cursedbelt 2.7.0 → 3.0.0

package/dist/server/audit/sqliteSink.js

@@ -1,96 +0,0 @@
-import { runMigrations } from '../migration/runner';
-import { AUDIT_LOG_MIGRATIONS } from './migrations';
-function rowToRecord(row) {
-    return {
-        namespace: row.namespace,
-        mutationKey: row.mutation_key,
-        targetId: row.target_id,
-        versionKey: row.version_key,
-        operation: row.operation,
-        tenantId: row.tenant_id,
-        changedBy: row.changed_by ?? undefined,
-        changedAt: row.changed_at,
-        snapshot: row.snapshot_data == null ? null : JSON.parse(row.snapshot_data),
-    };
-}
-/**
- * The persistent audit sink: one shared `audit_log` table (see `./migrations`),
- * versioned per `(namespace, targetId)`. Runs its migration on first
- * construction (idempotent — safe to call once per boot per `db`).
- *
- *   const sink = createSqliteAuditSink(db);
- *   const router = buildServerRouter(runtime, config, { verifyToken, audit: { sink } });
- *
- * Deliberately NOT annotated `: AuditSink` — see `cwip/audit`'s
- * `createMemoryAuditSink` for why (this sink is fully synchronous under the
- * hood; the interface's async-capable signature would erase that at every
- * call site). Structurally assignable to `AuditSink` wherever one is expected.
- */
-export function createSqliteAuditSink(db) {
-    runMigrations(db, AUDIT_LOG_MIGRATIONS);
-    // Scoped by tenant (05 §A1). `targetId` is a namespace-local business key, not
-    // a minted global id — a plugin's `todo` row "5" is "5" for every tenant — so
-    // an unscoped MAX() hands tenant B a version number tenant A already used, and
-    // the UNIQUE then refuses B's write over a row B may not read.
-    const nextVersion = db.prepare('SELECT COALESCE(MAX(version_key), 0) + 1 AS v FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ?');
-    const insert = db.prepare(`
-    INSERT INTO audit_log
-      (namespace, mutation_key, target_id, version_key, operation, tenant_id, changed_by, changed_at, snapshot_data)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `);
-    const selectTimeline = db.prepare('SELECT * FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ? ORDER BY version_key ASC');
-    return {
-        record(entry) {
-            // No `await` between the read and the write below — bun:sqlite's calls are
-            // synchronous, so nothing else can interleave and race the version number.
-            const record = db.transaction(() => {
-                const { v: versionKey } = nextVersion.get(entry.tenantId, entry.namespace, entry.targetId);
-                const changedAt = entry.changedAt ?? new Date().toISOString();
-                insert.run(entry.namespace, entry.mutationKey, entry.targetId, versionKey, entry.operation, entry.tenantId, entry.changedBy ?? null, changedAt, entry.snapshot == null ? null : JSON.stringify(entry.snapshot));
-                return { ...entry, versionKey, changedAt };
-            })();
-            return record;
-        },
-        timeline(tenantId, namespace, targetId) {
-            const rows = selectTimeline.all(tenantId, namespace, targetId);
-            return rows.map(rowToRecord);
-        },
-    };
-}
-/**
- * Every read below takes `tenantId` FIRST and as a required argument (05 §A1).
- *
- * `audit_log` is ONE shared table across every namespace and every tenant, and
- * its lookup key `(namespace, targetId)` is a business key a plugin chose — not a
- * minted id. So a read that omits the tenant is not merely broad: it returns
- * another tenant's snapshot for the same row number, which is the whole audit
- * trail's contents. Making the parameter optional (defaulting to "all tenants")
- * would put that one keystroke away, so it is required and positioned where a
- * mistaken call fails to typecheck rather than silently widening.
- */
-/** Query 1: the record's state as of a given moment (last version at or before `at`). */
-export function auditStateAt(db, tenantId, namespace, targetId, at) {
-    const row = db
-        .prepare('SELECT * FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ? AND changed_at <= ? ORDER BY version_key DESC LIMIT 1')
-        .get(tenantId, namespace, targetId, at);
-    return row ? rowToRecord(row) : null;
-}
-/** Query 2: jump directly to a specific `versionKey`. */
-export function auditStateAtVersion(db, tenantId, namespace, targetId, versionKey) {
-    const row = db
-        .prepare('SELECT * FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ? AND version_key = ?')
-        .get(tenantId, namespace, targetId, versionKey);
-    return row ? rowToRecord(row) : null;
-}
-/** Query 3: step one version back/forward from `currentVersion` (for a UI "prev/next" control). */
-export function auditStep(db, tenantId, namespace, targetId, currentVersion, direction) {
-    const row = direction === 'back'
-        ? db
-            .prepare('SELECT * FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ? AND version_key < ? ORDER BY version_key DESC LIMIT 1')
-            .get(tenantId, namespace, targetId, currentVersion)
-        : db
-            .prepare('SELECT * FROM audit_log WHERE tenant_id = ? AND namespace = ? AND target_id = ? AND version_key > ? ORDER BY version_key ASC LIMIT 1')
-            .get(tenantId, namespace, targetId, currentVersion);
-    return row ? rowToRecord(row) : null;
-}
-//# sourceMappingURL=sqliteSink.js.map

package/dist/server/audit/sqliteSink.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sqliteSink.js","sourceRoot":"","sources":["../../../src/server/audit/sqliteSink.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAcpD,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAY;IAChD,aAAa,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAExC,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,sHAAsH,CACvH,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;;GAIzB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAC/B,0GAA0G,CAC3G,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,KAAsB;YAC3B,2EAA2E;YAC3E,2EAA2E;YAC3E,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAgB,EAAE;gBAC9C,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAExF,CAAC;gBACF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC9D,MAAM,CAAC,GAAG,CACR,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,QAAQ,EACd,UAAU,EACV,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,SAAS,EACT,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,QAAQ,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAAgB;YAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAkB,CAAC;YAChF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AAEH,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAC1B,EAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,QAAgB,EAChB,EAAU;IAEV,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN,uIAAuI,CACxI;SACA,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAuB,CAAC;IAChE,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CACjC,EAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,QAAgB,EAChB,UAAkB;IAElB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN,qGAAqG,CACtG;SACA,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAuB,CAAC;IACxE,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,SAAS,CACvB,EAAY,EACZ,QAAgB,EAChB,SAAiB,EACjB,QAAgB,EAChB,cAAsB,EACtB,SAA6B;IAE7B,MAAM,GAAG,GACP,SAAS,KAAK,MAAM;QAClB,CAAC,CAAE,EAAE;aACA,OAAO,CACN,uIAAuI,CACxI;aACA,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAwB;QAC9E,CAAC,CAAE,EAAE;aACA,OAAO,CACN,sIAAsI,CACvI;aACA,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAwB,CAAC;IACnF,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}

package/dist/server/audit/sqliteSink.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=sqliteSink.test.d.ts.map

package/dist/server/audit/sqliteSink.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sqliteSink.test.d.ts","sourceRoot":"","sources":["../../../src/server/audit/sqliteSink.test.ts"],"names":[],"mappings":""}

package/dist/server/audit/sqliteSink.test.js

@@ -1,181 +0,0 @@
-import { Database } from 'bun:sqlite';
-import { beforeEach, describe, expect, it } from 'bun:test';
-import { auditStateAt, auditStateAtVersion, auditStep, createSqliteAuditSink } from './sqliteSink';
-let db;
-beforeEach(() => {
-    db = new Database(':memory:');
-});
-describe('createSqliteAuditSink', () => {
-    it('assigns sequential version keys per (namespace, targetId) and persists snapshots', async () => {
-        const sink = createSqliteAuditSink(db);
-        const v1 = await sink.record({
-            namespace: 'todo',
-            mutationKey: 'add',
-            targetId: '5',
-            operation: 'insert',
-            snapshot: { id: '5', title: 'a' },
-            tenantId: 't1',
-            changedBy: 'u1',
-        });
-        const v2 = await sink.record({
-            namespace: 'todo',
-            mutationKey: 'update',
-            targetId: '5',
-            operation: 'update',
-            snapshot: { id: '5', title: 'b' },
-            tenantId: 't1',
-        });
-        expect(v1.versionKey).toBe(1);
-        expect(v2.versionKey).toBe(2);
-        expect(v1.snapshot).toEqual({ id: '5', title: 'a' });
-    });
-    it('stores a null snapshot for delete tombstones', async () => {
-        const sink = createSqliteAuditSink(db);
-        const deleted = await sink.record({
-            namespace: 'todo',
-            mutationKey: 'remove',
-            targetId: '5',
-            operation: 'delete',
-            snapshot: null,
-            tenantId: 't1',
-        });
-        expect(deleted.snapshot).toBeNull();
-    });
-    it('is idempotent to construct twice against the same db (migration re-run is a no-op)', () => {
-        createSqliteAuditSink(db);
-        expect(() => createSqliteAuditSink(db)).not.toThrow();
-    });
-    it('timeline() returns full history oldest-first', async () => {
-        const sink = createSqliteAuditSink(db);
-        await sink.record({
-            namespace: 'todo',
-            mutationKey: 'add',
-            targetId: '5',
-            operation: 'insert',
-            snapshot: { title: 'a' },
-            tenantId: 't1',
-        });
-        await sink.record({
-            namespace: 'todo',
-            mutationKey: 'remove',
-            targetId: '5',
-            operation: 'delete',
-            snapshot: null,
-            tenantId: 't1',
-        });
-        const timeline = await sink.timeline('t1', 'todo', '5');
-        expect(timeline.map((r) => r.operation)).toEqual(['insert', 'delete']);
-    });
-    // 05 §A1. `targetId` is a namespace-local business key, not a minted id, so
-    // two tenants routinely mutate "5". Before the tenant joined the UNIQUE and
-    // the MAX() that feeds it, tenant B's first write took version 2 — or was
-    // refused outright by tenant A's row — and B's timeline read A's history.
-    it('versions and reads per TENANT, not just per (namespace, targetId)', async () => {
-        const sink = createSqliteAuditSink(db);
-        const entry = (tenantId, title) => ({
-            namespace: 'todo',
-            mutationKey: 'add',
-            targetId: '5',
-            operation: 'insert',
-            snapshot: { title },
-            tenantId,
-        });
-        const first = await sink.record(entry('t1', 'a'));
-        const second = await sink.record(entry('t2', 'b'));
-        expect(first.versionKey).toBe(1);
-        expect(second.versionKey).toBe(1);
-        expect((await sink.timeline('t2', 'todo', '5')).map((r) => r.snapshot)).toEqual([{ title: 'b' }]);
-        expect(auditStateAtVersion(db, 't1', 'todo', '5', 1)?.snapshot).toEqual({ title: 'a' });
-    });
-    // The repair half: a database created before this landing carries
-    // `UNIQUE(namespace, target_id, version_key)` and `CREATE TABLE IF NOT EXISTS`
-    // would never correct it, so `0002` rebuilds — preserving the rows.
-    it('rebuilds a pre-existing audit_log that carries the cross-tenant UNIQUE', () => {
-        db.run(`
-      CREATE TABLE audit_log (
-        audit_id     INTEGER PRIMARY KEY AUTOINCREMENT,
-        namespace    TEXT NOT NULL,
-        mutation_key TEXT NOT NULL,
-        target_id    TEXT NOT NULL,
-        version_key  INTEGER NOT NULL,
-        operation    TEXT NOT NULL CHECK (operation IN ('insert', 'update', 'delete')),
-        tenant_id    TEXT NOT NULL,
-        changed_by   TEXT,
-        changed_at   TEXT NOT NULL,
-        snapshot_data TEXT,
-        UNIQUE(namespace, target_id, version_key)
-      )
-    `);
-        db.run(`INSERT INTO audit_log (namespace, mutation_key, target_id, version_key, operation, tenant_id, changed_at, snapshot_data)
-       VALUES ('todo', 'add', '5', 1, 'insert', 't1', '2026-01-01T00:00:00.000Z', '{"title":"kept"}')`);
-        const sink = createSqliteAuditSink(db);
-        const schema = db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'audit_log'").get().sql;
-        expect(schema).toContain('UNIQUE(tenant_id, namespace, target_id, version_key)');
-        // The history survived the rebuild …
-        expect(auditStateAtVersion(db, 't1', 'todo', '5', 1)?.snapshot).toEqual({ title: 'kept' });
-        // … and the constraint the rebuild exists for now holds.
-        const other = sink.record({
-            namespace: 'todo',
-            mutationKey: 'add',
-            targetId: '5',
-            operation: 'insert',
-            snapshot: { title: 'theirs' },
-            tenantId: 't2',
-        });
-        expect(other.versionKey).toBe(1);
-    });
-});
-describe('time-travel queries', () => {
-    const seed = async () => {
-        const sink = createSqliteAuditSink(db);
-        await sink.record({
-            namespace: 'todo',
-            mutationKey: 'add',
-            targetId: '5',
-            operation: 'insert',
-            snapshot: { title: 'v1' },
-            tenantId: 't1',
-            changedAt: '2026-01-01T00:00:00.000Z',
-        });
-        await sink.record({
-            namespace: 'todo',
-            mutationKey: 'update',
-            targetId: '5',
-            operation: 'update',
-            snapshot: { title: 'v2' },
-            tenantId: 't1',
-            changedAt: '2026-01-02T00:00:00.000Z',
-        });
-        await sink.record({
-            namespace: 'todo',
-            mutationKey: 'update',
-            targetId: '5',
-            operation: 'update',
-            snapshot: { title: 'v3' },
-            tenantId: 't1',
-            changedAt: '2026-01-03T00:00:00.000Z',
-        });
-    };
-    it('auditStateAt returns the last version at or before the given time', async () => {
-        await seed();
-        const state = auditStateAt(db, 't1', 'todo', '5', '2026-01-02T12:00:00.000Z');
-        expect(state?.snapshot).toEqual({ title: 'v2' });
-    });
-    it('auditStateAt returns null before any history exists', async () => {
-        await seed();
-        expect(auditStateAt(db, 't1', 'todo', '5', '2025-12-31T00:00:00.000Z')).toBeNull();
-    });
-    it('auditStateAtVersion jumps directly to a version', async () => {
-        await seed();
-        expect(auditStateAtVersion(db, 't1', 'todo', '5', 1)?.snapshot).toEqual({ title: 'v1' });
-        expect(auditStateAtVersion(db, 't1', 'todo', '5', 99)).toBeNull();
-    });
-    it('auditStep walks back and forward one version', async () => {
-        await seed();
-        expect(auditStep(db, 't1', 'todo', '5', 2, 'back')?.versionKey).toBe(1);
-        expect(auditStep(db, 't1', 'todo', '5', 2, 'forward')?.versionKey).toBe(3);
-        expect(auditStep(db, 't1', 'todo', '5', 1, 'back')).toBeNull();
-        expect(auditStep(db, 't1', 'todo', '5', 3, 'forward')).toBeNull();
-    });
-});
-//# sourceMappingURL=sqliteSink.test.js.map

package/dist/server/audit/sqliteSink.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sqliteSink.test.js","sourceRoot":"","sources":["../../../src/server/audit/sqliteSink.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEnG,IAAI,EAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YACjC,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC3B,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YACjC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;YAClD,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAiB;YAC5B,QAAQ,EAAE,EAAE,KAAK,EAAE;YACnB,QAAQ;SACT,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAEnD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,QAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,+EAA+E;IAC/E,oEAAoE;IACpE,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,EAAE,CAAC,GAAG,CAAC;;;;;;;;;;;;;;KAcN,CAAC,CAAC;QACH,EAAE,CAAC,GAAG,CACJ;sGACgG,CACjG,CAAC;QAEF,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAEvC,MAAM,MAAM,GACV,EAAE,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC,GAAG,EAC1F,CAAC,GAAG,CAAC;QACN,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sDAAsD,CAAC,CAAC;QACjF,qCAAqC;QACrC,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,yDAAyD;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YACxB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YAC7B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,KAAK;YAClB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACzB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACzB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACzB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,0BAA0B;SACtC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,MAAM,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/auth/cookie.d.ts

@@ -1,23 +0,0 @@
-import type { Context } from 'hono';
-/**
- * Cookie helpers on `hono/cookie` (replacing `cookie-parser` + Express
- * `res.cookie`). Two cookies, two deliberately-different `sameSite` postures:
- *
- *  - `access_token` — httpOnly, **`sameSite: Lax`** so it rides top-level
- *    navigations (a returning user lands authenticated). The JWT is the auth
- *    credential; JS must never read it.
- *  - `csrf_token` — JS-readable (the SPA echoes it in a header), **`sameSite:
- *    Strict`** so it is NOT attached to cross-site requests. The two MUST stay
- *    separate cookies (see {@link ./csrf}).
- */
-export declare const AUTH_COOKIE_NAME = "access_token";
-/** Read the httpOnly auth cookie (the access JWT), or undefined. */
-export declare function readAuthCookie(c: Context): string | undefined;
-/**
- * Write the auth cookie. `maxAge` is seconds (cookie spec) — pass the access
- * token's lifetime. httpOnly + `sameSite: Lax`, secure in production.
- */
-export declare function writeAuthCookie(c: Context, token: string, maxAge: number): void;
-/** Clear the auth cookie (logout). */
-export declare function clearAuthCookie(c: Context): void;
-//# sourceMappingURL=cookie.d.ts.map

package/dist/server/auth/cookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../../src/server/auth/cookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGpC;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAI/C,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ/E;AAED,sCAAsC;AACtC,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAEhD"}

package/dist/server/auth/cookie.js

@@ -1,36 +0,0 @@
-import { deleteCookie, getCookie, setCookie } from 'hono/cookie';
-/**
- * Cookie helpers on `hono/cookie` (replacing `cookie-parser` + Express
- * `res.cookie`). Two cookies, two deliberately-different `sameSite` postures:
- *
- *  - `access_token` — httpOnly, **`sameSite: Lax`** so it rides top-level
- *    navigations (a returning user lands authenticated). The JWT is the auth
- *    credential; JS must never read it.
- *  - `csrf_token` — JS-readable (the SPA echoes it in a header), **`sameSite:
- *    Strict`** so it is NOT attached to cross-site requests. The two MUST stay
- *    separate cookies (see {@link ./csrf}).
- */
-export const AUTH_COOKIE_NAME = 'access_token';
-const isProd = () => process.env.NODE_ENV === 'production';
-/** Read the httpOnly auth cookie (the access JWT), or undefined. */
-export function readAuthCookie(c) {
-    return getCookie(c, AUTH_COOKIE_NAME);
-}
-/**
- * Write the auth cookie. `maxAge` is seconds (cookie spec) — pass the access
- * token's lifetime. httpOnly + `sameSite: Lax`, secure in production.
- */
-export function writeAuthCookie(c, token, maxAge) {
-    setCookie(c, AUTH_COOKIE_NAME, token, {
-        httpOnly: true,
-        secure: isProd(),
-        sameSite: 'Lax',
-        maxAge,
-        path: '/',
-    });
-}
-/** Clear the auth cookie (logout). */
-export function clearAuthCookie(c) {
-    deleteCookie(c, AUTH_COOKIE_NAME, { path: '/' });
-}
-//# sourceMappingURL=cookie.js.map

package/dist/server/auth/cookie.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../../src/server/auth/cookie.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEpE,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,KAAa,EAAE,MAAc;IACvE,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE;QACpC,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,EAAE;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM;QACN,IAAI,EAAE,GAAG;KACV,CAAC,CAAC;AACL,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/server/auth/csrf.d.ts

@@ -1,43 +0,0 @@
-import type { MiddlewareHandler } from 'hono';
-/**
- * Double-submit CSRF guard for the cookie-auth + ctgr GET-tunnel model.
- *
- * Because mutations tunnel through a GET (the ctgr twin) and the auth cookie is
- * `sameSite: Lax`, a cross-site top-level navigation could otherwise trigger a
- * state change. We defend with a JS-readable, `sameSite: Strict` `csrf_token`
- * cookie that the SPA echoes back in the `x-csrf-token` header. A cross-origin page
- * can neither read the victim's cookie nor (Strict) cause it to be sent on a
- * cross-site request, so it cannot forge the header.
- *
- * Behavior:
- *  - Safe verbs (GET/HEAD) OUTSIDE the protected prefix: mint the `csrf_token`
- *    cookie if absent (so a returning user has it on first paint), then continue.
- *    Genuine reads are never CSRF-checked.
- *  - ANY request whose path starts with the protected prefix (default `/ctgr`),
- *    regardless of HTTP method: require `header === cookie`, else 403. Every ctgr
- *    request is a tunneled mutation — and the twin rides a *GET* — so the check must
- *    fire even on GET here, or the exact attack CSRF defends against (a cross-site
- *    navigation/`<img>` to a `/ctgr*` mutation) slips through. Enforcing on the
- *    prefix (not the verb) keeps the guarantee independent of where task-25's
- *    `unGETify` sits in the chain. (Invariant #2: ctgr protection may never weaken.)
- *  - Mutating verbs OUTSIDE the prefix are NOT checked here (in production all
- *    mutations come through ctgr; direct verbs are internal/test traffic).
- *
- * MOUNT GLOBALLY — `app.use('*', createCsrfMiddleware())`. It matches the prefix with
- * a plain `path.startsWith`, so it is immune to Hono's `/ctgr*`-doesn't-match wildcard
- * gotcha; do NOT mount it on `CTGR_ROUTE_PATTERN` (that pattern is for the `unGETify`
- * decode mount) — a prefix-only mount would never run on normal reads and so would
- * never mint the `csrf_token` cookie.
- */
-export interface CsrfOptions {
-    /** Path prefix whose requests are CSRF-checked. Default `/ctgr`. */
-    protectedPrefix?: string;
-    /** Cookie name. Default `csrf_token`. */
-    cookieName?: string;
-    /** Request header the SPA echoes the token in. Default `x-csrf-token`. */
-    headerName?: string;
-}
-export declare const CSRF_COOKIE_NAME = "csrf_token";
-export declare const CSRF_HEADER_NAME = "x-csrf-token";
-export declare function createCsrfMiddleware(opts?: CsrfOptions): MiddlewareHandler;
-//# sourceMappingURL=csrf.d.ts.map

package/dist/server/auth/csrf.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../src/server/auth/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAI/C,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,WAAgB,GAAG,iBAAiB,CAkC9E"}

package/dist/server/auth/csrf.js

@@ -1,37 +0,0 @@
-import { getCookie, setCookie } from 'hono/cookie';
-import { ApiError, toErrorEnvelope } from '../errors';
-export const CSRF_COOKIE_NAME = 'csrf_token';
-export const CSRF_HEADER_NAME = 'x-csrf-token';
-const isProd = () => process.env.NODE_ENV === 'production';
-export function createCsrfMiddleware(opts = {}) {
-    const prefix = opts.protectedPrefix ?? '/ctgr';
-    const cookieName = opts.cookieName ?? CSRF_COOKIE_NAME;
-    const headerName = opts.headerName ?? CSRF_HEADER_NAME;
-    return async (c, next) => {
-        const method = c.req.method;
-        const isProtected = c.req.path.startsWith(prefix);
-        // Genuine reads (outside the ctgr tunnel): mint the cookie, never enforce.
-        if (!isProtected && (method === 'GET' || method === 'HEAD')) {
-            if (!getCookie(c, cookieName)) {
-                setCookie(c, cookieName, crypto.randomUUID(), {
-                    httpOnly: false, // the SPA must read it to echo it back
-                    secure: isProd(),
-                    sameSite: 'Strict',
-                    path: '/',
-                });
-            }
-            return next();
-        }
-        // Every ctgr request is a tunneled mutation (the twin is a GET) — enforce here
-        // regardless of verb. Non-ctgr mutating verbs fall through unchecked.
-        if (isProtected) {
-            const header = c.req.header(headerName);
-            const cookie = getCookie(c, cookieName);
-            if (!header || header !== cookie) {
-                return c.json(toErrorEnvelope(new ApiError(403, 'Invalid CSRF token')), 403);
-            }
-        }
-        return next();
-    };
-}
-//# sourceMappingURL=csrf.js.map

package/dist/server/auth/csrf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../../src/server/auth/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAyCtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEpE,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAEvD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAElD,2EAA2E;QAC3E,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9B,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE;oBAC5C,QAAQ,EAAE,KAAK,EAAE,uCAAuC;oBACxD,MAAM,EAAE,MAAM,EAAE;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,+EAA+E;QAC/E,sEAAsE;QACtE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/auth/fileTokenSigner.d.ts

@@ -1,11 +0,0 @@
-import type { FileTokenSigner } from '../storage/binaryServerStore';
-export type Rs256FileTokenSignerOptions = {
-    /** PKCS8 PEM private key. `\n` escape sequences are accepted (env-var friendly). */
-    privateKeyPem: string;
-    /** The `iss` claim — must match the issuer the tenant was registered with. */
-    issuer: string;
-    /** Token lifetime in seconds (default 6h — long enough for a paused, resumed video). */
-    ttlSeconds?: number;
-};
-export declare function createRs256FileTokenSigner(opts: Rs256FileTokenSignerOptions): FileTokenSigner;
-//# sourceMappingURL=fileTokenSigner.d.ts.map

package/dist/server/auth/fileTokenSigner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fileTokenSigner.d.ts","sourceRoot":"","sources":["../../../src/server/auth/fileTokenSigner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAOrF,MAAM,MAAM,2BAA2B,GAAG;IACxC,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,eAAe,CAsB7F"}

package/dist/server/auth/fileTokenSigner.js

@@ -1,23 +0,0 @@
-import { importPKCS8, SignJWT } from 'jose';
-export function createRs256FileTokenSigner(opts) {
-    const ttl = opts.ttlSeconds ?? 6 * 60 * 60;
-    const pem = opts.privateKeyPem.includes('-----')
-        ? opts.privateKeyPem.replace(/\\n/g, '\n')
-        : Buffer.from(opts.privateKeyPem, 'base64').toString('utf8');
-    // Lazy: a bad key must surface as a sign-time error, not an unhandled
-    // rejection parked on a module-scope promise from construction time.
-    let keyPromise = null;
-    return async (claims) => {
-        keyPromise ??= importPKCS8(pem, 'RS256');
-        const key = await keyPromise;
-        // Drop undefined values — jose serializes them as null otherwise.
-        const payload = Object.fromEntries(Object.entries(claims).filter(([, v]) => v !== undefined));
-        return new SignJWT(payload)
-            .setProtectedHeader({ alg: 'RS256' })
-            .setIssuer(opts.issuer)
-            .setIssuedAt()
-            .setExpirationTime(`${ttl}s`)
-            .sign(key);
-    };
-}
-//# sourceMappingURL=fileTokenSigner.js.map

package/dist/server/auth/fileTokenSigner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"fileTokenSigner.js","sourceRoot":"","sources":["../../../src/server/auth/fileTokenSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAiB5C,MAAM,UAAU,0BAA0B,CAAC,IAAiC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;QAC1C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,sEAAsE;IACtE,qEAAqE;IACrE,IAAI,UAAU,GAA0C,IAAI,CAAC;IAC7D,OAAO,KAAK,EAAE,MAAuB,EAAmB,EAAE;QACxD,UAAU,KAAK,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC7B,kEAAkE;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAC1D,CAAC;QACF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aACpC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;aAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/auth/getOnly.d.ts

@@ -1,21 +0,0 @@
-import type { MiddlewareHandler } from 'hono';
-import type { AuthEnv } from './types';
-/**
- * `getOnly` enforcement — the server-side half of the `/f` GET-only session
- * guarantee. A getOnly session (the obfuscated `/f` login) may read freely and may
- * mutate ONLY through the ctgr GET-twins (which are GETs at the transport level);
- * any raw non-GET/HEAD verb from such a session is rejected with 403.
- *
- * Mount GLOBALLY (`app.use('*', getOnlyEnforcement())`) AFTER `createAuthMiddleware`
- * — it reads the `user` the auth middleware sets and gates purely on the HTTP verb,
- * so it needs no ctgr path pattern (it must see EVERY mutating request, not only
- * `/ctgr*`). A non-getOnly session — or an unauthenticated request that never reached
- * here — passes through untouched.
- */
-/** Pure predicate: does this principal+method combination violate the GET-only
- * rule? Exposed for direct unit testing and reuse outside the middleware. */
-export declare function isGetOnlyViolation(user: {
-    getOnly?: boolean;
-}, method: string): boolean;
-export declare function getOnlyEnforcement(): MiddlewareHandler<AuthEnv>;
-//# sourceMappingURL=getOnly.d.ts.map

package/dist/server/auth/getOnly.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getOnly.d.ts","sourceRoot":"","sources":["../../../src/server/auth/getOnly.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;;;;GAWG;AAEH;6EAC6E;AAC7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEvF;AAED,wBAAgB,kBAAkB,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAQ/D"}

package/dist/server/auth/getOnly.js

@@ -1,28 +0,0 @@
-import { ApiError, toErrorEnvelope } from '../errors';
-/**
- * `getOnly` enforcement — the server-side half of the `/f` GET-only session
- * guarantee. A getOnly session (the obfuscated `/f` login) may read freely and may
- * mutate ONLY through the ctgr GET-twins (which are GETs at the transport level);
- * any raw non-GET/HEAD verb from such a session is rejected with 403.
- *
- * Mount GLOBALLY (`app.use('*', getOnlyEnforcement())`) AFTER `createAuthMiddleware`
- * — it reads the `user` the auth middleware sets and gates purely on the HTTP verb,
- * so it needs no ctgr path pattern (it must see EVERY mutating request, not only
- * `/ctgr*`). A non-getOnly session — or an unauthenticated request that never reached
- * here — passes through untouched.
- */
-/** Pure predicate: does this principal+method combination violate the GET-only
- * rule? Exposed for direct unit testing and reuse outside the middleware. */
-export function isGetOnlyViolation(user, method) {
-    return user.getOnly === true && method !== 'GET' && method !== 'HEAD';
-}
-export function getOnlyEnforcement() {
-    return async (c, next) => {
-        const user = c.get('user');
-        if (user && isGetOnlyViolation(user, c.req.method)) {
-            return c.json(toErrorEnvelope(new ApiError(403, 'GET-only session')), 403);
-        }
-        return next();
-    };
-}
-//# sourceMappingURL=getOnly.js.map

package/dist/server/auth/getOnly.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getOnly.js","sourceRoot":"","sources":["../../../src/server/auth/getOnly.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGtD;;;;;;;;;;;GAWG;AAEH;6EAC6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,IAA2B,EAAE,MAAc;IAC5E,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,IAAI,IAAI,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,13 +0,0 @@
-export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie';
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type CsrfOptions, createCsrfMiddleware } from './csrf';
-export { createRs256FileTokenSigner, type Rs256FileTokenSignerOptions, } from './fileTokenSigner';
-export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-export { signToken, verifyPurposeToken, verifyToken } from './jwt';
-export { clientKeyOf, clientKeyOfContext, createLoginThrottle, type LoginThrottle, type LoginThrottleOptions, type ThrottleVerdict, } from './loginThrottle';
-export { createAuthMiddleware } from './middleware';
-export { hashPassword, needsRehash, verifyPassword } from './password';
-export { createSessionStore, type SessionStoreOptions, } from './sessionStore';
-export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp';
-export type { AppJwtPayload, AuthEnv, AuthUser, AuthVariables, CreateSessionInput, Session, SessionStore, TokenPurpose, } from './types';
-export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,WAAW,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EACL,0BAA0B,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACnE,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,QAAQ,CAAC;AAChB,YAAY,EACV,aAAa,EACb,OAAO,EACP,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,YAAY,EACZ,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC"}

package/dist/server/auth/index.js

@@ -1,16 +0,0 @@
-// cursedbelt server auth toolkit (task 26) — jose JWT, cookies, CSRF, the getOnly
-// gate, a Kysely-backed session store, login throttle, argon2id passwords, TOTP, and
-// Web-Crypto vault item crypto. The *mechanism* lives here; the *model* (roles,
-// sharing, the `/f`-vs-`/login` policy, session semantics) stays in the apps.
-export { AUTH_COOKIE_NAME, clearAuthCookie, readAuthCookie, writeAuthCookie, } from './cookie';
-export { CSRF_COOKIE_NAME, CSRF_HEADER_NAME, createCsrfMiddleware } from './csrf';
-export { createRs256FileTokenSigner, } from './fileTokenSigner';
-export { getOnlyEnforcement, isGetOnlyViolation } from './getOnly';
-export { signToken, verifyPurposeToken, verifyToken } from './jwt';
-export { clientKeyOf, clientKeyOfContext, createLoginThrottle, } from './loginThrottle';
-export { createAuthMiddleware } from './middleware';
-export { hashPassword, needsRehash, verifyPassword } from './password';
-export { createSessionStore, } from './sessionStore';
-export { DEFAULT_TOTP_ISSUER, generateRecoveryCodes, generateTotpSecret, getTotpUri, verifyRecoveryCode, verifyTotpCode, } from './totp';
-export { decryptVaultItem, deriveVaultKey, encryptVaultItem } from './vault';
-//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,qFAAqF;AACrF,gFAAgF;AAChF,8EAA8E;AAE9E,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAoB,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EACL,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACnE,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EACL,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,cAAc,GACf,MAAM,QAAQ,CAAC;AAWhB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC"}