mythik 0.0.1 → 0.1.0

package/dist/auth/providers/custom-jwt.js

@@ -0,0 +1,165 @@
+/** Navigate an object by dot-notation path. "data.user.email" → obj.data.user.email */
+function getByDotPath(obj, path) {
+    const segments = path.split('.');
+    let current = obj;
+    for (const seg of segments) {
+        if (current === null || current === undefined || typeof current !== 'object')
+            return undefined;
+        current = current[seg];
+    }
+    return current;
+}
+function getRolePathValue(data, user, path) {
+    return path.includes('.') ? getByDotPath(data, path) : getByDotPath(user, path);
+}
+function warnDefaultRoleFallback(defaultRole, rolePath, rolesPath) {
+    if (process.env.NODE_ENV === 'production')
+        return;
+    // eslint-disable-next-line no-console
+    console.warn(`[Mythik Auth] Custom JWT provider could not find rolePath "${rolePath}" or rolesPath "${rolesPath}"; using defaultRole "${defaultRole}".`);
+}
+/** Replace $email and $password placeholders in a body template with actual values. */
+function resolveBodyTemplate(template, credentials) {
+    const resolved = {};
+    for (const [key, value] of Object.entries(template)) {
+        if (typeof value === 'string' && value.startsWith('$')) {
+            const credKey = value.slice(1); // "$email" → "email"
+            resolved[key] = credentials[credKey];
+        }
+        else if (value && typeof value === 'object' && !Array.isArray(value)) {
+            resolved[key] = resolveBodyTemplate(value, credentials);
+        }
+        else {
+            resolved[key] = value;
+        }
+    }
+    return resolved;
+}
+function extractUser(data, config) {
+    const userPath = config.userPath ?? 'user';
+    const userObj = getByDotPath(data, userPath);
+    if (!userObj || typeof userObj !== 'object') {
+        throw new Error(`User not found at path "${userPath}"`);
+    }
+    const user = userObj;
+    const defaultRole = config.defaultRole ?? 'user';
+    // Extract roles. Plain paths are relative to userPath; dotted paths are full-response paths.
+    const rolesPath = config.rolesPath ?? 'roles';
+    const rolesRaw = getRolePathValue(data, user, rolesPath);
+    const roles = Array.isArray(rolesRaw) ? rolesRaw : [];
+    // Extract primary role. Plain paths are relative to userPath; dotted paths are full-response paths.
+    const rolePath = config.rolePath ?? 'role';
+    const roleRaw = getRolePathValue(data, user, rolePath);
+    const role = typeof roleRaw === 'string' ? roleRaw : (roles[0] ?? defaultRole);
+    if (typeof roleRaw !== 'string' && roles.length === 0) {
+        warnDefaultRoleFallback(defaultRole, rolePath, rolesPath);
+    }
+    if (roles.length === 0)
+        roles.push(role);
+    if (!roles.includes(role))
+        roles.unshift(role);
+    return {
+        id: String(user.id ?? ''),
+        email: String(user.email ?? ''),
+        name: user.name,
+        avatar: user.avatar,
+        role,
+        roles,
+        metadata: user.metadata,
+    };
+}
+/**
+ * Custom JWT Provider — configurable endpoints and response mapping.
+ *
+ * Usage:
+ *   const provider = createCustomJWTProvider({
+ *     loginUrl: 'https://api.example.com/auth/login',
+ *     refreshUrl: 'https://api.example.com/auth/refresh',
+ *     tokenPath: 'data.access_token',
+ *     userPath: 'data.user',
+ *     rolePath: 'role', // relative to data.user; use 'data.user.role' for full-response paths
+ *   });
+ */
+export function createCustomJWTProvider(config) {
+    const fetcher = config.fetcher ?? globalThis.fetch?.bind(globalThis);
+    async function login(credentials) {
+        const body = config.loginBody
+            ? resolveBodyTemplate(config.loginBody, credentials)
+            : credentials;
+        const response = await fetcher(config.loginUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            const errorData = await response.json().catch(() => null);
+            const msg = errorData?.error?.message ?? errorData?.message ?? `Login failed: HTTP ${response.status}`;
+            throw new Error(String(msg));
+        }
+        const data = await response.json();
+        const tokenPath = config.tokenPath ?? 'token';
+        const token = getByDotPath(data, tokenPath);
+        if (!token || typeof token !== 'string') {
+            throw new Error(`Token not found at path "${tokenPath}"`);
+        }
+        const refreshTokenPath = config.refreshTokenPath ?? 'refreshToken';
+        const refreshToken = getByDotPath(data, refreshTokenPath);
+        const expiresIn = config.expiresInPath
+            ? getByDotPath(data, config.expiresInPath)
+            : undefined;
+        return {
+            token,
+            refreshToken: typeof refreshToken === 'string' ? refreshToken : undefined,
+            expiresIn: typeof expiresIn === 'number' ? expiresIn : undefined,
+            user: extractUser(data, config),
+        };
+    }
+    async function logout() {
+        if (!config.logoutUrl)
+            return; // Client-side only logout
+        const response = await fetcher(config.logoutUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+        });
+        if (!response.ok) {
+            throw new Error(`Logout failed: HTTP ${response.status}`);
+        }
+    }
+    async function refresh(refreshToken) {
+        if (!config.refreshUrl)
+            throw new Error('Refresh not supported: no refreshUrl configured');
+        const response = await fetcher(config.refreshUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refreshToken }),
+        });
+        if (!response.ok) {
+            const errorData = await response.json().catch(() => null);
+            const msg = errorData?.error?.message ?? errorData?.message ?? `Refresh failed: HTTP ${response.status}`;
+            throw new Error(String(msg));
+        }
+        const data = await response.json();
+        const tokenPath = config.tokenPath ?? 'token';
+        const token = getByDotPath(data, tokenPath);
+        if (!token || typeof token !== 'string') {
+            throw new Error(`Token not found at path "${tokenPath}"`);
+        }
+        const newRefreshToken = getByDotPath(data, config.refreshTokenPath ?? 'refreshToken');
+        const expiresIn = config.expiresInPath
+            ? getByDotPath(data, config.expiresInPath)
+            : undefined;
+        return {
+            token,
+            refreshToken: typeof newRefreshToken === 'string' ? newRefreshToken : undefined,
+            expiresIn: typeof expiresIn === 'number' ? expiresIn : undefined,
+            user: extractUser(data, config),
+        };
+    }
+    async function getUser(_token) {
+        // Custom JWT typically doesn't have a separate getUser endpoint
+        // Decode from the token itself or return cached user
+        throw new Error('getUser not supported by CustomJWTProvider — user data comes from login/refresh responses');
+    }
+    return { login, logout, refresh, getUser };
+}
+//# sourceMappingURL=custom-jwt.js.map

package/dist/auth/providers/custom-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-jwt.js","sourceRoot":"","sources":["../../../src/auth/providers/custom-jwt.ts"],"names":[],"mappings":"AA6BA,uFAAuF;AACvF,SAAS,YAAY,CAAC,GAAY,EAAE,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC/F,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa,EAAE,IAA6B,EAAE,IAAY;IAClF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,uBAAuB,CAAC,WAAmB,EAAE,QAAgB,EAAE,SAAiB;IACvF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO;IAClD,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,8DAA8D,QAAQ,mBAAmB,SAAS,yBAAyB,WAAW,IAAI,CAC3I,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,mBAAmB,CAC1B,QAAiC,EACjC,WAAoC;IAEpC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;YACrD,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,KAAgC,EAAE,WAAW,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,MAA+B;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAEjD,6FAA6F;IAC7F,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,oGAAoG;IACpG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;IAE/E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,uBAAuB,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,MAAM,EAAE,IAAI,CAAC,MAA4B;QACzC,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,QAA+C;KAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,WAAoC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;YAC3B,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YACpD,CAAC,CAAC,WAAW,CAAC;QAEhB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmC,CAAC;YAC5F,MAAM,GAAG,GAAI,SAAS,EAAE,KAAiC,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,cAAc,CAAC;QACnE,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAuB,CAAC;QAEhF,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;YACpC,CAAC,CAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAwB;YAClE,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,KAAK;YACL,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACzE,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAChE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,0BAA0B;QAEzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,YAAoB;QACzC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmC,CAAC;YAC5F,MAAM,GAAG,GAAI,SAAS,EAAE,KAAiC,EAAE,OAAO,IAAI,SAAS,EAAE,OAAO,IAAI,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtI,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,IAAI,cAAc,CAAuB,CAAC;QAC5G,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa;YACpC,CAAC,CAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAwB;YAClE,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,KAAK;YACL,YAAY,EAAE,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC/E,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAChE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAc;QACnC,gEAAgE;QAChE,qDAAqD;QACrD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}

package/dist/auth/providers/mock.d.ts

@@ -0,0 +1,7 @@
+import type { AuthProvider, MockAuthProviderConfig } from '../types.js';
+/**
+ * Mock auth provider for testing. No network required.
+ * Returns configurable user data, supports simulated delays and failures.
+ */
+export declare function createMockAuthProvider(config: MockAuthProviderConfig): AuthProvider;
+//# sourceMappingURL=mock.d.ts.map

package/dist/auth/providers/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/mock.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAwB,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE9F;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,GAAG,YAAY,CAqDnF"}

package/dist/auth/providers/mock.js

@@ -0,0 +1,52 @@
+/**
+ * Mock auth provider for testing. No network required.
+ * Returns configurable user data, supports simulated delays and failures.
+ */
+export function createMockAuthProvider(config) {
+    // Token counter scoped to this instance — no shared module state between tests
+    let tokenCounter = 0;
+    function generateToken() {
+        return `mock-token-${++tokenCounter}-${Date.now()}`;
+    }
+    const { user, shouldFail, shouldFailRefresh, errorMessage, delay, expiresIn } = config;
+    async function withDelay(fn) {
+        if (delay && delay > 0) {
+            await new Promise((r) => setTimeout(r, delay));
+        }
+        return fn();
+    }
+    async function login(_credentials) {
+        return withDelay(() => {
+            if (shouldFail) {
+                throw new Error(errorMessage ?? 'Mock login failed');
+            }
+            return {
+                token: generateToken(),
+                refreshToken: generateToken(),
+                expiresIn: expiresIn ?? 3600,
+                user: { ...user },
+            };
+        });
+    }
+    async function logout() {
+        return withDelay(() => undefined);
+    }
+    async function refresh(_refreshToken) {
+        return withDelay(() => {
+            if (shouldFailRefresh) {
+                throw new Error(errorMessage ?? 'Mock refresh failed');
+            }
+            return {
+                token: generateToken(),
+                refreshToken: generateToken(),
+                expiresIn: expiresIn ?? 3600,
+                user: { ...user },
+            };
+        });
+    }
+    async function getUser(_token) {
+        return withDelay(() => ({ ...user }));
+    }
+    return { login, logout, refresh, getUser };
+}
+//# sourceMappingURL=mock.js.map

package/dist/auth/providers/mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../../src/auth/providers/mock.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,+EAA+E;IAC/E,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,SAAS,aAAa;QACpB,OAAO,cAAc,EAAE,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEvF,KAAK,UAAU,SAAS,CAAI,EAAW;QACrC,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,YAAqC;QACxD,OAAO,SAAS,CAAC,GAAG,EAAE;YACpB,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,aAAa,EAAE;gBACtB,YAAY,EAAE,aAAa,EAAE;gBAC7B,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE;aAClB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,aAAqB;QAC1C,OAAO,SAAS,CAAC,GAAG,EAAE;YACpB,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;YACzD,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,aAAa,EAAE;gBACtB,YAAY,EAAE,aAAa,EAAE;gBAC7B,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE;aAClB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAc;QACnC,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}

package/dist/auth/providers/supabase.d.ts

@@ -0,0 +1,90 @@
+import type { AuthProvider } from '../types.js';
+/**
+ * Supabase client interface — minimal surface needed by the auth provider.
+ * Avoids importing the full @supabase/supabase-js package as a dependency.
+ */
+export interface SupabaseAuthClient {
+    auth: {
+        signInWithPassword(credentials: {
+            email: string;
+            password: string;
+        }): Promise<{
+            data: {
+                session: {
+                    access_token: string;
+                    refresh_token: string;
+                    expires_in: number;
+                } | null;
+                user: {
+                    id: string;
+                    email?: string;
+                    user_metadata?: Record<string, unknown>;
+                    app_metadata?: Record<string, unknown>;
+                } | null;
+            };
+            error: {
+                message: string;
+            } | null;
+        }>;
+        signOut(): Promise<{
+            error: {
+                message: string;
+            } | null;
+        }>;
+        refreshSession(): Promise<{
+            data: {
+                session: {
+                    access_token: string;
+                    refresh_token: string;
+                    expires_in: number;
+                } | null;
+                user: {
+                    id: string;
+                    email?: string;
+                    user_metadata?: Record<string, unknown>;
+                    app_metadata?: Record<string, unknown>;
+                } | null;
+            };
+            error: {
+                message: string;
+            } | null;
+        }>;
+        getUser(token: string): Promise<{
+            data: {
+                user: {
+                    id: string;
+                    email?: string;
+                    user_metadata?: Record<string, unknown>;
+                    app_metadata?: Record<string, unknown>;
+                } | null;
+            };
+            error: {
+                message: string;
+            } | null;
+        }>;
+        onAuthStateChange(callback: (event: string, session: unknown) => void): {
+            data: {
+                subscription: {
+                    unsubscribe: () => void;
+                };
+            };
+        };
+    };
+}
+export interface SupabaseAuthProviderConfig {
+    /** Default role when none specified in metadata. */
+    defaultRole?: string;
+    /** Key in app_metadata or user_metadata that holds role(s). Default: 'role'. */
+    roleKey?: string;
+    /** Key in app_metadata or user_metadata that holds roles array. Default: 'roles'. */
+    rolesKey?: string;
+}
+/**
+ * Supabase Auth Provider — wraps @supabase/supabase-js auth methods.
+ *
+ * Usage:
+ *   const supabase = createClient(url, key);
+ *   const provider = createSupabaseAuthProvider(supabase);
+ */
+export declare function createSupabaseAuthProvider(client: SupabaseAuthClient, config?: SupabaseAuthProviderConfig): AuthProvider;
+//# sourceMappingURL=supabase.d.ts.map

package/dist/auth/providers/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/supabase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAmC,MAAM,aAAa,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE;QACJ,kBAAkB,CAAC,WAAW,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAC5E,IAAI,EAAE;gBAAE,OAAO,EAAE;oBAAE,YAAY,EAAE,MAAM,CAAC;oBAAC,aAAa,EAAE,MAAM,CAAC;oBAAC,UAAU,EAAE,MAAM,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAAC,IAAI,EAAE;oBAAE,EAAE,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;iBAAE,GAAG,IAAI,CAAA;aAAE,CAAC;YAC5N,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAC;YAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QAC1D,cAAc,IAAI,OAAO,CAAC;YACxB,IAAI,EAAE;gBAAE,OAAO,EAAE;oBAAE,YAAY,EAAE,MAAM,CAAC;oBAAC,aAAa,EAAE,MAAM,CAAC;oBAAC,UAAU,EAAE,MAAM,CAAA;iBAAE,GAAG,IAAI,CAAC;gBAAC,IAAI,EAAE;oBAAE,EAAE,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;iBAAE,GAAG,IAAI,CAAA;aAAE,CAAC;YAC5N,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAC9B,IAAI,EAAE;gBAAE,IAAI,EAAE;oBAAE,EAAE,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;iBAAE,GAAG,IAAI,CAAA;aAAE,CAAC;YACvI,KAAK,EAAE;gBAAE,OAAO,EAAE,MAAM,CAAA;aAAE,GAAG,IAAI,CAAC;SACnC,CAAC,CAAC;QACH,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG;YAAE,IAAI,EAAE;gBAAE,YAAY,EAAE;oBAAE,WAAW,EAAE,MAAM,IAAI,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC;KACjI,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAoCD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,GAAE,0BAA+B,GACtC,YAAY,CAoEd"}

package/dist/auth/providers/supabase.js

@@ -0,0 +1,102 @@
+function extractUser(supaUser, config) {
+    const roleKey = config.roleKey ?? 'role';
+    const rolesKey = config.rolesKey ?? 'roles';
+    const defaultRole = config.defaultRole ?? 'user';
+    const appMeta = supaUser.app_metadata ?? {};
+    const userMeta = supaUser.user_metadata ?? {};
+    // Extract roles: check app_metadata first, then user_metadata
+    const rolesRaw = appMeta[rolesKey] ?? userMeta[rolesKey];
+    const roles = Array.isArray(rolesRaw) ? rolesRaw : [];
+    // Extract primary role
+    const roleRaw = appMeta[roleKey] ?? userMeta[roleKey];
+    const role = typeof roleRaw === 'string' ? roleRaw : (roles[0] ?? defaultRole);
+    // Ensure role is in roles array
+    if (roles.length === 0)
+        roles.push(role);
+    if (!roles.includes(role))
+        roles.unshift(role);
+    return {
+        id: supaUser.id,
+        email: supaUser.email ?? '',
+        name: (userMeta.name ?? userMeta.full_name),
+        avatar: (userMeta.avatar_url ?? userMeta.avatar),
+        role,
+        roles,
+        metadata: { ...userMeta },
+    };
+}
+/**
+ * Supabase Auth Provider — wraps @supabase/supabase-js auth methods.
+ *
+ * Usage:
+ *   const supabase = createClient(url, key);
+ *   const provider = createSupabaseAuthProvider(supabase);
+ */
+export function createSupabaseAuthProvider(client, config = {}) {
+    async function login(credentials) {
+        const { data, error } = await client.auth.signInWithPassword({
+            email: credentials.email,
+            password: credentials.password,
+        });
+        if (error)
+            throw new Error(error.message);
+        if (!data.session || !data.user)
+            throw new Error('Login failed: no session returned');
+        return {
+            token: data.session.access_token,
+            refreshToken: data.session.refresh_token,
+            expiresIn: data.session.expires_in,
+            user: extractUser(data.user, config),
+        };
+    }
+    async function logout() {
+        const { error } = await client.auth.signOut();
+        if (error)
+            throw new Error(error.message);
+    }
+    async function refresh(_refreshToken) {
+        // Supabase SDK manages refresh token internally
+        const { data, error } = await client.auth.refreshSession();
+        if (error)
+            throw new Error(error.message);
+        if (!data.session || !data.user)
+            throw new Error('Refresh failed: no session returned');
+        return {
+            token: data.session.access_token,
+            refreshToken: data.session.refresh_token,
+            expiresIn: data.session.expires_in,
+            user: extractUser(data.user, config),
+        };
+    }
+    async function getUser(token) {
+        const { data, error } = await client.auth.getUser(token);
+        if (error)
+            throw new Error(error.message);
+        if (!data.user)
+            throw new Error('No user found');
+        return extractUser(data.user, config);
+    }
+    function onAuthStateChange(callback) {
+        const { data } = client.auth.onAuthStateChange((event, session) => {
+            switch (event) {
+                case 'SIGNED_IN':
+                    if (session && typeof session === 'object' && 'user' in session) {
+                        const user = extractUser(session.user, config);
+                        callback({ type: 'SIGNED_IN', user });
+                    }
+                    break;
+                case 'SIGNED_OUT':
+                    callback({ type: 'SIGNED_OUT' });
+                    break;
+                case 'TOKEN_REFRESHED':
+                    if (session && typeof session === 'object' && 'access_token' in session) {
+                        callback({ type: 'TOKEN_REFRESHED', token: session.access_token });
+                    }
+                    break;
+            }
+        });
+        return () => data.subscription.unsubscribe();
+    }
+    return { login, logout, refresh, getUser, onAuthStateChange };
+}
+//# sourceMappingURL=supabase.js.map

package/dist/auth/providers/supabase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../../src/auth/providers/supabase.ts"],"names":[],"mappings":"AAkCA,SAAS,WAAW,CAClB,QAAyH,EACzH,MAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAEjD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IAE9C,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,KAAK,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,uBAAuB;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC;IAE/E,gCAAgC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAuB;QACjE,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAuB;QACtE,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,SAAqC,EAAE;IAEvC,KAAK,UAAU,KAAK,CAAC,WAAoC;QACvD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC3D,KAAK,EAAE,WAAW,CAAC,KAAe;YAClC,QAAQ,EAAE,WAAW,CAAC,QAAkB;SACzC,CAAC,CAAC;QAEH,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAEtF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACxC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YAClC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,aAAqB;QAC1C,gDAAgD;QAChD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAE3D,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAExF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;YACxC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YAClC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;SACrC,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,KAAa;QAClC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,SAAS,iBAAiB,CAAC,QAAoC;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,WAAW;oBACd,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;wBAChE,MAAM,IAAI,GAAG,WAAW,CAAE,OAAmC,CAAC,IAAyC,EAAE,MAAM,CAAC,CAAC;wBACjH,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;oBACxC,CAAC;oBACD,MAAM;gBACR,KAAK,YAAY;oBACf,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjC,MAAM;gBACR,KAAK,iBAAiB;oBACpB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;wBACxE,QAAQ,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAG,OAAmC,CAAC,YAAsB,EAAE,CAAC,CAAC;oBAC5G,CAAC;oBACD,MAAM;YACV,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAChE,CAAC"}

package/dist/auth/rate-limiter.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Login-specific rate limiter with exponential backoff.
+ *
+ * Independent from the general RateLimiter (which prevents infinite action loops).
+ * This specifically targets brute-force login attempts.
+ *
+ * Default: 5 attempts per 60s window. Each consecutive exhausted window
+ * doubles the wait time (exponential backoff).
+ */
+export interface LoginRateLimiterConfig {
+    /** Max login attempts per window. Default: 5. */
+    maxAttempts?: number;
+    /** Window duration in ms. Default: 60000 (1 minute). */
+    windowMs?: number;
+}
+export interface LoginRateLimiter {
+    /** Check if a login attempt is allowed. Increments counter. Returns true if allowed. */
+    check: () => boolean;
+    /** Throws if rate limited. Call before login. */
+    assertAllowed: () => void;
+    /** Remaining attempts in current window. */
+    remaining: () => number;
+    /** Time in ms until next attempt is allowed. 0 if not blocked. */
+    getWaitTime: () => number;
+    /** Reset all state. */
+    reset: () => void;
+}
+export declare function createLoginRateLimiter(config?: LoginRateLimiterConfig): LoginRateLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/auth/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../src/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,KAAK,EAAE,MAAM,OAAO,CAAC;IACrB,iDAAiD;IACjD,aAAa,EAAE,MAAM,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,kEAAkE;IAClE,WAAW,EAAE,MAAM,MAAM,CAAC;IAC1B,uBAAuB;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,gBAAgB,CAgExF"}

package/dist/auth/rate-limiter.js

@@ -0,0 +1,67 @@
+/**
+ * Login-specific rate limiter with exponential backoff.
+ *
+ * Independent from the general RateLimiter (which prevents infinite action loops).
+ * This specifically targets brute-force login attempts.
+ *
+ * Default: 5 attempts per 60s window. Each consecutive exhausted window
+ * doubles the wait time (exponential backoff).
+ */
+export function createLoginRateLimiter(config) {
+    const maxAttempts = config?.maxAttempts ?? 5;
+    const baseWindowMs = config?.windowMs ?? 60_000;
+    let attempts = 0;
+    let windowStart = Date.now();
+    let consecutiveBlocks = 0;
+    function currentWindowMs() {
+        return baseWindowMs * Math.pow(2, consecutiveBlocks);
+    }
+    function resetIfExpired() {
+        const now = Date.now();
+        if (now - windowStart >= currentWindowMs()) {
+            const wasExhausted = attempts >= maxAttempts;
+            attempts = 0;
+            windowStart = now;
+            if (wasExhausted) {
+                consecutiveBlocks++;
+            }
+            else {
+                consecutiveBlocks = 0;
+            }
+        }
+    }
+    return {
+        check() {
+            resetIfExpired();
+            attempts++;
+            return attempts <= maxAttempts;
+        },
+        assertAllowed() {
+            resetIfExpired();
+            if (attempts >= maxAttempts) {
+                const waitMs = Math.max(0, currentWindowMs() - (Date.now() - windowStart));
+                const waitSec = Math.ceil(waitMs / 1000);
+                throw new Error(`Login rate limit exceeded: ${maxAttempts} attempts per ${Math.ceil(currentWindowMs() / 1000)}s. ` +
+                    `Try again in ${waitSec} seconds.`);
+            }
+            attempts++;
+        },
+        remaining() {
+            resetIfExpired();
+            return Math.max(0, maxAttempts - attempts);
+        },
+        getWaitTime() {
+            resetIfExpired();
+            if (attempts < maxAttempts)
+                return 0;
+            const elapsed = Date.now() - windowStart;
+            return Math.max(0, currentWindowMs() - elapsed);
+        },
+        reset() {
+            attempts = 0;
+            windowStart = Date.now();
+            consecutiveBlocks = 0;
+        },
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/auth/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../src/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsBH,MAAM,UAAU,sBAAsB,CAAC,MAA+B;IACpE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC;IAEhD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,SAAS,eAAe;QACtB,OAAO,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAED,SAAS,cAAc;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,WAAW,IAAI,eAAe,EAAE,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,QAAQ,IAAI,WAAW,CAAC;YAC7C,QAAQ,GAAG,CAAC,CAAC;YACb,WAAW,GAAG,GAAG,CAAC;YAClB,IAAI,YAAY,EAAE,CAAC;gBACjB,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,iBAAiB,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;YACH,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,IAAI,WAAW,CAAC;QACjC,CAAC;QAED,aAAa;YACX,cAAc,EAAE,CAAC;YACjB,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;gBAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,8BAA8B,WAAW,iBAAiB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,KAAK;oBAClG,gBAAgB,OAAO,WAAW,CACnC,CAAC;YACJ,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;QAED,SAAS;YACP,cAAc,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAED,WAAW;YACT,cAAc,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,WAAW;gBAAE,OAAO,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;YACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,CAAC;QAClD,CAAC;QAED,KAAK;YACH,QAAQ,GAAG,CAAC,CAAC;YACb,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,iBAAiB,GAAG,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/refresh-engine.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Token refresh engine with mutex (anti-stampede) and proactive scheduling.
+ *
+ * Mutex: If 5 requests detect token expiry simultaneously, only 1 refresh
+ * executes. The other 4 wait and receive the same result.
+ *
+ * Proactive: Schedules refresh at 80% of token lifetime (before expiry).
+ * Minimum schedule time: 5 seconds (prevents tight loops on very short tokens).
+ */
+export interface RefreshEngineConfig {
+    /** The actual refresh function. Returns new token or throws. */
+    doRefresh: () => Promise<string>;
+}
+export interface RefreshEngine {
+    /** Request a token refresh. Concurrent calls share the same refresh via mutex. */
+    requestRefresh: () => Promise<string | null>;
+    /** Schedule proactive refresh. Fires at 80% of lifetimeMs. */
+    scheduleProactive: (lifetimeMs: number) => void;
+    /** Cancel any scheduled proactive refresh. */
+    cancelProactive: () => void;
+    /** Clean up timers. */
+    destroy: () => void;
+}
+export declare function createRefreshEngine(config: RefreshEngineConfig): RefreshEngine;
+//# sourceMappingURL=refresh-engine.d.ts.map

package/dist/auth/refresh-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-engine.d.ts","sourceRoot":"","sources":["../../src/auth/refresh-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,8DAA8D;IAC9D,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,8CAA8C;IAC9C,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,uBAAuB;IACvB,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAID,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,aAAa,CAwD9E"}

package/dist/auth/refresh-engine.js

@@ -0,0 +1,59 @@
+/**
+ * Token refresh engine with mutex (anti-stampede) and proactive scheduling.
+ *
+ * Mutex: If 5 requests detect token expiry simultaneously, only 1 refresh
+ * executes. The other 4 wait and receive the same result.
+ *
+ * Proactive: Schedules refresh at 80% of token lifetime (before expiry).
+ * Minimum schedule time: 5 seconds (prevents tight loops on very short tokens).
+ */
+const MIN_SCHEDULE_MS = 5000;
+export function createRefreshEngine(config) {
+    const { doRefresh } = config;
+    // ─── Mutex state ───
+    let refreshPromise = null;
+    // ─── Proactive timer ───
+    let proactiveTimer = null;
+    async function requestRefresh() {
+        // If a refresh is already in progress, wait for it (mutex)
+        if (refreshPromise) {
+            return refreshPromise;
+        }
+        // Start new refresh — all concurrent callers will share this promise
+        refreshPromise = (async () => {
+            try {
+                const newToken = await doRefresh();
+                return newToken;
+            }
+            catch {
+                return null;
+            }
+            finally {
+                // Release mutex after completion
+                refreshPromise = null;
+            }
+        })();
+        return refreshPromise;
+    }
+    function scheduleProactive(lifetimeMs) {
+        cancelProactive();
+        // Schedule at 80% of lifetime, minimum 5 seconds
+        const refreshAt = Math.max(MIN_SCHEDULE_MS, Math.floor(lifetimeMs * 0.8));
+        proactiveTimer = setTimeout(() => {
+            proactiveTimer = null;
+            requestRefresh();
+        }, refreshAt);
+    }
+    function cancelProactive() {
+        if (proactiveTimer !== null) {
+            clearTimeout(proactiveTimer);
+            proactiveTimer = null;
+        }
+    }
+    function destroy() {
+        cancelProactive();
+        refreshPromise = null;
+    }
+    return { requestRefresh, scheduleProactive, cancelProactive, destroy };
+}
+//# sourceMappingURL=refresh-engine.js.map

package/dist/auth/refresh-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-engine.js","sourceRoot":"","sources":["../../src/auth/refresh-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkBH,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE7B,sBAAsB;IACtB,IAAI,cAAc,GAAkC,IAAI,CAAC;IAEzD,0BAA0B;IAC1B,IAAI,cAAc,GAAyC,IAAI,CAAC;IAEhE,KAAK,UAAU,cAAc;QAC3B,2DAA2D;QAC3D,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,qEAAqE;QACrE,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;gBACnC,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,iCAAiC;gBACjC,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,SAAS,iBAAiB,CAAC,UAAkB;QAC3C,eAAe,EAAE,CAAC;QAElB,iDAAiD;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC;QAE1E,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,cAAc,GAAG,IAAI,CAAC;YACtB,cAAc,EAAE,CAAC;QACnB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED,SAAS,eAAe;QACtB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,YAAY,CAAC,cAAc,CAAC,CAAC;YAC7B,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,SAAS,OAAO;QACd,eAAe,EAAE,CAAC;QAClB,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC"}