cursedbelt 2.7.0 → 3.0.0

package/dist/server/auth/sessionStore.js

@@ -1,222 +0,0 @@
-/**
- * Kysely-backed, revocable, restart-surviving session store (task 26).
- *
- * The in-memory map is the hot-path source of truth for token validity — the auth
- * middleware reads it synchronously, no per-request DB round-trip. The
- * `auth_sessions` table exists only so the map can be rebuilt after a restart
- * ({@link SessionStore.rehydrate}); DB writes for sliding `touch`es are throttled
- * (memory is always current). Single-server deployment, so there is no
- * cross-instance coherence to manage.
- */
-const HOUR_MS = 60 * 60 * 1000;
-const DAY_MS = 24 * HOUR_MS;
-const rowToSession = (r) => ({
-    sessionId: r.session_id,
-    userId: r.user_id,
-    getOnly: r.get_only === 1,
-    createdAt: r.created_at,
-    lastSeenAt: r.last_seen_at,
-    refreshExpiresAt: r.refresh_expires_at,
-    accessExpiresAt: r.access_expires_at,
-    disabled: r.disabled === 1,
-    disabledAt: r.disabled_at,
-    disabledBy: r.disabled_by,
-    userAgent: r.user_agent,
-    ip: r.ip,
-});
-export function createSessionStore(ky, opts = {}) {
-    const refreshWindowMs = opts.refreshWindowMs ?? 7 * DAY_MS;
-    const retentionMs = opts.retentionMs ?? 30 * DAY_MS;
-    const flushIntervalMs = opts.flushIntervalMs ?? 60_000;
-    const pruneIntervalMs = opts.pruneIntervalMs ?? HOUR_MS;
-    const map = new Map();
-    const lastFlushAt = new Map();
-    let pruneTimer;
-    const isFresh = (s, now = Date.now()) => !!s && !s.disabled && Date.parse(s.refreshExpiresAt) >= now;
-    const store = {
-        async rehydrate() {
-            // Drop ancient rows first so the map starts trim, then load only currently-valid
-            // sessions (disabled/expired rows stay in the DB for the audit view).
-            await store.prune();
-            const rows = await ky.selectFrom('auth_sessions').selectAll().execute();
-            const now = Date.now();
-            map.clear();
-            lastFlushAt.clear();
-            for (const r of rows) {
-                const s = rowToSession(r);
-                if (isFresh(s, now)) {
-                    map.set(s.sessionId, s);
-                    lastFlushAt.set(s.sessionId, now);
-                }
-            }
-        },
-        async create(input) {
-            const now = Date.now();
-            const nowIso = new Date(now).toISOString();
-            const session = {
-                sessionId: input.sessionId,
-                userId: input.userId,
-                getOnly: input.getOnly ?? false,
-                createdAt: nowIso,
-                lastSeenAt: nowIso,
-                refreshExpiresAt: input.refreshExpiresAt ?? new Date(now + refreshWindowMs).toISOString(),
-                accessExpiresAt: input.accessExpiresAt ?? null,
-                disabled: false,
-                disabledAt: null,
-                disabledBy: null,
-                userAgent: input.userAgent ?? null,
-                ip: input.ip ?? null,
-            };
-            map.set(session.sessionId, session);
-            lastFlushAt.set(session.sessionId, now);
-            await ky
-                .insertInto('auth_sessions')
-                .values({
-                session_id: session.sessionId,
-                user_id: session.userId,
-                get_only: session.getOnly ? 1 : 0,
-                created_at: session.createdAt,
-                last_seen_at: session.lastSeenAt,
-                refresh_expires_at: session.refreshExpiresAt,
-                access_expires_at: session.accessExpiresAt,
-                disabled: 0,
-                disabled_at: null,
-                disabled_by: null,
-                user_agent: session.userAgent,
-                ip: session.ip,
-            })
-                .execute();
-            return session;
-        },
-        get(sessionId) {
-            return map.get(sessionId);
-        },
-        isValid(session) {
-            return isFresh(session);
-        },
-        async touch(sessionId, opts2) {
-            const s = map.get(sessionId);
-            if (!s)
-                return;
-            const now = Date.now();
-            s.lastSeenAt = new Date(now).toISOString();
-            s.refreshExpiresAt = new Date(now + refreshWindowMs).toISOString();
-            const reissued = opts2?.accessExpiresAt !== undefined;
-            if (reissued)
-                s.accessExpiresAt = opts2?.accessExpiresAt ?? null;
-            const last = lastFlushAt.get(sessionId) ?? 0;
-            if (reissued || now - last > flushIntervalMs) {
-                await ky
-                    .updateTable('auth_sessions')
-                    .set({
-                    last_seen_at: s.lastSeenAt,
-                    refresh_expires_at: s.refreshExpiresAt,
-                    access_expires_at: s.accessExpiresAt,
-                })
-                    .where('session_id', '=', sessionId)
-                    .execute();
-                lastFlushAt.set(sessionId, now);
-            }
-        },
-        async disable(sessionId, disabledBy = null) {
-            const s = map.get(sessionId);
-            const nowIso = new Date().toISOString();
-            if (s) {
-                s.disabled = true;
-                s.disabledAt = nowIso;
-                s.disabledBy = disabledBy;
-            }
-            const res = await ky
-                .updateTable('auth_sessions')
-                .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
-                .where('session_id', '=', sessionId)
-                .where('disabled', '=', 0)
-                .executeTakeFirst();
-            return s !== undefined || Number(res?.numUpdatedRows ?? 0) > 0;
-        },
-        async disableAllForUser(userId, disabledBy = null) {
-            const nowIso = new Date().toISOString();
-            const affected = [];
-            for (const s of map.values()) {
-                if (s.userId === userId && !s.disabled) {
-                    s.disabled = true;
-                    s.disabledAt = nowIso;
-                    s.disabledBy = disabledBy;
-                    affected.push(s.sessionId);
-                }
-            }
-            await ky
-                .updateTable('auth_sessions')
-                .set({ disabled: 1, disabled_at: nowIso, disabled_by: disabledBy })
-                .where('user_id', '=', userId)
-                .where('disabled', '=', 0)
-                .execute();
-            return affected;
-        },
-        async remove(sessionId) {
-            map.delete(sessionId);
-            lastFlushAt.delete(sessionId);
-            await ky.deleteFrom('auth_sessions').where('session_id', '=', sessionId).execute();
-        },
-        async deleteByUser(userId) {
-            for (const [id, s] of map) {
-                if (s.userId === userId) {
-                    map.delete(id);
-                    lastFlushAt.delete(id);
-                }
-            }
-            await ky.deleteFrom('auth_sessions').where('user_id', '=', userId).execute();
-        },
-        async listByUser(userId) {
-            const rows = await ky
-                .selectFrom('auth_sessions')
-                .selectAll()
-                .where('user_id', '=', userId)
-                .orderBy('created_at', 'desc')
-                .execute();
-            return rows.map(rowToSession);
-        },
-        listAll() {
-            return Array.from(map.values());
-        },
-        getLastSeenForUser(userId) {
-            let latest = null;
-            for (const s of map.values()) {
-                if (s.userId !== userId || s.disabled)
-                    continue;
-                if (!latest || s.lastSeenAt > latest)
-                    latest = s.lastSeenAt;
-            }
-            return latest;
-        },
-        async prune() {
-            const cutoff = Date.now() - retentionMs;
-            const cutoffIso = new Date(cutoff).toISOString();
-            let removed = 0;
-            for (const [id, s] of map) {
-                if (Date.parse(s.lastSeenAt) < cutoff) {
-                    map.delete(id);
-                    lastFlushAt.delete(id);
-                    removed++;
-                }
-            }
-            await ky.deleteFrom('auth_sessions').where('last_seen_at', '<', cutoffIso).execute();
-            return removed;
-        },
-        stop() {
-            if (pruneTimer) {
-                clearInterval(pruneTimer);
-                pruneTimer = undefined;
-            }
-        },
-    };
-    if (opts.autoPrune) {
-        pruneTimer = setInterval(() => {
-            void store.prune();
-        }, pruneIntervalMs);
-        // Never keep the process alive for a prune tick.
-        pruneTimer.unref?.();
-    }
-    return store;
-}
-//# sourceMappingURL=sessionStore.js.map

package/dist/server/auth/sessionStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../../../src/server/auth/sessionStore.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC;AAmB5B,MAAM,YAAY,GAAG,CAAC,CAAiB,EAAW,EAAE,CAAC,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,UAAU,EAAE,CAAC,CAAC,YAAY;IAC1B,gBAAgB,EAAE,CAAC,CAAC,kBAAkB;IACtC,eAAe,EAAE,CAAC,CAAC,iBAAiB;IACpC,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,UAAU,EAAE,CAAC,CAAC,WAAW;IACzB,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,EAAE,EAAE,CAAC,CAAC,EAAE;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,OAA4B,EAAE;IAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,IAAI,UAAsD,CAAC;IAE3D,MAAM,OAAO,GAAG,CAAC,CAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAgB,EAAE,CACzE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;IAE9D,MAAM,KAAK,GAAiB;QAC1B,KAAK,CAAC,SAAS;YACb,iFAAiF;YACjF,sEAAsE;YACtE,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;oBACpB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;oBACxB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAyB;YACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAY;gBACvB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;gBAC/B,SAAS,EAAE,MAAM;gBACjB,UAAU,EAAE,MAAM;gBAClB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE;gBACzF,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;gBAC9C,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;aACrB,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,EAAE;iBACL,UAAU,CAAC,eAAe,CAAC;iBAC3B,MAAM,CAAC;gBACN,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,YAAY,EAAE,OAAO,CAAC,UAAU;gBAChC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;gBAC5C,iBAAiB,EAAE,OAAO,CAAC,eAAe;gBAC1C,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,IAAI;gBACjB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,OAAO,CAAC,SAAS;gBAC7B,EAAE,EAAE,OAAO,CAAC,EAAE;aACf,CAAC;iBACD,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,GAAG,CAAC,SAAS;YACX,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,CAAC,OAAO;YACb,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK;YAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3C,CAAC,CAAC,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,MAAM,QAAQ,GAAG,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC;YACtD,IAAI,QAAQ;gBAAE,CAAC,CAAC,eAAe,GAAG,KAAK,EAAE,eAAe,IAAI,IAAI,CAAC;YAEjE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,eAAe,EAAE,CAAC;gBAC7C,MAAM,EAAE;qBACL,WAAW,CAAC,eAAe,CAAC;qBAC5B,GAAG,CAAC;oBACH,YAAY,EAAE,CAAC,CAAC,UAAU;oBAC1B,kBAAkB,EAAE,CAAC,CAAC,gBAAgB;oBACtC,iBAAiB,EAAE,CAAC,CAAC,eAAe;iBACrC,CAAC;qBACD,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;qBACnC,OAAO,EAAE,CAAC;gBACb,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI;YACxC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC;gBACN,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;gBACtB,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5B,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,eAAe,CAAC;iBAC5B,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;iBAClE,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;iBACnC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;iBACzB,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI;YAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACvC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;oBAClB,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC;oBACtB,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,MAAM,EAAE;iBACL,WAAW,CAAC,eAAe,CAAC;iBAC5B,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;iBAClE,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC7B,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;iBACzB,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAS;YACpB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtB,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACxB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACf,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,eAAe,CAAC;iBAC3B,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC7B,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;QAED,OAAO;YACL,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,kBAAkB,CAAC,MAAM;YACvB,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBAChD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM;oBAAE,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC;YAC9D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC;oBACtC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACf,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACvB,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACrF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI;YACF,IAAI,UAAU,EAAE,CAAC;gBACf,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,eAAe,CAAC,CAAC;QACpB,iDAAiD;QACjD,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server/auth/totp.d.ts

@@ -1,35 +0,0 @@
-/**
- * TOTP (RFC 6238) on `otplib` — standard authenticator-app parameters (base32
- * secret, SHA-1, 6 digits, 30s step). otplib's default plugins are pure-JS
- * (`@noble/hashes` + `@scure/base`), so this runs natively on Bun with no native
- * deps. Plus single-use recovery codes hashed with argon2id (never stored plain).
- *
- * The toolkit provides the crypto; enabling/disabling 2FA, persisting the secret +
- * recovery hashes, and the login-flow ordering stay app-business (task 32).
- */
-export declare const DEFAULT_TOTP_ISSUER = "CursedAlchemy";
-/** A fresh random base32 TOTP secret (20 bytes / 160 bits — the standard). */
-export declare function generateTotpSecret(): string;
-/** The `otpauth://` URI an authenticator app scans / imports (for QR rendering). */
-export declare function getTotpUri(account: string, secret: string, issuer?: string): string;
-/**
- * Verify a user-entered 6-digit code against a base32 secret, allowing ±1 step of
- * drift. Tolerates surrounding whitespace; rejects anything that isn't six digits.
- */
-export declare function verifyTotpCode(token: string, secret: string): boolean;
-/**
- * Generate `count` single-use recovery codes. Returns `plaintext` (shown to the user
- * exactly once) and `hashed` (argon2id PHC strings — persist these as a JSON array,
- * never the plaintext).
- */
-export declare function generateRecoveryCodes(count?: number): Promise<{
-    plaintext: string[];
-    hashed: string[];
-}>;
-/**
- * Verify a candidate recovery code against the stored argon2id hashes. Returns the
- * index of the matching hash, or -1 if none match. The caller consumes it (splice
- * that index out and persist the shortened array) so each code works exactly once.
- */
-export declare function verifyRecoveryCode(input: string, hashed: string[]): Promise<number>;
-//# sourceMappingURL=totp.d.ts.map

package/dist/server/auth/totp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../src/server/auth/totp.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAMnD,8EAA8E;AAC9E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAQrE;AAoBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,SAAK,GACT,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAMpD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzF"}

package/dist/server/auth/totp.js

@@ -1,82 +0,0 @@
-import { generateSecret, generateURI, verifySync } from 'otplib';
-/**
- * TOTP (RFC 6238) on `otplib` — standard authenticator-app parameters (base32
- * secret, SHA-1, 6 digits, 30s step). otplib's default plugins are pure-JS
- * (`@noble/hashes` + `@scure/base`), so this runs natively on Bun with no native
- * deps. Plus single-use recovery codes hashed with argon2id (never stored plain).
- *
- * The toolkit provides the crypto; enabling/disabling 2FA, persisting the secret +
- * recovery hashes, and the login-flow ordering stay app-business (task 32).
- */
-export const DEFAULT_TOTP_ISSUER = 'CursedAlchemy';
-// One 30s step of clock-skew tolerance on each side (±1 step). otplib v13 defaults
-// to ZERO tolerance, so we set it explicitly (period = 30s).
-const DRIFT_SECONDS = 30;
-/** A fresh random base32 TOTP secret (20 bytes / 160 bits — the standard). */
-export function generateTotpSecret() {
-    return generateSecret();
-}
-/** The `otpauth://` URI an authenticator app scans / imports (for QR rendering). */
-export function getTotpUri(account, secret, issuer = DEFAULT_TOTP_ISSUER) {
-    return generateURI({ issuer, label: account, secret });
-}
-/**
- * Verify a user-entered 6-digit code against a base32 secret, allowing ±1 step of
- * drift. Tolerates surrounding whitespace; rejects anything that isn't six digits.
- */
-export function verifyTotpCode(token, secret) {
-    const clean = String(token).replace(/\s+/g, '');
-    if (!/^\d{6}$/.test(clean))
-        return false;
-    try {
-        return verifySync({ secret, token: clean, epochTolerance: DRIFT_SECONDS }).valid;
-    }
-    catch {
-        return false;
-    }
-}
-// ── Recovery codes ──────────────────────────────────────────────────────────────
-// No easily-confused characters (no 0/O, 1/I/L) — readable + dictatable.
-const CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
-/** Strip separators + uppercase, so display formatting never affects matching. */
-const normalizeCode = (code) => String(code)
-    .replace(/[^a-zA-Z0-9]/g, '')
-    .toUpperCase();
-const randomCode = () => {
-    const bytes = crypto.getRandomValues(new Uint8Array(10));
-    let s = '';
-    for (const b of bytes)
-        s += CODE_ALPHABET[b % CODE_ALPHABET.length];
-    return `${s.slice(0, 5)}-${s.slice(5)}`; // e.g. "A1B2C-D3E4F"
-};
-/**
- * Generate `count` single-use recovery codes. Returns `plaintext` (shown to the user
- * exactly once) and `hashed` (argon2id PHC strings — persist these as a JSON array,
- * never the plaintext).
- */
-export async function generateRecoveryCodes(count = 10) {
-    const plaintext = Array.from({ length: count }, randomCode);
-    const hashed = await Promise.all(plaintext.map((code) => Bun.password.hash(normalizeCode(code), { algorithm: 'argon2id' })));
-    return { plaintext, hashed };
-}
-/**
- * Verify a candidate recovery code against the stored argon2id hashes. Returns the
- * index of the matching hash, or -1 if none match. The caller consumes it (splice
- * that index out and persist the shortened array) so each code works exactly once.
- */
-export async function verifyRecoveryCode(input, hashed) {
-    const candidate = normalizeCode(input);
-    if (!candidate)
-        return -1;
-    for (let i = 0; i < hashed.length; i++) {
-        try {
-            if (await Bun.password.verify(candidate, hashed[i]))
-                return i;
-        }
-        catch {
-            // ignore a malformed stored hash — treat as a non-match
-        }
-    }
-    return -1;
-}
-//# sourceMappingURL=totp.js.map

package/dist/server/auth/totp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/server/auth/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEjE;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,mFAAmF;AACnF,6DAA6D;AAC7D,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,EAAE,CAAC;AAC1B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,mBAAmB;IACtF,OAAO,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AAEnF,yEAAyE;AACzE,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,kFAAkF;AAClF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,MAAM,CAAC,IAAI,CAAC;KACT,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;KAC5B,WAAW,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,aAAa,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB;AAChE,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAK,GAAG,EAAE;IAEV,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAC3F,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAgB;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/server/auth/types.d.ts

@@ -1,134 +0,0 @@
-import type { JWTPayload } from 'jose';
-import type { CursedbeltVariables } from '../context';
-/**
- * Shared auth types for the cursedbelt server auth toolkit.
- *
- * cursedbelt owns the *mechanism* (sign/verify, session validity, the getOnly
- * gate, CSRF, throttling, TOTP, vault crypto). The *model* — which roles may do
- * what, the `/f`-vs-`/login` policy, what a "session" means to the product — stays
- * in the consuming app. The toolkit carries `roles`/`getOnly`/`purpose` opaquely
- * and never interprets them beyond the documented gates.
- */
-/** Token purposes the apps mint. `access` is the login session; the rest are
- * short-lived single-feature unlock/state tokens (held in page memory, never a
- * cookie). cursedbelt does not enforce these — {@link AppJwtPayload.purpose} is an
- * opaque string the app sets and checks (via `verifyPurposeToken`). */
-export type TokenPurpose = 'access' | 'refresh' | 'vault-unlock' | 'pm-unlock' | 'files-unlock' | 'yt-oauth';
-/**
- * The decoded JWT payload shape the apps use. `userId`/`sessionId` tie a token to
- * its user + its row in the session store (the kill switch); `roles` + `getOnly`
- * ride along for the auth middleware to surface on `c.get('user')`.
- */
-export interface AppJwtPayload extends JWTPayload {
-    userId: string;
-    sessionId: string;
-    roles: string[];
-    /** GET-only (`/f`) session marker. Absent on tokens minted before the claim
-     * existed → treated as `false` (see {@link AuthUser.getOnly}). */
-    getOnly?: boolean;
-    /** See {@link TokenPurpose}. Absent ⇒ a plain access token. */
-    purpose?: TokenPurpose | (string & {});
-}
-/**
- * The authenticated principal the auth middleware sets on `c.get('user')`. This is
- * the *normalized* view (getOnly defaulted), distinct from the raw {@link AppJwtPayload}.
- */
-export interface AuthUser {
-    id: string;
-    roles: string[];
-    /** Normalized: a missing `getOnly` claim becomes `false` here. */
-    getOnly: boolean;
-    sessionId: string;
-}
-/** Hono `Variables` the auth middleware contributes. Composed with the base
- * {@link CursedbeltVariables} into {@link AuthEnv}. */
-export interface AuthVariables {
-    /** Set by `createAuthMiddleware` once the token + session are validated. */
-    user: AuthUser;
-}
-/** The Hono env an app gets once it mounts the cursedbelt auth middleware: the
- * base plumbing variables plus the authenticated `user`. `user` is typed required
- * because the gate runs before any handler that reads it; mount auth before the
- * routes that depend on it. */
-export interface AuthEnv {
-    Variables: CursedbeltVariables & AuthVariables;
-}
-/** A persisted login session — the in-memory + DB-backed record the auth middleware
- * checks on every request (revocation + sliding-refresh expiry). */
-export interface Session {
-    sessionId: string;
-    userId: string;
-    /** GET-only (`/f`) session. Copied onto the access token's `getOnly` claim. */
-    getOnly: boolean;
-    createdAt: string;
-    lastSeenAt: string;
-    /** Sliding deadline: a session is valid while now < refreshExpiresAt. */
-    refreshExpiresAt: string;
-    /** When the *current* access token expires (informational; the cookie/JWT is the
-     * real gate). Null until first issued. */
-    accessExpiresAt: string | null;
-    disabled: boolean;
-    disabledAt: string | null;
-    disabledBy: string | null;
-    userAgent: string | null;
-    ip: string | null;
-}
-/** Inputs to mint a session. The store computes `createdAt`/`lastSeenAt` and (unless
- * overridden) `refreshExpiresAt` from its configured window — callers never hand-roll
- * timestamps. */
-export interface CreateSessionInput {
-    sessionId: string;
-    userId: string;
-    getOnly?: boolean;
-    accessExpiresAt?: string | null;
-    userAgent?: string | null;
-    ip?: string | null;
-    /** Override the computed `now + refreshWindowMs` deadline. */
-    refreshExpiresAt?: string;
-}
-/**
- * Revocable, restart-surviving session store. The in-memory map is the hot-path
- * source of truth for token validity (no per-request DB read); the `auth_sessions`
- * table exists so the map can be rebuilt after a restart ({@link SessionStore.rehydrate}).
- * Single-server deployment — no cross-instance coherence to manage.
- */
-export interface SessionStore {
-    /** Load the table into memory on boot (prunes expired/old rows first). */
-    rehydrate(): Promise<void>;
-    /** Persist + cache a new session. */
-    create(input: CreateSessionInput): Promise<Session>;
-    /** Sync hot-path read from memory. Returns the LIVE cached object (not a copy) —
-     * treat it read-only; mutate only through the store's methods. */
-    get(sessionId: string): Session | undefined;
-    /** Is this session usable right now (present, not disabled, inside its window)? */
-    isValid(session: Session | undefined): session is Session;
-    /** Slide the refresh deadline forward on activity (and optionally record a freshly
-     * issued access-token expiry). DB write is throttled unless `accessExpiresAt` is
-     * passed (a re-issue must persist immediately so a restart reflects it). */
-    touch(sessionId: string, opts?: {
-        accessExpiresAt?: string | null;
-    }): Promise<void>;
-    /** Revoke one session (keeps the audit row). Returns false if unknown. */
-    disable(sessionId: string, disabledBy?: string | null): Promise<boolean>;
-    /** Revoke every active session for a user; returns the affected ids (e.g. to drop
-     * matching live websockets). */
-    disableAllForUser(userId: string, disabledBy?: string | null): Promise<string[]>;
-    /** Forget a single session entirely (logout — drops the audit row too). */
-    remove(sessionId: string): Promise<void>;
-    /** Hard-delete every session for a user (memory + DB). */
-    deleteByUser(userId: string): Promise<void>;
-    /** All sessions for a user (incl. disabled audit rows), newest first — for an
-     * account/admin "your devices" view. */
-    listByUser(userId: string): Promise<Session[]>;
-    /** All cached sessions (sync; admin live list). */
-    listAll(): Session[];
-    /** Most-recent activity across a user's active sessions, or null — a cheap presence
-     * signal. */
-    getLastSeenForUser(userId: string): string | null;
-    /** Drop sessions whose last activity predates the retention window (memory + DB).
-     * Returns the count removed. */
-    prune(): Promise<number>;
-    /** Stop the optional auto-prune timer (no-op if none was started). */
-    stop(): void;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/server/auth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;GAQG;AAEH;;;uEAGuE;AACvE,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,SAAS,GACT,cAAc,GACd,WAAW,GACX,cAAc,GACd,UAAU,CAAC;AAEf;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;sEACkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;uDACuD;AACvD,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;+BAG+B;AAC/B,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,mBAAmB,GAAG,aAAa,CAAC;CAChD;AAED;oEACoE;AACpE,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,CAAC;IACzB;8CAC0C;IAC1C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB;AAED;;iBAEiB;AACjB,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,qCAAqC;IACrC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD;sEACkE;IAClE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,mFAAmF;IACnF,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC;IAC1D;;gFAE4E;IAC5E,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,0EAA0E;IAC1E,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE;oCACgC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,2EAA2E;IAC3E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,0DAA0D;IAC1D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;4CACwC;IACxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,mDAAmD;IACnD,OAAO,IAAI,OAAO,EAAE,CAAC;IACrB;iBACa;IACb,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAClD;oCACgC;IAChC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,sEAAsE;IACtE,IAAI,IAAI,IAAI,CAAC;CACd"}

package/dist/server/auth/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/server/auth/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/auth/types.ts"],"names":[],"mappings":""}

package/dist/server/auth/vault.d.ts

@@ -1,28 +0,0 @@
-/**
- * Vault item at-rest crypto — standard Web Crypto (HKDF-SHA256 + AES-256-GCM),
- * replacing the old hand-rolled `secretBox`/`deriveKey` scheme. Auditable, native on
- * modern Bun, zero dependencies. These primitives live in cursedbelt (not ca's
- * business layer) because ru gains a vault too.
- *
- * Keying is SERVER-SECRET–derived (per user), NOT master-password–derived: the
- * master password is a separate argon2id gate (a `Bun.password` hash — see
- * {@link ./password}), so resetting it never requires re-encrypting vault data. The
- * envelope carries a version byte so a future re-key can proceed row-by-row without
- * a flag-day migration.
- */
-/**
- * Derive a per-user AES-256-GCM vault key from the server secret via HKDF. The
- * per-user `salt` domain-separates users; `info` domain-separates this use of the
- * secret. The returned key is non-extractable (encrypt/decrypt only).
- */
-export declare function deriveVaultKey(serverSecret: string, userId: string): Promise<CryptoKey>;
-/**
- * Encrypt vault item plaintext. Returns a base64 envelope:
- *   `version(1B) || iv(12B) || ciphertext(+GCM tag)`
- * A fresh random IV per call. Store the string verbatim in `vault_items.data`.
- */
-export declare function encryptVaultItem(key: CryptoKey, plaintext: string): Promise<string>;
-/** Decrypt an envelope produced by {@link encryptVaultItem}. Throws on an unknown
- * version, a truncated envelope, or a failed GCM auth (tamper/wrong key). */
-export declare function decryptVaultItem(key: CryptoKey, envelope: string): Promise<string>;
-//# sourceMappingURL=vault.d.ts.map

package/dist/server/auth/vault.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/server/auth/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAoB7F;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzF;AAED;6EAC6E;AAC7E,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxF"}

package/dist/server/auth/vault.js

@@ -1,58 +0,0 @@
-/**
- * Vault item at-rest crypto — standard Web Crypto (HKDF-SHA256 + AES-256-GCM),
- * replacing the old hand-rolled `secretBox`/`deriveKey` scheme. Auditable, native on
- * modern Bun, zero dependencies. These primitives live in cursedbelt (not ca's
- * business layer) because ru gains a vault too.
- *
- * Keying is SERVER-SECRET–derived (per user), NOT master-password–derived: the
- * master password is a separate argon2id gate (a `Bun.password` hash — see
- * {@link ./password}), so resetting it never requires re-encrypting vault data. The
- * envelope carries a version byte so a future re-key can proceed row-by-row without
- * a flag-day migration.
- */
-const VERSION = 1;
-const IV_BYTES = 12; // 96-bit nonce — the AES-GCM standard
-const enc = new TextEncoder();
-const dec = new TextDecoder();
-/**
- * Derive a per-user AES-256-GCM vault key from the server secret via HKDF. The
- * per-user `salt` domain-separates users; `info` domain-separates this use of the
- * secret. The returned key is non-extractable (encrypt/decrypt only).
- */
-export async function deriveVaultKey(serverSecret, userId) {
-    const baseKey = await crypto.subtle.importKey('raw', enc.encode(serverSecret), { name: 'HKDF' }, false, ['deriveKey']);
-    return crypto.subtle.deriveKey({
-        name: 'HKDF',
-        hash: 'SHA-256',
-        salt: enc.encode(`vault:${userId}`),
-        info: enc.encode('vault-item-key'),
-    }, baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
-}
-/**
- * Encrypt vault item plaintext. Returns a base64 envelope:
- *   `version(1B) || iv(12B) || ciphertext(+GCM tag)`
- * A fresh random IV per call. Store the string verbatim in `vault_items.data`.
- */
-export async function encryptVaultItem(key, plaintext) {
-    const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-    const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, enc.encode(plaintext));
-    const envelope = new Uint8Array(1 + IV_BYTES + ct.byteLength);
-    envelope[0] = VERSION;
-    envelope.set(iv, 1);
-    envelope.set(new Uint8Array(ct), 1 + IV_BYTES);
-    return Buffer.from(envelope).toString('base64');
-}
-/** Decrypt an envelope produced by {@link encryptVaultItem}. Throws on an unknown
- * version, a truncated envelope, or a failed GCM auth (tamper/wrong key). */
-export async function decryptVaultItem(key, envelope) {
-    const bytes = new Uint8Array(Buffer.from(envelope, 'base64'));
-    if (bytes.length < 1 + IV_BYTES + 16)
-        throw new Error('vault: envelope too short');
-    if (bytes[0] !== VERSION)
-        throw new Error(`vault: unsupported envelope version ${bytes[0]}`);
-    const iv = bytes.subarray(1, 1 + IV_BYTES);
-    const ct = bytes.subarray(1 + IV_BYTES);
-    const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ct);
-    return dec.decode(plain);
-}
-//# sourceMappingURL=vault.js.map

package/dist/server/auth/vault.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/server/auth/vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC,sCAAsC;AAC3D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB,EAAE,MAAc;IACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;KACnC,EACD,OAAO,EACP,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,SAAiB;IACtE,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC9D,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAc,EAAE,QAAgB;IACrE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server/context.d.ts

@@ -1,36 +0,0 @@
-import type { CtgrDecoded, CtgrMethod } from '../ctgr/types';
-/**
- * The cursedbelt Hono environment. `createApp()` returns a `Hono<CursedbeltEnv>`
- * so every middleware and handler shares one typed `c.get`/`c.set` surface.
- *
- * Only *plumbing* variables live here — request identity that the cross-cutting
- * middleware owns. Business variables (roles, session, sharing) are added by the
- * app's own auth/feature middleware via its own env extension (task 26+).
- */
-export interface CursedbeltVariables {
-    /** Per-request correlation id. Set by {@link correlationId} on every request. */
-    correlationId: string;
-    /**
-     * Authenticated user id. cursedbelt never sets this — the app's auth middleware
-     * (task 26) populates it so the request logger can attribute metrics/events to a
-     * user. Optional because anonymous requests have none.
-     */
-    userId?: string;
-    /**
-     * The decoded original request on a `/ctgr*` GET twin. Set by the ctgr `unGETify`
-     * middleware; the downstream handler / zod validator reads the body from here.
-     */
-    ctgrDecoded?: CtgrDecoded;
-    /** The decoded original HTTP method of a ctgr-tunneled request. */
-    ctgrMethod?: CtgrMethod;
-    /**
-     * The parsed/coerced/stripped body a `zValidator(...)` route accepted. A convenience
-     * mirror of the typed `c.req.valid('json')` slot for handlers that prefer a getter.
-     * Set only on a validated route; `unknown` because the type is the route's schema.
-     */
-    validatedBody?: unknown;
-}
-export interface CursedbeltEnv {
-    Variables: CursedbeltVariables;
-}
-//# sourceMappingURL=context.d.ts.map