covara 0.0.1 → 0.6.0

package/dist/auth/totp.js

@@ -0,0 +1,126 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { hashPassword, verifyPassword } from "./password.js";
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export const base32Encode = (buffer) => {
+    let bits = 0;
+    let value = 0;
+    let output = "";
+    for (const byte of buffer) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 31];
+    }
+    return output;
+};
+export const base32Decode = (input) => {
+    const cleaned = input.replace(/=+$/, "").replace(/\s+/g, "").toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const char of cleaned) {
+        const idx = BASE32_ALPHABET.indexOf(char);
+        if (idx === -1) {
+            throw new Error("Invalid base32 character");
+        }
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+};
+const DEFAULT_STEP = 30;
+const DEFAULT_DIGITS = 6;
+export const generateTotpSecret = (byteLength = 20) => {
+    return base32Encode(randomBytes(byteLength));
+};
+const counterBuffer = (counter) => {
+    const buffer = Buffer.alloc(8);
+    buffer.writeBigUInt64BE(BigInt(counter));
+    return buffer;
+};
+const hotp = (secret, counter, digits) => {
+    const hmac = createHmac("sha1", secret).update(counterBuffer(counter)).digest();
+    const offset = hmac[hmac.length - 1] & 0xf;
+    const binary = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    const otp = binary % 10 ** digits;
+    return otp.toString().padStart(digits, "0");
+};
+export const generateTotp = (secret, options = {}) => {
+    const step = options.step ?? DEFAULT_STEP;
+    const digits = options.digits ?? DEFAULT_DIGITS;
+    const timestampMs = options.timestampMs ?? Date.now();
+    const counter = Math.floor(timestampMs / 1000 / step);
+    return hotp(base32Decode(secret), counter, digits);
+};
+export const verifyTotp = (secret, token, options = {}) => {
+    if (typeof token !== "string")
+        return false;
+    const trimmed = token.trim();
+    const step = options.step ?? DEFAULT_STEP;
+    const digits = options.digits ?? DEFAULT_DIGITS;
+    const window = options.window ?? 1;
+    if (trimmed.length !== digits || !/^\d+$/.test(trimmed))
+        return false;
+    const timestampMs = options.timestampMs ?? Date.now();
+    const counter = Math.floor(timestampMs / 1000 / step);
+    const secretBuffer = base32Decode(secret);
+    const candidate = Buffer.from(trimmed);
+    for (let offset = -window; offset <= window; offset++) {
+        const expected = Buffer.from(hotp(secretBuffer, counter + offset, digits));
+        if (expected.length === candidate.length && timingSafeEqual(expected, candidate)) {
+            return true;
+        }
+    }
+    return false;
+};
+export const getTotpUri = (params) => {
+    const digits = params.digits ?? DEFAULT_DIGITS;
+    const step = params.step ?? DEFAULT_STEP;
+    const label = params.issuer
+        ? `${encodeURIComponent(params.issuer)}:${encodeURIComponent(params.account)}`
+        : encodeURIComponent(params.account);
+    const query = new URLSearchParams({
+        secret: params.secret,
+        algorithm: "SHA1",
+        digits: String(digits),
+        period: String(step),
+    });
+    if (params.issuer) {
+        query.set("issuer", params.issuer);
+    }
+    return `otpauth://totp/${label}?${query.toString()}`;
+};
+const formatBackupCode = (raw) => {
+    const hex = raw.toString("hex").slice(0, 10);
+    return `${hex.slice(0, 5)}-${hex.slice(5, 10)}`;
+};
+export const generateBackupCodes = async (count = 10) => {
+    const codes = [];
+    for (let i = 0; i < count; i++) {
+        codes.push(formatBackupCode(randomBytes(5)));
+    }
+    const hashes = await Promise.all(codes.map((code) => hashPassword(code)));
+    return { codes, hashes };
+};
+export const verifyBackupCode = async (code, hashes) => {
+    const normalized = code.trim();
+    for (let i = 0; i < hashes.length; i++) {
+        if (await verifyPassword(normalized, hashes[i])) {
+            return { matched: true, index: i };
+        }
+    }
+    return { matched: false, index: -1 };
+};
+//# sourceMappingURL=totp.js.map

package/dist/auth/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE;IACrD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC,CAAC;AAQF,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,GAAG,EAAE,EAAU,EAAE;IAC5D,OAAO,YAAY,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,MAAc,EAAU,EAAE;IACvE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAC3C,MAAM,MAAM,GACV,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC;IAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,MAAc,EACd,UAAkD,EAAE,EAC5C,EAAE;IACV,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EACd,KAAa,EACb,UAAkD,EAAE,EAC3C,EAAE;IACX,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEvC,KAAK,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAqB,EAAU,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM;QACzB,CAAC,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC9E,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,kBAAkB,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC,CAAC;AAOF,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAU,EAAE;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,KAAK,GAAG,EAAE,EAA8B,EAAE;IAClF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,IAAY,EACZ,MAAgB,EAC8B,EAAE;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AACvC,CAAC,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,82 @@
+import type { Context, Hono } from "hono";
+import { UserContext } from "../resource/types.js";
+export interface AuthCredentials {
+    type: "bearer" | "session" | "apiKey" | "basic";
+    token?: string;
+    apiKey?: string;
+    username?: string;
+    password?: string;
+    sessionId?: string;
+}
+export interface AuthResult {
+    success: boolean;
+    user?: UserContext;
+    error?: string;
+    expiresAt?: Date;
+}
+export interface SessionData {
+    id: string;
+    userId: string;
+    createdAt: Date;
+    expiresAt: Date;
+    data?: Record<string, unknown>;
+}
+export interface ApiKeyData {
+    id: string;
+    key: string;
+    userId: string;
+    name: string;
+    createdAt: Date;
+    expiresAt?: Date;
+    scopes?: string[];
+    lastUsedAt?: Date;
+}
+export interface AuthAdapter {
+    name: string;
+    extractCredentials(c: Context): AuthCredentials | null;
+    validateCredentials(credentials: AuthCredentials): Promise<AuthResult>;
+    getSession(token: string): Promise<SessionData | null>;
+    invalidateSession(token: string): Promise<void>;
+    getRoutes(): Hono;
+    refreshSession?(sessionId: string): Promise<SessionData | null>;
+    createSession?(userId: string, data?: Record<string, unknown>): Promise<SessionData>;
+    invalidateUserSessions?(userId: string, exceptSessionId?: string): Promise<void>;
+}
+export interface ResourceAuthConfig {
+    required?: boolean;
+    public?: {
+        read?: boolean;
+        subscribe?: boolean;
+    };
+    scopes?: {
+        read?: (user: UserContext) => string | Promise<string>;
+        create?: (user: UserContext) => string | Promise<string>;
+        update?: (user: UserContext) => string | Promise<string>;
+        delete?: (user: UserContext) => string | Promise<string>;
+        subscribe?: (user: UserContext) => string | Promise<string>;
+    };
+}
+export interface AuthMiddlewareOptions {
+    unauthorizedMessage?: string;
+    skipPaths?: string[];
+    extractCredentials?: (c: Context) => AuthCredentials | null;
+}
+export interface SessionStore {
+    get(sessionId: string): Promise<SessionData | null>;
+    set(sessionId: string, data: SessionData, ttlMs: number): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+    touch(sessionId: string, ttlMs: number): Promise<void>;
+    getAll?(): Promise<SessionData[]>;
+}
+export declare class InMemorySessionStore implements SessionStore {
+    private sessions;
+    get(sessionId: string): Promise<SessionData | null>;
+    set(sessionId: string, data: SessionData, ttlMs: number): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+    touch(sessionId: string, ttlMs: number): Promise<void>;
+    cleanup(): void;
+    getAll(): Promise<SessionData[]>;
+}
+export declare const isAuthenticated: (c: Context) => boolean;
+export declare const requireUser: (c: Context) => UserContext;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAAC;IACvD,mBAAmB,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,SAAS,IAAI,IAAI,CAAC;IAClB,cAAc,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrF,sBAAsB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KAC7D,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,kBAAkB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,eAAe,GAAG,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CACnC;AAED,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAA+D;IAEzE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAUnD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5D,OAAO,IAAI,IAAI;IAST,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;CAIvC;AAED,eAAO,MAAM,eAAe,GAAI,GAAG,OAAO,KAAG,OAE5C,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,KAAG,WAMxC,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1,53 @@
+export class InMemorySessionStore {
+    constructor() {
+        this.sessions = new Map();
+    }
+    async get(sessionId) {
+        const entry = this.sessions.get(sessionId);
+        if (!entry)
+            return null;
+        if (Date.now() > entry.expiresAt) {
+            this.sessions.delete(sessionId);
+            return null;
+        }
+        return entry.data;
+    }
+    async set(sessionId, data, ttlMs) {
+        this.sessions.set(sessionId, {
+            data,
+            expiresAt: Date.now() + ttlMs,
+        });
+    }
+    async delete(sessionId) {
+        this.sessions.delete(sessionId);
+    }
+    async touch(sessionId, ttlMs) {
+        const entry = this.sessions.get(sessionId);
+        if (entry) {
+            entry.expiresAt = Date.now() + ttlMs;
+        }
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [id, entry] of this.sessions) {
+            if (now > entry.expiresAt) {
+                this.sessions.delete(id);
+            }
+        }
+    }
+    async getAll() {
+        this.cleanup();
+        return Array.from(this.sessions.values()).map(entry => entry.data);
+    }
+}
+export const isAuthenticated = (c) => {
+    return c.get("user") !== undefined;
+};
+export const requireUser = (c) => {
+    const user = c.get("user");
+    if (!user) {
+        throw new Error("User not authenticated");
+    }
+    return user;
+};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AA+EA,MAAM,OAAO,oBAAoB;IAAjC;QACU,aAAQ,GAAG,IAAI,GAAG,EAAoD,CAAC;IA2CjF,CAAC;IAzCC,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,IAAiB,EAAE,KAAa;QAC3D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;YAC3B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAU,EAAW,EAAE;IACrD,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAU,EAAe,EAAE;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/auth/verification.d.ts

@@ -0,0 +1,32 @@
+export interface VerificationTokenRecord {
+    identifier: string;
+    token: string;
+    expires: Date;
+}
+export interface VerificationTokenStore {
+    create(record: VerificationTokenRecord): Promise<void>;
+    consume(identifier: string, token: string): Promise<VerificationTokenRecord | null>;
+    deleteByIdentifier(identifier: string): Promise<void>;
+}
+export declare class InMemoryVerificationTokenStore implements VerificationTokenStore {
+    private tokens;
+    private key;
+    create(record: VerificationTokenRecord): Promise<void>;
+    consume(identifier: string, token: string): Promise<VerificationTokenRecord | null>;
+    deleteByIdentifier(identifier: string): Promise<void>;
+}
+export declare const hashToken: (token: string) => string;
+export declare const generateToken: (length?: number) => string;
+export declare const constantTimeTokenEquals: (a: string, b: string) => boolean;
+export interface IssueTokenResult {
+    token: string;
+    expiresAt: Date;
+}
+export declare const issueToken: (store: VerificationTokenStore, identifier: string, ttlMs: number, options?: {
+    tokenLength?: number;
+    hash?: boolean;
+}) => Promise<IssueTokenResult>;
+export declare const verifyToken: (store: VerificationTokenStore, identifier: string, token: string, options?: {
+    hash?: boolean;
+}) => Promise<boolean>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/auth/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/auth/verification.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,IAAI,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IACpF,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,qBAAa,8BAA+B,YAAW,sBAAsB;IAC3E,OAAO,CAAC,MAAM,CAA8C;IAE5D,OAAO,CAAC,GAAG;IAIL,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAWpC,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAO5D;AAED,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,KAAG,MACQ,CAAC;AAEnD,eAAO,MAAM,aAAa,GAAI,eAAW,KAAG,MACD,CAAC;AAE5C,eAAO,MAAM,uBAAuB,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAK9D,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,eAAO,MAAM,UAAU,GACrB,OAAO,sBAAsB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,EACb,UAAS;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,KACrD,OAAO,CAAC,gBAAgB,CAO1B,CAAC;AAEF,eAAO,MAAM,WAAW,GACtB,OAAO,sBAAsB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,EACb,UAAS;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,KAC/B,OAAO,CAAC,OAAO,CAIjB,CAAC"}

package/dist/auth/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/auth/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAcvE,MAAM,OAAO,8BAA8B;IAA3C;QACU,WAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IA+B9D,CAAC;IA7BS,GAAG,CAAC,UAAkB,EAAE,KAAa;QAC3C,OAAO,GAAG,UAAU,IAAI,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAA+B;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,UAAkB,EAClB,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CACjD,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,EAAU,EAAE,CACnD,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,KAA6B,EAC7B,UAAkB,EAClB,KAAa,EACb,UAAoD,EAAE,EAC3B,EAAE;IAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,KAA6B,EAC7B,UAAkB,EAClB,KAAa,EACb,UAA8B,EAAE,EACd,EAAE;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO,MAAM,KAAK,IAAI,CAAC;AACzB,CAAC,CAAC"}

package/dist/billing/credits.d.ts

@@ -0,0 +1,29 @@
+import { KVAdapter } from "../kv/index.js";
+export interface CreditEntry {
+    delta: number;
+    balance: number;
+    reason?: string;
+    at: number;
+    metadata?: Record<string, unknown>;
+}
+export interface CreditsLedger {
+    grant(account: string, amount: number, opts?: {
+        reason?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<number>;
+    consume(account: string, amount: number, opts?: {
+        reason?: string;
+        metadata?: Record<string, unknown>;
+        allowNegative?: boolean;
+    }): Promise<{
+        ok: boolean;
+        balance: number;
+    }>;
+    balance(account: string): Promise<number>;
+    set(account: string, amount: number, opts?: {
+        reason?: string;
+    }): Promise<number>;
+    history(account: string, limit?: number): Promise<CreditEntry[]>;
+}
+export declare const createCreditsLedger: (kv?: KVAdapter) => CreditsLedger;
+//# sourceMappingURL=credits.d.ts.map

package/dist/billing/credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits.d.ts","sourceRoot":"","sources":["../../src/billing/credits.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,SAAS,EAAE,MAAM,MAAM,CAAC;AAE3D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACtF,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClF,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;CAClE;AASD,eAAO,MAAM,mBAAmB,GAAI,KAAK,SAAS,KAAG,aAkEpD,CAAC"}

package/dist/billing/credits.js

@@ -0,0 +1,66 @@
+import { getGlobalKV, hasGlobalKV } from "../kv/index.js";
+const BALANCE_PREFIX = "covara:credits:balance:";
+const HISTORY_PREFIX = "covara:credits:history:";
+const HISTORY_MAX = 1000;
+// KV-backed credits ledger. Balance mutations use the KV's atomic incrBy so
+// concurrent grant/consume across instances stay consistent; every change
+// appends to a capped per-account history list.
+export const createCreditsLedger = (kv) => {
+    const resolveKv = () => {
+        if (kv)
+            return kv;
+        if (!hasGlobalKV()) {
+            throw new Error("Credits ledger requires a KV store. Configure a global KV or pass one in.");
+        }
+        return getGlobalKV();
+    };
+    const record = async (store, account, delta, balance, opts) => {
+        const entry = {
+            delta,
+            balance,
+            reason: opts?.reason,
+            at: Date.now(),
+            metadata: opts?.metadata,
+        };
+        await store.lpush(`${HISTORY_PREFIX}${account}`, JSON.stringify(entry));
+    };
+    return {
+        async grant(account, amount, opts) {
+            if (amount < 0)
+                throw new Error("grant amount must be >= 0");
+            const store = resolveKv();
+            const balance = await store.incrBy(`${BALANCE_PREFIX}${account}`, amount);
+            await record(store, account, amount, balance, opts);
+            return balance;
+        },
+        async consume(account, amount, opts) {
+            if (amount < 0)
+                throw new Error("consume amount must be >= 0");
+            const store = resolveKv();
+            const key = `${BALANCE_PREFIX}${account}`;
+            const current = Number((await store.get(key)) ?? 0);
+            if (!opts?.allowNegative && current < amount) {
+                return { ok: false, balance: current };
+            }
+            const balance = await store.incrBy(key, -amount);
+            await record(store, account, -amount, balance, opts);
+            return { ok: true, balance };
+        },
+        async balance(account) {
+            const store = resolveKv();
+            return Number((await store.get(`${BALANCE_PREFIX}${account}`)) ?? 0);
+        },
+        async set(account, amount, opts) {
+            const store = resolveKv();
+            await store.set(`${BALANCE_PREFIX}${account}`, String(amount));
+            await record(store, account, amount, amount, opts);
+            return amount;
+        },
+        async history(account, limit = 50) {
+            const store = resolveKv();
+            const raw = await store.lrange(`${HISTORY_PREFIX}${account}`, 0, Math.min(limit, HISTORY_MAX) - 1);
+            return raw.map((r) => JSON.parse(r));
+        },
+    };
+};
+//# sourceMappingURL=credits.js.map

package/dist/billing/credits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credits.js","sourceRoot":"","sources":["../../src/billing/credits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAa,MAAM,MAAM,CAAC;AAsB3D,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,4EAA4E;AAC5E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAAc,EAAiB,EAAE;IACnE,MAAM,SAAS,GAAG,GAAc,EAAE;QAChC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAClB,KAAgB,EAChB,OAAe,EACf,KAAa,EACb,OAAe,EACf,IAA8D,EAC/C,EAAE;QACjB,MAAM,KAAK,GAAgB;YACzB,KAAK;YACL,OAAO;YACP,MAAM,EAAE,IAAI,EAAE,MAAM;YACpB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,QAAQ,EAAE,IAAI,EAAE,QAAQ;SACzB,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI;YAC/B,IAAI,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI;YACjC,IAAI,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,cAAc,GAAG,OAAO,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,aAAa,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;gBAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI;YAC7B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,GAAG,EAAE;YAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACnG,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAgB,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/billing/index.d.ts

@@ -0,0 +1,53 @@
+import type { Context } from "hono";
+import { BillingAdapter, BillingEvent, BillingSubscription, CheckoutSession, CreateCheckoutInput, CreateCustomerInput, PortalSession, ReportUsageInput } from "./types.js";
+import { CreditsLedger } from "./credits.js";
+export declare const setGlobalBilling: (adapter: BillingAdapter) => void;
+export declare const getGlobalBilling: () => BillingAdapter;
+export declare const hasGlobalBilling: () => boolean;
+export declare const clearGlobalBilling: () => void;
+export interface BillingPlan {
+    key: string;
+    priceId: string;
+    name?: string;
+    type?: "subscription" | "one_time" | "usage";
+    credits?: number;
+    interval?: "month" | "year";
+    metadata?: Record<string, unknown>;
+}
+export interface BillingConfig {
+    adapter: BillingAdapter;
+    plans?: BillingPlan[];
+    credits?: CreditsLedger;
+    webhookSecret?: string;
+    autoGrantCredits?: boolean;
+    resolveAccount?: (event: BillingEvent) => string | undefined;
+    onEvent?: (event: BillingEvent) => void | Promise<void>;
+}
+export interface Billing {
+    readonly adapter: BillingAdapter;
+    readonly credits: CreditsLedger;
+    plan(key: string): BillingPlan | undefined;
+    createCustomer(input: CreateCustomerInput): ReturnType<BillingAdapter["createCustomer"]>;
+    checkout(input: CreateCheckoutInput): Promise<CheckoutSession>;
+    checkoutPlan(planKey: string, opts: Omit<CreateCheckoutInput, "items" | "mode"> & {
+        quantity?: number;
+        mode?: CreateCheckoutInput["mode"];
+    }): Promise<CheckoutSession>;
+    getSubscription(id: string): Promise<BillingSubscription | null>;
+    cancelSubscription(id: string, options?: {
+        atPeriodEnd?: boolean;
+    }): Promise<BillingSubscription>;
+    reportUsage(input: ReportUsageInput): Promise<void>;
+    portal(customerId: string, returnUrl: string): Promise<PortalSession>;
+    handleWebhook(payload: string, headers: Record<string, string>): Promise<BillingEvent | null>;
+    webhookHandler(): (c: Context) => Promise<Response>;
+}
+export declare const createBilling: (config: BillingConfig) => Billing;
+export * from "./types.js";
+export * from "./credits.js";
+export * from "./stripe.js";
+export * from "./lemonsqueezy.js";
+export * from "./paddle.js";
+export * from "./polar.js";
+export * from "./router.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/billing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/billing/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAuB,aAAa,EAAE,MAAM,WAAW,CAAC;AAI/D,eAAO,MAAM,gBAAgB,GAAI,SAAS,cAAc,KAAG,IAE1D,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,cAKnC,CAAC;AAEF,eAAO,MAAM,gBAAgB,QAAO,OAAwC,CAAC;AAE7E,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAEF,MAAM,WAAW,WAAW;IAE1B,GAAG,EAAE,MAAM,CAAC;IAEZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,cAAc,GAAG,UAAU,GAAG,OAAO,CAAC;IAE7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IAGvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAG3B,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,SAAS,CAAC;IAC7D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC3C,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACzF,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC/D,YAAY,CACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAA;KAAE,GAC5G,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACjE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClG,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC9F,cAAc,IAAI,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrD;AAYD,eAAO,MAAM,aAAa,GAAI,QAAQ,aAAa,KAAG,OA+GrD,CAAC;AAEF,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}

package/dist/billing/index.js

@@ -0,0 +1,139 @@
+import { getGlobalKV, hasGlobalKV } from "../kv/index.js";
+import { getLogger } from "../server/logger.js";
+import { createCreditsLedger } from "./credits.js";
+let globalBillingAdapter = null;
+export const setGlobalBilling = (adapter) => {
+    globalBillingAdapter = adapter;
+};
+export const getGlobalBilling = () => {
+    if (!globalBillingAdapter) {
+        throw new Error("No global billing adapter configured. Call setGlobalBilling() first.");
+    }
+    return globalBillingAdapter;
+};
+export const hasGlobalBilling = () => globalBillingAdapter !== null;
+export const clearGlobalBilling = () => {
+    globalBillingAdapter = null;
+};
+const defaultResolveAccount = (event) => {
+    const meta = (event.subscription?.metadata ?? event.metadata ?? {});
+    const candidate = meta.accountId ?? meta.userId ?? meta.account_id ?? meta.user_id;
+    if (typeof candidate === "string")
+        return candidate;
+    return event.customerId;
+};
+const DEDUP_PREFIX = "covara:billing:evt:";
+const DEDUP_TTL_MS = 24 * 60 * 60 * 1000;
+export const createBilling = (config) => {
+    const adapter = config.adapter;
+    const credits = config.credits ?? createCreditsLedger();
+    const plansByKey = new Map((config.plans ?? []).map((p) => [p.key, p]));
+    const plansByPrice = new Map((config.plans ?? []).map((p) => [p.priceId, p]));
+    const resolveAccount = config.resolveAccount ?? defaultResolveAccount;
+    const autoGrant = config.autoGrantCredits !== false;
+    const enrich = (event) => {
+        const priceId = event.subscription?.priceId ?? event.metadata?.priceId;
+        const plan = priceId ? plansByPrice.get(priceId) : undefined;
+        if (plan) {
+            event.planKey = plan.key;
+            event.creditsToGrant = plan.credits;
+        }
+        return event;
+    };
+    // De-duplicate webhook deliveries (providers retry): returns true if this is
+    // the first time we've seen the event id.
+    const markSeen = async (eventId) => {
+        if (!hasGlobalKV())
+            return true;
+        const kv = getGlobalKV();
+        const key = `${DEDUP_PREFIX}${eventId}`;
+        if (await kv.get(key))
+            return false;
+        await kv.set(key, "1", { px: DEDUP_TTL_MS });
+        return true;
+    };
+    const handleWebhook = async (payload, headers) => {
+        if (config.webhookSecret && !adapter.verifyWebhook(payload, headers, config.webhookSecret)) {
+            throw new Error("Invalid billing webhook signature");
+        }
+        const parsed = adapter.parseWebhookEvent(payload, headers);
+        if (!parsed)
+            return null;
+        const fresh = await markSeen(parsed.id);
+        if (!fresh)
+            return parsed;
+        const event = enrich(parsed);
+        if (autoGrant &&
+            event.type === "payment.succeeded" &&
+            event.creditsToGrant &&
+            event.creditsToGrant > 0) {
+            const account = resolveAccount(event);
+            if (account) {
+                await credits.grant(account, event.creditsToGrant, {
+                    reason: `billing:${event.planKey ?? "payment"}`,
+                    metadata: { eventId: event.id, provider: event.provider },
+                });
+            }
+        }
+        if (config.onEvent) {
+            await config.onEvent(event);
+        }
+        return event;
+    };
+    return {
+        adapter,
+        credits,
+        plan: (key) => plansByKey.get(key),
+        createCustomer: (input) => adapter.createCustomer(input),
+        checkout: (input) => adapter.createCheckout(input),
+        checkoutPlan: (planKey, opts) => {
+            const plan = plansByKey.get(planKey);
+            if (!plan)
+                throw new Error(`Unknown billing plan: ${planKey}`);
+            const mode = opts.mode ?? (plan.type === "one_time" ? "payment" : "subscription");
+            return adapter.createCheckout({
+                ...opts,
+                mode,
+                items: [{ priceId: plan.priceId, quantity: opts.quantity }],
+            });
+        },
+        getSubscription: (id) => adapter.getSubscription(id),
+        cancelSubscription: (id, options) => adapter.cancelSubscription(id, options),
+        reportUsage: (input) => adapter.reportUsage(input),
+        portal: (customerId, returnUrl) => {
+            if (!adapter.createPortalSession) {
+                throw new Error(`${adapter.provider} does not support a billing portal`);
+            }
+            return adapter.createPortalSession(customerId, returnUrl);
+        },
+        handleWebhook,
+        webhookHandler() {
+            return async (c) => {
+                const payload = await c.req.text();
+                const headers = {};
+                c.req.raw.headers.forEach((v, k) => {
+                    headers[k.toLowerCase()] = v;
+                });
+                try {
+                    await handleWebhook(payload, headers);
+                    return c.json({ received: true });
+                }
+                catch (err) {
+                    getLogger().warn("Billing webhook rejected", {
+                        provider: adapter.provider,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                    return c.json({ error: "Webhook verification failed" }, 400);
+                }
+            };
+        },
+    };
+};
+export * from "./types.js";
+export * from "./credits.js";
+export * from "./stripe.js";
+export * from "./lemonsqueezy.js";
+export * from "./paddle.js";
+export * from "./polar.js";
+export * from "./router.js";
+//# sourceMappingURL=index.js.map