ras-stack 0.1.0

package/README.md

@@ -0,0 +1,148 @@
+# ras-stack
+
+Composable full-stack primitives shared across Richard Solomou's applications.
+
+`ras-stack` removes repeated infrastructure decisions without wrapping or replacing the libraries underneath. Applications continue to call Better Auth, TanStack Start, Drizzle, React Query, and Centrifugo directly. They can adopt any primitive independently and retain ownership of schemas, migrations, authorization, plugins, routes, and domain events.
+
+## Install
+
+```sh
+pnpm add ras-stack
+```
+
+The email and upload entrypoints use optional peer dependencies. Install only the integration an application consumes:
+
+```sh
+pnpm add nodemailer
+pnpm add tus-js-client
+```
+
+The package requires Node 24 and publishes separate entrypoints so an application does not load unused integrations:
+
+- `ras-stack/auth` — secrets, origin policy, provider credentials, random tokens, sessions, and rate limits.
+- `ras-stack/email` — SMTP environment parsing, Nodemailer transport creation, and delivery.
+- `ras-stack/realtime` — Centrifugo publication, bounded retries/backpressure, shutdown, and signed tokens.
+- `ras-stack/server` — canonical redirects, health responses, and framework-injected RPC wrappers.
+- `ras-stack/uploads` — configurable tus uploads and error-response parsing.
+- `ras-stack/config/*` — inheritable Oxlint and TypeScript configuration.
+
+## Auth
+
+The auth entrypoint provides independent options and utilities rather than an auth factory:
+
+```ts
+import { standardRateLimitOptions, standardSessionOptions, trustedOrigins } from 'ras-stack/auth'
+import { betterAuth } from 'better-auth'
+
+const auth = betterAuth({
+  database,
+  plugins,
+  session: standardSessionOptions(),
+  rateLimit: standardRateLimitOptions({ '/sign-up/email': { window: 60, max: 10 } }),
+  trustedOrigins: trustedOrigins({ configured: [process.env.APP_URL], trustForwardedHeaders: true }),
+})
+```
+
+The application supplies its normal Better Auth configuration, including its database adapter, schema, plugins, callbacks, and product-specific policy.
+
+## Server functions
+
+Framework access is injected, leaving TanStack Start available normally:
+
+```ts
+import { getRequest } from '@tanstack/react-start/server'
+import { requireSameOrigin } from 'ras-stack/auth'
+import { createRpc } from 'ras-stack/server'
+
+export const { rpc, mutationRpc } = createRpc({
+  getRequest,
+  requireMutation: (request) => requireSameOrigin(request, { configured: [process.env.APP_URL], trustForwardedHeaders: true }),
+})
+```
+
+Only enable `trustForwardedHeaders` when the application is deployed behind a proxy that replaces incoming forwarded headers.
+
+## Realtime
+
+The realtime entrypoint owns Centrifugo transport mechanics and token signing. Applications own channel names, authorization, presence information, and publication payloads:
+
+```ts
+import { CentrifugoPublisher, signRealtimeToken } from 'ras-stack/realtime'
+
+const publisher = new CentrifugoPublisher({
+  apiUrl,
+  apiKey,
+  maxConcurrentChannels: 8,
+  maxPendingChannels: 1024,
+  onError: (error, channel) => logger.error({ error, channel }, 'realtime publication failed'),
+})
+publisher.publish(`battle:${battle.id}`, { type: 'change' })
+
+const token = signRealtimeToken(user.id, { channel: `battle:${battle.id}`, info: presence }, { secret })
+
+await publisher.close()
+```
+
+`publish()` returns `false` when the publisher is closed, disabled, or at capacity. `close()` rejects new work and waits for accepted publications to finish, including the bounded retry budget.
+
+## Email and uploads
+
+Optional entrypoints integrate with dependencies that remain installed and available to the application:
+
+```ts
+import { createSmtpDelivery, createSmtpTransport, smtpConfigFromEnvironment } from 'ras-stack/email'
+import { createTusUpload, startTusUpload } from 'ras-stack/uploads'
+
+const smtp = smtpConfigFromEnvironment()
+const email = smtp ? createSmtpDelivery(smtp) : undefined
+
+const upload = createTusUpload({
+  endpoint: '/api/upload',
+  file,
+  metadata,
+  shouldRetry: (status) => status !== 423,
+  onProgress,
+})
+await startTusUpload(upload)
+```
+
+`createSmtpTransport()` and `createTusUpload()` return the upstream objects, so applications can use capabilities the convenience wrappers do not cover. Applications retain ownership of email templates, missing-email behavior, upload metadata, authorization, quotas, and completion processing.
+
+## Shared configuration
+
+Oxlint and TypeScript configurations are inheritable:
+
+```json
+{
+  "extends": ["./node_modules/ras-stack/config/oxlint.json"],
+  "rules": {
+    "application-specific-rule": "off"
+  }
+}
+```
+
+```json
+{
+  "extends": "ras-stack/config/typescript/tanstack",
+  "include": ["src", "vite.config.ts"]
+}
+```
+
+## GitHub Actions
+
+The shared setup action reads Node from `engines.node` and pnpm from `packageManager` in the consuming repository's `package.json`:
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: richardsolomou/ras-stack/actions/setup-js@v0.1.0
+    with:
+      just-version: '1.58.0'
+  - run: pnpm check
+```
+
+Pin the action to an immutable release tag and let Dependabot propose upgrades.
+
+## License and security
+
+`ras-stack` is licensed under the GNU Affero General Public License v3.0. Report vulnerabilities through GitHub private vulnerability reporting as described in [SECURITY.md](SECURITY.md).

package/config/oxlint.json

@@ -0,0 +1,19 @@
+{
+  "plugins": ["typescript", "unicorn", "oxc", "react", "jsx-a11y", "import", "vitest"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "perf": "warn"
+  },
+  "rules": {
+    "import/no-unassigned-import": "off",
+    "react/react-in-jsx-scope": "off",
+    "typescript/consistent-return": "off",
+    "typescript/no-unsafe-type-assertion": "off",
+    "unicorn/filename-case": "off",
+    "vitest/require-mock-type-parameters": "off"
+  },
+  "env": {
+    "builtin": true
+  }
+}

package/config/typescript/browser.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "jsx": "react-jsx",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "target": "ES2023",
+    "lib": ["ES2023", "DOM", "DOM.Iterable"],
+    "skipLibCheck": true,
+    "noEmit": true,
+    "verbatimModuleSyntax": true
+  }
+}

package/config/typescript/library.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "target": "ES2024",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
+    "skipLibCheck": true,
+    "verbatimModuleSyntax": true
+  }
+}

package/config/typescript/tanstack.json

@@ -0,0 +1,6 @@
+{
+  "extends": "./browser.json",
+  "compilerOptions": {
+    "types": ["vite/client", "node"]
+  }
+}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export * from './origins.js';
+export * from './providers.js';
+export * from './random.js';
+export * from './secret.js';
+export * from './settings.js';

package/dist/auth/index.js

@@ -0,0 +1,6 @@
+export * from './origins.js';
+export * from './providers.js';
+export * from './random.js';
+export * from './secret.js';
+export * from './settings.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}

package/dist/auth/origins.d.ts

@@ -0,0 +1,11 @@
+export type OriginOptions = {
+    configured?: readonly (string | undefined)[];
+    allowReferer?: boolean;
+    trustForwardedHeaders?: boolean;
+};
+export declare function parseOrigin(value: string | undefined): string | undefined;
+export declare function forwardedOrigin(request: Request): string | undefined;
+export declare function acceptedOrigins(request: Request, options?: OriginOptions): string[];
+export declare function validSameOriginRequest(request: Request, options?: OriginOptions): boolean;
+export declare function requireSameOrigin(request: Request, options?: OriginOptions): void;
+export declare function trustedOrigins(options?: OriginOptions): (request?: Request) => string[];

package/dist/auth/origins.js

@@ -0,0 +1,35 @@
+export function parseOrigin(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function forwardedOrigin(request) {
+    const host = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim() || request.headers.get('host')?.trim();
+    const protocol = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim();
+    return host && (protocol === 'http' || protocol === 'https') ? parseOrigin(`${protocol}://${host}`) : undefined;
+}
+export function acceptedOrigins(request, options = {}) {
+    return [
+        new URL(request.url).origin,
+        ...(options.trustForwardedHeaders ? [forwardedOrigin(request)] : []),
+        ...(options.configured ?? []).map(parseOrigin),
+    ].filter((origin) => Boolean(origin));
+}
+export function validSameOriginRequest(request, options = {}) {
+    const origin = request.headers.get('origin') || (options.allowReferer ? parseOrigin(request.headers.get('referer') ?? undefined) : undefined);
+    const site = request.headers.get('sec-fetch-site');
+    return Boolean(origin && (!site || site === 'same-origin') && acceptedOrigins(request, options).includes(origin));
+}
+export function requireSameOrigin(request, options = {}) {
+    if (!validSameOriginRequest(request, options))
+        throw new Response('cross-origin mutation rejected', { status: 403 });
+}
+export function trustedOrigins(options = {}) {
+    return (request) => request ? acceptedOrigins(request, options).filter((origin) => origin !== new URL(request.url).origin) : [];
+}
+//# sourceMappingURL=origins.js.map

package/dist/auth/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/auth/origins.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAA;IAClH,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChF,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,OAAO,GAAkB,EAAE;IAC3E,OAAO;QACL,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;QAC3B,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;KAC/C,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,OAAO,GAAkB,EAAE;IAClF,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAChI,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAClD,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AACnH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB,EAAE,OAAO,GAAkB,EAAE;IAC7E,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AACtH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAO,GAAkB,EAAE;IACxD,OAAO,CAAC,OAAiB,EAAE,EAAE,CAC3B,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/G,CAAC"}

package/dist/auth/providers.d.ts

@@ -0,0 +1,6 @@
+export type ProviderCredentials = {
+    clientId: string;
+    clientSecret: string;
+};
+export declare function configuredProviders<const Provider extends string>(providers: readonly Provider[], environment?: NodeJS.ProcessEnv): Provider[];
+export declare function providerCredentials(provider: string, environment?: NodeJS.ProcessEnv): ProviderCredentials | undefined;

package/dist/auth/providers.js

@@ -0,0 +1,13 @@
+export function configuredProviders(providers, environment = process.env) {
+    return providers.filter((provider) => {
+        const prefix = provider.toUpperCase().replaceAll('-', '_');
+        return Boolean(environment[`${prefix}_CLIENT_ID`]?.trim() && environment[`${prefix}_CLIENT_SECRET`]?.trim());
+    });
+}
+export function providerCredentials(provider, environment = process.env) {
+    const prefix = provider.toUpperCase().replaceAll('-', '_');
+    const clientId = environment[`${prefix}_CLIENT_ID`]?.trim();
+    const clientSecret = environment[`${prefix}_CLIENT_SECRET`]?.trim();
+    return clientId && clientSecret ? { clientId, clientSecret } : undefined;
+}
+//# sourceMappingURL=providers.js.map

package/dist/auth/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CACjC,SAA8B,EAC9B,WAAW,GAAsB,OAAO,CAAC,GAAG;IAE5C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9G,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,WAAW,GAAsB,OAAO,CAAC,GAAG;IAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,CAAA;IAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAA;IACnE,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC"}

package/dist/auth/random.d.ts

@@ -0,0 +1,2 @@
+export declare function randomToken(bytes?: number): string;
+export declare function randomId(bytes?: number): string;

package/dist/auth/random.js

@@ -0,0 +1,10 @@
+import crypto from 'node:crypto';
+export function randomToken(bytes = 16) {
+    if (!Number.isSafeInteger(bytes) || bytes < 1)
+        throw new RangeError('Token bytes must be a positive integer');
+    return crypto.randomBytes(bytes).toString('base64url');
+}
+export function randomId(bytes = 8) {
+    return randomToken(bytes);
+}
+//# sourceMappingURL=random.js.map

package/dist/auth/random.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.js","sourceRoot":"","sources":["../../src/auth/random.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,MAAM,UAAU,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAA;IAC7G,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAK,GAAG,CAAC;IAChC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC"}

package/dist/auth/secret.d.ts

@@ -0,0 +1,8 @@
+export type PersistedSecretOptions = {
+    directory: string;
+    environment?: NodeJS.ProcessEnv;
+    environmentKey?: string;
+    filename?: string;
+    bytes?: number;
+};
+export declare function persistedSecret(options: PersistedSecretOptions): string;

package/dist/auth/secret.js

@@ -0,0 +1,45 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export function persistedSecret(options) {
+    const environment = options.environment ?? process.env;
+    const configured = environment[options.environmentKey ?? 'AUTH_SECRET']?.trim();
+    if (configured)
+        return configured;
+    const file = path.join(options.directory, options.filename ?? 'auth.secret');
+    try {
+        return readSecret(file);
+    }
+    catch (error) {
+        if (!isErrnoException(error) || error.code !== 'ENOENT')
+            throw error;
+    }
+    fs.mkdirSync(options.directory, { recursive: true });
+    const secret = crypto.randomBytes(options.bytes ?? 32).toString('base64url');
+    const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, secret, { mode: 0o600, flag: 'wx' });
+        try {
+            fs.linkSync(temporary, file);
+            return secret;
+        }
+        catch (error) {
+            if (!isErrnoException(error) || error.code !== 'EEXIST')
+                throw error;
+            return readSecret(file);
+        }
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+function readSecret(file) {
+    const secret = fs.readFileSync(file, 'utf8').trim();
+    if (!secret)
+        throw new Error(`Secret file is empty: ${file}`);
+    return secret;
+}
+function isErrnoException(error) {
+    return error instanceof Error && 'code' in error;
+}
+//# sourceMappingURL=secret.js.map

package/dist/auth/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/auth/secret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,MAAM,SAAS,CAAA;AACxB,OAAO,IAAI,MAAM,WAAW,CAAA;AAU5B,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAA;IACtD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IAC/E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAA;IAC5E,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IACtE,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC5E,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAA;IACrE,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC5B,OAAO,MAAM,CAAA;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;YACpE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAA;AAClD,CAAC"}

package/dist/auth/settings.d.ts

@@ -0,0 +1,28 @@
+export type RateLimitRule = {
+    window: number;
+    max: number;
+};
+export declare function standardSessionOptions(): {
+    expiresIn: number;
+    updateAge: number;
+};
+export declare function standardRateLimitOptions(customRules?: Record<string, RateLimitRule>): {
+    enabled: boolean;
+    storage: 'database';
+    window: number;
+    max: number;
+    customRules: {
+        '/sign-in/email': {
+            window: number;
+            max: number;
+        };
+        '/sign-up/email': {
+            window: number;
+            max: number;
+        };
+        '/forget-password': {
+            window: number;
+            max: number;
+        };
+    };
+};

package/dist/auth/settings.js

@@ -0,0 +1,18 @@
+export function standardSessionOptions() {
+    return { expiresIn: 60 * 60 * 24 * 90, updateAge: 60 * 60 * 24 };
+}
+export function standardRateLimitOptions(customRules = {}) {
+    return {
+        enabled: true,
+        storage: 'database',
+        window: 60,
+        max: 120,
+        customRules: {
+            '/sign-in/email': { window: 60, max: 20 },
+            '/sign-up/email': { window: 60, max: 15 },
+            '/forget-password': { window: 60, max: 5 },
+            ...customRules,
+        },
+    };
+}
+//# sourceMappingURL=settings.js.map

package/dist/auth/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/auth/settings.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,sBAAsB;IACpC,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,WAAW,GAAkC,EAAE;IACtF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,UAAmB;QAC5B,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,GAAG;QACR,WAAW,EAAE;YACX,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACzC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;YACzC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;YAC1C,GAAG,WAAW;SACf;KACF,CAAA;AACH,CAAC"}

package/dist/email/index.d.ts

@@ -0,0 +1,30 @@
+import nodemailer from 'nodemailer';
+export type EmailMessage = {
+    to: string;
+    subject: string;
+    text: string;
+    html?: string;
+};
+export type SmtpConfig = {
+    from: string;
+    host: string;
+    port: number;
+    secure: boolean;
+    user?: string;
+    password?: string;
+};
+export type SmtpEnvironmentOptions = {
+    host?: string;
+    port?: string;
+    secure?: string;
+    user?: string;
+    password?: string;
+    from?: string;
+};
+export type EmailDelivery = {
+    send(message: EmailMessage): Promise<void>;
+    verify(): Promise<void>;
+};
+export declare function smtpConfigFromEnvironment(environment?: NodeJS.ProcessEnv, keys?: SmtpEnvironmentOptions): SmtpConfig | undefined;
+export declare function createSmtpDelivery(config: SmtpConfig): EmailDelivery;
+export declare function createSmtpTransport(config: SmtpConfig): nodemailer.Transporter<import("nodemailer/lib/smtp-transport/index.js").SentMessageInfo, import("nodemailer/lib/smtp-transport/index.js").Options>;

package/dist/email/index.js

@@ -0,0 +1,44 @@
+import nodemailer from 'nodemailer';
+export function smtpConfigFromEnvironment(environment = process.env, keys = {}) {
+    const host = environment[keys.host ?? 'SMTP_HOST']?.trim();
+    const from = environment[keys.from ?? 'EMAIL_FROM']?.trim();
+    if (!host && !from)
+        return undefined;
+    if (!host)
+        throw new Error(`${keys.host ?? 'SMTP_HOST'} is required for SMTP email`);
+    if (!from)
+        throw new Error(`${keys.from ?? 'EMAIL_FROM'} is required for SMTP email`);
+    const portKey = keys.port ?? 'SMTP_PORT';
+    const port = Number(environment[portKey] ?? 587);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535)
+        throw new Error(`${portKey} must be a valid TCP port`);
+    const userKey = keys.user ?? 'SMTP_USER';
+    const passwordKey = keys.password ?? 'SMTP_PASSWORD';
+    const user = environment[userKey]?.trim();
+    const password = environment[passwordKey];
+    if (Boolean(user) !== Boolean(password))
+        throw new Error(`${userKey} and ${passwordKey} must be configured together`);
+    return {
+        from,
+        host,
+        port,
+        secure: environment[keys.secure ?? 'SMTP_SECURE']?.trim().toLowerCase() === 'true',
+        ...(user && password ? { user, password } : {}),
+    };
+}
+export function createSmtpDelivery(config) {
+    const transport = createSmtpTransport(config);
+    return {
+        send: async (message) => transport.sendMail({ from: config.from, ...message }).then(() => undefined),
+        verify: async () => transport.verify().then(() => undefined),
+    };
+}
+export function createSmtpTransport(config) {
+    return nodemailer.createTransport({
+        host: config.host,
+        port: config.port,
+        secure: config.secure,
+        auth: config.user ? { user: config.user, pass: config.password } : undefined,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/email/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/email/index.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAA;AA2BnC,MAAM,UAAU,yBAAyB,CACvC,WAAW,GAAsB,OAAO,CAAC,GAAG,EAC5C,IAAI,GAA2B,EAAE;IAEjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,CAAA;IAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,6BAA6B,CAAC,CAAA;IACpF,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,6BAA6B,CAAC,CAAA;IAErF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,2BAA2B,CAAC,CAAA;IAEhH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAA;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACzC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,QAAQ,WAAW,8BAA8B,CAAC,CAAA;IAErH,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAClF,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACpG,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,OAAO,UAAU,CAAC,eAAe,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAC,CAAA;AACJ,CAAC"}

package/dist/realtime/index.d.ts

@@ -0,0 +1,2 @@
+export * from './publisher.js';
+export * from './tokens.js';

package/dist/realtime/index.js

@@ -0,0 +1,3 @@
+export * from './publisher.js';
+export * from './tokens.js';
+//# sourceMappingURL=index.js.map

package/dist/realtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/realtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA"}

package/dist/realtime/publisher.d.ts

@@ -0,0 +1,34 @@
+export type CentrifugoPublisherOptions = {
+    apiUrl: string;
+    apiKey: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+    retryMs?: number;
+    maxRetries?: number;
+    maxConcurrentChannels?: number;
+    maxPendingChannels?: number;
+    onError: (error: unknown, channel: string) => void;
+    onRetry?: (error: unknown, channel: string) => void;
+};
+export declare class CentrifugoPublisher {
+    private readonly options;
+    private readonly pending;
+    private readonly queue;
+    private readonly idleWaiters;
+    private readonly request;
+    private readonly maxConcurrentChannels;
+    private readonly maxPendingChannels;
+    private active;
+    private closed;
+    constructor(options: CentrifugoPublisherOptions);
+    publish(channel: string, data: unknown): boolean;
+    idle(): Promise<void>;
+    close(): Promise<void>;
+    private pump;
+    private flush;
+    private deliver;
+    private deliverOnce;
+    private reportError;
+    private isIdle;
+    private resolveIdle;
+}