@push.rocks/smartregistry 2.3.0 → 2.5.0

package/dist_ts/core/classes.defaultauthprovider.d.ts

@@ -0,0 +1,78 @@
+import type { IAuthProvider, ITokenOptions } from './interfaces.auth.js';
+import type { IAuthConfig, IAuthToken, ICredentials, TRegistryProtocol } from './interfaces.core.js';
+/**
+ * Default in-memory authentication provider.
+ * This is the reference implementation that stores tokens in memory.
+ * For production use, implement IAuthProvider with Redis, database, or external auth.
+ */
+export declare class DefaultAuthProvider implements IAuthProvider {
+    private config;
+    private tokenStore;
+    private userCredentials;
+    constructor(config: IAuthConfig);
+    /**
+     * Initialize the auth provider
+     */
+    init(): Promise<void>;
+    /**
+     * Authenticate user credentials
+     */
+    authenticate(credentials: ICredentials): Promise<string | null>;
+    /**
+     * Validate any token (NPM, Maven, OCI, PyPI, RubyGems, Composer, Cargo)
+     */
+    validateToken(tokenString: string, protocol?: TRegistryProtocol): Promise<IAuthToken | null>;
+    /**
+     * Create a new token for a user
+     */
+    createToken(userId: string, protocol: TRegistryProtocol, options?: ITokenOptions): Promise<string>;
+    /**
+     * Revoke a token
+     */
+    revokeToken(token: string): Promise<void>;
+    /**
+     * Check if token has permission for an action
+     */
+    authorize(token: IAuthToken | null, resource: string, action: string): Promise<boolean>;
+    /**
+     * List all tokens for a user
+     */
+    listUserTokens(userId: string): Promise<Array<{
+        key: string;
+        readonly: boolean;
+        created: string;
+        protocol?: TRegistryProtocol;
+    }>>;
+    /**
+     * Create an OCI JWT token
+     */
+    private createOciToken;
+    /**
+     * Validate an OCI JWT token
+     */
+    private validateOciToken;
+    /**
+     * Check if a scope matches a resource and action
+     */
+    private matchesScope;
+    /**
+     * Convert unified scopes to OCI access array
+     */
+    private scopesToOciAccess;
+    /**
+     * Convert OCI access array to unified scopes
+     */
+    private ociAccessToScopes;
+    /**
+     * Generate UUID for tokens
+     */
+    private generateUuid;
+    /**
+     * Check if string is a valid UUID
+     */
+    private isValidUuid;
+    /**
+     * Hash a token for identification
+     */
+    private hashToken;
+}

package/dist_ts/core/classes.defaultauthprovider.js

@@ -0,0 +1,311 @@
+import * as crypto from 'crypto';
+/**
+ * Default in-memory authentication provider.
+ * This is the reference implementation that stores tokens in memory.
+ * For production use, implement IAuthProvider with Redis, database, or external auth.
+ */
+export class DefaultAuthProvider {
+    config;
+    tokenStore = new Map();
+    userCredentials = new Map(); // username -> password hash (mock)
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Initialize the auth provider
+     */
+    async init() {
+        // Initialize token store (in-memory for now)
+        // In production, this could be Redis or a database
+    }
+    // ========================================================================
+    // IAuthProvider Implementation
+    // ========================================================================
+    /**
+     * Authenticate user credentials
+     */
+    async authenticate(credentials) {
+        // Mock authentication - in production, verify against database/LDAP
+        const storedPassword = this.userCredentials.get(credentials.username);
+        if (!storedPassword) {
+            // Auto-register for testing (remove in production)
+            this.userCredentials.set(credentials.username, credentials.password);
+            return credentials.username;
+        }
+        if (storedPassword === credentials.password) {
+            return credentials.username;
+        }
+        return null;
+    }
+    /**
+     * Validate any token (NPM, Maven, OCI, PyPI, RubyGems, Composer, Cargo)
+     */
+    async validateToken(tokenString, protocol) {
+        // OCI uses JWT (contains dots), not UUID - check first if OCI is expected
+        if (protocol === 'oci' || tokenString.includes('.')) {
+            const ociToken = await this.validateOciToken(tokenString);
+            if (ociToken && (!protocol || protocol === 'oci')) {
+                return ociToken;
+            }
+            // If protocol was explicitly OCI but validation failed, return null
+            if (protocol === 'oci') {
+                return null;
+            }
+        }
+        // UUID-based tokens: single O(1) Map lookup
+        if (this.isValidUuid(tokenString)) {
+            const authToken = this.tokenStore.get(tokenString);
+            if (authToken) {
+                // If protocol specified, verify it matches
+                if (protocol && authToken.type !== protocol) {
+                    return null;
+                }
+                // Check expiration
+                if (authToken.expiresAt && authToken.expiresAt < new Date()) {
+                    this.tokenStore.delete(tokenString);
+                    return null;
+                }
+                return authToken;
+            }
+        }
+        return null;
+    }
+    /**
+     * Create a new token for a user
+     */
+    async createToken(userId, protocol, options) {
+        // OCI tokens use JWT
+        if (protocol === 'oci') {
+            return this.createOciToken(userId, options?.scopes || ['oci:*:*:*'], options?.expiresIn || 3600);
+        }
+        // All other protocols use UUID tokens
+        const token = this.generateUuid();
+        const scopes = options?.scopes || (options?.readonly
+            ? [`${protocol}:*:*:read`]
+            : [`${protocol}:*:*:*`]);
+        const authToken = {
+            type: protocol,
+            userId,
+            scopes,
+            readonly: options?.readonly,
+            expiresAt: options?.expiresIn ? new Date(Date.now() + options.expiresIn * 1000) : undefined,
+            metadata: {
+                created: new Date().toISOString(),
+            },
+        };
+        this.tokenStore.set(token, authToken);
+        return token;
+    }
+    /**
+     * Revoke a token
+     */
+    async revokeToken(token) {
+        this.tokenStore.delete(token);
+    }
+    /**
+     * Check if token has permission for an action
+     */
+    async authorize(token, resource, action) {
+        if (!token) {
+            return false;
+        }
+        // Check readonly flag
+        if (token.readonly && ['write', 'push', 'delete'].includes(action)) {
+            return false;
+        }
+        // Check scopes
+        for (const scope of token.scopes) {
+            if (this.matchesScope(scope, resource, action)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * List all tokens for a user
+     */
+    async listUserTokens(userId) {
+        const tokens = [];
+        for (const [token, authToken] of this.tokenStore.entries()) {
+            if (authToken.userId === userId) {
+                tokens.push({
+                    key: this.hashToken(token),
+                    readonly: authToken.readonly || false,
+                    created: authToken.metadata?.created || 'unknown',
+                    protocol: authToken.type,
+                });
+            }
+        }
+        return tokens;
+    }
+    // ========================================================================
+    // OCI JWT Token Methods
+    // ========================================================================
+    /**
+     * Create an OCI JWT token
+     */
+    async createOciToken(userId, scopes, expiresIn = 3600) {
+        if (!this.config.ociTokens?.enabled) {
+            throw new Error('OCI tokens are not enabled');
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            iss: this.config.ociTokens.realm,
+            sub: userId,
+            aud: this.config.ociTokens.service,
+            exp: now + expiresIn,
+            nbf: now,
+            iat: now,
+            access: this.scopesToOciAccess(scopes),
+        };
+        // Create JWT with HMAC-SHA256 signature
+        const header = { alg: 'HS256', typ: 'JWT' };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const signature = crypto
+            .createHmac('sha256', this.config.jwtSecret)
+            .update(`${headerB64}.${payloadB64}`)
+            .digest('base64url');
+        return `${headerB64}.${payloadB64}.${signature}`;
+    }
+    /**
+     * Validate an OCI JWT token
+     */
+    async validateOciToken(jwt) {
+        try {
+            const parts = jwt.split('.');
+            if (parts.length !== 3) {
+                return null;
+            }
+            const [headerB64, payloadB64, signatureB64] = parts;
+            // Verify signature
+            const expectedSignature = crypto
+                .createHmac('sha256', this.config.jwtSecret)
+                .update(`${headerB64}.${payloadB64}`)
+                .digest('base64url');
+            if (signatureB64 !== expectedSignature) {
+                return null;
+            }
+            // Decode and parse payload
+            const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
+            // Check expiration
+            const now = Math.floor(Date.now() / 1000);
+            if (payload.exp && payload.exp < now) {
+                return null;
+            }
+            // Check not-before time
+            if (payload.nbf && payload.nbf > now) {
+                return null;
+            }
+            // Convert to unified token format
+            const scopes = this.ociAccessToScopes(payload.access || []);
+            return {
+                type: 'oci',
+                userId: payload.sub,
+                scopes,
+                expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+                metadata: {
+                    iss: payload.iss,
+                    aud: payload.aud,
+                },
+            };
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    // ========================================================================
+    // Helper Methods
+    // ========================================================================
+    /**
+     * Check if a scope matches a resource and action
+     */
+    matchesScope(scope, resource, action) {
+        const scopeParts = scope.split(':');
+        const resourceParts = resource.split(':');
+        // Scope must have at least protocol:type:name:action
+        if (scopeParts.length < 4) {
+            return false;
+        }
+        const [scopeProtocol, scopeType, scopeName, scopeAction] = scopeParts;
+        const [resourceProtocol, resourceType, resourceName] = resourceParts;
+        // Check protocol
+        if (scopeProtocol !== '*' && scopeProtocol !== resourceProtocol) {
+            return false;
+        }
+        // Check type
+        if (scopeType !== '*' && scopeType !== resourceType) {
+            return false;
+        }
+        // Check name
+        if (scopeName !== '*' && scopeName !== resourceName) {
+            return false;
+        }
+        // Check action
+        if (scopeAction !== '*' && scopeAction !== action) {
+            // Map action aliases
+            const actionAliases = {
+                read: ['pull', 'get'],
+                write: ['push', 'put', 'post'],
+            };
+            const aliases = actionAliases[scopeAction] || [];
+            if (!aliases.includes(action)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Convert unified scopes to OCI access array
+     */
+    scopesToOciAccess(scopes) {
+        const access = [];
+        for (const scope of scopes) {
+            const parts = scope.split(':');
+            if (parts.length >= 4 && parts[0] === 'oci') {
+                access.push({
+                    type: parts[1],
+                    name: parts[2],
+                    actions: [parts[3]],
+                });
+            }
+        }
+        return access;
+    }
+    /**
+     * Convert OCI access array to unified scopes
+     */
+    ociAccessToScopes(access) {
+        const scopes = [];
+        for (const item of access) {
+            for (const action of item.actions) {
+                scopes.push(`oci:${item.type}:${item.name}:${action}`);
+            }
+        }
+        return scopes;
+    }
+    /**
+     * Generate UUID for tokens
+     */
+    generateUuid() {
+        return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+            const r = (Math.random() * 16) | 0;
+            const v = c === 'x' ? r : (r & 0x3) | 0x8;
+            return v.toString(16);
+        });
+    }
+    /**
+     * Check if string is a valid UUID
+     */
+    isValidUuid(str) {
+        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+        return uuidRegex.test(str);
+    }
+    /**
+     * Hash a token for identification
+     */
+    hashToken(token) {
+        return `sha512-${token.substring(0, 16)}...`;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5kZWZhdWx0YXV0aHByb3ZpZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvY29yZS9jbGFzc2VzLmRlZmF1bHRhdXRocHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFJakM7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxtQkFBbUI7SUFJVjtJQUhaLFVBQVUsR0FBNEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUNoRCxlQUFlLEdBQXdCLElBQUksR0FBRyxFQUFFLENBQUMsQ0FBQyxtQ0FBbUM7SUFFN0YsWUFBb0IsTUFBbUI7UUFBbkIsV0FBTSxHQUFOLE1BQU0sQ0FBYTtJQUFHLENBQUM7SUFFM0M7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLDZDQUE2QztRQUM3QyxtREFBbUQ7SUFDckQsQ0FBQztJQUVELDJFQUEyRTtJQUMzRSwrQkFBK0I7SUFDL0IsMkVBQTJFO0lBRTNFOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxXQUF5QjtRQUNqRCxvRUFBb0U7UUFDcEUsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXRFLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUNwQixtREFBbUQ7WUFDbkQsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDckUsT0FBTyxXQUFXLENBQUMsUUFBUSxDQUFDO1FBQzlCLENBQUM7UUFFRCxJQUFJLGNBQWMsS0FBSyxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDNUMsT0FBTyxXQUFXLENBQUMsUUFBUSxDQUFDO1FBQzlCLENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQ3hCLFdBQW1CLEVBQ25CLFFBQTRCO1FBRTVCLDBFQUEwRTtRQUMxRSxJQUFJLFFBQVEsS0FBSyxLQUFLLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3BELE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQzFELElBQUksUUFBUSxJQUFJLENBQUMsQ0FBQyxRQUFRLElBQUksUUFBUSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2xELE9BQU8sUUFBUSxDQUFDO1lBQ2xCLENBQUM7WUFDRCxvRUFBb0U7WUFDcEUsSUFBSSxRQUFRLEtBQUssS0FBSyxFQUFFLENBQUM7Z0JBQ3ZCLE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7UUFFRCw0Q0FBNEM7UUFDNUMsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDbEMsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDbkQsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFDZCwyQ0FBMkM7Z0JBQzNDLElBQUksUUFBUSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7b0JBQzVDLE9BQU8sSUFBSSxDQUFDO2dCQUNkLENBQUM7Z0JBQ0QsbUJBQW1CO2dCQUNuQixJQUFJLFNBQVMsQ0FBQyxTQUFTLElBQUksU0FBUyxDQUFDLFNBQVMsR0FBRyxJQUFJLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQzVELElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDO29CQUNwQyxPQUFPLElBQUksQ0FBQztnQkFDZCxDQUFDO2dCQUNELE9BQU8sU0FBUyxDQUFDO1lBQ25CLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUN0QixNQUFjLEVBQ2QsUUFBMkIsRUFDM0IsT0FBdUI7UUFFdkIscUJBQXFCO1FBQ3JCLElBQUksUUFBUSxLQUFLLEtBQUssRUFBRSxDQUFDO1lBQ3ZCLE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxFQUFFLE9BQU8sRUFBRSxTQUFTLElBQUksSUFBSSxDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUVELHNDQUFzQztRQUN0QyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEMsTUFBTSxNQUFNLEdBQUcsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxRQUFRO1lBQ2xELENBQUMsQ0FBQyxDQUFDLEdBQUcsUUFBUSxXQUFXLENBQUM7WUFDMUIsQ0FBQyxDQUFDLENBQUMsR0FBRyxRQUFRLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFFM0IsTUFBTSxTQUFTLEdBQWU7WUFDNUIsSUFBSSxFQUFFLFFBQVE7WUFDZCxNQUFNO1lBQ04sTUFBTTtZQUNOLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUTtZQUMzQixTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLE9BQU8sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDM0YsUUFBUSxFQUFFO2dCQUNSLE9BQU8sRUFBRSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTthQUNsQztTQUNGLENBQUM7UUFFRixJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDdEMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsV0FBVyxDQUFDLEtBQWE7UUFDcEMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDaEMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFNBQVMsQ0FDcEIsS0FBd0IsRUFDeEIsUUFBZ0IsRUFDaEIsTUFBYztRQUVkLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELHNCQUFzQjtRQUN0QixJQUFJLEtBQUssQ0FBQyxRQUFRLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ25FLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELGVBQWU7UUFDZixLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNqQyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO2dCQUMvQyxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsY0FBYyxDQUFDLE1BQWM7UUFNeEMsTUFBTSxNQUFNLEdBQTJGLEVBQUUsQ0FBQztRQUUxRyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQzNELElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxNQUFNLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxDQUFDLElBQUksQ0FBQztvQkFDVixHQUFHLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUM7b0JBQzFCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUSxJQUFJLEtBQUs7b0JBQ3JDLE9BQU8sRUFBRSxTQUFTLENBQUMsUUFBUSxFQUFFLE9BQU8sSUFBSSxTQUFTO29CQUNqRCxRQUFRLEVBQUUsU0FBUyxDQUFDLElBQUk7aUJBQ3pCLENBQUMsQ0FBQztZQUNMLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVELDJFQUEyRTtJQUMzRSx3QkFBd0I7SUFDeEIsMkVBQTJFO0lBRTNFOztPQUVHO0lBQ0ssS0FBSyxDQUFDLGNBQWMsQ0FDMUIsTUFBYyxFQUNkLE1BQWdCLEVBQ2hCLFlBQW9CLElBQUk7UUFFeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLENBQUMsQ0FBQztRQUNoRCxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDMUMsTUFBTSxPQUFPLEdBQUc7WUFDZCxHQUFHLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSztZQUNoQyxHQUFHLEVBQUUsTUFBTTtZQUNYLEdBQUcsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPO1lBQ2xDLEdBQUcsRUFBRSxHQUFHLEdBQUcsU0FBUztZQUNwQixHQUFHLEVBQUUsR0FBRztZQUNSLEdBQUcsRUFBRSxHQUFHO1lBQ1IsTUFBTSxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUM7U0FDdkMsQ0FBQztRQUVGLHdDQUF3QztRQUN4QyxNQUFNLE1BQU0sR0FBRyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDO1FBQzVDLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUM1RSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7UUFFOUUsTUFBTSxTQUFTLEdBQUcsTUFBTTthQUNyQixVQUFVLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDO2FBQzNDLE1BQU0sQ0FBQyxHQUFHLFNBQVMsSUFBSSxVQUFVLEVBQUUsQ0FBQzthQUNwQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUM7UUFFdkIsT0FBTyxHQUFHLFNBQVMsSUFBSSxVQUFVLElBQUksU0FBUyxFQUFFLENBQUM7SUFDbkQsQ0FBQztJQUVEOztPQUVHO0lBQ0ssS0FBSyxDQUFDLGdCQUFnQixDQUFDLEdBQVc7UUFDeEMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUM3QixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZCLE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztZQUVELE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFlBQVksQ0FBQyxHQUFHLEtBQUssQ0FBQztZQUVwRCxtQkFBbUI7WUFDbkIsTUFBTSxpQkFBaUIsR0FBRyxNQUFNO2lCQUM3QixVQUFVLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDO2lCQUMzQyxNQUFNLENBQUMsR0FBRyxTQUFTLElBQUksVUFBVSxFQUFFLENBQUM7aUJBQ3BDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUV2QixJQUFJLFlBQVksS0FBSyxpQkFBaUIsRUFBRSxDQUFDO2dCQUN2QyxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFFRCwyQkFBMkI7WUFDM0IsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUVuRixtQkFBbUI7WUFDbkIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7WUFDMUMsSUFBSSxPQUFPLENBQUMsR0FBRyxJQUFJLE9BQU8sQ0FBQyxHQUFHLEdBQUcsR0FBRyxFQUFFLENBQUM7Z0JBQ3JDLE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztZQUVELHdCQUF3QjtZQUN4QixJQUFJLE9BQU8sQ0FBQyxHQUFHLElBQUksT0FBTyxDQUFDLEdBQUcsR0FBRyxHQUFHLEVBQUUsQ0FBQztnQkFDckMsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBRUQsa0NBQWtDO1lBQ2xDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBRTVELE9BQU87Z0JBQ0wsSUFBSSxFQUFFLEtBQUs7Z0JBQ1gsTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHO2dCQUNuQixNQUFNO2dCQUNOLFNBQVMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTO2dCQUNqRSxRQUFRLEVBQUU7b0JBQ1IsR0FBRyxFQUFFLE9BQU8sQ0FBQyxHQUFHO29CQUNoQixHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQUc7aUJBQ2pCO2FBQ0YsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVELDJFQUEyRTtJQUMzRSxpQkFBaUI7SUFDakIsMkVBQTJFO0lBRTNFOztPQUVHO0lBQ0ssWUFBWSxDQUFDLEtBQWEsRUFBRSxRQUFnQixFQUFFLE1BQWM7UUFDbEUsTUFBTSxVQUFVLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNwQyxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBRTFDLHFEQUFxRDtRQUNyRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBRUQsTUFBTSxDQUFDLGFBQWEsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFdBQVcsQ0FBQyxHQUFHLFVBQVUsQ0FBQztRQUN0RSxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsWUFBWSxFQUFFLFlBQVksQ0FBQyxHQUFHLGFBQWEsQ0FBQztRQUVyRSxpQkFBaUI7UUFDakIsSUFBSSxhQUFhLEtBQUssR0FBRyxJQUFJLGFBQWEsS0FBSyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ2hFLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELGFBQWE7UUFDYixJQUFJLFNBQVMsS0FBSyxHQUFHLElBQUksU0FBUyxLQUFLLFlBQVksRUFBRSxDQUFDO1lBQ3BELE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELGFBQWE7UUFDYixJQUFJLFNBQVMsS0FBSyxHQUFHLElBQUksU0FBUyxLQUFLLFlBQVksRUFBRSxDQUFDO1lBQ3BELE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELGVBQWU7UUFDZixJQUFJLFdBQVcsS0FBSyxHQUFHLElBQUksV0FBVyxLQUFLLE1BQU0sRUFBRSxDQUFDO1lBQ2xELHFCQUFxQjtZQUNyQixNQUFNLGFBQWEsR0FBNkI7Z0JBQzlDLElBQUksRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUM7Z0JBQ3JCLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDO2FBQy9CLENBQUM7WUFFRixNQUFNLE9BQU8sR0FBRyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2pELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7Z0JBQzlCLE9BQU8sS0FBSyxDQUFDO1lBQ2YsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7T0FFRztJQUNLLGlCQUFpQixDQUFDLE1BQWdCO1FBS3hDLE1BQU0sTUFBTSxHQUEyRCxFQUFFLENBQUM7UUFFMUUsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUMzQixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQy9CLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLEtBQUssRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDO29CQUNWLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUNkLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUNkLE9BQU8sRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztpQkFDcEIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7O09BRUc7SUFDSyxpQkFBaUIsQ0FBQyxNQUl4QjtRQUNBLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztRQUU1QixLQUFLLE1BQU0sSUFBSSxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQzFCLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNsQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDekQsQ0FBQztRQUNILENBQUM7UUFFRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQ7O09BRUc7SUFDSyxZQUFZO1FBQ2xCLE9BQU8sc0NBQXNDLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFO1lBQ25FLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNuQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxHQUFHLEdBQUcsQ0FBQztZQUMxQyxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7O09BRUc7SUFDSyxXQUFXLENBQUMsR0FBVztRQUM3QixNQUFNLFNBQVMsR0FBRyx3RUFBd0UsQ0FBQztRQUMzRixPQUFPLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ssU0FBUyxDQUFDLEtBQWE7UUFDN0IsT0FBTyxVQUFVLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUM7SUFDL0MsQ0FBQztDQUNGIn0=

package/dist_ts/core/classes.registrystorage.d.ts

@@ -1,14 +1,42 @@
-import type { IStorageConfig, IStorageBackend } from './interfaces.core.js';
+import type { IStorageConfig, IStorageBackend, TRegistryProtocol } from './interfaces.core.js';
+import type { IStorageHooks, IStorageActor, IStorageMetadata } from './interfaces.storage.js';
 /**
- * Storage abstraction layer for registry
- * Provides a unified interface over SmartBucket
+ * Storage abstraction layer for registry.
+ * Provides a unified interface over SmartBucket with optional hooks
+ * for quota tracking, audit logging, cache invalidation, etc.
+ *
+ * @example
+ * ```typescript
+ * // Basic usage
+ * const storage = new RegistryStorage(config);
+ *
+ * // With hooks for quota tracking
+ * const storage = new RegistryStorage(config, {
+ *   beforePut: async (ctx) => {
+ *     const quota = await getQuota(ctx.actor?.orgId);
+ *     const usage = await getUsage(ctx.actor?.orgId);
+ *     if (usage + (ctx.metadata?.size || 0) > quota) {
+ *       return { allowed: false, reason: 'Quota exceeded' };
+ *     }
+ *     return { allowed: true };
+ *   },
+ *   afterPut: async (ctx) => {
+ *     await updateUsage(ctx.actor?.orgId, ctx.metadata?.size || 0);
+ *   }
+ * });
+ * ```
  */
 export declare class RegistryStorage implements IStorageBackend {
     private config;
     private smartBucket;
     private bucket;
     private bucketName;
-    constructor(config: IStorageConfig);
+    private hooks?;
+    constructor(config: IStorageConfig, hooks?: IStorageHooks);
+    /**
+     * Set storage hooks (can be called after construction)
+     */
+    setHooks(hooks: IStorageHooks): void;
     /**
      * Initialize the storage backend
      */
@@ -25,6 +53,44 @@ export declare class RegistryStorage implements IStorageBackend {
      * Delete an object
      */
     deleteObject(key: string): Promise<void>;
+    /**
+     * Current operation context for hooks.
+     * Set this before performing storage operations to enable hooks.
+     */
+    private currentContext?;
+    /**
+     * Set the current operation context for hooks.
+     * Call this before performing storage operations.
+     *
+     * @example
+     * ```typescript
+     * storage.setContext({
+     *   protocol: 'npm',
+     *   actor: { userId: 'user123', ip: '192.168.1.1' },
+     *   metadata: { packageName: 'lodash', version: '4.17.21' }
+     * });
+     * await storage.putNpmTarball('lodash', '4.17.21', tarball);
+     * storage.clearContext();
+     * ```
+     */
+    setContext(context: {
+        protocol: TRegistryProtocol;
+        actor?: IStorageActor;
+        metadata?: IStorageMetadata;
+    }): void;
+    /**
+     * Clear the current operation context.
+     */
+    clearContext(): void;
+    /**
+     * Execute a function with a temporary context.
+     * Context is automatically cleared after execution.
+     */
+    withContext<T>(context: {
+        protocol: TRegistryProtocol;
+        actor?: IStorageActor;
+        metadata?: IStorageMetadata;
+    }, fn: () => Promise<T>): Promise<T>;
     /**
      * List objects with a prefix (recursively)
      */