@panguard-ai/panguard-auth 0.1.0

package/dist/routes/shared.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared helpers, types, and the RouteContext interface for route modules.
+ * @module @panguard-ai/panguard-auth/routes/shared
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AuthDB } from '../database.js';
+import type { EmailConfig } from '../email-verify.js';
+import type { GoogleOAuthConfig } from '../google-oauth.js';
+import type { GoogleSheetsConfig } from '../google-sheets.js';
+import type { LemonSqueezyConfig } from '../lemonsqueezy.js';
+import { RateLimiter } from '../rate-limiter.js';
+import type { UserPublic } from '../types.js';
+export declare const MAX_BODY_SIZE: number;
+export type ReadBodyResult = {
+    ok: true;
+    data: Record<string, unknown>;
+} | {
+    ok: false;
+    status: 400 | 413;
+};
+export declare function readBody(req: IncomingMessage): Promise<ReadBodyResult>;
+export type ReadRawBodyResult = {
+    ok: true;
+    raw: string;
+} | {
+    ok: false;
+    status: 400 | 413;
+};
+export declare function readRawBody(req: IncomingMessage): Promise<ReadRawBodyResult>;
+export declare function json(res: ServerResponse, status: number, data: unknown): void;
+export declare function getClientIP(req: IncomingMessage): string;
+export declare function isValidEmail(email: unknown): email is string;
+export declare function toPublicUser(u: {
+    id: number;
+    email: string;
+    name: string;
+    role: string;
+    tier: string;
+    createdAt: string;
+    planExpiresAt?: string | null;
+}): UserPublic;
+export interface AuthRouteConfig {
+    db: AuthDB;
+    smtp?: EmailConfig;
+    baseUrl?: string;
+    google?: GoogleOAuthConfig;
+    sheets?: GoogleSheetsConfig;
+    lemonsqueezy?: LemonSqueezyConfig;
+}
+export interface RouteContext {
+    db: AuthDB;
+    config: AuthRouteConfig;
+    loginLimiter: RateLimiter;
+    registerLimiter: RateLimiter;
+    resetLimiter: RateLimiter;
+    waitlistLimiter: RateLimiter;
+    pendingOAuthFlows: Map<string, {
+        codeVerifier: string;
+        createdAt: number;
+    }>;
+    pendingCliFlows: Map<string, {
+        callbackUrl: string;
+        createdAt: number;
+    }>;
+    oauthExchangeCodes: Map<string, {
+        sessionToken: string;
+        expiresAt: string;
+        createdAt: number;
+    }>;
+}
+//# sourceMappingURL=shared.d.ts.map

package/dist/routes/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C,eAAO,MAAM,aAAa,QAAc,CAAC;AAIzC,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAErC,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA6BtE;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAE7F,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwB5E;AAID,wBAAgB,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAG7E;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CASxD;AAID,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAG5D;AAID,wBAAgB,YAAY,CAAC,CAAC,EAAE;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,UAAU,CAUb;AAID,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAID,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;IACxB,YAAY,EAAE,WAAW,CAAC;IAC1B,eAAe,EAAE,WAAW,CAAC;IAC7B,YAAY,EAAE,WAAW,CAAC;IAC1B,eAAe,EAAE,WAAW,CAAC;IAC7B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjG"}

package/dist/routes/shared.js

@@ -0,0 +1,100 @@
+/**
+ * Shared helpers, types, and the RouteContext interface for route modules.
+ * @module @panguard-ai/panguard-auth/routes/shared
+ */
+// ── Constants ────────────────────────────────────────────────────────
+export const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
+export function readBody(req) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let totalSize = 0;
+        let aborted = false;
+        req.on('data', (chunk) => {
+            totalSize += chunk.length;
+            if (totalSize > MAX_BODY_SIZE) {
+                aborted = true;
+                req.destroy();
+                resolve({ ok: false, status: 413 });
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            if (aborted)
+                return;
+            try {
+                const raw = Buffer.concat(chunks).toString('utf-8');
+                resolve({ ok: true, data: JSON.parse(raw) });
+            }
+            catch {
+                resolve({ ok: false, status: 400 });
+            }
+        });
+        req.on('error', () => {
+            if (!aborted)
+                resolve({ ok: false, status: 400 });
+        });
+    });
+}
+export function readRawBody(req) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let totalSize = 0;
+        let aborted = false;
+        req.on('data', (chunk) => {
+            totalSize += chunk.length;
+            if (totalSize > MAX_BODY_SIZE) {
+                aborted = true;
+                req.destroy();
+                resolve({ ok: false, status: 413 });
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            if (aborted)
+                return;
+            resolve({ ok: true, raw: Buffer.concat(chunks).toString('utf-8') });
+        });
+        req.on('error', () => {
+            if (!aborted)
+                resolve({ ok: false, status: 400 });
+        });
+    });
+}
+// ── Response helper ──────────────────────────────────────────────────
+export function json(res, status, data) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(data));
+}
+// ── IP helper ────────────────────────────────────────────────────────
+export function getClientIP(req) {
+    if (process.env['TRUST_PROXY'] === '1') {
+        const forwarded = req.headers['x-forwarded-for'];
+        if (typeof forwarded === 'string') {
+            const first = forwarded.split(',')[0]?.trim();
+            if (first)
+                return first;
+        }
+    }
+    return req.socket.remoteAddress ?? '127.0.0.1';
+}
+// ── Validation helpers ───────────────────────────────────────────────
+export function isValidEmail(email) {
+    if (typeof email !== 'string')
+        return false;
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+// ── User projection ──────────────────────────────────────────────────
+export function toPublicUser(u) {
+    return {
+        id: u.id,
+        email: u.email,
+        name: u.name,
+        role: u.role,
+        tier: u.tier,
+        createdAt: u.createdAt,
+        planExpiresAt: u.planExpiresAt,
+    };
+}
+//# sourceMappingURL=shared.js.map

package/dist/routes/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,wEAAwE;AAExE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;AAQjD,MAAM,UAAU,QAAQ,CAAC,GAAoB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAID,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;gBAC9B,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IACrE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,WAAW,CAAC,GAAoB;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,WAAW,CAAC;AACjD,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,YAAY,CAAC,CAQ5B;IACC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,aAAa,EAAE,CAAC,CAAC,aAAa;KAC/B,CAAC;AACJ,CAAC"}

package/dist/routes/totp.d.ts

@@ -0,0 +1,14 @@
+/**
+ * TOTP (Two-Factor Authentication) route handlers:
+ * handleTotpSetup, handleTotpVerify, handleTotpDisable, handleTotpStatus.
+ * @module @panguard-ai/panguard-auth/routes/totp
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteContext } from './shared.js';
+export declare function createTotpRoutes(ctx: RouteContext): {
+    handleTotpSetup: (req: IncomingMessage, res: ServerResponse) => void;
+    handleTotpVerify: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleTotpDisable: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleTotpStatus: (req: IncomingMessage, res: ServerResponse) => void;
+};
+//# sourceMappingURL=totp.d.ts.map

package/dist/routes/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY;2BAOlB,eAAe,OAAO,cAAc,KAAG,IAAI;4BA0CpC,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;6BAuDnD,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;4BAgD3D,eAAe,OAAO,cAAc,KAAG,IAAI;EA8B3E"}

package/dist/routes/totp.js

@@ -0,0 +1,166 @@
+/**
+ * TOTP (Two-Factor Authentication) route handlers:
+ * handleTotpSetup, handleTotpVerify, handleTotpDisable, handleTotpStatus.
+ * @module @panguard-ai/panguard-auth/routes/totp
+ */
+import { verifyPassword } from '../auth.js';
+import { authenticateRequest } from '../middleware.js';
+import { logAuditEvent } from '@panguard-ai/security-hardening';
+import { generateTotpSecret, generateBackupCodes, buildOtpauthUri, verifyTotp } from '../totp.js';
+import { readBody, json } from './shared.js';
+export function createTotpRoutes(ctx) {
+    const { db } = ctx;
+    /**
+     * POST /api/auth/totp/setup
+     * Generate a new TOTP secret and backup codes. Returns otpauth URI for QR code.
+     */
+    function handleTotpSetup(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        // Check if already enabled
+        const existing = db.getTotpSecret(user.id);
+        if (existing?.enabled) {
+            json(res, 409, { ok: false, error: '2FA is already enabled. Disable it first to re-setup.' });
+            return;
+        }
+        const secret = generateTotpSecret();
+        const backupCodes = generateBackupCodes();
+        const otpauthUri = buildOtpauthUri(secret, user.email);
+        // Store (not yet enabled — user must verify first)
+        db.saveTotpSecret(user.id, secret, JSON.stringify(backupCodes));
+        json(res, 200, {
+            ok: true,
+            data: {
+                secret,
+                otpauthUri,
+                backupCodes,
+                message: 'Scan the QR code with your authenticator app, then verify with /api/auth/totp/verify.',
+            },
+        });
+    }
+    /**
+     * POST /api/auth/totp/verify
+     * Verify a TOTP code to enable 2FA. Body: { code: "123456" }
+     */
+    async function handleTotpVerify(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        const { code } = body.data;
+        if (typeof code !== 'string' || code.length !== 6) {
+            json(res, 400, { ok: false, error: 'A 6-digit code is required' });
+            return;
+        }
+        const totpSecret = db.getTotpSecret(user.id);
+        if (!totpSecret) {
+            json(res, 404, { ok: false, error: 'No TOTP setup found. Call /api/auth/totp/setup first.' });
+            return;
+        }
+        const matchedStep = verifyTotp(totpSecret.encryptedSecret, code, totpSecret.lastUsedStep);
+        if (matchedStep < 0) {
+            json(res, 401, { ok: false, error: 'Invalid TOTP code' });
+            return;
+        }
+        db.updateLastUsedStep(user.id, matchedStep);
+        db.enableTotp(user.id);
+        db.addAuditLog('totp_enabled', user.id, user.id, undefined);
+        logAuditEvent({
+            level: 'info',
+            action: 'credential_access',
+            target: user.email,
+            result: 'success',
+            context: { details: '2FA enabled' },
+        });
+        json(res, 200, { ok: true, data: { message: '2FA has been enabled.' } });
+    }
+    /**
+     * POST /api/auth/totp/disable
+     * Disable 2FA. Requires password confirmation. Body: { password: "..." }
+     */
+    async function handleTotpDisable(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        const { password } = body.data;
+        if (typeof password !== 'string') {
+            json(res, 400, { ok: false, error: 'Password is required to disable 2FA' });
+            return;
+        }
+        const valid = await verifyPassword(password, user.passwordHash);
+        if (!valid) {
+            json(res, 401, { ok: false, error: 'Invalid password' });
+            return;
+        }
+        db.disableTotp(user.id);
+        db.addAuditLog('totp_disabled', user.id, user.id, undefined);
+        logAuditEvent({
+            level: 'info',
+            action: 'credential_access',
+            target: user.email,
+            result: 'success',
+            context: { details: '2FA disabled' },
+        });
+        json(res, 200, { ok: true, data: { message: '2FA has been disabled.' } });
+    }
+    /**
+     * GET /api/auth/totp/status
+     * Check if 2FA is enabled for the authenticated user.
+     */
+    function handleTotpStatus(req, res) {
+        if (req.method !== 'GET') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const totpSecret = db.getTotpSecret(user.id);
+        json(res, 200, {
+            ok: true,
+            data: {
+                enabled: totpSecret?.enabled === 1,
+                backupCodesRemaining: totpSecret
+                    ? JSON.parse(totpSecret.backupCodes).length
+                    : 0,
+            },
+        });
+    }
+    return {
+        handleTotpSetup,
+        handleTotpVerify,
+        handleTotpDisable,
+        handleTotpStatus,
+    };
+}
+//# sourceMappingURL=totp.js.map

package/dist/routes/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/routes/totp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAElG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAChD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;IAEnB;;;OAGG;IACH,SAAS,eAAe,CAAC,GAAoB,EAAE,GAAmB;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEvD,mDAAmD;QACnD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAEhE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,MAAM;gBACN,UAAU;gBACV,WAAW;gBACX,OAAO,EACL,uFAAuF;aAC1F;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAmB;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1F,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAE5C,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvB,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5D,aAAa,CAAC;YACZ,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExB,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7D,aAAa,CAAC;YACZ,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED;;;OAGG;IACH,SAAS,gBAAgB,CAAC,GAAoB,EAAE,GAAmB;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;YACb,EAAE,EAAE,IAAI;YACR,IAAI,EAAE;gBACJ,OAAO,EAAE,UAAU,EAAE,OAAO,KAAK,CAAC;gBAClC,oBAAoB,EAAE,UAAU;oBAC9B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAc,CAAC,MAAM;oBACzD,CAAC,CAAC,CAAC;aACN;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/routes/usage.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Usage / Quota route handlers:
+ * handleUsageSummary, handleUsageLimits, handleUsageCheck, handleUsageRecord.
+ * @module @panguard-ai/panguard-auth/routes/usage
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteContext } from './shared.js';
+export declare function createUsageRoutes(ctx: RouteContext): {
+    handleUsageSummary: (req: IncomingMessage, res: ServerResponse) => void;
+    handleUsageLimits: (req: IncomingMessage, res: ServerResponse) => void;
+    handleUsageCheck: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleUsageRecord: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+};
+//# sourceMappingURL=usage.d.ts.map

package/dist/routes/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../src/routes/usage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY;8BAOhB,eAAe,OAAO,cAAc,KAAG,IAAI;6BAoB5C,eAAe,OAAO,cAAc,KAAG,IAAI;4BAqBtC,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;6BAiCnD,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;EAuD3F"}

package/dist/routes/usage.js

@@ -0,0 +1,127 @@
+/**
+ * Usage / Quota route handlers:
+ * handleUsageSummary, handleUsageLimits, handleUsageCheck, handleUsageRecord.
+ * @module @panguard-ai/panguard-auth/routes/usage
+ */
+import { authenticateRequest } from '../middleware.js';
+import { checkQuota, recordUsage, getUsageSummary, getQuotaLimits } from '../usage-meter.js';
+import { readBody, json } from './shared.js';
+export function createUsageRoutes(ctx) {
+    const { db } = ctx;
+    /**
+     * GET /api/usage
+     * Returns current usage and quota for the authenticated user.
+     */
+    function handleUsageSummary(req, res) {
+        if (req.method !== 'GET') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const summary = getUsageSummary(db, user.id, user.tier);
+        json(res, 200, { ok: true, data: { usage: summary, tier: user.tier } });
+    }
+    /**
+     * GET /api/usage/limits
+     * Returns quota limits for the authenticated user's tier.
+     */
+    function handleUsageLimits(req, res) {
+        if (req.method !== 'GET') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const limits = getQuotaLimits(user.tier);
+        json(res, 200, { ok: true, data: { limits, tier: user.tier } });
+    }
+    /**
+     * POST /api/usage/check
+     * Checks if the user has quota for a specific resource.
+     * Body: { resource: string }
+     */
+    async function handleUsageCheck(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        const resource = body.data['resource'];
+        if (!resource) {
+            json(res, 400, { ok: false, error: 'resource is required' });
+            return;
+        }
+        const check = checkQuota(db, user.id, user.tier, resource);
+        json(res, 200, { ok: true, data: check });
+    }
+    /**
+     * POST /api/usage/record
+     * Records usage for a resource. Intended for internal/trusted callers.
+     * Body: { resource: string, count?: number }
+     */
+    async function handleUsageRecord(req, res) {
+        if (req.method !== 'POST') {
+            json(res, 405, { ok: false, error: 'Method not allowed' });
+            return;
+        }
+        const user = authenticateRequest(req, db);
+        if (!user) {
+            json(res, 401, { ok: false, error: 'Not authenticated' });
+            return;
+        }
+        const body = await readBody(req);
+        if (!body.ok) {
+            json(res, body.status, { ok: false, error: 'Invalid request body' });
+            return;
+        }
+        const VALID_RESOURCES = [
+            'scan',
+            'guard_endpoints',
+            'reports',
+            'api_calls',
+            'notifications',
+            'trap_instances',
+        ];
+        const resource = body.data['resource'];
+        const count = typeof body.data['count'] === 'number' ? body.data['count'] : 1;
+        if (!resource || !VALID_RESOURCES.includes(resource)) {
+            json(res, 400, { ok: false, error: 'Invalid or missing resource type' });
+            return;
+        }
+        // Check quota before recording
+        const check = checkQuota(db, user.id, user.tier, resource);
+        if (!check.allowed) {
+            json(res, 429, {
+                ok: false,
+                error: 'Quota exceeded',
+                data: { current: check.current, limit: check.limit, resource },
+            });
+            return;
+        }
+        recordUsage(db, user.id, resource, count);
+        json(res, 200, { ok: true, data: { recorded: count, resource } });
+    }
+    return {
+        handleUsageSummary,
+        handleUsageLimits,
+        handleUsageCheck,
+        handleUsageRecord,
+    };
+}
+//# sourceMappingURL=usage.js.map

package/dist/routes/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../src/routes/usage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG7F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,GAAiB;IACjD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;IAEnB;;;OAGG;IACH,SAAS,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,SAAS,iBAAiB,CAAC,GAAoB,EAAE,GAAmB;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,GAAmB;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAsB,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAsB;YACzC,MAAM;YACN,iBAAiB;YACjB,SAAS;YACT,WAAW;YACX,eAAe;YACf,gBAAgB;SACjB,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAsB,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9E,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,+BAA+B;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACb,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,kBAAkB;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/routes/waitlist.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Waitlist route handlers:
+ * handleWaitlistJoin, handleWaitlistVerify, handleWaitlistStats, handleWaitlistList.
+ * @module @panguard-ai/panguard-auth/routes/waitlist
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RouteContext } from './shared.js';
+export declare function createWaitlistRoutes(ctx: RouteContext): {
+    handleWaitlistJoin: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+    handleWaitlistVerify: (req: IncomingMessage, res: ServerResponse, token: string) => void;
+    handleWaitlistStats: (req: IncomingMessage, res: ServerResponse) => void;
+    handleWaitlistList: (req: IncomingMessage, res: ServerResponse) => void;
+    handleAdminWaitlistApprove: (req: IncomingMessage, res: ServerResponse, entryId: string) => Promise<void>;
+    handleAdminWaitlistReject: (req: IncomingMessage, res: ServerResponse, entryId: string) => Promise<void>;
+};
+//# sourceMappingURL=waitlist.d.ts.map

package/dist/routes/waitlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist.d.ts","sourceRoot":"","sources":["../../src/routes/waitlist.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY;8BAGb,eAAe,OAAO,cAAc,KAAG,OAAO,CAAC,IAAI,CAAC;gCA4ExD,eAAe,OAAO,cAAc,SAAS,MAAM,KAAG,IAAI;+BAkB3D,eAAe,OAAO,cAAc,KAAG,IAAI;8BAiB5C,eAAe,OAAO,cAAc,KAAG,IAAI;sCAiBrE,eAAe,OACf,cAAc,WACV,MAAM,KACd,OAAO,CAAC,IAAI,CAAC;qCAsCT,eAAe,OACf,cAAc,WACV,MAAM,KACd,OAAO,CAAC,IAAI,CAAC;EA8BjB"}