@kamod-ch/otok-auth 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kamod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,230 @@
+# @kamod-ch/otok-auth
+
+Cookie sessions, CSRF, and route middleware helpers for [Otok](https://github.com/kamod-ch/otok) apps.
+
+Ships as an **Otok plugin** (`auth()`) and as **composition helpers** for manual wiring.
+
+## Install
+
+```bash
+pnpm add @kamod-ch/otok-auth hono @kamod-ch/otok
+```
+
+## Plugin (recommended)
+
+```ts
+import { defineConfig } from "@kamod-ch/otok";
+import auth from "@kamod-ch/otok-auth";
+import { createMemorySessionAdapter } from "@kamod-ch/otok-auth/adapters/memory";
+
+export default defineConfig({
+  plugins: [
+    auth({
+      secret: process.env.AUTH_SECRET!,
+      session: { cookieName: "otok_session" },
+      adapter: createMemorySessionAdapter({ resolveUser: ({ session }) => users.get(session.userId) ?? null }),
+      redirectAllowlist: ["/", "/dashboard"],
+      getRole: (user) => user.role,
+    }),
+  ],
+});
+```
+
+## Loaders
+
+```ts
+import { defineLoader } from "@kamod-ch/otok-auth/loader";
+
+export const loader = defineLoader(async ({ auth }) => {
+  const user = await auth.requireUser();
+  return { user };
+});
+```
+
+## Server APIs
+
+```ts
+import { getSession, requireUser, requireRole } from "@kamod-ch/otok-auth/registry";
+```
+
+## Composition (manual wiring)
+
+This package remains **composition-friendly**. Database schema and user lookup stay in your app via a `SessionAdapter`.
+
+
+```ts
+import { createSessionManager, type SessionAdapter } from "@kamod-ch/otok-auth/session";
+
+type User = { id: string; email: string };
+
+const adapter: SessionAdapter<User> = {
+  async createRecord(input) { /* persist tokenHash + userId */ },
+  async revokeRecord(tokenHash) { /* mark revoked */ },
+  async resolveUser(tokenHash) { /* return user or null */ },
+};
+
+const sessions = createSessionManager<User>(
+  {
+    sessionCookie: "app_session",
+    csrfCookie: "app_csrf",
+    maxAgeSeconds: 60 * 60 * 24 * 14,
+    secure: process.env.NODE_ENV === "production",
+  },
+  adapter,
+);
+
+export const { createSession, revokeSession, getSessionUser } = sessions;
+```
+
+## Route middleware
+
+```ts
+// src/app/routes/_middleware.ts
+import { createRequireAuthMiddleware } from "@kamod-ch/otok-auth/middleware";
+import { getSessionUser } from "../features/auth/session.js";
+
+export default createRequireAuthMiddleware({
+  getUser: getSessionUser,
+  publicPaths: ["/login"],
+  onAuthenticated: (c, user) => {
+    c.set("user", user);
+  },
+});
+```
+
+## Tenant and role middleware
+
+Compose auth with tenant context and optional RBAC:
+
+```ts
+import {
+  composeMiddleware,
+  createRequireAuthMiddleware,
+  createRequireRoleMiddleware,
+  createTenantMiddleware,
+} from "@kamod-ch/otok-auth/middleware";
+
+export default composeMiddleware(
+  createRequireAuthMiddleware({ getUser: getSessionUser, publicPaths: ["/login"] }),
+  createTenantMiddleware({
+    getTenantId: (user) => user.organizationId,
+    contextKey: "organizationId",
+    also: { role: (user) => user.role },
+  }),
+  createRequireRoleMiddleware({
+    getRole: (user) => user.role,
+    allowed: ["owner", "admin"],
+  }),
+);
+```
+
+## CSRF
+
+```ts
+import { createCsrfMiddleware } from "@kamod-ch/otok-auth/middleware";
+import { ensureCsrfCookie, CSRF_FIELD } from "@kamod-ch/otok-auth/csrf";
+
+// Option A: dedicated middleware
+export default createCsrfMiddleware({ cookieName: "app_csrf" });
+
+// Option B: hidden field in forms
+<input type="hidden" name={CSRF_FIELD} value={ensureCsrfCookie(c)} />
+```
+
+## API guard (`configure()`)
+
+Route `_middleware.ts` does **not** run for Hono routes registered via `createOtokApp({ configure })`. Use `createApiGuard`:
+
+```ts
+import { createApiGuard } from "@kamod-ch/otok-auth/middleware";
+
+const requireApiUser = createApiGuard(getSessionUser);
+
+configure: (app) => {
+  app.get("/api/me", async (c) => {
+    const user = await requireApiUser(c);
+    if (!user) return c.json({ error: { code: "unauthorized" } }, 401);
+    return c.json(user);
+  });
+};
+```
+
+## Password helpers
+
+```ts
+import { hashPassword, verifyPassword } from "@kamod-ch/otok-auth/password";
+```
+
+Requires peer dependency `@node-rs/argon2` (Node / `nodejs_compat` Workers).
+
+### Edge / Workers (Web Crypto)
+
+When native Argon2 is unavailable, use PBKDF2 via Web Crypto:
+
+```ts
+import {
+  hashPasswordWebCrypto,
+  verifyPasswordWebCrypto,
+} from "@kamod-ch/otok-auth/password/webcrypto";
+
+const hash = await hashPasswordWebCrypto("secret");
+await verifyPasswordWebCrypto(hash, "secret");
+```
+
+Prefer Argon2 on Node. Do not mix hash formats without a migration path.
+
+## Exports
+
+| Subpath | Purpose |
+|---------|---------|
+| `@kamod-ch/otok-auth` | Re-exports |
+| `@kamod-ch/otok-auth/session` | Session manager + types |
+| `@kamod-ch/otok-auth/middleware` | Auth, CSRF, tenant context, RBAC, `composeMiddleware` |
+| `@kamod-ch/otok-auth/csrf` | CSRF cookie/field helpers |
+| `@kamod-ch/otok-auth/password` | Argon2 hash/verify |
+| `@kamod-ch/otok-auth/password/webcrypto` | Edge-safe PBKDF2 hash/verify |
+| `@kamod-ch/otok-auth/adapters/memory` | In-memory/file-backed session adapter |
+| `@kamod-ch/otok-auth/adapters/kysely` | Kysely session CRUD adapter |
+
+## Memory session adapter
+
+For dev, tests, or file-backed prototypes:
+
+```ts
+import { createMemorySessionAdapter } from "@kamod-ch/otok-auth/adapters/memory";
+
+const adapter = createMemorySessionAdapter<User>({
+  resolveUser: ({ session }) => users.get(session.userId) ?? null,
+  persistence: {
+    load: () => readSessionsFromDisk(),
+    save: (sessions) => writeSessionsToDisk(sessions),
+  },
+});
+```
+
+`resolveUser` stays app-specific. The adapter handles session CRUD, expiry, revoke, and touch.
+
+## Kysely session adapter
+
+For Postgres/SQLite apps using Kysely:
+
+```ts
+import { createKyselySessionAdapter } from "@kamod-ch/otok-auth/adapters/kysely";
+
+const adapter = createKyselySessionAdapter<User>({
+  db,
+  table: "appSession",
+  resolveUser: async (tokenHash) => {
+    return db
+      .selectFrom("appSession")
+      .innerJoin("appUser", "appUser.id", "appSession.userId")
+      .select(["appUser.id", "appUser.email"])
+      .where("appSession.tokenHash", "=", tokenHash)
+      .where("appSession.revokedAt", "is", null)
+      .where("appSession.expiresAt", ">", new Date())
+      .executeTakeFirst();
+  },
+});
+```
+
+A reference SQL migration is exported as `SESSION_TABLE_MIGRATION_SQL`.

package/dist/adapters/index.d.ts

@@ -0,0 +1,2 @@
+export { createMemorySessionAdapter, type MemorySessionAdapterOptions, type MemorySessionPersistence, type MemorySessionRecord, } from "./memory.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC"}

package/dist/adapters/index.js

@@ -0,0 +1,2 @@
+export { createMemorySessionAdapter, } from "./memory.js";
+//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAI3B,MAAM,aAAa,CAAC"}

package/dist/adapters/kysely.d.ts

@@ -0,0 +1,12 @@
+import type { Kysely } from "kysely";
+import type { SessionAdapter } from "../session/types.js";
+export declare const SESSION_TABLE_MIGRATION_SQL = "-- Reference migration for @kamod-ch/otok-auth session adapters\nCREATE TABLE IF NOT EXISTS app_session (\n  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n  user_id UUID NOT NULL REFERENCES app_user(id) ON DELETE CASCADE,\n  token_hash TEXT NOT NULL UNIQUE,\n  user_agent TEXT,\n  ip_address TEXT,\n  expires_at TIMESTAMPTZ NOT NULL,\n  revoked_at TIMESTAMPTZ,\n  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n  last_seen_at TIMESTAMPTZ\n);\n\nCREATE INDEX IF NOT EXISTS app_session_token_hash_idx ON app_session (token_hash);\nCREATE INDEX IF NOT EXISTS app_session_user_id_idx ON app_session (user_id);\nCREATE INDEX IF NOT EXISTS app_session_expires_at_idx ON app_session (expires_at);\n";
+export interface KyselySessionAdapterOptions<TUser> {
+    db: Kysely<any>;
+    /** Kysely table name, e.g. "appSession". */
+    table: string;
+    /** App-specific lookup: joins, roles, tenant context, etc. */
+    resolveUser: (tokenHash: string) => Promise<TUser | null> | TUser | null;
+}
+export declare function createKyselySessionAdapter<TUser>(options: KyselySessionAdapterOptions<TUser>): SessionAdapter<TUser>;
+//# sourceMappingURL=kysely.d.ts.map

package/dist/adapters/kysely.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely.d.ts","sourceRoot":"","sources":["../../src/adapters/kysely.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAA4B,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,2BAA2B,2rBAgBvC,CAAC;AAEF,MAAM,WAAW,2BAA2B,CAAC,KAAK;IAChD,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;CAC1E;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAC9C,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAC1C,cAAc,CAAC,KAAK,CAAC,CAkCvB"}

package/dist/adapters/kysely.js

@@ -0,0 +1,52 @@
+export const SESSION_TABLE_MIGRATION_SQL = `-- Reference migration for @kamod-ch/otok-auth session adapters
+CREATE TABLE IF NOT EXISTS app_session (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES app_user(id) ON DELETE CASCADE,
+  token_hash TEXT NOT NULL UNIQUE,
+  user_agent TEXT,
+  ip_address TEXT,
+  expires_at TIMESTAMPTZ NOT NULL,
+  revoked_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  last_seen_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS app_session_token_hash_idx ON app_session (token_hash);
+CREATE INDEX IF NOT EXISTS app_session_user_id_idx ON app_session (user_id);
+CREATE INDEX IF NOT EXISTS app_session_expires_at_idx ON app_session (expires_at);
+`;
+export function createKyselySessionAdapter(options) {
+    const { db, table, resolveUser } = options;
+    return {
+        async createRecord(input) {
+            await db
+                .insertInto(table)
+                .values({
+                userId: input.userId,
+                tokenHash: input.tokenHash,
+                expiresAt: input.expiresAt,
+                userAgent: input.userAgent,
+                ipAddress: input.ipAddress,
+            })
+                .execute();
+        },
+        async revokeRecord(tokenHash) {
+            await db
+                .updateTable(table)
+                .set({ revokedAt: new Date() })
+                .where("tokenHash", "=", tokenHash)
+                .execute();
+        },
+        async resolveUser(tokenHash) {
+            return resolveUser(tokenHash);
+        },
+        async touchRecord(tokenHash) {
+            await db
+                .updateTable(table)
+                .set({ lastSeenAt: new Date() })
+                .where("tokenHash", "=", tokenHash)
+                .execute();
+        },
+    };
+}
+//# sourceMappingURL=kysely.js.map

package/dist/adapters/kysely.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely.js","sourceRoot":"","sources":["../../src/adapters/kysely.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;;CAgB1C,CAAC;AAUF,MAAM,UAAU,0BAA0B,CACxC,OAA2C;IAE3C,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE3C,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,KAA+B;YAChD,MAAM,EAAE;iBACL,UAAU,CAAC,KAAK,CAAC;iBACjB,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;iBACD,OAAO,EAAE,CAAC;QACf,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,SAAS;YAC1B,MAAM,EAAE;iBACL,WAAW,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC9B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,OAAO,EAAE,CAAC;QACf,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,MAAM,EAAE;iBACL,WAAW,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAC/B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,OAAO,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/memory.d.ts

@@ -0,0 +1,26 @@
+import type { SessionAdapter } from "../session/types.js";
+export interface MemorySessionRecord {
+    tokenHash: string;
+    userId: string;
+    createdAt: Date;
+    expiresAt: Date;
+    userAgent: string | null;
+    ipAddress: string | null;
+    revokedAt: Date | null;
+    lastSeenAt: Date | null;
+}
+export interface MemorySessionPersistence {
+    load: () => MemorySessionRecord[] | Promise<MemorySessionRecord[]>;
+    save: (sessions: MemorySessionRecord[]) => void | Promise<void>;
+}
+export interface MemorySessionAdapterOptions<TUser> {
+    resolveUser: (input: {
+        tokenHash: string;
+        session: MemorySessionRecord;
+    }) => Promise<TUser | null> | TUser | null;
+    persistence?: MemorySessionPersistence;
+    /** Used when no persistence hook is configured (mainly tests). */
+    initialSessions?: MemorySessionRecord[];
+}
+export declare function createMemorySessionAdapter<TUser>(options: MemorySessionAdapterOptions<TUser>): SessionAdapter<TUser>;
+//# sourceMappingURL=memory.d.ts.map

package/dist/adapters/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/adapters/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEpF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,2BAA2B,CAAC,KAAK;IAChD,WAAW,EAAE,CAAC,KAAK,EAAE;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,mBAAmB,CAAC;KAC9B,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,kEAAkE;IAClE,eAAe,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACzC;AAMD,wBAAgB,0BAA0B,CAAC,KAAK,EAC9C,OAAO,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAC1C,cAAc,CAAC,KAAK,CAAC,CAiEvB"}

package/dist/adapters/memory.js

@@ -0,0 +1,72 @@
+function isActive(session, now = Date.now()) {
+    return !session.revokedAt && session.expiresAt.getTime() > now;
+}
+export function createMemorySessionAdapter(options) {
+    let sessions = [];
+    let loaded = false;
+    async function ensureLoaded() {
+        if (loaded)
+            return;
+        sessions = options.persistence
+            ? [...(await options.persistence.load())]
+            : [...(options.initialSessions ?? [])];
+        loaded = true;
+    }
+    async function persist() {
+        if (options.persistence) {
+            await options.persistence.save(sessions);
+        }
+    }
+    return {
+        async createRecord(input) {
+            await ensureLoaded();
+            sessions = sessions.filter((session) => session.tokenHash !== input.tokenHash);
+            sessions.push({
+                tokenHash: input.tokenHash,
+                userId: input.userId,
+                createdAt: new Date(),
+                expiresAt: input.expiresAt,
+                userAgent: input.userAgent,
+                ipAddress: input.ipAddress,
+                revokedAt: null,
+                lastSeenAt: null,
+            });
+            await persist();
+        },
+        async revokeRecord(tokenHash) {
+            await ensureLoaded();
+            const session = sessions.find((entry) => entry.tokenHash === tokenHash);
+            if (session)
+                session.revokedAt = new Date();
+            await persist();
+        },
+        async resolveUser(tokenHash) {
+            await ensureLoaded();
+            const session = sessions.find((entry) => entry.tokenHash === tokenHash && isActive(entry));
+            if (!session)
+                return null;
+            return options.resolveUser({ tokenHash, session });
+        },
+        async touchRecord(tokenHash) {
+            await ensureLoaded();
+            const session = sessions.find((entry) => entry.tokenHash === tokenHash);
+            if (!session)
+                return;
+            session.lastSeenAt = new Date();
+            await persist();
+        },
+        async resolveRecord(tokenHash) {
+            await ensureLoaded();
+            const session = sessions.find((entry) => entry.tokenHash === tokenHash && isActive(entry));
+            if (!session)
+                return null;
+            return {
+                tokenHash: session.tokenHash,
+                userId: session.userId,
+                createdAt: session.createdAt,
+                expiresAt: session.expiresAt,
+            };
+        },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/dist/adapters/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/adapters/memory.ts"],"names":[],"mappings":"AA4BA,SAAS,QAAQ,CAAC,OAA4B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9D,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAA2C;IAE3C,IAAI,QAAQ,GAA0B,EAAE,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,KAAK,UAAU,YAAY;QACzB,IAAI,MAAM;YAAE,OAAO;QACnB,QAAQ,GAAG,OAAO,CAAC,WAAW;YAC5B,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,UAAU,OAAO;QACpB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,KAA+B;YAChD,MAAM,YAAY,EAAE,CAAC;YACrB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/E,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,SAAS;YAC1B,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,OAAO;gBAAE,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,OAAO,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,OAAO,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,SAAS;YAC3B,MAAM,YAAY,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,36 @@
+import type { Context } from "hono";
+import type { SessionManager } from "./session/types.js";
+import type { AuthSession, AuthUser } from "./types.js";
+export interface AuthHelpersOptions<TUser extends AuthUser> {
+    sessions: SessionManager<TUser>;
+    contextKey?: string;
+    loginPath?: string;
+    redirectAllowlist?: readonly string[];
+    getRole?: (user: TUser) => string;
+}
+export interface AuthHelpers<TUser extends AuthUser = AuthUser> {
+    getSession(c: Context): Promise<TUser | null>;
+    requireUser(c: Context): Promise<TUser>;
+    requireRole(c: Context, role: string): Promise<TUser>;
+    safeRedirect(raw: string | null | undefined): string | null;
+    createSession(c: Context, userId: string): Promise<void>;
+    revokeSession(c: Context): Promise<void>;
+    rotateSession(c: Context): Promise<void>;
+}
+export declare function createAuthHelpers<TUser extends AuthUser>(options: AuthHelpersOptions<TUser>): AuthHelpers<TUser>;
+/** Build typed session metadata from a resolved user (optional helper). */
+export declare function toAuthSession<TUser extends AuthUser>(user: TUser, getUserId: (user: TUser) => string, expiresAt: Date): AuthSession<TUser>;
+/** Read user from Hono context (set by auth middleware or helpers). */
+export declare function readContextUser<TUser extends AuthUser = AuthUser>(c: Context, contextKey?: string): TUser | undefined;
+/** Helpers bound to a single request context (for loaders/actions). */
+export interface AuthBoundHelpers<TUser extends AuthUser = AuthUser> {
+    getSession(): Promise<TUser | null>;
+    requireUser(): Promise<TUser>;
+    requireRole(role: string): Promise<TUser>;
+    safeRedirect(raw: string | null | undefined): string | null;
+    createSession(userId: string): Promise<void>;
+    revokeSession(): Promise<void>;
+    rotateSession(): Promise<void>;
+}
+export declare function authFromOtokContext<TUser extends AuthUser = AuthUser>(hono: Context, helpers: AuthHelpers<TUser>): AuthBoundHelpers<TUser>;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,kBAAkB,CAAC,KAAK,SAAS,QAAQ;IACxD,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,WAAW,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IAC5D,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC9C,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACtD,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5D,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,SAAS,QAAQ,EACtD,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,GACjC,WAAW,CAAC,KAAK,CAAC,CAwCpB;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,KAAK,SAAS,QAAQ,EAClD,IAAI,EAAE,KAAK,EACX,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,EAClC,SAAS,EAAE,IAAI,GACd,WAAW,CAAC,KAAK,CAAC,CAOpB;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EAC/D,CAAC,EAAE,OAAO,EACV,UAAU,SAAS,GAClB,KAAK,GAAG,SAAS,CAEnB;AAED,uEAAuE;AACvE,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IACjE,UAAU,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACpC,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACnE,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,GAC1B,gBAAgB,CAAC,KAAK,CAAC,CAUzB"}

package/dist/context.js

@@ -0,0 +1,68 @@
+import { redirect } from "@kamod-ch/otok/server";
+import { AuthError } from "./errors.js";
+import { safeRedirectPath } from "./redirect.js";
+export function createAuthHelpers(options) {
+    const contextKey = options.contextKey ?? "user";
+    const loginPath = options.loginPath ?? "/login";
+    const redirectAllowlist = options.redirectAllowlist ?? ["/"];
+    async function getSession(c) {
+        const cached = c.get(contextKey);
+        if (cached)
+            return cached;
+        const user = await options.sessions.getSessionUser(c);
+        if (user)
+            c.set(contextKey, user);
+        return user;
+    }
+    async function requireUser(c) {
+        const user = await getSession(c);
+        if (!user)
+            redirect(loginPath, 303);
+        return user;
+    }
+    async function requireRole(c, role) {
+        const user = await requireUser(c);
+        if (!options.getRole) {
+            throw new AuthError("forbidden", "Role checks are not configured");
+        }
+        const userRole = options.getRole(user);
+        if (userRole !== role) {
+            throw new AuthError("forbidden", "Insufficient permissions");
+        }
+        return user;
+    }
+    return {
+        getSession,
+        requireUser,
+        requireRole,
+        safeRedirect: (raw) => safeRedirectPath(raw, redirectAllowlist),
+        createSession: (c, userId) => options.sessions.createSession(c, userId),
+        revokeSession: (c) => options.sessions.revokeSession(c),
+        rotateSession: (c) => options.sessions.rotateSession(c),
+    };
+}
+/** Build typed session metadata from a resolved user (optional helper). */
+export function toAuthSession(user, getUserId, expiresAt) {
+    return {
+        user,
+        userId: getUserId(user),
+        issuedAt: new Date(),
+        expiresAt,
+    };
+}
+/** Read user from Hono context (set by auth middleware or helpers). */
+export function readContextUser(c, contextKey = "user") {
+    return c.get(contextKey);
+}
+export function authFromOtokContext(hono, helpers) {
+    return {
+        getSession: () => helpers.getSession(hono),
+        requireUser: () => helpers.requireUser(hono),
+        requireRole: (role) => helpers.requireRole(hono, role),
+        safeRedirect: helpers.safeRedirect,
+        createSession: (userId) => helpers.createSession(hono, userId),
+        revokeSession: () => helpers.revokeSession(hono),
+        rotateSession: () => helpers.rotateSession(hono),
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAsBjD,MAAM,UAAU,iBAAiB,CAC/B,OAAkC;IAElC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,KAAK,UAAU,UAAU,CAAC,CAAU;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,CAAU;QACnC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,CAAU,EAAE,IAAY;QACjD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,UAAU;QACV,WAAW;QACX,WAAW;QACX,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC/D,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC;QACvE,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QACvD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,IAAW,EACX,SAAkC,EAClC,SAAe;IAEf,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;QACvB,QAAQ,EAAE,IAAI,IAAI,EAAE;QACpB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAC7B,CAAU,EACV,UAAU,GAAG,MAAM;IAEnB,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;AAChD,CAAC;AAaD,MAAM,UAAU,mBAAmB,CACjC,IAAa,EACb,OAA2B;IAE3B,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QAC5C,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;QACtD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;QAC9D,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;QAChD,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,5 @@
+export declare function sha256(value: string): string;
+/** Edge-compatible SHA-256 via Web Crypto API. */
+export declare function sha256Async(value: string): Promise<string>;
+export declare function randomToken(bytes?: number): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAWA,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5C;AAED,kDAAkD;AAClD,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhE;AAED,wBAAgB,WAAW,CAAC,KAAK,SAAK,GAAG,MAAM,CAO9C"}

package/dist/crypto.js

@@ -0,0 +1,33 @@
+import { createHash, randomBytes } from "node:crypto";
+function bytesToBase64Url(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64url");
+    }
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function sha256(value) {
+    if (typeof createHash === "function") {
+        return createHash("sha256").update(value).digest("hex");
+    }
+    throw new Error("otok-auth: sha256 requires Node crypto or use sha256Async for Web Crypto");
+}
+/** Edge-compatible SHA-256 via Web Crypto API. */
+export async function sha256Async(value) {
+    if (typeof globalThis.crypto?.subtle?.digest === "function") {
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+        return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+    }
+    return sha256(value);
+}
+export function randomToken(bytes = 32) {
+    if (typeof globalThis.crypto?.getRandomValues === "function") {
+        const arr = new Uint8Array(bytes);
+        crypto.getRandomValues(arr);
+        return bytesToBase64Url(arr);
+    }
+    return randomBytes(bytes).toString("base64url");
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;AAC9F,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,19 @@
+import type { Context } from "hono";
+export declare const CSRF_FIELD = "_csrf";
+export declare const DEFAULT_CSRF_COOKIE = "otok_csrf";
+export interface CsrfOptions {
+    cookieName?: string;
+    secure?: boolean | ((c: Context) => boolean);
+    sameSite?: "Strict" | "Lax" | "None";
+    path?: string;
+    maxAge?: number;
+}
+export declare function createCsrfToken(): string;
+/** Ensure a CSRF cookie exists on safe requests (GET/HEAD). */
+export declare function ensureCsrfCookie(c: Context, options?: CsrfOptions): string;
+export declare function verifyCsrf(c: Context, formToken?: string | null, options?: Pick<CsrfOptions, "cookieName">): boolean;
+/** Reject mutating form posts when the cookie and form field do not match. */
+export declare function assertCsrf(c: Context, formData: FormData | undefined, options?: Pick<CsrfOptions, "cookieName">): void;
+/** Hidden input snippet for progressive-enhancement forms. */
+export declare function csrfHiddenInput(token: string): string;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAKpC,eAAO,MAAM,UAAU,UAAU,CAAC;AAClC,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAQD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAa9E;AAED,wBAAgB,UAAU,CACxB,CAAC,EAAE,OAAO,EACV,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAM,GAC5C,OAAO,CAOT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CACxB,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAM,GAC5C,IAAI,CAKN;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD"}