@nexpress/core 0.1.0

package/dist/chunk-OK5HOCQI.js

@@ -0,0 +1,845 @@
+import {
+  recordAuditEvent
+} from "./chunk-RIPHIRPP.js";
+import {
+  getCommunitySettings
+} from "./chunk-PPBWRKO2.js";
+import {
+  NpAuthError,
+  NpForbiddenError,
+  NpNotFoundError,
+  NpValidationError
+} from "./chunk-ZCINJSS4.js";
+import {
+  readEnvPositiveInt
+} from "./chunk-OROPGO65.js";
+import {
+  getDb
+} from "./chunk-XANPEOJC.js";
+import {
+  npMemberIdentities,
+  npMemberSessions,
+  npMembers,
+  npSessions,
+  npUserOAuthIdentities,
+  npUsers
+} from "./chunk-M43PGOQY.js";
+
+// src/config/access.ts
+var authenticated = ({ user }) => !!user;
+var isAdmin = ({ user }) => user?.role === "admin";
+var isEditorOrAbove = ({ user }) => !!user && (user.role === "admin" || user.role === "editor");
+var isOwnerOrAdmin = ({ user, doc }) => user?.role === "admin" || doc?.createdBy === user?.id;
+
+// src/auth/token.ts
+import { randomBytes } from "crypto";
+import { jwtVerify, SignJWT, errors as joseErrors } from "jose";
+var textEncoder = new TextEncoder();
+async function signToken(user, secret, expirationSeconds = 7200, tokenUse = "access") {
+  const secretKey = textEncoder.encode(secret);
+  return new SignJWT({
+    sub: user.id,
+    role: user.role,
+    ver: user.tokenVersion,
+    use: tokenUse
+  }).setProtectedHeader({ alg: "HS256" }).setJti(randomBytes(16).toString("base64url")).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expirationSeconds).sign(secretKey);
+}
+async function verifyToken(token, secret, expectedUse) {
+  const secretKey = textEncoder.encode(secret);
+  const { payload } = await jwtVerify(token, secretKey);
+  const typed = payload;
+  if (typed.use !== "access" && typed.use !== "refresh") {
+    throw new NpAuthError("Staff token missing `use` claim");
+  }
+  const use = typed.use;
+  if (expectedUse && use !== expectedUse) {
+    throw new NpAuthError(
+      `Staff token use mismatch: expected ${expectedUse}, got ${use}`
+    );
+  }
+  return { ...typed, use };
+}
+function isTokenVerificationError(err) {
+  if (err instanceof NpAuthError) return true;
+  if (err instanceof joseErrors.JOSEError) return true;
+  return false;
+}
+
+// src/auth/password.ts
+import { hash, verify } from "@node-rs/argon2";
+var ARGON2_OPTIONS = {
+  memoryCost: 19456,
+  timeCost: 2,
+  outputLen: 32,
+  parallelism: 1
+};
+var TEST_ARGON2_OPTIONS = {
+  memoryCost: 8,
+  timeCost: 1,
+  outputLen: 32,
+  parallelism: 1
+};
+function hashPassword(password) {
+  return hash(
+    password,
+    process.env.NP_TEST_FAST_HASH === "1" ? TEST_ARGON2_OPTIONS : ARGON2_OPTIONS
+  );
+}
+function verifyPassword(passwordHash, password) {
+  return verify(passwordHash, password);
+}
+
+// src/auth/csrf.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function verifyCsrf(method, cookieToken, headerToken) {
+  if (SAFE_METHODS.has(method.toUpperCase())) {
+    return true;
+  }
+  return Boolean(cookieToken && headerToken && cookieToken === headerToken);
+}
+
+// src/auth/oauth-providers.ts
+var providers = /* @__PURE__ */ new Map();
+function registerOAuthProvider(provider) {
+  if (!provider.id || typeof provider.id !== "string") {
+    throw new Error("OAuth provider must have a non-empty string id");
+  }
+  if (typeof provider.authorize !== "function" || typeof provider.exchange !== "function") {
+    throw new Error(
+      `OAuth provider "${provider.id}" must implement authorize() and exchange()`
+    );
+  }
+  providers.set(provider.id, provider);
+}
+function getOAuthProvider(id) {
+  return providers.get(id);
+}
+function listOAuthProviders() {
+  return Array.from(providers.values());
+}
+function resetOAuthProviders() {
+  providers.clear();
+}
+
+// src/auth/oauth-resolve.ts
+import { eq, and, sql } from "drizzle-orm";
+var SYNTHETIC_EMAIL_SUFFIX = ".oauth.local";
+function syntheticEmail(provider, providerUserId) {
+  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX}`;
+}
+function deriveName(profile, fallbackEmail) {
+  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();
+  const localPart = fallbackEmail.split("@")[0];
+  return localPart && localPart.length > 0 ? localPart : "Member";
+}
+async function resolveOAuthLogin(input) {
+  const db = getDb();
+  const provider = input.provider;
+  const profile = input.profile;
+  const role = input.defaultRole ?? "viewer";
+  const [existingLink] = await db.select({
+    userId: npUserOAuthIdentities.userId,
+    identityId: npUserOAuthIdentities.id
+  }).from(npUserOAuthIdentities).where(
+    and(
+      eq(npUserOAuthIdentities.provider, provider),
+      eq(npUserOAuthIdentities.providerUserId, profile.providerUserId)
+    )
+  ).limit(1);
+  if (existingLink) {
+    const metadata = mergeMetadata(profile);
+    await db.update(npUserOAuthIdentities).set({ metadata, updatedAt: /* @__PURE__ */ new Date() }).where(eq(npUserOAuthIdentities.id, existingLink.identityId));
+    const user = await loadUser(db, existingLink.userId);
+    return { user, created: false, linked: false };
+  }
+  if (profile.email) {
+    const normalizedEmail = profile.email.trim().toLowerCase();
+    const [existingUser] = await db.select({
+      id: npUsers.id,
+      email: npUsers.email,
+      name: npUsers.name,
+      role: npUsers.role,
+      tokenVersion: npUsers.tokenVersion
+    }).from(npUsers).where(eq(sql`lower(${npUsers.email})`, normalizedEmail)).limit(1);
+    if (existingUser) {
+      await db.insert(npUserOAuthIdentities).values({
+        userId: existingUser.id,
+        provider,
+        providerUserId: profile.providerUserId,
+        metadata: mergeMetadata(profile)
+      });
+      return { user: existingUser, created: false, linked: true };
+    }
+  }
+  const email = profile.email && profile.email.trim().length > 0 ? profile.email.trim().toLowerCase() : syntheticEmail(provider, profile.providerUserId);
+  const name = deriveName(profile, email);
+  const placeholderPassword = await hashPassword(
+    crypto.randomUUID() + crypto.randomUUID()
+  );
+  const [created] = await db.insert(npUsers).values({
+    email,
+    name,
+    password: placeholderPassword,
+    role
+  }).returning({
+    id: npUsers.id,
+    email: npUsers.email,
+    name: npUsers.name,
+    role: npUsers.role,
+    tokenVersion: npUsers.tokenVersion
+  });
+  await db.insert(npUserOAuthIdentities).values({
+    userId: created.id,
+    provider,
+    providerUserId: profile.providerUserId,
+    metadata: mergeMetadata(profile)
+  });
+  return { user: created, created: true, linked: true };
+}
+function mergeMetadata(profile) {
+  const base = {};
+  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;
+  if (profile.email) base.email = profile.email;
+  if (profile.name) base.name = profile.name;
+  if (profile.metadata) Object.assign(base, profile.metadata);
+  return base;
+}
+async function loadUser(db, userId) {
+  const [row] = await db.select({
+    id: npUsers.id,
+    email: npUsers.email,
+    name: npUsers.name,
+    role: npUsers.role,
+    tokenVersion: npUsers.tokenVersion
+  }).from(npUsers).where(eq(npUsers.id, userId)).limit(1);
+  if (!row) {
+    throw new Error(`User ${userId} referenced by oauth identity is missing`);
+  }
+  return row;
+}
+
+// src/auth/oauth-resolve-member.ts
+import { and as and2, eq as eq2, sql as sql2 } from "drizzle-orm";
+var SYNTHETIC_EMAIL_SUFFIX2 = ".oauth.local";
+var HANDLE_FALLBACK = "user";
+var HANDLE_RANDOM_SUFFIX_BYTES = 4;
+function syntheticEmail2(provider, providerUserId) {
+  return `${providerUserId}@${provider}${SYNTHETIC_EMAIL_SUFFIX2}`;
+}
+function generateHandle(profile, fallbackEmail) {
+  const seed = profile.metadata && typeof profile.metadata.login === "string" && profile.metadata.login || profile.name || fallbackEmail.split("@")[0] || HANDLE_FALLBACK;
+  const sanitized = String(seed).toLowerCase().replace(/[^a-z0-9_-]/g, "-").replace(/^[-_]+/, "").slice(0, 20);
+  const base = sanitized.length >= 3 ? sanitized : HANDLE_FALLBACK;
+  const suffix = Math.random().toString(36).slice(2, 2 + HANDLE_RANDOM_SUFFIX_BYTES);
+  return `${base}-${suffix}`.slice(0, 30);
+}
+function deriveDisplayName(profile, fallbackEmail) {
+  if (profile.name && profile.name.trim().length > 0) return profile.name.trim();
+  const localPart = fallbackEmail.split("@")[0];
+  return localPart && localPart.length > 0 ? localPart : "Member";
+}
+function mergeMetadata2(profile) {
+  const base = {};
+  if (profile.avatarUrl) base.avatarUrl = profile.avatarUrl;
+  if (profile.email) base.email = profile.email;
+  if (profile.name) base.name = profile.name;
+  if (profile.metadata) Object.assign(base, profile.metadata);
+  return base;
+}
+async function loadMember(db, memberId) {
+  const [row] = await db.select({
+    id: npMembers.id,
+    email: npMembers.email,
+    handle: npMembers.handle,
+    displayName: npMembers.displayName,
+    status: npMembers.status,
+    tokenVersion: npMembers.tokenVersion
+  }).from(npMembers).where(eq2(npMembers.id, memberId)).limit(1);
+  if (!row) {
+    throw new Error(`Member ${memberId} referenced by oauth identity is missing`);
+  }
+  return row;
+}
+async function resolveMemberOAuthLogin(input) {
+  const db = getDb();
+  const { provider, profile } = input;
+  const [existingLink] = await db.select({ memberId: npMemberIdentities.memberId, identityId: npMemberIdentities.id }).from(npMemberIdentities).where(
+    and2(
+      eq2(npMemberIdentities.provider, provider),
+      eq2(npMemberIdentities.subject, profile.providerUserId)
+    )
+  ).limit(1);
+  if (existingLink) {
+    await db.update(npMemberIdentities).set({ metadata: mergeMetadata2(profile), updatedAt: /* @__PURE__ */ new Date() }).where(eq2(npMemberIdentities.id, existingLink.identityId));
+    const member = await loadMember(db, existingLink.memberId);
+    return { member, created: false, linked: false };
+  }
+  if (profile.email) {
+    const normalizedEmail = profile.email.trim().toLowerCase();
+    const [existingMember] = await db.select({
+      id: npMembers.id,
+      email: npMembers.email,
+      handle: npMembers.handle,
+      displayName: npMembers.displayName,
+      status: npMembers.status,
+      tokenVersion: npMembers.tokenVersion
+    }).from(npMembers).where(eq2(sql2`lower(${npMembers.email})`, normalizedEmail)).limit(1);
+    if (existingMember) {
+      if (existingMember.status !== "active") {
+        return { member: existingMember, created: false, linked: false };
+      }
+      await db.insert(npMemberIdentities).values({
+        memberId: existingMember.id,
+        provider,
+        subject: profile.providerUserId,
+        email: profile.email,
+        metadata: mergeMetadata2(profile)
+      });
+      return { member: existingMember, created: false, linked: true };
+    }
+  }
+  const settings = await getCommunitySettings();
+  if (!settings.registrationEnabled) {
+    throw new NpForbiddenError("members", "register");
+  }
+  const email = profile.email && profile.email.trim().length > 0 ? profile.email.trim().toLowerCase() : syntheticEmail2(provider, profile.providerUserId);
+  const displayName = deriveDisplayName(profile, email);
+  const handle = generateHandle(profile, email);
+  const placeholderPassword = await hashPassword(
+    crypto.randomUUID() + crypto.randomUUID()
+  );
+  const [created] = await db.insert(npMembers).values({
+    email,
+    handle,
+    displayName,
+    password: placeholderPassword,
+    // OAuth verifies the address out-of-band (the provider showed the
+    // user a real login screen for it), so skip the email-verify
+    // dance that password registration goes through.
+    emailVerified: true,
+    status: "active"
+  }).returning({
+    id: npMembers.id,
+    email: npMembers.email,
+    handle: npMembers.handle,
+    displayName: npMembers.displayName,
+    status: npMembers.status,
+    tokenVersion: npMembers.tokenVersion
+  });
+  await db.insert(npMemberIdentities).values({
+    memberId: created.id,
+    provider,
+    subject: profile.providerUserId,
+    email: profile.email ?? null,
+    metadata: mergeMetadata2(profile)
+  });
+  return { member: created, created: true, linked: true };
+}
+
+// src/auth/oauth-state.ts
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+var STATE_TTL_SECONDS = readEnvPositiveInt("NP_OAUTH_STATE_TTL_SECONDS", 600);
+var CODE_VERIFIER_BYTES = 32;
+function b64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function sign(payload, secret) {
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+function issueOAuthState(providerId, secret) {
+  const nonce = randomBytes2(16).toString("base64url");
+  const codeVerifier = randomBytes2(CODE_VERIFIER_BYTES).toString("base64url");
+  const expSeconds = Math.floor(Date.now() / 1e3) + STATE_TTL_SECONDS;
+  const payload = { providerId, nonce, expSeconds, codeVerifier };
+  const encoded = b64url(JSON.stringify(payload));
+  const sig = sign(encoded, secret);
+  return { token: `${encoded}.${sig}`, codeVerifier };
+}
+function verifyOAuthState(token, expectedProviderId, secret) {
+  if (typeof token !== "string" || !token.includes(".")) {
+    return { ok: false, reason: "format" };
+  }
+  const [encoded, sig] = token.split(".");
+  if (!encoded || !sig) {
+    return { ok: false, reason: "format" };
+  }
+  const expectedSig = sign(encoded, secret);
+  const sigBuf = Buffer.from(sig);
+  const expectedBuf = Buffer.from(expectedSig);
+  if (sigBuf.length !== expectedBuf.length || !timingSafeEqual(sigBuf, expectedBuf)) {
+    return { ok: false, reason: "signature" };
+  }
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "format" };
+  }
+  if (!payload || typeof payload.providerId !== "string" || typeof payload.nonce !== "string" || typeof payload.expSeconds !== "number" || typeof payload.codeVerifier !== "string" || payload.codeVerifier.length === 0) {
+    return { ok: false, reason: "format" };
+  }
+  if (payload.providerId !== expectedProviderId) {
+    return { ok: false, reason: "signature" };
+  }
+  if (payload.expSeconds <= Math.floor(Date.now() / 1e3)) {
+    return { ok: false, reason: "expired" };
+  }
+  return { ok: true, payload };
+}
+
+// src/auth/oauth-arctic.ts
+function fromArctic(factory, opts) {
+  const usePkce = opts.pkce !== false;
+  const scopes = opts.scopes ?? [];
+  return {
+    id: opts.id,
+    label: opts.label,
+    authorize({ state, redirectUri, codeVerifier }) {
+      const arctic = factory(redirectUri);
+      const url = usePkce ? arctic.createAuthorizationURL(state, codeVerifier, scopes) : arctic.createAuthorizationURL(state, scopes);
+      return url.toString();
+    },
+    async exchange({ code, redirectUri, codeVerifier }) {
+      const arctic = factory(redirectUri);
+      const tokens = usePkce ? await arctic.validateAuthorizationCode(code, codeVerifier) : await arctic.validateAuthorizationCode(code);
+      return opts.fetchProfile(tokens.accessToken(), tokens);
+    }
+  };
+}
+
+// src/auth/session.ts
+import { webcrypto } from "crypto";
+import { eq as eq3, sql as sql3 } from "drizzle-orm";
+async function sha256(input) {
+  const digest = await webcrypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(input)
+  );
+  return Array.from(
+    new Uint8Array(digest),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+async function verifyTokenFull(token, secret, db, expectedUse = "access") {
+  const payload = await verifyToken(token, secret, expectedUse);
+  const [user] = await db.select({
+    id: npUsers.id,
+    email: npUsers.email,
+    name: npUsers.name,
+    role: npUsers.role,
+    tokenVersion: npUsers.tokenVersion
+  }).from(npUsers).where(eq3(npUsers.id, payload.sub)).limit(1);
+  if (!user || user.tokenVersion !== payload.ver) {
+    return null;
+  }
+  return user;
+}
+async function invalidateAllSessions(userId, db) {
+  await db.transaction(async (tx) => {
+    await tx.update(npUsers).set({
+      tokenVersion: sql3`${npUsers.tokenVersion} + 1`
+    }).where(eq3(npUsers.id, userId));
+    await tx.delete(npSessions).where(eq3(npSessions.userId, userId));
+  });
+}
+
+// src/auth/identities-admin.ts
+import { and as and3, desc, eq as eq4 } from "drizzle-orm";
+async function assertUserExists(userId) {
+  const db = getDb();
+  const [row] = await db.select({ id: npUsers.id }).from(npUsers).where(eq4(npUsers.id, userId)).limit(1);
+  if (!row) throw new NpNotFoundError("user", userId);
+}
+async function assertMemberExists(memberId) {
+  const db = getDb();
+  const [row] = await db.select({ id: npMembers.id }).from(npMembers).where(eq4(npMembers.id, memberId)).limit(1);
+  if (!row) throw new NpNotFoundError("member", memberId);
+}
+async function listUserIdentities(userId) {
+  await assertUserExists(userId);
+  const db = getDb();
+  const rows = await db.select().from(npUserOAuthIdentities).where(eq4(npUserOAuthIdentities.userId, userId)).orderBy(desc(npUserOAuthIdentities.createdAt));
+  return rows;
+}
+async function listMemberIdentities(memberId) {
+  await assertMemberExists(memberId);
+  const db = getDb();
+  const rows = await db.select().from(npMemberIdentities).where(eq4(npMemberIdentities.memberId, memberId)).orderBy(desc(npMemberIdentities.createdAt));
+  return rows;
+}
+async function revokeUserIdentity(userId, identityId, actor) {
+  const db = getDb();
+  const [existing] = await db.select().from(npUserOAuthIdentities).where(
+    and3(
+      eq4(npUserOAuthIdentities.id, identityId),
+      eq4(npUserOAuthIdentities.userId, userId)
+    )
+  ).limit(1);
+  if (!existing) {
+    throw new NpNotFoundError("identity", identityId);
+  }
+  const deleted = await db.delete(npUserOAuthIdentities).where(eq4(npUserOAuthIdentities.id, identityId)).returning({ id: npUserOAuthIdentities.id });
+  if (deleted.length === 0) return;
+  await recordAuditEvent({
+    actor: { kind: "staff", userId: actor.staffUserId },
+    action: "user.identity.revoke",
+    targetType: "user",
+    targetId: userId,
+    payload: {
+      identityId,
+      provider: existing.provider,
+      providerUserId: existing.providerUserId
+    }
+  });
+}
+async function revokeMemberIdentity(memberId, identityId, actor) {
+  const db = getDb();
+  const [existing] = await db.select().from(npMemberIdentities).where(
+    and3(
+      eq4(npMemberIdentities.id, identityId),
+      eq4(npMemberIdentities.memberId, memberId)
+    )
+  ).limit(1);
+  if (!existing) throw new NpNotFoundError("identity", identityId);
+  const deleted = await db.delete(npMemberIdentities).where(eq4(npMemberIdentities.id, identityId)).returning({ id: npMemberIdentities.id });
+  if (deleted.length === 0) return;
+  await recordAuditEvent({
+    actor: { kind: "staff", userId: actor.staffUserId },
+    action: "member.identity.revoke",
+    targetType: "member",
+    targetId: memberId,
+    payload: {
+      identityId,
+      provider: existing.provider,
+      subject: existing.subject
+    }
+  });
+}
+
+// src/auth/reset-token.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { and as and4, eq as eq5, gt, isNotNull, sql as sql4 } from "drizzle-orm";
+var MIN_PASSWORD_LENGTH = 8;
+function generateRawToken() {
+  return randomBytes3(32).toString("hex");
+}
+async function createPasswordResetToken(db, options) {
+  const token = generateRawToken();
+  const tokenHash = await sha256(token);
+  const expiresAt = new Date(Date.now() + options.ttlMs);
+  await db.update(npUsers).set({
+    passwordResetTokenHash: tokenHash,
+    passwordResetExpiresAt: expiresAt,
+    passwordResetPurpose: options.purpose,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(eq5(npUsers.id, options.userId));
+  return { token, expiresAt, purpose: options.purpose };
+}
+async function requestPasswordReset(db, email, ttlMs) {
+  const normalizedEmail = email.trim().toLowerCase();
+  const [user] = await db.select({
+    id: npUsers.id,
+    email: npUsers.email,
+    name: npUsers.name
+  }).from(npUsers).where(eq5(npUsers.email, normalizedEmail)).limit(1);
+  if (!user) {
+    return { userId: null, name: null, email: null, issued: null };
+  }
+  const issued = await createPasswordResetToken(db, {
+    userId: user.id,
+    purpose: "reset",
+    ttlMs
+  });
+  return { userId: user.id, name: user.name, email: user.email, issued };
+}
+async function consumePasswordResetToken(db, options) {
+  if (!options.token || typeof options.token !== "string") {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Reset token is required." }
+    ]);
+  }
+  if (!options.newPassword || options.newPassword.length < MIN_PASSWORD_LENGTH) {
+    throw new NpValidationError("Invalid input", [
+      {
+        field: "password",
+        message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.`
+      }
+    ]);
+  }
+  const tokenHash = await sha256(options.token);
+  const now = /* @__PURE__ */ new Date();
+  const [user] = await db.select({
+    id: npUsers.id,
+    email: npUsers.email,
+    purpose: npUsers.passwordResetPurpose
+  }).from(npUsers).where(
+    and4(
+      eq5(npUsers.passwordResetTokenHash, tokenHash),
+      isNotNull(npUsers.passwordResetExpiresAt),
+      gt(npUsers.passwordResetExpiresAt, now)
+    )
+  ).limit(1);
+  if (!user) {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Reset link is invalid or has expired." }
+    ]);
+  }
+  const newPasswordHash = await hashPassword(options.newPassword);
+  await db.transaction(async (tx) => {
+    await tx.update(npUsers).set({
+      password: newPasswordHash,
+      passwordResetTokenHash: null,
+      passwordResetExpiresAt: null,
+      passwordResetPurpose: null,
+      loginAttempts: 0,
+      lockUntil: null,
+      tokenVersion: sql4`${npUsers.tokenVersion} + 1`,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(eq5(npUsers.id, user.id));
+    await tx.delete(npSessions).where(eq5(npSessions.userId, user.id));
+  });
+  return {
+    userId: user.id,
+    email: user.email,
+    purpose: user.purpose ?? "reset"
+  };
+}
+
+// src/auth/member-token.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { jwtVerify as jwtVerify2, SignJWT as SignJWT2 } from "jose";
+var textEncoder2 = new TextEncoder();
+var MEMBER_AUDIENCE = "member";
+async function signMemberToken(member, secret, expirationSeconds = 7200, tokenUse = "access") {
+  const secretKey = textEncoder2.encode(secret);
+  return new SignJWT2({ sub: member.id, ver: member.tokenVersion, use: tokenUse }).setProtectedHeader({ alg: "HS256" }).setAudience(MEMBER_AUDIENCE).setJti(randomBytes4(16).toString("base64url")).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + expirationSeconds).sign(secretKey);
+}
+async function verifyMemberToken(token, secret, expectedUse) {
+  const secretKey = textEncoder2.encode(secret);
+  const { payload } = await jwtVerify2(token, secretKey, { audience: MEMBER_AUDIENCE });
+  const typed = payload;
+  if (typed.use !== "access" && typed.use !== "refresh") {
+    throw new NpAuthError("Member token missing `use` claim");
+  }
+  const use = typed.use;
+  if (expectedUse && use !== expectedUse) {
+    throw new NpAuthError(
+      `Member token use mismatch: expected ${expectedUse}, got ${use}`
+    );
+  }
+  return { ...typed, aud: MEMBER_AUDIENCE, use };
+}
+
+// src/auth/member-session.ts
+import { and as and5, eq as eq6, gt as gt2, sql as sql5 } from "drizzle-orm";
+async function getMemberFromTokenPayload(db, payload, accessToken) {
+  const [row] = await db.select({
+    id: npMembers.id,
+    email: npMembers.email,
+    handle: npMembers.handle,
+    displayName: npMembers.displayName,
+    status: npMembers.status,
+    tokenVersion: npMembers.tokenVersion
+  }).from(npMembers).where(eq6(npMembers.id, payload.sub)).limit(1);
+  if (!row) return null;
+  if (row.tokenVersion !== payload.ver) return null;
+  if (accessToken) {
+    const tokenHash = await sha256(accessToken);
+    const now = /* @__PURE__ */ new Date();
+    const [session] = await db.select({ id: npMemberSessions.id }).from(npMemberSessions).where(
+      and5(
+        eq6(npMemberSessions.memberId, row.id),
+        eq6(npMemberSessions.tokenHash, tokenHash),
+        gt2(npMemberSessions.expiresAt, now)
+      )
+    ).limit(1);
+    if (!session) return null;
+  }
+  return row;
+}
+async function invalidateAllMemberSessions(db, memberId) {
+  await db.transaction(async (tx) => {
+    await tx.update(npMembers).set({
+      tokenVersion: sql5`${npMembers.tokenVersion} + 1`,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(eq6(npMembers.id, memberId));
+    await tx.delete(npMemberSessions).where(eq6(npMemberSessions.memberId, memberId));
+  });
+}
+
+// src/auth/member-credentials.ts
+import { randomBytes as randomBytes5 } from "crypto";
+import { and as and6, eq as eq7, gt as gt3, isNotNull as isNotNull2, sql as sql6 } from "drizzle-orm";
+var MIN_PASSWORD_LENGTH2 = 8;
+function generateRawToken2() {
+  return randomBytes5(32).toString("hex");
+}
+async function createMemberEmailVerifyToken(db, memberId, ttlMs) {
+  const token = generateRawToken2();
+  const tokenHash = await sha256(token);
+  const expiresAt = new Date(Date.now() + ttlMs);
+  await db.update(npMembers).set({
+    emailVerifyTokenHash: tokenHash,
+    emailVerifyExpiresAt: expiresAt,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(eq7(npMembers.id, memberId));
+  return { token, expiresAt };
+}
+async function consumeMemberEmailVerifyToken(db, token) {
+  if (!token || typeof token !== "string") {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Verification token is required." }
+    ]);
+  }
+  const tokenHash = await sha256(token);
+  const now = /* @__PURE__ */ new Date();
+  const [member] = await db.select({
+    id: npMembers.id,
+    email: npMembers.email,
+    handle: npMembers.handle,
+    displayName: npMembers.displayName
+  }).from(npMembers).where(
+    and6(
+      eq7(npMembers.emailVerifyTokenHash, tokenHash),
+      isNotNull2(npMembers.emailVerifyExpiresAt),
+      gt3(npMembers.emailVerifyExpiresAt, now)
+    )
+  ).limit(1);
+  if (!member) {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Verification link is invalid or has expired." }
+    ]);
+  }
+  await db.update(npMembers).set({
+    emailVerified: true,
+    // Pending → active on first verify so login can succeed afterwards.
+    // Suspended/deleted members stay where they are; the mod UI flips
+    // those statuses, never the verify endpoint.
+    status: sql6`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,
+    emailVerifyTokenHash: null,
+    emailVerifyExpiresAt: null,
+    updatedAt: now
+  }).where(eq7(npMembers.id, member.id));
+  return {
+    memberId: member.id,
+    email: member.email,
+    handle: member.handle,
+    displayName: member.displayName
+  };
+}
+async function requestMemberPasswordReset(db, email, ttlMs) {
+  const normalizedEmail = email.trim().toLowerCase();
+  const [member] = await db.select({
+    id: npMembers.id,
+    email: npMembers.email,
+    displayName: npMembers.displayName,
+    status: npMembers.status
+  }).from(npMembers).where(eq7(npMembers.email, normalizedEmail)).limit(1);
+  if (!member || member.status === "deleted") {
+    return { memberId: null, displayName: null, email: null, issued: null };
+  }
+  const token = generateRawToken2();
+  const tokenHash = await sha256(token);
+  const expiresAt = new Date(Date.now() + ttlMs);
+  await db.update(npMembers).set({
+    passwordResetTokenHash: tokenHash,
+    passwordResetExpiresAt: expiresAt,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(eq7(npMembers.id, member.id));
+  return {
+    memberId: member.id,
+    displayName: member.displayName,
+    email: member.email,
+    issued: { token, expiresAt }
+  };
+}
+async function consumeMemberPasswordReset(db, token, newPassword) {
+  if (!token || typeof token !== "string") {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Reset token is required." }
+    ]);
+  }
+  if (!newPassword || newPassword.length < MIN_PASSWORD_LENGTH2) {
+    throw new NpValidationError("Invalid input", [
+      {
+        field: "password",
+        message: `Password must be at least ${MIN_PASSWORD_LENGTH2} characters.`
+      }
+    ]);
+  }
+  const tokenHash = await sha256(token);
+  const now = /* @__PURE__ */ new Date();
+  const [member] = await db.select({ id: npMembers.id, email: npMembers.email }).from(npMembers).where(
+    and6(
+      eq7(npMembers.passwordResetTokenHash, tokenHash),
+      isNotNull2(npMembers.passwordResetExpiresAt),
+      gt3(npMembers.passwordResetExpiresAt, now)
+    )
+  ).limit(1);
+  if (!member) {
+    throw new NpValidationError("Invalid input", [
+      { field: "token", message: "Reset link is invalid or has expired." }
+    ]);
+  }
+  const newPasswordHash = await hashPassword(newPassword);
+  await db.transaction(async (tx) => {
+    await tx.update(npMembers).set({
+      password: newPasswordHash,
+      passwordResetTokenHash: null,
+      passwordResetExpiresAt: null,
+      loginAttempts: 0,
+      lockUntil: null,
+      // Bump tokenVersion in-place so existing JWTs are invalidated. Also
+      // mark email as verified — completing a reset on an unverified
+      // account is itself proof of email ownership.
+      tokenVersion: sql6`${npMembers.tokenVersion} + 1`,
+      emailVerified: true,
+      status: sql6`case when ${npMembers.status} = 'pending' then 'active' else ${npMembers.status} end`,
+      updatedAt: /* @__PURE__ */ new Date()
+    }).where(eq7(npMembers.id, member.id));
+    await tx.delete(npMemberSessions).where(eq7(npMemberSessions.memberId, member.id));
+  });
+  return { memberId: member.id, email: member.email };
+}
+
+export {
+  authenticated,
+  isAdmin,
+  isEditorOrAbove,
+  isOwnerOrAdmin,
+  signToken,
+  verifyToken,
+  isTokenVerificationError,
+  ARGON2_OPTIONS,
+  hashPassword,
+  verifyPassword,
+  verifyCsrf,
+  registerOAuthProvider,
+  getOAuthProvider,
+  listOAuthProviders,
+  resetOAuthProviders,
+  resolveOAuthLogin,
+  resolveMemberOAuthLogin,
+  issueOAuthState,
+  verifyOAuthState,
+  fromArctic,
+  sha256,
+  verifyTokenFull,
+  invalidateAllSessions,
+  listUserIdentities,
+  listMemberIdentities,
+  revokeUserIdentity,
+  revokeMemberIdentity,
+  createPasswordResetToken,
+  requestPasswordReset,
+  consumePasswordResetToken,
+  signMemberToken,
+  verifyMemberToken,
+  getMemberFromTokenPayload,
+  invalidateAllMemberSessions,
+  createMemberEmailVerifyToken,
+  consumeMemberEmailVerifyToken,
+  requestMemberPasswordReset,
+  consumeMemberPasswordReset
+};
+//# sourceMappingURL=chunk-OK5HOCQI.js.map