@spine-event-engine/auth 2.0.0-snapshot.26 → 2.0.0-snapshot.28

package/dist/sessions/cookies.js

@@ -12,10 +12,16 @@
  * the License.
  */
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { parseCookie, stringifySetCookie } from "cookie";
+import { SessionRecords } from "./session-record.js";
 /**
  * Strict, framework-neutral helper whose `close()` zeroes the copied CSRF secret.
  */
 export class OpaqueSessionCookies {
+    /**
+     * Immutable header and cookie names used by the browser host's raw admission.
+     */
+    admission;
     secret;
     origins;
     sessionName;
@@ -23,6 +29,8 @@ export class OpaqueSessionCookies {
     maxHeaderValues;
     maxHeaderCharacters;
     maxCookiePairs;
+    sameSite;
+    persistent;
     closed = false;
     /**
      * Creates strict cookie extraction with copied CSRF key material.
@@ -39,32 +47,55 @@ export class OpaqueSessionCookies {
         this.csrfName = CookieValues.validCookieName(options.csrfCookieName ?? "__Host-spine-csrf", "csrfCookieName");
         if (this.sessionName === this.csrfName)
             throw new Error("sessionCookieName and csrfCookieName must be distinct");
+        this.admission = CookieValues.admission(this.sessionName, this.csrfName);
         this.maxHeaderValues = CookieValues.positiveSafeInteger(options.maxHeaderValues ?? 32, "maxHeaderValues");
         this.maxHeaderCharacters = CookieValues.positiveSafeInteger(options.maxHeaderCharacters ?? 16_384, "maxHeaderCharacters");
         this.maxCookiePairs = CookieValues.positiveSafeInteger(options.maxCookiePairs ?? 64, "maxCookiePairs");
+        this.sameSite = options.sameSite ?? "lax";
+        if (!["lax", "strict", "none"].includes(this.sameSite))
+            throw new Error("sameSite must be lax, strict, or none");
+        this.persistent = options.persistent ?? false;
+        if (typeof this.persistent !== "boolean")
+            throw new Error("persistent must be a boolean");
     }
     /**
-     * Creates the fixed-length unpadded base64url CSRF value for one session ID.
-     * @param sessionId The session identifier protected by the CSRF value.
+     * Creates the CSRF value bound to the entire issued opaque credential.
+     * @param credential The complete sealed credential protected by the CSRF value.
      * @returns The derived CSRF value.
      */
-    csrf(sessionId) {
+    csrf(credential) {
         this.open();
-        if (!CookieValues.validSessionId(sessionId)) {
-            throw new Error("sessionId must be a 43-character unpadded base64url session ID");
-        }
-        return createHmac("sha256", this.secret).update(sessionId, "utf8").digest("base64url");
+        if (!CookieValues.validCredential(credential))
+            throw new Error("credential must be a nonempty sealed value without control characters");
+        return createHmac("sha256", this.secret).update(credential, "utf8").digest("base64url");
     }
     /**
-     * Creates the immutable pair of host-only cookies for a newly issued session.
-     * @param sessionId The issued opaque session identifier.
+     * Creates the immutable pair of host-only cookies for an issued or rotated session.
+     * @param credential The complete issued opaque credential.
+     * @param expiresAt The actual authoritative session deadline.
      * @returns The session and CSRF Set-Cookie values.
      */
-    issue(sessionId) {
-        const csrf = this.csrf(sessionId);
+    issue(credential, expiresAt) {
+        const csrf = this.csrf(credential);
+        const expires = this.persistent ? CookieValues.expiryDate(expiresAt) : undefined;
         return Object.freeze([
-            `${this.sessionName}=${sessionId}; Path=/; Secure; HttpOnly; SameSite=Lax`,
-            `${this.csrfName}=${csrf}; Path=/; Secure; SameSite=Lax`,
+            stringifySetCookie({
+                name: this.sessionName,
+                value: credential,
+                path: "/",
+                secure: true,
+                httpOnly: true,
+                sameSite: this.sameSite,
+                ...(expires === undefined ? {} : { expires }),
+            }),
+            stringifySetCookie({
+                name: this.csrfName,
+                value: csrf,
+                path: "/",
+                secure: true,
+                sameSite: this.sameSite,
+                ...(expires === undefined ? {} : { expires }),
+            }),
         ]);
     }
     /**
@@ -74,12 +105,27 @@ export class OpaqueSessionCookies {
     clear() {
         this.open();
         return Object.freeze([
-            `${this.sessionName}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`,
-            `${this.csrfName}=; Path=/; Secure; SameSite=Lax; Max-Age=0`,
+            stringifySetCookie({
+                name: this.sessionName,
+                value: "",
+                path: "/",
+                secure: true,
+                httpOnly: true,
+                sameSite: this.sameSite,
+                maxAge: 0,
+            }),
+            stringifySetCookie({
+                name: this.csrfName,
+                value: "",
+                path: "/",
+                secure: true,
+                sameSite: this.sameSite,
+                maxAge: 0,
+            }),
         ]);
     }
     /**
-     * Reads bearer credentials first, otherwise a fully checked cookie credential.
+     * Rejects simultaneous primary credentials, then reads a bearer or checked cookie credential.
      * @param headers The request headers to inspect.
      * @returns The admitted credential or its rejection reason.
      */
@@ -92,10 +138,22 @@ export class OpaqueSessionCookies {
         const authorization = values.get("authorization") ?? [];
         if (authorization.length > 1)
             return CookieValues.rejection("duplicate-authorization");
+        if (authorization.length === 1 &&
+            CookieValues.primaryPresent(values.get("cookie") ?? [], this.sessionName))
+            return CookieValues.rejection("simultaneous-credential");
         if (authorization.length === 1)
             return CookieValues.bearer(CookieValues.only(authorization));
         return this.cookieCredential(values);
     }
+    /**
+     * Reads a browser credential while representing no primary credential as absence.
+     * @param request Immutable raw headers with method and request-local parsed URL.
+     * @returns A credential, terminal rejection, or undefined absence.
+     */
+    read(request) {
+        const result = this.extract(request.headers);
+        return Promise.resolve(result.kind === "rejected" && result.reason === "missing-credential" ? undefined : result);
+    }
     /**
      * Closes the extractor, zeroes its HMAC secret, and rejects later operations.
      * @returns Completes after the secret is cleared.
@@ -107,6 +165,11 @@ export class OpaqueSessionCookies {
         this.secret.fill(0);
         return Promise.resolve();
     }
+    /**
+     * Validates origin and CSRF after the selected cookie pair has been parsed.
+     * @param values Duplicate-preserving normalized request headers.
+     * @returns Admitted cookie credential or a terminal rejection.
+     */
     cookieCredential(values) {
         const cookies = values.get("cookie") ?? [];
         const parsed = CookieValues.parseCookies(cookies, this.sessionName, this.csrfName, this.maxCookiePairs);
@@ -128,6 +191,9 @@ export class OpaqueSessionCookies {
         }
         return Object.freeze({ kind: "cookie", value: parsed.session });
     }
+    /**
+     * Rejects methods that require the copied CSRF key after closure.
+     */
     open() {
         if (this.closed)
             throw new Error("OpaqueSessionCookies is closed");
@@ -137,6 +203,36 @@ export class OpaqueSessionCookies {
  * Parses and validates cookie values used by {@link OpaqueSessionCookies}.
  */
 const CookieValues = Object.freeze({
+    /**
+     * Captures the validated standard browser admission names as immutable data.
+     * @param sessionName Configured primary cookie name.
+     * @param csrfName Configured supporting CSRF cookie name.
+     * @returns Frozen data declaration for the host's raw admission.
+     */
+    admission(sessionName, csrfName) {
+        return Object.freeze({
+            csrfHeaderNames: Object.freeze(["x-spine-csrf"]),
+            credentialCookieNames: Object.freeze([sessionName]),
+            stateCookieNames: Object.freeze([csrfName]),
+        });
+    },
+    /**
+     * Checks whether any Cookie field contains the selected primary credential.
+     * @param headers Raw Cookie fields that may be legally split.
+     * @param sessionName Configured authentication cookie name.
+     * @returns Whether a primary cookie is present, including an empty value.
+     */
+    primaryPresent(headers, sessionName) {
+        return headers.some((header) => Object.hasOwn(parseCookie(header), sessionName));
+    },
+    /**
+     * Collects own request header fields without losing duplicate values.
+     *
+     * @param headers Original header object.
+     * @param maxValues Existing field and value count limit.
+     * @param maxCharacters Existing total character limit.
+     * @returns Normalized duplicate-preserving values, or undefined when a limit is exceeded.
+     */
     headerValues(headers, maxValues, maxCharacters) {
         const result = new Map();
         let count = 0;
@@ -175,50 +271,90 @@ const CookieValues = Object.freeze({
         }
         return result;
     },
+    /**
+     * Reads one Bearer authorization field without accepting malformed syntax.
+     *
+     * @param value One Authorization field value.
+     * @returns Bearer credential or terminal malformed-authorization rejection.
+     */
     bearer(value) {
         const match = /^bearer ([\x21-\x7e]+)$/i.exec(value);
         return match === null
             ? CookieValues.rejection("malformed-authorization")
             : Object.freeze({ kind: "bearer", value: CookieValues.only(match.slice(1)) });
     },
+    /**
+     * Reads an unambiguous credential and CSRF pair across Cookie fields.
+     * @param headers Raw Cookie field values in arrival order.
+     * @param sessionName Selected authentication cookie name.
+     * @param csrfName Selected CSRF cookie name.
+     * @param maxPairs Existing total cookie-pair limit.
+     * @returns Decoded pair or a terminal parsing rejection.
+     */
     parseCookies(headers, sessionName, csrfName, maxPairs) {
         const found = new Map();
         let count = 0;
         for (const header of headers) {
-            if (CookieValues.hasForbiddenCookieCharacter(header))
-                return { reason: "malformed-cookie" };
-            for (const pair of header.split(";")) {
-                count += 1;
-                if (count > maxPairs)
-                    return { reason: "request-too-large" };
-                const index = pair.indexOf("=");
-                if (index <= 0)
-                    return { reason: "malformed-cookie" };
-                const name = pair.slice(0, index).trim();
-                const value = pair.slice(index + 1).trim();
-                if (!CookieValues.validCookiePair(name, value))
-                    return { reason: "malformed-cookie" };
-                if (name === sessionName || name === csrfName) {
-                    if (found.has(name))
-                        return { reason: "ambiguous-cookie" };
-                    found.set(name, [value]);
-                }
-            }
+            const result = CookieValues.readCookieHeader(header, found, sessionName, csrfName, maxPairs - count);
+            if ("reason" in result)
+                return result;
+            count += result.count;
         }
-        const session = found.get(sessionName) ?? [];
-        const csrf = found.get(csrfName) ?? [];
-        if (session.length === 0 && csrf.length === 0)
+        const session = found.get(sessionName);
+        const csrf = found.get(csrfName);
+        if (session === undefined && csrf === undefined)
             return { reason: "missing-credential" };
-        if (session.length > 1 || csrf.length > 1)
-            return { reason: "ambiguous-cookie" };
-        if (session.length !== 1 ||
-            csrf.length !== 1 ||
-            !CookieValues.validSessionId(CookieValues.only(session)) ||
-            !CookieValues.validCsrf(CookieValues.only(csrf))) {
+        if (session === undefined ||
+            csrf === undefined ||
+            !CookieValues.validCredential(session) ||
+            !CookieValues.validCsrf(csrf)) {
             return { reason: "malformed-cookie" };
         }
-        return { session: CookieValues.only(session), csrf: CookieValues.only(csrf) };
+        return { session, csrf };
     },
+    /**
+     * Validates one raw Cookie field before using cookie v2 decoded values.
+     * @param header One original Cookie field.
+     * @param found Selected names already seen in this request.
+     * @param sessionName Selected authentication cookie name.
+     * @param csrfName Selected CSRF cookie name.
+     * @param remaining Remaining count under the existing pair limit.
+     * @returns Count accepted from the field or a terminal rejection.
+     */
+    readCookieHeader(header, found, sessionName, csrfName, remaining) {
+        if (CookieValues.hasForbiddenCookieCharacter(header))
+            return { reason: "malformed-cookie" };
+        const decoded = parseCookie(header);
+        let count = 0;
+        for (const pair of header.split(";")) {
+            count += 1;
+            if (count > remaining)
+                return { reason: "request-too-large" };
+            const index = pair.indexOf("=");
+            if (index <= 0)
+                return { reason: "malformed-cookie" };
+            const name = pair.slice(0, index).trim();
+            const value = pair.slice(index + 1).trim();
+            if (!CookieValues.validCookiePair(name, value))
+                return { reason: "malformed-cookie" };
+            if (name === sessionName || name === csrfName) {
+                if (found.has(name))
+                    return { reason: "ambiguous-cookie" };
+                found.set(name, decoded[name] ?? "");
+            }
+        }
+        return { count };
+    },
+    /**
+     * Reads exactly one value for a required request header.
+     *
+     * @typeParam T Specific rejection reason.
+     * @param values Normalized duplicate-preserving fields.
+     * @param name Lowercase header name.
+     * @param missing Rejection when the header is absent.
+     * @param duplicate Rejection when the header repeats.
+     * @returns Selected value or the configured rejection.
+     */
     one(values, name, missing, duplicate) {
         const entries = values.get(name) ?? [];
         if (entries.length === 0)
@@ -227,12 +363,24 @@ const CookieValues = Object.freeze({
             return { reason: duplicate };
         return { value: CookieValues.only(entries) };
     },
+    /**
+     * Gets the required first value from a validated singleton field.
+     *
+     * @param values Values already known to contain one entry.
+     * @returns The single field value.
+     */
     only(values) {
         const value = values[0];
         if (value === undefined)
             throw new Error("expected one header value");
         return value;
     },
+    /**
+     * Checks raw Cookie fields for controls and commas.
+     *
+     * @param value Raw Cookie field.
+     * @returns Whether the field has forbidden characters.
+     */
     hasForbiddenCookieCharacter(value) {
         for (const character of value) {
             const code = character.charCodeAt(0);
@@ -241,6 +389,12 @@ const CookieValues = Object.freeze({
         }
         return false;
     },
+    /**
+     * Validates an exact canonical request Origin.
+     *
+     * @param origin Candidate Origin.
+     * @returns The canonical Origin or an error for malformed input.
+     */
     validOrigin(origin) {
         try {
             const url = new URL(origin);
@@ -259,35 +413,103 @@ const CookieValues = Object.freeze({
             throw new Error("origins must contain only canonical Origins");
         }
     },
+    /**
+     * Validates a secure host-prefixed cookie name.
+     *
+     * @param value Candidate name.
+     * @param name Option name for errors.
+     * @returns The validated host cookie name.
+     */
     validCookieName(value, name) {
         if (!value.startsWith("__Host-") || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value)) {
             throw new Error(`${name} must be a valid __Host- cookie name`);
         }
         return value;
     },
+    /**
+     * Validates an existing finite request limit.
+     *
+     * @param value Candidate limit.
+     * @param name Option name for errors.
+     * @returns The positive safe integer.
+     */
     positiveSafeInteger(value, name) {
         if (!Number.isSafeInteger(value) || value <= 0) {
             throw new Error(`${name} must be a positive safe integer`);
         }
         return value;
     },
+    /**
+     * Checks one raw Cookie name and value for safe field syntax.
+     *
+     * @param name Raw cookie name.
+     * @param value Raw cookie value.
+     * @returns Whether both components contain allowed field characters.
+     */
     validCookiePair(name, value) {
         return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name) && /^[\x21-\x7e]+$/.test(value);
     },
+    /**
+     * Checks the unpadded base64url alphabet for CSRF tokens.
+     *
+     * @param value Candidate CSRF encoding.
+     * @returns Whether the characters and length can represent unpadded base64url.
+     */
     base64url(value) {
         return /^[A-Za-z0-9_-]+$/.test(value) && value.length % 4 !== 1;
     },
+    /**
+     * Checks the fixed SHA-256 CSRF encoding.
+     *
+     * @param value Candidate CSRF value.
+     * @returns Whether it is a 43-character unpadded base64url digest.
+     */
     validCsrf(value) {
         return value.length === 43 && CookieValues.base64url(value);
     },
-    validSessionId(value) {
-        return value.length === 43 && CookieValues.base64url(value);
+    /**
+     * Checks an opaque credential without assuming a fixed sealed length.
+     *
+     * @param value Candidate complete credential.
+     * @returns Whether it is nonempty and free of control characters.
+     */
+    validCredential(value) {
+        if (value.length === 0)
+            return false;
+        for (const character of value) {
+            const code = character.charCodeAt(0);
+            if (code <= 31 || code === 127)
+                return false;
+        }
+        return true;
+    },
+    /**
+     * Converts the authoritative exact deadline to cookie date precision.
+     * @param expiresAt Issued session deadline.
+     * @returns Browser cookie expiry derived from that deadline.
+     */
+    expiryDate(expiresAt) {
+        const deadline = SessionRecords.deadline(expiresAt);
+        return new Date(Number(deadline.seconds) * 1_000 + Math.floor(deadline.nanos / 1_000_000));
     },
+    /**
+     * Compares equal-length CSRF values in constant time.
+     *
+     * @param expected Derived CSRF digest.
+     * @param supplied Browser-supplied CSRF digest.
+     * @returns Whether the values match.
+     */
     sameCsrf(expected, supplied) {
         if (expected.length !== supplied.length)
             return false;
         return timingSafeEqual(Buffer.from(expected), Buffer.from(supplied));
     },
+    /**
+     * Creates a frozen terminal credential rejection.
+     *
+     * @param reason Specific rejection reason.
+     * @returns The rejected extraction outcome.
+     */
     rejection(reason) {
         return Object.freeze({ kind: "rejected", reason });
     },

package/dist/sessions/cookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/sessions/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsF1D;;GAEG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAa;IACnB,OAAO,CAAsB;IAC7B,WAAW,CAAS;IACpB,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,mBAAmB,CAAS;IAC5B,cAAc,CAAS;IAChC,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,OAAoC;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,GAAG,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,eAAe,CAC7C,OAAO,CAAC,iBAAiB,IAAI,sBAAsB,EACnD,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,CAC1C,OAAO,CAAC,cAAc,IAAI,mBAAmB,EAC7C,gBAAgB,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ;YACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,mBAAmB,CACrD,OAAO,CAAC,eAAe,IAAI,EAAE,EAC7B,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CACzD,OAAO,CAAC,mBAAmB,IAAI,MAAM,EACrC,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,mBAAmB,CACpD,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,SAAiB;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAiB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,0CAA0C;YAC1E,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,gCAAgC;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,IAAI,CAAC,WAAW,sDAAsD;YACzE,GAAG,IAAI,CAAC,QAAQ,4CAA4C;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,OAA6B;QACnC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,mBAAmB,CACzB,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACvF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAEO,gBAAgB,CACtB,MAA8C;QAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACxF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC5F,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,IACE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;YAChD,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAC7C,CAAC;YACD,OAAO,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,CAAC;CACF;AAED;;GAEG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,YAAY,CACV,OAA6B,EAC7B,SAAiB,EACjB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAS;YACnE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,SAAS,CAAC;YACtF,KAAK,IAAI,CAAC,CAAC;YACX,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;YAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa;oBAAE,OAAO,SAAS,CAAC;gBACnE,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;oBAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;oBACvD,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,aAAa;wBAAE,OAAO,SAAS,CAAC;oBAChE,IAAI,KAAK,GAAG,CAAC;wBAAE,KAAK,IAAI,CAAC,CAAC;oBAC1B,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,YAAY,CACV,OAA0B,EAC1B,WAAmB,EACnB,QAAgB,EAChB,QAAgB;QAOhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,2BAA2B,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAC5F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrC,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,QAAQ;oBAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;gBAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,IAAI,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBACtF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;oBAC3D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACjF,IACE,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,IAAI,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,YAAY,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAChD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,GAAG,CACD,MAA8C,EAC9C,IAAY,EACZ,OAAU,EACV,SAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,MAAyB;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2BAA2B,CAAC,KAAa;QACvC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;gBACpB,GAAG,CAAC,MAAM,KAAK,EAAE;gBACjB,GAAG,CAAC,IAAI,KAAK,EAAE;gBACf,GAAG,CAAC,MAAM,KAAK,MAAM,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,eAAe,CAAC,KAAa,EAAE,IAAY;QACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,eAAe,CAAC,IAAY,EAAE,KAAa;QACzC,OAAO,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,SAAS,CAAC,MAA2C;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/sessions/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA+FrD;;GAEG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACM,SAAS,CAIf;IAEc,MAAM,CAAa;IAEnB,OAAO,CAAsB;IAE7B,WAAW,CAAS;IAEpB,QAAQ,CAAS;IAEjB,eAAe,CAAS;IAExB,mBAAmB,CAAS;IAE5B,cAAc,CAAS;IAEvB,QAAQ,CAA4B;IAEpC,UAAU,CAAU;IAE7B,MAAM,GAAG,KAAK,CAAC;IAEvB;;;OAGG;IACH,YAAY,OAAoC;QAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,GAAG,EAAE;YACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,eAAe,CAC7C,OAAO,CAAC,iBAAiB,IAAI,sBAAsB,EACnD,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,eAAe,CAC1C,OAAO,CAAC,cAAc,IAAI,mBAAmB,EAC7C,gBAAgB,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ;YACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,YAAY,CAAC,mBAAmB,CACrD,OAAO,CAAC,eAAe,IAAI,EAAE,EAC7B,iBAAiB,CAClB,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,mBAAmB,CACzD,OAAO,CAAC,mBAAmB,IAAI,MAAM,EACrC,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,cAAc,GAAG,YAAY,CAAC,mBAAmB,CACpD,OAAO,CAAC,cAAc,IAAI,EAAE,EAC5B,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC9C,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5F,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,UAAkB;QACrB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAkB,EAAE,SAAoB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,kBAAkB,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,WAAW;gBACtB,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C,CAAC;YACF,kBAAkB,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,kBAAkB,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,WAAW;gBACtB,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,CAAC;aACV,CAAC;YACF,kBAAkB,CAAC;gBACjB,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,KAAK,EAAE,EAAE;gBACT,IAAI,EAAE,GAAG;gBACT,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,CAAC;aACV,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,OAA6B;QACnC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,mBAAmB,CACzB,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACvF,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC;YAEzE,OAAO,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC3D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,OAIJ;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,OAAO,CACpB,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAC1F,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CACtB,MAA8C;QAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CACtC,OAAO,EACP,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QACxF,IAAI,QAAQ,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC5F,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,IACE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvC,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;YAChD,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAC7C,CAAC;YACD,OAAO,YAAY,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,CAAC;CACF;AAcD;;GAEG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC;;;;;OAKG;IACH,SAAS,CAAC,WAAmB,EAAE,QAAgB;QAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAChD,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;YACnD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,OAA0B,EAAE,WAAmB;QAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CACV,OAA6B,EAC7B,SAAiB,EACjB,aAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAS;YACnE,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,SAAS,CAAC;YACtF,KAAK,IAAI,CAAC,CAAC;YACX,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC;YAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,IAAI,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,aAAa;oBAAE,OAAO,SAAS,CAAC;gBACnE,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;oBAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,SAAS,CAAC;oBACvD,IAAI,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,aAAa;wBAAE,OAAO,SAAS,CAAC;oBAChE,IAAI,KAAK,GAAG,CAAC;wBAAE,KAAK,IAAI,CAAC,CAAC;oBAC1B,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,KAAK,IAAI;YACnB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,yBAAyB,CAAC;YACnD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CACV,OAA0B,EAC1B,WAAmB,EACnB,QAAgB,EAChB,QAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAC1C,MAAM,EACN,KAAK,EACL,WAAW,EACX,QAAQ,EACR,QAAQ,GAAG,KAAK,CACjB,CAAC;YACF,IAAI,QAAQ,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YACtC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACzF,IACE,OAAO,KAAK,SAAS;YACrB,IAAI,KAAK,SAAS;YAClB,CAAC,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC;YACtC,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAC7B,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB,CACd,MAAc,EACd,KAA0B,EAC1B,WAAmB,EACnB,QAAgB,EAChB,SAAiB;QAEjB,IAAI,YAAY,CAAC,2BAA2B,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5F,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACtF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC3D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACH,GAAG,CACD,MAA8C,EAC9C,IAAY,EACZ,OAAU,EACV,SAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,MAAyB;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,2BAA2B,CAAC,KAAa;QACvC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5B,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACvD,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;gBACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;gBACpB,GAAG,CAAC,MAAM,KAAK,EAAE;gBACjB,GAAG,CAAC,IAAI,KAAK,EAAE;gBACf,GAAG,CAAC,MAAM,KAAK,MAAM,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAa,EAAE,IAAY;QACzC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sCAAsC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,IAAY,EAAE,KAAa;QACzC,OAAO,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa;QACrB,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAa;QACrB,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAa;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,SAAoB;QAC7B,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACpD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAA2C;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAC,CAAC"}

package/dist/sessions/opaque-session-store.d.ts

@@ -0,0 +1,143 @@
+import { type Timestamp } from "@bufbuild/protobuf/wkt";
+import { type OpaqueSessionRecord } from "@spine-event-engine/proto/auth";
+/**
+ * Atomic domain transitions for stable opaque-session references.
+ */
+export interface OpaqueSessionStore {
+    /**
+     * Creates one session only when its stable reference is absent.
+     *
+     * `true` confirms this record was inserted, even if cancellation arrives after
+     * the physical commit. `false` confirms no mutation: an existing reference
+     * or a process-local capacity refusal can prevent insertion. A thrown result
+     * is unconfirmed; callers cannot safely infer insertion and
+     * must not delete another session after an ID collision. Custom stores must
+     * retain this distinction so a cancelled confirmed insert can be removed
+     * conditionally against this complete record.
+     *
+     * @param record Complete new session.
+     * @param signal Optional operation cancellation.
+     * @returns Whether insertion won.
+     */
+    insert(record: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Reads one authoritative session by stable reference.
+     *
+     * @param id Stable reference.
+     * @param signal Optional operation cancellation.
+     * @returns Detached current record, if present.
+     */
+    read(id: string, signal?: AbortSignal): Promise<OpaqueSessionRecord | undefined>;
+    /**
+     * Replaces exactly the expected generation and deadline.
+     *
+     * A committed replacement returns `true` even if cancellation arrives just
+     * after commit; the caller can conditionally remove that new generation.
+     * A `false` result confirms that no replacement occurred.
+     *
+     * @param expected Complete expected record.
+     * @param next Complete replacement with the same stable reference.
+     * @param signal Optional operation cancellation.
+     * @returns Whether the replacement won.
+     */
+    replace(expected: OpaqueSessionRecord, next: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Removes the current generation behind a stable reference.
+     *
+     * @param id Stable reference.
+     * @param signal Optional operation cancellation.
+     * @returns Whether a record was removed.
+     */
+    revoke(id: string, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Deletes only one complete expected record.
+     *
+     * @param expected Record that may be removed.
+     * @param signal Optional operation cancellation.
+     * @returns Whether the expected record was removed.
+     */
+    remove(expected: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Removes eligible exact deadlines through the selected cutoff.
+     *
+     * @param cutoff Trusted current-or-earlier deadline.
+     * @param signal Optional maintenance cancellation.
+     * @returns Number of records conditionally removed.
+     */
+    purgeExpired(cutoff: Timestamp, signal?: AbortSignal): Promise<number>;
+}
+/**
+ * Process-local implementation of the same atomic session transitions.
+ */
+export declare class MemoryOpaqueSessionStore implements OpaqueSessionStore {
+    #private;
+    /**
+     * Creates a process-local store with a trusted maintenance clock.
+     *
+     * @param clock Supplies the latest allowed purge cutoff.
+     * @param maxSessions Process-local retained record bound; defaults to 10,000.
+     */
+    constructor(clock?: () => Timestamp, maxSessions?: number);
+    /**
+     * Returns whether the process-local retained record bound is reached.
+     *
+     * @returns Whether another insert requires explicit expiry maintenance.
+     */
+    atCapacity(): boolean;
+    /**
+     * Creates a complete session only when its stable reference is absent.
+     *
+     * @param record Complete session to insert.
+     * @param signal Optional cancellation.
+     * @returns Whether insertion won.
+     */
+    insert(record: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Reads one authoritative session by stable reference.
+     *
+     * @param id Stable session reference.
+     * @param signal Optional cancellation.
+     * @returns Detached current record, if present.
+     */
+    read(id: string, signal?: AbortSignal): Promise<OpaqueSessionRecord | undefined>;
+    /**
+     * Replaces exactly one expected session record.
+     *
+     * @param expected Complete record that must still be current.
+     * @param next Replacement with the same stable reference.
+     * @param signal Optional cancellation.
+     * @returns Whether replacement won.
+     */
+    replace(expected: OpaqueSessionRecord, next: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Deletes the current generation behind a stable reference.
+     *
+     * @param id Stable session reference.
+     * @param signal Optional cancellation.
+     * @returns Whether a record was removed.
+     */
+    revoke(id: string, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Deletes only one complete expected record.
+     *
+     * @param expected Complete record that may be removed.
+     * @param signal Optional cancellation.
+     * @returns Whether the expected record was removed.
+     */
+    remove(expected: OpaqueSessionRecord, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Removes exact deadlines at or before the trusted cutoff.
+     *
+     * @param cutoff Current-or-earlier exact deadline.
+     * @param signal Optional maintenance cancellation.
+     * @returns Number of conditionally removed records.
+     */
+    purgeExpired(cutoff: Timestamp, signal?: AbortSignal): Promise<number>;
+    /**
+     * Closes and drops the process-local record references.
+     *
+     * @returns Completion after local records are dropped.
+     */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=opaque-session-store.d.ts.map

package/dist/sessions/opaque-session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque-session-store.d.ts","sourceRoot":"","sources":["../../src/sessions/opaque-session-store.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAIxC;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5E;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAEjF;;;;;;;;;;;OAWG;IACH,OAAO,CACL,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9E;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,qBAAa,wBAAyB,YAAW,kBAAkB;;IASjE;;;;;OAKG;gBACS,KAAK,GAAE,MAAM,SAA4B,EAAE,WAAW,SAAS;IAO3E;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;;;OAMG;IACH,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAW3E;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAQhF;;;;;;;OAOG;IACH,OAAO,CACL,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC;IAanB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAU7E;;;;;;OAMG;IACH,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBtE;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0BvB"}