cursedbelt 0.0.0

package/dist/server/auth/totp.d.ts

@@ -0,0 +1,35 @@
+/**
+ * TOTP (RFC 6238) on `otplib` — standard authenticator-app parameters (base32
+ * secret, SHA-1, 6 digits, 30s step). otplib's default plugins are pure-JS
+ * (`@noble/hashes` + `@scure/base`), so this runs natively on Bun with no native
+ * deps. Plus single-use recovery codes hashed with argon2id (never stored plain).
+ *
+ * The toolkit provides the crypto; enabling/disabling 2FA, persisting the secret +
+ * recovery hashes, and the login-flow ordering stay app-business (task 32).
+ */
+export declare const DEFAULT_TOTP_ISSUER = "CursedAlchemy";
+/** A fresh random base32 TOTP secret (20 bytes / 160 bits — the standard). */
+export declare function generateTotpSecret(): string;
+/** The `otpauth://` URI an authenticator app scans / imports (for QR rendering). */
+export declare function getTotpUri(account: string, secret: string, issuer?: string): string;
+/**
+ * Verify a user-entered 6-digit code against a base32 secret, allowing ±1 step of
+ * drift. Tolerates surrounding whitespace; rejects anything that isn't six digits.
+ */
+export declare function verifyTotpCode(token: string, secret: string): boolean;
+/**
+ * Generate `count` single-use recovery codes. Returns `plaintext` (shown to the user
+ * exactly once) and `hashed` (argon2id PHC strings — persist these as a JSON array,
+ * never the plaintext).
+ */
+export declare function generateRecoveryCodes(count?: number): Promise<{
+    plaintext: string[];
+    hashed: string[];
+}>;
+/**
+ * Verify a candidate recovery code against the stored argon2id hashes. Returns the
+ * index of the matching hash, or -1 if none match. The caller consumes it (splice
+ * that index out and persist the shortened array) so each code works exactly once.
+ */
+export declare function verifyRecoveryCode(input: string, hashed: string[]): Promise<number>;
+//# sourceMappingURL=totp.d.ts.map

package/dist/server/auth/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../src/server/auth/totp.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAMnD,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQrE;AAoBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,SAAK,GACT,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAMpD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzF"}

package/dist/server/auth/totp.js

@@ -0,0 +1,82 @@
+import { generateSecret, generateURI, verifySync } from 'otplib';
+/**
+ * TOTP (RFC 6238) on `otplib` — standard authenticator-app parameters (base32
+ * secret, SHA-1, 6 digits, 30s step). otplib's default plugins are pure-JS
+ * (`@noble/hashes` + `@scure/base`), so this runs natively on Bun with no native
+ * deps. Plus single-use recovery codes hashed with argon2id (never stored plain).
+ *
+ * The toolkit provides the crypto; enabling/disabling 2FA, persisting the secret +
+ * recovery hashes, and the login-flow ordering stay app-business (task 32).
+ */
+export const DEFAULT_TOTP_ISSUER = 'CursedAlchemy';
+// One 30s step of clock-skew tolerance on each side (±1 step). otplib v13 defaults
+// to ZERO tolerance, so we set it explicitly (period = 30s).
+const DRIFT_SECONDS = 30;
+/** A fresh random base32 TOTP secret (20 bytes / 160 bits — the standard). */
+export function generateTotpSecret() {
+    return generateSecret();
+}
+/** The `otpauth://` URI an authenticator app scans / imports (for QR rendering). */
+export function getTotpUri(account, secret, issuer = DEFAULT_TOTP_ISSUER) {
+    return generateURI({ issuer, label: account, secret });
+}
+/**
+ * Verify a user-entered 6-digit code against a base32 secret, allowing ±1 step of
+ * drift. Tolerates surrounding whitespace; rejects anything that isn't six digits.
+ */
+export function verifyTotpCode(token, secret) {
+    const clean = String(token).replace(/\s+/g, '');
+    if (!/^\d{6}$/.test(clean))
+        return false;
+    try {
+        return verifySync({ secret, token: clean, epochTolerance: DRIFT_SECONDS }).valid;
+    }
+    catch {
+        return false;
+    }
+}
+// ── Recovery codes ──────────────────────────────────────────────────────────────
+// No easily-confused characters (no 0/O, 1/I/L) — readable + dictatable.
+const CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+/** Strip separators + uppercase, so display formatting never affects matching. */
+const normalizeCode = (code) => String(code)
+    .replace(/[^a-zA-Z0-9]/g, '')
+    .toUpperCase();
+const randomCode = () => {
+    const bytes = crypto.getRandomValues(new Uint8Array(10));
+    let s = '';
+    for (const b of bytes)
+        s += CODE_ALPHABET[b % CODE_ALPHABET.length];
+    return `${s.slice(0, 5)}-${s.slice(5)}`; // e.g. "A1B2C-D3E4F"
+};
+/**
+ * Generate `count` single-use recovery codes. Returns `plaintext` (shown to the user
+ * exactly once) and `hashed` (argon2id PHC strings — persist these as a JSON array,
+ * never the plaintext).
+ */
+export async function generateRecoveryCodes(count = 10) {
+    const plaintext = Array.from({ length: count }, randomCode);
+    const hashed = await Promise.all(plaintext.map((code) => Bun.password.hash(normalizeCode(code), { algorithm: 'argon2id' })));
+    return { plaintext, hashed };
+}
+/**
+ * Verify a candidate recovery code against the stored argon2id hashes. Returns the
+ * index of the matching hash, or -1 if none match. The caller consumes it (splice
+ * that index out and persist the shortened array) so each code works exactly once.
+ */
+export async function verifyRecoveryCode(input, hashed) {
+    const candidate = normalizeCode(input);
+    if (!candidate)
+        return -1;
+    for (let i = 0; i < hashed.length; i++) {
+        try {
+            if (await Bun.password.verify(candidate, hashed[i]))
+                return i;
+        }
+        catch {
+            // ignore a malformed stored hash — treat as a non-match
+        }
+    }
+    return -1;
+}
+//# sourceMappingURL=totp.js.map

package/dist/server/auth/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/server/auth/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEjE;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,mFAAmF;AACnF,6DAA6D;AAC7D,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,EAAE,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,mBAAmB;IACtF,OAAO,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AAEnF,yEAAyE;AACzE,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,kFAAkF;AAClF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,MAAM,CAAC,IAAI,CAAC;KACT,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;KAC5B,WAAW,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,aAAa,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB;AAChE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAK,GAAG,EAAE;IAEV,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAC3F,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAgB;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/server/auth/types.d.ts

@@ -0,0 +1,134 @@
+import type { JWTPayload } from 'jose';
+import type { CursedbeltVariables } from '../context';
+/**
+ * Shared auth types for the cursedbelt server auth toolkit.
+ *
+ * cursedbelt owns the *mechanism* (sign/verify, session validity, the getOnly
+ * gate, CSRF, throttling, TOTP, vault crypto). The *model* — which roles may do
+ * what, the `/f`-vs-`/login` policy, what a "session" means to the product — stays
+ * in the consuming app. The toolkit carries `roles`/`getOnly`/`purpose` opaquely
+ * and never interprets them beyond the documented gates.
+ */
+/** Token purposes the apps mint. `access` is the login session; the rest are
+ * short-lived single-feature unlock/state tokens (held in page memory, never a
+ * cookie). cursedbelt does not enforce these — {@link AppJwtPayload.purpose} is an
+ * opaque string the app sets and checks (via `verifyPurposeToken`). */
+export type TokenPurpose = 'access' | 'refresh' | 'vault-unlock' | 'pm-unlock' | 'files-unlock' | 'yt-oauth';
+/**
+ * The decoded JWT payload shape the apps use. `userId`/`sessionId` tie a token to
+ * its user + its row in the session store (the kill switch); `roles` + `getOnly`
+ * ride along for the auth middleware to surface on `c.get('user')`.
+ */
+export interface AppJwtPayload extends JWTPayload {
+    userId: string;
+    sessionId: string;
+    roles: string[];
+    /** GET-only (`/f`) session marker. Absent on tokens minted before the claim
+     * existed → treated as `false` (see {@link AuthUser.getOnly}). */
+    getOnly?: boolean;
+    /** See {@link TokenPurpose}. Absent ⇒ a plain access token. */
+    purpose?: TokenPurpose | (string & {});
+}
+/**
+ * The authenticated principal the auth middleware sets on `c.get('user')`. This is
+ * the *normalized* view (getOnly defaulted), distinct from the raw {@link AppJwtPayload}.
+ */
+export interface AuthUser {
+    id: string;
+    roles: string[];
+    /** Normalized: a missing `getOnly` claim becomes `false` here. */
+    getOnly: boolean;
+    sessionId: string;
+}
+/** Hono `Variables` the auth middleware contributes. Composed with the base
+ * {@link CursedbeltVariables} into {@link AuthEnv}. */
+export interface AuthVariables {
+    /** Set by `createAuthMiddleware` once the token + session are validated. */
+    user: AuthUser;
+}
+/** The Hono env an app gets once it mounts the cursedbelt auth middleware: the
+ * base plumbing variables plus the authenticated `user`. `user` is typed required
+ * because the gate runs before any handler that reads it; mount auth before the
+ * routes that depend on it. */
+export interface AuthEnv {
+    Variables: CursedbeltVariables & AuthVariables;
+}
+/** A persisted login session — the in-memory + DB-backed record the auth middleware
+ * checks on every request (revocation + sliding-refresh expiry). */
+export interface Session {
+    sessionId: string;
+    userId: string;
+    /** GET-only (`/f`) session. Copied onto the access token's `getOnly` claim. */
+    getOnly: boolean;
+    createdAt: string;
+    lastSeenAt: string;
+    /** Sliding deadline: a session is valid while now < refreshExpiresAt. */
+    refreshExpiresAt: string;
+    /** When the *current* access token expires (informational; the cookie/JWT is the
+     * real gate). Null until first issued. */
+    accessExpiresAt: string | null;
+    disabled: boolean;
+    disabledAt: string | null;
+    disabledBy: string | null;
+    userAgent: string | null;
+    ip: string | null;
+}
+/** Inputs to mint a session. The store computes `createdAt`/`lastSeenAt` and (unless
+ * overridden) `refreshExpiresAt` from its configured window — callers never hand-roll
+ * timestamps. */
+export interface CreateSessionInput {
+    sessionId: string;
+    userId: string;
+    getOnly?: boolean;
+    accessExpiresAt?: string | null;
+    userAgent?: string | null;
+    ip?: string | null;
+    /** Override the computed `now + refreshWindowMs` deadline. */
+    refreshExpiresAt?: string;
+}
+/**
+ * Revocable, restart-surviving session store. The in-memory map is the hot-path
+ * source of truth for token validity (no per-request DB read); the `auth_sessions`
+ * table exists so the map can be rebuilt after a restart ({@link SessionStore.rehydrate}).
+ * Single-server deployment — no cross-instance coherence to manage.
+ */
+export interface SessionStore {
+    /** Load the table into memory on boot (prunes expired/old rows first). */
+    rehydrate(): Promise<void>;
+    /** Persist + cache a new session. */
+    create(input: CreateSessionInput): Promise<Session>;
+    /** Sync hot-path read from memory. Returns the LIVE cached object (not a copy) —
+     * treat it read-only; mutate only through the store's methods. */
+    get(sessionId: string): Session | undefined;
+    /** Is this session usable right now (present, not disabled, inside its window)? */
+    isValid(session: Session | undefined): session is Session;
+    /** Slide the refresh deadline forward on activity (and optionally record a freshly
+     * issued access-token expiry). DB write is throttled unless `accessExpiresAt` is
+     * passed (a re-issue must persist immediately so a restart reflects it). */
+    touch(sessionId: string, opts?: {
+        accessExpiresAt?: string | null;
+    }): Promise<void>;
+    /** Revoke one session (keeps the audit row). Returns false if unknown. */
+    disable(sessionId: string, disabledBy?: string | null): Promise<boolean>;
+    /** Revoke every active session for a user; returns the affected ids (e.g. to drop
+     * matching live websockets). */
+    disableAllForUser(userId: string, disabledBy?: string | null): Promise<string[]>;
+    /** Forget a single session entirely (logout — drops the audit row too). */
+    remove(sessionId: string): Promise<void>;
+    /** Hard-delete every session for a user (memory + DB). */
+    deleteByUser(userId: string): Promise<void>;
+    /** All sessions for a user (incl. disabled audit rows), newest first — for an
+     * account/admin "your devices" view. */
+    listByUser(userId: string): Promise<Session[]>;
+    /** All cached sessions (sync; admin live list). */
+    listAll(): Session[];
+    /** Most-recent activity across a user's active sessions, or null — a cheap presence
+     * signal. */
+    getLastSeenForUser(userId: string): string | null;
+    /** Drop sessions whose last activity predates the retention window (memory + DB).
+     * Returns the count removed. */
+    prune(): Promise<number>;
+    /** Stop the optional auto-prune timer (no-op if none was started). */
+    stop(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;GAQG;AAEH;;;uEAGuE;AACvE,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,SAAS,GACT,cAAc,GACd,WAAW,GACX,cAAc,GACd,UAAU,CAAC;AAEf;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;sEACkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;uDACuD;AACvD,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;+BAG+B;AAC/B,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,mBAAmB,GAAG,aAAa,CAAC;CAChD;AAED;oEACoE;AACpE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,CAAC;IACzB;8CAC0C;IAC1C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED;;iBAEiB;AACjB,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,qCAAqC;IACrC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD;sEACkE;IAClE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,mFAAmF;IACnF,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC;IAC1D;;gFAE4E;IAC5E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,0EAA0E;IAC1E,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;oCACgC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,2EAA2E;IAC3E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,0DAA0D;IAC1D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;4CACwC;IACxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,mDAAmD;IACnD,OAAO,IAAI,OAAO,EAAE,CAAC;IACrB;iBACa;IACb,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD;oCACgC;IAChC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,sEAAsE;IACtE,IAAI,IAAI,IAAI,CAAC;CACd"}

package/dist/server/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/auth/types.ts"],"names":[],"mappings":""}

package/dist/server/auth/vault.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Vault item at-rest crypto — standard Web Crypto (HKDF-SHA256 + AES-256-GCM),
+ * replacing the old hand-rolled `secretBox`/`deriveKey` scheme. Auditable, native on
+ * modern Bun, zero dependencies. These primitives live in cursedbelt (not ca's
+ * business layer) because ru gains a vault too.
+ *
+ * Keying is SERVER-SECRET–derived (per user), NOT master-password–derived: the
+ * master password is a separate argon2id gate (a `Bun.password` hash — see
+ * {@link ./password}), so resetting it never requires re-encrypting vault data. The
+ * envelope carries a version byte so a future re-key can proceed row-by-row without
+ * a flag-day migration.
+ */
+/**
+ * Derive a per-user AES-256-GCM vault key from the server secret via HKDF. The
+ * per-user `salt` domain-separates users; `info` domain-separates this use of the
+ * secret. The returned key is non-extractable (encrypt/decrypt only).
+ */
+export declare function deriveVaultKey(serverSecret: string, userId: string): Promise<CryptoKey>;
+/**
+ * Encrypt vault item plaintext. Returns a base64 envelope:
+ *   `version(1B) || iv(12B) || ciphertext(+GCM tag)`
+ * A fresh random IV per call. Store the string verbatim in `vault_items.data`.
+ */
+export declare function encryptVaultItem(key: CryptoKey, plaintext: string): Promise<string>;
+/** Decrypt an envelope produced by {@link encryptVaultItem}. Throws on an unknown
+ * version, a truncated envelope, or a failed GCM auth (tamper/wrong key). */
+export declare function decryptVaultItem(key: CryptoKey, envelope: string): Promise<string>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/server/auth/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/server/auth/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAoB7F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzF;AAED;6EAC6E;AAC7E,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxF"}

package/dist/server/auth/vault.js

@@ -0,0 +1,58 @@
+/**
+ * Vault item at-rest crypto — standard Web Crypto (HKDF-SHA256 + AES-256-GCM),
+ * replacing the old hand-rolled `secretBox`/`deriveKey` scheme. Auditable, native on
+ * modern Bun, zero dependencies. These primitives live in cursedbelt (not ca's
+ * business layer) because ru gains a vault too.
+ *
+ * Keying is SERVER-SECRET–derived (per user), NOT master-password–derived: the
+ * master password is a separate argon2id gate (a `Bun.password` hash — see
+ * {@link ./password}), so resetting it never requires re-encrypting vault data. The
+ * envelope carries a version byte so a future re-key can proceed row-by-row without
+ * a flag-day migration.
+ */
+const VERSION = 1;
+const IV_BYTES = 12; // 96-bit nonce — the AES-GCM standard
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+/**
+ * Derive a per-user AES-256-GCM vault key from the server secret via HKDF. The
+ * per-user `salt` domain-separates users; `info` domain-separates this use of the
+ * secret. The returned key is non-extractable (encrypt/decrypt only).
+ */
+export async function deriveVaultKey(serverSecret, userId) {
+    const baseKey = await crypto.subtle.importKey('raw', enc.encode(serverSecret), { name: 'HKDF' }, false, ['deriveKey']);
+    return crypto.subtle.deriveKey({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: enc.encode(`vault:${userId}`),
+        info: enc.encode('vault-item-key'),
+    }, baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+}
+/**
+ * Encrypt vault item plaintext. Returns a base64 envelope:
+ *   `version(1B) || iv(12B) || ciphertext(+GCM tag)`
+ * A fresh random IV per call. Store the string verbatim in `vault_items.data`.
+ */
+export async function encryptVaultItem(key, plaintext) {
+    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+    const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, enc.encode(plaintext));
+    const envelope = new Uint8Array(1 + IV_BYTES + ct.byteLength);
+    envelope[0] = VERSION;
+    envelope.set(iv, 1);
+    envelope.set(new Uint8Array(ct), 1 + IV_BYTES);
+    return Buffer.from(envelope).toString('base64');
+}
+/** Decrypt an envelope produced by {@link encryptVaultItem}. Throws on an unknown
+ * version, a truncated envelope, or a failed GCM auth (tamper/wrong key). */
+export async function decryptVaultItem(key, envelope) {
+    const bytes = new Uint8Array(Buffer.from(envelope, 'base64'));
+    if (bytes.length < 1 + IV_BYTES + 16)
+        throw new Error('vault: envelope too short');
+    if (bytes[0] !== VERSION)
+        throw new Error(`vault: unsupported envelope version ${bytes[0]}`);
+    const iv = bytes.subarray(1, 1 + IV_BYTES);
+    const ct = bytes.subarray(1 + IV_BYTES);
+    const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ct);
+    return dec.decode(plain);
+}
+//# sourceMappingURL=vault.js.map

package/dist/server/auth/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/server/auth/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,sCAAsC;AAC3D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB,EAAE,MAAc;IACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;KACnC,EACD,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,SAAiB;IACtE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC9D,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,QAAgB;IACrE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server/auth.d.ts

@@ -0,0 +1,20 @@
+import { type JWTPayload } from 'jose';
+/**
+ * JWT auth primitives on `jose` (Web Crypto — runs on Bun + Node, no native deps;
+ * replaces `jsonwebtoken`). The app owns the user/role/session MODEL; cursedbelt
+ * only signs/verifies and carries an opaque `getOnly` claim it does not interpret.
+ */
+export interface AccessClaims extends JWTPayload {
+    sub: string;
+    /** GET-only (ctgr) session marker — the server rejects non-GET when true. */
+    getOnly?: boolean;
+}
+/** Sign an HS256 access token. `expiresIn` is a jose duration string (e.g. '24h'). */
+export declare function signToken(claims: AccessClaims, secret: string, expiresIn?: string): Promise<string>;
+/** Verify + decode an HS256 token (throws on bad signature / expiry). */
+export declare function verifyToken<T extends JWTPayload = AccessClaims>(token: string, secret: string): Promise<T>;
+/** True when a GET-only (ctgr) session attempts a mutating method — the 403 gate. */
+export declare function isGetOnlyViolation(claims: {
+    getOnly?: boolean;
+}, method: string): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,MAAM,CAAC;AAE3D;;;;GAIG;AAEH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAID,sFAAsF;AACtF,wBAAsB,SAAS,CAC7B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,SAAQ,GAChB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,CAAC,SAAS,UAAU,GAAG,YAAY,EACnE,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzF"}

package/dist/server/auth.js

@@ -0,0 +1,20 @@
+import { jwtVerify, SignJWT } from 'jose';
+const keyOf = (secret) => new TextEncoder().encode(secret);
+/** Sign an HS256 access token. `expiresIn` is a jose duration string (e.g. '24h'). */
+export async function signToken(claims, secret, expiresIn = '24h') {
+    return new SignJWT(claims)
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(expiresIn)
+        .sign(keyOf(secret));
+}
+/** Verify + decode an HS256 token (throws on bad signature / expiry). */
+export async function verifyToken(token, secret) {
+    const { payload } = await jwtVerify(token, keyOf(secret));
+    return payload;
+}
+/** True when a GET-only (ctgr) session attempts a mutating method — the 403 gate. */
+export function isGetOnlyViolation(claims, method) {
+    return claims.getOnly === true && method !== 'GET' && method !== 'HEAD';
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAc3D,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAEnE,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAoB,EACpB,MAAc,EACd,SAAS,GAAG,KAAK;IAEjB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,SAAS,CAAC;SAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAc;IAEd,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAY,CAAC;AACtB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CAAC,MAA6B,EAAE,MAAc;IAC9E,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;AAC1E,CAAC"}

package/dist/server/context.d.ts

@@ -0,0 +1,36 @@
+import type { CtgrDecoded, CtgrMethod } from '../ctgr/types';
+/**
+ * The cursedbelt Hono environment. `createApp()` returns a `Hono<CursedbeltEnv>`
+ * so every middleware and handler shares one typed `c.get`/`c.set` surface.
+ *
+ * Only *plumbing* variables live here — request identity that the cross-cutting
+ * middleware owns. Business variables (roles, session, sharing) are added by the
+ * app's own auth/feature middleware via its own env extension (task 26+).
+ */
+export interface CursedbeltVariables {
+    /** Per-request correlation id. Set by {@link correlationId} on every request. */
+    correlationId: string;
+    /**
+     * Authenticated user id. cursedbelt never sets this — the app's auth middleware
+     * (task 26) populates it so the request logger can attribute metrics/events to a
+     * user. Optional because anonymous requests have none.
+     */
+    userId?: string;
+    /**
+     * The decoded original request on a `/ctgr*` GET twin. Set by the ctgr `unGETify`
+     * middleware; the downstream handler / zod validator reads the body from here.
+     */
+    ctgrDecoded?: CtgrDecoded;
+    /** The decoded original HTTP method of a ctgr-tunneled request. */
+    ctgrMethod?: CtgrMethod;
+    /**
+     * The parsed/coerced/stripped body a `zValidator(...)` route accepted. A convenience
+     * mirror of the typed `c.req.valid('json')` slot for handlers that prefer a getter.
+     * Set only on a validated route; `unknown` because the type is the route's schema.
+     */
+    validatedBody?: unknown;
+}
+export interface CursedbeltEnv {
+    Variables: CursedbeltVariables;
+}
+//# sourceMappingURL=context.d.ts.map

package/dist/server/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,mEAAmE;IACnE,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,mBAAmB,CAAC;CAChC"}

package/dist/server/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/server/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":""}

package/dist/server/ctgr.d.ts

@@ -0,0 +1,32 @@
+import type { Context, Hono, MiddlewareHandler } from 'hono';
+import type { ChunkStore } from '../ctgr/chunkStore';
+import { type CtgrDecoded, type CtgrMethod } from '../ctgr/types';
+import type { CursedbeltEnv } from './context';
+/**
+ * The path pattern that matches EVERY ctgr GET twin (`/ctgr<XX>...`) and nothing
+ * else — mount the decode + CSRF + getOnly middleware on this. NOTE: Hono's router
+ * does not treat `/ctgr*` as a prefix wildcard (a bare-suffix `*` only matches a
+ * single following segment), so a named param with a `ctgr.+` regex is the correct,
+ * portable matcher (`.` spans `/`, so it covers multi-segment paths like
+ * `/ctgrpa/api/v1/lists/123`). Reuse this everywhere a `/ctgr*` mount is meant.
+ */
+export declare const CTGR_ROUTE_PATTERN = "/:ctgrTwin{ctgr.+}";
+/**
+ * Mount on {@link CTGR_ROUTE_PATTERN} (before the twin routes). A single chunk decodes
+ * inline; a multi-chunk payload accumulates in the injected {@link ChunkStore}
+ * (intermediate chunk → 202). The decoded request + method are stashed on the context for the
+ * downstream handler / validator (`c.get('ctgrDecoded')`). Legacy `_cv`-absent
+ * requests fall back to the v0 decoder for the rollout window.
+ */
+export declare function unGETify(store: ChunkStore): MiddlewareHandler<CursedbeltEnv>;
+/** Read the ctgr-decoded request a `/ctgr*` twin stashed, if this was a tunneled call. */
+export declare function getCtgrDecoded(c: Context<CursedbeltEnv>): CtgrDecoded | undefined;
+/**
+ * Twin registrar: one call registers the real verb route AND its `/ctgr<XX>` GET twin
+ * (same handlers; the global `/ctgr*` {@link unGETify} middleware decodes the body
+ * first). Binary/download routes MUST NOT go through this — register those as a plain
+ * `app.get(path, handler)` so their bytes never ride the base64url tunnel and get
+ * mangled.
+ */
+export declare function buildRoutes(app: Hono<CursedbeltEnv>): (method: CtgrMethod | Lowercase<CtgrMethod>, path: string, ...handlers: MiddlewareHandler<CursedbeltEnv>[]) => void;
+//# sourceMappingURL=ctgr.d.ts.map

package/dist/server/ctgr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctgr.d.ts","sourceRoot":"","sources":["../../src/server/ctgr.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAEhB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAmB5E;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,WAAW,GAAG,SAAS,CAEjF;AAWD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,IAGhD,QAAQ,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,EAC1C,MAAM,MAAM,EACZ,GAAG,UAAU,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAC9C,IAAI,CASR"}

package/dist/server/ctgr.js

@@ -0,0 +1,61 @@
+import { ABBREV_TO_METHOD, METHOD_TO_ABBREV, } from '../ctgr/types';
+import { V0ChunkStore } from '../ctgr/v0compat';
+import { toErrorEnvelope } from './errors';
+/**
+ * The path pattern that matches EVERY ctgr GET twin (`/ctgr<XX>...`) and nothing
+ * else — mount the decode + CSRF + getOnly middleware on this. NOTE: Hono's router
+ * does not treat `/ctgr*` as a prefix wildcard (a bare-suffix `*` only matches a
+ * single following segment), so a named param with a `ctgr.+` regex is the correct,
+ * portable matcher (`.` spans `/`, so it covers multi-segment paths like
+ * `/ctgrpa/api/v1/lists/123`). Reuse this everywhere a `/ctgr*` mount is meant.
+ */
+export const CTGR_ROUTE_PATTERN = '/:ctgrTwin{ctgr.+}';
+/**
+ * Mount on {@link CTGR_ROUTE_PATTERN} (before the twin routes). A single chunk decodes
+ * inline; a multi-chunk payload accumulates in the injected {@link ChunkStore}
+ * (intermediate chunk → 202). The decoded request + method are stashed on the context for the
+ * downstream handler / validator (`c.get('ctgrDecoded')`). Legacy `_cv`-absent
+ * requests fall back to the v0 decoder for the rollout window.
+ */
+export function unGETify(store) {
+    const legacy = new V0ChunkStore();
+    return async (c, next) => {
+        const params = Object.fromEntries(new URL(c.req.url).searchParams);
+        const pathMethod = ABBREV_TO_METHOD[c.req.path.slice(5, 7)];
+        if (!pathMethod) {
+            return c.json(toErrorEnvelope(new Error('ctgr: unknown method twin')), 400);
+        }
+        const result = params._cv === undefined ? legacy.add(params, pathMethod) : await store.add(params);
+        if (result === false)
+            return c.json({ acknowledged: true }, 202);
+        if (result instanceof Error)
+            return c.json(toErrorEnvelope(result), 400);
+        c.set('ctgrDecoded', result);
+        c.set('ctgrMethod', result.method);
+        await next();
+    };
+}
+/** Read the ctgr-decoded request a `/ctgr*` twin stashed, if this was a tunneled call. */
+export function getCtgrDecoded(c) {
+    return c.get('ctgrDecoded');
+}
+/**
+ * Twin registrar: one call registers the real verb route AND its `/ctgr<XX>` GET twin
+ * (same handlers; the global `/ctgr*` {@link unGETify} middleware decodes the body
+ * first). Binary/download routes MUST NOT go through this — register those as a plain
+ * `app.get(path, handler)` so their bytes never ride the base64url tunnel and get
+ * mangled.
+ */
+export function buildRoutes(app) {
+    const on = app.on.bind(app);
+    return function register(method, path, ...handlers) {
+        const upper = method.toUpperCase();
+        const abbrev = METHOD_TO_ABBREV[upper];
+        if (!abbrev)
+            throw new Error(`buildRoutes: "${method}" is not a ctgr-tunnelable method`);
+        // The real verb route + its GET twin, from one call.
+        on(upper, path, ...handlers);
+        on('GET', `/ctgr${abbrev}${path}`, ...handlers);
+    };
+}
+//# sourceMappingURL=ctgr.js.map

package/dist/server/ctgr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctgr.js","sourceRoot":"","sources":["../../src/server/ctgr.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,gBAAgB,EAIhB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;IAClC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GACV,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEtF,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,MAAM,YAAY,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAEzE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,CAAyB;IACtD,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC9B,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAwB;IAClD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAkB,CAAC;IAC7C,OAAO,SAAS,QAAQ,CACtB,MAA0C,EAC1C,IAAY,EACZ,GAAG,QAA4C;QAE/C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAgB,CAAC;QACjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,mCAAmC,CAAC,CAAC;QAEzF,qDAAqD;QACrD,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC7B,EAAE,CAAC,KAAK,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/db/kysely.d.ts

@@ -0,0 +1,15 @@
+import type { Database } from 'bun:sqlite';
+import { Kysely } from 'kysely';
+import type { PlumbingSchema } from './plumbingTypes';
+/**
+ * A Kysely query builder typed to the {@link PlumbingSchema} plumbing tables, on the
+ * `bun:sqlite` dialect. Use it for type-checked reads/writes of sessions, config,
+ * logs, metrics, and jobs. Business / `data JSON` tables stay on raw `db.query()` —
+ * do NOT add them here (that would couple the Kysely schema to every feature table).
+ *
+ * The dialect wraps the SAME `Database` handle the rest of the app uses, so there is
+ * one connection, one WAL, one transaction space.
+ */
+export declare function createKysely(db: Database): Kysely<PlumbingSchema>;
+export type PlumbingDb = Kysely<PlumbingSchema>;
+//# sourceMappingURL=kysely.d.ts.map

package/dist/server/db/kysely.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely.d.ts","sourceRoot":"","sources":["../../../src/server/db/kysely.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAIjE;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC"}

package/dist/server/db/kysely.js

@@ -0,0 +1,17 @@
+import { Kysely } from 'kysely';
+import { BunSqliteDialect } from 'kysely-bun-sqlite';
+/**
+ * A Kysely query builder typed to the {@link PlumbingSchema} plumbing tables, on the
+ * `bun:sqlite` dialect. Use it for type-checked reads/writes of sessions, config,
+ * logs, metrics, and jobs. Business / `data JSON` tables stay on raw `db.query()` —
+ * do NOT add them here (that would couple the Kysely schema to every feature table).
+ *
+ * The dialect wraps the SAME `Database` handle the rest of the app uses, so there is
+ * one connection, one WAL, one transaction space.
+ */
+export function createKysely(db) {
+    return new Kysely({
+        dialect: new BunSqliteDialect({ database: db }),
+    });
+}
+//# sourceMappingURL=kysely.js.map

package/dist/server/db/kysely.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kysely.js","sourceRoot":"","sources":["../../../src/server/db/kysely.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,OAAO,IAAI,MAAM,CAAiB;QAChC,OAAO,EAAE,IAAI,gBAAgB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;KAChD,CAAC,CAAC;AACL,CAAC"}