yepanywhere 0.1.0

package/dist/auth/AuthService.d.ts

@@ -0,0 +1,98 @@
+/**
+ * AuthService manages cookie-based authentication.
+ *
+ * Features:
+ * - Single user account (self-hosted apps typically have one owner)
+ * - Session-based auth with signed cookies
+ * - Password hashing with bcrypt
+ *
+ * State is persisted to a JSON file for durability across server restarts.
+ */
+export interface AuthState {
+    /** Schema version for future migrations */
+    version: number;
+    /** Account credentials (undefined = setup mode) */
+    account?: {
+        /** bcrypt-hashed password */
+        passwordHash: string;
+        /** When account was created */
+        createdAt: string;
+    };
+    /** Active sessions: sessionId -> session data */
+    sessions: Record<string, {
+        createdAt: string;
+        lastActiveAt: string;
+        userAgent?: string;
+    }>;
+}
+export interface AuthServiceOptions {
+    /** Directory to store auth state (defaults to dataDir) */
+    dataDir: string;
+    /** Session TTL in milliseconds (default: 30 days) */
+    sessionTtlMs?: number;
+    /** Cookie signing secret (auto-generated if not provided) */
+    cookieSecret?: string;
+}
+export declare class AuthService {
+    private state;
+    private dataDir;
+    private filePath;
+    private sessionTtlMs;
+    private cookieSecret;
+    private savePromise;
+    private pendingSave;
+    constructor(options: AuthServiceOptions);
+    /**
+     * Initialize the service by loading state from disk.
+     * Creates the data directory if it doesn't exist.
+     * Generates cookie secret if not provided.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Check if an account has been set up.
+     */
+    hasAccount(): boolean;
+    /**
+     * Create the initial account. Only works if no account exists.
+     */
+    createAccount(password: string): Promise<boolean>;
+    /**
+     * Verify a password against the stored hash.
+     */
+    verifyPassword(password: string): Promise<boolean>;
+    /**
+     * Change the account password. Requires current password.
+     */
+    changePassword(currentPassword: string, newPassword: string): Promise<boolean>;
+    /**
+     * Create a new session and return the session ID.
+     */
+    createSession(userAgent?: string): Promise<string>;
+    /**
+     * Validate a session ID and update last active time.
+     * Returns true if valid, false if expired or not found.
+     */
+    validateSession(sessionId: string): Promise<boolean>;
+    /**
+     * Invalidate a session (logout).
+     */
+    invalidateSession(sessionId: string): Promise<void>;
+    /**
+     * Invalidate all sessions (logout everywhere).
+     */
+    invalidateAllSessions(): Promise<void>;
+    /**
+     * Get the cookie secret for signing.
+     */
+    getCookieSecret(): string;
+    /**
+     * Clean up expired sessions.
+     */
+    private cleanupExpiredSessions;
+    /**
+     * Save state to disk with debouncing.
+     */
+    private save;
+    private doSave;
+}
+//# sourceMappingURL=AuthService.d.ts.map

package/dist/auth/AuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.d.ts","sourceRoot":"","sources":["../../src/auth/AuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,MAAM,WAAW,SAAS;IACxB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE;QACR,6BAA6B;QAC7B,YAAY,EAAE,MAAM,CAAC;QACrB,+BAA+B;QAC/B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CACd,MAAM,EACN;QACE,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CACF,CAAC;CACH;AAID,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,WAAW,CAAS;gBAEhB,OAAO,EAAE,kBAAkB;IAQvC;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAqCjC;;OAEG;IACH,UAAU,IAAI,OAAO;IAIrB;;OAEG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcvD;;OAEG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOxD;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAqBnB;;OAEG;IACG,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAcxD;;;OAGG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB1D;;OAEG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzD;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;OAEG;IACH,eAAe,IAAI,MAAM;IAIzB;;OAEG;YACW,sBAAsB;IAiBpC;;OAEG;YACW,IAAI;YAgBJ,MAAM;CASrB"}

package/dist/auth/AuthService.js

@@ -0,0 +1,217 @@
+/**
+ * AuthService manages cookie-based authentication.
+ *
+ * Features:
+ * - Single user account (self-hosted apps typically have one owner)
+ * - Session-based auth with signed cookies
+ * - Password hashing with bcrypt
+ *
+ * State is persisted to a JSON file for durability across server restarts.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import bcrypt from "bcrypt";
+const BCRYPT_ROUNDS = 12;
+const SESSION_ID_BYTES = 32;
+const CURRENT_VERSION = 1;
+export class AuthService {
+    state;
+    dataDir;
+    filePath;
+    sessionTtlMs;
+    cookieSecret;
+    savePromise = null;
+    pendingSave = false;
+    constructor(options) {
+        this.dataDir = options.dataDir;
+        this.filePath = path.join(this.dataDir, "auth.json");
+        this.sessionTtlMs = options.sessionTtlMs ?? 30 * 24 * 60 * 60 * 1000; // 30 days
+        this.cookieSecret = options.cookieSecret ?? "";
+        this.state = { version: CURRENT_VERSION, sessions: {} };
+    }
+    /**
+     * Initialize the service by loading state from disk.
+     * Creates the data directory if it doesn't exist.
+     * Generates cookie secret if not provided.
+     */
+    async initialize() {
+        try {
+            await fs.mkdir(this.dataDir, { recursive: true });
+            const content = await fs.readFile(this.filePath, "utf-8");
+            const parsed = JSON.parse(content);
+            if (parsed.version === CURRENT_VERSION) {
+                this.state = parsed;
+            }
+            else {
+                // Future: handle migrations
+                this.state = {
+                    version: CURRENT_VERSION,
+                    account: parsed.account,
+                    sessions: parsed.sessions ?? {},
+                };
+                await this.save();
+            }
+        }
+        catch (error) {
+            if (error.code !== "ENOENT") {
+                console.warn("[AuthService] Failed to load state, starting fresh:", error);
+            }
+            this.state = { version: CURRENT_VERSION, sessions: {} };
+        }
+        // Generate cookie secret if not provided
+        if (!this.cookieSecret) {
+            this.cookieSecret = crypto.randomBytes(32).toString("hex");
+        }
+        // Clean up expired sessions on startup
+        await this.cleanupExpiredSessions();
+    }
+    /**
+     * Check if an account has been set up.
+     */
+    hasAccount() {
+        return !!this.state.account;
+    }
+    /**
+     * Create the initial account. Only works if no account exists.
+     */
+    async createAccount(password) {
+        if (this.state.account) {
+            return false; // Account already exists
+        }
+        const passwordHash = await bcrypt.hash(password, BCRYPT_ROUNDS);
+        this.state.account = {
+            passwordHash,
+            createdAt: new Date().toISOString(),
+        };
+        await this.save();
+        return true;
+    }
+    /**
+     * Verify a password against the stored hash.
+     */
+    async verifyPassword(password) {
+        if (!this.state.account) {
+            return false;
+        }
+        return bcrypt.compare(password, this.state.account.passwordHash);
+    }
+    /**
+     * Change the account password. Requires current password.
+     */
+    async changePassword(currentPassword, newPassword) {
+        if (!this.state.account) {
+            return false;
+        }
+        const valid = await bcrypt.compare(currentPassword, this.state.account.passwordHash);
+        if (!valid) {
+            return false;
+        }
+        this.state.account.passwordHash = await bcrypt.hash(newPassword, BCRYPT_ROUNDS);
+        await this.save();
+        return true;
+    }
+    /**
+     * Create a new session and return the session ID.
+     */
+    async createSession(userAgent) {
+        const sessionId = crypto.randomBytes(SESSION_ID_BYTES).toString("hex");
+        const now = new Date().toISOString();
+        this.state.sessions[sessionId] = {
+            createdAt: now,
+            lastActiveAt: now,
+            userAgent,
+        };
+        await this.save();
+        return sessionId;
+    }
+    /**
+     * Validate a session ID and update last active time.
+     * Returns true if valid, false if expired or not found.
+     */
+    async validateSession(sessionId) {
+        const session = this.state.sessions[sessionId];
+        if (!session) {
+            return false;
+        }
+        const createdAt = new Date(session.createdAt).getTime();
+        const now = Date.now();
+        if (now - createdAt > this.sessionTtlMs) {
+            // Session expired
+            delete this.state.sessions[sessionId];
+            await this.save();
+            return false;
+        }
+        // Update last active time (debounced via save)
+        session.lastActiveAt = new Date().toISOString();
+        // Don't await save here to avoid blocking every request
+        void this.save();
+        return true;
+    }
+    /**
+     * Invalidate a session (logout).
+     */
+    async invalidateSession(sessionId) {
+        if (this.state.sessions[sessionId]) {
+            delete this.state.sessions[sessionId];
+            await this.save();
+        }
+    }
+    /**
+     * Invalidate all sessions (logout everywhere).
+     */
+    async invalidateAllSessions() {
+        this.state.sessions = {};
+        await this.save();
+    }
+    /**
+     * Get the cookie secret for signing.
+     */
+    getCookieSecret() {
+        return this.cookieSecret;
+    }
+    /**
+     * Clean up expired sessions.
+     */
+    async cleanupExpiredSessions() {
+        const now = Date.now();
+        let changed = false;
+        for (const [sessionId, session] of Object.entries(this.state.sessions)) {
+            const createdAt = new Date(session.createdAt).getTime();
+            if (now - createdAt > this.sessionTtlMs) {
+                delete this.state.sessions[sessionId];
+                changed = true;
+            }
+        }
+        if (changed) {
+            await this.save();
+        }
+    }
+    /**
+     * Save state to disk with debouncing.
+     */
+    async save() {
+        if (this.savePromise) {
+            this.pendingSave = true;
+            return;
+        }
+        this.savePromise = this.doSave();
+        await this.savePromise;
+        this.savePromise = null;
+        if (this.pendingSave) {
+            this.pendingSave = false;
+            await this.save();
+        }
+    }
+    async doSave() {
+        try {
+            const content = JSON.stringify(this.state, null, 2);
+            await fs.writeFile(this.filePath, content, "utf-8");
+        }
+        catch (error) {
+            console.error("[AuthService] Failed to save state:", error);
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=AuthService.js.map

package/dist/auth/AuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../src/auth/AuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAuB5B,MAAM,eAAe,GAAG,CAAC,CAAC;AAW1B,MAAM,OAAO,WAAW;IACd,KAAK,CAAY;IACjB,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,YAAY,CAAS;IACrB,WAAW,GAAyB,IAAI,CAAC;IACzC,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;QAChF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAElD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAc,CAAC;YAEhD,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,4BAA4B;gBAC5B,IAAI,CAAC,KAAK,GAAG;oBACX,OAAO,EAAE,eAAe;oBACxB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;iBAChC,CAAC;gBACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,IAAI,CACV,qDAAqD,EACrD,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1D,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,uCAAuC;QACvC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,yBAAyB;QACzC,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG;YACnB,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,eAAuB,EACvB,WAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,eAAe,EACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAChC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CACjD,WAAW,EACX,aAAa,CACd,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,SAAkB;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG;YAC/B,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;YACjB,SAAS;SACV,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACxC,kBAAkB;YAClB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,+CAA+C;QAC/C,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,wDAAwD;QACxD,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAEjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACxD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,WAAW,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YACzB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,3 @@
+export { AuthService, type AuthServiceOptions, type AuthState, } from "./AuthService.js";
+export { createAuthRoutes, SESSION_COOKIE_NAME, type AuthRoutesDeps, } from "./routes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+export { AuthService, } from "./AuthService.js";
+export { createAuthRoutes, SESSION_COOKIE_NAME, } from "./routes.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,GAGZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,aAAa,CAAC"}

package/dist/auth/routes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Authentication API routes
+ */
+import { Hono } from "hono";
+import type { AuthService } from "./AuthService.js";
+export declare const SESSION_COOKIE_NAME = "yep-anywhere-session";
+export interface AuthRoutesDeps {
+    authService: AuthService;
+    /** Whether auth is enabled. If false, status returns enabled: false */
+    authEnabled?: boolean;
+}
+export declare function createAuthRoutes(deps: AuthRoutesDeps): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAeD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAuL3D"}

package/dist/auth/routes.js

@@ -0,0 +1,149 @@
+/**
+ * Authentication API routes
+ */
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+export const SESSION_COOKIE_NAME = "yep-anywhere-session";
+export function createAuthRoutes(deps) {
+    const app = new Hono();
+    const { authService, authEnabled = true } = deps;
+    /**
+     * GET /api/auth/status
+     * Check authentication status
+     */
+    app.get("/status", async (c) => {
+        // If auth is disabled, return early with enabled: false
+        if (!authEnabled) {
+            return c.json({
+                enabled: false,
+                authenticated: true,
+                setupRequired: false,
+            });
+        }
+        const sessionId = getCookie(c, SESSION_COOKIE_NAME);
+        const hasAccount = authService.hasAccount();
+        if (!hasAccount) {
+            return c.json({
+                enabled: true,
+                authenticated: false,
+                setupRequired: true,
+            });
+        }
+        if (!sessionId) {
+            return c.json({
+                enabled: true,
+                authenticated: false,
+                setupRequired: false,
+            });
+        }
+        const valid = await authService.validateSession(sessionId);
+        return c.json({
+            enabled: true,
+            authenticated: valid,
+            setupRequired: false,
+        });
+    });
+    /**
+     * POST /api/auth/setup
+     * Create the initial account (only works when no account exists)
+     */
+    app.post("/setup", async (c) => {
+        if (authService.hasAccount()) {
+            return c.json({ error: "Account already exists" }, 400);
+        }
+        const body = await c.req.json();
+        if (!body.password || typeof body.password !== "string") {
+            return c.json({ error: "Password is required" }, 400);
+        }
+        if (body.password.length < 8) {
+            return c.json({ error: "Password must be at least 8 characters" }, 400);
+        }
+        const success = await authService.createAccount(body.password);
+        if (!success) {
+            return c.json({ error: "Failed to create account" }, 500);
+        }
+        // Auto-login after setup
+        const userAgent = c.req.header("User-Agent");
+        const sessionId = await authService.createSession(userAgent);
+        setCookie(c, SESSION_COOKIE_NAME, sessionId, {
+            httpOnly: true,
+            secure: true,
+            sameSite: "Lax",
+            path: "/",
+            maxAge: 30 * 24 * 60 * 60, // 30 days
+        });
+        return c.json({ success: true });
+    });
+    /**
+     * POST /api/auth/login
+     * Login with password
+     */
+    app.post("/login", async (c) => {
+        if (!authService.hasAccount()) {
+            c.header("X-Setup-Required", "true");
+            return c.json({ error: "No account configured", setupRequired: true }, 401);
+        }
+        const body = await c.req.json();
+        if (!body.password || typeof body.password !== "string") {
+            return c.json({ error: "Password is required" }, 400);
+        }
+        const valid = await authService.verifyPassword(body.password);
+        if (!valid) {
+            return c.json({ error: "Invalid password" }, 401);
+        }
+        const userAgent = c.req.header("User-Agent");
+        const sessionId = await authService.createSession(userAgent);
+        setCookie(c, SESSION_COOKIE_NAME, sessionId, {
+            httpOnly: true,
+            secure: true,
+            sameSite: "Lax",
+            path: "/",
+            maxAge: 30 * 24 * 60 * 60, // 30 days
+        });
+        return c.json({ success: true });
+    });
+    /**
+     * POST /api/auth/logout
+     * Logout (invalidate session)
+     */
+    app.post("/logout", async (c) => {
+        const sessionId = getCookie(c, SESSION_COOKIE_NAME);
+        if (sessionId) {
+            await authService.invalidateSession(sessionId);
+        }
+        deleteCookie(c, SESSION_COOKIE_NAME, {
+            path: "/",
+        });
+        return c.json({ success: true });
+    });
+    /**
+     * POST /api/auth/change-password
+     * Change password (requires current password)
+     */
+    app.post("/change-password", async (c) => {
+        // Require authenticated session
+        const sessionId = getCookie(c, SESSION_COOKIE_NAME);
+        if (!sessionId || !(await authService.validateSession(sessionId))) {
+            return c.json({ error: "Not authenticated" }, 401);
+        }
+        const body = await c.req.json();
+        if (!body.currentPassword || typeof body.currentPassword !== "string") {
+            return c.json({ error: "Current password is required" }, 400);
+        }
+        if (!body.newPassword || typeof body.newPassword !== "string") {
+            return c.json({ error: "New password is required" }, 400);
+        }
+        if (body.newPassword.length < 8) {
+            return c.json({ error: "New password must be at least 8 characters" }, 400);
+        }
+        const success = await authService.changePassword(body.currentPassword, body.newPassword);
+        if (!success) {
+            return c.json({ error: "Current password is incorrect" }, 401);
+        }
+        // Optionally invalidate all other sessions
+        // await authService.invalidateAllSessions();
+        return c.json({ success: true });
+    });
+    return app;
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/auth/routes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAqB1D,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAEjD;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,wDAAwD;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,KAAK;gBACd,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC;QAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,KAAK;YACpB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAa,CAAC;QAE3C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,yBAAyB;QACzB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE7D,SAAS,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE;YAC3C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;SACtC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,uBAAuB,EAAE,aAAa,EAAE,IAAI,EAAE,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAa,CAAC;QAE3C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE7D,SAAS,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE;YAC3C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU;SACtC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAEpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC;QAED,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE;YACnC,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,gCAAgC;QAChC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAsB,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,4CAA4C,EAAE,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,cAAc,CAC9C,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,2CAA2C;QAC3C,6CAA6C;QAE7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for yepanywhere
+ *
+ * Usage:
+ *   yepanywhere                    # Start server with defaults
+ *   yepanywhere --help            # Show help
+ *   yepanywhere --version         # Show version
+ *
+ * Environment variables:
+ *   PORT                          # Server port (default: 3400)
+ *   YEP_ANYWHERE_DATA_DIR         # Data directory override
+ *   YEP_ANYWHERE_PROFILE          # Profile name (creates ~/.yep-anywhere-{profile}/)
+ *   AUTH_ENABLED                  # Enable cookie auth (default: false)
+ *   LOG_LEVEL                     # Log level: fatal, error, warn, info, debug, trace
+ *   ... (see CLAUDE.md for full list)
+ */
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;GAeG"}