@mars-stack/core 0.4.0

package/dist/auth/internal-api-key.js

@@ -0,0 +1,30 @@
+import { constantTimeEqual } from '../chunk-MXQ66RUN.js';
+import 'server-only';
+
+var MIN_INTERNAL_API_KEY_LENGTH = 32;
+function parseInternalApiKeys() {
+  const raw = process.env.INTERNAL_API_KEY;
+  if (!raw) return [];
+  return raw.split(",").map((k) => k.trim()).filter((k) => k.length >= MIN_INTERNAL_API_KEY_LENGTH);
+}
+function getRequiredInternalApiKey() {
+  const keys = parseInternalApiKeys();
+  if (keys.length === 0) {
+    throw new Error("INTERNAL_API_KEY must be set and at least 32 characters long");
+  }
+  return keys[0];
+}
+function getInternalApiKeys() {
+  return parseInternalApiKeys();
+}
+function isInternalApiRequestAuthorized(authHeader, expectedApiKeys) {
+  if (!authHeader) return false;
+  const keys = Array.isArray(expectedApiKeys) ? expectedApiKeys : [expectedApiKeys];
+  for (const key of keys) {
+    const expected = `Bearer ${key}`;
+    if (constantTimeEqual(authHeader, expected)) return true;
+  }
+  return false;
+}
+
+export { getInternalApiKeys, getRequiredInternalApiKey, isInternalApiRequestAuthorized };

package/dist/auth/link-utils.d.ts

@@ -0,0 +1,13 @@
+export interface BuildEmailVerificationUrlParams {
+    baseUrl: string;
+    token: string;
+}
+export interface BuildPasswordResetUrlParams {
+    baseUrl: string;
+    token: string;
+    email: string;
+}
+export declare function normalizeEmailFromQueryParam(rawEmail: string): string;
+export declare function buildEmailVerificationUrl({ baseUrl, token, }: BuildEmailVerificationUrlParams): string;
+export declare function buildPasswordResetUrl({ baseUrl, token, email, }: BuildPasswordResetUrlParams): string;
+//# sourceMappingURL=link-utils.d.ts.map

package/dist/auth/link-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-utils.d.ts","sourceRoot":"","sources":["../../src/auth/link-utils.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,yBAAyB,CAAC,EACxC,OAAO,EACP,KAAK,GACN,EAAE,+BAA+B,GAAG,MAAM,CAE1C;AAED,wBAAgB,qBAAqB,CAAC,EACpC,OAAO,EACP,KAAK,EACL,KAAK,GACN,EAAE,2BAA2B,GAAG,MAAM,CAKtC"}

package/dist/auth/link-utils.js

@@ -0,0 +1 @@
+export { buildEmailVerificationUrl, buildPasswordResetUrl, normalizeEmailFromQueryParam } from '../chunk-WBJOIENS.js';

package/dist/auth/middleware.d.ts

@@ -0,0 +1,56 @@
+import { NextRequest, NextResponse } from 'next/server';
+import type { SessionPayload } from './session';
+export interface AuthenticatedRequest extends NextRequest {
+    session: SessionPayload;
+}
+export type AuthenticatedAPIHandler = (request: AuthenticatedRequest, context: {
+    params: Promise<{
+        [key: string]: string;
+    }>;
+}) => Promise<NextResponse>;
+export type AuthenticatedAPIHandlerNoParams = (request: AuthenticatedRequest) => Promise<NextResponse>;
+export type AuthenticatedAPIHandlerSimple = () => Promise<NextResponse>;
+interface AuthMiddlewareConfig {
+    verifySession: () => Promise<SessionPayload | null>;
+    findUserRole: (userId: string) => Promise<string | null>;
+}
+/**
+ * Creates authentication middleware wrappers for Next.js API routes.
+ * All wrappers verify the session, attach it to the request, and return
+ * appropriate HTTP error responses on failure.
+ *
+ * @param config - Configuration with session verifier and role lookup
+ * @returns An object containing withAuth, withAuthNoParams, withAuthSimple, withRole, and withOwnership wrappers
+ * @example
+ * const { withAuth, withRole, withOwnership } = createAuthMiddleware({
+ *   verifySession: () => sessions.verifySessionForAPI(),
+ *   findUserRole: (userId) => db.user.findRole(userId),
+ * });
+ * export const GET = withAuth(async (req, ctx) => { ... });
+ * export const DELETE = withRole(['admin'], async (req, ctx) => { ... });
+ */
+export declare function createAuthMiddleware(config: AuthMiddlewareConfig): {
+    withAuth: (handler: AuthenticatedAPIHandler) => (request: NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<NextResponse>;
+    withAuthNoParams: (handler: AuthenticatedAPIHandlerNoParams) => (request: NextRequest) => Promise<NextResponse>;
+    withAuthSimple: (handler: AuthenticatedAPIHandlerSimple) => (_request: NextRequest) => Promise<NextResponse>;
+    withRole: (allowedRoles: string[], handler: AuthenticatedAPIHandler) => (request: NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<NextResponse>;
+    withOwnership: (getResourceUserId: (request: AuthenticatedRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<string | null | undefined>, handler: AuthenticatedAPIHandler) => (request: NextRequest, context: {
+        params: Promise<{
+            [key: string]: string;
+        }>;
+    }) => Promise<NextResponse>;
+};
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGhD,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,KACpD,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,MAAM,+BAA+B,GAAG,CAC5C,OAAO,EAAE,oBAAoB,KAC1B,OAAO,CAAC,YAAY,CAAC,CAAC;AAE3B,MAAM,MAAM,6BAA6B,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;AAExE,UAAU,oBAAoB;IAC5B,aAAa,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB;wBACpC,uBAAuB,MAE9C,SAAS,WAAW,EACpB,SAAS;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,KACtD,OAAO,CAAC,YAAY,CAAC;gCAgBS,+BAA+B,MAClD,SAAS,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC;8BAgB3B,6BAA6B,MAC9C,UAAU,WAAW,KAAG,OAAO,CAAC,YAAY,CAAC;6BAa7B,MAAM,EAAE,WAAW,uBAAuB,eAjD7D,WAAW,WACX;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,KACtD,OAAO,CAAC,YAAY,CAAC;uCA6DL,CACjB,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,KACpD,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,WAC9B,uBAAuB,eAnErB,WAAW,WACX;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,KACtD,OAAO,CAAC,YAAY,CAAC;EAyF3B"}

package/dist/auth/middleware.js

@@ -0,0 +1,3 @@
+export { createAuthMiddleware } from '../chunk-QWMN5UJC.js';
+import '../chunk-ZA46T6GX.js';
+import '../chunk-MXQ66RUN.js';

package/dist/auth/password.d.ts

@@ -0,0 +1,28 @@
+import 'server-only';
+import { z } from 'zod';
+/** Zod schema enforcing password strength rules: 8-100 chars, mixed case, digit, special char, no common patterns. */
+export declare const passwordSchema: z.ZodString;
+/**
+ * Hashes a password using SHA-256 prehash followed by bcrypt (cost 12).
+ * The prehash step allows bcrypt to work with passwords of any length while
+ * maintaining a domain separator to prevent cross-protocol collisions.
+ *
+ * @param password - The plaintext password to hash
+ * @returns The bcrypt hash string
+ * @example
+ * const hash = await hashPassword('mySecureP@ss1');
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verifies a plaintext password against a stored bcrypt hash.
+ * Attempts prehashed comparison first, then falls back to direct comparison
+ * for backwards compatibility with legacy hashes.
+ *
+ * @param plainPassword - The plaintext password to verify
+ * @param hashedPassword - The stored bcrypt hash
+ * @returns True if the password matches
+ * @example
+ * const valid = await verifyPassword('mySecureP@ss1', storedHash);
+ */
+export declare function verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,sHAAsH;AACtH,eAAO,MAAM,cAAc,aAYqE,CAAC;AAEjG;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAMlB"}

package/dist/auth/password.js

@@ -0,0 +1 @@
+export { hashPassword, passwordSchema, verifyPassword } from '../chunk-WO6FHJHG.js';

package/dist/auth/reset-token.d.ts

@@ -0,0 +1,3 @@
+import 'server-only';
+export declare function hashPasswordResetToken(token: string): Promise<string>;
+//# sourceMappingURL=reset-token.d.ts.map

package/dist/auth/reset-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-token.d.ts","sourceRoot":"","sources":["../../src/auth/reset-token.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAMrB,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E"}

package/dist/auth/reset-token.js

@@ -0,0 +1,9 @@
+import { hashToken } from '../chunk-MXQ66RUN.js';
+import 'server-only';
+
+var RESET_TOKEN_DOMAIN = "reset-token-v1";
+async function hashPasswordResetToken(token) {
+  return hashToken(token, RESET_TOKEN_DOMAIN);
+}
+
+export { hashPasswordResetToken };

package/dist/auth/responses.d.ts

@@ -0,0 +1,15 @@
+import 'server-only';
+import { NextResponse } from 'next/server';
+export declare const AUTH_RESPONSES: {
+    readonly UNAUTHORIZED: () => NextResponse<{
+        error: string;
+    }>;
+    readonly FORBIDDEN: () => NextResponse<{
+        error: string;
+    }>;
+    readonly SERVER_ERROR: () => NextResponse<{
+        error: string;
+    }>;
+};
+export declare function validateOwnership(resourceUserId: string, sessionUserId: string): boolean;
+//# sourceMappingURL=responses.d.ts.map

package/dist/auth/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/auth/responses.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C,eAAO,MAAM,cAAc;;;;;;;;;;CAajB,CAAC;AAEX,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAExF"}

package/dist/auth/responses.js

@@ -0,0 +1,2 @@
+export { AUTH_RESPONSES, validateOwnership } from '../chunk-ZA46T6GX.js';
+import '../chunk-MXQ66RUN.js';

package/dist/auth/session.d.ts

@@ -0,0 +1,79 @@
+import 'server-only';
+export interface SessionPayload {
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    fingerprint: string;
+    emailVerified: boolean;
+    credentialTag: string;
+    createdAt: number;
+    expiresAt: number;
+    lastActivity: number;
+}
+/**
+ * Encrypts a session payload into a JWE token using AES-256-GCM with a HKDF-derived key.
+ *
+ * @param payload - The session data to encrypt
+ * @param secret - The JWT secret used to derive the encryption key
+ * @returns The encrypted JWE token string
+ * @example
+ * const token = await encrypt(sessionPayload, process.env.JWT_SECRET);
+ */
+export declare function encrypt(payload: SessionPayload, secret: string): Promise<string>;
+/**
+ * Decrypts a JWE session token and validates expiration, inactivity, and absolute lifetime.
+ * Deletes the session cookie if decryption fails (e.g. legacy/corrupted cookie).
+ *
+ * @param session - The encrypted JWE token string (or undefined)
+ * @param secret - The JWT secret used to derive the decryption key
+ * @returns The decrypted session payload, or null if invalid/expired
+ * @example
+ * const session = await decrypt(cookieValue, process.env.JWT_SECRET);
+ * if (session) console.log(session.userId);
+ */
+export declare function decrypt(session: string | undefined, secret: string): Promise<SessionPayload | null>;
+interface SessionManagerConfig {
+    getJWTSecret: () => string;
+    signInRoute: string;
+    validateCredential: (userId: string, credentialTag: string) => Promise<boolean>;
+}
+/**
+ * Creates a session manager with methods for creating, reading, updating, and
+ * deleting encrypted HTTP-only session cookies. Uses HKDF-derived keys and
+ * validates credential tags against the database on every read.
+ *
+ * @param config - Configuration with JWT secret accessor, sign-in route, and credential validator
+ * @returns An object with session lifecycle methods
+ * @example
+ * const sessions = createSessionManager({
+ *   getJWTSecret: () => env.JWT_SECRET,
+ *   signInRoute: '/sign-in',
+ *   validateCredential: async (userId, tag) => db.user.checkCredential(userId, tag),
+ * });
+ * await sessions.createSession(user);
+ */
+export declare function createSessionManager(config: SessionManagerConfig): {
+    createSession: (user: {
+        id: string;
+        email: string;
+        name: string;
+        role: string;
+        emailVerified: boolean;
+        credentialTag: string;
+    }) => Promise<void>;
+    getSession: () => Promise<SessionPayload | null>;
+    updateSession: () => Promise<void>;
+    deleteSession: () => Promise<void>;
+    verifySession: () => Promise<SessionPayload>;
+    verifySessionForAPI: () => Promise<SessionPayload | null>;
+    getCurrentUser: () => Promise<{
+        id: string;
+        email: string;
+        name: string;
+        role: string;
+        emailVerified: boolean;
+    } | null>;
+};
+export {};
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAwCrB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMtF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,SAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAkC9G;AAED,UAAU,oBAAoB;IAC5B,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB;0BAC5B;QACjC,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;KACvB,KAAG,OAAO,CAAC,IAAI,CAAC;sBA6BY,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;yBAiB3B,OAAO,CAAC,IAAI,CAAC;yBAyBb,OAAO,CAAC,IAAI,CAAC;yBAKP,OAAO,CAAC,cAAc,CAAC;+BAUjB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;0BAKzC,OAAO,CAAC;QACvC,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;KACxB,GAAG,IAAI,CAAC;EAsBV"}

package/dist/auth/session.js

@@ -0,0 +1 @@
+export { createSessionManager, decrypt, encrypt } from '../chunk-4LS3QDD5.js';

package/dist/auth/types.d.ts

@@ -0,0 +1,18 @@
+export interface AuthError {
+    code: string;
+    message: string;
+}
+export interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    role: string;
+    emailVerified: boolean;
+}
+export declare enum AuthErrorCode {
+    INVALID_CREDENTIALS = "invalid_credentials",
+    EMAIL_NOT_VERIFIED = "email_not_verified",
+    ACCOUNT_LOCKED = "account_locked",
+    SERVER_ERROR = "server_error"
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,oBAAY,aAAa;IACvB,mBAAmB,wBAAwB;IAC3C,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;CAC9B"}

package/dist/auth/types.js

@@ -0,0 +1,10 @@
+// src/auth/types.ts
+var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
+  AuthErrorCode2["INVALID_CREDENTIALS"] = "invalid_credentials";
+  AuthErrorCode2["EMAIL_NOT_VERIFIED"] = "email_not_verified";
+  AuthErrorCode2["ACCOUNT_LOCKED"] = "account_locked";
+  AuthErrorCode2["SERVER_ERROR"] = "server_error";
+  return AuthErrorCode2;
+})(AuthErrorCode || {});
+
+export { AuthErrorCode };

package/dist/auth/validation.d.ts

@@ -0,0 +1,146 @@
+import { z } from 'zod';
+/** Individual field-level Zod schemas for email, password, name, token, and confirmPassword. */
+export declare const fieldSchemas: {
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodString;
+    token: z.ZodString;
+    confirmPassword: z.ZodString;
+};
+/** Client-side form validation schemas with cross-field refinements (e.g. password confirmation). */
+export declare const formSchemas: {
+    login: z.ZodObject<{
+        email: z.ZodString;
+        password: z.ZodString;
+    }, z.core.$strip>;
+    signup: z.ZodObject<{
+        email: z.ZodString;
+        password: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        confirmPassword: z.ZodString;
+        termsAccepted: z.ZodBoolean;
+        marketingOptIn: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    forgotPassword: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    resetPassword: z.ZodObject<{
+        token: z.ZodString;
+        email: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodString>;
+        password: z.ZodString;
+        confirmPassword: z.ZodString;
+    }, z.core.$strip>;
+    emailVerification: z.ZodObject<{
+        token: z.ZodString;
+        email: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodString>>;
+    }, z.core.$strip>;
+};
+/** Server-side API validation schemas (no confirmPassword field — that's a client concern). */
+export declare const apiSchemas: {
+    login: z.ZodObject<{
+        email: z.ZodString;
+        password: z.ZodString;
+    }, z.core.$strip>;
+    signup: z.ZodObject<{
+        email: z.ZodString;
+        password: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        termsAccepted: z.ZodBoolean;
+        marketingOptIn: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>;
+    forgotPassword: z.ZodObject<{
+        email: z.ZodString;
+    }, z.core.$strip>;
+    resetPassword: z.ZodObject<{
+        token: z.ZodString;
+        email: z.ZodString;
+        password: z.ZodString;
+    }, z.core.$strip>;
+    emailVerification: z.ZodObject<{
+        token: z.ZodString;
+        email: z.ZodOptional<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodString>>;
+    }, z.core.$strip>;
+};
+export type LoginFormData = z.infer<typeof formSchemas.login>;
+export type SignupFormData = z.infer<typeof formSchemas.signup>;
+export type ForgotPasswordFormData = z.infer<typeof formSchemas.forgotPassword>;
+export type ResetPasswordFormData = z.infer<typeof formSchemas.resetPassword>;
+export type EmailVerificationData = z.infer<typeof formSchemas.emailVerification>;
+/**
+ * Calculates a password strength score based on character diversity and common pattern avoidance.
+ *
+ * @param password - The password to evaluate
+ * @returns An object with a numeric score (0-7) and a strength label
+ * @example
+ * const { score, strength } = getPasswordStrength('MyP@ss99!');
+ * // { score: 7, strength: 'Strong' }
+ */
+export declare function getPasswordStrength(password: string): {
+    score: number;
+    strength: 'Weak' | 'Medium' | 'Strong';
+};
+/**
+ * Returns a boolean map of which password requirements are satisfied.
+ * Useful for rendering a live requirements checklist in signup forms.
+ *
+ * @param password - The password to check
+ * @returns An object with boolean flags for each requirement
+ * @example
+ * const reqs = getPasswordRequirements('Hello1!');
+ * // { length: false, lowercase: true, uppercase: true, number: true, special: true, ... }
+ */
+export declare function getPasswordRequirements(password: string): {
+    length: boolean;
+    lowercase: boolean;
+    uppercase: boolean;
+    number: boolean;
+    special: boolean;
+    noPassword: boolean;
+    noSequential: boolean;
+};
+/**
+ * Validates a single value against a Zod schema.
+ *
+ * @param schema - The Zod schema to validate against
+ * @param value - The value to validate
+ * @returns The first error message string, or null if valid
+ * @example
+ * const error = validateField(fieldSchemas.email, 'bad');
+ * // 'Please enter a valid email address'
+ */
+export declare function validateField<T extends z.ZodSchema>(schema: T, value: unknown): string | null;
+/**
+ * Validates a complete form data object against a Zod schema.
+ *
+ * @param schema - The Zod schema to validate against
+ * @param data - The form data object to validate
+ * @returns An object with success flag, parsed data (or null), and a path-keyed errors map
+ * @example
+ * const result = validateForm(formSchemas.login, { email: '', password: '' });
+ * // { success: false, data: null, errors: { email: 'Email is required', ... } }
+ */
+export declare function validateForm<T extends z.ZodSchema>(schema: T, data: unknown): {
+    success: boolean;
+    data: z.core.output<T>;
+    errors: {};
+} | {
+    success: boolean;
+    data: null;
+    errors: Record<string, string>;
+};
+export declare const passwordSchema: z.ZodString;
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const signupSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    termsAccepted: z.ZodBoolean;
+    marketingOptIn: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const forgotPasswordSchema: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/auth/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,gGAAgG;AAChG,eAAO,MAAM,YAAY;;;;;;CAwBxB,CAAC;AA0CF,qGAAqG;AACrG,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;CAgBvB,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;CAoBtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC9D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAChE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;AAChF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC;AAC9E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,iBAAiB,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAa3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM;;;;;;;;EAUvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,iBAG7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO;;;;;;;;EAW3E;AAED,eAAO,MAAM,cAAc,aAAwB,CAAC;AACpD,eAAO,MAAM,WAAW;;;iBAAmB,CAAC;AAC5C,eAAO,MAAM,YAAY;;;;;;iBAAoB,CAAC;AAC9C,eAAO,MAAM,oBAAoB;;iBAA4B,CAAC"}

package/dist/auth/validation.js

@@ -0,0 +1,116 @@
+import { normalizeEmailFromQueryParam } from '../chunk-WBJOIENS.js';
+import { z } from 'zod';
+
+var fieldSchemas = {
+  email: z.string().min(1, "Email is required").email("Please enter a valid email address"),
+  password: z.string().min(8, "Password must be at least 8 characters").max(100, "Password must be less than 100 characters").regex(/[A-Z]/, "Password must contain at least one uppercase letter").regex(/[a-z]/, "Password must contain at least one lowercase letter").regex(/[0-9]/, "Password must contain at least one number").regex(/[^A-Za-z0-9]/, "Password must contain at least one special character").refine((password) => !password.toLowerCase().includes("password"), "Password cannot contain 'password'").refine((password) => !password.includes("123"), "Password cannot contain sequential numbers"),
+  name: z.string().min(1, "Name is required").min(2, "Name must be at least 2 characters").max(100, "Name must be less than 100 characters").regex(/^[a-zA-Z\s'-]+$/, "Name can only contain letters, spaces, hyphens, and apostrophes"),
+  token: z.string().min(1, "Token is required"),
+  confirmPassword: z.string().min(1, "Please confirm your password")
+};
+var baseSchemas = {
+  login: z.object({
+    email: fieldSchemas.email,
+    password: z.string().min(1, "Password is required")
+  }),
+  signupBase: z.object({
+    email: fieldSchemas.email,
+    password: fieldSchemas.password,
+    name: fieldSchemas.name.optional(),
+    confirmPassword: fieldSchemas.confirmPassword,
+    termsAccepted: z.boolean().refine((val) => val === true, "You must accept the terms and conditions"),
+    marketingOptIn: z.boolean().optional()
+  }),
+  forgotPassword: z.object({
+    email: fieldSchemas.email
+  }),
+  resetPasswordBase: z.object({
+    token: fieldSchemas.token,
+    email: z.preprocess(
+      (value) => typeof value === "string" ? normalizeEmailFromQueryParam(value) : value,
+      fieldSchemas.email
+    ),
+    password: fieldSchemas.password,
+    confirmPassword: fieldSchemas.confirmPassword
+  }),
+  emailVerification: z.object({
+    token: fieldSchemas.token,
+    email: z.preprocess(
+      (value) => typeof value === "string" ? normalizeEmailFromQueryParam(value) : value,
+      fieldSchemas.email
+    ).optional()
+  })
+};
+var formSchemas = {
+  login: baseSchemas.login,
+  signup: baseSchemas.signupBase.refine((data) => data.password === data.confirmPassword, {
+    message: "Passwords do not match",
+    path: ["confirmPassword"]
+  }),
+  forgotPassword: baseSchemas.forgotPassword,
+  resetPassword: baseSchemas.resetPasswordBase.refine(
+    (data) => data.password === data.confirmPassword,
+    { message: "Passwords do not match", path: ["confirmPassword"] }
+  ),
+  emailVerification: baseSchemas.emailVerification
+};
+var apiSchemas = {
+  login: baseSchemas.login,
+  signup: z.object({
+    email: fieldSchemas.email,
+    password: fieldSchemas.password,
+    name: fieldSchemas.name.optional(),
+    termsAccepted: z.boolean().refine((val) => val === true, "You must accept the terms and conditions"),
+    marketingOptIn: z.boolean().optional()
+  }),
+  forgotPassword: baseSchemas.forgotPassword,
+  resetPassword: z.object({
+    token: fieldSchemas.token,
+    email: fieldSchemas.email,
+    password: fieldSchemas.password
+  }),
+  emailVerification: baseSchemas.emailVerification
+};
+function getPasswordStrength(password) {
+  let score = 0;
+  if (password.length >= 8) score++;
+  if (/[a-z]/.test(password)) score++;
+  if (/[A-Z]/.test(password)) score++;
+  if (/[0-9]/.test(password)) score++;
+  if (/[^A-Za-z0-9]/.test(password)) score++;
+  if (!password.toLowerCase().includes("password")) score++;
+  if (!password.includes("123")) score++;
+  const strength = score >= 6 ? "Strong" : score >= 4 ? "Medium" : "Weak";
+  return { score, strength };
+}
+function getPasswordRequirements(password) {
+  return {
+    length: password.length >= 8 && password.length <= 100,
+    lowercase: /[a-z]/.test(password),
+    uppercase: /[A-Z]/.test(password),
+    number: /[0-9]/.test(password),
+    special: /[^A-Za-z0-9]/.test(password),
+    noPassword: !password.toLowerCase().includes("password"),
+    noSequential: !password.includes("123")
+  };
+}
+function validateField(schema, value) {
+  const result = schema.safeParse(value);
+  return result.success ? null : result.error.issues[0]?.message || "Invalid value";
+}
+function validateForm(schema, data) {
+  const result = schema.safeParse(data);
+  if (result.success) return { success: true, data: result.data, errors: {} };
+  const errors = {};
+  result.error.issues.forEach((issue) => {
+    const path = issue.path.join(".");
+    errors[path] = issue.message;
+  });
+  return { success: false, data: null, errors };
+}
+var passwordSchema = fieldSchemas.password;
+var loginSchema = apiSchemas.login;
+var signupSchema = apiSchemas.signup;
+var forgotPasswordSchema = apiSchemas.forgotPassword;
+
+export { apiSchemas, fieldSchemas, forgotPasswordSchema, formSchemas, getPasswordRequirements, getPasswordStrength, loginSchema, passwordSchema, signupSchema, validateField, validateForm };

package/dist/auth/validators.d.ts

@@ -0,0 +1,4 @@
+export declare function validateEmail(value: string): string | undefined;
+export declare function validatePassword(value: string): string | undefined;
+export declare function validateRequired(fieldName: string): (value: string) => string | undefined;
+//# sourceMappingURL=validators.d.ts.map

package/dist/auth/validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../src/auth/validators.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO/D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUlE;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,IACxC,OAAO,MAAM,KAAG,MAAM,GAAG,SAAS,CAI3C"}

package/dist/auth/validators.js

@@ -0,0 +1,27 @@
+import { passwordSchema } from '../chunk-WO6FHJHG.js';
+
+// src/auth/validators.ts
+function validateEmail(value) {
+  if (!value) return "Email is required";
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!emailRegex.test(value)) return "Please enter a valid email address";
+  return void 0;
+}
+function validatePassword(value) {
+  if (!value) return "Password is required";
+  try {
+    passwordSchema.parse(value);
+    return void 0;
+  } catch (error) {
+    if (error instanceof Error) return error.message;
+    return "Password validation failed";
+  }
+}
+function validateRequired(fieldName) {
+  return (value) => {
+    if (!value) return `${fieldName} is required`;
+    return void 0;
+  };
+}
+
+export { validateEmail, validatePassword, validateRequired };