@voyant-travel/utils 0.105.1

package/dist/rate-limits.js

@@ -0,0 +1,86 @@
+/**
+ * Rate Limit Utilities
+ *
+ * Maps subscription plans to API rate limits
+ */
+/**
+ * Default rate limits by plan tier
+ *
+ * These limits apply to API key authentication
+ * Based on subscription tier or plan key
+ */
+export const RATE_LIMITS_BY_PLAN = {
+    // Free/Starter tier
+    free: {
+        rps: 5,
+        rpm: 300,
+        burst: 10,
+    },
+    starter: {
+        rps: 5,
+        rpm: 300,
+        burst: 10,
+    },
+    // Professional tier
+    professional: {
+        rps: 50,
+        rpm: 3000,
+        burst: 100,
+    },
+    pro: {
+        rps: 50,
+        rpm: 3000,
+        burst: 100,
+    },
+    // Business tier
+    business: {
+        rps: 100,
+        rpm: 6000,
+        burst: 200,
+    },
+    // Enterprise tier
+    enterprise: {
+        rps: 500,
+        rpm: 30000,
+        burst: 1000,
+    },
+    // Default fallback
+    default: {
+        rps: 5,
+        rpm: 300,
+        burst: 10,
+    },
+};
+/**
+ * Get rate limits for a given plan key
+ *
+ * @param planKey - The plan key (e.g., "starter", "professional", "enterprise")
+ * @returns Rate limit configuration
+ */
+export function getRateLimitsForPlan(planKey) {
+    if (!planKey)
+        return RATE_LIMITS_BY_PLAN.default;
+    const normalized = planKey.toLowerCase().trim();
+    return RATE_LIMITS_BY_PLAN[normalized] || RATE_LIMITS_BY_PLAN.default;
+}
+/**
+ * Check if a plan has enterprise-level access
+ *
+ * @param planKey - The plan key
+ * @returns True if enterprise plan
+ */
+export function isEnterprisePlan(planKey) {
+    if (!planKey)
+        return false;
+    return planKey.toLowerCase().includes("enterprise");
+}
+/**
+ * Get human-readable rate limit description
+ *
+ * @param limits - Rate limit configuration
+ * @returns Formatted string
+ */
+export function describeRateLimits(limits) {
+    return `${limits.rpm} requests/minute, ${limits.rps} requests/second`;
+}
+//# sourceMappingURL=rate-limits.js.map

package/dist/rate-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limits.js","sourceRoot":"","sources":["../src/rate-limits.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAoC;IAClE,oBAAoB;IACpB,IAAI,EAAE;QACJ,GAAG,EAAE,CAAC;QACN,GAAG,EAAE,GAAG;QACR,KAAK,EAAE,EAAE;KACV;IACD,OAAO,EAAE;QACP,GAAG,EAAE,CAAC;QACN,GAAG,EAAE,GAAG;QACR,KAAK,EAAE,EAAE;KACV;IAED,oBAAoB;IACpB,YAAY,EAAE;QACZ,GAAG,EAAE,EAAE;QACP,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,GAAG;KACX;IACD,GAAG,EAAE;QACH,GAAG,EAAE,EAAE;QACP,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,GAAG;KACX;IAED,gBAAgB;IAChB,QAAQ,EAAE;QACR,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,GAAG;KACX;IAED,kBAAkB;IAClB,UAAU,EAAE;QACV,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,IAAI;KACZ;IAED,mBAAmB;IACnB,OAAO,EAAE;QACP,GAAG,EAAE,CAAC;QACN,GAAG,EAAE,GAAG;QACR,KAAK,EAAE,EAAE;KACV;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAkC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,mBAAmB,CAAC,OAAQ,CAAA;IAEjD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC/C,OAAO,mBAAmB,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,OAAQ,CAAA;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,OAAO,GAAG,MAAM,CAAC,GAAG,qBAAqB,MAAM,CAAC,GAAG,kBAAkB,CAAA;AACvE,CAAC"}

package/dist/resilience.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Outbound-HTTP resilience primitives (RFC voyant#1687 Phase 3.3).
+ *
+ * Every outbound call from a Worker burns request CPU/subrequest budget
+ * (now platform-enforced per plan tier), so a slow third-party must
+ * fail fast, a flaky one must retry with jitter instead of hammering,
+ * and a down one must trip a breaker instead of cascading. These are
+ * the defaults the plugin clients (e-invoicing, CMS sync, payments)
+ * and channel push wrap their fetches with — consumers stop
+ * hand-rolling them.
+ */
+export interface RetryOptions {
+    /** Max attempts INCLUDING the first. Default 3. */
+    attempts?: number;
+    /** Base backoff before the 2nd attempt; doubles per retry. Default 250ms. */
+    baseDelayMs?: number;
+    /** Backoff ceiling. Default 4s. */
+    maxDelayMs?: number;
+    /**
+     * Which failures retry. Defaults to network errors, timeouts, 429 and
+     * 5xx responses — for requests considered idempotent (see
+     * `retryNonIdempotent` on {@link ResilientFetchOptions}).
+     */
+    retryOn?: (result: {
+        response?: Response;
+        error?: unknown;
+    }) => boolean;
+}
+export interface CircuitBreakerOptions {
+    /** Consecutive failures before the circuit opens. Default 5. */
+    failureThreshold?: number;
+    /** How long an open circuit rejects immediately. Default 30s. */
+    openMs?: number;
+}
+/**
+ * Minimal consecutive-failure circuit breaker. Half-open after
+ * `openMs`: the next call probes; success closes, failure re-opens.
+ * State is per-isolate (Workers have many isolates — the breaker bounds
+ * each isolate's contribution to a hammering herd rather than providing
+ * a global cutoff, which is the right scope for edge runtimes).
+ */
+export interface CircuitBreaker {
+    /** Throws {@link CircuitOpenError} when open. */
+    assertClosed(): void;
+    recordSuccess(): void;
+    recordFailure(): void;
+    readonly state: "closed" | "open" | "half-open";
+}
+export declare class CircuitOpenError extends Error {
+    readonly retryAfterMs: number;
+    constructor(retryAfterMs: number);
+}
+export declare function createCircuitBreaker(options?: CircuitBreakerOptions): CircuitBreaker;
+export interface ResilientFetchOptions {
+    /** Per-attempt timeout. Default 10s. */
+    timeoutMs?: number;
+    /** Retry policy. `false` disables retries. */
+    retry?: RetryOptions | false;
+    /**
+     * Retries default to idempotent methods only (GET/HEAD/PUT/DELETE).
+     * POSTs against APIs with their own idempotency keys (most payment /
+     * e-invoicing providers) can opt in.
+     */
+    retryNonIdempotent?: boolean;
+    /** Optional breaker — share one per upstream service. */
+    breaker?: CircuitBreaker;
+    /** Injection point for tests. Defaults to global fetch. */
+    fetchImpl?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+}
+/**
+ * `fetch` with a per-attempt timeout, capped exponential retries with
+ * full jitter, and an optional circuit breaker.
+ *
+ * Defaults: 10s timeout, 3 attempts on network errors/timeouts/429/5xx —
+ * but only for idempotent methods unless `retryNonIdempotent` is set.
+ * 4xx responses (other than 429) are returned, never retried. Breaker
+ * failures count once per attempt; a `CircuitOpenError` is thrown
+ * without touching the network.
+ */
+export declare function resilientFetch(input: string | URL | Request, init?: RequestInit, options?: ResilientFetchOptions): Promise<Response>;
+//# sourceMappingURL=resilience.d.ts.map

package/dist/resilience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.d.ts","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAA;CACxE;AAED,MAAM,WAAW,qBAAqB;IACpC,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,YAAY,IAAI,IAAI,CAAA;IACpB,aAAa,IAAI,IAAI,CAAA;IACrB,aAAa,IAAI,IAAI,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAA;CAChD;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;gBACjB,YAAY,EAAE,MAAM;CAKjC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA0CxF;AAED,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,YAAY,GAAG,KAAK,CAAA;IAC5B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,yDAAyD;IACzD,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACrF;AAwBD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC7B,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,QAAQ,CAAC,CAgEnB"}

package/dist/resilience.js

@@ -0,0 +1,156 @@
+/**
+ * Outbound-HTTP resilience primitives (RFC voyant#1687 Phase 3.3).
+ *
+ * Every outbound call from a Worker burns request CPU/subrequest budget
+ * (now platform-enforced per plan tier), so a slow third-party must
+ * fail fast, a flaky one must retry with jitter instead of hammering,
+ * and a down one must trip a breaker instead of cascading. These are
+ * the defaults the plugin clients (e-invoicing, CMS sync, payments)
+ * and channel push wrap their fetches with — consumers stop
+ * hand-rolling them.
+ */
+export class CircuitOpenError extends Error {
+    retryAfterMs;
+    constructor(retryAfterMs) {
+        super(`circuit open; retry in ~${Math.ceil(retryAfterMs / 1000)}s`);
+        this.name = "CircuitOpenError";
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+export function createCircuitBreaker(options = {}) {
+    const failureThreshold = options.failureThreshold ?? 5;
+    const openMs = options.openMs ?? 30_000;
+    let consecutiveFailures = 0;
+    let openedAt = null;
+    let probing = false;
+    function currentState() {
+        if (openedAt === null)
+            return "closed";
+        if (Date.now() - openedAt >= openMs)
+            return "half-open";
+        return "open";
+    }
+    return {
+        get state() {
+            return currentState();
+        },
+        assertClosed() {
+            const state = currentState();
+            if (state === "closed")
+                return;
+            if (state === "half-open" && !probing) {
+                // One probe through; everyone else keeps getting rejected until
+                // the probe settles.
+                probing = true;
+                return;
+            }
+            const elapsed = Date.now() - (openedAt ?? 0);
+            throw new CircuitOpenError(Math.max(0, openMs - elapsed));
+        },
+        recordSuccess() {
+            consecutiveFailures = 0;
+            openedAt = null;
+            probing = false;
+        },
+        recordFailure() {
+            consecutiveFailures += 1;
+            probing = false;
+            if (consecutiveFailures >= failureThreshold) {
+                openedAt = Date.now();
+            }
+        },
+    };
+}
+const IDEMPOTENT_METHODS = new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+function defaultRetryOn(result) {
+    if (result.error)
+        return !(result.error instanceof CircuitOpenError);
+    if (!result.response)
+        return false;
+    return result.response.status === 429 || result.response.status >= 500;
+}
+function backoffDelay(attempt, base, cap) {
+    const exp = Math.min(base * 2 ** (attempt - 1), cap);
+    // Full jitter — desynchronizes retry herds across isolates.
+    return Math.round(exp * (0.5 + Math.random() * 0.5));
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function defaultFetch(input, init) {
+    return fetch(input, init);
+}
+/**
+ * `fetch` with a per-attempt timeout, capped exponential retries with
+ * full jitter, and an optional circuit breaker.
+ *
+ * Defaults: 10s timeout, 3 attempts on network errors/timeouts/429/5xx —
+ * but only for idempotent methods unless `retryNonIdempotent` is set.
+ * 4xx responses (other than 429) are returned, never retried. Breaker
+ * failures count once per attempt; a `CircuitOpenError` is thrown
+ * without touching the network.
+ */
+export async function resilientFetch(input, init = {}, options = {}) {
+    const fetchImpl = options.fetchImpl ?? defaultFetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    const method = (init.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+    const retriesAllowed = options.retry !== false && (IDEMPOTENT_METHODS.has(method) || options.retryNonIdempotent);
+    const retry = options.retry === false ? undefined : options.retry;
+    const attempts = retriesAllowed ? (retry?.attempts ?? 3) : 1;
+    const retryOn = retry?.retryOn ?? defaultRetryOn;
+    const baseDelayMs = retry?.baseDelayMs ?? 250;
+    const maxDelayMs = retry?.maxDelayMs ?? 4_000;
+    let lastError;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        options.breaker?.assertClosed();
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(new Error(`request timed out after ${timeoutMs}ms`)), timeoutMs);
+        // Compose with a caller-supplied signal when present.
+        if (init.signal) {
+            const upstream = init.signal;
+            if (upstream.aborted)
+                controller.abort(upstream.reason);
+            else
+                upstream.addEventListener("abort", () => controller.abort(upstream.reason));
+        }
+        try {
+            // Cast: CF's lib types Request with its own generics; the runtime
+            // value is the same structural Request either way.
+            const requestInput = (input instanceof Request ? input.clone() : input);
+            const response = await fetchImpl(requestInput, { ...init, signal: controller.signal });
+            if (response.ok || !retryOn({ response })) {
+                if (response.ok)
+                    options.breaker?.recordSuccess();
+                else if (response.status >= 500 || response.status === 429) {
+                    options.breaker?.recordFailure();
+                }
+                else {
+                    // 4xx = upstream is alive and judging our request; not a
+                    // service-health signal either way.
+                    options.breaker?.recordSuccess();
+                }
+                return response;
+            }
+            options.breaker?.recordFailure();
+            lastError = new Error(`upstream responded ${response.status}`);
+            // Drain/cancel so the runtime doesn't hold the body across retries.
+            await response.body?.cancel().catch(() => { });
+        }
+        catch (error) {
+            if (error instanceof CircuitOpenError)
+                throw error;
+            options.breaker?.recordFailure();
+            lastError = error;
+            if (!retryOn({ error }))
+                throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (attempt < attempts) {
+            await sleep(backoffDelay(attempt, baseDelayMs, maxDelayMs));
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+//# sourceMappingURL=resilience.js.map

package/dist/resilience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.js","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuCH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,YAAY,CAAQ;IAC7B,YAAY,YAAoB;QAC9B,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;QACnE,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;IAClC,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAiC,EAAE;IACtE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAA;IACvC,IAAI,mBAAmB,GAAG,CAAC,CAAA;IAC3B,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,SAAS,YAAY;QACnB,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM;YAAE,OAAO,WAAW,CAAA;QACvD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,IAAI,KAAK;YACP,OAAO,YAAY,EAAE,CAAA;QACvB,CAAC;QACD,YAAY;YACV,MAAM,KAAK,GAAG,YAAY,EAAE,CAAA;YAC5B,IAAI,KAAK,KAAK,QAAQ;gBAAE,OAAM;YAC9B,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtC,gEAAgE;gBAChE,qBAAqB;gBACrB,OAAO,GAAG,IAAI,CAAA;gBACd,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAA;YAC5C,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAA;QAC3D,CAAC;QACD,aAAa;YACX,mBAAmB,GAAG,CAAC,CAAA;YACvB,QAAQ,GAAG,IAAI,CAAA;YACf,OAAO,GAAG,KAAK,CAAA;QACjB,CAAC;QACD,aAAa;YACX,mBAAmB,IAAI,CAAC,CAAA;YACxB,OAAO,GAAG,KAAK,CAAA;YACf,IAAI,mBAAmB,IAAI,gBAAgB,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACvB,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAmBD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;AAE/E,SAAS,cAAc,CAAC,MAAgD;IACtE,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY,gBAAgB,CAAC,CAAA;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAA;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY,EAAE,GAAW;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACpD,4DAA4D;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,KAA6B,EAAE,IAAkB;IACrE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAA6B,EAC7B,OAAoB,EAAE,EACtB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAA;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC/F,MAAM,cAAc,GAClB,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;IACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,cAAc,CAAA;IAChD,MAAM,WAAW,GAAG,KAAK,EAAE,WAAW,IAAI,GAAG,CAAA;IAC7C,MAAM,UAAU,GAAG,KAAK,EAAE,UAAU,IAAI,KAAK,CAAA;IAE7C,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,CAAA;QAE/B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,IAAI,CAAC,CAAC,EAC3E,SAAS,CACV,CAAA;QACD,sDAAsD;QACtD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;YAC5B,IAAI,QAAQ,CAAC,OAAO;gBAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;;gBAClD,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAClF,CAAC;QAED,IAAI,CAAC;YACH,kEAAkE;YAClE,mDAAmD;YACnD,MAAM,YAAY,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAElE,CAAA;YACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;YACtF,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAC1C,IAAI,QAAQ,CAAC,EAAE;oBAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;qBAC5C,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3D,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;gBAClC,CAAC;qBAAM,CAAC;oBACN,yDAAyD;oBACzD,oCAAoC;oBACpC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;gBAClC,CAAC;gBACD,OAAO,QAAQ,CAAA;YACjB,CAAC;YACD,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;YAChC,SAAS,GAAG,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YAC9D,oEAAoE;YACpE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAA;YAClD,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,CAAA;YAChC,SAAS,GAAG,KAAK,CAAA;YACjB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,MAAM,KAAK,CAAA;QACtC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;AAC7E,CAAC"}

package/dist/session-claims.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Session Claims Cookie Utilities
+ *
+ * Implements signed session claims to reduce API calls in middleware.
+ * Claims contain minimal session info (userId, sessionId hash) that can be
+ * verified locally without database lookup.
+ *
+ * Security:
+ * - HMAC-SHA256 signing prevents tampering
+ * - 5-minute expiration ensures quick revocation
+ * - HttpOnly, Secure, SameSite cookies
+ * - Context-separated signing keys (HKDF-SHA256): the deployment secret
+ *   (`SESSION_CLAIMS_SECRET`) is never used directly as an HMAC key.
+ *   `signSessionClaims`/`verifySessionClaims` derive a dedicated key under
+ *   the `voyant:session-claims:v1` context, so a leak of a token-signing
+ *   key (or any other derived key) does not compromise sibling contexts
+ *   (e.g. the cloud-admin state cookie) or the raw Better Auth secret.
+ *
+ * Compatible with environments that expose the standard Web Crypto API,
+ * including Node.js, browsers, and Cloudflare Workers.
+ */
+export interface SessionClaims {
+    userId: string;
+    sessionId: string;
+    iat: number;
+    exp: number;
+}
+/**
+ * HKDF context label under which session-claims bearer tokens are signed.
+ * Bumping the version suffix invalidates all outstanding tokens.
+ */
+export declare const SESSION_CLAIMS_KEY_CONTEXT = "voyant:session-claims:v1";
+/**
+ * HKDF context label for the Voyant Cloud admin-auth state-cookie HMAC key.
+ * Consumers (e.g. the operator auth handler) derive this at the boundary and
+ * pass the derived key down as `cookieSecret`.
+ */
+export declare const CLOUD_STATE_COOKIE_KEY_CONTEXT = "voyant:cloud-state-cookie:v1";
+/**
+ * Derive a context-separated subkey from a root secret via HKDF-SHA256
+ * (Web Crypto, Workers-compatible).
+ *
+ * The same root secret yields independent keys per context label, so a
+ * compromise of one derived key cannot be replayed against another context
+ * or against anything still using the root secret (e.g. Better Auth).
+ *
+ * @param secret - Root secret (e.g. `SESSION_CLAIMS_SECRET`)
+ * @param context - Context label, e.g. `"voyant:session-claims:v1"`
+ * @returns base64url-encoded 256-bit key (43 chars — satisfies >=32-char
+ *   secret checks downstream)
+ */
+export declare function deriveContextKey(secret: string, context: string): Promise<string>;
+/**
+ * Sign session claims and return as JWT-like token
+ *
+ * Format: base64url(header).base64url(payload).base64url(signature)
+ *
+ * The HMAC key is NOT the raw `secret`: it is derived via
+ * `deriveContextKey(secret, SESSION_CLAIMS_KEY_CONTEXT)` so the root secret
+ * is never used directly as a token-signing key (context separation).
+ *
+ * @param userId - User ID from verified session
+ * @param sessionId - Full session ID (will be hashed)
+ * @param secret - Root secret; the signing key is derived from it
+ * @returns Signed token string
+ */
+export declare function signSessionClaims(userId: string, sessionId: string, secret: string): Promise<string>;
+/**
+ * Verify and decode session claims token
+ *
+ * Verification uses the same context-derived key as `signSessionClaims`
+ * (`SESSION_CLAIMS_KEY_CONTEXT`), so tokens signed with the raw secret
+ * (pre context-separation) are rejected.
+ *
+ * @param token - Signed token from cookie
+ * @param secret - Root secret; the verification key is derived from it
+ * @returns Decoded claims if valid, null if invalid/expired
+ */
+export declare function verifySessionClaims(token: string, secret: string): Promise<SessionClaims | null>;
+//# sourceMappingURL=session-claims.d.ts.map

package/dist/session-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-claims.d.ts","sourceRoot":"","sources":["../src/session-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAID;;;GAGG;AACH,eAAO,MAAM,0BAA0B,6BAA6B,CAAA;AAEpE;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,iCAAiC,CAAA;AAiB5E;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYjF;AAmDD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA6C/B"}

package/dist/session-claims.js

@@ -0,0 +1,205 @@
+/**
+ * Session Claims Cookie Utilities
+ *
+ * Implements signed session claims to reduce API calls in middleware.
+ * Claims contain minimal session info (userId, sessionId hash) that can be
+ * verified locally without database lookup.
+ *
+ * Security:
+ * - HMAC-SHA256 signing prevents tampering
+ * - 5-minute expiration ensures quick revocation
+ * - HttpOnly, Secure, SameSite cookies
+ * - Context-separated signing keys (HKDF-SHA256): the deployment secret
+ *   (`SESSION_CLAIMS_SECRET`) is never used directly as an HMAC key.
+ *   `signSessionClaims`/`verifySessionClaims` derive a dedicated key under
+ *   the `voyant:session-claims:v1` context, so a leak of a token-signing
+ *   key (or any other derived key) does not compromise sibling contexts
+ *   (e.g. the cloud-admin state cookie) or the raw Better Auth secret.
+ *
+ * Compatible with environments that expose the standard Web Crypto API,
+ * including Node.js, browsers, and Cloudflare Workers.
+ */
+function getWebCrypto() {
+    if (typeof globalThis.crypto !== "undefined" && globalThis.crypto.subtle) {
+        return globalThis.crypto;
+    }
+    throw new Error("No crypto implementation available");
+}
+const CLAIMS_EXPIRY_SECONDS = 5 * 60; // 5 minutes
+/**
+ * HKDF context label under which session-claims bearer tokens are signed.
+ * Bumping the version suffix invalidates all outstanding tokens.
+ */
+export const SESSION_CLAIMS_KEY_CONTEXT = "voyant:session-claims:v1";
+/**
+ * HKDF context label for the Voyant Cloud admin-auth state-cookie HMAC key.
+ * Consumers (e.g. the operator auth handler) derive this at the boundary and
+ * pass the derived key down as `cookieSecret`.
+ */
+export const CLOUD_STATE_COOKIE_KEY_CONTEXT = "voyant:cloud-state-cookie:v1";
+/**
+ * Fixed, public HKDF salt. Domain separation comes from the `info` (context)
+ * parameter; the salt only needs to be a stable application-wide constant.
+ */
+const HKDF_SALT = "voyant:hkdf:salt:v1";
+const derivedKeyCache = new Map();
+function base64UrlEncode(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=/g, "");
+}
+/**
+ * Derive a context-separated subkey from a root secret via HKDF-SHA256
+ * (Web Crypto, Workers-compatible).
+ *
+ * The same root secret yields independent keys per context label, so a
+ * compromise of one derived key cannot be replayed against another context
+ * or against anything still using the root secret (e.g. Better Auth).
+ *
+ * @param secret - Root secret (e.g. `SESSION_CLAIMS_SECRET`)
+ * @param context - Context label, e.g. `"voyant:session-claims:v1"`
+ * @returns base64url-encoded 256-bit key (43 chars — satisfies >=32-char
+ *   secret checks downstream)
+ */
+export function deriveContextKey(secret, context) {
+    const cacheKey = `${context}\u0000${secret}`;
+    let cached = derivedKeyCache.get(cacheKey);
+    if (!cached) {
+        cached = deriveContextKeyUncached(secret, context).catch((error) => {
+            // Don't cache failures (e.g. transient crypto unavailability).
+            derivedKeyCache.delete(cacheKey);
+            throw error;
+        });
+        derivedKeyCache.set(cacheKey, cached);
+    }
+    return cached;
+}
+async function deriveContextKeyUncached(secret, context) {
+    const webCrypto = getWebCrypto();
+    const encoder = new TextEncoder();
+    const keyMaterial = await webCrypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveBits"]);
+    const bits = await webCrypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: encoder.encode(HKDF_SALT),
+        info: encoder.encode(context),
+    }, keyMaterial, 256);
+    return base64UrlEncode(new Uint8Array(bits));
+}
+async function hmacBase64Url(message, key) {
+    const webCrypto = getWebCrypto();
+    const encoder = new TextEncoder();
+    const cryptoKey = await webCrypto.subtle.importKey("raw", encoder.encode(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sigBuffer = await webCrypto.subtle.sign("HMAC", cryptoKey, encoder.encode(message));
+    return base64UrlEncode(new Uint8Array(sigBuffer));
+}
+/**
+ * Create a short identifier from session ID for inclusion in claims
+ * Uses first 16 chars of base64url-encoded SHA-256 hash
+ */
+async function hashSessionId(sessionId) {
+    const webCrypto = getWebCrypto();
+    const encoder = new TextEncoder();
+    const data = encoder.encode(sessionId);
+    const hashBuffer = await webCrypto.subtle.digest("SHA-256", data);
+    return base64UrlEncode(new Uint8Array(hashBuffer)).slice(0, 16);
+}
+/**
+ * Sign session claims and return as JWT-like token
+ *
+ * Format: base64url(header).base64url(payload).base64url(signature)
+ *
+ * The HMAC key is NOT the raw `secret`: it is derived via
+ * `deriveContextKey(secret, SESSION_CLAIMS_KEY_CONTEXT)` so the root secret
+ * is never used directly as a token-signing key (context separation).
+ *
+ * @param userId - User ID from verified session
+ * @param sessionId - Full session ID (will be hashed)
+ * @param secret - Root secret; the signing key is derived from it
+ * @returns Signed token string
+ */
+export async function signSessionClaims(userId, sessionId, secret) {
+    const now = Math.floor(Date.now() / 1000);
+    const exp = now + CLAIMS_EXPIRY_SECONDS;
+    const sessionIdHash = await hashSessionId(sessionId);
+    const claims = {
+        userId,
+        sessionId: sessionIdHash,
+        iat: now,
+        exp,
+    };
+    // Encode payload (works in both environments)
+    const header = { alg: "HS256", typ: "JWT" };
+    const encoder = new TextEncoder();
+    const headerB64 = base64UrlEncode(encoder.encode(JSON.stringify(header)));
+    const payloadB64 = base64UrlEncode(encoder.encode(JSON.stringify(claims)));
+    // Create signature with the context-derived key
+    const message = `${headerB64}.${payloadB64}`;
+    const signingKey = await deriveContextKey(secret, SESSION_CLAIMS_KEY_CONTEXT);
+    const signature = await hmacBase64Url(message, signingKey);
+    return `${headerB64}.${payloadB64}.${signature}`;
+}
+/**
+ * Verify and decode session claims token
+ *
+ * Verification uses the same context-derived key as `signSessionClaims`
+ * (`SESSION_CLAIMS_KEY_CONTEXT`), so tokens signed with the raw secret
+ * (pre context-separation) are rejected.
+ *
+ * @param token - Signed token from cookie
+ * @param secret - Root secret; the verification key is derived from it
+ * @returns Decoded claims if valid, null if invalid/expired
+ */
+export async function verifySessionClaims(token, secret) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            return null;
+        }
+        const [headerB64, payloadB64, signature] = parts;
+        // Ensure all parts are defined
+        if (!headerB64 || !payloadB64 || !signature) {
+            return null;
+        }
+        // Verify signature with the context-derived key
+        const message = `${headerB64}.${payloadB64}`;
+        const signingKey = await deriveContextKey(secret, SESSION_CLAIMS_KEY_CONTEXT);
+        const expectedSig = await hmacBase64Url(message, signingKey);
+        // Constant-time comparison
+        if (!constantTimeEqual(signature, expectedSig)) {
+            return null;
+        }
+        // Decode payload (works in both environments)
+        // base64url decode: replace - with +, _ with /, then decode
+        const payloadJson = atob(payloadB64.replace(/-/g, "+").replace(/_/g, "/"));
+        const payload = JSON.parse(payloadJson);
+        // Check expiration
+        const now = Math.floor(Date.now() / 1000);
+        if (payload.exp < now) {
+            return null;
+        }
+        // Validate structure
+        if (!payload.userId || !payload.sessionId || !payload.iat || !payload.exp) {
+            return null;
+        }
+        return payload;
+    }
+    catch (_error) {
+        // Invalid token format or JSON parse error
+        return null;
+    }
+}
+/**
+ * Constant-time string comparison to prevent timing attacks
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+//# sourceMappingURL=session-claims.js.map

package/dist/session-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-claims.js","sourceRoot":"","sources":["../src/session-claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,SAAS,YAAY;IACnB,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,UAAU,CAAC,MAAM,CAAA;IAC1B,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;AACvD,CAAC;AASD,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,CAAA,CAAC,YAAY;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAA;AAEpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,8BAA8B,CAAA;AAE5E;;;GAGG;AACH,MAAM,SAAS,GAAG,qBAAqB,CAAA;AAEvC,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAA;AAE1D,SAAS,eAAe,CAAC,KAAiB;IACxC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAe;IAC9D,MAAM,QAAQ,GAAG,GAAG,OAAO,SAAS,MAAM,EAAE,CAAA;IAC5C,IAAI,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC1E,+DAA+D;YAC/D,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAChC,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;QACF,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc,EAAE,OAAe;IACrE,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAC5C;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC/B,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;KAC9B,EACD,WAAW,EACX,GAAG,CACJ,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAChD,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EACnB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IACzF,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACjE,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,SAAiB,EACjB,MAAc;IAEd,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,GAAG,GAAG,qBAAqB,CAAA;IAEvC,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,MAAM,GAAkB;QAC5B,MAAM;QACN,SAAS,EAAE,aAAa;QACxB,GAAG,EAAE,GAAG;QACR,GAAG;KACJ,CAAA;IAED,8CAA8C;IAC9C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAE1E,gDAAgD;IAChD,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAE1D,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,SAAS,EAAE,CAAA;AAClD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;QAEhD,+BAA+B;QAC/B,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;QAC7E,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAE5D,2BAA2B;QAC3B,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,8CAA8C;QAC9C,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAkB,CAAA;QAExD,mBAAmB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1E,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,2CAA2C;QAC3C,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC"}

package/dist/template-renderer.d.ts

@@ -0,0 +1,2 @@
+export * from "@voyant-travel/templating";
+//# sourceMappingURL=template-renderer.d.ts.map

package/dist/template-renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../src/template-renderer.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAA"}

package/dist/template-renderer.js

@@ -0,0 +1,2 @@
+export * from "@voyant-travel/templating";
+//# sourceMappingURL=template-renderer.js.map

package/dist/template-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-renderer.js","sourceRoot":"","sources":["../src/template-renderer.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAA"}

package/dist/temporal.d.ts

@@ -0,0 +1,2 @@
+export declare function toIsoDateUtc(date: Date): string;
+//# sourceMappingURL=temporal.d.ts.map

package/dist/temporal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temporal.d.ts","sourceRoot":"","sources":["../src/temporal.ts"],"names":[],"mappings":"AACA,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAG/C"}