cortena-ui 1.4.2 → 1.6.0

package/dist/components/session-guard.js

@@ -0,0 +1,632 @@
+"use client";
+"use client";
+import { cn } from "../lib/cn.js";
+import { Button } from "./button.js";
+import { Dialog, DialogBody, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "./dialog.js";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/session-guard.tsx
+/** The org policy's defaults, used when neither `policy` nor a claim says otherwise. */
+const DEFAULT_SESSION_POLICY = /* @__PURE__ */ Object.freeze({
+	idleMs: 288e5,
+	absoluteMs: 432e5,
+	warnMs: 12e4
+});
+const DEFAULT_TIMERS = /* @__PURE__ */ Object.freeze({
+	setTimeout: (handler, ms) => globalThis.setTimeout(handler, ms),
+	clearTimeout: (handle) => {
+		globalThis.clearTimeout(handle);
+	}
+});
+/** The default `BroadcastChannel` name. One channel per origin is the point. */
+const SESSION_CHANNEL_NAME = "cortena-session";
+/** Epoch milliseconds, whichever unit the claim was written in. */
+const SECONDS_CEILING = 1e11;
+function epochMs(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return;
+	return value < SECONDS_CEILING ? value * 1e3 : value;
+}
+/**
+* The four session claims out of a JWT payload, **decoded and not verified**.
+*
+* Returns `{}` for anything that is not a readable JWT — an opaque token, a
+* truncated one, a payload that is not JSON. It never throws: a token the guard
+* cannot read falls back to the policy defaults, because a parse error must not
+* be what ends a user's session.
+*/
+function decodeSessionClaims(accessToken) {
+	const payload = readJwtPayload(accessToken);
+	if (!payload) return {};
+	return {
+		issuedAt: epochMs(payload.iat),
+		expiresAt: epochMs(payload.exp),
+		idleExpiresAt: epochMs(payload.idle_exp),
+		sessionExpiresAt: epochMs(payload.session_exp)
+	};
+}
+function readJwtPayload(accessToken) {
+	if (typeof accessToken !== "string") return;
+	const segment = accessToken.split(".")[1];
+	if (!segment) return;
+	try {
+		const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+		const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+		const binary = globalThis.atob(padded);
+		const json = decodeURIComponent(Array.from(binary, (char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join(""));
+		const parsed = JSON.parse(json);
+		return parsed && typeof parsed === "object" ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/** Refresh at three quarters of the access token's life, never on a 401. */
+const REFRESH_AT_FRACTION = .75;
+/** At most one activity broadcast per this many ms; the local clock is exact. */
+const ACTIVITY_BROADCAST_MS = 5e3;
+/** The countdown redraws once a second, which is the resolution it shows. */
+const COUNTDOWN_TICK_MS = 1e3;
+/**
+* At most one idle-clock reset per second from the pointer.
+*
+* `pointermove` fires on every frame a mouse is in motion — hundreds a second
+* on a 120 Hz display — and each one re-entered the whole tick, recomputed the
+* deadlines and tore down and rebuilt the timer. The idle clock has a
+* resolution of hours; a second is finer than it can express.
+*/
+const ACTIVITY_THROTTLE_MS = 1e3;
+/**
+* The largest delay `setTimeout` can express. Anything above it wraps to a
+* 32-bit signed integer and fires IMMEDIATELY, which turns a long deadline
+* into a busy loop rather than a long wait.
+*/
+const MAX_TIMEOUT_MS = 2 ** 31 - 1;
+/**
+* The longest idle window a claim may ask for. Beyond this the claim is not a
+* policy, it is a mistake — seconds parsed as milliseconds, a fixture with a
+* year 3000 expiry, a clock that has jumped — and honouring it means a session
+* that never idles out at all. Absent is safer than absurd: the default
+* applies, and cortena-auth remains the authority either way.
+*/
+const MAX_PLAUSIBLE_IDLE_MS = 2592e6;
+/** Whether `idle_exp` describes a window this guard will act on. */
+function plausibleIdleMs(ms) {
+	return ms !== void 0 && ms > 0 && ms <= MAX_PLAUSIBLE_IDLE_MS ? ms : void 0;
+}
+/** The Web Lock the proactive refresh is taken under. One rotation per origin. */
+const REFRESH_LOCK_NAME = "cortena-session-refresh";
+/**
+* How long a broadcast claim holds, for a browser with no `navigator.locks`.
+* Comfortably longer than a refresh round-trip and far shorter than the gap
+* between two proactive refreshes.
+*/
+const REFRESH_CLAIM_MS = 3e4;
+/**
+* How long the broadcast election runs before the winner rotates.
+*
+* One tick is all it takes: `BroadcastChannel` delivers within the same task
+* queue turn, so every tab that reached 75% of the same token's life at the
+* same instant has posted its ballot by the time this elapses. Long enough to
+* hear them, short enough that nobody notices the token rotated 50ms late.
+*/
+const REFRESH_ELECTION_MS = 50;
+/**
+* How long a tab that lost the election waits for the winner's `refreshed`.
+*
+* A leader can vanish between claiming and rotating — the user closed the tab,
+* the renderer was killed — and every other tab would then sit waiting for a
+* message that is never coming, until its token expired. This is the takeover:
+* comfortably longer than a refresh round-trip, far shorter than the life of
+* the credential it protects.
+*/
+const REFRESH_TAKEOVER_MS = 1e4;
+/**
+* A ballot for one election. `Math.random` on purpose: this breaks a tie
+* between tabs of one user in one browser, and nothing is defended by its
+* unpredictability. Fixed width so the comparison is over the whole ballot.
+*/
+function refreshNonce() {
+	return Math.random().toString(36).slice(2, 12).padEnd(10, "0");
+}
+function useSessionGuard(options) {
+	const { token, policy, channelName = SESSION_CHANNEL_NAME } = options;
+	const warnMs = policy?.warnMs ?? DEFAULT_SESSION_POLICY.warnMs;
+	const policyIdleMs = policy?.idleMs;
+	const policyAbsoluteMs = policy?.absoluteMs;
+	const latest = React.useRef(options);
+	latest.current = options;
+	const now = React.useCallback(() => (latest.current.now ?? Date.now)(), []);
+	const timers = React.useCallback(() => latest.current.timers ?? DEFAULT_TIMERS, []);
+	const [state, setState] = React.useState("active");
+	const [remainingMs, setRemainingMs] = React.useState(0);
+	const [reason, setReason] = React.useState(void 0);
+	const engineRef = React.useRef(null);
+	if (engineRef.current === null) {
+		const startedAt = now();
+		const claims = decodeSessionClaims(token.accessToken);
+		const claimedIdleMs = claims.idleExpiresAt !== void 0 && claims.issuedAt !== void 0 ? plausibleIdleMs(claims.idleExpiresAt - claims.issuedAt) : void 0;
+		const idleMs = policyIdleMs ?? claimedIdleMs ?? DEFAULT_SESSION_POLICY.idleMs;
+		const sessionStart = claims.issuedAt ?? startedAt;
+		engineRef.current = {
+			idleMs,
+			sessionStart,
+			lastActivity: policyIdleMs === void 0 && claimedIdleMs !== void 0 && claims.idleExpiresAt !== void 0 ? claims.idleExpiresAt - idleMs : startedAt,
+			absoluteDeadline: policyAbsoluteMs !== void 0 ? sessionStart + policyAbsoluteMs : claims.sessionExpiresAt ?? sessionStart + DEFAULT_SESSION_POLICY.absoluteMs,
+			refreshing: false,
+			ended: false,
+			timer: void 0,
+			lastBroadcast: 0,
+			lastPointer: 0,
+			lastRefreshClaim: 0
+		};
+	}
+	const engine = engineRef.current;
+	const tickRef = React.useRef(() => {});
+	const clearTimer = React.useCallback(() => {
+		if (engine.timer !== void 0) {
+			timers().clearTimeout(engine.timer);
+			engine.timer = void 0;
+		}
+	}, [engine, timers]);
+	const schedule = React.useCallback((ms) => {
+		clearTimer();
+		engine.timer = timers().setTimeout(() => {
+			engine.timer = void 0;
+			tickRef.current();
+		}, Math.min(Math.max(0, ms), MAX_TIMEOUT_MS));
+	}, [
+		clearTimer,
+		engine,
+		timers
+	]);
+	const post = React.useCallback((message) => {
+		try {
+			engine.channel?.postMessage(message);
+		} catch {}
+	}, [engine]);
+	const end = React.useCallback((why, opts) => {
+		if (engine.ended) return;
+		engine.ended = true;
+		clearTimer();
+		setState("signedOut");
+		setReason(why);
+		setRemainingMs(0);
+		if (opts?.broadcast !== false) post({
+			type: "signed-out",
+			reason: why
+		});
+		const done = () => latest.current.onSignedOut(why);
+		if (opts?.logout === false || why === "refresh_failed") {
+			done();
+			return;
+		}
+		Promise.resolve().then(() => latest.current.logout()).catch(() => {}).finally(done);
+	}, [
+		clearTimer,
+		engine,
+		post
+	]);
+	const adoptToken = React.useCallback((accessToken, expiresAtProp, at) => {
+		engine.seenToken = accessToken;
+		const claims = decodeSessionClaims(accessToken);
+		const expiresAt = claims.expiresAt ?? epochMs(expiresAtProp);
+		const issuedAt = claims.issuedAt ?? at;
+		engine.expiresAt = expiresAt;
+		engine.refreshAt = expiresAt !== void 0 && expiresAt > issuedAt ? issuedAt + (expiresAt - issuedAt) * REFRESH_AT_FRACTION : void 0;
+		if (policyAbsoluteMs === void 0 && claims.sessionExpiresAt !== void 0) engine.absoluteDeadline = claims.sessionExpiresAt;
+	}, [engine, policyAbsoluteMs]);
+	const doRefresh = React.useCallback(() => {
+		if (engine.refreshing || engine.ended) return Promise.resolve();
+		engine.refreshing = true;
+		engine.lastRefreshClaim = now();
+		return Promise.resolve().then(() => latest.current.refresh()).then((next) => {
+			engine.refreshing = false;
+			if (engine.ended) return;
+			adoptToken(next.accessToken, void 0, now());
+			post({
+				type: "refreshed",
+				...engine.expiresAt === void 0 ? {} : { expiresAt: engine.expiresAt }
+			});
+			tickRef.current();
+		}).catch(() => {
+			engine.refreshing = false;
+			end("refresh_failed");
+		});
+	}, [
+		adoptToken,
+		end,
+		engine,
+		now,
+		post
+	]);
+	/** Abandon any election in flight, and its timer. */
+	const clearElection = React.useCallback(() => {
+		if (engine.election?.timer !== void 0) timers().clearTimeout(engine.election.timer);
+		engine.election = void 0;
+	}, [engine, timers]);
+	/**
+	* The ballots are in.
+	*
+	* The highest one rotates. Everybody else waits for its `refreshed` — and
+	* takes the rotation over if the winner never sends one, because a leader
+	* that is closed between claiming and refreshing would otherwise leave every
+	* remaining tab waiting for a message nobody is going to send.
+	*/
+	const settleElection = React.useCallback(() => {
+		const election = engine.election;
+		if (!election || engine.ended) return;
+		if (election.best === election.nonce) {
+			engine.election = void 0;
+			if (engine.refreshing) return;
+			if (engine.refreshAt !== void 0 && now() < engine.refreshAt) return;
+			doRefresh();
+			return;
+		}
+		election.timer = timers().setTimeout(() => {
+			engine.election = void 0;
+			if (engine.ended || engine.refreshing) return;
+			if (engine.refreshAt !== void 0 && now() < engine.refreshAt) return;
+			doRefresh();
+		}, REFRESH_TAKEOVER_MS);
+	}, [
+		doRefresh,
+		engine,
+		now,
+		timers
+	]);
+	/**
+	* The proactive refresh, once per origin rather than once per tab.
+	*
+	* Every open tab reaches 75% of the same token's life at the same instant,
+	* so without a claim a user with four tabs fires four rotations at once.
+	* The refresh token rotates on use, so three of them present a token that
+	* has just been superseded — and a failed refresh is a signed-out state, by
+	* design. Four tabs, one of them signed in.
+	*
+	* `navigator.locks` is the right instrument and is available everywhere
+	* Cortena runs. `ifAvailable` means a tab that does not get the lock does
+	* NOT queue behind it: the rotation is already happening, and a second one
+	* afterwards is exactly what this prevents.
+	*
+	* Where locks are absent, an election over the channel the guard already
+	* owns. Claiming and refreshing in the same tick was no coordination at all:
+	* every tab reaches the deadline on the same clock, so every tab posted its
+	* claim and rotated before any of them could hear another's — the exact
+	* simultaneous rotation the lock exists to prevent, in the browsers with no
+	* lock to take. So a tab posts a ballot, waits one tick to hear the others,
+	* and only the highest ballot rotates. The losers wait for its `refreshed`,
+	* and take over if it never comes.
+	*/
+	const refreshOnce = React.useCallback(() => {
+		if (engine.refreshing || engine.ended) return;
+		const locks = globalThis.navigator?.locks;
+		if (locks && typeof locks.request === "function") {
+			locks.request(REFRESH_LOCK_NAME, { ifAvailable: true }, async (lock) => {
+				if (!lock) return;
+				if (engine.ended || engine.refreshing) return;
+				if (engine.refreshAt !== void 0 && now() < engine.refreshAt) return;
+				await doRefresh();
+			}).catch(() => {
+				doRefresh();
+			});
+			return;
+		}
+		const at = now();
+		if (engine.election || at - engine.lastRefreshClaim < REFRESH_CLAIM_MS) return;
+		engine.lastRefreshClaim = at;
+		const nonce = refreshNonce();
+		engine.election = {
+			nonce,
+			best: nonce
+		};
+		post({
+			type: "refresh-claim",
+			at,
+			nonce
+		});
+		engine.election.timer = timers().setTimeout(settleElection, REFRESH_ELECTION_MS);
+	}, [
+		doRefresh,
+		engine,
+		now,
+		post,
+		settleElection,
+		timers
+	]);
+	tickRef.current = React.useCallback(() => {
+		if (engine.ended) return;
+		const at = now();
+		const idleDeadline = engine.lastActivity + engine.idleMs;
+		const deadline = Math.min(idleDeadline, engine.absoluteDeadline);
+		if (at >= deadline) {
+			end(engine.absoluteDeadline <= idleDeadline ? "absolute" : "idle");
+			return;
+		}
+		const warnAt = deadline - warnMs;
+		if (at >= warnAt) {
+			setState("warning");
+			setRemainingMs(deadline - at);
+			schedule(Math.min(COUNTDOWN_TICK_MS, deadline - at));
+			return;
+		}
+		setState("active");
+		setRemainingMs(deadline - at);
+		const { refreshAt } = engine;
+		if (refreshAt !== void 0 && at >= refreshAt && !engine.refreshing) refreshOnce();
+		const wakeAt = refreshAt !== void 0 && refreshAt > at && !engine.refreshing ? Math.min(warnAt, refreshAt) : warnAt;
+		schedule(wakeAt - at);
+	}, [
+		end,
+		engine,
+		now,
+		refreshOnce,
+		schedule,
+		warnMs
+	]);
+	const stateRef = React.useRef(state);
+	stateRef.current = state;
+	const recordActivity = React.useCallback((at, opts) => {
+		if (engine.ended) return;
+		if (!opts?.force && stateRef.current !== "active") return;
+		if (at > engine.lastActivity) engine.lastActivity = at;
+		if (opts?.broadcast !== false && at - engine.lastBroadcast >= ACTIVITY_BROADCAST_MS) {
+			engine.lastBroadcast = at;
+			post({
+				type: "activity",
+				at
+			});
+		}
+		tickRef.current();
+	}, [engine, post]);
+	const continueSession = React.useCallback(() => {
+		if (engine.ended) return;
+		const at = now();
+		engine.lastBroadcast = at;
+		post({
+			type: "continue",
+			at
+		});
+		recordActivity(at, {
+			force: true,
+			broadcast: false
+		});
+		doRefresh();
+	}, [
+		doRefresh,
+		engine,
+		now,
+		post,
+		recordActivity
+	]);
+	const signOut = React.useCallback((why = "user") => {
+		end(why);
+	}, [end]);
+	React.useEffect(() => {
+		let channel;
+		try {
+			channel = typeof globalThis.BroadcastChannel === "function" ? new globalThis.BroadcastChannel(channelName) : void 0;
+		} catch {
+			channel = void 0;
+		}
+		engine.channel = channel;
+		if (channel) channel.onmessage = (event) => {
+			const message = event.data;
+			if (!message || typeof message !== "object") return;
+			if (message.type === "activity") recordActivity(message.at, { broadcast: false });
+			else if (message.type === "continue") recordActivity(message.at, {
+				force: true,
+				broadcast: false
+			});
+			else if (message.type === "refreshed") {
+				engine.lastRefreshClaim = now();
+				clearElection();
+				if (message.expiresAt !== void 0) {
+					const at = now();
+					engine.refreshAt = at + (message.expiresAt - at) * REFRESH_AT_FRACTION;
+				}
+				tickRef.current();
+			} else if (message.type === "refresh-claim") {
+				engine.lastRefreshClaim = Math.max(engine.lastRefreshClaim, message.at);
+				const ballot = message.nonce ?? "";
+				if (engine.election && ballot > engine.election.best) engine.election.best = ballot;
+			} else if (message.type === "signed-out") end(message.reason, {
+				logout: false,
+				broadcast: false
+			});
+		};
+		const onPointer = () => {
+			const at = now();
+			if (at - engine.lastPointer < ACTIVITY_THROTTLE_MS) return;
+			engine.lastPointer = at;
+			recordActivity(at);
+		};
+		const onKey = () => recordActivity(now());
+		/**
+		* The tab came back. **Judge the clock before crediting the hand.**
+		*
+		* A laptop lid closed at 5pm and opened at 9am delivers exactly one
+		* `visibilitychange`, and the timer that should have signed the user out
+		* at 1am never ran — a background tab's timers are throttled, and a
+		* suspended machine's do not run at all. Crediting the wake as activity
+		* first reset `lastActivity` to now and bought a fully idle session a
+		* fresh eight hours, every morning, for ever. So the deadline that
+		* elapsed while nobody was looking is evaluated against the OLD
+		* `lastActivity`, and only a session that survives it is credited.
+		*/
+		const onWake = () => {
+			if (engine.ended) return;
+			const at = now();
+			const idleDeadline = engine.lastActivity + engine.idleMs;
+			if (at >= Math.min(idleDeadline, engine.absoluteDeadline)) {
+				end(engine.absoluteDeadline <= idleDeadline ? "absolute" : "idle");
+				return;
+			}
+			recordActivity(at);
+		};
+		const onVisibility = () => {
+			if (typeof document !== "undefined" && document.visibilityState === "visible") onWake();
+		};
+		window.addEventListener("pointerdown", onPointer, { passive: true });
+		window.addEventListener("pointermove", onPointer, { passive: true });
+		window.addEventListener("keydown", onKey, { passive: true });
+		window.addEventListener("focus", onWake);
+		document.addEventListener("visibilitychange", onVisibility);
+		tickRef.current();
+		return () => {
+			window.removeEventListener("pointerdown", onPointer);
+			window.removeEventListener("pointermove", onPointer);
+			window.removeEventListener("keydown", onKey);
+			window.removeEventListener("focus", onWake);
+			document.removeEventListener("visibilitychange", onVisibility);
+			if (channel) {
+				channel.onmessage = null;
+				channel.close();
+			}
+			engine.channel = void 0;
+			clearElection();
+			clearTimer();
+		};
+	}, [
+		channelName,
+		clearElection,
+		clearTimer,
+		end,
+		engine,
+		now,
+		recordActivity
+	]);
+	React.useEffect(() => {
+		if (engine.seenToken === token.accessToken) return;
+		adoptToken(token.accessToken, token.expiresAt, now());
+		tickRef.current();
+	}, [
+		adoptToken,
+		engine,
+		now,
+		token.accessToken,
+		token.expiresAt
+	]);
+	const recordActivityNow = React.useCallback(() => recordActivity(now()), [now, recordActivity]);
+	const idleDeadline = engine.lastActivity + engine.idleMs;
+	const deadline = Math.min(idleDeadline, engine.absoluteDeadline);
+	return {
+		state,
+		remainingMs: state === "signedOut" ? 0 : remainingMs,
+		canContinue: idleDeadline < engine.absoluteDeadline,
+		reason,
+		idleDeadline,
+		absoluteDeadline: engine.absoluteDeadline,
+		deadline,
+		continueSession,
+		signOut,
+		recordActivity: recordActivityNow
+	};
+}
+/** `m:ss`, rounded up, so the countdown reaches 0:00 exactly as it ends. */
+function formatCountdown(ms) {
+	const seconds = Math.max(0, Math.ceil(ms / 1e3));
+	return `${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`;
+}
+/**
+* The countdown. `role="alertdialog"` rather than `dialog`, because it is not a
+* surface the user opened — it interrupts them to ask a question with a
+* deadline, and assistive technology announces it as such.
+*
+* It is deliberately undismissable: no Escape, no outside press, no close X.
+* Both ways out are decisions — Continue or Log out — and a modal you can wave
+* away without answering is one that ends a session by accident. Focus opens on
+* Continue, which is the answer nearly every user wants.
+*/
+function SessionExpiryDialog({ open, remainingMs, canContinue = true, onContinue, onLogout, modal = true, container }) {
+	const continueRef = React.useRef(null);
+	return /* @__PURE__ */ jsx(Dialog, {
+		open,
+		modal,
+		disablePointerDismissal: true,
+		onOpenChange: () => {},
+		children: /* @__PURE__ */ jsxs(DialogContent, {
+			role: "alertdialog",
+			"data-slot": "session-expiry-dialog",
+			container,
+			initialFocus: canContinue ? continueRef : void 0,
+			className: "max-w-[420px]",
+			children: [
+				/* @__PURE__ */ jsx(DialogHeader, { children: /* @__PURE__ */ jsxs("div", {
+					className: "flex items-center gap-3",
+					children: [/* @__PURE__ */ jsx("span", {
+						"data-slot": "session-expiry-glyph",
+						className: cn("flex size-9 shrink-0 items-center justify-center", "rounded-[var(--ds-radius-full)] bg-[var(--ds-warning-soft)]", "text-[color:var(--ds-warning)]"),
+						children: /* @__PURE__ */ jsx(CountdownGlyph, {})
+					}), /* @__PURE__ */ jsxs(DialogTitle, {
+						"data-slot": "session-expiry-title",
+						children: [
+							"Your session ends in",
+							" ",
+							/* @__PURE__ */ jsx("span", {
+								"data-slot": "session-expiry-countdown",
+								className: "font-mono tabular-nums",
+								children: formatCountdown(remainingMs)
+							})
+						]
+					})]
+				}) }),
+				/* @__PURE__ */ jsx(DialogBody, { children: /* @__PURE__ */ jsx(DialogDescription, {
+					"data-slot": "session-expiry-message",
+					children: canContinue ? "You have been inactive for a while. Continue to stay signed in — anything you have not saved is kept." : "This session has reached its maximum length and cannot be extended. Save anything you need before it ends."
+				}) }),
+				/* @__PURE__ */ jsxs(DialogFooter, { children: [/* @__PURE__ */ jsx(Button, {
+					variant: "secondary",
+					onClick: onLogout,
+					"data-slot": "session-expiry-logout",
+					children: "Log out"
+				}), canContinue ? /* @__PURE__ */ jsx(Button, {
+					ref: continueRef,
+					onClick: onContinue,
+					"data-slot": "session-expiry-continue",
+					children: "Continue"
+				}) : null] })
+			]
+		})
+	});
+}
+/** A clock face. Inline rather than a lucide import: one icon, one shape. */
+function CountdownGlyph() {
+	return /* @__PURE__ */ jsxs("svg", {
+		viewBox: "0 0 24 24",
+		fill: "none",
+		stroke: "currentColor",
+		strokeWidth: "2",
+		className: "size-5",
+		"aria-hidden": true,
+		focusable: "false",
+		children: [/* @__PURE__ */ jsx("circle", {
+			cx: "12",
+			cy: "12",
+			r: "9"
+		}), /* @__PURE__ */ jsx("path", {
+			d: "M12 7v5l3 2",
+			strokeLinecap: "round",
+			strokeLinejoin: "round"
+		})]
+	});
+}
+/**
+* Mount one per surface: the shell mounts it, and so does the agent pop-up
+* (§17). A user whose extension warns them while the chat pop-up beside it does
+* not has learned nothing about how long a Cortena session lasts.
+*/
+function SessionGuard({ modal, container, ...options }) {
+	const session = useSessionGuard(options);
+	return /* @__PURE__ */ jsx(SessionExpiryDialog, {
+		open: session.state === "warning",
+		remainingMs: session.remainingMs,
+		canContinue: session.canContinue,
+		onContinue: session.continueSession,
+		onLogout: () => session.signOut("user"),
+		modal,
+		container
+	});
+}
+//#endregion
+export { DEFAULT_SESSION_POLICY, REFRESH_LOCK_NAME, SESSION_CHANNEL_NAME, SessionExpiryDialog, SessionGuard, decodeSessionClaims, formatCountdown, useSessionGuard };
+
+//# sourceMappingURL=session-guard.js.map