@kamod-ch/otok-auth 1.0.0

package/dist/plugin.js

@@ -0,0 +1,132 @@
+import { definePlugin } from "@kamod-ch/otok";
+import { createAuthHelpers } from "./context.js";
+import { createCsrfMiddleware } from "./middleware/csrf.js";
+import { createRequireAuthMiddleware } from "./middleware/require-auth.js";
+import { registerAuthRuntime } from "./registry.js";
+import { createSessionManager } from "./session/manager.js";
+function resolveSessionCookie(options) {
+    return options.cookieName ?? options.sessionCookie ?? "otok_session";
+}
+function resolveSecret(options) {
+    const secret = options.secret ?? process.env.AUTH_SECRET;
+    if (!secret || secret.length < 32) {
+        throw new Error("otok-auth: provide secret (min 32 bytes) or set AUTH_SECRET");
+    }
+    return secret;
+}
+function configureAuthApp(app, options) {
+    resolveSecret(options);
+    const sessionCookie = resolveSessionCookie(options.session);
+    const csrfCookie = options.session.csrfCookie ?? "otok_csrf";
+    const contextKey = options.contextKey ?? "user";
+    const loginPath = options.loginPath ?? "/login";
+    const logoutPath = options.logoutPath ?? "/auth/logout";
+    const redirectAllowlist = options.redirectAllowlist ?? ["/"];
+    const sessions = createSessionManager({
+        sessionCookie,
+        csrfCookie,
+        maxAgeSeconds: options.session.maxAgeSeconds,
+        secure: options.session.secure,
+        sameSite: options.session.sameSite,
+        path: options.session.path,
+        rotationIntervalSeconds: options.session.rotationIntervalSeconds,
+    }, options.adapter);
+    const helpers = createAuthHelpers({
+        sessions,
+        contextKey,
+        loginPath,
+        redirectAllowlist,
+        getRole: options.getRole,
+    });
+    registerAuthRuntime({
+        sessions,
+        helpers,
+        contextKey,
+        loginPath,
+        logoutPath,
+        redirectAllowlist,
+    });
+    app.post(logoutPath, async (c) => {
+        await sessions.revokeSession(c);
+        return c.redirect(loginPath, 303);
+    });
+    app.use("*", async (c, next) => {
+        const user = await sessions.getSessionUser(c);
+        if (user)
+            c.set(contextKey, user);
+        await next();
+    });
+}
+const authPluginFactory = definePlugin({
+    name: "@kamod-ch/otok-auth",
+    version: "1.1.0",
+    schema: {
+        parse(input) {
+            if (!input || typeof input !== "object") {
+                throw new Error("auth() options must be an object");
+            }
+            const record = input;
+            if (!record.session || typeof record.session !== "object") {
+                throw new Error("auth() requires session options");
+            }
+            if (!record.adapter || typeof record.adapter !== "object") {
+                throw new Error("auth() requires a SessionAdapter");
+            }
+            return input;
+        },
+    },
+    envSchema: {
+        parse(input) {
+            return {
+                authSecret: input.AUTH_SECRET,
+            };
+        },
+    },
+});
+/** Otok plugin factory — register after `auth()` in otok.config.ts. */
+export default function auth(options) {
+    const plugin = authPluginFactory(options);
+    plugin.configureApp = ({ app }) => {
+        configureAuthApp(app, options);
+    };
+    return plugin;
+}
+/** Factory for programmatic (non-plugin) setup — same options as the plugin. */
+export function createAuthRuntime(options) {
+    resolveSecret(options);
+    const sessionCookie = resolveSessionCookie(options.session);
+    const csrfCookie = options.session.csrfCookie ?? "otok_csrf";
+    const contextKey = options.contextKey ?? "user";
+    const loginPath = options.loginPath ?? "/login";
+    const redirectAllowlist = options.redirectAllowlist ?? ["/"];
+    const sessions = createSessionManager({
+        sessionCookie,
+        csrfCookie,
+        maxAgeSeconds: options.session.maxAgeSeconds,
+        secure: options.session.secure,
+        sameSite: options.session.sameSite,
+        path: options.session.path,
+        rotationIntervalSeconds: options.session.rotationIntervalSeconds,
+    }, options.adapter);
+    const helpers = createAuthHelpers({
+        sessions,
+        contextKey,
+        loginPath,
+        redirectAllowlist,
+        getRole: options.getRole,
+    });
+    return {
+        ...helpers,
+        sessions,
+        middleware: {
+            requireAuth: createRequireAuthMiddleware({
+                getUser: (c) => sessions.getSessionUser(c),
+                loginPath,
+                contextKey,
+            }),
+            csrf: createCsrfMiddleware({ cookieName: csrfCookie }),
+        },
+    };
+}
+export { configureAuthApp };
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,SAAS,oBAAoB,CAAC,OAAqC;IACjE,OAAO,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,OAA0C;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAS,EAAE,OAA0B;IAC7D,aAAa,CAAC,OAAO,CAAC,CAAC;IAEvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,cAAc,CAAC;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,oBAAoB,CACnC;QACE,aAAa;QACb,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC9B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;QAClC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,uBAAuB;KACjE,EACD,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,QAAQ;QACR,UAAU;QACV,SAAS;QACT,iBAAiB;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,mBAAmB,CAAC;QAClB,QAAQ;QACR,OAAO;QACP,UAAU;QACV,SAAS;QACT,UAAU;QACV,iBAAiB;KAClB,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI;YAAG,CAAa,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAG,YAAY,CAAoB;IACxD,IAAI,EAAE,qBAAqB;IAC3B,OAAO,EAAE,OAAO;IAChB,MAAM,EAAE;QACN,KAAK,CAAC,KAAK;YACT,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,GAAG,KAAgC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,KAA0B,CAAC;QACpC,CAAC;KACF;IACD,SAAS,EAAE;QACT,KAAK,CAAC,KAAK;YACT,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,WAAW;aAC9B,CAAC;QACJ,CAAC;KACF;CACF,CAAC,CAAC;AAEH,uEAAuE;AACvE,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAA0B;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QAChC,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAC/B,OAAiC;IAQjC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,oBAAoB,CACnC;QACE,aAAa;QACb,UAAU;QACV,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;QAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;QAC9B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;QAClC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;QAC1B,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,uBAAuB;KACjE,EACD,OAAO,CAAC,OAAO,CAChB,CAAC;IAEF,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,QAAQ;QACR,UAAU;QACV,SAAS;QACT,iBAAiB;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,OAAO;QACV,QAAQ;QACR,UAAU,EAAE;YACV,WAAW,EAAE,2BAA2B,CAAC;gBACvC,OAAO,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;gBACnD,SAAS;gBACT,UAAU;aACX,CAAC;YACF,IAAI,EAAE,oBAAoB,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;SACvD;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/redirect.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Validates a post-login redirect target against an allowlist.
+ * Only same-origin relative paths are accepted; `//` and external URLs are rejected.
+ */
+export declare function safeRedirectPath(raw: string | null | undefined, allowlist?: readonly string[]): string | null;
+/** @deprecated Use `safeRedirectPath`. Kept for backward compatibility. */
+export declare const safeNextPath: typeof safeRedirectPath;
+//# sourceMappingURL=redirect.d.ts.map

package/dist/redirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,SAAS,GAAE,SAAS,MAAM,EAAsB,GAC/C,MAAM,GAAG,IAAI,CAWf;AAED,2EAA2E;AAC3E,eAAO,MAAM,YAAY,yBAAmB,CAAC"}

package/dist/redirect.js

@@ -0,0 +1,21 @@
+const DEFAULT_ALLOWLIST = ["/"];
+/**
+ * Validates a post-login redirect target against an allowlist.
+ * Only same-origin relative paths are accepted; `//` and external URLs are rejected.
+ */
+export function safeRedirectPath(raw, allowlist = DEFAULT_ALLOWLIST) {
+    if (!raw)
+        return null;
+    if (!raw.startsWith("/") || raw.startsWith("//"))
+        return null;
+    const allowed = allowlist.length > 0 ? allowlist : DEFAULT_ALLOWLIST;
+    const matches = allowed.some((prefix) => {
+        if (prefix === "/")
+            return true;
+        return raw === prefix || raw.startsWith(`${prefix}/`);
+    });
+    return matches ? raw : null;
+}
+/** @deprecated Use `safeRedirectPath`. Kept for backward compatibility. */
+export const safeNextPath = safeRedirectPath;
+//# sourceMappingURL=redirect.js.map

package/dist/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../src/redirect.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,CAAC,GAAG,CAAU,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAA8B,EAC9B,YAA+B,iBAAiB;IAEhD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACtC,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,22 @@
+import type { Context } from "hono";
+import type { AuthHelpers } from "./context.js";
+import type { SessionManager } from "./session/types.js";
+import type { AuthUser } from "./types.js";
+export interface AuthRuntime<TUser extends AuthUser = AuthUser> {
+    sessions: SessionManager<TUser>;
+    helpers: AuthHelpers<TUser>;
+    contextKey: string;
+    loginPath: string;
+    logoutPath: string;
+    redirectAllowlist: readonly string[];
+}
+/** @internal Test helper */
+export declare function resetAuthRuntimeForTests(): void;
+export declare function registerAuthRuntime<TUser extends AuthUser>(value: AuthRuntime<TUser>): void;
+export declare function getAuthRuntime<TUser extends AuthUser = AuthUser>(): AuthRuntime<TUser>;
+export declare function tryGetAuthRuntime<TUser extends AuthUser = AuthUser>(): AuthRuntime<TUser> | null;
+/** Convenience for API routes outside the plugin registry. */
+export declare function getSession<TUser extends AuthUser = AuthUser>(c: Context): Promise<TUser | null>;
+export declare function requireUser<TUser extends AuthUser = AuthUser>(c: Context): Promise<TUser>;
+export declare function requireRole<TUser extends AuthUser = AuthUser>(c: Context, role: string): Promise<TUser>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IAC5D,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAID,4BAA4B;AAC5B,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,SAAS,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI,CAE3F;AAED,wBAAgB,cAAc,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,CAAC,KAAK,CAAC,CAOtF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI,CAEhG;AAED,8DAA8D;AAC9D,wBAAsB,UAAU,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAErG;AAED,wBAAsB,WAAW,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAE/F;AAED,wBAAsB,WAAW,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAE7G"}

package/dist/registry.js

@@ -0,0 +1,28 @@
+let runtime = null;
+/** @internal Test helper */
+export function resetAuthRuntimeForTests() {
+    runtime = null;
+}
+export function registerAuthRuntime(value) {
+    runtime = value;
+}
+export function getAuthRuntime() {
+    if (!runtime) {
+        throw new Error("otok-auth: no auth runtime registered. Add auth() to otok.config.ts plugins or call registerAuthRuntime().");
+    }
+    return runtime;
+}
+export function tryGetAuthRuntime() {
+    return runtime;
+}
+/** Convenience for API routes outside the plugin registry. */
+export async function getSession(c) {
+    return getAuthRuntime().helpers.getSession(c);
+}
+export async function requireUser(c) {
+    return getAuthRuntime().helpers.requireUser(c);
+}
+export async function requireRole(c, role) {
+    return getAuthRuntime().helpers.requireRole(c, role);
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAcA,IAAI,OAAO,GAAuB,IAAI,CAAC;AAEvC,4BAA4B;AAC5B,MAAM,UAAU,wBAAwB;IACtC,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAyB,KAAyB;IACnF,OAAO,GAAG,KAAoB,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,OAAO,OAA6B,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAoC,CAAC;AAC9C,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAoC,CAAU;IAC5E,OAAO,cAAc,EAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAoC,CAAU;IAC7E,OAAO,cAAc,EAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAoC,CAAU,EAAE,IAAY;IAC3F,OAAO,cAAc,EAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}

package/dist/session/index.d.ts

@@ -0,0 +1,3 @@
+export { createSessionManager } from "./manager.js";
+export type { CreateSessionRecordInput, ResolvedSessionRecord, SessionAdapter, SessionConfig, SessionManager, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,2 @@
+export { createSessionManager } from "./manager.js";
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC"}

package/dist/session/manager.d.ts

@@ -0,0 +1,3 @@
+import type { SessionAdapter, SessionConfig, SessionManager } from "./types.js";
+export declare function createSessionManager<TUser>(config: SessionConfig, adapter: SessionAdapter<TUser>): SessionManager<TUser>;
+//# sourceMappingURL=manager.d.ts.map

package/dist/session/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAchF,wBAAgB,oBAAoB,CAAC,KAAK,EACxC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,GAC7B,cAAc,CAAC,KAAK,CAAC,CA6GvB"}

package/dist/session/manager.js

@@ -0,0 +1,120 @@
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { randomToken, sha256 } from "../crypto.js";
+const DEFAULT_MAX_AGE = 60 * 60 * 24 * 14;
+function resolveSecure(c, secure) {
+    if (typeof secure === "function")
+        return secure(c);
+    if (typeof secure === "boolean")
+        return secure;
+    return process.env.NODE_ENV === "production";
+}
+function defaultRotationInterval(maxAgeSeconds) {
+    return Math.floor(maxAgeSeconds / 2);
+}
+export function createSessionManager(config, adapter) {
+    const maxAgeSeconds = config.maxAgeSeconds ?? DEFAULT_MAX_AGE;
+    const path = config.path ?? "/";
+    const sameSite = config.sameSite ?? "Lax";
+    const rotationIntervalSeconds = config.rotationIntervalSeconds ?? defaultRotationInterval(maxAgeSeconds);
+    const resolvedConfig = {
+        ...config,
+        sessionCookie: config.sessionCookie,
+        maxAgeSeconds,
+        rotationIntervalSeconds,
+    };
+    function setSessionCookies(c, token) {
+        const secure = resolveSecure(c, config.secure);
+        setCookie(c, config.sessionCookie, token, {
+            httpOnly: true,
+            secure,
+            sameSite,
+            path,
+            maxAge: maxAgeSeconds,
+        });
+        if (config.csrfCookie) {
+            setCookie(c, config.csrfCookie, randomToken(), {
+                httpOnly: false,
+                secure,
+                sameSite,
+                path,
+                maxAge: maxAgeSeconds,
+            });
+        }
+    }
+    async function createSession(c, userId) {
+        const token = randomToken();
+        const tokenHash = sha256(token);
+        const expiresAt = new Date(Date.now() + maxAgeSeconds * 1000);
+        await adapter.createRecord({
+            tokenHash,
+            userId,
+            expiresAt,
+            userAgent: c.req.header("user-agent") ?? null,
+            ipAddress: null,
+        });
+        setSessionCookies(c, token);
+    }
+    async function revokeSession(c) {
+        const token = getCookie(c, config.sessionCookie);
+        if (token)
+            await adapter.revokeRecord(sha256(token));
+        deleteCookie(c, config.sessionCookie, { path });
+        if (config.csrfCookie)
+            deleteCookie(c, config.csrfCookie, { path });
+    }
+    async function rotateSession(c) {
+        const token = getCookie(c, config.sessionCookie);
+        if (!token)
+            return;
+        const tokenHash = sha256(token);
+        const record = adapter.resolveRecord ? await adapter.resolveRecord(tokenHash) : null;
+        if (!record) {
+            await revokeSession(c);
+            return;
+        }
+        await adapter.revokeRecord(tokenHash);
+        const newToken = randomToken();
+        const newHash = sha256(newToken);
+        await adapter.createRecord({
+            tokenHash: newHash,
+            userId: record.userId,
+            expiresAt: record.expiresAt,
+            userAgent: c.req.header("user-agent") ?? null,
+            ipAddress: null,
+        });
+        setSessionCookies(c, newToken);
+    }
+    async function getSessionUser(c) {
+        const token = getCookie(c, config.sessionCookie);
+        if (!token)
+            return null;
+        const tokenHash = sha256(token);
+        const user = await adapter.resolveUser(tokenHash);
+        if (!user)
+            return null;
+        if (adapter.resolveRecord) {
+            const record = await adapter.resolveRecord(tokenHash);
+            if (record) {
+                const ageSeconds = (Date.now() - record.createdAt.getTime()) / 1000;
+                if (ageSeconds >= rotationIntervalSeconds) {
+                    await rotateSession(c);
+                }
+                else {
+                    await adapter.touchRecord?.(tokenHash);
+                }
+            }
+        }
+        else {
+            await adapter.touchRecord?.(tokenHash);
+        }
+        return user;
+    }
+    return {
+        createSession,
+        revokeSession,
+        rotateSession,
+        getSessionUser,
+        config: resolvedConfig,
+    };
+}
+//# sourceMappingURL=manager.js.map

package/dist/session/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/session/manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGnD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1C,SAAS,aAAa,CAAC,CAAU,EAAE,MAA4C;IAC7E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAqB;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,OAA8B;IAE9B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,eAAe,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,IAAI,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAEzG,MAAM,cAAc,GAAoC;QACtD,GAAG,MAAM;QACT,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa;QACb,uBAAuB;KACxB,CAAC;IAEF,SAAS,iBAAiB,CAAC,CAAU,EAAE,KAAa;QAClD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE;YACxC,QAAQ,EAAE,IAAI;YACd,MAAM;YACN,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE;gBAC7C,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,CAAU,EAAE,MAAc;QACrD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC;QAC9D,MAAM,OAAO,CAAC,YAAY,CAAC;YACzB,SAAS;YACT,MAAM;YACN,SAAS;YACT,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YAC7C,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,iBAAiB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,CAAU;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,KAAK;YAAE,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,UAAU;YAAE,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,CAAU;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;YAC7C,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,CAAU;QACtC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;gBACpE,IAAI,UAAU,IAAI,uBAAuB,EAAE,CAAC;oBAC1C,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,aAAa;QACb,aAAa;QACb,aAAa;QACb,cAAc;QACd,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC"}

package/dist/session/types.d.ts

@@ -0,0 +1,41 @@
+import type { Context } from "hono";
+export interface SessionConfig {
+    sessionCookie: string;
+    csrfCookie?: string;
+    maxAgeSeconds?: number;
+    secure?: boolean | ((c: Context) => boolean);
+    sameSite?: "Strict" | "Lax" | "None";
+    path?: string;
+    /** Rotate session token after this interval (seconds). Defaults to half of maxAgeSeconds. */
+    rotationIntervalSeconds?: number;
+}
+export interface CreateSessionRecordInput {
+    tokenHash: string;
+    userId: string;
+    expiresAt: Date;
+    userAgent: string | null;
+    ipAddress: string | null;
+}
+export interface ResolvedSessionRecord {
+    tokenHash: string;
+    userId: string;
+    createdAt: Date;
+    expiresAt: Date;
+}
+export interface SessionAdapter<TUser> {
+    createRecord(input: CreateSessionRecordInput): Promise<void>;
+    revokeRecord(tokenHash: string): Promise<void>;
+    resolveUser(tokenHash: string): Promise<TUser | null>;
+    touchRecord?(tokenHash: string): Promise<void>;
+    /** Return session metadata for rotation decisions. */
+    resolveRecord?(tokenHash: string): Promise<ResolvedSessionRecord | null>;
+}
+export interface SessionManager<TUser> {
+    createSession(c: Context, userId: string): Promise<void>;
+    revokeSession(c: Context): Promise<void>;
+    /** Re-issue session cookie with a new token for the same user (rotation). */
+    rotateSession(c: Context): Promise<void>;
+    getSessionUser(c: Context): Promise<TUser | null>;
+    readonly config: Required<Pick<SessionConfig, "sessionCookie" | "maxAgeSeconds">> & SessionConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/session/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC,YAAY,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACtD,WAAW,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,sDAAsD;IACtD,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,6EAA6E;IAC7E,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,GAAG,eAAe,CAAC,CAAC,GAAG,aAAa,CAAC;CACnG"}

package/dist/session/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/session/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/session/types.ts"],"names":[],"mappings":""}

package/dist/types.d.ts

@@ -0,0 +1,43 @@
+import type { Context } from "hono";
+import type { SessionAdapter } from "./session/types.js";
+/** Default user shape — extend in your app via generics. */
+export interface AuthUser {
+    id: string;
+    email?: string | null;
+    name?: string | null;
+    role?: string;
+    [key: string]: unknown;
+}
+export interface AuthSession<TUser extends AuthUser = AuthUser> {
+    user: TUser;
+    userId: string;
+    issuedAt: Date;
+    expiresAt: Date;
+}
+export interface AuthPluginSessionOptions {
+    /** Session cookie name. Alias: `cookieName`. */
+    cookieName?: string;
+    sessionCookie?: string;
+    csrfCookie?: string;
+    maxAgeSeconds?: number;
+    secure?: boolean | ((c: Context) => boolean);
+    sameSite?: "Strict" | "Lax" | "None";
+    path?: string;
+    /** Rotate session token after this many seconds (default: half of maxAge). */
+    rotationIntervalSeconds?: number;
+}
+export interface AuthPluginOptions<TUser extends AuthUser = AuthUser> {
+    session: AuthPluginSessionOptions;
+    /** Required for plugin mode — app-owned persistence. */
+    adapter: SessionAdapter<TUser>;
+    /** HMAC secret for signed payloads (min 32 bytes). Falls back to env AUTH_SECRET. */
+    secret?: string;
+    contextKey?: string;
+    loginPath?: string;
+    logoutPath?: string;
+    /** Allowed post-login redirect path prefixes (open-redirect safe). */
+    redirectAllowlist?: readonly string[];
+    /** Role accessor for RBAC helpers. */
+    getRole?: (user: TUser) => string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,4DAA4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IAC5D,IAAI,EAAE,KAAK,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IAClE,OAAO,EAAE,wBAAwB,CAAC;IAClC,wDAAwD;IACxD,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC;CACnC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,110 @@
+{
+  "name": "@kamod-ch/otok-auth",
+  "version": "1.0.0",
+  "description": "Cookie sessions, CSRF, and route middleware helpers for Otok apps.",
+  "homepage": "https://github.com/kamod-ch/otok/tree/main/packages/otok-auth#readme",
+  "bugs": {
+    "url": "https://github.com/kamod-ch/otok/issues"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kamod-ch/otok.git",
+    "directory": "packages/otok-auth"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./session": {
+      "types": "./dist/session/index.d.ts",
+      "default": "./dist/session/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/middleware/index.d.ts",
+      "default": "./dist/middleware/index.js"
+    },
+    "./csrf": {
+      "types": "./dist/csrf.d.ts",
+      "default": "./dist/csrf.js"
+    },
+    "./password": {
+      "types": "./dist/password.d.ts",
+      "default": "./dist/password.js"
+    },
+    "./password/webcrypto": {
+      "types": "./dist/password-webcrypto.d.ts",
+      "default": "./dist/password-webcrypto.js"
+    },
+    "./adapters/memory": {
+      "types": "./dist/adapters/index.d.ts",
+      "default": "./dist/adapters/index.js"
+    },
+    "./adapters/kysely": {
+      "types": "./dist/adapters/kysely.d.ts",
+      "default": "./dist/adapters/kysely.js"
+    },
+    "./plugin": {
+      "types": "./dist/plugin.d.ts",
+      "default": "./dist/plugin.js"
+    },
+    "./context": {
+      "types": "./dist/context.d.ts",
+      "default": "./dist/context.js"
+    },
+    "./registry": {
+      "types": "./dist/registry.d.ts",
+      "default": "./dist/registry.js"
+    },
+    "./loader": {
+      "types": "./dist/loader.d.ts",
+      "default": "./dist/loader.js"
+    },
+    "./redirect": {
+      "types": "./dist/redirect.d.ts",
+      "default": "./dist/redirect.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@kamod-ch/otok": "1.0.0",
+    "@kamod-ch/otok-test": "1.0.0",
+    "@node-rs/argon2": "^2.0.2",
+    "@types/node": "^24.12.2",
+    "hono": "^4.13.8",
+    "kysely": "^0.29.2",
+    "preact": "^10.28.2",
+    "typescript": "~6.0.2",
+    "vitest": "^4.1.2"
+  },
+  "peerDependencies": {
+    "@kamod-ch/otok": ">=0.6.1",
+    "@node-rs/argon2": ">=2.0.0",
+    "hono": ">=4",
+    "kysely": ">=0.27.0"
+  },
+  "peerDependenciesMeta": {
+    "@node-rs/argon2": {
+      "optional": true
+    },
+    "kysely": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}