@plumix/core 0.1.0

package/dist/auth/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAKlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnE;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAU3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAiB5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,cAAc,EAAE,SAAS,oBAAoB,EAAE,GACjD,oBAAoB,CAiBtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAE3D"}

package/dist/auth/authenticator.js

@@ -0,0 +1,98 @@
+import { validateApiToken } from "./api-tokens.js";
+import { readSessionCookie } from "./cookies.js";
+import { validateSession } from "./sessions.js";
+/**
+ * Default authenticator — reads the `plumix_session` cookie, validates
+ * the row, returns the user. Same logic the dispatcher used inline
+ * before this contract existed; isolating it here makes it swappable.
+ *
+ * Returns no `tokenScopes` — a browser session inherits the full role
+ * caps. PAT-style scoping doesn't apply here.
+ */
+export function sessionAuthenticator() {
+    return {
+        async authenticate(request, db) {
+            const token = readSessionCookie(request);
+            if (!token)
+                return null;
+            const validated = await validateSession(db, token);
+            if (!validated)
+                return null;
+            return { user: validated.user };
+        },
+    };
+}
+/**
+ * Personal-access-token authenticator. Reads the
+ * `Authorization: Bearer pl_pat_…` header, hashes it, looks up the
+ * row in `api_tokens`, and bumps `lastUsedAt`. Used by CLIs / MCP
+ * servers / any non-browser client.
+ *
+ * Composed with `sessionAuthenticator()` by default (see
+ * `defaultAuthenticator()`) so a single plumix install supports both
+ * cookie-authed admin browsing AND bearer-authed API access without
+ * any operator config.
+ */
+export function apiTokenAuthenticator() {
+    return {
+        async authenticate(request, db) {
+            const header = request.headers.get("authorization");
+            if (!header)
+                return null;
+            const match = /^Bearer\s+(\S+)$/i.exec(header);
+            if (!match?.[1])
+                return null;
+            const validated = await validateApiToken(db, match[1]);
+            if (!validated)
+                return null;
+            return {
+                user: validated.user,
+                // null = unrestricted (token inherits role caps); array =
+                // narrow to that intersection. `auth.can()` enforces.
+                tokenScopes: validated.token.scopes ?? null,
+            };
+        },
+    };
+}
+/**
+ * Compose multiple authenticators into a first-match-wins chain. The
+ * first one to return a non-null user decides the request. `signOutUrl`
+ * is taken from the first authenticator that exposes it — the chain is
+ * a list, and the head wins when both could speak.
+ *
+ * Used to wire the default plumix install: the cookie-session guard
+ * in front of the API-token guard, so browser requests resolve via
+ * the existing path and bearer-auth API clients don't need any
+ * operator config.
+ */
+export function chainAuthenticators(...authenticators) {
+    return {
+        async authenticate(request, db) {
+            for (const auth of authenticators) {
+                const result = await auth.authenticate(request, db);
+                if (result)
+                    return result;
+            }
+            return null;
+        },
+        signOutUrl() {
+            for (const auth of authenticators) {
+                const url = auth.signOutUrl?.() ?? null;
+                if (url)
+                    return url;
+            }
+            return null;
+        },
+    };
+}
+/**
+ * Out-of-the-box authenticator: cookie-session + API token. Plumix
+ * uses this when `auth.authenticator` is omitted from config; the
+ * existing `sessionAuthenticator()` direct usage is preserved as the
+ * intentional "no API tokens" path for ops who want to disable
+ * bearer-auth at the runtime level.
+ */
+export function defaultAuthenticator() {
+    return chainAuthenticators(sessionAuthenticator(), apiTokenAuthenticator());
+}
+//# sourceMappingURL=authenticator.js.map

package/dist/auth/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAqEhD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,0DAA0D;gBAC1D,sDAAsD;gBACtD,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;aAC5C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAG,cAA+C;IAElD,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU;YACR,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;gBACxC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/bearer.d.ts

@@ -0,0 +1,9 @@
+import type { AppContext } from "../context/app.js";
+export declare function hasBearerToken(request: Request): boolean;
+/**
+ * Resolve a bearer PAT to an authenticated context (user + token scopes), or
+ * null when the token is absent, malformed, expired, revoked, or its user is
+ * disabled. Callers decide whether a null means 401 or anonymous access.
+ */
+export declare function authenticateBearer(ctx: AppContext): Promise<AppContext | null>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/auth/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAgBpD,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAK5B"}

package/dist/auth/bearer.js

@@ -0,0 +1,28 @@
+import { withUser } from "../context/app.js";
+import { apiTokenAuthenticator } from "./authenticator.js";
+// Bearer PAT only — shared by the CSRF-exempt external surfaces (MCP, REST).
+// Deliberately NOT the request's configured authenticator (cookie/custom
+// guard): cookie auth must never resolve on an endpoint mounted ahead of the
+// CSRF gate, since only bearer auth is inherently CSRF-immune.
+const bearerAuthenticator = apiTokenAuthenticator();
+// Must stay a superset of what `apiTokenAuthenticator` actually parses, so the
+// "bearer present?" check never reports false while the token still fails to
+// authenticate — the gap (e.g. a multi-token header) fails closed to 401, never
+// to silent anonymous access.
+const BEARER = /^bearer\s+\S/i;
+export function hasBearerToken(request) {
+    return BEARER.test(request.headers.get("authorization") ?? "");
+}
+/**
+ * Resolve a bearer PAT to an authenticated context (user + token scopes), or
+ * null when the token is absent, malformed, expired, revoked, or its user is
+ * disabled. Callers decide whether a null means 401 or anonymous access.
+ */
+export async function authenticateBearer(ctx) {
+    const result = await bearerAuthenticator.authenticate(ctx.request, ctx.db);
+    if (!result)
+        return null;
+    const { id, email, role, meta } = result.user;
+    return withUser(ctx, { id, email, role, meta }, result.tokenScopes ?? null);
+}
+//# sourceMappingURL=bearer.js.map

package/dist/auth/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;AAEpD,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,8BAA8B;AAC9B,MAAM,MAAM,GAAG,eAAe,CAAC;AAE/B,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAe;IAEf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/bootstrap.d.ts

@@ -0,0 +1,14 @@
+import type { Db } from "../context/app.js";
+import type { User, UserRole } from "../db/schema/users.js";
+export interface BootstrappedUser {
+    readonly user: User;
+    readonly bootstrapped: boolean;
+}
+export declare function provisionUser(db: Db, input: {
+    readonly email: string;
+    readonly name?: string | null;
+    readonly avatarUrl?: string | null;
+    readonly defaultRole?: UserRole;
+    readonly emailVerified?: boolean;
+}): Promise<BootstrappedUser>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/auth/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAI5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAwB3B"}

package/dist/auth/bootstrap.js

@@ -0,0 +1,27 @@
+import { sql } from "../db/index.js";
+import { users } from "../db/schema/users.js";
+export async function provisionUser(db, input) {
+    const defaultRole = input.defaultRole ?? "subscriber";
+    // Role is decided inside the INSERT so concurrent first-user provisioning
+    // can't elect two admins: SQLite serializes writers, and the subquery
+    // observes previously-inserted rows. Only the statement that runs when
+    // the table is empty gets `admin`.
+    const [user] = await db
+        .insert(users)
+        .values({
+        email: input.email,
+        name: input.name ?? null,
+        avatarUrl: input.avatarUrl ?? null,
+        role: sql `CASE WHEN (SELECT COUNT(*) FROM ${users}) = 0 THEN 'admin' ELSE ${defaultRole} END`,
+        emailVerifiedAt: input.emailVerified ? new Date() : null,
+    })
+        .returning();
+    // eslint-disable-next-line no-restricted-syntax -- defensive driver-regression guard; migrate alongside auth errors in PR 2 (#234)
+    if (!user)
+        throw new Error("provisionUser: insert returned no row");
+    return {
+        user,
+        bootstrapped: user.role === "admin" && defaultRole !== "admin",
+    };
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/auth/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAO9C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAMC;IAED,MAAM,WAAW,GAAa,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC;IAEhE,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,IAAI,EAAE,GAAG,CAAU,mCAAmC,KAAK,2BAA2B,WAAW,MAAM;QACvG,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KACzD,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,mIAAmI;IACnI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,KAAK,OAAO;KAC/D,CAAC;AACJ,CAAC"}

package/dist/auth/config.d.ts

@@ -0,0 +1,96 @@
+import type { RequestAuthenticator } from "./authenticator.js";
+import type { OAuthProviderClient } from "./oauth/types.js";
+import type { PasskeyConfig } from "./passkey/config.js";
+import type { SessionPolicy } from "./sessions.js";
+export interface PlumixMagicLinkConfig {
+    /**
+     * Site name shown in the email subject + body ("Sign in to {siteName}").
+     * Required so the operator picks the user-visible string explicitly —
+     * the alternative (silently falling back to `passkey.rpName`) couples
+     * config blocks in a non-obvious way.
+     */
+    readonly siteName: string;
+    /**
+     * Token lifetime in seconds. Defaults to 15 minutes (900) — the
+     * Copenhagen Book / emdash convention. Lower for paranoid deploys.
+     */
+    readonly ttlSeconds?: number;
+}
+export interface PlumixOAuthConfig {
+    /**
+     * Map of provider keys → configured provider clients. The map key
+     * doubles as the URL path segment (`/_plumix/auth/oauth/<key>/start`)
+     * and the value of `oauth_accounts.provider` for any user that signs
+     * in via this provider. Pass instances from `github(creds)` /
+     * `google(creds)` (built-ins) or from your own factory implementing
+     * `OAuthProviderClient` for provider parity.
+     */
+    readonly providers: Readonly<Record<string, OAuthProviderClient>>;
+}
+export type BootstrapVia = "passkey" | "first-method-wins";
+export interface PlumixAuthInput {
+    readonly passkey: PasskeyConfig;
+    readonly sessions?: SessionPolicy;
+    readonly oauth?: PlumixOAuthConfig;
+    readonly magicLink?: PlumixMagicLinkConfig;
+    /**
+     * Request-level guard. Decides "who is this user" on every request.
+     * Defaults to `defaultAuthenticator()` — a chain of
+     * `sessionAuthenticator()` (cookie) followed by
+     * `apiTokenAuthenticator()` (Authorization: Bearer pl_pat_…).
+     * Browser admins and CLI / MCP clients both authenticate out of
+     * the box without operator config.
+     *
+     * Override for transparent SSO — e.g. `cfAccess({ teamDomain })` from
+     * `@plumix/runtime-cloudflare`, where the edge sets a JWT header on
+     * every request. The built-in login routes (passkey / oauth /
+     * magic-link) remain mounted regardless: operators that want them
+     * disabled when an external authenticator owns the session should
+     * firewall `/_plumix/auth/*` at the edge (e.g. a Cloudflare Access
+     * policy on those paths). Leaving them live by default supports
+     * deploys that mix transparent SSO with passkey-as-backup.
+     *
+     * If you override and still want bearer-token auth alongside, wrap
+     * yours in `chainAuthenticators(yourGuard, apiTokenAuthenticator())`.
+     */
+    readonly authenticator?: RequestAuthenticator;
+    /**
+     * How the very first admin enrols on a fresh deploy.
+     *
+     * - `"passkey"` (default) — magic-link and OAuth signup are refused
+     *   while the users table is empty. The first admin must enrol via
+     *   the dedicated passkey bootstrap rail. Phishing-resistant; no
+     *   external dependency.
+     *
+     * - `"first-method-wins"` — any verified external flow (magic-link,
+     *   OAuth, custom authenticator) can mint the first admin via the
+     *   atomic CASE-WHEN-COUNT election in `provisionUser`. Use when the
+     *   runtime layer already gates who reaches plumix (Cloudflare Access
+     *   in front, SAML at the edge, internal-only deploy) — the gate is
+     *   "can the JWT be issued at all", not "can plumix see any user".
+     */
+    readonly bootstrapVia?: BootstrapVia;
+}
+export interface PlumixAuthConfig {
+    readonly kind: "plumix";
+    readonly passkey: PasskeyConfig;
+    readonly sessions?: SessionPolicy;
+    readonly oauth?: PlumixOAuthConfig;
+    readonly magicLink?: PlumixMagicLinkConfig;
+    readonly authenticator?: RequestAuthenticator;
+    readonly bootstrapVia?: BootstrapVia;
+}
+export interface PlumixConfigIssue {
+    readonly path: string;
+    readonly message: string;
+}
+export declare class PlumixConfigError extends Error {
+    readonly code: "invalid_auth_config";
+    readonly issues: readonly PlumixConfigIssue[];
+    private constructor();
+    static invalidAuthConfig(ctx: {
+        issues: readonly PlumixConfigIssue[];
+    }): PlumixConfigError;
+}
+export declare function auth(input: PlumixAuthInput): PlumixAuthConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACnE;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAK1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAE9C,OAAO;IAUP,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAC5B,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;KACtC,GAAG,iBAAiB;CAUtB;AA+JD,wBAAgB,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAe7D"}

package/dist/auth/config.js

@@ -0,0 +1,98 @@
+import * as v from "valibot";
+import { OAUTH_PROVIDER_KEY_PATTERN } from "./oauth/types.js";
+export class PlumixConfigError extends Error {
+    static {
+        PlumixConfigError.prototype.name = "PlumixConfigError";
+    }
+    code;
+    issues;
+    constructor(code, message, issues) {
+        super(message);
+        this.code = code;
+        this.issues = issues;
+    }
+    static invalidAuthConfig(ctx) {
+        const summary = ctx.issues
+            .map((i) => (i.path ? `${i.path}: ${i.message}` : i.message))
+            .join("; ");
+        return new PlumixConfigError("invalid_auth_config", `Invalid auth() config — ${summary}`, ctx.issues);
+    }
+}
+const isPlainObject = (val) => typeof val === "object" && val !== null;
+const isNonEmptyString = (val) => typeof val === "string" && val.length > 0;
+const field = (val, key) => isPlainObject(val) ? val[key] : undefined;
+const passkeySchema = v.object({
+    rpName: v.pipe(v.string(), v.nonEmpty("rpName must be a non-empty string")),
+    rpId: v.pipe(v.string(), v.nonEmpty("rpId must be a non-empty string")),
+    origin: v.pipe(v.string(), v.url("origin must be a valid URL")),
+});
+const sessionPolicySchema = v.pipe(v.object({
+    maxAgeSeconds: v.pipe(v.number(), v.integer("maxAgeSeconds must be an integer"), v.minValue(1, "maxAgeSeconds must be ≥ 1")),
+    absoluteMaxAgeSeconds: v.pipe(v.number(), v.integer("absoluteMaxAgeSeconds must be an integer"), v.minValue(1, "absoluteMaxAgeSeconds must be ≥ 1")),
+    refreshThreshold: v.pipe(v.number(), v.minValue(0, "refreshThreshold must be in [0, 1]"), v.maxValue(1, "refreshThreshold must be in [0, 1]")),
+}), v.check((s) => s.absoluteMaxAgeSeconds >= s.maxAgeSeconds, "absoluteMaxAgeSeconds must be ≥ maxAgeSeconds"));
+// Provider clients are user-supplied factory output — we shape-check the
+// minimum required fields so a malformed entry surfaces at config time
+// rather than at the first sign-in attempt. Anything beyond these (the
+// `parseProfile` impl, optional hooks) is the provider author's contract.
+const oauthProviderClientSchema = v.object({
+    label: v.pipe(v.string(), v.nonEmpty("provider label must be non-empty")),
+    authorizeUrl: v.pipe(v.string(), v.url("authorizeUrl must be a valid URL")),
+    tokenUrl: v.pipe(v.string(), v.url("tokenUrl must be a valid URL")),
+    userInfoUrl: v.pipe(v.string(), v.url("userInfoUrl must be a valid URL")),
+    scopes: v.array(v.string()),
+    // Literal credentials, or an `(env) => OAuthClientConfig` resolver (the
+    // secret is read from the request env at token exchange). A resolver's
+    // return is validated at use, not here — env isn't available at config
+    // time — so the field checks below short-circuit for functions. A bare
+    // pipe (not `v.union`) keeps the literal path's field errors precise:
+    // a union would collapse them into "Expected (Object | unknown)".
+    client: v.pipe(v.unknown(), v.check((val) => typeof val === "function" || isPlainObject(val), "client must be an { clientId, clientSecret } object or an (env) => … resolver"), v.check((val) => typeof val === "function" || isNonEmptyString(field(val, "clientId")), "clientId must be non-empty"), v.check((val) => typeof val === "function" ||
+        isNonEmptyString(field(val, "clientSecret")), "clientSecret must be non-empty")),
+    parseProfile: v.pipe(v.unknown(), v.check((val) => typeof val === "function", "parseProfile must be a function")),
+    // optional hooks — present-or-absent, no shape check beyond function
+    decorateAuthorizeUrl: v.optional(v.pipe(v.unknown(), v.check((val) => typeof val === "function", "decorateAuthorizeUrl must be a function"))),
+    fetchVerifiedEmail: v.optional(v.pipe(v.unknown(), v.check((val) => typeof val === "function", "fetchVerifiedEmail must be a function"))),
+});
+const oauthSchema = v.pipe(v.object({
+    providers: v.record(v.pipe(v.string(), v.regex(OAUTH_PROVIDER_KEY_PATTERN, "oauth.providers key must be lowercase alphanum + dash/underscore (1-32 chars)")), oauthProviderClientSchema),
+}), v.check((cfg) => Object.keys(cfg.providers).length > 0, "oauth.providers must declare at least one provider"));
+const magicLinkSchema = v.object({
+    siteName: v.pipe(v.string(), v.nonEmpty("siteName must be non-empty"), 
+    // Defense-in-depth: siteName flows into the email Subject header. Today
+    // it's operator config (not request input) so safe, but if a future
+    // settings UI ever lets it become user-input, blocking CR/LF here
+    // prevents header injection at the boundary.
+    v.regex(/^[^\r\n]+$/, "siteName must not contain newlines")),
+    ttlSeconds: v.optional(v.pipe(v.number(), v.integer("ttlSeconds must be an integer"), v.minValue(60, "ttlSeconds must be ≥ 60"), v.maxValue(60 * 60, "ttlSeconds must be ≤ 3600"))),
+});
+const authInputSchema = v.object({
+    passkey: passkeySchema,
+    sessions: v.optional(sessionPolicySchema),
+    oauth: v.optional(oauthSchema),
+    magicLink: v.optional(magicLinkSchema),
+    bootstrapVia: v.optional(v.picklist(["passkey", "first-method-wins"])),
+});
+function toIssues(issues) {
+    return issues.map((issue) => ({
+        path: v.getDotPath(issue) ?? "",
+        message: issue.message,
+    }));
+}
+export function auth(input) {
+    const result = v.safeParse(authInputSchema, input);
+    if (!result.success) {
+        const issues = toIssues(result.issues);
+        throw PlumixConfigError.invalidAuthConfig({ issues });
+    }
+    return {
+        kind: "plumix",
+        passkey: input.passkey,
+        sessions: input.sessions,
+        oauth: input.oauth,
+        magicLink: input.magicLink,
+        authenticator: input.authenticator,
+        bootstrapVia: input.bootstrapVia,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAM7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AA0F9D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,iBAAiB,CAAC,SAAS,CAAC,IAAI,GAAG,mBAAmB,CAAC;IACzD,CAAC;IAEQ,IAAI,CAAwB;IAC5B,MAAM,CAA+B;IAE9C,YACE,IAA2B,EAC3B,OAAe,EACf,MAAoC;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,iBAAiB,CAAC,GAExB;QACC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM;aACvB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;aAC5D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,IAAI,iBAAiB,CAC1B,qBAAqB,EACrB,2BAA2B,OAAO,EAAE,EACpC,GAAG,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;CACF;AAED,MAAM,aAAa,GAAG,CAAC,GAAY,EAAkC,EAAE,CACrE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;AAE1C,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAW,EAAE,CACjD,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;AAE5C,MAAM,KAAK,GAAG,CAAC,GAAY,EAAE,GAAW,EAAW,EAAE,CACnD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAE5C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,MAAM,CAAC;IACP,aAAa,EAAE,CAAC,CAAC,IAAI,CACnB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,EAC7C,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAC3C;IACD,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,OAAO,CAAC,0CAA0C,CAAC,EACrD,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,mCAAmC,CAAC,CACnD;IACD,gBAAgB,EAAE,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,oCAAoC,CAAC,EACnD,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,oCAAoC,CAAC,CACpD;CACF,CAAC,EACF,CAAC,CAAC,KAAK,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,aAAa,EACjD,+CAA+C,CAChD,CACF,CAAC;AAEF,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IACzE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACnE,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,EAAE,CAAC,CAAC,IAAI,CACZ,CAAC,CAAC,OAAO,EAAE,EACX,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,IAAI,aAAa,CAAC,GAAG,CAAC,EACxD,+EAA+E,CAChF,EACD,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,GAAG,KAAK,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EACvE,4BAA4B,CAC7B,EACD,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,GAAG,KAAK,UAAU;QACzB,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAC9C,gCAAgC,CACjC,CACF;IACD,YAAY,EAAE,CAAC,CAAC,IAAI,CAClB,CAAC,CAAC,OAAO,EAAE,EACX,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,EAClC,iCAAiC,CAClC,CACF;IACD,qEAAqE;IACrE,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAC9B,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,OAAO,EAAE,EACX,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,EAClC,yCAAyC,CAC1C,CACF,CACF;IACD,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAC5B,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,OAAO,EAAE,EACX,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,EAClC,uCAAuC,CACxC,CACF,CACF;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CACxB,CAAC,CAAC,MAAM,CAAC;IACP,SAAS,EAAE,CAAC,CAAC,MAAM,CACjB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,KAAK,CACL,0BAA0B,EAC1B,+EAA+E,CAChF,CACF,EACD,yBAAyB,CAC1B;CACF,CAAC,EACF,CAAC,CAAC,KAAK,CACL,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAC9C,oDAAoD,CACrD,CACF,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CACd,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IACxC,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,6CAA6C;IAC7C,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAC5D;IACD,UAAU,EAAE,CAAC,CAAC,QAAQ,CACpB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,EAC1C,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,yBAAyB,CAAC,EACzC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE,2BAA2B,CAAC,CACjD,CACF;CACF,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;CACvE,CAAC,CAAC;AAEH,SAAS,QAAQ,CACf,MAAuC;IAEvC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAsB;IACzC,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,29 @@
+export declare const SESSION_COOKIE_NAME = "plumix_session";
+export interface SessionCookieOptions {
+    readonly name?: string;
+    /** Cookie Max-Age in seconds. Mirrors the session's sliding TTL. */
+    readonly maxAgeSeconds: number;
+    /** Set Secure when serving over HTTPS — auto-detected from request URL. */
+    readonly secure: boolean;
+    readonly sameSite?: "Lax" | "Strict" | "None";
+    readonly path?: string;
+    readonly domain?: string;
+}
+/**
+ * Build a Set-Cookie value following Copenhagen Book guidance:
+ * HttpOnly + Secure-when-https + SameSite=Lax + explicit Max-Age + Path=/.
+ * Domain is intentionally omitted (host-only cookies are stricter than wildcard).
+ */
+export declare function buildSessionCookie(value: string, options: SessionCookieOptions): string;
+/** Build a Set-Cookie that immediately deletes the session cookie. */
+export declare function buildSessionDeletionCookie(options: Omit<SessionCookieOptions, "maxAgeSeconds">): string;
+/**
+ * Parse a single named cookie out of a request's Cookie header. We accept
+ * the cookie ONLY from the Cookie header — never from URL or form (Copenhagen
+ * Book explicit rule: session IDs must not be readable from form submissions
+ * or query parameters).
+ */
+export declare function readSessionCookie(request: Request, name?: string): string | null;
+/** True when the request was served over HTTPS — controls the Secure flag. */
+export declare function isSecureRequest(request: Request): boolean;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAoBR;AAED,sEAAsE;AACtE,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,GACnD,MAAM,CAmBR;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE,MAA4B,GACjC,MAAM,GAAG,IAAI,CAYf;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAMzD"}

package/dist/auth/cookies.js

@@ -0,0 +1,70 @@
+export const SESSION_COOKIE_NAME = "plumix_session";
+/**
+ * Build a Set-Cookie value following Copenhagen Book guidance:
+ * HttpOnly + Secure-when-https + SameSite=Lax + explicit Max-Age + Path=/.
+ * Domain is intentionally omitted (host-only cookies are stricter than wildcard).
+ */
+export function buildSessionCookie(value, options) {
+    const { name = SESSION_COOKIE_NAME, maxAgeSeconds, secure, sameSite = "Lax", path = "/", domain, } = options;
+    const parts = [
+        `${name}=${value}`,
+        `Path=${path}`,
+        `Max-Age=${maxAgeSeconds}`,
+        "HttpOnly",
+        `SameSite=${sameSite}`,
+    ];
+    if (secure)
+        parts.push("Secure");
+    if (domain)
+        parts.push(`Domain=${domain}`);
+    return parts.join("; ");
+}
+/** Build a Set-Cookie that immediately deletes the session cookie. */
+export function buildSessionDeletionCookie(options) {
+    const { name = SESSION_COOKIE_NAME, secure, sameSite = "Lax", path = "/", domain, } = options;
+    const parts = [
+        `${name}=`,
+        `Path=${path}`,
+        "Max-Age=0",
+        "Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+        "HttpOnly",
+        `SameSite=${sameSite}`,
+    ];
+    if (secure)
+        parts.push("Secure");
+    if (domain)
+        parts.push(`Domain=${domain}`);
+    return parts.join("; ");
+}
+/**
+ * Parse a single named cookie out of a request's Cookie header. We accept
+ * the cookie ONLY from the Cookie header — never from URL or form (Copenhagen
+ * Book explicit rule: session IDs must not be readable from form submissions
+ * or query parameters).
+ */
+export function readSessionCookie(request, name = SESSION_COOKIE_NAME) {
+    const header = request.headers.get("cookie");
+    if (!header)
+        return null;
+    for (const part of header.split(";")) {
+        const eq = part.indexOf("=");
+        if (eq < 0)
+            continue;
+        const key = part.slice(0, eq).trim();
+        if (key !== name)
+            continue;
+        const value = part.slice(eq + 1).trim();
+        return value === "" ? null : value;
+    }
+    return null;
+}
+/** True when the request was served over HTTPS — controls the Secure flag. */
+export function isSecureRequest(request) {
+    try {
+        return new URL(request.url).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAapD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAA6B;IAE7B,MAAM,EACJ,IAAI,GAAG,mBAAmB,EAC1B,aAAa,EACb,MAAM,EACN,QAAQ,GAAG,KAAK,EAChB,IAAI,GAAG,GAAG,EACV,MAAM,GACP,GAAG,OAAO,CAAC;IAEZ,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,QAAQ,IAAI,EAAE;QACd,WAAW,aAAa,EAAE;QAC1B,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,0BAA0B,CACxC,OAAoD;IAEpD,MAAM,EACJ,IAAI,GAAG,mBAAmB,EAC1B,MAAM,EACN,QAAQ,GAAG,KAAK,EAChB,IAAI,GAAG,GAAG,EACV,MAAM,GACP,GAAG,OAAO,CAAC;IACZ,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG;QACV,QAAQ,IAAI,EAAE;QACd,WAAW;QACX,uCAAuC;QACvC,UAAU;QACV,YAAY,QAAQ,EAAE;KACvB,CAAC;IACF,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,OAAe,mBAAmB;IAElC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/auth/csrf.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Two-layered CSRF protection:
+ *
+ * 1. RPC + auth endpoints: require a custom `X-Plumix-Request: 1` header.
+ *    Browsers cannot set custom headers on cross-origin requests without a
+ *    CORS preflight, and Plumix does not enable CORS — so a forged request
+ *    from another origin cannot include this header.
+ *
+ * 2. Public route mutations (POST/PUT/PATCH/DELETE): validate the Origin
+ *    header (or Referer if Origin is absent) against the site origin. This
+ *    is stateless and CDN-cache compatible.
+ *
+ * Combined with `SameSite=Lax` on the session cookie this covers all modern
+ * browsers; Origin/Referer check covers older clients without SameSite support.
+ */
+export declare const CSRF_HEADER_NAME = "X-Plumix-Request";
+export declare const CSRF_HEADER_VALUE = "1";
+export declare function isSafeMethod(method: string): boolean;
+/**
+ * True when the request includes the expected `X-Plumix-Request` header.
+ * Use on RPC and auth endpoints. Returns true for safe (non-mutating)
+ * methods so GETs aren't blocked.
+ */
+export declare function hasCsrfHeader(request: Request): boolean;
+export interface OriginCheckOptions {
+    /** Allowed origins (e.g. `https://cms.example.com`). Compared exactly. */
+    readonly allowed: readonly string[];
+}
+/**
+ * Validate Origin (or Referer) for non-safe methods. Returns false on
+ * mismatch / missing header. Safe methods always pass.
+ */
+export declare function hasMatchingOrigin(request: Request, options: OriginCheckOptions): boolean;
+export declare class CsrfError extends Error {
+    readonly code: "missing_header" | "origin_mismatch";
+    private constructor();
+    static missingHeader(): CsrfError;
+    static originMismatch(): CsrfError;
+}
+export declare function requireCsrf(request: Request): void;
+export declare function requireMatchingOrigin(request: Request, options: OriginCheckOptions): void;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/auth/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/auth/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAIrC,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAGvD;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAcT;AAED,qBAAa,SAAU,SAAQ,KAAK;IAKlC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;IAEpD,OAAO;IAQP,MAAM,CAAC,aAAa,IAAI,SAAS;IAOjC,MAAM,CAAC,cAAc,IAAI,SAAS;CAMnC;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAIlD;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,kBAAkB,GAC1B,IAAI,CAIN"}