@alphacifer/authkit 0.0.1

package/lib/hash/index.cjs

@@ -0,0 +1,46 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../jwt.cjs");
+let node_crypto = require("node:crypto");
+let node_util = require("node:util");
+//#region src/hash/index.ts
+const asyncArgon2 = (0, node_util.promisify)(node_crypto.argon2);
+const asyncRandomBytes = (0, node_util.promisify)(node_crypto.randomBytes);
+async function passwordHash({ password, passes = 3, tagLength = 32, parallelism = 4, memory = 65534 }) {
+	const salt = await asyncRandomBytes(16);
+	const hash = await asyncArgon2("argon2id", {
+		memory,
+		passes,
+		tagLength,
+		parallelism,
+		nonce: salt,
+		message: password
+	});
+	return `$argon2id$v=19$m=${memory},t=${passes},p=${parallelism}$${salt.toString("base64").replace(/=+$/, "")}$${hash.toString("base64").replace(/=+$/, "")}`;
+}
+async function verifyPassword({ password, hashPassword }) {
+	try {
+		const parts = hashPassword.split("$");
+		if (parts.length !== 6 || parts[1] !== "argon2id") return false;
+		const [, , , params, saltB64, hashB64] = parts;
+		const paramMatch = params?.match(/m=(\d+),t=(\d+),p=(\d+)/);
+		if (!paramMatch) return false;
+		const memory = Number.parseInt(paramMatch[1] || "", 10);
+		const passes = Number.parseInt(paramMatch[2] || "", 10);
+		const parallelism = Number.parseInt(paramMatch[3] || "", 10);
+		const salt = Buffer.from(saltB64 || "", "base64");
+		const originalHash = Buffer.from(hashB64 || "", "base64");
+		return (0, node_crypto.timingSafeEqual)(originalHash, await asyncArgon2("argon2id", {
+			memory,
+			passes,
+			parallelism,
+			nonce: salt,
+			message: password,
+			tagLength: originalHash.length
+		}));
+	} catch {
+		return false;
+	}
+}
+//#endregion
+exports.passwordHash = passwordHash;
+exports.verifyPassword = verifyPassword;

package/lib/hash/index.d.cts

@@ -0,0 +1,25 @@
+//#region src/hash/index.d.ts
+interface IPasswordHashParams {
+  memory?: number;
+  passes?: number;
+  password: string;
+  tagLength?: number;
+  parallelism?: number;
+}
+declare function passwordHash({
+  password,
+  passes,
+  tagLength,
+  parallelism,
+  memory
+}: IPasswordHashParams): Promise<string>;
+interface IVerifyPasswordParams {
+  password: string;
+  hashPassword: string;
+}
+declare function verifyPassword({
+  password,
+  hashPassword
+}: IVerifyPasswordParams): Promise<boolean>;
+//#endregion
+export { passwordHash, verifyPassword };

package/lib/hash/index.d.mts

@@ -0,0 +1,25 @@
+//#region src/hash/index.d.ts
+interface IPasswordHashParams {
+  memory?: number;
+  passes?: number;
+  password: string;
+  tagLength?: number;
+  parallelism?: number;
+}
+declare function passwordHash({
+  password,
+  passes,
+  tagLength,
+  parallelism,
+  memory
+}: IPasswordHashParams): Promise<string>;
+interface IVerifyPasswordParams {
+  password: string;
+  hashPassword: string;
+}
+declare function verifyPassword({
+  password,
+  hashPassword
+}: IVerifyPasswordParams): Promise<boolean>;
+//#endregion
+export { passwordHash, verifyPassword };

package/lib/hash/index.mjs

@@ -0,0 +1,43 @@
+import { argon2, randomBytes, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+//#region src/hash/index.ts
+const asyncArgon2 = promisify(argon2);
+const asyncRandomBytes = promisify(randomBytes);
+async function passwordHash({ password, passes = 3, tagLength = 32, parallelism = 4, memory = 65534 }) {
+	const salt = await asyncRandomBytes(16);
+	const hash = await asyncArgon2("argon2id", {
+		memory,
+		passes,
+		tagLength,
+		parallelism,
+		nonce: salt,
+		message: password
+	});
+	return `$argon2id$v=19$m=${memory},t=${passes},p=${parallelism}$${salt.toString("base64").replace(/=+$/, "")}$${hash.toString("base64").replace(/=+$/, "")}`;
+}
+async function verifyPassword({ password, hashPassword }) {
+	try {
+		const parts = hashPassword.split("$");
+		if (parts.length !== 6 || parts[1] !== "argon2id") return false;
+		const [, , , params, saltB64, hashB64] = parts;
+		const paramMatch = params?.match(/m=(\d+),t=(\d+),p=(\d+)/);
+		if (!paramMatch) return false;
+		const memory = Number.parseInt(paramMatch[1] || "", 10);
+		const passes = Number.parseInt(paramMatch[2] || "", 10);
+		const parallelism = Number.parseInt(paramMatch[3] || "", 10);
+		const salt = Buffer.from(saltB64 || "", "base64");
+		const originalHash = Buffer.from(hashB64 || "", "base64");
+		return timingSafeEqual(originalHash, await asyncArgon2("argon2id", {
+			memory,
+			passes,
+			parallelism,
+			nonce: salt,
+			message: password,
+			tagLength: originalHash.length
+		}));
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { passwordHash, verifyPassword };

package/lib/jwt.cjs

@@ -0,0 +1,53 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let jsonwebtoken = require("jsonwebtoken");
+jsonwebtoken = __toESM(jsonwebtoken);
+let nanoid = require("nanoid");
+//#region src/jwt.ts
+function extractJWT({ token, issuer, subject, audience, secretKey, algorithms = ["HS256"] }) {
+	return jsonwebtoken.default.verify(token, secretKey || process.env.JWT_SECRET || "", {
+		issuer,
+		subject,
+		audience,
+		algorithms
+	});
+}
+function genToken({ jwtId, issuer, subject, payload, audience, secretKey, expiresIn, notBefore, algorithm = "HS256" }) {
+	const options = {
+		algorithm,
+		expiresIn: expiresIn ?? 3600
+	};
+	if (notBefore) options.notBefore = notBefore;
+	return jsonwebtoken.default.sign({
+		...payload,
+		iss: issuer,
+		sub: subject,
+		aud: audience,
+		jti: jwtId ?? (0, nanoid.nanoid)(20)
+	}, secretKey || process.env.JWT_SECRET || "", options);
+}
+//#endregion
+exports.__toESM = __toESM;
+exports.extractJWT = extractJWT;
+exports.genToken = genToken;

package/lib/jwt.d.cts

@@ -0,0 +1,43 @@
+import { SignOptions, VerifyOptions } from "jsonwebtoken";
+
+//#region src/jwt.d.ts
+interface IExtractJWTParams {
+  token: string;
+  issuer?: string;
+  subject?: string;
+  secretKey?: string;
+  algorithms?: ('HS256' | 'HS512')[];
+  audience?: VerifyOptions['audience'];
+}
+declare function extractJWT<T = unknown>({
+  token,
+  issuer,
+  subject,
+  audience,
+  secretKey,
+  algorithms
+}: IExtractJWTParams): T;
+interface IGenTokenParams {
+  jwtId?: string;
+  issuer?: string;
+  subject?: string;
+  secretKey?: string;
+  algorithm?: 'HS256' | 'HS512';
+  audience?: VerifyOptions['audience'];
+  expiresIn?: SignOptions['expiresIn'];
+  notBefore?: SignOptions['notBefore'];
+  payload: Record<string, string | string[]>;
+}
+declare function genToken({
+  jwtId,
+  issuer,
+  subject,
+  payload,
+  audience,
+  secretKey,
+  expiresIn,
+  notBefore,
+  algorithm
+}: IGenTokenParams): string;
+//#endregion
+export { extractJWT, genToken };

package/lib/jwt.d.mts

@@ -0,0 +1,43 @@
+import { SignOptions, VerifyOptions } from "jsonwebtoken";
+
+//#region src/jwt.d.ts
+interface IExtractJWTParams {
+  token: string;
+  issuer?: string;
+  subject?: string;
+  secretKey?: string;
+  algorithms?: ('HS256' | 'HS512')[];
+  audience?: VerifyOptions['audience'];
+}
+declare function extractJWT<T = unknown>({
+  token,
+  issuer,
+  subject,
+  audience,
+  secretKey,
+  algorithms
+}: IExtractJWTParams): T;
+interface IGenTokenParams {
+  jwtId?: string;
+  issuer?: string;
+  subject?: string;
+  secretKey?: string;
+  algorithm?: 'HS256' | 'HS512';
+  audience?: VerifyOptions['audience'];
+  expiresIn?: SignOptions['expiresIn'];
+  notBefore?: SignOptions['notBefore'];
+  payload: Record<string, string | string[]>;
+}
+declare function genToken({
+  jwtId,
+  issuer,
+  subject,
+  payload,
+  audience,
+  secretKey,
+  expiresIn,
+  notBefore,
+  algorithm
+}: IGenTokenParams): string;
+//#endregion
+export { extractJWT, genToken };

package/lib/jwt.mjs

@@ -0,0 +1,27 @@
+import jwt from "jsonwebtoken";
+import { nanoid } from "nanoid";
+//#region src/jwt.ts
+function extractJWT({ token, issuer, subject, audience, secretKey, algorithms = ["HS256"] }) {
+	return jwt.verify(token, secretKey || process.env.JWT_SECRET || "", {
+		issuer,
+		subject,
+		audience,
+		algorithms
+	});
+}
+function genToken({ jwtId, issuer, subject, payload, audience, secretKey, expiresIn, notBefore, algorithm = "HS256" }) {
+	const options = {
+		algorithm,
+		expiresIn: expiresIn ?? 3600
+	};
+	if (notBefore) options.notBefore = notBefore;
+	return jwt.sign({
+		...payload,
+		iss: issuer,
+		sub: subject,
+		aud: audience,
+		jti: jwtId ?? nanoid(20)
+	}, secretKey || process.env.JWT_SECRET || "", options);
+}
+//#endregion
+export { extractJWT, genToken };

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@alphacifer/authkit",
+  "version": "0.0.1",
+  "description": "Auth Kit for Alpha's projects.",
+  "exports": {
+    "./hash": {
+      "import": {
+        "types": "./lib/hash/index.d.mts",
+        "default": "./lib/hash/index.mjs"
+      },
+      "require": {
+        "types": "./lib/hash/index.d.cts",
+        "default": "./lib/hash/index.cjs"
+      }
+    },
+    "./jwt": {
+      "import": {
+        "types": "./lib/jwt.d.mts",
+        "default": "./lib/jwt.mjs"
+      },
+      "require": {
+        "types": "./lib/jwt.d.cts",
+        "default": "./lib/jwt.cjs"
+      }
+    }
+  },
+  "keywords": [
+    "alpha",
+    "dx",
+    "authkit"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "author": "Alpha",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zgid123/alpha-dx.git"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "jsonwebtoken": "9.0.3",
+    "nanoid": "5.1.11"
+  },
+  "devDependencies": {
+    "@types/jsonwebtoken": "9.0.10",
+    "@types/node": "25.9.0"
+  },
+  "scripts": {
+    "prepublish": "pnpm build",
+    "build": "tsdown"
+  }
+}