@bajustone/fortress 1.0.0-rc.1

package/dist/convert-routes-BLCQT57f.d.ts

@@ -0,0 +1,72 @@
+import { J as JSONSchema, E as EndpointDefinition } from './config-B2366s_G.js';
+
+/**
+ * Convert external route definitions (e.g., from @hono/zod-openapi createRoute)
+ * into Fortress EndpointDefinitions.
+ *
+ * Schema-library agnostic — the user provides a converter function
+ * that turns their schema objects into JSON Schema.
+ *
+ * @example
+ * ```ts
+ * import { z } from 'zod';
+ * import { convertRoutes } from '@bajustone/fortress/hono';
+ * import { loginRoute, listUsersRoute } from './modules/auth/routes';
+ *
+ * const endpoints = convertRoutes(
+ *   [loginRoute, listUsersRoute],
+ *   { prefix: '/api/v1/auth', schemaConverter: z.toJSONSchema },
+ * );
+ * ```
+ */
+
+/** A function that converts a schema object (Zod, Valibot, etc.) to JSON Schema. */
+type ToJSONSchemaConverter = (schema: unknown) => JSONSchema;
+/**
+ * Generic route shape matching what `createRoute` from `@hono/zod-openapi` returns.
+ * No dependency on any specific framework or schema library.
+ */
+interface ExternalRoute {
+    method: string;
+    path: string;
+    tags?: string[];
+    summary?: string;
+    description?: string;
+    deprecated?: boolean;
+    security?: Array<Record<string, string[]>>;
+    request?: {
+        body?: {
+            content: {
+                'application/json': {
+                    schema: unknown;
+                };
+            };
+        };
+        params?: unknown;
+        query?: unknown;
+    };
+    responses: Record<number | string, {
+        description: string;
+        content?: {
+            'application/json': {
+                schema: unknown;
+            };
+        };
+    }>;
+}
+/** Options accepted by {@link convertRoutes}. */
+interface ConvertRoutesOptions {
+    /** Convert your schema objects to JSON Schema (e.g., `z.toJSONSchema` for Zod v4). */
+    schemaConverter: ToJSONSchemaConverter;
+    /** Path prefix to prepend (e.g., '/api/v1/auth'). */
+    prefix?: string;
+}
+/**
+ * Convert an array of external route definitions into Fortress EndpointDefinitions.
+ *
+ * The `schemaConverter` is called for every schema object encountered in request/response
+ * definitions. Fortress never imports or depends on your schema library.
+ */
+declare function convertRoutes(routes: ExternalRoute[], options: ConvertRoutesOptions): EndpointDefinition[];
+
+export { type ConvertRoutesOptions as C, type ExternalRoute as E, type ToJSONSchemaConverter as T, convertRoutes as c };

package/dist/convert-routes-BdMvP2_X.d.cts

@@ -0,0 +1,72 @@
+import { J as JSONSchema, E as EndpointDefinition } from './config-GtlVt6ZD.cjs';
+
+/**
+ * Convert external route definitions (e.g., from @hono/zod-openapi createRoute)
+ * into Fortress EndpointDefinitions.
+ *
+ * Schema-library agnostic — the user provides a converter function
+ * that turns their schema objects into JSON Schema.
+ *
+ * @example
+ * ```ts
+ * import { z } from 'zod';
+ * import { convertRoutes } from '@bajustone/fortress/hono';
+ * import { loginRoute, listUsersRoute } from './modules/auth/routes';
+ *
+ * const endpoints = convertRoutes(
+ *   [loginRoute, listUsersRoute],
+ *   { prefix: '/api/v1/auth', schemaConverter: z.toJSONSchema },
+ * );
+ * ```
+ */
+
+/** A function that converts a schema object (Zod, Valibot, etc.) to JSON Schema. */
+type ToJSONSchemaConverter = (schema: unknown) => JSONSchema;
+/**
+ * Generic route shape matching what `createRoute` from `@hono/zod-openapi` returns.
+ * No dependency on any specific framework or schema library.
+ */
+interface ExternalRoute {
+    method: string;
+    path: string;
+    tags?: string[];
+    summary?: string;
+    description?: string;
+    deprecated?: boolean;
+    security?: Array<Record<string, string[]>>;
+    request?: {
+        body?: {
+            content: {
+                'application/json': {
+                    schema: unknown;
+                };
+            };
+        };
+        params?: unknown;
+        query?: unknown;
+    };
+    responses: Record<number | string, {
+        description: string;
+        content?: {
+            'application/json': {
+                schema: unknown;
+            };
+        };
+    }>;
+}
+/** Options accepted by {@link convertRoutes}. */
+interface ConvertRoutesOptions {
+    /** Convert your schema objects to JSON Schema (e.g., `z.toJSONSchema` for Zod v4). */
+    schemaConverter: ToJSONSchemaConverter;
+    /** Path prefix to prepend (e.g., '/api/v1/auth'). */
+    prefix?: string;
+}
+/**
+ * Convert an array of external route definitions into Fortress EndpointDefinitions.
+ *
+ * The `schemaConverter` is called for every schema object encountered in request/response
+ * definitions. Fortress never imports or depends on your schema library.
+ */
+declare function convertRoutes(routes: ExternalRoute[], options: ConvertRoutesOptions): EndpointDefinition[];
+
+export { type ConvertRoutesOptions as C, type ExternalRoute as E, type ToJSONSchemaConverter as T, convertRoutes as c };

package/dist/crypto.cjs

@@ -0,0 +1,61 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/auth/password.ts
+var password_exports = {};
+__export(password_exports, {
+  createDefaultHasher: () => createDefaultHasher,
+  normalizePasswordInput: () => normalizePasswordInput
+});
+module.exports = __toCommonJS(password_exports);
+var import_hash_wasm = require("hash-wasm");
+function normalizePasswordInput(password) {
+  return password.normalize("NFKC");
+}
+function createDefaultHasher() {
+  return {
+    async hash(password) {
+      const normalizedPassword = normalizePasswordInput(password);
+      const salt = new Uint8Array(16);
+      crypto.getRandomValues(salt);
+      return (0, import_hash_wasm.argon2id)({
+        password: normalizedPassword,
+        salt,
+        parallelism: 1,
+        iterations: 3,
+        memorySize: 65536,
+        // 64 MB
+        hashLength: 32,
+        outputType: "encoded"
+      });
+    },
+    async verify(hash, password) {
+      try {
+        return await (0, import_hash_wasm.argon2Verify)({ hash, password: normalizePasswordInput(password) });
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createDefaultHasher,
+  normalizePasswordInput
+});

package/dist/crypto.d.cts

@@ -0,0 +1,36 @@
+export { P as PasswordHasher } from './config-GtlVt6ZD.cjs';
+import './index-CxEkfCA0.cjs';
+import './jwt.cjs';
+import './types-et0R8tsC.cjs';
+import './auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Password hashing primitives for fortress.
+ *
+ * Exports {@link createDefaultHasher}, a WASM-based Argon2id `PasswordHasher`
+ * that works across every runtime fortress targets (Bun, Deno, Node, Cloudflare
+ * Workers, Vercel Edge). Consumers can drop in a faster native hasher
+ * (`@node-rs/argon2`, `Bun.password`) by implementing the `PasswordHasher`
+ * contract and passing it to `createFortress({ passwordHasher })`.
+ *
+ * @module
+ */
+
+/**
+ * Canonicalize password input before policy checks, breach checks, hashing,
+ * and verification. NFKC collapses visually/confusably equivalent Unicode
+ * forms (for example full-width ASCII) so users are not locked out by input
+ * method differences.
+ */
+declare function normalizePasswordInput(password: string): string;
+/**
+ * Default PasswordHasher using WASM-based Argon2id.
+ * Works across all runtimes (Bun, Deno, Node, edge).
+ * Consumers can swap for @node-rs/argon2 or Bun.password for native speed.
+ */
+declare function createDefaultHasher(): {
+    hash: (password: string) => Promise<string>;
+    verify: (hash: string, password: string) => Promise<boolean>;
+};
+
+export { createDefaultHasher, normalizePasswordInput };

package/dist/crypto.d.ts

@@ -0,0 +1,36 @@
+export { P as PasswordHasher } from './config-B2366s_G.js';
+import './index-CxEkfCA0.js';
+import './jwt.js';
+import './types-et0R8tsC.js';
+import './auth-service-BkzZkWfH.js';
+
+/**
+ * Password hashing primitives for fortress.
+ *
+ * Exports {@link createDefaultHasher}, a WASM-based Argon2id `PasswordHasher`
+ * that works across every runtime fortress targets (Bun, Deno, Node, Cloudflare
+ * Workers, Vercel Edge). Consumers can drop in a faster native hasher
+ * (`@node-rs/argon2`, `Bun.password`) by implementing the `PasswordHasher`
+ * contract and passing it to `createFortress({ passwordHasher })`.
+ *
+ * @module
+ */
+
+/**
+ * Canonicalize password input before policy checks, breach checks, hashing,
+ * and verification. NFKC collapses visually/confusably equivalent Unicode
+ * forms (for example full-width ASCII) so users are not locked out by input
+ * method differences.
+ */
+declare function normalizePasswordInput(password: string): string;
+/**
+ * Default PasswordHasher using WASM-based Argon2id.
+ * Works across all runtimes (Bun, Deno, Node, edge).
+ * Consumers can swap for @node-rs/argon2 or Bun.password for native speed.
+ */
+declare function createDefaultHasher(): {
+    hash: (password: string) => Promise<string>;
+    verify: (hash: string, password: string) => Promise<boolean>;
+};
+
+export { createDefaultHasher, normalizePasswordInput };

package/dist/crypto.js

@@ -0,0 +1,35 @@
+// src/core/auth/password.ts
+import { argon2id, argon2Verify } from "hash-wasm";
+function normalizePasswordInput(password) {
+  return password.normalize("NFKC");
+}
+function createDefaultHasher() {
+  return {
+    async hash(password) {
+      const normalizedPassword = normalizePasswordInput(password);
+      const salt = new Uint8Array(16);
+      crypto.getRandomValues(salt);
+      return argon2id({
+        password: normalizedPassword,
+        salt,
+        parallelism: 1,
+        iterations: 3,
+        memorySize: 65536,
+        // 64 MB
+        hashLength: 32,
+        outputType: "encoded"
+      });
+    },
+    async verify(hash, password) {
+      try {
+        return await argon2Verify({ hash, password: normalizePasswordInput(password) });
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+export {
+  createDefaultHasher,
+  normalizePasswordInput
+};

package/dist/drift-BT1wtMDJ.d.cts

@@ -0,0 +1,22 @@
+import { O as OpenAPISpec } from './index-D054pcb-.cjs';
+import { R as RouteManifestEntry, F as Fortress } from './fortress-BmSvFfqK.cjs';
+
+interface RouteManifestDrift {
+    mountedMissingFromManifest: string[];
+    manifestMissingFromMounted: string[];
+    openapiMissingFromManifest: string[];
+    manifestMissingFromOpenapi: string[];
+    rbacPermissionMismatches: Array<{
+        route: string;
+        expected?: string;
+        actual?: string;
+    }>;
+}
+interface DetectRouteManifestDriftOptions {
+    manifest?: RouteManifestEntry[];
+    openapi?: OpenAPISpec;
+}
+declare function detectRouteManifestDrift(fortress: Pick<Fortress, 'endpoints' | 'config' | 'manifest'>, options?: DetectRouteManifestDriftOptions): RouteManifestDrift;
+declare function hasRouteManifestDrift(drift: RouteManifestDrift): boolean;
+
+export { type DetectRouteManifestDriftOptions as D, type RouteManifestDrift as R, detectRouteManifestDrift as d, hasRouteManifestDrift as h };

package/dist/drift-k9LiYpRP.d.ts

@@ -0,0 +1,22 @@
+import { O as OpenAPISpec } from './index-jAMbbUAY.js';
+import { R as RouteManifestEntry, F as Fortress } from './fortress-uA-_cheR.js';
+
+interface RouteManifestDrift {
+    mountedMissingFromManifest: string[];
+    manifestMissingFromMounted: string[];
+    openapiMissingFromManifest: string[];
+    manifestMissingFromOpenapi: string[];
+    rbacPermissionMismatches: Array<{
+        route: string;
+        expected?: string;
+        actual?: string;
+    }>;
+}
+interface DetectRouteManifestDriftOptions {
+    manifest?: RouteManifestEntry[];
+    openapi?: OpenAPISpec;
+}
+declare function detectRouteManifestDrift(fortress: Pick<Fortress, 'endpoints' | 'config' | 'manifest'>, options?: DetectRouteManifestDriftOptions): RouteManifestDrift;
+declare function hasRouteManifestDrift(drift: RouteManifestDrift): boolean;
+
+export { type DetectRouteManifestDriftOptions as D, type RouteManifestDrift as R, detectRouteManifestDrift as d, hasRouteManifestDrift as h };