@zudojs/auth 0.0.1

package/dist/authErrors/authError.base.js

@@ -0,0 +1,108 @@
+/**
+ * Authentication and authorization error classes.
+ *
+ * @module authErrors
+ */
+import { BaseError, ErrorCode, ErrorCategory, ErrorSeverity, } from "@zudojs/errors";
+/**
+ * Base error for all auth-related failures.
+ */
+export class AuthError extends BaseError {
+    constructor(message, options) {
+        super(message, {
+            code: options?.code ?? ErrorCode.AUTHENTICATION,
+            category: ErrorCategory.AUTHENTICATION,
+            severity: ErrorSeverity.ERROR,
+            metadata: options?.metadata,
+            cause: options?.cause,
+        });
+    }
+}
+/**
+ * Invalid credentials (wrong password, unknown user).
+ */
+export class InvalidCredentialsError extends AuthError {
+    constructor(message = "Invalid credentials") {
+        super(message, { code: ErrorCode.INVALID_CREDENTIALS });
+    }
+}
+/**
+ * Token has expired.
+ */
+export class TokenExpiredError extends AuthError {
+    constructor(message = "Token has expired") {
+        super(message, { code: ErrorCode.TOKEN_EXPIRED });
+    }
+}
+/**
+ * Token is invalid or malformed.
+ */
+export class TokenInvalidError extends AuthError {
+    constructor(message = "Token is invalid") {
+        super(message, { code: ErrorCode.TOKEN_INVALID });
+    }
+}
+/**
+ * Token has been revoked.
+ */
+export class TokenRevokedError extends AuthError {
+    constructor(message = "Token has been revoked") {
+        super(message, { code: ErrorCode.FORBIDDEN });
+    }
+}
+/**
+ * User account is locked (too many failed attempts).
+ */
+export class AccountLockedError extends AuthError {
+    constructor(message = "Account is locked due to too many failed attempts", options) {
+        super(message, {
+            code: ErrorCode.FORBIDDEN,
+            metadata: {
+                retryAfterSeconds: options?.retryAfterSeconds ?? 900,
+            },
+        });
+    }
+}
+/**
+ * User account is deactivated.
+ */
+export class AccountDeactivatedError extends AuthError {
+    constructor(message = "User account is deactivated") {
+        super(message, { code: ErrorCode.FORBIDDEN });
+    }
+}
+/**
+ * Access denied (insufficient permissions).
+ */
+export class AccessDeniedError extends AuthError {
+    constructor(message = "Access denied", options) {
+        super(message, {
+            code: ErrorCode.ACCESS_DENIED,
+            metadata: {
+                requiredPermission: options?.requiredPermission,
+            },
+        });
+    }
+}
+/**
+ * Session has expired or is invalid.
+ */
+export class SessionExpiredError extends AuthError {
+    constructor(message = "Session has expired") {
+        super(message, { code: ErrorCode.SESSION_EXPIRED });
+    }
+}
+/**
+ * Rate limit exceeded for auth endpoint.
+ */
+export class AuthRateLimitError extends AuthError {
+    constructor(message = "Too many authentication attempts", options) {
+        super(message, {
+            code: ErrorCode.RATE_LIMITED,
+            metadata: {
+                retryAfterSeconds: options?.retryAfterSeconds ?? 60,
+            },
+        });
+    }
+}
+//# sourceMappingURL=authError.base.js.map

package/dist/authErrors/authError.base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authError.base.js","sourceRoot":"","sources":["../../src/authErrors/authError.base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,GAEd,MAAM,gBAAgB,CAAC;AAExB;;GAEG;AACH,MAAM,OAAO,SAAU,SAAQ,SAAS;IACtC,YACE,OAAe,EACf,OAIC;QAED,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,cAAc;YAC/C,QAAQ,EAAE,aAAa,CAAC,cAAc;YACtC,QAAQ,EAAE,aAAa,CAAC,KAAK;YAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,KAAK,EAAE,OAAO,EAAE,KAAK;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAO,GAAG,mBAAmB;QACvC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAO,GAAG,kBAAkB;QACtC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IACpD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAO,GAAG,wBAAwB;QAC5C,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YACE,OAAO,GAAG,mDAAmD,EAC7D,OAAiD;QAEjD,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,SAAS,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACR,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,GAAG;aACpC;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD,YAAY,OAAO,GAAG,6BAA6B;QACjD,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,SAAS;IAC9C,YACE,OAAO,GAAG,eAAe,EACzB,OAAkD;QAElD,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,SAAS,CAAC,aAAa;YAC7B,QAAQ,EAAE;gBACR,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;aAC/B;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;IACtD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YACE,OAAO,GAAG,kCAAkC,EAC5C,OAAiD;QAEjD,KAAK,CAAC,OAAO,EAAE;YACb,IAAI,EAAE,SAAS,CAAC,YAAY;YAC5B,QAAQ,EAAE;gBACR,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE;aACnC;SACnB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/authErrors/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Authentication and authorization error types.
+ *
+ * @module authErrors
+ */
+export { AuthError, InvalidCredentialsError, TokenExpiredError, TokenInvalidError, TokenRevokedError, AccountLockedError, AccountDeactivatedError, AccessDeniedError, SessionExpiredError, AuthRateLimitError, } from "./authError.base.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/authErrors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authErrors/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/authErrors/index.js

@@ -0,0 +1,7 @@
+/**
+ * Authentication and authorization error types.
+ *
+ * @module authErrors
+ */
+export { AuthError, InvalidCredentialsError, TokenExpiredError, TokenInvalidError, TokenRevokedError, AccountLockedError, AccountDeactivatedError, AccessDeniedError, SessionExpiredError, AuthRateLimitError, } from "./authError.base.js";
+//# sourceMappingURL=index.js.map

package/dist/authErrors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authErrors/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,SAAS,EACT,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/authPassword/authPassword.core.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Password hashing and verification using Node.js crypto scrypt.
+ *
+ * @module authPassword/authPassword
+ *
+ * Uses scrypt with salt for secure password hashing.
+ * Compatible with Node.js ≥ 24 (no external dependencies).
+ */
+/**
+ * Hash a plain-text password.
+ *
+ * @param password - Plain-text password
+ * @param saltLength - Salt length in bytes (default: 32)
+ * @returns Hashed password string in format "scrypt$salt$hash"
+ */
+export declare function hashPassword(password: string, saltLength?: number): Promise<string>;
+/**
+ * Verify a plain-text password against a hash.
+ *
+ * @param password - Plain-text password to verify
+ * @param hashedPassword - Previously hashed password
+ * @returns Whether the password matches
+ */
+export declare function verifyPassword(password: string, hashedPassword: string): Promise<boolean>;
+/**
+ * Check if a password hash needs rehashing (e.g. after salt length change).
+ *
+ * @param hashedPassword - The stored hash
+ * @returns Whether the hash should be regenerated
+ */
+export declare function needsRehash(hashedPassword: string): boolean;
+/**
+ * Generate a random token string (for password reset, etc.).
+ *
+ * @param length - Token length in bytes (default: 32)
+ * @returns Hex-encoded random string
+ */
+export declare function generateRandomToken(length?: number): string;
+//# sourceMappingURL=authPassword.core.d.ts.map

package/dist/authPassword/authPassword.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPassword.core.d.ts","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAE/D"}

package/dist/authPassword/authPassword.core.js

@@ -0,0 +1,86 @@
+/**
+ * Password hashing and verification using Node.js crypto scrypt.
+ *
+ * @module authPassword/authPassword
+ *
+ * Uses scrypt with salt for secure password hashing.
+ * Compatible with Node.js ≥ 24 (no external dependencies).
+ */
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+/** Default salt length in bytes. */
+const SALT_LENGTH = 32;
+/** Default key length for scrypt. */
+const KEY_LENGTH = 64;
+/** Scrypt parameters (N, r, p). */
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+/**
+ * Hash a plain-text password.
+ *
+ * @param password - Plain-text password
+ * @param saltLength - Salt length in bytes (default: 32)
+ * @returns Hashed password string in format "scrypt$salt$hash"
+ */
+export async function hashPassword(password, saltLength = SALT_LENGTH) {
+    const salt = randomBytes(saltLength).toString("hex");
+    const derivedKey = await deriveKey(password, salt);
+    return `scrypt${salt}$${derivedKey}`;
+}
+/**
+ * Verify a plain-text password against a hash.
+ *
+ * @param password - Plain-text password to verify
+ * @param hashedPassword - Previously hashed password
+ * @returns Whether the password matches
+ */
+export async function verifyPassword(password, hashedPassword) {
+    const parts = hashedPassword.split("$");
+    if (parts.length !== 2 || !parts[0].startsWith("scrypt")) {
+        return false;
+    }
+    const salt = parts[0].slice(6);
+    const storedHash = parts[1];
+    const derivedKey = await deriveKey(password, salt);
+    const storedBuffer = Buffer.from(storedHash, "hex");
+    const derivedBuffer = Buffer.from(derivedKey, "hex");
+    if (storedBuffer.length !== derivedBuffer.length) {
+        return false;
+    }
+    return timingSafeEqual(storedBuffer, derivedBuffer);
+}
+/**
+ * Check if a password hash needs rehashing (e.g. after salt length change).
+ *
+ * @param hashedPassword - The stored hash
+ * @returns Whether the hash should be regenerated
+ */
+export function needsRehash(hashedPassword) {
+    const parts = hashedPassword.split("$");
+    if (parts.length !== 2 || !parts[0].startsWith("scrypt")) {
+        return true;
+    }
+    const salt = parts[0].slice(6);
+    const saltBytes = salt.length / 2;
+    return saltBytes !== SALT_LENGTH;
+}
+/**
+ * Generate a random token string (for password reset, etc.).
+ *
+ * @param length - Token length in bytes (default: 32)
+ * @returns Hex-encoded random string
+ */
+export function generateRandomToken(length = 32) {
+    return randomBytes(length).toString("hex");
+}
+function deriveKey(password, salt) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, KEY_LENGTH, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, derivedKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve(derivedKey.toString("hex"));
+        });
+    });
+}
+//# sourceMappingURL=authPassword.core.js.map

package/dist/authPassword/authPassword.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPassword.core.js","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE,oCAAoC;AACpC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,qCAAqC;AACrC,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,mCAAmC;AACnC,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAAU,GAAW,WAAW;IAEhC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,SAAS,IAAI,IAAI,UAAU,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,cAAsB;IAEtB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,cAAsB;IAChD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,OAAO,SAAS,KAAK,WAAW,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAW,EAAE;IACrD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EACzC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAClB,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/authPassword/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Password hashing and verification utilities.
+ *
+ * @module authPassword
+ */
+export { hashPassword, verifyPassword, needsRehash, generateRandomToken, } from "./authPassword.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/authPassword/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authPassword/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,GACpB,MAAM,wBAAwB,CAAC"}

package/dist/authPassword/index.js

@@ -0,0 +1,7 @@
+/**
+ * Password hashing and verification utilities.
+ *
+ * @module authPassword
+ */
+export { hashPassword, verifyPassword, needsRehash, generateRandomToken, } from "./authPassword.core.js";
+//# sourceMappingURL=index.js.map

package/dist/authPassword/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authPassword/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,GACpB,MAAM,wBAAwB,CAAC"}

package/dist/authProvider/authProvider.core.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Main auth service — coordinates password, token, session, and permissions.
+ *
+ * @module authProvider/authProvider
+ */
+import type { AuthUser, UserCredentials, UserId } from "../authTypes/authUser.type.js";
+import type { TokenPair, TokenConfig } from "../authTypes/authToken.type.js";
+import type { SessionStore, SessionId } from "../authTypes/authSession.type.js";
+import type { GuardResult } from "../authTypes/authRbac.type.js";
+import type { PermissionEngine } from "@zudojs/permissions";
+/** User lookup function provided by the consumer. */
+export type UserLookup = (identifier: string) => Promise<AuthUser | null>;
+/** Password verifier function provided by the consumer. */
+export type PasswordVerifier = (userId: UserId, password: string) => Promise<boolean>;
+/**
+ * Auth service configuration.
+ */
+export interface AuthServiceConfig {
+    /** JWT token configuration */
+    readonly token: TokenConfig;
+    /** Session store */
+    readonly sessionStore: SessionStore;
+    /** User lookup function */
+    readonly findUser: UserLookup;
+    /** Password verifier function */
+    readonly verifyPassword: PasswordVerifier;
+    /** Session TTL in seconds */
+    readonly sessionTtlSeconds: number;
+    /** Optional permission engine */
+    readonly permissions?: PermissionEngine;
+}
+/**
+ * Auth service interface.
+ */
+export interface AuthService {
+    login(credentials: UserCredentials, context?: {
+        readonly userAgent?: string;
+        readonly ip?: string;
+    }): Promise<LoginResult>;
+    verifyToken(token: string): Record<string, unknown>;
+    refresh(refreshToken: string): Promise<TokenPair>;
+    logout(sessionId: SessionId): Promise<void>;
+    checkAccess(userId: UserId, userRoles: readonly string[], permission: string, resourceOwnerId?: UserId): Promise<GuardResult>;
+    hashPassword(password: string): Promise<string>;
+    verifyPasswordHash(password: string, hash: string): Promise<boolean>;
+}
+/**
+ * Result of a login attempt.
+ */
+export interface LoginResult {
+    /** Authenticated user */
+    readonly user: AuthUser;
+    /** Token pair */
+    readonly tokens: TokenPair;
+    /** Session ID */
+    readonly sessionId: SessionId;
+}
+/**
+ * Create an auth service.
+ */
+export declare function createAuthService(config: AuthServiceConfig): AuthService;
+//# sourceMappingURL=authProvider.core.d.ts.map

package/dist/authProvider/authProvider.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authProvider.core.d.ts","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,MAAM,EACP,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EACV,YAAY,EAEZ,SAAS,EACV,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgB5D,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAC1E,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,oBAAoB;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,6BAA6B;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iCAAiC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CACH,WAAW,EAAE,eAAe,EAC5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iBAAiB;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iBAAiB;IACjB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAqHxE"}

package/dist/authProvider/authProvider.core.js

@@ -0,0 +1,125 @@
+/**
+ * Main auth service — coordinates password, token, session, and permissions.
+ *
+ * @module authProvider/authProvider
+ */
+import { hashPassword, verifyPassword, } from "../authPassword/authPassword.core.js";
+import { createTokenPair, verifyAccessToken, refreshAccessToken, } from "../authToken/authToken.core.js";
+import { InvalidCredentialsError, TokenExpiredError, AccountDeactivatedError, } from "../authErrors/authError.base.js";
+/**
+ * Create an auth service.
+ */
+export function createAuthService(config) {
+    const { token: tokenConfig, sessionStore, findUser, verifyPassword: verifyPwd, sessionTtlSeconds, permissions, } = config;
+    return {
+        /**
+         * Authenticate a user with credentials and return tokens + session.
+         */
+        async login(credentials, context) {
+            const user = await findUser(credentials.identifier);
+            if (!user) {
+                throw new InvalidCredentialsError();
+            }
+            if (!user.active) {
+                throw new AccountDeactivatedError();
+            }
+            const valid = await verifyPwd(user.id, credentials.password);
+            if (!valid) {
+                throw new InvalidCredentialsError();
+            }
+            const tokens = createTokenPair(user.id, tokenConfig, {
+                roles: user.roles,
+            });
+            const session = await sessionStore.create({
+                userId: user.id,
+                userAgent: context?.userAgent,
+                ip: context?.ip,
+                ttlSeconds: sessionTtlSeconds,
+            });
+            return { user, tokens, sessionId: session.id };
+        },
+        /**
+         * Verify an access token and return the payload.
+         */
+        verifyToken(token) {
+            const result = verifyAccessToken(token, tokenConfig);
+            if (!result.valid) {
+                throw new TokenExpiredError(result.error ?? "Token verification failed");
+            }
+            return result.payload;
+        },
+        /**
+         * Refresh an access token using a refresh token.
+         */
+        async refresh(refreshToken) {
+            const result = refreshAccessToken(refreshToken, tokenConfig);
+            if (!result) {
+                throw new TokenExpiredError("Refresh token is invalid or expired");
+            }
+            return result;
+        },
+        /**
+         * Logout — destroy the session.
+         */
+        async logout(sessionId) {
+            await sessionStore.destroy(sessionId);
+        },
+        /**
+         * Check if a user has a specific permission.
+         * Delegates to @zudojs/permissions engine when configured.
+         */
+        async checkAccess(userId, userRoles, permission, resourceOwnerId) {
+            if (permissions) {
+                const actor = { id: userId, roles: [...userRoles] };
+                const resource = resourceOwnerId
+                    ? { ownerId: resourceOwnerId }
+                    : undefined;
+                const decision = await permissions.check(actor, permission, resource);
+                return {
+                    allowed: decision.allowed,
+                    reason: decision.reason,
+                    requiredPermission: permission,
+                    userRoles: [...userRoles],
+                };
+            }
+            // Fallback: simple wildcard matching (no engine configured)
+            return simpleGuard(userRoles, permission, userId, resourceOwnerId);
+        },
+        /**
+         * Hash a password (for user registration).
+         */
+        hashPassword(password) {
+            return hashPassword(password);
+        },
+        /**
+         * Verify a password against a hash.
+         */
+        verifyPasswordHash(password, hash) {
+            return verifyPassword(password, hash);
+        },
+    };
+}
+/**
+ * Simple fallback guard when no permissions engine is configured.
+ * Performs basic wildcard matching without full ABAC support.
+ */
+function simpleGuard(userRoles, permission, userId, resourceOwnerId) {
+    // Ownership check
+    if (resourceOwnerId && resourceOwnerId === userId) {
+        return { allowed: true, userRoles: [...userRoles] };
+    }
+    const [requiredResource, requiredAction] = permission.split(":");
+    for (const role of userRoles) {
+        // Role-based — simplified check
+        if (role === "admin") {
+            return { allowed: true, userRoles: [...userRoles] };
+        }
+    }
+    return {
+        allowed: false,
+        reason: `User lacks required permission: ${permission}`,
+        requiredPermission: permission,
+        userRoles: [...userRoles],
+    };
+}
+//# sourceMappingURL=authProvider.core.js.map

package/dist/authProvider/authProvider.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authProvider.core.js","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EACL,YAAY,EACZ,cAAc,GACf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AA6DzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,EACJ,KAAK,EAAE,WAAW,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EAAE,SAAS,EACzB,iBAAiB,EACjB,WAAW,GACZ,GAAG,MAAM,CAAC;IAEX,OAAO;QACL;;WAEG;QACH,KAAK,CAAC,KAAK,CACT,WAA4B,EAC5B,OAA+D;YAE/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,UAAU,EAAE,iBAAiB;aAC9B,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QAED;;WAEG;QACH,WAAW,CAAC,KAAa;YACvB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,KAAK,IAAI,2BAA2B,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAQ,CAAC;QACzB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,OAAO,CAAC,YAAoB;YAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,MAAM,CAAC,SAAoB;YAC/B,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,SAA4B,EAC5B,UAAkB,EAClB,eAAwB;YAExB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,eAAe;oBAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,kBAAkB,EAAE,UAAU;oBAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;iBAC1B,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,OAAO,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED;;WAEG;QACH,YAAY,CAAC,QAAgB;YAC3B,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED;;WAEG;QACH,kBAAkB,CAAC,QAAgB,EAAE,IAAY;YAC/C,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,SAA4B,EAC5B,UAAkB,EAClB,MAAc,EACd,eAAwB;IAExB,kBAAkB;IAClB,IAAI,eAAe,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,gCAAgC;QAChC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,mCAAmC,UAAU,EAAE;QACvD,kBAAkB,EAAE,UAAU;QAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/authProvider/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Main auth service: login, token verification, RBAC checks.
+ *
+ * @module authProvider
+ */
+export { createAuthService, type AuthServiceConfig, type LoginResult, type UserLookup, type PasswordVerifier, } from "./authProvider.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/authProvider/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authProvider/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/authProvider/index.js

@@ -0,0 +1,7 @@
+/**
+ * Main auth service: login, token verification, RBAC checks.
+ *
+ * @module authProvider
+ */
+export { createAuthService, } from "./authProvider.core.js";
+//# sourceMappingURL=index.js.map

package/dist/authProvider/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authProvider/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC"}

package/dist/authSession/authSession.core.d.ts

@@ -0,0 +1,16 @@
+/**
+ * In-memory session store implementation.
+ *
+ * @module authSession/authSession
+ *
+ * For production, implement SessionStore backed by Redis, database, etc.
+ */
+import type { SessionStore } from "../authTypes/authSession.type.js";
+/**
+ * Create an in-memory session store.
+ *
+ * Good for development and testing. For production,
+ * implement SessionStore with Redis or a database.
+ */
+export declare function createMemorySessionStore(): SessionStore;
+//# sourceMappingURL=authSession.core.d.ts.map

package/dist/authSession/authSession.core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSession.core.d.ts","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,kCAAkC,CAAC;AAM1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,YAAY,CA0DvD"}

package/dist/authSession/authSession.core.js

@@ -0,0 +1,73 @@
+/**
+ * In-memory session store implementation.
+ *
+ * @module authSession/authSession
+ *
+ * For production, implement SessionStore backed by Redis, database, etc.
+ */
+import { randomBytes } from "node:crypto";
+const DEFAULT_TTL_SECONDS = 86400; // 24 hours
+/**
+ * Create an in-memory session store.
+ *
+ * Good for development and testing. For production,
+ * implement SessionStore with Redis or a database.
+ */
+export function createMemorySessionStore() {
+    const sessions = new Map();
+    return {
+        async create(options) {
+            const id = generateSessionId();
+            const now = new Date();
+            const ttlMs = (options.ttlSeconds ?? DEFAULT_TTL_SECONDS) * 1000;
+            const session = {
+                id,
+                userId: options.userId,
+                userAgent: options.userAgent,
+                ip: options.ip,
+                createdAt: now,
+                lastActivityAt: now,
+                expiresAt: new Date(now.getTime() + ttlMs),
+                active: true,
+                metadata: options.metadata,
+            };
+            sessions.set(id, session);
+            return session;
+        },
+        async get(sessionId) {
+            const session = sessions.get(sessionId);
+            if (!session)
+                return null;
+            if (!session.active)
+                return null;
+            if (new Date() > session.expiresAt) {
+                sessions.delete(sessionId);
+                return null;
+            }
+            return session;
+        },
+        async touch(sessionId) {
+            const session = sessions.get(sessionId);
+            if (session && session.active) {
+                sessions.set(sessionId, {
+                    ...session,
+                    lastActivityAt: new Date(),
+                });
+            }
+        },
+        async destroy(sessionId) {
+            sessions.delete(sessionId);
+        },
+        async destroyAllForUser(userId) {
+            for (const [id, session] of sessions) {
+                if (session.userId === userId) {
+                    sessions.delete(id);
+                }
+            }
+        },
+    };
+}
+function generateSessionId() {
+    return randomBytes(32).toString("hex");
+}
+//# sourceMappingURL=authSession.core.js.map

package/dist/authSession/authSession.core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSession.core.js","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,WAAW;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAA6B;YACxC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;YAEjE,MAAM,OAAO,GAAgB;gBAC3B,EAAE;gBACF,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,GAAG;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YAEF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAoB;YAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAoB;YAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;oBACtB,GAAG,OAAO;oBACV,cAAc,EAAE,IAAI,IAAI,EAAE;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAoB;YAChC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;YACpC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAc,CAAC;AACtD,CAAC"}

package/dist/authSession/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Session management: creation, storage, and lifecycle.
+ *
+ * @module authSession
+ */
+export { createMemorySessionStore } from "./authSession.core.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/authSession/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authSession/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/authSession/index.js

@@ -0,0 +1,7 @@
+/**
+ * Session management: creation, storage, and lifecycle.
+ *
+ * @module authSession
+ */
+export { createMemorySessionStore } from "./authSession.core.js";
+//# sourceMappingURL=index.js.map

package/dist/authSession/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authSession/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC"}