npm - @proteinjs/user-server - Versions diffs - 1.10.1 → 1.10.3 - Mend

@proteinjs/user-server 1.10.1 → 1.10.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (26) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
+## [1.10.3](https://github.com/proteinjs/user/compare/@proteinjs/user-server@1.10.2...@proteinjs/user-server@1.10.3) (2026-08-28)
+### Bug Fixes
+* avatar route reads bytes through the driver door — its own access decision, not the gated service read ([0fbf954](https://github.com/proteinjs/user/commit/0fbf95439b11bb4c67ad6109eb7d519d0c8788e1))
+## [1.10.2](https://github.com/proteinjs/user/compare/@proteinjs/user-server@1.10.1...@proteinjs/user-server@1.10.2) (2026-08-27)
+### Bug Fixes
+* /dev/login first-hit lands on the login form — diagnosed to runtime passport skew; establishSession now refuses a non-regenerating login instead of silently racing ([a34a85e](https://github.com/proteinjs/user/commit/a34a85e088dcf212d4bb1e79c162b716e8d6a444))
 ## [1.10.1](https://github.com/proteinjs/user/compare/@proteinjs/user-server@1.10.0...@proteinjs/user-server@1.10.1) (2026-08-26)

package/dist/src/authentication/establishSession.d.ts CHANGED Viewed

@@ -19,8 +19,15 @@
  * real passport machinery.
  *
  * COUPLED to the passport 0.6 upgrade in @proteinjs/server (which supplies the runtime passport
- * middleware): under passport 0.4, `request.login` neither regenerates nor saves — shipping this
- * package against a pre-0.6 @proteinjs/server would silently reopen both holes.
+ * middleware): under passport 0.4, `request.login` neither regenerates nor saves. That skew is
+ * NOT silent here: the post-login guard below verifies the one observable trace of the contract —
+ * express-session's regenerate always REPLACES `request.session` with a fresh Session — and
+ * REFUSES (rejects) when the session object survived the login. A pre-0.6 runtime (a stale
+ * @proteinjs/server < 3.5.1 checkout symlinked into a dev workspace, live-observed as
+ * DEV_SMOKE_OVERNIGHT 2026-08-26 finding 7: /dev/login's redirected navigation raced the
+ * deferred session write and landed on the login form) then fails loudly at the seam instead of
+ * degrading into fixation-vulnerable, race-prone logins. The guard is a post-condition, not a
+ * fallback — establishSession never does passport's regenerate/save itself.
  *
  * `request` is typed loosely because passport augments the express request at runtime; the
  * routes in this package share that convention. A login failure (regenerate/serialize/save

package/dist/src/authentication/establishSession.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"establishSession.d.ts","sourceRoot":"","sources":["../../../src/authentication/establishSession.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG~~;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,~~CAIjF~~"}
1	+ {"version":3,"file":"establishSession.d.ts","sourceRoot":"","sources":["../../../src/authentication/establishSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAejF"}

package/dist/src/authentication/establishSession.js CHANGED Viewed

@@ -58,8 +58,15 @@ exports.establishSession = void 0;
  * real passport machinery.
  *
  * COUPLED to the passport 0.6 upgrade in @proteinjs/server (which supplies the runtime passport
- * middleware): under passport 0.4, `request.login` neither regenerates nor saves — shipping this
- * package against a pre-0.6 @proteinjs/server would silently reopen both holes.
+ * middleware): under passport 0.4, `request.login` neither regenerates nor saves. That skew is
+ * NOT silent here: the post-login guard below verifies the one observable trace of the contract —
+ * express-session's regenerate always REPLACES `request.session` with a fresh Session — and
+ * REFUSES (rejects) when the session object survived the login. A pre-0.6 runtime (a stale
+ * @proteinjs/server < 3.5.1 checkout symlinked into a dev workspace, live-observed as
+ * DEV_SMOKE_OVERNIGHT 2026-08-26 finding 7: /dev/login's redirected navigation raced the
+ * deferred session write and landed on the login form) then fails loudly at the seam instead of
+ * degrading into fixation-vulnerable, race-prone logins. The guard is a post-condition, not a
+ * fallback — establishSession never does passport's regenerate/save itself.
  *
  * `request` is typed loosely because passport augments the express request at runtime; the
  * routes in this package share that convention. A login failure (regenerate/serialize/save
@@ -67,13 +74,24 @@ exports.establishSession = void 0;
  */
 function establishSession(request, email) {
     return __awaiter(this, void 0, void 0, function () {
+        var preLoginSession;
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, new Promise(function (resolve, reject) {
-                        return request.login(email, function (error) { return (error ? reject(error) : resolve()); });
-                    })];
+                case 0:
+                    preLoginSession = request.session;
+                    return [4 /*yield*/, new Promise(function (resolve, reject) {
+                            return request.login(email, function (error) { return (error ? reject(error) : resolve()); });
+                        })];
                 case 1:
                     _a.sent();
+                    if (request.session === preLoginSession) {
+                        throw new Error('establishSession: request.login resolved without replacing request.session, so the runtime passport ' +
+                            'did not regenerate the session id (pre-0.6 shape — the runtime middleware comes from ' +
+                            '@proteinjs/server, which supplies passport 0.6 as of 3.5.1; check for a stale checkout or ' +
+                            'node_modules). Refusing to answer success: without regenerate → save-before-response, the ' +
+                            'post-login navigation races the session write (first hit lands unauthenticated) and session ' +
+                            'fixation (CVE-2022-25896) reopens.');
+                    }
                     return [2 /*return*/];
             }
         });

package/dist/src/authentication/establishSession.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"establishSession.js","sourceRoot":"","sources":["../../../src/authentication/establishSession.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA~~;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG~~;AACH,SAAsB,gBAAgB,CAAC,OAAY,EAAE,KAAa~~;;;;wBAChE~~,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;~~wBACtC~~,OAAA,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAC,KAAc,IAAK,OAAA,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAnC,CAAmC,CAAC;~~oBAA7E~~,CAA6E,CAC9E,EAAA;;oBAFD,SAEC,CAAC;;;;;~~CACH~~;~~AAJD~~,~~4CAIC~~"}
1	+ {"version":3,"file":"establishSession.js","sourceRoot":"","sources":["../../../src/authentication/establishSession.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAsB,gBAAgB,CAAC,OAAY,EAAE,KAAa;;;;;;oBAC1D,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;oBACxC,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;4BACtC,OAAA,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,UAAC,KAAc,IAAK,OAAA,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAnC,CAAmC,CAAC;wBAA7E,CAA6E,CAC9E,EAAA;;oBAFD,SAEC,CAAC;oBACF,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE;wBACvC,MAAM,IAAI,KAAK,CACb,sGAAsG;4BACpG,uFAAuF;4BACvF,4FAA4F;4BAC5F,4FAA4F;4BAC5F,8FAA8F;4BAC9F,oCAAoC,CACvC,CAAC;qBACH;;;;;CACF;AAfD,4CAeC"}

package/dist/src/routes/avatar.d.ts CHANGED Viewed

@@ -8,7 +8,10 @@ import { Route } from '@proteinjs/server-api';
  * System-read surface is exactly: the user row (for `avatarFileId`), that one file row (for the
  * Content-Type), and its bytes. The file id is never taken from the request — only the id stored
  * on the user row is served, so this can never read arbitrary files. `:userId` is a keyed lookup
- * (no path/filesystem interpretation).
+ * (no path/filesystem interpretation). Bytes come through the deliberately-unscoped DRIVER read:
+ * the route has already made its own access decision above, and the gated service read
+ * (`FileStorage.getFileData` — the caller's row-read as the byte-access check) would refuse every
+ * viewer but the avatar's owner.
  *
  * Cache contract (mirrored by `avatarRoute` in @proteinjs/user routes.ts): the path is stable per
  * user, so responses carry `max-age=86400, immutable`; clients bust with `?v=<avatarFileId>`,

package/dist/src/routes/avatar.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"avatar.d.ts","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQ9C~~;;;;;;;;;;;;;;;GAeG~~;AACH,eAAO,MAAM,MAAM,EAAE,KAgCpB,CAAC"}
1	+ {"version":3,"file":"avatar.d.ts","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAQ9C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,MAAM,EAAE,KAgCpB,CAAC"}

package/dist/src/routes/avatar.js CHANGED Viewed

@@ -51,7 +51,10 @@ var logger = new logger_1.Logger({ name: 'avatarRoute' });
  * System-read surface is exactly: the user row (for `avatarFileId`), that one file row (for the
  * Content-Type), and its bytes. The file id is never taken from the request — only the id stored
  * on the user row is served, so this can never read arbitrary files. `:userId` is a keyed lookup
- * (no path/filesystem interpretation).
+ * (no path/filesystem interpretation). Bytes come through the deliberately-unscoped DRIVER read:
+ * the route has already made its own access decision above, and the gated service read
+ * (`FileStorage.getFileData` — the caller's row-read as the byte-access check) would refuse every
+ * viewer but the avatar's owner.
  *
  * Cache contract (mirrored by `avatarRoute` in @proteinjs/user routes.ts): the path is stable per
  * user, so responses carry `max-age=86400, immutable`; clients bust with `?v=<avatarFileId>`,
@@ -88,7 +91,7 @@ exports.avatar = {
                         response.status(404).send('No avatar photo');
                         return [2 /*return*/];
                     }
-                    return [4 /*yield*/, new db_file_1.FileStorage().getFileData(file.id)];
+                    return [4 /*yield*/, db_file_1.FileStorage.getDriver().getFileData(file.id)];
                 case 4:
                     fileDataBase64 = _a.sent();
                     response.setHeader('Content-Type', file.type);

package/dist/src/routes/avatar.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"avatar.js","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAwE;AACxE,8CAA6E;AAC7E,4CAA2C;AAE3C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;AAEnD~~;;;;;;;;;;;;;;;GAeG~~;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBACjC,IAAI,CAAC,eAAQ,CAAC,UAAU,EAAE,EAAE;wBAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;wBAChD,sBAAO;qBACR;;;;oBAGO,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxB,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAA7D,IAAI,GAAG,SAAsD;oBACnE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;wBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,sBAAO;qBACR;oBAEY,qBAAM,IAAA,0BAAmB,GAAQ,CAAC,GAAG,CAAC,gBAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAA;;oBAAxF,IAAI,GAAG,SAAiF;oBAC9F,IAAI,CAAC,IAAI,EAAE;wBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,sBAAO;qBACR;oBAEsB,qBAAM,~~IAAI,~~qBAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;~~oBAA7D~~,cAAc,GAAG,~~SAA4C~~;~~oBACnE~~,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9C,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;;;;oBAErD,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBAC3D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;;;;;SAEtD;CACF,CAAC"}
1	+ {"version":3,"file":"avatar.js","sourceRoot":"","sources":["../../../src/routes/avatar.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oCAA8C;AAC9C,wCAAwE;AACxE,8CAA6E;AAC7E,4CAA2C;AAE3C,IAAM,MAAM,GAAG,IAAI,eAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;;;GAkBG;AACU,QAAA,MAAM,GAAU;IAC3B,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,KAAK;IACb,SAAS,EAAE,UAAO,OAAO,EAAE,QAAQ;;;;;oBACjC,IAAI,CAAC,eAAQ,CAAC,UAAU,EAAE,EAAE;wBAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;wBAChD,sBAAO;qBACR;;;;oBAGO,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxB,qBAAM,IAAA,kBAAa,GAAE,CAAC,GAAG,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAA7D,IAAI,GAAG,SAAsD;oBACnE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;wBAC/B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,sBAAO;qBACR;oBAEY,qBAAM,IAAA,0BAAmB,GAAQ,CAAC,GAAG,CAAC,gBAAU,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAA;;oBAAxF,IAAI,GAAG,SAAiF;oBAC9F,IAAI,CAAC,IAAI,EAAE;wBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;wBAC7C,sBAAO;qBACR;oBAEsB,qBAAM,qBAAW,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAnE,cAAc,GAAG,SAAkD;oBACzE,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC9C,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;;;;oBAErD,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,SAAA,EAAE,CAAC,CAAC;oBAC3D,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;;;;;SAEtD;CACF,CAAC"}

package/dist/test/DevLoginStaleCookieFirstHit.test.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=DevLoginStaleCookieFirstHit.test.d.ts.map

package/dist/test/DevLoginStaleCookieFirstHit.test.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"DevLoginStaleCookieFirstHit.test.d.ts","sourceRoot":"","sources":["../../test/DevLoginStaleCookieFirstHit.test.ts"],"names":[],"mappings":""}

package/dist/test/DevLoginStaleCookieFirstHit.test.js ADDED Viewed

@@ -0,0 +1,401 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var http_1 = __importDefault(require("http"));
+var express_session_1 = __importStar(require("express-session"));
+var passport_1 = __importDefault(require("passport"));
+var devLogin_1 = require("../src/routes/devLogin");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+/**
+ * DEV_SMOKE_OVERNIGHT (2026-08-26) finding 7: a browser holding a STALE session cookie (a sid
+ * absent from the store — prior server generation, swept row, or reseeded dev db) hits
+ * `GET /dev/login`, gets the 302, and lands on the LOGIN FORM; the second hit lands home.
+ *
+ * The mechanism is write-ordering at the session-establishment seam: a browser follows a redirect
+ * the moment RESPONSE HEADERS arrive — it never waits for the body. So the session row for the
+ * sid named by the 302's Set-Cookie must be COMMITTED to the store before those headers flush.
+ * passport 0.6's `request.login` guarantees exactly that (regenerate → bind → save, committed
+ * before the login callback — see establishSession); under a pre-0.6 passport runtime the save
+ * is deferred to express-session's end-of-response proxy, whose split-response write flushes the
+ * 302's headers BEFORE the store write commits — the redirected navigation races the commit and
+ * loses, reads no session, and the SPA routes to /login.
+ *
+ * This suite drives the REAL stack a browser meets — express-session 1.17.1 (the exact
+ * @proteinjs/server configureSession options and dev cookie-name shape) + real passport +
+ * the devLogin route — against a store with honest commit latency, and asserts the contract
+ * from the client's side: follow the 302 the instant headers arrive, carrying exactly the
+ * cookies the response set, and the follow-up MUST read as authenticated on the FIRST pass.
+ */
+var SESSION_COOKIE_NAME = 'n3xa.sid.9876'; // dev cookie-name shape: n3xa.sid.${SERVER_PORT}
+var SESSION_SECRET = 'dev-first-hit-test-secret';
+var ENV_EMAIL = 'dev@test.local';
+/** Store commit latency. Generous so a pre-0.6 runtime (write racing the redirect) loses the
+ *  race DETERMINISTICALLY; under the passport 0.6 contract the row commits before the redirect
+ *  is even issued, so green never depends on this number. */
+var COMMIT_LATENCY_MS = 150;
+var READ_LATENCY_MS = 5;
+/**
+ * In-memory session store with DbSessionStore's contract: callbacks fire only after the
+ * operation commits, and commits take real time (Spanner in dev). Rows are inspectable so the
+ * test can assert store truth directly and clear it to model a next server generation.
+ */
+var CommitLatencySessionStore = /** @class */ (function (_super) {
+    __extends(CommitLatencySessionStore, _super);
+    function CommitLatencySessionStore() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.rows = new Map();
+        _this.get = function (sessionId, cb) {
+            var timer = setTimeout(function () {
+                var row = _this.rows.get(sessionId);
+                cb(null, row ? JSON.parse(row) : undefined);
+            }, READ_LATENCY_MS);
+            timer.unref();
+        };
+        _this.set = function (sessionId, session, cb) {
+            var timer = setTimeout(function () {
+                _this.rows.set(sessionId, JSON.stringify(session));
+                if (cb) {
+                    cb();
+                }
+            }, COMMIT_LATENCY_MS);
+            timer.unref();
+        };
+        _this.destroy = function (sessionId, cb) {
+            var timer = setTimeout(function () {
+                _this.rows.delete(sessionId);
+                if (cb) {
+                    cb();
+                }
+            }, READ_LATENCY_MS);
+            timer.unref();
+        };
+        return _this;
+    }
+    return CommitLatencySessionStore;
+}(express_session_1.Store));
+describe('devLogin first hit through the real session middleware stack', function () {
+    var originalEnv = {
+        DEVELOPMENT: process.env.DEVELOPMENT,
+        DEV_AUTO_LOGIN_EMAIL: process.env.DEV_AUTO_LOGIN_EMAIL,
+    };
+    var store = new CommitLatencySessionStore();
+    var server;
+    var port;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Dev Default', email: ENV_EMAIL })];
+                case 2:
+                    _a.sent();
+                    server = createServerWithRealSessionStack(store);
+                    return [4 /*yield*/, new Promise(function (resolve) { return server.listen(0, resolve); })];
+                case 3:
+                    _a.sent();
+                    port = server.address().port;
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, new Promise(function (resolve, reject) { return server.close(function (error) { return (error ? reject(error) : resolve()); }); })];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    beforeEach(function () {
+        process.env.DEVELOPMENT = 'true';
+        process.env.DEV_AUTO_LOGIN_EMAIL = ENV_EMAIL;
+    });
+    afterEach(function () {
+        for (var _i = 0, _a = Object.entries(originalEnv); _i < _a.length; _i++) {
+            var _b = _a[_i], key = _b[0], value = _b[1];
+            if (value === undefined) {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        }
+    });
+    it('stale-cookie first hit: following the 302 on HEADERS reads as authenticated, first pass', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var priorHit, staleCookie, firstHit, followUpCookie, followUp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, request(port, '/dev/login', { waitForBody: true })];
+                case 1:
+                    priorHit = _a.sent();
+                    staleCookie = sessionCookiePair(priorHit);
+                    store.rows.clear();
+                    return [4 /*yield*/, request(port, '/dev/login', { cookie: staleCookie })];
+                case 2:
+                    firstHit = _a.sent();
+                    expect(firstHit.statusCode).toBe(302);
+                    expect(firstHit.headers.location).toBe('/');
+                    followUpCookie = sessionCookiePair(firstHit);
+                    expect(sidOf(followUpCookie)).not.toBe(sidOf(staleCookie));
+                    return [4 /*yield*/, request(port, '/whoami', { cookie: followUpCookie, waitForBody: true })];
+                case 3:
+                    followUp = _a.sent();
+                    expect(JSON.parse(followUp.body)).toEqual({ user: ENV_EMAIL });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('cookieless first hit: same first-pass guarantee for a fresh browser', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var firstHit, followUp;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    store.rows.clear();
+                    return [4 /*yield*/, request(port, '/dev/login')];
+                case 1:
+                    firstHit = _a.sent();
+                    expect(firstHit.statusCode).toBe(302);
+                    return [4 /*yield*/, request(port, '/whoami', { cookie: sessionCookiePair(firstHit), waitForBody: true })];
+                case 2:
+                    followUp = _a.sent();
+                    expect(JSON.parse(followUp.body)).toEqual({ user: ENV_EMAIL });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+/**
+ * The real middleware stack a request traverses in front of the route — express-session with
+ * @proteinjs/server configureSession's exact options (resave: false, saveUninitialized: false,
+ * rolling: true, the dev port-scoped cookie name) + passport initialize/session with the
+ * identity (de)serialization @proteinjs/server registers — on a raw node http server, so
+ * header-flush timing is the genuine article.
+ */
+function createServerWithRealSessionStack(store) {
+    var sixtyDays = 1000 * 60 * 60 * 24 * 60;
+    var sessionMiddleware = (0, express_session_1.default)({
+        name: SESSION_COOKIE_NAME,
+        secret: SESSION_SECRET,
+        store: store,
+        resave: false,
+        saveUninitialized: false,
+        cookie: { maxAge: sixtyDays },
+        rolling: true,
+    });
+    var authenticator = new passport_1.default.Passport();
+    authenticator.serializeUser(function (user, done) { return done(null, user); });
+    authenticator.deserializeUser(function (id, done) { return done(null, id); });
+    var middleware = [
+        sessionMiddleware,
+        authenticator.initialize(),
+        authenticator.session(),
+    ];
+    return http_1.default.createServer(function (req, res) {
+        runMiddleware(middleware, req, res, function (error) {
+            if (error) {
+                res.statusCode = 500;
+                res.end(String(error));
+                return;
+            }
+            void dispatch(req, res);
+        });
+    });
+}
+function runMiddleware(middleware, req, res, done) {
+    var next = function (index) { return function (error) {
+        if (error || index >= middleware.length) {
+            done(error);
+            return;
+        }
+        middleware[index](req, res, next(index + 1));
+    }; };
+    next(0)();
+}
+function dispatch(req, res) {
+    var _a, _b, _c;
+    return __awaiter(this, void 0, void 0, function () {
+        var url, request_1, query_1, error_1, session;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    url = new URL((_a = req.url) !== null && _a !== void 0 ? _a : '/', 'http://localhost');
+                    if (!(url.pathname === '/dev/login')) return [3 /*break*/, 5];
+                    request_1 = req;
+                    query_1 = {};
+                    url.searchParams.forEach(function (value, key) { return (query_1[key] = value); });
+                    request_1.query = query_1;
+                    _d.label = 1;
+                case 1:
+                    _d.trys.push([1, 3, , 4]);
+                    return [4 /*yield*/, devLogin_1.devLogin.onRequest(req, expressResponseShim(res))];
+                case 2:
+                    _d.sent();
+                    return [3 /*break*/, 4];
+                case 3:
+                    error_1 = _d.sent();
+                    // Mirrors @proteinjs/server's wrapRoute: a route throw is caught and logged, never a
+                    // hung response. (There it falls through to the star route; here we end with 500.)
+                    console.error(error_1);
+                    if (!res.writableEnded) {
+                        res.statusCode = 500;
+                        res.end();
+                    }
+                    return [3 /*break*/, 4];
+                case 4: return [2 /*return*/];
+                case 5:
+                    if (url.pathname === '/whoami') {
+                        session = req.session;
+                        res.setHeader('Content-Type', 'application/json');
+                        res.end(JSON.stringify({ user: (_c = (_b = session === null || session === void 0 ? void 0 : session.passport) === null || _b === void 0 ? void 0 : _b.user) !== null && _c !== void 0 ? _c : null }));
+                        return [2 /*return*/];
+                    }
+                    res.statusCode = 404;
+                    res.end();
+                    return [2 /*return*/];
+            }
+        });
+    });
+}
+/** The express response surface devLogin touches, over the RAW response object — so
+ *  express-session's proxied `res.end` (the commit point under test) is the one that runs. */
+function expressResponseShim(res) {
+    var shim = {
+        status: function (code) {
+            res.statusCode = code;
+            return shim;
+        },
+        send: function (body) {
+            res.end(body === undefined ? undefined : String(body));
+        },
+        redirect: function (path) {
+            var body = "Found. Redirecting to ".concat(path);
+            res.statusCode = 302;
+            res.setHeader('Location', path);
+            res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+            res.setHeader('Content-Length', Buffer.byteLength(body));
+            res.end(body);
+        },
+    };
+    return shim;
+}
+/**
+ * GET `path`. By default resolves the moment response HEADERS arrive (browser-following-a-
+ * redirect semantics — the body may still be in flight and its socket is left to drain);
+ * `waitForBody` resolves after the full body, which with express-session's end proxy also
+ * means the response's session write has committed.
+ */
+function request(port, path, options) {
+    if (options === void 0) { options = {}; }
+    return new Promise(function (resolve, reject) {
+        var clientRequest = http_1.default.get({ port: port, path: path, headers: options.cookie ? { cookie: options.cookie } : {}, agent: false }, function (res) {
+            if (!options.waitForBody) {
+                resolve({ statusCode: res.statusCode, headers: res.headers });
+                res.resume();
+                return;
+            }
+            var body = '';
+            res.on('data', function (chunk) { return (body += chunk); });
+            res.on('end', function () { return resolve({ statusCode: res.statusCode, headers: res.headers, body: body }); });
+        });
+        clientRequest.on('error', reject);
+    });
+}
+/** The `name=value` pair of the response's session Set-Cookie — what the browser sends back. */
+function sessionCookiePair(response) {
+    var _a;
+    var setCookies = (_a = response.headers['set-cookie']) !== null && _a !== void 0 ? _a : [];
+    var sessionCookie = setCookies.find(function (cookie) { return cookie.startsWith("".concat(SESSION_COOKIE_NAME, "=")); });
+    if (!sessionCookie) {
+        throw new Error("response set no ".concat(SESSION_COOKIE_NAME, " cookie (Set-Cookie: ").concat(JSON.stringify(setCookies), ")"));
+    }
+    return sessionCookie.split(';')[0];
+}
+/** The raw sid inside a signed session cookie pair (`name=s%3A<sid>.<signature>`). */
+function sidOf(cookiePair) {
+    var value = decodeURIComponent(cookiePair.slice(cookiePair.indexOf('=') + 1));
+    return value.startsWith('s:') ? value.slice(2, value.indexOf('.')) : value;
+}
+//# sourceMappingURL=DevLoginStaleCookieFirstHit.test.js.map

package/dist/test/DevLoginStaleCookieFirstHit.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"DevLoginStaleCookieFirstHit.test.js","sourceRoot":"","sources":["../../test/DevLoginStaleCookieFirstHit.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,8CAAwB;AAExB,iEAAwD;AACxD,sDAAgC;AAChC,mDAAkD;AAClD,yEAAwE;AAExE,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,IAAM,mBAAmB,GAAG,eAAe,CAAC,CAAC,iDAAiD;AAC9F,IAAM,cAAc,GAAG,2BAA2B,CAAC;AACnD,IAAM,SAAS,GAAG,gBAAgB,CAAC;AACnC;;6DAE6D;AAC7D,IAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,IAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;GAIG;AACH;IAAwC,6CAAK;IAA7C;QAAA,qEA8BC;QA7BU,UAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE1C,SAAG,GAAG,UAAC,SAAiB,EAAE,EAAkE;YAC1F,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,IAAM,GAAG,GAAG,KAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACrC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,SAAG,GAAG,UAAC,SAAiB,EAAE,OAA4B,EAAE,EAA8B;YACpF,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,KAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,IAAI,EAAE,EAAE;oBACN,EAAE,EAAE,CAAC;iBACN;YACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACtB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;QAEF,aAAO,GAAG,UAAC,SAAiB,EAAE,EAA8B;YAC1D,IAAM,KAAK,GAAG,UAAU,CAAC;gBACvB,KAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC5B,IAAI,EAAE,EAAE;oBACN,EAAE,EAAE,CAAC;iBACN;YACH,CAAC,EAAE,eAAe,CAAC,CAAC;YACpB,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC;;IACJ,CAAC;IAAD,gCAAC;AAAD,CAAC,AA9BD,CAAwC,uBAAK,GA8B5C;AAMD,QAAQ,CAAC,8DAA8D,EAAE;IACvE,IAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;QACpC,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;KACvD,CAAC;IACF,IAAM,KAAK,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC9C,IAAI,MAAmB,CAAC;IACxB,IAAI,IAAY,CAAC;IAEjB,SAAS,CAAC;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAA;;oBAAnE,SAAmE,CAAC;oBACpE,MAAM,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;oBACjD,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,IAAK,OAAA,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,EAAzB,CAAyB,CAAC,EAAA;;oBAA/D,SAA+D,CAAC;oBAChE,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;;;;SAC/C,CAAC,CAAC;IAEH,QAAQ,CAAC;;;wBACP,qBAAM,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM,IAAK,OAAA,MAAM,CAAC,KAAK,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAnC,CAAmC,CAAC,EAA5D,CAA4D,CAAC,EAAA;;oBAA1G,SAA0G,CAAC;oBAC3G,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,CAAC,CAAC;IAEH,UAAU,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC;QACR,KAA2B,UAA2B,EAA3B,KAAA,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAA3B,cAA2B,EAA3B,IAA2B,EAAE;YAA7C,IAAA,WAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YACpB,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACzB;iBAAM;gBACL,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;aAC1B;SACF;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE;;;;wBAG3E,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAAnE,QAAQ,GAAG,SAAwD;oBACnE,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBAChD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAIF,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAA;;oBAArE,QAAQ,GAAG,SAA0D;oBAC3E,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAGtC,cAAc,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;oBACnD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;oBAI1C,qBAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAAxF,QAAQ,GAAG,SAA6E;oBAC9F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;;;;SACjE,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE;;;;;oBACxE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;oBAEF,qBAAM,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAAA;;oBAA5C,QAAQ,GAAG,SAAiC;oBAClD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAErB,qBAAM,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAA;;oBAArG,QAAQ,GAAG,SAA0F;oBAC3G,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;;;;SACjE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,KAAY;IACpD,IAAM,SAAS,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3C,IAAM,iBAAiB,GAAG,IAAA,yBAAc,EAAC;QACvC,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,cAAc;QACtB,KAAK,OAAA;QACL,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,KAAK;QACxB,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC7B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAM,aAAa,GAAG,IAAI,kBAAQ,CAAC,QAAQ,EAAE,CAAC;IAC9C,aAAa,CAAC,aAAa,CAAC,UAAC,IAAa,EAAE,IAA0C,IAAK,OAAA,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAhB,CAAgB,CAAC,CAAC;IAC7G,aAAa,CAAC,eAAe,CAAC,UAAC,EAAW,EAAE,IAA4C,IAAK,OAAA,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAd,CAAc,CAAC,CAAC;IAC7G,IAAM,UAAU,GAAiB;QAC/B,iBAA0C;QAC1C,aAAa,CAAC,UAAU,EAA2B;QACnD,aAAa,CAAC,OAAO,EAA2B;KACjD,CAAC;IAEF,OAAO,cAAI,CAAC,YAAY,CAAC,UAAC,GAAG,EAAE,GAAG;QAChC,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,UAAC,KAAe;YAClD,IAAI,KAAK,EAAE;gBACT,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvB,OAAO;aACR;YACD,KAAK,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,UAAwB,EACxB,GAAyB,EACzB,GAAwB,EACxB,IAA+B;IAE/B,IAAM,IAAI,GAAG,UAAC,KAAa,IAAK,OAAA,UAAC,KAAe;QAC9C,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE;YACvC,IAAI,CAAC,KAAK,CAAC,CAAC;YACZ,OAAO;SACR;QACD,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,EAN+B,CAM/B,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACZ,CAAC;AAED,SAAe,QAAQ,CAAC,GAAyB,EAAE,GAAwB;;;;;;;oBACnE,GAAG,GAAG,IAAI,GAAG,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;yBACpD,CAAA,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA,EAA7B,wBAA6B;oBACzB,YAAU,GAAuC,CAAC;oBAClD,UAAgC,EAAE,CAAC;oBACzC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,UAAC,KAAK,EAAE,GAAG,IAAK,OAAA,CAAC,OAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAApB,CAAoB,CAAC,CAAC;oBAC/D,SAAO,CAAC,KAAK,GAAG,OAAK,CAAC;;;;oBAEpB,qBAAM,mBAAQ,CAAC,SAAS,CAAC,GAAY,EAAE,mBAAmB,CAAC,GAAG,CAAU,CAAC,EAAA;;oBAAzE,SAAyE,CAAC;;;;oBAE1E,qFAAqF;oBACrF,mFAAmF;oBACnF,OAAO,CAAC,KAAK,CAAC,OAAK,CAAC,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE;wBACtB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;wBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;qBACX;;wBAEH,sBAAO;;oBAET,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE;wBAExB,OAAO,GAAI,GAA+D,CAAC,OAAO,CAAC;wBACzF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;wBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,IAAI,mCAAI,IAAI,EAAE,CAAC,CAAC,CAAC;wBACnE,sBAAO;qBACR;oBACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,EAAE,CAAC;;;;;CACX;AAED;8FAC8F;AAC9F,SAAS,mBAAmB,CAAC,GAAwB;IACnD,IAAM,IAAI,GAAG;QACX,MAAM,YAAC,IAAY;YACjB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,YAAC,IAAc;YACjB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,QAAQ,YAAC,IAAY;YACnB,IAAM,IAAI,GAAG,gCAAyB,IAAI,CAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;YAC3D,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CACd,IAAY,EACZ,IAAY,EACZ,OAAwD;IAAxD,wBAAA,EAAA,YAAwD;IAExD,OAAO,IAAI,OAAO,CAAC,UAAC,OAAO,EAAE,MAAM;QACjC,IAAM,aAAa,GAAG,cAAI,CAAC,GAAG,CAC5B,EAAE,IAAI,MAAA,EAAE,IAAI,MAAA,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EACvF,UAAC,GAAG;YACF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBACxB,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9D,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO;aACR;YACD,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,UAAC,KAAK,IAAK,OAAA,CAAC,IAAI,IAAI,KAAK,CAAC,EAAf,CAAe,CAAC,CAAC;YAC3C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,cAAM,OAAA,OAAO,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,MAAA,EAAE,CAAC,EAAnE,CAAmE,CAAC,CAAC;QAC3F,CAAC,CACF,CAAC;QACF,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,QAAwB;;IACjD,IAAM,UAAU,GAAG,MAAA,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,mCAAI,EAAE,CAAC;IACxD,IAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,UAAU,CAAC,UAAG,mBAAmB,MAAG,CAAC,EAA5C,CAA4C,CAAC,CAAC;IAChG,IAAI,CAAC,aAAa,EAAE;QAClB,MAAM,IAAI,KAAK,CAAC,0BAAmB,mBAAmB,kCAAwB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAG,CAAC,CAAC;KAC9G;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,sFAAsF;AACtF,SAAS,KAAK,CAAC,UAAkB;IAC/B,IAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC"}

package/dist/test/EstablishSessionRuntimeContract.test.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=EstablishSessionRuntimeContract.test.d.ts.map

package/dist/test/EstablishSessionRuntimeContract.test.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"EstablishSessionRuntimeContract.test.d.ts","sourceRoot":"","sources":["../../test/EstablishSessionRuntimeContract.test.ts"],"names":[],"mappings":""}