@trokky/trokky 2.0.3

package/dist/core/crypto/password-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/password-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,eAAO,MAAM,yBAAyB,SAAU,CAAA;AAChD,eAAO,MAAM,wBAAwB,OAAO,CAAA;AAC5C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAU,CAAA;AAC5C,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAOlC,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GACxE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,UAAU,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAmBvB,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CASvE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,IAAI,MAAM,CAOjF;AAUD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,GAAG,MAAM,CAG7F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAqDlE;AA+DD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAkC,GAC7C,OAAO,CAAC,MAAM,CAAC,CAKjB;AAoBD,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAMxE;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,OAAO,CAAC,CA+BlB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAGlF"}

package/dist/core/crypto/password-hash.js

@@ -0,0 +1,244 @@
+/**
+ * Shared, runtime-agnostic password hashing helpers.
+ *
+ * Supports a versioned PBKDF2 format:
+ *   $pbkdf2-sha256$<iterations>$<base64 salt>$<base64 derived key>
+ *
+ * and can still verify:
+ *   - legacy untagged hashes: base64(salt16 || pbkdf2_sha256_dk32)
+ *   - bcrypt hashes ($2a$/$2b$/$2y$) when the bcrypt package is loadable
+ */
+export const PBKDF2_DEFAULT_ITERATIONS = 100_000;
+export const PBKDF2_LEGACY_ITERATIONS = 4096;
+/**
+ * Upper bound on the iteration count accepted from a stored hash or from
+ * configuration. A stored hash claiming billions of iterations would otherwise
+ * turn every login attempt for that account into minutes of CPU.
+ */
+export const PBKDF2_MAX_ITERATIONS = 2 ** 24; // 16,777,216: covers legacy 2^saltRounds up to saltRounds=24
+export const PBKDF2_SALT_BYTES = 16;
+export const PBKDF2_KEY_BYTES = 32;
+/** Longest hash string we are willing to parse. Real hashes are < 120 chars. */
+const MAX_HASH_LENGTH = 512;
+const PBKDF2_TAG = 'pbkdf2-sha256';
+const BCRYPT_PATTERN = /^\$2[aby]\$(\d{2})\$/;
+function toBase64(bytes) {
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+function fromBase64(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function constantTimeEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a[i] ^ b[i];
+    }
+    return result === 0;
+}
+/**
+ * True when `iterations` is an integer within the supported range.
+ */
+export function isValidPbkdf2Iterations(iterations) {
+    return (typeof iterations === 'number' &&
+        Number.isInteger(iterations) &&
+        iterations >= 1 &&
+        iterations <= PBKDF2_MAX_ITERATIONS);
+}
+function assertValidIterations(iterations) {
+    if (!isValidPbkdf2Iterations(iterations)) {
+        throw new Error(`pbkdf2Iterations must be an integer between 1 and ${PBKDF2_MAX_ITERATIONS}, got ${String(iterations)}`);
+    }
+}
+/**
+ * Format a PBKDF2 derivation as the versioned hash string.
+ */
+export function formatPbkdf2Hash(iterations, salt, dk) {
+    assertValidIterations(iterations);
+    return `$${PBKDF2_TAG}$${iterations}$${toBase64(salt)}$${toBase64(dk)}`;
+}
+/**
+ * Identify the format of a stored password hash. Never throws.
+ */
+export function parsePasswordHash(hash) {
+    if (typeof hash !== 'string' || hash.length === 0 || hash.length > MAX_HASH_LENGTH) {
+        return { kind: 'unknown' };
+    }
+    const bcryptMatch = BCRYPT_PATTERN.exec(hash);
+    if (bcryptMatch) {
+        return { kind: 'bcrypt', cost: Number(bcryptMatch[1]) };
+    }
+    if (hash.startsWith(`$${PBKDF2_TAG}$`)) {
+        // ['', tag, iterations, salt, dk]
+        const parts = hash.split('$');
+        if (parts.length !== 5) {
+            return { kind: 'unknown' };
+        }
+        // Strict decimal only: Number() would accept '1e5', '0x10' or ' 100000'.
+        if (!/^[1-9][0-9]{0,8}$/.test(parts[2])) {
+            return { kind: 'unknown' };
+        }
+        const iterations = Number(parts[2]);
+        if (!isValidPbkdf2Iterations(iterations)) {
+            return { kind: 'unknown' };
+        }
+        try {
+            const salt = fromBase64(parts[3]);
+            const dk = fromBase64(parts[4]);
+            // We only ever write salt16/dk32; anything else is corrupt or forged.
+            if (salt.length !== PBKDF2_SALT_BYTES || dk.length !== PBKDF2_KEY_BYTES) {
+                return { kind: 'unknown' };
+            }
+            return { kind: 'pbkdf2', iterations, salt, dk };
+        }
+        catch {
+            return { kind: 'unknown' };
+        }
+    }
+    if (!hash.includes('$')) {
+        try {
+            const bytes = fromBase64(hash);
+            if (bytes.length === PBKDF2_SALT_BYTES + PBKDF2_KEY_BYTES) {
+                return {
+                    kind: 'legacy-pbkdf2',
+                    salt: bytes.slice(0, PBKDF2_SALT_BYTES),
+                    dk: bytes.slice(PBKDF2_SALT_BYTES),
+                };
+            }
+        }
+        catch {
+            return { kind: 'unknown' };
+        }
+    }
+    return { kind: 'unknown' };
+}
+function hasSubtle() {
+    return typeof globalThis.crypto?.subtle?.deriveBits === 'function';
+}
+/**
+ * PBKDF2-SHA256 via Node's crypto module, for hosts without global WebCrypto
+ * (Node 18). Same parameters, so output is identical.
+ */
+async function derivePbkdf2Node(password, salt, iterations) {
+    const { pbkdf2 } = await import('crypto');
+    return new Promise((resolve, reject) => {
+        pbkdf2(password, salt, iterations, PBKDF2_KEY_BYTES, 'sha256', (err, key) => {
+            if (err)
+                reject(err);
+            else
+                resolve(new Uint8Array(key.buffer, key.byteOffset, key.byteLength));
+        });
+    });
+}
+async function derivePbkdf2(password, salt, iterations) {
+    assertValidIterations(iterations);
+    if (!hasSubtle()) {
+        return derivePbkdf2Node(password, salt, iterations);
+    }
+    const subtle = globalThis.crypto.subtle;
+    const keyMaterial = await subtle.importKey('raw', new TextEncoder().encode(password), { name: 'PBKDF2' }, false, ['deriveBits']);
+    const derived = await subtle.deriveBits({
+        name: 'PBKDF2',
+        salt: salt,
+        iterations,
+        hash: 'SHA-256',
+    }, keyMaterial, PBKDF2_KEY_BYTES * 8);
+    return new Uint8Array(derived);
+}
+async function randomSalt() {
+    if (typeof globalThis.crypto?.getRandomValues === 'function') {
+        return globalThis.crypto.getRandomValues(new Uint8Array(PBKDF2_SALT_BYTES));
+    }
+    const { randomBytes } = await import('crypto');
+    const buf = randomBytes(PBKDF2_SALT_BYTES);
+    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+/**
+ * Hash a password with PBKDF2-SHA256 and return the versioned hash string.
+ */
+export async function hashPasswordPbkdf2(password, iterations = PBKDF2_DEFAULT_ITERATIONS) {
+    assertValidIterations(iterations);
+    const salt = await randomSalt();
+    const dk = await derivePbkdf2(password, salt, iterations);
+    return formatPbkdf2Hash(iterations, salt, dk);
+}
+let warnedMissingBcrypt = false;
+async function loadBcrypt() {
+    try {
+        // Resolved lazily so edge runtimes without Node builtins never load it.
+        const { createRequire } = await import('module');
+        return createRequire(import.meta.url)('bcrypt');
+    }
+    catch {
+        if (!warnedMissingBcrypt) {
+            warnedMissingBcrypt = true;
+            console.warn('[password-hash] A bcrypt ($2…) password hash was encountered but the bcrypt package is not installed; those users cannot log in until it is.');
+        }
+        return null;
+    }
+}
+/**
+ * Iteration counts to try, in order, for a legacy untagged hash.
+ */
+export function legacyIterationCandidates(extra = []) {
+    const out = [];
+    for (const n of [PBKDF2_DEFAULT_ITERATIONS, PBKDF2_LEGACY_ITERATIONS, ...extra]) {
+        if (isValidPbkdf2Iterations(n) && !out.includes(n))
+            out.push(n);
+    }
+    return out;
+}
+/**
+ * Verify a password against any supported hash format. Never throws.
+ */
+export async function verifyPasswordHash(password, hash, options = {}) {
+    try {
+        const parsed = parsePasswordHash(hash);
+        switch (parsed.kind) {
+            case 'pbkdf2': {
+                const derived = await derivePbkdf2(password, parsed.salt, parsed.iterations);
+                return constantTimeEqual(derived, parsed.dk);
+            }
+            case 'legacy-pbkdf2': {
+                for (const iterations of legacyIterationCandidates(options.legacyIterations)) {
+                    const derived = await derivePbkdf2(password, parsed.salt, iterations);
+                    if (constantTimeEqual(derived, parsed.dk)) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            case 'bcrypt': {
+                const bcrypt = await loadBcrypt();
+                if (!bcrypt) {
+                    return false;
+                }
+                return await bcrypt.compare(password, hash);
+            }
+            default:
+                return false;
+        }
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when the stored hash is not a PBKDF2 hash at the current iteration count.
+ */
+export function pbkdf2NeedsRehash(hash, currentIterations) {
+    const parsed = parsePasswordHash(hash);
+    return !(parsed.kind === 'pbkdf2' && parsed.iterations === currentIterations);
+}
+//# sourceMappingURL=password-hash.js.map

package/dist/core/crypto/password-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.js","sourceRoot":"","sources":["../../../src/core/crypto/password-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAA;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAC5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAI,EAAE,CAAA,CAAC,6DAA6D;AAC1G,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAClC,gFAAgF;AAChF,MAAM,eAAe,GAAG,GAAG,CAAA;AAE3B,MAAM,UAAU,GAAG,eAAe,CAAA;AAClC,MAAM,cAAc,GAAG,sBAAsB,CAAA;AAQ7C,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAmB;IACzD,OAAO,CACL,OAAO,UAAU,KAAK,QAAQ;QAC9B,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAC5B,UAAU,IAAI,CAAC;QACf,UAAU,IAAI,qBAAqB,CACpC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,qDAAqD,qBAAqB,SAAS,MAAM,CAAC,UAAU,CAAC,EAAE,CACxG,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAgB,EAAE,EAAc;IACnF,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACjC,OAAO,IAAI,UAAU,IAAI,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAA;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC5B,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzD,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACvC,kCAAkC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YACjC,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/B,sEAAsE;YACtE,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,IAAI,EAAE,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACxE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAC5B,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,GAAG,gBAAgB,EAAE,CAAC;gBAC1D,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;oBACvC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC;iBACnC,CAAA;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,UAAU,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,IAAgB,EAChB,UAAkB;IAElB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1E,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,IAAgB,EAChB,UAAkB;IAElB,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACjC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACjB,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAA;IACvC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CACrC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAA+B;QACrC,UAAU;QACV,IAAI,EAAE,SAAS;KAChB,EACD,WAAW,EACX,gBAAgB,GAAG,CAAC,CACrB,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,UAAU;IACvB,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAO,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,aAAqB,yBAAyB;IAE9C,qBAAqB,CAAC,UAAU,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAA;IAC/B,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACzD,OAAO,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,IAAI,mBAAmB,GAAG,KAAK,CAAA;AAE/B,KAAK,UAAU,UAAU;IACvB,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QAChD,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,mBAAmB,GAAG,IAAI,CAAA;YAC1B,OAAO,CAAC,IAAI,CACV,8IAA8I,CAC/I,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAWD;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAkB,EAAE;IAC5D,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAChF,IAAI,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,IAAY,EACZ,UAAiC,EAAE;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAEtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;gBAC5E,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;YAC9C,CAAC;YACD,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,KAAK,MAAM,UAAU,IAAI,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC7E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;oBACrE,IAAI,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC1C,OAAO,IAAI,CAAA;oBACb,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;gBACjC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,KAAK,CAAA;gBACd,CAAC;gBACD,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC7C,CAAC;YACD;gBACE,OAAO,KAAK,CAAA;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,iBAAyB;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,iBAAiB,CAAC,CAAA;AAC/E,CAAC"}

package/dist/core/crypto/webcrypto-adapter.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Web Crypto API adapter for edge environments
+ * Compatible with Cloudflare Workers, Deno, Vercel Edge, etc.
+ */
+import type { CryptoAdapter, JWTOptions, CryptoAdapterOptions } from './adapter.js';
+export declare class WebCryptoAdapter implements CryptoAdapter {
+    private pbkdf2Iterations;
+    /** Iteration count main used for legacy untagged hashes: 2^saltRounds. */
+    private legacyIterations;
+    constructor(options?: CryptoAdapterOptions);
+    hashPassword(password: string): Promise<string>;
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string): boolean;
+    generateJWT(payload: Record<string, any>, secret: string, options?: JWTOptions): Promise<string>;
+    verifyJWT(token: string, secret: string): Promise<Record<string, any> | null>;
+    generateSecureRandom(length?: number): string;
+    private sign;
+    private verify;
+    private base64UrlEncode;
+    private base64UrlDecode;
+    private base64UrlDecodeToBuffer;
+    private parseExpirationString;
+}
+//# sourceMappingURL=webcrypto-adapter.d.ts.map

package/dist/core/crypto/webcrypto-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webcrypto-adapter.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/webcrypto-adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAUnF,qBAAa,gBAAiB,YAAW,aAAa;IACpD,OAAO,CAAC,gBAAgB,CAAQ;IAChC,0EAA0E;IAC1E,OAAO,CAAC,gBAAgB,CAAU;gBAEtB,OAAO,GAAE,oBAAyB;IAmBxC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ/C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI5B,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IA0CpG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IA+BnF,oBAAoB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM;YAMnC,IAAI;YAcJ,MAAM;IAmBpB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,uBAAuB;IAK/B,OAAO,CAAC,qBAAqB;CAmB9B"}

package/dist/core/crypto/webcrypto-adapter.js

@@ -0,0 +1,158 @@
+/**
+ * Web Crypto API adapter for edge environments
+ * Compatible with Cloudflare Workers, Deno, Vercel Edge, etc.
+ */
+import { PBKDF2_DEFAULT_ITERATIONS, PBKDF2_MAX_ITERATIONS, hashPasswordPbkdf2, isValidPbkdf2Iterations, pbkdf2NeedsRehash, verifyPasswordHash, } from './password-hash.js';
+export class WebCryptoAdapter {
+    pbkdf2Iterations;
+    /** Iteration count main used for legacy untagged hashes: 2^saltRounds. */
+    legacyIterations;
+    constructor(options = {}) {
+        // PBKDF2 needs a high iteration count for security.
+        // Default to 100,000 per OWASP recommendations.
+        const iterations = options.pbkdf2Iterations ?? PBKDF2_DEFAULT_ITERATIONS;
+        if (!isValidPbkdf2Iterations(iterations)) {
+            throw new Error(`security.cryptoOptions.pbkdf2Iterations must be an integer between 1 and ${PBKDF2_MAX_ITERATIONS}, got ${String(iterations)}`);
+        }
+        this.pbkdf2Iterations = iterations;
+        // Also try the configured count: an untagged hash may have been written by
+        // an earlier build at a custom pbkdf2Iterations.
+        this.legacyIterations = [2 ** (options.saltRounds ?? 12), iterations];
+        if (!crypto || !crypto.subtle) {
+            throw new Error('Web Crypto API not available in this environment');
+        }
+    }
+    async hashPassword(password) {
+        try {
+            return await hashPasswordPbkdf2(password, this.pbkdf2Iterations);
+        }
+        catch (error) {
+            throw new Error(`Failed to hash password: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    async verifyPassword(password, hash) {
+        return verifyPasswordHash(password, hash, { legacyIterations: this.legacyIterations });
+    }
+    needsRehash(hash) {
+        return pbkdf2NeedsRehash(hash, this.pbkdf2Iterations);
+    }
+    async generateJWT(payload, secret, options = {}) {
+        try {
+            // Create header
+            const header = {
+                alg: 'HS256',
+                typ: 'JWT'
+            };
+            // Add standard claims to payload
+            const now = Math.floor(Date.now() / 1000);
+            const jwtPayload = {
+                ...payload,
+                iat: now
+            };
+            // Add expiration if specified
+            if (options.expiresIn) {
+                if (typeof options.expiresIn === 'string') {
+                    // Parse expiration string (e.g., "24h", "7d")
+                    jwtPayload.exp = now + this.parseExpirationString(options.expiresIn);
+                }
+                else {
+                    jwtPayload.exp = now + options.expiresIn;
+                }
+            }
+            if (options.issuer)
+                jwtPayload.iss = options.issuer;
+            if (options.audience)
+                jwtPayload.aud = options.audience;
+            // Encode header and payload
+            const encodedHeader = this.base64UrlEncode(JSON.stringify(header));
+            const encodedPayload = this.base64UrlEncode(JSON.stringify(jwtPayload));
+            // Create signature
+            const message = `${encodedHeader}.${encodedPayload}`;
+            const signature = await this.sign(message, secret);
+            return `${message}.${signature}`;
+        }
+        catch (error) {
+            throw new Error(`Failed to generate JWT: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        }
+    }
+    async verifyJWT(token, secret) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3) {
+                return null;
+            }
+            const [encodedHeader, encodedPayload, signature] = parts;
+            // Verify signature
+            const message = `${encodedHeader}.${encodedPayload}`;
+            const isValid = await this.verify(message, signature, secret);
+            if (!isValid) {
+                return null;
+            }
+            // Decode payload
+            const payload = JSON.parse(this.base64UrlDecode(encodedPayload));
+            // Check expiration
+            if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+                return null;
+            }
+            return payload;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    generateSecureRandom(length = 64) {
+        const buffer = crypto.getRandomValues(new Uint8Array(length));
+        return Array.from(buffer, byte => byte.toString(16).padStart(2, '0')).join('');
+    }
+    // Helper methods
+    async sign(message, secret) {
+        const encoder = new TextEncoder();
+        const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
+        return this.base64UrlEncode(new Uint8Array(signature));
+    }
+    async verify(message, signature, secret) {
+        try {
+            const encoder = new TextEncoder();
+            const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+            const signatureBuffer = this.base64UrlDecodeToBuffer(signature);
+            const messageBuffer = encoder.encode(message);
+            return await crypto.subtle.verify('HMAC', key, signatureBuffer.buffer, messageBuffer.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    base64UrlEncode(data) {
+        const base64 = typeof data === 'string'
+            ? btoa(data)
+            : btoa(String.fromCharCode(...data));
+        return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+    }
+    base64UrlDecode(data) {
+        const base64 = data.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - base64.length % 4) % 4);
+        return atob(padded);
+    }
+    base64UrlDecodeToBuffer(data) {
+        const decoded = this.base64UrlDecode(data);
+        return new Uint8Array(decoded.split('').map(char => char.charCodeAt(0)));
+    }
+    parseExpirationString(expiration) {
+        const match = expiration.match(/^(\d+)([smhdw])$/);
+        if (!match) {
+            throw new Error(`Invalid expiration format: ${expiration}`);
+        }
+        const value = parseInt(match[1]);
+        const unit = match[2];
+        const multipliers = {
+            s: 1,
+            m: 60,
+            h: 60 * 60,
+            d: 60 * 60 * 24,
+            w: 60 * 60 * 24 * 7
+        };
+        return value * multipliers[unit];
+    }
+}
+//# sourceMappingURL=webcrypto-adapter.js.map

package/dist/core/crypto/webcrypto-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webcrypto-adapter.js","sourceRoot":"","sources":["../../../src/core/crypto/webcrypto-adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAE3B,MAAM,OAAO,gBAAgB;IACnB,gBAAgB,CAAQ;IAChC,0EAA0E;IAClE,gBAAgB,CAAU;IAElC,YAAY,UAAgC,EAAE;QAC5C,oDAAoD;QACpD,gDAAgD;QAChD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAA;QACxE,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,4EAA4E,qBAAqB,SAAS,MAAM,CAAC,UAAU,CAAC,EAAE,CAC/H,CAAA;QACH,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAA;QAClC,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;QAErE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAA;QACzG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAA4B,EAAE,MAAc,EAAE,UAAsB,EAAE;QACtF,IAAI,CAAC;YACH,gBAAgB;YAChB,MAAM,MAAM,GAAG;gBACb,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,KAAK;aACX,CAAA;YAED,iCAAiC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YACzC,MAAM,UAAU,GAAQ;gBACtB,GAAG,OAAO;gBACV,GAAG,EAAE,GAAG;aACT,CAAA;YAED,8BAA8B;YAC9B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC1C,8CAA8C;oBAC9C,UAAU,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBACtE,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,SAAS,CAAA;gBAC1C,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM;gBAAE,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAA;YACnD,IAAI,OAAO,CAAC,QAAQ;gBAAE,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAA;YAEvD,4BAA4B;YAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YAClE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;YAEvE,mBAAmB;YACnB,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAElD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAA;QACxG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAc;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;YAExD,mBAAmB;YACnB,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAA;YACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YAE7D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iBAAiB;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAA;YAEhE,mBAAmB;YACnB,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,SAAiB,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,iBAAiB;IACT,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,MAAc;QAChD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;QAChF,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACxD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAc;QACrE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;YACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAA;YAC/D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAC7C,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,eAAe,CAAC,MAAqB,EAAE,aAAa,CAAC,MAAqB,CAAC,CAAA;QAC5H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,IAAyB;QAC/C,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ;YACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACZ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;QAEtC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzE,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACzD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IAEO,uBAAuB,CAAC,IAAY;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAC1C,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,CAAC;IAEO,qBAAqB,CAAC,UAAkB;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,MAAM,WAAW,GAAG;YAClB,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,EAAE;YACL,CAAC,EAAE,EAAE,GAAG,EAAE;YACV,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;YACf,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;SACpB,CAAA;QAED,OAAO,KAAK,GAAG,WAAW,CAAC,IAAgC,CAAC,CAAA;IAC9D,CAAC;CACF"}

package/dist/core/errors/index.d.ts

@@ -0,0 +1,30 @@
+export declare class TrokkyError extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+    toJSON(): Record<string, unknown>;
+}
+export declare class ValidationError extends TrokkyError {
+    readonly validationErrors: ValidationErrorDetail[];
+    constructor(message: string, validationErrors: ValidationErrorDetail[]);
+    toJSON(): Record<string, unknown>;
+}
+export declare class SchemaNotFoundError extends TrokkyError {
+    constructor(collection: string);
+}
+export declare class DocumentNotFoundError extends TrokkyError {
+    constructor(collection: string, id: string);
+}
+export declare class InvalidInputError extends TrokkyError {
+    readonly field?: string | undefined;
+    constructor(message: string, field?: string | undefined);
+}
+export declare class RateLimitError extends TrokkyError {
+    constructor(operation: string);
+}
+export interface ValidationErrorDetail {
+    field: string;
+    message: string;
+    code: string;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/core/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,qBAAa,WAAY,SAAQ,KAAK;aAGlB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjD,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;IAOnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASlC;AAED,qBAAa,eAAgB,SAAQ,WAAW;aACD,gBAAgB,EAAE,qBAAqB,EAAE;gBAA1E,OAAO,EAAE,MAAM,EAAkB,gBAAgB,EAAE,qBAAqB,EAAE;IAKtF,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAMlC;AAED,qBAAa,mBAAoB,SAAQ,WAAW;gBACtC,UAAU,EAAE,MAAM;CAI/B;AAED,qBAAa,qBAAsB,SAAQ,WAAW;gBACxC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM;CAI3C;AAED,qBAAa,iBAAkB,SAAQ,WAAW;aACH,KAAK,CAAC,EAAE,MAAM;gBAA/C,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,MAAM,YAAA;CAI5D;AAED,qBAAa,cAAe,SAAQ,WAAW;gBACjC,SAAS,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb"}

package/dist/core/errors/index.js

@@ -0,0 +1,61 @@
+export class TrokkyError extends Error {
+    code;
+    details;
+    constructor(message, code, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'TrokkyError';
+        Error.captureStackTrace?.(this, TrokkyError);
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            message: this.message,
+            code: this.code,
+            details: this.details,
+            stack: this.stack
+        };
+    }
+}
+export class ValidationError extends TrokkyError {
+    validationErrors;
+    constructor(message, validationErrors) {
+        super(message, 'VALIDATION_FAILED', { errors: validationErrors });
+        this.validationErrors = validationErrors;
+        this.name = 'ValidationError';
+    }
+    toJSON() {
+        return {
+            ...super.toJSON(),
+            validationErrors: this.validationErrors
+        };
+    }
+}
+export class SchemaNotFoundError extends TrokkyError {
+    constructor(collection) {
+        super(`Schema not found for collection: ${collection}`, 'SCHEMA_NOT_FOUND', { collection });
+        this.name = 'SchemaNotFoundError';
+    }
+}
+export class DocumentNotFoundError extends TrokkyError {
+    constructor(collection, id) {
+        super(`Document not found: ${collection}/${id}`, 'DOCUMENT_NOT_FOUND', { collection, id });
+        this.name = 'DocumentNotFoundError';
+    }
+}
+export class InvalidInputError extends TrokkyError {
+    field;
+    constructor(message, field) {
+        super(message, 'INVALID_INPUT', { field });
+        this.field = field;
+        this.name = 'InvalidInputError';
+    }
+}
+export class RateLimitError extends TrokkyError {
+    constructor(operation) {
+        super(`Rate limit exceeded for operation: ${operation}`, 'RATE_LIMIT_EXCEEDED', { operation });
+        this.name = 'RateLimitError';
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/errors/index.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGlB;IACA;IAHlB,YACE,OAAe,EACC,IAAY,EACZ,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,KAAK,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC9C,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,WAAW;IACD;IAA7C,YAAY,OAAe,EAAkB,gBAAyC;QACpF,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;QADtB,qBAAgB,GAAhB,gBAAgB,CAAyB;QAEpF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;IAED,MAAM;QACJ,OAAO;YACL,GAAG,KAAK,CAAC,MAAM,EAAE;YACjB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;SACxC,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAClD,YAAY,UAAkB;QAC5B,KAAK,CAAC,oCAAoC,UAAU,EAAE,EAAE,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;QAC3F,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,WAAW;IACpD,YAAY,UAAkB,EAAE,EAAU;QACxC,KAAK,CAAC,uBAAuB,UAAU,IAAI,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IACH;IAA7C,YAAY,OAAe,EAAkB,KAAc;QACzD,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QADC,UAAK,GAAL,KAAK,CAAS;QAEzD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,WAAW;IAC7C,YAAY,SAAiB;QAC3B,KAAK,CAAC,sCAAsC,SAAS,EAAE,EAAE,qBAAqB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC9F,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF"}