@spinajs/rbac 2.0.489 → 2.0.491

package/lib/cjs/migrations/RBACInitial_2022_06_28_01_13_00.js

@@ -13,7 +13,7 @@ let RBACInitial_2022_06_28_01_13_00 = class RBACInitial_2022_06_28_01_13_00 exte
     async up(connection) {
         await connection.schema().createTable('users', (table) => {
             table.int('Id').primaryKey().autoIncrement();
-            table.uuid('Uuid').notNull();
+            table.string('Uuid', 36).notNull();
             table.string('Email', 64).unique().notNull();
             table.string('Password', 128).notNull();
             table.string('Login', 64).notNull();

package/lib/cjs/migrations/RBACInitial_2022_06_28_01_13_00.js.map

@@ -1 +1 @@
-{"version":3,"file":"RBACInitial_2022_06_28_01_13_00.js","sourceRoot":"","sources":["../../../src/migrations/RBACInitial_2022_06_28_01_13_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sDAAsD;AACtD,sCAAkE;AAI3D,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,kBAAY;IACxD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACtH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,qCAAqC;IACrC,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AAhCY,0EAA+B;0CAA/B,+BAA+B;IAD3C,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,+BAA+B,CAgC3C"}
+{"version":3,"file":"RBACInitial_2022_06_28_01_13_00.js","sourceRoot":"","sources":["../../../src/migrations/RBACInitial_2022_06_28_01_13_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sDAAsD;AACtD,sCAAkE;AAI3D,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,kBAAY;IACxD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACtH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,qCAAqC;IACrC,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AAhCY,0EAA+B;0CAA/B,+BAA+B;IAD3C,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,+BAA+B,CAgC3C"}

package/lib/cjs/session-codec.d.ts

@@ -6,10 +6,36 @@
  */
 export declare function encodeSessionData(data: Map<string, unknown>): string;
 /**
- * Restores a session `Data` map from a JSON string produced by
- * {@link encodeSessionData}.
+ * Restores a session `Data` map from whatever a store hands back for the payload
+ * written by {@link encodeSessionData}.
  *
- * @param json - the serialized session data
+ * TWO representations reach this function, and both are legitimate:
+ *
+ *  - a **string** - what {@link encodeSessionData} produces, and what every
+ *    text-ish column and every non-SQL store (redis, dynamodb) returns. Parsed
+ *    with {@link sessionReviver}, the JSON.parse path.
+ *  - an **object** - a MySQL `json` column, which mysql2 parses for us before
+ *    the ORM ever sees it. Walked with {@link reviveSessionValue}: the value is
+ *    already an object graph, so round-tripping it back through
+ *    `JSON.stringify` + `JSON.parse` purely to reach the reviver would be
+ *    pointless work on every single session read.
+ *
+ * Both branches are kept deliberately. `user_sessions.Data` is a `json` column
+ * on fresh installs and on every install that has run the converging migration,
+ * but a driver, a column type or a store that still yields a string must keep
+ * decoding - and the sqlite driver used by the tests is exactly that case.
+ *
+ * ANYTHING ELSE THROWS. The object branch is narrowed to a real object
+ * (`!== null && typeof === 'object'`) rather than being the `else` of the string
+ * test, because widening the parameter to `unknown` otherwise turns `null`,
+ * `undefined` and a stray number into a silently EMPTY session: every request
+ * carrying that session reads as authenticated-but-anonymous, and a store that
+ * started handing back the wrong shape would log out its entire user base
+ * without a single error line. A missing or malformed payload is a defect in the
+ * store, not a session with no data, and it is raised as one.
+ *
+ * @param data - the serialized session data, as string or as parsed object
+ * @throws `InvalidArgument` when `data` is neither a string nor a non-null object
  */
-export declare function decodeSessionData(json: string): Map<string, unknown>;
+export declare function decodeSessionData(data: string | unknown): Map<string, unknown>;
 //# sourceMappingURL=session-codec.d.ts.map

package/lib/cjs/session-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpE"}
+{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAkHA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAc9E"}

package/lib/cjs/session-codec.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodeSessionData = encodeSessionData;
 exports.decodeSessionData = decodeSessionData;
 const luxon_1 = require("luxon");
+const exceptions_1 = require("@spinajs/exceptions");
 const util_1 = require("@spinajs/util");
 /**
  * Shared session-data serialization codec (fixes B5 — symmetric write/read).
@@ -37,6 +38,68 @@ function sessionReviver(key, value) {
     }
     return (0, util_1.reviver)(key, value);
 }
+const MAP_TAG = 'Map';
+const SET_TAG = 'Set';
+/**
+ * Object-graph twin of {@link sessionReviver}: turns the same tags back into the
+ * same instances, but reads a value that is ALREADY a parsed object graph
+ * instead of JSON text.
+ *
+ * It exists because a MySQL `json` column comes back from mysql2 already parsed.
+ * Re-serializing that object only to hand it straight back to `JSON.parse` would
+ * be a pure waste - and passing it to the decoder untransformed is worse than
+ * wasteful: the payload's top level is the tagged wrapper
+ * `{ dataType: 'Map', value: [...] }`, so without this walk `parsed instanceof Map`
+ * is false and the session decodes as silently EMPTY.
+ *
+ * Kept byte-for-byte semantically equal to the reviver:
+ *
+ *  - `JSON.parse` calls its reviver bottom-up (children before parents), so the
+ *    walk recurses into children BEFORE inspecting the node's own tag,
+ *  - the DateTime tag is checked before the shared Map/Set tags, matching
+ *    {@link sessionReviver}'s order,
+ *  - properties are installed with `defineProperty` so a payload carrying a
+ *    literal `__proto__` key becomes an own data property (what `JSON.parse`
+ *    does) rather than mutating the result's prototype.
+ *
+ * Values that are already live instances (`Map` / `Set` / `DateTime`) are passed
+ * through untouched: a caller may legitimately hand over data that never went
+ * through a database at all.
+ */
+function reviveSessionValue(value) {
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(reviveSessionValue);
+    }
+    // already-materialized structural types - nothing to rebuild
+    if (value instanceof Map || value instanceof Set || luxon_1.DateTime.isDateTime(value)) {
+        return value;
+    }
+    const tag = value.dataType;
+    if (tag === DATETIME_TAG) {
+        return luxon_1.DateTime.fromISO(value.value);
+    }
+    if (tag === MAP_TAG) {
+        const entries = (value.value ?? []);
+        return new Map(entries.map(([k, v]) => [reviveSessionValue(k), reviveSessionValue(v)]));
+    }
+    if (tag === SET_TAG) {
+        const members = (value.value ?? []);
+        return new Set(members.map(reviveSessionValue));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        Object.defineProperty(out, k, {
+            value: reviveSessionValue(v),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
+    return out;
+}
 /**
  * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
  * `DateTime` values.
@@ -47,13 +110,46 @@ function encodeSessionData(data) {
     return JSON.stringify({ dataType: 'Map', value: Array.from(data.entries()) }, sessionReplacer);
 }
 /**
- * Restores a session `Data` map from a JSON string produced by
- * {@link encodeSessionData}.
+ * Restores a session `Data` map from whatever a store hands back for the payload
+ * written by {@link encodeSessionData}.
+ *
+ * TWO representations reach this function, and both are legitimate:
  *
- * @param json - the serialized session data
+ *  - a **string** - what {@link encodeSessionData} produces, and what every
+ *    text-ish column and every non-SQL store (redis, dynamodb) returns. Parsed
+ *    with {@link sessionReviver}, the JSON.parse path.
+ *  - an **object** - a MySQL `json` column, which mysql2 parses for us before
+ *    the ORM ever sees it. Walked with {@link reviveSessionValue}: the value is
+ *    already an object graph, so round-tripping it back through
+ *    `JSON.stringify` + `JSON.parse` purely to reach the reviver would be
+ *    pointless work on every single session read.
+ *
+ * Both branches are kept deliberately. `user_sessions.Data` is a `json` column
+ * on fresh installs and on every install that has run the converging migration,
+ * but a driver, a column type or a store that still yields a string must keep
+ * decoding - and the sqlite driver used by the tests is exactly that case.
+ *
+ * ANYTHING ELSE THROWS. The object branch is narrowed to a real object
+ * (`!== null && typeof === 'object'`) rather than being the `else` of the string
+ * test, because widening the parameter to `unknown` otherwise turns `null`,
+ * `undefined` and a stray number into a silently EMPTY session: every request
+ * carrying that session reads as authenticated-but-anonymous, and a store that
+ * started handing back the wrong shape would log out its entire user base
+ * without a single error line. A missing or malformed payload is a defect in the
+ * store, not a session with no data, and it is raised as one.
+ *
+ * @param data - the serialized session data, as string or as parsed object
+ * @throws `InvalidArgument` when `data` is neither a string nor a non-null object
  */
-function decodeSessionData(json) {
-    const parsed = JSON.parse(json, sessionReviver);
-    return parsed instanceof Map ? parsed : new Map();
+function decodeSessionData(data) {
+    if (typeof data === 'string') {
+        const parsed = JSON.parse(data, sessionReviver);
+        return parsed instanceof Map ? parsed : new Map();
+    }
+    if (data !== null && typeof data === 'object') {
+        const revived = reviveSessionValue(data);
+        return revived instanceof Map ? revived : new Map();
+    }
+    throw new exceptions_1.InvalidArgument(`Cannot decode session data: expected a JSON string or an already-parsed object, got ${data === null ? 'null' : typeof data}`, 'data');
 }
 //# sourceMappingURL=session-codec.js.map

package/lib/cjs/session-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":";;AA8CA,8CAEC;AAQD,8CAGC;AA3DD,iCAAiC;AACjC,wCAAkG;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,gBAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAA,eAAY,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,gBAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAA,cAAW,EAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":";;AAwHA,8CAEC;AAkCD,8CAcC;AA1KD,iCAAiC;AACjC,oDAAsD;AACtD,wCAAkG;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,gBAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAA,eAAY,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,gBAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAA,cAAW,EAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,CAAC;AACtB,MAAM,OAAO,GAAG,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK,YAAY,GAAG,IAAI,KAAK,YAAY,GAAG,IAAI,gBAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAI,KAAyB,CAAC,QAAQ,CAAC;IAEhD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,OAAO,gBAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAE,KAAyB,CAAC,KAAK,IAAI,EAAE,CAAyB,CAAC;QACjF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAuB,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAE,KAAyB,CAAC,KAAK,IAAI,EAAE,CAAc,CAAC;QACtE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE;YAC5B,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC5B,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAgB,iBAAiB,CAAC,IAAsB;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEhD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IAC/F,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,OAAO,YAAY,GAAG,CAAC,CAAC,CAAE,OAAgC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IACjG,CAAC;IAED,MAAM,IAAI,4BAAe,CAAC,uFAAuF,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACnK,CAAC"}

package/lib/mjs/migrations/RBACInitial_2022_06_28_01_13_00.js

@@ -10,7 +10,7 @@ let RBACInitial_2022_06_28_01_13_00 = class RBACInitial_2022_06_28_01_13_00 exte
     async up(connection) {
         await connection.schema().createTable('users', (table) => {
             table.int('Id').primaryKey().autoIncrement();
-            table.uuid('Uuid').notNull();
+            table.string('Uuid', 36).notNull();
             table.string('Email', 64).unique().notNull();
             table.string('Password', 128).notNull();
             table.string('Login', 64).notNull();

package/lib/mjs/migrations/RBACInitial_2022_06_28_01_13_00.js.map

@@ -1 +1 @@
-{"version":3,"file":"RBACInitial_2022_06_28_01_13_00.js","sourceRoot":"","sources":["../../../src/migrations/RBACInitial_2022_06_28_01_13_00.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAa,SAAS,EAAE,MAAM,cAAc,CAAC;AAI3D,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,YAAY;IACxD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACtH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,qCAAqC;IACrC,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AAhCY,+BAA+B;IAD3C,SAAS,CAAC,SAAS,CAAC;GACR,+BAA+B,CAgC3C"}
+{"version":3,"file":"RBACInitial_2022_06_28_01_13_00.js","sourceRoot":"","sources":["../../../src/migrations/RBACInitial_2022_06_28_01_13_00.ts"],"names":[],"mappings":";;;;;;AAAA,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAa,SAAS,EAAE,MAAM,cAAc,CAAC;AAI3D,IAAM,+BAA+B,GAArC,MAAM,+BAAgC,SAAQ,YAAY;IACxD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACtH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,qCAAqC;IACrC,gEAAgE;IACzD,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAkB,CAAC;CAC5D,CAAA;AAhCY,+BAA+B;IAD3C,SAAS,CAAC,SAAS,CAAC;GACR,+BAA+B,CAgC3C"}

package/lib/mjs/session-codec.d.ts

@@ -6,10 +6,36 @@
  */
 export declare function encodeSessionData(data: Map<string, unknown>): string;
 /**
- * Restores a session `Data` map from a JSON string produced by
- * {@link encodeSessionData}.
+ * Restores a session `Data` map from whatever a store hands back for the payload
+ * written by {@link encodeSessionData}.
  *
- * @param json - the serialized session data
+ * TWO representations reach this function, and both are legitimate:
+ *
+ *  - a **string** - what {@link encodeSessionData} produces, and what every
+ *    text-ish column and every non-SQL store (redis, dynamodb) returns. Parsed
+ *    with {@link sessionReviver}, the JSON.parse path.
+ *  - an **object** - a MySQL `json` column, which mysql2 parses for us before
+ *    the ORM ever sees it. Walked with {@link reviveSessionValue}: the value is
+ *    already an object graph, so round-tripping it back through
+ *    `JSON.stringify` + `JSON.parse` purely to reach the reviver would be
+ *    pointless work on every single session read.
+ *
+ * Both branches are kept deliberately. `user_sessions.Data` is a `json` column
+ * on fresh installs and on every install that has run the converging migration,
+ * but a driver, a column type or a store that still yields a string must keep
+ * decoding - and the sqlite driver used by the tests is exactly that case.
+ *
+ * ANYTHING ELSE THROWS. The object branch is narrowed to a real object
+ * (`!== null && typeof === 'object'`) rather than being the `else` of the string
+ * test, because widening the parameter to `unknown` otherwise turns `null`,
+ * `undefined` and a stray number into a silently EMPTY session: every request
+ * carrying that session reads as authenticated-but-anonymous, and a store that
+ * started handing back the wrong shape would log out its entire user base
+ * without a single error line. A missing or malformed payload is a defect in the
+ * store, not a session with no data, and it is raised as one.
+ *
+ * @param data - the serialized session data, as string or as parsed object
+ * @throws `InvalidArgument` when `data` is neither a string nor a non-null object
  */
-export declare function decodeSessionData(json: string): Map<string, unknown>;
+export declare function decodeSessionData(data: string | unknown): Map<string, unknown>;
 //# sourceMappingURL=session-codec.d.ts.map

package/lib/mjs/session-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpE"}
+{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAkHA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAc9E"}

package/lib/mjs/session-codec.js

@@ -1,4 +1,5 @@
 import { DateTime } from 'luxon';
+import { InvalidArgument } from '@spinajs/exceptions';
 import { replacer as baseReplacer, reviver as baseReviver } from '@spinajs/util';
 /**
  * Shared session-data serialization codec (fixes B5 — symmetric write/read).
@@ -33,6 +34,68 @@ function sessionReviver(key, value) {
     }
     return baseReviver(key, value);
 }
+const MAP_TAG = 'Map';
+const SET_TAG = 'Set';
+/**
+ * Object-graph twin of {@link sessionReviver}: turns the same tags back into the
+ * same instances, but reads a value that is ALREADY a parsed object graph
+ * instead of JSON text.
+ *
+ * It exists because a MySQL `json` column comes back from mysql2 already parsed.
+ * Re-serializing that object only to hand it straight back to `JSON.parse` would
+ * be a pure waste - and passing it to the decoder untransformed is worse than
+ * wasteful: the payload's top level is the tagged wrapper
+ * `{ dataType: 'Map', value: [...] }`, so without this walk `parsed instanceof Map`
+ * is false and the session decodes as silently EMPTY.
+ *
+ * Kept byte-for-byte semantically equal to the reviver:
+ *
+ *  - `JSON.parse` calls its reviver bottom-up (children before parents), so the
+ *    walk recurses into children BEFORE inspecting the node's own tag,
+ *  - the DateTime tag is checked before the shared Map/Set tags, matching
+ *    {@link sessionReviver}'s order,
+ *  - properties are installed with `defineProperty` so a payload carrying a
+ *    literal `__proto__` key becomes an own data property (what `JSON.parse`
+ *    does) rather than mutating the result's prototype.
+ *
+ * Values that are already live instances (`Map` / `Set` / `DateTime`) are passed
+ * through untouched: a caller may legitimately hand over data that never went
+ * through a database at all.
+ */
+function reviveSessionValue(value) {
+    if (value === null || typeof value !== 'object') {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(reviveSessionValue);
+    }
+    // already-materialized structural types - nothing to rebuild
+    if (value instanceof Map || value instanceof Set || DateTime.isDateTime(value)) {
+        return value;
+    }
+    const tag = value.dataType;
+    if (tag === DATETIME_TAG) {
+        return DateTime.fromISO(value.value);
+    }
+    if (tag === MAP_TAG) {
+        const entries = (value.value ?? []);
+        return new Map(entries.map(([k, v]) => [reviveSessionValue(k), reviveSessionValue(v)]));
+    }
+    if (tag === SET_TAG) {
+        const members = (value.value ?? []);
+        return new Set(members.map(reviveSessionValue));
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        Object.defineProperty(out, k, {
+            value: reviveSessionValue(v),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
+    return out;
+}
 /**
  * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
  * `DateTime` values.
@@ -43,13 +106,46 @@ export function encodeSessionData(data) {
     return JSON.stringify({ dataType: 'Map', value: Array.from(data.entries()) }, sessionReplacer);
 }
 /**
- * Restores a session `Data` map from a JSON string produced by
- * {@link encodeSessionData}.
+ * Restores a session `Data` map from whatever a store hands back for the payload
+ * written by {@link encodeSessionData}.
+ *
+ * TWO representations reach this function, and both are legitimate:
  *
- * @param json - the serialized session data
+ *  - a **string** - what {@link encodeSessionData} produces, and what every
+ *    text-ish column and every non-SQL store (redis, dynamodb) returns. Parsed
+ *    with {@link sessionReviver}, the JSON.parse path.
+ *  - an **object** - a MySQL `json` column, which mysql2 parses for us before
+ *    the ORM ever sees it. Walked with {@link reviveSessionValue}: the value is
+ *    already an object graph, so round-tripping it back through
+ *    `JSON.stringify` + `JSON.parse` purely to reach the reviver would be
+ *    pointless work on every single session read.
+ *
+ * Both branches are kept deliberately. `user_sessions.Data` is a `json` column
+ * on fresh installs and on every install that has run the converging migration,
+ * but a driver, a column type or a store that still yields a string must keep
+ * decoding - and the sqlite driver used by the tests is exactly that case.
+ *
+ * ANYTHING ELSE THROWS. The object branch is narrowed to a real object
+ * (`!== null && typeof === 'object'`) rather than being the `else` of the string
+ * test, because widening the parameter to `unknown` otherwise turns `null`,
+ * `undefined` and a stray number into a silently EMPTY session: every request
+ * carrying that session reads as authenticated-but-anonymous, and a store that
+ * started handing back the wrong shape would log out its entire user base
+ * without a single error line. A missing or malformed payload is a defect in the
+ * store, not a session with no data, and it is raised as one.
+ *
+ * @param data - the serialized session data, as string or as parsed object
+ * @throws `InvalidArgument` when `data` is neither a string nor a non-null object
  */
-export function decodeSessionData(json) {
-    const parsed = JSON.parse(json, sessionReviver);
-    return parsed instanceof Map ? parsed : new Map();
+export function decodeSessionData(data) {
+    if (typeof data === 'string') {
+        const parsed = JSON.parse(data, sessionReviver);
+        return parsed instanceof Map ? parsed : new Map();
+    }
+    if (data !== null && typeof data === 'object') {
+        const revived = reviveSessionValue(data);
+        return revived instanceof Map ? revived : new Map();
+    }
+    throw new InvalidArgument(`Cannot decode session data: expected a JSON string or an already-parsed object, got ${data === null ? 'null' : typeof data}`, 'data');
 }
 //# sourceMappingURL=session-codec.js.map

package/lib/mjs/session-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAmB,MAAM,eAAe,CAAC;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,QAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAmB,MAAM,eAAe,CAAC;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,QAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,CAAC;AACtB,MAAM,OAAO,GAAG,KAAK,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvC,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK,YAAY,GAAG,IAAI,KAAK,YAAY,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,GAAG,GAAI,KAAyB,CAAC,QAAQ,CAAC;IAEhD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAE,KAAyB,CAAC,KAAK,IAAI,EAAE,CAAyB,CAAC;QACjF,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAuB,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,CAAE,KAAyB,CAAC,KAAK,IAAI,EAAE,CAAc,CAAC;QACtE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,GAAG,GAA4B,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE;YAC5B,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC5B,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEhD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IAC/F,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAEzC,OAAO,OAAO,YAAY,GAAG,CAAC,CAAC,CAAE,OAAgC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;IACjG,CAAC;IAED,MAAM,IAAI,eAAe,CAAC,uFAAuF,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AACnK,CAAC"}