@knpkv/browser-pairing 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 knpkv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,12 @@
+# @knpkv/browser-pairing
+
+Typed, redacted browser-pairing credentials and transport primitives. Product
+packages keep their own persistence, authorization, and route policy.
+
+`PairingCode`, `SessionToken`, and `CsrfToken` are distinct branded roles over
+the same validated credential encoding. Consumers must issue and decode the
+role they need; the generic `BrowserCredential` is only a pre-role transport
+value.
+
+Typed cookie serialization accepts only a redacted `SessionToken`; JavaScript
+callers still reach the runtime credential and attribute validation boundary.

package/dist/crypto.d.ts

@@ -0,0 +1,28 @@
+import { Crypto, Effect, Redacted, Schema } from "effect";
+import { CredentialDigest } from "./schema.js";
+declare const BrowserPairingError_base: Schema.Class<BrowserPairingError, Schema.TaggedStruct<"BrowserPairingError", {
+    readonly reason: Schema.Literals<readonly ["credential-rejected", "crypto-failed", "invalid-lifetime"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Shared failure class; applications map it to their local HTTP/domain errors. */
+export declare class BrowserPairingError extends BrowserPairingError_base {
+}
+/** Produce a fresh generic browser credential using the caller's platform crypto service. */
+export declare const issueCredential: () => Effect.Effect<Redacted.Redacted<string & import("effect/Brand").Brand<"BrowserCredential">>, BrowserPairingError, Crypto.Crypto>;
+/** Produce a pairing credential while preserving its role brand. */
+export declare const issuePairingCode: () => Effect.Effect<Redacted.Redacted<string & import("effect/Brand").Brand<"PairingCode">>, BrowserPairingError, Crypto.Crypto>;
+/** Produce a session credential while preserving its role brand. */
+export declare const issueSessionToken: () => Effect.Effect<Redacted.Redacted<string & import("effect/Brand").Brand<"SessionToken">>, BrowserPairingError, Crypto.Crypto>;
+/** Produce a CSRF credential while preserving its role brand. */
+export declare const issueCsrfToken: () => Effect.Effect<Redacted.Redacted<string & import("effect/Brand").Brand<"CsrfToken">>, BrowserPairingError, Crypto.Crypto>;
+/** Hash a credential for durable persistence without retaining its plaintext. */
+export declare const hashCredential: (credential: Redacted.Redacted<string>) => Effect.Effect<string & import("effect/Brand").Brand<"CredentialDigest">, BrowserPairingError, Crypto.Crypto>;
+/** Verify a supplied credential against a stored digest in constant time. */
+export declare const verifyCredentialDigest: (credential: Redacted.Redacted<string>, expectedDigest: string) => Effect.Effect<undefined, BrowserPairingError, Crypto.Crypto>;
+/** Compare validated digests without an early-exit string comparison. */
+export declare const credentialDigestsEqual: (left: CredentialDigest, right: CredentialDigest) => boolean;
+/** Compare two untrusted credential strings without exposing length or content. */
+export declare const credentialValuesEqual: (left: string, right: string) => boolean;
+/** Validate and calculate a bounded expiry at the edge of an issuance operation. */
+export declare const expiresAt: (now: number, lifetimeMs: number) => Effect.Effect<number, BrowserPairingError, never>;
+export {};
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEjE,OAAO,EAAqB,gBAAgB,EAAwC,MAAM,aAAa,CAAA;;;;AAIvG,mFAAmF;AACnF,qBAAa,mBAAoB,SAAQ,wBAEvC;CAAG;AAgBL,6FAA6F;AAC7F,eAAO,MAAM,eAAe,wIAE1B,CAAA;AAEF,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,kIAE3B,CAAA;AAEF,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,mIAE5B,CAAA;AAEF,iEAAiE;AACjE,eAAO,MAAM,cAAc,gIAEzB,CAAA;AAEF,iFAAiF;AACjF,eAAO,MAAM,cAAc,yJAczB,CAAA;AAWF,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,iIAiBjC,CAAA;AAEF,yEAAyE;AACzE,eAAO,MAAM,sBAAsB,SAAU,gBAAgB,SAAS,gBAAgB,KAAG,OAKxF,CAAA;AAED,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,SAAU,MAAM,SAAS,MAAM,KAAG,OAQnE,CAAA;AAED,oFAAoF;AACpF,eAAO,MAAM,SAAS,wFAOpB,CAAA"}

package/dist/crypto.js

@@ -0,0 +1,86 @@
+import { Crypto, Effect, Redacted, Result, Schema } from "effect";
+import { Hex } from "effect/encoding";
+import { BrowserCredential, CredentialDigest, CsrfToken, PairingCode, SessionToken } from "./schema.js";
+const CREDENTIAL_BYTES = 32;
+/** Shared failure class; applications map it to their local HTTP/domain errors. */
+export class BrowserPairingError extends Schema.TaggedError()("BrowserPairingError", {
+    reason: Schema.Literals(["credential-rejected", "crypto-failed", "invalid-lifetime"])
+}) {
+}
+const issueCredentialFor = (decode) => Effect.gen(function* () {
+    const cryptoService = yield* Crypto.Crypto;
+    const bytes = yield* cryptoService.randomBytes(CREDENTIAL_BYTES).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "crypto-failed" })));
+    const decoded = yield* decode(Hex.encode(bytes)).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "crypto-failed" })));
+    return Redacted.make(decoded);
+});
+/** Produce a fresh generic browser credential using the caller's platform crypto service. */
+export const issueCredential = Effect.fn("BrowserPairing.issueCredential")(function* () {
+    return yield* issueCredentialFor(Schema.decodeUnknownEffect(BrowserCredential));
+});
+/** Produce a pairing credential while preserving its role brand. */
+export const issuePairingCode = Effect.fn("BrowserPairing.issuePairingCode")(function* () {
+    return yield* issueCredentialFor(Schema.decodeUnknownEffect(PairingCode));
+});
+/** Produce a session credential while preserving its role brand. */
+export const issueSessionToken = Effect.fn("BrowserPairing.issueSessionToken")(function* () {
+    return yield* issueCredentialFor(Schema.decodeUnknownEffect(SessionToken));
+});
+/** Produce a CSRF credential while preserving its role brand. */
+export const issueCsrfToken = Effect.fn("BrowserPairing.issueCsrfToken")(function* () {
+    return yield* issueCredentialFor(Schema.decodeUnknownEffect(CsrfToken));
+});
+/** Hash a credential for durable persistence without retaining its plaintext. */
+export const hashCredential = Effect.fn("BrowserPairing.hashCredential")(function* (credential) {
+    const decoded = yield* Schema.decodeUnknownEffect(BrowserCredential)(Redacted.value(credential)).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "credential-rejected" })));
+    const bytes = yield* Effect.fromResult(Hex.decode(decoded)).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "credential-rejected" })));
+    const cryptoService = yield* Crypto.Crypto;
+    const digest = yield* cryptoService.digest("SHA-256", bytes).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "crypto-failed" })));
+    return CredentialDigest.make(Hex.encode(digest));
+});
+const fixedTimeEqual = (left, right) => {
+    let difference = left.byteLength ^ right.byteLength;
+    const length = Math.max(left.byteLength, right.byteLength);
+    for (let index = 0; index < length; index += 1) {
+        difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+    }
+    return difference === 0;
+};
+/** Verify a supplied credential against a stored digest in constant time. */
+export const verifyCredentialDigest = Effect.fn("BrowserPairing.verifyCredentialDigest")(function* (credential, expectedDigest) {
+    const expected = yield* Schema.decodeUnknownEffect(CredentialDigest)(expectedDigest).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "credential-rejected" })));
+    const actual = yield* hashCredential(credential);
+    const actualBytes = yield* Effect.fromResult(Hex.decode(actual)).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "credential-rejected" })));
+    const expectedBytes = yield* Effect.fromResult(Hex.decode(expected)).pipe(Effect.mapError(() => new BrowserPairingError({ reason: "credential-rejected" })));
+    if (!fixedTimeEqual(actualBytes, expectedBytes)) {
+        return yield* new BrowserPairingError({ reason: "credential-rejected" });
+    }
+});
+/** Compare validated digests without an early-exit string comparison. */
+export const credentialDigestsEqual = (left, right) => {
+    const leftBytes = Hex.decode(left);
+    const rightBytes = Hex.decode(right);
+    return Result.isSuccess(leftBytes) && Result.isSuccess(rightBytes) &&
+        fixedTimeEqual(leftBytes.success, rightBytes.success);
+};
+/** Compare two untrusted credential strings without exposing length or content. */
+export const credentialValuesEqual = (left, right) => {
+    const decodedLeft = Schema.decodeUnknownResult(BrowserCredential)(left);
+    const decodedRight = Schema.decodeUnknownResult(BrowserCredential)(right);
+    if (Result.isFailure(decodedLeft) || Result.isFailure(decodedRight))
+        return false;
+    const leftBytes = Hex.decode(decodedLeft.success);
+    const rightBytes = Hex.decode(decodedRight.success);
+    return Result.isSuccess(leftBytes) && Result.isSuccess(rightBytes) &&
+        fixedTimeEqual(leftBytes.success, rightBytes.success);
+};
+/** Validate and calculate a bounded expiry at the edge of an issuance operation. */
+export const expiresAt = Effect.fn("BrowserPairing.expiresAt")(function* (now, lifetimeMs) {
+    if (!Number.isSafeInteger(now) || !Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0) {
+        return yield* new BrowserPairingError({ reason: "invalid-lifetime" });
+    }
+    const expiry = now + lifetimeMs;
+    if (!Number.isSafeInteger(expiry))
+        return yield* new BrowserPairingError({ reason: "invalid-lifetime" });
+    return expiry;
+});
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAEvG,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAE3B,mFAAmF;AACnF,MAAM,OAAO,mBAAoB,SAAQ,MAAM,CAAC,WAAW,EAAuB,CAAC,qBAAqB,EAAE;IACxG,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;CACtF,CAAC;CAAG;AAEL,MAAM,kBAAkB,GAAG,CACzB,MAA+E,EAC/E,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAC5E,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAC5E,CAAA;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC,CAAC,CAAA;AAEJ,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC;IAClF,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAA;AACjF,CAAC,CAAC,CAAA;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC3E,CAAC,CAAC,CAAA;AAEF,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC;IACtF,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAA;AAC5E,CAAC,CAAC,CAAA;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC;IAChF,OAAO,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAA;AACzE,CAAC,CAAC,CAAA;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,QAAQ,CAAC,EAChF,UAAqC;IAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CACnG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,CAC5E,CAAA;IACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE;IACtE,IAAI,UAAU,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAA;AACzB,CAAC,CAAA;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,QAAQ,CAAC,EAChG,UAAqC,EACrC,cAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CACvF,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACvE,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAClF,CAAA;IACD,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAsB,EAAE,KAAuB,EAAW,EAAE;IACjG,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpC,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAChE,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAA;IACzE,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA;IACjF,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IACnD,OAAO,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAChE,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;AACzD,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,EAAC,GAAW,EAAE,UAAkB;IACtG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,GAAG,UAAU,CAAA;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAA;IACxG,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./crypto.js";
+export * from "./schema.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from "./crypto.js";
+export * from "./schema.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA"}

package/dist/schema.d.ts

@@ -0,0 +1,75 @@
+import { Redacted, Schema } from "effect";
+/** A 256-bit browser credential. Keep values redacted except at a transport boundary. */
+export declare const BrowserCredential: Schema.brand<Schema.String, "BrowserCredential">;
+export type BrowserCredential = typeof BrowserCredential.Type;
+/** Pairing code accepted by an unauthenticated confirmation route. */
+export declare const PairingCode: Schema.brand<Schema.String, "PairingCode">;
+export type PairingCode = typeof PairingCode.Type;
+/** Opaque session credential normally delivered through an HttpOnly cookie. */
+export declare const SessionToken: Schema.brand<Schema.String, "SessionToken">;
+export type SessionToken = typeof SessionToken.Type;
+/** Independent mutation proof sent in a request header. */
+export declare const CsrfToken: Schema.brand<Schema.String, "CsrfToken">;
+export type CsrfToken = typeof CsrfToken.Type;
+/** SHA-256 digest persisted instead of a browser credential. */
+export declare const CredentialDigest: Schema.brand<Schema.String, "CredentialDigest">;
+export type CredentialDigest = typeof CredentialDigest.Type;
+/** Credential-bearing confirmation payload containing the one-time pairing proof. */
+export declare const PairingConfirmationRequest: Schema.Struct<{
+    readonly pairingCode: Schema.brand<Schema.String, "PairingCode">;
+}>;
+export type PairingConfirmationRequest = typeof PairingConfirmationRequest.Type;
+/** Credential-bearing response containing the CSRF mutation proof. */
+export declare const PairingConfirmationResponse: Schema.Struct<{
+    readonly csrfToken: Schema.brand<Schema.String, "CsrfToken">;
+}>;
+export type PairingConfirmationResponse = typeof PairingConfirmationResponse.Type;
+export declare const OneTimeCredentialState: Schema.Struct<{
+    readonly expiresAt: Schema.Number;
+    readonly consumedAt: Schema.NullOr<Schema.Number>;
+    readonly revokedAt: Schema.NullOr<Schema.Number>;
+}>;
+export type OneTimeCredentialState = typeof OneTimeCredentialState.Type;
+export type OneTimeCredentialDecision = "accepted" | "expired" | "consumed" | "revoked" | "invalid";
+/** Expiry is inclusive: a credential at its deadline is no longer usable. */
+export declare const isExpired: (now: number, expiry: number) => boolean;
+/** Pure state transition guard reusable by durable and in-memory stores. */
+export declare const decideOneTimeCredential: (state: OneTimeCredentialState, now: number) => OneTimeCredentialDecision;
+declare const CredentialCookieError_base: Schema.Class<CredentialCookieError, Schema.TaggedStruct<"CredentialCookieError", {
+    readonly reason: Schema.Literals<readonly ["invalid-credential", "invalid-attribute", "invalid-max-age"]>;
+}>, import("effect/Cause").YieldableError>;
+/** A cookie value or attribute contained a delimiter, control character, or invalid credential. */
+export declare class CredentialCookieError extends CredentialCookieError_base {
+}
+interface CredentialCookieOptionsBase {
+    readonly name: string;
+    readonly path: string;
+    readonly httpOnly: boolean;
+    readonly sameSite: "strict" | "lax" | "none";
+    readonly maxAge?: number;
+}
+/** Cookie policy with an origin required whenever the Secure attribute is enabled. */
+export type CredentialCookieOptions = (CredentialCookieOptionsBase & {
+    readonly secure: true;
+    readonly sourceOrigin: string;
+}) | (CredentialCookieOptionsBase & {
+    readonly secure: false;
+    readonly sourceOrigin?: string;
+});
+/** Serialize a validated credential cookie without allowing header injection or invalid lifetimes. */
+export declare const serializeCredentialCookie: (credential: Redacted.Redacted<SessionToken>, options: CredentialCookieOptions) => string;
+/** A credential-bearing bootstrap result; the present token remains redacted until transport. */
+export type BootstrapTokenRead = {
+    readonly _tag: "missing";
+} | {
+    readonly _tag: "malformed";
+} | {
+    readonly _tag: "present";
+    readonly token: Redacted.Redacted<PairingCode>;
+};
+/** Read a bootstrap token without silently accepting malformed URL fragments. */
+export declare const readBootstrapToken: (hash: string) => BootstrapTokenRead;
+/** Remove a bootstrap fragment while retaining the current route and query. */
+export declare const bootstrapRouteWithoutToken: (pathname: string, search: string) => string;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAA;AAQjD,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,kDAA0D,CAAA;AAExF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,sEAAsE;AACtE,eAAO,MAAM,WAAW,4CAAoD,CAAA;AAC5E,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;AAEjD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,6CAAqD,CAAA;AAC9E,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,2DAA2D;AAC3D,eAAO,MAAM,SAAS,0CAAkD,CAAA;AACxE,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,iDAEW,CAAA;AAExC,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,qFAAqF;AACrF,eAAO,MAAM,0BAA0B;;EAA8C,CAAA;AACrF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,sEAAsE;AACtE,eAAO,MAAM,2BAA2B;;EAA0C,CAAA;AAClF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,eAAO,MAAM,sBAAsB;;;;EAIjC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAA;AAEnG,6EAA6E;AAC7E,eAAO,MAAM,SAAS,QAAS,MAAM,UAAU,MAAM,KAAG,OACsB,CAAA;AAE9E,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,UAC3B,sBAAsB,OACxB,MAAM,KACV,yBAWF,CAAA;;;;AAED,mGAAmG;AACnG,qBAAa,qBAAsB,SAAQ,0BAG1C;CAAG;AAEJ,UAAU,2BAA2B;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,sFAAsF;AACtF,MAAM,MAAM,uBAAuB,GAC/B,CAAC,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B,CAAC,GACA,CAAC,2BAA2B,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B,CAAC,CAAA;AAwCJ,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,EAAE,CACtC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC3C,OAAO,EAAE,uBAAuB,KAC7B,MAmEJ,CAAA;AAED,iGAAiG;AACjG,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;CAAE,CAAA;AAEhF,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,kBAOjD,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,aAAc,MAAM,UAAU,MAAM,KAAG,MAAgC,CAAA"}

package/dist/schema.js

@@ -0,0 +1,158 @@
+import { Redacted, Result, Schema } from "effect";
+const CREDENTIAL_PATTERN = /^[0-9a-f]{64}$/u;
+const COOKIE_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u;
+const CredentialValue = Schema.String.check(Schema.isPattern(CREDENTIAL_PATTERN, { expected: "a lowercase 256-bit browser credential" }));
+/** A 256-bit browser credential. Keep values redacted except at a transport boundary. */
+export const BrowserCredential = CredentialValue.pipe(Schema.brand("BrowserCredential"));
+/** Pairing code accepted by an unauthenticated confirmation route. */
+export const PairingCode = CredentialValue.pipe(Schema.brand("PairingCode"));
+/** Opaque session credential normally delivered through an HttpOnly cookie. */
+export const SessionToken = CredentialValue.pipe(Schema.brand("SessionToken"));
+/** Independent mutation proof sent in a request header. */
+export const CsrfToken = CredentialValue.pipe(Schema.brand("CsrfToken"));
+/** SHA-256 digest persisted instead of a browser credential. */
+export const CredentialDigest = Schema.String.check(Schema.isPattern(CREDENTIAL_PATTERN, { expected: "a lowercase SHA-256 credential digest" })).pipe(Schema.brand("CredentialDigest"));
+/** Credential-bearing confirmation payload containing the one-time pairing proof. */
+export const PairingConfirmationRequest = Schema.Struct({ pairingCode: PairingCode });
+/** Credential-bearing response containing the CSRF mutation proof. */
+export const PairingConfirmationResponse = Schema.Struct({ csrfToken: CsrfToken });
+export const OneTimeCredentialState = Schema.Struct({
+    expiresAt: Schema.Number.check(Schema.isInt()),
+    consumedAt: Schema.NullOr(Schema.Number.check(Schema.isInt())),
+    revokedAt: Schema.NullOr(Schema.Number.check(Schema.isInt()))
+});
+/** Expiry is inclusive: a credential at its deadline is no longer usable. */
+export const isExpired = (now, expiry) => !Number.isSafeInteger(now) || !Number.isSafeInteger(expiry) || now >= expiry;
+/** Pure state transition guard reusable by durable and in-memory stores. */
+export const decideOneTimeCredential = (state, now) => {
+    if (!Number.isSafeInteger(now) ||
+        !Number.isSafeInteger(state.expiresAt) ||
+        (state.consumedAt !== null && !Number.isSafeInteger(state.consumedAt)) ||
+        (state.revokedAt !== null && !Number.isSafeInteger(state.revokedAt)))
+        return "invalid";
+    if (state.revokedAt !== null)
+        return "revoked";
+    if (state.consumedAt !== null)
+        return "consumed";
+    if (isExpired(now, state.expiresAt))
+        return "expired";
+    return "accepted";
+};
+/** A cookie value or attribute contained a delimiter, control character, or invalid credential. */
+export class CredentialCookieError extends Schema.TaggedError()("CredentialCookieError", { reason: Schema.Literals(["invalid-credential", "invalid-attribute", "invalid-max-age"]) }) {
+}
+const CredentialCookieOptionsSchema = Schema.Union([
+    Schema.Struct({
+        name: Schema.String,
+        path: Schema.String,
+        httpOnly: Schema.Boolean,
+        sameSite: Schema.Literals(["strict", "lax", "none"]),
+        secure: Schema.Literal(true),
+        maxAge: Schema.optionalKey(Schema.Number),
+        sourceOrigin: Schema.String
+    }),
+    Schema.Struct({
+        name: Schema.String,
+        path: Schema.String,
+        httpOnly: Schema.Boolean,
+        sameSite: Schema.Literals(["strict", "lax", "none"]),
+        secure: Schema.Literal(false),
+        maxAge: Schema.optionalKey(Schema.Number),
+        sourceOrigin: Schema.optionalKey(Schema.String)
+    })
+]);
+const isLoopbackIpv4 = (hostname) => {
+    const octets = hostname.split(".");
+    return octets.length === 4 &&
+        octets[0] === "127" &&
+        octets.slice(1).every((octet) => /^\d{1,3}$/u.test(octet) && Number(octet) <= 255);
+};
+const isChromiumLocalhost = (hostname) => {
+    const normalized = hostname.toLowerCase();
+    return isLoopbackIpv4(normalized) ||
+        normalized === "[::1]" ||
+        normalized === "localhost" ||
+        normalized === "localhost." ||
+        normalized.endsWith(".localhost") ||
+        normalized.endsWith(".localhost.");
+};
+/** Serialize a validated credential cookie without allowing header injection or invalid lifetimes. */
+export const serializeCredentialCookie = (credential, options) => {
+    const value = Redacted.isRedacted(credential) ? Redacted.value(credential) : String(credential);
+    const decoded = Schema.decodeUnknownResult(BrowserCredential)(value);
+    if (Result.isFailure(decoded))
+        throw new CredentialCookieError({ reason: "invalid-credential" });
+    const decodedOptions = Schema.decodeUnknownResult(CredentialCookieOptionsSchema)(options);
+    if (Result.isFailure(decodedOptions))
+        throw new CredentialCookieError({ reason: "invalid-attribute" });
+    const validatedOptions = decodedOptions.success;
+    const invalidPath = (value) => value.length === 0 || Array.from(value).some((character) => {
+        const code = character.charCodeAt(0);
+        return !((code >= 0x20 && code <= 0x3a) || (code >= 0x3c && code <= 0x7e));
+    });
+    const normalizedName = validatedOptions.name.toLowerCase();
+    const hasRecognizedPrefix = normalizedName.startsWith("__host-http-") ||
+        normalizedName.startsWith("__http-") ||
+        normalizedName.startsWith("__host-") ||
+        normalizedName.startsWith("__secure-");
+    const sourceUrl = validatedOptions.sourceOrigin !== undefined && URL.canParse(validatedOptions.sourceOrigin)
+        ? new URL(validatedOptions.sourceOrigin)
+        : undefined;
+    const sourceOriginIsTrustworthy = sourceUrl !== undefined &&
+        (sourceUrl.protocol === "https:" ||
+            (sourceUrl.protocol === "http:" && isChromiumLocalhost(sourceUrl.hostname)));
+    const invalidSecureSource = validatedOptions.secure &&
+        (validatedOptions.sourceOrigin === undefined || !sourceOriginIsTrustworthy);
+    const invalidReservedPrefix = (normalizedName.startsWith("__host-http-") &&
+        (!validatedOptions.secure || !validatedOptions.httpOnly || validatedOptions.path !== "/")) ||
+        (normalizedName.startsWith("__http-") && (!validatedOptions.secure || !validatedOptions.httpOnly)) ||
+        (normalizedName.startsWith("__host-") && (!validatedOptions.secure || validatedOptions.path !== "/")) ||
+        (normalizedName.startsWith("__secure-") && !validatedOptions.secure) ||
+        (hasRecognizedPrefix && !sourceOriginIsTrustworthy);
+    if (!COOKIE_NAME_PATTERN.test(validatedOptions.name) ||
+        invalidPath(validatedOptions.path) ||
+        !validatedOptions.path.startsWith("/") ||
+        invalidReservedPrefix ||
+        invalidSecureSource ||
+        (validatedOptions.sourceOrigin !== undefined && sourceUrl === undefined)) {
+        throw new CredentialCookieError({ reason: "invalid-attribute" });
+    }
+    if (validatedOptions.maxAge !== undefined &&
+        (!Number.isSafeInteger(validatedOptions.maxAge) || validatedOptions.maxAge < 0)) {
+        throw new CredentialCookieError({ reason: "invalid-max-age" });
+    }
+    if (validatedOptions.sameSite === "none" && !validatedOptions.secure) {
+        throw new CredentialCookieError({ reason: "invalid-attribute" });
+    }
+    const sameSite = validatedOptions.sameSite === "strict"
+        ? "Strict"
+        : validatedOptions.sameSite === "lax"
+            ? "Lax"
+            : validatedOptions.sameSite === "none"
+                ? "None"
+                : undefined;
+    if (sameSite === undefined)
+        throw new CredentialCookieError({ reason: "invalid-attribute" });
+    const parts = [
+        `${validatedOptions.name}=${decoded.success}`,
+        ...(validatedOptions.httpOnly ? ["HttpOnly"] : []),
+        `Path=${validatedOptions.path}`,
+        `SameSite=${sameSite}`,
+        ...(validatedOptions.secure ? ["Secure"] : []),
+        ...(validatedOptions.maxAge === undefined ? [] : [`Max-Age=${String(validatedOptions.maxAge)}`])
+    ];
+    return parts.join("; ");
+};
+/** Read a bootstrap token without silently accepting malformed URL fragments. */
+export const readBootstrapToken = (hash) => {
+    const value = new URLSearchParams(hash.startsWith("#") ? hash.slice(1) : hash).get("bootstrap_token");
+    if (value === null)
+        return { _tag: "missing" };
+    const decoded = Schema.decodeUnknownResult(PairingCode)(value);
+    return Result.isSuccess(decoded)
+        ? { _tag: "present", token: Redacted.make(decoded.success) }
+        : { _tag: "malformed" };
+};
+/** Remove a bootstrap fragment while retaining the current route and query. */
+export const bootstrapRouteWithoutToken = (pathname, search) => `${pathname}${search}`;
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEjD,MAAM,kBAAkB,GAAG,iBAAiB,CAAA;AAC5C,MAAM,mBAAmB,GAAG,iCAAiC,CAAA;AAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACzC,MAAM,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,wCAAwC,EAAE,CAAC,CAC7F,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAA;AAIxF,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;AAG5E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;AAG9E,2DAA2D;AAC3D,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;AAGxE,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CACjD,MAAM,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,uCAAuC,EAAE,CAAC,CAC5F,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAIxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;AAGrF,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;AAGlF,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;CAC9D,CAAC,CAAA;AAMF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,MAAc,EAAW,EAAE,CAChE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,MAAM,CAAA;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,KAA6B,EAC7B,GAAW,EACgB,EAAE;IAC7B,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC;QAC1B,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QACtC,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpE,OAAO,SAAS,CAAA;IAClB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC9C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAA;IAChD,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACrD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,OAAO,qBAAsB,SAAQ,MAAM,CAAC,WAAW,EAAyB,CACpF,uBAAuB,EACvB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAC5F;CAAG;AAqBJ,MAAM,6BAA6B,GAAG,MAAM,CAAC,KAAK,CAAC;IACjD,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;QACzC,YAAY,EAAE,MAAM,CAAC,MAAM;KAC5B,CAAC;IACF,MAAM,CAAC,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;QACzC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;KAChD,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK;QACnB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAA;AACtF,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAW,EAAE;IACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACzC,OAAO,cAAc,CAAC,UAAU,CAAC;QAC/B,UAAU,KAAK,OAAO;QACtB,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,YAAY;QAC3B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAGxB,CAAC,UAA2C,EAAE,OAAgC,EAAU,EAAE;IACtG,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAChG,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,CAAA;IACzF,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;IACtG,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAA;IAC/C,MAAM,WAAW,GAAG,CAAC,KAAa,EAAW,EAAE,CAC7C,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACpC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IACJ,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC1D,MAAM,mBAAmB,GAAG,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;QACnE,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACpC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACpC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAC1G,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,yBAAyB,GAAG,SAAS,KAAK,SAAS;QACvD,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,MAAM;QACjD,CAAC,gBAAgB,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,CAAA;IAC7E,MAAM,qBAAqB,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;QACtE,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC1F,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClG,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,gBAAgB,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QACrG,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACpE,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACrD,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAChD,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAClC,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACtC,qBAAqB;QACrB,mBAAmB;QACnB,CAAC,gBAAgB,CAAC,YAAY,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC,EACxE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,IACE,gBAAgB,CAAC,MAAM,KAAK,SAAS;QACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,EAC/E,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;QACrD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,gBAAgB,CAAC,QAAQ,KAAK,KAAK;YACrC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,gBAAgB,CAAC,QAAQ,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG;QACZ,GAAG,gBAAgB,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE;QAC7C,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,gBAAgB,CAAC,IAAI,EAAE;QAC/B,YAAY,QAAQ,EAAE;QACtB,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,gBAAgB,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;KACjG,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAA;AAQD,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAsB,EAAE;IACrE,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACrG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AAC3B,CAAC,CAAA;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAA"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@knpkv/browser-pairing",
+  "version": "0.2.0",
+  "description": "Typed browser pairing credentials and transport primitives",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/knpkv/npm.git",
+    "directory": "packages/browser-pairing"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "import": "./dist/schema.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0"
+  },
+  "devDependencies": {
+    "@effect/vitest": "4.0.0",
+    "@types/node": "^26.6.4",
+    "effect": "4.0.0",
+    "rimraf": "^6.1.3",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^5.0.3"
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.build.json --force",
+    "check": "tsc -b tsconfig.json && tsc -p tsconfig.roles.json --noEmit",
+    "lint": "eslint src test",
+    "test": "vitest run"
+  }
+}