@tinyrack/tinyauth-server 0.0.7

package/dist/lib/config/server.d.ts

@@ -0,0 +1,13 @@
+import z from 'zod';
+export declare const SERVER_CONFIG_DEFAULT: {
+    readonly public_origin: "http://localhost:8080";
+    readonly listen_port: 8080;
+    readonly trust_proxy: false;
+};
+export declare const ServerConfigSchema: z.ZodDefault<z.ZodObject<{
+    public_origin: z.ZodDefault<z.ZodURL>;
+    listen_port: z.ZodDefault<z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
+    trust_proxy: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodArray<z.ZodString>, z.ZodNumber]>>, z.ZodTransform<string | number | boolean | string[], string | number | boolean | string[]>>;
+}, z.z.core.$strict>>;
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+//# sourceMappingURL=server.d.ts.map

package/dist/lib/config/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/lib/config/server.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AA+BX,eAAO,MAAM,kBAAkB;;;;qBAcE,CAAC;AAElC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/lib/config/server.js

@@ -0,0 +1,45 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+export const SERVER_CONFIG_DEFAULT = {
+    public_origin: 'http://localhost:8080',
+    listen_port: 8080,
+    trust_proxy: false,
+};
+const TrustProxySchema = z
+    .union([
+    z.boolean(),
+    z.string(),
+    z.array(z.string()),
+    z.number().int().min(0),
+])
+    .default(SERVER_CONFIG_DEFAULT.trust_proxy)
+    .transform((value) => {
+    if (typeof value === 'string') {
+        if (value === 'true') {
+            return true;
+        }
+        if (value === 'false') {
+            return false;
+        }
+        const num = Number(value);
+        if (!Number.isNaN(num) && String(num) === value) {
+            return num;
+        }
+    }
+    return value;
+})
+    .describe('Trust proxy configuration for X-Forwarded-* headers. ' +
+    'Can be true (trust all), false (trust none), ' +
+    'IP/CIDR string, array of IPs, or number (nth hop)');
+export const ServerConfigSchema = z
+    .object({
+    public_origin: z
+        .url()
+        .default(SERVER_CONFIG_DEFAULT.public_origin)
+        .describe('Public origin for the auth service, used for redirects, emails, and CORS.'),
+    listen_port: zz.PORT.default(SERVER_CONFIG_DEFAULT.listen_port).describe('TCP port to listen on.'),
+    trust_proxy: TrustProxySchema,
+})
+    .strict()
+    .default(SERVER_CONFIG_DEFAULT);
+//# sourceMappingURL=server.js.map

package/dist/lib/config/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/lib/config/server.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,uBAAuB;IACtC,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,KAAK;CACV,CAAC;AAEX,MAAM,gBAAgB,GAAG,CAAC;KACvB,KAAK,CAAC;IACL,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC;KAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAChD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;KACD,QAAQ,CACP,uDAAuD;IACrD,+CAA+C;IAC/C,mDAAmD,CACtD,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC;SACb,GAAG,EAAE;SACL,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC;SAC5C,QAAQ,CACP,2EAA2E,CAC5E;IACH,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,QAAQ,CACtE,wBAAwB,CACzB;IACD,WAAW,EAAE,gBAAgB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/lib/config/terms.d.ts

@@ -0,0 +1,47 @@
+import z from 'zod';
+/**
+ * Individual term item configuration.
+ */
+export declare const TermsItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    required: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>>;
+    consent_mode: z.ZodDefault<z.ZodEnum<{
+        explicit: "explicit";
+        implicit: "implicit";
+    }>>;
+    version: z.ZodString;
+    content: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"link">;
+        content: z.ZodURL;
+    }, z.z.core.$strict>, z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"text">;
+        content: z.ZodString;
+    }, z.z.core.$strict>]>>>;
+}, z.z.core.$strict>;
+export type TermsItem = z.infer<typeof TermsItemSchema>;
+export declare const TERMS_CONFIG_DEFAULT: TermsItem[];
+/**
+ * Terms configuration schema.
+ */
+export declare const TermsConfigSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    required: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>>;
+    consent_mode: z.ZodDefault<z.ZodEnum<{
+        explicit: "explicit";
+        implicit: "implicit";
+    }>>;
+    version: z.ZodString;
+    content: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"link">;
+        content: z.ZodURL;
+    }, z.z.core.$strict>, z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"text">;
+        content: z.ZodString;
+    }, z.z.core.$strict>]>>>;
+}, z.z.core.$strict>>>;
+export type TermsConfig = z.infer<typeof TermsConfigSchema>;
+//# sourceMappingURL=terms.d.ts.map

package/dist/lib/config/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../../src/lib/config/terms.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAsCpB;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;oBAiCgB,CAAC;AAE7C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB,EAAE,SAAS,EAAO,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;sBAGe,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/lib/config/terms.js

@@ -0,0 +1,71 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+/**
+ * Localized content for a term item.
+ * Each language code maps to a title, type, and content.
+ * Type determines how the content should be interpreted.
+ */
+const TermsLocalizedContentLinkSchema = z
+    .object({
+    title: z.string().min(1).describe('Display title for the term'),
+    type: z.literal('link').describe('Content type: link to external document'),
+    content: z.url().describe('URL to the full terms document'),
+})
+    .strict();
+const TermsLocalizedContentTextSchema = z
+    .object({
+    title: z.string().min(1).describe('Display title for the term'),
+    type: z.literal('text').describe('Content type: inline text'),
+    content: z.string().min(1).describe('Inline text content'),
+})
+    .strict();
+const TermsLocalizedContentSchema = z
+    .union([TermsLocalizedContentLinkSchema, TermsLocalizedContentTextSchema])
+    .describe('Localized content for a term');
+const TERMS_ITEM_CONFIG_DEFAULT = {
+    required: true,
+    consent_mode: 'explicit',
+    content: {},
+};
+/**
+ * Individual term item configuration.
+ */
+export const TermsItemSchema = z
+    .object({
+    id: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9-_]+$/, 'ID must be lowercase alphanumeric with - or _')
+        .describe('Unique identifier for the term'),
+    required: z
+        .union([z.boolean(), z.string()])
+        .pipe(zz.COERCE_BOOLEAN)
+        .default(TERMS_ITEM_CONFIG_DEFAULT.required)
+        .describe('Whether agreement to this term is mandatory'),
+    consent_mode: z
+        .enum(['explicit', 'implicit'])
+        .default(TERMS_ITEM_CONFIG_DEFAULT.consent_mode)
+        .describe('Consent mode for this term: ' +
+        '"explicit" shows checkbox requiring user action, ' +
+        '"implicit" means signup implies agreement'),
+    version: z
+        .string()
+        .min(1)
+        .describe('Version string for tracking changes (e.g., "1.0.0")'),
+    content: z
+        .record(z.string(), TermsLocalizedContentSchema)
+        .default(TERMS_ITEM_CONFIG_DEFAULT.content)
+        .describe('Localized content keyed by language code (e.g., "en", "ko"). ' +
+        'Can be omitted for implicit consent terms where content is not displayed.'),
+})
+    .strict()
+    .describe('Individual term configuration');
+export const TERMS_CONFIG_DEFAULT = [];
+/**
+ * Terms configuration schema.
+ */
+export const TermsConfigSchema = z
+    .array(TermsItemSchema)
+    .default(TERMS_CONFIG_DEFAULT)
+    .describe('Terms of service configuration');
+//# sourceMappingURL=terms.js.map

package/dist/lib/config/terms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.js","sourceRoot":"","sources":["../../../src/lib/config/terms.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAE/C;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,+BAA+B,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CAC3D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,2BAA2B,GAAG,CAAC;KAClC,KAAK,CAAC,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;KACzE,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AAE5C,MAAM,yBAAyB,GAI3B;IACF,QAAQ,EAAE,IAAI;IACd,YAAY,EAAE,UAAU;IACxB,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACvE,QAAQ,CAAC,gCAAgC,CAAC;IAC7C,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC;SAC3C,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,YAAY,EAAE,CAAC;SACZ,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC9B,OAAO,CAAC,yBAAyB,CAAC,YAAY,CAAC;SAC/C,QAAQ,CACP,8BAA8B;QAC5B,mDAAmD;QACnD,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,qDAAqD,CAAC;IAClE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;SAC/C,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC;SAC1C,QAAQ,CACP,+DAA+D;QAC7D,2EAA2E,CAC9E;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,+BAA+B,CAAC,CAAC;AAI7C,MAAM,CAAC,MAAM,oBAAoB,GAAgB,EAAE,CAAC;AAEpD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,eAAe,CAAC;KACtB,OAAO,CAAC,oBAAoB,CAAC;KAC7B,QAAQ,CAAC,gCAAgC,CAAC,CAAC"}

package/dist/lib/config/tokens.d.ts

@@ -0,0 +1,32 @@
+import z from 'zod';
+export declare const TOKEN_ROTATION_CONFIG_DEFAULT: {
+    readonly enabled: true;
+    readonly interval_days: 30;
+    readonly overlap_days: 7;
+};
+export declare const TOKENS_CONFIG_DEFAULT: {
+    readonly access_token_ttl: 3600;
+    readonly refresh_token_ttl: 2592000;
+    readonly key_rotation: {
+        readonly enabled: true;
+        readonly interval_days: 30;
+        readonly overlap_days: 7;
+    };
+};
+export declare const TokenKeyRotationConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>;
+    interval_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    overlap_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+}, z.z.core.$strict>>;
+export type TokenKeyRotationConfig = z.infer<typeof TokenKeyRotationConfigSchema>;
+export declare const TokensConfigSchema: z.ZodDefault<z.ZodObject<{
+    access_token_ttl: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    refresh_token_ttl: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    key_rotation: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>;
+        interval_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+        overlap_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    }, z.z.core.$strict>>;
+}, z.z.core.$strict>>;
+export type TokensConfig = z.infer<typeof TokensConfigSchema>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/lib/config/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/lib/config/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,6BAA6B;;;;CAIhC,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,4BAA4B;;;;qBAoBS,CAAC;AAEnD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;qBAgB6B,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/lib/config/tokens.js

@@ -0,0 +1,47 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+export const TOKEN_ROTATION_CONFIG_DEFAULT = {
+    enabled: true,
+    interval_days: 30,
+    overlap_days: 7,
+};
+export const TOKENS_CONFIG_DEFAULT = {
+    access_token_ttl: 3600,
+    refresh_token_ttl: 2592000,
+    key_rotation: TOKEN_ROTATION_CONFIG_DEFAULT,
+};
+export const TokenKeyRotationConfigSchema = z
+    .object({
+    enabled: zz.COERCE_BOOLEAN.default(TOKEN_ROTATION_CONFIG_DEFAULT.enabled).describe('Whether automatic signing key rotation is enabled.'),
+    interval_days: zz
+        .coerceInt()
+        .pipe(z.number().int().min(1))
+        .default(TOKEN_ROTATION_CONFIG_DEFAULT.interval_days)
+        .describe('Number of days between signing key rotations.'),
+    overlap_days: zz
+        .coerceInt()
+        .pipe(z.number().int().min(1))
+        .default(TOKEN_ROTATION_CONFIG_DEFAULT.overlap_days)
+        .describe('Number of days the old key remains valid after rotation for graceful transition.'),
+})
+    .strict()
+    .default(TOKEN_ROTATION_CONFIG_DEFAULT)
+    .describe('Signing key rotation configuration.');
+export const TokensConfigSchema = z
+    .object({
+    access_token_ttl: zz
+        .coerceInt()
+        .pipe(z.number().int().min(60))
+        .default(TOKENS_CONFIG_DEFAULT.access_token_ttl)
+        .describe('Access token time-to-live in seconds.'),
+    refresh_token_ttl: zz
+        .coerceInt()
+        .pipe(z.number().int().min(3600))
+        .default(TOKENS_CONFIG_DEFAULT.refresh_token_ttl)
+        .describe('Refresh token time-to-live in seconds.'),
+    key_rotation: TokenKeyRotationConfigSchema,
+})
+    .strict()
+    .default(TOKENS_CONFIG_DEFAULT)
+    .describe('Token issuance and signing key configuration.');
+//# sourceMappingURL=tokens.js.map

package/dist/lib/config/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/lib/config/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAE/C,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,EAAE;IACjB,YAAY,EAAE,CAAC;CACP,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,OAAO;IAC1B,YAAY,EAAE,6BAA6B;CACnC,CAAC;AAEX,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAChC,6BAA6B,CAAC,OAAO,CACtC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAChE,aAAa,EAAE,EAAE;SACd,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,OAAO,CAAC,6BAA6B,CAAC,aAAa,CAAC;SACpD,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,YAAY,EAAE,EAAE;SACb,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,OAAO,CAAC,6BAA6B,CAAC,YAAY,CAAC;SACnD,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,6BAA6B,CAAC;KACtC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;AAMnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,gBAAgB,EAAE,EAAE;SACjB,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9B,OAAO,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;SAC/C,QAAQ,CAAC,uCAAuC,CAAC;IACpD,iBAAiB,EAAE,EAAE;SAClB,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAChC,OAAO,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;SAChD,QAAQ,CAAC,wCAAwC,CAAC;IACrD,YAAY,EAAE,4BAA4B;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,qBAAqB,CAAC;KAC9B,QAAQ,CAAC,+CAA+C,CAAC,CAAC"}

package/dist/lib/config/user.d.ts

@@ -0,0 +1,22 @@
+import z from 'zod';
+export declare const UserConfigSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+    role: z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>;
+}, z.z.core.$strict>;
+export type UserConfig = z.infer<typeof UserConfigSchema>;
+export declare const USER_CONFIGS_DEFAULT: UserConfig[];
+export declare const UserConfigsSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+    role: z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>;
+}, z.z.core.$strict>>>;
+//# sourceMappingURL=user.d.ts.map

package/dist/lib/config/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/lib/config/user.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,eAAO,MAAM,gBAAgB;;;;;;;;oBAU6B,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,oBAAoB,EAAE,UAAU,EAAO,CAAC;AAErD,eAAO,MAAM,iBAAiB;;;;;;;;sBAGuB,CAAC"}

package/dist/lib/config/user.js

@@ -0,0 +1,18 @@
+import z from 'zod';
+export const UserConfigSchema = z
+    .object({
+    sub: z.string().describe('Unique subject identifier for the user.'),
+    email: z.string().describe('Email address for the user account.'),
+    password: z.string().describe('Plain-text password (hashed at startup).'),
+    role: z
+        .enum(['user', 'admin'])
+        .describe('User role. "admin" grants access to the admin panel.'),
+})
+    .strict()
+    .describe('Pre-provisioned user account configuration.');
+export const USER_CONFIGS_DEFAULT = [];
+export const UserConfigsSchema = z
+    .array(UserConfigSchema)
+    .default(USER_CONFIGS_DEFAULT)
+    .describe('List of pre-provisioned user accounts.');
+//# sourceMappingURL=user.js.map

package/dist/lib/config/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../src/lib/config/user.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACnE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACzE,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAI3D,MAAM,CAAC,MAAM,oBAAoB,GAAiB,EAAE,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,gBAAgB,CAAC;KACvB,OAAO,CAAC,oBAAoB,CAAC;KAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC"}

package/dist/lib/crypto.d.ts

@@ -0,0 +1,106 @@
+export { getRandomBytes } from './base64url.ts';
+export declare function encrypt(data: string, keyHex: string): Promise<string>;
+export declare function decrypt(encoded: string, keyHex: string): Promise<string | null>;
+/**
+ * Compares two byte arrays in constant time to prevent timing side-channel attacks.
+ *
+ * Returns `false` immediately if the arrays differ in length, but the byte-level
+ * comparison always processes every element to avoid leaking positional information.
+ *
+ * @param left - The first byte array.
+ * @param right - The second byte array.
+ * @returns `true` if both arrays contain identical bytes, `false` otherwise.
+ */
+export declare function timingSafeEqualBytes(left: Uint8Array, right: Uint8Array): boolean;
+/**
+ * Parses a persisted PBKDF2 hash string into its constituent parameters.
+ *
+ * The expected format is: `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`
+ * where salt and digest are base64url-encoded.
+ *
+ * @param hash - The stored hash string to parse.
+ * @param expectedAlgorithm - The algorithm identifier to match (e.g. `'pbkdf2-sha256'`).
+ * @returns The parsed components, or `undefined` if the string is malformed.
+ */
+export declare function parsePbkdf2Hash(hash: string, expectedAlgorithm: string): {
+    version: number;
+    iterations: number;
+    salt: Uint8Array;
+    digest: Uint8Array;
+} | undefined;
+/**
+ * Encodes PBKDF2 hash parameters into a self-describing string for storage.
+ *
+ * @param params - The PBKDF2 parameters to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`.
+ */
+export declare function formatPbkdf2Hash(params: {
+    algorithm: string;
+    version: number;
+    iterations: number;
+    salt: Uint8Array;
+    digest: Uint8Array;
+}): string;
+/**
+ * Encodes an HMAC digest into a self-describing string for opaque token storage.
+ *
+ * @param params - The HMAC digest to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$h=<digest>`.
+ */
+export declare function formatOpaqueHash(params: {
+    algorithm: string;
+    version: number;
+    digest: Uint8Array;
+}): string;
+/**
+ * Normalizes a secret string to Unicode NFC form and encodes it as UTF-8 bytes.
+ * This ensures visually equivalent strings (e.g. `café` vs `cafe\u0301`) produce
+ * identical byte sequences across all runtimes.
+ *
+ * @param secret - The raw secret string.
+ * @returns The NFC-normalized, UTF-8-encoded byte representation.
+ */
+export declare function normalizeSecret(secret: string): Uint8Array;
+/**
+ * Derives a purpose-specific subkey from a master secret using HKDF-SHA-256.
+ *
+ * Each purpose produces a cryptographically isolated key, so compromising
+ * one purpose key does not affect others.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param masterSecret - The 32-byte master secret.
+ * @param hkdfSalt - The salt string for HKDF (e.g. application context identifier).
+ * @param hkdfInfo - The info string for HKDF (e.g. purpose label).
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived purpose key of the specified length.
+ */
+export declare function derivePurposeKeyBytes(crypto: Crypto, masterSecret: Uint8Array, hkdfSalt: string, hkdfInfo: string, derivedKeyBytes: number): Promise<Uint8Array>;
+/**
+ * Derives a PBKDF2-SHA-256 digest from a low-entropy secret (e.g. a password).
+ *
+ * The secret is first NFC-normalized and concatenated with the purpose key before
+ * being fed into PBKDF2, binding the derivation to a specific purpose.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param secret - The raw secret string (password, client secret, etc.).
+ * @param salt - A random salt (typically 16 bytes).
+ * @param iterations - The PBKDF2 iteration count.
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived key of the specified length.
+ */
+export declare function derivePbkdf2Bytes(crypto: Crypto, purposeKey: Uint8Array, secret: string, salt: Uint8Array, iterations: number, derivedKeyBytes: number): Promise<Uint8Array>;
+/**
+ * Computes an HMAC-SHA-256 signature over a high-entropy opaque value.
+ *
+ * Unlike PBKDF2, this is intended for values that are already cryptographically
+ * random (e.g. authorization codes, recovery tokens), where deterministic hashing
+ * enables efficient database lookups.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param value - The opaque value to sign.
+ * @returns A 32-byte HMAC signature.
+ */
+export declare function signOpaqueValue(crypto: Crypto, purposeKey: Uint8Array, value: string): Promise<Uint8Array>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAuBhD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B3E;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BxB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,GAChB,OAAO,CAkBT;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,GAEvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GACD,SAAS,CAqCZ;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAMT;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,UAAU,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAmBrB"}