@spine-event-engine/auth 2.0.0-snapshot.21 → 2.0.0-snapshot.22

package/dist/sessions/opaque.d.ts

@@ -151,13 +151,50 @@ export declare class OpaqueSessions implements SessionResolver {
      * @returns Completes after retained records are dropped.
      */
     close(): Promise<void>;
+    /**
+     * Checks whether the session store has been closed.
+     * @returns Whether further session operations must be rejected.
+     */
     private isClosed;
+    /**
+     * Creates a bounded session record for an authenticated principal.
+     * @param principal The identity to store in the session.
+     * @param now The validated issuance time in milliseconds.
+     * @returns The record, or undefined if expiry cannot be represented.
+     */
     private record;
+    /**
+     * Creates an unused opaque credential identifier within the retry limit.
+     * @returns The identifier, or undefined after entropy failures or collisions.
+     */
     private nextId;
+    /**
+     * Returns a live session record and removes it when expired.
+     * @param id The opaque credential identifier.
+     * @param now The validated lookup time in milliseconds.
+     * @returns The live record, or undefined if absent or expired.
+     */
     private live;
+    /**
+     * Removes every session that has expired by the supplied time.
+     * @param now The validated sweep time in milliseconds.
+     */
     private sweepExpired;
+    /**
+     * Compares a session expiry with the current millisecond reading.
+     * @param record The session record to inspect.
+     * @param now The validated current time.
+     * @returns Whether the record has expired.
+     */
     private expired;
+    /**
+     * Reads a safe clock value and closes the store on clock failure.
+     * @returns Current epoch milliseconds, or undefined after failure.
+     */
     private now;
+    /**
+     * Closes the store and clears session records after a clock fault.
+     */
     private failClosed;
 }
 //# sourceMappingURL=opaque.d.ts.map

package/dist/sessions/opaque.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CACzF,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,SAAS,GACT,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,MAAM,CAAS;IAEvB;;;OAGG;gBACS,OAAO,GAAE,qBAA0B;IAiB/C;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA8B7E;;;;OAIG;IACH,OAAO,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAQjF;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAsC9E;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM9E;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,MAAM;IAmBd,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,GAAG;IAYX,OAAO,CAAC,UAAU;CAInB"}
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CACzF,CAAC;AAEN;;GAEG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,WAAW,GACX,SAAS,GACT,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAE3C,OAAO,CAAC,MAAM,CAAS;IAEvB;;;OAGG;gBACS,OAAO,GAAE,qBAA0B;IAiB/C;;;;OAIG;IACH,MAAM,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA8B7E;;;;OAIG;IACH,OAAO,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAQjF;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAsC9E;;;;OAIG;IACH,MAAM,CAAC,eAAe,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAM9E;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAOtB;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IASd;;;OAGG;IACH,OAAO,CAAC,MAAM;IAmBd;;;;;OAKG;IACH,OAAO,CAAC,IAAI;IAQZ;;;OAGG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;IAIf;;;OAGG;IACH,OAAO,CAAC,GAAG;IAYX;;OAEG;IACH,OAAO,CAAC,UAAU;CAInB"}

package/dist/sessions/opaque.js

@@ -11,6 +11,7 @@
  * or implied. See the License for the specific language governing permissions and limitations under
  * the License.
  */
+import { Time } from "@spine-event-engine/core/time";
 import { create } from "@bufbuild/protobuf";
 import { TimestampSchema } from "@bufbuild/protobuf/wkt";
 import { randomBytes as nodeRandomBytes } from "node:crypto";
@@ -33,7 +34,7 @@ export class OpaqueSessions {
      * @param options The optional clock, entropy, lifetime, and capacity settings.
      */
     constructor(options = {}) {
-        this.clock = options.clock ?? { now: Date.now };
+        this.clock = options.clock ?? { now: () => Time.currentTimeMillis() };
         this.random = options.randomBytes ?? nodeRandomBytes;
         this.ttlMilliseconds = OpaqueSessionValues.positiveSafeInteger(options.ttlMilliseconds ?? 8 * 60 * 60 * 1_000, "ttlMilliseconds");
         this.maxSessions = OpaqueSessionValues.positiveSafeInteger(options.maxSessions ?? 10_000, "maxSessions");
@@ -162,9 +163,19 @@ export class OpaqueSessions {
         this.records.clear();
         return Promise.resolve();
     }
+    /**
+     * Checks whether the session store has been closed.
+     * @returns Whether further session operations must be rejected.
+     */
     isClosed() {
         return this.closed;
     }
+    /**
+     * Creates a bounded session record for an authenticated principal.
+     * @param principal The identity to store in the session.
+     * @param now The validated issuance time in milliseconds.
+     * @returns The record, or undefined if expiry cannot be represented.
+     */
     record(principal, now) {
         const expiresAt = now + this.ttlMilliseconds;
         if (!Number.isSafeInteger(expiresAt) || !OpaqueSessionValues.timestampValid(expiresAt)) {
@@ -173,6 +184,10 @@ export class OpaqueSessions {
         }
         return { principal: OpaqueSessionValues.copyPrincipal(principal), expiresAt };
     }
+    /**
+     * Creates an unused opaque credential identifier within the retry limit.
+     * @returns The identifier, or undefined after entropy failures or collisions.
+     */
     nextId() {
         for (let attempt = 0; attempt < this.collisionAttempts; attempt += 1) {
             let bytes;
@@ -195,6 +210,12 @@ export class OpaqueSessions {
         }
         return undefined;
     }
+    /**
+     * Returns a live session record and removes it when expired.
+     * @param id The opaque credential identifier.
+     * @param now The validated lookup time in milliseconds.
+     * @returns The live record, or undefined if absent or expired.
+     */
     live(id, now) {
         const record = this.records.get(id);
         if (record === undefined)
@@ -204,14 +225,28 @@ export class OpaqueSessions {
         this.records.delete(id);
         return undefined;
     }
+    /**
+     * Removes every session that has expired by the supplied time.
+     * @param now The validated sweep time in milliseconds.
+     */
     sweepExpired(now) {
         for (const [id, record] of this.records)
             if (this.expired(record, now))
                 this.records.delete(id);
     }
+    /**
+     * Compares a session expiry with the current millisecond reading.
+     * @param record The session record to inspect.
+     * @param now The validated current time.
+     * @returns Whether the record has expired.
+     */
     expired(record, now) {
         return now >= record.expiresAt;
     }
+    /**
+     * Reads a safe clock value and closes the store on clock failure.
+     * @returns Current epoch milliseconds, or undefined after failure.
+     */
     now() {
         try {
             const value = this.clock.now();
@@ -224,6 +259,9 @@ export class OpaqueSessions {
             return undefined;
         }
     }
+    /**
+     * Closes the store and clears session records after a clock fault.
+     */
     failClosed() {
         this.closed = true;
         this.records.clear();
@@ -233,26 +271,52 @@ export class OpaqueSessions {
  * Validates opaque-session values and creates immutable credential data.
  */
 const OpaqueSessionValues = Object.freeze({
+    /**
+     * Validates a positive safe integer for a session limit.
+     * @param value The candidate limit.
+     * @param name The option named in an error.
+     * @returns The accepted limit.
+     */
     positiveSafeInteger(value, name) {
         if (!Number.isSafeInteger(value) || value <= 0)
             throw new Error(`${name} must be a positive safe integer`);
         return value;
     },
+    /**
+     * Wraps an opaque identifier in an immutable cookie credential.
+     * @param value The opaque identifier.
+     * @returns The cookie credential.
+     */
     credential(value) {
         return Object.freeze({ kind: "cookie", value });
     },
+    /**
+     * Copies a principal and freezes its attributes before retention.
+     * @param principal The authenticated identity to copy.
+     * @returns An immutable principal snapshot.
+     */
     copyPrincipal(principal) {
         if (typeof principal.id !== "string")
             throw new Error("principal.id must be a string");
         const attributes = principal.attributes === undefined ? undefined : Object.freeze({ ...principal.attributes });
         return Object.freeze(attributes === undefined ? { id: principal.id } : { id: principal.id, attributes });
     },
+    /**
+     * Builds a detached resolved session from a retained record.
+     * @param record The live session record.
+     * @returns The resolved principal and precise expiry.
+     */
     resolved(record) {
         return Object.freeze({
             principal: OpaqueSessionValues.copyPrincipal(record.principal),
             expiresAt: OpaqueSessionValues.timestamp(record.expiresAt),
         });
     },
+    /**
+     * Converts epoch milliseconds to a Protobuf expiry timestamp.
+     * @param milliseconds The expiry time to encode.
+     * @returns The normalized Protobuf timestamp.
+     */
     timestamp(milliseconds) {
         const seconds = Math.floor(milliseconds / 1_000);
         return create(TimestampSchema, {
@@ -260,6 +324,11 @@ const OpaqueSessionValues = Object.freeze({
             nanos: (milliseconds - seconds * 1_000) * 1_000_000,
         });
     },
+    /**
+     * Checks whether epoch milliseconds fit the Protobuf timestamp range.
+     * @param milliseconds The candidate expiry time.
+     * @returns Whether it fits the supported range.
+     */
     timestampValid(milliseconds) {
         const seconds = Math.floor(milliseconds / 1_000);
         return seconds >= -62_135_596_800 && seconds <= 253_402_300_799;

package/dist/sessions/opaque.js.map

@@ -1 +1 @@
-{"version":3,"file":"opaque.js","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AA0J7D;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC3C,KAAK,CAAqB;IAC1B,MAAM,CAAsB;IAC5B,eAAe,CAAS;IACxB,WAAW,CAAS;IACpB,iBAAiB,CAAS;IACnC,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,mBAAmB,CAC5D,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC9C,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,mBAAmB,CACxD,OAAO,CAAC,WAAW,IAAI,MAAM,EAC7B,aAAa,CACd,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAC9D,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAC9B,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiC;QACtC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,eAAkC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,SAAiC,EAAE,GAAW;QAC3D,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAChF,CAAC;IAEO,MAAM;QACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;oBAAE,SAAS;gBACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,OAAO,EAAE,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,GAAW;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAEO,OAAO,CAAC,MAAqB,EAAE,GAAW;QAChD,OAAO,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,GAAG;QACT,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAOD;;GAEG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,aAAa,CAAC,SAAiC;QAC7C,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,MAAM,UAAU,GACd,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,MAAM,CAClB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAqB;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9D,SAAS,EAAE,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,YAAoB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,eAAe,EAAE;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,CAAC,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG,SAAS;SACpD,CAAC,CAAC;IACL,CAAC;IAED,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,OAAO,IAAI,CAAC,cAAc,IAAI,OAAO,IAAI,eAAe,CAAC;IAClE,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"opaque.js","sourceRoot":"","sources":["../../src/sessions/opaque.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AA0J7D;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE3C,KAAK,CAAqB;IAE1B,MAAM,CAAsB;IAE5B,eAAe,CAAS;IAExB,WAAW,CAAS;IAEpB,iBAAiB,CAAS;IAEnC,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,mBAAmB,CAC5D,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,EAC9C,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,mBAAmB,CACxD,OAAO,CAAC,WAAW,IAAI,MAAM,EAC7B,aAAa,CACd,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,mBAAmB,CAAC,mBAAmB,CAC9D,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAC9B,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAiC;QACtC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YACvC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,eAAkC;QACxC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,SAAS;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,QAAQ,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,eAAkC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,KAAK,QAAQ;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAiC,EAAE,GAAW;QAC3D,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAChF,CAAC;IAED;;;OAGG;IACK,MAAM;QACZ,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACrE,IAAI,KAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE;oBAAE,SAAS;gBACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACpD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,OAAO,EAAE,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,EAAU,EAAE,GAAW;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;;;;OAKG;IACK,OAAO,CAAC,MAAqB,EAAE,GAAW;QAChD,OAAO,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,GAAG;QACT,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAOD;;GAEG;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC;;;;;OAKG;IACH,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,KAAa;QACtB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,SAAiC;QAC7C,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,MAAM,UAAU,GACd,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,MAAM,CAClB,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,CACnF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,MAAqB;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,mBAAmB,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9D,SAAS,EAAE,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,YAAoB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,eAAe,EAAE;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;YACxB,KAAK,EAAE,CAAC,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG,SAAS;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;QACjD,OAAO,OAAO,IAAI,CAAC,cAAc,IAAI,OAAO,IAAI,eAAe,CAAC;IAClE,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/signed.d.ts

@@ -93,7 +93,7 @@ export interface SignedSessionsOptions {
      */
     readonly revocation?: SignedTokenRevocation;
     /**
-     * Unix-millisecond clock; defaults to `Date.now`.
+     * Unix-millisecond clock; defaults to `Time.currentTimeMillis`.
      */
     readonly clock?: SignedSessionClock;
     /**

package/dist/sessions/signed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../../src/sessions/signed.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,SAAS,EAMV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;CAC5F,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC1F,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;CACzD;AAyBD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,eAAe;;IAiBpD;;;OAGG;gBACS,OAAO,EAAE,qBAAqB;IAmD1C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiE3E;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAoBlF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA0C3E;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA6HvB"}
+{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../../src/sessions/signed.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,SAAS,EAMV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;CAC5F,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC1F,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;CACzD;AAyBD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,eAAe;;IA+BpD;;;OAGG;gBACS,OAAO,EAAE,qBAAqB;IAmC1C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiE3E;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAoBlF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA0C3E;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmIvB"}

package/dist/sessions/signed.js

@@ -11,6 +11,7 @@
  * or implied. See the License for the specific language governing permissions and limitations under
  * the License.
  */
+import { Time } from "@spine-event-engine/core/time";
 import { create } from "@bufbuild/protobuf";
 import { KeyObject, createPrivateKey, createPublicKey, randomBytes as nodeRandomBytes, sign, verify, } from "node:crypto";
 import { TimestampSchema } from "@bufbuild/protobuf/wkt";
@@ -40,23 +41,20 @@ export class SignedSessions {
      * @param options The issuer, key ring, limits, clock, entropy, and revocation settings.
      */
     constructor(options) {
-        this.#issuer = SignedSessionValues.boundedString(options.issuer, "issuer");
-        this.#audience = SignedSessionValues.boundedString(options.audience, "audience");
-        this.#ttl = SignedSessionValues.positive(options.ttlSeconds ?? 28_800, "ttlSeconds");
-        this.#skew = SignedSessionValues.nonnegative(options.clockSkewSeconds ?? 60, "clockSkewSeconds");
-        this.#maxToken = SignedSessionValues.positive(options.maxTokenCharacters ?? 8_192, "maxTokenCharacters");
-        this.#maxKeys = SignedSessionValues.positive(options.maxKeys ?? 16, "maxKeys");
-        this.#maxId = SignedSessionValues.positive(options.maxPrincipalIdCharacters ?? 256, "maxPrincipalIdCharacters");
-        this.#maxAttributes = SignedSessionValues.nonnegative(options.maxAttributes ?? 32, "maxAttributes");
-        this.#maxAttributeChars = SignedSessionValues.nonnegative(options.maxAttributeCharacters ?? 4_096, "maxAttributeCharacters");
-        this.#clock = options.clock ?? { now: Date.now };
+        const settings = SignedSessionValues.settings(options);
+        this.#issuer = settings.issuer;
+        this.#audience = settings.audience;
+        this.#ttl = settings.ttl;
+        this.#skew = settings.skew;
+        this.#maxToken = settings.maxToken;
+        this.#maxKeys = settings.maxKeys;
+        this.#maxId = settings.maxId;
+        this.#maxAttributes = settings.maxAttributes;
+        this.#maxAttributeChars = settings.maxAttributeChars;
+        this.#clock = options.clock ?? { now: () => Time.currentTimeMillis() };
         this.#random = options.randomBytes ?? nodeRandomBytes;
         this.#revocation = options.revocation;
-        if ((options.retiredKeys?.length ?? 0) + 1 > this.#maxKeys)
-            throw new Error("maxKeys exceeded");
-        const retainedUntil = options.retiredKeys === undefined || options.retiredKeys.length === 0
-            ? undefined
-            : SignedSessionValues.retentionDeadline(SignedSessionValues.clockValue(this.#clock), this.#ttl, this.#skew);
+        const retainedUntil = SignedSessionValues.retiredRetention(options, this.#maxKeys, this.#clock, this.#ttl, this.#skew);
         this.#active = SignedSessionValues.signing(options.activeKey);
         this.#keys.set(this.#active.kid, { publicKey: this.#active.publicKey });
         for (const key of options.retiredKeys ?? []) {
@@ -360,12 +358,61 @@ export class SignedSessions {
  * Validates, serializes, and constructs finite signed-session values.
  */
 const SignedSessionValues = Object.freeze({
+    /**
+     * Validates the issuer, audience, and finite token limits before key installation.
+     * @param options The signed-session configuration.
+     * @returns Copied and bounded settings for a signed session.
+     */
+    settings(options) {
+        return {
+            issuer: SignedSessionValues.boundedString(options.issuer, "issuer"),
+            audience: SignedSessionValues.boundedString(options.audience, "audience"),
+            ttl: SignedSessionValues.positive(options.ttlSeconds ?? 28_800, "ttlSeconds"),
+            skew: SignedSessionValues.nonnegative(options.clockSkewSeconds ?? 60, "clockSkewSeconds"),
+            maxToken: SignedSessionValues.positive(options.maxTokenCharacters ?? 8_192, "maxTokenCharacters"),
+            maxKeys: SignedSessionValues.positive(options.maxKeys ?? 16, "maxKeys"),
+            maxId: SignedSessionValues.positive(options.maxPrincipalIdCharacters ?? 256, "maxPrincipalIdCharacters"),
+            maxAttributes: SignedSessionValues.nonnegative(options.maxAttributes ?? 32, "maxAttributes"),
+            maxAttributeChars: SignedSessionValues.nonnegative(options.maxAttributeCharacters ?? 4_096, "maxAttributeCharacters"),
+        };
+    },
+    /**
+     * Checks retired-key capacity and computes their shared retention deadline.
+     * @param options The configured retired keys.
+     * @param maxKeys The maximum ring size including the active key.
+     * @param clock The effective session clock.
+     * @param ttl The token lifetime in seconds.
+     * @param skew The accepted clock skew in seconds.
+     * @returns The retention deadline, or no deadline when no retired keys exist.
+     */
+    retiredRetention(options, maxKeys, clock, ttl, skew) {
+        if ((options.retiredKeys?.length ?? 0) + 1 > maxKeys)
+            throw new Error("maxKeys exceeded");
+        return options.retiredKeys === undefined || options.retiredKeys.length === 0
+            ? undefined
+            : SignedSessionValues.retentionDeadline(SignedSessionValues.clockValue(clock), ttl, skew);
+    },
+    /**
+     * Creates a rejected token-issue result.
+     * @param reason The reason for rejecting the operation.
+     * @returns The rejected issue outcome.
+     */
     rejected(reason) {
         return { kind: "rejected", reason };
     },
+    /**
+     * Creates a rejected key-rotation result.
+     * @param reason The reason for rejecting the operation.
+     * @returns The rejected rotation outcome.
+     */
     rotation(reason) {
         return { kind: "rejected", reason };
     },
+    /**
+     * Copies and validates a P-256 private signing key.
+     * @param key The key material to copy and validate.
+     * @returns The copied private and public key pair.
+     */
     signing(key) {
         const kid = SignedSessionValues.boundedString(key.kid, "kid");
         if (key.privateKey.type !== "private" ||
@@ -383,6 +430,11 @@ const SignedSessionValues = Object.freeze({
         const publicKey = createPublicKey(privateKey);
         return { kid, privateKey, publicKey };
     },
+    /**
+     * Copies and validates a P-256 public verification key.
+     * @param key The key material to copy and validate.
+     * @returns The copied public verification key.
+     */
     verification(key) {
         const kid = SignedSessionValues.boundedString(key.kid, "kid");
         if (key.publicKey.type !== "public" ||
@@ -397,41 +449,92 @@ const SignedSessionValues = Object.freeze({
             der.fill(0);
         }
     },
+    /**
+     * Validates a positive safe integer limit.
+     * @param value The positive integer limit to validate.
+     * @param name The named setting in a validation error.
+     * @returns The validated positive limit.
+     */
     positive(value, name) {
         if (!Number.isSafeInteger(value) || value <= 0)
             throw new Error(`${name} must be a positive safe integer`);
         return value;
     },
+    /**
+     * Validates a non-negative safe integer limit.
+     * @param value The non-negative integer limit to validate.
+     * @param name The named setting in a validation error.
+     * @returns The validated non-negative limit.
+     */
     nonnegative(value, name) {
         if (!Number.isSafeInteger(value) || value < 0)
             throw new Error(`${name} must be a non-negative safe integer`);
         return value;
     },
+    /**
+     * Validates a non-empty bounded key or identity string.
+     * @param value The signing key or identity string to validate.
+     * @param name The named setting in a validation error.
+     * @returns The validated string.
+     */
     boundedString(value, name) {
         if (typeof value !== "string" || value.length === 0 || value.length > 256)
             throw new Error(`${name} must be a non-empty string of at most 256 characters`);
         return value;
     },
+    /**
+     * Checks the signing-key identifier length.
+     * @param value The signing-key identifier to check.
+     * @returns Whether the key identifier length is valid.
+     */
     validKid(value) {
         return value.length > 0 && value.length <= 256;
     },
+    /**
+     * Checks the URL-safe base64 alphabet and length.
+     * @param value The encoded string to check for URL-safe base64.
+     * @returns Whether the string is URL-safe base64.
+     */
     base64url(value) {
         return value.length > 0 && /^[A-Za-z0-9_-]+$/.test(value) && value.length % 4 !== 1;
     },
+    /**
+     * Encodes a JSON value as URL-safe base64.
+     * @param value The JSON value to encode.
+     * @returns The encoded JSON string.
+     */
     encode(value) {
         return Buffer.from(JSON.stringify(value)).toString("base64url");
     },
+    /**
+     * Decodes bounded URL-safe base64 JSON.
+     * @param value The URL-safe base64 JSON string to decode.
+     * @returns The decoded JSON value.
+     */
     json(value) {
         const decoded = Buffer.from(value, "base64url");
         if (decoded.byteLength > 16_384)
             throw new Error();
         return JSON.parse(decoded.toString("utf8"));
     },
+    /**
+     * Checks whether a value is a plain object.
+     * @param value The unknown value to test for plain-record shape.
+     * @returns Whether the value is a plain record.
+     */
     plain(value) {
         return (typeof value === "object" &&
             value !== null &&
             Object.getPrototypeOf(value) === Object.prototype);
     },
+    /**
+     * Copies a principal under identifier and attribute bounds.
+     * @param value The principal data to copy under configured bounds.
+     * @param maxId The maximum principal identifier length.
+     * @param maxAttributes The maximum attribute count.
+     * @param maxChars The maximum combined attribute characters.
+     * @returns The immutable principal, or undefined when bounds fail.
+     */
     principalCopy(value, maxId, maxAttributes, maxChars) {
         if (typeof value.id !== "string" || value.id.length === 0 || value.id.length > maxId)
             return undefined;
@@ -459,6 +562,19 @@ const SignedSessionValues = Object.freeze({
             attributes: Object.freeze(Object.fromEntries(entries)),
         });
     },
+    /**
+     * Validates signed token claims, time limits, and principal bounds.
+     * @param value The decoded signed-token claims to validate.
+     * @param issuer The required token issuer.
+     * @param audience The required token audience.
+     * @param ttl The maximum token lifetime in seconds.
+     * @param skew The accepted clock skew in seconds.
+     * @param now The current epoch milliseconds.
+     * @param maxId The maximum principal identifier length.
+     * @param maxAttributes The maximum attribute count.
+     * @param maxChars The maximum combined attribute characters.
+     * @returns Validated claims, or undefined when verification fails.
+     */
     validClaims(value, issuer, audience, ttl, skew, now, maxId, maxAttributes, maxChars) {
         if (!SignedSessionValues.plain(value) ||
             Object.keys(value).some((key) => !["iss", "aud", "sub", "iat", "nbf", "exp", "jti", "attributes"].includes(key)))
@@ -495,9 +611,20 @@ const SignedSessionValues = Object.freeze({
             ...(principal.attributes === undefined ? {} : { attributes: principal.attributes }),
         };
     },
+    /**
+     * Creates a Protobuf timestamp from epoch seconds.
+     * @param seconds The timestamp seconds.
+     * @returns The Protobuf timestamp.
+     */
     timestamp(seconds) {
         return create(TimestampSchema, { seconds: BigInt(seconds) });
     },
+    /**
+     * Creates a resolved session with a detached principal.
+     * @param principal The principal to copy.
+     * @param seconds The timestamp seconds.
+     * @returns The detached resolved session.
+     */
     session(principal, seconds) {
         const copied = SignedSessionValues.principalCopy(principal, Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER, Number.MAX_SAFE_INTEGER);
         if (copied === undefined)
@@ -507,19 +634,41 @@ const SignedSessionValues = Object.freeze({
             expiresAt: SignedSessionValues.timestamp(seconds),
         });
     },
+    /**
+     * Checks whether epoch milliseconds fit a Protobuf timestamp.
+     * @param milliseconds The candidate epoch milliseconds.
+     * @returns Whether the instant is representable.
+     */
     timeValid(milliseconds) {
         const seconds = Math.floor(milliseconds / 1000);
         return seconds >= -62_135_596_800 && seconds <= 253_402_300_799;
     },
+    /**
+     * Checks a token identifier against expected random encoding.
+     * @param value The token identifier to check.
+     * @returns Whether the token identifier has the expected shape.
+     */
     validJti(value) {
         return value.length === 22 && SignedSessionValues.base64url(value);
     },
+    /**
+     * Reads a safe signed-session clock value.
+     * @param clock The configured millisecond clock.
+     * @returns The validated epoch milliseconds.
+     */
     clockValue(clock) {
         const value = clock.now();
         if (!Number.isSafeInteger(value) || !SignedSessionValues.timeValid(value))
             throw new Error("invalid clock");
         return value;
     },
+    /**
+     * Calculates when a retired signing key may be removed.
+     * @param now The current epoch milliseconds.
+     * @param ttl The maximum token lifetime in seconds.
+     * @param skew The accepted clock skew in seconds.
+     * @returns The safe retired-key deadline.
+     */
     retentionDeadline(now, ttl, skew) {
         const seconds = ttl + skew;
         const milliseconds = seconds * 1_000;