[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12},"actionData","errors","root",{"_228":-5,"_231":232,"_233":234},"routes/shell",{"_40":41,"_227":-5,"_228":-5,"_229":230},"routes/repo",{"_33":-7,"_34":35,"_36":37,"_38":39,"_40":41,"_42":31,"_43":31,"_44":31,"_45":31,"_46":31,"_47":31,"_48":49,"_50":49,"_51":31,"_52":-7,"_53":-7,"_54":55,"_56":57,"_58":59,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68},"routes/repo.blob",{"_13":14,"_15":16,"_17":18,"_19":20,"_21":14,"_22":23,"_24":-5,"_25":26,"_27":28,"_28":29,"_30":31,"_32":14},"ref","7c690cbcfdf23f1e1925f493bd4e10949afcb76d","path","apps/server/src/auth/session.ts","oid","85d9098ae954de99255e8742b2db54e6d1624cf9","size",26093,"commit","mounts",[],"source","plain",{"_13":14,"_15":16},"kind","text","import { createHash, hkdfSync, timingSafeEqual } from \"node:crypto\";\n\nimport { GitHubError, GitHubTokenError } from \"../github/client\";\n\nimport type { GitHubTokenGrant } from \"../github/client\";\nimport type { StorageAdapter } from \"../storage/port\";\nimport type { SessionCredentials, UserRecord, WebSession } from \"../storage/model\";\n\nconst SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1_000;\nconst ATTEMPT_TTL_MS = 10 * 60 * 1_000;\nconst REFRESH_EARLY_MS = 5 * 60 * 1_000;\nconst CIPHER_VERSION = 1;\nconst NONCE_BYTES = 12;\nconst SECRET_BYTES = 32;\nconst SESSION_CONTEXT = \"chopin:hosted-session:v1\";\n\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\ntype Clock = () => Date;\n\nexport type SessionAccess = {\n\ttoken: string;\n\texpiresAt: Date;\n\trevision: number;\n};\n\nexport type AuthenticatedSession = {\n\tsession: WebSession;\n\tuser: UserRecord;\n\taccess: SessionAccess;\n};\n\nexport type IssuedSession = {\n\tid: string;\n\tcookie: string;\n\texpiresAt: Date;\n};\n\nexport type OAuthAttempt = {\n\tstate: string;\n\tverifier: string;\n\tchallenge: string;\n\tcookie: string;\n\texpiresAt: Date;\n};\n\ntype StoredAttempt = {\n\tv: 1;\n\tstate: string;\n\tverifier: string;\n\texpiresAt: string;\n\treturnPath?: string;\n};\n\ntype MemorySession = {\n\tsession: WebSession;\n\tuser: UserRecord;\n\tsecretHash: Uint8Array;\n\taccessToken: string;\n\taccessExpiresAt: Date;\n\trefreshToken: string;\n\trefreshExpiresAt: Date;\n\trevision: number;\n};\n\ntype SessionOptions = {\n\tpersistence?: { key: Uint8Array; origin: string; clientId: string };\n\trefresh?: (refreshToken: string) => Promise;\n\tauthorize?: (user: UserRecord, accessToken: string) => Promise;\n\tbeforeRefresh?: (sessionId: string, revision: number) => Promise;\n\tonRevoked?: (sessionId: string) => Promise;\n\tinvalidate?: (accessToken: string) => void;\n\tpersist?: (sessionId: string, grant: GitHubTokenGrant, revision: number) => Promise;\n\tcookieSuffix?: string;\n};\n\ntype Rejection = \"revoked\" | \"changed\" | \"missing\";\n\nfunction random(bytes: number): Uint8Array {\n\tlet value = new Uint8Array(bytes);\n\tcrypto.getRandomValues(value);\n\treturn value;\n}\n\nfunction base64(value: Uint8Array): string {\n\treturn Buffer.from(value).toString(\"base64url\");\n}\n\nfunction decoded(value: string): Uint8Array | undefined {\n\tif (!value || !/^[A-Za-z0-9_-]+$/.test(value)) return undefined;\n\ttry {\n\t\tlet bytes = new Uint8Array(Buffer.from(value, \"base64url\"));\n\t\treturn bytes.length > 0 && base64(bytes) === value ? bytes : undefined;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction hash(value: Uint8Array): Uint8Array {\n\treturn new Uint8Array(createHash(\"sha256\").update(value).digest());\n}\n\nfunction buffer(value: Uint8Array): ArrayBuffer {\n\treturn value.slice().buffer as ArrayBuffer;\n}\n\nfunction equal(left: Uint8Array, right: Uint8Array): boolean {\n\treturn left.length === right.length && timingSafeEqual(left, right);\n}\n\nfunction values(request: Request, name: string): string[] {\n\tlet header = request.headers.get(\"cookie\");\n\tif (!header) return [];\n\tlet found: string[] = [];\n\tfor (let part of header.split(\";\")) {\n\t\tlet separator = part.indexOf(\"=\");\n\t\tif (separator < 0 || part.slice(0, separator).trim() !== name) continue;\n\t\tfound.push(part.slice(separator + 1).trim());\n\t}\n\treturn found;\n}\n\nfunction serialized(\n\tname: string,\n\tvalue: string,\n\texpiresAt: Date,\n\tsecure: boolean,\n\tpath = \"/\",\n\tmaxAge = Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1_000)),\n): string {\n\tlet attributes = [\n\t\t`${name}=${value}`,\n\t\t`Path=${path}`,\n\t\t\"HttpOnly\",\n\t\t\"SameSite=Lax\",\n\t\t`Max-Age=${maxAge}`,\n\t\t`Expires=${expiresAt.toUTCString()}`,\n\t];\n\tif (secure) attributes.push(\"Secure\");\n\treturn attributes.join(\"; \");\n}\n\nfunction cleared(name: string, secure: boolean, path = \"/\"): string {\n\treturn serialized(name, \"\", new Date(0), secure, path, 0);\n}\n\nasync function imported(value: Uint8Array): Promise {\n\treturn crypto.subtle.importKey(\"raw\", buffer(value), \"AES-GCM\", false, [\"encrypt\", \"decrypt\"]);\n}\n\nasync function encrypted(key: CryptoKey, aad: string, plaintext: unknown): Promise {\n\tlet nonce = random(NONCE_BYTES);\n\tlet content = encoder.encode(JSON.stringify(plaintext));\n\tlet ciphertext = await crypto.subtle.encrypt(\n\t\t{ name: \"AES-GCM\", iv: buffer(nonce), additionalData: buffer(encoder.encode(aad)) },\n\t\tkey,\n\t\tbuffer(content),\n\t);\n\tlet envelope = new Uint8Array(1 + NONCE_BYTES + ciphertext.byteLength);\n\tenvelope[0] = CIPHER_VERSION;\n\tenvelope.set(nonce, 1);\n\tenvelope.set(new Uint8Array(ciphertext), 1 + NONCE_BYTES);\n\treturn envelope;\n}\n\nasync function decrypted(key: CryptoKey, aad: string, envelope: Uint8Array): Promise {\n\tif (envelope.length <= 1 + NONCE_BYTES || envelope[0] !== CIPHER_VERSION) {\n\t\tthrow new Error(\"bad envelope\");\n\t}\n\tlet nonce = envelope.slice(1, 1 + NONCE_BYTES);\n\tlet ciphertext = envelope.slice(1 + NONCE_BYTES);\n\tlet plaintext = await crypto.subtle.decrypt(\n\t\t{ name: \"AES-GCM\", iv: buffer(nonce), additionalData: buffer(encoder.encode(aad)) },\n\t\tkey,\n\t\tbuffer(ciphertext),\n\t);\n\treturn JSON.parse(decoder.decode(plaintext));\n}\n\nfunction attempt(value: unknown): StoredAttempt | undefined {\n\tif (!value || typeof value !== \"object\") return undefined;\n\tlet record = value as Record;\n\tif (\n\t\trecord.v !== 1\n\t\t|| typeof record.state !== \"string\"\n\t\t|| typeof record.verifier !== \"string\"\n\t\t|| typeof record.expiresAt !== \"string\"\n\t\t|| (record.returnPath !== undefined && typeof record.returnPath !== \"string\")\n\t) return undefined;\n\tlet stored: StoredAttempt = {\n\t\tv: 1,\n\t\tstate: record.state,\n\t\tverifier: record.verifier,\n\t\texpiresAt: record.expiresAt,\n\t};\n\tif (typeof record.returnPath === \"string\") stored.returnPath = record.returnPath;\n\treturn stored;\n}\n\n/** Browser sessions with optional encrypted persistence and process-local Planner access. */\nexport class Sessions {\n\treadonly #storage: StorageAdapter;\n\treadonly #secure: boolean;\n\treadonly #clock: Clock;\n\treadonly #options: SessionOptions;\n\treadonly #key: Promise | undefined;\n\treadonly #sessions = new Map();\n\treadonly #restores = new Map>();\n\treadonly #refreshes = new Map>();\n\treadonly #revocations = new Map>();\n\treadonly #pendingDeletes = new Set();\n\treadonly cookieName: string;\n\n\tconstructor(\n\t\tstorage: StorageAdapter,\n\t\tsecure: boolean,\n\t\tclock: Clock = () => new Date(),\n\t\toptions: SessionOptions = {},\n\t) {\n\t\tthis.#storage = storage;\n\t\tthis.#secure = secure;\n\t\tthis.#clock = clock;\n\t\tthis.#options = options;\n\t\tthis.#key = options.persistence\n\t\t\t? imported(\n\t\t\t\tnew Uint8Array(hkdfSync(\"sha256\", options.persistence.key, \"\", SESSION_CONTEXT, 32)),\n\t\t\t)\n\t\t\t: undefined;\n\t\tthis.cookieName = `${secure ? \"__Host-chopin_session\" : \"chopin_session\"}${\n\t\t\toptions.cookieSuffix ?? \"\"\n\t\t}`;\n\t}\n\n\tasync issue(userId: string, grant: GitHubTokenGrant): Promise {\n\t\tlet id = crypto.randomUUID();\n\t\tlet secret = random(SECRET_BYTES);\n\t\tlet createdAt = this.#clock();\n\t\tlet expiresAt = new Date(createdAt.getTime() + SESSION_TTL_MS);\n\t\tlet user = await this.#storage.users.get(userId);\n\t\tif (!user) throw new Error(\"cannot create a session for a missing user\");\n\t\tlet session = { id, userId, expiresAt, createdAt };\n\t\tlet current = this.#fromGrant(session, user, hash(secret), grant, 1, createdAt);\n\t\tlet credentials = this.#key ? await this.#encrypt(current) : undefined;\n\t\tawait this.#storage.sessions.create({ ...session, ...(credentials ? { credentials } : {}) });\n\t\tthis.#sessions.set(id, current);\n\t\treturn {\n\t\t\tid,\n\t\t\tcookie: serialized(\n\t\t\t\tthis.cookieName,\n\t\t\t\t`${id}.${base64(secret)}`,\n\t\t\t\texpiresAt,\n\t\t\t\tthis.#secure,\n\t\t\t\t\"/\",\n\t\t\t\tSESSION_TTL_MS / 1_000,\n\t\t\t),\n\t\t\texpiresAt,\n\t\t};\n\t}\n\n\tasync authenticate(request: Request): Promise {\n\t\tlet parsed = this.#parse(request);\n\t\tif (!parsed) return undefined;\n\t\tlet current = await this.#find(parsed);\n\t\tif (\n\t\t\t!current\n\t\t\t|| current.session.expiresAt <= this.#clock()\n\t\t\t|| !equal(hash(parsed.secret), current.secretHash)\n\t\t) return undefined;\n\t\treturn this.#resolve(current);\n\t}\n\n\t#aad(session: WebSession, secretHash: Uint8Array, revision: number): string {\n\t\tlet scope = this.#options.persistence!;\n\t\treturn JSON.stringify([\n\t\t\tSESSION_CONTEXT,\n\t\t\tscope.origin,\n\t\t\tscope.clientId,\n\t\t\tsession.id,\n\t\t\tsession.userId,\n\t\t\tsession.createdAt.toISOString(),\n\t\t\tsession.expiresAt.toISOString(),\n\t\t\tbase64(secretHash),\n\t\t\trevision,\n\t\t]);\n\t}\n\n\tasync #encrypt(current: MemorySession): Promise {\n\t\treturn {\n\t\t\tsecretHash: current.secretHash,\n\t\t\trevision: current.revision,\n\t\t\tciphertext: await encrypted(\n\t\t\t\tawait this.#key!,\n\t\t\t\tthis.#aad(current.session, current.secretHash, current.revision),\n\t\t\t\t{\n\t\t\t\t\taccessToken: current.accessToken,\n\t\t\t\t\taccessExpiresAt: current.accessExpiresAt.getTime(),\n\t\t\t\t\trefreshToken: current.refreshToken,\n\t\t\t\t\trefreshExpiresAt: current.refreshExpiresAt.getTime(),\n\t\t\t\t},\n\t\t\t),\n\t\t};\n\t}\n\n\tasync #find(parsed: { id: string; secret: Uint8Array }): Promise {\n\t\tif (this.#pendingDeletes.has(parsed.id) || this.#revocations.has(parsed.id)) return undefined;\n\t\tlet current = this.#sessions.get(parsed.id);\n\t\tif (current || !this.#key) return current;\n\t\tlet proof = hash(parsed.secret);\n\t\tlet key = `${parsed.id}.${base64(proof)}`;\n\t\tlet restoring = this.#restores.get(key);\n\t\tif (restoring) return restoring;\n\t\tlet task = this.#restore(parsed.id, proof);\n\t\tthis.#restores.set(key, task);\n\t\ttry {\n\t\t\treturn await task;\n\t\t} finally {\n\t\t\tif (this.#restores.get(key) === task) this.#restores.delete(key);\n\t\t}\n\t}\n\n\tasync #restore(id: string, proof: Uint8Array): Promise {\n\t\tlet stored = await this.#storage.sessions.get(id, this.#clock());\n\t\tif (!stored?.credentials || !equal(proof, stored.credentials.secretHash)) return undefined;\n\t\tlet { credentials, ...session } = stored;\n\t\tlet payload: unknown;\n\t\ttry {\n\t\t\tpayload = await decrypted(\n\t\t\t\tawait this.#key!,\n\t\t\t\tthis.#aad(session, proof, credentials.revision),\n\t\t\t\tcredentials.ciphertext,\n\t\t\t);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (!payload || typeof payload !== \"object\") return undefined;\n\t\tlet value = payload as Record;\n\t\tif (\n\t\t\ttypeof value.accessToken !== \"string\" || !value.accessToken\n\t\t\t|| typeof value.refreshToken !== \"string\" || !value.refreshToken\n\t\t\t|| typeof value.accessExpiresAt !== \"number\" || !Number.isSafeInteger(value.accessExpiresAt)\n\t\t\t|| typeof value.refreshExpiresAt !== \"number\" || !Number.isSafeInteger(value.refreshExpiresAt)\n\t\t\t|| !Number.isFinite(new Date(value.accessExpiresAt).getTime())\n\t\t\t|| !Number.isFinite(new Date(value.refreshExpiresAt).getTime())\n\t\t) return undefined;\n\t\tlet user = await this.#storage.users.get(session.userId);\n\t\tif (!user || this.#pendingDeletes.has(id) || this.#revocations.has(id)) return undefined;\n\t\tlet current: MemorySession = {\n\t\t\tsession,\n\t\t\tuser,\n\t\t\tsecretHash: proof,\n\t\t\taccessToken: value.accessToken,\n\t\t\taccessExpiresAt: new Date(value.accessExpiresAt),\n\t\t\trefreshToken: value.refreshToken,\n\t\t\trefreshExpiresAt: new Date(value.refreshExpiresAt),\n\t\t\trevision: credentials.revision,\n\t\t};\n\t\tthis.#sessions.set(id, current);\n\t\treturn current;\n\t}\n\n\t/** Resolve an already-authorized internal owner from this process. */\n\tasync resolve(id: string): Promise {\n\t\tlet current = this.#sessions.get(id);\n\t\treturn current && current.session.expiresAt > this.#clock()\n\t\t\t? this.#resolve(current)\n\t\t\t: undefined;\n\t}\n\n\t/** An MCP handoff may borrow an existing login to claim ownership, never the caller's bearer. */\n\tasync forUser(userId: string): Promise {\n\t\tfor (let current of [...this.#sessions.values()].toReversed()) {\n\t\t\tif (current.session.userId !== userId) continue;\n\t\t\tlet resolved = await this.resolve(current.session.id);\n\t\t\tif (resolved) return resolved;\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t/** Read current credentials without triggering rotation from inside an active agent callback. */\n\tasync inspect(id: string): Promise {\n\t\tif (this.#refreshes.has(id) || this.#revocations.has(id)) return undefined;\n\t\tlet current = this.#sessions.get(id);\n\t\tif (\n\t\t\t!current\n\t\t\t|| current.session.expiresAt <= this.#clock()\n\t\t\t|| current.accessExpiresAt <= this.#clock()\n\t\t) return undefined;\n\t\treturn this.#authenticated(current);\n\t}\n\n\t/** Resolve a copied agent credential without yielding before its request starts. */\n\ttoken(id: string, revision: number): string | undefined {\n\t\tif (this.#refreshes.has(id) || this.#revocations.has(id)) return undefined;\n\t\tlet current = this.#sessions.get(id);\n\t\treturn current\n\t\t\t\t&& current.revision === revision\n\t\t\t\t&& current.session.expiresAt > this.#clock()\n\t\t\t\t&& current.accessExpiresAt > this.#clock()\n\t\t\t? current.accessToken\n\t\t\t: undefined;\n\t}\n\n\t/** Run one idempotent GitHub read, refreshing and retrying once after a 401. */\n\tasync use(\n\t\tauthenticated: AuthenticatedSession,\n\t\toperation: (token: string) => Promise,\n\t): Promise<{ value: T; authenticated: AuthenticatedSession }> {\n\t\tlet current = this.#current(authenticated);\n\t\tif (!current) throw new GitHubError(\"GitHub authorization expired\", 401);\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tvalue: await operation(current.accessToken),\n\t\t\t\tauthenticated: this.#authenticated(current),\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (!(err instanceof GitHubError) || err.status !== 401) throw err;\n\t\t}\n\t\tlet refreshed = await this.#rotate(current.session.id, current.revision);\n\t\tif (!refreshed || this.#sessions.get(current.session.id) !== refreshed) {\n\t\t\tthrow new GitHubError(\"GitHub authorization expired\", 401);\n\t\t}\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tvalue: await operation(refreshed.accessToken),\n\t\t\t\tauthenticated: this.#authenticated(refreshed),\n\t\t\t};\n\t\t} catch (err) {\n\t\t\tif (!(err instanceof GitHubError) || err.status !== 401) throw err;\n\t\t\tlet rejected = await this.#reject(refreshed.session.id, refreshed.revision);\n\t\t\tif (rejected === \"changed\") {\n\t\t\t\tthrow new GitHubError(\"GitHub credentials changed; retry the request\", 503);\n\t\t\t}\n\t\t\tthrow new GitHubError(\"GitHub authorization expired\", 401);\n\t\t}\n\t}\n\n\tasync #resolve(current: MemorySession): Promise {\n\t\tlet fresh = await this.#fresh(current);\n\t\tif (!fresh) return undefined;\n\t\tlet authorize = this.#options.authorize;\n\t\tif (authorize) {\n\t\t\tlet allowed: boolean;\n\t\t\ttry {\n\t\t\t\tallowed = await authorize(fresh.user, fresh.accessToken);\n\t\t\t} catch (err) {\n\t\t\t\tif (!(err instanceof GitHubError) || err.status !== 401) throw err;\n\t\t\t\tlet refreshed = await this.#rotate(fresh.session.id, fresh.revision);\n\t\t\t\tif (!refreshed || this.#sessions.get(fresh.session.id) !== refreshed) return undefined;\n\t\t\t\tfresh = refreshed;\n\t\t\t\ttry {\n\t\t\t\t\tallowed = await authorize(fresh.user, fresh.accessToken);\n\t\t\t\t} catch (retryError) {\n\t\t\t\t\tif (!(retryError instanceof GitHubError) || retryError.status !== 401) {\n\t\t\t\t\t\tthrow retryError;\n\t\t\t\t\t}\n\t\t\t\t\tlet rejected = await this.#reject(fresh.session.id, fresh.revision);\n\t\t\t\t\tif (rejected === \"changed\") {\n\t\t\t\t\t\tlet active = this.#sessions.get(fresh.session.id);\n\t\t\t\t\t\treturn active ? this.#resolve(active) : undefined;\n\t\t\t\t\t}\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t\tlet active = this.#sessions.get(fresh.session.id);\n\t\t\tif (active !== fresh) return active ? this.#resolve(active) : undefined;\n\t\t\tif (!allowed) {\n\t\t\t\tawait this.#revokeExact(fresh);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\t\treturn this.#sessions.get(fresh.session.id) === fresh\n\t\t\t? this.#authenticated(fresh)\n\t\t\t: undefined;\n\t}\n\n\tasync #fresh(current: MemorySession): Promise {\n\t\tif (current.session.expiresAt <= this.#clock()) {\n\t\t\tawait this.#revokeExact(current);\n\t\t\treturn undefined;\n\t\t}\n\t\tif (current.accessExpiresAt.getTime() > this.#clock().getTime() + REFRESH_EARLY_MS) {\n\t\t\treturn current;\n\t\t}\n\t\treturn this.#rotate(current.session.id, undefined);\n\t}\n\n\tasync #rotate(\n\t\tid: string,\n\t\trejectedRevision: number | undefined,\n\t): Promise {\n\t\tlet active = this.#refreshes.get(id);\n\t\tif (active) {\n\t\t\tlet result = await active;\n\t\t\tif (\n\t\t\t\trejectedRevision === undefined\n\t\t\t\t|| !result\n\t\t\t\t|| result.revision !== rejectedRevision\n\t\t\t) return result;\n\t\t\tif (this.#refreshes.get(id) === active) this.#refreshes.delete(id);\n\t\t\treturn this.#rotate(id, rejectedRevision);\n\t\t}\n\t\tlet refresh = this.#rotateOnce(id, rejectedRevision);\n\t\tthis.#refreshes.set(id, refresh);\n\t\tvoid refresh.finally(() => {\n\t\t\tif (this.#refreshes.get(id) === refresh) this.#refreshes.delete(id);\n\t\t}).catch(() => {});\n\t\treturn refresh;\n\t}\n\n\tasync #rotateOnce(\n\t\tid: string,\n\t\trejectedRevision: number | undefined,\n\t): Promise {\n\t\tlet now = this.#clock();\n\t\tlet current = this.#sessions.get(id);\n\t\tif (!current) return undefined;\n\t\tif (current.session.expiresAt <= now) {\n\t\t\tawait this.#revokeExact(current);\n\t\t\treturn undefined;\n\t\t}\n\t\tif (rejectedRevision !== undefined && current.revision !== rejectedRevision) {\n\t\t\treturn current;\n\t\t}\n\t\tif (\n\t\t\trejectedRevision === undefined\n\t\t\t&& current.accessExpiresAt.getTime() > now.getTime() + REFRESH_EARLY_MS\n\t\t) return current;\n\t\tif (current.refreshExpiresAt <= now) {\n\t\t\tawait this.#revokeExact(current);\n\t\t\treturn this.#sessions.get(id);\n\t\t}\n\t\tlet refresh = this.#options.refresh;\n\t\tif (!refresh) {\n\t\t\tif (current.accessExpiresAt > now && rejectedRevision === undefined) return current;\n\t\t\tthrow new GitHubTokenError(\"GitHub token refresh is not configured\");\n\t\t}\n\t\ttry {\n\t\t\tawait this.#options.beforeRefresh?.(id, current.revision);\n\t\t\tif (this.#sessions.get(id) !== current) return this.#sessions.get(id);\n\t\t\tlet grant = await refresh(current.refreshToken);\n\t\t\tif (this.#sessions.get(id) !== current) return this.#sessions.get(id);\n\t\t\tlet refreshedAt = this.#clock();\n\t\t\tif (current.session.expiresAt <= refreshedAt) {\n\t\t\t\tawait this.#revokeExact(current);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tlet replacement = this.#fromGrant(\n\t\t\t\tcurrent.session,\n\t\t\t\tcurrent.user,\n\t\t\t\tcurrent.secretHash,\n\t\t\t\tgrant,\n\t\t\t\tcurrent.revision + 1,\n\t\t\t\trefreshedAt,\n\t\t\t);\n\t\t\tif (this.#key) {\n\t\t\t\ttry {\n\t\t\t\t\tlet saved = await this.#storage.sessions.rotate(\n\t\t\t\t\t\tid,\n\t\t\t\t\t\tcurrent.revision,\n\t\t\t\t\t\tawait this.#encrypt(replacement),\n\t\t\t\t\t);\n\t\t\t\t\tif (!saved) {\n\t\t\t\t\t\tif (this.#sessions.get(id) === current) this.#sessions.delete(id);\n\t\t\t\t\t\tthis.#options.invalidate?.(current.accessToken);\n\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t}\n\t\t\t\t} catch {\n\t\t\t\t\tawait this.#revokeExact(current);\n\t\t\t\t\tthrow new GitHubTokenError(\"Could not persist refreshed credentials\", 503, true);\n\t\t\t\t}\n\t\t\t\tif (this.#sessions.get(id) !== current) return this.#sessions.get(id);\n\t\t\t}\n\t\t\tif (this.#options.persist) {\n\t\t\t\ttry {\n\t\t\t\t\tawait this.#options.persist(id, grant, replacement.revision);\n\t\t\t\t} catch {\n\t\t\t\t\tawait this.#revokeExact(current);\n\t\t\t\t\tthrow new GitHubTokenError(\"Could not persist refreshed credentials\", 503, true);\n\t\t\t\t}\n\t\t\t\tif (this.#sessions.get(id) !== current) return this.#sessions.get(id);\n\t\t\t}\n\t\t\tthis.#sessions.set(id, replacement);\n\t\t\tthis.#options.invalidate?.(current.accessToken);\n\t\t\treturn replacement;\n\t\t} catch (err) {\n\t\t\tif (err instanceof GitHubTokenError && err.terminal) {\n\t\t\t\tawait this.#revokeExact(current);\n\t\t\t\treturn this.#sessions.get(id);\n\t\t\t}\n\t\t\tif (\n\t\t\t\trejectedRevision === undefined\n\t\t\t\t&& this.#sessions.get(id) === current\n\t\t\t\t&& current.accessExpiresAt > this.#clock()\n\t\t\t) {\n\t\t\t\treturn current;\n\t\t\t}\n\t\t\tthrow err;\n\t\t}\n\t}\n\n\t#fromGrant(\n\t\tsession: WebSession,\n\t\tuser: UserRecord,\n\t\tsecretHash: Uint8Array,\n\t\tgrant: GitHubTokenGrant,\n\t\trevision: number,\n\t\tnow: Date,\n\t): MemorySession {\n\t\treturn {\n\t\t\tsession: {\n\t\t\t\t...session,\n\t\t\t\texpiresAt: new Date(session.expiresAt),\n\t\t\t\tcreatedAt: new Date(session.createdAt),\n\t\t\t},\n\t\t\tuser: {\n\t\t\t\t...user,\n\t\t\t\tcreatedAt: new Date(user.createdAt),\n\t\t\t\tupdatedAt: new Date(user.updatedAt),\n\t\t\t},\n\t\t\tsecretHash: new Uint8Array(secretHash),\n\t\t\taccessToken: grant.accessToken,\n\t\t\taccessExpiresAt: new Date(now.getTime() + grant.accessExpiresIn * 1_000),\n\t\t\trefreshToken: grant.refreshToken,\n\t\t\trefreshExpiresAt: new Date(now.getTime() + grant.refreshExpiresIn * 1_000),\n\t\t\trevision,\n\t\t};\n\t}\n\n\t#authenticated(current: MemorySession): AuthenticatedSession {\n\t\treturn {\n\t\t\tsession: {\n\t\t\t\t...current.session,\n\t\t\t\texpiresAt: new Date(current.session.expiresAt),\n\t\t\t\tcreatedAt: new Date(current.session.createdAt),\n\t\t\t},\n\t\t\tuser: {\n\t\t\t\t...current.user,\n\t\t\t\tcreatedAt: new Date(current.user.createdAt),\n\t\t\t\tupdatedAt: new Date(current.user.updatedAt),\n\t\t\t},\n\t\t\taccess: {\n\t\t\t\ttoken: current.accessToken,\n\t\t\t\texpiresAt: new Date(current.accessExpiresAt),\n\t\t\t\trevision: current.revision,\n\t\t\t},\n\t\t};\n\t}\n\n\t#current(authenticated: AuthenticatedSession): MemorySession | undefined {\n\t\tlet current = this.#sessions.get(authenticated.session.id);\n\t\treturn current\n\t\t\t\t&& current.session.expiresAt > this.#clock()\n\t\t\t? current\n\t\t\t: undefined;\n\t}\n\n\tasync #reject(id: string, revision: number): Promise {\n\t\tlet refreshing = this.#refreshes.get(id);\n\t\tif (refreshing) await refreshing.catch(() => {});\n\t\tlet current = this.#sessions.get(id);\n\t\tif (!current) return \"missing\";\n\t\tif (current.revision !== revision) return \"changed\";\n\t\treturn this.#revokeExact(current);\n\t}\n\n\tasync #revokeExact(current: MemorySession): Promise {\n\t\tlet id = current.session.id;\n\t\tlet active = this.#sessions.get(id);\n\t\tif (active !== current) return active ? \"changed\" : \"missing\";\n\t\tthis.#sessions.delete(id);\n\t\tthis.#options.invalidate?.(current.accessToken);\n\t\tawait this.#deleteRegistry(id);\n\t\treturn \"revoked\";\n\t}\n\n\t#deleteRegistry(id: string): Promise {\n\t\tlet existing = this.#revocations.get(id);\n\t\tif (existing) return existing;\n\t\tthis.#pendingDeletes.add(id);\n\t\tlet operation = (async () => {\n\t\t\tlet callbackError: unknown;\n\t\t\ttry {\n\t\t\t\tawait this.#options.onRevoked?.(id);\n\t\t\t} catch (err) {\n\t\t\t\tcallbackError = err;\n\t\t\t}\n\t\t\tlet deleted: boolean;\n\t\t\ttry {\n\t\t\t\tdeleted = await this.#storage.sessions.delete(id);\n\t\t\t\tthis.#pendingDeletes.delete(id);\n\t\t\t} catch (err) {\n\t\t\t\tthis.#pendingDeletes.add(id);\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t\tif (callbackError) throw callbackError;\n\t\t\treturn deleted;\n\t\t})();\n\t\tthis.#revocations.set(id, operation);\n\t\tvoid operation.finally(() => {\n\t\t\tif (this.#revocations.get(id) === operation) this.#revocations.delete(id);\n\t\t}).catch(() => {});\n\t\treturn operation;\n\t}\n\n\tasync revoke(request: Request): Promise {\n\t\tlet parsed = this.#parse(request);\n\t\tif (!parsed) return undefined;\n\t\tif (this.#pendingDeletes.has(parsed.id)) {\n\t\t\tawait this.#deleteRegistry(parsed.id);\n\t\t\treturn parsed.id;\n\t\t}\n\t\tlet current = await this.#find(parsed);\n\t\tif (!current || !equal(hash(parsed.secret), current.secretHash)) return undefined;\n\t\tawait this.#revokeExact(current);\n\t\treturn current.session.id;\n\t}\n\n\tasync cleanupExpired(): Promise {\n\t\tlet now = this.#clock();\n\t\tlet removed = 0;\n\t\tfor (let id of this.#pendingDeletes) {\n\t\t\tawait this.#storage.sessions.delete(id);\n\t\t\tthis.#pendingDeletes.delete(id);\n\t\t}\n\t\tfor (let current of this.#sessions.values()) {\n\t\t\tif (current.session.expiresAt > now) continue;\n\t\t\tif (await this.#revokeExact(current) === \"revoked\") removed++;\n\t\t}\n\t\treturn removed + await this.#storage.sessions.deleteExpired(now);\n\t}\n\n\tclearCookie(): string {\n\t\treturn cleared(this.cookieName, this.#secure);\n\t}\n\n\t/** The one credential needed to revalidate an already-open hosted socket. */\n\tcredential(request: Request): string | undefined {\n\t\tlet cookies = values(request, this.cookieName);\n\t\treturn cookies.length === 1 && this.#parse(request)\n\t\t\t? `${this.cookieName}=${cookies[0]}`\n\t\t\t: undefined;\n\t}\n\n\t#parse(request: Request): { id: string; secret: Uint8Array } | undefined {\n\t\tlet cookies = values(request, this.cookieName);\n\t\tif (cookies.length !== 1) return undefined;\n\t\tlet separator = cookies[0]!.indexOf(\".\");\n\t\tif (separator < 1) return undefined;\n\t\tlet id = cookies[0]!.slice(0, separator);\n\t\tlet secret = decoded(cookies[0]!.slice(separator + 1));\n\t\tif (\n\t\t\t!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)\n\t\t\t|| !secret\n\t\t\t|| secret.length !== SECRET_BYTES\n\t\t) return undefined;\n\t\treturn { id, secret };\n\t}\n}\n\n/** Short-lived encrypted OAuth attempt data carried only by the browser. */\nexport class OAuthAttempts {\n\treadonly #key: Promise;\n\treadonly #secure: boolean;\n\treadonly #clock: Clock;\n\treadonly cookieName: string;\n\n\tconstructor(key: Uint8Array, secure: boolean, clock: Clock = () => new Date()) {\n\t\tthis.#key = imported(key);\n\t\tthis.#secure = secure;\n\t\tthis.#clock = clock;\n\t\tthis.cookieName = secure ? \"__Host-chopin_oauth_state\" : \"chopin_oauth_state\";\n\t}\n\n\tasync issue(returnPath?: string): Promise {\n\t\tlet state = base64(random(SECRET_BYTES));\n\t\tlet verifier = base64(random(SECRET_BYTES));\n\t\tlet digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", encoder.encode(verifier)));\n\t\tlet expiresAt = new Date(this.#clock().getTime() + ATTEMPT_TTL_MS);\n\t\tlet stored: StoredAttempt = {\n\t\t\tv: 1,\n\t\t\tstate,\n\t\t\tverifier,\n\t\t\texpiresAt: expiresAt.toISOString(),\n\t\t};\n\t\tif (returnPath !== undefined) stored.returnPath = returnPath;\n\t\tlet envelope = await encrypted(\n\t\t\tawait this.#key,\n\t\t\t\"chopin:oauth-state:v1\",\n\t\t\tstored,\n\t\t);\n\t\treturn {\n\t\t\tstate,\n\t\t\tverifier,\n\t\t\tchallenge: base64(digest),\n\t\t\tcookie: serialized(\n\t\t\t\tthis.cookieName,\n\t\t\t\tbase64(envelope),\n\t\t\t\texpiresAt,\n\t\t\t\tthis.#secure,\n\t\t\t\t\"/\",\n\t\t\t\tATTEMPT_TTL_MS / 1_000,\n\t\t\t),\n\t\t\texpiresAt,\n\t\t};\n\t}\n\n\tasync read(request: Request): Promise {\n\t\tlet cookies = values(request, this.cookieName);\n\t\tif (cookies.length !== 1) return undefined;\n\t\tlet envelope = decoded(cookies[0]!);\n\t\tif (!envelope) return undefined;\n\t\ttry {\n\t\t\tlet stored = attempt(await decrypted(await this.#key, \"chopin:oauth-state:v1\", envelope));\n\t\t\tif (!stored) return undefined;\n\t\t\tlet expiresAt = new Date(stored.expiresAt);\n\t\t\tif (Number.isNaN(expiresAt.getTime()) || expiresAt <= this.#clock()) return undefined;\n\t\t\treturn stored;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tclearCookie(): string {\n\t\treturn cleared(this.cookieName, this.#secure);\n\t}\n}\n","editable",false,"branch","documentNavigation","repo","githubnext/chopin","repoId","7d1a8ac3-35b0-4dea-85d4-06a980f3bada","ownerId","org:89615882","site","nexthub","private","admin","settings","maintainer","triage","starred","stars",0,"watchers","watching","pinned","notify","views",[183,184,185,186,187,188,189,190,191,192,193,194,195],"navigation",{"_54":55,"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":150},"sources",[],"viewer","meta",{"_131":132,"_133":134,"_135":136,"_42":31,"_137":126,"_138":31,"_48":49,"_50":49},"branches",[73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"tags",[69,70,71,72],"cloneUrl","https://git.nexthub.sh/githubnext/chopin.git","color-controls-slice-1","color-controls-slice-2","color-controls-slice-3","color-controls-slice-4","Krzysztof-Cieslak-patch-1","Krzysztof-Cieslak-patch-2","Maggie/app-preview-toolkit","Maggie/ci-playwright-install-timeout","Maggie/collaborative-visual-decision","Maggie/design-audit","Maggie/generic-visual-decision-runtime","Maggie/impeccable-chopin-metadata","Maggie/jev-chat-product","Maggie/jev-composed-assessment","Maggie/native-document-layouts","Maggie/openui-composition-product","Maggie/openui-composition-trial","Maggie/planner-visual-authoring","Maggie/planner-visual-requests","Maggie/visual-selection-eval","artifacts/pr-419-live-preview-20261009","automation/pr-maintenance-state","automation/use-effect/callout-disabled-picker-8cf9e49ba5c09471","automation/use-effect/collaboration-options-ref-4e3a5a08a879a5ae","automation/use-effect/room-workspace-effective-access-a57d40866c71bed0","chore/bun-1.4.2","color-controls","color-controls-plan","comments","design-pr-assets","design/archived-decisions-badge","design/channel-route-remount","design/chat-decision-entry","design/conversation-analysis-markers","design/decision-evidence","design/settled-line-icon","dev/integration","diagram-step-controls","feat/liveapp-frontend-pilot","feat/local-experiments","feat/local-launcher-tracer","fix/autolink-mdx-crash","github-pills/2-pills","github-pills/3-hover-card","maggie/app-preview-toolkit","maggie/ci-playwright-install-timeout","maggie/collaborative-visual-decision","maggie/design-audit","maggie/generic-visual-decision-runtime","maggie/impeccable-chopin-metadata","maggie/jev-composed-assessment","maggie/native-document-layouts","maggie/openui-composition-product","maggie/openui-composition-trial","maggie/planner-visual-authoring","maggie/planner-visual-requests","maggie/visual-selection-eval","main","plain-text-fence-chrome","tokens/09-copy","wireframes/2-renderer","wireframes/3-planner","description","Let's compose rich plans together","owner","githubnext","section","","head","empty","pins",[165,166,167],"documents",{"_160":161,"_162":163},"code",{"_156":157,"_158":159},"automations",{"_153":154,"_155":-5},"delivery",{"_151":49,"_152":-5},"tag","04zvKQ8QOrDUF8TO1Ovz0Zy8_TT","releases","applications","workflows",3,"deployments","commits",1000,"changes",13,"counts",{"_164":163},"total",11,"issue",{"_168":158,"_170":181,"_15":158,"_172":182,"_52":174,"_175":31,"_176":174,"_177":159},{"_168":178,"_170":179,"_15":178,"_172":180,"_52":174,"_175":31,"_176":174,"_177":49},{"_168":169,"_170":171,"_15":169,"_172":173,"_52":174,"_175":31,"_176":174,"_177":163},"id","issues","name","Issues","filters",{},true,"saved","pinnable","count","tasks","Tasks",{},"Changes",{},{"_168":158,"_170":181,"_15":158,"_172":226,"_52":174,"_175":31,"_176":174},{"_168":178,"_170":179,"_15":178,"_172":225,"_52":174,"_175":31,"_176":174},{"_168":169,"_170":171,"_15":169,"_172":224,"_52":174,"_175":31,"_176":174},{"_168":221,"_170":222,"_15":221,"_172":223,"_52":31,"_175":31,"_176":174},{"_168":218,"_170":219,"_15":218,"_172":220,"_52":31,"_175":31,"_176":174},{"_168":153,"_170":216,"_15":145,"_172":217,"_52":31,"_175":31,"_176":174},{"_168":155,"_170":213,"_15":214,"_172":215,"_52":31,"_175":31,"_176":174},{"_168":151,"_170":211,"_15":151,"_172":212,"_52":31,"_175":31,"_176":174},{"_168":207,"_170":208,"_15":209,"_172":210,"_52":31,"_175":31,"_176":174},{"_168":141,"_170":205,"_15":141,"_172":206,"_52":31,"_175":31,"_176":31},{"_168":202,"_170":203,"_15":202,"_172":204,"_52":31,"_175":31,"_176":31},{"_168":199,"_170":200,"_15":199,"_172":201,"_52":31,"_175":31,"_176":31},{"_168":196,"_170":197,"_15":196,"_172":198,"_52":31,"_175":31,"_176":31},"decisions","Decisions",{},"changelog","Changelog",{},"roadmap","Roadmap",{},"Documents",{},"activity","Activity","insights",{},"Releases",{},"Deployments","automations/deployments",{},"Workflows",{},"discussions","Discussions",{},"goals","Goals",{},{},{},{},"groups","user","agents",[],"now",1794438209267,"sidebar","expanded"]