@kya-os/mcp 1.2.0

package/dist/providers/node-crypto.js

@@ -0,0 +1,69 @@
+/**
+ * Node.js CryptoProvider
+ *
+ * Ed25519 crypto backed by Node.js built-in `node:crypto`.
+ * Use this on any Node.js 20+ server.
+ *
+ * @example
+ * ```typescript
+ * import { NodeCryptoProvider } from '@kya-os/mcp/providers';
+ * import { withMCPI } from '@kya-os/mcp/middleware';
+ *
+ * await withMCPI(server, { crypto: new NodeCryptoProvider() });
+ * ```
+ */
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, randomBytes, } from "node:crypto";
+import { CryptoProvider } from "./base.js";
+/** PKCS8 DER header for Ed25519 private keys (16 bytes) */
+const ED25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+/** SPKI DER header for Ed25519 public keys (12 bytes) */
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+export class NodeCryptoProvider extends CryptoProvider {
+    async sign(data, privateKeyBase64) {
+        const privateKey = Buffer.from(privateKeyBase64, "base64");
+        // Handle both raw 32-byte and full 64-byte Ed25519 keys
+        const keyBytes = privateKey.length === 64 ? privateKey.subarray(0, 32) : privateKey;
+        const keyObject = createPrivateKey({
+            key: Buffer.concat([ED25519_PKCS8_PREFIX, keyBytes]),
+            format: "der",
+            type: "pkcs8",
+        });
+        return new Uint8Array(sign(null, Buffer.from(data), keyObject));
+    }
+    async verify(data, signature, publicKeyBase64) {
+        try {
+            const keyObject = createPublicKey({
+                key: Buffer.concat([
+                    ED25519_SPKI_PREFIX,
+                    Buffer.from(publicKeyBase64, "base64"),
+                ]),
+                format: "der",
+                type: "spki",
+            });
+            return verify(null, Buffer.from(data), keyObject, Buffer.from(signature));
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateKeyPair() {
+        const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
+            publicKeyEncoding: { type: "spki", format: "der" },
+            privateKeyEncoding: { type: "pkcs8", format: "der" },
+        });
+        return {
+            privateKey: privateKey.subarray(16, 48).toString("base64"),
+            publicKey: publicKey.subarray(12, 44).toString("base64"),
+        };
+    }
+    async hash(data) {
+        const hex = createHash("sha256")
+            .update(Buffer.from(data))
+            .digest("hex");
+        return `sha256:${hex}`;
+    }
+    async randomBytes(length) {
+        return new Uint8Array(randomBytes(length));
+    }
+}
+//# sourceMappingURL=node-crypto.js.map

package/dist/providers/node-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-crypto.js","sourceRoot":"","sources":["../../src/providers/node-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,EACJ,MAAM,EACN,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,kCAAkC,EAClC,KAAK,CACN,CAAC;AAEF,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE3E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACpD,KAAK,CAAC,IAAI,CACR,IAAgB,EAChB,gBAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAE3D,wDAAwD;QACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAErE,MAAM,SAAS,GAAG,gBAAgB,CAAC;YACjC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAgB,EAChB,SAAqB,EACrB,eAAuB;QAEvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,eAAe,CAAC;gBAChC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACjB,mBAAmB;oBACnB,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC;iBACvC,CAAC;gBACF,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,OAAO,MAAM,CACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACvB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QAInB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,EAAE;YAC/D,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAG,UAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtE,SAAS,EAAG,SAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/session/index.d.ts

@@ -0,0 +1,2 @@
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,2 @@
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './manager.js';
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,cAAc,CAAC"}

package/dist/session/manager.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Session Management — Platform-agnostic Protocol Reference
+ *
+ * Handles handshake enforcement, session management, and nonce validation
+ * according to MCP-I requirements 4.5–4.9 and 19.1–19.2.
+ *
+ * Platform adapters inject a CryptoProvider for all random byte generation.
+ * The static generateNonce() uses globalThis.crypto (available Node 20+ and
+ * Cloudflare Workers) to remain synchronous without platform-specific imports.
+ */
+import { type MCPIErrorCode } from "../errors.js";
+import type { HandshakeRequest, SessionContext, NonceCache } from '../types/protocol.js';
+import type { CryptoProvider } from '../providers/base.js';
+export interface SessionConfig {
+    timestampSkewSeconds?: number;
+    sessionTtlMinutes?: number;
+    absoluteSessionLifetime?: number;
+    nonceCache?: NonceCache;
+    serverDid?: string;
+    /** Maximum number of concurrent sessions. Oldest sessions are evicted when exceeded. Default: 10000 */
+    maxSessions?: number;
+}
+export interface HandshakeResult {
+    success: boolean;
+    session?: SessionContext;
+    error?: {
+        code: MCPIErrorCode;
+        message: string;
+        remediation?: string;
+    };
+}
+export declare class SessionManager {
+    private config;
+    private cryptoProvider;
+    private sessions;
+    private sessionInsertionOrder;
+    private maxSessions;
+    constructor(cryptoProvider: CryptoProvider, config?: SessionConfig);
+    setServerDid(serverDid: string): void;
+    /**
+     * Validate an MCP-I handshake request and create a session.
+     *
+     * Performs the following checks:
+     * - Timestamp within acceptable skew window
+     * - Audience matches server DID (if configured)
+     * - Nonce not previously used (replay protection)
+     *
+     * @param request - The handshake request containing nonce, audience, timestamp, and optional agentDid
+     * @returns Result object with success flag, session on success, or error details on failure
+     */
+    validateHandshake(request: HandshakeRequest): Promise<HandshakeResult>;
+    /**
+     * Retrieve a session by ID, checking for expiration.
+     *
+     * Updates lastActivity timestamp on successful retrieval (sliding window expiry).
+     * Returns null if session doesn't exist, has exceeded idle TTL, or has exceeded
+     * absolute lifetime (if configured).
+     *
+     * @param sessionId - The session ID (e.g., "mcpi_...")
+     * @returns Session context if valid, null if expired or not found
+     */
+    getSession(sessionId: string): Promise<SessionContext | null>;
+    private generateSessionId;
+    private generateClientId;
+    private normalizeClientInfoString;
+    private buildClientInfo;
+    static generateNonce(): string;
+    private evictIfNeeded;
+    cleanup(): Promise<void>;
+    getStats(): {
+        activeSessions: number;
+        config: {
+            timestampSkewSeconds: number;
+            sessionTtlMinutes: number;
+            absoluteSessionLifetime?: number;
+            cacheType: string;
+        };
+    };
+    clearSessions(): void;
+}
+export declare function createHandshakeRequest(audience: string): HandshakeRequest;
+export declare function validateHandshakeFormat(request: unknown): request is HandshakeRequest;
+//# sourceMappingURL=manager.d.ts.map

package/dist/session/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAI3D,MAAM,WAAW,aAAa;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,aAAa,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAGZ;IACF,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,qBAAqB,CAAgB;IAC7C,OAAO,CAAC,WAAW,CAAS;gBAEhB,cAAc,EAAE,cAAc,EAAE,MAAM,GAAE,aAAkB;IAsBtE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAkF5E;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;YA2BrD,iBAAiB;YAWjB,gBAAgB;IAQ9B,OAAO,CAAC,yBAAyB;YAMnB,eAAe;IA2B7B,MAAM,CAAC,aAAa,IAAI,MAAM;IAa9B,OAAO,CAAC,aAAa;IASf,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B9B,QAAQ,IAAI;QACV,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE;YACN,oBAAoB,EAAE,MAAM,CAAC;YAC7B,iBAAiB,EAAE,MAAM,CAAC;YAC1B,uBAAuB,CAAC,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC;SACnB,CAAC;KACH;IAYD,aAAa,IAAI,IAAI;CAItB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAMzE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,gBAAgB,CAYrF"}

package/dist/session/manager.js

@@ -0,0 +1,267 @@
+/**
+ * Session Management — Platform-agnostic Protocol Reference
+ *
+ * Handles handshake enforcement, session management, and nonce validation
+ * according to MCP-I requirements 4.5–4.9 and 19.1–19.2.
+ *
+ * Platform adapters inject a CryptoProvider for all random byte generation.
+ * The static generateNonce() uses globalThis.crypto (available Node 20+ and
+ * Cloudflare Workers) to remain synchronous without platform-specific imports.
+ */
+import { MCPI_ERROR_CODES } from "../errors.js";
+import { MemoryNonceCacheProvider } from '../providers/memory.js';
+import { logger } from '../logging/index.js';
+export class SessionManager {
+    config;
+    cryptoProvider;
+    sessions = new Map();
+    sessionInsertionOrder = [];
+    maxSessions;
+    constructor(cryptoProvider, config = {}) {
+        this.cryptoProvider = cryptoProvider;
+        this.maxSessions = config.maxSessions ?? 10_000;
+        this.config = {
+            timestampSkewSeconds: config.timestampSkewSeconds ?? 120,
+            sessionTtlMinutes: config.sessionTtlMinutes ?? 30,
+            nonceCache: config.nonceCache ?? new MemoryNonceCacheProvider(),
+            ...(config.absoluteSessionLifetime !== undefined && {
+                absoluteSessionLifetime: config.absoluteSessionLifetime,
+            }),
+            ...(config.serverDid !== undefined && { serverDid: config.serverDid }),
+        };
+        if (this.config.nonceCache instanceof MemoryNonceCacheProvider) {
+            logger.warn('[SessionManager] Using MemoryNonceCacheProvider — not suitable for ' +
+                'multi-instance deployments. Use Redis, DynamoDB, or Cloudflare KV ' +
+                'for production.');
+        }
+    }
+    setServerDid(serverDid) {
+        this.config.serverDid = serverDid;
+    }
+    /**
+     * Validate an MCP-I handshake request and create a session.
+     *
+     * Performs the following checks:
+     * - Timestamp within acceptable skew window
+     * - Audience matches server DID (if configured)
+     * - Nonce not previously used (replay protection)
+     *
+     * @param request - The handshake request containing nonce, audience, timestamp, and optional agentDid
+     * @returns Result object with success flag, session on success, or error details on failure
+     */
+    async validateHandshake(request) {
+        try {
+            const now = Math.floor(Date.now() / 1000);
+            const timeDiff = Math.abs(now - request.timestamp);
+            if (timeDiff > this.config.timestampSkewSeconds) {
+                return {
+                    success: false,
+                    error: {
+                        code: MCPI_ERROR_CODES.handshake_failed,
+                        message: `Timestamp outside acceptable range (±${this.config.timestampSkewSeconds}s)`,
+                        remediation: `Check NTP sync on client and server. Current server time: ${now}, received: ${request.timestamp}, diff: ${timeDiff}s. Adjust timestampSkewSeconds if needed.`,
+                    },
+                };
+            }
+            // Validate audience matches this server's DID (SPEC.md §4 MUST)
+            if (this.config.serverDid && request.audience !== this.config.serverDid) {
+                return {
+                    success: false,
+                    error: {
+                        code: MCPI_ERROR_CODES.handshake_failed,
+                        message: `Audience mismatch: expected ${this.config.serverDid}, got ${request.audience}`,
+                    },
+                };
+            }
+            const nonceExists = await this.config.nonceCache.has(request.nonce, request.agentDid);
+            if (nonceExists) {
+                return {
+                    success: false,
+                    error: {
+                        code: MCPI_ERROR_CODES.handshake_failed,
+                        message: 'Nonce already used (replay attack prevention)',
+                        remediation: 'Generate a new unique nonce for each request',
+                    },
+                };
+            }
+            const nonceTtlSeconds = this.config.sessionTtlMinutes * 60 + 60;
+            await this.config.nonceCache.add(request.nonce, nonceTtlSeconds, request.agentDid);
+            const sessionId = await this.generateSessionId();
+            const clientInfo = await this.buildClientInfo(request);
+            const session = {
+                sessionId,
+                audience: request.audience,
+                nonce: request.nonce,
+                timestamp: request.timestamp,
+                createdAt: now,
+                lastActivity: now,
+                ttlMinutes: this.config.sessionTtlMinutes,
+                identityState: 'anonymous',
+                agentDid: request.agentDid,
+                ...(this.config.serverDid && { serverDid: this.config.serverDid }),
+                ...(clientInfo && { clientInfo }),
+            };
+            this.evictIfNeeded();
+            this.sessions.set(sessionId, session);
+            this.sessionInsertionOrder.push(sessionId);
+            return { success: true, session };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: {
+                    code: MCPI_ERROR_CODES.handshake_failed,
+                    message: `Handshake validation failed: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                },
+            };
+        }
+    }
+    /**
+     * Retrieve a session by ID, checking for expiration.
+     *
+     * Updates lastActivity timestamp on successful retrieval (sliding window expiry).
+     * Returns null if session doesn't exist, has exceeded idle TTL, or has exceeded
+     * absolute lifetime (if configured).
+     *
+     * @param sessionId - The session ID (e.g., "mcpi_...")
+     * @returns Session context if valid, null if expired or not found
+     */
+    async getSession(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return null;
+        const now = Math.floor(Date.now() / 1000);
+        const idleTimeSeconds = now - session.lastActivity;
+        const maxIdleSeconds = session.ttlMinutes * 60;
+        if (idleTimeSeconds > maxIdleSeconds) {
+            this.sessions.delete(sessionId);
+            return null;
+        }
+        if (this.config.absoluteSessionLifetime !== undefined) {
+            const sessionAgeSeconds = now - session.createdAt;
+            const maxAgeSeconds = this.config.absoluteSessionLifetime * 60;
+            if (sessionAgeSeconds > maxAgeSeconds) {
+                this.sessions.delete(sessionId);
+                return null;
+            }
+        }
+        session.lastActivity = now;
+        this.sessions.set(sessionId, session);
+        return session;
+    }
+    async generateSessionId() {
+        const bytes = await this.cryptoProvider.randomBytes(16);
+        bytes[6] = (bytes[6] & 0x0f) | 0x40;
+        bytes[8] = (bytes[8] & 0x3f) | 0x80;
+        const hex = Array.from(bytes)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+        const uuid = `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+        return `mcpi_${uuid}`;
+    }
+    async generateClientId() {
+        const bytes = await this.cryptoProvider.randomBytes(6);
+        const hex = Array.from(bytes)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+        return `client_${hex}`;
+    }
+    normalizeClientInfoString(value) {
+        if (typeof value !== 'string')
+            return undefined;
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : undefined;
+    }
+    async buildClientInfo(request) {
+        const hasMetadata = !!request.clientInfo ||
+            typeof request.clientProtocolVersion === 'string' ||
+            request.clientCapabilities !== undefined;
+        if (!hasMetadata)
+            return undefined;
+        const source = request.clientInfo;
+        return {
+            name: this.normalizeClientInfoString(source?.name) ?? 'unknown',
+            title: this.normalizeClientInfoString(source?.title),
+            version: this.normalizeClientInfoString(source?.version),
+            platform: this.normalizeClientInfoString(source?.platform),
+            vendor: this.normalizeClientInfoString(source?.vendor),
+            persistentId: this.normalizeClientInfoString(source?.persistentId),
+            clientId: this.normalizeClientInfoString(source?.clientId) ??
+                (await this.generateClientId()),
+            protocolVersion: this.normalizeClientInfoString(request.clientProtocolVersion),
+            capabilities: request.clientCapabilities,
+        };
+    }
+    static generateNonce() {
+        const buffer = new Uint8Array(16);
+        globalThis.crypto.getRandomValues(buffer);
+        let binaryStr = '';
+        for (let i = 0; i < buffer.length; i++) {
+            binaryStr += String.fromCharCode(buffer[i]);
+        }
+        return btoa(binaryStr)
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    evictIfNeeded() {
+        while (this.sessions.size >= this.maxSessions && this.sessionInsertionOrder.length > 0) {
+            const oldest = this.sessionInsertionOrder.shift();
+            if (oldest) {
+                this.sessions.delete(oldest);
+            }
+        }
+    }
+    async cleanup() {
+        const now = Math.floor(Date.now() / 1000);
+        for (const [sessionId, session] of this.sessions.entries()) {
+            const idleTimeSeconds = now - session.lastActivity;
+            const maxIdleSeconds = session.ttlMinutes * 60;
+            let expired = idleTimeSeconds > maxIdleSeconds;
+            if (!expired && this.config.absoluteSessionLifetime !== undefined) {
+                const sessionAgeSeconds = now - session.createdAt;
+                const maxAgeSeconds = this.config.absoluteSessionLifetime * 60;
+                expired = sessionAgeSeconds > maxAgeSeconds;
+            }
+            if (expired) {
+                this.sessions.delete(sessionId);
+            }
+        }
+        this.sessionInsertionOrder = this.sessionInsertionOrder.filter(id => this.sessions.has(id));
+        await this.config.nonceCache.cleanup();
+    }
+    getStats() {
+        return {
+            activeSessions: this.sessions.size,
+            config: {
+                timestampSkewSeconds: this.config.timestampSkewSeconds,
+                sessionTtlMinutes: this.config.sessionTtlMinutes,
+                absoluteSessionLifetime: this.config.absoluteSessionLifetime,
+                cacheType: this.config.nonceCache.constructor.name,
+            },
+        };
+    }
+    clearSessions() {
+        this.sessions.clear();
+        this.sessionInsertionOrder = [];
+    }
+}
+export function createHandshakeRequest(audience) {
+    return {
+        nonce: SessionManager.generateNonce(),
+        audience,
+        timestamp: Math.floor(Date.now() / 1000),
+    };
+}
+export function validateHandshakeFormat(request) {
+    return (typeof request === 'object' &&
+        request !== null &&
+        typeof request['nonce'] === 'string' &&
+        request['nonce'].length > 0 &&
+        typeof request['audience'] === 'string' &&
+        request['audience'].length > 0 &&
+        typeof request['timestamp'] === 'number' &&
+        request['timestamp'] > 0 &&
+        Number.isInteger(request['timestamp']));
+}
+//# sourceMappingURL=manager.js.map

package/dist/session/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAsB,MAAM,cAAc,CAAC;AAOpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAsB7C,MAAM,OAAO,cAAc;IACjB,MAAM,CAGZ;IACM,cAAc,CAAiB;IAC/B,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,qBAAqB,GAAa,EAAE,CAAC;IACrC,WAAW,CAAS;IAE5B,YAAY,cAA8B,EAAE,SAAwB,EAAE;QACpE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG;YACZ,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,GAAG;YACxD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE;YAC/D,GAAG,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,IAAI;gBAClD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;aACxD,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACvE,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,YAAY,wBAAwB,EAAE,CAAC;YAC/D,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACnE,oEAAoE;gBACpE,iBAAiB,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAyB;QAC/C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAEnD,IAAI,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB,CAAC,gBAAgB;wBACvC,OAAO,EAAE,wCAAwC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI;wBACrF,WAAW,EAAE,6DAA6D,GAAG,eAAe,OAAO,CAAC,SAAS,WAAW,QAAQ,2CAA2C;qBAC5K;iBACF,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB,CAAC,gBAAgB;wBACvC,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,CAAC,SAAS,SAAS,OAAO,CAAC,QAAQ,EAAE;qBACzF;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAClD,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,gBAAgB,CAAC,gBAAgB;wBACvC,OAAO,EAAE,+CAA+C;wBACxD,WAAW,EAAE,8CAA8C;qBAC5D;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,EAAE,GAAG,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAC9B,OAAO,CAAC,KAAK,EACb,eAAe,EACf,OAAO,CAAC,QAAQ,CACjB,CAAC;YAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvD,MAAM,OAAO,GAAmB;gBAC9B,SAAS;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,GAAG;gBACjB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBACzC,aAAa,EAAE,WAAW;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAClE,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC;YAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB,CAAC,gBAAgB;oBACvC,OAAO,EAAE,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE;iBACpG;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;QACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;QAE/C,IAAI,eAAe,GAAG,cAAc,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;YAC/D,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrH,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;IAEO,yBAAyB,CAAC,KAAc;QAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAyB;QAEzB,MAAM,WAAW,GACf,CAAC,CAAC,OAAO,CAAC,UAAU;YACpB,OAAO,OAAO,CAAC,qBAAqB,KAAK,QAAQ;YACjD,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAE3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;QAElC,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS;YAC/D,KAAK,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC;YACxD,QAAQ,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC1D,MAAM,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,YAAY,CAAC;YAClE,QAAQ,EACN,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAChD,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjC,eAAe,EAAE,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC9E,YAAY,EAAE,OAAO,CAAC,kBAAkB;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,MAAM,eAAe,GAAG,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC;YACnD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;gBAClE,MAAM,iBAAiB,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,CAAC;gBAC/D,OAAO,GAAG,iBAAiB,GAAG,aAAa,CAAC;YAC9C,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAC5D,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAC5B,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ;QASN,OAAO;YACL,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAClC,MAAM,EAAE;gBACN,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;gBACtD,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB;gBAChD,uBAAuB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;gBAC5D,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI;aACnD;SACF,CAAC;IACJ,CAAC;IAED,aAAa;QACX,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO;QACL,KAAK,EAAE,cAAc,CAAC,aAAa,EAAE;QACrC,QAAQ;QACR,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,OAAQ,OAAmC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC/D,OAAmC,CAAC,OAAO,CAAY,CAAC,MAAM,GAAG,CAAC;QACpE,OAAQ,OAAmC,CAAC,UAAU,CAAC,KAAK,QAAQ;QAClE,OAAmC,CAAC,UAAU,CAAY,CAAC,MAAM,GAAG,CAAC;QACvE,OAAQ,OAAmC,CAAC,WAAW,CAAC,KAAK,QAAQ;QACnE,OAAmC,CAAC,WAAW,CAAY,GAAG,CAAC;QACjE,MAAM,CAAC,SAAS,CAAE,OAAmC,CAAC,WAAW,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC"}