schematic-pg 0.1.7 → 0.1.10

package/dist/api/auth/jwt-crypto.d.ts

@@ -0,0 +1,10 @@
+/** HS256 only — matches createJwtResolver / createTokenService. */
+export declare const JWT_ALGORITHM = "HS256";
+export declare function base64UrlEncode(value: string | Buffer): string;
+export declare function base64UrlDecode(value: string): Buffer;
+export declare function signHs256Jwt(payload: Record<string, unknown>, secret: string): string;
+/**
+ * Verify HS256 signature and optional exp/nbf.
+ * Tokens without exp/nbf remain valid (backward compatible with older test JWTs).
+ */
+export declare function verifyHs256Jwt(token: string, secret: string, nowSeconds?: number): Record<string, unknown>;

package/dist/api/auth/jwt-crypto.js

@@ -0,0 +1,61 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { UnauthorizedError } from './errors.js';
+/** HS256 only — matches createJwtResolver / createTokenService. */
+export const JWT_ALGORITHM = 'HS256';
+export function base64UrlEncode(value) {
+    const buffer = typeof value === 'string' ? Buffer.from(value, 'utf8') : value;
+    return buffer.toString('base64url');
+}
+export function base64UrlDecode(value) {
+    const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padding = normalized.length % 4 === 0 ? '' : '='.repeat(4 - (normalized.length % 4));
+    return Buffer.from(normalized + padding, 'base64');
+}
+export function signHs256Jwt(payload, secret) {
+    const header = base64UrlEncode(JSON.stringify({ alg: JWT_ALGORITHM, typ: 'JWT' }));
+    const body = base64UrlEncode(JSON.stringify(payload));
+    const signingInput = `${header}.${body}`;
+    const signature = createHmac('sha256', secret).update(signingInput).digest('base64url');
+    return `${signingInput}.${signature}`;
+}
+/**
+ * Verify HS256 signature and optional exp/nbf.
+ * Tokens without exp/nbf remain valid (backward compatible with older test JWTs).
+ */
+export function verifyHs256Jwt(token, secret, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new UnauthorizedError('Invalid JWT format');
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const expectedSignature = createHmac('sha256', secret).update(signingInput).digest();
+    const actualSignature = base64UrlDecode(encodedSignature);
+    if (expectedSignature.length !== actualSignature.length ||
+        !timingSafeEqual(expectedSignature, actualSignature)) {
+        throw new UnauthorizedError('Invalid JWT signature');
+    }
+    const header = JSON.parse(base64UrlDecode(encodedHeader).toString('utf8'));
+    if (header.alg !== JWT_ALGORITHM) {
+        throw new UnauthorizedError(`Unsupported JWT algorithm "${header.alg ?? 'unknown'}"`);
+    }
+    const payload = JSON.parse(base64UrlDecode(encodedPayload).toString('utf8'));
+    assertJwtTimeClaims(payload, nowSeconds);
+    return payload;
+}
+function assertJwtTimeClaims(payload, nowSeconds) {
+    const exp = payload.exp;
+    if (exp !== undefined && exp !== null) {
+        const expSeconds = Number(exp);
+        if (!Number.isFinite(expSeconds) || nowSeconds >= expSeconds) {
+            throw new UnauthorizedError('JWT has expired');
+        }
+    }
+    const nbf = payload.nbf;
+    if (nbf !== undefined && nbf !== null) {
+        const nbfSeconds = Number(nbf);
+        if (!Number.isFinite(nbfSeconds) || nowSeconds < nbfSeconds) {
+            throw new UnauthorizedError('JWT is not yet valid');
+        }
+    }
+}

package/dist/api/auth/jwt-resolver.js

@@ -1,9 +1,8 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
 import { UnauthorizedError } from './errors.js';
+import { verifyHs256Jwt } from './jwt-crypto.js';
 const BEARER_PREFIX = 'Bearer ';
 const DEFAULT_ROLE_CLAIM = 'role';
 const DEFAULT_USER_ID_CLAIM = 'sub';
-const JWT_ALGORITHM = 'HS256';
 export function createJwtResolver(options = {}) {
     const roleClaim = options.roleClaim ?? process.env.JWT_ROLE_CLAIM ?? DEFAULT_ROLE_CLAIM;
     const userIdClaim = options.userIdClaim ?? process.env.JWT_USER_ID_CLAIM ?? DEFAULT_USER_ID_CLAIM;
@@ -20,7 +19,7 @@ export function createJwtResolver(options = {}) {
         if (!secret) {
             throw new UnauthorizedError('JWT_SECRET is not configured');
         }
-        const payload = verifyJwt(token, secret);
+        const payload = verifyHs256Jwt(token, secret);
         const role = String(payload[roleClaim] ?? 'PUBLIC');
         const userId = payload[userIdClaim];
         if (userId === undefined || userId === null || userId === '') {
@@ -33,27 +32,3 @@ export function createJwtResolver(options = {}) {
         return { role, user };
     };
 }
-function verifyJwt(token, secret) {
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-        throw new UnauthorizedError('Invalid JWT format');
-    }
-    const [encodedHeader, encodedPayload, encodedSignature] = parts;
-    const signingInput = `${encodedHeader}.${encodedPayload}`;
-    const expectedSignature = createHmac('sha256', secret).update(signingInput).digest();
-    const actualSignature = base64UrlDecode(encodedSignature);
-    if (expectedSignature.length !== actualSignature.length ||
-        !timingSafeEqual(expectedSignature, actualSignature)) {
-        throw new UnauthorizedError('Invalid JWT signature');
-    }
-    const header = JSON.parse(base64UrlDecode(encodedHeader).toString('utf8'));
-    if (header.alg !== JWT_ALGORITHM) {
-        throw new UnauthorizedError(`Unsupported JWT algorithm "${header.alg ?? 'unknown'}"`);
-    }
-    return JSON.parse(base64UrlDecode(encodedPayload).toString('utf8'));
-}
-function base64UrlDecode(value) {
-    const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
-    const padding = normalized.length % 4 === 0 ? '' : '='.repeat(4 - (normalized.length % 4));
-    return Buffer.from(normalized + padding, 'base64');
-}

package/dist/api/auth/password/config.d.ts

@@ -0,0 +1,32 @@
+import { argon2id } from 'argon2';
+/**
+ * Argon2id (hybrid) resists both GPU/ASIC cracking and side-channel leaks better
+ * than pure argon2i/argon2d for password storage (OWASP Password Storage Cheat Sheet).
+ * Version 19 (0x13) is the current Argon2 RFC reference version.
+ */
+export declare const ARGON2_VERSION = 19;
+/**
+ * Single source of truth for hash parameters. Do not scatter these literals.
+ * memoryCost 65536 = 64 MiB; timeCost 3 ≈ interactive login cost.
+ */
+export declare const DEFAULT_PASSWORD_CONFIG: {
+    readonly memoryCost: 65536;
+    readonly timeCost: 3;
+    readonly parallelism: number;
+    readonly type: 2;
+    readonly version: 19;
+};
+export type PasswordConfig = {
+    memoryCost: number;
+    timeCost: number;
+    parallelism: number;
+    type: typeof argon2id;
+    version: number;
+};
+/** Pepper is application-side secret; never persisted with the hash. */
+export declare function resolvePepper(env?: NodeJS.ProcessEnv): string;
+/**
+ * Bind password to the app by appending pepper before hash/verify.
+ * Compromise of the hash DB alone is insufficient without AUTH_PEPPER.
+ */
+export declare function applyPepper(password: string, pepper: string): string;

package/dist/api/auth/password/config.js

@@ -0,0 +1,35 @@
+import { availableParallelism } from 'node:os';
+import { argon2id } from 'argon2';
+import { MissingAuthPepperError } from './errors.js';
+/**
+ * Argon2id (hybrid) resists both GPU/ASIC cracking and side-channel leaks better
+ * than pure argon2i/argon2d for password storage (OWASP Password Storage Cheat Sheet).
+ * Version 19 (0x13) is the current Argon2 RFC reference version.
+ */
+export const ARGON2_VERSION = 19;
+/**
+ * Single source of truth for hash parameters. Do not scatter these literals.
+ * memoryCost 65536 = 64 MiB; timeCost 3 ≈ interactive login cost.
+ */
+export const DEFAULT_PASSWORD_CONFIG = {
+    memoryCost: 65_536,
+    timeCost: 3,
+    parallelism: availableParallelism(),
+    type: argon2id,
+    version: ARGON2_VERSION,
+};
+/** Pepper is application-side secret; never persisted with the hash. */
+export function resolvePepper(env = process.env) {
+    const pepper = env.AUTH_PEPPER;
+    if (pepper === undefined || pepper === null || pepper === '') {
+        throw new MissingAuthPepperError();
+    }
+    return pepper;
+}
+/**
+ * Bind password to the app by appending pepper before hash/verify.
+ * Compromise of the hash DB alone is insufficient without AUTH_PEPPER.
+ */
+export function applyPepper(password, pepper) {
+    return password + pepper;
+}

package/dist/api/auth/password/errors.d.ts

@@ -0,0 +1,8 @@
+/** Raised when AUTH_PEPPER is missing. Pepper must never be stored in the DB. */
+export declare class MissingAuthPepperError extends Error {
+    constructor(message?: string);
+}
+/** Raised when the password input is empty, null, undefined, or not a string. */
+export declare class InvalidPasswordInputError extends Error {
+    constructor(message?: string);
+}

package/dist/api/auth/password/errors.js

@@ -0,0 +1,14 @@
+/** Raised when AUTH_PEPPER is missing. Pepper must never be stored in the DB. */
+export class MissingAuthPepperError extends Error {
+    constructor(message = 'AUTH_PEPPER is not configured') {
+        super(message);
+        this.name = 'MissingAuthPepperError';
+    }
+}
+/** Raised when the password input is empty, null, undefined, or not a string. */
+export class InvalidPasswordInputError extends Error {
+    constructor(message = 'Password must be a non-empty string') {
+        super(message);
+        this.name = 'InvalidPasswordInputError';
+    }
+}

package/dist/api/auth/password/index.d.ts

@@ -0,0 +1,3 @@
+export { ARGON2_VERSION, DEFAULT_PASSWORD_CONFIG, applyPepper, resolvePepper, type PasswordConfig, } from './config.js';
+export { InvalidPasswordInputError, MissingAuthPepperError } from './errors.js';
+export { createPasswordService, passwordService, type PasswordService, } from './password.js';

package/dist/api/auth/password/index.js

@@ -0,0 +1,3 @@
+export { ARGON2_VERSION, DEFAULT_PASSWORD_CONFIG, applyPepper, resolvePepper, } from './config.js';
+export { InvalidPasswordInputError, MissingAuthPepperError } from './errors.js';
+export { createPasswordService, passwordService, } from './password.js';

package/dist/api/auth/password/password.d.ts

@@ -0,0 +1,14 @@
+import { type PasswordConfig } from './config.js';
+export interface PasswordService {
+    hashPassword(password: string): Promise<string>;
+    verifyPassword(password: string, encodedHash: string): Promise<boolean>;
+    needsRehash(encodedHash: string): boolean;
+}
+/**
+ * Factory for the password service.
+ * Uses Argon2id with automatic salt; output is the full `$argon2id$…` encoded string
+ * (algo, version, params, salt, hash) so verify never needs a separate salt column.
+ */
+export declare function createPasswordService(config?: PasswordConfig): PasswordService;
+/** Default singleton — import as `passwordService` in app code. */
+export declare const passwordService: PasswordService;

package/dist/api/auth/password/password.js

@@ -0,0 +1,46 @@
+import { hash as argon2Hash, needsRehash as argon2NeedsRehash, verify as argon2Verify } from 'argon2';
+import { applyPepper, DEFAULT_PASSWORD_CONFIG, resolvePepper, } from './config.js';
+import { InvalidPasswordInputError } from './errors.js';
+function assertPasswordInput(password) {
+    if (typeof password !== 'string' || password.length === 0) {
+        throw new InvalidPasswordInputError();
+    }
+}
+/**
+ * Factory for the password service.
+ * Uses Argon2id with automatic salt; output is the full `$argon2id$…` encoded string
+ * (algo, version, params, salt, hash) so verify never needs a separate salt column.
+ */
+export function createPasswordService(config = DEFAULT_PASSWORD_CONFIG) {
+    const hashOptions = {
+        memoryCost: config.memoryCost,
+        timeCost: config.timeCost,
+        parallelism: config.parallelism,
+        type: config.type,
+        version: config.version,
+    };
+    return {
+        async hashPassword(password) {
+            assertPasswordInput(password);
+            const pepper = resolvePepper();
+            // Never log password, pepper, or the resulting hash.
+            return argon2Hash(applyPepper(password, pepper), hashOptions);
+        },
+        async verifyPassword(password, encodedHash) {
+            assertPasswordInput(password);
+            const pepper = resolvePepper();
+            // Argon2 verify is constant-time for the crypto compare; no manual string compare.
+            return argon2Verify(encodedHash, applyPepper(password, pepper));
+        },
+        needsRehash(encodedHash) {
+            return argon2NeedsRehash(encodedHash, {
+                memoryCost: config.memoryCost,
+                timeCost: config.timeCost,
+                parallelism: config.parallelism,
+                version: config.version,
+            });
+        },
+    };
+}
+/** Default singleton — import as `passwordService` in app code. */
+export const passwordService = createPasswordService();

package/dist/api/auth/routes.d.ts

@@ -0,0 +1,23 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+import { type PasswordService } from './password/index.js';
+import { type TokenService } from './token/index.js';
+export interface CreateAuthRouterOptions {
+    userModel?: string;
+    emailField?: string;
+    passwordHashField?: string;
+    roleField?: string;
+    nameField?: string;
+    defaultRole?: string;
+    omitFields?: string[];
+    /** Merged into create payloads (e.g. required schema defaults like `{ balance: 0 }`). */
+    defaultCreateFields?: Record<string, unknown>;
+    passwordService?: PasswordService;
+    tokenService?: TokenService;
+}
+/**
+ * Reusable auth router: POST /register, POST /login, GET /me.
+ * Mount via custom routes (src/routes/auth.ts → /auth).
+ * Speaks to the DB client directly — does not go through model @policy.
+ */
+export declare function createAuthRouter(options?: CreateAuthRouterOptions): Hono<AppEnv>;

package/dist/api/auth/routes.js

@@ -0,0 +1,118 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { UnauthorizedError } from './errors.js';
+import { createPasswordService } from './password/index.js';
+import { createTokenService } from './token/index.js';
+import { omitFields } from '../utils/omit-fields.js';
+import { validateJson } from '../middleware/validate.js';
+import { PUBLIC_ROLE } from './types.js';
+const DEFAULT_USER_MODEL = 'user';
+const DEFAULT_EMAIL_FIELD = 'email';
+const DEFAULT_PASSWORD_HASH_FIELD = 'passwordHash';
+const DEFAULT_ROLE_FIELD = 'role';
+const DEFAULT_NAME_FIELD = 'name';
+const DEFAULT_ROLE = 'USER';
+const DUMMY_PASSWORD = '__schematic-pg-timing-dummy__';
+function resolveUserModel(db, modelKey) {
+    const model = db[modelKey];
+    if (!model || typeof model !== 'object') {
+        throw new Error(`Auth user model "${modelKey}" not found on db client`);
+    }
+    return model;
+}
+function asUserRecord(row) {
+    if (typeof row.id !== 'string' && typeof row.id !== 'number') {
+        throw new Error('User row is missing id');
+    }
+    return row;
+}
+/**
+ * Reusable auth router: POST /register, POST /login, GET /me.
+ * Mount via custom routes (src/routes/auth.ts → /auth).
+ * Speaks to the DB client directly — does not go through model @policy.
+ */
+export function createAuthRouter(options = {}) {
+    const userModel = options.userModel ?? DEFAULT_USER_MODEL;
+    const emailField = options.emailField ?? DEFAULT_EMAIL_FIELD;
+    const passwordHashField = options.passwordHashField ?? DEFAULT_PASSWORD_HASH_FIELD;
+    const roleField = options.roleField ?? DEFAULT_ROLE_FIELD;
+    const nameField = options.nameField ?? DEFAULT_NAME_FIELD;
+    const defaultRole = options.defaultRole ?? DEFAULT_ROLE;
+    const fieldsToOmit = options.omitFields ?? [passwordHashField];
+    const defaultCreateFields = options.defaultCreateFields ?? {};
+    const passwordService = options.passwordService ?? createPasswordService();
+    const tokenService = options.tokenService ?? createTokenService();
+    let dummyHashPromise = null;
+    function getDummyHash() {
+        if (!dummyHashPromise) {
+            dummyHashPromise = passwordService.hashPassword(DUMMY_PASSWORD);
+        }
+        return dummyHashPromise;
+    }
+    const registerSchema = z.object({
+        email: z.email(),
+        password: z.string().min(1),
+        name: z.string().min(1).optional(),
+    });
+    const loginSchema = z.object({
+        email: z.email(),
+        password: z.string().min(1),
+    });
+    const router = new Hono();
+    router.post('/register', validateJson(registerSchema), async (c) => {
+        const db = c.get('db');
+        const body = c.req.valid('json');
+        const users = resolveUserModel(db, userModel);
+        const passwordHash = await passwordService.hashPassword(body.password);
+        const createData = {
+            ...defaultCreateFields,
+            [emailField]: body.email,
+            [passwordHashField]: passwordHash,
+            [roleField]: defaultRole,
+        };
+        if (body.name !== undefined) {
+            createData[nameField] = body.name;
+        }
+        const row = asUserRecord(await users.create(createData));
+        const role = String(row[roleField] ?? defaultRole);
+        const token = tokenService.signAccessToken({ userId: String(row.id), role });
+        return c.json({
+            token,
+            user: omitFields(row, fieldsToOmit),
+        }, 201);
+    });
+    router.post('/login', validateJson(loginSchema), async (c) => {
+        const db = c.get('db');
+        const body = c.req.valid('json');
+        const users = resolveUserModel(db, userModel);
+        const row = await users.findFirst({ where: { [emailField]: body.email } });
+        const storedHash = row && typeof row[passwordHashField] === 'string'
+            ? row[passwordHashField]
+            : await getDummyHash();
+        // Always verify to reduce user-enumeration timing differences.
+        const valid = await passwordService.verifyPassword(body.password, storedHash);
+        if (!row || !valid) {
+            // Uniform message — do not reveal whether email exists.
+            throw new UnauthorizedError('Invalid email or password');
+        }
+        let user = asUserRecord(row);
+        if (passwordService.needsRehash(storedHash)) {
+            const newHash = await passwordService.hashPassword(body.password);
+            user = asUserRecord(await users.update({
+                where: { id: user.id },
+                data: { [passwordHashField]: newHash },
+            }));
+        }
+        const role = String(user[roleField] ?? defaultRole);
+        const token = tokenService.signAccessToken({ userId: String(user.id), role });
+        return c.json({
+            token,
+            user: omitFields(user, fieldsToOmit),
+        });
+    });
+    router.get('/me', (c) => {
+        const auth = c.get('auth');
+        return c.json(auth ?? { role: PUBLIC_ROLE });
+    });
+    return router;
+}

package/dist/api/auth/token/config.d.ts

@@ -0,0 +1,10 @@
+/** Default access-token lifetime when AUTH_ACCESS_TOKEN_TTL is unset (1 hour). */
+export declare const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3600;
+export interface TokenConfig {
+    secret?: string;
+    ttlSeconds: number;
+    roleClaim: string;
+    userIdClaim: string;
+}
+export declare function parseTtlSeconds(value: string | undefined, defaultSeconds?: number): number;
+export declare function resolveTokenConfig(overrides?: Partial<TokenConfig>): TokenConfig;

package/dist/api/auth/token/config.js

@@ -0,0 +1,43 @@
+import { InvalidTokenTtlError } from './errors.js';
+/** Default access-token lifetime when AUTH_ACCESS_TOKEN_TTL is unset (1 hour). */
+export const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 3_600;
+const DEFAULT_ROLE_CLAIM = 'role';
+const DEFAULT_USER_ID_CLAIM = 'sub';
+const TTL_UNIT_SECONDS = {
+    s: 1,
+    m: 60,
+    h: 3_600,
+    d: 86_400,
+};
+export function parseTtlSeconds(value, defaultSeconds = DEFAULT_ACCESS_TOKEN_TTL_SECONDS) {
+    if (value === undefined || value === null || value === '') {
+        return defaultSeconds;
+    }
+    if (/^\d+$/.test(value)) {
+        const seconds = Number(value);
+        if (seconds <= 0) {
+            throw new InvalidTokenTtlError(`AUTH_ACCESS_TOKEN_TTL must be positive, got "${value}"`);
+        }
+        return seconds;
+    }
+    const match = /^(\d+)([smhd])$/i.exec(value.trim());
+    if (!match) {
+        throw new InvalidTokenTtlError(`AUTH_ACCESS_TOKEN_TTL must be seconds or a duration like 15m/1h, got "${value}"`);
+    }
+    const amount = Number(match[1]);
+    const unit = match[2].toLowerCase();
+    const multiplier = TTL_UNIT_SECONDS[unit];
+    const seconds = amount * multiplier;
+    if (seconds <= 0) {
+        throw new InvalidTokenTtlError(`AUTH_ACCESS_TOKEN_TTL must be positive, got "${value}"`);
+    }
+    return seconds;
+}
+export function resolveTokenConfig(overrides = {}) {
+    return {
+        secret: overrides.secret ?? process.env.JWT_SECRET,
+        ttlSeconds: overrides.ttlSeconds ?? parseTtlSeconds(process.env.AUTH_ACCESS_TOKEN_TTL),
+        roleClaim: overrides.roleClaim ?? process.env.JWT_ROLE_CLAIM ?? DEFAULT_ROLE_CLAIM,
+        userIdClaim: overrides.userIdClaim ?? process.env.JWT_USER_ID_CLAIM ?? DEFAULT_USER_ID_CLAIM,
+    };
+}

package/dist/api/auth/token/errors.d.ts

@@ -0,0 +1,6 @@
+export declare class MissingJwtSecretError extends Error {
+    constructor(message?: string);
+}
+export declare class InvalidTokenTtlError extends Error {
+    constructor(message?: string);
+}

package/dist/api/auth/token/errors.js

@@ -0,0 +1,12 @@
+export class MissingJwtSecretError extends Error {
+    constructor(message = 'JWT_SECRET is not configured') {
+        super(message);
+        this.name = 'MissingJwtSecretError';
+    }
+}
+export class InvalidTokenTtlError extends Error {
+    constructor(message = 'Invalid AUTH_ACCESS_TOKEN_TTL value') {
+        super(message);
+        this.name = 'InvalidTokenTtlError';
+    }
+}

package/dist/api/auth/token/index.d.ts

@@ -0,0 +1,3 @@
+export { DEFAULT_ACCESS_TOKEN_TTL_SECONDS, parseTtlSeconds, resolveTokenConfig, type TokenConfig, } from './config.js';
+export { InvalidTokenTtlError, MissingJwtSecretError } from './errors.js';
+export { createTokenService, type AccessTokenClaims, type TokenService, } from './token.js';

package/dist/api/auth/token/index.js

@@ -0,0 +1,3 @@
+export { DEFAULT_ACCESS_TOKEN_TTL_SECONDS, parseTtlSeconds, resolveTokenConfig, } from './config.js';
+export { InvalidTokenTtlError, MissingJwtSecretError } from './errors.js';
+export { createTokenService, } from './token.js';

package/dist/api/auth/token/token.d.ts

@@ -0,0 +1,11 @@
+import { type TokenConfig } from './config.js';
+export interface AccessTokenClaims {
+    userId: string;
+    role: string;
+    [key: string]: unknown;
+}
+export interface TokenService {
+    signAccessToken(claims: AccessTokenClaims): string;
+    verifyAccessToken(token: string): Record<string, unknown>;
+}
+export declare function createTokenService(overrides?: Partial<TokenConfig>): TokenService;

package/dist/api/auth/token/token.js

@@ -0,0 +1,31 @@
+import { signHs256Jwt, verifyHs256Jwt } from '../jwt-crypto.js';
+import { resolveTokenConfig } from './config.js';
+import { MissingJwtSecretError } from './errors.js';
+export function createTokenService(overrides = {}) {
+    const config = resolveTokenConfig(overrides);
+    return {
+        signAccessToken(claims) {
+            const secret = config.secret;
+            if (!secret) {
+                throw new MissingJwtSecretError();
+            }
+            const { userId, role, ...extra } = claims;
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const payload = {
+                ...extra,
+                [config.userIdClaim]: userId,
+                [config.roleClaim]: role,
+                iat: nowSeconds,
+                exp: nowSeconds + config.ttlSeconds,
+            };
+            return signHs256Jwt(payload, secret);
+        },
+        verifyAccessToken(token) {
+            const secret = config.secret;
+            if (!secret) {
+                throw new MissingJwtSecretError();
+            }
+            return verifyHs256Jwt(token, secret);
+        },
+    };
+}

package/dist/api/hooks/define.d.ts

@@ -0,0 +1,10 @@
+import type { AfterHook, BeforeHook, ModelHooks } from './types.js';
+export interface TypedModelHooks<TRow, TCreate, TUpdate> {
+    beforeCreate?: BeforeHook | BeforeHook[];
+    afterCreate?: AfterHook | AfterHook[];
+    beforeUpdate?: BeforeHook | BeforeHook[];
+    afterUpdate?: AfterHook | AfterHook[];
+    beforeDelete?: BeforeHook | BeforeHook[];
+    afterDelete?: AfterHook | AfterHook[];
+}
+export declare function defineHooks<TRow, TCreate, TUpdate>(hooks: TypedModelHooks<TRow, TCreate, TUpdate>): ModelHooks;

package/dist/api/hooks/define.js

@@ -0,0 +1,3 @@
+export function defineHooks(hooks) {
+    return hooks;
+}

package/dist/api/hooks/index.d.ts

@@ -0,0 +1,4 @@
+export { defineHooks } from './define.js';
+export type { TypedModelHooks } from './define.js';
+export { cancelledResponse, configureHooks, createHookContext, runAfterHooks, runBeforeHooks, } from './registry.js';
+export type { AfterHook, AfterHookContext, BeforeHook, BeforeHookContext, BeforeHookNext, BeforeHookResult, CreateHookContextInput, HookOperation, HookRegistry, ModelHooks, } from './types.js';

package/dist/api/hooks/index.js

@@ -0,0 +1,2 @@
+export { defineHooks } from './define.js';
+export { cancelledResponse, configureHooks, createHookContext, runAfterHooks, runBeforeHooks, } from './registry.js';

package/dist/api/hooks/registry.d.ts

@@ -0,0 +1,8 @@
+import type { Context } from 'hono';
+import type { AppEnv } from '../types.js';
+import type { AfterHookContext, BeforeHookContext, BeforeHookResult, CreateHookContextInput, HookOperation, HookRegistry } from './types.js';
+export declare function configureHooks(next: HookRegistry): void;
+export declare function createHookContext(init: CreateHookContextInput): BeforeHookContext;
+export declare function cancelledResponse(c: Context<AppEnv>): Response;
+export declare function runBeforeHooks(model: string, operation: HookOperation, ctx: BeforeHookContext): Promise<BeforeHookResult>;
+export declare function runAfterHooks(model: string, operation: HookOperation, ctx: AfterHookContext): Promise<void>;