@spine-event-engine/auth 2.0.0-snapshot.26 → 2.0.0-snapshot.29

package/README.md

@@ -24,15 +24,25 @@ is native-only and treats auth as an optional peer.
 
 ## First success: create and resolve a local session
 
-`OpaqueSessions` is a bounded, process-local store for local development or a
-single process. This creates a credential, resolves it, and closes the store.
+Omitting a store selects process-local memory for development. Configure a seal
+secret and explicit session policy before issuing credentials. A
+`PersistentOpaqueSessionStore` can instead share the same atomic sessions across
+processes; its asynchronous factory prepares selected structures by default.
 
 ```ts
 import { OpaqueSessions } from "@spine-event-engine/auth";
-
-const sessions = new OpaqueSessions({ ttlMilliseconds: 60 * 60 * 1_000, maxSessions: 100 });
+import { Time } from "@spine-event-engine/core/time";
+
+const password = process.env.SESSION_SEAL_PASSWORD;
+if (!password) throw new Error("Configure SESSION_SEAL_PASSWORD");
+const sessions = await OpaqueSessions.create({
+  scope: "local-browser",
+  password,
+  clock: { now: Time.currentTimeMillis },
+  ttlMilliseconds: 60 * 60 * 1_000,
+});
 try {
-  const created = await sessions.create({ id: "local-user" });
+  const created = await sessions.issue({ id: "local-user" });
   if (created.kind !== "created") throw new Error(`Session creation failed: ${created.reason}`);
   const resolved = await sessions.resolve(created.credential);
   if (resolved === undefined) throw new Error("New local session was not resolvable");
@@ -42,6 +52,67 @@ try {
 }
 ```
 
+## Share opaque sessions through PostgreSQL
+
+Install `@spine-event-engine/storage-postgres` alongside the auth package. Give
+the session family a dedicated storage group. The database and schema must
+already exist.
+
+```ts
+import { OpaqueSessions, PersistentOpaqueSessionStore } from "@spine-event-engine/auth";
+import { Time } from "@spine-event-engine/core/time";
+import { StorageGroup } from "@spine-event-engine/storage";
+import { PostgresStorageFactory } from "@spine-event-engine/storage-postgres";
+
+const url = process.env.DATABASE_URL;
+const password = process.env.SESSION_SEAL_PASSWORD;
+if (!url || !password) throw new Error("Configure database and session credentials");
+const factory = await PostgresStorageFactory.newBuilder().setOptions({ url }).build();
+let store: PersistentOpaqueSessionStore | undefined;
+try {
+  store = await PersistentOpaqueSessionStore.create({
+    storageFactory: factory,
+    group: new StorageGroup("auth_sessions"),
+  });
+  const sessions = await OpaqueSessions.create({
+    store,
+    scope: "orders-browser",
+    password,
+    clock: { now: Time.currentTimeMillis },
+    ttlMilliseconds: 60 * 60 * 1_000,
+  });
+  try {
+    const issued = await sessions.issue({ id: "user-42" });
+    if (issued.kind !== "created") throw new Error(`Session issue failed: ${issued.reason}`);
+    // Send issued.credential through the application's credential transport.
+  } finally {
+    await sessions.close();
+  }
+} finally {
+  try {
+    await store?.close();
+  } finally {
+    await factory.close();
+  }
+}
+```
+
+The strategy leaves an injected store open; close the strategy, store, and
+factory in that order. Use the same group and seal policy in each process.
+
+## Signed bearer sessions
+
+`SignedSessions` issues and verifies ES256 bearer tokens with an application
+P-256 key pair. Without a revocation source, logout reports expiry-only.
+`PersistentTokenRevocations.create` supplies shared scoped revocation through
+the selected storage factory and group; pass the resulting store as the
+strategy's `revocation`. The store prepares its indexed record family by
+default. Its explicit `purgeExpired` method removes records only after their
+full inclusive acceptance deadline, including configured clock skew. The
+application closes the strategy, store, and factory separately. See the
+[signed session reference](REFERENCE.md) for exact retention and maintenance
+behavior.
+
 For a real gateway, construct `UnaryGateway` with exactly one admission mode:
 `sessions`, or deliberate `publicAccess: true`. It requires a finite request
 limit, policy, trusted-context resolver, clock, and forwarder. Every approved
@@ -82,12 +153,24 @@ for direct native authentication and managed forwarding configuration.
 
 ## Browser and OIDC extensions
 
-The package does not provide HTTP routes, browser pages, users, permissions,
-TLS, or a production session database. An application can compose
-`OidcFlow` with Google, GitHub, or another verified provider, but it must own
-the start, callback, exchange, identity mapping, and session issuance routes.
+`OidcFlow` is a component flow: the application provides its start, callback,
+exchange, identity mapping, and session issuance routes. It does not supply
+browser pages, users, permissions, TLS, or a production session database. An application can compose `OidcFlow` with
+Google, GitHub, or another verified provider.
 Keep provider access, refresh, and ID tokens server-side.
 
+`OidcFlow.start()` is asynchronous: await it before redirecting the browser.
+The default transaction and application-grant store is process-local. To share
+one login flow across processes, create `PersistentOidcFlowStore` with a
+`StorageFactory`, `StorageGroup`, and stable `flowId`, then pass it in
+`OidcFlowOptions.store`. The factory prepares both record families by default;
+`createMissingStructures: false` skips preparation. Close the flow, then its
+injected store and factory when the application shuts down. Call
+`purgeExpired(cutoff)` explicitly for expired records; no timer runs it.
+
+The application must send the authorization URL returned by `OidcFlow.start()`
+to the browser and supply the actual callback parameters.
+
 For browser-facing hosting, install the server browser entry point and use
 `BrowserServer` and `DurableSubscriptionBindings` from
 `@spine-event-engine/server/browser`. That boundary requires exact origins,
@@ -96,8 +179,16 @@ durable authenticated bindings when applicable.
 
 ## Limits and next steps
 
-`OpaqueSessions` is not shared or durable. Signed-session revocation and OIDC
-identity provisioning are application responsibilities. A gateway protects
+The [Fieldnotes application](https://github.com/SpineEventEngine/spine-ts/blob/master/examples/fieldnotes/README.md)
+connects a Next.js map interface to a single-tenant Bounded Context. Its two launch
+options demonstrate direct Google OIDC and Google sign-in through Firebase Auth.
+Both use persistent opaque application sessions stored through the PostgreSQL
+storage factory. The application guide follows sign-in through authenticated
+Commands, private queries and subscriptions, and logout.
+
+Memory-selected `OpaqueSessions` is process-local; select durable shared storage
+for sessions that must survive process restart. Signed-session revocation and
+OIDC identity provisioning are application responsibilities. A gateway protects
 only traffic that operators route through it; do not expose a backend route
 around that boundary.
 

package/REFERENCE.md

@@ -83,12 +83,134 @@ receiving boundary. Credentials and provider tokens are not forwarding fields.
 
 ## Sessions and sign-in
 
-`OpaqueSessions` implements a bounded, process-local `SessionResolver` with random cookie credentials. Defaults are an eight-hour lifetime, 10,000 retained sessions, and three identifier attempts. It lazily removes expired entries and is terminal after `close()`. It suits local development and the supported single-Gateway shape; choose an application session strategy that meets that gateway's restart and revocation requirements.
-
-`SignedSessions` provides signed application session tokens. Local signature validation can delay revocation; shared revocation requires an explicit `SignedTokenRevocation` implementation. `OpaqueSessionCookies` supplies strict cookie parsing and serialization helpers. Neither strategy provisions users nor grants permissions.
+`OpaqueSessions.create` requires an application scope, iron-session password
+configuration, trusted clock, and positive lifetime. `issue` seals a random
+stable reference and generation before atomic absent insertion. `resolve`
+checks the current stored generation and exact deadline without renewal.
+The authenticated application deadline is authoritative: any grace period in
+iron-session's seal validation cannot extend it. Rotation seals before
+compare-and-set. An old unexpired seal can revoke the current generation, but
+an expired seal cannot resolve or revoke.
+
+Omitting the store selects process-local memory. `PersistentOpaqueSessionStore.create`
+accepts a common storage factory and group; it prepares the indexed session
+family before returning by default. `createMissingStructures: false` opens a
+non-preparing handle for already prepared structures. The strategy leaves an
+injected store open, so the application closes the strategy, store, and factory
+separately. Explicit `purgeExpired(cutoff, signal)` traverses finite indexed
+pages with conditional removal in the persistent store; process-local memory
+scans its own records. If a row changes during conditional removal, the pass
+finishes that expiry group and returns its removed count. The changed row and
+other eligible rows in later groups can remain for another explicit purge.
+Storage errors and cancellation reject, possibly after partial removal. No
+timer calls maintenance automatically.
+
+For cancellation after a confirmed insertion or replacement, the strategy
+attempts conditional compensation and returns no credential. A storage error
+that does not confirm whether a commit occurred cannot safely authorize removal:
+another session may already occupy the same stable reference. The operation
+fails without returning a credential, but a committed row may require later
+explicit maintenance. This is a best-effort cleanup guarantee.
+
+`SignedSessions` issues and verifies ES256 application bearer tokens using jose.
+Without a `SignedTokenRevocation` source, logout is expiry-only. For shared
+revocation, create `PersistentTokenRevocations` with a storage factory, group,
+issuer, and audience, then inject it as `revocation`. Its asynchronous factory
+prepares the indexed record family by default; `createMissingStructures: false`
+opens a non-preparing handle with no physical schema checks or DDL at creation
+or during later operations. If structures are missing, ordinary storage
+operations fail. Close the strategy, revocation store, and shared
+factory separately. The strategy passes the full inclusive acceptance deadline,
+including clock skew, to the store. Reads ignore records after that deadline
+even before maintenance. Explicit `purgeExpired(cutoff, signal)` removes only
+records strictly before a cutoff no later than the store's trusted clock. It
+uses scoped indexed pages and conditional deletion; a concurrent change can
+leave eligible rows for a later invocation. No automatic cleanup runs.
+
+`SessionResolver.resolve(credential, lifetime?)` accepts an optional operation
+signal. Omitting it performs one validation without a retained monitor. With
+one, standard opaque and signed strategies register by stable authenticated
+identity before the authoritative storage or revocation read and return
+`ResolvedSession.invalidated`. Local logout, the captured resolved deadline,
+or strategy close aborts that signal. The supplied operation ending releases
+the listener and expiry timer. Opaque rotation does not extend an existing
+operation's captured deadline; signed token verification skew and durable
+revocation retention do not extend it either. The Gateway links invalidation
+to its backend cancellation and suppresses late updates. Logout errors remain
+visible even when local forwarding has stopped. Another process receives no
+local abort signal and must validate against shared durable state separately.
+`OpaqueSessionCookies` binds its CSRF value to the complete sealed credential,
+parses Cookie fields with cookie 2.0.1 after duplicate checks, and emits separate
+secure `__Host-` session and CSRF `Set-Cookie` fields. Pass the actual issued
+deadline to `issue`; `persistent: true` gives both cookies that deadline while
+the default keeps them as browser-session cookies. `sameSite` accepts `lax`,
+`strict`, or `none`; the session cookie remains `HttpOnly` and the CSRF cookie
+remains readable by the browser.
+
+```ts
+import { OpaqueSessionCookies, type OpaqueSessions } from "@spine-event-engine/auth";
+
+declare const sessions: OpaqueSessions;
+const cookies = new OpaqueSessionCookies({
+  csrfSecret: crypto.getRandomValues(new Uint8Array(32)),
+  origins: ["https://app.example"],
+  sameSite: "strict",
+  persistent: true,
+});
+const issued = await sessions.issue({ id: "example-user" });
+if (issued.kind === "created") {
+  const setCookieFields = cookies.issue(issued.credential.value, issued.session.expiresAt);
+  // Append each field separately to the HTTP response.
+  void setCookieFields;
+}
+```
+
+After rotation, call `issue` again with the new sealed value and its deadline;
+`clear()` emits matching host-only removal fields. `read` distinguishes missing
+credentials from terminal rejection so browser hosting does not fall back to a
+different reader after invalid input.
+Neither strategy provisions users nor grants permissions.
 
 `OidcFlow` is a bounded authorization-code and PKCE transaction manager. It works with `createGoogleProvider`, `createGitHubProvider`, or a discovered or configured OIDC provider. Applications expose start/callback/exchange endpoints, perform HTTP routing, map verified external identity through `IdentityMapping`, and issue an application session through `ApplicationSessionIssuer`. Provider access, refresh, and ID tokens remain sensitive server-side material; do not return them to browser application code.
 
+`OidcFlow.start()` awaits transaction persistence before returning an
+authorization URL. Callback binding and expiry are validated before the
+transaction is atomically consumed; provider exchange and identity mapping
+follow consumption. Browser PKCE proof and grant expiry are validated before
+the grant is consumed; application session issuance follows consumption. A
+trusted clock check after each confirmed consumption stops the next external
+step if the record reached expiry while storage was pending. A
+failed external step does not restore a consumed record. Independent flow
+instances select the same one-use records through their configured store.
+The optional second `AbortSignal` on start, callback, and exchange carries host
+request cancellation. Ordinary abort rejects with that reason; a distinct
+session issuer failure rejects the pending exchange or, after an abort or
+timeout has returned, is reported by `close()`. Close waits for admitted work
+and the original provider, mapping, and issuer promises to settle. A consumed
+transaction or grant is never restored after cancellation.
+
+The default `OidcFlow` store is process-local. `PersistentOidcFlowStore.create()`
+selects two record families from the supplied `StorageFactory` and `StorageGroup`;
+`flowId` qualifies state, grants, and indexed expiry queries. Preparation of
+both families completes by default. `createMissingStructures: false` returns
+non-preparing handles that do not probe for structures later. `OidcFlow.close()`
+drains admitted work and closes only its default memory store. Close an injected
+store and its factory separately. `purgeExpired(cutoff)` is explicit and uses a
+flow-scoped exact expiry index in persistent storage. A concurrent row change
+can leave eligible records for a later invocation. Cancellation or storage
+failure rejects with partial progress possible. A known confirmed late insert
+is conditionally removed after close; if another writer has replaced that
+record, the replacement remains. An ambiguous thrown storage result cannot be
+rolled back safely and may need later explicit maintenance.
+
+`discoverOidcProvider()` uses the exact selected discovery URL, including an
+application supplied path and query, and rejects a returned issuer mismatch.
+The selected URL does not replace token or JWKS destinations. Authorization
+URLs use S256 and replace reserved protocol parameters while retaining other
+provider query values. Token exchange uses the configured client authentication
+and exact callback URI; the provider returns an identity only after bounded
+response parsing and JOSE ID-token verification.
+
 ## Subscription and native adapters
 
 `SubscriptionGateway` and `InMemorySubscriptionBindings` compose subscription creation, activation, cancellation, and relaying at the gateway boundary. The Gateway accepts a logical `SubscriptionCoordinator`; native `SubscriptionCreator` instances remain a per-node implementation seam. This is an intentional replacement of the former public native-creator input, with no compatibility adapter because Spine TS has no deployed users. In-memory bindings are local to one process and have finite operation limits; they do not provide cross-machine propagation. `createNativeGatewayServices`, `NativeSubscriptionCreator`, and `SubscriptionUpdateRelay` adapt these public contracts to the native service layer. They do not make a deployment secure by themselves: applications choose how their listener accepts only gateway-routed traffic.

package/dist/index.d.ts

@@ -248,6 +248,10 @@ export interface ResolvedSession {
      * Specifies when the resolved session expires.
      */
     readonly expiresAt: Timestamp;
+    /**
+     * Ends this monitored operation on local logout, expiry, or strategy close.
+     */
+    readonly invalidated?: AbortSignal;
 }
 /**
  * Provider-neutral authentication boundary. Credentials do not reach policy request facts.
@@ -267,9 +271,10 @@ export interface SessionResolver {
     /**
      * Resolves a presented credential into a valid session.
      * @param credential Supplies the credential to resolve.
+     * @param lifetime Optional operation signal; omission retains no monitor.
      * @returns Returns the resolved session or `undefined` when it is invalid.
      */
-    resolve(credential: RequestCredential): Promise<ResolvedSession | undefined>;
+    resolve(credential: RequestCredential, lifetime?: AbortSignal): Promise<ResolvedSession | undefined>;
 }
 /**
  * Authorization policy boundary evaluated separately for every incoming request.
@@ -466,6 +471,15 @@ export { IncomingRequests } from "./request/index.js";
 export { UnaryGateway } from "./gateway/index.js";
 export { OpaqueSessionCookies } from "./sessions/cookies.js";
 export { OpaqueSessions } from "./sessions/opaque.js";
+export { MemoryOpaqueSessionStore } from "./sessions/opaque-session-store.js";
+export type { OpaqueSessionStore } from "./sessions/opaque-session-store.js";
+export { PersistentOpaqueSessionStore } from "./sessions/persistent-opaque-session-store.js";
+export type { PersistentOpaqueStoreOptions } from "./sessions/persistent-opaque-session-store.js";
+export { PersistentOidcFlowStore } from "./oidc/persistent-flow-store.js";
+export type { PersistentOidcFlowOptions } from "./oidc/persistent-flow-store.js";
+export { PersistentTokenRevocations } from "./sessions/persistent-token-revocations.js";
+export type { PersistentTokenRevocationsOptions } from "./sessions/persistent-token-revocations.js";
+export type { OidcFlowStore } from "./oidc/flow-store.js";
 export { SignedSessions } from "./sessions/signed.js";
 export { OidcFlow } from "./oidc/index.js";
 export { createGitHubProvider, createGoogleProvider, createOidcProvider, discoverOidcProvider, } from "./providers/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,MAAM,EACP,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,KAAK,EACX,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,uBAAuB,EACvB,WAAW,GAAG,eAAe,CAC9B;IAGC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACjE;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAGnC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAG7C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAG/C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,oBAAoB,GACpB,8BAA8B,GAC9B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IAGrC;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAGhC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;OAKG;IACH,SAAS,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1F;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IAGvC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;;OAMG;IACH,OAAO,CACL,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErC;;;;;OAKG;IACH,cAAc,CACZ,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IAGpB;;;OAGG;IACH,GAAG,IAAI,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,GAAG,SAAS,CAAC;CAClE;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED;;GAEG;AACH,UAAU,iBAAiB;IACzB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,uBAAuB,CAAC;CAC3D;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,iBAAiB,CAwBrD,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiBtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,gCAAgC,EAChC,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,MAAM,EACP,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,KAAK,EACV,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,KAAK,EACX,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,uBAAuB,EACvB,WAAW,GAAG,eAAe,CAC9B;IAGC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACjE;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAGnC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAG7C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAG/C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,oBAAoB,GACpB,8BAA8B,GAC9B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IAGrC;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAGhC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;OAKG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CACtG;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;OAKG;IACH,SAAS,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1F;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IAGvC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CACnE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;;OAMG;IACH,OAAO,CACL,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErC;;;;;OAKG;IACH,cAAc,CACZ,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IAGpB;;;OAGG;IACH,GAAG,IAAI,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,GAAG,SAAS,CAAC;CAClE;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED;;GAEG;AACH,UAAU,iBAAiB;IACzB;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,uBAAuB,CAAC;CAC3D;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,iBAAiB,CAwBrD,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAiBtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,YAAY,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,YAAY,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AACpG,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,gCAAgC,EAChC,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/index.js

@@ -51,6 +51,10 @@ const TransportFactsValues = Object.freeze({
 export { UnaryGateway } from "./gateway/index.js";
 export { OpaqueSessionCookies } from "./sessions/cookies.js";
 export { OpaqueSessions } from "./sessions/opaque.js";
+export { MemoryOpaqueSessionStore } from "./sessions/opaque-session-store.js";
+export { PersistentOpaqueSessionStore } from "./sessions/persistent-opaque-session-store.js";
+export { PersistentOidcFlowStore } from "./oidc/persistent-flow-store.js";
+export { PersistentTokenRevocations } from "./sessions/persistent-token-revocations.js";
 export { SignedSessions } from "./sessions/signed.js";
 export { OidcFlow } from "./oidc/index.js";
 export { createGitHubProvider, createGoogleProvider, createOidcProvider, discoverOidcProvider, } from "./providers/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,EAMN,MAAM,kCAAkC,CAAC;AA6lB1C;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgC,MAAM,CAAC,MAAM,CAAC;IACvE,kBAAkB;IAElB;;;;OAIG;IACH,IAAI,CAAC,KAA0B;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CACvD,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC;;;;OAIG;IACH,OAAO,CACL,OACqD;QAErD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC7B,CAAC;IAC1C,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAoF3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,EAMN,MAAM,kCAAkC,CAAC;AAmmB1C;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgC,MAAM,CAAC,MAAM,CAAC;IACvE,kBAAkB;IAElB;;;;OAIG;IACH,IAAI,CAAC,KAA0B;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CACvD,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC;;;;OAIG;IACH,OAAO,CACL,OACqD;QAErD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC7B,CAAC;IAC1C,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAGxF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAoF3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/oidc/contracts.d.ts

@@ -1,4 +1,5 @@
 import type { AuthenticatedPrincipal, RequestCredential, ResolvedSession } from "../index.js";
+import type { OidcFlowStore } from "./flow-store.js";
 /**
  * Clock used to evaluate finite OIDC transactions.
  */
@@ -46,7 +47,7 @@ export interface ResolvedApplicationIdentity {
     readonly principal: AuthenticatedPrincipal;
 }
 /**
- * Application-owned mapping from a verified external identity to a principal.
+ * Application-supplied mapping from a verified external identity to a principal.
  */
 export interface IdentityMapping {
     /**
@@ -120,9 +121,16 @@ export interface ApplicationSessionIssue {
 export interface ApplicationSessionIssuer {
     /**
      * Creates an application session for a mapped principal.
+     *
+     * Await durable issuance and any conditional cancellation compensation.
+     * Return `undefined` only for ordinary declined issuance. A distinct failure
+     * rejects; rejection with the exact supplied reason after abort is ordinary
+     * cancellation. The flow waits for this promise even after a caller-facing
+     * timeout or abort and reports late distinct failures at close.
+     *
      * @param principal The mapped principal.
      * @param signal The operation cancellation signal.
-     * @returns The issued session, or undefined when issuance fails.
+     * @returns The issued session, or undefined for an ordinary decline.
      */
     issue(principal: AuthenticatedPrincipal, signal: AbortSignal): Promise<ApplicationSessionIssue | undefined>;
 }
@@ -162,6 +170,10 @@ export interface OidcFlowOptions {
      * Issues application sessions.
      */
     readonly sessionIssuer: ApplicationSessionIssuer;
+    /**
+     * Atomic flow state; omission selects process-local memory.
+     */
+    readonly store?: OidcFlowStore;
     /**
      * Provides the optional flow clock.
      */
@@ -179,11 +191,13 @@ export interface OidcFlowOptions {
      */
     readonly grantTtlMilliseconds?: number;
     /**
-     * Limits retained transactions.
+     * Limits transactions in the default memory store.
+     * Supplying this option with an injected store is rejected.
      */
     readonly maxTransactions?: number;
     /**
-     * Limits retained grants.
+     * Limits grants in the default memory store.
+     * Supplying this option with an injected store is rejected.
      */
     readonly maxGrants?: number;
     /**

package/dist/oidc/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/oidc/contracts.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9F;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAG1C;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;OAKG;IACH,OAAO,CACL,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAG5C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,yBAAyB,CACvB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAGvC;;;;;OAKG;IACH,KAAK,CACH,SAAS,EAAE,sBAAsB,EACjC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAEhD;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IAEjD;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAE7C;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAE/C;;OAEG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;OAEG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAGE;;OAEG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAE7B;;OAEG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAEtC;;OAEG,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAChC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,eAAe,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CAC5F,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAGnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,CAAC,oBAAoB,GAAG;IAGtB;;OAEG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAE1B;;OAEG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CAC5B,CAAC,GACF,CAAC,oBAAoB,GAAG;IAGtB;;OAEG,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAE3B;;OAEG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;CAC3B,CAAC,CAAC;AAEP;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,eAAe,GACf,WAAW,GACX,SAAS,GACT,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B,CAAC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/oidc/contracts.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;;OAGG;IACH,GAAG,IAAI,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAG/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAG1C;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;OAKG;IACH,OAAO,CACL,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAG5C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAG3C;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,yBAAyB,CACvB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAGvC;;;;;;;;;;;;OAYG;IACH,KAAK,CACH,SAAS,EAAE,sBAAsB,EACjC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAEhD;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,wBAAwB,CAAC;IAEjD;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAE7C;;OAEG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAEvC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAElC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IAE/C;;OAEG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAGjC;;OAEG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAGE;;OAEG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAE7B;;OAEG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAEtC;;OAEG,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAChC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACb,eAAe,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,eAAe,GAAG,QAAQ,CAAC;CAC5F,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAGnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,CAAC,oBAAoB,GAAG;IAGtB;;OAEG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAE1B;;OAEG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CAC5B,CAAC,GACF,CAAC,oBAAoB,GAAG;IAGtB;;OAEG,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAE3B;;OAEG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;CAC3B,CAAC,CAAC;AAEP;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EACX,eAAe,GACf,WAAW,GACX,SAAS,GACT,gBAAgB,GAChB,iBAAiB,GACjB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,QAAQ,CAAC;CACd,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAGpC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;CACnC,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B,CAAC"}

package/dist/oidc/flow-store.d.ts

@@ -0,0 +1,143 @@
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+import { type OidcLoginGrant, type OidcLoginTransaction } from "@spine-event-engine/proto/auth";
+/**
+ * Atomic one-use transitions for one application-selected OIDC login flow.
+ */
+export interface OidcFlowStore {
+    /**
+     * Flow identity used to qualify state and grant digests.
+     */
+    readonly flowId: string;
+    /**
+     * Creates a transaction only if its qualified digest is absent.
+     *
+     * @param record Complete transaction with this flow identity.
+     * @param signal Optional cancellation.
+     * @returns True for confirmed insertion, false for confirmed no mutation.
+     */
+    insertTransaction(record: OidcLoginTransaction, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Reads a transaction by its qualified digest.
+     *
+     * @param digest Flow-qualified lookup digest.
+     * @param signal Optional cancellation.
+     * @returns Complete current transaction, if present for this flow.
+     */
+    readTransaction(digest: string, signal?: AbortSignal): Promise<OidcLoginTransaction | undefined>;
+    /**
+     * Deletes only the complete expected transaction before external exchange.
+     *
+     * @param expected Validated transaction snapshot.
+     * @param signal Optional cancellation.
+     * @returns True for one winning consumption, false for no mutation.
+     */
+    consumeTransaction(expected: OidcLoginTransaction, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Creates a one-use application grant only if its digest is absent.
+     *
+     * @param record Complete grant with this flow identity.
+     * @param signal Optional cancellation.
+     * @returns True for confirmed insertion, false for confirmed no mutation.
+     */
+    insertGrant(record: OidcLoginGrant, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Reads a grant by its qualified digest.
+     *
+     * @param digest Flow-qualified lookup digest.
+     * @param signal Optional cancellation.
+     * @returns Complete current grant, if present for this flow.
+     */
+    readGrant(digest: string, signal?: AbortSignal): Promise<OidcLoginGrant | undefined>;
+    /**
+     * Deletes only the complete expected grant before session issuance.
+     *
+     * @param expected Validated grant snapshot.
+     * @param signal Optional cancellation.
+     * @returns True for one winning consumption, false for no mutation.
+     */
+    consumeGrant(expected: OidcLoginGrant, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Removes expired records using the selected store's maintenance policy.
+     *
+     * @param cutoff Trusted current-or-earlier deadline.
+     * @param signal Optional cancellation.
+     * @returns Confirmed transaction and grant removals in this pass.
+     */
+    purgeExpired(cutoff: Timestamp, signal?: AbortSignal): Promise<{
+        transactions: number;
+        grants: number;
+    }>;
+    /**
+     * Closes new work and drains admitted work; an injected factory remains open.
+     *
+     * @returns Completion after the store releases its acquired resources.
+     */
+    close(): Promise<void>;
+}
+/**
+ * Process-local atomic transitions for one component login flow.
+ */
+export declare class MemoryOidcFlowStore implements OidcFlowStore {
+    #private;
+    /**
+     * Flow identity used in this process-local record family.
+     */
+    readonly flowId: string;
+    /**
+     * Binds a flow identity, trusted clock and process-local capacity policy.
+     *
+     * @param flowId Identity qualifying all state and grant digests.
+     * @param clock Latest allowed maintenance cutoff.
+     * @param maxTransactions Existing memory transaction bound.
+     * @param maxGrants Existing memory grant bound.
+     */
+    constructor(flowId: string, clock: () => Timestamp, maxTransactions: number, maxGrants: number);
+    /**
+     * Checks current process-local transaction capacity.
+     *
+     * @returns Whether another transaction needs explicit maintenance.
+     */
+    transactionsFull(): boolean;
+    /**
+     * Checks current process-local grant capacity.
+     *
+     * @returns Whether another grant needs explicit maintenance.
+     */
+    grantsFull(): boolean;
+    /**
+     * @inheritdoc
+     */
+    insertTransaction(record: OidcLoginTransaction, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * @inheritdoc
+     */
+    readTransaction(digest: string, signal?: AbortSignal): Promise<OidcLoginTransaction | undefined>;
+    /**
+     * @inheritdoc
+     */
+    consumeTransaction(expected: OidcLoginTransaction, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * @inheritdoc
+     */
+    insertGrant(record: OidcLoginGrant, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * @inheritdoc
+     */
+    readGrant(digest: string, signal?: AbortSignal): Promise<OidcLoginGrant | undefined>;
+    /**
+     * @inheritdoc
+     */
+    consumeGrant(expected: OidcLoginGrant, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * @inheritdoc
+     */
+    purgeExpired(cutoff: Timestamp, signal?: AbortSignal): Promise<{
+        transactions: number;
+        grants: number;
+    }>;
+    /**
+     * @inheritdoc
+     */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=flow-store.d.ts.map

package/dist/oidc/flow-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-store.d.ts","sourceRoot":"","sources":["../../src/oidc/flow-store.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,gCAAgC,CAAC;AAKxC;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExF;;;;;;OAMG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAEjG;;;;;;OAMG;IACH,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3F;;;;;;OAMG;IACH,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5E;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAErF;;;;;;OAMG;IACH,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/E;;;;;;OAMG;IACH,YAAY,CACV,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IAEH;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,aAAa;;IACvD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAcxB;;;;;;;OAOG;gBACS,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAe9F;;;;OAIG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;;;OAIG;IACH,UAAU,IAAI,OAAO;IAIrB;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAQvF;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAQhG;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1F;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAO3E;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAMpF;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9E;;OAEG;IACH,YAAY,CACV,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAUpD;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA8CvB"}