@zintrust/core 0.1.28 → 0.1.29

package/src/security/XssProtection.js

@@ -0,0 +1,324 @@
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace pattern - all exports through XssProtection namespace
+ */
+import { Logger } from '../config/logger.js';
+const HTML_ESCAPE_MAP = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '/': '&#x2F;',
+    // Additional characters commonly escaped in attribute / template contexts
+    '`': '&#96;',
+    '=': '&#x3D;',
+};
+/**
+ * Escape HTML special characters
+ */
+const escapeHtml = (text) => {
+    if (typeof text !== 'string') {
+        return '';
+    }
+    return text.replaceAll(/[&<>"'/`=]/g, (char) => HTML_ESCAPE_MAP[char] || char);
+};
+/**
+ * Sanitize HTML by removing dangerous tags and attributes
+ */
+const MAX_SANITIZE_LOOPS = 50;
+function removeScripts(input) {
+    // Remove script tags and content (loop until stable to avoid incomplete multi-character sanitization)
+    let sanitized = input;
+    let prevSanitized;
+    let loopCount = 0;
+    do {
+        prevSanitized = sanitized;
+        sanitized = sanitized.replaceAll(/<script\b[\s\S]*?<\/script[^<]*?>/gi, '');
+        loopCount++;
+    } while (sanitized !== prevSanitized && loopCount < MAX_SANITIZE_LOOPS);
+    if (loopCount >= MAX_SANITIZE_LOOPS) {
+        Logger.warn('[XSS] Sanitization loop limit reached (script removal)');
+        return ''; // Fail safe: return empty string if attack detected
+    }
+    return sanitized;
+}
+function removeDangerousTags(input) {
+    // Remove iframe, object, embed, and base tags
+    let sanitized = input;
+    sanitized = sanitized.replaceAll(/<(?:iframe|object|embed|base)\b[\s\S]*?>/gi, '');
+    sanitized = sanitized.replaceAll(/<\/(?:iframe|object|embed|base)>/gi, '');
+    return sanitized;
+}
+function removeEventHandlers(input) {
+    // Remove event handlers (on*). Re-apply until stable to avoid incomplete multi-character sanitization.
+    let sanitized = input;
+    let prevSanitized;
+    let loopCount = 0;
+    do {
+        prevSanitized = sanitized;
+        sanitized = sanitized.replaceAll(/\bon\w+\s*=\s*(?:'[^']*'|"[^"]*"|`[^`]*`|[^\s>]*)/gi, '');
+        loopCount++;
+    } while (sanitized !== prevSanitized && loopCount < MAX_SANITIZE_LOOPS);
+    if (loopCount >= MAX_SANITIZE_LOOPS) {
+        Logger.warn('[XSS] Sanitization loop limit reached (event handler removal)');
+        return '';
+    }
+    return sanitized;
+}
+function stripDangerousUrlAttributes(input) {
+    // Remove dangerous protocols in URL-bearing attributes.
+    // This uses the same protocol normalization logic as encodeHref to prevent obfuscations like:
+    //   href="jav&#x61;script:..." or href="java\nscript:..." or href="%6a%61..."
+    return input.replaceAll(/(\s)(href|src|action|formaction|xlink:href)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi, (match, _leadingWhitespace, _attributeName, doubleQuotedValue, singleQuotedValue, unquotedValue) => {
+        const rawValue = doubleQuotedValue ?? singleQuotedValue ?? unquotedValue ?? '';
+        const protocolCheck = normalizeHrefForProtocolCheck(rawValue);
+        // Allow relative URLs and fragments.
+        if (protocolCheck.startsWith('/') ||
+            protocolCheck.startsWith('#') ||
+            protocolCheck.startsWith('./') ||
+            protocolCheck.startsWith('../') ||
+            protocolCheck.startsWith('//')) {
+            return match;
+        }
+        // Allow-list a narrow set of data:image/* URLs for common raster formats.
+        if (protocolCheck.startsWith('data:')) {
+            const allowedDataImagePrefixes = [
+                'data:image/png',
+                'data:image/jpeg',
+                'data:image/jpg',
+                'data:image/gif',
+                'data:image/webp',
+                'data:image/avif',
+            ];
+            if (allowedDataImagePrefixes.some((p) => protocolCheck.startsWith(p))) {
+                return match;
+            }
+            return '';
+        }
+        const blockedProtocols = ['javascript:', 'vbscript:']; // NOSONAR: S1523 - Explicit protocol blocking to prevent XSS
+        if (blockedProtocols.some((p) => protocolCheck.startsWith(p))) {
+            return '';
+        }
+        // If a scheme is present, allowlist it.
+        const schemeMatch = new RegExp(/^([a-z][a-z0-9+.-]*):/i).exec(protocolCheck);
+        if (schemeMatch) {
+            const scheme = schemeMatch[1].toLowerCase();
+            const allowedSchemes = new Set(['http', 'https', 'mailto', 'tel']);
+            if (!allowedSchemes.has(scheme)) {
+                return '';
+            }
+        }
+        // Otherwise, keep the attribute (e.g. relative-like values without a scheme).
+        return match;
+    });
+}
+function removeStyles(input) {
+    // Remove style tags and style attributes with potentially dangerous content
+    let sanitized = input;
+    let prevSanitized;
+    let loopCount = 0;
+    do {
+        prevSanitized = sanitized;
+        sanitized = sanitized.replaceAll(/<style\b[\s\S]*?<\/style>/gi, '');
+        loopCount++;
+    } while (sanitized !== prevSanitized && loopCount < MAX_SANITIZE_LOOPS);
+    if (loopCount >= MAX_SANITIZE_LOOPS) {
+        Logger.warn('[XSS] Sanitization loop limit reached (style removal)');
+        return '';
+    }
+    sanitized = sanitized.replaceAll(/\bstyle\s*=\s*(?:'[^']*'|"[^"]*"|[^\s>]*)/gi, '');
+    return sanitized;
+}
+function sanitizeHtml(html) {
+    if (typeof html !== 'string') {
+        return '';
+    }
+    let sanitized = html;
+    sanitized = removeScripts(sanitized);
+    if (!sanitized)
+        return '';
+    sanitized = removeDangerousTags(sanitized);
+    sanitized = removeEventHandlers(sanitized);
+    if (!sanitized)
+        return '';
+    sanitized = stripDangerousUrlAttributes(sanitized);
+    sanitized = removeStyles(sanitized);
+    if (!sanitized)
+        return '';
+    // Remove form elements
+    sanitized = sanitized.replaceAll(/<form\b[\s\S]*?<\/form>/gi, '');
+    // Remove object and embed tags
+    sanitized = sanitized.replaceAll(/<(?:object|embed|applet|meta|link|base)\b[\s\S]*?>/gi, '');
+    return sanitized.trim();
+}
+/**
+ * Encode URI component to prevent injection in URLs
+ */
+const encodeUri = (uri) => {
+    if (typeof uri !== 'string') {
+        return '';
+    }
+    try {
+        return encodeURIComponent(uri);
+    }
+    catch (error) {
+        Logger.error('URI encoding failed', error);
+        return '';
+    }
+};
+/**
+ * Encode URI for use in href attribute
+ */
+function decodeHtmlEntitiesForProtocolCheck(input) {
+    // Decode numeric HTML entities so obfuscations like "jav&#x61;script:" are caught.
+    // This is intentionally minimal and only used for protocol detection (not output rendering).
+    const decodeCodePoint = (codePoint) => {
+        if (!Number.isFinite(codePoint) || codePoint < 0 || codePoint > 0x10ffff) {
+            return '';
+        }
+        try {
+            return String.fromCodePoint(codePoint);
+        }
+        catch {
+            return '';
+        }
+    };
+    // Decode a small set of named entities commonly used for obfuscation.
+    const namedDecoded = input.replaceAll(/&([a-z]+);?/gi, (m, name) => {
+        const key = String(name).toLowerCase();
+        if (key === 'colon')
+            return ':';
+        if (key === 'tab')
+            return '\t';
+        if (key === 'newline')
+            return '\n';
+        if (key === 'nbsp')
+            return ' ';
+        return m;
+    });
+    return namedDecoded
+        .replaceAll(/&#(\d+);?/g, (_m, dec) => {
+        const decStr = typeof dec === 'string' ? dec : String(dec);
+        return decodeCodePoint(Number.parseInt(decStr, 10)) || _m;
+    })
+        .replaceAll(/&#x([0-9a-f]+);?/gi, (_m, hex) => {
+        const hexStr = typeof hex === 'string' ? hex : String(hex);
+        return decodeCodePoint(Number.parseInt(hexStr, 16)) || _m;
+    });
+}
+function tryDecodePercentEncoding(input, rounds = 2) {
+    let out = input;
+    for (let i = 0; i < rounds; i += 1) {
+        try {
+            const decoded = decodeURIComponent(out);
+            if (decoded === out) {
+                break;
+            }
+            out = decoded;
+        }
+        catch {
+            break;
+        }
+    }
+    return out;
+}
+function normalizeHrefForProtocolCheck(href) {
+    // Decode common obfuscations before protocol checks.
+    const entityDecoded = decodeHtmlEntitiesForProtocolCheck(href);
+    const percentDecoded = tryDecodePercentEncoding(entityDecoded, 2);
+    // Remove control characters and whitespace to prevent "java\nscript:" bypasses.
+    // eslint-disable-next-line no-control-regex
+    return percentDecoded.replaceAll(/[\x00-\x20\x7f\u00a0]/g, '').toLowerCase();
+}
+const encodeHref = (href) => {
+    if (typeof href !== 'string') {
+        return '';
+    }
+    const protocolCheck = normalizeHrefForProtocolCheck(href);
+    // Allow relative URLs and fragments.
+    if (protocolCheck.startsWith('/') ||
+        protocolCheck.startsWith('#') ||
+        protocolCheck.startsWith('./') ||
+        protocolCheck.startsWith('../') ||
+        protocolCheck.startsWith('//')) {
+        return escapeHtml(href);
+    }
+    // Explicitly block common dangerous protocols (including obfuscated versions).
+    // Allow-list a narrow set of data:image/* URLs for common raster formats.
+    if (protocolCheck.startsWith('data:')) {
+        const allowedDataImagePrefixes = [
+            'data:image/png',
+            'data:image/jpeg',
+            'data:image/jpg',
+            'data:image/gif',
+            'data:image/webp',
+            'data:image/avif',
+        ];
+        if (allowedDataImagePrefixes.some((p) => protocolCheck.startsWith(p))) {
+            return escapeHtml(href);
+        }
+        return '';
+    }
+    const blockedProtocols = ['javascript:', 'vbscript:']; // NOSONAR: S1523 - Explicit protocol blocking to prevent XSS
+    if (blockedProtocols.some((p) => protocolCheck.startsWith(p))) {
+        return '';
+    }
+    // If a scheme is present, allowlist it.
+    const schemeMatch = new RegExp(/^([a-z][a-z0-9+.-]*):/i).exec(protocolCheck);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        const allowedSchemes = new Set(['http', 'https', 'mailto', 'tel']);
+        if (!allowedSchemes.has(scheme)) {
+            return '';
+        }
+    }
+    return escapeHtml(href);
+};
+/**
+ * Check if string is safe URL (http, https, or relative)
+ */
+const isSafeUrl = (url) => {
+    if (typeof url !== 'string') {
+        return false;
+    }
+    const trimmed = url.trim().toLowerCase();
+    // Allow relative URLs
+    if (trimmed.startsWith('/') || trimmed.startsWith('#')) {
+        return true;
+    }
+    // Allow http and https
+    if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+        return true;
+    }
+    // Allow common safe schemes
+    if (trimmed.startsWith('mailto:') || trimmed.startsWith('tel:')) {
+        return true;
+    }
+    // Block dangerous protocols
+    if (/^\w+:/.test(trimmed)) {
+        return false;
+    }
+    return true;
+};
+/**
+ * Escape JSON for safe embedding in HTML
+ */
+export const escapeJson = (obj) => {
+    const json = JSON.stringify(obj);
+    return escapeHtml(json);
+};
+/**
+ * XSS Protection Utilities
+ * HTML escaping and sanitization (pure TypeScript, zero dependencies)
+ * Sealed namespace with protection methods
+ */
+export const XssProtection = Object.freeze({
+    escape: escapeHtml,
+    sanitize: sanitizeHtml,
+    encodeUri,
+    encodeHref,
+    isSafeUrl,
+    escapeJson,
+});

package/src/seeders/SeederDiscovery.d.ts

@@ -0,0 +1,5 @@
+export declare const SeederDiscovery: Readonly<{
+    resolveDir(projectRoot: string, dir: string): string;
+    listSeederFiles(dir: string): string[];
+}>;
+//# sourceMappingURL=SeederDiscovery.d.ts.map

package/src/seeders/SeederDiscovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SeederDiscovery.d.ts","sourceRoot":"","sources":["../../../src/seeders/SeederDiscovery.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,eAAe;4BACF,MAAM,OAAO,MAAM,GAAG,MAAM;yBAI/B,MAAM,GAAG,MAAM,EAAE;EAQtC,CAAC"}

package/src/seeders/SeederDiscovery.js

@@ -0,0 +1,21 @@
+import fs from '../node-singletons/fs.js';
+import * as path from '../node-singletons/path.js';
+const isSeederFile = (file) => {
+    if (file.endsWith('.d.ts'))
+        return false;
+    return file.endsWith('.ts') || file.endsWith('.js');
+};
+export const SeederDiscovery = Object.freeze({
+    resolveDir(projectRoot, dir) {
+        return path.resolve(projectRoot, dir);
+    },
+    listSeederFiles(dir) {
+        if (!fs.existsSync(dir))
+            return [];
+        const files = fs.readdirSync(dir);
+        return files
+            .filter(isSeederFile)
+            .sort((a, b) => a.localeCompare(b))
+            .map((f) => path.join(dir, f));
+    },
+});

package/src/seeders/SeederLoader.d.ts

@@ -0,0 +1,5 @@
+import type { LoadedSeeder } from '../seeders/types';
+export declare const SeederLoader: Readonly<{
+    load(filePath: string): Promise<LoadedSeeder>;
+}>;
+//# sourceMappingURL=SeederLoader.d.ts.map

package/src/seeders/SeederLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SeederLoader.d.ts","sourceRoot":"","sources":["../../../src/seeders/SeederLoader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,iBAAiB,CAAC;AAwDnE,eAAO,MAAM,YAAY;mBACF,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;EA0BnD,CAAC"}

package/src/seeders/SeederLoader.js

@@ -0,0 +1,60 @@
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import * as path from '../node-singletons/path.js';
+import { pathToFileURL } from 'node:url';
+function isFunction(value) {
+    return typeof value === 'function';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function hasRun(value) {
+    return typeof value === 'object' && value !== null && 'run' in value;
+}
+function normalizeHandler(fn, label) {
+    if (!isFunction(fn)) {
+        throw ErrorFactory.createValidationError(`Invalid seeder export: expected function for ${label}`);
+    }
+    return async (db) => {
+        // Support both (db) => Promise<void> and () => Promise<void>.
+        if (fn.length <= 0) {
+            await Promise.resolve(fn());
+            return;
+        }
+        await Promise.resolve(fn(db));
+    };
+}
+function selectSeederExport(mod, baseName) {
+    const defaultExport = mod.default;
+    const defaultNamed = isRecord(defaultExport) ? defaultExport[baseName] : undefined;
+    // Prefer conventional exports first.
+    const candidate = mod.seeder ?? mod[baseName] ?? mod.run ?? defaultExport ?? defaultNamed;
+    if (candidate !== undefined)
+        return candidate;
+    // Last resort: pick the first export that looks like a seeder object.
+    for (const value of Object.values(mod)) {
+        if (hasRun(value))
+            return value;
+    }
+    return undefined;
+}
+export const SeederLoader = Object.freeze({
+    async load(filePath) {
+        const url = pathToFileURL(filePath).href;
+        const raw = (await import(url));
+        const mod = isRecord(raw) ? raw : {};
+        const baseName = path.basename(filePath, path.extname(filePath));
+        const picked = selectSeederExport(mod, baseName);
+        const baseExport = mod[baseName];
+        const runFn = (hasRun(picked) ? picked.run : undefined) ??
+            (hasRun(baseExport) ? baseExport.run : undefined) ??
+            mod.run;
+        if (runFn === undefined) {
+            throw ErrorFactory.createValidationError(`Seeder '${filePath}' is missing a runnable export (expected '${baseName}.run()', 'seeder.run()', 'run()', or default export with 'run()')`);
+        }
+        return {
+            name: baseName,
+            filePath,
+            run: normalizeHandler(runFn, 'run'),
+        };
+    },
+});

package/src/seeders/types.d.ts

@@ -0,0 +1,18 @@
+import type { IDatabase } from '../orm/Database';
+export type SeederModule = {
+    /** Common pattern: export const UserSeeder = { run() { ... } } */
+    [key: string]: unknown;
+    /** Alternative: export const seeder = { run() { ... } } */
+    seeder?: unknown;
+    /** Alternative: export async function run() { ... } */
+    run?: unknown;
+    /** Interop: export default { run() { ... } } */
+    default?: unknown;
+};
+export type SeederHandler = (db: IDatabase) => Promise<void>;
+export type LoadedSeeder = {
+    name: string;
+    filePath: string;
+    run: SeederHandler;
+};
+//# sourceMappingURL=types.d.ts.map

package/src/seeders/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/seeders/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG;IACzB,kEAAkE;IAClE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC"}

package/src/seeders/types.js

@@ -0,0 +1 @@
+export {};

package/src/session/SessionManager.d.ts

@@ -0,0 +1,39 @@
+export type SessionData = Record<string, unknown>;
+export interface ISession {
+    id: string;
+    get<T = unknown>(key: string): T | undefined;
+    set(key: string, value: unknown): void;
+    has(key: string): boolean;
+    forget(key: string): void;
+    all(): SessionData;
+    clear(): void;
+}
+export interface ISessionManager {
+    getIdFromCookieHeader(cookieHeader: string | undefined): string | undefined;
+    getIdFromRequest(req: {
+        getHeader: (name: string) => unknown;
+        sessionId?: unknown;
+        context?: Record<string, unknown>;
+    }): string | undefined;
+    ensureSessionId(req: {
+        getHeader: (name: string) => unknown;
+        sessionId?: unknown;
+        context: Record<string, unknown>;
+    }, res: {
+        getHeader: (name: string) => unknown;
+        setHeader: (name: string, value: string | string[]) => unknown;
+    }): Promise<string>;
+    get(sessionId: string): ISession;
+    destroy(sessionId: string): void;
+    cleanup(): number;
+}
+export interface SessionManagerOptions {
+    cookieName?: string;
+    headerName?: string;
+    ttlMs?: number;
+}
+export declare const SessionManager: Readonly<{
+    create(options?: SessionManagerOptions): ISessionManager;
+}>;
+export default SessionManager;
+//# sourceMappingURL=SessionManager.d.ts.map

package/src/session/SessionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,IAAI,WAAW,CAAC;IACnB,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5E,gBAAgB,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,MAAM,GAAG,SAAS,CAAC;IACvB,eAAe,CACb,GAAG,EAAE;QACH,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,EACD,GAAG,EAAE;QACH,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,OAAO,CAAC;KAChE,GACA,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC;IACjC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,IAAI,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyHD,eAAO,MAAM,cAAc;qBACT,qBAAqB,GAAQ,eAAe;EA2E5D,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/src/session/SessionManager.js

@@ -0,0 +1,149 @@
+import { generateSecureJobId } from '../common/utility.js';
+const DEFAULT_OPTIONS = {
+    cookieName: 'ZIN_SESSION_ID',
+    headerName: 'x-session-id',
+    ttlMs: 7 * 24 * 60 * 60 * 1000,
+};
+function parseCookies(cookieHeader) {
+    const list = {};
+    if (cookieHeader.length === 0)
+        return list;
+    cookieHeader.split(';').forEach((cookie) => {
+        const parts = cookie.split('=');
+        const name = parts.shift()?.trim();
+        const value = parts.join('=');
+        if (name !== null && name !== undefined)
+            list[name] = decodeURIComponent(value);
+    });
+    return list;
+}
+function appendSetCookie(res, cookie) {
+    const existing = res.getHeader('Set-Cookie');
+    if (existing === undefined) {
+        res.setHeader('Set-Cookie', cookie);
+        return;
+    }
+    if (Array.isArray(existing)) {
+        const existingCookies = existing.map(String);
+        res.setHeader('Set-Cookie', [...existingCookies, cookie]);
+        return;
+    }
+    if (typeof existing === 'string') {
+        res.setHeader('Set-Cookie', [existing, cookie]);
+        return;
+    }
+    res.setHeader('Set-Cookie', cookie);
+}
+function buildSessionCookie(cookieName, sessionId) {
+    // Keep this minimal; callers can override behavior later.
+    // HttpOnly prevents JS access; SameSite=Lax is a reasonable default for app sessions.
+    return `${cookieName}=${encodeURIComponent(sessionId)}; Path=/; HttpOnly; SameSite=Lax`;
+}
+function createSessionApi(sessions, sessionId, ttlMs) {
+    const withoutKey = (data, key) => {
+        if (!Object.prototype.hasOwnProperty.call(data, key))
+            return data;
+        const record = data;
+        const { [key]: _removed, ...rest } = record;
+        return rest;
+    };
+    const ensureStored = () => {
+        const existing = sessions.get(sessionId);
+        const now = Date.now();
+        if (existing !== undefined && existing.expiresAt > now) {
+            return existing;
+        }
+        const created = { data: {}, expiresAt: now + ttlMs };
+        sessions.set(sessionId, created);
+        return created;
+    };
+    return {
+        id: sessionId,
+        get(key) {
+            return ensureStored().data[key];
+        },
+        set(key, value) {
+            const stored = ensureStored();
+            stored.data[key] = value;
+            stored.expiresAt = Date.now() + ttlMs;
+        },
+        has(key) {
+            return Object.prototype.hasOwnProperty.call(ensureStored().data, key);
+        },
+        forget(key) {
+            const stored = ensureStored();
+            stored.data = withoutKey(stored.data, key);
+            stored.expiresAt = Date.now() + ttlMs;
+        },
+        all() {
+            return { ...ensureStored().data };
+        },
+        clear() {
+            const stored = ensureStored();
+            stored.data = {};
+            stored.expiresAt = Date.now() + ttlMs;
+        },
+    };
+}
+export const SessionManager = Object.freeze({
+    create(options = {}) {
+        const config = { ...DEFAULT_OPTIONS, ...options };
+        const sessions = new Map();
+        return {
+            getIdFromCookieHeader(cookieHeader) {
+                if (cookieHeader === undefined || cookieHeader.length === 0)
+                    return undefined;
+                const cookies = parseCookies(cookieHeader);
+                return cookies[config.cookieName];
+            },
+            getIdFromRequest(req) {
+                const cookieHeader = req.getHeader('cookie');
+                if (typeof cookieHeader === 'string') {
+                    const fromCookie = this.getIdFromCookieHeader(cookieHeader);
+                    if (fromCookie !== undefined)
+                        return fromCookie;
+                }
+                const fromHeader = req.getHeader(config.headerName);
+                if (typeof fromHeader === 'string' && fromHeader.length > 0)
+                    return fromHeader;
+                if (typeof req.sessionId === 'string' && req.sessionId.length > 0)
+                    return req.sessionId;
+                const fromContext = req.context?.['sessionId'];
+                if (typeof fromContext === 'string' && fromContext.length > 0)
+                    return fromContext;
+                return undefined;
+            },
+            async ensureSessionId(req, res) {
+                const existing = this.getIdFromRequest(req);
+                const sessionId = existing ??
+                    (await Promise.resolve(generateSecureJobId('SessionManager: secure crypto API not available to generate a session id')));
+                req.context['sessionId'] = sessionId;
+                // If the cookie is missing, set it.
+                const cookieHeader = req.getHeader('cookie');
+                const fromCookie = typeof cookieHeader === 'string' ? this.getIdFromCookieHeader(cookieHeader) : undefined;
+                if (fromCookie === undefined) {
+                    appendSetCookie(res, buildSessionCookie(config.cookieName, sessionId));
+                }
+                return sessionId;
+            },
+            get(sessionId) {
+                return createSessionApi(sessions, sessionId, config.ttlMs);
+            },
+            destroy(sessionId) {
+                sessions.delete(sessionId);
+            },
+            cleanup() {
+                const now = Date.now();
+                let removed = 0;
+                for (const [id, stored] of sessions.entries()) {
+                    if (stored.expiresAt <= now) {
+                        sessions.delete(id);
+                        removed++;
+                    }
+                }
+                return removed;
+            },
+        };
+    },
+});
+export default SessionManager;

package/src/session/index.d.ts

@@ -0,0 +1,3 @@
+export { SessionManager } from './SessionManager';
+export type { ISession, ISessionManager, SessionData, SessionManagerOptions } from './SessionManager';
+//# sourceMappingURL=index.d.ts.map

package/src/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC"}

package/src/session/index.js

@@ -0,0 +1 @@
+export { SessionManager } from './SessionManager.js';