@plumix/core 0.1.0

package/dist/auth/rbac.d.ts

@@ -0,0 +1,81 @@
+import type { UserRole } from "../db/schema/users.js";
+import type { EntryTypeOptions, PluginRegistry, TermTaxonomyOptions } from "../plugin/manifest.js";
+/**
+ * Role hierarchy (ascending). A role with a higher level has all capabilities
+ * of lower roles — e.g., editor satisfies any capability whose minRole is
+ * author, contributor, or subscriber.
+ */
+export declare const ROLE_LEVEL: Readonly<Record<UserRole, number>>;
+export declare function roleLevel(role: UserRole): number;
+export declare const CORE_CAPABILITIES: Readonly<Record<string, UserRole>>;
+export declare const POST_TYPE_CAPABILITY_ACTIONS: {
+    readonly read: "subscriber";
+    readonly create: "contributor";
+    readonly edit_own: "contributor";
+    readonly publish: "author";
+    readonly edit_any: "editor";
+    readonly delete: "editor";
+    readonly read_revisions: "editor";
+    readonly restore_revision: "editor";
+};
+export declare const TERM_TAXONOMY_CAPABILITY_ACTIONS: {
+    readonly read: "subscriber";
+    readonly assign: "contributor";
+    readonly edit: "editor";
+    readonly delete: "editor";
+    readonly manage: "editor";
+};
+export type PostCapabilityAction = keyof typeof POST_TYPE_CAPABILITY_ACTIONS;
+export type TermTaxonomyCapabilityAction = keyof typeof TERM_TAXONOMY_CAPABILITY_ACTIONS;
+export type CoreCapability = keyof typeof CORE_CAPABILITIES;
+export type EntryTypeCapabilityOverrides = Partial<Record<PostCapabilityAction, UserRole>>;
+export type TermTaxonomyCapabilityOverrides = Partial<Record<TermTaxonomyCapabilityAction, UserRole>>;
+/**
+ * Capabilities we know about statically — the built-in core caps. IDE
+ * autocomplete picks these up when a `KnownCapability | (string & {})`
+ * signature is used (the `string & {}` half preserves flexibility for
+ * plugin-defined caps without losing literal suggestions). Derived
+ * `{entryType|termTaxonomy}:{action}` shapes deliberately aren't listed here:
+ * `${string}:${action}` collapses to `string` in TypeScript, which would
+ * erase the autocomplete benefit for the core strings.
+ */
+export type KnownCapability = CoreCapability;
+export interface DerivedCapability {
+    readonly name: string;
+    readonly minRole: UserRole;
+}
+export declare function deriveEntryTypeCapabilities(entryTypeName: string, options: EntryTypeOptions): readonly DerivedCapability[];
+export declare function deriveTermTaxonomyCapabilities(termTaxonomyName: string, options: TermTaxonomyOptions): readonly DerivedCapability[];
+export interface CapabilityResolver {
+    /** Returns the minimum role required for a capability, or null if unknown. */
+    requiredRole(capability: string): UserRole | null;
+    /** True iff the given role meets the capability's minimum role. */
+    hasCapability(role: UserRole, capability: string): boolean;
+}
+export declare function createCapabilityResolver(plugins: PluginRegistry): CapabilityResolver;
+export declare class CapabilityError extends Error {
+    readonly code: "unauthorized" | "forbidden";
+    readonly capability: string;
+    private constructor();
+    static unauthorized(ctx: {
+        capability: string;
+    }): CapabilityError;
+    static forbidden(ctx: {
+        capability: string;
+    }): CapabilityError;
+}
+/**
+ * Flatten every capability the given role is granted — core plus every
+ * plugin-registered capability (including the derived `{type}:{action}`
+ * entries). Sorted for deterministic output so wire payloads are stable
+ * across identical inputs (tests, caching, etc.).
+ *
+ * The returned list is intended for shipping to the admin on `auth.session`
+ * so client code can gate nav items and actions without knowing the
+ * role-hierarchy rules.
+ */
+export declare function capabilitiesForRole(role: UserRole, plugins: PluginRegistry): readonly string[];
+export declare function requireCapability(resolver: CapabilityResolver, user: {
+    role: UserRole;
+} | null, capability: string): void;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/auth/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/auth/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACpB,MAAM,uBAAuB,CAAC;AAG/B;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAQzD,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAEhD;AAmBD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAwB7D,CAAC;AAEL,eAAO,MAAM,4BAA4B;;;;;;;;;CAgBI,CAAC;AAE9C,eAAO,MAAM,gCAAgC;;;;;;CAMA,CAAC;AAE9C,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,4BAA4B,CAAC;AAC7E,MAAM,MAAM,4BAA4B,GACtC,MAAM,OAAO,gCAAgC,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE5D,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAChD,MAAM,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CACvC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,OAAO,CACnD,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAC/C,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAE7C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;CAC5B;AAaD,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,gBAAgB,GACxB,SAAS,iBAAiB,EAAE,CAQ9B;AAED,wBAAgB,8BAA8B,CAC5C,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,mBAAmB,GAC3B,SAAS,iBAAiB,EAAE,CAM9B;AAED,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClD,mEAAmE;IACnE,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5D;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,cAAc,GACtB,kBAAkB,CAgBpB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAKxC,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,OAAO;IAUP,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe;IAQjE,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe;CAO/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,cAAc,GACtB,SAAS,MAAM,EAAE,CAgBnB;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,IAAI,EAC/B,UAAU,EAAE,MAAM,GACjB,IAAI,CAKN"}

package/dist/auth/rbac.js

@@ -0,0 +1,166 @@
+import { USER_ROLES } from "../db/schema/users.js";
+/**
+ * Role hierarchy (ascending). A role with a higher level has all capabilities
+ * of lower roles — e.g., editor satisfies any capability whose minRole is
+ * author, contributor, or subscriber.
+ */
+export const ROLE_LEVEL = Object.freeze(USER_ROLES.reduce((acc, role, index) => {
+    acc[role] = index;
+    return acc;
+}, {}));
+export function roleLevel(role) {
+    return ROLE_LEVEL[role];
+}
+// Capability shape: `<entity>:<typeName>:<action>` for per-type
+// resources (`entry:post:edit_own`, `term:category:manage`); flat
+// `<entity>:<action>` for entity-level caps without a type segment
+// (`user:list`, `settings:manage`).
+//
+// `entry:post:*` is the baked-in default — plumix assumes a "post"
+// entry type exists out of the box (the conventional default). Other
+// entry types and every term taxonomy derive their caps at plugin
+// registration time. The `entry:` and `term:` prefixes prevent name
+// collisions when an entry type and a taxonomy share a name (e.g.
+// `entry:location:read` ≠ `term:location:read`).
+//
+// `user:*` mirrors WP's split: `list` is editor+, `edit_own` is any
+// authenticated user, create / edit / promote / delete are admin-only.
+// `promote` is split out from `edit` — role escalation is more
+// sensitive than a name/avatar change. `settings:manage` is a single
+// gate over both reads and writes (matches WP's `manage_options`).
+export const CORE_CAPABILITIES = Object.freeze({
+    "entry:post:read": "subscriber",
+    "entry:post:create": "contributor",
+    "entry:post:edit_own": "contributor",
+    "entry:post:publish": "author",
+    "entry:post:edit_any": "editor",
+    "entry:post:delete": "editor",
+    "entry:post:read_revisions": "editor",
+    "entry:post:restore_revision": "editor",
+    "user:list": "editor",
+    "user:edit_own": "subscriber",
+    "user:create": "admin",
+    "user:edit": "admin",
+    "user:promote": "admin",
+    "user:delete": "admin",
+    // Cross-user PAT oversight: list/revoke any user's API tokens.
+    // Distinct from `user:edit` so an audit policy can grant "edit
+    // profiles but not nuke tokens" or vice-versa. Self-management
+    // doesn't need this cap — every authed user manages their own
+    // via the self-scoped procedures.
+    "user:manage_tokens": "admin",
+    "plugin:manage": "admin",
+    "settings:manage": "admin",
+});
+export const POST_TYPE_CAPABILITY_ACTIONS = {
+    read: "subscriber",
+    create: "contributor",
+    edit_own: "contributor",
+    publish: "author",
+    edit_any: "editor",
+    delete: "editor",
+    // Revision history reads are an editor concern — authors don't
+    // ordinarily look at past versions of their own drafts. Matches the
+    // PRD's "editors can see who saved what and when" framing.
+    read_revisions: "editor",
+    // Restoring a prior revision overwrites the live row. Pairs with
+    // `read_revisions` for symmetry with the existing list/get gates;
+    // capability lands here so the full surface is consistent before
+    // the restore-into-autosave action wires up in a later slice.
+    restore_revision: "editor",
+};
+export const TERM_TAXONOMY_CAPABILITY_ACTIONS = {
+    read: "subscriber",
+    assign: "contributor",
+    edit: "editor",
+    delete: "editor",
+    manage: "editor",
+};
+function deriveCapabilities(base, actions, overrides) {
+    return Object.entries(actions).map(([action, minRole]) => ({
+        name: `${base}:${action}`,
+        minRole: overrides?.[action] ?? minRole,
+    }));
+}
+export function deriveEntryTypeCapabilities(entryTypeName, options) {
+    // Sharing `capabilityType` across entry types pools their permissions —
+    // two plugins both with `capabilityType: "post"` share `entry:post:*`.
+    return deriveCapabilities(`entry:${options.capabilityType ?? entryTypeName}`, POST_TYPE_CAPABILITY_ACTIONS, options.capabilities);
+}
+export function deriveTermTaxonomyCapabilities(termTaxonomyName, options) {
+    return deriveCapabilities(`term:${termTaxonomyName}`, TERM_TAXONOMY_CAPABILITY_ACTIONS, options.capabilities);
+}
+export function createCapabilityResolver(plugins) {
+    return {
+        requiredRole(capability) {
+            const fromPlugin = plugins.capabilities.get(capability);
+            if (fromPlugin)
+                return fromPlugin.minRole;
+            return CORE_CAPABILITIES[capability] ?? null;
+        },
+        hasCapability(role, capability) {
+            const fromPlugin = plugins.capabilities.get(capability);
+            // defaultGrants is an explicit allowlist independent of hierarchy.
+            if (fromPlugin?.defaultGrants?.includes(role))
+                return true;
+            const required = this.requiredRole(capability);
+            if (required === null)
+                return false;
+            return roleLevel(role) >= roleLevel(required);
+        },
+    };
+}
+export class CapabilityError extends Error {
+    static {
+        CapabilityError.prototype.name = "CapabilityError";
+    }
+    code;
+    capability;
+    constructor(code, capability, message) {
+        super(message);
+        this.code = code;
+        this.capability = capability;
+    }
+    static unauthorized(ctx) {
+        return new CapabilityError("unauthorized", ctx.capability, "Authentication required");
+    }
+    static forbidden(ctx) {
+        return new CapabilityError("forbidden", ctx.capability, `Missing capability: ${ctx.capability}`);
+    }
+}
+/**
+ * Flatten every capability the given role is granted — core plus every
+ * plugin-registered capability (including the derived `{type}:{action}`
+ * entries). Sorted for deterministic output so wire payloads are stable
+ * across identical inputs (tests, caching, etc.).
+ *
+ * The returned list is intended for shipping to the admin on `auth.session`
+ * so client code can gate nav items and actions without knowing the
+ * role-hierarchy rules.
+ */
+export function capabilitiesForRole(role, plugins) {
+    const level = roleLevel(role);
+    // Set — a plugin registering an entry type with `capabilityType: 'post'`
+    // duplicates the derived `entry:post:read` etc. caps into `plugins.capabilities`
+    // on top of the entries already present in CORE_CAPABILITIES. Dedupe so
+    // the wire payload doesn't carry `["entry:post:read", "entry:post:read", ...]`.
+    const granted = new Set();
+    for (const [name, minRole] of Object.entries(CORE_CAPABILITIES)) {
+        if (roleLevel(minRole) <= level)
+            granted.add(name);
+    }
+    for (const [name, cap] of plugins.capabilities) {
+        if (roleLevel(cap.minRole) <= level || cap.defaultGrants?.includes(role)) {
+            granted.add(name);
+        }
+    }
+    return [...granted].sort();
+}
+export function requireCapability(resolver, user, capability) {
+    if (!user)
+        throw CapabilityError.unauthorized({ capability });
+    if (!resolver.hasCapability(user.role, capability)) {
+        throw CapabilityError.forbidden({ capability });
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/auth/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/auth/rbac.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAuC,MAAM,CAAC,MAAM,CACzE,UAAU,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;IACnB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC,EACD,EAA8B,CAC/B,CACF,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gEAAgE;AAChE,kEAAkE;AAClE,mEAAmE;AACnE,oCAAoC;AACpC,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,oEAAoE;AACpE,kEAAkE;AAClE,iDAAiD;AACjD,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,+DAA+D;AAC/D,qEAAqE;AACrE,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,MAAM,CAAC,MAAM,CAAC;IACZ,iBAAiB,EAAE,YAAY;IAC/B,mBAAmB,EAAE,aAAa;IAClC,qBAAqB,EAAE,aAAa;IACpC,oBAAoB,EAAE,QAAQ;IAC9B,qBAAqB,EAAE,QAAQ;IAC/B,mBAAmB,EAAE,QAAQ;IAC7B,2BAA2B,EAAE,QAAQ;IACrC,6BAA6B,EAAE,QAAQ;IACvC,WAAW,EAAE,QAAQ;IACrB,eAAe,EAAE,YAAY;IAC7B,aAAa,EAAE,OAAO;IACtB,WAAW,EAAE,OAAO;IACpB,cAAc,EAAE,OAAO;IACvB,aAAa,EAAE,OAAO;IACtB,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,8DAA8D;IAC9D,kCAAkC;IAClC,oBAAoB,EAAE,OAAO;IAC7B,eAAe,EAAE,OAAO;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,QAAQ;IAClB,MAAM,EAAE,QAAQ;IAChB,+DAA+D;IAC/D,oEAAoE;IACpE,2DAA2D;IAC3D,cAAc,EAAE,QAAQ;IACxB,iEAAiE;IACjE,kEAAkE;IAClE,iEAAiE;IACjE,8DAA8D;IAC9D,gBAAgB,EAAE,QAAQ;CACiB,CAAC;AAE9C,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,aAAa;IACrB,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CAC2B,CAAC;AA+B9C,SAAS,kBAAkB,CACzB,IAAY,EACZ,OAAiC,EACjC,SAAwD;IAExD,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,EAAE;QACzB,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO;KACxC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,aAAqB,EACrB,OAAyB;IAEzB,wEAAwE;IACxE,uEAAuE;IACvE,OAAO,kBAAkB,CACvB,SAAS,OAAO,CAAC,cAAc,IAAI,aAAa,EAAE,EAClD,4BAA4B,EAC5B,OAAO,CAAC,YAAY,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,gBAAwB,EACxB,OAA4B;IAE5B,OAAO,kBAAkB,CACvB,QAAQ,gBAAgB,EAAE,EAC1B,gCAAgC,EAChC,OAAO,CAAC,YAAY,CACrB,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,wBAAwB,CACtC,OAAuB;IAEvB,OAAO;QACL,YAAY,CAAC,UAAU;YACrB,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC,OAAO,CAAC;YAC1C,OAAO,iBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QACD,aAAa,CAAC,IAAI,EAAE,UAAU;YAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,mEAAmE;YACnE,IAAI,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACpC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC;QACE,eAAe,CAAC,SAAS,CAAC,IAAI,GAAG,iBAAiB,CAAC;IACrD,CAAC;IAEQ,IAAI,CAA+B;IACnC,UAAU,CAAS;IAE5B,YACE,IAAkC,EAClC,UAAkB,EAClB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,GAA2B;QAC7C,OAAO,IAAI,eAAe,CACxB,cAAc,EACd,GAAG,CAAC,UAAU,EACd,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,GAA2B;QAC1C,OAAO,IAAI,eAAe,CACxB,WAAW,EACX,GAAG,CAAC,UAAU,EACd,uBAAuB,GAAG,CAAC,UAAU,EAAE,CACxC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAc,EACd,OAAuB;IAEvB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,yEAAyE;IACzE,iFAAiF;IACjF,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAA4B,EAC5B,IAA+B,EAC/B,UAAkB;IAElB,IAAI,CAAC,IAAI;QAAE,MAAM,eAAe,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,69 @@
+import type { Db } from "../context/app.js";
+import type { Session } from "../db/schema/sessions.js";
+import type { User } from "../db/schema/users.js";
+export interface SessionPolicy {
+    /** Sliding-window duration. The cookie's Max-Age and DB expiresAt. */
+    readonly maxAgeSeconds: number;
+    /** Hard ceiling regardless of activity — re-auth required past this. */
+    readonly absoluteMaxAgeSeconds: number;
+    /** Refresh expiry only when more than this fraction of life has elapsed. */
+    readonly refreshThreshold: number;
+}
+export declare const DEFAULT_SESSION_POLICY: SessionPolicy;
+export interface CreateSessionInput {
+    readonly userId: number;
+    readonly ipAddress?: string | null;
+    readonly userAgent?: string | null;
+}
+/**
+ * Pull the client IP + user-agent off a request for `sessions.ipAddress`
+ * / `sessions.userAgent`. Prefers `cf-connecting-ip` (set by Cloudflare
+ * Access / Workers / CDN) over `x-forwarded-for` (which can be a chain
+ * — pick the first hop). Falls back to null when neither header is
+ * present. Truncates aggressively so a misconfigured upstream can't
+ * blow up the row width.
+ *
+ * Used at every `createSession` call site so the per-session admin UI
+ * can surface meaningful "what device / where from" context for the
+ * "is this me?" workflow. The values are advisory: an attacker who
+ * controls the request can spoof both, so policy decisions still flow
+ * through the session id (hash-keyed, server-issued).
+ */
+export declare function readRequestMeta(request: Request): {
+    readonly ipAddress: string | null;
+    readonly userAgent: string | null;
+};
+export interface CreatedSession {
+    /** Raw token to send to the client as a cookie value. Never stored. */
+    readonly token: string;
+    readonly session: Session;
+    readonly expiresAt: Date;
+}
+export interface ValidatedSession {
+    readonly session: Session;
+    readonly user: User;
+    /** True if `expiresAt` was extended on this validation. */
+    readonly refreshed: boolean;
+}
+/**
+ * Mint a new session: random token → SHA-256 hash → row keyed by hash.
+ * The raw token is returned exactly once for the cookie; the DB never sees it.
+ */
+export declare function createSession(db: Db, input: CreateSessionInput, policy?: SessionPolicy): Promise<CreatedSession>;
+/**
+ * Validate a raw session token from the cookie. Returns null on any failure
+ * (no row, expired, beyond absolute cap). Slides expiresAt when over the
+ * refresh threshold; deletes the row on absolute-cap breach so a stolen
+ * token past the ceiling is purged on first use.
+ */
+export declare function validateSession(db: Db, rawToken: string, policy?: SessionPolicy): Promise<ValidatedSession | null>;
+export declare function invalidateSession(db: Db, rawToken: string): Promise<void>;
+/** Used on role/permission change. */
+export declare function invalidateAllSessionsForUser(db: Db, userId: number): Promise<void>;
+/**
+ * Bulk-delete expired rows, returning how many were reaped. Caller decides
+ * cadence (cron / on-demand). `returning()` gives a driver-portable count
+ * (SQLite `DELETE ... RETURNING` on both libsql and D1).
+ */
+export declare function pruneExpiredSessions(db: Db): Promise<number>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAOlD,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,eAAO,MAAM,sBAAsB,EAAE,aAIpC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AASD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAaA;AASD,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,kBAAkB,EACzB,MAAM,GAAE,aAAsC,GAC7C,OAAO,CAAC,cAAc,CAAC,CAmBzB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,aAAsC,GAC7C,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqDlC;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,sCAAsC;AACtC,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlE"}

package/dist/auth/sessions.js

@@ -0,0 +1,147 @@
+import { eq, lt } from "drizzle-orm";
+import { sessions } from "../db/schema/sessions.js";
+import { users } from "../db/schema/users.js";
+import { generateToken, hashToken } from "./tokens.js";
+const SECONDS_PER_DAY = 60 * 60 * 24;
+export const DEFAULT_SESSION_POLICY = {
+    maxAgeSeconds: 30 * SECONDS_PER_DAY,
+    absoluteMaxAgeSeconds: 90 * SECONDS_PER_DAY,
+    refreshThreshold: 0.5,
+};
+// Bounds for the values we persist. Real-world UA strings are typically
+// 100-400 chars; 1024 leaves headroom while bounding row width on
+// hostile / malformed input. IPs are at most 45 chars (IPv6) — 64 gives
+// space for IPv6 zone IDs without going wild.
+const MAX_IP_LENGTH = 64;
+const MAX_UA_LENGTH = 1024;
+/**
+ * Pull the client IP + user-agent off a request for `sessions.ipAddress`
+ * / `sessions.userAgent`. Prefers `cf-connecting-ip` (set by Cloudflare
+ * Access / Workers / CDN) over `x-forwarded-for` (which can be a chain
+ * — pick the first hop). Falls back to null when neither header is
+ * present. Truncates aggressively so a misconfigured upstream can't
+ * blow up the row width.
+ *
+ * Used at every `createSession` call site so the per-session admin UI
+ * can surface meaningful "what device / where from" context for the
+ * "is this me?" workflow. The values are advisory: an attacker who
+ * controls the request can spoof both, so policy decisions still flow
+ * through the session id (hash-keyed, server-issued).
+ */
+export function readRequestMeta(request) {
+    const cfIp = request.headers.get("cf-connecting-ip");
+    const xff = request.headers.get("x-forwarded-for");
+    // x-forwarded-for is comma-separated when multiple proxies appended;
+    // the leftmost entry is the original client (per RFC 7239 / common
+    // proxy convention).
+    const fallback = xff?.split(",")[0]?.trim() ?? null;
+    const rawIp = cfIp ?? fallback ?? null;
+    const rawUa = request.headers.get("user-agent");
+    return {
+        ipAddress: clip(rawIp, MAX_IP_LENGTH),
+        userAgent: clip(rawUa, MAX_UA_LENGTH),
+    };
+}
+function clip(value, max) {
+    if (value === null)
+        return null;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return null;
+    return trimmed.length > max ? trimmed.slice(0, max) : trimmed;
+}
+/**
+ * Mint a new session: random token → SHA-256 hash → row keyed by hash.
+ * The raw token is returned exactly once for the cookie; the DB never sees it.
+ */
+export async function createSession(db, input, policy = DEFAULT_SESSION_POLICY) {
+    const token = generateToken();
+    const id = await hashToken(token);
+    const expiresAt = new Date(Date.now() + policy.maxAgeSeconds * 1000);
+    const [session] = await db
+        .insert(sessions)
+        .values({
+        id,
+        userId: input.userId,
+        expiresAt,
+        ipAddress: input.ipAddress ?? null,
+        userAgent: input.userAgent ?? null,
+    })
+        .returning();
+    // eslint-disable-next-line no-restricted-syntax -- defensive driver-regression guard; migrate alongside auth errors in PR 2 (#234)
+    if (!session)
+        throw new Error("createSession: insert returned no row");
+    return { token, session, expiresAt };
+}
+/**
+ * Validate a raw session token from the cookie. Returns null on any failure
+ * (no row, expired, beyond absolute cap). Slides expiresAt when over the
+ * refresh threshold; deletes the row on absolute-cap breach so a stolen
+ * token past the ceiling is purged on first use.
+ */
+export async function validateSession(db, rawToken, policy = DEFAULT_SESSION_POLICY) {
+    if (!rawToken)
+        return null;
+    const id = await hashToken(rawToken);
+    const row = await db
+        .select({ session: sessions, user: users })
+        .from(sessions)
+        .innerJoin(users, eq(sessions.userId, users.id))
+        .where(eq(sessions.id, id))
+        .get();
+    if (!row)
+        return null;
+    const now = Date.now();
+    const expiresAtMs = row.session.expiresAt.getTime();
+    const createdAtMs = row.session.createdAt.getTime();
+    if (now >= expiresAtMs ||
+        now >= createdAtMs + policy.absoluteMaxAgeSeconds * 1000) {
+        await db.delete(sessions).where(eq(sessions.id, id));
+        return null;
+    }
+    if (row.user.disabledAt) {
+        await db.delete(sessions).where(eq(sessions.id, id));
+        return null;
+    }
+    const elapsedFraction = (now - createdAtMs) / (policy.maxAgeSeconds * 1000);
+    if (elapsedFraction < policy.refreshThreshold) {
+        return { session: row.session, user: row.user, refreshed: false };
+    }
+    const newExpiryMs = Math.min(now + policy.maxAgeSeconds * 1000, createdAtMs + policy.absoluteMaxAgeSeconds * 1000);
+    if (newExpiryMs === expiresAtMs) {
+        return { session: row.session, user: row.user, refreshed: false };
+    }
+    const newExpiry = new Date(newExpiryMs);
+    await db
+        .update(sessions)
+        .set({ expiresAt: newExpiry })
+        .where(eq(sessions.id, id));
+    return {
+        session: { ...row.session, expiresAt: newExpiry },
+        user: row.user,
+        refreshed: true,
+    };
+}
+export async function invalidateSession(db, rawToken) {
+    if (!rawToken)
+        return;
+    const id = await hashToken(rawToken);
+    await db.delete(sessions).where(eq(sessions.id, id));
+}
+/** Used on role/permission change. */
+export async function invalidateAllSessionsForUser(db, userId) {
+    await db.delete(sessions).where(eq(sessions.userId, userId));
+}
+/**
+ * Bulk-delete expired rows, returning how many were reaped. Caller decides
+ * cadence (cron / on-demand). `returning()` gives a driver-portable count
+ * (SQLite `DELETE ... RETURNING` on both libsql and D1).
+ */
+export async function pruneExpiredSessions(db) {
+    const deleted = await db
+        .delete(sessions)
+        .where(lt(sessions.expiresAt, new Date()))
+        .returning({ id: sessions.id });
+    return deleted.length;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/auth/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAKrC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAWrC,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACnD,aAAa,EAAE,EAAE,GAAG,eAAe;IACnC,qBAAqB,EAAE,EAAE,GAAG,eAAe;IAC3C,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAQF,wEAAwE;AACxE,kEAAkE;AAClE,wEAAwE;AACxE,8CAA8C;AAC9C,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAI9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,qEAAqE;IACrE,mEAAmE;IACnE,qBAAqB;IACrB,MAAM,QAAQ,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChD,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAoB,EAAE,GAAW;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAChE,CAAC;AAgBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAyB,EACzB,SAAwB,sBAAsB;IAE9C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAErE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC;QACN,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,mIAAmI;IACnI,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACvE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,QAAgB,EAChB,SAAwB,sBAAsB;IAE9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;SAC1C,IAAI,CAAC,QAAQ,CAAC;SACd,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SAC/C,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAC1B,GAAG,EAAE,CAAC;IAET,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACpD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAEpD,IACE,GAAG,IAAI,WAAW;QAClB,GAAG,IAAI,WAAW,GAAG,MAAM,CAAC,qBAAqB,GAAG,IAAI,EACxD,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5E,IAAI,eAAe,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,GAAG,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,EACjC,WAAW,GAAG,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAClD,CAAC;IACF,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,EAAE;SACL,MAAM,CAAC,QAAQ,CAAC;SAChB,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;SAC7B,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE;QACjD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,QAAgB;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAM,EACN,MAAc;IAEd,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAM;IAC/C,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;SACzC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/dist/auth/sign-in.d.ts

@@ -0,0 +1,21 @@
+import type { AppContext } from "../context/app.js";
+import type { PlumixApp } from "../runtime/app.js";
+interface MintedSession {
+    /** Raw session token — same value the cookie carries. */
+    readonly token: string;
+    /** Ready-to-set `Set-Cookie` header value. */
+    readonly cookieHeader: string;
+}
+/**
+ * Compose the four steps every successful sign-in shares: read request
+ * meta, create the session row, derive the secure-context flag, and
+ * build the `Set-Cookie` header from the configured `sessionPolicy`.
+ *
+ * Every auth flow that mints a session for the user (magic-link, oauth,
+ * passkey register/login/invite-accept) calls this — cookie attribute
+ * policy lives here so a change to `SameSite`, `Secure`, or `Max-Age`
+ * applies uniformly without scanning five call sites.
+ */
+export declare function mintSessionAndCookie(ctx: AppContext, app: PlumixApp, userId: number): Promise<MintedSession>;
+export {};
+//# sourceMappingURL=sign-in.d.ts.map

package/dist/auth/sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.d.ts","sourceRoot":"","sources":["../../src/auth/sign-in.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAKnD,UAAU,aAAa;IACrB,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC,CAexB"}

package/dist/auth/sign-in.js

@@ -0,0 +1,26 @@
+import { withBasePath } from "../base-path.js";
+import { buildSessionCookie, isSecureRequest } from "./cookies.js";
+import { createSession, readRequestMeta } from "./sessions.js";
+/**
+ * Compose the four steps every successful sign-in shares: read request
+ * meta, create the session row, derive the secure-context flag, and
+ * build the `Set-Cookie` header from the configured `sessionPolicy`.
+ *
+ * Every auth flow that mints a session for the user (magic-link, oauth,
+ * passkey register/login/invite-accept) calls this — cookie attribute
+ * policy lives here so a change to `SameSite`, `Secure`, or `Max-Age`
+ * applies uniformly without scanning five call sites.
+ */
+export async function mintSessionAndCookie(ctx, app, userId) {
+    const { token } = await createSession(ctx.db, { userId, ...readRequestMeta(ctx.request) }, app.sessionPolicy);
+    const cookieHeader = buildSessionCookie(token, {
+        maxAgeSeconds: app.sessionPolicy.maxAgeSeconds,
+        secure: isSecureRequest(ctx.request),
+        sameSite: "Lax",
+        // Scope the session to the subdirectory so it isn't sent to a sibling
+        // app on the same host (`""` → `/`, the host-wide default).
+        path: withBasePath("/", app.basePath),
+    });
+    return { token, cookieHeader };
+}
+//# sourceMappingURL=sign-in.js.map

package/dist/auth/sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../src/auth/sign-in.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAS/D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAe,EACf,GAAc,EACd,MAAc;IAEd,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CACnC,GAAG,CAAC,EAAE,EACN,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAC3C,GAAG,CAAC,aAAa,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE;QAC7C,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC,aAAa;QAC9C,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,KAAK;QACf,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC"}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,9 @@
+export declare function generateToken(): string;
+/**
+ * SHA-256(token), hex-encoded. The DB stores only the hash so a snapshot
+ * leak does not yield live tokens. Native WebCrypto on the hot path.
+ */
+export declare function hashToken(token: string): Promise<string>;
+/** Constant-time string equality — `constantTimeEqual` short-circuits on length mismatch. */
+export declare function safeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/auth/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAQA,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG9D;AAED,6FAA6F;AAC7F,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/auth/tokens.js

@@ -0,0 +1,23 @@
+import { constantTimeEqual } from "@oslojs/crypto/subtle";
+import { encodeBase64urlNoPadding, encodeHexLowerCase } from "@oslojs/encoding";
+// 192 bits — comfortably inside the Copenhagen Book's 120–256 band.
+const TOKEN_BYTES = 24;
+const ENCODER = new TextEncoder();
+export function generateToken() {
+    const bytes = new Uint8Array(TOKEN_BYTES);
+    crypto.getRandomValues(bytes);
+    return encodeBase64urlNoPadding(bytes);
+}
+/**
+ * SHA-256(token), hex-encoded. The DB stores only the hash so a snapshot
+ * leak does not yield live tokens. Native WebCrypto on the hot path.
+ */
+export async function hashToken(token) {
+    const digest = await crypto.subtle.digest("SHA-256", ENCODER.encode(token));
+    return encodeHexLowerCase(new Uint8Array(digest));
+}
+/** Constant-time string equality — `constantTimeEqual` short-circuits on length mismatch. */
+export function safeEqual(a, b) {
+    return constantTimeEqual(ENCODER.encode(a), ENCODER.encode(b));
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,oEAAoE;AACpE,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,kBAAkB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,OAAO,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/base-path.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Base-path algebra for serving a plumix site under a subdirectory
+ * (`example.com/custom-directory/*`). Three pure helpers mirror the model
+ * the major frameworks settled on: normalize once at config load, strip once
+ * on the inbound request before routing, prepend on every outbound URL.
+ *
+ * The empty string is the root deployment (today's behavior) and every helper
+ * treats it as a no-op, so an unconfigured site is byte-for-byte unchanged.
+ */
+/**
+ * Canonicalize an operator-supplied base path: `""` for a root deployment,
+ * otherwise a leading-slash, no-trailing-slash, single-slash-separated prefix.
+ * Lenient by design (`docs`, `/docs/`, `/a//b` all normalize) so a small
+ * config typo doesn't 404 the whole site.
+ */
+export declare function normalizeBasePath(input: string | undefined): string;
+/**
+ * Remove the base prefix from an inbound pathname so the rest of the router
+ * matches against root-relative paths unchanged. Returns the remainder (always
+ * leading-slash; the bare base maps to `/`) or `null` when the request isn't
+ * under the base, which the caller turns into a 404.
+ *
+ * A root base (`""`) is a pure pass-through — the path is returned verbatim so
+ * an unconfigured deployment behaves exactly as before. When a base IS set,
+ * duplicate leading slashes are collapsed first so `//docs/admin` can't dodge
+ * the prefix gate (matching the hardening the SSR frameworks apply).
+ */
+export declare function stripBasePath(pathname: string, basePath: string): string | null;
+/**
+ * Prepend the base to a root-relative path for an outbound URL (canonical tag,
+ * sitemap `<loc>`, feed link, permalink, cookie `Path`). Inverse of
+ * {@link stripBasePath}: the site root (`/`) maps back to the bare base, and a
+ * root base (`""`) returns the path untouched.
+ */
+export declare function withBasePath(path: string, basePath: string): string;
+//# sourceMappingURL=base-path.d.ts.map

package/dist/base-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-path.d.ts","sourceRoot":"","sources":["../src/base-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAQf;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGnE"}