@hamak/auth 0.5.1

package/dist/impl/strategies/StrategyRegistry.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Strategy Registry Implementation
+ * Registry for managing multiple authentication strategies
+ */
+import type { IAuthStrategy, IOAuthStrategy, IStrategyRegistry } from '../../spi';
+/**
+ * Default implementation of the strategy registry
+ */
+export declare class StrategyRegistry implements IStrategyRegistry {
+    private strategies;
+    private defaultStrategyName;
+    register(strategy: IAuthStrategy): void;
+    unregister(name: string): void;
+    get(name: string): IAuthStrategy | undefined;
+    getOAuth(name: string): IOAuthStrategy | undefined;
+    getAll(): IAuthStrategy[];
+    getAllOAuth(): IOAuthStrategy[];
+    has(name: string): boolean;
+    getDefault(): IAuthStrategy | undefined;
+    setDefault(name: string): void;
+    clear(): void;
+    private isOAuthStrategy;
+}
+//# sourceMappingURL=StrategyRegistry.d.ts.map

package/dist/impl/strategies/StrategyRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StrategyRegistry.d.ts","sourceRoot":"","sources":["../../../src/impl/strategies/StrategyRegistry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAElF;;GAEG;AACH,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,mBAAmB,CAAuB;IAElD,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAYvC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAW9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAQlD,MAAM,IAAI,aAAa,EAAE;IAIzB,WAAW,IAAI,cAAc,EAAE;IAI/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,UAAU,IAAI,aAAa,GAAG,SAAS;IAOvC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAO9B,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,eAAe;CAGxB"}

package/dist/impl/strategies/StrategyRegistry.js

@@ -0,0 +1,70 @@
+/**
+ * Strategy Registry Implementation
+ * Registry for managing multiple authentication strategies
+ */
+/**
+ * Default implementation of the strategy registry
+ */
+export class StrategyRegistry {
+    constructor() {
+        this.strategies = new Map();
+        this.defaultStrategyName = null;
+    }
+    register(strategy) {
+        if (this.strategies.has(strategy.name)) {
+            console.warn(`Strategy "${strategy.name}" is already registered. Overwriting.`);
+        }
+        this.strategies.set(strategy.name, strategy);
+        // Set as default if it's the first strategy
+        if (this.strategies.size === 1) {
+            this.defaultStrategyName = strategy.name;
+        }
+    }
+    unregister(name) {
+        this.strategies.delete(name);
+        // Clear default if it was the unregistered strategy
+        if (this.defaultStrategyName === name) {
+            this.defaultStrategyName = this.strategies.size > 0
+                ? this.strategies.keys().next().value ?? null
+                : null;
+        }
+    }
+    get(name) {
+        return this.strategies.get(name);
+    }
+    getOAuth(name) {
+        const strategy = this.strategies.get(name);
+        if (strategy && this.isOAuthStrategy(strategy)) {
+            return strategy;
+        }
+        return undefined;
+    }
+    getAll() {
+        return Array.from(this.strategies.values());
+    }
+    getAllOAuth() {
+        return this.getAll().filter(this.isOAuthStrategy);
+    }
+    has(name) {
+        return this.strategies.has(name);
+    }
+    getDefault() {
+        if (!this.defaultStrategyName) {
+            return undefined;
+        }
+        return this.strategies.get(this.defaultStrategyName);
+    }
+    setDefault(name) {
+        if (!this.strategies.has(name)) {
+            throw new Error(`Strategy "${name}" is not registered`);
+        }
+        this.defaultStrategyName = name;
+    }
+    clear() {
+        this.strategies.clear();
+        this.defaultStrategyName = null;
+    }
+    isOAuthStrategy(strategy) {
+        return 'getAuthorizationUrl' in strategy && 'handleCallback' in strategy;
+    }
+}

package/dist/impl/strategies/index.d.ts

@@ -0,0 +1,5 @@
+export * from './PasswordStrategy';
+export * from './OAuth2Strategy';
+export * from './KeycloakStrategy';
+export * from './StrategyRegistry';
+//# sourceMappingURL=index.d.ts.map

package/dist/impl/strategies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/impl/strategies/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}

package/dist/impl/strategies/index.js

@@ -0,0 +1,4 @@
+export * from './PasswordStrategy';
+export * from './OAuth2Strategy';
+export * from './KeycloakStrategy';
+export * from './StrategyRegistry';

package/dist/impl/utils/index.d.ts

@@ -0,0 +1,3 @@
+export * from './pkce';
+export * from './jwt';
+//# sourceMappingURL=index.d.ts.map

package/dist/impl/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/impl/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,OAAO,CAAC"}

package/dist/impl/utils/index.js

@@ -0,0 +1,2 @@
+export * from './pkce';
+export * from './jwt';

package/dist/impl/utils/jwt.d.ts

@@ -0,0 +1,81 @@
+/**
+ * JWT Utilities
+ * Utilities for parsing and validating JWT tokens
+ */
+import type { User } from '../../api';
+/**
+ * Standard JWT payload claims
+ */
+export interface JWTPayload {
+    /** Subject (user ID) */
+    sub?: string;
+    /** Email */
+    email?: string;
+    /** Name */
+    name?: string;
+    /** Preferred username */
+    preferred_username?: string;
+    /** Given name */
+    given_name?: string;
+    /** Family name */
+    family_name?: string;
+    /** Picture/avatar URL */
+    picture?: string;
+    /** Issued at (timestamp) */
+    iat?: number;
+    /** Expiration time (timestamp) */
+    exp?: number;
+    /** Not before (timestamp) */
+    nbf?: number;
+    /** Issuer */
+    iss?: string;
+    /** Audience */
+    aud?: string | string[];
+    /** JWT ID */
+    jti?: string;
+    /** Scopes */
+    scope?: string;
+    /** Keycloak realm access */
+    realm_access?: {
+        roles: string[];
+    };
+    /** Keycloak resource access */
+    resource_access?: Record<string, {
+        roles: string[];
+    }>;
+    /** Custom claims */
+    [key: string]: unknown;
+}
+/**
+ * Parse a JWT token and extract the payload
+ * Note: This does NOT validate the signature
+ * @param token The JWT token string
+ * @returns The decoded payload or null if invalid
+ */
+export declare function parseJWT(token: string): JWTPayload | null;
+/**
+ * Check if a JWT token is expired
+ * @param token The JWT token or parsed payload
+ * @param bufferSeconds Extra seconds before expiry to consider expired (default: 0)
+ */
+export declare function isJWTExpired(token: string | JWTPayload, bufferSeconds?: number): boolean;
+/**
+ * Get expiration time from a JWT token
+ * @param token The JWT token
+ * @returns Expiration timestamp in milliseconds or null
+ */
+export declare function getJWTExpiry(token: string): number | null;
+/**
+ * Extract user information from a JWT token
+ * Handles standard OIDC claims and Keycloak-specific claims
+ * @param token The JWT token
+ * @param clientId Optional client ID for Keycloak resource roles
+ */
+export declare function extractUserFromJWT(token: string, clientId?: string): User | null;
+/**
+ * Calculate time until token expires
+ * @param token The JWT token
+ * @returns Time in milliseconds until expiry, or 0 if expired
+ */
+export declare function getTimeUntilExpiry(token: string): number;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/impl/utils/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/impl/utils/jwt.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,YAAY,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;IACF,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACtD,oBAAoB;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAqBzD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,aAAa,SAAI,GAAG,OAAO,CAQnF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAkChF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMxD"}

package/dist/impl/utils/jwt.js

@@ -0,0 +1,103 @@
+/**
+ * JWT Utilities
+ * Utilities for parsing and validating JWT tokens
+ */
+/**
+ * Parse a JWT token and extract the payload
+ * Note: This does NOT validate the signature
+ * @param token The JWT token string
+ * @returns The decoded payload or null if invalid
+ */
+export function parseJWT(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return null;
+        }
+        const payload = parts[1];
+        // Handle base64url encoding
+        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const jsonPayload = decodeURIComponent(atob(base64)
+            .split('')
+            .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
+            .join(''));
+        return JSON.parse(jsonPayload);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check if a JWT token is expired
+ * @param token The JWT token or parsed payload
+ * @param bufferSeconds Extra seconds before expiry to consider expired (default: 0)
+ */
+export function isJWTExpired(token, bufferSeconds = 0) {
+    const payload = typeof token === 'string' ? parseJWT(token) : token;
+    if (!payload?.exp) {
+        return true;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    return payload.exp - bufferSeconds <= now;
+}
+/**
+ * Get expiration time from a JWT token
+ * @param token The JWT token
+ * @returns Expiration timestamp in milliseconds or null
+ */
+export function getJWTExpiry(token) {
+    const payload = parseJWT(token);
+    if (!payload?.exp) {
+        return null;
+    }
+    return payload.exp * 1000;
+}
+/**
+ * Extract user information from a JWT token
+ * Handles standard OIDC claims and Keycloak-specific claims
+ * @param token The JWT token
+ * @param clientId Optional client ID for Keycloak resource roles
+ */
+export function extractUserFromJWT(token, clientId) {
+    const payload = parseJWT(token);
+    if (!payload) {
+        return null;
+    }
+    // Extract roles from Keycloak format
+    const realmRoles = payload.realm_access?.roles || [];
+    const resourceRoles = clientId
+        ? payload.resource_access?.[clientId]?.roles || []
+        : [];
+    const roles = [...new Set([...realmRoles, ...resourceRoles])];
+    // Extract permissions (scopes)
+    const permissions = payload.scope?.split(' ').filter(Boolean) || [];
+    // Build user object
+    const user = {
+        id: payload.sub || '',
+        email: payload.email || '',
+        name: payload.name || payload.preferred_username || '',
+        username: payload.preferred_username,
+        avatar: payload.picture,
+        roles,
+        permissions,
+        metadata: {
+            iss: payload.iss,
+            aud: payload.aud,
+            iat: payload.iat,
+            exp: payload.exp
+        }
+    };
+    return user;
+}
+/**
+ * Calculate time until token expires
+ * @param token The JWT token
+ * @returns Time in milliseconds until expiry, or 0 if expired
+ */
+export function getTimeUntilExpiry(token) {
+    const expiry = getJWTExpiry(token);
+    if (!expiry) {
+        return 0;
+    }
+    return Math.max(0, expiry - Date.now());
+}

package/dist/impl/utils/pkce.d.ts

@@ -0,0 +1,44 @@
+/**
+ * PKCE (Proof Key for Code Exchange) Utilities
+ * Used for secure OAuth2 authorization code flow
+ */
+/**
+ * Generate a cryptographically random string for state or code verifier
+ * @param length Length of the string (default: 43 for code verifier)
+ */
+export declare function generateRandomString(length?: number): string;
+/**
+ * Generate a state parameter for OAuth
+ */
+export declare function generateState(): string;
+/**
+ * Generate a code verifier for PKCE
+ * Must be between 43 and 128 characters
+ */
+export declare function generateCodeVerifier(): string;
+/**
+ * Generate a code challenge from a code verifier
+ * Uses SHA-256 hashing as recommended by RFC 7636
+ */
+export declare function generateCodeChallenge(verifier: string): Promise<string>;
+/**
+ * PKCE state stored during OAuth flow
+ */
+export interface PKCEState {
+    state: string;
+    codeVerifier: string;
+    createdAt: number;
+}
+/**
+ * Store PKCE state for later verification
+ */
+export declare function storePKCEState(pkceState: PKCEState): void;
+/**
+ * Retrieve stored PKCE state
+ */
+export declare function retrievePKCEState(): PKCEState | null;
+/**
+ * Clear stored PKCE state
+ */
+export declare function clearPKCEState(): void;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/impl/utils/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/impl/utils/pkce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAK,GAAG,MAAM,CAIxD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAK7E;AAiBD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD;;GAEG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAOzD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,SAAS,GAAG,IAAI,CAWpD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAMrC"}

package/dist/impl/utils/pkce.js

@@ -0,0 +1,93 @@
+/**
+ * PKCE (Proof Key for Code Exchange) Utilities
+ * Used for secure OAuth2 authorization code flow
+ */
+/**
+ * Generate a cryptographically random string for state or code verifier
+ * @param length Length of the string (default: 43 for code verifier)
+ */
+export function generateRandomString(length = 43) {
+    const array = new Uint8Array(length);
+    crypto.getRandomValues(array);
+    return base64UrlEncode(array);
+}
+/**
+ * Generate a state parameter for OAuth
+ */
+export function generateState() {
+    return generateRandomString(32);
+}
+/**
+ * Generate a code verifier for PKCE
+ * Must be between 43 and 128 characters
+ */
+export function generateCodeVerifier() {
+    return generateRandomString(43);
+}
+/**
+ * Generate a code challenge from a code verifier
+ * Uses SHA-256 hashing as recommended by RFC 7636
+ */
+export async function generateCodeChallenge(verifier) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hash = await crypto.subtle.digest('SHA-256', data);
+    return base64UrlEncode(new Uint8Array(hash));
+}
+/**
+ * Base64 URL encode a byte array
+ * Uses URL-safe alphabet without padding as per RFC 4648
+ */
+function base64UrlEncode(buffer) {
+    let binary = '';
+    for (let i = 0; i < buffer.length; i++) {
+        binary += String.fromCharCode(buffer[i]);
+    }
+    return btoa(binary)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Storage key for PKCE state
+ */
+const PKCE_STORAGE_KEY = '@hamak/auth:pkce';
+/**
+ * Store PKCE state for later verification
+ */
+export function storePKCEState(pkceState) {
+    try {
+        sessionStorage.setItem(PKCE_STORAGE_KEY, JSON.stringify(pkceState));
+    }
+    catch {
+        // Fallback to memory if sessionStorage is not available
+        window[PKCE_STORAGE_KEY] = pkceState;
+    }
+}
+/**
+ * Retrieve stored PKCE state
+ */
+export function retrievePKCEState() {
+    try {
+        const stored = sessionStorage.getItem(PKCE_STORAGE_KEY);
+        if (stored) {
+            return JSON.parse(stored);
+        }
+    }
+    catch {
+        // Fallback to memory
+        return window[PKCE_STORAGE_KEY] || null;
+    }
+    return null;
+}
+/**
+ * Clear stored PKCE state
+ */
+export function clearPKCEState() {
+    try {
+        sessionStorage.removeItem(PKCE_STORAGE_KEY);
+    }
+    catch {
+        delete window[PKCE_STORAGE_KEY];
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @hamak/auth
+ *
+ * Complete authentication plugin with password, OAuth2, and Keycloak support.
+ *
+ * Usage:
+ *   import { createAuthPlugin, AUTH_SERVICE_TOKEN } from '@hamak/auth';
+ *   import type { IAuthService } from '@hamak/auth/api';
+ *   import type { ITokenStorage } from '@hamak/auth/spi';
+ */
+export * from './impl';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,QAAQ,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+/**
+ * @hamak/auth
+ *
+ * Complete authentication plugin with password, OAuth2, and Keycloak support.
+ *
+ * Usage:
+ *   import { createAuthPlugin, AUTH_SERVICE_TOKEN } from '@hamak/auth';
+ *   import type { IAuthService } from '@hamak/auth/api';
+ *   import type { ITokenStorage } from '@hamak/auth/spi';
+ */
+export * from './impl';

package/dist/spi/guards/AuthGuard.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Auth Guard Interface
+ * Navigation guards for protected routes
+ */
+import type { IAuthService, User } from '../../api';
+/**
+ * Route metadata that can be used for auth decisions
+ */
+export interface RouteMeta {
+    /** Whether the route requires authentication */
+    requiresAuth?: boolean;
+    /** Required roles to access the route */
+    roles?: string[];
+    /** Required permissions to access the route */
+    permissions?: string[];
+    /** Custom guard function */
+    guard?: (user: User | null) => boolean;
+    /** Path to redirect to if auth fails */
+    redirectTo?: string;
+}
+/**
+ * Guard context passed to auth guards
+ */
+export interface AuthGuardContext {
+    /** The path being navigated to */
+    toPath: string;
+    /** The path being navigated from */
+    fromPath: string | null;
+    /** Route metadata */
+    meta?: RouteMeta;
+    /** The auth service instance */
+    authService: IAuthService;
+    /** Abort navigation */
+    abort: () => void;
+    /** Redirect to a different path */
+    redirect: (path: string) => void;
+    /** Continue with navigation */
+    proceed: () => void;
+}
+/**
+ * Auth guard function type
+ */
+export type AuthGuardFn = (context: AuthGuardContext) => void | Promise<void>;
+/**
+ * Auth guard configuration
+ */
+export interface AuthGuardConfig {
+    /** Path to redirect unauthenticated users */
+    loginPath: string;
+    /** Path to redirect unauthorized users (has auth but wrong permissions) */
+    unauthorizedPath?: string;
+    /** Path to redirect after successful login */
+    afterLoginPath?: string;
+    /** Whether to store the intended path for redirect after login */
+    preserveIntendedPath?: boolean;
+    /** Key to use when storing intended path */
+    intendedPathKey?: string;
+}
+/**
+ * Auth guard manager interface
+ * Manages navigation guards for authentication
+ */
+export interface IAuthGuardManager {
+    /**
+     * Register a global auth guard
+     * @param guard The guard function
+     * @returns Unregister function
+     */
+    register(guard: AuthGuardFn): () => void;
+    /**
+     * Check if navigation to a path is allowed
+     * @param context The guard context
+     * @returns Whether navigation should proceed
+     */
+    check(context: AuthGuardContext): Promise<boolean>;
+    /**
+     * Create a guard that requires authentication
+     * @param config Guard configuration
+     */
+    requireAuth(config?: Partial<AuthGuardConfig>): AuthGuardFn;
+    /**
+     * Create a guard that requires specific roles
+     * @param roles Required roles (user must have at least one)
+     * @param config Guard configuration
+     */
+    requireRoles(roles: string[], config?: Partial<AuthGuardConfig>): AuthGuardFn;
+    /**
+     * Create a guard that requires specific permissions
+     * @param permissions Required permissions (user must have all)
+     * @param config Guard configuration
+     */
+    requirePermissions(permissions: string[], config?: Partial<AuthGuardConfig>): AuthGuardFn;
+    /**
+     * Store the intended path for redirect after login
+     * @param path The path the user intended to visit
+     */
+    setIntendedPath(path: string): void;
+    /**
+     * Get and clear the intended path
+     * @returns The intended path or null
+     */
+    getIntendedPath(): string | null;
+    /**
+     * Clear all registered guards
+     */
+    clear(): void;
+}
+//# sourceMappingURL=AuthGuard.d.ts.map

package/dist/spi/guards/AuthGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthGuard.d.ts","sourceRoot":"","sources":["../../../src/spi/guards/AuthGuard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC;IACvC,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,qBAAqB;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,gCAAgC;IAChC,WAAW,EAAE,YAAY,CAAC;IAC1B,uBAAuB;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,mCAAmC;IACnC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,+BAA+B;IAC/B,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CAAC;IAEzC;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnD;;;OAGG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IAE5D;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IAE9E;;;;OAIG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;IAE1F;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC;;;OAGG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;CACf"}

package/dist/spi/guards/AuthGuard.js

@@ -0,0 +1,5 @@
+/**
+ * Auth Guard Interface
+ * Navigation guards for protected routes
+ */
+export {};

package/dist/spi/guards/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthGuard';
+//# sourceMappingURL=index.d.ts.map

package/dist/spi/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/spi/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/spi/guards/index.js

@@ -0,0 +1 @@
+export * from './AuthGuard';

package/dist/spi/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @hamak/auth/spi
+ *
+ * Service Provider Interfaces for the authentication system.
+ * Contains extension points for implementing custom strategies,
+ * storage providers, and guards.
+ */
+export * from '../api';
+export * from './strategies';
+export * from './storage';
+export * from './guards';
+//# sourceMappingURL=index.d.ts.map

package/dist/spi/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spi/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,cAAc,QAAQ,CAAC;AAGvB,cAAc,cAAc,CAAC;AAG7B,cAAc,WAAW,CAAC;AAG1B,cAAc,UAAU,CAAC"}

package/dist/spi/index.js

@@ -0,0 +1,15 @@
+/**
+ * @hamak/auth/spi
+ *
+ * Service Provider Interfaces for the authentication system.
+ * Contains extension points for implementing custom strategies,
+ * storage providers, and guards.
+ */
+// Re-export API types for convenience
+export * from '../api';
+// Strategy interfaces
+export * from './strategies';
+// Storage interfaces
+export * from './storage';
+// Guard interfaces
+export * from './guards';