@storyshelf/core 0.6.0 → 0.6.2

package/dist/auth.d.mts

@@ -89,6 +89,13 @@ interface Auth {
   /** Revoke one session by token (accepts the signed cookie value). */
   destroySession: (sessionToken: string) => Promise<void>;
 }
+/** Minimum password length for local accounts (matches legacy policy). */
+declare const MIN_PASSWORD_LENGTH = 12;
+/**
+ * Raw session token from a possibly-signed cookie value (`token.signature`).
+ * Single shared parser: cookies, CSRF binding, and table lookups must agree.
+ */
+declare function unsignedToken(value: string): string;
 //#endregion
-export { Auth, EngineLoginMethod, EngineLoginMethodKind, EnginePasskeyInfo, EngineSessionInfo };
+export { Auth, EngineLoginMethod, EngineLoginMethodKind, EnginePasskeyInfo, EngineSessionInfo, MIN_PASSWORD_LENGTH, unsignedToken };
 //# sourceMappingURL=auth.d.mts.map

package/dist/auth.mjs

@@ -1,4 +1,17 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-export {};
+//#region src/auth.ts
+/** Minimum password length for local accounts (matches legacy policy). */
+const MIN_PASSWORD_LENGTH = 12;
+/**
+* Raw session token from a possibly-signed cookie value (`token.signature`).
+* Single shared parser: cookies, CSRF binding, and table lookups must agree.
+*/
+function unsignedToken(value) {
+	return value.split(".")[0] ?? "";
+}
+//#endregion
+export { MIN_PASSWORD_LENGTH, unsignedToken };
+
+//# sourceMappingURL=auth.mjs.map

package/dist/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["/**\n * Auth singleton surface: the shelf authentication contract (not an adapter).\n *\n * Owned by core so `ShelfOptions.auth` needs no dependency edge into the\n * engine package (which would cycle: the engine already depends on core).\n * `@storyshelf/auth` implements this interface and re-exports it; app code\n * imports `Auth` (and the shared runtime helpers below) from\n * `@storyshelf/core/auth`, so a server without auth never needs the engine.\n */\nimport type { AuthUser } from \"./types.ts\";\n\n/** Login widget kinds in display order (the shelf plugin contract). */\nexport type EngineLoginMethodKind = \"password\" | \"oauth\" | \"passkey\" | \"sso\";\n\n/**\n * One login widget on the descriptor-driven login page.\n *\n * Plugin contract: `password` posts the credential form to\n * `/auth/engine/login`; `oauth`/`sso` link at `/auth/engine/:id` (the app\n * starts the provider flow server-side); `passkey` is JS-driven on the page\n * (its `url` is an unused fallback). Method ids must be unique across all\n * providers (checked at boot).\n */\nexport interface EngineLoginMethod {\n  kind: EngineLoginMethodKind;\n  id: string;\n  label: string;\n}\n\n/** One device session for the profile device list. */\nexport interface EngineSessionInfo {\n  id: string;\n  token: string;\n  ipAddress: string | null;\n  userAgent: string | null;\n  createdAt: string;\n  expiresAt: string;\n}\n\n/** One registered passkey for the profile page. */\nexport interface EnginePasskeyInfo {\n  id: string;\n  name: string | null;\n  deviceType: string;\n  backedUp: boolean;\n  transports: string | null;\n  aaguid: string | null;\n  createdAt: string;\n}\n\n/** Auth singleton: the shelf authentication surface (not an adapter). */\nexport interface Auth {\n  /** Raw engine handler (mount at `/api/auth/*`). */\n  handler: (request: Request) => Response | Promise<Response>;\n  /** Login methods in display order (drives the login page). */\n  loginMethods: () => EngineLoginMethod[];\n  /** One-shot boot validation (secret strength); the app calls it directly. */\n  setup: () => Promise<void>;\n  /** Stage a shelf user and mint a single-use invite token. */\n  issueInvite: (input: {\n    email: string;\n    name: string;\n    role: AuthUser[\"role\"];\n  }) => Promise<{ inviteId: string; token: string; expiresAt: string }>;\n  /** Check an invite token without consuming it (drives the accept page). */\n  verifyInvite: (input: { inviteId: string; token: string }) => Promise<{\n    email: string;\n    name: string;\n  }>;\n  /** Consume an invite: set the engine credential and return the shelf user. */\n  acceptInvite: (input: { inviteId: string; token: string; password: string }) => Promise<AuthUser>;\n  /** Whether WebAuthn passkeys are enabled (drives the profile section). */\n  passkeysEnabled: () => boolean;\n  /** Active device sessions for the profile page (newest first). */\n  listSessions: (userId: string) => Promise<EngineSessionInfo[]>;\n  /** Registered passkeys for the profile page (oldest first). */\n  listPasskeys: (userId: string) => Promise<EnginePasskeyInfo[]>;\n  /** Whether the user has a local credential (shows the password form). */\n  hasPassword: (userId: string) => Promise<boolean>;\n  /**\n   * Disable or re-enable a user: flips the shelf flag and eagerly revokes\n   * every engine session (the per-request check is the backstop).\n   */\n  setDisabled: (userId: string, disabled: boolean) => Promise<void>;\n  /** Resolve the session user from a request (null when anonymous). */\n  check: (request: Request) => Promise<AuthUser | null>;\n  /** Forbidden by design: sessions mint at engine endpoints, never here. */\n  createSession: (user: AuthUser) => Promise<string>;\n  /** Revoke one session by token (accepts the signed cookie value). */\n  destroySession: (sessionToken: string) => Promise<void>;\n}\n\n/** Minimum password length for local accounts (matches legacy policy). */\nexport const MIN_PASSWORD_LENGTH = 12;\n\n/**\n * Raw session token from a possibly-signed cookie value (`token.signature`).\n * Single shared parser: cookies, CSRF binding, and table lookups must agree.\n */\nexport function unsignedToken(value: string): string {\n  return value.split(\".\")[0] ?? \"\";\n}\n"],"mappings":";;;;;AA6FA,MAAa,sBAAsB;;;;;AAMnC,SAAgB,cAAc,OAAuB;CACnD,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM;AAChC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@storyshelf/core",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "StoryShelf core: adapter interfaces, models, capture pipeline, diff, and retention (no HTTP).",
   "keywords": [
     "chromatic-alternative",
@@ -27,6 +27,9 @@
     "dist"
   ],
   "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
   "sideEffects": false,
   "types": "./dist/index.d.mts",
   "exports": {
@@ -196,7 +199,7 @@
   },
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@storyshelf/affected": "0.6.0",
+    "@storyshelf/affected": "0.6.2",
     "drizzle-orm": "^0.44.0",
     "pino": "^10.3.1",
     "pixelmatch": "^7.1.0",