@c9up/warden 0.1.21 → 0.1.22

package/dist/native/generated.d.ts

@@ -0,0 +1,8 @@
+export declare function jwtSign(payload: string, secret: string): string;
+export declare function jwtVerify(token: string, secret: string): string;
+export declare function constantTimeEq(a: string, b: string): boolean;
+export declare function hmacSign(data: string, secret: string): string;
+export declare function hmacVerify(data: string, signature: string, secret: string): boolean;
+export declare function randomBytes(len: number): string;
+export declare function randomHex(len: number): string;
+//# sourceMappingURL=generated.d.ts.map

package/dist/native/generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../src/native/generated.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,OAAO,UAAU,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;AAEzE,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;AAEzE,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;AAEtE,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;AAEvE,MAAM,CAAC,OAAO,UAAU,UAAU,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;AAEX,MAAM,CAAC,OAAO,UAAU,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;AAEzD,MAAM,CAAC,OAAO,UAAU,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC"}

package/dist/native/generated.js

@@ -0,0 +1,7 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+export {};
+//# sourceMappingURL=generated.js.map

package/dist/native/generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.js","sourceRoot":"","sources":["../../src/native/generated.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,qEAAqE;AACrE,4DAA4D"}

package/dist/native.d.ts

@@ -1,12 +1,11 @@
-export interface NativeWarden {
-    jwtSign(payload: string, secret: string): string;
-    jwtVerify(token: string, secret: string): string;
-    constantTimeEq(a: string, b: string): boolean;
-    hmacSign(data: string, secret: string): string;
-    hmacVerify(data: string, signature: string, secret: string): boolean;
-    randomBytes(len: number): string;
-    randomHex(len: number): string;
-}
+/**
+ * The engine's surface, as the Rust declares it.
+ *
+ * Derived from `./native/generated.js` — written by `pnpm build:napi-types`
+ * from napi-derive's own `type-def` output — rather than restated here, where
+ * nothing would notice a `pub fn` gaining a parameter or changing its return.
+ */
+export type NativeWarden = typeof import("./native/generated.js");
 /** Whether the Rust NAPI engine loaded. */
 export declare function isNativeAvailable(): boolean;
 /** Get the native engine. Returns undefined if not loaded — caller must throw. */

package/dist/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,YAAY;IAC5B,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACrE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CAC/B;AAaD,2CAA2C;AAC3C,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,IAAI,YAAY,GAAG,SAAS,CAEvD"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,cAAc,uBAAuB,CAAC,CAAC;AAalE,2CAA2C;AAC3C,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,kFAAkF;AAClF,wBAAgB,YAAY,IAAI,YAAY,GAAG,SAAS,CAEvD"}

package/dist/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAYF,IAAI,MAAgC,CAAC;AAErC,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;AACF,CAAC;AAAC,MAAM,CAAC;IACR,kFAAkF;AACnF,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY;IAC3B,OAAO,MAAM,CAAC;AACf,CAAC"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3D,MAAM,WAAW,GAA2B;IAC3C,WAAW,EAAE,eAAe;IAC5B,aAAa,EAAE,iBAAiB;IAChC,YAAY,EAAE,YAAY;IAC1B,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,gBAAgB;CAC7B,CAAC;AAWF,IAAI,MAAgC,CAAC;AAErC,IAAI,CAAC;IACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,MAAM,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;AACF,CAAC;AAAC,MAAM,CAAC;IACR,kFAAkF;AACnF,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB;IAChC,OAAO,MAAM,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY;IAC3B,OAAO,MAAM,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",
@@ -82,7 +82,8 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "build:rust": "cargo build --release -p warden-engine-napi",
-    "build:napi": "pnpm build:rust && node scripts/copy-napi.mjs",
+    "build:napi": "pnpm build:rust && pnpm build:napi-types && node scripts/copy-napi.mjs",
+    "build:napi-types": "node scripts/build-napi-types.mjs",
     "test": "vitest run",
     "test:rust": "cargo test -p warden-engine",
     "lint": "biome check src/",

package/scripts/build-napi-types.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Regenerate `src/native/generated.ts` from the Rust.
+ *
+ * Node rather than a shell script because this runs inside `build:napi`, and
+ * that runs on the Windows prebuild runner too: a bash `mktemp` there hands
+ * cargo a `/tmp/...` path the native proc-macro cannot write to, so the
+ * type-def file comes back empty and the build fails for no visible reason.
+ *
+ * One crate at a time on purpose: napi-derive APPENDS to `TYPE_DEF_TMP_PATH`
+ * while cargo compiles, and a parallel build interleaves the writes —
+ * definitions go missing, silently, and the generated file comes out short.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const CRATES = ['warden-engine-napi']
+
+const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
+const output = join('src', 'native', 'generated.ts')
+const scratch = mkdtempSync(join(tmpdir(), 'napi-types-'))
+
+try {
+  const lines = []
+  for (const crate of CRATES) {
+    const perCrate = join(scratch, `${crate}.jsonl`)
+    writeFileSync(perCrate, '')
+    execFileSync('cargo', ['build', '-p', crate], {
+      cwd: packageRoot,
+      env: { ...process.env, TYPE_DEF_TMP_PATH: perCrate },
+      stdio: ['ignore', 'ignore', 'inherit'],
+    })
+    const emitted = readFileSync(perCrate, 'utf8').split('\n').filter(Boolean)
+    if (emitted.length === 0) {
+      throw new Error(
+        `[napi-types] ${crate} emitted nothing — is napi-derive's "type-def" feature on?`,
+      )
+    }
+    lines.push(...emitted)
+  }
+
+  const combined = join(scratch, 'combined.jsonl')
+  writeFileSync(combined, `${lines.join('\n')}\n`)
+
+  execFileSync(
+    process.execPath,
+    [join('scripts', 'generate-napi-types.mjs'), combined, output],
+    { cwd: packageRoot, stdio: 'inherit' },
+  )
+
+  // Formatted here rather than excluded from the linter: the file is checked
+  // in, so it should read like the rest of the tree — and formatting it at
+  // generation means it never shows up as a diff someone has to fix by hand.
+  // Resolved through the package entry rather than `node_modules/.bin`, whose
+  // shim is a shell script the Windows runner cannot execute directly.
+  const biome = createRequire(import.meta.url).resolve('@biomejs/biome/bin/biome')
+  execFileSync(process.execPath, [biome, 'format', '--write', output], {
+    cwd: packageRoot,
+    stdio: ['ignore', 'ignore', 'inherit'],
+  })
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}

package/scripts/generate-napi-types.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+/**
+ * Generate the TypeScript surface of the native module FROM the Rust.
+ *
+ * `napi-derive`'s `type-def` feature emits one JSON line per exported item
+ * while cargo compiles. Those lines are the source of truth: they are derived
+ * from the `#[napi]` items themselves, so a signature cannot drift from the
+ * Rust without this file changing.
+ *
+ * Hand-written interfaces are what this replaces, and they do drift — nothing
+ * on the TypeScript side notices when a `pub fn` gains a parameter or stops
+ * being `async`.
+ *
+ * One thing napi-rs cannot infer: the shape of a `JsFunction` callback. It
+ * emits `(...args: any[]) => any`. Any such parameter is refined below, by
+ * name, and the script fails if a refinement no longer matches anything — so
+ * the table cannot rot either.
+ *
+ *   TYPE_DEF_TMP_PATH=<file> cargo build -p <crate>
+ *   node scripts/generate-napi-types.mjs <file> <out.d.ts>
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+
+/**
+ * Callback signatures napi-rs erases to `any`, restored here.
+ *
+ * Keyed by `<owner>.<method>`; the value replaces the whole parameter. Every
+ * entry must match, or the script fails: a stale refinement is how a hand
+ * annotation quietly stops describing the Rust.
+ *
+ * Empty while this crate exposes no `JsFunction` parameter — add an entry the
+ * day one appears, rather than letting an `any` through.
+ */
+const CALLBACK_REFINEMENTS = {}
+
+const [input, output] = process.argv.slice(2)
+if (!input || !output) {
+  console.error('usage: generate-napi-types.mjs <type-def file> <out.d.ts>')
+  process.exit(2)
+}
+
+const entries = readFileSync(input, 'utf8')
+  .split('\n')
+  .map((l) => l.trim())
+  .filter(Boolean)
+  .map((l) => JSON.parse(l))
+
+const used = new Set()
+
+/** Apply the refinements that belong to `owner`, tracking which ones matched. */
+function refine(owner, body) {
+  let out = body
+  for (const [key, { from, to }] of Object.entries(CALLBACK_REFINEMENTS)) {
+    const [entryOwner] = key.split('.')
+    if (entryOwner !== owner) continue
+    if (out.includes(from)) {
+      out = out.replace(from, to)
+      used.add(key)
+    }
+  }
+  return out
+}
+
+/**
+ * JSDoc as emitted by napi-derive, indented to sit above its member.
+ *
+ * `*` followed by `/` inside the text closes the comment early — a Rust doc
+ * example holding a cron expression (`0 *​/5 * * *`) is enough to do it, and
+ * the generated file then fails to parse. Escaped rather than stripped, so the
+ * example still reads correctly.
+ */
+function docBlock(doc, indent = '') {
+  if (!doc) return ''
+  // Escape every `*/` EXCEPT the one that closes the block. A Rust doc example
+  // holding a cron expression (`0 */5 * * *`) closes the comment early
+  // otherwise, and the generated file stops parsing — but escaping the closer
+  // too breaks it just as thoroughly, whether the block spans one line or many.
+  const closer = doc.lastIndexOf('*/')
+  const escaped =
+    closer === -1
+      ? doc
+      : doc.slice(0, closer).replaceAll('*/', '*\\/') + doc.slice(closer)
+  return (
+    escaped
+      .split('\n')
+      .filter((l) => l.length > 0)
+      .map((l) => `${indent}${l}`)
+      .join('\n') + '\n'
+  )
+}
+
+const interfaces = entries.filter((e) => e.kind === 'interface')
+const structs = entries.filter((e) => e.kind === 'struct')
+const impls = new Map(entries.filter((e) => e.kind === 'impl').map((e) => [e.name, e]))
+const fns = entries.filter((e) => e.kind === 'fn')
+
+const out = [
+  '// GENERATED FROM THE RUST — do not edit.',
+  '//',
+  "// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def",
+  '// output. Editing this file by hand puts it back where it started: a',
+  '// description that can disagree with the code it describes.',
+  '',
+]
+
+for (const iface of interfaces) {
+  out.push(docBlock(iface.js_doc))
+  out.push(`export interface ${iface.name} {`)
+  for (const line of iface.def.split('\n')) {
+    out.push(line ? `  ${line.trim()}` : '')
+  }
+  out.push('}', '')
+}
+
+for (const struct of structs) {
+  const impl = impls.get(struct.name)
+  out.push(docBlock(struct.js_doc))
+  out.push(`export declare class ${struct.name} {`)
+  if (impl) {
+    for (const line of refine(struct.name, impl.def).split('\n')) {
+      out.push(line ? `  ${line.trim()}` : '')
+    }
+  }
+  out.push('}', '')
+}
+
+for (const fn of fns) {
+  out.push(docBlock(fn.js_doc))
+  // napi-derive emits the whole declaration for a function, unlike a struct
+  // where `def` holds only the members.
+  const declaration = fn.def.trim()
+  out.push(
+    declaration.startsWith('export declare function')
+      ? `${declaration};`
+      : `export declare function ${fn.name}${declaration};`,
+    '',
+  )
+}
+
+const stale = Object.keys(CALLBACK_REFINEMENTS).filter((k) => !used.has(k))
+if (stale.length > 0) {
+  console.error(
+    `[napi-types] refinement(s) that matched nothing: ${stale.join(', ')}\n` +
+      '[napi-types] the Rust changed under them — update or remove the entry.',
+  )
+  process.exit(1)
+}
+
+writeFileSync(output, out.join('\n'))
+console.log(
+  `[napi-types] ${output} — ${interfaces.length} interface(s), ${structs.length} class(es), ${fns.length} function(s)`,
+)

package/src/native/generated.ts

@@ -0,0 +1,23 @@
+// GENERATED FROM THE RUST — do not edit.
+//
+// Produced by scripts/generate-napi-types.mjs from napi-derive's type-def
+// output. Editing this file by hand puts it back where it started: a
+// description that can disagree with the code it describes.
+
+export declare function jwtSign(payload: string, secret: string): string;
+
+export declare function jwtVerify(token: string, secret: string): string;
+
+export declare function constantTimeEq(a: string, b: string): boolean;
+
+export declare function hmacSign(data: string, secret: string): string;
+
+export declare function hmacVerify(
+	data: string,
+	signature: string,
+	secret: string,
+): boolean;
+
+export declare function randomBytes(len: number): string;
+
+export declare function randomHex(len: number): string;

package/src/native.ts

@@ -21,15 +21,14 @@ const platformMap: Record<string, string> = {
 	"win32-x64": "win32-x64-msvc",
 };
 
-export interface NativeWarden {
-	jwtSign(payload: string, secret: string): string;
-	jwtVerify(token: string, secret: string): string;
-	constantTimeEq(a: string, b: string): boolean;
-	hmacSign(data: string, secret: string): string;
-	hmacVerify(data: string, signature: string, secret: string): boolean;
-	randomBytes(len: number): string;
-	randomHex(len: number): string;
-}
+/**
+ * The engine's surface, as the Rust declares it.
+ *
+ * Derived from `./native/generated.js` — written by `pnpm build:napi-types`
+ * from napi-derive's own `type-def` output — rather than restated here, where
+ * nothing would notice a `pub fn` gaining a parameter or changing its return.
+ */
+export type NativeWarden = typeof import("./native/generated.js");
 
 let native: NativeWarden | undefined;