@warlock.js/core 4.0.174 → 4.1.2

package/esm/dev-server/types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../@warlock.js/core/src/dev-server/types.ts"],"mappings":";KAAY,QAAA;AAAA,KAUA,YAAA;EACV,YAAA;EACA,YAAA;EACA,YAAA;EACA,IAAA;EACA,YAAA;EALsB;;;;;;;EAatB,oBAAA;EACA,UAAA;EACA,IAAA,EAAM,QAAQ;AAAA;;;AAAA;AAWhB;;;;AAAqB;KAAT,SAAA"}

package/esm/dev-server/utils.mjs

@@ -0,0 +1,33 @@
+import { srcPath, warlockPath } from "../utils/paths.mjs";
+import "../utils/index.mjs";
+import { Path } from "./path.mjs";
+import { ensureDirectoryAsync } from "@warlock.js/fs";
+import glob from "fast-glob";
+
+//#region ../../@warlock.js/core/src/dev-server/utils.ts
+/**
+* Ensure the .warlock/ directory exists. Used by the loader-hook
+* registration which writes its bundled hook file into this directory.
+*/
+async function ensureWarlockDirectory() {
+	await ensureDirectoryAsync(warlockPath());
+}
+/**
+* Glob the project's `src/` directory for `.ts`/`.tsx` files. Returns
+* normalised absolute paths.
+*/
+async function getFilesFromDirectory(directoryPath = srcPath(), pattern = "**/*.{ts,tsx}") {
+	return (await glob(`${Path.normalize(directoryPath)}/${pattern}`, { absolute: true })).map((file) => Path.normalize(file));
+}
+async function getCertainFilesFromDirectory(directoryPath, filesNames) {
+	return getFilesFromDirectory(directoryPath, (filesNames.length === 1 ? filesNames[0] : `(${filesNames.join("|")})`) + ".{ts,tsx}");
+}
+function areSetsEqual(set1, set2) {
+	if (set1.size !== set2.size) return false;
+	for (const item of set1) if (!set2.has(item)) return false;
+	return true;
+}
+
+//#endregion
+export { areSetsEqual, ensureWarlockDirectory, getCertainFilesFromDirectory, getFilesFromDirectory };
+//# sourceMappingURL=utils.mjs.map

package/esm/dev-server/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":[],"sources":["../../../../../../@warlock.js/core/src/dev-server/utils.ts"],"sourcesContent":["import { ensureDirectoryAsync } from \"@warlock.js/fs\";\r\nimport glob from \"fast-glob\";\r\nimport { srcPath, warlockPath } from \"../utils\";\r\nimport { Path } from \"./path\";\r\n\r\n/**\r\n * Ensure the .warlock/ directory exists. Used by the loader-hook\r\n * registration which writes its bundled hook file into this directory.\r\n */\r\nexport async function ensureWarlockDirectory() {\r\n  await ensureDirectoryAsync(warlockPath());\r\n}\r\n\r\n/**\r\n * Glob the project's `src/` directory for `.ts`/`.tsx` files. Returns\r\n * normalised absolute paths.\r\n */\r\nexport async function getFilesFromDirectory(directoryPath = srcPath(), pattern = \"**/*.{ts,tsx}\") {\r\n  const files = await glob(`${Path.normalize(directoryPath)}/${pattern}`, { absolute: true });\r\n  return files.map(file => Path.normalize(file));\r\n}\r\n\r\nexport async function getCertainFilesFromDirectory(directoryPath: string, filesNames: string[]) {\r\n  const pattern = filesNames.length === 1 ? filesNames[0] : `(${filesNames.join(\"|\")})`;\r\n  return getFilesFromDirectory(directoryPath, pattern + \".{ts,tsx}\");\r\n}\r\n\r\nexport function areSetsEqual<T>(set1: Set<T>, set2: Set<T>): boolean {\r\n  if (set1.size !== set2.size) return false;\r\n  for (const item of set1) {\r\n    if (!set2.has(item)) return false;\r\n  }\r\n  return true;\r\n}\r\n"],"mappings":";;;;;;;;;;;AASA,eAAsB,yBAAyB;CAC7C,MAAM,qBAAqB,YAAY,CAAC;AAC1C;;;;;AAMA,eAAsB,sBAAsB,gBAAgB,QAAQ,GAAG,UAAU,iBAAiB;CAEhG,QAAO,MADa,KAAK,GAAG,KAAK,UAAU,aAAa,EAAE,GAAG,WAAW,EAAE,UAAU,KAAK,CAAC,GAC7E,KAAI,SAAQ,KAAK,UAAU,IAAI,CAAC;AAC/C;AAEA,eAAsB,6BAA6B,eAAuB,YAAsB;CAE9F,OAAO,sBAAsB,gBADb,WAAW,WAAW,IAAI,WAAW,KAAK,IAAI,WAAW,KAAK,GAAG,EAAE,MAC7B,WAAW;AACnE;AAEA,SAAgB,aAAgB,MAAc,MAAuB;CACnE,IAAI,KAAK,SAAS,KAAK,MAAM,OAAO;CACpC,KAAK,MAAM,QAAQ,MACjB,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,OAAO;CAE9B,OAAO;AACT"}

package/esm/encryption/encrypt.d.mts

@@ -0,0 +1,26 @@
+//#region ../../@warlock.js/core/src/encryption/encrypt.d.ts
+/**
+ * Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).
+ * Returns a combined string in the format `iv:ciphertext:authTag`.
+ *
+ * @example
+ * import { encrypt } from "@warlock.js/core";
+ *
+ * const encrypted = encrypt("sk-proj-12345");
+ * // => "a1b2c3...:d4e5f6...:g7h8i9..."
+ */
+declare function encrypt(plainText: string): string;
+/**
+ * Decrypts a string previously encrypted with {@link encrypt}.
+ * Expects the format `iv:ciphertext:authTag`.
+ *
+ * @example
+ * import { decrypt } from "@warlock.js/core";
+ *
+ * const original = decrypt(encryptedString);
+ * // => "sk-proj-12345"
+ */
+declare function decrypt(cipherText: string): string;
+//#endregion
+export { decrypt, encrypt };
+//# sourceMappingURL=encrypt.d.mts.map

package/esm/encryption/encrypt.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.mts","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/encrypt.ts"],"mappings":";;AAoDA;;;;AAAyC;AAiCzC;;;;iBAjCgB,OAAA,CAAQ,SAAiB;;;;;;;;;;;iBAiCzB,OAAA,CAAQ,UAAkB"}

package/esm/encryption/encrypt.mjs

@@ -0,0 +1,81 @@
+import { config } from "../config/config-getter.mjs";
+import "../config/index.mjs";
+import crypto from "crypto";
+
+//#region ../../@warlock.js/core/src/encryption/encrypt.ts
+/**
+* Default encryption algorithm.
+*/
+const DEFAULT_ALGORITHM = "aes-256-gcm";
+/**
+* Get the encryption key from config, validated as a 32-byte hex string.
+*/
+function getEncryptionKey() {
+	const key = config.key("encryption.key");
+	if (!key) throw new Error("Missing encryption key. Set 'encryption.key' in your config (64 hex characters = 32 bytes).");
+	const buffer = Buffer.from(key, "hex");
+	if (buffer.length !== 32) throw new Error(`Encryption key must be exactly 32 bytes (64 hex characters). Got ${buffer.length} bytes for key ${key}.`);
+	return buffer;
+}
+/**
+* Get the configured encryption algorithm, defaults to aes-256-gcm.
+*/
+function getAlgorithm() {
+	return config.key("encryption.algorithm", DEFAULT_ALGORITHM);
+}
+/**
+* Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).
+* Returns a combined string in the format `iv:ciphertext:authTag`.
+*
+* @example
+* import { encrypt } from "@warlock.js/core";
+*
+* const encrypted = encrypt("sk-proj-12345");
+* // => "a1b2c3...:d4e5f6...:g7h8i9..."
+*/
+function encrypt(plainText) {
+	if (!plainText) return plainText;
+	const keyBuffer = getEncryptionKey();
+	const algorithm = getAlgorithm();
+	try {
+		const iv = crypto.randomBytes(16);
+		const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);
+		let encrypted = cipher.update(plainText, "utf8", "hex");
+		encrypted += cipher.final("hex");
+		const authTag = cipher.getAuthTag().toString("hex");
+		return `${iv.toString("hex")}:${encrypted}:${authTag}`;
+	} catch (error) {
+		throw new Error(`Encryption failed: ${error.message}`);
+	}
+}
+/**
+* Decrypts a string previously encrypted with {@link encrypt}.
+* Expects the format `iv:ciphertext:authTag`.
+*
+* @example
+* import { decrypt } from "@warlock.js/core";
+*
+* const original = decrypt(encryptedString);
+* // => "sk-proj-12345"
+*/
+function decrypt(cipherText) {
+	if (!cipherText) return cipherText;
+	const keyBuffer = getEncryptionKey();
+	const algorithm = getAlgorithm();
+	try {
+		const parts = cipherText.split(":");
+		if (parts.length !== 3) throw new Error("Invalid encrypted format. Expected iv:ciphertext:authTag");
+		const [ivHex, encryptedHex, authTagHex] = parts;
+		const decipher = crypto.createDecipheriv(algorithm, keyBuffer, Buffer.from(ivHex, "hex"));
+		decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
+		let decrypted = decipher.update(encryptedHex, "hex", "utf8");
+		decrypted += decipher.final("utf8");
+		return decrypted;
+	} catch (error) {
+		throw new Error(`Decryption failed: ${error.message}`);
+	}
+}
+
+//#endregion
+export { decrypt, encrypt };
+//# sourceMappingURL=encrypt.mjs.map

package/esm/encryption/encrypt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.mjs","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/encrypt.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { EncryptionConfigurations } from \"./types\";\n\n/**\n * Default encryption algorithm.\n */\nconst DEFAULT_ALGORITHM = \"aes-256-gcm\";\n\n/**\n * Get the encryption key from config, validated as a 32-byte hex string.\n */\nfunction getEncryptionKey(): Buffer {\n  const key = config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!key) {\n    throw new Error(\n      \"Missing encryption key. Set 'encryption.key' in your config (64 hex characters = 32 bytes).\",\n    );\n  }\n\n  const buffer = Buffer.from(key, \"hex\");\n\n  if (buffer.length !== 32) {\n    throw new Error(\n      `Encryption key must be exactly 32 bytes (64 hex characters). Got ${buffer.length} bytes for key ${key}.`,\n    );\n  }\n\n  return buffer;\n}\n\n/**\n * Get the configured encryption algorithm, defaults to aes-256-gcm.\n */\nfunction getAlgorithm(): string {\n  return config.key<EncryptionConfigurations[\"algorithm\"]>(\n    \"encryption.algorithm\",\n    DEFAULT_ALGORITHM,\n  )!;\n}\n\n/**\n * Encrypts a plaintext string using AES-256-GCM (or the configured algorithm).\n * Returns a combined string in the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { encrypt } from \"@warlock.js/core\";\n *\n * const encrypted = encrypt(\"sk-proj-12345\");\n * // => \"a1b2c3...:d4e5f6...:g7h8i9...\"\n */\nexport function encrypt(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const keyBuffer = getEncryptionKey();\n  const algorithm = getAlgorithm();\n\n  try {\n    // IV must be unique per encryption. 16 bytes is standard for AES.\n    const iv = crypto.randomBytes(16);\n    const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);\n\n    let encrypted = cipher.update(plainText, \"utf8\", \"hex\");\n    encrypted += cipher.final(\"hex\");\n\n    // Auth tag validates ciphertext integrity (tamper detection)\n    const authTag = (cipher as crypto.CipherGCM).getAuthTag().toString(\"hex\");\n\n    return `${iv.toString(\"hex\")}:${encrypted}:${authTag}`;\n  } catch (error) {\n    throw new Error(`Encryption failed: ${(error as Error).message}`);\n  }\n}\n\n/**\n * Decrypts a string previously encrypted with {@link encrypt}.\n * Expects the format `iv:ciphertext:authTag`.\n *\n * @example\n * import { decrypt } from \"@warlock.js/core\";\n *\n * const original = decrypt(encryptedString);\n * // => \"sk-proj-12345\"\n */\nexport function decrypt(cipherText: string): string {\n  if (!cipherText) return cipherText;\n\n  const keyBuffer = getEncryptionKey();\n  const algorithm = getAlgorithm();\n\n  try {\n    const parts = cipherText.split(\":\");\n\n    if (parts.length !== 3) {\n      throw new Error(\"Invalid encrypted format. Expected iv:ciphertext:authTag\");\n    }\n\n    const [ivHex, encryptedHex, authTagHex] = parts;\n\n    const decipher = crypto.createDecipheriv(algorithm, keyBuffer, Buffer.from(ivHex, \"hex\"));\n\n    (decipher as crypto.DecipherGCM).setAuthTag(Buffer.from(authTagHex, \"hex\"));\n\n    let decrypted = decipher.update(encryptedHex, \"hex\", \"utf8\");\n    // .final() throws if auth tag is invalid (data tampered)\n    decrypted += decipher.final(\"utf8\");\n\n    return decrypted;\n  } catch (error) {\n    throw new Error(`Decryption failed: ${(error as Error).message}`);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,oBAAoB;;;;AAK1B,SAAS,mBAA2B;CAClC,MAAM,MAAM,OAAO,IAAqC,gBAAgB;CAExE,IAAI,CAAC,KACH,MAAM,IAAI,MACR,6FACF;CAGF,MAAM,SAAS,OAAO,KAAK,KAAK,KAAK;CAErC,IAAI,OAAO,WAAW,IACpB,MAAM,IAAI,MACR,oEAAoE,OAAO,OAAO,iBAAiB,IAAI,EACzG;CAGF,OAAO;AACT;;;;AAKA,SAAS,eAAuB;CAC9B,OAAO,OAAO,IACZ,wBACA,iBACF;AACF;;;;;;;;;;;AAYA,SAAgB,QAAQ,WAA2B;CACjD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,YAAY,iBAAiB;CACnC,MAAM,YAAY,aAAa;CAE/B,IAAI;EAEF,MAAM,KAAK,OAAO,YAAY,EAAE;EAChC,MAAM,SAAS,OAAO,eAAe,WAAW,WAAW,EAAE;EAE7D,IAAI,YAAY,OAAO,OAAO,WAAW,QAAQ,KAAK;EACtD,aAAa,OAAO,MAAM,KAAK;EAG/B,MAAM,UAAW,OAA4B,WAAW,EAAE,SAAS,KAAK;EAExE,OAAO,GAAG,GAAG,SAAS,KAAK,EAAE,GAAG,UAAU,GAAG;CAC/C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF;;;;;;;;;;;AAYA,SAAgB,QAAQ,YAA4B;CAClD,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,YAAY,iBAAiB;CACnC,MAAM,YAAY,aAAa;CAE/B,IAAI;EACF,MAAM,QAAQ,WAAW,MAAM,GAAG;EAElC,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,CAAC,OAAO,cAAc,cAAc;EAE1C,MAAM,WAAW,OAAO,iBAAiB,WAAW,WAAW,OAAO,KAAK,OAAO,KAAK,CAAC;EAExF,AAAC,SAAgC,WAAW,OAAO,KAAK,YAAY,KAAK,CAAC;EAE1E,IAAI,YAAY,SAAS,OAAO,cAAc,OAAO,MAAM;EAE3D,aAAa,SAAS,MAAM,MAAM;EAElC,OAAO;CACT,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,sBAAuB,MAAgB,SAAS;CAClE;AACF"}

package/esm/encryption/hash.d.mts

@@ -0,0 +1,20 @@
+//#region ../../@warlock.js/core/src/encryption/hash.d.ts
+/**
+ * Creates a deterministic HMAC-SHA256 hash of the given string.
+ *
+ * Useful for creating searchable, unique fingerprints of sensitive data
+ * (e.g., an API key) without storing the plaintext.
+ *
+ * Uses a dedicated HMAC key from config. Falls back to the encryption key
+ * if no separate HMAC key is configured.
+ *
+ * @example
+ * import { hmacHash } from "@warlock.js/core";
+ *
+ * const fingerprint = hmacHash("sk-proj-12345");
+ * // Store `fingerprint` in DB for lookups, store encrypted value separately
+ */
+declare function hmacHash(plainText: string): string;
+//#endregion
+export { hmacHash };
+//# sourceMappingURL=hash.d.mts.map

package/esm/encryption/hash.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.mts","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/hash.ts"],"mappings":";;AAmBA;;;;AAA0C;;;;;;;;;;iBAA1B,QAAA,CAAS,SAAiB"}

package/esm/encryption/hash.mjs

@@ -0,0 +1,31 @@
+import { config } from "../config/config-getter.mjs";
+import "../config/index.mjs";
+import crypto from "crypto";
+
+//#region ../../@warlock.js/core/src/encryption/hash.ts
+/**
+* Creates a deterministic HMAC-SHA256 hash of the given string.
+*
+* Useful for creating searchable, unique fingerprints of sensitive data
+* (e.g., an API key) without storing the plaintext.
+*
+* Uses a dedicated HMAC key from config. Falls back to the encryption key
+* if no separate HMAC key is configured.
+*
+* @example
+* import { hmacHash } from "@warlock.js/core";
+*
+* const fingerprint = hmacHash("sk-proj-12345");
+* // Store `fingerprint` in DB for lookups, store encrypted value separately
+*/
+function hmacHash(plainText) {
+	if (!plainText) return plainText;
+	const hmacKey = config.key("encryption.hmacKey") || config.key("encryption.key");
+	if (!hmacKey) throw new Error("Missing HMAC key. Set 'encryption.hmacKey' (or 'encryption.key') in your config.");
+	const keyBuffer = Buffer.from(hmacKey, "hex");
+	return crypto.createHmac("sha256", keyBuffer).update(plainText).digest("hex");
+}
+
+//#endregion
+export { hmacHash };
+//# sourceMappingURL=hash.mjs.map

package/esm/encryption/hash.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.mjs","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/hash.ts"],"sourcesContent":["import crypto from \"crypto\";\nimport { config } from \"../config\";\nimport { EncryptionConfigurations } from \"./types\";\n\n/**\n * Creates a deterministic HMAC-SHA256 hash of the given string.\n *\n * Useful for creating searchable, unique fingerprints of sensitive data\n * (e.g., an API key) without storing the plaintext.\n *\n * Uses a dedicated HMAC key from config. Falls back to the encryption key\n * if no separate HMAC key is configured.\n *\n * @example\n * import { hmacHash } from \"@warlock.js/core\";\n *\n * const fingerprint = hmacHash(\"sk-proj-12345\");\n * // Store `fingerprint` in DB for lookups, store encrypted value separately\n */\nexport function hmacHash(plainText: string): string {\n  if (!plainText) return plainText;\n\n  const hmacKey =\n    config.key<EncryptionConfigurations[\"hmacKey\"]>(\"encryption.hmacKey\") ||\n    config.key<EncryptionConfigurations[\"key\"]>(\"encryption.key\");\n\n  if (!hmacKey) {\n    throw new Error(\n      \"Missing HMAC key. Set 'encryption.hmacKey' (or 'encryption.key') in your config.\",\n    );\n  }\n\n  const keyBuffer = Buffer.from(hmacKey, \"hex\");\n\n  return crypto.createHmac(\"sha256\", keyBuffer).update(plainText).digest(\"hex\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,SAAS,WAA2B;CAClD,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,UACJ,OAAO,IAAyC,oBAAoB,KACpE,OAAO,IAAqC,gBAAgB;CAE9D,IAAI,CAAC,SACH,MAAM,IAAI,MACR,kFACF;CAGF,MAAM,YAAY,OAAO,KAAK,SAAS,KAAK;CAE5C,OAAO,OAAO,WAAW,UAAU,SAAS,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC9E"}

package/esm/encryption/index.mjs

@@ -0,0 +1,5 @@
+import { decrypt, encrypt } from "./encrypt.mjs";
+import { hmacHash } from "./hash.mjs";
+import { hashPassword, verifyPassword } from "./password.mjs";
+
+export {  };

package/esm/encryption/password.d.mts

@@ -0,0 +1,26 @@
+//#region ../../@warlock.js/core/src/encryption/password.d.ts
+/**
+ * Hashes a password using bcrypt (async — does not block the event loop).
+ *
+ * Salt rounds are read from \`encryption.password.saltRounds\` config,
+ * defaulting to 12.
+ *
+ * @example
+ * import { hashPassword } from "@warlock.js/core";
+ *
+ * const hashed = await hashPassword("user-password-123");
+ * // Store \`hashed\` in the database
+ */
+declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verifies a plain password against a bcrypt hash (async — does not block the event loop).
+ *
+ * @example
+ * import { verifyPassword } from "@warlock.js/core";
+ *
+ * const isValid = await verifyPassword("user-password-123", storedHash);
+ */
+declare function verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean>;
+//#endregion
+export { hashPassword, verifyPassword };
+//# sourceMappingURL=password.d.mts.map

package/esm/encryption/password.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.mts","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/password.ts"],"mappings":";;AA6DA;;;;AAA6D;AAqB7D;;;;;;iBArBsB,YAAA,CAAa,QAAA,WAAmB,OAAO;;AAwBnD;;;;;;;iBAHY,cAAA,CACpB,aAAA,UACA,cAAA,WACC,OAAO"}

package/esm/encryption/password.mjs

@@ -0,0 +1,73 @@
+import { config } from "../config/config-getter.mjs";
+import "../config/index.mjs";
+
+//#region ../../@warlock.js/core/src/encryption/password.ts
+/**
+* Default bcrypt salt rounds.
+*/
+const DEFAULT_SALT_ROUNDS = 12;
+/**
+* Cached bcryptjs module (loaded once, reused)
+*/
+let Bcryptjs;
+let isModuleExists = null;
+/**
+* Installation instructions for bcryptjs package
+*/
+const BCRYPTJS_INSTALL_INSTRUCTIONS = `
+Password encryption requires the bcryptjs package.
+Install it with:
+
+  yarn add bcryptjs
+
+Or with your preferred package manager:
+
+  npm install bcryptjs
+  pnpm add bcryptjs
+  yarn add bcryptjs
+`.trim();
+/**
+* Load bcryptjs module
+*/
+async function loadBcryptjs() {
+	try {
+		Bcryptjs = await import("bcryptjs");
+		isModuleExists = true;
+	} catch {
+		isModuleExists = false;
+	}
+}
+loadBcryptjs();
+/**
+* Hashes a password using bcrypt (async — does not block the event loop).
+*
+* Salt rounds are read from \`encryption.password.saltRounds\` config,
+* defaulting to 12.
+*
+* @example
+* import { hashPassword } from "@warlock.js/core";
+*
+* const hashed = await hashPassword("user-password-123");
+* // Store \`hashed\` in the database
+*/
+async function hashPassword(password) {
+	if (!isModuleExists) throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);
+	const saltRounds = config.key("encryption.password.salt", DEFAULT_SALT_ROUNDS);
+	return Bcryptjs.hash(String(password), saltRounds);
+}
+/**
+* Verifies a plain password against a bcrypt hash (async — does not block the event loop).
+*
+* @example
+* import { verifyPassword } from "@warlock.js/core";
+*
+* const isValid = await verifyPassword("user-password-123", storedHash);
+*/
+async function verifyPassword(plainPassword, hashedPassword) {
+	if (!isModuleExists) throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);
+	return Bcryptjs.compare(String(plainPassword), String(hashedPassword));
+}
+
+//#endregion
+export { hashPassword, verifyPassword };
+//# sourceMappingURL=password.mjs.map

package/esm/encryption/password.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.mjs","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/password.ts"],"sourcesContent":["import { config } from \"../config\";\r\nimport { EncryptionPasswordConfigurations } from \"./types\";\r\n\r\n/**\r\n * Default bcrypt salt rounds.\r\n */\r\nconst DEFAULT_SALT_ROUNDS = 12;\r\n\r\n// ============================================================\r\n// Lazy-loaded bcryptjs SDK Types\r\n// ============================================================\r\n\r\n/**\r\n * Cached bcryptjs module (loaded once, reused)\r\n */\r\nlet Bcryptjs: typeof import(\"bcryptjs\");\r\n\r\nlet isModuleExists: boolean | null = null;\r\n\r\n/**\r\n * Installation instructions for bcryptjs package\r\n */\r\nconst BCRYPTJS_INSTALL_INSTRUCTIONS = `\r\nPassword encryption requires the bcryptjs package.\r\nInstall it with:\r\n\r\n  yarn add bcryptjs\r\n\r\nOr with your preferred package manager:\r\n\r\n  npm install bcryptjs\r\n  pnpm add bcryptjs\r\n  yarn add bcryptjs\r\n`.trim();\r\n\r\n/**\r\n * Load bcryptjs module\r\n */\r\nasync function loadBcryptjs() {\r\n  try {\r\n    Bcryptjs = await import(\"bcryptjs\");\r\n    isModuleExists = true;\r\n  } catch {\r\n    isModuleExists = false;\r\n  }\r\n}\r\n\r\nloadBcryptjs();\r\n\r\n/**\r\n * Hashes a password using bcrypt (async — does not block the event loop).\r\n *\r\n * Salt rounds are read from \\`encryption.password.saltRounds\\` config,\r\n * defaulting to 12.\r\n *\r\n * @example\r\n * import { hashPassword } from \"@warlock.js/core\";\r\n *\r\n * const hashed = await hashPassword(\"user-password-123\");\r\n * // Store \\`hashed\\` in the database\r\n */\r\nexport async function hashPassword(password: string): Promise<string> {\r\n  if (!isModuleExists) {\r\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\r\n  }\r\n\r\n  const saltRounds = config.key<EncryptionPasswordConfigurations[\"salt\"]>(\r\n    \"encryption.password.salt\",\r\n    DEFAULT_SALT_ROUNDS,\r\n  )!;\r\n\r\n  return Bcryptjs.hash(String(password), saltRounds);\r\n}\r\n\r\n/**\r\n * Verifies a plain password against a bcrypt hash (async — does not block the event loop).\r\n *\r\n * @example\r\n * import { verifyPassword } from \"@warlock.js/core\";\r\n *\r\n * const isValid = await verifyPassword(\"user-password-123\", storedHash);\r\n */\r\nexport async function verifyPassword(\r\n  plainPassword: string,\r\n  hashedPassword: string,\r\n): Promise<boolean> {\r\n  if (!isModuleExists) {\r\n    throw new Error(BCRYPTJS_INSTALL_INSTRUCTIONS);\r\n  }\r\n\r\n  return Bcryptjs.compare(String(plainPassword), String(hashedPassword));\r\n}\r\n"],"mappings":";;;;;;;AAMA,MAAM,sBAAsB;;;;AAS5B,IAAI;AAEJ,IAAI,iBAAiC;;;;AAKrC,MAAM,gCAAgC;;;;;;;;;;;EAWpC,KAAK;;;;AAKP,eAAe,eAAe;CAC5B,IAAI;EACF,WAAW,MAAM,OAAO;EACxB,iBAAiB;CACnB,QAAQ;EACN,iBAAiB;CACnB;AACF;AAEA,aAAa;;;;;;;;;;;;;AAcb,eAAsB,aAAa,UAAmC;CACpE,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,MAAM,aAAa,OAAO,IACxB,4BACA,mBACF;CAEA,OAAO,SAAS,KAAK,OAAO,QAAQ,GAAG,UAAU;AACnD;;;;;;;;;AAUA,eAAsB,eACpB,eACA,gBACkB;CAClB,IAAI,CAAC,gBACH,MAAM,IAAI,MAAM,6BAA6B;CAG/C,OAAO,SAAS,QAAQ,OAAO,aAAa,GAAG,OAAO,cAAc,CAAC;AACvE"}

package/esm/encryption/types.d.mts

@@ -0,0 +1,54 @@
+//#region ../../@warlock.js/core/src/encryption/types.d.ts
+/**
+ * Configuration for the encryption module.
+ *
+ * @example
+ * // src/config/encryption.ts
+ * import type { EncryptionConfigurations } from "@warlock.js/core";
+ * import { env } from "@warlock.js/core";
+ *
+ * const encryptionConfig: EncryptionConfigurations = {
+ *   key: env("APP_ENCRYPTION_KEY"),
+ *   algorithm: "aes-256-gcm",
+ *   hmacKey: env("APP_HMAC_KEY"),
+ *   password: {
+ *     salt: 12,
+ *   },
+ * };
+ *
+ * export default encryptionConfig;
+ */
+type EncryptionConfigurations = {
+  /**
+   * 32-byte hex-encoded encryption key (64 hex characters).
+   * Used by encrypt() and decrypt().
+   * Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+   */
+  key: string;
+  /**
+   * Encryption algorithm to use.
+   * Defaults to "aes-256-gcm" if not set.
+   */
+  algorithm?: string;
+  /**
+   * Separate HMAC key (hex-encoded) for hmacHash().
+   * Falls back to `key` if not provided.
+   * Best practice: keep these separate.
+   * Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+   */
+  hmacKey?: string;
+  /**
+   * Password hashing configuration (bcrypt).
+   */
+  password?: EncryptionPasswordConfigurations;
+};
+type EncryptionPasswordConfigurations = {
+  /**
+   * bcrypt salt rounds. Higher = slower and more secure.
+   * 10–12 is the standard range. Defaults to 12.
+   */
+  salt?: number;
+};
+//#endregion
+export { EncryptionConfigurations, EncryptionPasswordConfigurations };
+//# sourceMappingURL=types.d.mts.map

package/esm/encryption/types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../@warlock.js/core/src/encryption/types.ts"],"mappings":";;AAmBA;;;;;;;;;;AAyB6C;AAG7C;;;;AAKM;;;KAjCM,wBAAA;;;;;;EAMV,GAAA;;;;;EAMA,SAAA;;;;;;;EAQA,OAAA;;;;EAKA,QAAA,GAAW,gCAAgC;AAAA;AAAA,KAGjC,gCAAA;;;;;EAKV,IAAI;AAAA"}