@wtfalch/auth 0.5.0 → 0.6.0

package/dist/auth.d.ts

@@ -3,6 +3,9 @@ import { type AuthRequest, type NewUser, type PeoplePage } from './broker.js';
 import { type AuthOptions } from './config.js';
 import { type SetCookie } from './cookies.js';
 export interface User {
+    /** Present only for validated namespace sessions. Membership is app-owned. */
+    namespaceId?: string;
+    bindingId?: string;
     id: string;
     email: string | null;
     emailVerified: boolean;
@@ -14,6 +17,10 @@ export interface User {
     claims: JWTPayload;
 }
 export interface ReadResult {
+    /** A cookie exists for another binding/revision or cannot be opened. Do not auto-switch. */
+    accountChanged?: true;
+    /** Namespace mode: the binding is suspended or its status cannot be confirmed. Do not start a sign-in. */
+    unavailable?: true;
     user: User | null;
     /** What the response must set. Empty unless the session was refreshed or ended. */
     cookies: SetCookie[];
@@ -35,6 +42,7 @@ export type Gate = {
  | {
     kind: 'deny';
     cookies: SetCookie[];
+    reason?: 'account_changed' | 'unavailable';
 };
 export type Intent = 'login' | 'register';
 export type SignInError = 'invalid_credentials' | 'too_many' | 'request' | 'unavailable';
@@ -135,7 +143,10 @@ export interface Auth {
         invited: boolean;
     }>;
     handle(request: Request): Promise<Response>;
-    /** `refresh: false` for callers that cannot set cookies; they get a user only while the token is valid. */
+    /**
+     * `refresh: false` for callers that cannot set cookies; they get a user only while the token is valid.
+     * Namespace sessions refresh on the server and never set a cookie, so they ignore it.
+     */
     read(request: Request, opts?: {
         refresh?: boolean;
     }): Promise<ReadResult>;
@@ -171,6 +182,13 @@ export interface Auth {
         userId: string;
         state: string;
     }>;
+    /**
+     * Namespace mode: end every session this person has in this service, on
+     * every replica, at their next request. Deactivating someone does this too.
+     * Their sign-in at the issuer is untouched, so an active person can sign
+     * straight back in.
+     */
+    revokeSessions(userId: string): Promise<number>;
     /** The auth request the issuer sent the browser here with. Refuses one for another application. */
     authRequest(id: string): Promise<AuthRequest>;
     signIn(input: {

package/dist/auth.js

@@ -3,15 +3,48 @@ import * as client from 'openid-client';
 import { Broker, BrokerError } from './broker.js';
 import { resolveOptions } from './config.js';
 import { clearSession, clearTransaction, cookieFrom, openSession, openTransaction, sealSession, sealTransaction, sessionCookieName, transactionCookieName, } from './cookies.js';
+import { namespaceSessions } from './namespace-session.js';
 import { AuthError, ORG_CLAIM, Oidc } from './oidc.js';
 import { safeNextPath } from './redirect.js';
 export function createAuth(input) {
     // Resolved on first use so `next build`, which imports every route module, needs none of the values set.
     let resolved = null;
     const options = () => {
-        resolved ??= resolveOptions(input);
+        if (!resolved) {
+            const candidate = resolveOptions(input);
+            if (candidate.namespace && (!candidate.sessionStore || !candidate.appKey))
+                throw new Error('@wtfalch/auth: namespace mode needs a sessionStore and an appKey');
+            resolved = candidate;
+        }
         return resolved;
     };
+    const boundUser = (claims) => {
+        const namespace = options().namespace;
+        return {
+            ...userFrom(claims),
+            ...(namespace
+                ? {
+                    namespaceId: namespace.namespaceId,
+                    bindingId: namespace.id,
+                }
+                : {}),
+        };
+    };
+    const validCallback = (raw) => {
+        if (!options().namespace)
+            return true;
+        try {
+            const url = new URL(raw);
+            return (!url.username &&
+                !url.password &&
+                !url.hash &&
+                `${url.origin}${url.pathname}` ===
+                    new URL(`${options().basePath}/callback`, options().appUrl).href);
+        }
+        catch {
+            return false;
+        }
+    };
     let oidcInstance = null;
     const oidc = () => {
         oidcInstance ??= new Oidc(options());
@@ -22,6 +55,11 @@ export function createAuth(input) {
         brokerInstance ??= new Broker(options());
         return brokerInstance;
     };
+    const sessions = namespaceSessions({ options, oidc, broker });
+    const sessionCookie = (tokens) => options().namespace
+        ? sessions.create(tokens)
+        : sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+    const unavailable = () => new Response('Sign-in is unavailable for this workspace', { status: 503 });
     const startUrl = (next, intent = 'login') => {
         const url = new URL(`${options().basePath}/start`, options().appUrl);
         const path = safeNextPath(next, '');
@@ -34,6 +72,8 @@ export function createAuth(input) {
     const start = async (request) => {
         if (!isNavigation(request))
             return new Response('Unauthorized', { status: 401 });
+        if (options().namespace && !(await sessions.bindingActive()))
+            return unavailable();
         const params = new URL(request.url).searchParams;
         const next = safeNextPath(params.get('next'), options().afterLogin);
         const state = client.randomState();
@@ -51,13 +91,17 @@ export function createAuth(input) {
         return redirect(target.href, [transaction]);
     };
     const complete = async (callbackUrl, cookieHeader) => {
+        if (!validCallback(callbackUrl))
+            return failure('request', []);
         const cleared = clearTransaction(options());
         const transaction = await openTransaction(options(), cookieFrom(cookieHeader, transactionCookieName(options())));
         if (!transaction)
-            return failure('expired', [cleared]);
+            return failure('expired', options().namespace ? [] : [cleared]);
         const params = new URL(callbackUrl).searchParams;
         if (params.get('state') !== transaction.st)
-            return failure('state', [cleared]);
+            return failure('state', options().namespace ? [] : [cleared]);
+        if (options().namespace && !(await sessions.bindingActive()))
+            return failure('unavailable', [cleared]);
         let session;
         try {
             const tokens = await oidc().exchange(params, {
@@ -65,11 +109,16 @@ export function createAuth(input) {
                 nonce: transaction.nc,
                 codeVerifier: transaction.cv,
             });
-            session = await sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+            session = await sessionCookie(tokens);
         }
         catch (error) {
             return failure(reasonOf(error), [cleared]);
         }
+        // Signing in again replaces this binding's previous session outright.
+        if (options().namespace)
+            await sessions
+                .end(cookieFrom(cookieHeader, sessionCookieName(options())))
+                .catch((error) => console.error('@wtfalch/auth: could not end the replaced session', error));
         return {
             location: new URL(transaction.nx, options().appUrl).href,
             cookies: [cleared, session],
@@ -83,7 +132,14 @@ export function createAuth(input) {
         if (!isSameOrigin(request, options().appUrl.origin)) {
             return new Response('Forbidden', { status: 403 });
         }
-        const session = await openSession(options(), cookieFrom(request.headers.get('cookie'), sessionCookieName(options())));
+        const value = cookieFrom(request.headers.get('cookie'), sessionCookieName(options()));
+        if (options().namespace) {
+            // Revoked in the store first: that is what ends copies of the cookie too.
+            if ((await sessions.end(value)) === 'changed')
+                return new Response('Account changed', { status: 409 });
+            return redirect(new URL(options().afterLogout, options().appUrl).href, [clearSession(options())], 303);
+        }
+        const session = await openSession(options(), value);
         if (session?.rt)
             await broker()
                 .revoke(session.rt)
@@ -106,7 +162,13 @@ export function createAuth(input) {
         // The id token in the cookie still says unverified; the claim is what the
         // app reads, so it is refreshed here rather than at the next expiry.
         const cookies = [];
-        const session = await openSession(options(), cookieFrom(request.headers.get('cookie'), sessionCookieName(options())));
+        const value = cookieFrom(request.headers.get('cookie'), sessionCookieName(options()));
+        if (options().namespace) {
+            await sessions.read(value, true).catch(() => { });
+            url.searchParams.set('verified', '1');
+            return redirect(url.href, cookies);
+        }
+        const session = await openSession(options(), value);
         if (session?.rt) {
             try {
                 const tokens = await oidc().refresh(session.rt);
@@ -135,6 +197,16 @@ export function createAuth(input) {
         return new Response('Not found', { status: 404 });
     };
     const readCookie = async (value, { refresh = true } = {}) => {
+        if (options().namespace) {
+            const result = await sessions.read(value);
+            if (result.kind === 'user')
+                return { user: boundUser(result.claims), cookies: [] };
+            if (result.kind === 'changed')
+                return { user: null, cookies: [], accountChanged: true };
+            if (result.kind === 'unavailable')
+                return { user: null, cookies: [], unavailable: true };
+            return { user: null, cookies: [] };
+        }
         const session = await openSession(options(), value);
         if (!session)
             return { user: null, cookies: [] };
@@ -149,7 +221,7 @@ export function createAuth(input) {
                     idt: tokens.idToken,
                     rt: tokens.refreshToken,
                 });
-                return { user: userFrom(tokens.claims), cookies: [cookie] };
+                return { user: boundUser(tokens.claims), cookies: [cookie] };
             }
             catch (error) {
                 // A failed refresh never clears the cookie: a valid token carries on, and a dead one is replaced by the next sign-in.
@@ -161,7 +233,7 @@ export function createAuth(input) {
         }
         try {
             const claims = await oidc().verify(session.idt);
-            return { user: userFrom(claims), cookies: [] };
+            return { user: boundUser(claims), cookies: [] };
         }
         catch (error) {
             return { user: null, cookies: refresh && rejected(error) ? [clearSession(options())] : [] };
@@ -173,27 +245,47 @@ export function createAuth(input) {
         const isPublic = url.pathname === options().basePath ||
             url.pathname.startsWith(`${options().basePath}/`) ||
             matches(rules.public, url.pathname);
-        const { user, cookies } = await read(request);
+        const { user, cookies, accountChanged, unavailable } = await read(request);
         if (user || isPublic)
             return { kind: 'next', user, cookies };
+        if (accountChanged)
+            return { kind: 'deny', cookies, reason: 'account_changed' };
+        if (unavailable)
+            return { kind: 'deny', cookies, reason: 'unavailable' };
         if (!isNavigation(request))
             return { kind: 'deny', cookies };
         return { kind: 'redirect', location: startUrl(`${url.pathname}${url.search}`), cookies };
     };
     const people = (options) => broker().people(options);
-    const setPersonActive = (userId, active) => broker().setPersonActive(userId, active);
+    const setPersonActive = async (userId, active) => {
+        const result = await broker().setPersonActive(userId, active);
+        if (!active && options().namespace)
+            await sessions.revokeSubject(userId);
+        return result;
+    };
+    const revokeSessions = (userId) => {
+        if (!options().namespace)
+            throw new Error('@wtfalch/auth: revokeSessions needs namespace sessions');
+        return sessions.revokeSubject(userId);
+    };
     const authRequest = (id) => broker().authRequest(id);
     /**
      * An OIDC flow this app starts and finishes itself, for a person arriving
      * from an email rather than from a browser the app sent to the issuer.
      */
     const serverFlow = async () => {
+        if (options().namespace && !(await sessions.bindingActive()))
+            throw new AuthError('unavailable', 'the namespace binding is not active');
         const state = client.randomState();
         const nonce = client.randomNonce();
         const verifier = client.randomPKCECodeVerifier();
         const target = await oidc().authorizationUrl(state, nonce, verifier);
         const response = await options().fetch(target.href, { redirect: 'manual' });
         const location = response.headers.get('location');
+        if (options().namespace &&
+            location &&
+            new URL(location, options().issuer).origin !== options().namespace?.loginOrigin)
+            throw new AuthError('request', 'issuer returned a different namespace login origin');
         const id = location && new URL(location, options().issuer).searchParams.get('authRequest');
         if (!id)
             throw new AuthError('request', 'the issuer did not start an auth request');
@@ -201,16 +293,18 @@ export function createAuth(input) {
     };
     /** Exchanges a callback the service issued, and seals the cookie. */
     const finish = async (callbackUrl, flow, next) => {
+        if (!validCallback(callbackUrl))
+            throw new AuthError('request', 'callback does not match namespace binding');
         const tokens = await oidc().exchange(new URL(callbackUrl).searchParams, {
             state: flow.state,
             nonce: flow.nonce,
             codeVerifier: flow.verifier,
         });
-        const cookie = await sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+        const cookie = await sessionCookie(tokens);
         return { location: new URL(next, options().appUrl).href, cookies: [cookie] };
     };
     const hostedUrl = (id) => {
-        const url = new URL('/login', options().issuer);
+        const url = new URL('/login', options().namespace?.loginOrigin ?? options().issuer);
         url.searchParams.set('authRequest', id);
         return url.href;
     };
@@ -358,6 +452,7 @@ export function createAuth(input) {
         errorUrl,
         people,
         setPersonActive,
+        revokeSessions,
         authRequest,
         signIn,
         signUp,

package/dist/broker.d.ts

@@ -86,6 +86,15 @@ export declare class Broker {
     sendLink(email: string, next: string): Promise<unknown>;
     sendReset(email: string, next: string): Promise<unknown>;
     sendVerification(email: string, next: string): Promise<unknown>;
+    /**
+     * What the service routes this key to. A suspended binding's key is refused.
+     * Bounded, because every namespace request waits on this answer when it is due.
+     */
+    binding(): Promise<{
+        organizationId: string;
+        clientIds: string[];
+        origins: string[];
+    }>;
     verifyEmail(userId: string, code: string): Promise<unknown>;
     /** A public client revoking its own token: no key, no service. */
     revoke(refreshToken: string): Promise<void>;

package/dist/broker.js

@@ -20,7 +20,7 @@ export class Broker {
     constructor(options) {
         this.options = options;
     }
-    async call(method, path, body) {
+    async call(method, path, body, signal) {
         if (!this.options.appKey) {
             throw new Error('@wtfalch/auth: appKey is required to sign people in on the app');
         }
@@ -30,6 +30,7 @@ export class Broker {
                 url.searchParams.set(k, String(v));
         const response = await this.options.fetch(url.href, {
             method,
+            signal,
             headers: {
                 authorization: `Bearer ${this.options.appKey}`,
                 'content-type': 'application/json',
@@ -95,6 +96,13 @@ export class Broker {
     sendVerification(email, next) {
         return this.call('POST', '/verification/send', { email, next });
     }
+    /**
+     * What the service routes this key to. A suspended binding's key is refused.
+     * Bounded, because every namespace request waits on this answer when it is due.
+     */
+    binding() {
+        return this.call('GET', '/binding', {}, AbortSignal.timeout(5_000));
+    }
     verifyEmail(userId, code) {
         return this.call('POST', '/verify', { userId, code });
     }

package/dist/browser.d.ts

@@ -1,3 +1,4 @@
+import type { NamespaceSelection } from './namespaces.js';
 /**
  * Signing in from a browser app, and being *already* signed in when another
  * subdomain did it.
@@ -37,6 +38,8 @@
  * bounce somebody straight back in — a sign-out that undoes itself is not one.
  */
 export interface BrowserAuthOptions {
+    /** Public namespace registry projection; never include broker or cookie secrets. */
+    namespace?: NamespaceSelection;
     /** The issuer, e.g. `https://auth.wtfalch.dev`. */
     issuer: string;
     /** This app's client id at the issuer. */
@@ -56,6 +59,8 @@ export interface BrowserAuthOptions {
     scope?: string;
 }
 export interface BrowserSession {
+    namespaceId?: string;
+    bindingId?: string;
     accessToken: string;
     /** Epoch milliseconds. */
     expiresAt: number;
@@ -78,6 +83,8 @@ export type SignInOutcome = {
     error: string;
 };
 export interface BrowserAuth {
+    /** Another account/binding replaced this context; require a deliberate sign-in. */
+    accountChanged(): boolean;
     /** The session this tab holds, or null. Expiry is checked with a minute of
      *  slack: a token that dies mid-request is worse than one renewed early. */
     currentSession(): BrowserSession | null;

package/dist/browser.js

@@ -1,41 +1,4 @@
-/**
- * Signing in from a browser app, and being *already* signed in when another
- * subdomain did it.
- *
- * The rest of this package is for a server: it holds a session in a cookie and
- * the person never sees a token. A browser app cannot do that — whatever it
- * holds, the person holding the browser holds too — so this is a public client
- * using PKCE, the flow designed for exactly that.
- *
- * **Why a session cannot simply be shared across subdomains.** The server
- * side's cookie is `__Host-` prefixed, and that prefix is defined as `Secure`,
- * `Path=/` and *no* `Domain` attribute: host-only, by specification. It is
- * what stops one subdomain writing a session cookie the next one would trust.
- * Widening it to `.<apex>` to get single sign-on would trade that away, so the
- * shared thing is not a cookie: it is the **session at the issuer**. Every
- * origin gets its own token from it, and the person is asked for credentials
- * once.
- *
- * **`prompt=none` is what makes that invisible.** On load, an app with no token
- * asks the issuer to authorise without interacting. Either a code comes back —
- * a redirect out and in, a flash, and the app is signed in — or the issuer
- * answers `login_required`, and the app shows its own sign-in affordance
- * having lost nothing. `trySilentSignIn` is that attempt, `completeSignIn`
- * tells the two apart, and `SilentRefused` is the outcome to draw a button for
- * rather than an error.
- *
- * **A top-level redirect, not a hidden iframe.** The classic silent-auth trick
- * loads the issuer in an iframe, which needs the issuer's cookie in a
- * third-party context — blocked by default in Safari and increasingly
- * elsewhere. It fails *silently* and intermittently, which is the worst
- * failure mode available. A redirect always works and costs a flash.
- *
- * **Every silent attempt is made at most once per tab.** Without that, an
- * issuer answering `login_required` sends the app back to a page whose load
- * asks again, forever, and the loop is invisible: the address bar settles and
- * the tab spins. `forget()` sets the same mark, so pressing sign out does not
- * bounce somebody straight back in — a sign-out that undoes itself is not one.
- */
+import { createNamespaceBrowserAuth } from './namespace-browser.js';
 const TOKEN = 'wtfalch.auth.token';
 const VERIFIER = 'wtfalch.auth.verifier';
 const RETURN = 'wtfalch.auth.return';
@@ -85,6 +48,8 @@ function verifier() {
     return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
 }
 export function createBrowserAuth(options) {
+    if (options.namespace)
+        return createNamespaceBrowserAuth(options, options.namespace);
     const origin = options.origin ?? window.location.origin;
     const callbackPath = options.callbackPath ?? '/auth/callback';
     const scope = options.scope ?? 'openid email profile offline_access';
@@ -118,6 +83,7 @@ export function createBrowserAuth(options) {
     };
     const silentSignInAvailable = () => !currentSession() && !store.get(TRIED);
     return {
+        accountChanged: () => false,
         currentSession,
         silentSignInAvailable,
         async trySilentSignIn(returnTo = window.location.pathname) {

package/dist/config.d.ts

@@ -1,4 +1,13 @@
+import { type NamespaceSelection, resolveNamespaceContext } from './namespaces.js';
+import type { SessionStore } from './sessions.js';
 export interface AuthOptions {
+    /** Opt-in namespace mode. Resolve this from trusted workspace/host configuration. */
+    namespace?: NamespaceSelection;
+    /**
+     * Where namespace sessions are kept. Required with `namespace`, together with
+     * `appKey`; unused without it. Every replica of the app must share one.
+     */
+    sessionStore?: SessionStore;
     /** This app's origin, e.g. https://portal.valet.wtfalch.dev. Every URL the SDK builds starts here, never from the request's Host. */
     appUrl: string | undefined;
     /** From scripts/provisioned.json. */
@@ -30,13 +39,15 @@ export interface AuthOptions {
     appKey?: string;
     /** The sign-in service. Defaults to the issuer's /api. */
     brokerUrl?: string;
-    /** Cookie lifetime in seconds, sliding. Default 30 days, the issuer's idle expiry for a refresh token. */
+    /** Session lifetime in seconds, sliding. Default 30 days, the issuer's idle expiry for a refresh token. */
     sessionMaxAge?: number;
     /** Refresh when the id token has fewer seconds left than this. Default 300. */
     refreshWindow?: number;
     fetch?: typeof fetch;
 }
 export interface ResolvedOptions {
+    namespace: ReturnType<typeof resolveNamespaceContext> | null;
+    sessionStore: SessionStore | null;
     appUrl: URL;
     clientId: string;
     organizationId: string;

package/dist/config.js

@@ -1,3 +1,4 @@
+import { resolveNamespaceContext } from './namespaces.js';
 export const ISSUER = 'https://auth.wtfalch.dev';
 export function resolveOptions(options) {
     const appUrl = parseAppUrl(options.appUrl);
@@ -19,9 +20,24 @@ export function resolveOptions(options) {
     */
     if (options.cookieSecret !== undefined)
         decodeKey(options.cookieSecret);
+    const issuer = (options.issuer ?? ISSUER).replace(/\/$/, '');
+    const namespace = options.namespace
+        ? resolveNamespaceContext(options.namespace, {
+            issuer,
+            clientId: options.clientId,
+            organizationId: options.organizationId,
+            appOrigin: appUrl.origin,
+            redirectUri: new URL(`${basePath}/callback`, appUrl).href,
+        })
+        : null;
+    if (namespace &&
+        !namespace.postLogoutRedirectUris.includes(new URL(options.afterLogout ?? '/', appUrl).href))
+        throw new Error('@wtfalch/auth: logout destination disagrees with binding');
     // Held here so the key is decoded at most once however often it is read.
     let cookieKey;
     return {
+        namespace,
+        sessionStore: options.sessionStore ?? null,
         appUrl,
         clientId: options.clientId,
         organizationId: options.organizationId,

package/dist/cookies.d.ts

@@ -4,6 +4,12 @@ export interface SessionPayload extends JWTPayload {
     idt: string;
     rt?: string;
 }
+/** The tokens inside a namespace session record, bound to that record's key. */
+export interface RecordPayload extends JWTPayload {
+    k: string;
+    idt: string;
+    rt?: string;
+}
 export interface TransactionPayload extends JWTPayload {
     st: string;
     nc: string;
@@ -33,6 +39,16 @@ export declare function transactionCookieName(options: ResolvedOptions): string;
 export declare function sealSession(options: ResolvedOptions, payload: Omit<SessionPayload, keyof JWTPayload>): Promise<SetCookie>;
 export declare function openSession(options: ResolvedOptions, value: string | undefined): Promise<SessionPayload | null>;
 export declare function clearSession(options: ResolvedOptions): SetCookie;
+/** The namespace session cookie: a random handle to a server record, nothing else. */
+export declare function sealHandle(options: ResolvedOptions, sid: string): Promise<SetCookie>;
+export declare function openHandle(options: ResolvedOptions, value: string | undefined): Promise<string | null>;
+export declare function sealRecord(options: ResolvedOptions, payload: Omit<RecordPayload, keyof JWTPayload>): Promise<string>;
+/** The tokens, if this payload was sealed for this record under this binding. */
+export declare function openRecord(options: ResolvedOptions, key: string, value: string): Promise<RecordPayload | null>;
+/** The binding digest a namespace record is filed under. */
+export declare function contextDigest(options: ResolvedOptions): Promise<string>;
+/** SHA-256, base64url. */
+export declare function digest(value: string): Promise<string>;
 export declare function sealTransaction(options: ResolvedOptions, payload: Omit<TransactionPayload, keyof JWTPayload>): Promise<SetCookie>;
 export declare function openTransaction(options: ResolvedOptions, value: string | undefined): Promise<TransactionPayload | null>;
 export declare function clearTransaction(options: ResolvedOptions): SetCookie;

package/dist/cookies.js

@@ -4,6 +4,13 @@ const SESSION = 'wtfalch_auth';
 const TRANSACTION = 'wtfalch_auth_tx';
 const LINK = 'wtfalch_auth_link';
 const TRANSACTION_TTL = 10 * 60;
+/**
+ * A namespace session handle lives as long as a browser will keep a cookie.
+ * It grants nothing by itself: the server record decides, and slides its own
+ * expiry. Refreshing never sets it again, which is what stops a late response
+ * from putting back a cookie the person has since replaced.
+ */
+const HANDLE_TTL = 400 * 24 * 60 * 60;
 export function sessionCookieName(options) {
     return options.secure ? `__Host-${SESSION}` : SESSION;
 }
@@ -25,6 +32,37 @@ export async function openSession(options, value) {
 export function clearSession(options) {
     return setCookie(sessionCookieName(options), '', 0, options.secure);
 }
+/** The namespace session cookie: a random handle to a server record, nothing else. */
+export async function sealHandle(options, sid) {
+    const value = await seal(options, 'handle', { sid }, HANDLE_TTL);
+    return setCookie(sessionCookieName(options), value, HANDLE_TTL, options.secure);
+}
+export async function openHandle(options, value) {
+    const payload = await open(options, 'handle', value);
+    return payload && typeof payload.sid === 'string' ? payload.sid : null;
+}
+export function sealRecord(options, payload) {
+    return seal(options, 'record', payload, HANDLE_TTL);
+}
+/** The tokens, if this payload was sealed for this record under this binding. */
+export async function openRecord(options, key, value) {
+    const payload = await open(options, 'record', value);
+    return payload && payload.k === key && typeof payload.idt === 'string' ? payload : null;
+}
+/** The binding digest a namespace record is filed under. */
+export async function contextDigest(options) {
+    if (!options.namespace)
+        throw new Error('@wtfalch/auth: no namespace binding');
+    return digest(options.namespace.context);
+}
+/** SHA-256, base64url. */
+export async function digest(value) {
+    const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replace(/=+$/, '');
+}
 export async function sealTransaction(options, payload) {
     const value = await seal(options, 'transaction', payload, TRANSACTION_TTL);
     return setCookie(transactionCookieName(options), value, TRANSACTION_TTL, options.secure);
@@ -61,11 +99,21 @@ export async function openLink(options, value) {
 export function clearLink(options) {
     return setCookie(linkCookieName(options), '', 0, options.secure);
 }
+// A different audience also prevents old static consumers from accepting a
+// namespace cookie. Hashing keeps the encrypted session below browser limits.
+async function audience(options, kind) {
+    if (!options.namespace)
+        return kind;
+    return `${kind}:namespace:1:${await digest(options.namespace.context)}`;
+}
 async function seal(options, kind, payload, ttl) {
-    return new EncryptJWT(payload)
+    return new EncryptJWT({
+        ...payload,
+        ...(options.namespace ? { ns: options.namespace.namespaceId } : {}),
+    })
         .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
         .setIssuer(options.appUrl.origin)
-        .setAudience(kind)
+        .setAudience(await audience(options, kind))
         .setIssuedAt()
         .setExpirationTime(Math.floor(Date.now() / 1000) + ttl)
         .encrypt(options.cookieKey);
@@ -76,7 +124,7 @@ async function open(options, kind, value) {
     try {
         const { payload } = await jwtDecrypt(value, options.cookieKey, {
             issuer: options.appUrl.origin,
-            audience: kind,
+            audience: await audience(options, kind),
             contentEncryptionAlgorithms: ['A256GCM'],
             keyManagementAlgorithms: ['dir'],
         });

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { type Auth, type AuthRequest, type Gate, type GateRules, type Intent, type NewUser, type ReadResult, type ResetError, type SignInError, type SignInResult, type SignUpError, type SignUpResult, type SignedIn, type User, createAuth, } from './auth.js';
 export { type AuthOptions, ISSUER } from './config.js';
 export type { SetCookie } from './cookies.js';
+export type { SessionRecord, SessionStore, SessionUpdate } from './sessions.js';
 export { BrokerError } from './broker.js';
 export { AuthError, type AuthErrorReason, ORG_CLAIM } from './oidc.js';
 export { safeNextPath } from './redirect.js';

package/dist/namespace-browser.d.ts

@@ -0,0 +1,4 @@
+import type { BrowserAuth, BrowserAuthOptions } from './browser.js';
+import { type NamespaceSelection } from './namespaces.js';
+/** Isolated implementation: legacy storage and callback behavior stay unchanged. */
+export declare function createNamespaceBrowserAuth(options: BrowserAuthOptions, selection: NamespaceSelection): BrowserAuth;