@smess/networking 1.2.0 → 2.1.0

package/dist/modules/smeup-file/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * SMEUp files (`src/Microservice/SMEUpFile`, host `app.smeup_file_host` → api.smess.vn).
+ * The file name is the storage key: give each upload a unique one or it replaces the earlier file.
+ */
+import type { SmessClient } from '../../core/client.js';
+/** `SMEUpFileGetDto`, plain `json_encode` (camelCase, nulls kept). */
+export interface SmeupFile {
+    id: string | null;
+    name: string | null;
+    path: string | null;
+    /** Public URL of the stored file. */
+    realPath: string | null;
+}
+export interface SmeupFileUploadInput {
+    /** Storage key, ≤ 255 characters. */
+    name: string;
+    /** A data URL (`data:image/png;base64,…`), ≤ 7 MB of text. */
+    base64_image: string;
+}
+export declare const smeupFileEndpoints: {
+    readonly upload: import("../../core/endpoint.js").Endpoint<"/v1/smeup-files/upload", SmeupFileUploadInput, never, SmeupFile>;
+};
+export declare function smeupFile(client: SmessClient): {
+    upload: (input: SmeupFileUploadInput) => Promise<SmeupFile>;
+};
+export type SmeupFileModule = ReturnType<typeof smeupFile>;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/smeup-file/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/smeup-file/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAIxD,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,kBAAkB;;CAQrB,CAAC;AAEX,wBAAgB,SAAS,CAAC,MAAM,EAAE,WAAW;oBAEzB,oBAAoB;EAEvC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC"}

package/dist/modules/smeup-file/index.js

@@ -0,0 +1,17 @@
+import { unwrapData } from '../../core/decoders.js';
+import { defineEndpoint } from '../../core/endpoint.js';
+export const smeupFileEndpoints = {
+    upload: defineEndpoint()({
+        service: 'smeupFile',
+        method: 'POST',
+        path: '/v1/smeup-files/upload',
+        auth: 'required',
+        decode: unwrapData,
+    }),
+};
+export function smeupFile(client) {
+    return {
+        upload: (input) => client.call(smeupFileEndpoints.upload, { body: input }),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/smeup-file/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/smeup-file/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAkBxD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM,EAAE,cAAc,EAAmC,CAAC;QACxD,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,UAAU;KACnB,CAAC;CACM,CAAC;AAEX,MAAM,UAAU,SAAS,CAAC,MAAmB;IAC3C,OAAO;QACL,MAAM,EAAE,CAAC,KAA2B,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;KACjG,CAAC;AACJ,CAAC"}

package/dist/modules/sso/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Company single sign-on (`src/Microservice/Sso`, host `app.sso_host` → sso.smess.vn).
+ *
+ * 1. `start(provider, { app })` returns the provider's authorization URL; navigate the browser there.
+ * 2. The provider returns to `https://sso.smess.vn/sso/{provider}/callback`, which redirects to
+ *    `{appUrl}/sso#token=…&refresh_token=…&email=…` (tokens in the fragment, never sent to a server),
+ *    or to `{appUrl}/login?sso_error=<message>`.
+ * 3. On the `/sso` page call `completeLogin(location.hash)`.
+ */
+import type { SmessClient } from '../../core/client.js';
+import type { Session } from '../../session/types.js';
+/** Provider keys configured in core (`entra-id` today). */
+export type SsoProvider = 'entra-id' | (string & Record<never, never>);
+export interface SsoAuthorization {
+    object: 'sso_authorization';
+    authorization_url: string;
+}
+export interface SsoStartInput {
+    /** The app key registered in core's Sso module (e.g. `smeup-email`). */
+    app: string;
+}
+export declare const ssoEndpoints: {
+    readonly start: import("../../core/endpoint.js").Endpoint<"/v1/sso/{provider}/start", SsoStartInput, never, SsoAuthorization>;
+};
+export interface SsoCallbackResult {
+    session: Session;
+    email: string | null;
+}
+/** Reads the tokens from the `/sso` page fragment (`#token=…&refresh_token=…&email=…`); null when absent. */
+export declare function parseSsoCallback(hash: string): SsoCallbackResult | null;
+/** The message core put in `?sso_error=` on the app's `/login` page, or null. */
+export declare function readSsoError(search: string): string | null;
+export declare function sso(client: SmessClient): {
+    /** The provider's sign-in URL for this app. */
+    start: (provider: SsoProvider, input: SsoStartInput) => Promise<string>;
+    /** Saves the session carried by the callback fragment. Fails with `unauthenticated` / `sso_no_token`. */
+    completeLogin: (hash: string) => Promise<SsoCallbackResult>;
+};
+export type SsoModule = ReturnType<typeof sso>;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/sso/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/sso/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,YAAY;;CAOf,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,6GAA6G;AAC7G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAQvE;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1D;AAED,wBAAgB,GAAG,CAAC,MAAM,EAAE,WAAW;IAEnC,+CAA+C;sBACvB,WAAW,SAAS,aAAa;IAGzD,yGAAyG;0BAC7E,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAAC;EASlE;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC"}

package/dist/modules/sso/index.js

@@ -0,0 +1,41 @@
+import { defineEndpoint } from '../../core/endpoint.js';
+import { SmessApiError } from '../../errors/smess-api-error.js';
+export const ssoEndpoints = {
+    start: defineEndpoint()({
+        service: 'sso',
+        method: 'POST',
+        path: '/v1/sso/{provider}/start',
+        auth: 'none',
+    }),
+};
+/** Reads the tokens from the `/sso` page fragment (`#token=…&refresh_token=…&email=…`); null when absent. */
+export function parseSsoCallback(hash) {
+    const params = new URLSearchParams(hash.startsWith('#') ? hash.slice(1) : hash);
+    const token = params.get('token');
+    if (!token)
+        return null;
+    return {
+        session: { accessToken: token, refreshToken: params.get('refresh_token') || null },
+        email: params.get('email') || null,
+    };
+}
+/** The message core put in `?sso_error=` on the app's `/login` page, or null. */
+export function readSsoError(search) {
+    return new URLSearchParams(search.startsWith('?') ? search.slice(1) : search).get('sso_error') || null;
+}
+export function sso(client) {
+    return {
+        /** The provider's sign-in URL for this app. */
+        start: async (provider, input) => (await client.call(ssoEndpoints.start, { path: { provider }, body: input })).authorization_url,
+        /** Saves the session carried by the callback fragment. Fails with `unauthenticated` / `sso_no_token`. */
+        completeLogin: async (hash) => {
+            const result = parseSsoCallback(hash);
+            if (!result) {
+                throw new SmessApiError({ kind: 'unauthenticated', code: 'sso_no_token', message: 'The sign-in response has no token.' });
+            }
+            await client.session.set(result.session);
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/sso/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/sso/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAgBhE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,cAAc,EAAmC,CAAC;QACvD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,0BAA0B;QAChC,IAAI,EAAE,MAAM;KACb,CAAC;CACM,CAAC;AAOX,6GAA6G;AAC7G,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE;QAClF,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAmB;IACrC,OAAO;QACL,+CAA+C;QAC/C,KAAK,EAAE,KAAK,EAAE,QAAqB,EAAE,KAAoB,EAAE,EAAE,CAC3D,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB;QAEhG,yGAAyG;QACzG,aAAa,EAAE,KAAK,EAAE,IAAY,EAA8B,EAAE;YAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAC5H,CAAC;YACD,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/rx/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Optional RxJS adapter (peer dependency `rxjs`). Wraps a promise-returning call in a cold Observable
+ * that aborts the HTTP request when the subscriber unsubscribes.
+ *
+ * ```ts
+ * fromSmess((signal) => email.templates.list({ signal })).subscribe(...)
+ * ```
+ */
+import { Observable } from 'rxjs';
+export declare function fromSmess<T>(call: (signal: AbortSignal) => Promise<T>): Observable<T>;
+//# sourceMappingURL=index.d.ts.map

package/dist/rx/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rx/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAYrF"}

package/dist/rx/index.js

@@ -0,0 +1,20 @@
+/**
+ * Optional RxJS adapter (peer dependency `rxjs`). Wraps a promise-returning call in a cold Observable
+ * that aborts the HTTP request when the subscriber unsubscribes.
+ *
+ * ```ts
+ * fromSmess((signal) => email.templates.list({ signal })).subscribe(...)
+ * ```
+ */
+import { Observable } from 'rxjs';
+export function fromSmess(call) {
+    return new Observable((subscriber) => {
+        const controller = new AbortController();
+        call(controller.signal).then((value) => {
+            subscriber.next(value);
+            subscriber.complete();
+        }, (error) => subscriber.error(error));
+        return () => controller.abort();
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/rx/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rx/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,MAAM,UAAU,SAAS,CAAI,IAAyC;IACpE,OAAO,IAAI,UAAU,CAAI,CAAC,UAAU,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE;YACR,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,UAAU,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAC5C,CAAC;QACF,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/session/auth-middleware.d.ts

@@ -0,0 +1,27 @@
+import type { SmessClient } from '../core/client.js';
+import type { Middleware } from '../core/pipeline.js';
+import type { Session, SessionExpiredEvent, SessionStore } from './types.js';
+/**
+ * Exchanges a session's refresh token for a new session. Reject with a `SmessApiError`: a 4xx means the
+ * refresh token is dead (the session is cleared); anything else (network, 5xx) keeps the session.
+ */
+export type RefreshStrategy = (context: {
+    session: Session;
+    client: SmessClient;
+}) => Promise<Session>;
+export interface AuthMiddlewareOptions {
+    store: SessionStore | null;
+    refresh: RefreshStrategy | null;
+    /** Refresh this long before `exp` (ms). */
+    refreshSkewMs: number;
+    onSessionExpired?: ((event: SessionExpiredEvent) => void) | undefined;
+    /** The client refresh calls go through (resolved lazily). */
+    client: () => SmessClient;
+    now?: () => number;
+}
+/**
+ * Attaches the access token per the endpoint's auth mode, refreshes it shortly before expiry and once on
+ * 401 (single-flight), and clears the session when it cannot be renewed.
+ */
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): Middleware;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/session/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../src/session/auth-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,qBAAqB,CAAC;AAGtE,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnG;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvG,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACtE,6DAA6D;IAC7D,MAAM,EAAE,MAAM,WAAW,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAmBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,UAAU,CAmG/E"}

package/dist/session/auth-middleware.js

@@ -0,0 +1,122 @@
+import { SmessApiError } from '../errors/smess-api-error.js';
+import { tokenExpiresAt } from './jwt.js';
+/** One refresh at a time per store, shared by every client that uses the store. */
+const inflight = new WeakMap();
+const TRANSIENT_KINDS = new Set(['network', 'timeout', 'unavailable', 'server', 'rate_limited']);
+function isDeadRefreshToken(error) {
+    if (!SmessApiError.is(error))
+        return false;
+    if (error.kind === 'invalid_response')
+        return true;
+    return error.status >= 400 && error.status < 500 && error.status !== 408 && error.status !== 429;
+}
+const isTransient = (error) => SmessApiError.is(error) && TRANSIENT_KINDS.has(error.kind);
+function requestInfo(context) {
+    return { method: context.request.method, url: context.request.url, service: context.endpoint.service };
+}
+/**
+ * Attaches the access token per the endpoint's auth mode, refreshes it shortly before expiry and once on
+ * 401 (single-flight), and clears the session when it cannot be renewed.
+ */
+export function createAuthMiddleware(options) {
+    const now = options.now ?? Date.now;
+    const { store, refresh } = options;
+    const expire = async (usedToken, reason, error) => {
+        if (!store)
+            return;
+        const current = await store.get();
+        // Another request already cleared it, or a newer session replaced it: nothing to do.
+        if (!current || current.accessToken !== usedToken)
+            return;
+        await store.clear();
+        options.onSessionExpired?.(error === undefined ? { reason } : { reason, error });
+    };
+    const refreshOnce = (session) => {
+        if (!store || !refresh)
+            return Promise.resolve(null);
+        const pending = inflight.get(store);
+        if (pending)
+            return pending;
+        const run = (async () => {
+            try {
+                const renewed = await refresh({ session, client: options.client() });
+                await store.set(renewed);
+                return renewed;
+            }
+            catch (error) {
+                if (isDeadRefreshToken(error)) {
+                    await expire(session.accessToken, 'refresh_failed', error);
+                    return null;
+                }
+                throw error;
+            }
+        })().finally(() => inflight.delete(store));
+        inflight.set(store, run);
+        return run;
+    };
+    const expiresSoon = (token) => {
+        const expiresAt = tokenExpiresAt(token);
+        return expiresAt !== null && expiresAt - now() <= options.refreshSkewMs;
+    };
+    return async (context, next) => {
+        const { headers } = context.request;
+        const mode = context.endpoint.auth;
+        if (mode === 'none') {
+            headers.delete('Authorization');
+            return next();
+        }
+        // A caller-supplied Authorization header (server-to-server token) bypasses the session.
+        if (headers.has('Authorization'))
+            return next();
+        let session = store ? await store.get() : null;
+        if (!session?.accessToken) {
+            if (mode === 'required') {
+                throw new SmessApiError({ kind: 'unauthenticated', code: 'no_session', message: 'Sign-in is required.', request: requestInfo(context) });
+            }
+            return next();
+        }
+        if (refresh && session.refreshToken && expiresSoon(session.accessToken)) {
+            try {
+                const renewed = await refreshOnce(session);
+                if (!renewed) {
+                    if (mode === 'required') {
+                        throw new SmessApiError({ kind: 'unauthenticated', code: 'session_expired', message: 'The session has expired.', request: requestInfo(context) });
+                    }
+                    return next();
+                }
+                session = renewed;
+            }
+            catch (error) {
+                // Could not reach the refresh endpoint: try the current token, the server decides.
+                if (!isTransient(error))
+                    throw error;
+            }
+        }
+        const usedToken = session.accessToken;
+        headers.set('Authorization', `Bearer ${usedToken}`);
+        const response = await next();
+        if (response.status !== 401)
+            return response;
+        const current = store ? await store.get() : null;
+        if (current?.accessToken && current.accessToken !== usedToken) {
+            // Another request refreshed meanwhile.
+            if (!context.request.replayable)
+                return response;
+            headers.set('Authorization', `Bearer ${current.accessToken}`);
+            return next();
+        }
+        if (refresh && current?.refreshToken) {
+            const renewed = await refreshOnce(current);
+            if (!renewed || !context.request.replayable)
+                return response;
+            headers.set('Authorization', `Bearer ${renewed.accessToken}`);
+            const retried = await next();
+            if (retried.status === 401)
+                await expire(renewed.accessToken, 'unauthorized');
+            return retried;
+        }
+        await expire(usedToken, 'unauthorized');
+        return response;
+    };
+}
+//# sourceMappingURL=auth-middleware.js.map

package/dist/session/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../src/session/auth-middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAoB1C,mFAAmF;AACnF,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAyC,CAAC;AAEtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAEjG,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;AACnG,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAE5G,SAAS,WAAW,CAAC,OAAuB;IAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;AACzG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEnC,MAAM,MAAM,GAAG,KAAK,EAAE,SAAiB,EAAE,MAA4B,EAAE,KAAe,EAAE,EAAE;QACxF,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClC,qFAAqF;QACrF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QAC1D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,OAAgB,EAA2B,EAAE;QAChE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;YACtB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACrE,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACzB,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;oBAC3D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,KAAa,EAAW,EAAE;QAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,GAAG,EAAE,IAAI,OAAO,CAAC,aAAa,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEnC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAChC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,wFAAwF;QACxF,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAEhD,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;wBACxB,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACpJ,CAAC;oBACD,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mFAAmF;gBACnF,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAE7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9D,uCAAuC;YACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU;gBAAE,OAAO,QAAQ,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU;gBAAE,OAAO,QAAQ,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/session/jwt.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Claims core-services puts in its access JWT (Lexik defaults plus `JWTCreatedEventListener`).
+ * Decoding does not verify the signature: use the claims for UI decisions only, never for security.
+ */
+export interface SmessJwtClaims {
+    readonly exp?: number;
+    readonly iat?: number;
+    readonly username?: string;
+    readonly roles?: readonly string[];
+    readonly user_id?: string | number;
+    /** The tenant (Authentication Client) the token is stamped for; must match any `X-Client-Id` sent with it. */
+    readonly client_id?: string;
+    readonly contact_verification_enabled?: boolean;
+    readonly [claim: string]: unknown;
+}
+/** The JWT payload, or null when the token is not a decodable JWT. */
+export declare function decodeJwt(token: string): SmessJwtClaims | null;
+/** Expiry in epoch milliseconds, or null when the token has no readable `exp`. */
+export declare function tokenExpiresAt(token: string): number | null;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/session/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/session/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAChD,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AASD,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAS9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D"}

package/dist/session/jwt.js

@@ -0,0 +1,25 @@
+function base64UrlDecode(segment) {
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(segment.length / 4) * 4, '=');
+    const binary = atob(base64);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+}
+/** The JWT payload, or null when the token is not a decodable JWT. */
+export function decodeJwt(token) {
+    const payload = token.split('.')[1];
+    if (!payload)
+        return null;
+    try {
+        const claims = JSON.parse(base64UrlDecode(payload));
+        return typeof claims === 'object' && claims !== null && !Array.isArray(claims) ? claims : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Expiry in epoch milliseconds, or null when the token has no readable `exp`. */
+export function tokenExpiresAt(token) {
+    const exp = decodeJwt(token)?.exp;
+    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/session/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/session/jwt.ts"],"names":[],"mappings":"AAgBA,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IAClC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC"}

package/dist/session/stores.d.ts

@@ -0,0 +1,19 @@
+import type { Session, SessionStore } from './types.js';
+/** Keeps the session in memory. One store per user: never share one across server requests. */
+export declare function memorySession(initial?: Session | null): SessionStore;
+/** A fixed, read-only session, e.g. the token a Next.js server component read from the request cookie. */
+export declare function staticSession(value: string | Session | null | undefined): SessionStore;
+export interface WebStorageSessionOptions {
+    /** The Storage to use, or a getter (resolved on each access, so importing on the server is safe). Default: `localStorage`. */
+    storage?: Storage | (() => Storage | undefined);
+    /** Default `smess.access_token`. */
+    accessKey?: string;
+    /** Default `smess.refresh_token`. */
+    refreshKey?: string;
+}
+/**
+ * Persists the session in `localStorage` (or another Web Storage). Changes made in other tabs are
+ * delivered to `subscribe` listeners through the `storage` event.
+ */
+export declare function webStorageSession(options?: WebStorageSessionOptions): SessionStore;
+//# sourceMappingURL=stores.d.ts.map

package/dist/session/stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../src/session/stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiBxD,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,OAAO,GAAE,OAAO,GAAG,IAAW,GAAG,YAAY,CAe1E;AAED,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAStF;AAED,MAAM,WAAW,wBAAwB;IACvC,8HAA8H;IAC9H,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC;IAChD,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,YAAY,CAoDtF"}

package/dist/session/stores.js

@@ -0,0 +1,103 @@
+function createListeners() {
+    const listeners = new Set();
+    return {
+        add(listener) {
+            listeners.add(listener);
+            return () => void listeners.delete(listener);
+        },
+        emit(session) {
+            for (const listener of listeners)
+                listener(session);
+        },
+    };
+}
+/** Keeps the session in memory. One store per user: never share one across server requests. */
+export function memorySession(initial = null) {
+    let current = initial;
+    const listeners = createListeners();
+    return {
+        get: () => current,
+        set(session) {
+            current = session;
+            listeners.emit(current);
+        },
+        clear() {
+            current = null;
+            listeners.emit(null);
+        },
+        subscribe: (listener) => listeners.add(listener),
+    };
+}
+/** A fixed, read-only session, e.g. the token a Next.js server component read from the request cookie. */
+export function staticSession(value) {
+    const session = typeof value === 'string' ? (value ? { accessToken: value } : null) : value?.accessToken ? value : null;
+    return {
+        get: () => session,
+        set: () => undefined,
+        clear: () => undefined,
+        readOnly: true,
+    };
+}
+/**
+ * Persists the session in `localStorage` (or another Web Storage). Changes made in other tabs are
+ * delivered to `subscribe` listeners through the `storage` event.
+ */
+export function webStorageSession(options = {}) {
+    const accessKey = options.accessKey ?? 'smess.access_token';
+    const refreshKey = options.refreshKey ?? 'smess.refresh_token';
+    const listeners = createListeners();
+    const storage = () => {
+        if (typeof options.storage === 'function')
+            return options.storage();
+        if (options.storage)
+            return options.storage;
+        try {
+            return typeof localStorage === 'undefined' ? undefined : localStorage;
+        }
+        catch {
+            return undefined; // Access denied (privacy mode, sandboxed iframe).
+        }
+    };
+    const read = () => {
+        const store = storage();
+        const accessToken = store?.getItem(accessKey);
+        if (!accessToken)
+            return null;
+        return { accessToken, refreshToken: store?.getItem(refreshKey) || null };
+    };
+    let subscribed = false;
+    const watchOtherTabs = () => {
+        if (subscribed || typeof window === 'undefined' || typeof window.addEventListener !== 'function')
+            return;
+        subscribed = true;
+        window.addEventListener('storage', (event) => {
+            if (event.key === null || event.key === accessKey || event.key === refreshKey)
+                listeners.emit(read());
+        });
+    };
+    return {
+        get: read,
+        set(session) {
+            const store = storage();
+            if (!store)
+                return;
+            store.setItem(accessKey, session.accessToken);
+            if (session.refreshToken)
+                store.setItem(refreshKey, session.refreshToken);
+            else
+                store.removeItem(refreshKey);
+            listeners.emit(read());
+        },
+        clear() {
+            const store = storage();
+            store?.removeItem(accessKey);
+            store?.removeItem(refreshKey);
+            listeners.emit(null);
+        },
+        subscribe(listener) {
+            watchOtherTabs();
+            return listeners.add(listener);
+        },
+    };
+}
+//# sourceMappingURL=stores.js.map

package/dist/session/stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.js","sourceRoot":"","sources":["../../src/session/stores.ts"],"names":[],"mappings":"AAIA,SAAS,eAAe;IACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAY,CAAC;IACtC,OAAO;QACL,GAAG,CAAC,QAAkB;YACpB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,OAAuB;YAC1B,KAAK,MAAM,QAAQ,IAAI,SAAS;gBAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,aAAa,CAAC,UAA0B,IAAI;IAC1D,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO;YACT,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK;YACH,OAAO,GAAG,IAAI,CAAC;YACf,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,KAA0C;IACtE,MAAM,OAAO,GACX,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,OAAO;QACL,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO;QAClB,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;QACpB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oBAAoB,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IAEpC,MAAM,OAAO,GAAG,GAAwB,EAAE;QACxC,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QACpE,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,kDAAkD;QACtE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAmB,EAAE;QAChC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3E,CAAC,CAAC;IAEF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,IAAI,UAAU,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,UAAU;YAAE,OAAO;QACzG,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3C,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,IAAI;QACT,GAAG,CAAC,OAAO;YACT,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,YAAY;gBAAE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;;gBACrE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,KAAK;YACH,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;YACxB,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YAC7B,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,SAAS,CAAC,QAAQ;YAChB,cAAc,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/session/types.d.ts

@@ -0,0 +1,28 @@
+import type { MaybePromise } from '../core/types.js';
+/** A signed-in session: the Lexik access JWT and, when the login flow returned one, the refresh token. */
+export interface Session {
+    readonly accessToken: string;
+    readonly refreshToken?: string | null;
+}
+/**
+ * Where the session lives (localStorage, memory, a cookie, a per-request server value).
+ * Methods may be sync or async. `readOnly` stores ignore `set`/`clear` (e.g. a token read from a request cookie).
+ */
+export interface SessionStore {
+    get(): MaybePromise<Session | null>;
+    set(session: Session): MaybePromise<void>;
+    clear(): MaybePromise<void>;
+    /** Called with the new session (or null) after any change, including other tabs where supported. */
+    subscribe?(listener: (session: Session | null) => void): () => void;
+    readonly readOnly?: boolean;
+}
+export type SessionExpiredReason = 
+/** The refresh endpoint rejected the refresh token (revoked, expired). */
+'refresh_failed'
+/** The server returned 401 for the access token and it could not be refreshed. */
+ | 'unauthorized';
+export interface SessionExpiredEvent {
+    readonly reason: SessionExpiredReason;
+    readonly error?: unknown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,oGAAoG;IACpG,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,MAAM,oBAAoB;AAC9B,0EAA0E;AACxE,gBAAgB;AAClB,kFAAkF;GAChF,cAAc,CAAC;AAEnB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/session/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":""}