstrap token state is invalid");
+        }), () => Ref.update(attempts, (state) => ({ ...state, inFlight: Math.max(0, state.inFlight - 1) })));
+    });
+    const mintBootstrapCode = Effect.gen(function* () {
+        const token = yield* issuePairingCode();
+        const now = yield* Clock.currentTimeMillis;
+        const until = yield* expiresAt(now, BOOTSTRAP_LIFETIME_MILLIS);
+        yield* Ref.set(bootstrap, { token, expiresAt: until, available: true });
+        yield* Ref.set(attempts, { failedAttempts: 0, inFlight: 0 });
+        return token;
+    }).pipe(Effect.provideService(Crypto.Crypto, cryptoService), Effect.withSpan("OwnerSession.mintBootstrapCode"));
+    return {
+        authorityOrigin: options.authorityOrigin,
+        authorizeBootstrap,
+        authorizeHttp: (credential) => Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => authorizeRequest(requestFromHttp(request, credential))),
+        authorizeRequest,
+        browserOrigin,
+        cookieName: options.cookieName,
+        mintBootstrapCode,
+        sessionCookie,
+        writes
+    };
+};
+/**
+ * Build an owner session with fresh tokens. No bootstrap code exists until
+ * {@link OwnerSessionService.mintBootstrapCode} runs.
+ */
+export const make = Effect.fn("OwnerSession.make")(function* (options) {
+    const authorityOrigin = yield* requireLoopbackOrigin(options.authorityOrigin);
+    const browserOrigin = yield* requireLoopbackOrigin(options.browserOrigin);
+    const cryptoService = yield* Crypto.Crypto;
+    const ownerToken = yield* issueSessionToken();
+    const writes = options.writes === "csrf"
+        ? { _tag: "Csrf", token: yield* issueCsrfToken() }
+        : { _tag: "ReadOnly" };
+    // A cookie name is caller configuration: an invalid one fails typed. Anything else the serializer
+    // throws is a bug and stays a defect.
+    const sessionCookie = yield* Effect.sync(() => serializeCredentialCookie(ownerToken, {
+        httpOnly: true,
+        name: options.cookieName,
+        path: "/api",
+        sameSite: "strict",
+        secure: false
+    })).pipe(Effect.catchDefect((defect) => isCredentialCookieError(defect) ? Effect.fail(defect) : Effect.die(defect)));
+    return OwnerSession.of(makeService({ ...options, authorityOrigin, browserOrigin }, ownerToken, sessionCookie, writes, cryptoService, yield* Ref.make(undefined), yield* Ref.make({ failedAttempts: 0, inFlight: 0 })));
+});
+export const layer = (options) => Layer.effect(OwnerSession, make(options));
+/**
+ * The one route outside the authenticated API: `POST /auth/bootstrap` spends a code for the session
+ * cookie, answering `{ csrfToken }` when writes are allowed and `{}` otherwise.
+ */
+export const BootstrapRouter = HttpRouter.use((router) => Effect.gen(function* () {
+    const session = yield* OwnerSession;
+    yield* router.add("POST", "/auth/bootstrap", Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        const result = yield* Effect.result(session.authorizeBootstrap({ authorization: request.headers.authorization, origin: request.headers.origin }));
+        if (result._tag === "Failure") {
+            return HttpServerResponse.text(result.failure.message, {
+                status: result.failure._tag === "OwnerSessionUnauthorizedError" ? 401 : 403
+            });
+        }
+        const body = session.writes._tag === "Csrf" ? { csrfToken: Redacted.value(session.writes.token) } : {};
+        return yield* HttpServerResponse.json(body, {
+            headers: { "cache-control": "no-store", "set-cookie": session.sessionCookie },
+            status: 200
+        });
+    }));
+}));
+//# sourceMappingURL=owner-session.js.map

package/dist/owner-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-session.js","sourceRoot":"","sources":["../src/owner-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGnH,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAEvG,kGAAkG;AAClG,MAAM,yBAAyB,GAAG,MAAM,CAAA;AAExC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAEhC,sFAAsF;AACtF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAA;AAEtD,8FAA8F;AAC9F,MAAM,OAAO,6BAA8B,SAAQ,MAAM,CAAC,WAAW,EAAiC,CACpG,+BAA+B,EAC/B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG;AAEJ,+FAA+F;AAC/F,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3B;CAAG;AAEJ,iEAAiE;AACjE,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,WAAW,EAA8B,CAC9F,4BAA4B,EAC5B,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CACnD;CAAG;AAEJ,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAGlF,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAC9D,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,CAAA;AAEpG,iEAAiE;AACjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC1D,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CACnB,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAChH,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAU,EAAE,CACvE,UAAU,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAA;AAE7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAClF,QAAQ,CAAC,EAAC,MAAc;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC5B,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;KACrG,CAAC,CAAA;IACF,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE,EACf,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,4EAA4E;SACtF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACnB,CAAC,CACF,CAAA;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAC9E,QAAQ,CAAC,EAAC,gBAAoC,EAAE,eAAuB;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC/D,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAA;IACjE,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC;YAC3C,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,yDAAyD;SACnE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CACF,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,IAAoC,EAAU,EAAE,CAC3F,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;AAqE/F,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,OAAO,EAAqC,CACpF,qCAAqC,CACtC;CAAG;AAgBJ,MAAM,uBAAuB,GAAG,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAA;AAEhE,MAAM,WAAW,GAAG,CAAC,aAAiC,EAAsB,EAAE,CAC5E,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;IAChE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;IACvC,CAAC,CAAC,SAAS,CAAA;AAEf,MAAM,eAAe,GAAG,CAAC,OAA4C,EAAE,UAAkB,EAAgB,EAAE,CAAC,CAAC;IAC3G,UAAU;IACV,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;IAC1C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;IACtB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;CAC/B,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAClB,OAA4B,EAC5B,UAA2C,EAC3C,aAAqB,EACrB,MAAmB,EACnB,aAA4B,EAC5B,SAA6C,EAC7C,QAA+B,EACV,EAAE;IACvB,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC1C,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,6BAA6B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,0BAA0B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAElF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAqB;QACjG,IAAI,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC,kCAAkC,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAA;QACnF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,OAAO,SAAS,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,+CAA+C,CAAC,CAAA;QAC1E,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,YAAY;YAClC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,EACpF,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,OAAO,OAAO,CAAC,CAAA;QAC7E,CAAC;QACD,iGAAiG;QACjG,+FAA+F;QAC/F,oDAAoD;QACpD,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAAE,OAAM;QACzD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAA;QACzF,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,OAAO,SAAS,CAAC,CAAA;QACjG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS;YACjD,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAA;QACjF,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,MAAM,kBAAkB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAAC,OAAyB;QACzG,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,CAAC,SAAS,CAAC,wCAAwC,OAAO,SAAS,CAAC,CAAA;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzC,+FAA+F;QAC/F,iDAAiD;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAsC,EAAE;YAC/E,IAAI,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB;gBAAE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;YAClG,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;gBAC7D,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAA;YACzE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,SAAS,EAAE;wBACjB,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC;wBAC1E,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,CAAA;QACjE,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3B,SAAS,KAAK,aAAa;YACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,gDAAgD,CAAC,CAAC;YAC7E,CAAC,CAAC,SAAS,KAAK,SAAS;gBACzB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC;gBACjE,CAAC,CAAC,MAAM,CAAC,IAAI,CAChB,CACF,CAAA;QACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,iBAAiB,CACpC,KAAK,EACL,GAAG,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;YAC1C,4FAA4F;YAC5F,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAChC,SAAS,EACT,CAAC,IAAI,EAAmE,EAAE;gBACxE,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBAChF,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBAC3B,CAAC;gBACD,MAAM,IAAI,GAAG,uBAAuB,CAClC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EACrF,GAAG,CACJ,CAAA;gBACD,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC3E,CAAC,CACF,CAAA;YACD,IAAI,QAAQ,KAAK,UAAU;gBAAE,OAAM;YACnC,OAAO,KAAK,CAAC,CAAC,YAAY,CACxB,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,iCAAiC,OAAO,CAAC,YAAY,EAAE;gBACzD,CAAC,CAAC,QAAQ,KAAK,UAAU;oBACzB,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,kCAAkC,CACvC,CAAA;QACH,CAAC,CAAC,EACJ,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CACjG,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,gBAAgB,EAAE,CAAA;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAA;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;QAC9D,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAC,CAAA;IAE/G,OAAO;QACL,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,kBAAkB;QAClB,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE,CAC5B,MAAM,CAAC,OAAO,CACZ,iBAAiB,CAAC,iBAAiB,EACnC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CACpE;QACH,gBAAgB;QAChB,aAAa;QACb,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,iBAAiB;QACjB,aAAa;QACb,MAAM;KACP,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAC,OAA4B;IACvF,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC7E,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACzE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAA;IAC7C,MAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,KAAK,MAAM;QACnD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,cAAc,EAAE,EAAE;QAClD,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IACxB,kGAAkG;IAClG,sCAAsC;IACtC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAC5C,yBAAyB,CAAC,UAAU,EAAE;QACpC,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAClH,OAAO,YAAY,CAAC,EAAE,CAAC,WAAW,CAChC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,EAC9C,UAAU,EACV,aAAa,EACb,MAAM,EACN,aAAa,EACb,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAA4B,SAAS,CAAC,EACrD,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAe,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAClE,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAEhG;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACnC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACf,MAAM,EACN,iBAAiB,EACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAA;QAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CACjC,OAAO,CAAC,kBAAkB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAC7G,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;gBACrD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,+BAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;aAC5E,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACtG,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE;YAC1C,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE;YAC7E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAC,CACH,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knpkv/browser-pairing",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Typed browser pairing credentials and transport primitives",
   "license": "MIT",
   "repository": {
@@ -20,6 +20,10 @@
     "./schema": {
       "types": "./dist/schema.d.ts",
       "import": "./dist/schema.js"
+    },
+    "./owner-session": {
+      "types": "./dist/owner-session.d.ts",
+      "import": "./dist/owner-session.js"
     }
   },
   "files": [