@shware/security 7.1.0 → 8.0.0

package/dist/oauth2/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";AAkKA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../src/oauth2/types.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc7636\nexport interface PkceParameters {\n  code_verifier: string;\n  code_challenge: string;\n  code_challenge_method: 'S256' | 'plain';\n}\n\nexport interface OAuth2AuthorizationRequest {\n  state: string;\n  /** Key of the provider in `OAuth2ClientConfig.providers` the flow was started for. */\n  provider: string;\n  authorizationRequestUri: string;\n  additionalParameters: PkceParameters;\n  /**\n   * What the host attached when the flow started (`oauth2Authorization` options), kept on the\n   * server and handed back to `onAuthorized` once the callback checks out. Never sent to the\n   * provider, unlike `additionalParameters`. Absent on requests stored before this field existed.\n   */\n  attributes?: Record<string, string>;\n}\n\ninterface CreateAuthorizationUriParams {\n  state: string;\n  clientId: string;\n  redirectUri: string;\n  scope: string[] | undefined;\n  pkce?: Omit<PkceParameters, 'code_verifier'>;\n}\n\nexport interface ExchangeCodeParams {\n  code: string;\n  clientId: string;\n  /** Absent for public clients (Google's installed-app clients, PKCE-only clients). */\n  clientSecret?: string;\n  redirectUri: string;\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n}\n\nexport interface RefreshTokenParams {\n  clientId: string;\n  clientSecret?: string;\n  refreshToken: string;\n}\n\nexport interface RevokeTokenParams {\n  token: string;\n  clientId: string;\n  clientSecret?: string;\n}\n\nexport interface LoginOAuth2NativeParams {\n  /**\n   * The configured client the app signs in as (its `client_id`, or the provider's default native\n   * client). Id tokens must be issued to it: it is the only audience accepted.\n   */\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  /**\n   * The PKCE verifier for the code exchange, taken from `credentials.code_verifier`: the app made\n   * the challenge and keeps the verifier, so the server only ever has the verifier. Providers\n   * whose token endpoint takes `code_verifier` send it; the others ignore it.\n   */\n  pkce?: Omit<PkceParameters, 'code_challenge' | 'code_challenge_method'>;\n  /** What the app posted, without `code_verifier`, which arrives as `pkce`. */\n  credentials: NativeCredential;\n}\n\n// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-5.1\nexport interface OAuth2Token {\n  /**\n   * REQUIRED.\n   * The access token issued by the authorization server.\n   */\n  access_token: string;\n\n  /**\n   * REQUIRED.\n   * The type of the token issued as described in Section 7.1.  Value is case insensitive.\n   */\n  token_type: 'Bearer' | 'bearer' | 'mac' | (string & {});\n\n  /**\n   * RECOMMENDED.\n   * The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the\n   * access token will expire in one hour from the time the response was generated. If omitted, the\n   * authorization server SHOULD provide the expiration time via other means or document the default\n   * value.\n   */\n  expires_in?: number;\n\n  /**\n   * OPTIONAL.\n   * The refresh token, which can be used to obtain new access tokens using the same authorization\n   * grant as described in Section 6.\n   */\n  refresh_token?: string;\n\n  /**\n   * OPTIONAL.\n   * If identical to the scope requested by the client; otherwise, REQUIRED. The scope of the\n   * access token as described by Section 3.3.\n   */\n  scope?: string;\n\n  id_token?: string;\n\n  [key: string]: unknown;\n}\n\nexport interface OidcToken extends OAuth2Token {\n  id_token: string;\n}\n\nexport type NativeCredential = {\n  state?: string;\n  code?: string;\n  client_id?: string;\n  redirect_uri?: string;\n  /**\n   * The PKCE verifier (RFC 7636) for `code`, when the app sent a `code_challenge` with the\n   * authorization request: 43-128 characters from `[A-Za-z0-9-._~]`. Sent on to the provider's\n   * token endpoint, which refuses the code unless the verifier matches its challenge, so a code\n   * intercepted on the redirect (a custom-scheme redirect any app can claim) is useless alone.\n   * RFC 8252 §8.1 requires it for native apps, whose installed-app clients have no secret.\n   */\n  code_verifier?: string;\n  id_token?: string;\n  access_token?: string;\n  /**\n   * The user's name as the platform hands it to the app, for providers whose id token carries none\n   * (Apple sends it on the first authorization only): iOS\n   * `ASAuthorizationAppleIDCredential.fullName`, expo-apple-authentication's `credential.fullName`.\n   * The snake_case fields above are OAuth / OIDC protocol parameters; this one is not, it is the\n   * platform's object passed through unchanged, so it keeps the platform's own name and apps send\n   * `fullName: credential.fullName` as is. Unsigned client input: the provider cleans each part and\n   * ignores anything that is not a string. Parts with a standard claim become `given_name`,\n   * `family_name`, `middle_name` and `nickname`; `namePrefix` / `nameSuffix` have none and are kept\n   * in `userInfo.data.fullName` only.\n   */\n  fullName?: PersonNameComponents;\n};\n\n/** iOS `PersonNameComponents` as JSON; every part may be missing or `null`. */\nexport interface PersonNameComponents {\n  givenName?: string | null;\n  familyName?: string | null;\n  middleName?: string | null;\n  namePrefix?: string | null;\n  nameSuffix?: string | null;\n  nickname?: string | null;\n}\n\n/**\n * Fields of the authorization response besides `code` and `state` that a provider uses to fill in\n * the user info: Apple posts the user's name as `user` (JSON) with the first authorization only,\n * since its id token never carries one. Unsigned, so treated as untrusted input.\n */\nexport interface AuthorizationResponse {\n  user?: string;\n}\n\nexport const OIDC_SCOPES = [\n  'openid',\n  'profile',\n  'email',\n  'phone',\n  'address',\n  'offline_access',\n] as const;\n\nexport type OidcScope = (typeof OIDC_SCOPES)[number];\n\n// https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\nexport interface StandardClaims {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  /**\n   * Set only by providers that state it (Google, Apple, GitHub from the primary address's\n   * `verified` flag, X when it returns `confirmed_email`); Facebook leaves it unset. Trust the\n   * address only when this is `true`.\n   */\n  email_verified?: boolean;\n  gender?: 'female' | 'male' | (string & {});\n  birthdate?: string; // ISO 8601-1 [ISO8601‑1] YYYY-MM-DD format.\n  zoneinfo?: string; // IANA Time Zone Database [IANA.time‑zones]\n  locale?: string; // BCP47 [RFC5646] language tag.\n  phone_number?: string; // E.164\n  phone_number_verified?: boolean;\n  address?: {\n    formatted: string;\n    street_address: string;\n    locality: string;\n    region: string;\n    postal_code: string;\n    country: string;\n  }; // [RFC8259] JSON object\n  updated_at?: number;\n}\n\nexport interface UserInfo<T = unknown> {\n  claims: StandardClaims;\n  data: T;\n}\n\nexport interface Provider {\n  /** Authorization URI for the provider. */\n  authorizationUri: string;\n\n  /** Token URI for the provider. */\n  tokenUri: string;\n\n  /** Token revoke URI for the provider. */\n  tokenRevokeUri?: string;\n\n  /** Token refresh URI for the provider. */\n  tokenRefreshUri?: string;\n\n  /** User info URI for the provider. */\n  userInfoUri?: string;\n\n  /** User info authentication method for the provider. */\n  userInfoAuthenticationMethod?: string;\n\n  /**\n   * Name of the attribute that will be used to extract the username from the call to 'userInfoUri'.\n   * */\n  userNameAttribute?: string;\n\n  /** JWK set URI for the provider */\n  jwkSetUri?: string;\n\n  /**\n   * URI that can either be an OpenID Connect discovery endpoint or an OAuth 2.0 Authorization\n   * Server Metadata endpoint defined by RFC 8414.\n   * */\n  issuerUri?: string;\n\n  /** Default scopes for the provider. */\n  defaultScope: string[];\n\n  /** step 1: generate authorization uri and redirect user to it */\n  createAuthorizationUri: (params: CreateAuthorizationUriParams) => URL;\n\n  /** step 2: exchange code for token */\n  exchangeAuthorizationCode: (params: ExchangeCodeParams) => Promise<OAuth2Token>;\n\n  /**\n   * step 3: get user info. `context.clientId` is the client the token was issued to, the only\n   * audience an id token may carry; `context.response` holds what the authorization response\n   * carried besides the code, for the providers that send user data there (Apple).\n   */\n  getUserInfo: (token: OAuth2Token, context: UserInfoContext) => Promise<UserInfo>;\n\n  /** others: refresh access token */\n  refreshAccessToken?: (params: RefreshTokenParams) => Promise<OAuth2Token>;\n\n  /** others: revoke token */\n  revokeToken?: (params: RevokeTokenParams) => Promise<void>;\n\n  loginOAuth2Native?: (\n    params: LoginOAuth2NativeParams\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\nexport interface UserInfoContext {\n  clientId: string;\n  response?: AuthorizationResponse;\n}\n\nexport interface OneTapProvider extends Provider {\n  /** Verifies a One Tap / FedCM credential, which must be issued to `clientId` (the web client). */\n  getTokenInfo: (\n    id_token: string,\n    clientId: string\n  ) => Promise<{ token: OAuth2Token; userInfo: UserInfo }>;\n}\n\n/**\n * A client secret: a fixed string, or a function minting one for the client id it is called with\n * (Sign in with Apple's signed JWT, see `createAppleClientSecret`), called on every use so it can\n * cache and renew on its own.\n */\nexport type ClientSecret = string | ((clientId: string) => string | Promise<string>);\n\n/** The client a provider's server-side flows sign in as: the redirect flow and Google One Tap. */\nexport interface WebClient {\n  clientId: string;\n  /** Absent for a public client. */\n  clientSecret?: ClientSecret;\n  /** Default: `${baseUri}/login/oauth2/code/<provider key>`. */\n  redirectUri?: string;\n  /** Authorization scopes. Default: the provider's `defaultScope`. */\n  scope?: string[];\n}\n\n/**\n * A client an app signs in as on the device (an iOS bundle id, a Google iOS / Android client) and\n * whose code or id token it posts to the native login route.\n */\nexport interface NativeClient {\n  clientId: string;\n  /** Absent for a public client (Google's installed-app clients have none). */\n  clientSecret?: ClientSecret;\n  /**\n   * Redirect URI sent with the code exchange when the app sends no `redirect_uri` of its own.\n   * Default: `${baseUri}/login/oauth2/code/<provider key>`.\n   */\n  redirectUri?: string;\n}\n\n/**\n * One identity source: every user it signs in has a `sub` unique within it, whichever client they\n * came through. The key in `OAuth2ClientConfig.providers` names it in the routes and in\n * `onAuthorized`. Two keys may share an implementation (two Google Cloud projects, one Okta per\n * tenant) when their subjects are separate namespaces.\n */\nexport interface ProviderConfig {\n  /** The implementation: `apple`, `google`, `github`, ... from `@shware/security/oauth2/provider`. */\n  provider: Provider;\n  /** The redirect flow's and One Tap's client. Required by those flows. */\n  web?: WebClient;\n  /**\n   * Clients the native login accepts besides `web`. An app names its client with `client_id`;\n   * without one, the only native client is used, or `web` when there is none.\n   */\n  native?: NativeClient[];\n}\n\nexport type ProvidersConfig = { [key: string]: ProviderConfig | undefined };\n\nexport interface OAuth2ClientConfig {\n  baseUri: string;\n  errorUri: string;\n  successUri: string;\n  /** Providers by key; a function is called per request, for secrets read at request time. */\n  providers: ProvidersConfig | (() => Promise<ProvidersConfig>);\n}\n"],"mappings":";AAkKA,MAAa,cAAc;CACzB;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/session/common.cjs

@@ -1,20 +1,16 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region src/session/common.ts
-const SPRING_SECURITY_CONTEXT = "SPRING_SECURITY_CONTEXT";
-const PRINCIPAL_NAME_INDEX_NAME = `org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME`;
-function resolveIndexesFor(session) {
-	const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);
-	if (principalName !== null) return principalName;
-	const jsonString = session.getAttribute(SPRING_SECURITY_CONTEXT);
-	if (typeof jsonString === "string") {
-		const context = JSON.parse(jsonString);
-		return context?.authentication?.name ?? context?.authentication?.principal?.name ?? null;
-	}
-	return null;
+// src/session/common.ts
+/**
+* The session attribute holding the signed-in principal's name, and the one index the
+* repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every
+* session of a user.
+*/
+const PRINCIPAL_NAME_INDEX_NAME = "principalName";
+function principalNameOf(session) {
+	const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);
+	return name === null ? null : String(name);
 }
-//#endregion
 exports.PRINCIPAL_NAME_INDEX_NAME = PRINCIPAL_NAME_INDEX_NAME;
-exports.SPRING_SECURITY_CONTEXT = SPRING_SECURITY_CONTEXT;
-exports.resolveIndexesFor = resolveIndexesFor;
+exports.principalNameOf = principalNameOf;
 
 //# sourceMappingURL=common.cjs.map

package/dist/session/common.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.cjs","names":[],"sources":["../../src/session/common.ts"],"sourcesContent":["import type { SecurityContext, Session } from './types';\n\nexport const SPRING_SECURITY_CONTEXT = 'SPRING_SECURITY_CONTEXT';\nexport const PRINCIPAL_NAME_INDEX_NAME = `org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME`;\n\nexport function resolveIndexesFor(session: Session): string | null {\n  const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME) as string | null;\n  if (principalName !== null) return principalName;\n\n  const jsonString = session.getAttribute(SPRING_SECURITY_CONTEXT);\n  if (typeof jsonString === 'string') {\n    // The attribute is externally stored JSON, so it may parse to null.\n    const context = JSON.parse(jsonString) as SecurityContext | null;\n    return context?.authentication?.name ?? context?.authentication?.principal?.name ?? null;\n  }\n  return null;\n}\n"],"mappings":";;AAEA,MAAa,0BAA0B;AACvC,MAAa,4BAA4B;AAEzC,SAAgB,kBAAkB,SAAiC;CACjE,MAAM,gBAAgB,QAAQ,aAAa,yBAAyB;CACpE,IAAI,kBAAkB,MAAM,OAAO;CAEnC,MAAM,aAAa,QAAQ,aAAa,uBAAuB;CAC/D,IAAI,OAAO,eAAe,UAAU;EAElC,MAAM,UAAU,KAAK,MAAM,UAAU;EACrC,OAAO,SAAS,gBAAgB,QAAQ,SAAS,gBAAgB,WAAW,QAAQ;CACtF;CACA,OAAO;AACT"}
+{"version":3,"file":"common.cjs","names":[],"sources":["../../src/session/common.ts"],"sourcesContent":["import type { Session } from './types';\n\n/**\n * The session attribute holding the signed-in principal's name, and the one index the\n * repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every\n * session of a user.\n */\nexport const PRINCIPAL_NAME_INDEX_NAME = 'principalName';\n\nexport function principalNameOf(session: Session): string | null {\n  const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n  return name === null ? null : String(name);\n}\n"],"mappings":";;;;;;;AAOA,MAAa,4BAA4B;AAEzC,SAAgB,gBAAgB,SAAiC;CAC/D,MAAM,OAAO,QAAQ,aAAa,yBAAyB;CAC3D,OAAO,SAAS,OAAO,OAAO,OAAO,IAAI;AAC3C"}

package/dist/session/common.d.cts

@@ -1,7 +1,9 @@
 import { Session } from "./types.cjs";
-//#region src/session/common.d.ts
-export declare const SPRING_SECURITY_CONTEXT = "SPRING_SECURITY_CONTEXT";
-export declare const PRINCIPAL_NAME_INDEX_NAME = "org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME";
-export declare function resolveIndexesFor(session: Session): string | null;
-//#endregion
+/**
+ * The session attribute holding the signed-in principal's name, and the one index the
+ * repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every
+ * session of a user.
+ */
+export declare const PRINCIPAL_NAME_INDEX_NAME = "principalName";
+export declare function principalNameOf(session: Session): string | null;
 //# sourceMappingURL=common.d.cts.map

package/dist/session/common.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.cts","names":[],"sources":["../../src/session/common.ts"],"mappings":";;qBAEa;qBACA;wBAEG,kBAAkB,SAAS"}
+{"version":3,"file":"common.d.cts","names":[],"sources":["../../src/session/common.ts"],"mappings":";;;;;;qBAOa;wBAEG,gBAAgB,SAAS"}

package/dist/session/common.d.mts

@@ -1,7 +1,9 @@
 import { Session } from "./types.mjs";
-//#region src/session/common.d.ts
-export declare const SPRING_SECURITY_CONTEXT = "SPRING_SECURITY_CONTEXT";
-export declare const PRINCIPAL_NAME_INDEX_NAME = "org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME";
-export declare function resolveIndexesFor(session: Session): string | null;
-//#endregion
+/**
+ * The session attribute holding the signed-in principal's name, and the one index the
+ * repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every
+ * session of a user.
+ */
+export declare const PRINCIPAL_NAME_INDEX_NAME = "principalName";
+export declare function principalNameOf(session: Session): string | null;
 //# sourceMappingURL=common.d.mts.map

package/dist/session/common.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.mts","names":[],"sources":["../../src/session/common.ts"],"mappings":";;qBAEa;qBACA;wBAEG,kBAAkB,SAAS"}
+{"version":3,"file":"common.d.mts","names":[],"sources":["../../src/session/common.ts"],"mappings":";;;;;;qBAOa;wBAEG,gBAAgB,SAAS"}

package/dist/session/common.mjs

@@ -1,17 +1,14 @@
-//#region src/session/common.ts
-const SPRING_SECURITY_CONTEXT = "SPRING_SECURITY_CONTEXT";
-const PRINCIPAL_NAME_INDEX_NAME = `org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME`;
-function resolveIndexesFor(session) {
-	const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);
-	if (principalName !== null) return principalName;
-	const jsonString = session.getAttribute(SPRING_SECURITY_CONTEXT);
-	if (typeof jsonString === "string") {
-		const context = JSON.parse(jsonString);
-		return context?.authentication?.name ?? context?.authentication?.principal?.name ?? null;
-	}
-	return null;
+// src/session/common.ts
+/**
+* The session attribute holding the signed-in principal's name, and the one index the
+* repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every
+* session of a user.
+*/
+const PRINCIPAL_NAME_INDEX_NAME = "principalName";
+function principalNameOf(session) {
+	const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);
+	return name === null ? null : String(name);
 }
-//#endregion
-export { PRINCIPAL_NAME_INDEX_NAME, SPRING_SECURITY_CONTEXT, resolveIndexesFor };
+export { PRINCIPAL_NAME_INDEX_NAME, principalNameOf };
 
 //# sourceMappingURL=common.mjs.map

package/dist/session/common.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"common.mjs","names":[],"sources":["../../src/session/common.ts"],"sourcesContent":["import type { SecurityContext, Session } from './types';\n\nexport const SPRING_SECURITY_CONTEXT = 'SPRING_SECURITY_CONTEXT';\nexport const PRINCIPAL_NAME_INDEX_NAME = `org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME`;\n\nexport function resolveIndexesFor(session: Session): string | null {\n  const principalName = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME) as string | null;\n  if (principalName !== null) return principalName;\n\n  const jsonString = session.getAttribute(SPRING_SECURITY_CONTEXT);\n  if (typeof jsonString === 'string') {\n    // The attribute is externally stored JSON, so it may parse to null.\n    const context = JSON.parse(jsonString) as SecurityContext | null;\n    return context?.authentication?.name ?? context?.authentication?.principal?.name ?? null;\n  }\n  return null;\n}\n"],"mappings":";AAEA,MAAa,0BAA0B;AACvC,MAAa,4BAA4B;AAEzC,SAAgB,kBAAkB,SAAiC;CACjE,MAAM,gBAAgB,QAAQ,aAAa,yBAAyB;CACpE,IAAI,kBAAkB,MAAM,OAAO;CAEnC,MAAM,aAAa,QAAQ,aAAa,uBAAuB;CAC/D,IAAI,OAAO,eAAe,UAAU;EAElC,MAAM,UAAU,KAAK,MAAM,UAAU;EACrC,OAAO,SAAS,gBAAgB,QAAQ,SAAS,gBAAgB,WAAW,QAAQ;CACtF;CACA,OAAO;AACT"}
+{"version":3,"file":"common.mjs","names":[],"sources":["../../src/session/common.ts"],"sourcesContent":["import type { Session } from './types';\n\n/**\n * The session attribute holding the signed-in principal's name, and the one index the\n * repositories keep (`findByIndexNameAndIndexValue`), so `kick` and `listSessions` can find every\n * session of a user.\n */\nexport const PRINCIPAL_NAME_INDEX_NAME = 'principalName';\n\nexport function principalNameOf(session: Session): string | null {\n  const name = session.getAttribute(PRINCIPAL_NAME_INDEX_NAME);\n  return name === null ? null : String(name);\n}\n"],"mappings":";;;;;;AAOA,MAAa,4BAA4B;AAEzC,SAAgB,gBAAgB,SAAiC;CAC/D,MAAM,OAAO,QAAQ,aAAa,yBAAyB;CAC3D,OAAO,SAAS,OAAO,OAAO,OAAO,IAAI;AAC3C"}

package/dist/session/db.cjs

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_session_common = require("./common.cjs");
 const require_session_map_session = require("./map-session.cjs");
 let node_crypto = require("node:crypto");
-//#region src/session/db.ts
+// src/session/db.ts
 var DBSession = class extends require_session_map_session.MapSession {
 	isNew;
 	primaryId;
@@ -24,7 +24,7 @@ var DBIndexedSessionRepository = class {
 	mapSessionToEntity(session) {
 		const attributes = {};
 		for (const name of session.getAttributeNames()) attributes[name] = session.getAttribute(name);
-		const principalName = require_session_common.resolveIndexesFor(session);
+		const principalName = require_session_common.principalNameOf(session);
 		return {
 			primaryId: session.primaryId,
 			sessionId: session.getId(),
@@ -70,7 +70,7 @@ var DBIndexedSessionRepository = class {
 		await this.db.deleteById(sessionId);
 	}
 	async findByIndexNameAndIndexValue(indexName, indexValue) {
-		if (indexName !== "org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME") return /* @__PURE__ */ new Map();
+		if (indexName !== "principalName") return /* @__PURE__ */ new Map();
 		const entities = await this.db.findByPrincipalName(indexValue);
 		if (entities.length === 0) return /* @__PURE__ */ new Map();
 		const sessions = /* @__PURE__ */ new Map();
@@ -87,7 +87,6 @@ var DBIndexedSessionRepository = class {
 		return this.db.cleanupExpiredSessions(cleanupCount);
 	}
 };
-//#endregion
 exports.DBIndexedSessionRepository = DBIndexedSessionRepository;
 
 //# sourceMappingURL=db.cjs.map

package/dist/session/db.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"db.cjs","names":["MapSession","randomUUID","resolveIndexesFor","PRINCIPAL_NAME_INDEX_NAME"],"sources":["../../src/session/db.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { PRINCIPAL_NAME_INDEX_NAME, resolveIndexesFor } from './common';\nimport { MapSession } from './map-session';\nimport type { SessionRepository } from './types';\n\ninterface SessionEntity {\n  primaryId: string;\n  sessionId: string;\n  /**\n   * Set on the entity `save` hands the adapter: `true` for a session created in this request and\n   * never stored, `false` for one the adapter returned from `findById` / `findByPrincipalName`. As\n   * in Spring Session's `JdbcIndexedSessionRepository`, it is what decides between an INSERT and\n   * an UPDATE — an UPDATE that touches no row then means the session was deleted meanwhile\n   * (logout, kick) and must not be written back. Absent on entities the adapter returns.\n   */\n  isNew?: boolean;\n  creationTime: number;\n  lastAccessTime: number;\n  maxInactiveInterval: number;\n  expiryTime: number;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  attributes: Record<string, any>;\n  principalName?: string | null;\n}\n\nclass DBSession extends MapSession {\n  public isNew: boolean;\n  public primaryId: string;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    super(cached);\n    this.isNew = isNew;\n    this.primaryId = randomUUID();\n  }\n}\n\nexport interface DBAdapter {\n  save(session: SessionEntity): Promise<void>;\n  deleteById(sessionId: string): Promise<void>;\n  findById(sessionId: string): Promise<SessionEntity | null>;\n  findByPrincipalName(principalName: string): Promise<SessionEntity[]>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nexport class DBIndexedSessionRepository implements SessionRepository<DBSession> {\n  private defaultMaxInactiveInterval = 1800;\n  private readonly db: DBAdapter;\n\n  constructor(db: DBAdapter) {\n    this.db = db;\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private mapSessionToEntity(session: DBSession): SessionEntity {\n    const attributes: Record<string, string | number | null> = {};\n    for (const name of session.getAttributeNames()) {\n      attributes[name] = session.getAttribute(name);\n    }\n    const principalName = resolveIndexesFor(session);\n\n    return {\n      primaryId: session.primaryId,\n      sessionId: session.getId(),\n      isNew: session.isNew,\n      creationTime: session.getCreationTime(),\n      lastAccessTime: session.getLastAccessedTime(),\n      maxInactiveInterval: session.getMaxInactiveInterval(),\n      expiryTime: session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000,\n      attributes,\n      principalName,\n    };\n  }\n\n  private mapEntityToSession(entity: SessionEntity, allowExpired: boolean): DBSession | null {\n    const loaded = new MapSession(entity.sessionId);\n    loaded.setCreationTime(entity.creationTime);\n    loaded.setLastAccessedTime(entity.lastAccessTime);\n    loaded.setMaxInactiveInterval(entity.maxInactiveInterval);\n    for (const [key, value] of Object.entries(entity.attributes)) {\n      loaded.setAttribute(key, value);\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const session = new DBSession(loaded, false);\n    session.primaryId = entity.primaryId;\n    return session;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<DBSession | null> {\n    const entity = await this.db.findById(id);\n    if (!entity) return null;\n    return this.mapEntityToSession(entity, allowExpired);\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new DBSession(cached, true);\n  }\n\n  async save(session: DBSession) {\n    const entity = this.mapSessionToEntity(session);\n    await this.db.save(entity);\n    session.isNew = false;\n  }\n\n  async findById(sessionId: string): Promise<DBSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    await this.db.deleteById(sessionId);\n  }\n\n  async findByIndexNameAndIndexValue(\n    indexName: string,\n    indexValue: string\n  ): Promise<Map<string, DBSession>> {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, DBSession>();\n    }\n    const entities = await this.db.findByPrincipalName(indexValue);\n    if (entities.length === 0) {\n      return new Map<string, DBSession>();\n    }\n    const sessions = new Map<string, DBSession>();\n    for (const entity of entities) {\n      const session = this.mapEntityToSession(entity, false);\n      if (session) {\n        sessions.set(session.getId(), session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string): Promise<Map<string, DBSession>> {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number): Promise<void> {\n    return this.db.cleanupExpiredSessions(cleanupCount);\n  }\n}\n"],"mappings":";;;;;AAyBA,IAAM,YAAN,cAAwBA,4BAAAA,WAAW;CACjC;CACA;CAEA,YAAY,QAAoB,OAAgB;EAC9C,MAAM,MAAM;EACZ,KAAK,QAAQ;EACb,KAAK,aAAA,GAAYC,YAAAA,WAAAA,CAAW;CAC9B;AACF;AAUA,IAAa,6BAAb,MAAgF;CAC9E,6BAAqC;CACrC;CAEA,YAAY,IAAe;EACzB,KAAK,KAAK;CACZ;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,mBAA2B,SAAmC;EAC5D,MAAM,aAAqD,CAAC;EAC5D,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,GAC3C,WAAW,QAAQ,QAAQ,aAAa,IAAI;EAE9C,MAAM,gBAAgBC,uBAAAA,kBAAkB,OAAO;EAE/C,OAAO;GACL,WAAW,QAAQ;GACnB,WAAW,QAAQ,MAAM;GACzB,OAAO,QAAQ;GACf,cAAc,QAAQ,gBAAgB;GACtC,gBAAgB,QAAQ,oBAAoB;GAC5C,qBAAqB,QAAQ,uBAAuB;GACpD,YAAY,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;GAC/E;GACA;EACF;CACF;CAEA,mBAA2B,QAAuB,cAAyC;EACzF,MAAM,SAAS,IAAIF,4BAAAA,WAAW,OAAO,SAAS;EAC9C,OAAO,gBAAgB,OAAO,YAAY;EAC1C,OAAO,oBAAoB,OAAO,cAAc;EAChD,OAAO,uBAAuB,OAAO,mBAAmB;EACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,UAAU,GACzD,OAAO,aAAa,KAAK,KAAK;EAGhC,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,UAAU,IAAI,UAAU,QAAQ,KAAK;EAC3C,QAAQ,YAAY,OAAO;EAC3B,OAAO;CACT;CAEA,MAAc,WAAW,IAAY,cAAkD;EACrF,MAAM,SAAS,MAAM,KAAK,GAAG,SAAS,EAAE;EACxC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,KAAK,mBAAmB,QAAQ,YAAY;CACrD;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAIA,4BAAAA,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,UAAU,QAAQ,IAAI;CACnC;CAEA,MAAM,KAAK,SAAoB;EAC7B,MAAM,SAAS,KAAK,mBAAmB,OAAO;EAC9C,MAAM,KAAK,GAAG,KAAK,MAAM;EACzB,QAAQ,QAAQ;CAClB;CAEA,MAAM,SAAS,WAA8C;EAC3D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,KAAK,GAAG,WAAW,SAAS;CACpC;CAEA,MAAM,6BACJ,WACA,YACiC;EACjC,IAAI,cAAA,0FACF,uBAAO,IAAI,IAAuB;EAEpC,MAAM,WAAW,MAAM,KAAK,GAAG,oBAAoB,UAAU;EAC7D,IAAI,SAAS,WAAW,GACtB,uBAAO,IAAI,IAAuB;EAEpC,MAAM,2BAAW,IAAI,IAAuB;EAC5C,KAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,KAAK,mBAAmB,QAAQ,KAAK;GACrD,IAAI,SACF,SAAS,IAAI,QAAQ,MAAM,GAAG,OAAO;EAEzC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAwD;EAChF,OAAO,KAAK,6BAA6BG,uBAAAA,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAsC;EACjE,OAAO,KAAK,GAAG,uBAAuB,YAAY;CACpD;AACF"}
+{"version":3,"file":"db.cjs","names":["MapSession","randomUUID","principalNameOf","PRINCIPAL_NAME_INDEX_NAME"],"sources":["../../src/session/db.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { PRINCIPAL_NAME_INDEX_NAME, principalNameOf } from './common';\nimport { MapSession } from './map-session';\nimport type { SessionRepository } from './types';\n\ninterface SessionEntity {\n  primaryId: string;\n  sessionId: string;\n  /**\n   * Set on the entity `save` hands the adapter: `true` for a session created in this request and\n   * never stored, `false` for one the adapter returned from `findById` / `findByPrincipalName`. As\n   * in Spring Session's `JdbcIndexedSessionRepository`, it is what decides between an INSERT and\n   * an UPDATE — an UPDATE that touches no row then means the session was deleted meanwhile\n   * (logout, kick) and must not be written back. Absent on entities the adapter returns.\n   */\n  isNew?: boolean;\n  creationTime: number;\n  lastAccessTime: number;\n  maxInactiveInterval: number;\n  expiryTime: number;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  attributes: Record<string, any>;\n  principalName?: string | null;\n}\n\nclass DBSession extends MapSession {\n  public isNew: boolean;\n  public primaryId: string;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    super(cached);\n    this.isNew = isNew;\n    this.primaryId = randomUUID();\n  }\n}\n\nexport interface DBAdapter {\n  save(session: SessionEntity): Promise<void>;\n  deleteById(sessionId: string): Promise<void>;\n  findById(sessionId: string): Promise<SessionEntity | null>;\n  findByPrincipalName(principalName: string): Promise<SessionEntity[]>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nexport class DBIndexedSessionRepository implements SessionRepository<DBSession> {\n  private defaultMaxInactiveInterval = 1800;\n  private readonly db: DBAdapter;\n\n  constructor(db: DBAdapter) {\n    this.db = db;\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private mapSessionToEntity(session: DBSession): SessionEntity {\n    const attributes: Record<string, string | number | null> = {};\n    for (const name of session.getAttributeNames()) {\n      attributes[name] = session.getAttribute(name);\n    }\n    const principalName = principalNameOf(session);\n\n    return {\n      primaryId: session.primaryId,\n      sessionId: session.getId(),\n      isNew: session.isNew,\n      creationTime: session.getCreationTime(),\n      lastAccessTime: session.getLastAccessedTime(),\n      maxInactiveInterval: session.getMaxInactiveInterval(),\n      expiryTime: session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000,\n      attributes,\n      principalName,\n    };\n  }\n\n  private mapEntityToSession(entity: SessionEntity, allowExpired: boolean): DBSession | null {\n    const loaded = new MapSession(entity.sessionId);\n    loaded.setCreationTime(entity.creationTime);\n    loaded.setLastAccessedTime(entity.lastAccessTime);\n    loaded.setMaxInactiveInterval(entity.maxInactiveInterval);\n    for (const [key, value] of Object.entries(entity.attributes)) {\n      loaded.setAttribute(key, value);\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const session = new DBSession(loaded, false);\n    session.primaryId = entity.primaryId;\n    return session;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<DBSession | null> {\n    const entity = await this.db.findById(id);\n    if (!entity) return null;\n    return this.mapEntityToSession(entity, allowExpired);\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new DBSession(cached, true);\n  }\n\n  async save(session: DBSession) {\n    const entity = this.mapSessionToEntity(session);\n    await this.db.save(entity);\n    session.isNew = false;\n  }\n\n  async findById(sessionId: string): Promise<DBSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    await this.db.deleteById(sessionId);\n  }\n\n  async findByIndexNameAndIndexValue(\n    indexName: string,\n    indexValue: string\n  ): Promise<Map<string, DBSession>> {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, DBSession>();\n    }\n    const entities = await this.db.findByPrincipalName(indexValue);\n    if (entities.length === 0) {\n      return new Map<string, DBSession>();\n    }\n    const sessions = new Map<string, DBSession>();\n    for (const entity of entities) {\n      const session = this.mapEntityToSession(entity, false);\n      if (session) {\n        sessions.set(session.getId(), session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string): Promise<Map<string, DBSession>> {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number): Promise<void> {\n    return this.db.cleanupExpiredSessions(cleanupCount);\n  }\n}\n"],"mappings":";;;;;AAyBA,IAAM,YAAN,cAAwBA,4BAAAA,WAAW;CACjC;CACA;CAEA,YAAY,QAAoB,OAAgB;EAC9C,MAAM,MAAM;EACZ,KAAK,QAAQ;EACb,KAAK,aAAA,GAAYC,YAAAA,WAAAA,CAAW;CAC9B;AACF;AAUA,IAAa,6BAAb,MAAgF;CAC9E,6BAAqC;CACrC;CAEA,YAAY,IAAe;EACzB,KAAK,KAAK;CACZ;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,mBAA2B,SAAmC;EAC5D,MAAM,aAAqD,CAAC;EAC5D,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,GAC3C,WAAW,QAAQ,QAAQ,aAAa,IAAI;EAE9C,MAAM,gBAAgBC,uBAAAA,gBAAgB,OAAO;EAE7C,OAAO;GACL,WAAW,QAAQ;GACnB,WAAW,QAAQ,MAAM;GACzB,OAAO,QAAQ;GACf,cAAc,QAAQ,gBAAgB;GACtC,gBAAgB,QAAQ,oBAAoB;GAC5C,qBAAqB,QAAQ,uBAAuB;GACpD,YAAY,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;GAC/E;GACA;EACF;CACF;CAEA,mBAA2B,QAAuB,cAAyC;EACzF,MAAM,SAAS,IAAIF,4BAAAA,WAAW,OAAO,SAAS;EAC9C,OAAO,gBAAgB,OAAO,YAAY;EAC1C,OAAO,oBAAoB,OAAO,cAAc;EAChD,OAAO,uBAAuB,OAAO,mBAAmB;EACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,UAAU,GACzD,OAAO,aAAa,KAAK,KAAK;EAGhC,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,UAAU,IAAI,UAAU,QAAQ,KAAK;EAC3C,QAAQ,YAAY,OAAO;EAC3B,OAAO;CACT;CAEA,MAAc,WAAW,IAAY,cAAkD;EACrF,MAAM,SAAS,MAAM,KAAK,GAAG,SAAS,EAAE;EACxC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,KAAK,mBAAmB,QAAQ,YAAY;CACrD;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAIA,4BAAAA,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,UAAU,QAAQ,IAAI;CACnC;CAEA,MAAM,KAAK,SAAoB;EAC7B,MAAM,SAAS,KAAK,mBAAmB,OAAO;EAC9C,MAAM,KAAK,GAAG,KAAK,MAAM;EACzB,QAAQ,QAAQ;CAClB;CAEA,MAAM,SAAS,WAA8C;EAC3D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,KAAK,GAAG,WAAW,SAAS;CACpC;CAEA,MAAM,6BACJ,WACA,YACiC;EACjC,IAAI,cAAA,iBACF,uBAAO,IAAI,IAAuB;EAEpC,MAAM,WAAW,MAAM,KAAK,GAAG,oBAAoB,UAAU;EAC7D,IAAI,SAAS,WAAW,GACtB,uBAAO,IAAI,IAAuB;EAEpC,MAAM,2BAAW,IAAI,IAAuB;EAC5C,KAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,KAAK,mBAAmB,QAAQ,KAAK;GACrD,IAAI,SACF,SAAS,IAAI,QAAQ,MAAM,GAAG,OAAO;EAEzC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAwD;EAChF,OAAO,KAAK,6BAA6BG,uBAAAA,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAsC;EACjE,OAAO,KAAK,GAAG,uBAAuB,YAAY;CACpD;AACF"}

package/dist/session/db.d.cts

@@ -1,6 +1,5 @@
 import { SessionRepository } from "./types.cjs";
 import { MapSession } from "./map-session.cjs";
-//#region src/session/db.d.ts
 interface SessionEntity {
   primaryId: string;
   sessionId: string;
@@ -47,6 +46,5 @@ export declare class DBIndexedSessionRepository implements SessionRepository<DBS
   findByPrincipalName(principalName: string): Promise<Map<string, DBSession>>;
   cleanupExpiredSessions(cleanupCount?: number): Promise<void>;
 }
-//#endregion
 export {};
 //# sourceMappingURL=db.d.cts.map

package/dist/session/db.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.cts","names":[],"sources":["../../src/session/db.ts"],"mappings":";;;UAKU;EACR;EACA;;;;;;;;EAQA;EACA;EACA;EACA;EACA;EAEA,YAAY;EACZ;;cAGI,kBAAkB;EACf;EACA;EAEP,YAAY,QAAQ,YAAY;;iBAOjB;EACf,KAAK,SAAS,gBAAgB;EAC9B,WAAW,oBAAoB;EAC/B,SAAS,oBAAoB,QAAQ;EACrC,oBAAoB,wBAAwB,QAAQ;EACpD,uBAAuB,wBAAwB;;qBAGpC,sCAAsC,kBAAkB;UAC3D;mBACS;EAEjB,YAAY,IAAI;EAIhB,8BAA8B;UAItB;UAoBA;UAeM;EAOd,iBAAa;EAMP,KAAK,SAAS,YAAS;EAMvB,SAAS,oBAAoB,QAAQ;EAIrC,WAAW,oBAAiB;EAI5B,6BACJ,mBACA,qBACC,QAAQ,YAAY;EAkBjB,oBAAoB,wBAAwB,QAAQ,YAAY;EAIhE,uBAAuB,wBAAwB"}
+{"version":3,"file":"db.d.cts","names":[],"sources":["../../src/session/db.ts"],"mappings":";;UAKU;EACR;EACA;;;;;;;;EAQA;EACA;EACA;EACA;EACA;EAEA,YAAY;EACZ;;cAGI,kBAAkB;EACf;EACA;EAEP,YAAY,QAAQ,YAAY;;iBAOjB;EACf,KAAK,SAAS,gBAAgB;EAC9B,WAAW,oBAAoB;EAC/B,SAAS,oBAAoB,QAAQ;EACrC,oBAAoB,wBAAwB,QAAQ;EACpD,uBAAuB,wBAAwB;;qBAGpC,sCAAsC,kBAAkB;UAC3D;mBACS;EAEjB,YAAY,IAAI;EAIhB,8BAA8B;UAItB;UAoBA;UAeM;EAOd,iBAAa;EAMP,KAAK,SAAS,YAAS;EAMvB,SAAS,oBAAoB,QAAQ;EAIrC,WAAW,oBAAiB;EAI5B,6BACJ,mBACA,qBACC,QAAQ,YAAY;EAkBjB,oBAAoB,wBAAwB,QAAQ,YAAY;EAIhE,uBAAuB,wBAAwB"}

package/dist/session/db.d.mts

@@ -1,6 +1,5 @@
 import { SessionRepository } from "./types.mjs";
 import { MapSession } from "./map-session.mjs";
-//#region src/session/db.d.ts
 interface SessionEntity {
   primaryId: string;
   sessionId: string;
@@ -47,6 +46,5 @@ export declare class DBIndexedSessionRepository implements SessionRepository<DBS
   findByPrincipalName(principalName: string): Promise<Map<string, DBSession>>;
   cleanupExpiredSessions(cleanupCount?: number): Promise<void>;
 }
-//#endregion
 export {};
 //# sourceMappingURL=db.d.mts.map

package/dist/session/db.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.mts","names":[],"sources":["../../src/session/db.ts"],"mappings":";;;UAKU;EACR;EACA;;;;;;;;EAQA;EACA;EACA;EACA;EACA;EAEA,YAAY;EACZ;;cAGI,kBAAkB;EACf;EACA;EAEP,YAAY,QAAQ,YAAY;;iBAOjB;EACf,KAAK,SAAS,gBAAgB;EAC9B,WAAW,oBAAoB;EAC/B,SAAS,oBAAoB,QAAQ;EACrC,oBAAoB,wBAAwB,QAAQ;EACpD,uBAAuB,wBAAwB;;qBAGpC,sCAAsC,kBAAkB;UAC3D;mBACS;EAEjB,YAAY,IAAI;EAIhB,8BAA8B;UAItB;UAoBA;UAeM;EAOd,iBAAa;EAMP,KAAK,SAAS,YAAS;EAMvB,SAAS,oBAAoB,QAAQ;EAIrC,WAAW,oBAAiB;EAI5B,6BACJ,mBACA,qBACC,QAAQ,YAAY;EAkBjB,oBAAoB,wBAAwB,QAAQ,YAAY;EAIhE,uBAAuB,wBAAwB"}
+{"version":3,"file":"db.d.mts","names":[],"sources":["../../src/session/db.ts"],"mappings":";;UAKU;EACR;EACA;;;;;;;;EAQA;EACA;EACA;EACA;EACA;EAEA,YAAY;EACZ;;cAGI,kBAAkB;EACf;EACA;EAEP,YAAY,QAAQ,YAAY;;iBAOjB;EACf,KAAK,SAAS,gBAAgB;EAC9B,WAAW,oBAAoB;EAC/B,SAAS,oBAAoB,QAAQ;EACrC,oBAAoB,wBAAwB,QAAQ;EACpD,uBAAuB,wBAAwB;;qBAGpC,sCAAsC,kBAAkB;UAC3D;mBACS;EAEjB,YAAY,IAAI;EAIhB,8BAA8B;UAItB;UAoBA;UAeM;EAOd,iBAAa;EAMP,KAAK,SAAS,YAAS;EAMvB,SAAS,oBAAoB,QAAQ;EAIrC,WAAW,oBAAiB;EAI5B,6BACJ,mBACA,qBACC,QAAQ,YAAY;EAkBjB,oBAAoB,wBAAwB,QAAQ,YAAY;EAIhE,uBAAuB,wBAAwB"}

package/dist/session/db.mjs

@@ -1,7 +1,7 @@
-import { PRINCIPAL_NAME_INDEX_NAME, resolveIndexesFor } from "./common.mjs";
+import { PRINCIPAL_NAME_INDEX_NAME, principalNameOf } from "./common.mjs";
 import { MapSession } from "./map-session.mjs";
 import { randomUUID } from "node:crypto";
-//#region src/session/db.ts
+// src/session/db.ts
 var DBSession = class extends MapSession {
 	isNew;
 	primaryId;
@@ -23,7 +23,7 @@ var DBIndexedSessionRepository = class {
 	mapSessionToEntity(session) {
 		const attributes = {};
 		for (const name of session.getAttributeNames()) attributes[name] = session.getAttribute(name);
-		const principalName = resolveIndexesFor(session);
+		const principalName = principalNameOf(session);
 		return {
 			primaryId: session.primaryId,
 			sessionId: session.getId(),
@@ -69,7 +69,7 @@ var DBIndexedSessionRepository = class {
 		await this.db.deleteById(sessionId);
 	}
 	async findByIndexNameAndIndexValue(indexName, indexValue) {
-		if (indexName !== "org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME") return /* @__PURE__ */ new Map();
+		if (indexName !== "principalName") return /* @__PURE__ */ new Map();
 		const entities = await this.db.findByPrincipalName(indexValue);
 		if (entities.length === 0) return /* @__PURE__ */ new Map();
 		const sessions = /* @__PURE__ */ new Map();
@@ -86,7 +86,6 @@ var DBIndexedSessionRepository = class {
 		return this.db.cleanupExpiredSessions(cleanupCount);
 	}
 };
-//#endregion
 export { DBIndexedSessionRepository };
 
 //# sourceMappingURL=db.mjs.map

package/dist/session/db.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"db.mjs","names":[],"sources":["../../src/session/db.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { PRINCIPAL_NAME_INDEX_NAME, resolveIndexesFor } from './common';\nimport { MapSession } from './map-session';\nimport type { SessionRepository } from './types';\n\ninterface SessionEntity {\n  primaryId: string;\n  sessionId: string;\n  /**\n   * Set on the entity `save` hands the adapter: `true` for a session created in this request and\n   * never stored, `false` for one the adapter returned from `findById` / `findByPrincipalName`. As\n   * in Spring Session's `JdbcIndexedSessionRepository`, it is what decides between an INSERT and\n   * an UPDATE — an UPDATE that touches no row then means the session was deleted meanwhile\n   * (logout, kick) and must not be written back. Absent on entities the adapter returns.\n   */\n  isNew?: boolean;\n  creationTime: number;\n  lastAccessTime: number;\n  maxInactiveInterval: number;\n  expiryTime: number;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  attributes: Record<string, any>;\n  principalName?: string | null;\n}\n\nclass DBSession extends MapSession {\n  public isNew: boolean;\n  public primaryId: string;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    super(cached);\n    this.isNew = isNew;\n    this.primaryId = randomUUID();\n  }\n}\n\nexport interface DBAdapter {\n  save(session: SessionEntity): Promise<void>;\n  deleteById(sessionId: string): Promise<void>;\n  findById(sessionId: string): Promise<SessionEntity | null>;\n  findByPrincipalName(principalName: string): Promise<SessionEntity[]>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nexport class DBIndexedSessionRepository implements SessionRepository<DBSession> {\n  private defaultMaxInactiveInterval = 1800;\n  private readonly db: DBAdapter;\n\n  constructor(db: DBAdapter) {\n    this.db = db;\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private mapSessionToEntity(session: DBSession): SessionEntity {\n    const attributes: Record<string, string | number | null> = {};\n    for (const name of session.getAttributeNames()) {\n      attributes[name] = session.getAttribute(name);\n    }\n    const principalName = resolveIndexesFor(session);\n\n    return {\n      primaryId: session.primaryId,\n      sessionId: session.getId(),\n      isNew: session.isNew,\n      creationTime: session.getCreationTime(),\n      lastAccessTime: session.getLastAccessedTime(),\n      maxInactiveInterval: session.getMaxInactiveInterval(),\n      expiryTime: session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000,\n      attributes,\n      principalName,\n    };\n  }\n\n  private mapEntityToSession(entity: SessionEntity, allowExpired: boolean): DBSession | null {\n    const loaded = new MapSession(entity.sessionId);\n    loaded.setCreationTime(entity.creationTime);\n    loaded.setLastAccessedTime(entity.lastAccessTime);\n    loaded.setMaxInactiveInterval(entity.maxInactiveInterval);\n    for (const [key, value] of Object.entries(entity.attributes)) {\n      loaded.setAttribute(key, value);\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const session = new DBSession(loaded, false);\n    session.primaryId = entity.primaryId;\n    return session;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<DBSession | null> {\n    const entity = await this.db.findById(id);\n    if (!entity) return null;\n    return this.mapEntityToSession(entity, allowExpired);\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new DBSession(cached, true);\n  }\n\n  async save(session: DBSession) {\n    const entity = this.mapSessionToEntity(session);\n    await this.db.save(entity);\n    session.isNew = false;\n  }\n\n  async findById(sessionId: string): Promise<DBSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    await this.db.deleteById(sessionId);\n  }\n\n  async findByIndexNameAndIndexValue(\n    indexName: string,\n    indexValue: string\n  ): Promise<Map<string, DBSession>> {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, DBSession>();\n    }\n    const entities = await this.db.findByPrincipalName(indexValue);\n    if (entities.length === 0) {\n      return new Map<string, DBSession>();\n    }\n    const sessions = new Map<string, DBSession>();\n    for (const entity of entities) {\n      const session = this.mapEntityToSession(entity, false);\n      if (session) {\n        sessions.set(session.getId(), session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string): Promise<Map<string, DBSession>> {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number): Promise<void> {\n    return this.db.cleanupExpiredSessions(cleanupCount);\n  }\n}\n"],"mappings":";;;;AAyBA,IAAM,YAAN,cAAwB,WAAW;CACjC;CACA;CAEA,YAAY,QAAoB,OAAgB;EAC9C,MAAM,MAAM;EACZ,KAAK,QAAQ;EACb,KAAK,YAAY,WAAW;CAC9B;AACF;AAUA,IAAa,6BAAb,MAAgF;CAC9E,6BAAqC;CACrC;CAEA,YAAY,IAAe;EACzB,KAAK,KAAK;CACZ;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,mBAA2B,SAAmC;EAC5D,MAAM,aAAqD,CAAC;EAC5D,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,GAC3C,WAAW,QAAQ,QAAQ,aAAa,IAAI;EAE9C,MAAM,gBAAgB,kBAAkB,OAAO;EAE/C,OAAO;GACL,WAAW,QAAQ;GACnB,WAAW,QAAQ,MAAM;GACzB,OAAO,QAAQ;GACf,cAAc,QAAQ,gBAAgB;GACtC,gBAAgB,QAAQ,oBAAoB;GAC5C,qBAAqB,QAAQ,uBAAuB;GACpD,YAAY,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;GAC/E;GACA;EACF;CACF;CAEA,mBAA2B,QAAuB,cAAyC;EACzF,MAAM,SAAS,IAAI,WAAW,OAAO,SAAS;EAC9C,OAAO,gBAAgB,OAAO,YAAY;EAC1C,OAAO,oBAAoB,OAAO,cAAc;EAChD,OAAO,uBAAuB,OAAO,mBAAmB;EACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,UAAU,GACzD,OAAO,aAAa,KAAK,KAAK;EAGhC,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,UAAU,IAAI,UAAU,QAAQ,KAAK;EAC3C,QAAQ,YAAY,OAAO;EAC3B,OAAO;CACT;CAEA,MAAc,WAAW,IAAY,cAAkD;EACrF,MAAM,SAAS,MAAM,KAAK,GAAG,SAAS,EAAE;EACxC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,KAAK,mBAAmB,QAAQ,YAAY;CACrD;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAI,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,UAAU,QAAQ,IAAI;CACnC;CAEA,MAAM,KAAK,SAAoB;EAC7B,MAAM,SAAS,KAAK,mBAAmB,OAAO;EAC9C,MAAM,KAAK,GAAG,KAAK,MAAM;EACzB,QAAQ,QAAQ;CAClB;CAEA,MAAM,SAAS,WAA8C;EAC3D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,KAAK,GAAG,WAAW,SAAS;CACpC;CAEA,MAAM,6BACJ,WACA,YACiC;EACjC,IAAI,cAAA,0FACF,uBAAO,IAAI,IAAuB;EAEpC,MAAM,WAAW,MAAM,KAAK,GAAG,oBAAoB,UAAU;EAC7D,IAAI,SAAS,WAAW,GACtB,uBAAO,IAAI,IAAuB;EAEpC,MAAM,2BAAW,IAAI,IAAuB;EAC5C,KAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,KAAK,mBAAmB,QAAQ,KAAK;GACrD,IAAI,SACF,SAAS,IAAI,QAAQ,MAAM,GAAG,OAAO;EAEzC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAwD;EAChF,OAAO,KAAK,6BAA6B,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAsC;EACjE,OAAO,KAAK,GAAG,uBAAuB,YAAY;CACpD;AACF"}
+{"version":3,"file":"db.mjs","names":[],"sources":["../../src/session/db.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { PRINCIPAL_NAME_INDEX_NAME, principalNameOf } from './common';\nimport { MapSession } from './map-session';\nimport type { SessionRepository } from './types';\n\ninterface SessionEntity {\n  primaryId: string;\n  sessionId: string;\n  /**\n   * Set on the entity `save` hands the adapter: `true` for a session created in this request and\n   * never stored, `false` for one the adapter returned from `findById` / `findByPrincipalName`. As\n   * in Spring Session's `JdbcIndexedSessionRepository`, it is what decides between an INSERT and\n   * an UPDATE — an UPDATE that touches no row then means the session was deleted meanwhile\n   * (logout, kick) and must not be written back. Absent on entities the adapter returns.\n   */\n  isNew?: boolean;\n  creationTime: number;\n  lastAccessTime: number;\n  maxInactiveInterval: number;\n  expiryTime: number;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  attributes: Record<string, any>;\n  principalName?: string | null;\n}\n\nclass DBSession extends MapSession {\n  public isNew: boolean;\n  public primaryId: string;\n\n  constructor(cached: MapSession, isNew: boolean) {\n    super(cached);\n    this.isNew = isNew;\n    this.primaryId = randomUUID();\n  }\n}\n\nexport interface DBAdapter {\n  save(session: SessionEntity): Promise<void>;\n  deleteById(sessionId: string): Promise<void>;\n  findById(sessionId: string): Promise<SessionEntity | null>;\n  findByPrincipalName(principalName: string): Promise<SessionEntity[]>;\n  cleanupExpiredSessions(cleanupCount?: number): Promise<void>;\n}\n\nexport class DBIndexedSessionRepository implements SessionRepository<DBSession> {\n  private defaultMaxInactiveInterval = 1800;\n  private readonly db: DBAdapter;\n\n  constructor(db: DBAdapter) {\n    this.db = db;\n  }\n\n  setDefaultMaxInactiveInterval(interval: number) {\n    this.defaultMaxInactiveInterval = interval;\n  }\n\n  private mapSessionToEntity(session: DBSession): SessionEntity {\n    const attributes: Record<string, string | number | null> = {};\n    for (const name of session.getAttributeNames()) {\n      attributes[name] = session.getAttribute(name);\n    }\n    const principalName = principalNameOf(session);\n\n    return {\n      primaryId: session.primaryId,\n      sessionId: session.getId(),\n      isNew: session.isNew,\n      creationTime: session.getCreationTime(),\n      lastAccessTime: session.getLastAccessedTime(),\n      maxInactiveInterval: session.getMaxInactiveInterval(),\n      expiryTime: session.getLastAccessedTime() + session.getMaxInactiveInterval() * 1000,\n      attributes,\n      principalName,\n    };\n  }\n\n  private mapEntityToSession(entity: SessionEntity, allowExpired: boolean): DBSession | null {\n    const loaded = new MapSession(entity.sessionId);\n    loaded.setCreationTime(entity.creationTime);\n    loaded.setLastAccessedTime(entity.lastAccessTime);\n    loaded.setMaxInactiveInterval(entity.maxInactiveInterval);\n    for (const [key, value] of Object.entries(entity.attributes)) {\n      loaded.setAttribute(key, value);\n    }\n\n    if (!allowExpired && loaded.isExpired()) return null;\n    const session = new DBSession(loaded, false);\n    session.primaryId = entity.primaryId;\n    return session;\n  }\n\n  private async getSession(id: string, allowExpired: boolean): Promise<DBSession | null> {\n    const entity = await this.db.findById(id);\n    if (!entity) return null;\n    return this.mapEntityToSession(entity, allowExpired);\n  }\n\n  // override\n  createSession() {\n    const cached = new MapSession();\n    cached.setMaxInactiveInterval(this.defaultMaxInactiveInterval);\n    return new DBSession(cached, true);\n  }\n\n  async save(session: DBSession) {\n    const entity = this.mapSessionToEntity(session);\n    await this.db.save(entity);\n    session.isNew = false;\n  }\n\n  async findById(sessionId: string): Promise<DBSession | null> {\n    return this.getSession(sessionId, false);\n  }\n\n  async deleteById(sessionId: string) {\n    await this.db.deleteById(sessionId);\n  }\n\n  async findByIndexNameAndIndexValue(\n    indexName: string,\n    indexValue: string\n  ): Promise<Map<string, DBSession>> {\n    if (indexName !== PRINCIPAL_NAME_INDEX_NAME) {\n      return new Map<string, DBSession>();\n    }\n    const entities = await this.db.findByPrincipalName(indexValue);\n    if (entities.length === 0) {\n      return new Map<string, DBSession>();\n    }\n    const sessions = new Map<string, DBSession>();\n    for (const entity of entities) {\n      const session = this.mapEntityToSession(entity, false);\n      if (session) {\n        sessions.set(session.getId(), session);\n      }\n    }\n    return sessions;\n  }\n\n  async findByPrincipalName(principalName: string): Promise<Map<string, DBSession>> {\n    return this.findByIndexNameAndIndexValue(PRINCIPAL_NAME_INDEX_NAME, principalName);\n  }\n\n  async cleanupExpiredSessions(cleanupCount?: number): Promise<void> {\n    return this.db.cleanupExpiredSessions(cleanupCount);\n  }\n}\n"],"mappings":";;;;AAyBA,IAAM,YAAN,cAAwB,WAAW;CACjC;CACA;CAEA,YAAY,QAAoB,OAAgB;EAC9C,MAAM,MAAM;EACZ,KAAK,QAAQ;EACb,KAAK,YAAY,WAAW;CAC9B;AACF;AAUA,IAAa,6BAAb,MAAgF;CAC9E,6BAAqC;CACrC;CAEA,YAAY,IAAe;EACzB,KAAK,KAAK;CACZ;CAEA,8BAA8B,UAAkB;EAC9C,KAAK,6BAA6B;CACpC;CAEA,mBAA2B,SAAmC;EAC5D,MAAM,aAAqD,CAAC;EAC5D,KAAK,MAAM,QAAQ,QAAQ,kBAAkB,GAC3C,WAAW,QAAQ,QAAQ,aAAa,IAAI;EAE9C,MAAM,gBAAgB,gBAAgB,OAAO;EAE7C,OAAO;GACL,WAAW,QAAQ;GACnB,WAAW,QAAQ,MAAM;GACzB,OAAO,QAAQ;GACf,cAAc,QAAQ,gBAAgB;GACtC,gBAAgB,QAAQ,oBAAoB;GAC5C,qBAAqB,QAAQ,uBAAuB;GACpD,YAAY,QAAQ,oBAAoB,IAAI,QAAQ,uBAAuB,IAAI;GAC/E;GACA;EACF;CACF;CAEA,mBAA2B,QAAuB,cAAyC;EACzF,MAAM,SAAS,IAAI,WAAW,OAAO,SAAS;EAC9C,OAAO,gBAAgB,OAAO,YAAY;EAC1C,OAAO,oBAAoB,OAAO,cAAc;EAChD,OAAO,uBAAuB,OAAO,mBAAmB;EACxD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,UAAU,GACzD,OAAO,aAAa,KAAK,KAAK;EAGhC,IAAI,CAAC,gBAAgB,OAAO,UAAU,GAAG,OAAO;EAChD,MAAM,UAAU,IAAI,UAAU,QAAQ,KAAK;EAC3C,QAAQ,YAAY,OAAO;EAC3B,OAAO;CACT;CAEA,MAAc,WAAW,IAAY,cAAkD;EACrF,MAAM,SAAS,MAAM,KAAK,GAAG,SAAS,EAAE;EACxC,IAAI,CAAC,QAAQ,OAAO;EACpB,OAAO,KAAK,mBAAmB,QAAQ,YAAY;CACrD;CAGA,gBAAgB;EACd,MAAM,SAAS,IAAI,WAAW;EAC9B,OAAO,uBAAuB,KAAK,0BAA0B;EAC7D,OAAO,IAAI,UAAU,QAAQ,IAAI;CACnC;CAEA,MAAM,KAAK,SAAoB;EAC7B,MAAM,SAAS,KAAK,mBAAmB,OAAO;EAC9C,MAAM,KAAK,GAAG,KAAK,MAAM;EACzB,QAAQ,QAAQ;CAClB;CAEA,MAAM,SAAS,WAA8C;EAC3D,OAAO,KAAK,WAAW,WAAW,KAAK;CACzC;CAEA,MAAM,WAAW,WAAmB;EAClC,MAAM,KAAK,GAAG,WAAW,SAAS;CACpC;CAEA,MAAM,6BACJ,WACA,YACiC;EACjC,IAAI,cAAA,iBACF,uBAAO,IAAI,IAAuB;EAEpC,MAAM,WAAW,MAAM,KAAK,GAAG,oBAAoB,UAAU;EAC7D,IAAI,SAAS,WAAW,GACtB,uBAAO,IAAI,IAAuB;EAEpC,MAAM,2BAAW,IAAI,IAAuB;EAC5C,KAAK,MAAM,UAAU,UAAU;GAC7B,MAAM,UAAU,KAAK,mBAAmB,QAAQ,KAAK;GACrD,IAAI,SACF,SAAS,IAAI,QAAQ,MAAM,GAAG,OAAO;EAEzC;EACA,OAAO;CACT;CAEA,MAAM,oBAAoB,eAAwD;EAChF,OAAO,KAAK,6BAA6B,2BAA2B,aAAa;CACnF;CAEA,MAAM,uBAAuB,cAAsC;EACjE,OAAO,KAAK,GAAG,uBAAuB,YAAY;CACpD;AACF"}

package/dist/session/map-session.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let node_crypto = require("node:crypto");
-//#region src/session/map-session.ts
+// src/session/map-session.ts
 function generateId() {
 	return (0, node_crypto.randomUUID)();
 }
@@ -70,7 +70,6 @@ var MapSession = class {
 		return Date.now() - this.maxInactiveInterval * 1e3 - this.lastAccessedTime >= 0;
 	}
 };
-//#endregion
 exports.MapSession = MapSession;
 
 //# sourceMappingURL=map-session.cjs.map

package/dist/session/map-session.d.cts

@@ -1,5 +1,4 @@
 import { Session } from "./types.cjs";
-//#region src/session/map-session.d.ts
 export declare class MapSession implements Session {
   private id;
   private readonly sessionAttrs;
@@ -22,5 +21,4 @@ export declare class MapSession implements Session {
   setMaxInactiveInterval(interval: number): void;
   isExpired(): boolean;
 }
-//#endregion
 //# sourceMappingURL=map-session.d.cts.map

package/dist/session/map-session.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"map-session.d.cts","names":[],"sources":["../../src/session/map-session.ts"],"mappings":";;qBASa,sBAAsB;UACzB;mBACS;UACT;UACA;UACA;EAER,YAAY;EACZ,YAAY,SAAS;EAuBrB,gBAAgB;EAKhB;EAIA;EAMA,aAAa;EAIb;EAIA,aAAa,cAAc;EAQ3B,gBAAgB;EAIhB;EAIA;EAIA,oBAAoB;EAIpB;EAIA,uBAAuB;EAIvB"}
+{"version":3,"file":"map-session.d.cts","names":[],"sources":["../../src/session/map-session.ts"],"mappings":";qBASa,sBAAsB;UACzB;mBACS;UACT;UACA;UACA;EAER,YAAY;EACZ,YAAY,SAAS;EAuBrB,gBAAgB;EAKhB;EAIA;EAMA,aAAa;EAIb;EAIA,aAAa,cAAc;EAQ3B,gBAAgB;EAIhB;EAIA;EAIA,oBAAoB;EAIpB;EAIA,uBAAuB;EAIvB"}

package/dist/session/map-session.d.mts

@@ -1,5 +1,4 @@
 import { Session } from "./types.mjs";
-//#region src/session/map-session.d.ts
 export declare class MapSession implements Session {
   private id;
   private readonly sessionAttrs;
@@ -22,5 +21,4 @@ export declare class MapSession implements Session {
   setMaxInactiveInterval(interval: number): void;
   isExpired(): boolean;
 }
-//#endregion
 //# sourceMappingURL=map-session.d.mts.map

package/dist/session/map-session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"map-session.d.mts","names":[],"sources":["../../src/session/map-session.ts"],"mappings":";;qBASa,sBAAsB;UACzB;mBACS;UACT;UACA;UACA;EAER,YAAY;EACZ,YAAY,SAAS;EAuBrB,gBAAgB;EAKhB;EAIA;EAMA,aAAa;EAIb;EAIA,aAAa,cAAc;EAQ3B,gBAAgB;EAIhB;EAIA;EAIA,oBAAoB;EAIpB;EAIA,uBAAuB;EAIvB"}
+{"version":3,"file":"map-session.d.mts","names":[],"sources":["../../src/session/map-session.ts"],"mappings":";qBASa,sBAAsB;UACzB;mBACS;UACT;UACA;UACA;EAER,YAAY;EACZ,YAAY,SAAS;EAuBrB,gBAAgB;EAKhB;EAIA;EAMA,aAAa;EAIb;EAIA,aAAa,cAAc;EAQ3B,gBAAgB;EAIhB;EAIA;EAIA,oBAAoB;EAIpB;EAIA,uBAAuB;EAIvB"}

package/dist/session/map-session.mjs

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-//#region src/session/map-session.ts
+// src/session/map-session.ts
 function generateId() {
 	return randomUUID();
 }
@@ -69,7 +69,6 @@ var MapSession = class {
 		return Date.now() - this.maxInactiveInterval * 1e3 - this.lastAccessedTime >= 0;
 	}
 };
-//#endregion
 export { MapSession };
 
 //# sourceMappingURL=map-session.mjs.map

package/dist/session/redis.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_session_common = require("./common.cjs");
 const require_session_map_session = require("./map-session.cjs");
-//#region src/session/redis.ts
+// src/session/redis.ts
 const CREATION_TIME_KEY = "creationTime";
 const LAST_ACCESSED_TIME_KEY = "lastAccessedTime";
 const MAX_INACTIVE_INTERVAL_KEY = "maxInactiveInterval";
@@ -18,7 +18,7 @@ var RedisSession = class {
 		this.cached = cached;
 		this.isNew = isNew;
 		this.originalSessionId = cached.getId();
-		this.originalPrincipalName = require_session_common.resolveIndexesFor(this);
+		this.originalPrincipalName = require_session_common.principalNameOf(this);
 		if (isNew) {
 			this.delta.set(CREATION_TIME_KEY, cached.getCreationTime());
 			this.delta.set(LAST_ACCESSED_TIME_KEY, cached.getLastAccessedTime());
@@ -113,7 +113,7 @@ var RedisIndexedSessionRepository = class {
 	namespace;
 	expirationStore;
 	defaultMaxInactiveInterval = 1800;
-	constructor(redis, namespace = "spring:session") {
+	constructor(redis, namespace = "app:session") {
 		this.redis = redis;
 		this.namespace = namespace;
 		this.expirationStore = new SortedSetRedisSessionExpirationStore(redis, namespace);
@@ -161,14 +161,12 @@ var RedisIndexedSessionRepository = class {
 		});
 		if (delta.size !== 0) await this.redis.hset(this.getSessionKey(sessionId), delta);
 		if (removes.length !== 0) await this.redis.hdel(this.getSessionKey(sessionId), ...removes);
-		const principalSessionKey = this.getSessionAttrNameKey(require_session_common.PRINCIPAL_NAME_INDEX_NAME);
-		const securityPrincipalSessionKey = this.getSessionAttrNameKey(require_session_common.SPRING_SECURITY_CONTEXT);
-		if (session.delta.has(principalSessionKey) || session.delta.has(securityPrincipalSessionKey)) {
+		if (session.delta.has(this.getSessionAttrNameKey("principalName"))) {
 			if (session.originalPrincipalName !== null) {
 				const originalPrincipalRedisKey = this.getPrincipalKey(session.originalPrincipalName);
 				await this.redis.srem(originalPrincipalRedisKey, sessionId);
 			}
-			const principal = require_session_common.resolveIndexesFor(session);
+			const principal = require_session_common.principalNameOf(session);
 			session.originalPrincipalName = principal;
 			if (principal !== null) {
 				const principalRedisKey = this.getPrincipalKey(principal);
@@ -229,7 +227,7 @@ var RedisIndexedSessionRepository = class {
 	async deleteById(sessionId) {
 		const session = await this.getSession(sessionId, true);
 		if (!session) return;
-		const principal = require_session_common.resolveIndexesFor(session);
+		const principal = require_session_common.principalNameOf(session);
 		if (principal !== null) await this.redis.srem(this.getPrincipalKey(principal), sessionId);
 		await this.expirationStore.remove(sessionId);
 		const expiredKey = this.getExpiredKey(sessionId);
@@ -238,7 +236,7 @@ var RedisIndexedSessionRepository = class {
 		await this.save(session);
 	}
 	async findByIndexNameAndIndexValue(indexName, indexValue) {
-		if (indexName !== "org.springframework.session.FindByIndexNameSessionRepository.PRINCIPAL_NAME_INDEX_NAME") return /* @__PURE__ */ new Map();
+		if (indexName !== "principalName") return /* @__PURE__ */ new Map();
 		const principalKey = this.getPrincipalKey(indexValue);
 		const sessionIds = await this.redis.smembers(principalKey);
 		if (sessionIds.length === 0) return /* @__PURE__ */ new Map();
@@ -281,7 +279,6 @@ var RedisKVRepository = class {
 		return Number(count);
 	}
 };
-//#endregion
 exports.RedisIndexedSessionRepository = RedisIndexedSessionRepository;
 exports.RedisKVRepository = RedisKVRepository;