@periodic/tungsten 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+All notable changes to @periodic/tungsten will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2024-02-15
+
+### Added
+
+- **JWT Access Tokens**: `signAccessToken()` and `verifyAccessToken()` with HS256/RS256 support
+- **Refresh Token Rotation**: `rotateRefreshToken()` with replay protection
+- **Password Hashing**: Argon2id implementation with secure defaults
+- **API Key Generation**: Cryptographically secure key generation with prefix support
+- **Opaque Tokens**: Session identifier generation and hashing
+- **TOTP**: RFC 6238 compliant time-based one-time passwords
+- **HMAC Signing**: Request signing with timestamp-based replay protection
+- **Cookie Utilities**: Secure cookie configuration helpers
+- **Key Providers**: SimpleKeyProvider, RotatingKeyProvider, and MultiTenantKeyProvider
+- **Security Event Hooks**: Interface for monitoring security events
+- **Instrumentation Adapter**: Interface for metrics collection
+- **Timing-Safe Comparisons**: Prevent timing attacks in verification operations
+- **Comprehensive Test Suite**: 80%+ code coverage
+- **Full TypeScript Support**: Strict mode with complete type definitions
+- **ESM + CJS Output**: Dual module format support
+- **Tree-Shakeable**: Optimized for modern bundlers
+
+### Security
+
+- All cryptographic operations use timing-safe comparisons
+- Argon2id with memory-hard configuration (64MB, 3 iterations)
+- Minimum key lengths enforced (16 bytes for API keys)
+- Password length limits (max 128 characters)
+- No secret leakage in error messages
+- Constant-time password verification
+
+### Documentation
+
+- Complete API reference
+- Security best practices guide
+- Production deployment examples
+- Architecture documentation
+- Contributing guidelines

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Periodic Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.