@knpkv/codecommit-web 0.17.0 → 0.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/README.md +7 -4
  2. package/dist/server/Api.d.ts +421 -421
  3. package/dist/server/Server.d.ts +11 -7
  4. package/dist/server/Server.d.ts.map +1 -1
  5. package/dist/server/Server.js +27 -77
  6. package/dist/server/Server.js.map +1 -1
  7. package/dist/server/internal/OwnerSession.d.ts +18 -0
  8. package/dist/server/internal/OwnerSession.d.ts.map +1 -0
  9. package/dist/server/internal/OwnerSession.js +27 -0
  10. package/dist/server/internal/OwnerSession.js.map +1 -0
  11. package/dist/server/internal/PublicOrigin.d.ts +2 -5
  12. package/dist/server/internal/PublicOrigin.d.ts.map +1 -1
  13. package/dist/server/internal/PublicOrigin.js +4 -9
  14. package/dist/server/internal/PublicOrigin.js.map +1 -1
  15. package/dist/server/internal/StaticClient.d.ts +7 -0
  16. package/dist/server/internal/StaticClient.d.ts.map +1 -0
  17. package/dist/server/internal/StaticClient.js +8 -0
  18. package/dist/server/internal/StaticClient.js.map +1 -0
  19. package/dist/tooling/authenticated-dev-proxy.test.js +18 -24
  20. package/dist/tooling/authenticated-dev-proxy.test.js.map +1 -1
  21. package/package.json +6 -6
  22. package/dist/server/internal/OwnerSessionSecurity.d.ts +0 -57
  23. package/dist/server/internal/OwnerSessionSecurity.d.ts.map +0 -1
  24. package/dist/server/internal/OwnerSessionSecurity.js +0 -220
  25. package/dist/server/internal/OwnerSessionSecurity.js.map +0 -1
package/README.md CHANGED
@@ -5,9 +5,12 @@ the owner, CSRF, and bootstrap credentials; the bootstrap credential is valid fo
5
5
  60 seconds, single-use, and limited to five failed unauthenticated attempts. The
6
6
  owner cookie is HttpOnly and SameSite=Strict. This intentionally differs from
7
7
  Control Center's durable workspace session (12-hour idle and 30-day absolute
8
- lifetimes); the shared `@knpkv/browser-pairing` package supplies only credential
9
- validation, issuance, hashing, expiry, cookie serialization, and one-time state
10
- transitions. Each application keeps its own persistence and authorization policy.
8
+ lifetimes). The policy is the shared single-operator Owner Session from
9
+ `@knpkv/browser-pairing/owner-session` (ADR-0008); CodeCommit web keeps its API
10
+ middleware, wire errors, `cc_owner` cookie name, and dev-proxy model.
11
11
 
12
12
  Origin checks use the configured loopback authority captured at bind time. The
13
- request `Host` header is not an authority source.
13
+ request `Host` header is not an authority source. Browser reads that Fetch
14
+ Metadata marks as cross-site, or as same-site/`none` without the bound Origin,
15
+ are refused; explicit clients without Fetch Metadata still need the owner
16
+ cookie.