@fuzdev/fuz_app 0.1.0

package/dist/auth/invite_queries.js

@@ -0,0 +1,105 @@
+/**
+ * Invite database queries.
+ *
+ * CRUD operations for the invite table — creating invites,
+ * finding unclaimed matches, claiming, and cleanup.
+ *
+ * @module
+ */
+import { assert_row } from '../db/assert_row.js';
+/**
+ * Create a new invite.
+ *
+ * @param deps - query dependencies
+ * @param input - the invite fields
+ * @returns the created invite
+ */
+export const query_create_invite = async (deps, input) => {
+    const row = await deps.db.query_one(`INSERT INTO invite (email, username, created_by)
+		 VALUES ($1, $2, $3)
+		 RETURNING *`, [input.email ?? null, input.username ?? null, input.created_by]);
+    return assert_row(row, 'INSERT INTO invite');
+};
+/**
+ * Find an unclaimed invite by email (case-insensitive).
+ */
+export const query_invite_find_unclaimed_by_email = async (deps, email) => {
+    return deps.db.query_one(`SELECT * FROM invite WHERE LOWER(email) = LOWER($1) AND claimed_at IS NULL`, [email]);
+};
+/**
+ * Find an unclaimed invite by username (case-insensitive).
+ */
+export const query_invite_find_unclaimed_by_username = async (deps, username) => {
+    return deps.db.query_one(`SELECT * FROM invite WHERE LOWER(username) = LOWER($1) AND claimed_at IS NULL`, [username]);
+};
+/**
+ * Find an unclaimed invite matching email and/or username using three scoping modes:
+ *
+ * - **Email-only invite** (email set, username NULL) → matches only if signup provides matching email.
+ * - **Username-only invite** (username set, email NULL) → matches only if signup provides matching username.
+ * - **Both-field invite** (both set) → requires BOTH email and username to match.
+ *
+ * @param deps - query dependencies
+ * @param email - email to match (or null if signup provides none)
+ * @param username - username to match
+ * @returns the matching invite, or `undefined`
+ */
+export const query_invite_find_unclaimed_match = async (deps, email, username) => {
+    return deps.db.query_one(`SELECT * FROM invite WHERE claimed_at IS NULL AND (
+			(email IS NOT NULL AND username IS NULL
+			 AND $1::text IS NOT NULL AND LOWER(email) = LOWER($1::text))
+			OR
+			(username IS NOT NULL AND email IS NULL
+			 AND LOWER(username) = LOWER($2))
+			OR
+			(email IS NOT NULL AND username IS NOT NULL
+			 AND $1::text IS NOT NULL AND LOWER(email) = LOWER($1::text)
+			 AND LOWER(username) = LOWER($2))
+		) ORDER BY created_at ASC, id ASC LIMIT 1`, [email, username]);
+};
+/**
+ * Claim an invite by setting the claimed_by and claimed_at fields.
+ *
+ * @param deps - query dependencies
+ * @param invite_id - the invite to claim
+ * @param account_id - the account claiming the invite
+ * @returns true if the invite was claimed, false if already claimed or not found
+ */
+export const query_invite_claim = async (deps, invite_id, account_id) => {
+    const rows = await deps.db.query(`UPDATE invite SET claimed_by = $1, claimed_at = NOW()
+		 WHERE id = $2 AND claimed_at IS NULL
+		 RETURNING id`, [account_id, invite_id]);
+    return rows.length > 0;
+};
+/**
+ * List all invites, newest first.
+ */
+export const query_invite_list_all = async (deps) => {
+    return deps.db.query(`SELECT * FROM invite ORDER BY created_at DESC`);
+};
+/**
+ * List all invites with resolved creator/claimer usernames, newest first.
+ *
+ * @param deps - query dependencies
+ * @returns invites with `created_by_username` and `claimed_by_username`
+ */
+export const query_invite_list_all_with_usernames = async (deps) => {
+    return deps.db.query(`SELECT i.*,
+			act.name AS created_by_username,
+			a.username AS claimed_by_username
+		 FROM invite i
+		 LEFT JOIN actor act ON act.id = i.created_by
+		 LEFT JOIN account a ON a.id = i.claimed_by
+		 ORDER BY i.created_at DESC`);
+};
+/**
+ * Delete an unclaimed invite.
+ *
+ * @param deps - query dependencies
+ * @param id - the invite id
+ * @returns true if deleted, false if not found or already claimed
+ */
+export const query_invite_delete_unclaimed = async (deps, id) => {
+    const rows = await deps.db.query(`DELETE FROM invite WHERE id = $1 AND claimed_at IS NULL RETURNING id`, [id]);
+    return rows.length > 0;
+};

package/dist/auth/invite_routes.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Admin invite route specs for invite-based signup.
+ *
+ * All routes require the `admin` role. Provides CRUD for invites
+ * that gate who can sign up.
+ *
+ * @module
+ */
+import { type RouteSpec } from '../http/route_spec.js';
+import type { RouteFactoryDeps } from './deps.js';
+/**
+ * Create admin invite route specs.
+ *
+ * @param deps - stateless capabilities (log)
+ * @returns route specs for invite management
+ */
+export declare const create_invite_route_specs: (deps: Pick<RouteFactoryDeps, "log" | "on_audit_event">) => Array<RouteSpec>;
+//# sourceMappingURL=invite_routes.d.ts.map

package/dist/auth/invite_routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/invite_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAoC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAYxF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAUhD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,gBAAgB,CAAC,KACpD,KAAK,CAAC,SAAS,CAwHjB,CAAC"}

package/dist/auth/invite_routes.js

@@ -0,0 +1,129 @@
+/**
+ * Admin invite route specs for invite-based signup.
+ *
+ * All routes require the `admin` role. Provides CRUD for invites
+ * that gate who can sign up.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { get_route_input, get_route_params } from '../http/route_spec.js';
+import { require_request_context } from './request_context.js';
+import { get_client_ip } from '../http/proxy.js';
+import { audit_log_fire_and_forget } from './audit_log_queries.js';
+import { query_account_by_username, query_account_by_email } from './account_queries.js';
+import { query_create_invite, query_invite_list_all_with_usernames, query_invite_delete_unclaimed, } from './invite_queries.js';
+import { InviteJson, InviteWithUsernamesJson } from './invite_schema.js';
+import { Username, Email } from './account_schema.js';
+import { is_pg_unique_violation } from '../db/pg_error.js';
+import { ERROR_INVITE_NOT_FOUND, ERROR_INVITE_MISSING_IDENTIFIER, ERROR_INVITE_DUPLICATE, ERROR_INVITE_ACCOUNT_EXISTS_USERNAME, ERROR_INVITE_ACCOUNT_EXISTS_EMAIL, } from '../http/error_schemas.js';
+/**
+ * Create admin invite route specs.
+ *
+ * @param deps - stateless capabilities (log)
+ * @returns route specs for invite management
+ */
+export const create_invite_route_specs = (deps) => {
+    return [
+        {
+            method: 'POST',
+            path: '/invites',
+            auth: { type: 'role', role: 'admin' },
+            description: 'Create an invite',
+            input: z.strictObject({
+                email: Email.nullish(),
+                username: Username.nullish(),
+            }),
+            output: z.strictObject({ ok: z.literal(true), invite: InviteJson }),
+            errors: {
+                400: z.looseObject({ error: z.literal(ERROR_INVITE_MISSING_IDENTIFIER) }),
+                409: z.looseObject({
+                    error: z.enum([
+                        ERROR_INVITE_DUPLICATE,
+                        ERROR_INVITE_ACCOUNT_EXISTS_USERNAME,
+                        ERROR_INVITE_ACCOUNT_EXISTS_EMAIL,
+                    ]),
+                }),
+            },
+            handler: async (c, route) => {
+                const ctx = require_request_context(c);
+                const { email, username } = get_route_input(c);
+                if (!email && !username) {
+                    return c.json({ error: ERROR_INVITE_MISSING_IDENTIFIER }, 400);
+                }
+                if (username) {
+                    const existing = await query_account_by_username(route, username);
+                    if (existing) {
+                        return c.json({ error: ERROR_INVITE_ACCOUNT_EXISTS_USERNAME }, 409);
+                    }
+                }
+                if (email) {
+                    const existing = await query_account_by_email(route, email);
+                    if (existing) {
+                        return c.json({ error: ERROR_INVITE_ACCOUNT_EXISTS_EMAIL }, 409);
+                    }
+                }
+                let invite;
+                try {
+                    invite = await query_create_invite(route, {
+                        email: email ?? null,
+                        username: username ?? null,
+                        created_by: ctx.actor.id,
+                    });
+                }
+                catch (e) {
+                    if (is_pg_unique_violation(e)) {
+                        return c.json({ error: ERROR_INVITE_DUPLICATE }, 409);
+                    }
+                    throw e;
+                }
+                void audit_log_fire_and_forget(route, {
+                    event_type: 'invite_create',
+                    actor_id: ctx.actor.id,
+                    account_id: ctx.account.id,
+                    ip: get_client_ip(c),
+                    metadata: { invite_id: invite.id, email: email ?? null, username: username ?? null },
+                }, deps.log, deps.on_audit_event);
+                return c.json({ ok: true, invite });
+            },
+        },
+        {
+            method: 'GET',
+            path: '/invites',
+            auth: { type: 'role', role: 'admin' },
+            description: 'List all invites',
+            input: z.null(),
+            output: z.strictObject({ invites: z.array(InviteWithUsernamesJson) }),
+            handler: async (c, route) => {
+                const invites = await query_invite_list_all_with_usernames(route);
+                return c.json({ invites });
+            },
+        },
+        {
+            method: 'DELETE',
+            path: '/invites/:id',
+            auth: { type: 'role', role: 'admin' },
+            description: 'Delete an unclaimed invite',
+            params: z.strictObject({ id: z.uuid() }),
+            input: z.null(),
+            output: z.strictObject({ ok: z.literal(true) }),
+            errors: { 404: z.looseObject({ error: z.literal(ERROR_INVITE_NOT_FOUND) }) },
+            handler: async (c, route) => {
+                const { id } = get_route_params(c);
+                const deleted = await query_invite_delete_unclaimed(route, id);
+                if (!deleted) {
+                    return c.json({ error: ERROR_INVITE_NOT_FOUND }, 404);
+                }
+                const ctx = require_request_context(c);
+                void audit_log_fire_and_forget(route, {
+                    event_type: 'invite_delete',
+                    actor_id: ctx.actor.id,
+                    account_id: ctx.account.id,
+                    ip: get_client_ip(c),
+                    metadata: { invite_id: id },
+                }, deps.log, deps.on_audit_event);
+                return c.json({ ok: true });
+            },
+        },
+    ];
+};

package/dist/auth/invite_schema.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Invite types and client-safe schemas.
+ *
+ * Defines the runtime types for the invite system: invite creation,
+ * matching, and claiming.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { Username, Email } from './account_schema.js';
+/** Invite row from the database. */
+export interface Invite {
+    id: string;
+    email: Email | null;
+    username: Username | null;
+    claimed_by: string | null;
+    claimed_at: string | null;
+    created_at: string;
+    created_by: string | null;
+}
+/** Zod schema for client-safe invite data. */
+export declare const InviteJson: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodNullable<z.ZodEmail>;
+    username: z.ZodNullable<z.ZodString>;
+    claimed_by: z.ZodNullable<z.ZodString>;
+    claimed_at: z.ZodNullable<z.ZodString>;
+    created_at: z.ZodString;
+    created_by: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type InviteJson = z.infer<typeof InviteJson>;
+/** Zod schema for invite data with resolved creator/claimer usernames. */
+export declare const InviteWithUsernamesJson: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodNullable<z.ZodEmail>;
+    username: z.ZodNullable<z.ZodString>;
+    claimed_by: z.ZodNullable<z.ZodString>;
+    claimed_at: z.ZodNullable<z.ZodString>;
+    created_at: z.ZodString;
+    created_by: z.ZodNullable<z.ZodString>;
+    created_by_username: z.ZodNullable<z.ZodString>;
+    claimed_by_username: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type InviteWithUsernamesJson = z.infer<typeof InviteWithUsernamesJson>;
+/** Input for creating an invite. */
+export interface CreateInviteInput {
+    email?: Email | null;
+    username?: Username | null;
+    created_by: string | null;
+}
+//# sourceMappingURL=invite_schema.d.ts.map

package/dist/auth/invite_schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/invite_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAAC,QAAQ,EAAE,KAAK,EAAC,MAAM,qBAAqB,CAAC;AAEpD,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;kBAQrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB;;;;;;;;;;kBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IACjC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}

package/dist/auth/invite_schema.js

@@ -0,0 +1,25 @@
+/**
+ * Invite types and client-safe schemas.
+ *
+ * Defines the runtime types for the invite system: invite creation,
+ * matching, and claiming.
+ *
+ * @module
+ */
+import { z } from 'zod';
+import { Username, Email } from './account_schema.js';
+/** Zod schema for client-safe invite data. */
+export const InviteJson = z.strictObject({
+    id: z.string(),
+    email: Email.nullable(),
+    username: Username.nullable(),
+    claimed_by: z.string().nullable(),
+    claimed_at: z.string().nullable(),
+    created_at: z.string(),
+    created_by: z.string().nullable(),
+});
+/** Zod schema for invite data with resolved creator/claimer usernames. */
+export const InviteWithUsernamesJson = InviteJson.extend({
+    created_by_username: z.string().nullable(),
+    claimed_by_username: z.string().nullable(),
+});

package/dist/auth/keyring.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Key ring for cookie signing.
+ *
+ * Encapsulates secret keys and crypto operations. Keys are never exposed -
+ * only sign/verify operations are available. This prevents accidental
+ * logging or leakage of secrets.
+ *
+ * @example
+ * ```ts
+ * const keyring = create_keyring(process.env.SECRET_COOKIE_KEYS);
+ * if (!keyring) throw new Error('No keys configured');
+ *
+ * const signed = await keyring.sign('user:123:1700000000');
+ * const result = await keyring.verify(signed);
+ * // result = { value: 'user:123:1700000000', key_index: 0 }
+ * ```
+ *
+ * @module
+ */
+/**
+ * Opaque keyring that encapsulates secret keys.
+ * Only exposes sign/verify operations, never the raw keys.
+ */
+export interface Keyring {
+    /**
+     * Sign a value with HMAC SHA-256.
+     * @returns signed value in format: `value.signature`
+     */
+    sign: (value: string) => Promise<string>;
+    /**
+     * Verify a signed value and extract the original.
+     * Tries all keys in order to support key rotation.
+     * @returns object with value and key_index, or null if invalid
+     */
+    verify: (signed_value: string) => Promise<{
+        value: string;
+        key_index: number;
+    } | null>;
+}
+/**
+ * Create a keyring from environment variable.
+ *
+ * Keys are separated by `__` for rotation support. First key is used
+ * for signing, all keys are tried for verification.
+ *
+ * CryptoKeys are cached on first use for performance.
+ *
+ * **Security: key rotation is an operational concern.** Old keys remain valid
+ * for verification indefinitely — a leaked old key can forge session cookies
+ * until it is removed from `SECRET_COOKIE_KEYS`. After rotating to a new
+ * signing key, remove the old key within a grace period (e.g. 24–48 hours,
+ * long enough for active sessions to re-sign with the new key via cookie
+ * refresh). Treat `SECRET_COOKIE_KEYS` changes as security-critical deploys.
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns keyring or null if no keys configured
+ */
+export declare const create_keyring: (env_value: string | undefined) => Keyring | null;
+/**
+ * Validate key ring configuration.
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns array of validation errors (empty if valid)
+ */
+export declare const validate_keyring: (env_value: string | undefined) => Array<string>;
+/**
+ * Result of `create_validated_keyring`.
+ * Discriminated union — callers handle the error case their own way.
+ */
+export type ValidatedKeyringResult = {
+    ok: true;
+    keyring: Keyring;
+} | {
+    ok: false;
+    errors: Array<string>;
+};
+/**
+ * Validate and create a keyring in one step.
+ *
+ * Returns a discriminated union so callers handle exit/logging their own way
+ * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`).
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns `{ok: true, keyring}` or `{ok: false, errors}`
+ */
+export declare const create_validated_keyring: (env_value: string | undefined) => ValidatedKeyringResult;
+//# sourceMappingURL=keyring.d.ts.map

package/dist/auth/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;GAGG;AACH,MAAM,WAAW,OAAO;IACvB;;;OAGG;IACH,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;;OAIG;IACH,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,GAAG,IAAI,CAAC,CAAC;CACrF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,OAAO,GAAG,IAkCxE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAW5E,CAAC;AA6CF;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAC/B;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAC,GAC5B;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAC,CAAC;AAEtC;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,sBAUxE,CAAC"}

package/dist/auth/keyring.js

@@ -0,0 +1,142 @@
+/**
+ * Key ring for cookie signing.
+ *
+ * Encapsulates secret keys and crypto operations. Keys are never exposed -
+ * only sign/verify operations are available. This prevents accidental
+ * logging or leakage of secrets.
+ *
+ * @example
+ * ```ts
+ * const keyring = create_keyring(process.env.SECRET_COOKIE_KEYS);
+ * if (!keyring) throw new Error('No keys configured');
+ *
+ * const signed = await keyring.sign('user:123:1700000000');
+ * const result = await keyring.verify(signed);
+ * // result = { value: 'user:123:1700000000', key_index: 0 }
+ * ```
+ *
+ * @module
+ */
+const KEY_SEPARATOR = '__';
+const MIN_KEY_LENGTH = 32;
+const encoder = new TextEncoder();
+/**
+ * Create a keyring from environment variable.
+ *
+ * Keys are separated by `__` for rotation support. First key is used
+ * for signing, all keys are tried for verification.
+ *
+ * CryptoKeys are cached on first use for performance.
+ *
+ * **Security: key rotation is an operational concern.** Old keys remain valid
+ * for verification indefinitely — a leaked old key can forge session cookies
+ * until it is removed from `SECRET_COOKIE_KEYS`. After rotating to a new
+ * signing key, remove the old key within a grace period (e.g. 24–48 hours,
+ * long enough for active sessions to re-sign with the new key via cookie
+ * refresh). Treat `SECRET_COOKIE_KEYS` changes as security-critical deploys.
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns keyring or null if no keys configured
+ */
+export const create_keyring = (env_value) => {
+    const secrets = parse_keys(env_value);
+    if (secrets.length === 0)
+        return null;
+    // Cache CryptoKey promises - imported once on first use
+    const key_cache = [];
+    const get_key = (index) => {
+        if (!key_cache[index]) {
+            key_cache[index] = create_hmac_key(secrets[index]);
+        }
+        return key_cache[index];
+    };
+    // Create the opaque key ring - secrets captured in closure, never exposed
+    return {
+        async sign(value) {
+            const key = await get_key(0);
+            return sign_with_crypto_key(value, key);
+        },
+        async verify(signed_value) {
+            for (let i = 0; i < secrets.length; i++) {
+                // eslint-disable-next-line no-await-in-loop
+                const key = await get_key(i);
+                // eslint-disable-next-line no-await-in-loop
+                const result = await verify_with_crypto_key(signed_value, key);
+                if (result !== false) {
+                    return { value: result, key_index: i };
+                }
+            }
+            return null;
+        },
+    };
+};
+/**
+ * Validate key ring configuration.
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns array of validation errors (empty if valid)
+ */
+export const validate_keyring = (env_value) => {
+    const keys = parse_keys(env_value);
+    const errors = [];
+    for (const [i, key] of keys.entries()) {
+        if (key.length < MIN_KEY_LENGTH) {
+            errors.push(`Key ${i + 1} is too short (${key.length} chars, min ${MIN_KEY_LENGTH})`);
+        }
+    }
+    return errors;
+};
+const create_hmac_key = (secret) => {
+    return crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+};
+const sign_with_crypto_key = async (value, key) => {
+    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(value));
+    const signature_base64 = btoa(String.fromCharCode(...new Uint8Array(signature)));
+    return `${value}.${signature_base64}`;
+};
+const verify_with_crypto_key = async (signed_value, key) => {
+    const dot_index = signed_value.lastIndexOf('.');
+    if (dot_index === -1)
+        return false;
+    const value = signed_value.slice(0, dot_index);
+    const signature_base64 = signed_value.slice(dot_index + 1);
+    let signature;
+    try {
+        const decoded = atob(signature_base64);
+        const bytes = new Uint8Array(decoded.length);
+        for (let i = 0; i < decoded.length; i++) {
+            bytes[i] = decoded.charCodeAt(i);
+        }
+        signature = bytes.buffer;
+    }
+    catch {
+        return false;
+    }
+    const valid = await crypto.subtle.verify('HMAC', key, signature, encoder.encode(value));
+    return valid ? value : false;
+};
+/**
+ * Validate and create a keyring in one step.
+ *
+ * Returns a discriminated union so callers handle exit/logging their own way
+ * (e.g. `Deno.exit(1)` vs `runtime.exit(1)`).
+ *
+ * @param env_value - the SECRET_COOKIE_KEYS environment variable
+ * @returns `{ok: true, keyring}` or `{ok: false, errors}`
+ */
+export const create_validated_keyring = (env_value) => {
+    const errors = validate_keyring(env_value);
+    if (errors.length > 0) {
+        return { ok: false, errors };
+    }
+    const keyring = create_keyring(env_value);
+    if (!keyring) {
+        return { ok: false, errors: ['SECRET_COOKIE_KEYS is required'] };
+    }
+    return { ok: true, keyring };
+};
+const parse_keys = (env_value) => {
+    if (!env_value)
+        return [];
+    return env_value.split(KEY_SEPARATOR).filter((k) => k.length > 0);
+};

package/dist/auth/middleware.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Auth middleware stack factory.
+ *
+ * Creates the standard middleware layers (origin, session, request_context,
+ * bearer_auth, optional daemon_token) from configuration.
+ *
+ * @module
+ */
+import type { SessionOptions } from './session_cookie.js';
+import type { AppDeps } from './deps.js';
+import type { DaemonTokenState } from './daemon_token.js';
+import type { RateLimiter } from '../rate_limiter.js';
+import type { MiddlewareSpec } from '../http/middleware_spec.js';
+/**
+ * Per-factory configuration for the standard auth middleware stack.
+ */
+export interface AuthMiddlewareOptions {
+    allowed_origins: Array<RegExp>;
+    session_options: SessionOptions<string>;
+    /** Path pattern for middleware (default: `'/api/*'`). */
+    path?: string;
+    /** Daemon token state for keeper auth. Omit to disable daemon token middleware. */
+    daemon_token_state?: DaemonTokenState;
+    /** Rate limiter for bearer token auth attempts (per-IP). Pass `null` to disable. */
+    bearer_ip_rate_limiter: RateLimiter | null;
+}
+/**
+ * Create the auth middleware stack.
+ *
+ * Returns `[origin, session, request_context, bearer_auth]` middleware specs
+ * for the given path pattern. When `daemon_token_state` is provided, appends
+ * a 5th `daemon_token` layer. Apps can append extra entries for non-standard
+ * paths (e.g., tx's `/tx` binary endpoint).
+ *
+ * @param deps - stateless capabilities (keyring, db)
+ * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state)
+ * @returns the middleware spec array
+ */
+export declare const create_auth_middleware_specs: (deps: AppDeps, options: AuthMiddlewareOptions) => Promise<Array<MiddlewareSpec>>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAG/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA+D/B,CAAC"}