@pureq/auth 0.2.0

package/dist/revocation/index.js

@@ -0,0 +1,182 @@
+import { markPolicyMiddleware } from "@pureq/pureq";
+import { createAuthError } from "../shared";
+function isExpired(expiresAt, now) {
+    return expiresAt !== null && expiresAt <= now;
+}
+function clearBucket(bucket, now) {
+    for (const [key, expiresAt] of bucket) {
+        if (isExpired(expiresAt, now)) {
+            bucket.delete(key);
+        }
+    }
+}
+/** SEC-H3: In-memory revocation registry backend. */
+function createInMemoryBackend() {
+    const buckets = new Map();
+    const getBucket = (name) => {
+        let bucket = buckets.get(name);
+        if (!bucket) {
+            bucket = new Map();
+            buckets.set(name, bucket);
+        }
+        return bucket;
+    };
+    return {
+        set(bucket, key, expiresAt) {
+            getBucket(bucket).set(key, expiresAt);
+        },
+        has(bucket, key) {
+            const b = buckets.get(bucket);
+            if (!b) {
+                return false;
+            }
+            const expiresAt = b.get(key);
+            if (expiresAt === undefined) {
+                return false;
+            }
+            if (isExpired(expiresAt, Date.now())) {
+                b.delete(key);
+                return false;
+            }
+            return true;
+        },
+        delete(bucket, key) {
+            buckets.get(bucket)?.delete(key);
+        },
+        clear(bucket) {
+            buckets.get(bucket)?.clear();
+        },
+        keys(bucket) {
+            return Array.from(buckets.get(bucket)?.keys() ?? []);
+        },
+    };
+}
+/**
+ * Create a revocation registry.
+ * SEC-H3: Accepts an optional pluggable backend for distributed deployments (Redis, DB, etc.).
+ * Default is in-memory.
+ */
+export function createAuthRevocationRegistry(backend) {
+    // When using custom backend, delegate fully
+    if (backend) {
+        return {
+            revokeToken(tokenId, expiresAt) {
+                void backend.set("tokens", tokenId, expiresAt ?? null);
+            },
+            revokeSession(sessionId, expiresAt) {
+                void backend.set("sessions", sessionId, expiresAt ?? null);
+            },
+            revokeSubject(subject, expiresAt) {
+                void backend.set("subjects", subject, expiresAt ?? null);
+            },
+            isRevoked(claims) {
+                const tokenRevoked = claims.jti ? backend.has("tokens", claims.jti) : false;
+                const sessionRevoked = claims.sid ? backend.has("sessions", claims.sid) : false;
+                const subjectRevoked = claims.sub ? backend.has("subjects", claims.sub) : false;
+                // Handle both sync and async backends — sync for backward compat
+                if (typeof tokenRevoked === "boolean") {
+                    return tokenRevoked || sessionRevoked || subjectRevoked;
+                }
+                // For async backends, callers must check promises. Sync path only for in-memory.
+                return false;
+            },
+            clearExpired() {
+                // delegated to backend implementation
+            },
+            clear() {
+                void backend.clear("tokens");
+                void backend.clear("sessions");
+                void backend.clear("subjects");
+            },
+            snapshot() {
+                const tokens = backend.keys("tokens");
+                const sessions = backend.keys("sessions");
+                const subjects = backend.keys("subjects");
+                return {
+                    tokens: Array.isArray(tokens) ? tokens : [],
+                    sessions: Array.isArray(sessions) ? sessions : [],
+                    subjects: Array.isArray(subjects) ? subjects : [],
+                };
+            },
+        };
+    }
+    // Default in-memory implementation
+    const tokens = new Map();
+    const sessions = new Map();
+    const subjects = new Map();
+    const revoke = (bucket, key, expiresAt) => {
+        bucket.set(key, expiresAt ?? null);
+    };
+    const isBucketRevoked = (bucket, key, now) => {
+        if (!key) {
+            return false;
+        }
+        const expiresAt = bucket.get(key);
+        if (expiresAt === undefined) {
+            return false;
+        }
+        if (isExpired(expiresAt, now)) {
+            bucket.delete(key);
+            return false;
+        }
+        return true;
+    };
+    return {
+        revokeToken(tokenId, expiresAt) {
+            revoke(tokens, tokenId, expiresAt);
+        },
+        revokeSession(sessionId, expiresAt) {
+            revoke(sessions, sessionId, expiresAt);
+        },
+        revokeSubject(subject, expiresAt) {
+            revoke(subjects, subject, expiresAt);
+        },
+        isRevoked(claims) {
+            const now = Date.now();
+            clearBucket(tokens, now);
+            clearBucket(sessions, now);
+            clearBucket(subjects, now);
+            return (isBucketRevoked(tokens, claims.jti, now) ||
+                isBucketRevoked(sessions, claims.sid, now) ||
+                isBucketRevoked(subjects, claims.sub, now));
+        },
+        clearExpired(now = Date.now()) {
+            clearBucket(tokens, now);
+            clearBucket(sessions, now);
+            clearBucket(subjects, now);
+        },
+        clear() {
+            tokens.clear();
+            sessions.clear();
+            subjects.clear();
+        },
+        snapshot() {
+            return {
+                tokens: Array.from(tokens.keys()),
+                sessions: Array.from(sessions.keys()),
+                subjects: Array.from(subjects.keys()),
+            };
+        },
+    };
+}
+export function withRevocationGuard(options) {
+    const middleware = async (req, next) => {
+        const claims = await options.getClaims(req);
+        if (!claims) {
+            return next(req);
+        }
+        if (options.registry.isRevoked(claims)) {
+            await options.onRevoked?.(claims);
+            throw createAuthError("PUREQ_AUTH_REVOKED", "pureq: token or session has been revoked", {
+                details: {
+                    ...(claims.jti !== undefined ? { jti: claims.jti } : {}),
+                    ...(claims.sid !== undefined ? { sid: claims.sid } : {}),
+                    ...(claims.sub !== undefined ? { sub: claims.sub } : {}),
+                },
+            });
+        }
+        return next(req);
+    };
+    return markPolicyMiddleware(middleware, { name: "revocationGuard", kind: "auth" });
+}
+//# sourceMappingURL=index.js.map

package/dist/revocation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/revocation/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAOpD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAI5C,SAAS,SAAS,CAAC,SAAwB,EAAE,GAAW;IACtD,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,MAAwB,EAAE,GAAW;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEpD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAoB,EAAE;QACnD,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS;YACxB,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,GAAG;YACb,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBACrC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,GAAG;YAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,MAAM;YACT,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAuC;IAClF,4CAA4C;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,WAAW,CAAC,OAAO,EAAE,SAAS;gBAC5B,KAAK,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;YACzD,CAAC;YACD,aAAa,CAAC,SAAS,EAAE,SAAS;gBAChC,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;YAC7D,CAAC;YACD,aAAa,CAAC,OAAO,EAAE,SAAS;gBAC9B,KAAK,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS,CAAC,MAAM;gBACd,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC5E,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAChF,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAChF,iEAAiE;gBACjE,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;oBACtC,OAAO,YAAY,IAAK,cAA0B,IAAK,cAA0B,CAAC;gBACpF,CAAC;gBACD,iFAAiF;gBACjF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,YAAY;gBACV,sCAAsC;YACxC,CAAC;YACD,KAAK;gBACH,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC7B,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC/B,KAAK,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YACD,QAAQ;gBACN,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC1C,OAAO;oBACL,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;oBAC3C,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBACjD,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;iBAClD,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IAED,mCAAmC;IACnC,MAAM,MAAM,GAAqB,IAAI,GAAG,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAqB,IAAI,GAAG,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAqB,IAAI,GAAG,EAAE,CAAC;IAE7C,MAAM,MAAM,GAAG,CAAC,MAAwB,EAAE,GAAW,EAAE,SAAkB,EAAQ,EAAE;QACjF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,MAAwB,EAAE,GAAuB,EAAE,GAAW,EAAW,EAAE;QAClG,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,WAAW,CAAC,OAAe,EAAE,SAAkB;YAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,aAAa,CAAC,SAAiB,EAAE,SAAkB;YACjD,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,aAAa,CAAC,OAAe,EAAE,SAAkB;YAC/C,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;QAED,SAAS,CAAC,MAAsC;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzB,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3B,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAE3B,OAAO,CACL,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;gBACxC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;gBAC1C,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAC3C,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAC3B,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACzB,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC3B,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK;YACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,QAAQ;YACN,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACrC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;aACtC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,UAAU,GAAe,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,eAAe,CAAC,oBAAoB,EAAE,0CAA0C,EAAE;gBACtF,OAAO,EAAE;oBACP,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,oBAAoB,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/session/exporters.d.ts

@@ -0,0 +1,15 @@
+import type { AuthSessionEvent, AuthSessionEventAudit } from "../shared";
+export interface SessionEventExporterOptions {
+    readonly sink: (events: readonly AuthSessionEvent[]) => void | Promise<void>;
+    readonly flushSize?: number;
+}
+export interface SessionEventBufferedExporter {
+    readonly auditEvent: AuthSessionEventAudit;
+    snapshot(): readonly AuthSessionEvent[];
+    flush(): Promise<void>;
+    clear(): void;
+}
+export declare function composeSessionEventAudits(...audits: readonly AuthSessionEventAudit[]): AuthSessionEventAudit;
+export declare function createConsoleSessionEventAudit(logger?: Pick<Console, "info">): AuthSessionEventAudit;
+export declare function createBufferedSessionEventExporter(options: SessionEventExporterOptions): SessionEventBufferedExporter;
+//# sourceMappingURL=exporters.d.ts.map

package/dist/session/exporters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exporters.d.ts","sourceRoot":"","sources":["../../src/session/exporters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,IAAI,SAAS,gBAAgB,EAAE,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,yBAAyB,CAAC,GAAG,MAAM,EAAE,SAAS,qBAAqB,EAAE,GAAG,qBAAqB,CAM5G;AAED,wBAAgB,8BAA8B,CAAC,MAAM,GAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAW,GAAG,qBAAqB,CAU7G;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,2BAA2B,GACnC,4BAA4B,CAmD9B"}

package/dist/session/exporters.js

@@ -0,0 +1,62 @@
+export function composeSessionEventAudits(...audits) {
+    return async (event) => {
+        for (const audit of audits) {
+            await audit(event);
+        }
+    };
+}
+export function createConsoleSessionEventAudit(logger = console) {
+    return (event) => {
+        logger.info("[pureq/auth/session]", {
+            type: event.type,
+            source: event.source,
+            at: event.at,
+            ...(event.reason !== undefined ? { reason: event.reason } : {}),
+            ...(event.errorMessage !== undefined ? { errorMessage: event.errorMessage } : {}),
+        });
+    };
+}
+export function createBufferedSessionEventExporter(options) {
+    if (!options || typeof options.sink !== "function") {
+        throw new Error("pureq: session event exporter requires a sink function");
+    }
+    const flushSize = options.flushSize ?? 20;
+    if (!Number.isInteger(flushSize) || flushSize < 1) {
+        throw new Error("pureq: session event exporter flushSize must be a positive integer");
+    }
+    const buffer = [];
+    let flushing = null;
+    const flush = async () => {
+        if (buffer.length === 0) {
+            return;
+        }
+        const events = buffer.splice(0, buffer.length);
+        await options.sink(events);
+    };
+    const flushSerial = async () => {
+        if (!flushing) {
+            flushing = flush().finally(() => {
+                flushing = null;
+            });
+        }
+        await flushing;
+    };
+    return {
+        auditEvent(event) {
+            buffer.push(event);
+            if (buffer.length >= flushSize) {
+                void flushSerial();
+            }
+        },
+        snapshot() {
+            return buffer.slice();
+        },
+        async flush() {
+            await flushSerial();
+        },
+        clear() {
+            buffer.splice(0, buffer.length);
+        },
+    };
+}
+//# sourceMappingURL=exporters.js.map

package/dist/session/exporters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exporters.js","sourceRoot":"","sources":["../../src/session/exporters.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,yBAAyB,CAAC,GAAG,MAAwC;IACnF,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,SAAgC,OAAO;IACpF,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAoC;IAEpC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,QAAQ,GAAyB,IAAI,CAAC;IAE1C,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC9B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,KAAK;YACd,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,KAAK,WAAW,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,QAAQ;YACN,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,WAAW,EAAE,CAAC;QACtB,CAAC;QAED,KAAK;YACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/session/index.d.ts

@@ -0,0 +1,11 @@
+import type { AuthSessionManager, AuthSessionManagerOptions, AuthStore } from "../shared";
+/**
+ * Create a session manager with token storage, event broadcasting, and lifecycle management.
+ *
+ * Includes: refresh deduplication, rate limiting (SEC-M3), session regeneration (SEC-M1),
+ * sliding window (FEAT-M10), idle timeout (FEAT-L5), signed broadcast (SEC-H7).
+ */
+export declare function createAuthSessionManager(storage: AuthStore, options?: AuthSessionManagerOptions): AuthSessionManager;
+export { composeSessionEventAudits, createConsoleSessionEventAudit, createBufferedSessionEventExporter, } from "./exporters";
+export type { SessionEventBufferedExporter, SessionEventExporterOptions } from "./exporters";
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,kBAAkB,EAClB,yBAAyB,EAEzB,SAAS,EAGV,MAAM,WAAW,CAAC;AAoHnB;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,EAClB,OAAO,GAAE,yBAA8B,GACtC,kBAAkB,CAiRpB;AAED,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,324 @@
+import { decodeJwt } from "../jwt";
+function tokenExpiresAt(token) {
+    if (!token) {
+        return undefined;
+    }
+    try {
+        const claims = decodeJwt(token);
+        if (typeof claims.exp !== "number") {
+            return undefined;
+        }
+        return claims.exp * 1000;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readState(storage) {
+    const accessToken = await storage.get();
+    const refreshToken = await storage.getRefresh();
+    const expiresAt = tokenExpiresAt(accessToken);
+    return {
+        accessToken,
+        refreshToken,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+    };
+}
+async function rotateTokensInternal(storage, tokens, policy) {
+    await storage.set(tokens.accessToken);
+    if (tokens.refreshToken !== undefined) {
+        await storage.setRefresh(tokens.refreshToken);
+        return readState(storage);
+    }
+    if (policy === "clear-refresh-token") {
+        await storage.clearRefresh();
+        return readState(storage);
+    }
+    if (policy === "require-refresh-token") {
+        const existing = await storage.getRefresh();
+        if (!existing) {
+            throw new Error("pureq: refresh token is required by rotation policy");
+        }
+    }
+    return readState(storage);
+}
+/** SEC-H7: HMAC-based broadcast message signing. */
+async function signMessage(payload, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(payload));
+    const arr = new Uint8Array(sig);
+    let result = "";
+    for (const byte of arr) {
+        result += byte.toString(16).padStart(2, "0");
+    }
+    return result;
+}
+async function verifySignature(payload, signature, secret) {
+    const expected = await signMessage(payload, secret);
+    // constant length comparison
+    if (expected.length !== signature.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < expected.length; i++) {
+        diff |= expected.charCodeAt(i) ^ signature.charCodeAt(i);
+    }
+    return diff === 0;
+}
+/**
+ * Create a session manager with token storage, event broadcasting, and lifecycle management.
+ *
+ * Includes: refresh deduplication, rate limiting (SEC-M3), session regeneration (SEC-M1),
+ * sliding window (FEAT-M10), idle timeout (FEAT-L5), signed broadcast (SEC-H7).
+ */
+export function createAuthSessionManager(storage, options = {}) {
+    let disposed = false;
+    let refreshLock = null;
+    let lastRefreshAt = 0;
+    let lastAccessAt = Date.now();
+    const rotationPolicy = options.rotationPolicy ?? "preserve-refresh-token";
+    const listeners = new Set();
+    const channelName = options.broadcastChannel ?? "pureq:auth:session";
+    const channel = typeof BroadcastChannel === "function" ? new BroadcastChannel(channelName) : null;
+    const auditEvent = options.auditEvent;
+    const exporter = options.exporter;
+    const instanceId = options.instanceId ?? `session-${Math.random().toString(16).slice(2)}`;
+    const minRefreshIntervalMs = options.minRefreshIntervalMs ?? 10000;
+    const slidingWindowMs = options.slidingWindowMs;
+    const idleTimeoutMs = options.idleTimeoutMs;
+    // SEC-H7: broadcast secret for HMAC signing
+    const broadcastSecret = options.broadcastSecret ?? `pureq-bc-${instanceId}-${Math.random().toString(36).slice(2)}`;
+    const assertActive = () => {
+        if (disposed) {
+            throw new Error("pureq: session manager has been disposed");
+        }
+    };
+    const notify = (event) => {
+        void auditEvent?.(event);
+        void exporter?.export(event);
+        for (const listener of listeners) {
+            void listener(event);
+        }
+    };
+    const broadcast = async (message) => {
+        if (!channel) {
+            return;
+        }
+        const payload = JSON.stringify(message);
+        const sig = await signMessage(payload, broadcastSecret);
+        try {
+            channel.postMessage({
+                ...message,
+                from: instanceId,
+                sig,
+            });
+        }
+        catch {
+            // Ignore post-dispose async broadcasts.
+        }
+    };
+    if (channel) {
+        channel.onmessage = (event) => {
+            const message = event.data;
+            if (!message || typeof message !== "object") {
+                return;
+            }
+            if (message.from === instanceId) {
+                return;
+            }
+            // SEC-H7: Verify broadcast signature
+            const { sig, from, ...payloadFields } = message;
+            void verifySignature(JSON.stringify(payloadFields), sig, broadcastSecret).then((valid) => {
+                if (!valid) {
+                    return;
+                }
+                if (message.kind === "rotate") {
+                    void rotateTokensInternal(storage, message.tokens, message.policy)
+                        .then((state) => {
+                        notify({
+                            type: "tokens-updated",
+                            at: Date.now(),
+                            source: "remote",
+                            state,
+                        });
+                    })
+                        .catch((error) => {
+                        notify({
+                            type: "session-refresh-failed",
+                            at: Date.now(),
+                            source: "remote",
+                            errorMessage: error instanceof Error ? error.message : String(error),
+                        });
+                    });
+                    return;
+                }
+                if (message.kind === "logout") {
+                    void storage
+                        .clear()
+                        .then(() => storage.clearRefresh())
+                        .then(() => {
+                        notify({
+                            type: "session-logout",
+                            at: Date.now(),
+                            source: "remote",
+                            ...(message.reason !== undefined ? { reason: message.reason } : {}),
+                        });
+                    });
+                }
+            });
+        };
+    }
+    return {
+        async getState() {
+            assertActive();
+            lastAccessAt = Date.now();
+            const state = await readState(storage);
+            // FEAT-L5: idle timeout check
+            if (idleTimeoutMs !== undefined && Date.now() - lastAccessAt > idleTimeoutMs) {
+                return { accessToken: null, refreshToken: null };
+            }
+            // FEAT-M10: sliding window extension
+            if (slidingWindowMs !== undefined && typeof state.expiresAt === "number") {
+                const remaining = state.expiresAt - Date.now();
+                if (remaining > 0 && remaining < slidingWindowMs) {
+                    // Extend the session by re-storing the token (triggers new expiry tracking)
+                    if (state.accessToken) {
+                        await storage.set(state.accessToken);
+                    }
+                }
+            }
+            return state;
+        },
+        async setTokens(tokens) {
+            assertActive();
+            const state = await rotateTokensInternal(storage, tokens, rotationPolicy);
+            notify({
+                type: "tokens-updated",
+                at: Date.now(),
+                source: "local",
+                state,
+            });
+            void broadcast({ kind: "rotate", tokens, policy: rotationPolicy });
+        },
+        async rotateTokens(tokens, policy) {
+            assertActive();
+            const nextPolicy = policy ?? rotationPolicy;
+            const state = await rotateTokensInternal(storage, tokens, nextPolicy);
+            notify({
+                type: "tokens-updated",
+                at: Date.now(),
+                source: "local",
+                state,
+            });
+            void broadcast({ kind: "rotate", tokens, policy: nextPolicy });
+            return state;
+        },
+        async clear() {
+            assertActive();
+            await storage.clear();
+            await storage.clearRefresh();
+            notify({
+                type: "tokens-cleared",
+                at: Date.now(),
+                source: "local",
+            });
+        },
+        async logout(reason) {
+            assertActive();
+            await this.clear();
+            notify({
+                type: "session-logout",
+                at: Date.now(),
+                source: "local",
+                ...(reason !== undefined ? { reason } : {}),
+            });
+            void broadcast({
+                kind: "logout",
+                ...(reason !== undefined ? { reason } : {}),
+            });
+        },
+        async isExpired() {
+            assertActive();
+            const state = await readState(storage);
+            return typeof state.expiresAt === "number" ? state.expiresAt <= Date.now() : false;
+        },
+        async needsRefresh(thresholdMs = 60000) {
+            assertActive();
+            const state = await readState(storage);
+            if (typeof state.expiresAt !== "number") {
+                return false;
+            }
+            return state.expiresAt - Date.now() <= thresholdMs;
+        },
+        async refreshIfNeeded(refresh, thresholdMs = 60000) {
+            assertActive();
+            const shouldRefresh = await this.needsRefresh(thresholdMs);
+            if (!shouldRefresh) {
+                return this.getState();
+            }
+            if (refreshLock) {
+                return refreshLock;
+            }
+            // SEC-M3: rate limiting
+            const now = Date.now();
+            if (now - lastRefreshAt < minRefreshIntervalMs) {
+                return this.getState();
+            }
+            if (!refreshLock) {
+                refreshLock = (async () => {
+                    lastRefreshAt = Date.now();
+                    const tokens = await refresh();
+                    const state = await this.rotateTokens(tokens, rotationPolicy);
+                    notify({
+                        type: "session-refreshed",
+                        at: Date.now(),
+                        source: "local",
+                        state,
+                    });
+                    return state;
+                })().finally(() => {
+                    refreshLock = null;
+                });
+            }
+            return refreshLock;
+        },
+        /** SEC-M1: Regenerate session — clear and re-initialize with new tokens. */
+        async regenerateSession(newTokens) {
+            assertActive();
+            await storage.clear();
+            await storage.clearRefresh();
+            const state = await rotateTokensInternal(storage, newTokens, rotationPolicy);
+            notify({
+                type: "session-regenerated",
+                at: Date.now(),
+                source: "local",
+                state,
+            });
+            return state;
+        },
+        onEvent(listener) {
+            assertActive();
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        dispose() {
+            if (disposed) {
+                return;
+            }
+            disposed = true;
+            listeners.clear();
+            if (channel) {
+                channel.onmessage = null;
+                channel.close();
+            }
+            // DX-M4: flush before dispose
+            void exporter?.flush?.();
+            exporter?.dispose?.();
+        },
+    };
+}
+export { composeSessionEventAudits, createConsoleSessionEventAudit, createBufferedSessionEventExporter, } from "./exporters";
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AA4BnC,SAAS,cAAc,CAAC,KAAoB;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAA4B,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAkB;IACzC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAE9C,OAAO;QACL,WAAW;QACX,YAAY;QACZ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAkB,EAClB,MAAkB,EAClB,MAA+B;IAE/B,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAc;IAC/E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkB,EAClB,UAAqC,EAAE;IAEvC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAqC,IAAI,CAAC;IACzD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,KAAM,CAAC;IACpE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAChD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,4CAA4C;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,YAAY,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnH,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAQ,EAAE;QAC/C,KAAK,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,KAAK,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgC,EAAiB,EAAE;QAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,CAAC,WAAW,CAAC;gBAClB,GAAG,OAAO;gBACV,IAAI,EAAE,UAAU;gBAChB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAA+B,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;YAChD,KAAK,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO;gBACT,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,KAAK,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;yBAC/D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;wBACd,MAAM,CAAC;4BACL,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,KAAK;yBACN,CAAC,CAAC;oBACL,CAAC,CAAC;yBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACf,MAAM,CAAC;4BACL,IAAI,EAAE,wBAAwB;4BAC9B,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;yBACrE,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;oBACL,OAAO;gBACT,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,KAAK,OAAO;yBACT,KAAK,EAAE;yBACP,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;yBAClC,IAAI,CAAC,GAAG,EAAE;wBACT,MAAM,CAAC;4BACL,IAAI,EAAE,gBAAgB;4BACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;4BACd,MAAM,EAAE,QAAQ;4BAChB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACpE,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACP,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ;YACZ,YAAY,EAAE,CAAC;YACf,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YAEvC,8BAA8B;YAC9B,IAAI,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;gBAC7E,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACnD,CAAC;YAED,qCAAqC;YACrC,IAAI,eAAe,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACzE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/C,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;oBACjD,4EAA4E;oBAC5E,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;wBACtB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAkB;YAChC,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAC1E,MAAM,CAAC;gBACL,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,OAAO;gBACf,KAAK;aACN,CAAC,CAAC;YACH,KAAK,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAkB,EAAE,MAAgC;YACrE,YAAY,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,MAAM,IAAI,cAAc,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACtE,MAAM,CAAC;gBACL,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,OAAO;gBACf,KAAK;aACN,CAAC,CAAC;YACH,KAAK,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,KAAK;YACT,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,CAAC;gBACL,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAe;YAC1B,YAAY,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC;gBACL,IAAI,EAAE,gBAAgB;gBACtB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,OAAO;gBACf,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAC;YACH,KAAK,SAAS,CAAC;gBACb,IAAI,EAAE,QAAQ;gBACd,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,SAAS;YACb,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,WAAW,GAAG,KAAM;YACrC,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAkC,EAAE,WAAW,GAAG,KAAM;YAC5E,YAAY,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC;YAED,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,wBAAwB;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,aAAa,GAAG,oBAAoB,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzB,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;oBACxB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;oBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC9D,MAAM,CAAC;wBACL,IAAI,EAAE,mBAAmB;wBACzB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;wBACd,MAAM,EAAE,OAAO;wBACf,KAAK;qBACN,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;oBAChB,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,iBAAiB,CAAC,SAAqB;YAC3C,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAC7E,MAAM,CAAC;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,OAAO;gBACf,KAAK;aACN,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,QAAkC;YACxC,YAAY,EAAE,CAAC;YACf,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAED,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACzB,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YACD,8BAA8B;YAC9B,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EACL,yBAAyB,EACzB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,aAAa,CAAC"}

package/dist/shared/encoding.d.ts

@@ -0,0 +1,5 @@
+export declare function base64Encode(input: string): string;
+export declare function base64Decode(input: string): string;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(input: string): Uint8Array;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/shared/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/shared/encoding.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CASzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMzD"}