@c9up/ream 0.2.2 → 0.2.4

package/dist/helpers/MessageBuilder.js

@@ -0,0 +1,63 @@
+/**
+ * Wrap a value with an expiry and a purpose before it is signed or encrypted.
+ *
+ * The signature on a token proves it was issued by this application. It does
+ * NOT prove the token is still valid, nor that it was issued for the job it is
+ * being presented for — a signed password-reset token would otherwise pass as a
+ * signed email-verification token. Those two claims travel inside the payload,
+ * which is why they are added before signing rather than checked after.
+ *
+ * Ported from `@poppinss/utils`; `CookieSigner` and `SignedUrl` sign what this
+ * produces.
+ */
+import { milliseconds } from './duration.js';
+export class MessageBuilder {
+    /**
+     * Serialise `message`, optionally stamped with an expiry and a purpose.
+     *
+     * @param expiresIn - a duration (`'2 hours'`) or a number of milliseconds.
+     */
+    build(message, expiresIn, purpose) {
+        const envelope = { message };
+        if (purpose !== undefined)
+            envelope.purpose = purpose;
+        if (expiresIn !== undefined) {
+            envelope.expiryDate = new Date(Date.now() + milliseconds.parse(expiresIn)).toISOString();
+        }
+        return JSON.stringify(envelope);
+    }
+    /**
+     * Read an envelope back, or `null` when it is malformed, expired, or was
+     * issued for a different purpose.
+     *
+     * Never throws: every failure is the same `null`, so a caller cannot
+     * accidentally tell "tampered" from "expired" and leak which it was.
+     */
+    verify(payload, purpose) {
+        let parsed;
+        try {
+            parsed = JSON.parse(payload);
+        }
+        catch {
+            return null;
+        }
+        if (parsed === null || typeof parsed !== 'object')
+            return null;
+        if (!('message' in parsed) || parsed.message === undefined)
+            return null;
+        const envelopePurpose = 'purpose' in parsed ? parsed.purpose : undefined;
+        if (envelopePurpose !== purpose)
+            return null;
+        if ('expiryDate' in parsed && typeof parsed.expiryDate === 'string') {
+            const expiresAt = new Date(parsed.expiryDate);
+            // An unparseable date counts as expired: a token whose expiry cannot be
+            // read is a token whose expiry cannot be enforced.
+            if (Number.isNaN(expiresAt.getTime()) || expiresAt <= new Date())
+                return null;
+        }
+        // The caller declares the shape it put in — the same contract as
+        // `session.get<T>()`, over a payload that is untyped by nature.
+        return parsed.message;
+    }
+}
+//# sourceMappingURL=MessageBuilder.js.map

package/dist/helpers/MessageBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageBuilder.js","sourceRoot":"","sources":["../../src/helpers/MessageBuilder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAS5C,MAAM,OAAO,cAAc;IACzB;;;;OAIG;IACH,KAAK,CAAC,OAAgB,EAAE,SAA2B,EAAE,OAAgB;QACnE,MAAM,QAAQ,GAAa,EAAE,OAAO,EAAE,CAAA;QACtC,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,OAAO,GAAG,OAAO,CAAA;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAc,OAAe,EAAE,OAAgB;QACnD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC9D,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAEvE,MAAM,eAAe,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACxE,IAAI,eAAe,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAE5C,IAAI,YAAY,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YAC7C,wEAAwE;YACxE,mDAAmD;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAA;QAC/E,CAAC;QAED,iEAAiE;QACjE,gEAAgE;QAChE,OAAO,MAAM,CAAC,OAAY,CAAA;IAC5B,CAAC;CACF"}

package/dist/helpers/VerificationToken.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The base class for opaque, single-use tokens — password resets, email
+ * verification, magic links.
+ *
+ * The shape it enforces is the point. The token handed to the user is
+ * `<identifier>.<secret>`, and only the SHA-256 of the secret is stored. A
+ * database leak therefore yields hashes, not usable tokens, and the identifier
+ * travels alongside so verification is one indexed lookup rather than a scan.
+ *
+ * Comparison goes through a constant-time equality: comparing hashes with `===`
+ * leaks their common prefix through timing, which is enough to forge one.
+ *
+ * Ported from `@adonisjs/core/helpers` — subclass it and add the persistence.
+ */
+import { Secret } from '../env/Secret.js';
+export declare abstract class VerificationToken {
+    /** Row identifier, as stored. */
+    identifier: string | number | bigint;
+    /** Who the token belongs to. */
+    tokenableId: string | number | bigint;
+    /** SHA-256 of the secret — the only half that is persisted. */
+    hash: string;
+    /** When the token stops being accepted. */
+    expiresAt: Date;
+    /** The full token, present only on the instance that just created it. */
+    value?: Secret<string>;
+    /**
+     * Split a presented token back into its identifier and secret.
+     *
+     * Returns `null` for anything malformed rather than throwing: the input is
+     * attacker-controlled, and every rejection should look the same.
+     */
+    static decode(value: string): {
+        identifier: string;
+        secret: Secret<string>;
+    } | null;
+    /** A fresh secret and its hash. */
+    static seed(size: number): {
+        secret: Secret<string>;
+        hash: string;
+    };
+    /** A seed plus the owner and an expiry, ready to be persisted. */
+    static createTransientToken(userId: string | number | bigint, size: number, expiresIn: string | number): {
+        userId: string | number | bigint;
+        expiresAt: Date;
+        secret: Secret<string>;
+        hash: string;
+    };
+    /** Build the public `<identifier>.<secret>` value, after the row has an id. */
+    protected computeValue(secret: Secret<string>): void;
+    /** Whether the expiry has passed. */
+    isExpired(): boolean;
+    /** Whether `secret` hashes to the stored hash, compared in constant time. */
+    verify(secret: Secret<string>): boolean;
+}
+//# sourceMappingURL=VerificationToken.d.ts.map

package/dist/helpers/VerificationToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerificationToken.d.ts","sourceRoot":"","sources":["../../src/helpers/VerificationToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAMzC,8BAAsB,iBAAiB;IACrC,iCAAiC;IACzB,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAC5C,gCAAgC;IACxB,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;IAC7C,+DAA+D;IACvD,IAAI,EAAE,MAAM,CAAA;IACpB,2CAA2C;IACnC,SAAS,EAAE,IAAI,CAAA;IACvB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI;IAUnF,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAQnE,kEAAkE;IAClE,MAAM,CAAC,oBAAoB,CACzB,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAChC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,MAAM,GACzB;QACD,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;QAChC,SAAS,EAAE,IAAI,CAAA;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACtB,IAAI,EAAE,MAAM,CAAA;KACb;IAMD,+EAA+E;IAC/E,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI;IAMpD,qCAAqC;IACrC,SAAS,IAAI,OAAO;IAIpB,6EAA6E;IAC7E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO;CAIxC"}

package/dist/helpers/VerificationToken.js

@@ -0,0 +1,70 @@
+/**
+ * The base class for opaque, single-use tokens — password resets, email
+ * verification, magic links.
+ *
+ * The shape it enforces is the point. The token handed to the user is
+ * `<identifier>.<secret>`, and only the SHA-256 of the secret is stored. A
+ * database leak therefore yields hashes, not usable tokens, and the identifier
+ * travels alongside so verification is one indexed lookup rather than a scan.
+ *
+ * Comparison goes through a constant-time equality: comparing hashes with `===`
+ * leaks their common prefix through timing, which is enough to forge one.
+ *
+ * Ported from `@adonisjs/core/helpers` — subclass it and add the persistence.
+ */
+import { createHash } from 'node:crypto';
+import { Secret } from '../env/Secret.js';
+import { base64 } from './base64.js';
+import { seconds } from './duration.js';
+import { safeEqual } from './safeEqual.js';
+import { random } from './string.js';
+export class VerificationToken {
+    /** The full token, present only on the instance that just created it. */
+    value;
+    /**
+     * Split a presented token back into its identifier and secret.
+     *
+     * Returns `null` for anything malformed rather than throwing: the input is
+     * attacker-controlled, and every rejection should look the same.
+     */
+    static decode(value) {
+        if (typeof value !== 'string' || value.length === 0)
+            return null;
+        const [identifier, ...rest] = value.split('.');
+        if (!identifier || rest.length === 0)
+            return null;
+        const decodedIdentifier = base64.urlDecode(identifier);
+        const decodedSecret = base64.urlDecode(rest.join('.'));
+        if (!decodedIdentifier || !decodedSecret)
+            return null;
+        return { identifier: decodedIdentifier, secret: new Secret(decodedSecret) };
+    }
+    /** A fresh secret and its hash. */
+    static seed(size) {
+        const secret = new Secret(random(size));
+        return {
+            secret,
+            hash: createHash('sha256').update(secret.release()).digest('hex'),
+        };
+    }
+    /** A seed plus the owner and an expiry, ready to be persisted. */
+    static createTransientToken(userId, size, expiresIn) {
+        const expiresAt = new Date();
+        expiresAt.setSeconds(expiresAt.getSeconds() + seconds.parse(expiresIn));
+        return { userId, expiresAt, ...VerificationToken.seed(size) };
+    }
+    /** Build the public `<identifier>.<secret>` value, after the row has an id. */
+    computeValue(secret) {
+        this.value = new Secret(`${base64.urlEncode(String(this.identifier))}.${base64.urlEncode(secret.release())}`);
+    }
+    /** Whether the expiry has passed. */
+    isExpired() {
+        return this.expiresAt < new Date();
+    }
+    /** Whether `secret` hashes to the stored hash, compared in constant time. */
+    verify(secret) {
+        const candidate = createHash('sha256').update(secret.release()).digest('hex');
+        return safeEqual(this.hash, candidate);
+    }
+}
+//# sourceMappingURL=VerificationToken.js.map

package/dist/helpers/VerificationToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VerificationToken.js","sourceRoot":"","sources":["../../src/helpers/VerificationToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,OAAgB,iBAAiB;IASrC,yEAAyE;IACzE,KAAK,CAAiB;IAEtB;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,KAAa;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACjD,MAAM,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,CAAC,iBAAiB,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAA;QACrD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,CAAA;IAC7E,CAAC;IAED,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,IAAY;QACtB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,OAAO;YACL,MAAM;YACN,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAClE,CAAA;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,oBAAoB,CACzB,MAAgC,EAChC,IAAY,EACZ,SAA0B;QAO1B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;QAC5B,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QACvE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC/D,CAAC;IAED,+EAA+E;IACrE,YAAY,CAAC,MAAsB;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CACrB,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CACrF,CAAA;IACH,CAAC;IAED,qCAAqC;IACrC,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;IACpC,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,MAAsB;QAC3B,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;CACF"}

package/dist/helpers/defineStaticProperty.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Give a subclass its own copy of an inherited static property.
+ *
+ * A static declared on a base class is SHARED: every subclass mutating
+ * `Model.booted` or `Model.$columns` writes into the same object. This walks
+ * that back by defining an own property on the subclass, seeded either from a
+ * fresh value or from a copy of what it inherited.
+ *
+ * Ported from `@poppinss/utils` — the mechanism ORM-style base classes rely on.
+ */
+export declare function defineStaticProperty<T>(target: object, propertyName: string, options: {
+    initialValue: T;
+    strategy: 'inherit' | 'define' | ((value: T) => T);
+}): void;
+//# sourceMappingURL=defineStaticProperty.d.ts.map

package/dist/helpers/defineStaticProperty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defineStaticProperty.d.ts","sourceRoot":"","sources":["../../src/helpers/defineStaticProperty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,YAAY,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;CAAE,GAC/E,IAAI,CAmBN"}

package/dist/helpers/defineStaticProperty.js

@@ -0,0 +1,47 @@
+/**
+ * Give a subclass its own copy of an inherited static property.
+ *
+ * A static declared on a base class is SHARED: every subclass mutating
+ * `Model.booted` or `Model.$columns` writes into the same object. This walks
+ * that back by defining an own property on the subclass, seeded either from a
+ * fresh value or from a copy of what it inherited.
+ *
+ * Ported from `@poppinss/utils` — the mechanism ORM-style base classes rely on.
+ */
+export function defineStaticProperty(target, propertyName, options) {
+    if (Object.hasOwn(target, propertyName))
+        return;
+    const inherited = Reflect.get(target, propertyName);
+    const { strategy, initialValue } = options;
+    const value = strategy === 'define' || inherited === undefined
+        ? initialValue
+        : typeof strategy === 'function'
+            ? strategy(inherited)
+            : structuredCloneOrCopy(inherited);
+    Object.defineProperty(target, propertyName, {
+        value,
+        configurable: true,
+        enumerable: true,
+        writable: true,
+    });
+}
+/**
+ * A deep copy where one is possible, a shallow one otherwise.
+ *
+ * `structuredClone` throws on functions and class instances, which a static
+ * bag can legitimately hold — falling back keeps the inherit strategy usable
+ * instead of failing at class-definition time.
+ */
+function structuredCloneOrCopy(value) {
+    try {
+        return structuredClone(value);
+    }
+    catch {
+        if (Array.isArray(value))
+            return [...value];
+        if (value !== null && typeof value === 'object')
+            return { ...value };
+        return value;
+    }
+}
+//# sourceMappingURL=defineStaticProperty.js.map

package/dist/helpers/defineStaticProperty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defineStaticProperty.js","sourceRoot":"","sources":["../../src/helpers/defineStaticProperty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,YAAoB,EACpB,OAAgF;IAEhF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC;QAAE,OAAM;IAE/C,MAAM,SAAS,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAC5D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAA;IAE1C,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS;QAC9C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,QAAQ,KAAK,UAAU;YAC9B,CAAC,CAAC,QAAQ,CAAC,SAAc,CAAC;YAC1B,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;IAExC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;QAC1C,KAAK;QACL,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;QAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/helpers/duration.d.ts

@@ -29,4 +29,24 @@ export declare function parseDurationMs(value: string): number | undefined;
  * @param label - what is being parsed, for the error message.
  */
 export declare function durationToSeconds(value: number | string, label: string): number;
+/**
+ * `string.milliseconds` — parse and format durations in milliseconds.
+ *
+ * A number passes through untouched, matching `@poppinss/string`.
+ */
+export declare const milliseconds: {
+    parse(duration: string | number): number;
+    format(value: number, long?: boolean): string;
+};
+/**
+ * `string.seconds` — the same, in seconds.
+ *
+ * `parse` keeps the AdonisJS quirk its own `durationToSeconds` documents: a
+ * NUMBER is already seconds and passes through, while a unit-less STRING is
+ * milliseconds and gets scaled down.
+ */
+export declare const seconds: {
+    parse(duration: string | number): number;
+    format(value: number, long?: boolean): string;
+};
 //# sourceMappingURL=duration.d.ts.map

package/dist/helpers/duration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../src/helpers/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAejE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS/E"}
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../src/helpers/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgBH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAejE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAS/E;AA8CD;;;;GAIG;AACH,eAAO,MAAM,YAAY;oBACP,MAAM,GAAG,MAAM,GAAG,MAAM;kBAG1B,MAAM,mBAAiB,MAAM;CAG5C,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,OAAO;oBACF,MAAM,GAAG,MAAM,GAAG,MAAM;kBAI1B,MAAM,mBAAiB,MAAM;CAG5C,CAAA"}

package/dist/helpers/duration.js

@@ -71,4 +71,75 @@ export function durationToSeconds(value, label) {
     }
     return Math.floor(milliseconds / SECOND);
 }
+/**
+ * Format a millisecond duration the way `@poppinss/string` does.
+ *
+ * Short form by default (`'2h'`), long form on request (`'2 hours'`).
+ */
+function formatMs(value, long) {
+    const table = long
+        ? [
+            [YEAR, 'year'],
+            [DAY, 'day'],
+            [HOUR, 'hour'],
+            [MINUTE, 'minute'],
+            [SECOND, 'second'],
+            [1, 'millisecond'],
+        ]
+        : [
+            [DAY, 'd'],
+            [HOUR, 'h'],
+            [MINUTE, 'm'],
+            [SECOND, 's'],
+            [1, 'ms'],
+        ];
+    const magnitude = Math.abs(value);
+    for (const [scale, label] of table) {
+        if (magnitude >= scale) {
+            const count = Math.round(value / scale);
+            return long ? `${count} ${label}${Math.abs(count) === 1 ? '' : 's'}` : `${count}${label}`;
+        }
+    }
+    return long ? `${value} milliseconds` : `${value}ms`;
+}
+/** The duration that could not be read, as one message shape for both objects. */
+function parseOrThrow(duration, unitLabel) {
+    if (typeof duration === 'number')
+        return duration;
+    const parsed = parseDurationMs(duration);
+    if (parsed === undefined) {
+        throw new Error(`Cannot read "${duration}" as ${unitLabel}. Use a number, or a duration such as '30m', '2 hours' or '7 days'.`);
+    }
+    return parsed;
+}
+/**
+ * `string.milliseconds` — parse and format durations in milliseconds.
+ *
+ * A number passes through untouched, matching `@poppinss/string`.
+ */
+export const milliseconds = {
+    parse(duration) {
+        return parseOrThrow(duration, 'milliseconds');
+    },
+    format(value, long = false) {
+        return formatMs(value, long);
+    },
+};
+/**
+ * `string.seconds` — the same, in seconds.
+ *
+ * `parse` keeps the AdonisJS quirk its own `durationToSeconds` documents: a
+ * NUMBER is already seconds and passes through, while a unit-less STRING is
+ * milliseconds and gets scaled down.
+ */
+export const seconds = {
+    parse(duration) {
+        if (typeof duration === 'number')
+            return duration;
+        return parseOrThrow(duration, 'seconds') / SECOND;
+    },
+    format(value, long = false) {
+        return formatMs(value * SECOND, long);
+    },
+};
 //# sourceMappingURL=duration.js.map

package/dist/helpers/duration.js.map

@@ -1 +1 @@
-{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/helpers/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,wKAAwK,CAAA;AAE1K,MAAM,MAAM,GAAG,IAAI,CAAA;AACnB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAA;AAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,EAAE,CAAA;AACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;AACrB,MAAM,IAAI,GAAG,GAAG,GAAG,MAAM,CAAA;AAEzB;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,MAAM,CAAA;IACpD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,MAAM,CAAA;IACpD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,IAAI,CAAA;IAClD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,GAAG,CAAA;IACjD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,GAAG,GAAG,CAAC,CAAA;IACrD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,IAAI,CAAA;IAClD,gEAAgE;IAChE,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB,EAAE,KAAa;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,QAAQ,KAAK,gFAAgF,CACnH,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/helpers/duration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,wKAAwK,CAAA;AAE1K,MAAM,MAAM,GAAG,IAAI,CAAA;AACnB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAA;AAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,EAAE,CAAA;AACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;AACrB,MAAM,IAAI,GAAG,GAAG,GAAG,MAAM,CAAA;AAEzB;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAClD,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,MAAM,CAAA;IACpD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,MAAM,CAAA;IACpD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,IAAI,CAAA;IAClD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,GAAG,CAAA;IACjD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,GAAG,GAAG,CAAC,CAAA;IACrD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,GAAG,IAAI,CAAA;IAClD,gEAAgE;IAChE,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAsB,EAAE,KAAa;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvD,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,QAAQ,KAAK,gFAAgF,CACnH,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAa;IAC5C,MAAM,KAAK,GAAuB,IAAI;QACpC,CAAC,CAAC;YACE,CAAC,IAAI,EAAE,MAAM,CAAC;YACd,CAAC,GAAG,EAAE,KAAK,CAAC;YACZ,CAAC,IAAI,EAAE,MAAM,CAAC;YACd,CAAC,MAAM,EAAE,QAAQ,CAAC;YAClB,CAAC,MAAM,EAAE,QAAQ,CAAC;YAClB,CAAC,CAAC,EAAE,aAAa,CAAC;SACnB;QACH,CAAC,CAAC;YACE,CAAC,GAAG,EAAE,GAAG,CAAC;YACV,CAAC,IAAI,EAAE,GAAG,CAAC;YACX,CAAC,MAAM,EAAE,GAAG,CAAC;YACb,CAAC,MAAM,EAAE,GAAG,CAAC;YACb,CAAC,CAAC,EAAE,IAAI,CAAC;SACV,CAAA;IACL,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAA;YACvC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,EAAE,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAA;AACtD,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,QAAyB,EAAE,SAAiB;IAChE,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACjD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,QAAQ,SAAS,qEAAqE,CAC/G,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,CAAC,QAAyB;QAC7B,OAAO,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,CAAC,KAAa,EAAE,IAAI,GAAG,KAAK;QAChC,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,KAAK,CAAC,QAAyB;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;QACjD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,CAAA;IACnD,CAAC;IACD,MAAM,CAAC,KAAa,EAAE,IAAI,GAAG,KAAK;QAChC,OAAO,QAAQ,CAAC,KAAK,GAAG,MAAM,EAAE,IAAI,CAAC,CAAA;IACvC,CAAC;CACF,CAAA"}

package/dist/helpers/fs.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Recursive directory reads, as `fsReadAll` / `fsImportAll` in AdonisJS.
+ *
+ * What the framework itself uses to discover config files, preloads and
+ * commands, and what an app reaches for to load a directory of modules.
+ */
+export interface ReadAllFilesOptions {
+    /** Keep only files this returns true for. Defaults to `.js`/`.ts` modules. */
+    filter?: (filePath: string, index: number) => boolean;
+    /** Sort the collected paths. Defaults to a stable alphabetical order. */
+    sort?: (current: string, next: string) => number;
+    /** Ignore directories whose name this returns true for. */
+    ignoreMissingRoot?: boolean;
+    /** Return absolute paths instead of paths relative to the root. */
+    absolute?: boolean;
+    /** Also descend into subdirectories. Defaults to true. */
+    recursive?: boolean;
+}
+/**
+ * Every file under `location`, relative to it and alphabetically sorted.
+ *
+ * A missing root throws unless `ignoreMissingRoot` is set — an app that
+ * declares no `config/` directory is legitimate, a typo in the path is not,
+ * and only the caller can tell them apart.
+ */
+export declare function fsReadAll(location: string | URL, options?: ReadAllFilesOptions): Promise<string[]>;
+export interface ImportAllFilesOptions extends ReadAllFilesOptions {
+    /** Turn a file path into the key it lands under. Defaults to the path minus its extension. */
+    transformKeys?: (key: string) => string;
+}
+/**
+ * Import every file under `location`, keyed by its path minus the extension.
+ *
+ * A module with a default export contributes that export; one without
+ * contributes its named exports as a plain object — the same rule the config
+ * loader follows, and for the same reason.
+ */
+export declare function fsImportAll(location: string | URL, options?: ImportAllFilesOptions): Promise<Record<string, unknown>>;
+//# sourceMappingURL=fs.d.ts.map

package/dist/helpers/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/helpers/fs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IACrD,yEAAyE;IACzE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAChD,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAKD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,GAAG,GAAG,EACtB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAwBnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,8FAA8F;IAC9F,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAA;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,GAAG,GAAG,EACtB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAWlC"}

package/dist/helpers/fs.js

@@ -0,0 +1,70 @@
+/**
+ * Recursive directory reads, as `fsReadAll` / `fsImportAll` in AdonisJS.
+ *
+ * What the framework itself uses to discover config files, preloads and
+ * commands, and what an app reaches for to load a directory of modules.
+ */
+import { readdir } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+const DEFAULT_FILTER = (filePath) => /\.(js|ts|mjs|cjs|mts|cts)$/.test(filePath) && !/\.d\.ts$/.test(filePath);
+/**
+ * Every file under `location`, relative to it and alphabetically sorted.
+ *
+ * A missing root throws unless `ignoreMissingRoot` is set — an app that
+ * declares no `config/` directory is legitimate, a typo in the path is not,
+ * and only the caller can tell them apart.
+ */
+export async function fsReadAll(location, options = {}) {
+    const root = location instanceof URL ? location.pathname : location;
+    const filter = options.filter ?? DEFAULT_FILTER;
+    const recursive = options.recursive ?? true;
+    let entries;
+    try {
+        entries = await readdir(root, { withFileTypes: true, recursive });
+    }
+    catch (error) {
+        if (options.ignoreMissingRoot && isMissing(error))
+            return [];
+        throw error;
+    }
+    const files = [];
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        // `parentPath` is where recursive readdir puts the containing directory.
+        const absolute = join(entry.parentPath ?? root, entry.name);
+        const value = options.absolute ? absolute : relative(root, absolute).split(sep).join('/');
+        files.push(value);
+    }
+    const kept = files.filter((file, index) => filter(file, index));
+    return options.sort ? kept.sort(options.sort) : kept.sort();
+}
+/**
+ * Import every file under `location`, keyed by its path minus the extension.
+ *
+ * A module with a default export contributes that export; one without
+ * contributes its named exports as a plain object — the same rule the config
+ * loader follows, and for the same reason.
+ */
+export async function fsImportAll(location, options = {}) {
+    const root = location instanceof URL ? location.pathname : location;
+    const files = await fsReadAll(root, options);
+    const collected = {};
+    for (const file of files) {
+        const key = (options.transformKeys ?? stripExtension)(file);
+        const module = await import(pathToFileURL(join(root, file)).href);
+        collected[key] = 'default' in module ? module.default : { ...module };
+    }
+    return collected;
+}
+function stripExtension(file) {
+    return file.replace(/\.(js|ts|mjs|cjs|mts|cts)$/, '');
+}
+function isMissing(error) {
+    return (error !== null &&
+        typeof error === 'object' &&
+        'code' in error &&
+        (error.code === 'ENOENT' || error.code === 'ENOTDIR'));
+}
+//# sourceMappingURL=fs.js.map

package/dist/helpers/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/helpers/fs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAexC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAW,EAAE,CACnD,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAsB,EACtB,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAA;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAE3C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAC5D,MAAM,KAAK,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAQ;QAC7B,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACzF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC/D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;AAC7D,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAsB,EACtB,UAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,SAAS,GAA4B,EAAE,CAAA;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,MAAM,GAA4B,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1F,SAAS,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAA;IACvE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,IAAI,KAAK;QACf,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CACtD,CAAA;AACH,CAAC"}

package/dist/helpers/index.d.ts

@@ -1,7 +1,15 @@
+export { Secret } from '../env/Secret.js';
 export { base64 } from './base64.js';
+export { defineStaticProperty } from './defineStaticProperty.js';
+export { milliseconds, seconds } from './duration.js';
+export type { ImportAllFilesOptions, ReadAllFilesOptions } from './fs.js';
+export { fsImportAll, fsReadAll } from './fs.js';
 export type * from './is.js';
 export { default as is } from './is.js';
+export { MessageBuilder } from './MessageBuilder.js';
 export { safeEqual } from './safeEqual.js';
+export { safeTiming } from './safeTiming.js';
 export { default as string } from './string.js';
 export type * from './types.js';
+export { VerificationToken } from './VerificationToken.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,mBAAmB,SAAS,CAAA;AAC5B,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AAC/C,mBAAmB,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACrD,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAChD,mBAAmB,SAAS,CAAA;AAC5B,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AAC/C,mBAAmB,YAAY,CAAA;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/helpers/index.js

@@ -1,5 +1,12 @@
+export { Secret } from '../env/Secret.js';
 export { base64 } from './base64.js';
+export { defineStaticProperty } from './defineStaticProperty.js';
+export { milliseconds, seconds } from './duration.js';
+export { fsImportAll, fsReadAll } from './fs.js';
 export { default as is } from './is.js';
+export { MessageBuilder } from './MessageBuilder.js';
 export { safeEqual } from './safeEqual.js';
+export { safeTiming } from './safeTiming.js';
 export { default as string } from './string.js';
+export { VerificationToken } from './VerificationToken.js';
 //# sourceMappingURL=index.js.map

package/dist/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/helpers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAEhD,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/helpers/safeTiming.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Run `callback`, never returning before `minimumMs` has elapsed.
+ *
+ * A login that answers in 3ms for an unknown address and 80ms for a known one
+ * tells an attacker which addresses exist, whatever the response body says.
+ * Holding every path to the same floor removes that signal.
+ *
+ * The callback can call `returnEarly()` to opt out — on a path where the timing
+ * carries nothing, waiting is pure latency.
+ */
+export declare function safeTiming<T>(minimumMs: number, callback: (timing: {
+    returnEarly(): void;
+}) => Promise<T>): Promise<T>;
+//# sourceMappingURL=safeTiming.d.ts.map

package/dist/helpers/safeTiming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeTiming.d.ts","sourceRoot":"","sources":["../../src/helpers/safeTiming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,MAAM,EAAE;IAAE,WAAW,IAAI,IAAI,CAAA;CAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GACxD,OAAO,CAAC,CAAC,CAAC,CA+BZ"}

package/dist/helpers/safeTiming.js

@@ -0,0 +1,42 @@
+/**
+ * Run `callback`, never returning before `minimumMs` has elapsed.
+ *
+ * A login that answers in 3ms for an unknown address and 80ms for a known one
+ * tells an attacker which addresses exist, whatever the response body says.
+ * Holding every path to the same floor removes that signal.
+ *
+ * The callback can call `returnEarly()` to opt out — on a path where the timing
+ * carries nothing, waiting is pure latency.
+ */
+export async function safeTiming(minimumMs, callback) {
+    const startedAt = performance.now();
+    let returnEarly = false;
+    let result;
+    let caught;
+    let threw = false;
+    try {
+        result = await callback({
+            returnEarly() {
+                returnEarly = true;
+            },
+        });
+    }
+    catch (error) {
+        caught = error;
+        threw = true;
+    }
+    // The floor applies to the failing path too: an error that comes back faster
+    // than a success is the same leak in the other direction.
+    if (!returnEarly) {
+        const remaining = minimumMs - (performance.now() - startedAt);
+        if (remaining > 0) {
+            await new Promise((resolve) => setTimeout(resolve, remaining));
+        }
+    }
+    if (threw)
+        throw caught;
+    // `result` is assigned whenever the callback returned, and we rethrew above
+    // when it did not.
+    return result;
+}
+//# sourceMappingURL=safeTiming.js.map

package/dist/helpers/safeTiming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeTiming.js","sourceRoot":"","sources":["../../src/helpers/safeTiming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,QAAyD;IAEzD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IACnC,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,IAAI,MAAqB,CAAA;IACzB,IAAI,MAAe,CAAA;IACnB,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC;YACtB,WAAW;gBACT,WAAW,GAAG,IAAI,CAAA;YACpB,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,KAAK,CAAA;QACd,KAAK,GAAG,IAAI,CAAA;IACd,CAAC;IAED,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAA;QAC7D,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IAED,IAAI,KAAK;QAAE,MAAM,MAAM,CAAA;IACvB,4EAA4E;IAC5E,mBAAmB;IACnB,OAAO,MAAW,CAAA;AACpB,CAAC"}