@airdraft/auth 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+All notable changes to `@airdraft/auth` will be documented here.
+
+See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './tokens.js';
+export * from './middleware.js';
+export * from './jwt.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,UAAU,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// @airdraft/auth — public surface
+export * from './tokens.js';
+export * from './middleware.js';
+export * from './jwt.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,UAAU,CAAA"}

package/dist/jwt.d.ts

@@ -0,0 +1,51 @@
+/** Airdraft role hierarchy. admin > publisher > editor. */
+export type Role = 'admin' | 'publisher' | 'editor';
+/**
+ * Authenticated user identity, carried in the JWT payload and returned by
+ * `AuthProvider.verify()` on every protected request.
+ */
+export interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    role: Role;
+    meta?: Record<string, unknown>;
+}
+export interface RolePermissions {
+    /** Create, edit, delete entries + trigger publish. */
+    publish: boolean;
+    /** Delete entries that have already been published. */
+    deletePublished: boolean;
+    /** Edit collection schemas via the schema editor. */
+    manageSchema: boolean;
+    /** Invite / remove team members. */
+    manageTeam: boolean;
+}
+export declare const ROLE_PERMISSIONS: Record<Role, RolePermissions>;
+/** Returns the permissions object for the given user's role. */
+export declare function can(user: AuthUser): RolePermissions;
+/** Access JWT lifetime in seconds (15 min). */
+export declare const ACCESS_TOKEN_TTL: number;
+/** Refresh token lifetime in seconds (7 days). */
+export declare const REFRESH_TOKEN_TTL: number;
+/**
+ * Signs a short-lived HS256 access JWT for the given user.
+ *
+ * ```ts
+ * const token = signAccessToken(user, process.env.AIRDRAFT_JWT_SECRET!)
+ * ```
+ */
+export declare function signAccessToken(user: AuthUser, secret: string, ttlSeconds?: number): string;
+/**
+ * Generates a cryptographically random opaque refresh token (96 hex chars).
+ * Store this in an httpOnly cookie scoped to the refresh endpoint.
+ */
+export declare function signRefreshToken(): string;
+/**
+ * Verifies an HS256 access JWT.
+ *
+ * Returns the `AuthUser` from the payload, or `null` if the token is
+ * invalid, expired, or has a bad signature.
+ */
+export declare function verifyAccessToken(token: string, secret: string): AuthUser | null;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAMA,2DAA2D;AAC3D,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEnD;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAMD,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAA;IAChB,uDAAuD;IACvD,eAAe,EAAE,OAAO,CAAA;IACxB,qDAAqD;IACrD,YAAY,EAAE,OAAO,CAAA;IACrB,oCAAoC;IACpC,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,CAI1D,CAAA;AAED,gEAAgE;AAChE,wBAAgB,GAAG,CAAC,IAAI,EAAE,QAAQ,GAAG,eAAe,CAEnD;AAMD,+CAA+C;AAC/C,eAAO,MAAM,gBAAgB,QAAU,CAAA;AAEvC,kDAAkD;AAClD,eAAO,MAAM,iBAAiB,QAAmB,CAAA;AA+BjD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,MAAyB,GACpC,MAAM,CAiBR;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CA2BhF"}

package/dist/jwt.js

@@ -0,0 +1,109 @@
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+export const ROLE_PERMISSIONS = {
+    admin: { publish: true, deletePublished: true, manageSchema: true, manageTeam: true },
+    publisher: { publish: true, deletePublished: true, manageSchema: false, manageTeam: false },
+    editor: { publish: false, deletePublished: false, manageSchema: false, manageTeam: false },
+};
+/** Returns the permissions object for the given user's role. */
+export function can(user) {
+    return ROLE_PERMISSIONS[user.role];
+}
+// ---------------------------------------------------------------------------
+// Token TTL constants (C6, C8)
+// ---------------------------------------------------------------------------
+/** Access JWT lifetime in seconds (15 min). */
+export const ACCESS_TOKEN_TTL = 15 * 60;
+/** Refresh token lifetime in seconds (7 days). */
+export const REFRESH_TOKEN_TTL = 7 * 24 * 60 * 60;
+// ---------------------------------------------------------------------------
+// Internal HS256 JWT helpers  (C6, C7)
+// ---------------------------------------------------------------------------
+function b64url(data) {
+    const buf = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+    return buf.toString('base64url');
+}
+function b64urlDecode(s) {
+    return Buffer.from(s, 'base64url').toString('utf8');
+}
+function hmacSign(data, secret) {
+    return createHmac('sha256', secret).update(data).digest('base64url');
+}
+function hmacVerify(data, sig, secret) {
+    const expected = hmacSign(data, secret);
+    const a = Buffer.from(sig, 'ascii');
+    const b = Buffer.from(expected, 'ascii');
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+// ---------------------------------------------------------------------------
+// Public JWT API  (C6, C7)
+// ---------------------------------------------------------------------------
+/**
+ * Signs a short-lived HS256 access JWT for the given user.
+ *
+ * ```ts
+ * const token = signAccessToken(user, process.env.AIRDRAFT_JWT_SECRET!)
+ * ```
+ */
+export function signAccessToken(user, secret, ttlSeconds = ACCESS_TOKEN_TTL) {
+    const now = Math.floor(Date.now() / 1000);
+    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+    const payload = b64url(JSON.stringify({
+        sub: user.email,
+        id: user.id,
+        email: user.email,
+        ...(user.name ? { name: user.name } : {}),
+        role: user.role,
+        ...(user.meta ? { meta: user.meta } : {}),
+        iat: now,
+        exp: now + ttlSeconds,
+    }));
+    const sig = hmacSign(`${header}.${payload}`, secret);
+    return `${header}.${payload}.${sig}`;
+}
+/**
+ * Generates a cryptographically random opaque refresh token (96 hex chars).
+ * Store this in an httpOnly cookie scoped to the refresh endpoint.
+ */
+export function signRefreshToken() {
+    return randomBytes(48).toString('hex');
+}
+/**
+ * Verifies an HS256 access JWT.
+ *
+ * Returns the `AuthUser` from the payload, or `null` if the token is
+ * invalid, expired, or has a bad signature.
+ */
+export function verifyAccessToken(token, secret) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    const [header, payload, sig] = parts;
+    if (!hmacVerify(`${header}.${payload}`, sig, secret))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(b64urlDecode(payload));
+    }
+    catch {
+        return null;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof parsed.exp === 'number' && parsed.exp < now)
+        return null;
+    if (typeof parsed.email !== 'string')
+        return null;
+    if (typeof parsed.role !== 'string')
+        return null;
+    if (!['admin', 'publisher', 'editor'].includes(parsed.role))
+        return null;
+    return {
+        id: typeof parsed.id === 'string' ? parsed.id : String(parsed.sub ?? parsed.email),
+        email: parsed.email,
+        name: typeof parsed.name === 'string' ? parsed.name : undefined,
+        role: parsed.role,
+        meta: parsed.meta,
+    };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAoCtE,MAAM,CAAC,MAAM,gBAAgB,GAAkC;IAC7D,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IACrF,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;IAC3F,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;CAC3F,CAAA;AAED,gEAAgE;AAChE,MAAM,UAAU,GAAG,CAAC,IAAc;IAChC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,CAAA;AAEvC,kDAAkD;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEjD,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,SAAS,MAAM,CAAC,IAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,MAAc;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAc,EACd,MAAc,EACd,aAAqB,gBAAgB;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,MAAM,CACpB,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,EAAE,IAAI,CAAC,KAAK;QACf,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,UAAU;KACtB,CAAC,CACH,CAAA;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;IACpD,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,GAAG,EAAE,CAAA;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,CAAA;IAEpC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjE,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAA4B,CAAA;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG;QAAE,OAAO,IAAI,CAAA;IACnE,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAExE,OAAO;QACL,EAAE,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC;QAClF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC/D,IAAI,EAAE,MAAM,CAAC,IAAY;QACzB,IAAI,EAAE,MAAM,CAAC,IAA2C;KACzD,CAAA;AACH,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,31 @@
+export type CredentialType = 'bearer' | 'apiKey' | 'embedToken' | 'sessionCookie';
+export interface ExtractedCredential {
+    type: CredentialType;
+    token: string;
+    /** True when token came from `?embedToken` query param (must be redacted in logs) */
+    fromQuery?: boolean;
+}
+/**
+ * Extracts credentials from an incoming HTTP request in the following priority order:
+ *
+ * 1. `Authorization: Bearer <token>` → `bearer`
+ * 2. `X-API-Key: <token>` → `apiKey`
+ * 3. `X-Embed-Token: <token>` → `embedToken`
+ * 4. `Cookie: airdraft_session=<token>` → `sessionCookie`
+ * 5. `?embedToken=<token>` query param → `embedToken` (fromQuery: true)
+ *
+ * When both a cookie and an Authorization header are present, Authorization wins.
+ * `embedToken` header takes precedence over `?embedToken` query param.
+ *
+ * Returns `null` if no credentials are found.
+ */
+export declare function extractCredentials(request: Request): ExtractedCredential | null;
+/**
+ * Returns a log-safe representation of a credential, redacting sensitive values.
+ *
+ * - Bearer and cookie tokens: shows first 8 chars + `...`
+ * - API keys: shows `ntk_` prefix + first 4 chars + `...`
+ * - Embed tokens from query: fully redacted (never log embed query tokens)
+ */
+export declare function redactCredential(cred: ExtractedCredential): string;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,eAAe,CAAA;AAEjF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAmC/E;AAoBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAIlE"}

package/dist/middleware.js

@@ -0,0 +1,82 @@
+// ---------------------------------------------------------------------------
+// Credential extraction from HTTP requests
+// ---------------------------------------------------------------------------
+/**
+ * Extracts credentials from an incoming HTTP request in the following priority order:
+ *
+ * 1. `Authorization: Bearer <token>` → `bearer`
+ * 2. `X-API-Key: <token>` → `apiKey`
+ * 3. `X-Embed-Token: <token>` → `embedToken`
+ * 4. `Cookie: airdraft_session=<token>` → `sessionCookie`
+ * 5. `?embedToken=<token>` query param → `embedToken` (fromQuery: true)
+ *
+ * When both a cookie and an Authorization header are present, Authorization wins.
+ * `embedToken` header takes precedence over `?embedToken` query param.
+ *
+ * Returns `null` if no credentials are found.
+ */
+export function extractCredentials(request) {
+    const headers = request.headers;
+    // 1. Authorization: Bearer
+    const auth = headers.get('authorization');
+    if (auth) {
+        const match = auth.match(/^Bearer\s+(.+)$/i);
+        if (match)
+            return { type: 'bearer', token: match[1] };
+    }
+    // 2. X-API-Key
+    const apiKey = headers.get('x-api-key');
+    if (apiKey)
+        return { type: 'apiKey', token: apiKey };
+    // 3. X-Embed-Token (header takes precedence over query)
+    const embedHeader = headers.get('x-embed-token');
+    if (embedHeader)
+        return { type: 'embedToken', token: embedHeader };
+    // 4. Session cookie
+    const cookie = headers.get('cookie');
+    if (cookie) {
+        const sessionToken = parseCookie(cookie, 'airdraft_session');
+        if (sessionToken)
+            return { type: 'sessionCookie', token: sessionToken };
+    }
+    // 5. ?embedToken query param (iframe fallback)
+    try {
+        const url = new URL(request.url);
+        const queryToken = url.searchParams.get('embedToken');
+        if (queryToken)
+            return { type: 'embedToken', token: queryToken, fromQuery: true };
+    }
+    catch {
+        // Malformed URL — no credentials from query
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function parseCookie(cookieHeader, name) {
+    for (const part of cookieHeader.split(';')) {
+        const [key, ...valueParts] = part.trim().split('=');
+        if (key.trim() === name) {
+            return decodeURIComponent(valueParts.join('='));
+        }
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Log-safe credential representation
+// ---------------------------------------------------------------------------
+/**
+ * Returns a log-safe representation of a credential, redacting sensitive values.
+ *
+ * - Bearer and cookie tokens: shows first 8 chars + `...`
+ * - API keys: shows `ntk_` prefix + first 4 chars + `...`
+ * - Embed tokens from query: fully redacted (never log embed query tokens)
+ */
+export function redactCredential(cred) {
+    if (cred.fromQuery)
+        return '[embedToken: REDACTED]';
+    const preview = cred.token.slice(0, cred.type === 'apiKey' ? 8 : 8);
+    return `[${cred.type}: ${preview}...]`;
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAW9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAE/B,2BAA2B;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACzC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAC5C,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IACvD,CAAC;IAED,eAAe;IACf,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACvC,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAEpD,wDAAwD;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAChD,IAAI,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IAElE,oBAAoB;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;QAC5D,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,CAAA;IACzE,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACrD,IAAI,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,YAAoB,EAAE,IAAY;IACrD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,wBAAwB,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,MAAM,CAAA;AACxC,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,85 @@
+export type TokenType = 'session' | 'apiKey' | 'embed';
+export interface ApiKeyPair {
+    /** The plaintext key shown to the user once. Format: `ntk_<64-char-hex>`. */
+    key: string;
+    /** SHA-256 hex digest for secure storage. Never return this to users. */
+    hash: string;
+}
+export interface EmbedTokenOptions {
+    /** Project identifier. */
+    projectId: string;
+    /** Allowed request origin (exact match). */
+    allowedOrigin: string;
+    /** Token TTL in seconds. Default: 3600 (1 hour). Max: 86400 (24 hours). */
+    ttlSeconds?: number;
+    /** Optional additional claims. */
+    claims?: Record<string, unknown>;
+}
+export interface EmbedTokenPayload {
+    projectId: string;
+    allowedOrigin: string;
+    exp: number;
+    iat: number;
+    claims?: Record<string, unknown>;
+}
+export interface EmbedTokenVerifyResult {
+    valid: true;
+    payload: EmbedTokenPayload;
+}
+export interface EmbedTokenInvalidResult {
+    valid: false;
+    reason: 'expired' | 'origin_mismatch' | 'invalid_signature' | 'malformed';
+}
+export type EmbedTokenResult = EmbedTokenVerifyResult | EmbedTokenInvalidResult;
+/**
+ * Generates a new API key pair.
+ *
+ * The `key` is shown to the user once and never stored.
+ * The `hash` is stored in the database and used for verification.
+ *
+ * ```ts
+ * const { key, hash } = generateApiKey()
+ * await db.apiKeys.create({ hash, projectId, name })
+ * return { key } // shown once to user
+ * ```
+ */
+export declare function generateApiKey(): ApiKeyPair;
+/**
+ * Produces a SHA-256 hex digest of the plaintext API key for storage.
+ */
+export declare function hashApiKey(key: string): string;
+/**
+ * Verifies a plaintext API key against its stored hash using a
+ * constant-time comparison to prevent timing attacks.
+ *
+ * Returns `false` if either value is empty.
+ */
+export declare function verifyApiKey(plaintextKey: string, storedHash: string): boolean;
+/**
+ * Returns true if the string looks like an Airdraft API key.
+ * Does NOT validate the key against a stored hash.
+ */
+export declare function isApiKeyFormat(value: string): boolean;
+/**
+ * Issues a short-lived, origin-restricted embed token.
+ *
+ * Token format: `<b64url(payload)>.<b64url(hmac-sha256)>`
+ *
+ * ```ts
+ * const token = generateEmbedToken(
+ *   { projectId: 'proj_123', allowedOrigin: 'https://example.com', ttlSeconds: 3600 },
+ *   process.env.EMBED_TOKEN_SECRET!
+ * )
+ * ```
+ */
+export declare function generateEmbedToken(opts: EmbedTokenOptions, secret: string): string;
+/**
+ * Verifies an embed token against the secret and a request origin.
+ *
+ * Checks:
+ * 1. HMAC signature integrity
+ * 2. Token has not expired
+ * 3. Request origin matches `allowedOrigin` in the payload
+ */
+export declare function verifyEmbedToken(token: string, secret: string, requestOrigin: string): EmbedTokenResult;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAA;AAEtD,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,iBAAiB;IAChC,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,IAAI,CAAA;IACX,OAAO,EAAE,iBAAiB,CAAA;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,EAAE,SAAS,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,WAAW,CAAA;CAC1E;AAED,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,GAAG,uBAAuB,CAAA;AAS/E;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAK3C;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAU9E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAiBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAiBlF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,gBAAgB,CAuClB"}

package/dist/tokens.js

@@ -0,0 +1,138 @@
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+// ---------------------------------------------------------------------------
+// API Keys  (ntk_*)
+// ---------------------------------------------------------------------------
+const API_KEY_PREFIX = 'ntk_';
+const API_KEY_BYTES = 32; // 64 hex chars
+/**
+ * Generates a new API key pair.
+ *
+ * The `key` is shown to the user once and never stored.
+ * The `hash` is stored in the database and used for verification.
+ *
+ * ```ts
+ * const { key, hash } = generateApiKey()
+ * await db.apiKeys.create({ hash, projectId, name })
+ * return { key } // shown once to user
+ * ```
+ */
+export function generateApiKey() {
+    const raw = randomBytes(API_KEY_BYTES).toString('hex');
+    const key = `${API_KEY_PREFIX}${raw}`;
+    const hash = hashApiKey(key);
+    return { key, hash };
+}
+/**
+ * Produces a SHA-256 hex digest of the plaintext API key for storage.
+ */
+export function hashApiKey(key) {
+    return createHash('sha256').update(key).digest('hex');
+}
+/**
+ * Verifies a plaintext API key against its stored hash using a
+ * constant-time comparison to prevent timing attacks.
+ *
+ * Returns `false` if either value is empty.
+ */
+export function verifyApiKey(plaintextKey, storedHash) {
+    if (!plaintextKey || !storedHash)
+        return false;
+    try {
+        const expected = Buffer.from(storedHash, 'hex');
+        const actual = Buffer.from(hashApiKey(plaintextKey), 'hex');
+        if (expected.length !== actual.length)
+            return false;
+        return timingSafeEqual(expected, actual);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Returns true if the string looks like an Airdraft API key.
+ * Does NOT validate the key against a stored hash.
+ */
+export function isApiKeyFormat(value) {
+    return value.startsWith(API_KEY_PREFIX) && value.length === API_KEY_PREFIX.length + API_KEY_BYTES * 2;
+}
+// ---------------------------------------------------------------------------
+// Embed tokens  (HMAC-SHA256 signed, base64url encoded)
+// ---------------------------------------------------------------------------
+const MAX_EMBED_TTL = 86400;
+function b64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+function b64urlDecode(s) {
+    const padded = s.replace(/-/g, '+').replace(/_/g, '/') + '=='.slice((s.length + 3) & 3);
+    return Buffer.from(padded, 'base64');
+}
+/**
+ * Issues a short-lived, origin-restricted embed token.
+ *
+ * Token format: `<b64url(payload)>.<b64url(hmac-sha256)>`
+ *
+ * ```ts
+ * const token = generateEmbedToken(
+ *   { projectId: 'proj_123', allowedOrigin: 'https://example.com', ttlSeconds: 3600 },
+ *   process.env.EMBED_TOKEN_SECRET!
+ * )
+ * ```
+ */
+export function generateEmbedToken(opts, secret) {
+    const ttl = Math.min(opts.ttlSeconds ?? 3600, MAX_EMBED_TTL);
+    const now = Math.floor(Date.now() / 1000);
+    const payload = {
+        projectId: opts.projectId,
+        allowedOrigin: opts.allowedOrigin,
+        iat: now,
+        exp: now + ttl,
+        ...(opts.claims ? { claims: opts.claims } : {}),
+    };
+    const payloadB64 = b64url(Buffer.from(JSON.stringify(payload)));
+    const hmac = createHash('sha256')
+        .update(`${payloadB64}.${secret}`)
+        .digest();
+    const sig = b64url(hmac);
+    return `${payloadB64}.${sig}`;
+}
+/**
+ * Verifies an embed token against the secret and a request origin.
+ *
+ * Checks:
+ * 1. HMAC signature integrity
+ * 2. Token has not expired
+ * 3. Request origin matches `allowedOrigin` in the payload
+ */
+export function verifyEmbedToken(token, secret, requestOrigin) {
+    const parts = token.split('.');
+    if (parts.length !== 2)
+        return { valid: false, reason: 'malformed' };
+    const [payloadB64, sig] = parts;
+    // Verify signature
+    const expectedSig = b64url(Buffer.from(createHash('sha256').update(`${payloadB64}.${secret}`).digest()));
+    const expectedBuf = Buffer.from(expectedSig);
+    const actualBuf = Buffer.from(sig);
+    if (expectedBuf.length !== actualBuf.length ||
+        !timingSafeEqual(expectedBuf, actualBuf)) {
+        return { valid: false, reason: 'invalid_signature' };
+    }
+    // Decode payload
+    let payload;
+    try {
+        payload = JSON.parse(b64urlDecode(payloadB64).toString());
+    }
+    catch {
+        return { valid: false, reason: 'malformed' };
+    }
+    // Check expiry
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp < now) {
+        return { valid: false, reason: 'expired' };
+    }
+    // Check origin
+    if (payload.allowedOrigin !== requestOrigin) {
+        return { valid: false, reason: 'origin_mismatch' };
+    }
+    return { valid: true, payload };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA8CtE,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,cAAc,GAAG,MAAM,CAAA;AAC7B,MAAM,aAAa,GAAG,EAAE,CAAA,CAAC,eAAe;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACtD,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,GAAG,EAAE,CAAA;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,UAAkB;IACnE,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QACnD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,GAAG,aAAa,GAAG,CAAC,CAAA;AACvG,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,aAAa,GAAG,KAAK,CAAA;AAE3B,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,aAAa,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAA;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC;SACjC,MAAM,EAAE,CAAA;IACX,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IACxB,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,MAAc,EACd,aAAqB;IAErB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAEpE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAK,CAAA;IAE/B,mBAAmB;IACnB,MAAM,WAAW,GAAG,MAAM,CACxB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAC7E,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,IACE,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACvC,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,EACxC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACtD,CAAC;IAED,iBAAiB;IACjB,IAAI,OAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAsB,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC9C,CAAC;IAED,eAAe;IACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC5C,CAAC;IAED,eAAe;IACf,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAA;IACpD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AACjC,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@airdraft/auth",
+  "version": "0.1.0",
+  "description": "Airdraft authentication utilities — session, API key, embed token",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": ["dist", "README.md", "CHANGELOG.md"],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build",
+    "release": "standard-version",
+    "release:patch": "standard-version --release-as patch",
+    "release:minor": "standard-version --release-as minor",
+    "release:major": "standard-version --release-as major"
+  },
+  "publishConfig": { "access": "public" },
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "standard-version": "^9.5.0",
+    "tsx": "^4.7.0",
+    "typescript": "^5.4.0",
+    "vitest": "^1.5.0"
+  },
+  "dependencies": {
+    "@airdraft/core": "*",
+    "zod": "^3.23.0"
+  },
+  "engines": { "node": ">=18.0.0" }
+}