@nbtca/prompt 1.4.2 → 1.5.1

package/dist/app/views/settings.js

@@ -3,21 +3,33 @@ import { renderSettings } from './settings-render.js';
 import { applyColorModePreference, loadPreferences, resetPreferences, setColorMode, setIconMode, } from '../../config/preferences.js';
 import { resetIconCache, pickIcon } from '../../core/icons.js';
 import { APP_INFO, URLS } from '../../config/data.js';
-import { t, getCurrentLanguage, saveLanguagePreference, clearTranslationCache } from '../../i18n/index.js';
+import { t, getCurrentLanguage, saveLanguagePreference, clearTranslationCache, } from '../../i18n/index.js';
 import { padEndV } from '../../core/text.js';
+import { resetCapabilities } from '../../core/capabilities.js';
 let state = { mode: 'menu' };
+function currentHint(current, hint) {
+    return current ? { hint } : {};
+}
 function buildMenuField(statusMessage) {
     const trans = t();
     const prefs = loadPreferences();
     const currentLang = getCurrentLanguage();
     const options = [
-        { value: 'language', label: trans.language.selectLanguage, hint: currentLang === 'zh' ? trans.language.zh : trans.language.en },
+        {
+            value: 'language',
+            label: trans.language.selectLanguage,
+            hint: currentLang === 'zh' ? trans.language.zh : trans.language.en,
+        },
         { value: 'icon', label: trans.theme.iconMode, hint: prefs.iconMode },
         { value: 'color', label: trans.theme.colorMode, hint: prefs.colorMode },
         { value: 'reset', label: trans.theme.resetLabel },
         { value: 'about', label: trans.about.title },
     ];
-    return { mode: 'menu', statusMessage, menuField: new ListField({ title: trans.theme.chooseAction, options }) };
+    return {
+        mode: 'menu',
+        ...(statusMessage === undefined ? {} : { statusMessage }),
+        menuField: new ListField({ title: trans.theme.chooseAction, options }),
+    };
 }
 function goToMenu(statusMessage) {
     state = buildMenuField(statusMessage);
@@ -25,8 +37,9 @@ function goToMenu(statusMessage) {
 export const settingsView = {
     id: 'settings',
     title: t().menu.settings,
-    async load(_ctx) {
+    load() {
         goToMenu();
+        return Promise.resolve();
     },
     render(ctx) {
         return renderSettings(state, ctx.bodyRows, ctx.size.cols);
@@ -34,6 +47,9 @@ export const settingsView = {
     capturesInput() {
         return false;
     },
+    capturesPageKeys() {
+        return state.mode !== 'about';
+    },
     handleBack() {
         if (state.mode !== 'menu') {
             goToMenu();
@@ -41,7 +57,7 @@ export const settingsView = {
         }
         return false;
     },
-    handleKey(key, _ctx) {
+    handleKey(key) {
         const trans = t();
         switch (state.mode) {
             case 'menu': {
@@ -51,38 +67,92 @@ export const settingsView = {
                 if (result.selected === 'language') {
                     const currentLang = getCurrentLanguage();
                     const options = [
-                        { value: 'zh', label: trans.language.zh, hint: currentLang === 'zh' ? trans.common.current : undefined },
-                        { value: 'en', label: trans.language.en, hint: currentLang === 'en' ? trans.common.current : undefined },
+                        {
+                            value: 'zh',
+                            label: trans.language.zh,
+                            ...currentHint(currentLang === 'zh', trans.common.current),
+                        },
+                        {
+                            value: 'en',
+                            label: trans.language.en,
+                            ...currentHint(currentLang === 'en', trans.common.current),
+                        },
                     ];
-                    state = { mode: 'language', subField: new ListField({ title: trans.language.selectLanguage, options, initialIndex: currentLang === 'en' ? 1 : 0 }) };
+                    state = {
+                        mode: 'language',
+                        subField: new ListField({
+                            title: trans.language.selectLanguage,
+                            options,
+                            initialIndex: currentLang === 'en' ? 1 : 0,
+                        }),
+                    };
                     return;
                 }
                 if (result.selected === 'icon') {
                     const prefs = loadPreferences();
                     const options = [
-                        { value: 'auto', label: trans.theme.modeAuto, hint: prefs.iconMode === 'auto' ? trans.common.current : undefined },
-                        { value: 'ascii', label: trans.theme.modeAscii, hint: prefs.iconMode === 'ascii' ? trans.common.current : undefined },
-                        { value: 'unicode', label: trans.theme.modeUnicode, hint: prefs.iconMode === 'unicode' ? trans.common.current : undefined },
+                        {
+                            value: 'auto',
+                            label: trans.theme.modeAuto,
+                            ...currentHint(prefs.iconMode === 'auto', trans.common.current),
+                        },
+                        {
+                            value: 'ascii',
+                            label: trans.theme.modeAscii,
+                            ...currentHint(prefs.iconMode === 'ascii', trans.common.current),
+                        },
+                        {
+                            value: 'unicode',
+                            label: trans.theme.modeUnicode,
+                            ...currentHint(prefs.iconMode === 'unicode', trans.common.current),
+                        },
                     ];
                     const idx = Math.max(0, options.findIndex((o) => o.value === prefs.iconMode));
-                    state = { mode: 'icon', subField: new ListField({ title: trans.theme.chooseIconMode, options, initialIndex: idx }) };
+                    state = {
+                        mode: 'icon',
+                        subField: new ListField({
+                            title: trans.theme.chooseIconMode,
+                            options,
+                            initialIndex: idx,
+                        }),
+                    };
                     return;
                 }
                 if (result.selected === 'color') {
                     const prefs = loadPreferences();
                     const options = [
-                        { value: 'auto', label: trans.theme.modeAuto, hint: prefs.colorMode === 'auto' ? trans.common.current : undefined },
-                        { value: 'on', label: trans.theme.modeOn, hint: prefs.colorMode === 'on' ? trans.common.current : undefined },
-                        { value: 'off', label: trans.theme.modeOff, hint: prefs.colorMode === 'off' ? trans.common.current : undefined },
+                        {
+                            value: 'auto',
+                            label: trans.theme.modeAuto,
+                            ...currentHint(prefs.colorMode === 'auto', trans.common.current),
+                        },
+                        {
+                            value: 'on',
+                            label: trans.theme.modeOn,
+                            ...currentHint(prefs.colorMode === 'on', trans.common.current),
+                        },
+                        {
+                            value: 'off',
+                            label: trans.theme.modeOff,
+                            ...currentHint(prefs.colorMode === 'off', trans.common.current),
+                        },
                     ];
                     const idx = Math.max(0, options.findIndex((o) => o.value === prefs.colorMode));
-                    state = { mode: 'color', subField: new ListField({ title: trans.theme.chooseColorMode, options, initialIndex: idx }) };
+                    state = {
+                        mode: 'color',
+                        subField: new ListField({
+                            title: trans.theme.chooseColorMode,
+                            options,
+                            initialIndex: idx,
+                        }),
+                    };
                     return;
                 }
                 if (result.selected === 'reset') {
                     const saved = resetPreferences();
                     resetIconCache();
                     applyColorModePreference(false);
+                    resetCapabilities();
                     goToMenu(saved ? trans.theme.reset : trans.theme.resetSessionOnly);
                     return;
                 }
@@ -102,7 +172,10 @@ export const settingsView = {
                             '',
                             row(trans.about.license, `MIT  ${pickIcon('·', '-')}  ${trans.about.author}: m1ngsama`),
                         ],
-                        backField: new ListField({ title: trans.about.title, options: [{ value: '__back__', label: trans.common.back }] }),
+                        backField: new ListField({
+                            title: trans.about.title,
+                            options: [{ value: '__back__', label: trans.common.back }],
+                        }),
                     };
                 }
                 return;
@@ -128,6 +201,7 @@ export const settingsView = {
                     return;
                 const saved = setIconMode(result.selected);
                 resetIconCache();
+                resetCapabilities();
                 goToMenu(saved ? trans.theme.updated : trans.theme.updatedSessionOnly);
                 return;
             }
@@ -137,6 +211,7 @@ export const settingsView = {
                     return;
                 const saved = setColorMode(result.selected);
                 applyColorModePreference(false);
+                resetCapabilities();
                 goToMenu(saved ? trans.theme.updated : trans.theme.updatedSessionOnly);
                 return;
             }

package/dist/auth/cookie-transport.js

@@ -11,10 +11,7 @@ const WEBVPN_PATHS = new Set([
     '/users/auth/cas/callback',
     '/vpn_key/update',
 ]);
-const AUTH_PATHS = new Set([
-    '/authserver/login',
-    '/authserver/checkNeedCaptcha.htl',
-]);
+const AUTH_PATHS = new Set(['/authserver/login', '/authserver/checkNeedCaptcha.htl']);
 const JWXT_EXACT_PATHS = new Set([
     '/sso/jziotlogin',
     '/jwglxt/ticketlogin',
@@ -35,19 +32,17 @@ function assertAllowedVpnOrigin(value) {
     catch {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service returned an untrusted redirect.');
     }
-    if (nested.protocol !== 'https:'
-        || (nested.port !== '' && nested.port !== '443')
-        || nested.username !== ''
-        || nested.password !== '') {
+    if (nested.protocol !== 'https:' ||
+        (nested.port !== '' && nested.port !== '443') ||
+        nested.username !== '' ||
+        nested.password !== '') {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service returned an untrusted redirect.');
     }
     const host = nested.hostname.toLowerCase();
-    const allowed = (host === JWXT_HOST && isAllowedJwxtPath(nested.pathname)) || (host === AUTH_HOST && nested.pathname === '/authserver/login') || (host === WEBVPN_HOST && [
-        '/',
-        '/users/sign_in',
-        '/users/auth/cas',
-        '/users/auth/cas/callback',
-    ].includes(nested.pathname));
+    const allowed = (host === JWXT_HOST && isAllowedJwxtPath(nested.pathname)) ||
+        (host === AUTH_HOST && nested.pathname === '/authserver/login') ||
+        (host === WEBVPN_HOST &&
+            ['/', '/users/sign_in', '/users/auth/cas', '/users/auth/cas/callback'].includes(nested.pathname));
     if (!allowed) {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service returned an untrusted redirect.');
     }
@@ -60,23 +55,23 @@ function assertAllowedCasService(value) {
     catch {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service returned an untrusted redirect.');
     }
-    const allowed = service.protocol === 'https:'
-        && (service.port === '' || service.port === '443')
-        && service.username === ''
-        && service.password === ''
-        && ((service.hostname.toLowerCase() === WEBVPN_HOST
-            && service.pathname === '/users/auth/cas/callback') || (service.hostname.toLowerCase() === JWXT_HOST
-            && service.pathname === '/sso/jziotlogin'));
+    const allowed = service.protocol === 'https:' &&
+        (service.port === '' || service.port === '443') &&
+        service.username === '' &&
+        service.password === '' &&
+        ((service.hostname.toLowerCase() === WEBVPN_HOST &&
+            service.pathname === '/users/auth/cas/callback') ||
+            (service.hostname.toLowerCase() === JWXT_HOST && service.pathname === '/sso/jziotlogin'));
     if (!allowed) {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service returned an untrusted redirect.');
     }
 }
 export function assertAllowedCampusUrl(url) {
     const hostname = url.hostname.toLowerCase();
-    if (url.protocol !== 'https:'
-        || (url.port !== '' && url.port !== '443')
-        || url.username !== ''
-        || url.password !== '') {
+    if (url.protocol !== 'https:' ||
+        (url.port !== '' && url.port !== '443') ||
+        url.username !== '' ||
+        url.password !== '') {
         throw new AuthError('UNTRUSTED_URL', 'session', 'The campus service URL is not allowed.');
     }
     if (hostname === WEBVPN_HOST && WEBVPN_PATHS.has(url.pathname)) {
@@ -111,7 +106,9 @@ function safeHeaders(headers) {
 function abortSignal(signal, timeoutMs) {
     const controller = new AbortController();
     let didTimeout = false;
-    const onAbort = () => controller.abort(signal?.reason);
+    const onAbort = () => {
+        controller.abort(signal?.reason);
+    };
     signal?.addEventListener('abort', onAbort, { once: true });
     if (signal?.aborted)
         onAbort();
@@ -119,7 +116,7 @@ function abortSignal(signal, timeoutMs) {
         didTimeout = true;
         controller.abort();
     }, timeoutMs);
-    timer.unref?.();
+    timer.unref();
     return {
         signal: controller.signal,
         cleanup() {
@@ -133,7 +130,9 @@ function safeFetchError(error, stage, didTimeout) {
     if (error instanceof AuthError)
         return error;
     if (didTimeout)
-        return new AuthError('TIMEOUT', stage, 'The campus service request timed out.', { retryable: true });
+        return new AuthError('TIMEOUT', stage, 'The campus service request timed out.', {
+            retryable: true,
+        });
     if (typeof error === 'object' && error !== null && Reflect.get(error, 'name') === 'AbortError') {
         return new DOMException('The campus service request was aborted.', 'AbortError');
     }
@@ -188,10 +187,10 @@ export function createCampusCookieSession(options = {}) {
         const response = await request(url, init, 'session');
         try {
             const finalUrl = new URL(response.url);
-            if (finalUrl.hostname.toLowerCase() !== JWXT_HOST
-                || finalUrl.pathname.includes('/authserver/login')
-                || finalUrl.pathname.includes('/users/sign_in')
-                || finalUrl.pathname === '/vpn_key/update')
+            if (finalUrl.hostname.toLowerCase() !== JWXT_HOST ||
+                finalUrl.pathname.includes('/authserver/login') ||
+                finalUrl.pathname.includes('/users/sign_in') ||
+                finalUrl.pathname === '/vpn_key/update')
                 throw new SessionExpiredError();
         }
         catch (error) {

package/dist/auth/errors.js

@@ -12,7 +12,9 @@ export class AuthError extends Error {
 }
 export class SessionExpiredError extends AuthError {
     constructor() {
-        super('SESSION_EXPIRED', 'session', 'The campus login session has expired.', { retryable: true });
+        super('SESSION_EXPIRED', 'session', 'The campus login session has expired.', {
+            retryable: true,
+        });
         this.name = 'SessionExpiredError';
     }
 }

package/dist/auth/nbt-auth.js

@@ -1,4 +1,4 @@
-import { createCipheriv, randomBytes } from 'node:crypto';
+import { createCipheriv, randomFillSync } from 'node:crypto';
 import { load } from 'cheerio';
 import { AuthError } from './errors.js';
 import { JWXT_HOST, cookieSessionFromSerialized, createCampusCookieSession, } from './cookie-transport.js';
@@ -9,29 +9,38 @@ const TIMETABLE_INDEX = new URL(`https://${JWXT_HOST}/jwglxt/kbcx/xskbcx_cxXskbc
 const RANDOM_ALPHABET = 'ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678';
 const MAX_AUTH_HTML_BYTES = 2 * 1024 * 1024;
 const SESSION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const GRAPHEME_SEGMENTER = new Intl.Segmenter(undefined, { granularity: 'grapheme' });
+function signalOption(signal) {
+    return signal === undefined ? {} : { signal };
+}
+const secureRandomBytes = (size) => randomFillSync(new Uint8Array(size));
 function randomCharacters(length, source) {
     const bytes = source(length);
     if (bytes.length < length)
         throw new AuthError('LOGIN_PAGE_CHANGED', 'credentials', 'Secure login initialization failed.');
     let result = '';
     for (let index = 0; index < length; index += 1) {
-        result += RANDOM_ALPHABET[bytes[index] % RANDOM_ALPHABET.length];
+        const byte = bytes[index];
+        if (byte === undefined) {
+            throw new AuthError('LOGIN_PAGE_CHANGED', 'credentials', 'Secure login initialization failed.');
+        }
+        result += RANDOM_ALPHABET.charAt(byte % RANDOM_ALPHABET.length);
     }
     return result;
 }
-export function encryptCampusPassword(password, salt, source = randomBytes) {
-    const key = Buffer.from(salt, 'utf8');
+export function encryptCampusPassword(password, salt, source = secureRandomBytes) {
+    const key = Uint8Array.from(Buffer.from(salt, 'utf8'));
     if (key.length !== 16) {
         key.fill(0);
         throw new AuthError('LOGIN_PAGE_CHANGED', 'credentials', 'The campus login page changed unexpectedly.');
     }
     const ivText = randomCharacters(16, source);
     const prefix = randomCharacters(64, source);
-    const iv = Buffer.from(ivText, 'utf8');
-    const plaintext = Buffer.from(prefix + password, 'utf8');
+    const iv = Uint8Array.from(Buffer.from(ivText, 'utf8'));
+    const plaintext = Uint8Array.from(Buffer.from(prefix + password, 'utf8'));
     try {
         const cipher = createCipheriv('aes-128-cbc', key, iv);
-        return Buffer.concat([cipher.update(plaintext), cipher.final()]).toString('base64');
+        return cipher.update(plaintext, undefined, 'base64') + cipher.final('base64');
     }
     finally {
         key.fill(0);
@@ -72,7 +81,10 @@ function classifyRejectedLogin(html) {
         $('#showWarnTip').text(),
         $('#errorMsg').text(),
         $('.alert-danger').text(),
-    ].join(' ').replace(/\s+/g, ' ').trim();
+    ]
+        .join(' ')
+        .replace(/\s+/g, ' ')
+        .trim();
     if (/锁定|冻结|次数过多|稍后再试/.test(visibleError)) {
         return new AuthError('ACCOUNT_LOCKED', 'credentials', 'The campus account is temporarily locked.');
     }
@@ -89,7 +101,9 @@ function classifyRejectedLogin(html) {
 }
 async function readText(response, stage) {
     if (response.status < 200 || response.status >= 300) {
-        throw new AuthError('HTTP_ERROR', stage, 'The campus service returned an error.', { retryable: response.status >= 500 });
+        throw new AuthError('HTTP_ERROR', stage, 'The campus service returned an error.', {
+            retryable: response.status >= 500,
+        });
     }
     const length = Number.parseInt(response.headers.get('content-length') ?? '', 10);
     if (Number.isFinite(length) && length > MAX_AUTH_HTML_BYTES) {
@@ -107,7 +121,7 @@ async function challengeRequired(cookies, loginUrl, username, signal) {
     const response = await cookies.request(endpoint, {
         method: 'GET',
         headers: { Accept: 'application/json', 'X-Requested-With': 'XMLHttpRequest' },
-        signal,
+        ...signalOption(signal),
     }, 'challenge-check');
     const text = await readText(response, 'challenge-check');
     let parsed;
@@ -120,7 +134,8 @@ async function challengeRequired(cookies, loginUrl, username, signal) {
     if (typeof parsed === 'boolean')
         return parsed;
     if (typeof parsed === 'object' && parsed !== null) {
-        const value = Reflect.get(parsed, 'isNeed') ?? Reflect.get(parsed, 'needCaptcha');
+        const challenge = parsed;
+        const value = challenge['isNeed'] ?? challenge['needCaptcha'];
         if (value === true || value === 'true' || value === 1 || value === '1')
             return true;
         if (value === false || value === 'false' || value === 0 || value === '0')
@@ -129,7 +144,7 @@ async function challengeRequired(cookies, loginUrl, username, signal) {
     throw new AuthError('LOGIN_PAGE_CHANGED', 'challenge-check', 'The campus challenge response changed unexpectedly.');
 }
 function maskAccountId(username) {
-    const characters = [...username];
+    const characters = Array.from(GRAPHEME_SEGMENTER.segment(username), ({ segment }) => segment);
     if (characters.length <= 2)
         return '•'.repeat(characters.length);
     return `${'•'.repeat(characters.length - 2)}${characters.slice(-2).join('')}`;
@@ -144,7 +159,7 @@ function createAuthenticatedSession(cookies, metadata) {
                 version: 1,
                 provider: 'nbt-webvpn',
                 jar: await cookies.serialize(),
-                accountHint: metadata.accountHint,
+                ...(metadata.accountHint === undefined ? {} : { accountHint: metadata.accountHint }),
                 authenticatedAt: metadata.authenticatedAt,
                 validatedAt: validatedAtText,
                 expiresAt: new Date(validatedAt.getTime() + SESSION_MAX_AGE_MS).toISOString(),
@@ -154,9 +169,9 @@ function createAuthenticatedSession(cookies, metadata) {
     };
 }
 async function verifyJwxtSession(cookies, signal) {
-    await readText(await cookies.request(SSO_ENTRY, { method: 'GET', signal }, 'sso'), 'sso');
-    await readText(await cookies.request(JWXT_MENU, { method: 'GET', signal }, 'sso'), 'sso');
-    const response = await cookies.request(TIMETABLE_INDEX, { method: 'GET', signal }, 'sso');
+    await readText(await cookies.request(SSO_ENTRY, { method: 'GET', ...signalOption(signal) }, 'sso'), 'sso');
+    await readText(await cookies.request(JWXT_MENU, { method: 'GET', ...signalOption(signal) }, 'sso'), 'sso');
+    const response = await cookies.request(TIMETABLE_INDEX, { method: 'GET', ...signalOption(signal) }, 'sso');
     const html = await readText(response, 'sso');
     let finalUrl;
     try {
@@ -165,10 +180,10 @@ async function verifyJwxtSession(cookies, signal) {
     catch {
         throw new AuthError('UNEXPECTED_RESPONSE', 'sso', 'Campus login could not be confirmed.');
     }
-    if (finalUrl.hostname.toLowerCase() !== JWXT_HOST
-        || hasLoginFingerprint(html)
-        || !/<select\b[^>]*(?:id|name)=["']xnm["']/i.test(html)
-        || !/<select\b[^>]*(?:id|name)=["']xqm["']/i.test(html)) {
+    if (finalUrl.hostname.toLowerCase() !== JWXT_HOST ||
+        hasLoginFingerprint(html) ||
+        !/<select\b[^>]*(?:id|name)=["']xnm["']/i.test(html) ||
+        !/<select\b[^>]*(?:id|name)=["']xqm["']/i.test(html)) {
         throw new AuthError('UNEXPECTED_RESPONSE', 'sso', 'Campus login could not be confirmed.');
     }
 }
@@ -185,14 +200,14 @@ export async function loginWithStudentPassword(username, password, options = {})
                 Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
             },
-            signal: options.signal,
+            ...signalOption(options.signal),
         }, 'login-page');
         const loginHtml = await readText(loginResponse, 'login-page');
         const form = parseLoginForm(loginHtml, loginResponse.url);
         if (await challengeRequired(cookies, form.action, normalizedUsername, options.signal)) {
             throw new AuthError('INTERACTIVE_CHALLENGE', 'challenge-check', 'The campus login requires an interactive browser challenge.');
         }
-        const encryptedPassword = encryptCampusPassword(password, form.salt, options.randomBytes ?? randomBytes);
+        const encryptedPassword = encryptCampusPassword(password, form.salt, options.randomBytes ?? secureRandomBytes);
         const body = new URLSearchParams({
             username: normalizedUsername,
             password: encryptedPassword,
@@ -209,7 +224,7 @@ export async function loginWithStudentPassword(username, password, options = {})
                 Referer: loginResponse.url,
             },
             body: body.toString(),
-            signal: options.signal,
+            ...signalOption(options.signal),
         }, 'credentials');
         const credentialHtml = await readText(credentialResponse, 'credentials');
         if (hasLoginFingerprint(credentialHtml))
@@ -227,13 +242,15 @@ export async function loginWithStudentPassword(username, password, options = {})
             throw error;
         if (typeof error === 'object' && error !== null && Reflect.get(error, 'name') === 'AbortError')
             throw error;
-        throw new AuthError('NETWORK', 'credentials', 'The campus login request failed.', { retryable: true });
+        throw new AuthError('NETWORK', 'credentials', 'The campus login request failed.', {
+            retryable: true,
+        });
     }
 }
 export async function restoreNbtSession(persisted, options = {}) {
     const cookies = await cookieSessionFromSerialized(persisted.jar, options);
     return createAuthenticatedSession(cookies, {
-        accountHint: persisted.accountHint,
+        ...(persisted.accountHint === undefined ? {} : { accountHint: persisted.accountHint }),
         authenticatedAt: persisted.authenticatedAt,
     });
 }

package/dist/auth/session-store.js

@@ -23,19 +23,21 @@ function parseSession(value) {
         return null;
     if (value['expiresAt'] !== undefined && !isIsoDate(value['expiresAt']))
         return null;
-    if (value['accountHint'] !== undefined
-        && (typeof value['accountHint'] !== 'string'
-            || value['accountHint'].length > 64
-            || /[\u0000-\u001f\u007f]/.test(value['accountHint'])))
+    if (value['accountHint'] !== undefined &&
+        (typeof value['accountHint'] !== 'string' ||
+            value['accountHint'].length > 64 ||
+            /[\u0000-\u001f\u007f]/.test(value['accountHint'])))
         return null;
+    const accountHint = value['accountHint'];
+    const expiresAt = value['expiresAt'];
     return {
         version: SESSION_SCHEMA_VERSION,
         provider: 'nbt-webvpn',
         jar: value['jar'],
-        accountHint: value['accountHint'],
+        ...(typeof accountHint === 'string' ? { accountHint } : {}),
         authenticatedAt: value['authenticatedAt'],
         validatedAt: value['validatedAt'],
-        expiresAt: value['expiresAt'],
+        ...(typeof expiresAt === 'string' ? { expiresAt } : {}),
     };
 }
 function removeFile(filePath) {
@@ -93,7 +95,9 @@ export function createSessionStore(options = {}) {
         try {
             fs.chmodSync(directory, 0o700);
         }
-        catch { /* Best effort on non-POSIX filesystems. */ }
+        catch {
+            /* Best effort on non-POSIX filesystems. */
+        }
         const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
         try {
             fs.writeFileSync(temporaryPath, `${JSON.stringify(validated)}\n`, {
@@ -105,13 +109,17 @@ export function createSessionStore(options = {}) {
             try {
                 fs.chmodSync(filePath, 0o600);
             }
-            catch { /* Best effort on non-POSIX filesystems. */ }
+            catch {
+                /* Best effort on non-POSIX filesystems. */
+            }
         }
         finally {
             try {
                 removeFile(temporaryPath);
             }
-            catch { /* The main write result is authoritative. */ }
+            catch {
+                /* The main write result is authoritative. */
+            }
         }
     }
     return { filePath, load, save, clear };