@shohaghinfo/aerojs 0.2.0 → 0.4.0

package/dist/security/encryption.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @file encryption.ts
+ * @description Enterprise-grade authenticated encryption (AES-256-GCM) for AeroJS.
+ * Supports transparent model field encryption, arbitrary object encryption, and secure key derivation.
+ */
+export interface EncrypterOptions {
+    key?: string;
+    cipher?: string;
+}
+export declare class Encrypter {
+    private keyBuffer;
+    readonly cipher: string;
+    private static defaultInstance?;
+    constructor(key?: string);
+    /**
+     * Generates a cryptographically random 32-byte key encoded as a hex string.
+     */
+    static generateKey(): string;
+    /**
+     * Normalizes any key string into a 32-byte Buffer.
+     */
+    static normalizeKey(key: string): Buffer;
+    /**
+     * Encrypts any serializable value (string, object, number, boolean) using AES-256-GCM.
+     * Returns a compact token formatted as `aero:enc:<iv>:<authTag>:<ciphertext>`.
+     */
+    encrypt(value: unknown): string;
+    /**
+     * Decrypts an AES-256-GCM encrypted payload produced by `encrypt`.
+     */
+    decrypt<T = any>(payload: string): T;
+    /**
+     * Encrypts a string directly.
+     */
+    encryptString(text: string): string;
+    /**
+     * Decrypts an encrypted string directly.
+     */
+    decryptString(payload: string): string;
+    /**
+     * Checks whether a value is an encrypted payload string.
+     */
+    static isEncrypted(value: unknown): boolean;
+    /**
+     * Returns the shared singleton instance.
+     */
+    static getInstance(): Encrypter;
+}
+/**
+ * Global Crypt facade for easy application-wide encryption and decryption.
+ */
+export declare const Crypt: {
+    encrypt: (value: unknown, key?: string) => string;
+    decrypt: <T = any>(payload: string, key?: string) => T;
+    encryptString: (text: string, key?: string) => string;
+    decryptString: (payload: string, key?: string) => string;
+    generateKey: () => string;
+    isEncrypted: (value: unknown) => boolean;
+};
+//# sourceMappingURL=encryption.d.ts.map

package/dist/security/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,SAAS,CAAS;IAC1B,SAAgB,MAAM,EAAE,MAAM,CAAiB;IAC/C,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAY;gBAE/B,GAAG,CAAC,EAAE,MAAM;IAKxB;;OAEG;WACW,WAAW,IAAI,MAAM;IAInC;;OAEG;WACW,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAe/C;;;OAGG;IACI,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAYtC;;OAEG;IACI,OAAO,CAAC,CAAC,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC;IAuB3C;;OAEG;IACI,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI1C;;OAEG;IACI,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAI7C;;OAEG;WACW,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAIlD;;OAEG;WACW,WAAW,IAAI,SAAS;CAMvC;AAED;;GAEG;AACH,eAAO,MAAM,KAAK;qBACC,OAAO,QAAQ,MAAM,KAAG,MAAM;cAGrC,CAAC,iBAAiB,MAAM,QAAQ,MAAM,KAAG,CAAC;0BAG9B,MAAM,QAAQ,MAAM,KAAG,MAAM;6BAG1B,MAAM,QAAQ,MAAM,KAAG,MAAM;uBAGrC,MAAM;yBACF,OAAO,KAAG,OAAO;CACvC,CAAC"}

package/dist/security/encryption.js

@@ -0,0 +1,120 @@
+/**
+ * @file encryption.ts
+ * @description Enterprise-grade authenticated encryption (AES-256-GCM) for AeroJS.
+ * Supports transparent model field encryption, arbitrary object encryption, and secure key derivation.
+ */
+import * as crypto from 'node:crypto';
+export class Encrypter {
+    keyBuffer;
+    cipher = 'aes-256-gcm';
+    static defaultInstance;
+    constructor(key) {
+        const rawKey = key || process.env['APP_KEY'] || process.env['AERO_KEY'] || 'aerojs-default-encryption-secret-key-32bytes!';
+        this.keyBuffer = Encrypter.normalizeKey(rawKey);
+    }
+    /**
+     * Generates a cryptographically random 32-byte key encoded as a hex string.
+     */
+    static generateKey() {
+        return crypto.randomBytes(32).toString('hex');
+    }
+    /**
+     * Normalizes any key string into a 32-byte Buffer.
+     */
+    static normalizeKey(key) {
+        if (key.startsWith('base64:')) {
+            const buf = Buffer.from(key.slice(7), 'base64');
+            if (buf.length === 32)
+                return buf;
+        }
+        // If it's a 64-char hex string
+        if (/^[0-9a-fA-F]{64}$/.test(key)) {
+            return Buffer.from(key, 'hex');
+        }
+        const buf = Buffer.from(key, 'utf8');
+        if (buf.length === 32)
+            return buf;
+        // Otherwise hash to 32 bytes with SHA-256
+        return crypto.createHash('sha256').update(key).digest();
+    }
+    /**
+     * Encrypts any serializable value (string, object, number, boolean) using AES-256-GCM.
+     * Returns a compact token formatted as `aero:enc:<iv>:<authTag>:<ciphertext>`.
+     */
+    encrypt(value) {
+        const serialized = JSON.stringify(value);
+        const iv = crypto.randomBytes(12); // standard 96-bit IV
+        const cipher = crypto.createCipheriv(this.cipher, this.keyBuffer, iv);
+        let encrypted = cipher.update(serialized, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag().toString('hex');
+        return `aero:enc:${iv.toString('hex')}:${authTag}:${encrypted}`;
+    }
+    /**
+     * Decrypts an AES-256-GCM encrypted payload produced by `encrypt`.
+     */
+    decrypt(payload) {
+        if (!Encrypter.isEncrypted(payload)) {
+            throw new Error('Invalid encryption payload: missing aero:enc prefix');
+        }
+        const parts = payload.slice(9).split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid encryption payload format. Expected iv:authTag:ciphertext');
+        }
+        const [ivHex, authTagHex, encryptedHex] = parts;
+        const iv = Buffer.from(ivHex, 'hex');
+        const authTag = Buffer.from(authTagHex, 'hex');
+        const decipher = crypto.createDecipheriv(this.cipher, this.keyBuffer, iv, { authTagLength: 16 });
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encryptedHex, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return JSON.parse(decrypted);
+    }
+    /**
+     * Encrypts a string directly.
+     */
+    encryptString(text) {
+        return this.encrypt(text);
+    }
+    /**
+     * Decrypts an encrypted string directly.
+     */
+    decryptString(payload) {
+        return this.decrypt(payload);
+    }
+    /**
+     * Checks whether a value is an encrypted payload string.
+     */
+    static isEncrypted(value) {
+        return typeof value === 'string' && value.startsWith('aero:enc:');
+    }
+    /**
+     * Returns the shared singleton instance.
+     */
+    static getInstance() {
+        if (!this.defaultInstance) {
+            this.defaultInstance = new Encrypter();
+        }
+        return this.defaultInstance;
+    }
+}
+/**
+ * Global Crypt facade for easy application-wide encryption and decryption.
+ */
+export const Crypt = {
+    encrypt: (value, key) => {
+        return key ? new Encrypter(key).encrypt(value) : Encrypter.getInstance().encrypt(value);
+    },
+    decrypt: (payload, key) => {
+        return key ? new Encrypter(key).decrypt(payload) : Encrypter.getInstance().decrypt(payload);
+    },
+    encryptString: (text, key) => {
+        return key ? new Encrypter(key).encryptString(text) : Encrypter.getInstance().encryptString(text);
+    },
+    decryptString: (payload, key) => {
+        return key ? new Encrypter(key).decryptString(payload) : Encrypter.getInstance().decryptString(payload);
+    },
+    generateKey: () => Encrypter.generateKey(),
+    isEncrypted: (value) => Encrypter.isEncrypted(value),
+};
+//# sourceMappingURL=encryption.js.map

package/dist/security/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/security/encryption.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAOtC,MAAM,OAAO,SAAS;IACZ,SAAS,CAAS;IACV,MAAM,GAAW,aAAa,CAAC;IACvC,MAAM,CAAC,eAAe,CAAa;IAE3C,YAAY,GAAY;QACtB,MAAM,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,+CAA+C,CAAC;QAC3H,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW;QACvB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,GAAW;QACpC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC;QACpC,CAAC;QACD,+BAA+B;QAC/B,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QAClC,0CAA0C;QAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACI,OAAO,CAAC,KAAc;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,CAAQ,CAAC;QAE7E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEpD,OAAO,YAAY,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;IAClE,CAAC;IAED;;OAEG;IACI,OAAO,CAAU,OAAe;QACrC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAM,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAW,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAI,MAAM,CAAC,gBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1G,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAM,CAAC;IACpC,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,IAAY;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,OAAO,CAAS,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACpE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,OAAO,EAAE,CAAC,KAAc,EAAE,GAAY,EAAU,EAAE;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAU,OAAe,EAAE,GAAY,EAAK,EAAE;QACrD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAI,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAI,OAAO,CAAC,CAAC;IACpG,CAAC;IACD,aAAa,EAAE,CAAC,IAAY,EAAE,GAAY,EAAU,EAAE;QACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,aAAa,EAAE,CAAC,OAAe,EAAE,GAAY,EAAU,EAAE;QACvD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1G,CAAC;IACD,WAAW,EAAE,GAAW,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE;IAClD,WAAW,EAAE,CAAC,KAAc,EAAW,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC;CACvE,CAAC"}

package/dist/security/fingerprint.d.ts

@@ -0,0 +1,47 @@
+/**
+ * @file fingerprint.ts
+ * @description Client Request Fingerprinting and Anti-Session Hijacking protection for AeroJS.
+ * Computes deterministic cryptographic hashes of client browser, network, and header signatures.
+ */
+import type { AeroContext } from '../core/context.js';
+import type { Middleware } from '../core/types.js';
+export interface FingerprintOptions {
+    /**
+     * Include client IP address in fingerprint. Default: true.
+     */
+    ip?: boolean;
+    /**
+     * Include User-Agent header. Default: true.
+     */
+    userAgent?: boolean;
+    /**
+     * Include Accept-Language header. Default: true.
+     */
+    acceptLanguage?: boolean;
+    /**
+     * Custom application salt for the hash.
+     */
+    salt?: string;
+    /**
+     * Additional header names to include in the signature.
+     */
+    additionalHeaders?: string[];
+}
+export declare class RequestFingerprint {
+    /**
+     * Generates a deterministic SHA-256 fingerprint hash of the request client traits.
+     */
+    static generate(ctx: AeroContext, options?: FingerprintOptions): string;
+    /**
+     * Verifies whether an incoming request matches the expected fingerprint hash.
+     */
+    static verify(ctx: AeroContext, expectedFingerprint: string, options?: FingerprintOptions): boolean;
+}
+/**
+ * Middleware that binds client fingerprinting to AeroContext and validates session integrity.
+ * If session hijacking is detected (mismatched device fingerprint), access is rejected with 401.
+ */
+export declare function fingerprintGuard(options?: FingerprintOptions & {
+    onMismatch?: (ctx: AeroContext) => void | Promise<void>;
+}): Middleware;
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/security/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../src/security/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,EAAE,CAAC,EAAE,OAAO,CAAC;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;OAEG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,qBAAa,kBAAkB;IAC7B;;OAEG;WACW,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM;IAsClF;;OAEG;WACW,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO;CAK/G;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,kBAAkB,GAAG;IAC7D,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,GAAG,UAAU,CA2BlB"}

package/dist/security/fingerprint.js

@@ -0,0 +1,83 @@
+/**
+ * @file fingerprint.ts
+ * @description Client Request Fingerprinting and Anti-Session Hijacking protection for AeroJS.
+ * Computes deterministic cryptographic hashes of client browser, network, and header signatures.
+ */
+import * as crypto from 'node:crypto';
+export class RequestFingerprint {
+    /**
+     * Generates a deterministic SHA-256 fingerprint hash of the request client traits.
+     */
+    static generate(ctx, options = {}) {
+        const includeIp = options.ip !== false;
+        const includeUa = options.userAgent !== false;
+        const includeLang = options.acceptLanguage !== false;
+        const salt = options.salt || 'aero-fingerprint-salt';
+        const components = [];
+        if (includeUa) {
+            const ua = ctx.req.headers['user-agent'];
+            components.push(Array.isArray(ua) ? ua.join(',') : ua || 'unknown-ua');
+        }
+        if (includeLang) {
+            const lang = ctx.req.headers['accept-language'];
+            components.push(Array.isArray(lang) ? lang.join(',') : lang || 'unknown-lang');
+        }
+        if (includeIp) {
+            // Resolve client IP from headers or request IP
+            const forwarded = ctx.req.headers['x-forwarded-for'];
+            const rawIp = typeof forwarded === 'string'
+                ? forwarded.split(',')[0]?.trim()
+                : (ctx.ip || ctx.req.raw?.socket?.remoteAddress || '127.0.0.1');
+            components.push(rawIp || '127.0.0.1');
+        }
+        if (options.additionalHeaders) {
+            for (const h of options.additionalHeaders) {
+                const val = ctx.req.headers[h.toLowerCase()];
+                components.push(Array.isArray(val) ? val.join(',') : val || '');
+            }
+        }
+        const payload = `${salt}::${components.join('||')}`;
+        return crypto.createHash('sha256').update(payload).digest('hex');
+    }
+    /**
+     * Verifies whether an incoming request matches the expected fingerprint hash.
+     */
+    static verify(ctx, expectedFingerprint, options = {}) {
+        const current = this.generate(ctx, options);
+        if (current.length !== expectedFingerprint.length)
+            return false;
+        return crypto.timingSafeEqual(Buffer.from(current), Buffer.from(expectedFingerprint));
+    }
+}
+/**
+ * Middleware that binds client fingerprinting to AeroContext and validates session integrity.
+ * If session hijacking is detected (mismatched device fingerprint), access is rejected with 401.
+ */
+export function fingerprintGuard(options = {}) {
+    return async (ctx, next) => {
+        const currentFingerprint = RequestFingerprint.generate(ctx, options);
+        ctx.fingerprint = currentFingerprint;
+        // If session is active, bind and verify fingerprint
+        const session = ctx.session;
+        if (session && typeof session.get === 'function') {
+            const stored = await session.get('_fingerprint');
+            if (!stored) {
+                // First visit in this session -> bind fingerprint
+                await session.put('_fingerprint', currentFingerprint);
+            }
+            else if (stored !== currentFingerprint) {
+                // Anomaly / Session Hijack detected!
+                if (options.onMismatch) {
+                    await options.onMismatch(ctx);
+                    return;
+                }
+                ctx.status(401).json({
+                    error: 'Unauthorized: Session fingerprint mismatch (Potential Session Hijack)',
+                });
+                return;
+            }
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/security/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../src/security/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AA2BtC,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACI,MAAM,CAAC,QAAQ,CAAC,GAAgB,EAAE,UAA8B,EAAE;QACvE,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;QAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,uBAAuB,CAAC;QAErD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,cAAc,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,+CAA+C;YAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ;gBACzC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBACjC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAK,GAAG,CAAC,GAAG,CAAC,GAAW,EAAE,MAAM,EAAE,aAAa,IAAI,WAAW,CAAC,CAAC;YAC3E,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC7C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,GAAgB,EAAE,mBAA2B,EAAE,UAA8B,EAAE;QAClG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAE7B,EAAE;IACJ,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpE,GAAW,CAAC,WAAW,GAAG,kBAAkB,CAAC;QAE9C,oDAAoD;QACpD,MAAM,OAAO,GAAI,GAAW,CAAC,OAAO,CAAC;QACrC,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,kDAAkD;gBAClD,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;gBACzC,qCAAqC;gBACrC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,uEAAuE;iBAC/E,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/security/index.d.ts

@@ -10,4 +10,7 @@ export { Hash, hash, hashVerify, type ScryptOptions, } from './hash.js';
 export { cors, type CorsOptions, } from '../middleware/cors.js';
 export * from './totp.js';
 export * from './vault.js';
+export * from './signed-url.js';
+export * from './encryption.js';
+export * from './fingerprint.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,+BAA+B,GACrC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,+BAA+B,GACrC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/security/index.js

@@ -10,4 +10,7 @@ export { Hash, hash, hashVerify, } from './hash.js';
 export { cors, } from '../middleware/cors.js';
 export * from './totp.js';
 export * from './vault.js';
+export * from './signed-url.js';
+export * from './encryption.js';
+export * from './fingerprint.js';
 //# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GAOf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,GAIhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,GAEL,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,GAEX,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,GAEL,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,GAAG,EACH,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GAOf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,SAAS,EACT,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,GAKrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,eAAe,GAIhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,IAAI,GAEL,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,UAAU,GAEX,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,IAAI,GAEL,MAAM,uBAAuB,CAAC;AAE/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC"}

package/dist/security/signed-url.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @file signed-url.ts
+ * @description Tamper-proof HMAC URL Signing & Validation for AeroJS.
+ * Supports temporary expiring signed URLs for private downloads, password resets, and webhooks.
+ */
+import type { Middleware } from '../core/types.js';
+export interface SignUrlOptions {
+    expiresIn?: number;
+    key?: string;
+}
+export declare class UrlSigner {
+    private static defaultKey;
+    static setDefaultKey(key: string): void;
+    static getDefaultKey(): string;
+    /**
+     * Generates a signed URL with timestamp and HMAC signature.
+     */
+    static sign(url: string, options?: SignUrlOptions): string;
+    /**
+     * Verifies if a given URL has a valid and unexpired HMAC signature.
+     */
+    static hasValidSignature(url: string, key?: string): boolean;
+    private static getPayload;
+}
+/**
+ * Middleware that validates the incoming request has a valid, non-expired signed URL.
+ */
+export declare function validateSignedUrl(key?: string): Middleware;
+//# sourceMappingURL=signed-url.d.ts.map

package/dist/security/signed-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.d.ts","sourceRoot":"","sources":["../../src/security/signed-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAgB,MAAM,kBAAkB,CAAC;AAIjE,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAoG;WAE/G,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;WAIhC,aAAa,IAAI,MAAM;IAIrC;;OAEG;WACW,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM;IAsBrE;;OAEG;WACW,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO;IAmCnE,OAAO,CAAC,MAAM,CAAC,UAAU;CAM1B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,UAAU,CAW1D"}

package/dist/security/signed-url.js

@@ -0,0 +1,86 @@
+/**
+ * @file signed-url.ts
+ * @description Tamper-proof HMAC URL Signing & Validation for AeroJS.
+ * Supports temporary expiring signed URLs for private downloads, password resets, and webhooks.
+ */
+import * as crypto from 'node:crypto';
+import { ForbiddenError } from '../core/errors.js';
+export class UrlSigner {
+    static defaultKey = process.env.APP_KEY || process.env.AERO_KEY || 'aero-default-signing-secret-key-32chars';
+    static setDefaultKey(key) {
+        this.defaultKey = key;
+    }
+    static getDefaultKey() {
+        return this.defaultKey;
+    }
+    /**
+     * Generates a signed URL with timestamp and HMAC signature.
+     */
+    static sign(url, options = {}) {
+        const key = options.key || this.defaultKey;
+        const urlObj = new URL(url, 'http://localhost');
+        const expiresIn = options.expiresIn ?? 3600; // Default: 1 hour
+        const expiresAt = Math.floor(Date.now() / 1000) + expiresIn;
+        urlObj.searchParams.set('expires', String(expiresAt));
+        // Remove old signature if present
+        urlObj.searchParams.delete('signature');
+        // Create signature payload: pathname + sorted query string
+        const payload = this.getPayload(urlObj);
+        const signature = crypto.createHmac('sha256', key).update(payload).digest('hex');
+        urlObj.searchParams.set('signature', signature);
+        if (url.startsWith('http://') || url.startsWith('https://')) {
+            return urlObj.toString();
+        }
+        return `${urlObj.pathname}${urlObj.search}`;
+    }
+    /**
+     * Verifies if a given URL has a valid and unexpired HMAC signature.
+     */
+    static hasValidSignature(url, key) {
+        const secret = key || this.defaultKey;
+        const urlObj = new URL(url, 'http://localhost');
+        const signature = urlObj.searchParams.get('signature');
+        const expiresStr = urlObj.searchParams.get('expires');
+        if (!signature || !expiresStr) {
+            return false;
+        }
+        const expires = parseInt(expiresStr, 10);
+        if (isNaN(expires)) {
+            return false;
+        }
+        // Check expiration
+        const now = Math.floor(Date.now() / 1000);
+        if (now > expires) {
+            return false;
+        }
+        // Remove signature to compute expected signature
+        urlObj.searchParams.delete('signature');
+        const payload = this.getPayload(urlObj);
+        const expectedSignature = crypto.createHmac('sha256', secret).update(payload).digest('hex');
+        // Constant-time comparison to prevent timing attacks
+        if (signature.length !== expectedSignature.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
+    }
+    static getPayload(urlObj) {
+        // Sort query keys for consistent hashing
+        const params = Array.from(urlObj.searchParams.entries()).sort(([a], [b]) => a.localeCompare(b));
+        const sortedQuery = params.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
+        return `${urlObj.pathname}?${sortedQuery}`;
+    }
+}
+/**
+ * Middleware that validates the incoming request has a valid, non-expired signed URL.
+ */
+export function validateSignedUrl(key) {
+    return async (ctx, next) => {
+        const fullUrl = ctx.req.url || '/';
+        const isValid = UrlSigner.hasValidSignature(fullUrl, key);
+        if (!isValid) {
+            throw new ForbiddenError('Invalid or expired URL signature.');
+        }
+        await next();
+    };
+}
+//# sourceMappingURL=signed-url.js.map

package/dist/security/signed-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-url.js","sourceRoot":"","sources":["../../src/security/signed-url.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAOnD,MAAM,OAAO,SAAS;IACZ,MAAM,CAAC,UAAU,GAAW,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,yCAAyC,CAAC;IAEtH,MAAM,CAAC,aAAa,CAAC,GAAW;QACrC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;IACxB,CAAC;IAEM,MAAM,CAAC,aAAa;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,IAAI,CAAC,GAAW,EAAE,UAA0B,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,kBAAkB;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;QAE5D,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACtD,kCAAkC;QAClC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAExC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjF,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAEhD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,iBAAiB,CAAC,GAAW,EAAE,GAAY;QACvD,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEhD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mBAAmB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,OAAO,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5F,qDAAqD;QACrD,IAAI,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxF,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,MAAW;QACnC,yCAAyC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1G,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAC7C,CAAC;;AAGH;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,KAAK,EAAE,GAAqB,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/session/cookie-session-driver.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @file cookie-session-driver.ts
+ * @description Encrypted client-side cookie session driver for AeroJS.
+ * Serializes and encrypts session state into an authenticated AES-256-GCM cookie.
+ * Zero-dependency, stateless, and ideal for serverless / edge deployments.
+ */
+import type { SessionDriver } from './session-driver.js';
+export declare class CookieSessionDriver implements SessionDriver {
+    readonly isClientSide = true;
+    private encrypter;
+    private lastPayload;
+    constructor(key?: string);
+    /**
+     * Reads and decrypts session data from the encrypted cookie payload.
+     */
+    read(sessionIdOrPayload: string): Promise<Record<string, unknown>>;
+    /**
+     * Encrypts the session state for writing to the client cookie.
+     */
+    write(sessionId: string, data: Record<string, unknown>, _ttl: number): Promise<void>;
+    /**
+     * Returns the encrypted cookie ciphertext string for the given session state.
+     */
+    getEncryptedCookieValue(data: Record<string, unknown>): string;
+    /**
+     * Destroys the session state.
+     */
+    destroy(_sessionId: string): Promise<void>;
+    /**
+     * Garbage collection is a no-op for client-side cookies as browsers manage expiry.
+     */
+    gc(): Promise<void>;
+}
+//# sourceMappingURL=cookie-session-driver.d.ts.map

package/dist/session/cookie-session-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-session-driver.d.ts","sourceRoot":"","sources":["../../src/session/cookie-session-driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,qBAAa,mBAAoB,YAAW,aAAa;IACvD,SAAgB,YAAY,QAAQ;IACpC,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,WAAW,CAAM;gBAEb,GAAG,CAAC,EAAE,MAAM;IAIxB;;OAEG;IACU,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAgB/E;;OAEG;IACU,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjG;;OAEG;IACI,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM;IAIrE;;OAEG;IACU,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;OAEG;IACU,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;CACjC"}

package/dist/session/cookie-session-driver.js

@@ -0,0 +1,57 @@
+/**
+ * @file cookie-session-driver.ts
+ * @description Encrypted client-side cookie session driver for AeroJS.
+ * Serializes and encrypts session state into an authenticated AES-256-GCM cookie.
+ * Zero-dependency, stateless, and ideal for serverless / edge deployments.
+ */
+import { Encrypter } from '../security/encryption.js';
+export class CookieSessionDriver {
+    isClientSide = true;
+    encrypter;
+    lastPayload = '';
+    constructor(key) {
+        this.encrypter = new Encrypter(key);
+    }
+    /**
+     * Reads and decrypts session data from the encrypted cookie payload.
+     */
+    async read(sessionIdOrPayload) {
+        if (!sessionIdOrPayload || !Encrypter.isEncrypted(sessionIdOrPayload)) {
+            return {};
+        }
+        try {
+            const data = this.encrypter.decrypt(sessionIdOrPayload);
+            if (data && typeof data === 'object') {
+                return data;
+            }
+            return {};
+        }
+        catch {
+            // Tampered or invalid ciphertext -> reset session
+            return {};
+        }
+    }
+    /**
+     * Encrypts the session state for writing to the client cookie.
+     */
+    async write(sessionId, data, _ttl) {
+        this.lastPayload = this.encrypter.encrypt(data);
+    }
+    /**
+     * Returns the encrypted cookie ciphertext string for the given session state.
+     */
+    getEncryptedCookieValue(data) {
+        return this.encrypter.encrypt(data);
+    }
+    /**
+     * Destroys the session state.
+     */
+    async destroy(_sessionId) {
+        this.lastPayload = '';
+    }
+    /**
+     * Garbage collection is a no-op for client-side cookies as browsers manage expiry.
+     */
+    async gc() { }
+}
+//# sourceMappingURL=cookie-session-driver.js.map

package/dist/session/cookie-session-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-session-driver.js","sourceRoot":"","sources":["../../src/session/cookie-session-driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEtD,MAAM,OAAO,mBAAmB;IACd,YAAY,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAY;IACrB,WAAW,GAAG,EAAE,CAAC;IAEzB,YAAY,GAAY;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI,CAAC,kBAA0B;QAC1C,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAA0B,kBAAkB,CAAC,CAAC;YACjF,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;YAClD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,IAA6B,EAAE,IAAY;QAC/E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,uBAAuB,CAAC,IAA6B;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,OAAO,CAAC,UAAkB;QACrC,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,EAAE,KAAmB,CAAC;CACpC"}

package/dist/session/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @file index.ts
+ * @description AeroJS Session Management and Drivers.
+ */
+export * from './session-driver.js';
+export * from './cookie-session-driver.js';
+export * from './session-manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,8 @@
+/**
+ * @file index.ts
+ * @description AeroJS Session Management and Drivers.
+ */
+export * from './session-driver.js';
+export * from './cookie-session-driver.js';
+export * from './session-manager.js';
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/session/session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/session/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;QAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC;IAOhF;;OAEG;YACW,YAAY;IAM1B,2BAA2B;IACd,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKlE,4BAA4B;IACf,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKpD,2BAA2B;IACd,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,qCAAqC;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK/C,4BAA4B;IACf,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,8BAA8B;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC;;;OAGG;IACU,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAclE;;OAEG;IACU,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAaxC;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASrC;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQpC,OAAO,CAAC,kBAAkB;IAUnB,KAAK,IAAI,MAAM;CAGvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,UAAU,CA+BpE"}
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/session/session-manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;QAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,CAAC;IAOhF;;OAEG;YACW,YAAY;IAM1B,2BAA2B;IACd,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAKlE,4BAA4B;IACf,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKpD,2BAA2B;IACd,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D,qCAAqC;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK/C,4BAA4B;IACf,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,8BAA8B;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC;;;OAGG;IACU,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAclE;;OAEG;IACU,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD;;;OAGG;IACU,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAaxC;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASrC;;OAEG;IACU,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAWpC,OAAO,CAAC,kBAAkB;IAUnB,KAAK,IAAI,MAAM;CAGvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,aAAkB,GAAG,UAAU,CAmCpE"}