@spine-event-engine/auth 2.0.0-snapshot.10

package/dist/request/index.js

@@ -0,0 +1,81 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { ActorContextSchema, CommandSchema } from "@spine-event-engine/proto";
+import { QuerySchema, SubscriptionSchema, TargetSchema, TopicSchema, } from "@spine-event-engine/proto/client";
+import { AnyMessages } from "@spine-event-engine/core";
+/**
+ * Decodes the public request envelopes accepted by authentication gateways.
+ */
+export const IncomingRequests = Object.freeze({
+    // prettier-ignore
+    /**
+     * Decodes one known wire envelope and omits malformed data.
+     * @param input Supplies the wire envelope and its transport context.
+     * @returns Returns decoded request facts or `undefined` for malformed input.
+     */
+    decode(input) {
+        try {
+            switch (input.kind) {
+                case "command": {
+                    const command = fromBinary(CommandSchema, input.value);
+                    return {
+                        kind: input.kind,
+                        command,
+                        message: command.message === undefined || input.registry === undefined
+                            ? undefined
+                            : AnyMessages.unpackUsing(input.registry, command.message),
+                        messageType: command.message?.typeUrl ?? "",
+                        requestedContext: command.context?.actorContext ?? create(ActorContextSchema),
+                        transport: input.transport,
+                    };
+                }
+                case "query": {
+                    const query = fromBinary(QuerySchema, input.value);
+                    return {
+                        kind: input.kind,
+                        query,
+                        target: query.target ?? create(TargetSchema),
+                        requestedContext: query.context ?? create(ActorContextSchema),
+                        transport: input.transport,
+                    };
+                }
+                case "subscribe": {
+                    const topic = fromBinary(TopicSchema, input.value);
+                    return {
+                        kind: input.kind,
+                        topic,
+                        target: topic.target ?? create(TargetSchema),
+                        requestedContext: topic.context ?? create(ActorContextSchema),
+                        transport: input.transport,
+                    };
+                }
+                case "activate":
+                case "cancel": {
+                    const subscription = fromBinary(SubscriptionSchema, input.value);
+                    return {
+                        kind: input.kind,
+                        subscription,
+                        requestedContext: subscription.topic?.context ?? create(ActorContextSchema),
+                        transport: input.transport,
+                    };
+                }
+            }
+        }
+        catch {
+            return undefined;
+        }
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/request/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAOvD;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,kBAAkB;IAElB;;;;OAIG;IACH,MAAM,CAAC,KAA2B;QAChC,IAAI,CAAC;YACH,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACvD,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO;wBACP,OAAO,EACL,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;4BAC3D,CAAC,CAAC,SAAS;4BACX,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;wBAC9D,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE;wBAC3C,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,MAAM,CAAC,kBAAkB,CAAC;wBAC7E,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC3B,CAAC;gBACJ,CAAC;gBACD,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACnD,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,KAAK;wBACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;wBAC5C,gBAAgB,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC;wBAC7D,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC3B,CAAC;gBACJ,CAAC;gBACD,KAAK,WAAW,CAAC,CAAC,CAAC;oBACjB,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACnD,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,KAAK;wBACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;wBAC5C,gBAAgB,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC;wBAC7D,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC3B,CAAC;gBACJ,CAAC;gBACD,KAAK,UAAU,CAAC;gBAChB,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,YAAY,GAAG,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;oBACjE,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,YAAY;wBACZ,gBAAgB,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC;wBAC3E,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/cookies.d.ts

@@ -0,0 +1,104 @@
+import type { RequestCredential } from "../index.js";
+/**
+ * Header input whose own-property arrays preserve observable duplicate values.
+ */
+export type OpaqueSessionHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
+/**
+ * Construction options for strict opaque-session browser cookie handling.
+ */
+export interface OpaqueSessionCookiesOptions {
+    /**
+     * HMAC key copied on construction; it needs at least 32 bytes and the owned copy is zeroed on `close()`.
+     */
+    readonly csrfSecret: Uint8Array;
+    /**
+     * One or more non-empty canonical Origins matched byte-for-byte on cookie requests.
+     */
+    readonly origins: readonly string[];
+    /**
+     * Distinct valid `__Host-` session-cookie name; defaults to `__Host-spine-session`.
+     */
+    readonly sessionCookieName?: string;
+    /**
+     * Distinct valid `__Host-` CSRF-cookie name; defaults to `__Host-spine-csrf`.
+     */
+    readonly csrfCookieName?: string;
+    /**
+     * Maximum observable own header fields and array values. Defaults to 32.
+     */
+    readonly maxHeaderValues?: number;
+    /**
+     * Maximum total header characters. Defaults to 16,384.
+     */
+    readonly maxHeaderCharacters?: number;
+    /**
+     * Maximum cookie pairs. Defaults to 64.
+     */
+    readonly maxCookiePairs?: number;
+}
+/**
+ * Rejection result from strict browser credential extraction.
+ */
+export interface OpaqueCredentialRejection {
+    /**
+     * Identifies the rejected extraction result.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why the credential was rejected.
+     */
+    readonly reason: "missing-credential" | "duplicate-authorization" | "malformed-authorization" | "malformed-cookie" | "ambiguous-cookie" | "missing-origin" | "duplicate-origin" | "forbidden-origin" | "missing-csrf" | "duplicate-csrf" | "csrf-mismatch" | "request-too-large" | "closed";
+}
+/**
+ * Result of extracting a bearer or CSRF-protected opaque-cookie credential.
+ */
+export type OpaqueCredentialExtraction = RequestCredential | OpaqueCredentialRejection;
+/**
+ * Strict, framework-neutral helper whose `close()` zeroes the copied CSRF secret.
+ */
+export declare class OpaqueSessionCookies {
+    private readonly secret;
+    private readonly origins;
+    private readonly sessionName;
+    private readonly csrfName;
+    private readonly maxHeaderValues;
+    private readonly maxHeaderCharacters;
+    private readonly maxCookiePairs;
+    private closed;
+    /**
+     * Creates strict cookie extraction with copied CSRF key material.
+     * @param options The cookie names, trusted origins, bounds, and CSRF secret.
+     */
+    constructor(options: OpaqueSessionCookiesOptions);
+    /**
+     * Creates the fixed-length unpadded base64url CSRF value for one session ID.
+     * @param sessionId The session identifier protected by the CSRF value.
+     * @returns The derived CSRF value.
+     */
+    csrf(sessionId: string): string;
+    /**
+     * Creates the immutable pair of host-only cookies for a newly issued session.
+     * @param sessionId The issued opaque session identifier.
+     * @returns The session and CSRF Set-Cookie values.
+     */
+    issue(sessionId: string): readonly string[];
+    /**
+     * Creates the immutable pair of host-only cookie removals.
+     * @returns The expired session and CSRF Set-Cookie values.
+     */
+    clear(): readonly string[];
+    /**
+     * Reads bearer credentials first, otherwise a fully checked cookie credential.
+     * @param headers The request headers to inspect.
+     * @returns The admitted credential or its rejection reason.
+     */
+    extract(headers: OpaqueSessionHeaders): OpaqueCredentialExtraction;
+    /**
+     * Closes the extractor, zeroes its HMAC secret, and rejects later operations.
+     * @returns Completes after the secret is cleared.
+     */
+    close(): Promise<void>;
+    private cookieCredential;
+    private open;
+}
+//# sourceMappingURL=cookies.d.ts.map

package/dist/sessions/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/sessions/cookies.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;AAEpG;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAG1C;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,oBAAoB,GACpB,yBAAyB,GACzB,yBAAyB,GACzB,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,mBAAmB,GACnB,QAAQ,CAAC;CACd;AAED;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,GAAG,yBAAyB,CAAC;AAEvF;;GAEG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,MAAM,CAAS;IAEvB;;;OAGG;gBACS,OAAO,EAAE,2BAA2B;IA8BhD;;;;OAIG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAQ/B;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE;IAQ3C;;;OAGG;IACH,KAAK,IAAI,SAAS,MAAM,EAAE;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,0BAA0B;IAclE;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB,OAAO,CAAC,gBAAgB;IA2BxB,OAAO,CAAC,IAAI;CAGb"}

package/dist/sessions/cookies.js

@@ -0,0 +1,295 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Strict, framework-neutral helper whose `close()` zeroes the copied CSRF secret.
+ */
+export class OpaqueSessionCookies {
+    secret;
+    origins;
+    sessionName;
+    csrfName;
+    maxHeaderValues;
+    maxHeaderCharacters;
+    maxCookiePairs;
+    closed = false;
+    /**
+     * Creates strict cookie extraction with copied CSRF key material.
+     * @param options The cookie names, trusted origins, bounds, and CSRF secret.
+     */
+    constructor(options) {
+        if (options.csrfSecret.byteLength < 32)
+            throw new Error("csrfSecret must contain at least 32 bytes");
+        this.secret = new Uint8Array(options.csrfSecret);
+        this.origins = new Set(options.origins.map(CookieValues.validOrigin));
+        if (this.origins.size === 0)
+            throw new Error("origins must contain at least one valid Origin");
+        this.sessionName = CookieValues.validCookieName(options.sessionCookieName ?? "__Host-spine-session", "sessionCookieName");
+        this.csrfName = CookieValues.validCookieName(options.csrfCookieName ?? "__Host-spine-csrf", "csrfCookieName");
+        if (this.sessionName === this.csrfName)
+            throw new Error("sessionCookieName and csrfCookieName must be distinct");
+        this.maxHeaderValues = CookieValues.positiveSafeInteger(options.maxHeaderValues ?? 32, "maxHeaderValues");
+        this.maxHeaderCharacters = CookieValues.positiveSafeInteger(options.maxHeaderCharacters ?? 16_384, "maxHeaderCharacters");
+        this.maxCookiePairs = CookieValues.positiveSafeInteger(options.maxCookiePairs ?? 64, "maxCookiePairs");
+    }
+    /**
+     * Creates the fixed-length unpadded base64url CSRF value for one session ID.
+     * @param sessionId The session identifier protected by the CSRF value.
+     * @returns The derived CSRF value.
+     */
+    csrf(sessionId) {
+        this.open();
+        if (!CookieValues.validSessionId(sessionId)) {
+            throw new Error("sessionId must be a 43-character unpadded base64url session ID");
+        }
+        return createHmac("sha256", this.secret).update(sessionId, "utf8").digest("base64url");
+    }
+    /**
+     * Creates the immutable pair of host-only cookies for a newly issued session.
+     * @param sessionId The issued opaque session identifier.
+     * @returns The session and CSRF Set-Cookie values.
+     */
+    issue(sessionId) {
+        const csrf = this.csrf(sessionId);
+        return Object.freeze([
+            `${this.sessionName}=${sessionId}; Path=/; Secure; HttpOnly; SameSite=Lax`,
+            `${this.csrfName}=${csrf}; Path=/; Secure; SameSite=Lax`,
+        ]);
+    }
+    /**
+     * Creates the immutable pair of host-only cookie removals.
+     * @returns The expired session and CSRF Set-Cookie values.
+     */
+    clear() {
+        this.open();
+        return Object.freeze([
+            `${this.sessionName}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`,
+            `${this.csrfName}=; Path=/; Secure; SameSite=Lax; Max-Age=0`,
+        ]);
+    }
+    /**
+     * Reads bearer credentials first, otherwise a fully checked cookie credential.
+     * @param headers The request headers to inspect.
+     * @returns The admitted credential or its rejection reason.
+     */
+    extract(headers) {
+        if (this.closed)
+            return CookieValues.rejection("closed");
+        const values = CookieValues.headerValues(headers, this.maxHeaderValues, this.maxHeaderCharacters);
+        if (values === undefined)
+            return CookieValues.rejection("request-too-large");
+        const authorization = values.get("authorization") ?? [];
+        if (authorization.length > 1)
+            return CookieValues.rejection("duplicate-authorization");
+        if (authorization.length === 1)
+            return CookieValues.bearer(CookieValues.only(authorization));
+        return this.cookieCredential(values);
+    }
+    /**
+     * Closes the extractor, zeroes its HMAC secret, and rejects later operations.
+     * @returns Completes after the secret is cleared.
+     */
+    close() {
+        if (this.closed)
+            return Promise.resolve();
+        this.closed = true;
+        this.secret.fill(0);
+        return Promise.resolve();
+    }
+    cookieCredential(values) {
+        const cookies = values.get("cookie") ?? [];
+        const parsed = CookieValues.parseCookies(cookies, this.sessionName, this.csrfName, this.maxCookiePairs);
+        if ("reason" in parsed)
+            return CookieValues.rejection(parsed.reason);
+        const origin = CookieValues.one(values, "origin", "missing-origin", "duplicate-origin");
+        if ("reason" in origin)
+            return CookieValues.rejection(origin.reason);
+        if (!this.origins.has(origin.value))
+            return CookieValues.rejection("forbidden-origin");
+        const supplied = CookieValues.one(values, "x-spine-csrf", "missing-csrf", "duplicate-csrf");
+        if ("reason" in supplied)
+            return CookieValues.rejection(supplied.reason);
+        const expected = this.csrf(parsed.session);
+        if (!CookieValues.validCsrf(supplied.value) ||
+            !CookieValues.sameCsrf(expected, supplied.value) ||
+            !CookieValues.sameCsrf(expected, parsed.csrf)) {
+            return CookieValues.rejection("csrf-mismatch");
+        }
+        return Object.freeze({ kind: "cookie", value: parsed.session });
+    }
+    open() {
+        if (this.closed)
+            throw new Error("OpaqueSessionCookies is closed");
+    }
+}
+/**
+ * Parses and validates cookie values used by {@link OpaqueSessionCookies}.
+ */
+const CookieValues = Object.freeze({
+    headerValues(headers, maxValues, maxCharacters) {
+        const result = new Map();
+        let count = 0;
+        let characters = 0;
+        for (const name in headers) {
+            if (!Object.prototype.hasOwnProperty.call(headers, name))
+                continue;
+            if (count === maxValues || characters + name.length > maxCharacters)
+                return undefined;
+            count += 1;
+            characters += name.length;
+            const supplied = headers[name];
+            if (supplied === undefined)
+                continue;
+            const key = name.toLowerCase();
+            const current = result.get(key) ?? [];
+            if (typeof supplied === "string") {
+                if (characters + supplied.length > maxCharacters)
+                    return undefined;
+                characters += supplied.length;
+                current.push(supplied);
+            }
+            else {
+                for (const [index, value] of supplied.entries()) {
+                    if (index > 0 && count === maxValues)
+                        return undefined;
+                    if (characters + value.length > maxCharacters)
+                        return undefined;
+                    if (index > 0)
+                        count += 1;
+                    characters += value.length;
+                    current.push(value);
+                }
+            }
+            result.set(key, current);
+        }
+        return result;
+    },
+    bearer(value) {
+        const match = /^bearer ([\x21-\x7e]+)$/i.exec(value);
+        return match === null
+            ? CookieValues.rejection("malformed-authorization")
+            : Object.freeze({ kind: "bearer", value: CookieValues.only(match.slice(1)) });
+    },
+    parseCookies(headers, sessionName, csrfName, maxPairs) {
+        const found = new Map();
+        let count = 0;
+        for (const header of headers) {
+            if (CookieValues.hasForbiddenCookieCharacter(header))
+                return { reason: "malformed-cookie" };
+            for (const pair of header.split(";")) {
+                count += 1;
+                if (count > maxPairs)
+                    return { reason: "request-too-large" };
+                const index = pair.indexOf("=");
+                if (index <= 0)
+                    return { reason: "malformed-cookie" };
+                const name = pair.slice(0, index).trim();
+                const value = pair.slice(index + 1).trim();
+                if (!CookieValues.validCookiePair(name, value))
+                    return { reason: "malformed-cookie" };
+                if (name === sessionName || name === csrfName) {
+                    if (found.has(name))
+                        return { reason: "ambiguous-cookie" };
+                    found.set(name, [value]);
+                }
+            }
+        }
+        const session = found.get(sessionName) ?? [];
+        const csrf = found.get(csrfName) ?? [];
+        if (session.length === 0 && csrf.length === 0)
+            return { reason: "missing-credential" };
+        if (session.length > 1 || csrf.length > 1)
+            return { reason: "ambiguous-cookie" };
+        if (session.length !== 1 ||
+            csrf.length !== 1 ||
+            !CookieValues.validSessionId(CookieValues.only(session)) ||
+            !CookieValues.validCsrf(CookieValues.only(csrf))) {
+            return { reason: "malformed-cookie" };
+        }
+        return { session: CookieValues.only(session), csrf: CookieValues.only(csrf) };
+    },
+    one(values, name, missing, duplicate) {
+        const entries = values.get(name) ?? [];
+        if (entries.length === 0)
+            return { reason: missing };
+        if (entries.length !== 1)
+            return { reason: duplicate };
+        return { value: CookieValues.only(entries) };
+    },
+    only(values) {
+        const value = values[0];
+        if (value === undefined)
+            throw new Error("expected one header value");
+        return value;
+    },
+    hasForbiddenCookieCharacter(value) {
+        for (const character of value) {
+            const code = character.charCodeAt(0);
+            if (code <= 31 || code === 127 || character === ",")
+                return true;
+        }
+        return false;
+    },
+    validOrigin(origin) {
+        try {
+            const url = new URL(origin);
+            if ((url.protocol !== "https:" && url.protocol !== "http:") ||
+                url.username !== "" ||
+                url.password !== "" ||
+                url.pathname !== "/" ||
+                url.search !== "" ||
+                url.hash !== "" ||
+                url.origin !== origin) {
+                throw new Error();
+            }
+            return origin;
+        }
+        catch {
+            throw new Error("origins must contain only canonical Origins");
+        }
+    },
+    validCookieName(value, name) {
+        if (!value.startsWith("__Host-") || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value)) {
+            throw new Error(`${name} must be a valid __Host- cookie name`);
+        }
+        return value;
+    },
+    positiveSafeInteger(value, name) {
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new Error(`${name} must be a positive safe integer`);
+        }
+        return value;
+    },
+    validCookiePair(name, value) {
+        return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name) && /^[\x21-\x7e]+$/.test(value);
+    },
+    base64url(value) {
+        return /^[A-Za-z0-9_-]+$/.test(value) && value.length % 4 !== 1;
+    },
+    validCsrf(value) {
+        return value.length === 43 && CookieValues.base64url(value);
+    },
+    validSessionId(value) {
+        return value.length === 43 && CookieValues.base64url(value);
+    },
+    sameCsrf(expected, supplied) {
+        if (expected.length !== supplied.length)
+            return false;
+        return timingSafeEqual(Buffer.from(expected), Buffer.from(supplied));
+    },
+    rejection(reason) {
+        return Object.freeze({ kind: "rejected", reason });
+    },
+});
+//# sourceMappingURL=cookies.js.map

package/dist/sessions/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/sessions/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsF1D;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAa;IACnB,OAAO,CAAsB;IAC7B,WAAW,CAAS;IACpB,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,mBAAmB,CAAS;IAC5B,cAAc,CAAS;IAChC,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,OAAoC;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,GAAG,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,eAAe,CAC7C,OAAO,CAAC,iBAAiB,IAAI,sBAAsB,EACnD,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,CAC1C,OAAO,CAAC,cAAc,IAAI,mBAAmB,EAC7C,gBAAgB,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ;YACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,mBAAmB,CACrD,OAAO,CAAC,eAAe,IAAI,EAAE,EAC7B,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CACzD,OAAO,CAAC,mBAAmB,IAAI,MAAM,EACrC,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,mBAAmB,CACpD,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,SAAiB;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAiB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,0CAA0C;YAC1E,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,gCAAgC;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,IAAI,CAAC,WAAW,sDAAsD;YACzE,GAAG,IAAI,CAAC,QAAQ,4CAA4C;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,OAA6B;QACnC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,mBAAmB,CACzB,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACvF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,gBAAgB,CACtB,MAA8C;QAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACxF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC5F,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,IACE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;YAChD,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAC7C,CAAC;YACD,OAAO,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,YAAY,CACV,OAA6B,EAC7B,SAAiB,EACjB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAS;YACnE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,SAAS,CAAC;YACtF,KAAK,IAAI,CAAC,CAAC;YACX,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;YAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa;oBAAE,OAAO,SAAS,CAAC;gBACnE,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;oBAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;oBACvD,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,aAAa;wBAAE,OAAO,SAAS,CAAC;oBAChE,IAAI,KAAK,GAAG,CAAC;wBAAE,KAAK,IAAI,CAAC,CAAC;oBAC1B,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,YAAY,CACV,OAA0B,EAC1B,WAAmB,EACnB,QAAgB,EAChB,QAAgB;QAOhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,2BAA2B,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAC5F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,QAAQ;oBAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;gBAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,IAAI,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBACtF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;oBAC3D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACjF,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAChD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,GAAG,CACD,MAA8C,EAC9C,IAAY,EACZ,OAAU,EACV,SAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,MAAyB;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B,CAAC,KAAa;QACvC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;gBACpB,GAAG,CAAC,MAAM,KAAK,EAAE;gBACjB,GAAG,CAAC,IAAI,KAAK,EAAE;gBACf,GAAG,CAAC,MAAM,KAAK,MAAM,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,eAAe,CAAC,KAAa,EAAE,IAAY;QACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,KAAa;QACzC,OAAO,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,SAAS,CAAC,MAA2C;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/opaque.d.ts

@@ -0,0 +1,163 @@
+import type { AuthenticatedPrincipal, CookieCredential, RequestCredential, ResolvedSession, SessionResolver } from "../index.js";
+/**
+ * Clock used to evaluate opaque-session expiry.
+ */
+export interface OpaqueSessionClock {
+    /**
+     * Returns Unix epoch milliseconds as a safe integer in the Protobuf Timestamp range.
+     * @returns The current milliseconds.
+     */
+    now(): number;
+}
+/**
+ * Creates random bytes for an opaque session identifier.
+ * @param length The required byte length.
+ * @returns The generated bytes.
+ */
+export type OpaqueSessionRandom = (length: number) => Uint8Array;
+/**
+ * Construction options for the bounded in-memory opaque-session resolver.
+ */
+export interface OpaqueSessionsOptions {
+    /**
+     * Millisecond clock; each value must be a safe integer in Timestamp range.
+     */
+    readonly clock?: OpaqueSessionClock;
+    /**
+     * Receives exactly `32` and returns exactly 32 random bytes per call.
+     * Throwing or wrong-length results consume a bounded collision attempt, and
+     * every returned mutable buffer is zeroed before this resolver returns.
+     */
+    readonly randomBytes?: OpaqueSessionRandom;
+    /**
+     * Positive safe session lifetime in milliseconds; defaults to eight hours.
+     */
+    readonly ttlMilliseconds?: number;
+    /**
+     * Positive safe retained-session bound; defaults to 10,000.
+     */
+    readonly maxSessions?: number;
+    /**
+     * Positive safe ID-generation attempt bound; defaults to three.
+     */
+    readonly collisionAttempts?: number;
+}
+/**
+ * Result of creating an opaque session.
+ */
+export type OpaqueSessionCreateResult = {
+    /**
+     * Identifies successful session creation.
+     */
+    readonly kind: "created";
+    /**
+     * Provides the cookie credential for the created session.
+     */
+    readonly credential: CookieCredential;
+    /**
+     * Provides a defensive copy of the created session.
+     */
+    readonly session: ResolvedSession;
+} | {
+    /**
+     * Identifies rejected session creation.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why the session could not be created.
+     */
+    readonly reason: "capacity-exceeded" | "entropy-exhausted" | "clock-failure" | "closed";
+};
+/**
+ * Result of rotating an opaque session.
+ */
+export type OpaqueSessionRotateResult = {
+    /**
+     * Identifies successful session rotation.
+     */
+    readonly kind: "rotated";
+    /**
+     * Provides the replacement cookie credential.
+     */
+    readonly credential: CookieCredential;
+    /**
+     * Provides a defensive copy of the replacement session.
+     */
+    readonly session: ResolvedSession;
+} | {
+    /**
+     * Identifies rejected session rotation.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why the session could not be rotated.
+     */
+    readonly reason: "not-found" | "expired" | "unsupported-credential" | "entropy-exhausted" | "clock-failure" | "closed";
+};
+/**
+ * Enumeration-safe acknowledgement of an opaque-session logout request.
+ */
+export interface OpaqueSessionLogoutResult {
+    /**
+     * Confirms that the logout request was accepted.
+     */
+    readonly kind: "logged-out";
+}
+/**
+ * A bounded, terminal in-memory store of random opaque application sessions.
+ *
+ * It is intentionally process-local: applications needing durable or shared
+ * sessions provide another `SessionResolver` implementation.
+ */
+export declare class OpaqueSessions implements SessionResolver {
+    private readonly records;
+    private readonly clock;
+    private readonly random;
+    private readonly ttlMilliseconds;
+    private readonly maxSessions;
+    private readonly collisionAttempts;
+    private closed;
+    /**
+     * Creates a bounded in-memory session store.
+     * @param options The optional clock, entropy, lifetime, and capacity settings.
+     */
+    constructor(options?: OpaqueSessionsOptions);
+    /**
+     * Creates a new session unless the terminal or bounded store state rejects it.
+     * @param principal The authenticated principal to retain.
+     * @returns The creation outcome and, when accepted, credential and session.
+     */
+    create(principal: AuthenticatedPrincipal): Promise<OpaqueSessionCreateResult>;
+    /**
+     * Resolves one currently live cookie credential as a defensive copy.
+     * @param credentialInput The credential to resolve.
+     * @returns The live session, or undefined when it is invalid or expired.
+     */
+    resolve(credentialInput: RequestCredential): Promise<ResolvedSession | undefined>;
+    /**
+     * Updates a live opaque credential without ever retaining both values.
+     * @param credentialInput The credential to replace.
+     * @returns The rotation outcome and, when accepted, the replacement values.
+     */
+    rotate(credentialInput: RequestCredential): Promise<OpaqueSessionRotateResult>;
+    /**
+     * Deletes a cookie session when present without revealing whether it existed.
+     * @param credentialInput The credential to invalidate.
+     * @returns An enumeration-safe logout acknowledgement.
+     */
+    logout(credentialInput: RequestCredential): Promise<OpaqueSessionLogoutResult>;
+    /**
+     * Closes the store and drops retained session identity and record references.
+     * @returns Completes after retained records are dropped.
+     */
+    close(): Promise<void>;
+    private isClosed;
+    private record;
+    private nextId;
+    private live;
+    private sweepExpired;
+    private expired;
+    private now;
+    private failClosed;
+}
+//# sourceMappingURL=opaque.d.ts.map