@graphmemory/server 1.1.0

package/dist/lib/file-mirror.js

@@ -0,0 +1,461 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mirrorNoteCreate = mirrorNoteCreate;
+exports.mirrorNoteUpdate = mirrorNoteUpdate;
+exports.mirrorTaskCreate = mirrorTaskCreate;
+exports.mirrorTaskUpdate = mirrorTaskUpdate;
+exports.mirrorSkillCreate = mirrorSkillCreate;
+exports.mirrorSkillUpdate = mirrorSkillUpdate;
+exports.mirrorNoteRelation = mirrorNoteRelation;
+exports.mirrorTaskRelation = mirrorTaskRelation;
+exports.mirrorSkillRelation = mirrorSkillRelation;
+exports.mirrorAttachmentEvent = mirrorAttachmentEvent;
+exports.deleteMirrorDir = deleteMirrorDir;
+exports.sanitizeFilename = sanitizeFilename;
+exports.writeAttachment = writeAttachment;
+exports.deleteAttachment = deleteAttachment;
+exports.getAttachmentPath = getAttachmentPath;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+const frontmatter_1 = require("./frontmatter");
+const events_log_1 = require("./events-log");
+/** Write to a temp file then rename — atomic on same filesystem. */
+function atomicWriteFileSync(filePath, data, encoding) {
+    const tmp = `${filePath}.${crypto_1.default.randomBytes(4).toString('hex')}.tmp`;
+    fs.writeFileSync(tmp, data, encoding);
+    fs.renameSync(tmp, filePath);
+}
+function tsToIso(ts) {
+    if (ts == null || ts === 0)
+        return null;
+    return new Date(ts).toISOString();
+}
+function buildOutgoingRelations(entityId, relations) {
+    return relations
+        .filter(r => r.fromId === entityId)
+        .map(r => {
+        const entry = { to: r.toId, kind: r.kind };
+        if (r.targetGraph)
+            entry.graph = r.targetGraph;
+        return entry;
+    });
+}
+/** Append a 'created' event + write content.md + regenerate note.md snapshot. */
+function mirrorNoteCreate(notesDir, noteId, attrs, relations) {
+    try {
+        const entityDir = path.join(notesDir, noteId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        if (!fs.existsSync(eventsPath)) {
+            const event = {
+                op: 'created',
+                id: noteId,
+                title: attrs.title,
+                tags: attrs.tags,
+                createdAt: attrs.createdAt,
+            };
+            if (attrs.createdBy)
+                event.createdBy = attrs.createdBy;
+            (0, events_log_1.appendEvent)(eventsPath, event);
+        }
+        atomicWriteFileSync(path.join(entityDir, 'content.md'), attrs.content, 'utf-8');
+        _regenerateNoteSnapshot(notesDir, noteId, attrs, relations);
+        (0, events_log_1.ensureGitignore)(notesDir, '*/note.md');
+        (0, events_log_1.ensureGitattributes)(notesDir);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror note create ${noteId}: ${err}\n`);
+    }
+}
+/** Append an 'update' event + (if content changed) write content.md + regenerate note.md. */
+function mirrorNoteUpdate(notesDir, noteId, patch, attrs, relations) {
+    try {
+        const entityDir = path.join(notesDir, noteId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const delta = { op: 'update' };
+        if (patch.title !== undefined)
+            delta.title = patch.title;
+        if (patch.tags !== undefined)
+            delta.tags = patch.tags;
+        if (patch.by !== undefined)
+            delta.by = patch.by;
+        else if (attrs.updatedBy)
+            delta.by = attrs.updatedBy;
+        if (Object.keys(delta).length > 1)
+            (0, events_log_1.appendEvent)(eventsPath, delta);
+        if (patch.content !== undefined) {
+            atomicWriteFileSync(path.join(entityDir, 'content.md'), patch.content, 'utf-8');
+        }
+        _regenerateNoteSnapshot(notesDir, noteId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror note update ${noteId}: ${err}\n`);
+    }
+}
+function _regenerateNoteSnapshot(notesDir, noteId, attrs, relations) {
+    const outgoing = buildOutgoingRelations(noteId, relations);
+    const fm = {
+        id: noteId,
+        tags: attrs.tags,
+        createdAt: tsToIso(attrs.createdAt),
+        updatedAt: tsToIso(attrs.updatedAt),
+        version: attrs.version,
+    };
+    if (attrs.createdBy)
+        fm.createdBy = attrs.createdBy;
+    if (attrs.updatedBy)
+        fm.updatedBy = attrs.updatedBy;
+    if (outgoing.length > 0)
+        fm.relations = outgoing;
+    const body = `# ${attrs.title}\n\n${attrs.content}`;
+    const entityDir = path.join(notesDir, noteId);
+    fs.mkdirSync(entityDir, { recursive: true });
+    atomicWriteFileSync(path.join(entityDir, 'note.md'), (0, frontmatter_1.serializeMarkdown)(fm, body));
+}
+/** Append a 'created' event + write description.md + regenerate task.md snapshot. */
+function mirrorTaskCreate(tasksDir, taskId, attrs, relations) {
+    try {
+        const entityDir = path.join(tasksDir, taskId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        if (!fs.existsSync(eventsPath)) {
+            const event = {
+                op: 'created',
+                id: taskId,
+                title: attrs.title,
+                status: attrs.status,
+                priority: attrs.priority,
+                tags: attrs.tags,
+                dueDate: attrs.dueDate,
+                estimate: attrs.estimate,
+                completedAt: attrs.completedAt,
+                createdAt: attrs.createdAt,
+            };
+            if (attrs.createdBy)
+                event.createdBy = attrs.createdBy;
+            (0, events_log_1.appendEvent)(eventsPath, event);
+        }
+        atomicWriteFileSync(path.join(entityDir, 'description.md'), attrs.description, 'utf-8');
+        _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations);
+        (0, events_log_1.ensureGitignore)(tasksDir, '*/task.md');
+        (0, events_log_1.ensureGitattributes)(tasksDir);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror task create ${taskId}: ${err}\n`);
+    }
+}
+/** Append an 'update' event + (if description changed) write description.md + regenerate task.md. */
+function mirrorTaskUpdate(tasksDir, taskId, patch, attrs, relations) {
+    try {
+        const entityDir = path.join(tasksDir, taskId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const delta = { op: 'update' };
+        if (patch.title !== undefined)
+            delta.title = patch.title;
+        if (patch.status !== undefined)
+            delta.status = patch.status;
+        if (patch.priority !== undefined)
+            delta.priority = patch.priority;
+        if (patch.tags !== undefined)
+            delta.tags = patch.tags;
+        if ('dueDate' in patch)
+            delta.dueDate = patch.dueDate;
+        if ('estimate' in patch)
+            delta.estimate = patch.estimate;
+        if ('completedAt' in patch)
+            delta.completedAt = patch.completedAt;
+        if (patch.by !== undefined)
+            delta.by = patch.by;
+        else if (attrs.updatedBy)
+            delta.by = attrs.updatedBy;
+        if (Object.keys(delta).length > 1)
+            (0, events_log_1.appendEvent)(eventsPath, delta);
+        if (patch.description !== undefined) {
+            atomicWriteFileSync(path.join(entityDir, 'description.md'), patch.description, 'utf-8');
+        }
+        _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror task update ${taskId}: ${err}\n`);
+    }
+}
+function _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations) {
+    const outgoing = buildOutgoingRelations(taskId, relations);
+    const fm = {
+        id: taskId,
+        status: attrs.status,
+        priority: attrs.priority,
+        tags: attrs.tags,
+        assignee: attrs.assignee ?? null,
+        dueDate: tsToIso(attrs.dueDate),
+        estimate: attrs.estimate,
+        completedAt: tsToIso(attrs.completedAt),
+        createdAt: tsToIso(attrs.createdAt),
+        updatedAt: tsToIso(attrs.updatedAt),
+        version: attrs.version,
+    };
+    if (attrs.createdBy)
+        fm.createdBy = attrs.createdBy;
+    if (attrs.updatedBy)
+        fm.updatedBy = attrs.updatedBy;
+    if (outgoing.length > 0)
+        fm.relations = outgoing;
+    const body = `# ${attrs.title}\n\n${attrs.description}`;
+    const entityDir = path.join(tasksDir, taskId);
+    fs.mkdirSync(entityDir, { recursive: true });
+    atomicWriteFileSync(path.join(entityDir, 'task.md'), (0, frontmatter_1.serializeMarkdown)(fm, body));
+}
+/** Append a 'created' event + write description.md + regenerate skill.md snapshot. */
+function mirrorSkillCreate(skillsDir, skillId, attrs, relations) {
+    try {
+        const entityDir = path.join(skillsDir, skillId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        if (!fs.existsSync(eventsPath)) {
+            const event = {
+                op: 'created',
+                id: skillId,
+                title: attrs.title,
+                tags: attrs.tags,
+                steps: attrs.steps,
+                triggers: attrs.triggers,
+                inputHints: attrs.inputHints,
+                filePatterns: attrs.filePatterns,
+                source: attrs.source,
+                confidence: attrs.confidence,
+                usageCount: attrs.usageCount,
+                lastUsedAt: attrs.lastUsedAt,
+                createdAt: attrs.createdAt,
+            };
+            if (attrs.createdBy)
+                event.createdBy = attrs.createdBy;
+            (0, events_log_1.appendEvent)(eventsPath, event);
+        }
+        atomicWriteFileSync(path.join(entityDir, 'description.md'), attrs.description, 'utf-8');
+        _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations);
+        (0, events_log_1.ensureGitignore)(skillsDir, '*/skill.md');
+        (0, events_log_1.ensureGitattributes)(skillsDir);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror skill create ${skillId}: ${err}\n`);
+    }
+}
+/** Append an 'update' event + (if description changed) write description.md + regenerate skill.md. */
+function mirrorSkillUpdate(skillsDir, skillId, patch, attrs, relations) {
+    try {
+        const entityDir = path.join(skillsDir, skillId);
+        fs.mkdirSync(entityDir, { recursive: true });
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const delta = { op: 'update' };
+        if (patch.title !== undefined)
+            delta.title = patch.title;
+        if (patch.tags !== undefined)
+            delta.tags = patch.tags;
+        if (patch.steps !== undefined)
+            delta.steps = patch.steps;
+        if (patch.triggers !== undefined)
+            delta.triggers = patch.triggers;
+        if (patch.inputHints !== undefined)
+            delta.inputHints = patch.inputHints;
+        if (patch.filePatterns !== undefined)
+            delta.filePatterns = patch.filePatterns;
+        if (patch.source !== undefined)
+            delta.source = patch.source;
+        if (patch.confidence !== undefined)
+            delta.confidence = patch.confidence;
+        if (patch.usageCount !== undefined)
+            delta.usageCount = patch.usageCount;
+        if ('lastUsedAt' in patch)
+            delta.lastUsedAt = patch.lastUsedAt;
+        if (patch.by !== undefined)
+            delta.by = patch.by;
+        else if (attrs.updatedBy)
+            delta.by = attrs.updatedBy;
+        if (Object.keys(delta).length > 1)
+            (0, events_log_1.appendEvent)(eventsPath, delta);
+        if (patch.description !== undefined) {
+            atomicWriteFileSync(path.join(entityDir, 'description.md'), patch.description, 'utf-8');
+        }
+        _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror skill update ${skillId}: ${err}\n`);
+    }
+}
+function _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations) {
+    const outgoing = buildOutgoingRelations(skillId, relations);
+    const fm = {
+        id: skillId,
+        source: attrs.source,
+        confidence: attrs.confidence,
+        triggers: attrs.triggers,
+        inputHints: attrs.inputHints,
+        filePatterns: attrs.filePatterns,
+        tags: attrs.tags,
+        createdAt: tsToIso(attrs.createdAt),
+        updatedAt: tsToIso(attrs.updatedAt),
+        version: attrs.version,
+    };
+    if (attrs.createdBy)
+        fm.createdBy = attrs.createdBy;
+    if (attrs.updatedBy)
+        fm.updatedBy = attrs.updatedBy;
+    if (outgoing.length > 0)
+        fm.relations = outgoing;
+    const stepsBlock = attrs.steps.length > 0
+        ? `\n\n## Steps\n${attrs.steps.map((s, i) => `${i + 1}. ${s}`).join('\n')}`
+        : '';
+    const body = `# ${attrs.title}\n\n${attrs.description}${stepsBlock}`;
+    const entityDir = path.join(skillsDir, skillId);
+    fs.mkdirSync(entityDir, { recursive: true });
+    atomicWriteFileSync(path.join(entityDir, 'skill.md'), (0, frontmatter_1.serializeMarkdown)(fm, body));
+}
+// ---------------------------------------------------------------------------
+// Relation + attachment event append helpers
+// ---------------------------------------------------------------------------
+/** Append a relation add/remove event and regenerate snapshot. */
+function mirrorNoteRelation(notesDir, noteId, action, kind, to, attrs, relations, graph) {
+    try {
+        const entityDir = path.join(notesDir, noteId);
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const event = { op: 'relation', action, kind, to };
+        if (graph)
+            event.graph = graph;
+        (0, events_log_1.appendEvent)(eventsPath, event);
+        _regenerateNoteSnapshot(notesDir, noteId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror note relation ${noteId}: ${err}\n`);
+    }
+}
+function mirrorTaskRelation(tasksDir, taskId, action, kind, to, attrs, relations, graph) {
+    try {
+        const entityDir = path.join(tasksDir, taskId);
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const event = { op: 'relation', action, kind, to };
+        if (graph)
+            event.graph = graph;
+        (0, events_log_1.appendEvent)(eventsPath, event);
+        _regenerateTaskSnapshot(tasksDir, taskId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror task relation ${taskId}: ${err}\n`);
+    }
+}
+function mirrorSkillRelation(skillsDir, skillId, action, kind, to, attrs, relations, graph) {
+    try {
+        const entityDir = path.join(skillsDir, skillId);
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        const event = { op: 'relation', action, kind, to };
+        if (graph)
+            event.graph = graph;
+        (0, events_log_1.appendEvent)(eventsPath, event);
+        _regenerateSkillSnapshot(skillsDir, skillId, attrs, relations);
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror skill relation ${skillId}: ${err}\n`);
+    }
+}
+/** Append an attachment add/remove event. */
+function mirrorAttachmentEvent(entityDir, action, file) {
+    try {
+        const eventsPath = path.join(entityDir, 'events.jsonl');
+        (0, events_log_1.appendEvent)(eventsPath, { op: 'attachment', action, file });
+    }
+    catch (err) {
+        process.stderr.write(`[file-mirror] failed to mirror attachment event: ${err}\n`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Delete
+// ---------------------------------------------------------------------------
+/** Delete the entire mirror directory for a note, task or skill (including attachments). */
+function deleteMirrorDir(dir, id) {
+    try {
+        fs.rmSync(path.join(dir, id), { recursive: true, force: true });
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            process.stderr.write(`[file-mirror] failed to delete ${id}/: ${err}\n`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Attachment file helpers (paths now go through attachments/ subdir)
+// ---------------------------------------------------------------------------
+/** Sanitize a filename: strip path separators, .., and null bytes. */
+function sanitizeFilename(name) {
+    const sanitized = name
+        .replace(/\0/g, '')
+        .replace(/\.\./g, '')
+        .replace(/[/\\]/g, '')
+        .trim();
+    return sanitized; // empty string is a valid return — callers must check
+}
+/** Write an attachment file to the entity's attachments/ subdirectory. */
+function writeAttachment(baseDir, entityId, filename, data) {
+    const safe = sanitizeFilename(filename);
+    if (!safe)
+        throw new Error('Attachment filename is empty after sanitization');
+    const attachmentsDir = path.join(baseDir, entityId, 'attachments');
+    fs.mkdirSync(attachmentsDir, { recursive: true });
+    fs.writeFileSync(path.join(attachmentsDir, safe), data);
+}
+/** Delete an attachment file from attachments/ subdir. Returns true if it existed. */
+function deleteAttachment(baseDir, entityId, filename) {
+    const filePath = path.join(baseDir, entityId, 'attachments', sanitizeFilename(filename));
+    try {
+        fs.unlinkSync(filePath);
+        return true;
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT') {
+            process.stderr.write(`[file-mirror] failed to delete attachment ${filename}: ${err}\n`);
+        }
+        return false;
+    }
+}
+/** Get the absolute path of an attachment in attachments/ subdir, or null if not found. */
+function getAttachmentPath(baseDir, entityId, filename) {
+    const filePath = path.join(baseDir, entityId, 'attachments', sanitizeFilename(filename));
+    return fs.existsSync(filePath) ? filePath : null;
+}

package/dist/lib/frontmatter.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serializeMarkdown = serializeMarkdown;
+exports.parseMarkdown = parseMarkdown;
+const yaml_1 = require("yaml");
+function serializeMarkdown(frontmatter, body) {
+    const yamlStr = (0, yaml_1.stringify)(frontmatter, { lineWidth: 0 }).trimEnd();
+    return `---\n${yamlStr}\n---\n\n${body}\n`;
+}
+function parseMarkdown(raw) {
+    const match = raw.match(/^---\n([\s\S]*?)\n---\n\n?([\s\S]*)$/);
+    if (!match)
+        return { frontmatter: {}, body: raw };
+    const frontmatter = (0, yaml_1.parse)(match[1], { maxAliasCount: 10 }) ?? {};
+    const body = match[2].replace(/\n$/, '');
+    return { frontmatter, body };
+}

package/dist/lib/jwt.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPassword = hashPassword;
+exports.verifyPassword = verifyPassword;
+exports.parseTtl = parseTtl;
+exports.signAccessToken = signAccessToken;
+exports.signRefreshToken = signRefreshToken;
+exports.verifyToken = verifyToken;
+exports.setAuthCookies = setAuthCookies;
+exports.clearAuthCookies = clearAuthCookies;
+exports.getAccessToken = getAccessToken;
+exports.getRefreshToken = getRefreshToken;
+exports.resolveUserByEmail = resolveUserByEmail;
+const crypto_1 = __importDefault(require("crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// ---------------------------------------------------------------------------
+// Password hashing (scrypt)
+// ---------------------------------------------------------------------------
+const SCRYPT_KEYLEN = 64;
+const SCRYPT_COST = 16384; // N
+const SCRYPT_BLOCK = 8; // r
+const SCRYPT_PARALLEL = 1; // p
+/**
+ * Hash a password using scrypt. Returns a string: `$scrypt$N$r$p$salt$hash`
+ */
+async function hashPassword(password) {
+    const salt = crypto_1.default.randomBytes(16).toString('hex');
+    const derived = await new Promise((resolve, reject) => {
+        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_COST, r: SCRYPT_BLOCK, p: SCRYPT_PARALLEL }, (err, key) => {
+            if (err)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+    return `$scrypt$${SCRYPT_COST}$${SCRYPT_BLOCK}$${SCRYPT_PARALLEL}$${salt}$${derived.toString('hex')}`;
+}
+/**
+ * Verify a password against a stored hash.
+ */
+async function verifyPassword(password, storedHash) {
+    const parts = storedHash.split('$');
+    // Format: $scrypt$N$r$p$salt$hash → ['', 'scrypt', N, r, p, salt, hash]
+    if (parts.length !== 7 || parts[1] !== 'scrypt')
+        return false;
+    const N = parseInt(parts[2], 10);
+    const r = parseInt(parts[3], 10);
+    const p = parseInt(parts[4], 10);
+    const salt = parts[5];
+    const expectedHash = parts[6];
+    const derived = await new Promise((resolve, reject) => {
+        crypto_1.default.scrypt(password, salt, SCRYPT_KEYLEN, { N, r, p }, (err, key) => {
+            if (err)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+    const derivedHex = derived.toString('hex');
+    // Timing-safe comparison
+    if (derivedHex.length !== expectedHash.length)
+        return false;
+    return crypto_1.default.timingSafeEqual(Buffer.from(derivedHex), Buffer.from(expectedHash));
+}
+/**
+ * Parse a TTL string like "15m", "1h", "7d" into seconds.
+ */
+function parseTtl(ttl) {
+    const match = ttl.match(/^(\d+)(s|m|h|d)$/);
+    if (!match)
+        throw new Error(`Invalid TTL format: "${ttl}". Expected e.g. "15m", "1h", "7d"`);
+    const value = parseInt(match[1], 10);
+    if (value <= 0)
+        throw new Error(`TTL must be positive, got "${ttl}"`);
+    switch (match[2]) {
+        case 's': return value;
+        case 'm': return value * 60;
+        case 'h': return value * 3600;
+        case 'd': return value * 86400;
+        default: throw new Error(`Invalid TTL unit: ${match[2]}`);
+    }
+}
+function signAccessToken(userId, secret, ttl) {
+    const payload = { userId, type: 'access' };
+    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+}
+function signRefreshToken(userId, secret, ttl) {
+    const payload = { userId, type: 'refresh' };
+    return jsonwebtoken_1.default.sign(payload, secret, { expiresIn: parseTtl(ttl) });
+}
+function verifyToken(token, secret) {
+    try {
+        const decoded = jsonwebtoken_1.default.verify(token, secret);
+        if (!decoded.userId || !decoded.type)
+            return null;
+        return { userId: decoded.userId, type: decoded.type };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Cookie helpers
+// ---------------------------------------------------------------------------
+const ACCESS_COOKIE = 'mgm_access';
+const REFRESH_COOKIE = 'mgm_refresh';
+function setAuthCookies(res, accessToken, refreshToken, accessTtl, refreshTtl) {
+    const secure = process.env.NODE_ENV === 'production';
+    res.cookie(ACCESS_COOKIE, accessToken, {
+        httpOnly: true,
+        secure,
+        sameSite: 'strict',
+        path: '/api',
+        maxAge: parseTtl(accessTtl) * 1000,
+    });
+    res.cookie(REFRESH_COOKIE, refreshToken, {
+        httpOnly: true,
+        secure,
+        sameSite: 'strict',
+        path: '/api/auth/refresh',
+        maxAge: parseTtl(refreshTtl) * 1000,
+    });
+}
+function clearAuthCookies(res) {
+    res.clearCookie(ACCESS_COOKIE, { path: '/api' });
+    res.clearCookie(REFRESH_COOKIE, { path: '/api/auth/refresh' });
+}
+function getAccessToken(req) {
+    return req.cookies?.[ACCESS_COOKIE];
+}
+function getRefreshToken(req) {
+    return req.cookies?.[REFRESH_COOKIE];
+}
+// ---------------------------------------------------------------------------
+// User lookup by email
+// ---------------------------------------------------------------------------
+function resolveUserByEmail(email, users) {
+    for (const [userId, user] of Object.entries(users)) {
+        if (user.email === email)
+            return { userId, user };
+    }
+    return undefined;
+}