@trokky/trokky 2.0.3

package/dist/core/security/auth.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Authentication and Authorization Service
+ *
+ * Provides secure user authentication with JWT tokens and app token management.
+ * Supports multiple authentication methods:
+ * - User JWT sessions (for Studio access)
+ * - App tokens (for API integrations)
+ * - Service tokens (for internal communication)
+ */
+import type { User, AppToken, AuthContext, Permission, UserRole, CreateAppTokenData, AuthenticatedUser } from '../types/user.js';
+export interface AuthConfig {
+    jwtSecret: string;
+    jwtExpiresIn: string;
+    refreshTokenExpiresIn: string;
+    bcryptRounds: number;
+    rateLimitAttempts: number;
+    rateLimitWindow: number;
+}
+export interface LoginResult {
+    success: boolean;
+    accessToken?: string;
+    refreshToken?: string;
+    user?: AuthenticatedUser;
+    error?: string;
+}
+export interface TokenValidationResult {
+    valid: boolean;
+    context?: AuthContext;
+    error?: string;
+}
+export interface AppTokenCreationResult {
+    success: boolean;
+    token?: string;
+    appToken?: AppToken;
+    error?: string;
+}
+export declare class AuthenticationService {
+    private config;
+    private failedAttempts;
+    constructor(config: AuthConfig);
+    /**
+     * Hash a password using bcrypt-compatible algorithm
+     */
+    hashPassword(password: string): Promise<string>;
+    /**
+     * Verify a password against its hash
+     */
+    verifyPassword(password: string, hash: string): Promise<boolean>;
+    /**
+     * Generate a secure JWT token for user authentication
+     */
+    generateUserToken(user: User): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    /**
+     * Generate a secure app token for API access
+     */
+    generateAppToken(): Promise<{
+        token: string;
+        hash: string;
+    }>;
+    /**
+     * Create an app token with specified permissions
+     */
+    createAppToken(data: CreateAppTokenData, createdBy: string): Promise<AppTokenCreationResult>;
+    /**
+     * Validate a JWT token and return authentication context
+     */
+    validateToken(token: string): Promise<TokenValidationResult>;
+    /**
+     * Validate an app token using the raw token string
+     */
+    validateAppToken(token: string): Promise<{
+        valid: boolean;
+        hash?: string;
+        error?: string;
+    }>;
+    /**
+     * Check if a user/token has a specific permission
+     */
+    hasPermission(context: AuthContext, permission: Permission): boolean;
+    /**
+     * Check if a user/token has any of the specified permissions
+     */
+    hasAnyPermission(context: AuthContext, permissions: Permission[]): boolean;
+    /**
+     * Check if a user/token has all of the specified permissions
+     */
+    hasAllPermissions(context: AuthContext, permissions: Permission[]): boolean;
+    /**
+     * Get default permissions for a role
+     */
+    getRolePermissions(role: UserRole): Permission[];
+    /**
+     * Rate limiting for login attempts
+     */
+    isRateLimited(identifier: string): boolean;
+    /**
+     * Record a failed login attempt
+     */
+    recordFailedAttempt(identifier: string): void;
+    /**
+     * Clear failed login attempts (on successful login)
+     */
+    clearFailedAttempts(identifier: string): void;
+    /**
+     * Generate a unique ID for entities
+     */
+    private generateId;
+    /**
+     * Parse time string to seconds (e.g., '1h' -> 3600)
+     */
+    private parseTimeToSeconds;
+}
+/**
+ * Default authentication configuration
+ */
+export declare const DEFAULT_AUTH_CONFIG: AuthConfig;
+//# sourceMappingURL=auth.d.ts.map

package/dist/core/security/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/core/security/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,QAAQ,EAGR,kBAAkB,EAClB,iBAAiB,EAElB,MAAM,kBAAkB,CAAA;AAKzB,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,MAAM,CAAA;IACzB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,cAAc,CAAiE;gBAE3E,MAAM,EAAE,UAAU;IAI9B;;OAEG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKrD;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAStE;;OAEG;IACG,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA0B3F;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlE;;OAEG;IACG,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAiClG;;OAEG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA+ClE;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAajG;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO;IAgBpE;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO;IAI1E;;OAEG;IACH,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO;IAI3E;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,EAAE;IAIhD;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAgB1C;;OAEG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQ7C;;OAEG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI7C;;OAEG;IACH,OAAO,CAAC,UAAU;IAIlB;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAiB3B;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAOjC,CAAA"}

package/dist/core/security/auth.js

@@ -0,0 +1,274 @@
+/**
+ * Authentication and Authorization Service
+ *
+ * Provides secure user authentication with JWT tokens and app token management.
+ * Supports multiple authentication methods:
+ * - User JWT sessions (for Studio access)
+ * - App tokens (for API integrations)
+ * - Service tokens (for internal communication)
+ */
+import { randomBytes, createHash } from 'node:crypto';
+// ROLE_PERMISSIONS is a value, not a type: a type-only import is erased at runtime,
+// which is why this used to be fetched with require() in an ESM package.
+import { ROLE_PERMISSIONS } from '../types/user.js';
+export class AuthenticationService {
+    config;
+    failedAttempts = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Hash a password using bcrypt-compatible algorithm
+     */
+    async hashPassword(password) {
+        const bcrypt = await import('bcrypt');
+        return bcrypt.hash(password, this.config.bcryptRounds);
+    }
+    /**
+     * Verify a password against its hash
+     */
+    async verifyPassword(password, hash) {
+        try {
+            const bcrypt = await import('bcrypt');
+            return bcrypt.compare(password, hash);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Generate a secure JWT token for user authentication
+     */
+    async generateUserToken(user) {
+        const jwt = await import('jsonwebtoken');
+        const payload = {
+            type: 'user',
+            userId: user.id,
+            username: user.username,
+            role: user.role,
+            permissions: user.permissions,
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + this.parseTimeToSeconds(this.config.jwtExpiresIn)
+        };
+        const refreshPayload = {
+            type: 'refresh',
+            userId: user.id,
+            iat: Math.floor(Date.now() / 1000),
+            exp: Math.floor(Date.now() / 1000) + this.parseTimeToSeconds(this.config.refreshTokenExpiresIn)
+        };
+        const accessToken = jwt.sign(payload, this.config.jwtSecret);
+        const refreshToken = jwt.sign(refreshPayload, this.config.jwtSecret);
+        return { accessToken, refreshToken };
+    }
+    /**
+     * Generate a secure app token for API access
+     */
+    async generateAppToken() {
+        // Generate a secure random token (32 bytes = 256 bits)
+        const tokenBytes = randomBytes(32);
+        const token = tokenBytes.toString('base64url'); // URL-safe base64
+        // Hash the token for secure storage
+        const hash = createHash('sha256').update(token).digest('hex');
+        return { token, hash };
+    }
+    /**
+     * Create an app token with specified permissions
+     */
+    async createAppToken(data, createdBy) {
+        try {
+            const { token, hash } = await this.generateAppToken();
+            const now = new Date().toISOString();
+            const appToken = {
+                id: this.generateId(),
+                name: data.name,
+                description: data.description,
+                tokenHash: hash,
+                permissions: data.permissions,
+                createdBy,
+                isActive: true,
+                lastUsedAt: undefined,
+                usageCount: 0,
+                expiresAt: data.expiresAt,
+                createdAt: now,
+                updatedAt: now
+            };
+            return {
+                success: true,
+                token, // Return plain text token only once
+                appToken
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'Failed to create app token'
+            };
+        }
+    }
+    /**
+     * Validate a JWT token and return authentication context
+     */
+    async validateToken(token) {
+        try {
+            const jwt = await import('jsonwebtoken');
+            const decoded = jwt.verify(token, this.config.jwtSecret);
+            if (decoded.type === 'user') {
+                return {
+                    valid: true,
+                    context: {
+                        type: 'user',
+                        user: {
+                            id: decoded.userId,
+                            username: decoded.username,
+                            email: '', // Will be populated from storage
+                            firstName: '', // Will be populated from storage
+                            lastName: '', // Will be populated from storage
+                            role: decoded.role,
+                            permissions: decoded.permissions,
+                            isActive: true // Will be verified from storage
+                        }
+                    }
+                };
+            }
+            else if (decoded.type === 'app_token') {
+                return {
+                    valid: true,
+                    context: {
+                        type: 'app_token',
+                        token: {
+                            id: decoded.tokenId,
+                            name: decoded.name,
+                            permissions: decoded.permissions,
+                            createdBy: decoded.createdBy,
+                            isActive: true // Will be verified from storage
+                        }
+                    }
+                };
+            }
+            return { valid: false, error: 'Invalid token type' };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : 'Token validation failed'
+            };
+        }
+    }
+    /**
+     * Validate an app token using the raw token string
+     */
+    async validateAppToken(token) {
+        try {
+            // Hash the provided token to compare with stored hash
+            const hash = createHash('sha256').update(token).digest('hex');
+            return { valid: true, hash };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : 'App token validation failed'
+            };
+        }
+    }
+    /**
+     * Check if a user/token has a specific permission
+     */
+    hasPermission(context, permission) {
+        if (context.type === 'anonymous') {
+            return false;
+        }
+        if (context.type === 'user') {
+            return context.user.permissions.includes(permission);
+        }
+        if (context.type === 'app_token') {
+            return context.token.permissions.includes(permission);
+        }
+        return false;
+    }
+    /**
+     * Check if a user/token has any of the specified permissions
+     */
+    hasAnyPermission(context, permissions) {
+        return permissions.some(permission => this.hasPermission(context, permission));
+    }
+    /**
+     * Check if a user/token has all of the specified permissions
+     */
+    hasAllPermissions(context, permissions) {
+        return permissions.every(permission => this.hasPermission(context, permission));
+    }
+    /**
+     * Get default permissions for a role
+     */
+    getRolePermissions(role) {
+        return ROLE_PERMISSIONS[role] || [];
+    }
+    /**
+     * Rate limiting for login attempts
+     */
+    isRateLimited(identifier) {
+        const attempts = this.failedAttempts.get(identifier);
+        if (!attempts)
+            return false;
+        const now = Date.now();
+        const timeSinceLastAttempt = now - attempts.lastAttempt;
+        // Reset if window has passed
+        if (timeSinceLastAttempt > this.config.rateLimitWindow) {
+            this.failedAttempts.delete(identifier);
+            return false;
+        }
+        return attempts.count >= this.config.rateLimitAttempts;
+    }
+    /**
+     * Record a failed login attempt
+     */
+    recordFailedAttempt(identifier) {
+        const attempts = this.failedAttempts.get(identifier) || { count: 0, lastAttempt: 0 };
+        this.failedAttempts.set(identifier, {
+            count: attempts.count + 1,
+            lastAttempt: Date.now()
+        });
+    }
+    /**
+     * Clear failed login attempts (on successful login)
+     */
+    clearFailedAttempts(identifier) {
+        this.failedAttempts.delete(identifier);
+    }
+    /**
+     * Generate a unique ID for entities
+     */
+    generateId() {
+        return randomBytes(16).toString('hex');
+    }
+    /**
+     * Parse time string to seconds (e.g., '1h' -> 3600)
+     */
+    parseTimeToSeconds(timeString) {
+        const units = {
+            's': 1,
+            'm': 60,
+            'h': 3600,
+            'd': 86400,
+            'w': 604800
+        };
+        const match = timeString.match(/^(\d+)([smhdw])$/);
+        if (!match) {
+            throw new Error(`Invalid time format: ${timeString}`);
+        }
+        const [, value, unit] = match;
+        return parseInt(value, 10) * units[unit];
+    }
+}
+/**
+ * Default authentication configuration
+ */
+export const DEFAULT_AUTH_CONFIG = {
+    jwtSecret: process.env.TROKKY_JWT_SECRET || 'your-super-secret-jwt-key-change-in-production',
+    jwtExpiresIn: '2h', // 2 hours for access tokens
+    refreshTokenExpiresIn: '7d', // 7 days for refresh tokens
+    bcryptRounds: 12,
+    rateLimitAttempts: 5,
+    rateLimitWindow: 15 * 60 * 1000 // 15 minutes
+};
+//# sourceMappingURL=auth.js.map

package/dist/core/security/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/core/security/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAarD,oFAAoF;AACpF,yEAAyE;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAgCnD,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAY;IAClB,cAAc,GAAwD,IAAI,GAAG,EAAE,CAAA;IAEvF,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAU;QAChC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QAExC,MAAM,OAAO,GAAqB;YAChC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACvF,CAAA;QAED,MAAM,cAAc,GAAG;YACrB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAChG,CAAA;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5D,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAEpE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,uDAAuD;QACvD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA,CAAC,kBAAkB;QAEjE,oCAAoC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAE7D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,IAAwB,EAAE,SAAiB;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAA;YACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAEpC,MAAM,QAAQ,GAAa;gBACzB,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAA;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,oCAAoC;gBAC3C,QAAQ;aACT,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;aAC7E,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAuC,CAAA;YAE9F,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE;wBACP,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE;4BACJ,EAAE,EAAE,OAAO,CAAC,MAAM;4BAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,KAAK,EAAE,EAAE,EAAE,iCAAiC;4BAC5C,SAAS,EAAE,EAAE,EAAE,iCAAiC;4BAChD,QAAQ,EAAE,EAAE,EAAE,iCAAiC;4BAC/C,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,QAAQ,EAAE,IAAI,CAAC,gCAAgC;yBAChD;qBACF;iBACF,CAAA;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACxC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW;wBACjB,KAAK,EAAE;4BACL,EAAE,EAAE,OAAO,CAAC,OAAO;4BACnB,IAAI,EAAE,OAAO,CAAC,IAAI;4BAClB,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,QAAQ,EAAE,IAAI,CAAC,gCAAgC;yBAChD;qBACF;iBACF,CAAA;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;aAC1E,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC;YACH,sDAAsD;YACtD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC7D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;aAC9E,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAoB,EAAE,UAAsB;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAoB,EAAE,WAAyB;QAC9D,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;IAChF,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,OAAoB,EAAE,WAAyB;QAC/D,OAAO,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAA;IACjF,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,IAAc;QAC/B,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,oBAAoB,GAAG,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAA;QAEvD,6BAA6B;QAC7B,IAAI,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YACvD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACtC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAA;IACxD,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,UAAkB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAA;QACpF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE;YAClC,KAAK,EAAE,QAAQ,CAAC,KAAK,GAAG,CAAC;YACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,UAAkB;QACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,UAAkB;QAC3C,MAAM,KAAK,GAA2B;YACpC,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,EAAE;YACP,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,MAAM;SACZ,CAAA;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAA;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,gDAAgD;IAC5F,YAAY,EAAE,IAAI,EAAE,4BAA4B;IAChD,qBAAqB,EAAE,IAAI,EAAE,4BAA4B;IACzD,YAAY,EAAE,EAAE;IAChB,iBAAiB,EAAE,CAAC;IACpB,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa;CAC9C,CAAA"}

package/dist/core/security/captcha/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * CAPTCHA Services
+ *
+ * Provides CAPTCHA verification with multiple provider support.
+ * Currently supports Cloudflare Turnstile, with extensible architecture
+ * for hCaptcha and reCAPTCHA.
+ */
+export type { CaptchaProvider, CaptchaProviderConfig, CaptchaProviderType, CaptchaProtectedEndpoint, CaptchaVerificationResult, } from './types.js';
+export { TurnstileService, createTurnstileService, type TurnstileConfig, } from './turnstile.js';
+export { RecaptchaService, createRecaptchaService, type RecaptchaConfig, } from './recaptcha.js';
+import type { CaptchaProvider, CaptchaProviderConfig, CaptchaProviderType } from './types.js';
+/**
+ * Factory function to create a CAPTCHA provider
+ *
+ * @param provider - The provider type ('turnstile', 'hcaptcha', 'recaptcha')
+ * @param config - Provider configuration including keys
+ * @returns A configured CaptchaProvider instance
+ * @throws Error if provider is not implemented
+ */
+export declare function createCaptchaProvider(provider: CaptchaProviderType, config: CaptchaProviderConfig): CaptchaProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security/captcha/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/security/captcha/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAI7F;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,qBAAqB,GAC5B,eAAe,CAcjB"}

package/dist/core/security/captcha/index.js

@@ -0,0 +1,34 @@
+/**
+ * CAPTCHA Services
+ *
+ * Provides CAPTCHA verification with multiple provider support.
+ * Currently supports Cloudflare Turnstile, with extensible architecture
+ * for hCaptcha and reCAPTCHA.
+ */
+// Export Turnstile service
+export { TurnstileService, createTurnstileService, } from './turnstile.js';
+// Export reCAPTCHA service
+export { RecaptchaService, createRecaptchaService, } from './recaptcha.js';
+import { TurnstileService } from './turnstile.js';
+import { RecaptchaService } from './recaptcha.js';
+/**
+ * Factory function to create a CAPTCHA provider
+ *
+ * @param provider - The provider type ('turnstile', 'hcaptcha', 'recaptcha')
+ * @param config - Provider configuration including keys
+ * @returns A configured CaptchaProvider instance
+ * @throws Error if provider is not implemented
+ */
+export function createCaptchaProvider(provider, config) {
+    switch (provider) {
+        case 'turnstile':
+            return new TurnstileService(config);
+        case 'hcaptcha':
+            throw new Error('hCaptcha provider not yet implemented. Coming soon!');
+        case 'recaptcha':
+            return new RecaptchaService(config);
+        default:
+            throw new Error(`Unknown CAPTCHA provider: ${provider}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/core/security/captcha/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/security/captcha/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAA;AAEvB,2BAA2B;AAC3B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAA6B,EAC7B,MAA6B;IAE7B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAErC,KAAK,UAAU;YACb,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QAExE,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAErC;YACE,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC"}

package/dist/core/security/captcha/recaptcha.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Google reCAPTCHA v2 Service
+ *
+ * Implements the CaptchaProvider interface for Google reCAPTCHA v2.
+ * https://developers.google.com/recaptcha/docs/display
+ */
+import type { CaptchaProvider, CaptchaProviderConfig, CaptchaVerificationResult } from './types.js';
+/**
+ * reCAPTCHA-specific configuration
+ */
+export interface RecaptchaConfig extends CaptchaProviderConfig {
+    options?: {
+        theme?: 'light' | 'dark';
+        size?: 'normal' | 'compact';
+    };
+}
+/**
+ * Google reCAPTCHA v2 Service
+ */
+export declare class RecaptchaService implements CaptchaProvider {
+    readonly name: "recaptcha";
+    private config;
+    constructor(config: RecaptchaConfig);
+    /**
+     * Verify a reCAPTCHA token with Google's API
+     */
+    verify(token: string, remoteIp?: string): Promise<CaptchaVerificationResult>;
+    /**
+     * Check if the service is properly configured
+     */
+    isConfigured(): boolean;
+    /**
+     * Get the public site key
+     */
+    getSiteKey(): string;
+}
+/**
+ * Factory function to create a RecaptchaService
+ */
+export declare function createRecaptchaService(config: RecaptchaConfig): RecaptchaService;
+//# sourceMappingURL=recaptcha.d.ts.map

package/dist/core/security/captcha/recaptcha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recaptcha.d.ts","sourceRoot":"","sources":["../../../../src/core/security/captcha/recaptcha.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAKnG;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,qBAAqB;IAC5D,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;QACxB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;KAC5B,CAAA;CACF;AAYD;;GAEG;AACH,qBAAa,gBAAiB,YAAW,eAAe;IACtD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,OAAO,CAAC,MAAM,CAAiB;gBAEnB,MAAM,EAAE,eAAe;IAKnC;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAsDlF;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;CAGrB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,CAEhF"}

package/dist/core/security/captcha/recaptcha.js

@@ -0,0 +1,89 @@
+/**
+ * Google reCAPTCHA v2 Service
+ *
+ * Implements the CaptchaProvider interface for Google reCAPTCHA v2.
+ * https://developers.google.com/recaptcha/docs/display
+ */
+import { createLogger } from '../../utils/logger.js';
+const logger = createLogger('security', 'reCAPTCHA');
+const RECAPTCHA_VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify';
+/**
+ * Google reCAPTCHA v2 Service
+ */
+export class RecaptchaService {
+    name = 'recaptcha';
+    config;
+    constructor(config) {
+        this.config = config;
+        logger.debug('RecaptchaService initialized', { siteKey: config.siteKey });
+    }
+    /**
+     * Verify a reCAPTCHA token with Google's API
+     */
+    async verify(token, remoteIp) {
+        logger.debug('Verifying reCAPTCHA token');
+        const formData = new URLSearchParams({
+            secret: this.config.secretKey,
+            response: token,
+        });
+        if (remoteIp) {
+            formData.append('remoteip', remoteIp);
+        }
+        try {
+            const response = await fetch(RECAPTCHA_VERIFY_URL, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: formData,
+            });
+            if (!response.ok) {
+                logger.error('reCAPTCHA verification request failed', { status: response.status });
+                return {
+                    success: false,
+                    errorCodes: ['network-error'],
+                };
+            }
+            const data = (await response.json());
+            const result = {
+                success: data.success,
+                challengeTimestamp: data.challenge_ts,
+                hostname: data.hostname,
+                errorCodes: data['error-codes'],
+            };
+            if (data.success) {
+                logger.debug('reCAPTCHA verification successful', { hostname: data.hostname });
+            }
+            else {
+                logger.warn('reCAPTCHA verification failed', { errorCodes: data['error-codes'] });
+            }
+            return result;
+        }
+        catch (error) {
+            logger.error('reCAPTCHA verification error', error);
+            return {
+                success: false,
+                errorCodes: ['internal-error'],
+            };
+        }
+    }
+    /**
+     * Check if the service is properly configured
+     */
+    isConfigured() {
+        return !!(this.config.siteKey && this.config.secretKey);
+    }
+    /**
+     * Get the public site key
+     */
+    getSiteKey() {
+        return this.config.siteKey;
+    }
+}
+/**
+ * Factory function to create a RecaptchaService
+ */
+export function createRecaptchaService(config) {
+    return new RecaptchaService(config);
+}
+//# sourceMappingURL=recaptcha.js.map

package/dist/core/security/captcha/recaptcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recaptcha.js","sourceRoot":"","sources":["../../../../src/core/security/captcha/recaptcha.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;AACpD,MAAM,oBAAoB,GAAG,iDAAiD,CAAA;AAsB9E;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,WAAoB,CAAA;IAC5B,MAAM,CAAiB;IAE/B,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAiB;QAC3C,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAEzC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC7B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QACvC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,QAAQ;aACf,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,UAAU,EAAE,CAAC,eAAe,CAAC;iBAC9B,CAAA;YACH,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAA;YAEzD,MAAM,MAAM,GAA8B;gBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;aAChC,CAAA;YAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAChF,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;YACnF,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAA;YACnD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC,gBAAgB,CAAC;aAC/B,CAAA;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACzD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA;IAC5B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAC5D,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC"}

package/dist/core/security/captcha/turnstile.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Cloudflare Turnstile CAPTCHA Service
+ *
+ * Implements the CaptchaProvider interface for Cloudflare Turnstile.
+ * https://developers.cloudflare.com/turnstile/
+ */
+import type { CaptchaProvider, CaptchaProviderConfig, CaptchaVerificationResult } from './types.js';
+/**
+ * Turnstile-specific configuration
+ */
+export interface TurnstileConfig extends CaptchaProviderConfig {
+    options?: {
+        theme?: 'light' | 'dark' | 'auto';
+        size?: 'normal' | 'compact' | 'invisible';
+    };
+}
+/**
+ * Cloudflare Turnstile Service
+ */
+export declare class TurnstileService implements CaptchaProvider {
+    readonly name: "turnstile";
+    private config;
+    constructor(config: TurnstileConfig);
+    /**
+     * Verify a Turnstile token with Cloudflare's API
+     */
+    verify(token: string, remoteIp?: string): Promise<CaptchaVerificationResult>;
+    /**
+     * Check if the service is properly configured
+     */
+    isConfigured(): boolean;
+    /**
+     * Get the public site key
+     */
+    getSiteKey(): string;
+}
+/**
+ * Factory function to create a TurnstileService
+ */
+export declare function createTurnstileService(config: TurnstileConfig): TurnstileService;
+//# sourceMappingURL=turnstile.d.ts.map

package/dist/core/security/captcha/turnstile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turnstile.d.ts","sourceRoot":"","sources":["../../../../src/core/security/captcha/turnstile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAKnG;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,qBAAqB;IAC5D,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAA;QACjC,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAA;KAC1C,CAAA;CACF;AAcD;;GAEG;AACH,qBAAa,gBAAiB,YAAW,eAAe;IACtD,QAAQ,CAAC,IAAI,EAAG,WAAW,CAAS;IACpC,OAAO,CAAC,MAAM,CAAiB;gBAEnB,MAAM,EAAE,eAAe;IAKnC;;OAEG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAuDlF;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACH,UAAU,IAAI,MAAM;CAGrB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,CAEhF"}