hammoc 1.0.0

package/packages/server/dist/middleware/__tests__/pathGuard.test.js

@@ -0,0 +1,73 @@
+/**
+ * Path Guard Middleware Tests
+ * [Source: Story 11.1 - Task 7.1]
+ */
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import { validateProjectPath } from '../pathGuard.js';
+const PROJECT_ROOT = path.resolve('/tmp/test-project');
+describe('validateProjectPath', () => {
+    // TC-PG1: Normal relative path returns resolved absolute path
+    it('returns resolved absolute path for valid relative path', () => {
+        const result = validateProjectPath(PROJECT_ROOT, 'src/index.ts');
+        expect(result).toBe(path.resolve(PROJECT_ROOT, 'src/index.ts'));
+    });
+    it('allows current directory path', () => {
+        const result = validateProjectPath(PROJECT_ROOT, '.');
+        expect(result).toBe(path.resolve(PROJECT_ROOT));
+    });
+    it('allows nested paths within project root', () => {
+        const result = validateProjectPath(PROJECT_ROOT, 'src/components/App.tsx');
+        expect(result).toBe(path.resolve(PROJECT_ROOT, 'src/components/App.tsx'));
+    });
+    // TC-PG2: ../ path traversal throws error
+    it('throws PATH_TRAVERSAL for ../ traversal', () => {
+        try {
+            validateProjectPath(PROJECT_ROOT, '../etc/passwd');
+            expect.fail('Should have thrown');
+        }
+        catch (error) {
+            expect(error.code).toBe('PATH_TRAVERSAL');
+        }
+    });
+    // TC-PG3: Absolute paths throw error
+    it('throws PATH_TRAVERSAL for Unix absolute path', () => {
+        try {
+            validateProjectPath(PROJECT_ROOT, '/etc/passwd');
+            expect.fail('Should have thrown');
+        }
+        catch (error) {
+            expect(error.code).toBe('PATH_TRAVERSAL');
+        }
+    });
+    it('throws PATH_TRAVERSAL for Windows absolute path', () => {
+        try {
+            validateProjectPath(PROJECT_ROOT, 'C:\\Windows\\System32');
+            expect.fail('Should have thrown');
+        }
+        catch (error) {
+            expect(error.code).toBe('PATH_TRAVERSAL');
+        }
+    });
+    // TC-PG4: Null byte throws error
+    it('throws PATH_TRAVERSAL for path with null byte', () => {
+        try {
+            validateProjectPath(PROJECT_ROOT, 'src/index.ts\0.html');
+            expect.fail('Should have thrown');
+        }
+        catch (error) {
+            expect(error.code).toBe('PATH_TRAVERSAL');
+        }
+    });
+    // TC-PG5: Nested traversal throws error
+    it('throws PATH_TRAVERSAL for nested traversal (foo/../../etc/passwd)', () => {
+        try {
+            validateProjectPath(PROJECT_ROOT, 'foo/../../etc/passwd');
+            expect.fail('Should have thrown');
+        }
+        catch (error) {
+            expect(error.code).toBe('PATH_TRAVERSAL');
+        }
+    });
+});
+//# sourceMappingURL=pathGuard.test.js.map

package/packages/server/dist/middleware/__tests__/pathGuard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathGuard.test.js","sourceRoot":"","sources":["../../../src/middleware/__tests__/pathGuard.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAEvD,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,8DAA8D;IAC9D,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,IAAI,CAAC;YACH,mBAAmB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,IAAI,CAAC;YACH,mBAAmB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,IAAI,CAAC;YACH,mBAAmB,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,iCAAiC;IACjC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,IAAI,CAAC;YACH,mBAAmB,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,IAAI,CAAC;YACH,mBAAmB,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAE,KAA+B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/packages/server/dist/middleware/__tests__/session.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Session Middleware Tests
+ * [Source: Story 2.3 - Task 9, Story 2.4 - Task 2]
+ */
+export {};
+//# sourceMappingURL=session.test.d.ts.map

package/packages/server/dist/middleware/__tests__/session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.test.d.ts","sourceRoot":"","sources":["../../../src/middleware/__tests__/session.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/packages/server/dist/middleware/__tests__/session.test.js

@@ -0,0 +1,33 @@
+/**
+ * Session Middleware Tests
+ * [Source: Story 2.3 - Task 9, Story 2.4 - Task 2]
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createSessionMiddleware, THIRTY_DAYS_MS } from '../session';
+// Mock AuthConfigService
+vi.mock('../../services/authConfigService', () => ({
+    AuthConfigService: vi.fn().mockImplementation(() => ({
+        getSessionSecret: vi.fn().mockResolvedValue('mock-session-secret'),
+    })),
+}));
+describe('session middleware', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('configuration', () => {
+        it('[HIGH] should have default maxAge of 30 days', () => {
+            expect(THIRTY_DAYS_MS).toBe(30 * 24 * 60 * 60 * 1000);
+        });
+        it('[HIGH] should create async session middleware', async () => {
+            const middleware = await createSessionMiddleware();
+            expect(typeof middleware).toBe('function');
+        });
+    });
+    describe('THIRTY_DAYS_MS constant', () => {
+        it('should be exported and equal to 30 days in milliseconds', () => {
+            const expectedMs = 30 * 24 * 60 * 60 * 1000;
+            expect(THIRTY_DAYS_MS).toBe(expectedMs);
+        });
+    });
+});
+//# sourceMappingURL=session.test.js.map

package/packages/server/dist/middleware/__tests__/session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.test.js","sourceRoot":"","sources":["../../../src/middleware/__tests__/session.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAErE,yBAAyB;AACzB,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,CAAC;KACnE,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,UAAU,GAAG,MAAM,uBAAuB,EAAE,CAAC;YACnD,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5C,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/packages/server/dist/middleware/auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Authentication Middleware
+ * Validates session authentication for protected routes
+ * [Source: Story 2.5 - Task 1, 2]
+ */
+import { Request, Response, NextFunction } from 'express';
+/**
+ * API request authentication middleware
+ * Checks session cookie authenticated state
+ */
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Authentication middleware with route exclusions
+ * Skips authentication for public routes and static files
+ * [Source: Story 2.5 - Task 2]
+ */
+export declare function authMiddlewareWithExclusions(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/packages/server/dist/middleware/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAa1D;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAWN;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,IAAI,CAkBN"}

package/packages/server/dist/middleware/auth.js

@@ -0,0 +1,52 @@
+/**
+ * Authentication Middleware
+ * Validates session authentication for protected routes
+ * [Source: Story 2.5 - Task 1, 2]
+ */
+import { AUTH_ERROR_CODES, AUTH_ERROR_MESSAGES } from '@hammoc/shared';
+/**
+ * Public routes that don't require authentication (AC4)
+ */
+const PUBLIC_ROUTES = [
+    '/api/auth/login',
+    '/api/auth/status',
+    '/api/auth/setup',
+    '/api/health',
+];
+/**
+ * API request authentication middleware
+ * Checks session cookie authenticated state
+ */
+export function authMiddleware(req, res, next) {
+    if (req.session?.authenticated) {
+        return next();
+    }
+    res.status(401).json({
+        error: {
+            code: AUTH_ERROR_CODES.UNAUTHORIZED,
+            message: AUTH_ERROR_MESSAGES.UNAUTHORIZED,
+        },
+    });
+}
+/**
+ * Authentication middleware with route exclusions
+ * Skips authentication for public routes and static files
+ * [Source: Story 2.5 - Task 2]
+ */
+export function authMiddlewareWithExclusions(req, res, next) {
+    // CORS preflight (OPTIONS) requests are handled by cors middleware before auth
+    // Note: cors middleware is applied before auth middleware in the middleware chain
+    if (req.method === 'OPTIONS') {
+        return next();
+    }
+    // Public routes skip authentication
+    if (PUBLIC_ROUTES.some((route) => req.path === route)) {
+        return next();
+    }
+    // Static files skip authentication (non-api paths) (AC5)
+    if (!req.path.startsWith('/api/')) {
+        return next();
+    }
+    return authMiddleware(req, res, next);
+}
+//# sourceMappingURL=auth.js.map

package/packages/server/dist/middleware/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEvE;;GAEG;AACH,MAAM,aAAa,GAAG;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,aAAa;CACd,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE;YACL,IAAI,EAAE,gBAAgB,CAAC,YAAY;YACnC,OAAO,EAAE,mBAAmB,CAAC,YAAY;SAC1C;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAAY,EACZ,GAAa,EACb,IAAkB;IAElB,+EAA+E;IAC/E,kFAAkF;IAClF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,oCAAoC;IACpC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/packages/server/dist/middleware/i18n.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Server i18n Middleware (Epic 22 - Story 22.1, 22.3)
+ * Determines request language using priority:
+ * (1) user preference from preferencesService → (2) Accept-Language header → (3) 'en' fallback
+ * Attaches req.t (translation function) and req.language to the request.
+ */
+import type { Request, Response, NextFunction } from 'express';
+declare module 'express' {
+    interface Request {
+        t?: (key: string, options?: Record<string, unknown>) => string;
+        language?: string;
+    }
+}
+export declare function i18nMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void>;
+/** Reset the preference cache (e.g., after language preference changes) */
+export declare function invalidateI18nCache(): void;
+//# sourceMappingURL=i18n.d.ts.map

package/packages/server/dist/middleware/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../src/middleware/i18n.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,OAAO;QACf,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;QAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB;CACF;AAOD,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBpG;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/packages/server/dist/middleware/i18n.js

@@ -0,0 +1,42 @@
+/**
+ * Server i18n Middleware (Epic 22 - Story 22.1, 22.3)
+ * Determines request language using priority:
+ * (1) user preference from preferencesService → (2) Accept-Language header → (3) 'en' fallback
+ * Attaches req.t (translation function) and req.language to the request.
+ */
+import i18next from '../i18n.js';
+import { SUPPORTED_LANGUAGES } from '@hammoc/shared';
+import { preferencesService } from '../services/preferencesService.js';
+// In-memory cache for language preference (avoids disk I/O on every request)
+let cachedPrefLang = null;
+let cacheTimestamp = 0;
+const CACHE_TTL_MS = 30_000; // 30 seconds
+export async function i18nMiddleware(req, _res, next) {
+    try {
+        const now = Date.now();
+        if (now - cacheTimestamp > CACHE_TTL_MS) {
+            const prefs = await preferencesService.readPreferences();
+            cachedPrefLang = prefs.language && SUPPORTED_LANGUAGES.includes(prefs.language)
+                ? prefs.language
+                : null;
+            cacheTimestamp = now;
+        }
+        const headerLang = req.acceptsLanguages([...SUPPORTED_LANGUAGES]);
+        const lang = cachedPrefLang || headerLang || 'en';
+        req.t = i18next.getFixedT(lang);
+        req.language = lang;
+    }
+    catch {
+        // Fallback: try Accept-Language before hard-coding 'en'
+        const headerLang = req.acceptsLanguages([...SUPPORTED_LANGUAGES]);
+        const lang = headerLang || 'en';
+        req.t = i18next.getFixedT(lang);
+        req.language = lang;
+    }
+    next();
+}
+/** Reset the preference cache (e.g., after language preference changes) */
+export function invalidateI18nCache() {
+    cacheTimestamp = 0;
+}
+//# sourceMappingURL=i18n.js.map

package/packages/server/dist/middleware/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/middleware/i18n.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,OAAO,MAAM,YAAY,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AASvE,6EAA6E;AAC7E,IAAI,cAAc,GAAkB,IAAI,CAAC;AACzC,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,aAAa;AAE1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,cAAc,GAAG,YAAY,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,eAAe,EAAE,CAAC;YACzD,cAAc,GAAG,KAAK,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAA8C,CAAC;gBACnH,CAAC,CAAC,KAAK,CAAC,QAAQ;gBAChB,CAAC,CAAC,IAAI,CAAC;YACT,cAAc,GAAG,GAAG,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,cAAc,IAAK,UAAqB,IAAI,IAAI,CAAC;QAE9D,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,MAAM,UAAU,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAI,UAAqB,IAAI,IAAI,CAAC;QAC5C,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,cAAc,GAAG,CAAC,CAAC;AACrB,CAAC"}

package/packages/server/dist/middleware/pathGuard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Path Guard Middleware
+ * Validates that requested paths stay within the project root.
+ * Prevents path traversal attacks for file system API endpoints.
+ * [Source: Story 11.1 - Task 2]
+ */
+/**
+ * Validates that the requested path stays within the project root.
+ * Throws error with code 'PATH_TRAVERSAL' if validation fails.
+ * @param projectRoot Absolute path to the project root directory
+ * @param requestedPath Relative path requested by the client
+ * @returns Resolved absolute path
+ */
+export declare function validateProjectPath(projectRoot: string, requestedPath: string): string;
+//# sourceMappingURL=pathGuard.d.ts.map

package/packages/server/dist/middleware/pathGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathGuard.d.ts","sourceRoot":"","sources":["../../src/middleware/pathGuard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA8BtF"}

package/packages/server/dist/middleware/pathGuard.js

@@ -0,0 +1,41 @@
+/**
+ * Path Guard Middleware
+ * Validates that requested paths stay within the project root.
+ * Prevents path traversal attacks for file system API endpoints.
+ * [Source: Story 11.1 - Task 2]
+ */
+import path from 'path';
+/**
+ * Validates that the requested path stays within the project root.
+ * Throws error with code 'PATH_TRAVERSAL' if validation fails.
+ * @param projectRoot Absolute path to the project root directory
+ * @param requestedPath Relative path requested by the client
+ * @returns Resolved absolute path
+ */
+export function validateProjectPath(projectRoot, requestedPath) {
+    // 1. Null byte check
+    if (requestedPath.includes('\0')) {
+        const err = new Error('Invalid path: null byte detected');
+        err.code = 'PATH_TRAVERSAL';
+        throw err;
+    }
+    // 2. Block absolute paths (Unix: /, Windows: C:\, \\UNC)
+    if (path.isAbsolute(requestedPath)) {
+        const err = new Error('Invalid path: absolute paths are not allowed');
+        err.code = 'PATH_TRAVERSAL';
+        throw err;
+    }
+    // 3. Resolve the full path
+    const resolvedPath = path.resolve(projectRoot, requestedPath);
+    // 4. Ensure resolved path is within projectRoot
+    const normalizedRoot = path.resolve(projectRoot) + path.sep;
+    const normalizedResolved = path.resolve(resolvedPath);
+    // Allow exact match (root itself) or child paths
+    if (normalizedResolved !== path.resolve(projectRoot) && !normalizedResolved.startsWith(normalizedRoot)) {
+        const err = new Error('Invalid path: path traversal detected');
+        err.code = 'PATH_TRAVERSAL';
+        throw err;
+    }
+    return resolvedPath;
+}
+//# sourceMappingURL=pathGuard.js.map

package/packages/server/dist/middleware/pathGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathGuard.js","sourceRoot":"","sources":["../../src/middleware/pathGuard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IAC5E,qBAAqB;IACrB,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,GAA6B,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,yDAAyD;IACzD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACrE,GAA6B,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE9D,gDAAgD;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;IAC5D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAEtD,iDAAiD;IACjD,IAAI,kBAAkB,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvG,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC9D,GAA6B,CAAC,IAAI,GAAG,gBAAgB,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/packages/server/dist/middleware/session.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Session Middleware
+ * cookie-session configuration for authentication
+ * [Source: Story 2.2 - Task 4, Story 2.3 - Task 2, Story 2.4 - Task 2]
+ */
+import { RequestHandler } from 'express';
+export declare const THIRTY_DAYS_MS: number;
+/**
+ * Create session middleware with persisted secret
+ * [Source: Story 2.4 - Task 2]
+ *
+ * @note cookie-session maxAge behavior:
+ * - maxAge: number → expires after that many milliseconds
+ * - maxAge: undefined → session cookie (expires on browser close)
+ * - maxAge: 0 → immediate expiration (deletes cookie) - DO NOT USE!
+ */
+export declare function createSessionMiddleware(): Promise<RequestHandler>;
+//# sourceMappingURL=session.d.ts.map

package/packages/server/dist/middleware/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,eAAO,MAAM,cAAc,QAA2B,CAAC;AAEvD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAkBvE"}

package/packages/server/dist/middleware/session.js

@@ -0,0 +1,35 @@
+/**
+ * Session Middleware
+ * cookie-session configuration for authentication
+ * [Source: Story 2.2 - Task 4, Story 2.3 - Task 2, Story 2.4 - Task 2]
+ */
+import cookieSession from 'cookie-session';
+import { AuthConfigService } from '../services/authConfigService.js';
+export const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Create session middleware with persisted secret
+ * [Source: Story 2.4 - Task 2]
+ *
+ * @note cookie-session maxAge behavior:
+ * - maxAge: number → expires after that many milliseconds
+ * - maxAge: undefined → session cookie (expires on browser close)
+ * - maxAge: 0 → immediate expiration (deletes cookie) - DO NOT USE!
+ */
+export async function createSessionMiddleware() {
+    const authConfig = new AuthConfigService();
+    const secret = await authConfig.getSessionSecret();
+    // Use environment-specific cookie name to prevent session conflicts
+    // when running multiple instances on same hostname (different ports)
+    const cookieName = process.env.NODE_ENV === 'production'
+        ? 'bmad-session'
+        : `bmad-session-${process.env.PORT || '3000'}`;
+    return cookieSession({
+        name: cookieName,
+        keys: [secret],
+        maxAge: THIRTY_DAYS_MS,
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: false, // localhost only
+    });
+}
+//# sourceMappingURL=session.js.map

package/packages/server/dist/middleware/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/middleware/session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAC;IAEnD,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACtD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;IAEjD,OAAO,aAAa,CAAC;QACnB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK,EAAE,iBAAiB;KACjC,CAA8B,CAAC;AAClC,CAAC"}

package/packages/server/dist/routes/__tests__/auth.integration.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Auth Integration Tests
+ * [Source: Story 2.5 - Task 7]
+ */
+export {};
+//# sourceMappingURL=auth.integration.test.d.ts.map

package/packages/server/dist/routes/__tests__/auth.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.integration.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/auth.integration.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/packages/server/dist/routes/__tests__/auth.integration.test.js

@@ -0,0 +1,111 @@
+/**
+ * Auth Integration Tests
+ * [Source: Story 2.5 - Task 7]
+ */
+import { describe, it, expect, vi, beforeAll, afterAll } from 'vitest';
+import request from 'supertest';
+// Mock AuthConfigService before importing app
+vi.mock('../../services/authConfigService.js', () => ({
+    AuthConfigService: vi.fn().mockImplementation(() => ({
+        getSessionSecret: vi.fn().mockResolvedValue('test-secret-key-for-integration-tests'),
+        verifyPassword: vi.fn().mockResolvedValue(true),
+    })),
+}));
+// Mock rateLimiter
+vi.mock('../../services/rateLimiter.js', () => ({
+    rateLimiter: {
+        canAttempt: vi.fn().mockReturnValue({ allowed: true }),
+        recordFailure: vi.fn(),
+        reset: vi.fn(),
+    },
+}));
+import { createApp } from '../../app.js';
+describe('Auth Integration Tests', () => {
+    let app;
+    beforeAll(async () => {
+        app = await createApp();
+    });
+    afterAll(() => {
+        vi.clearAllMocks();
+    });
+    describe('Public Routes (AC4)', () => {
+        it('[HIGH] GET /api/auth/status - accessible without auth, returns authenticated: false', async () => {
+            const response = await request(app)
+                .get('/api/auth/status')
+                .expect(200);
+            expect(response.body).toEqual({ authenticated: false });
+        });
+        it('[HIGH] GET /api/health - accessible without auth', async () => {
+            const response = await request(app)
+                .get('/api/health')
+                .expect(200);
+            expect(response.body.status).toBe('healthy');
+        });
+        it('[MEDIUM] POST /api/auth/login - accessible without auth', async () => {
+            const response = await request(app)
+                .post('/api/auth/login')
+                .send({ password: 'test-password' })
+                .expect(200);
+            expect(response.body.success).toBe(true);
+        });
+    });
+    describe('Protected Routes (AC1)', () => {
+        it('[HIGH] GET /api/cli-status - returns 401 without auth', async () => {
+            const response = await request(app)
+                .get('/api/cli-status')
+                .expect(401);
+            expect(response.body.error.code).toBe('UNAUTHORIZED');
+            expect(response.body.error.message).toBe('Authentication required');
+        });
+    });
+    describe('CORS Preflight (OPTIONS)', () => {
+        it('[MEDIUM] OPTIONS /api/cli-status - passes without auth', async () => {
+            const response = await request(app)
+                .options('/api/cli-status')
+                .set('Origin', 'http://localhost:5173')
+                .set('Access-Control-Request-Method', 'GET')
+                .expect(204);
+            expect(response.headers['access-control-allow-origin']).toBeDefined();
+        });
+    });
+    describe('Authenticated Access', () => {
+        it('[HIGH] GET /api/auth/status after login - returns authenticated: true', async () => {
+            const agent = request.agent(app);
+            // Login first
+            await agent
+                .post('/api/auth/login')
+                .send({ password: 'test-password' })
+                .expect(200);
+            // Check status with session cookie
+            const response = await agent
+                .get('/api/auth/status')
+                .expect(200);
+            expect(response.body).toEqual({ authenticated: true });
+        });
+        it('[HIGH] GET /api/cli-status after login - returns 200', async () => {
+            const agent = request.agent(app);
+            // Login first
+            await agent
+                .post('/api/auth/login')
+                .send({ password: 'test-password' })
+                .expect(200);
+            // Access protected route with session cookie
+            const response = await agent
+                .get('/api/cli-status')
+                .expect(200);
+            expect(response.body).toBeDefined();
+        });
+    });
+    describe('Static Files (AC5)', () => {
+        it('[HIGH] non-API paths skip authentication', async () => {
+            // Static file paths that don't start with /api/ should not return 401
+            // Note: actual static files may not exist in test environment
+            // We're testing that the middleware doesn't block, not that files are served
+            const response = await request(app)
+                .get('/some-static-path.js');
+            // Should not be 401 (may be 404 if file doesn't exist, which is fine)
+            expect(response.status).not.toBe(401);
+        });
+    });
+});
+//# sourceMappingURL=auth.integration.test.js.map

package/packages/server/dist/routes/__tests__/auth.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.integration.test.js","sourceRoot":"","sources":["../../../src/routes/__tests__/auth.integration.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,OAAO,MAAM,WAAW,CAAC;AAGhC,8CAA8C;AAC9C,EAAE,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE,CAAC,CAAC;IACpD,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,uCAAuC,CAAC;QACpF,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;KAChD,CAAC,CAAC;CACJ,CAAC,CAAC,CAAC;AAEJ,mBAAmB;AACnB,EAAE,CAAC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,WAAW,EAAE;QACX,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtD,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;KACf;CACF,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,GAAY,CAAC;IAEjB,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;YACnG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,kBAAkB,CAAC;iBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,aAAa,CAAC;iBAClB,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,iBAAiB,CAAC;iBACvB,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;iBACnC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;YACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,iBAAiB,CAAC;iBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,OAAO,CAAC,iBAAiB,CAAC;iBAC1B,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC;iBACtC,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC;iBAC3C,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;YACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEjC,cAAc;YACd,MAAM,KAAK;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;iBACnC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,mCAAmC;YACnC,MAAM,QAAQ,GAAG,MAAM,KAAK;iBACzB,GAAG,CAAC,kBAAkB,CAAC;iBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEjC,cAAc;YACd,MAAM,KAAK;iBACR,IAAI,CAAC,iBAAiB,CAAC;iBACvB,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;iBACnC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,6CAA6C;YAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK;iBACzB,GAAG,CAAC,iBAAiB,CAAC;iBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YAEf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,sEAAsE;YACtE,8DAA8D;YAC9D,6EAA6E;YAC7E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YAE/B,sEAAsE;YACtE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/packages/server/dist/routes/__tests__/auth.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Auth Routes Integration Tests
+ * [Source: Story 2.2 - Task 10]
+ */
+export {};
+//# sourceMappingURL=auth.test.d.ts.map

package/packages/server/dist/routes/__tests__/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../../../src/routes/__tests__/auth.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}