@spine-event-engine/auth 2.0.0-snapshot.25 → 2.0.0-snapshot.28

package/dist/sessions/session-record.d.ts

@@ -0,0 +1,15 @@
+import { type Timestamp } from "@bufbuild/protobuf/wkt";
+import { type AuthenticatedPrincipal as ProtoPrincipal, type OpaqueSessionRecord } from "@spine-event-engine/proto/auth";
+import type { AuthenticatedPrincipal } from "../index.js";
+/**
+ * Domain conversion and exact time ordering for opaque session records.
+ */
+export declare const SessionRecords: Readonly<{
+    deadline(value: Timestamp): Timestamp;
+    compare(left: Timestamp, right: Timestamp): number;
+    orderKey(value: Timestamp): Uint8Array;
+    principal(principal: AuthenticatedPrincipal): ProtoPrincipal;
+    publicPrincipal(record: OpaqueSessionRecord): AuthenticatedPrincipal;
+    expiry(record: OpaqueSessionRecord): Timestamp;
+}>;
+//# sourceMappingURL=session-record.d.ts.map

package/dist/sessions/session-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-record.d.ts","sourceRoot":"","sources":["../../src/sessions/session-record.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAGL,KAAK,sBAAsB,IAAI,cAAc,EAC7C,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;IACtC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAAC;IACvC,SAAS,CAAC,SAAS,EAAE,sBAAsB,GAAG,cAAc,CAAC;IAC7D,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,sBAAsB,CAAC;IACrE,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAChD,CA4FC,CAAC"}

package/dist/sessions/session-record.js

@@ -0,0 +1,109 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { clone, create } from "@bufbuild/protobuf";
+import { TimestampSchema } from "@bufbuild/protobuf/wkt";
+import { AuthenticatedPrincipalSchema, PrincipalAttributesSchema, } from "@spine-event-engine/proto/auth";
+/**
+ * Domain conversion and exact time ordering for opaque session records.
+ */
+export const SessionRecords = Object.freeze({
+    /**
+     * Validates an exact Protobuf deadline.
+     *
+     * @param value Candidate deadline.
+     * @returns Detached validated deadline.
+     */
+    deadline(value) {
+        if (value.seconds < -62135596800n ||
+            value.seconds > 253402300799n ||
+            !Number.isInteger(value.nanos) ||
+            value.nanos < 0 ||
+            value.nanos >= 1_000_000_000)
+            throw new RangeError("Session deadline is outside the Protobuf Timestamp range.");
+        return clone(TimestampSchema, value);
+    },
+    /**
+     * Compares exact deadlines without millisecond truncation.
+     *
+     * @param left First deadline.
+     * @param right Second deadline.
+     * @returns Negative, zero, or positive order.
+     */
+    compare(left, right) {
+        if (left.seconds < right.seconds)
+            return -1;
+        if (left.seconds > right.seconds)
+            return 1;
+        return left.nanos - right.nanos;
+    },
+    /**
+     * Encodes a complete deadline for unsigned byte ordering.
+     *
+     * @param value Exact deadline.
+     * @returns Twelve ordered bytes.
+     */
+    orderKey(value) {
+        const deadline = SessionRecords.deadline(value);
+        const bytes = Buffer.alloc(12);
+        bytes.writeBigUInt64BE(BigInt.asUintN(64, deadline.seconds) ^ 0x8000000000000000n, 0);
+        bytes.writeUInt32BE(deadline.nanos, 8);
+        return bytes;
+    },
+    /**
+     * Copies a public principal into the domain message with attributes presence.
+     *
+     * @param principal Authenticated identity.
+     * @returns Complete Protobuf identity.
+     */
+    principal(principal) {
+        if (typeof principal.id !== "string")
+            throw new TypeError("principal.id must be a string.");
+        if (principal.attributes === undefined)
+            return create(AuthenticatedPrincipalSchema, { id: principal.id });
+        const values = Object.fromEntries(Object.entries(principal.attributes));
+        if (Object.values(values).some((value) => typeof value !== "string"))
+            throw new TypeError("Principal attributes must be strings.");
+        return create(AuthenticatedPrincipalSchema, {
+            id: principal.id,
+            attributes: create(PrincipalAttributesSchema, { values }),
+        });
+    },
+    /**
+     * Copies a stored identity to the public principal shape.
+     *
+     * @param record Complete session record.
+     * @returns Detached public identity.
+     */
+    publicPrincipal(record) {
+        const principal = record.principal;
+        if (principal === undefined)
+            throw new Error("Stored session has no principal.");
+        const attributes = principal.attributes;
+        return Object.freeze(attributes === undefined
+            ? { id: principal.id }
+            : { id: principal.id, attributes: Object.freeze({ ...attributes.values }) });
+    },
+    /**
+     * Reads the required exact deadline from a stored session.
+     *
+     * @param record Complete session record.
+     * @returns Validated deadline.
+     */
+    expiry(record) {
+        if (record.whenExpires === undefined)
+            throw new Error("Stored session has no expiry.");
+        return SessionRecords.deadline(record.whenExpires);
+    },
+});
+//# sourceMappingURL=session-record.js.map

package/dist/sessions/session-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-record.js","sourceRoot":"","sources":["../../src/sessions/session-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,GAG1B,MAAM,gCAAgC,CAAC;AAIxC;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAOtB,MAAM,CAAC,MAAM,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,KAAgB;QACvB,IACE,KAAK,CAAC,OAAO,GAAG,CAAC,YAAe;YAChC,KAAK,CAAC,OAAO,GAAG,aAAgB;YAChC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YAC9B,KAAK,CAAC,KAAK,GAAG,CAAC;YACf,KAAK,CAAC,KAAK,IAAI,aAAa;YAE5B,MAAM,IAAI,UAAU,CAAC,2DAA2D,CAAC,CAAC;QACpF,OAAO,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,IAAe,EAAE,KAAgB;QACvC,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,KAAgB;QACvB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,mBAAsB,EAAE,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,SAAiC;QACzC,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC5F,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;YACpC,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,OAAO,MAAM,CAAC,4BAA4B,EAAE;YAC1C,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,MAAM,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,MAA2B;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;QACxC,OAAO,MAAM,CAAC,MAAM,CAClB,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAA2B;QAChC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/signed.d.ts

@@ -59,10 +59,10 @@ export interface SignedTokenRevocation {
      */
     isRevoked(jti: string): Promise<boolean>;
     /**
-     * Stores the exact token ID through its Protobuf Timestamp expiry.
-     * The application owns persistence, cleanup, availability, and atomicity.
+     * Stores the exact token ID through the inclusive last acceptance instant.
+     * The strategy includes its configured clock tolerance before calling this port.
      * @param jti The token identifier to retain.
-     * @param expiresAt The expiry after which retention may end.
+     * @param expiresAt The full last-acceptance deadline, including clock tolerance.
      * @returns Completes after the token ID is retained.
      */
     revoke(jti: string, expiresAt: Timestamp): Promise<void>;
@@ -214,9 +214,10 @@ export declare class SignedSessions implements SessionResolver {
      * Cookie credentials and every malformed, invalid, expired, revoked, or
      * unavailable-revocation result return `undefined`.
      * @param credential The credential to resolve.
+     * @param lifetime Optional host operation; omission retains no monitor.
      * @returns The verified session, or undefined when it cannot be trusted.
      */
-    resolve(credential: RequestCredential): Promise<ResolvedSession | undefined>;
+    resolve(credential: RequestCredential, lifetime?: AbortSignal): Promise<ResolvedSession | undefined>;
     /**
      * Updates the active P-256 key atomically.
      *

package/dist/sessions/signed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../../src/sessions/signed.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,SAAS,EAMV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;CAC5F,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC1F,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;CACzD;AAyBD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,eAAe;;IA+BpD;;;OAGG;gBACS,OAAO,EAAE,qBAAqB;IAmC1C;;;;OAIG;IACH,KAAK,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiE3E;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAoBlF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA0C3E;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAY/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmIvB"}
+{"version":3,"file":"signed.d.ts","sourceRoot":"","sources":["../../src/sessions/signed.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,SAAS,EAIV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGzE,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAChB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;;;OAIG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,UAAU,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;CAC5F,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,QAAQ,GAAG,eAAe,GAAG,aAAa,GAAG,eAAe,GAAG,uBAAuB,CAAC;CAC1F,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,aAAa,CAAC;CACzD;AAyBD;;;;GAIG;AACH,qBAAa,cAAe,YAAW,eAAe;;IAoCpD;;;OAGG;gBACS,OAAO,EAAE,qBAAqB;IAmC1C;;;;OAIG;IACG,KAAK,CAAC,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAyHjF;;;;;;;;OAQG;IACG,OAAO,CACX,UAAU,EAAE,iBAAiB,EAC7B,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAqEvC;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA0C3E;;;;;;;OAOG;IACG,MAAM,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAoB/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAwKvB"}

package/dist/sessions/signed.js

@@ -13,8 +13,10 @@
  */
 import { Time } from "@spine-event-engine/core/time";
 import { create } from "@bufbuild/protobuf";
-import { KeyObject, createPrivateKey, createPublicKey, randomBytes as nodeRandomBytes, sign, verify, } from "node:crypto";
+import { KeyObject, createPrivateKey, createPublicKey, randomBytes as nodeRandomBytes, } from "node:crypto";
 import { TimestampSchema } from "@bufbuild/protobuf/wkt";
+import { SignJWT, decodeProtectedHeader, jwtVerify } from "jose";
+import { SessionLifetimes } from "./session-lifetime.js";
 /**
  * Finite, local ES256/JWT application sessions. This class has no remote key
  * discovery, persistence, OIDC behavior, or authorization policy. It imports
@@ -36,6 +38,10 @@ export class SignedSessions {
     #keys = new Map();
     #revocation;
     #closed = false;
+    #lifetimes = new SessionLifetimes(() => {
+        const now = this.#now();
+        return typeof now === "number" ? now : undefined;
+    });
     /**
      * Creates signed sessions with copied finite configuration and P-256 keys.
      * @param options The issuer, key ring, limits, clock, entropy, and revocation settings.
@@ -71,80 +77,156 @@ export class SignedSessions {
      * @param principal The authenticated principal to encode.
      * @returns The issuance outcome and, when accepted, credential and session.
      */
-    issue(principal) {
+    async issue(principal) {
         if (this.#isClosed())
-            return Promise.resolve(SignedSessionValues.rejected("closed"));
+            return SignedSessionValues.rejected("closed");
         const now = this.#now();
         if (typeof now !== "number")
-            return Promise.resolve(SignedSessionValues.rejected(now.kind === "closed" ? "closed" : "clock-failure"));
+            return SignedSessionValues.rejected(now.kind === "closed" ? "closed" : "clock-failure");
         if (this.#isClosed())
-            return Promise.resolve(SignedSessionValues.rejected("closed"));
+            return SignedSessionValues.rejected("closed");
         this.#sweep(now);
+        return this.#issuePrepared(principal);
+    }
+    /**
+     * Copies the principal and constructs bounded claims before signing.
+     *
+     * @param principal Authenticated principal supplied for issuance.
+     * @returns Issuance outcome after signing or a specific input failure.
+     */
+    async #issuePrepared(principal) {
         let copied;
         try {
             copied = SignedSessionValues.principalCopy(principal, this.#maxId, this.#maxAttributes, this.#maxAttributeChars);
         }
         catch {
-            return Promise.resolve(SignedSessionValues.rejected("principal-invalid"));
+            return SignedSessionValues.rejected("principal-invalid");
         }
         if (copied === undefined)
-            return Promise.resolve(SignedSessionValues.rejected("principal-invalid"));
+            return SignedSessionValues.rejected("principal-invalid");
         const jti = this.#jti();
         if (jti === undefined)
-            return Promise.resolve(this.#isClosed()
+            return this.#isClosed()
                 ? SignedSessionValues.rejected("closed")
-                : SignedSessionValues.rejected("entropy-failure"));
+                : SignedSessionValues.rejected("entropy-failure");
         if (this.#isClosed())
-            return Promise.resolve(SignedSessionValues.rejected("closed"));
+            return SignedSessionValues.rejected("closed");
         const again = this.#now();
         if (typeof again !== "number")
-            return Promise.resolve(SignedSessionValues.rejected(again.kind === "closed" ? "closed" : "clock-failure"));
+            return SignedSessionValues.rejected(again.kind === "closed" ? "closed" : "clock-failure");
         if (this.#isClosed())
-            return Promise.resolve(SignedSessionValues.rejected("closed"));
-        const iat = Math.floor(again / 1000);
+            return SignedSessionValues.rejected("closed");
+        const claims = this.#issueClaims(copied, jti, again);
+        if (claims === undefined)
+            return SignedSessionValues.rejected("clock-failure");
+        return this.#signIssued(claims, copied);
+    }
+    /**
+     * Builds exact signed claims when their expiry fits the trusted clock domain.
+     *
+     * @param principal Detached authenticated principal.
+     * @param jti Fresh token identifier.
+     * @param now Trusted issuance time in milliseconds.
+     * @returns Claims, or undefined when expiry exceeds the Timestamp range.
+     */
+    #issueClaims(principal, jti, now) {
+        const iat = Math.floor(now / 1000);
         const exp = iat + this.#ttl;
         if (!Number.isSafeInteger(exp) || !SignedSessionValues.timeValid(exp * 1000))
-            return Promise.resolve(SignedSessionValues.rejected("clock-failure"));
-        const claims = {
+            return undefined;
+        return {
             iss: this.#issuer,
             aud: this.#audience,
-            sub: copied.id,
+            sub: principal.id,
             iat,
             nbf: iat,
             exp,
             jti,
-            ...(copied.attributes === undefined ? {} : { attributes: copied.attributes }),
+            ...(principal.attributes === undefined ? {} : { attributes: principal.attributes }),
         };
+    }
+    /**
+     * Signs claims and rechecks closure and time after the awaited signature.
+     *
+     * @param claims Validated claims to sign.
+     * @param principal Detached authenticated principal.
+     * @returns Issued credential or a failure without exposing a late token.
+     */
+    async #signIssued(claims, principal) {
         try {
-            const token = this.#token(claims);
+            const token = await this.#token(claims);
             if (token.length > this.#maxToken)
-                return Promise.resolve(SignedSessionValues.rejected("signing-failure"));
+                return SignedSessionValues.rejected("signing-failure");
             if (this.#isClosed())
-                return Promise.resolve(SignedSessionValues.rejected("closed"));
-            return Promise.resolve({
+                return SignedSessionValues.rejected("closed");
+            if (!this.#signedTimeValid(claims))
+                return SignedSessionValues.rejected("clock-failure");
+            if (this.#isClosed())
+                return SignedSessionValues.rejected("closed");
+            return {
                 kind: "issued",
                 credential: Object.freeze({ kind: "bearer", value: token }),
-                session: SignedSessionValues.session(copied, exp),
-            });
+                session: SignedSessionValues.session(principal, claims.exp),
+            };
         }
         catch {
-            return Promise.resolve(SignedSessionValues.rejected("signing-failure"));
+            return this.#isClosed()
+                ? SignedSessionValues.rejected("closed")
+                : SignedSessionValues.rejected("signing-failure");
         }
     }
+    /**
+     * Checks issued claims against a fresh trusted clock reading.
+     *
+     * @param claims Claims signed by the active key.
+     * @returns Whether they still satisfy the exact application time policy.
+     */
+    #signedTimeValid(claims) {
+        const signedAt = this.#now();
+        return (typeof signedAt === "number" &&
+            SignedSessionValues.validClaims(claims, this.#issuer, this.#audience, this.#ttl, this.#skew, signedAt, this.#maxId, this.#maxAttributes, this.#maxAttributeChars) !== undefined);
+    }
     /**
      * Resolves one locally verifiable bearer credential.
      *
      * Cookie credentials and every malformed, invalid, expired, revoked, or
      * unavailable-revocation result return `undefined`.
      * @param credential The credential to resolve.
+     * @param lifetime Optional host operation; omission retains no monitor.
      * @returns The verified session, or undefined when it cannot be trusted.
      */
-    async resolve(credential) {
+    async resolve(credential, lifetime) {
         if (this.#isClosed() || credential.kind !== "bearer")
             return undefined;
-        const claims = this.#verifiedClaims(credential.value);
-        if (claims === undefined)
+        lifetime?.throwIfAborted();
+        const claims = await this.#verifiedClaims(credential.value);
+        if (claims === undefined || this.#isClosed())
             return undefined;
+        const monitor = lifetime === undefined
+            ? undefined
+            : this.#lifetimes.register(this.#identity(claims.jti), lifetime);
+        let retained = false;
+        try {
+            const resolved = await this.#resolveClaims(claims);
+            if (resolved === undefined || monitor === undefined)
+                return resolved;
+            if (!monitor.ready(resolved.expiresAt))
+                return undefined;
+            retained = true;
+            return { ...resolved, invalidated: monitor.signal };
+        }
+        finally {
+            if (!retained)
+                monitor?.release();
+        }
+    }
+    /**
+     * Checks authoritative revocation and time after monitored registration.
+     *
+     * @param claims Verified token claims.
+     * @returns Detached session if still valid.
+     */
+    async #resolveClaims(claims) {
         if (this.#revocation !== undefined)
             try {
                 if (await this.#revocation.isRevoked(claims.jti))
@@ -153,13 +235,25 @@ export class SignedSessions {
             catch {
                 return undefined;
             }
-        if (this.#isClosed())
+        const checkedAt = this.#now();
+        if (typeof checkedAt !== "number" || this.#isClosed())
+            return undefined;
+        if (SignedSessionValues.validClaims(claims, this.#issuer, this.#audience, this.#ttl, this.#skew, checkedAt, this.#maxId, this.#maxAttributes, this.#maxAttributeChars) === undefined)
             return undefined;
         return SignedSessionValues.session({
             id: claims.sub,
             ...(claims.attributes === undefined ? {} : { attributes: claims.attributes }),
         }, claims.exp);
     }
+    /**
+     * Scopes a token ID to this strategy's issuer and audience.
+     *
+     * @param jti Authenticated token ID.
+     * @returns Local monitor key.
+     */
+    #identity(jti) {
+        return `${this.#issuer}\u0000${this.#audience}\u0000${jti}`;
+    }
     /**
      * Updates the active P-256 key atomically.
      *
@@ -223,15 +317,20 @@ export class SignedSessions {
         const resolved = await this.#claimsForLogout(credential);
         if (resolved === undefined)
             return { kind: "expiryOnly" };
-        if (this.#revocation === undefined)
+        if (this.#revocation === undefined) {
+            this.#lifetimes.invalidate(this.#identity(resolved.jti));
             return { kind: "expiryOnly" };
+        }
         try {
-            await this.#revocation.revoke(resolved.jti, SignedSessionValues.timestamp(resolved.exp));
+            await this.#revocation.revoke(resolved.jti, SignedSessionValues.lastAcceptance(resolved.exp, this.#skew));
             return this.#closed ? { kind: "expiryOnly" } : { kind: "revoked" };
         }
         catch {
             return this.#closed ? { kind: "expiryOnly" } : { kind: "unavailable" };
         }
+        finally {
+            this.#lifetimes.invalidate(this.#identity(resolved.jti));
+        }
     }
     /**
      * Closes the resolver and clears active, verification-key, and revocation references.
@@ -240,6 +339,7 @@ export class SignedSessions {
      */
     close() {
         this.#closed = true;
+        this.#lifetimes.close();
         this.#keys.clear();
         this.#active = undefined;
         this.#revocation = undefined;
@@ -248,9 +348,15 @@ export class SignedSessions {
     #claimsForLogout(credential) {
         if (credential.kind !== "bearer" || this.#isClosed())
             return Promise.resolve(undefined);
-        return Promise.resolve(this.#verifiedClaims(credential.value));
+        return this.#verifiedClaims(credential.value);
     }
-    #verifiedClaims(value) {
+    /**
+     * Verifies a compact token and checks current key and claim policy again.
+     *
+     * @param value Compact bearer token.
+     * @returns Trusted claims, or undefined on any verification failure.
+     */
+    async #verifiedClaims(value) {
         const parsed = this.#parse(value);
         if (parsed === undefined)
             return undefined;
@@ -261,29 +367,63 @@ export class SignedSessions {
         const key = this.#keys.get(parsed.kid);
         if (key === undefined || (key.expiresAt !== undefined && now > key.expiresAt))
             return undefined;
+        const verified = await this.#verifyToken(value, key.publicKey, now);
+        if (verified === undefined)
+            return undefined;
+        const checkedAt = this.#now();
+        if (typeof checkedAt !== "number" || this.#isClosed())
+            return undefined;
+        this.#sweep(checkedAt);
+        if (!this.#keys.has(parsed.kid) || (key.expiresAt !== undefined && checkedAt > key.expiresAt))
+            return undefined;
+        return SignedSessionValues.validClaims(verified, this.#issuer, this.#audience, this.#ttl, this.#skew, checkedAt, this.#maxId, this.#maxAttributes, this.#maxAttributeChars);
+    }
+    /**
+     * Runs jose JWT verification with preliminary time tolerance.
+     *
+     * @param value Compact bearer token.
+     * @param key Selected public verification key.
+     * @param now Trusted time sampled before verification.
+     * @returns Verified payload, or undefined when jose rejects the token.
+     */
+    async #verifyToken(value, key, now) {
         try {
-            if (!verify("sha256", Buffer.from(parsed.input), { key: key.publicKey, dsaEncoding: "ieee-p1363" }, parsed.signature))
-                return undefined;
+            const result = await jwtVerify(value, key, {
+                algorithms: ["ES256"],
+                typ: "JWT",
+                issuer: this.#issuer,
+                audience: this.#audience,
+                requiredClaims: ["sub", "iat", "nbf", "exp", "jti"],
+                maxTokenAge: this.#ttl,
+                clockTolerance: this.#skew + 1,
+                currentDate: new Date(now),
+            });
+            return result.payload;
         }
         catch {
             return undefined;
         }
-        return SignedSessionValues.validClaims(parsed.claims, this.#issuer, this.#audience, this.#ttl, this.#skew, now, this.#maxId, this.#maxAttributes, this.#maxAttributeChars);
     }
+    /**
+     * Signs the exact JWT header and claims with the active P-256 key.
+     *
+     * @param claims Validated application claims.
+     * @returns Compact ES256 JWT from jose.
+     */
     #token(claims) {
         const active = this.#active;
         if (active === undefined)
             throw new Error("SignedSessions is closed");
-        const header = SignedSessionValues.encode({ alg: "ES256", typ: "JWT", kid: active.kid });
-        const payload = SignedSessionValues.encode(claims);
-        const input = `${header}.${payload}`;
-        const signature = sign("sha256", Buffer.from(input), {
-            key: active.privateKey,
-            dsaEncoding: "ieee-p1363",
-        });
-        if (signature.byteLength !== 64)
-            throw new Error("invalid ES256 signature");
-        return `${input}.${Buffer.from(signature).toString("base64url")}`;
+        return new SignJWT(claims.attributes === undefined ? {} : { attributes: claims.attributes })
+            .setProtectedHeader({ alg: "ES256", typ: "JWT", kid: active.kid })
+            .setIssuer(claims.iss)
+            .setAudience(claims.aud)
+            .setSubject(claims.sub)
+            .setIssuedAt(claims.iat)
+            .setNotBefore(claims.nbf)
+            .setExpirationTime(claims.exp)
+            .setJti(claims.jti)
+            .sign(active.privateKey);
     }
     #jti() {
         let bytes;
@@ -322,6 +462,12 @@ export class SignedSessions {
             if (key.expiresAt !== undefined && now > key.expiresAt)
                 this.#keys.delete(kid);
     }
+    /**
+     * Checks compact encoding bounds and reads the exact protected header with jose.
+     *
+     * @param value Candidate compact bearer token.
+     * @returns Validated key ID, or undefined for an unsupported encoding or header.
+     */
     #parse(value) {
         if (typeof value !== "string" || value.length === 0 || value.length > this.#maxToken)
             return undefined;
@@ -331,9 +477,11 @@ export class SignedSessions {
             return undefined;
         const [encodedHeader, encodedClaims, encodedSignature] = segments;
         try {
-            const header = SignedSessionValues.json(encodedHeader);
-            if (!SignedSessionValues.plain(header) ||
-                header.alg !== "ES256" ||
+            if (Buffer.byteLength(encodedHeader, "base64url") > 16_384 ||
+                Buffer.byteLength(encodedClaims, "base64url") > 16_384)
+                return undefined;
+            const header = decodeProtectedHeader(value);
+            if (header.alg !== "ES256" ||
                 header.typ !== "JWT" ||
                 typeof header.kid !== "string" ||
                 Object.keys(header).length !== 3 ||
@@ -342,12 +490,7 @@ export class SignedSessions {
             const signature = Buffer.from(encodedSignature, "base64url");
             if (signature.byteLength !== 64 || signature.toString("base64url") !== encodedSignature)
                 return undefined;
-            return {
-                kid: header.kid,
-                input: `${encodedHeader}.${encodedClaims}`,
-                signature,
-                claims: SignedSessionValues.json(encodedClaims),
-            };
+            return { kid: header.kid };
         }
         catch {
             return undefined;
@@ -357,6 +500,7 @@ export class SignedSessions {
 /**
  * Validates, serializes, and constructs finite signed-session values.
  */
+const maxTimestampSecond = 253402300799n;
 const SignedSessionValues = Object.freeze({
     /**
      * Validates the issuer, audience, and finite token limits before key installation.
@@ -498,25 +642,6 @@ const SignedSessionValues = Object.freeze({
     base64url(value) {
         return value.length > 0 && /^[A-Za-z0-9_-]+$/.test(value) && value.length % 4 !== 1;
     },
-    /**
-     * Encodes a JSON value as URL-safe base64.
-     * @param value The JSON value to encode.
-     * @returns The encoded JSON string.
-     */
-    encode(value) {
-        return Buffer.from(JSON.stringify(value)).toString("base64url");
-    },
-    /**
-     * Decodes bounded URL-safe base64 JSON.
-     * @param value The URL-safe base64 JSON string to decode.
-     * @returns The decoded JSON value.
-     */
-    json(value) {
-        const decoded = Buffer.from(value, "base64url");
-        if (decoded.byteLength > 16_384)
-            throw new Error();
-        return JSON.parse(decoded.toString("utf8"));
-    },
     /**
      * Checks whether a value is a plain object.
      * @param value The unknown value to test for plain-record shape.
@@ -619,6 +744,19 @@ const SignedSessionValues = Object.freeze({
     timestamp(seconds) {
         return create(TimestampSchema, { seconds: BigInt(seconds) });
     },
+    /**
+     * Calculates the final representable acceptance instant without unsafe addition.
+     *
+     * @param expiry Signed token expiry in epoch seconds.
+     * @param skew Accepted clock tolerance in seconds.
+     * @returns Exact inclusive deadline within the configured clock's Timestamp domain.
+     */
+    lastAcceptance(expiry, skew) {
+        const endpoint = BigInt(expiry) + BigInt(skew);
+        return endpoint > maxTimestampSecond
+            ? create(TimestampSchema, { seconds: maxTimestampSecond, nanos: 999_999_999 })
+            : create(TimestampSchema, { seconds: endpoint });
+    },
     /**
      * Creates a resolved session with a detached principal.
      * @param principal The principal to copy.
@@ -641,7 +779,7 @@ const SignedSessionValues = Object.freeze({
      */
     timeValid(milliseconds) {
         const seconds = Math.floor(milliseconds / 1000);
-        return seconds >= -62_135_596_800 && seconds <= 253_402_300_799;
+        return seconds >= -62_135_596_800 && seconds <= Number(maxTimestampSecond);
     },
     /**
      * Checks a token identifier against expected random encoding.