@shubh90/app-runtime 0.4.0 → 0.5.0

package/README.md

@@ -29,11 +29,20 @@ and autosave never fights a kit-dirtied tree. Apps pin a version; a breaking
 Plaza contract change is a semver major with a deprecation window, not a flag
 day.
 
-## Publishing (GitHub Packages)
+## Publishing (npmjs, public)
 
-Built and published from the monorepo on a `app-runtime-v*` tag by
-`.github/workflows/publish-app-runtime.yml`. The registry is
-`npm.pkg.github.com`, scope `@mii`.
+Every released version (0.1.0 →) lives on the PUBLIC npm registry — that is
+where app installs resolve, with no auth to provision in any build
+environment, which is the point. Publish from a machine logged in as
+`shubh90`:
+
+```bash
+# from packages/app-runtime, after npm run check && npm run build:
+npm publish --registry=https://registry.npmjs.org
+```
+
+The `app-runtime-v*` tag workflow publishes a mirror copy to GitHub Packages;
+nothing installs from there today, so treat npmjs as the source of truth.
 
 ```bash
 # maintainers, from packages/app-runtime:

package/dist/auth/core.d.ts

@@ -1,17 +1,17 @@
 import { getAuthMode } from "./mode.js";
 import { safeNext } from "./next-path.js";
 import { SIGN_IN_PROBLEMS } from "./problems.js";
-import { type MiiUser } from "./lookup.js";
-import { type MiiIdentity } from "./plaza.js";
+import { type MiiUser, type ResolvedSession } from "./lookup.js";
+import { type MiiIdentity, type PlazaSession } from "./plaza.js";
 import { type UsersConfig } from "./users-config.js";
-export type { MiiUser } from "./lookup.js";
+export type { MiiUser, ResolvedSession } from "./lookup.js";
 export type { AuthMode } from "./mode.js";
-export type { MiiIdentity, SignInFailure, SignInResult } from "./plaza.js";
+export type { MiiIdentity, PlazaSession, SignedIn, SignInFailure, SignInResult } from "./plaza.js";
 export type { UsersConfig } from "./users-config.js";
 export { SIGN_IN_PROBLEMS } from "./problems.js";
 export { safeNext } from "./next-path.js";
 export { getAuthMode } from "./mode.js";
-export { SESSION_COOKIE, SESSION_TTL_MS } from "./lookup.js";
+export { SESSION_COOKIE, SESSION_RECHECK_MS } from "./lookup.js";
 export { miiAuthConfig, type MiiAuthConfig } from "./config.js";
 export { redeemWithPlaza, signInWithPlaza } from "./plaza.js";
 export type CreateMiiAuthCoreOptions = {
@@ -23,8 +23,13 @@ export type CreateMiiAuthCoreOptions = {
 export type MiiAuthCore = {
     /** The user behind a session token, or null. The app reads its own cookie. */
     resolveSession(token: string): Promise<MiiUser | null>;
-    /** Start a session; the app sets the cookie itself (see cookie notes below). */
-    issueSession(userId: string): Promise<{
+    /** The same, with the Plaza token behind the session, for acting as the person. */
+    resolveSessionWithPlaza(token: string): Promise<ResolvedSession | null>;
+    /**
+     * Start a session for the session Plaza signed at sign-in; the app sets the
+     * cookie itself (see cookie notes below).
+     */
+    issueSession(userId: string, plaza: PlazaSession): Promise<{
         token: string;
         expiresAt: Date;
     }>;

package/dist/auth/core.js

@@ -2,14 +2,14 @@ import { makeAuthSql } from "./db.js";
 import { getAuthMode } from "./mode.js";
 import { safeNext } from "./next-path.js";
 import { SIGN_IN_PROBLEMS } from "./problems.js";
-import { issueSession, resolveSession, SESSION_COOKIE, SESSION_TTL_MS, hashToken } from "./lookup.js";
+import { issueSession, resolveSession, resolveSessionWithPlaza, revokeSession, SESSION_COOKIE } from "./lookup.js";
 import { redeemWithPlaza } from "./plaza.js";
 import { deactivateUser, upsertMemberFromIdentity } from "./users.js";
 import { resolveUsers } from "./users-config.js";
 export { SIGN_IN_PROBLEMS } from "./problems.js";
 export { safeNext } from "./next-path.js";
 export { getAuthMode } from "./mode.js";
-export { SESSION_COOKIE, SESSION_TTL_MS } from "./lookup.js";
+export { SESSION_COOKIE, SESSION_RECHECK_MS } from "./lookup.js";
 export { miiAuthConfig } from "./config.js";
 export { redeemWithPlaza, signInWithPlaza } from "./plaza.js";
 /**
@@ -38,21 +38,19 @@ export function createMiiAuthCore(options = {}) {
     };
     return {
         resolveSession: (token) => resolveSession(ctx, token),
-        issueSession: (userId) => issueSession(ctx, userId),
-        revokeSession: async (token) => {
-            const sql = await ctx.getSql();
-            await sql `delete from mii_auth_sessions where token_hash = ${hashToken(token)}`;
-        },
+        resolveSessionWithPlaza: (token) => resolveSessionWithPlaza(ctx, token),
+        issueSession: (userId, plaza) => issueSession(ctx, userId, plaza),
+        revokeSession: (token) => revokeSession(ctx, token),
         upsertMemberFromIdentity: (identity) => upsertMemberFromIdentity(ctx, identity),
         deactivateUser: (userId) => deactivateUser(ctx, userId),
         redeemPaneCode: async (code) => {
-            const identity = await redeemWithPlaza(code);
-            if (identity === null)
+            const signedIn = await redeemWithPlaza(code);
+            if (signedIn === null)
                 return null;
-            const user = await upsertMemberFromIdentity(ctx, identity);
+            const user = await upsertMemberFromIdentity(ctx, signedIn.identity);
             if (user.status !== "active")
                 return null;
-            return issueSession(ctx, user.id);
+            return issueSession(ctx, user.id, signedIn.session);
         },
         getAuthMode,
         SESSION_COOKIE,

package/dist/auth/db.js

@@ -32,6 +32,13 @@ const DDL = [
   )`,
     `create index if not exists mii_auth_sessions_user_idx on mii_auth_sessions (user_id)`
 ];
+// The session columns that carry Plaza's side of a session. Run whatever the
+// users table: the sessions table is always the kit's, and a session without
+// them cannot be resolved (see lookup.ts).
+const SESSION_DDL = [
+    `alter table if exists mii_auth_sessions add column if not exists plaza_token text`,
+    `alter table if exists mii_auth_sessions add column if not exists checked_at timestamptz`
+];
 /**
  * A connection factory bound to one app's user config. Memoizes a single pool
  * per process; a failed init (database briefly unreachable) does not wedge
@@ -51,6 +58,9 @@ export function makeAuthSql(users) {
                         await client.unsafe(statement);
                     }
                 }
+                for (const statement of SESSION_DDL) {
+                    await client.unsafe(statement);
+                }
                 return client;
             })();
             ready.catch(() => {

package/dist/auth/index.d.ts

@@ -2,11 +2,11 @@ import { getAuthMode } from "./mode.js";
 import { safeNext } from "./next-path.js";
 import { SIGN_IN_PROBLEMS } from "./problems.js";
 import { type MiiUser } from "./lookup.js";
-import { type MiiIdentity } from "./plaza.js";
+import { type MiiIdentity, type PlazaSession } from "./plaza.js";
 import { type UsersConfig } from "./users-config.js";
 export type { MiiUser } from "./lookup.js";
 export type { AuthMode } from "./mode.js";
-export type { MiiIdentity } from "./plaza.js";
+export type { MiiIdentity, PlazaSession } from "./plaza.js";
 export type { UsersConfig } from "./users-config.js";
 export { SIGN_IN_PROBLEMS } from "./problems.js";
 export { safeNext } from "./next-path.js";
@@ -27,7 +27,7 @@ export type CreateMiiAuthOptions = {
 export type MiiAuth = {
     getUser(): Promise<MiiUser | null>;
     requireUser(): Promise<MiiUser | null>;
-    createSession(userId: string): Promise<void>;
+    createSession(userId: string, plaza: PlazaSession): Promise<void>;
     destroySession(): Promise<void>;
     resolveSession(token: string): Promise<MiiUser | null>;
     deactivateUser(userId: string): Promise<void>;
@@ -45,7 +45,7 @@ export type MiiAuth = {
         token: string;
         expiresAt: Date;
     } | null>;
-    issueSession(userId: string): Promise<{
+    issueSession(userId: string, plaza: PlazaSession): Promise<{
         token: string;
         expiresAt: Date;
     }>;

package/dist/auth/index.js

@@ -27,7 +27,7 @@ export function createMiiAuth(options = {}) {
     return {
         getUser: () => getUser(ctx),
         requireUser: () => requireUser(ctx),
-        createSession: (userId) => createSession(ctx, userId),
+        createSession: (userId, plaza) => createSession(ctx, userId, plaza),
         destroySession: () => destroySession(ctx),
         resolveSession: (token) => resolveSession(ctx, token),
         deactivateUser: (userId) => deactivateUser(ctx, userId),
@@ -35,15 +35,15 @@ export function createMiiAuth(options = {}) {
         loginRoute: (request) => loginRoute(ctx, request),
         logoutRoute: () => logoutRoute(ctx),
         redeemPaneCode: async (code) => {
-            const identity = await redeemWithPlaza(code);
-            if (identity === null)
+            const signedIn = await redeemWithPlaza(code);
+            if (signedIn === null)
                 return null;
-            const user = await upsertMemberFromIdentity(ctx, identity);
+            const user = await upsertMemberFromIdentity(ctx, signedIn.identity);
             if (user.status !== "active")
                 return null;
-            return issueSession(ctx, user.id);
+            return issueSession(ctx, user.id, signedIn.session);
         },
-        issueSession: (userId) => issueSession(ctx, userId),
+        issueSession: (userId, plaza) => issueSession(ctx, userId, plaza),
         upsertMemberFromIdentity: (identity) => upsertMemberFromIdentity(ctx, identity),
         SESSION_COOKIE,
         LOGIN_ACTION,

package/dist/auth/lookup.d.ts

@@ -1,16 +1,13 @@
 import type { AuthContext } from "./context.js";
+import { type PlazaSession } from "./plaza.js";
 /** The cookie holding this app's own session. Nothing of Plaza's is read here. */
 export declare const SESSION_COOKIE = "mii_session";
 /**
- * A week.
- *
- * This app holds its own sessions now, so signing in means a password typed on
- * its own page rather than a silent hop through a session Plaza already had —
- * which makes a short life felt. A week is one sign-in most people notice once.
- * Someone removed from the org keeps this app until their session runs out, so
- * deactivate them here when it has to be immediate.
+ * How often a session asks Plaza whether it still stands. Someone removed from
+ * the org is signed out of the app within this long; their chat stops at once,
+ * because Plaza checks membership on every chat request.
  */
-export declare const SESSION_TTL_MS: number;
+export declare const SESSION_RECHECK_MS: number;
 export type MiiUser = {
     readonly id: string;
     readonly miiId: string | null;
@@ -19,18 +16,32 @@ export type MiiUser = {
     readonly avatarUrl: string | null;
     readonly role: string;
 };
+/** A session with the Plaza token behind it, for acting on Plaza as the person. */
+export type ResolvedSession = {
+    readonly user: MiiUser;
+    readonly plazaToken: string;
+};
 /**
  * The user behind a session token, or null. Pure lookup — no request context —
  * so the proxy can call it with the raw cookie value. A missing, expired, or
- * deactivated session is null.
+ * deactivated session is null, and so is one Plaza no longer stands behind.
  */
 export declare function resolveSession(ctx: AuthContext, token: string): Promise<MiiUser | null>;
+export declare function resolveSessionWithPlaza(ctx: AuthContext, token: string): Promise<ResolvedSession | null>;
 /**
- * Start a session and hand back the cookie value to set. Only the hash is
- * stored, so a database read cannot be replayed as a sign-in.
+ * Start a session and hand back the cookie value to set. It lasts exactly as
+ * long as the session Plaza signed. Only the cookie's hash is stored, so a
+ * database read cannot be replayed as a sign-in here; Plaza's token is kept as
+ * it is, because this server has to send it, and signing out revokes it.
  */
-export declare function issueSession(ctx: AuthContext, userId: string): Promise<{
+export declare function issueSession(ctx: AuthContext, userId: string, plaza: PlazaSession): Promise<{
     token: string;
     expiresAt: Date;
 }>;
+/**
+ * End one session by its cookie value, here and on Plaza. The session here ends
+ * whatever Plaza says: a Plaza that cannot be reached is reported, and signing
+ * out still signs out.
+ */
+export declare function revokeSession(ctx: AuthContext, token: string): Promise<void>;
 export declare function hashToken(token: string): string;

package/dist/auth/lookup.js

@@ -1,55 +1,116 @@
 import { createHash, randomBytes } from "node:crypto";
+import { checkPlazaSession, revokePlazaSession } from "./plaza.js";
 /** The cookie holding this app's own session. Nothing of Plaza's is read here. */
 export const SESSION_COOKIE = "mii_session";
 /**
- * A week.
- *
- * This app holds its own sessions now, so signing in means a password typed on
- * its own page rather than a silent hop through a session Plaza already had —
- * which makes a short life felt. A week is one sign-in most people notice once.
- * Someone removed from the org keeps this app until their session runs out, so
- * deactivate them here when it has to be immediate.
+ * How often a session asks Plaza whether it still stands. Someone removed from
+ * the org is signed out of the app within this long; their chat stops at once,
+ * because Plaza checks membership on every chat request.
  */
-export const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const SESSION_RECHECK_MS = 5 * 60 * 1000;
 /**
  * The user behind a session token, or null. Pure lookup — no request context —
  * so the proxy can call it with the raw cookie value. A missing, expired, or
- * deactivated session is null.
+ * deactivated session is null, and so is one Plaza no longer stands behind.
  */
 export async function resolveSession(ctx, token) {
+    return (await resolveSessionWithPlaza(ctx, token))?.user ?? null;
+}
+export async function resolveSessionWithPlaza(ctx, token) {
     const sql = await ctx.getSql();
+    const tokenHash = hashToken(token);
     const rows = await sql `
-    select u.id, u.mii_id, u.name, u.email, u.${sql(ctx.users.avatarColumn)} as avatar_url, u.role
+    select u.id, u.mii_id, u.name, u.email, u.${sql(ctx.users.avatarColumn)} as avatar_url, u.role,
+           s.plaza_token,
+           (s.checked_at is null or s.checked_at < now() - ${`${SESSION_RECHECK_MS} milliseconds`}::interval) as due
     from mii_auth_sessions s
     join ${sql(ctx.users.table)} u on u.id = s.user_id
-    where s.token_hash = ${hashToken(token)}
+    where s.token_hash = ${tokenHash}
       and s.expires_at > now()
+      and s.plaza_token is not null
       and u.status = 'active'
     limit 1`;
     const row = rows[0];
     if (row === undefined)
         return null;
+    if (row.due && !(await stillStands(ctx, tokenHash, row.plaza_token))) {
+        return null;
+    }
     return {
-        id: row.id,
-        miiId: row.mii_id,
-        name: row.name,
-        email: row.email,
-        avatarUrl: row.avatar_url,
-        role: row.role
+        user: {
+            id: row.id,
+            miiId: row.mii_id,
+            name: row.name,
+            email: row.email,
+            avatarUrl: row.avatar_url,
+            role: row.role
+        },
+        plazaToken: row.plaza_token
     };
 }
 /**
- * Start a session and hand back the cookie value to set. Only the hash is
- * stored, so a database read cannot be replayed as a sign-in.
+ * Ask Plaza whether a session still stands, once per recheck window however
+ * many requests arrive together: the first to claim the window asks, the rest
+ * go on the answer it last had. A session Plaza has ended is deleted. Plaza
+ * being unreachable is reported and the session kept — an outage there must not
+ * sign every app's people out.
+ */
+async function stillStands(ctx, tokenHash, plazaToken) {
+    const sql = await ctx.getSql();
+    const claimed = await sql `
+    update mii_auth_sessions set checked_at = now()
+    where token_hash = ${tokenHash}
+      and (checked_at is null or checked_at < now() - ${`${SESSION_RECHECK_MS} milliseconds`}::interval)
+    returning token_hash`;
+    if (claimed.length === 0)
+        return true;
+    let answer;
+    try {
+        answer = await checkPlazaSession(plazaToken);
+    }
+    catch (error) {
+        ctx.reportError(error, { where: "mii-auth/session", step: "recheck" });
+        return true;
+    }
+    if (answer === "ended") {
+        await sql `delete from mii_auth_sessions where token_hash = ${tokenHash}`;
+        return false;
+    }
+    return true;
+}
+/**
+ * Start a session and hand back the cookie value to set. It lasts exactly as
+ * long as the session Plaza signed. Only the cookie's hash is stored, so a
+ * database read cannot be replayed as a sign-in here; Plaza's token is kept as
+ * it is, because this server has to send it, and signing out revokes it.
  */
-export async function issueSession(ctx, userId) {
+export async function issueSession(ctx, userId, plaza) {
     const token = randomBytes(32).toString("base64url");
-    const expiresAt = new Date(Date.now() + SESSION_TTL_MS);
     const sql = await ctx.getSql();
     await sql `
-    insert into mii_auth_sessions (token_hash, user_id, expires_at)
-    values (${hashToken(token)}, ${userId}, ${expiresAt})`;
-    return { token, expiresAt };
+    insert into mii_auth_sessions (token_hash, user_id, expires_at, plaza_token, checked_at)
+    values (${hashToken(token)}, ${userId}, ${plaza.expiresAt}, ${plaza.token}, now())`;
+    return { token, expiresAt: plaza.expiresAt };
+}
+/**
+ * End one session by its cookie value, here and on Plaza. The session here ends
+ * whatever Plaza says: a Plaza that cannot be reached is reported, and signing
+ * out still signs out.
+ */
+export async function revokeSession(ctx, token) {
+    const sql = await ctx.getSql();
+    const ended = await sql `
+    delete from mii_auth_sessions where token_hash = ${hashToken(token)}
+    returning plaza_token`;
+    const plazaToken = ended[0]?.plaza_token;
+    if (plazaToken === null || plazaToken === undefined)
+        return;
+    try {
+        await revokePlazaSession(plazaToken);
+    }
+    catch (error) {
+        ctx.reportError(error, { where: "mii-auth/session", step: "revoke" });
+    }
 }
 export function hashToken(token) {
     return createHash("sha256").update(token).digest("hex");

package/dist/auth/plaza.d.ts

@@ -6,6 +6,16 @@ export type MiiIdentity = {
     readonly name: string;
     readonly avatarUrl: string | null;
 };
+/**
+ * The session Plaza signs for someone it just signed in. This app keeps the
+ * token on its own session, ends that session when the token expires, and sends
+ * the token back whenever it acts for the person (their chat), so Plaza can
+ * check they are still in the org.
+ */
+export type PlazaSession = {
+    readonly token: string;
+    readonly expiresAt: Date;
+};
 /**
  * Why a sign-in did not happen, in words this app can show as they are.
  *
@@ -19,20 +29,19 @@ export type SignInFailure = {
     readonly message: string;
     readonly cause?: unknown;
 };
-export type SignInResult = {
-    readonly ok: true;
+export type SignedIn = {
     readonly identity: MiiIdentity;
-} | {
+    readonly session: PlazaSession;
+};
+export type SignInResult = ({
+    readonly ok: true;
+} & SignedIn) | {
     readonly ok: false;
     readonly failure: SignInFailure;
 };
 /**
- * Check an email and password with Plaza, and get back who the person is.
- *
- * One round trip. It used to be two — a code, then a redeem — which doubled
- * the wait on a form submit for nothing: this server is the only party on the
- * line and is trusted to hold the answer. The code path still exists for the
- * App pane, where a browser carries it.
+ * Check an email and password with Plaza, and get back who the person is and
+ * the session Plaza signed for them.
  */
 export declare function signInWithPlaza(email: string, password: string): Promise<SignInResult>;
 /**
@@ -42,5 +51,16 @@ export declare function signInWithPlaza(email: string, password: string): Promis
  * that reaches the route's error reporting rather than looking like a stale
  * code and sending the person round again.
  */
-export declare function redeemWithPlaza(code: string): Promise<MiiIdentity | null>;
+export declare function redeemWithPlaza(code: string): Promise<SignedIn | null>;
+/**
+ * Whether Plaza still stands behind a session: "ended" when the token is no
+ * longer good or the person has left the org. Throws when Plaza cannot say, so
+ * an outage is reported rather than read as either answer.
+ */
+export declare function checkPlazaSession(token: string): Promise<"valid" | "ended">;
+/**
+ * Tell Plaza a session is over, so the token stops working now rather than when
+ * it expires. Throws when Plaza did not take it.
+ */
+export declare function revokePlazaSession(token: string): Promise<void>;
 export declare function failureFor(status: number, body: string): SignInFailure;

package/dist/auth/plaza.js

@@ -1,11 +1,7 @@
 import { miiAuthConfig } from "./config.js";
 /**
- * Check an email and password with Plaza, and get back who the person is.
- *
- * One round trip. It used to be two — a code, then a redeem — which doubled
- * the wait on a form submit for nothing: this server is the only party on the
- * line and is trusted to hold the answer. The code path still exists for the
- * App pane, where a browser carries it.
+ * Check an email and password with Plaza, and get back who the person is and
+ * the session Plaza signed for them.
  */
 export async function signInWithPlaza(email, password) {
     const { plazaUrl, appId } = miiAuthConfig();
@@ -30,16 +26,16 @@ export async function signInWithPlaza(email, password) {
     }
     if (response.ok) {
         const body = (await response.json());
-        const identity = asIdentity(body);
-        if (identity !== null) {
-            return { ok: true, identity };
+        const signedIn = asSignedIn(body);
+        if (signedIn !== null) {
+            return { ok: true, ...signedIn };
         }
         return {
             ok: false,
             failure: {
                 kind: "unavailable",
                 message: "Sign-in answered with something unexpected. Try again.",
-                cause: new Error(`Plaza sign-in answered 200 without an identity: ${JSON.stringify(body)}`)
+                cause: new Error(`Plaza sign-in answered 200 without an identity and session: ${JSON.stringify(body)}`)
             }
         };
     }
@@ -67,22 +63,70 @@ export async function redeemWithPlaza(code) {
         return null;
     }
     const body = (await response.json());
-    const identity = asIdentity(body);
-    if (identity === null) {
-        throw new Error(`Plaza redeem answered 200 without an identity: ${JSON.stringify(body)}`);
+    const signedIn = asSignedIn(body);
+    if (signedIn === null) {
+        throw new Error(`Plaza redeem answered 200 without an identity and session: ${JSON.stringify(body)}`);
     }
-    return identity;
+    return signedIn;
 }
-function asIdentity(body) {
-    if (typeof body.miiId !== "string" || typeof body.name !== "string") {
+/**
+ * Whether Plaza still stands behind a session: "ended" when the token is no
+ * longer good or the person has left the org. Throws when Plaza cannot say, so
+ * an outage is reported rather than read as either answer.
+ */
+export async function checkPlazaSession(token) {
+    const { plazaUrl } = miiAuthConfig();
+    // Asked from inside a page load, so a Plaza that hangs must not hang the page.
+    const response = await fetch(`${plazaUrl}/api/app-chat/v1/session`, {
+        headers: { Authorization: `Bearer ${token}` },
+        cache: "no-store",
+        signal: AbortSignal.timeout(PLAZA_SESSION_TIMEOUT_MS)
+    });
+    if (response.ok)
+        return "valid";
+    if (response.status === 401 || response.status === 403)
+        return "ended";
+    throw new Error(`Plaza session check answered ${response.status}: ${(await response.text()).slice(0, 300)}`);
+}
+/**
+ * Tell Plaza a session is over, so the token stops working now rather than when
+ * it expires. Throws when Plaza did not take it.
+ */
+export async function revokePlazaSession(token) {
+    const { plazaUrl } = miiAuthConfig();
+    const response = await fetch(`${plazaUrl}/api/app-chat/v1/session`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${token}` },
+        cache: "no-store",
+        signal: AbortSignal.timeout(PLAZA_SESSION_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+        throw new Error(`Plaza session revoke answered ${response.status}: ${(await response.text()).slice(0, 300)}`);
+    }
+}
+const PLAZA_SESSION_TIMEOUT_MS = 5000;
+function asSignedIn(body) {
+    const session = body.session;
+    if (typeof body.miiId !== "string" ||
+        typeof body.orgId !== "string" ||
+        typeof body.name !== "string" ||
+        typeof session?.token !== "string" ||
+        typeof session.expiresAt !== "string") {
+        return null;
+    }
+    const expiresAt = new Date(session.expiresAt);
+    if (Number.isNaN(expiresAt.getTime())) {
         return null;
     }
     return {
-        miiId: body.miiId,
-        orgId: typeof body.orgId === "string" ? body.orgId : "",
-        email: typeof body.email === "string" ? body.email : null,
-        name: body.name,
-        avatarUrl: typeof body.avatarUrl === "string" ? body.avatarUrl : null
+        identity: {
+            miiId: body.miiId,
+            orgId: body.orgId,
+            email: typeof body.email === "string" ? body.email : null,
+            name: body.name,
+            avatarUrl: typeof body.avatarUrl === "string" ? body.avatarUrl : null
+        },
+        session: { token: session.token, expiresAt }
     };
 }
 export function failureFor(status, body) {

package/dist/auth/routes.js

@@ -73,7 +73,7 @@ export async function loginRoute(ctx, request) {
             // Plaza has no idea; this is the app's own switch.
             return answer("deactivated", 403);
         }
-        await createSession(ctx, user.id);
+        await createSession(ctx, user.id, attempt.session);
         return answer(null, 200);
     }
     catch (error) {

package/dist/auth/session.d.ts

@@ -1,5 +1,6 @@
 import type { AuthContext } from "./context.js";
 import { type MiiUser } from "./lookup.js";
+import type { PlazaSession } from "./plaza.js";
 /**
  * The signed-in user, or null. Use in API routes and anywhere "who is this, if
  * anyone" is the question. For pages that need a person, prefer requireUser().
@@ -13,8 +14,8 @@ export declare function getUser(ctx: AuthContext): Promise<MiiUser | null>;
  * app is public it returns null and your pages render for an anonymous visitor.
  */
 export declare function requireUser(ctx: AuthContext): Promise<MiiUser | null>;
-/** Start a session for a user and set its cookie. */
-export declare function createSession(ctx: AuthContext, userId: string): Promise<void>;
+/** Start a session for a user and the session Plaza signed, and set its cookie. */
+export declare function createSession(ctx: AuthContext, userId: string, plaza: PlazaSession): Promise<void>;
 /** End the current session, if any, and clear its cookie. */
 export declare function destroySession(ctx: AuthContext): Promise<void>;
 /**

package/dist/auth/session.js

@@ -1,6 +1,6 @@
 import { cookies, headers } from "next/headers";
 import { redirect } from "next/navigation";
-import { hashToken, issueSession, resolveSession, SESSION_COOKIE } from "./lookup.js";
+import { issueSession, resolveSession, revokeSession, SESSION_COOKIE } from "./lookup.js";
 import { getAuthMode } from "./mode.js";
 import { safeNext } from "./next-path.js";
 /**
@@ -29,9 +29,9 @@ export async function requireUser(ctx) {
     const path = (await headers()).get("x-mii-pathname") ?? "/";
     redirect(`/login?next=${encodeURIComponent(safeNext(path))}`);
 }
-/** Start a session for a user and set its cookie. */
-export async function createSession(ctx, userId) {
-    const { token, expiresAt } = await issueSession(ctx, userId);
+/** Start a session for a user and the session Plaza signed, and set its cookie. */
+export async function createSession(ctx, userId, plaza) {
+    const { token, expiresAt } = await issueSession(ctx, userId, plaza);
     (await cookies()).set(SESSION_COOKIE, token, {
         ...(await cookieOptions()),
         expires: expiresAt
@@ -42,8 +42,7 @@ export async function destroySession(ctx) {
     const store = await cookies();
     const token = store.get(SESSION_COOKIE)?.value;
     if (token !== undefined) {
-        const sql = await ctx.getSql();
-        await sql `delete from mii_auth_sessions where token_hash = ${hashToken(token)}`;
+        await revokeSession(ctx, token);
         store.set(SESSION_COOKIE, "", { ...(await cookieOptions()), maxAge: 0 });
     }
 }

package/dist/chat/index.d.ts

@@ -0,0 +1,8 @@
+import type { Brand } from "./widget/app.js";
+export { CHAT_BASE_PATH } from "./paths.js";
+export declare function MiiChat({ enabled }: {
+    readonly enabled: boolean;
+}): null;
+export declare function readBrand(): Brand;
+/** `217 84% 52%` is shadcn's bare HSL; anything else is already a colour. */
+export declare function asColour(value: string): string | null;