@argos-js/auth 0.0.0-stage → 0.1.0

package/dist/guards/hmac.guard.d.ts

@@ -0,0 +1,18 @@
+import type { AuthGuard, AuthUser, GuardResult } from './guard.interface.js';
+import type { ArgosContext } from '@argos-js/net';
+export interface HmacGuardOptions {
+    secret: string | Buffer | ((ctx: ArgosContext) => Promise<string | Buffer> | string | Buffer);
+    header?: string;
+    algorithm?: string;
+    prefix?: string;
+    encoding?: 'hex' | 'base64';
+    payloadExtractor?: (ctx: ArgosContext) => Promise<string | Buffer> | string | Buffer;
+    userResolver?: (ctx: ArgosContext) => Promise<AuthUser> | AuthUser;
+}
+export declare class HmacGuard implements AuthGuard {
+    readonly name = "hmac";
+    private options;
+    constructor(options: HmacGuardOptions);
+    authenticate(ctx: ArgosContext): Promise<GuardResult>;
+}
+//# sourceMappingURL=hmac.guard.d.ts.map

package/dist/guards/hmac.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.guard.d.ts","sourceRoot":"","sources":["../../src/guards/hmac.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;IACrF,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACpE;AAED,qBAAa,SAAU,YAAW,SAAS;IACzC,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,OAAO,CAAmB;gBAEtB,OAAO,EAAE,gBAAgB;IAS/B,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CAiG5D"}

package/dist/guards/hmac.guard.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HmacGuard = void 0;
+const node_crypto_1 = require("node:crypto");
+class HmacGuard {
+    name = 'hmac';
+    options;
+    constructor(options) {
+        this.options = {
+            header: 'x-signature',
+            algorithm: 'sha256',
+            encoding: 'hex',
+            ...options,
+        };
+    }
+    async authenticate(ctx) {
+        const headerName = this.options.header.toLowerCase();
+        const rawHeader = typeof ctx.getHeader === 'function'
+            ? ctx.getHeader(headerName)
+            : ctx.headers?.[headerName];
+        if (!rawHeader) {
+            return {
+                authenticated: false,
+                error: `Missing HMAC signature header (${this.options.header})`,
+                guard: this.name,
+            };
+        }
+        let signature = rawHeader.trim();
+        if (this.options.prefix && signature.startsWith(this.options.prefix)) {
+            signature = signature.slice(this.options.prefix.length).trim();
+        }
+        try {
+            // 1. Resolve Secret
+            const secret = typeof this.options.secret === 'function'
+                ? await this.options.secret(ctx)
+                : this.options.secret;
+            // 2. Extract Raw Payload
+            let payloadData;
+            if (this.options.payloadExtractor) {
+                payloadData = await this.options.payloadExtractor(ctx);
+            }
+            else {
+                const anyCtx = ctx;
+                if (anyCtx.rawBody !== undefined) {
+                    payloadData = anyCtx.rawBody;
+                }
+                else if (anyCtx.rawText !== undefined) {
+                    payloadData = anyCtx.rawText;
+                }
+                else if (typeof ctx.body === 'function') {
+                    const bodyVal = await ctx.body();
+                    payloadData = typeof bodyVal === 'string' || Buffer.isBuffer(bodyVal)
+                        ? bodyVal
+                        : bodyVal !== undefined && bodyVal !== null
+                            ? JSON.stringify(bodyVal)
+                            : '';
+                }
+                else {
+                    payloadData = '';
+                }
+            }
+            // 3. Compute HMAC
+            const hmac = (0, node_crypto_1.createHmac)(this.options.algorithm || 'sha256', secret);
+            hmac.update(payloadData);
+            const computedDigest = hmac.digest(this.options.encoding || 'hex');
+            // 4. Compare with timingSafeEqual
+            const sigBuf = Buffer.from(signature, this.options.encoding || 'hex');
+            const compBuf = Buffer.from(computedDigest, this.options.encoding || 'hex');
+            if (sigBuf.length !== compBuf.length) {
+                const dummy = Buffer.alloc(sigBuf.length);
+                (0, node_crypto_1.timingSafeEqual)(sigBuf, dummy);
+                return {
+                    authenticated: false,
+                    error: 'HMAC signature mismatch',
+                    guard: this.name,
+                };
+            }
+            if (!(0, node_crypto_1.timingSafeEqual)(sigBuf, compBuf)) {
+                return {
+                    authenticated: false,
+                    error: 'HMAC signature mismatch',
+                    guard: this.name,
+                };
+            }
+            let user;
+            if (this.options.userResolver) {
+                user = await this.options.userResolver(ctx);
+            }
+            else {
+                user = {
+                    id: 'hmac-client',
+                    scopes: ['webhook:verified'],
+                };
+            }
+            return {
+                authenticated: true,
+                user,
+                guard: this.name,
+            };
+        }
+        catch (err) {
+            return {
+                authenticated: false,
+                error: err.message || 'Error verifying HMAC signature',
+                guard: this.name,
+            };
+        }
+    }
+}
+exports.HmacGuard = HmacGuard;
+//# sourceMappingURL=hmac.guard.js.map

package/dist/guards/hmac.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.guard.js","sourceRoot":"","sources":["../../src/guards/hmac.guard.ts"],"names":[],"mappings":";;;AAAA,6CAA0D;AAc1D,MAAa,SAAS;IACX,IAAI,GAAG,MAAM,CAAC;IACf,OAAO,CAAmB;IAElC,YAAY,OAAyB;QACnC,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,aAAa;YACrB,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,KAAK;YACf,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAiB;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAO,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3B,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,kCAAkC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG;gBAC/D,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,oBAAoB;YACpB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU;gBACtD,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAExB,yBAAyB;YACzB,IAAI,WAA4B,CAAC;YACjC,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAClC,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,GAAU,CAAC;gBAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACjC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC/B,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBACxC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC/B,CAAC;qBAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAC1C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBACjC,WAAW,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;wBACnE,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;4BACzC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;4BACzB,CAAC,CAAC,EAAE,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACN,WAAW,GAAG,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,kBAAkB;YAClB,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YAEnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YAE5E,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAA,6BAAe,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC/B,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,yBAAyB;oBAChC,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,6BAAe,EAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,yBAAyB;oBAChC,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,IAAI,IAAc,CAAC;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG;oBACL,EAAE,EAAE,aAAa;oBACjB,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,gCAAgC;gBACtD,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA9GD,8BA8GC"}

package/dist/guards/index.d.ts

@@ -0,0 +1,8 @@
+export * from './guard.interface.js';
+export * from './jwt.guard.js';
+export * from './api-key.guard.js';
+export * from './basic.guard.js';
+export * from './basic.js';
+export * from './hmac.guard.js';
+export * from '../certificates/mtls.guard.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC"}

package/dist/guards/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./guard.interface.js"), exports);
+__exportStar(require("./jwt.guard.js"), exports);
+__exportStar(require("./api-key.guard.js"), exports);
+__exportStar(require("./basic.guard.js"), exports);
+__exportStar(require("./basic.js"), exports);
+__exportStar(require("./hmac.guard.js"), exports);
+__exportStar(require("../certificates/mtls.guard.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,iDAA+B;AAC/B,qDAAmC;AACnC,mDAAiC;AACjC,6CAA2B;AAC3B,kDAAgC;AAChC,gEAA8C"}

package/dist/guards/jwt.guard.d.ts

@@ -0,0 +1,17 @@
+import { type JwtVerifyOptions } from '../tokens/jwt.js';
+import type { AuthGuard, AuthUser, GuardResult } from './guard.interface.js';
+import type { ArgosContext } from '@argos-js/net';
+export interface JwtGuardOptions extends Omit<JwtVerifyOptions, 'algorithms'> {
+    secretOrPublicKey: string | Buffer;
+    algorithms?: ('HS256' | 'RS256' | 'EdDSA')[];
+    header?: string;
+    tokenPrefix?: string;
+    userResolver?: (payload: any) => Promise<AuthUser | null> | AuthUser | null;
+}
+export declare class JwtGuard implements AuthGuard {
+    readonly name = "jwt";
+    private options;
+    constructor(options: JwtGuardOptions);
+    authenticate(ctx: ArgosContext): Promise<GuardResult>;
+}
+//# sourceMappingURL=jwt.guard.d.ts.map

package/dist/guards/jwt.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.guard.d.ts","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAC3E,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,UAAU,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;CAC7E;AAED,qBAAa,QAAS,YAAW,SAAS;IACxC,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,OAAO,CAAkB;gBAErB,OAAO,EAAE,eAAe;IAS9B,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CAgF5D"}

package/dist/guards/jwt.guard.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtGuard = void 0;
+const jwt_js_1 = require("../tokens/jwt.js");
+class JwtGuard {
+    name = 'jwt';
+    options;
+    constructor(options) {
+        this.options = {
+            header: 'authorization',
+            tokenPrefix: 'Bearer ',
+            algorithms: ['HS256'],
+            ...options,
+        };
+    }
+    async authenticate(ctx) {
+        const headerName = this.options.header.toLowerCase();
+        const rawHeader = typeof ctx.getHeader === 'function'
+            ? ctx.getHeader(headerName)
+            : ctx.headers?.[headerName];
+        if (!rawHeader) {
+            return {
+                authenticated: false,
+                error: 'Missing authorization header',
+                guard: this.name,
+            };
+        }
+        const prefix = this.options.tokenPrefix || 'Bearer ';
+        let token = rawHeader.trim();
+        if (token.toLowerCase().startsWith(prefix.toLowerCase())) {
+            token = token.slice(prefix.length).trim();
+        }
+        else if (this.options.tokenPrefix) {
+            return {
+                authenticated: false,
+                error: `Invalid authorization scheme. Expected ${prefix.trim()}`,
+                guard: this.name,
+            };
+        }
+        try {
+            const payload = await (0, jwt_js_1.verifyToken)(token, this.options.secretOrPublicKey, {
+                algorithms: this.options.algorithms,
+                issuer: this.options.issuer,
+                audience: this.options.audience,
+                clockTolerance: this.options.clockTolerance,
+                ignoreExpiration: this.options.ignoreExpiration,
+            });
+            let user;
+            if (this.options.userResolver) {
+                const resolved = await this.options.userResolver(payload);
+                if (!resolved) {
+                    return {
+                        authenticated: false,
+                        error: 'User not found or deactivated',
+                        guard: this.name,
+                    };
+                }
+                user = resolved;
+            }
+            else {
+                const id = (payload.sub ?? payload.id ?? payload.userId);
+                user = {
+                    id: id ?? 'anonymous',
+                    username: (payload.username ?? payload.name),
+                    email: payload.email,
+                    roles: Array.isArray(payload.roles) ? payload.roles : undefined,
+                    permissions: Array.isArray(payload.permissions) ? payload.permissions : undefined,
+                    scopes: Array.isArray(payload.scopes)
+                        ? payload.scopes
+                        : typeof payload.scope === 'string'
+                            ? payload.scope.split(' ')
+                            : undefined,
+                    ...payload,
+                };
+            }
+            return {
+                authenticated: true,
+                user,
+                guard: this.name,
+            };
+        }
+        catch (err) {
+            return {
+                authenticated: false,
+                error: err.message || 'Invalid token',
+                guard: this.name,
+            };
+        }
+    }
+}
+exports.JwtGuard = JwtGuard;
+//# sourceMappingURL=jwt.guard.js.map

package/dist/guards/jwt.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.guard.js","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":";;;AAAA,6CAAsE;AAYtE,MAAa,QAAQ;IACV,IAAI,GAAG,KAAK,CAAC;IACd,OAAO,CAAkB;IAEjC,YAAY,OAAwB;QAClC,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAiB;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAO,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3B,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,8BAA8B;gBACrC,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;QACrD,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACzD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,0CAA0C,MAAM,CAAC,IAAI,EAAE,EAAE;gBAChE,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,oBAAW,EAC/B,KAAK,EACL,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAC9B;gBACE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;gBACnC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC3C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;aAChD,CACF,CAAC;YAEF,IAAI,IAAc,CAAC;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,aAAa,EAAE,KAAK;wBACpB,KAAK,EAAE,+BAA+B;wBACtC,KAAK,EAAE,IAAI,CAAC,IAAI;qBACjB,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,QAAQ,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAoB,CAAC;gBAC5E,IAAI,GAAG;oBACL,EAAE,EAAE,EAAE,IAAI,WAAW;oBACrB,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAuB;oBAClE,KAAK,EAAE,OAAO,CAAC,KAA2B;oBAC1C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAkB,CAAC,CAAC,CAAC,SAAS;oBAC7E,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,WAAwB,CAAC,CAAC,CAAC,SAAS;oBAC/F,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;wBACnC,CAAC,CAAE,OAAO,CAAC,MAAmB;wBAC9B,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;4BACjC,CAAC,CAAE,OAAO,CAAC,KAAgB,CAAC,KAAK,CAAC,GAAG,CAAC;4BACtC,CAAC,CAAC,SAAS;oBACf,GAAG,OAAO;iBACX,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,eAAe;gBACrC,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA7FD,4BA6FC"}

package/dist/hasher/argon2-hasher.d.ts

@@ -0,0 +1,31 @@
+import type { Hasher } from './hasher.interface';
+export interface Argon2HasherOptions {
+    memoryCost?: number;
+    timeCost?: number;
+    parallelism?: number;
+    outputLen?: number;
+}
+/**
+ * Enterprise Argon2id password hasher.
+ * Utilizes native high-performance `@node-rs/argon2` or `argon2` if available,
+ * with graceful fallback to ScryptHasher if native binding is absent.
+ */
+export declare class Argon2Hasher implements Hasher {
+    readonly algorithm = "argon2id";
+    private nativeModule;
+    private readonly fallbackScrypt;
+    private readonly memoryCost;
+    private readonly timeCost;
+    private readonly parallelism;
+    private readonly outputLen;
+    constructor(options?: Argon2HasherOptions);
+    private detectModule;
+    /**
+     * Returns true if a native Argon2 engine is installed and loaded.
+     */
+    isAvailable(): boolean;
+    hash(password: string, customOptions?: Argon2HasherOptions): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string, customOptions?: Argon2HasherOptions): boolean;
+}
+//# sourceMappingURL=argon2-hasher.d.ts.map

package/dist/hasher/argon2-hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2-hasher.d.ts","sourceRoot":"","sources":["../../src/hasher/argon2-hasher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,SAAgB,SAAS,cAAc;IAEvC,OAAO,CAAC,YAAY,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,OAAO,GAAE,mBAAwB;IAS7C,OAAO,CAAC,YAAY;IAgBpB;;OAEG;IACI,WAAW,IAAI,OAAO;IAIhB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBhF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB9D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,GAAE,mBAAwB,GAAG,OAAO;CA6BnF"}

package/dist/hasher/argon2-hasher.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Argon2Hasher = void 0;
+const scrypt_hasher_1 = require("./scrypt-hasher");
+/**
+ * Enterprise Argon2id password hasher.
+ * Utilizes native high-performance `@node-rs/argon2` or `argon2` if available,
+ * with graceful fallback to ScryptHasher if native binding is absent.
+ */
+class Argon2Hasher {
+    algorithm = 'argon2id';
+    nativeModule = null;
+    fallbackScrypt = new scrypt_hasher_1.ScryptHasher();
+    memoryCost;
+    timeCost;
+    parallelism;
+    outputLen;
+    constructor(options = {}) {
+        this.memoryCost = options.memoryCost ?? 65536;
+        this.timeCost = options.timeCost ?? 3;
+        this.parallelism = options.parallelism ?? 4;
+        this.outputLen = options.outputLen ?? 32;
+        this.detectModule();
+    }
+    detectModule() {
+        try {
+            // 1. Try @node-rs/argon2 (NAPI-RS binding)
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            this.nativeModule = require('@node-rs/argon2');
+        }
+        catch {
+            try {
+                // 2. Try standard argon2 package
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                this.nativeModule = require('argon2');
+            }
+            catch {
+                this.nativeModule = null;
+            }
+        }
+    }
+    /**
+     * Returns true if a native Argon2 engine is installed and loaded.
+     */
+    isAvailable() {
+        return this.nativeModule !== null;
+    }
+    async hash(password, customOptions = {}) {
+        if (this.nativeModule) {
+            const memoryCost = customOptions.memoryCost ?? this.memoryCost;
+            const timeCost = customOptions.timeCost ?? this.timeCost;
+            const parallelism = customOptions.parallelism ?? this.parallelism;
+            const outputLen = customOptions.outputLen ?? this.outputLen;
+            if (typeof this.nativeModule.hash === 'function') {
+                return this.nativeModule.hash(password, {
+                    memoryCost,
+                    timeCost,
+                    parallelism,
+                    outputLen,
+                    algorithm: 2, // Argon2id
+                });
+            }
+        }
+        // Graceful fallback to Scrypt if Argon2 binding is not installed in environment
+        return this.fallbackScrypt.hash(password);
+    }
+    async verify(password, hash) {
+        if (!hash)
+            return false;
+        if (hash.startsWith('$argon2') && this.nativeModule) {
+            try {
+                if (typeof this.nativeModule.verify === 'function') {
+                    return await this.nativeModule.verify(hash, password);
+                }
+            }
+            catch {
+                return false;
+            }
+        }
+        if (hash.startsWith('$scrypt$')) {
+            return this.fallbackScrypt.verify(password, hash);
+        }
+        return false;
+    }
+    needsRehash(hash, customOptions = {}) {
+        if (!hash || !hash.startsWith('$argon2')) {
+            return true;
+        }
+        if (this.nativeModule && typeof this.nativeModule.needsRehash === 'function') {
+            const memoryCost = customOptions.memoryCost ?? this.memoryCost;
+            const timeCost = customOptions.timeCost ?? this.timeCost;
+            return this.nativeModule.needsRehash(hash, { memoryCost, timeCost });
+        }
+        // Inspect parameter string in PHC format: $argon2id$v=19$m=65536,t=3,p=4$...
+        const parts = hash.split('$');
+        const paramPart = parts.find((p) => p.includes('m='));
+        if (!paramPart)
+            return true;
+        let m = 0;
+        let t = 0;
+        for (const item of paramPart.split(',')) {
+            const [k, v] = item.split('=');
+            if (k === 'm')
+                m = parseInt(v, 10);
+            if (k === 't')
+                t = parseInt(v, 10);
+        }
+        const targetMemory = customOptions.memoryCost ?? this.memoryCost;
+        const targetTime = customOptions.timeCost ?? this.timeCost;
+        return m < targetMemory || t < targetTime;
+    }
+}
+exports.Argon2Hasher = Argon2Hasher;
+//# sourceMappingURL=argon2-hasher.js.map

package/dist/hasher/argon2-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2-hasher.js","sourceRoot":"","sources":["../../src/hasher/argon2-hasher.ts"],"names":[],"mappings":";;;AACA,mDAA+C;AAS/C;;;;GAIG;AACH,MAAa,YAAY;IACP,SAAS,GAAG,UAAU,CAAC;IAE/B,YAAY,GAAQ,IAAI,CAAC;IAChB,cAAc,GAAG,IAAI,4BAAY,EAAE,CAAC;IACpC,UAAU,CAAS;IACnB,QAAQ,CAAS;IACjB,WAAW,CAAS;IACpB,SAAS,CAAS;IAEnC,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAEzC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC;YACH,2CAA2C;YAC3C,8DAA8D;YAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,iCAAiC;gBACjC,8DAA8D;gBAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACI,WAAW;QAChB,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACpC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,gBAAqC,EAAE;QACzE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;YAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;YACzD,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC;YAClE,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;YAE5D,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACtC,UAAU;oBACV,QAAQ;oBACR,WAAW;oBACX,SAAS;oBACT,SAAS,EAAE,CAAC,EAAE,WAAW;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACnD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,WAAW,CAAC,IAAY,EAAE,gBAAqC,EAAE;QACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;YAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;YACzD,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;QACjE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QAE3D,OAAO,CAAC,GAAG,YAAY,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5C,CAAC;CACF;AAjHD,oCAiHC"}

package/dist/hasher/hasher.interface.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Common interface for password hashing engines.
+ */
+export interface Hasher {
+    /**
+     * Unique identifier for the algorithm (e.g. 'scrypt', 'argon2id', 'bcrypt').
+     */
+    readonly algorithm: string;
+    /**
+     * Hashes a plaintext password into a secure PHC formatted string.
+     */
+    hash(password: string, options?: Record<string, unknown>): Promise<string>;
+    /**
+     * Verifies a candidate password against an existing hash using timing-safe comparison.
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+    /**
+     * Determines if the hash was created with outdated parameters and requires re-hashing.
+     */
+    needsRehash(hash: string, options?: Record<string, unknown>): boolean;
+}
+//# sourceMappingURL=hasher.interface.d.ts.map

package/dist/hasher/hasher.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasher.interface.d.ts","sourceRoot":"","sources":["../../src/hasher/hasher.interface.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE3E;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CACvE"}

package/dist/hasher/hasher.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=hasher.interface.js.map

package/dist/hasher/hasher.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasher.interface.js","sourceRoot":"","sources":["../../src/hasher/hasher.interface.ts"],"names":[],"mappings":""}

package/dist/hasher/index.d.ts

@@ -0,0 +1,5 @@
+export * from './hasher.interface';
+export * from './scrypt-hasher';
+export * from './argon2-hasher';
+export * from './password-manager';
+//# sourceMappingURL=index.d.ts.map

package/dist/hasher/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hasher/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/hasher/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./hasher.interface"), exports);
+__exportStar(require("./scrypt-hasher"), exports);
+__exportStar(require("./argon2-hasher"), exports);
+__exportStar(require("./password-manager"), exports);
+//# sourceMappingURL=index.js.map

package/dist/hasher/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hasher/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,kDAAgC;AAChC,kDAAgC;AAChC,qDAAmC"}

package/dist/hasher/password-manager.d.ts

@@ -0,0 +1,52 @@
+import type { Hasher } from './hasher.interface';
+import { type ScryptHasherOptions } from './scrypt-hasher';
+import { type Argon2HasherOptions } from './argon2-hasher';
+export interface PasswordManagerOptions {
+    default?: 'argon2' | 'scrypt' | string;
+    scrypt?: ScryptHasherOptions;
+    argon2?: Argon2HasherOptions;
+}
+/**
+ * Unified Password Manager coordinating multi-algorithm hashing and verification.
+ * Automatically inspects stored hash prefixes ($argon2id$, $scrypt$, etc.) to verify
+ * without requiring the caller to specify which algorithm was used.
+ */
+export declare class PasswordManager {
+    private hashers;
+    private defaultAlgorithm;
+    constructor(options?: PasswordManagerOptions);
+    /**
+     * Registers a custom hasher implementation.
+     */
+    register(name: string, hasher: Hasher): this;
+    /**
+     * Hashes a password using the default or specified algorithm.
+     */
+    hash(password: string, algorithm?: string): Promise<string>;
+    /**
+     * Verifies a password against any supported stored hash format.
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+    /**
+     * Checks if the stored hash should be upgraded (e.g. algorithm migrated or cost increased).
+     */
+    needsRehash(hash: string): boolean;
+    /**
+     * Returns the name of the current default algorithm.
+     */
+    getDefaultAlgorithm(): string;
+}
+export declare const defaultPasswordManager: PasswordManager;
+/**
+ * Convenience helper: Hashes password using the default enterprise hasher.
+ */
+export declare function hashPassword(password: string, algorithm?: string): Promise<string>;
+/**
+ * Convenience helper: Verifies password against stored hash.
+ */
+export declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+/**
+ * Convenience helper: Checks if hash needs re-hashing.
+ */
+export declare function needsRehash(hash: string): boolean;
+//# sourceMappingURL=password-manager.d.ts.map

package/dist/hasher/password-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-manager.d.ts","sourceRoot":"","sources":["../../src/hasher/password-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACvC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,gBAAgB,CAAS;gBAErB,OAAO,GAAE,sBAA2B;IAiBhD;;OAEG;IACI,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAKnD;;OAEG;IACU,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWxE;;OAEG;IACU,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BrE;;OAEG;IACI,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAiBzC;;OAEG;IACI,mBAAmB,IAAI,MAAM;CAGrC;AAGD,eAAO,MAAM,sBAAsB,iBAAwB,CAAC;AAE5D;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAElF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/E;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD"}