cursedbelt 2.7.0 → 3.0.0

package/dist/server/guard/revocationStore.d.ts

@@ -1,133 +0,0 @@
-/**
- * Somewhere to record the session/token ids that must no longer be accepted,
- * answered synchronously.
- *
- * Deliberately tiny, and deliberately not a session store: the token still
- * carries its own expiry and signature, so this only ever answers "was this one
- * withdrawn early". `sweep` exists so the table cannot grow forever — every
- * entry becomes meaningless the moment its session would have expired anyway.
- *
- * Epoch **milliseconds** throughout, matching `Date.now()` and the satellites'
- * cookie expiry. (The cross-node {@link AsyncRevocationStore} works in seconds,
- * matching the signer's `exp`; {@link createAsyncBackedRevocationStore} bridges
- * the two.)
- */
-export interface RevocationStore {
-    /** Has this id been revoked? Called on every authenticated request. */
-    isRevoked(id: string): boolean;
-    /** Record a revocation until `expiresAtMs`, after which it is moot. */
-    revoke(id: string, expiresAtMs: number): void;
-    /** Drop entries whose sessions have expired. Called opportunistically. */
-    sweep(nowMs: number): void;
-}
-/**
- * An in-memory sync {@link RevocationStore}.
- *
- * For tests, and for a single-process caller that does not need durability.
- * NOT for a deployed satellite: an in-memory table would be worse than none —
- * sign out, redeploy, and the session works again, which reads as the feature
- * being broken rather than absent. Give a deployed door
- * {@link createSqliteRevocationStore} (durable) or nothing.
- */
-export declare function createMemoryRevocationStore(): RevocationStore & {
-    size(): number;
-};
-/**
- * A durable sync {@link RevocationStore} backed by a sqlite file.
- *
- * Because an in-memory table would be worse than none (see above), and the
- * deploy engine persists each release's data directory, so durability costs one
- * file. The table is self-limiting: an entry is meaningless once the session it
- * names would have expired anyway, and `sweep` drops those on logout — rare,
- * cheap, and exactly when the table has just grown, so there is no background
- * timer to own.
- *
- * Its OWN file, not a table in an app's database: keeping a credential surface
- * out of an app's data file bounds the blast radius of a corrupt or deleted
- * file to "everyone signs in again".
- */
-export declare function createSqliteRevocationStore(dbPath: string): RevocationStore & {
-    close(): void;
-};
-/**
- * Where revoked jtis live so every node sees them (03 §4a). Local profile:
- * unused (a per-process `Map` is enough for one process). SaaS: a Redis hash
- * with per-entry TTL, or a row in the shared Postgres — the contract is
- * identical, which is the point.
- *
- * Only `set`/`get`/`prune` and no bulk `list`, because the consumer's hot path
- * is a SYNCHRONOUS `verify` (see {@link createSessionSigner}) that consults the
- * store read-through by id off the hot path — never a full scan on every verify.
- *
- * Epoch **seconds** throughout, matching a token's own `exp`.
- */
-export interface AsyncRevocationStore {
-    /**
-     * Record `jti` as revoked until `expEpochSeconds`. Idempotent; a re-revoke of
-     * the same jti is a no-op (or extends the exp, which is harmless — a denylist
-     * entry that outlives its token only wastes a little space until `prune`).
-     */
-    set(jti: string, expEpochSeconds: number): Promise<void>;
-    /** The `exp` of a revoked jti (epoch seconds), or `null` when it is not revoked. */
-    get(jti: string): Promise<number | null>;
-    /** Drop every entry whose `exp <= nowEpochSeconds`. Returns the count removed. */
-    prune(nowEpochSeconds: number): Promise<number>;
-}
-/**
- * An in-memory {@link AsyncRevocationStore}.
- *
- * Two uses: a single-process saas test that wants the seam exercised without a
- * real Redis, and — crucially — the **two-signer replay probe**, where one
- * shared instance is handed to signer A and signer B so "revoke on A, verify on
- * B" becomes provable in one process (V7.3). It is NOT a cross-process store:
- * two OS processes do not share this Map, which is the whole reason a real
- * deployment injects Redis/Postgres instead.
- *
- * (Named `…Async…` to stand apart from the sync {@link createMemoryRevocationStore};
- * before DEDUP-7 both shapes shared the bare name across two packages and that
- * collision was the footgun this file exists to remove.)
- */
-export declare function createMemoryAsyncRevocationStore(): AsyncRevocationStore & {
-    size(): number;
-};
-export interface AsyncBackedRevocationStoreOptions {
-    /** Injected clock in **milliseconds** (default `Date.now`), for tests. */
-    now?: () => number;
-    /**
-     * How long a store verdict is trusted before `isRevoked` re-reads it (ms).
-     * This is the cross-node revocation LATENCY BOUND: a revocation written by
-     * another node is seen here within this window (plus the store's own read
-     * latency), because `isRevoked` stays synchronous — it answers from the cache
-     * and refreshes it off the hot path rather than awaiting a round trip. Default
-     * 5000 (03 §4a's ≤5s).
-     */
-    cacheTtlMs?: number;
-    /**
-     * Reports a backing read/write that failed. A failed write-through means a
-     * revocation did not reach other nodes — the local cache still refuses the id
-     * HERE, but the host may want to retry or alarm. Default: swallow, because a
-     * sync store must never throw out of `isRevoked`/`revoke` on the request path.
-     */
-    onError?: (op: 'get' | 'set' | 'prune', error: unknown) => void;
-}
-/**
- * A SYNC {@link RevocationStore} whose durable backing is an async cross-node
- * {@link AsyncRevocationStore} — the bridge that gives a satellite the cross-node
- * seam without its `isAuthenticated` becoming a promise.
- *
- * It is the same read-through-cache trick {@link createSessionSigner} keeps
- * internally, packaged so a plain sync consumer can use it: `revoke` writes
- * through fire-and-forget and caches locally so the id is refused HERE the
- * instant it returns; `isRevoked` answers from the cache and schedules a refresh
- * when the entry is missing or older than `cacheTtlMs`, never blocking. Ids and
- * expiries cross the ms↔seconds boundary here (the sync contract is ms, the
- * async one seconds).
- *
- * {@link flush} settles the fire-and-forget work — for shutdown/handover (a node
- * draining must not lose an unwritten revocation) and for tests that need the
- * cross-node state to have settled.
- */
-export declare function createAsyncBackedRevocationStore(backing: AsyncRevocationStore, options?: AsyncBackedRevocationStoreOptions): RevocationStore & {
-    flush(): Promise<void>;
-};
-//# sourceMappingURL=revocationStore.d.ts.map

package/dist/server/guard/revocationStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"revocationStore.d.ts","sourceRoot":"","sources":["../../../src/server/guard/revocationStore.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,uEAAuE;IACvE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,IAAI,eAAe,GAAG;IAAE,IAAI,IAAI,MAAM,CAAA;CAAE,CAUlF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CA0B/F;AAID;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,oFAAoF;IACpF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,kFAAkF;IAClF,KAAK,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,IAAI,oBAAoB,GAAG;IAAE,IAAI,IAAI,MAAM,CAAA;CAAE,CA0B5F;AAID,MAAM,WAAW,iCAAiC;IAChD,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACjE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,oBAAoB,EAC7B,OAAO,GAAE,iCAAsC,GAC9C,eAAe,GAAG;IAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAsD9C"}

package/dist/server/guard/revocationStore.js

@@ -1,212 +0,0 @@
-/**
- * The one revocation store, in two shapes for two hot paths (DEDUP-7).
- *
- * "Was this session/token withdrawn early?" is a single concern, but it is
- * consulted from two verify paths whose constraints do not meet in the middle,
- * so this file settles ONE contract per constraint and gives the async one a
- * bridge back to the sync one:
- *
- *   • {@link RevocationStore} — SYNCHRONOUS (`isRevoked`/`revoke`/`sweep`, epoch
- *     **milliseconds**). The single-owner satellites' `createOwnerAuth` consults
- *     it inside `isAuthenticated`, which is called on every request and cannot
- *     become a promise without turning every route async. Its durable
- *     implementation is a local sqlite file — the denylist a redeploy must not
- *     forget (`apps/roms`'s deploy smoke caught a logout that did not log out).
- *
- *   • {@link AsyncRevocationStore} — ASYNCHRONOUS (`set`/`get`/`prune`, epoch
- *     **seconds**). The cross-node seam (03 §4a, audit G6): a Redis hash or a
- *     Postgres row that every node in a saas deployment reads, so a `lock()` on
- *     node A closes the token on node B too. `createSessionSigner` consumes THIS
- *     one and keeps its own read-through cache so its `verify` stays sync.
- *
- * Before DEDUP-7 these lived in two packages, BOTH exporting a
- * `createMemoryRevocationStore` of a different shape — a live footgun the moment
- * a file imported from the wrong one. They are one file now; `satellite-kit`
- * re-exports the sync half so its callers are unchanged.
- *
- * The bridge between them is {@link createAsyncBackedRevocationStore}: a SYNC
- * store whose durable backing is an async cross-node store, using the same
- * read-through-cache trick the signer does. It is what lets a satellite opt into
- * the cross-node seam without its `isAuthenticated` becoming a promise.
- */
-import { mkdirSync } from 'node:fs';
-import { dirname } from 'node:path';
-import { Database } from 'bun:sqlite';
-import { assertCcPragmas } from 'cwip/sqlite';
-/**
- * An in-memory sync {@link RevocationStore}.
- *
- * For tests, and for a single-process caller that does not need durability.
- * NOT for a deployed satellite: an in-memory table would be worse than none —
- * sign out, redeploy, and the session works again, which reads as the feature
- * being broken rather than absent. Give a deployed door
- * {@link createSqliteRevocationStore} (durable) or nothing.
- */
-export function createMemoryRevocationStore() {
-    const entries = new Map();
-    return {
-        isRevoked: (id) => entries.has(id),
-        revoke: (id, expiresAtMs) => void entries.set(id, expiresAtMs),
-        sweep: (nowMs) => {
-            for (const [id, expiresAt] of entries)
-                if (expiresAt <= nowMs)
-                    entries.delete(id);
-        },
-        size: () => entries.size,
-    };
-}
-/**
- * A durable sync {@link RevocationStore} backed by a sqlite file.
- *
- * Because an in-memory table would be worse than none (see above), and the
- * deploy engine persists each release's data directory, so durability costs one
- * file. The table is self-limiting: an entry is meaningless once the session it
- * names would have expired anyway, and `sweep` drops those on logout — rare,
- * cheap, and exactly when the table has just grown, so there is no background
- * timer to own.
- *
- * Its OWN file, not a table in an app's database: keeping a credential surface
- * out of an app's data file bounds the blast radius of a corrupt or deleted
- * file to "everyone signs in again".
- */
-export function createSqliteRevocationStore(dbPath) {
-    if (dbPath !== ':memory:' && !dbPath.startsWith('file:')) {
-        mkdirSync(dirname(dbPath), { recursive: true });
-    }
-    const db = new Database(dbPath, { create: true });
-    // Route pragmas through cwip's one controller (applies WAL + busy_timeout +
-    // foreign_keys + wal_autocheckpoint and re-reads to prove each took), rather
-    // than hand-rolling a lone `journal_mode = WAL` the pragma sweep rejects.
-    assertCcPragmas(db);
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS revoked_sessions (
-      id         TEXT PRIMARY KEY,
-      expires_at INTEGER NOT NULL
-    )
-  `);
-    const has = db.query('SELECT id FROM revoked_sessions WHERE id = ?');
-    const insert = db.query('INSERT OR REPLACE INTO revoked_sessions (id, expires_at) VALUES (?, ?)');
-    const prune = db.query('DELETE FROM revoked_sessions WHERE expires_at <= ?');
-    return {
-        isRevoked: (id) => has.get(id) !== null,
-        revoke: (id, expiresAtMs) => void insert.run(id, expiresAtMs),
-        sweep: (nowMs) => void prune.run(nowMs),
-        close: () => db.close(),
-    };
-}
-/**
- * An in-memory {@link AsyncRevocationStore}.
- *
- * Two uses: a single-process saas test that wants the seam exercised without a
- * real Redis, and — crucially — the **two-signer replay probe**, where one
- * shared instance is handed to signer A and signer B so "revoke on A, verify on
- * B" becomes provable in one process (V7.3). It is NOT a cross-process store:
- * two OS processes do not share this Map, which is the whole reason a real
- * deployment injects Redis/Postgres instead.
- *
- * (Named `…Async…` to stand apart from the sync {@link createMemoryRevocationStore};
- * before DEDUP-7 both shapes shared the bare name across two packages and that
- * collision was the footgun this file exists to remove.)
- */
-export function createMemoryAsyncRevocationStore() {
-    const revoked = new Map();
-    return {
-        async set(jti, expEpochSeconds) {
-            const existing = revoked.get(jti);
-            // Keep the later exp: two nodes revoking the same jti with slightly
-            // different clocks must not shorten the window.
-            if (existing === undefined || expEpochSeconds > existing)
-                revoked.set(jti, expEpochSeconds);
-        },
-        async get(jti) {
-            return revoked.get(jti) ?? null;
-        },
-        async prune(nowEpochSeconds) {
-            let removed = 0;
-            for (const [jti, exp] of revoked) {
-                if (exp <= nowEpochSeconds) {
-                    revoked.delete(jti);
-                    removed += 1;
-                }
-            }
-            return removed;
-        },
-        size() {
-            return revoked.size;
-        },
-    };
-}
-/**
- * A SYNC {@link RevocationStore} whose durable backing is an async cross-node
- * {@link AsyncRevocationStore} — the bridge that gives a satellite the cross-node
- * seam without its `isAuthenticated` becoming a promise.
- *
- * It is the same read-through-cache trick {@link createSessionSigner} keeps
- * internally, packaged so a plain sync consumer can use it: `revoke` writes
- * through fire-and-forget and caches locally so the id is refused HERE the
- * instant it returns; `isRevoked` answers from the cache and schedules a refresh
- * when the entry is missing or older than `cacheTtlMs`, never blocking. Ids and
- * expiries cross the ms↔seconds boundary here (the sync contract is ms, the
- * async one seconds).
- *
- * {@link flush} settles the fire-and-forget work — for shutdown/handover (a node
- * draining must not lose an unwritten revocation) and for tests that need the
- * cross-node state to have settled.
- */
-export function createAsyncBackedRevocationStore(backing, options = {}) {
-    const now = options.now ?? (() => Date.now());
-    const cacheTtlMs = options.cacheTtlMs ?? 5000;
-    const onError = options.onError ?? (() => undefined);
-    /** id → the last backing verdict (exp in ms, or null) and when it was read. */
-    const cache = new Map();
-    const pending = new Set();
-    /** Reads in flight per id, so a burst of `isRevoked` coalesces into one read. */
-    const inflightReads = new Map();
-    const track = (work) => {
-        pending.add(work);
-        void work.finally(() => pending.delete(work));
-    };
-    const refresh = (id) => {
-        if (inflightReads.has(id))
-            return;
-        const read = backing
-            .get(id)
-            .then((expSec) => {
-            cache.set(id, { expMs: expSec === null ? null : expSec * 1000, readAtMs: now() });
-        })
-            .catch((error) => onError('get', error))
-            .finally(() => inflightReads.delete(id));
-        inflightReads.set(id, read);
-        track(read);
-    };
-    return {
-        isRevoked(id) {
-            const cached = cache.get(id);
-            if (cached === undefined || now() - cached.readAtMs >= cacheTtlMs)
-                refresh(id);
-            // A fresh cached exp still in the future ⇒ revoked. An expired cached exp
-            // is treated as not-revoked: the token's own expiry already refuses it, so
-            // the denylist has nothing left to add.
-            return cached?.expMs != null && cached.expMs > now();
-        },
-        revoke(id, expiresAtMs) {
-            // Cache locally FIRST so this node refuses the id the instant this returns,
-            // regardless of whether the write-through has propagated yet.
-            cache.set(id, { expMs: expiresAtMs, readAtMs: now() });
-            track(backing.set(id, Math.ceil(expiresAtMs / 1000)).catch((error) => onError('set', error)));
-        },
-        sweep(nowMs) {
-            for (const [id, cached] of cache)
-                if (cached.expMs !== null && cached.expMs <= nowMs)
-                    cache.delete(id);
-            track(backing.prune(Math.floor(nowMs / 1000)).catch((error) => onError('prune', error)));
-        },
-        async flush() {
-            // Settle in-flight work, then whatever it scheduled (a read can resolve
-            // after we snapshot), so the caller sees a fully-quiesced state.
-            while (pending.size > 0)
-                await Promise.allSettled([...pending]);
-        },
-    };
-}
-//# sourceMappingURL=revocationStore.js.map

package/dist/server/guard/revocationStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"revocationStore.js","sourceRoot":"","sources":["../../../src/server/guard/revocationStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA2B9C;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO;QACL,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC;QAC9D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,OAAO;gBAAE,IAAI,SAAS,IAAI,KAAK;oBAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,eAAe,CAAC,EAAE,CAAC,CAAC;IACpB,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAA2B,8CAA8C,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CACrB,wEAAwE,CACzE,CAAC;IACF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAoB,oDAAoD,CAAC,CAAC;IAChG,OAAO;QACL,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI;QACvC,MAAM,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC;QAC7D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QACvC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;KACxB,CAAC;AACJ,CAAC;AA6BD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gCAAgC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,oEAAoE;YACpE,gDAAgD;YAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,GAAG,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,eAAe;YACzB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBACjC,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;oBAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACpB,OAAO,IAAI,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA6B,EAC7B,UAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAErD,+EAA+E;IAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsD,CAAC;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,iFAAiF;IACjF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEvD,MAAM,KAAK,GAAG,CAAC,IAAsB,EAAQ,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,EAAU,EAAQ,EAAE;QACnC,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAClC,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,EAAE,CAAC;aACP,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACvC,OAAO,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3C,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,EAAE;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,IAAI,UAAU;gBAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC/E,0EAA0E;YAC1E,2EAA2E;YAC3E,wCAAwC;YACxC,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,EAAE,EAAE,WAAW;YACpB,4EAA4E;YAC5E,8DAA8D;YAC9D,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACvD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK;oBAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,KAAK,CAAC,KAAK;YACT,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/guard/sessionSigner.d.ts

@@ -1,133 +0,0 @@
-/**
- * The production session signer (02 §4.2) — Ed25519-signed `CCUserClaims` plus
- * the jti denylist that makes `lock()` mean something.
- *
- * The verify harness ships an HMAC stand-in because a probe suite tests the
- * DECISION table (signature validity, expiry, revocation), not the algorithm.
- * This is the real one, and the differences are the parts a stand-in cannot
- * model:
- *
- *   * **Asymmetric.** Only the server that holds the private key can mint a
- *     session. A verifier can be handed the public key alone, so a read-only
- *     replica or an edge worker can verify without being able to forge.
- *   * **Revocation is bounded, not unbounded.** A denylist that only ever grows
- *     is a memory leak wearing a security hat. An entry is dropped once its
- *     token would have expired anyway, because after `exp` the signature check
- *     already refuses it.
- *   * **Expiry before revocation.** An expired token is expired whether or not
- *     anyone bothered to revoke it — checking in the other order makes the
- *     denylist load-bearing for a case it does not need to cover.
- */
-import { type KeyObject } from 'node:crypto';
-import { type CCUserClaims } from '../../core/session/claims';
-import type { GuardVerifier } from '../mixins/types';
-import type { AsyncRevocationStore } from './revocationStore';
-export interface SessionSignerOptions {
-    /**
-     * Ed25519 private key (PEM/DER/`KeyObject`). Omitted ⇒ an ephemeral pair is
-     * generated, which is correct ONLY for a single-process dev server: every
-     * restart invalidates every session, and a second process cannot verify.
-     */
-    privateKey?: KeyObject | string | Buffer;
-    /** Public half, when the verifier is separate from the minter. */
-    publicKey?: KeyObject | string | Buffer;
-    /** Default session lifetime. `guard.features.sessionTtlMinutes` feeds this. */
-    ttlSeconds?: number;
-    /** Clock injection for deterministic tests. */
-    now?: () => number;
-    /** Id generator for `jti`. */
-    mintJti?: () => string;
-    /**
-     * The cross-node denylist (03 §4a). Absent ⇒ the in-process `Map` is the whole
-     * story, which is correct for the local profile. Present (saas) ⇒ a `revoke`
-     * ALSO writes through to the shared store, and `verify` consults it for jtis
-     * revoked on OTHER nodes — so `lock()` on node A closes the token everywhere,
-     * not just where the request landed.
-     */
-    revocationStore?: AsyncRevocationStore;
-    /**
-     * How long a store verdict is trusted before `verify` re-reads it (ms). This is
-     * the cross-node revocation LATENCY BOUND: a jti revoked on another node is
-     * seen here within this window (plus the store's own read latency), because
-     * `verify` stays synchronous — it answers from the cache and refreshes it off
-     * the hot path rather than awaiting a network round trip on every route.
-     * Default 5000 (03 §4a's ≤5s). Ignored when no `revocationStore` is set.
-     */
-    revocationCacheTtlMs?: number;
-    /**
-     * Reports a store read/write that failed. A failed write-through means a
-     * revocation did not reach other nodes — the local Map still refuses the token
-     * HERE, but the host needs to know propagation failed (and may retry). Default:
-     * swallow, because a signer must never throw out of `verify`/`revoke` on the
-     * request path.
-     */
-    onRevocationStoreError?: (op: 'get' | 'set' | 'prune', error: unknown) => void;
-}
-/**
- * One live session this signer minted (02 §4) — the `(userId, tenantId,
- * deviceLabel)` association the spec asks for, keyed by `jti`.
- *
- * The device label is deliberately NOT a claim: `CCUserClaimsSchema` is
- * `.strict()`, and widening the SIGNED payload with a human-readable string a
- * client supplies would put attacker-controlled text inside the token every
- * verifier parses. It is display metadata for "your devices", so it lives here,
- * server-side, beside the jti it describes.
- */
-export interface SessionRecord {
-    jti: string;
-    userId: string;
-    tenantId: string;
-    /** What the client called itself (`x-cc-device`), if anything. */
-    deviceLabel?: string;
-    /** Epoch SECONDS, matching `exp`'s unit. */
-    issuedAt: number;
-    exp: number;
-}
-/** Non-claim session metadata recorded at mint time (02 §4). */
-export interface SessionMintMeta {
-    /** Free-text device name for the sessions panel. Never signed, never trusted. */
-    deviceLabel?: string;
-}
-export interface SessionSigner extends GuardVerifier {
-    /** Mint a signed session token. `exp`/`jti` are stamped here, never by a caller. */
-    mint(claims: Omit<CCUserClaims, 'exp' | 'jti'> & Partial<Pick<CCUserClaims, 'exp' | 'jti'>>, meta?: SessionMintMeta): {
-        token: string;
-        claims: CCUserClaims;
-    };
-    /**
-     * Revoke every live session this signer minted for `userId`, returning the
-     * jtis it closed. The primitive behind a role/permission change taking effect
-     * NOW (02 §3 — authorization is decided from the token's claims, so a grant
-     * change that leaves the old token alive is a grant change that did not
-     * happen) and behind "log out everywhere" (02 §4).
-     *
-     * Node-local by construction: it can only enumerate what THIS process minted.
-     * Each revocation still writes through to the shared `revocationStore`, so the
-     * jtis it does know about die fleet-wide; a session minted on another node is
-     * closed when that node calls this (or by its own next login).
-     */
-    revokeUser(userId: string): readonly string[];
-    /**
-     * The live sessions this signer minted for `userId`, newest first — the
-     * "your devices" list (02 §4). Node-local for the same reason `revokeUser` is:
-     * a process can only enumerate what it minted. Expired and revoked entries are
-     * dropped, so what it returns is what a request would still be accepted on.
-     */
-    sessionsOf(userId: string): readonly SessionRecord[];
-    /** Revoked-but-not-yet-expired jtis. Exposed for the shutdown/handover path. */
-    activeRevocations(): readonly string[];
-    /** The public half, for a verifier in another process. */
-    publicKeyPem(): string;
-    /**
-     * Settle every pending revocation-store read and write, then prune the store.
-     *
-     * The store writes on `revoke` and the read-through refreshes on `verify` are
-     * fire-and-forget so neither blocks the request path. This awaits them — for
-     * the shutdown/handover path (a node draining must not lose an unwritten
-     * revocation), for the two-signer replay probe, and for any test that needs the
-     * cross-node state to have settled. A no-op when no `revocationStore` is wired.
-     */
-    flushRevocations(): Promise<void>;
-}
-export declare const createSessionSigner: (options?: SessionSignerOptions) => SessionSigner;
-//# sourceMappingURL=sessionSigner.d.ts.map

package/dist/server/guard/sessionSigner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionSigner.d.ts","sourceRoot":"","sources":["../../../src/server/guard/sessionSigner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAA0D,KAAK,SAAS,EAAgB,MAAM,aAAa,CAAC;AACnH,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,2BAA2B,CAAC;AAElF,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,kEAAkE;IAClE,SAAS,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CAChF;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,oFAAoF;IACpF,IAAI,CACF,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,EACtF,IAAI,CAAC,EAAE,eAAe,GACrB;QACD,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,YAAY,CAAC;KACtB,CAAC;IACF;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC9C;;;;;OAKG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,aAAa,EAAE,CAAC;IACrD,gFAAgF;IAChF,iBAAiB,IAAI,SAAS,MAAM,EAAE,CAAC;IACvC,0DAA0D;IAC1D,YAAY,IAAI,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAaD,eAAO,MAAM,mBAAmB,GAAI,UAAS,oBAAyB,KAAG,aAiRxE,CAAC"}