@bajustone/fortress 1.0.0-rc.1

package/package.json

@@ -0,0 +1,398 @@
+{
+  "name": "@bajustone/fortress",
+  "version": "1.0.0-rc.1",
+  "description": "Framework-agnostic, adapter-based authentication and authorization library for TypeScript. Core auth (JWT, refresh tokens, password hashing) plus IAM (resource+action permissions, groups, roles) with a plugin system for OAuth, 2FA, tenancy, WebAuthn, magic links, audit logging, rate limiting, and more.",
+  "type": "module",
+  "module": "src/index.ts",
+  "main": "./dist/index.cjs",
+  "types": "./dist/index.d.ts",
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "bin": {
+    "fortress": "bin/fortress.ts"
+  },
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./fetcher": {
+      "import": {
+        "types": "./dist/fetcher.d.ts",
+        "default": "./dist/fetcher.js"
+      },
+      "require": {
+        "types": "./dist/fetcher.d.cts",
+        "default": "./dist/fetcher.cjs"
+      }
+    },
+    "./hono": {
+      "import": {
+        "types": "./dist/hono.d.ts",
+        "default": "./dist/hono.js"
+      },
+      "require": {
+        "types": "./dist/hono.d.cts",
+        "default": "./dist/hono.cjs"
+      }
+    },
+    "./sveltekit": {
+      "import": {
+        "types": "./dist/sveltekit.d.ts",
+        "default": "./dist/sveltekit.js"
+      },
+      "require": {
+        "types": "./dist/sveltekit.d.cts",
+        "default": "./dist/sveltekit.cjs"
+      }
+    },
+    "./drizzle": {
+      "import": {
+        "types": "./dist/drizzle.d.ts",
+        "default": "./dist/drizzle.js"
+      },
+      "require": {
+        "types": "./dist/drizzle.d.cts",
+        "default": "./dist/drizzle.cjs"
+      }
+    },
+    "./testing": {
+      "import": {
+        "types": "./dist/testing.d.ts",
+        "default": "./dist/testing.js"
+      },
+      "require": {
+        "types": "./dist/testing.d.cts",
+        "default": "./dist/testing.cjs"
+      }
+    },
+    "./crypto": {
+      "import": {
+        "types": "./dist/crypto.d.ts",
+        "default": "./dist/crypto.js"
+      },
+      "require": {
+        "types": "./dist/crypto.d.cts",
+        "default": "./dist/crypto.cjs"
+      }
+    },
+    "./jwt": {
+      "import": {
+        "types": "./dist/jwt.d.ts",
+        "default": "./dist/jwt.js"
+      },
+      "require": {
+        "types": "./dist/jwt.d.cts",
+        "default": "./dist/jwt.cjs"
+      }
+    },
+    "./otel": {
+      "import": {
+        "types": "./dist/otel.d.ts",
+        "default": "./dist/otel.js"
+      },
+      "require": {
+        "types": "./dist/otel.d.cts",
+        "default": "./dist/otel.cjs"
+      }
+    },
+    "./drizzle/pg": {
+      "import": {
+        "types": "./dist/drizzle/pg.d.ts",
+        "default": "./dist/drizzle/pg.js"
+      },
+      "require": {
+        "types": "./dist/drizzle/pg.d.cts",
+        "default": "./dist/drizzle/pg.cjs"
+      }
+    },
+    "./express": {
+      "import": {
+        "types": "./dist/express.d.ts",
+        "default": "./dist/express.js"
+      },
+      "require": {
+        "types": "./dist/express.d.cts",
+        "default": "./dist/express.cjs"
+      }
+    },
+    "./plugins/email-verification": {
+      "import": {
+        "types": "./dist/plugins/email-verification.d.ts",
+        "default": "./dist/plugins/email-verification.js"
+      },
+      "require": {
+        "types": "./dist/plugins/email-verification.d.cts",
+        "default": "./dist/plugins/email-verification.cjs"
+      }
+    },
+    "./plugins/api-key": {
+      "import": {
+        "types": "./dist/plugins/api-key.d.ts",
+        "default": "./dist/plugins/api-key.js"
+      },
+      "require": {
+        "types": "./dist/plugins/api-key.d.cts",
+        "default": "./dist/plugins/api-key.cjs"
+      }
+    },
+    "./plugins/two-factor": {
+      "import": {
+        "types": "./dist/plugins/two-factor.d.ts",
+        "default": "./dist/plugins/two-factor.js"
+      },
+      "require": {
+        "types": "./dist/plugins/two-factor.d.cts",
+        "default": "./dist/plugins/two-factor.cjs"
+      }
+    },
+    "./plugins/social-login": {
+      "import": {
+        "types": "./dist/plugins/social-login.d.ts",
+        "default": "./dist/plugins/social-login.js"
+      },
+      "require": {
+        "types": "./dist/plugins/social-login.d.cts",
+        "default": "./dist/plugins/social-login.cjs"
+      }
+    },
+    "./plugins/data-isolation": {
+      "import": {
+        "types": "./dist/plugins/data-isolation.d.ts",
+        "default": "./dist/plugins/data-isolation.js"
+      },
+      "require": {
+        "types": "./dist/plugins/data-isolation.d.cts",
+        "default": "./dist/plugins/data-isolation.cjs"
+      }
+    },
+    "./plugins/tenancy": {
+      "import": {
+        "types": "./dist/plugins/tenancy.d.ts",
+        "default": "./dist/plugins/tenancy.js"
+      },
+      "require": {
+        "types": "./dist/plugins/tenancy.d.cts",
+        "default": "./dist/plugins/tenancy.cjs"
+      }
+    },
+    "./plugins/oauth": {
+      "import": {
+        "types": "./dist/plugins/oauth.d.ts",
+        "default": "./dist/plugins/oauth.js"
+      },
+      "require": {
+        "types": "./dist/plugins/oauth.d.cts",
+        "default": "./dist/plugins/oauth.cjs"
+      }
+    },
+    "./plugins/rate-limit": {
+      "import": {
+        "types": "./dist/plugins/rate-limit.d.ts",
+        "default": "./dist/plugins/rate-limit.js"
+      },
+      "require": {
+        "types": "./dist/plugins/rate-limit.d.cts",
+        "default": "./dist/plugins/rate-limit.cjs"
+      }
+    },
+    "./plugins/rate-limit/hono": {
+      "import": {
+        "types": "./dist/plugins/rate-limit/hono.d.ts",
+        "default": "./dist/plugins/rate-limit/hono.js"
+      },
+      "require": {
+        "types": "./dist/plugins/rate-limit/hono.d.cts",
+        "default": "./dist/plugins/rate-limit/hono.cjs"
+      }
+    },
+    "./plugins/rate-limit/express": {
+      "import": {
+        "types": "./dist/plugins/rate-limit/express.d.ts",
+        "default": "./dist/plugins/rate-limit/express.js"
+      },
+      "require": {
+        "types": "./dist/plugins/rate-limit/express.d.cts",
+        "default": "./dist/plugins/rate-limit/express.cjs"
+      }
+    },
+    "./plugins/rate-limit/sveltekit": {
+      "import": {
+        "types": "./dist/plugins/rate-limit/sveltekit.d.ts",
+        "default": "./dist/plugins/rate-limit/sveltekit.js"
+      },
+      "require": {
+        "types": "./dist/plugins/rate-limit/sveltekit.d.cts",
+        "default": "./dist/plugins/rate-limit/sveltekit.cjs"
+      }
+    },
+    "./plugins/audit-log": {
+      "import": {
+        "types": "./dist/plugins/audit-log.d.ts",
+        "default": "./dist/plugins/audit-log.js"
+      },
+      "require": {
+        "types": "./dist/plugins/audit-log.d.cts",
+        "default": "./dist/plugins/audit-log.cjs"
+      }
+    },
+    "./plugins/account-lockout": {
+      "import": {
+        "types": "./dist/plugins/account-lockout.d.ts",
+        "default": "./dist/plugins/account-lockout.js"
+      },
+      "require": {
+        "types": "./dist/plugins/account-lockout.d.cts",
+        "default": "./dist/plugins/account-lockout.cjs"
+      }
+    },
+    "./plugins/webauthn": {
+      "import": {
+        "types": "./dist/plugins/webauthn.d.ts",
+        "default": "./dist/plugins/webauthn.js"
+      },
+      "require": {
+        "types": "./dist/plugins/webauthn.d.cts",
+        "default": "./dist/plugins/webauthn.cjs"
+      }
+    },
+    "./plugins/magic-link": {
+      "import": {
+        "types": "./dist/plugins/magic-link.d.ts",
+        "default": "./dist/plugins/magic-link.js"
+      },
+      "require": {
+        "types": "./dist/plugins/magic-link.d.cts",
+        "default": "./dist/plugins/magic-link.cjs"
+      }
+    },
+    "./plugins/webhook": {
+      "import": {
+        "types": "./dist/plugins/webhook.d.ts",
+        "default": "./dist/plugins/webhook.js"
+      },
+      "require": {
+        "types": "./dist/plugins/webhook.d.cts",
+        "default": "./dist/plugins/webhook.cjs"
+      }
+    },
+    "./plugins/openapi": {
+      "import": {
+        "types": "./dist/plugins/openapi.d.ts",
+        "default": "./dist/plugins/openapi.js"
+      },
+      "require": {
+        "types": "./dist/plugins/openapi.d.cts",
+        "default": "./dist/plugins/openapi.cjs"
+      }
+    },
+    "./plugins/admin": {
+      "import": {
+        "types": "./dist/plugins/admin.d.ts",
+        "default": "./dist/plugins/admin.js"
+      },
+      "require": {
+        "types": "./dist/plugins/admin.d.cts",
+        "default": "./dist/plugins/admin.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "docs",
+    "examples",
+    "migrations",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "dev": "bun run --watch examples/hono-app/index.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:integration": "vitest run --config vitest.integration.config.ts",
+    "typecheck": "tsc --noEmit",
+    "typecheck:examples": "tsc -p tsconfig.examples.json --noEmit",
+    "build": "tsup",
+    "version": "bun scripts/changelog.ts",
+    "changelog:dry-run": "bun scripts/changelog.ts --dry-run",
+    "check:version": "bun scripts/check-version-sync.ts",
+    "check:exports": "bun scripts/check-exports-parity.ts",
+    "check:testing-esm": "node scripts/check-testing-esm.mjs",
+    "check:release": "bun run check:version && bun run check:exports && bun run lint && bun run typecheck && bun run typecheck:examples && bun run test && bun run test:integration && bun run build && bun run check:testing-esm",
+    "publish:npm": "bun run check:release && npm publish --access public",
+    "publish:npm:next": "bun run check:release && npm publish --access public --tag next",
+    "publish:jsr": "bun run check:release && npx jsr publish",
+    "publish:jsr:dry": "bun run check:release && npx jsr publish --dry-run --allow-dirty",
+    "prepublishOnly": "bun run build && bun run check:exports && bun run check:testing-esm",
+    "prepare": "husky"
+  },
+  "devDependencies": {
+    "@antfu/eslint-config": "^8.0.0",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/context-async-hooks": "^2.9.0",
+    "@opentelemetry/sdk-metrics": "^2.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.9.0",
+    "@sveltejs/kit": "^2.0.0",
+    "@types/better-sqlite3": "^7.6.13",
+    "@types/bun": "^1.3.11",
+    "@types/express": "^5.0.6",
+    "@types/node": "^25.5.2",
+    "better-sqlite3": "^12.8.0",
+    "drizzle-orm": "^0.45.2",
+    "eslint": "^10.1.0",
+    "express": "^5.2.1",
+    "hono": "^4.12.10",
+    "husky": "^9.1.7",
+    "lint-staged": "^16.4.0",
+    "postgres": "^3.4.9",
+    "testcontainers": "^11.13.0",
+    "tsup": "^8.0.0",
+    "vitest": "^4.1.2"
+  },
+  "peerDependencies": {
+    "@opentelemetry/api": "^1.9.0",
+    "@sveltejs/kit": "^2.0.0",
+    "better-sqlite3": "^12.8.0",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.10",
+    "typescript": "^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@opentelemetry/api": {
+      "optional": true
+    },
+    "@sveltejs/kit": {
+      "optional": true
+    },
+    "better-sqlite3": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "hono": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@bajustone/fetcher": "^1.0.0",
+    "@simplewebauthn/server": "^13.1.1",
+    "hash-wasm": "^4.12.0",
+    "jose": "^6.2.2"
+  },
+  "lint-staged": {
+    "*.ts": "eslint --fix"
+  }
+}

package/src/adapters/database/index.ts

@@ -0,0 +1,63 @@
+import type { WhereClause } from './types';
+
+export type { CoreOperator, ScopeRule, WhereClause } from './types';
+
+/**
+ * Generic CRUD database adapter interface fortress uses to talk to any
+ * datastore. Implement seven required methods (create, findOne, findMany,
+ * update, delete, count, transaction) and optionally `rawQuery` for
+ * performance-critical multi-table operations.
+ */
+export interface DatabaseAdapter {
+  create: <T>(params: {
+    model: string;
+    data: Record<string, unknown>;
+  }) => Promise<T>;
+
+  findOne: <T>(params: {
+    model: string;
+    where: WhereClause[];
+  }) => Promise<T | null>;
+
+  findMany: <T>(params: {
+    model: string;
+    where?: WhereClause[];
+    limit?: number;
+    offset?: number;
+    sortBy?: { field: string; direction: 'asc' | 'desc' };
+  }) => Promise<T[]>;
+
+  /**
+   * Update rows matching the where clause.
+   * Returns the updated row, or null if no rows matched the where clause.
+   */
+  update: <T>(params: {
+    model: string;
+    where: WhereClause[];
+    data: Record<string, unknown>;
+  }) => Promise<T | null>;
+
+  delete: (params: {
+    model: string;
+    where: WhereClause[];
+  }) => Promise<void>;
+
+  count: (params: {
+    model: string;
+    where?: WhereClause[];
+  }) => Promise<number>;
+
+  transaction: <T>(fn: (tx: DatabaseAdapter) => Promise<T>) => Promise<T>;
+
+  /**
+   * Optional: raw query for performance-critical multi-table operations.
+   *  Adapters that implement this get optimized IAM queries.
+   *  Others fall back to multiple findMany calls.
+   *  @param sql SQL string using `?` positional placeholders on every dialect
+   *  @param params Positional parameters matching the `?` placeholders
+   */
+  rawQuery?: <T>(sql: string, params?: unknown[]) => Promise<T[]>;
+
+  /** Database dialect hint for adapters that implement rawQuery */
+  readonly dialect?: 'sqlite' | 'pg';
+}

package/src/adapters/database/types.ts

@@ -0,0 +1,22 @@
+/** Core operators that all DatabaseAdapter implementations MUST support */
+export type CoreOperator = '=' | '!=' | 'in' | 'gt' | 'lt' | 'gte' | 'lte' | 'isNull';
+
+/** A single condition in a database query, joined with AND by the adapter. */
+export interface WhereClause {
+  field: string;
+  /**
+   * Open string — core uses CoreOperator values.
+   *  Adapters MAY support additional operators: 'like', 'between', etc.
+   *  Adapters throw on unsupported operators at runtime.
+   */
+  operator: CoreOperator | (string & {});
+  value: unknown;
+}
+
+/** Scope rules for row-level data isolation */
+export interface ScopeRule {
+  /** WHERE clauses auto-injected on findOne, findMany, count, update, delete */
+  filters: WhereClause[];
+  /** Default values auto-injected on create (e.g., { siteId: 3 }) */
+  defaults: Record<string, unknown>;
+}

package/src/changelog-script.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { promoteUnreleased } from './internal/changelog';
+
+describe('promoteUnreleased', () => {
+  it('promotes the top section in place and retains curated notes', () => {
+    const input = '# Changelog\n\n## [Unreleased]\n\n### Fixed\n- curated fix\n\n### Changed\n- migration instructions\n\n## [0.2.8] - 2026-06-10\n';
+    const output = promoteUnreleased(input, '1.0.0-rc.2', '2026-07-15', '\n### Fixed\n- generated fix\n');
+
+    expect(output).toContain('## [1.0.0-rc.2] - 2026-07-15');
+    expect(output).toContain('### Fixed\n- curated fix\n\n- generated fix');
+    expect(output.match(/### Fixed/g)).toHaveLength(1);
+    expect(output).toContain('### Changed\n- migration instructions');
+    expect(output.indexOf('[1.0.0-rc.2]')).toBeLessThan(output.indexOf('[0.2.8]'));
+    expect(output).not.toContain('[Unreleased]');
+  });
+
+  it('refuses to promote a historical or missing Unreleased section', () => {
+    const malformed = '# Changelog\n\n## [0.2.8] - 2026-06-10\n\n## [Unreleased]\n';
+    expect(() => promoteUnreleased(malformed, '1.0.0', '2026-07-15')).toThrow('first release section');
+  });
+});

package/src/cli.test.ts

@@ -0,0 +1,79 @@
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const CLI_PATH = fileURLToPath(new URL('../bin/fortress.ts', import.meta.url));
+const RUNTIME_ERROR_RE = /(?:TypeError|ReferenceError|SyntaxError):/;
+
+interface CommandCase {
+  name: string;
+  args: string[];
+  expectedStatus?: number;
+  output?: string;
+}
+
+function runCli(cwd: string, args: string[]): ReturnType<typeof spawnSync> {
+  return spawnSync('bun', [CLI_PATH, ...args], {
+    cwd,
+    encoding: 'utf8',
+    env: { ...process.env, NO_COLOR: '1' },
+  });
+}
+
+describe('fortress CLI smoke tests', () => {
+  let cwd: string;
+
+  beforeAll(() => {
+    cwd = mkdtempSync(join(tmpdir(), 'fortress-cli-'));
+  });
+
+  afterAll(() => {
+    rmSync(cwd, { recursive: true, force: true });
+  });
+
+  it('invokes every documented command without an uncaught runtime error', () => {
+    expect(runCli(cwd, ['init']).status).toBe(0);
+    writeFileSync(join(cwd, 'fortress.policy.json'), '{}');
+
+    const commands: CommandCase[] = [
+      { name: 'help', args: ['--help'] },
+      { name: 'sync:push', args: ['sync:push'] },
+      { name: 'sync:pull', args: ['sync:pull'] },
+      { name: 'sync:types', args: ['sync:types'] },
+      { name: 'generate-secret', args: ['generate-secret'] },
+      { name: 'openapi', args: ['openapi', '--out', 'openapi.json'], output: 'openapi.json' },
+      { name: 'schemas json-schema', args: ['schemas', '--format', 'json-schema', '--out', 'schemas.json'], output: 'schemas.json' },
+      { name: 'schemas zod', args: ['schemas', '--format', 'zod', '--out', 'schemas.ts'], output: 'schemas.ts' },
+      { name: 'manifest', args: ['manifest', '--out', 'manifest.json'], output: 'manifest.json' },
+      { name: 'manifest:check', args: ['manifest:check'] },
+      { name: 'check:routes', args: ['check:routes'] },
+      { name: 'check:public-routes', args: ['check:public-routes'] },
+      { name: 'policy:summary', args: ['policy:summary'] },
+      { name: 'policy:diff', args: ['policy:diff'] },
+      { name: 'policy:apply', args: ['policy:apply'] },
+      { name: 'policy:check', args: ['policy:check'] },
+      { name: 'migrate:status sqlite', args: ['migrate:status', '--dialect', 'sqlite', '--out', 'migration-status.json'], output: 'migration-status.json' },
+      { name: 'migrate:status pg', args: ['migrate:status', '--dialect', 'pg'] },
+      // Unicode canonicalization requires the runtime migration hook, so SQL
+      // export intentionally fails closed with a controlled diagnostic.
+      { name: 'migrate:up', args: ['migrate:up'], expectedStatus: 1 },
+      { name: 'migrate:down', args: ['migrate:down', '--out', 'down.sql'], output: 'down.sql' },
+      { name: 'migrate:diff', args: ['migrate:diff'] },
+      { name: 'migrate:check', args: ['migrate:check'] },
+      { name: 'check:migrations', args: ['check:migrations', '--dialect', 'pg'] },
+    ];
+
+    for (const command of commands) {
+      const result = runCli(cwd, command.args);
+      const diagnostic = `${result.stdout ?? ''}\n${result.stderr ?? ''}`;
+      expect(result.error, command.name).toBeUndefined();
+      expect(result.status, `${command.name}: ${diagnostic}`).toBe(command.expectedStatus ?? 0);
+      expect(diagnostic, command.name).not.toMatch(RUNTIME_ERROR_RE);
+      if (command.output)
+        expect(readFileSync(join(cwd, command.output), 'utf8').length, command.name).toBeGreaterThan(0);
+    }
+  }, 30_000);
+});