@aooth/user 0.2.0 → 0.2.2

package/dist/atscript-db.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_federated_identity_store = require("./federated-identity-store-D-LvRXdx.cjs");
+const require_federated_identity_store = require("./federated-identity-store-Cbstwl4-.cjs");
 let node_crypto = require("node:crypto");
-//#region src/atscript-db/federated-identity-store.ts
+// src/atscript-db/federated-identity-store.ts
 function isConflict$1(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -71,8 +71,7 @@ var FederatedIdentityStoreAtscriptDb = class extends require_federated_identity_
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
 };
-//#endregion
-//#region src/atscript-db/index.ts
+// src/atscript-db/index.ts
 function isConflict(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -161,6 +160,5 @@ var UsersStoreAtscriptDb = class extends require_federated_identity_store.UserSt
 		throw new require_federated_identity_store.UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
 exports.FederatedIdentityStoreAtscriptDb = FederatedIdentityStoreAtscriptDb;
 exports.UsersStoreAtscriptDb = UsersStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -1,5 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.cjs";
-//#region src/atscript-db/federated-identity-store.d.ts
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-D10-BT9l.cjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -39,7 +38,7 @@ interface FederatedIdentityStoreAtscriptDbOptions {
  * is a plain indexed column, so `listForUser` / `deleteAllForUser` scan it
  * natively.
  */
-declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   private readonly table;
   private readonly clock;
   constructor(opts: FederatedIdentityStoreAtscriptDbOptions);
@@ -50,15 +49,13 @@ declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — `UserCredentials` plus the consumer's custom user
  * fields. The `.as` model shipped at `@aooth/user/atscript-db/model.as`
  * (`AoothUserCredentials`) matches by construction; consumers extend it with
  * their own `.as` interface to add custom columns.
  */
-type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
+export type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
@@ -67,7 +64,7 @@ type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials &
  *
  * Mirrors `AuthCredentialTable` from `@aooth/auth/atscript-db`.
  */
-interface AuthUserTable<TUserCustom extends object = object> {
+export interface AuthUserTable<TUserCustom extends object = object> {
   count(query: {
     filter: Record<string, unknown>;
   }): Promise<number>;
@@ -105,7 +102,7 @@ interface UsersStoreAtscriptDbOptions<TUserCustom extends object> {
  * `@meta.id` PK (`id`) and the unique `username` index, plus any
  * annotation-resolved `handleFields`; writes key on `id`.
  */
-declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
+export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
   protected table: AuthUserTable<TUserCustom>;
   /** Secondary handle fields tried (in order) by `findByHandle` after `username`. */
   protected readonly handleFields: string[];
@@ -129,5 +126,4 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
    */
   withCas(id: string, mutator: (current: UserCredentials & TUserCustom) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-export { AuthUserTable, FederatedIdentityStoreAtscriptDb, type FederatedIdentityTable, UserCredentialsRow, UsersStoreAtscriptDb };
+export type { FederatedIdentityTable };

package/dist/atscript-db.d.mts

@@ -1,5 +1,4 @@
-import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-B_jEkl-a.mjs";
-//#region src/atscript-db/federated-identity-store.d.ts
+import { D as UserCredentials, i as NewFederatedIdentity, k as UserStoreUpdate, n as FederatedIdentityStore, o as UserStore, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity } from "./federated-identity-store-D10-BT9l.mjs";
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls — kept loose so `@aooth/user` doesn't pull `@atscript/db` types
@@ -39,7 +38,7 @@ interface FederatedIdentityStoreAtscriptDbOptions {
  * is a plain indexed column, so `listForUser` / `deleteAllForUser` scan it
  * natively.
  */
-declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   private readonly table;
   private readonly clock;
   constructor(opts: FederatedIdentityStoreAtscriptDbOptions);
@@ -50,15 +49,13 @@ declare class FederatedIdentityStoreAtscriptDb extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — `UserCredentials` plus the consumer's custom user
  * fields. The `.as` model shipped at `@aooth/user/atscript-db/model.as`
  * (`AoothUserCredentials`) matches by construction; consumers extend it with
  * their own `.as` interface to add custom columns.
  */
-type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
+export type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials & TUserCustom;
 /**
  * Structural surface of `AtscriptDbTable` covering exactly the methods this
  * adapter calls. Kept loose to avoid pulling `@atscript/db` types into the
@@ -67,7 +64,7 @@ type UserCredentialsRow<TUserCustom extends object = object> = UserCredentials &
  *
  * Mirrors `AuthCredentialTable` from `@aooth/auth/atscript-db`.
  */
-interface AuthUserTable<TUserCustom extends object = object> {
+export interface AuthUserTable<TUserCustom extends object = object> {
   count(query: {
     filter: Record<string, unknown>;
   }): Promise<number>;
@@ -105,7 +102,7 @@ interface UsersStoreAtscriptDbOptions<TUserCustom extends object> {
  * `@meta.id` PK (`id`) and the unique `username` index, plus any
  * annotation-resolved `handleFields`; writes key on `id`.
  */
-declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
+export declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends UserStore<TUserCustom> {
   protected table: AuthUserTable<TUserCustom>;
   /** Secondary handle fields tried (in order) by `findByHandle` after `username`. */
   protected readonly handleFields: string[];
@@ -129,5 +126,4 @@ declare class UsersStoreAtscriptDb<TUserCustom extends object = object> extends
    */
   withCas(id: string, mutator: (current: UserCredentials & TUserCustom) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-export { AuthUserTable, FederatedIdentityStoreAtscriptDb, type FederatedIdentityTable, UserCredentialsRow, UsersStoreAtscriptDb };
+export type { FederatedIdentityTable };

package/dist/atscript-db.mjs

@@ -1,6 +1,6 @@
-import { c as setAtPath, l as UserStore, n as pickDefinedProfile, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-CRycYlMj.mjs";
+import { c as setAtPath, l as UserStore, n as pickDefinedProfile, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-BZRvw9Pz.mjs";
 import { randomUUID } from "node:crypto";
-//#region src/atscript-db/federated-identity-store.ts
+// src/atscript-db/federated-identity-store.ts
 function isConflict$1(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -70,8 +70,7 @@ var FederatedIdentityStoreAtscriptDb = class extends FederatedIdentityStore {
 		return (await this.table.deleteMany({ userId })).deletedCount;
 	}
 };
-//#endregion
-//#region src/atscript-db/index.ts
+// src/atscript-db/index.ts
 function isConflict(err) {
 	return typeof err === "object" && err !== null && err.code === "CONFLICT";
 }
@@ -160,5 +159,4 @@ var UsersStoreAtscriptDb = class extends UserStore {
 		throw new UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
 export { FederatedIdentityStoreAtscriptDb, UsersStoreAtscriptDb };

package/dist/{federated-identity-store-CRycYlMj.mjs → federated-identity-store-BZRvw9Pz.mjs}

@@ -1,5 +1,5 @@
 import "node:crypto";
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	NOT_FOUND: "User not found",
 	ALREADY_EXISTS: "User already exists",
@@ -24,8 +24,7 @@ var UserAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/store/user-store.ts
+// src/store/user-store.ts
 /**
 * Storage seam for user credentials, keyed by the stable surrogate **`id`**
 * (the token subject). Reads come in three flavours:
@@ -40,8 +39,7 @@ var UserAuthError = class extends Error {
 * Writes (`update`/`delete`/`withCas`) all key on the surrogate `id`.
 */
 var UserStore = class {};
-//#endregion
-//#region src/utils.ts
+// src/utils.ts
 function maskEmail(email) {
 	if (!email) return "";
 	const at = email.indexOf("@");
@@ -101,8 +99,7 @@ function incrementAtPath(obj, path, amount) {
 	const existing = current[leaf];
 	current[leaf] = (typeof existing === "number" ? existing : 0) + amount;
 }
-//#endregion
-//#region src/store/federated-identity-store.ts
+// src/store/federated-identity-store.ts
 /**
 * Copy only the DEFINED display fields — so a `touchLogin` / `link` with a
 * partial profile (e.g. Apple omitting the email on a repeat login) never
@@ -126,5 +123,4 @@ function pickDefinedProfile(src) {
 * keeps the federated-login core (`@aooth/idp`, phase 2) storage-agnostic.
 */
 var FederatedIdentityStore = class {};
-//#endregion
 export { maskEmail as a, setAtPath as c, incrementAtPath as i, UserStore as l, pickDefinedProfile as n, maskMfaValue as o, deepMerge as r, maskPhone as s, FederatedIdentityStore as t, UserAuthError as u };

package/dist/{federated-identity-store-D-LvRXdx.cjs → federated-identity-store-Cbstwl4-.cjs}

@@ -1,5 +1,5 @@
 require("node:crypto");
-//#region src/errors.ts
+// src/errors.ts
 const defaultMessages = {
 	NOT_FOUND: "User not found",
 	ALREADY_EXISTS: "User already exists",
@@ -24,8 +24,7 @@ var UserAuthError = class extends Error {
 		this.details = details;
 	}
 };
-//#endregion
-//#region src/store/user-store.ts
+// src/store/user-store.ts
 /**
 * Storage seam for user credentials, keyed by the stable surrogate **`id`**
 * (the token subject). Reads come in three flavours:
@@ -40,8 +39,7 @@ var UserAuthError = class extends Error {
 * Writes (`update`/`delete`/`withCas`) all key on the surrogate `id`.
 */
 var UserStore = class {};
-//#endregion
-//#region src/utils.ts
+// src/utils.ts
 function maskEmail(email) {
 	if (!email) return "";
 	const at = email.indexOf("@");
@@ -101,8 +99,7 @@ function incrementAtPath(obj, path, amount) {
 	const existing = current[leaf];
 	current[leaf] = (typeof existing === "number" ? existing : 0) + amount;
 }
-//#endregion
-//#region src/store/federated-identity-store.ts
+// src/store/federated-identity-store.ts
 /**
 * Copy only the DEFINED display fields — so a `touchLogin` / `link` with a
 * partial profile (e.g. Apple omitting the email on a repeat login) never
@@ -126,7 +123,6 @@ function pickDefinedProfile(src) {
 * keeps the federated-login core (`@aooth/idp`, phase 2) storage-agnostic.
 */
 var FederatedIdentityStore = class {};
-//#endregion
 Object.defineProperty(exports, "FederatedIdentityStore", {
 	enumerable: true,
 	get: function() {

package/dist/{federated-identity-store-B_jEkl-a.d.cts → federated-identity-store-D10-BT9l.d.cts}

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 interface UserCredentials {
   id: string;
   username: string;
@@ -243,8 +242,6 @@ interface TotpConfig {
   /** Injectable clock for testability */
   clock?: () => number;
 }
-//#endregion
-//#region src/store/user-store.d.ts
 interface WithCasOptions {
   /**
    * Total attempts (1 initial + retries). Default `2` = one retry. Each
@@ -312,8 +309,6 @@ declare abstract class UserStore<T extends object = object> {
    */
   abstract withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store.d.ts
 /**
  * Display fields snapshotted from an IdP profile onto a federated-identity row.
  * Refreshed on each login via {@link FederatedIdentityStore.touchLogin}; never
@@ -404,5 +399,4 @@ declare abstract class FederatedIdentityStore {
    */
   abstract deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
 export { TotpConfig as C, UserCredentials as D, UserAuthErrorType as E, UserServiceConfig as O, PolicyCheckResult as S, TrustedDeviceRecord as T, PasswordData as _, pickDefinedProfile as a, PasswordPolicyEvalFn as b, AccountData as c, LockoutConfig as d, LoginResult as f, PasswordConfig as g, MfaMethodInfo as h, NewFederatedIdentity as i, UserStoreUpdate as k, DeepPartial as l, MfaMethod as m, FederatedIdentityStore as n, UserStore as o, MfaData as p, FederatedProfileSnapshot as r, WithCasOptions as s, FederatedIdentity as t, LockStatus as u, PasswordPolicyContext as v, TransferablePolicy as w, PasswordPolicyInstance as x, PasswordPolicyDef as y };

package/dist/{federated-identity-store-B_jEkl-a.d.mts → federated-identity-store-D10-BT9l.d.mts}

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 interface UserCredentials {
   id: string;
   username: string;
@@ -243,8 +242,6 @@ interface TotpConfig {
   /** Injectable clock for testability */
   clock?: () => number;
 }
-//#endregion
-//#region src/store/user-store.d.ts
 interface WithCasOptions {
   /**
    * Total attempts (1 initial + retries). Default `2` = one retry. Each
@@ -312,8 +309,6 @@ declare abstract class UserStore<T extends object = object> {
    */
   abstract withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store.d.ts
 /**
  * Display fields snapshotted from an IdP profile onto a federated-identity row.
  * Refreshed on each login via {@link FederatedIdentityStore.touchLogin}; never
@@ -404,5 +399,4 @@ declare abstract class FederatedIdentityStore {
    */
   abstract deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
 export { TotpConfig as C, UserCredentials as D, UserAuthErrorType as E, UserServiceConfig as O, PolicyCheckResult as S, TrustedDeviceRecord as T, PasswordData as _, pickDefinedProfile as a, PasswordPolicyEvalFn as b, AccountData as c, LockoutConfig as d, LoginResult as f, PasswordConfig as g, MfaMethodInfo as h, NewFederatedIdentity as i, UserStoreUpdate as k, DeepPartial as l, MfaMethod as m, FederatedIdentityStore as n, UserStore as o, MfaData as p, FederatedProfileSnapshot as r, WithCasOptions as s, FederatedIdentity as t, LockStatus as u, PasswordPolicyContext as v, TransferablePolicy as w, PasswordPolicyInstance as x, PasswordPolicyDef as y };

package/dist/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_federated_identity_store = require("./federated-identity-store-D-LvRXdx.cjs");
+const require_federated_identity_store = require("./federated-identity-store-Cbstwl4-.cjs");
 let node_crypto = require("node:crypto");
-//#region src/base-x/base32.ts
+// src/base-x/base32.ts
 /**
 * Partially copied from "thirty-two" library, all credits to Chris Umbel.
 *
@@ -72,8 +72,7 @@ function decode(input) {
 	}
 	return output.subarray(0, index);
 }
-//#endregion
-//#region src/mfa/totp.ts
+// src/mfa/totp.ts
 function generateTotpSecret(bytes = 20) {
 	return encode((0, node_crypto.randomBytes)(bytes)).toString().replace(/=+$/, "").toUpperCase();
 }
@@ -127,8 +126,7 @@ function hotpCode(key, counter, digits) {
 	const offset = hmacResult[hmacResult.length - 1] & 15;
 	return (((hmacResult[offset] & 127) << 24 | (hmacResult[offset + 1] & 255) << 16 | (hmacResult[offset + 2] & 255) << 8 | hmacResult[offset + 3] & 255) % 10 ** digits).toString().padStart(digits, "0");
 }
-//#endregion
-//#region src/password/hasher.ts
+// src/password/hasher.ts
 const DEFAULTS = {
 	N: 16384,
 	r: 8,
@@ -138,11 +136,11 @@ const DEFAULTS = {
 };
 const PREFIX = "$scrypt$";
 /** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
-const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+const DEFAULT_MAXMEM = 33554432;
 /** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
-const MAX_MAXMEM = 1024 * 1024 * 1024;
+const MAX_MAXMEM = 1073741824;
 function scryptAsync(password, salt, keyLength, options) {
-	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1048576));
 	return new Promise((resolve, reject) => {
 		(0, node_crypto.scrypt)(password, salt, keyLength, {
 			...options,
@@ -212,7 +210,7 @@ var PasswordHasher = class {
 		const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		const digits = "0123456789";
 		const special = "!@#$%^&*()-_=+";
-		const all = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+";
+		const all = lower + upper + digits + special;
 		const bytes = (0, node_crypto.randomBytes)(minLen);
 		const result = Array.from({ length: minLen });
 		result[0] = lower[bytes[0] % 26];
@@ -228,8 +226,7 @@ var PasswordHasher = class {
 		return result.join("");
 	}
 };
-//#endregion
-//#region src/password/policy.ts
+// src/password/policy.ts
 function normalizePolicies(policies) {
 	return (policies || []).map((p) => p instanceof PasswordPolicy ? p : new PasswordPolicy(p));
 }
@@ -283,8 +280,7 @@ var PasswordPolicy = class {
 		return this.serialized !== void 0;
 	}
 };
-//#endregion
-//#region src/user-service.ts
+// src/user-service.ts
 function resolveConfig(config) {
 	return {
 		password: {
@@ -1108,8 +1104,7 @@ function observeWrites(store, hooks) {
 		return fn;
 	} });
 }
-//#endregion
-//#region src/store/memory.ts
+// src/store/memory.ts
 var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 	/** Keyed by the stable surrogate `id` (the token subject). */
 	store = /* @__PURE__ */ new Map();
@@ -1223,8 +1218,7 @@ var UserStoreMemory = class extends require_federated_identity_store.UserStore {
 		throw new require_federated_identity_store.UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
-//#region src/store/federated-identity-store-memory.ts
+// src/store/federated-identity-store-memory.ts
 /**
 * In-memory {@link FederatedIdentityStore} — the offline-testable reference
 * impl (RFC IDP.md §9). Keyed by the composite `(provider, subject)`;
@@ -1282,8 +1276,7 @@ var FederatedIdentityStoreMemory = class extends require_federated_identity_stor
 function compositeKey(provider, subject) {
 	return `${provider}${subject}`;
 }
-//#endregion
-//#region src/password/policies.ts
+// src/password/policies.ts
 const ppHasMinLength = (min = 8) => definePasswordPolicy({
 	rule: (v, min) => v.length >= min,
 	args: [min],
@@ -1320,8 +1313,7 @@ const ppMaxRepeatedChars = (maxRepeated = 2) => definePasswordPolicy({
 	description: `No more than ${maxRepeated} consecutive repeated characters`,
 	errorMessage: `Password must not have more than ${maxRepeated} consecutive repeated characters`
 });
-//#endregion
-//#region src/mfa/codes.ts
+// src/mfa/codes.ts
 /**
 * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
 *
@@ -1346,7 +1338,6 @@ function verifyMfaCode(submitted, expectedHash) {
 	if (a.length !== b.length) return false;
 	return (0, node_crypto.timingSafeEqual)(a, b);
 }
-//#endregion
 exports.FederatedIdentityStore = require_federated_identity_store.FederatedIdentityStore;
 exports.FederatedIdentityStoreMemory = FederatedIdentityStoreMemory;
 exports.PasswordHasher = PasswordHasher;

package/dist/index.d.cts

@@ -1,14 +1,11 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.cjs";
-//#region src/errors.d.ts
-declare class UserAuthError extends Error {
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-D10-BT9l.cjs";
+export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "UserAuthError";
   constructor(type: UserAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/password/hasher.d.ts
-declare class PasswordHasher {
+export declare class PasswordHasher {
   private readonly pepper;
   private readonly N;
   private readonly r;
@@ -19,9 +16,7 @@ declare class PasswordHasher {
   verify(password: string, encoded: string): Promise<boolean>;
   generatePassword(length?: number): string;
 }
-//#endregion
-//#region src/password/policy.d.ts
-declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
+export declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
 /**
  * Helper that builds a `PasswordPolicyDef` from a real backend function plus
  * its bound positional arguments. The function runs directly on the server
@@ -43,13 +38,13 @@ declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolic
  * `undefined` and `transferable` is false; frontend pre-validation skips it
  * and only the server check enforces the rule.
  */
-declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
+export declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
   rule: (v: string, ...args: A) => boolean | Promise<boolean>;
   args?: A;
   description?: string;
   errorMessage?: string;
 }): PasswordPolicyDef;
-declare class PasswordPolicy implements PasswordPolicyInstance {
+export declare class PasswordPolicy implements PasswordPolicyInstance {
   readonly rule: PasswordPolicyEvalFn;
   readonly serialized?: string;
   readonly description: string;
@@ -58,8 +53,6 @@ declare class PasswordPolicy implements PasswordPolicyInstance {
   evaluate(password: string, context?: PasswordPolicyContext): boolean | Promise<boolean>;
   get transferable(): boolean;
 }
-//#endregion
-//#region src/user-service.d.ts
 interface ResolvedConfig {
   password: Required<Omit<PasswordConfig, "policies">> & {
     policies: PasswordPolicy[];
@@ -71,7 +64,7 @@ interface ResolvedConfig {
   };
   emailField?: string;
 }
-declare const SEEN_DEVICES_DEFAULT_CAP = 5;
+export declare const SEEN_DEVICES_DEFAULT_CAP = 5;
 /**
  * Orchestrates user credentials over a pluggable {@link UserStore}.
  *
@@ -81,7 +74,7 @@ declare const SEEN_DEVICES_DEFAULT_CAP = 5;
  * handle-driven entry points) take a `username`/`email` login handle, resolved
  * via `UserStore.findByHandle`.
  */
-declare class UserService<T extends object = object> {
+export declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
@@ -386,9 +379,7 @@ declare class UserService<T extends object = object> {
    */
   private incrementAndMaybeLock;
 }
-//#endregion
-//#region src/store/memory.d.ts
-declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
+export declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   /** Keyed by the stable surrogate `id` (the token subject). */
   private store;
   /**
@@ -427,8 +418,6 @@ declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   delete(id: string): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store-memory.d.ts
 interface FederatedIdentityStoreMemoryOptions {
   /** Injectable clock for deterministic `linkedAt` / `lastLoginAt`. Defaults to `Date.now`. */
   clock?: () => number;
@@ -439,7 +428,7 @@ interface FederatedIdentityStoreMemoryOptions {
  * `structuredClone` on every read/write isolates callers from later mutation
  * (mirrors `UserStoreMemory`).
  */
-declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   /** Keyed by `compositeKey(provider, subject)`. */
   private store;
   private clock;
@@ -451,28 +440,22 @@ declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/password/policies.d.ts
-declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
-declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
-declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
-declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
-//#endregion
-//#region src/mfa/totp.d.ts
-declare function generateTotpSecret(bytes?: number): string;
-declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
-declare function generateTotpCode(secret: string, config?: TotpConfig): string;
+export declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
+export declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
+export declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
+export declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
+export declare function generateTotpSecret(bytes?: number): string;
+export declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
+export declare function generateTotpCode(secret: string, config?: TotpConfig): string;
 /**
  * Returns the matched HOTP counter when `code` is valid within the verification
  * window, otherwise `null`. Returning the counter (not a bool) lets the caller
  * persist `lastUsedWindow` and reject same-window replays (RFC 6238 §5.2 SHOULD).
  */
-declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
-declare function generateMfaCode(length?: number): string;
-//#endregion
-//#region src/mfa/codes.d.ts
+export declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
+export declare function generateMfaCode(length?: number): string;
 /**
  * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
  *
@@ -480,7 +463,7 @@ declare function generateMfaCode(length?: number): string;
  * Use {@link verifyMfaCode} to compare a submitted plaintext code against the
  * stored hash in constant time.
  */
-declare function hashMfaCode(code: string): string;
+export declare function hashMfaCode(code: string): string;
 /**
  * Constant-time comparison of a submitted plaintext code against an
  * expected SHA-256 hex hash (as produced by {@link hashMfaCode}).
@@ -488,12 +471,9 @@ declare function hashMfaCode(code: string): string;
  * Returns false for malformed/empty expected hashes (timingSafeEqual
  * requires equal-length, non-empty buffers).
  */
-declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
-//#endregion
-//#region src/utils.d.ts
-declare function maskEmail(email: string): string;
-declare function maskPhone(phone: string): string;
-declare function maskMfaValue(method: MfaMethod): string;
-declare function setAtPath(obj: object, path: string, value: unknown): void;
-//#endregion
-export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, FederatedIdentityStoreMemory, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, PasswordHasher, PasswordPolicy, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, SEEN_DEVICES_DEFAULT_CAP, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, UserAuthError, type UserAuthErrorType, type UserCredentials, UserService, type UserServiceConfig, UserStore, UserStoreMemory, type UserStoreUpdate, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };
+export declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
+export declare function maskEmail(email: string): string;
+export declare function maskPhone(phone: string): string;
+export declare function maskMfaValue(method: MfaMethod): string;
+export declare function setAtPath(obj: object, path: string, value: unknown): void;
+export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, type UserAuthErrorType, type UserCredentials, type UserServiceConfig, UserStore, type UserStoreUpdate, pickDefinedProfile };

package/dist/index.d.mts

@@ -1,14 +1,11 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.mjs";
-//#region src/errors.d.ts
-declare class UserAuthError extends Error {
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-D10-BT9l.mjs";
+export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "UserAuthError";
   constructor(type: UserAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/password/hasher.d.ts
-declare class PasswordHasher {
+export declare class PasswordHasher {
   private readonly pepper;
   private readonly N;
   private readonly r;
@@ -19,9 +16,7 @@ declare class PasswordHasher {
   verify(password: string, encoded: string): Promise<boolean>;
   generatePassword(length?: number): string;
 }
-//#endregion
-//#region src/password/policy.d.ts
-declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
+export declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
 /**
  * Helper that builds a `PasswordPolicyDef` from a real backend function plus
  * its bound positional arguments. The function runs directly on the server
@@ -43,13 +38,13 @@ declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolic
  * `undefined` and `transferable` is false; frontend pre-validation skips it
  * and only the server check enforces the rule.
  */
-declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
+export declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
   rule: (v: string, ...args: A) => boolean | Promise<boolean>;
   args?: A;
   description?: string;
   errorMessage?: string;
 }): PasswordPolicyDef;
-declare class PasswordPolicy implements PasswordPolicyInstance {
+export declare class PasswordPolicy implements PasswordPolicyInstance {
   readonly rule: PasswordPolicyEvalFn;
   readonly serialized?: string;
   readonly description: string;
@@ -58,8 +53,6 @@ declare class PasswordPolicy implements PasswordPolicyInstance {
   evaluate(password: string, context?: PasswordPolicyContext): boolean | Promise<boolean>;
   get transferable(): boolean;
 }
-//#endregion
-//#region src/user-service.d.ts
 interface ResolvedConfig {
   password: Required<Omit<PasswordConfig, "policies">> & {
     policies: PasswordPolicy[];
@@ -71,7 +64,7 @@ interface ResolvedConfig {
   };
   emailField?: string;
 }
-declare const SEEN_DEVICES_DEFAULT_CAP = 5;
+export declare const SEEN_DEVICES_DEFAULT_CAP = 5;
 /**
  * Orchestrates user credentials over a pluggable {@link UserStore}.
  *
@@ -81,7 +74,7 @@ declare const SEEN_DEVICES_DEFAULT_CAP = 5;
  * handle-driven entry points) take a `username`/`email` login handle, resolved
  * via `UserStore.findByHandle`.
  */
-declare class UserService<T extends object = object> {
+export declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
@@ -386,9 +379,7 @@ declare class UserService<T extends object = object> {
    */
   private incrementAndMaybeLock;
 }
-//#endregion
-//#region src/store/memory.d.ts
-declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
+export declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   /** Keyed by the stable surrogate `id` (the token subject). */
   private store;
   /**
@@ -427,8 +418,6 @@ declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   delete(id: string): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store-memory.d.ts
 interface FederatedIdentityStoreMemoryOptions {
   /** Injectable clock for deterministic `linkedAt` / `lastLoginAt`. Defaults to `Date.now`. */
   clock?: () => number;
@@ -439,7 +428,7 @@ interface FederatedIdentityStoreMemoryOptions {
  * `structuredClone` on every read/write isolates callers from later mutation
  * (mirrors `UserStoreMemory`).
  */
-declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   /** Keyed by `compositeKey(provider, subject)`. */
   private store;
   private clock;
@@ -451,28 +440,22 @@ declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/password/policies.d.ts
-declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
-declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
-declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
-declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
-//#endregion
-//#region src/mfa/totp.d.ts
-declare function generateTotpSecret(bytes?: number): string;
-declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
-declare function generateTotpCode(secret: string, config?: TotpConfig): string;
+export declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
+export declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
+export declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
+export declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
+export declare function generateTotpSecret(bytes?: number): string;
+export declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
+export declare function generateTotpCode(secret: string, config?: TotpConfig): string;
 /**
  * Returns the matched HOTP counter when `code` is valid within the verification
  * window, otherwise `null`. Returning the counter (not a bool) lets the caller
  * persist `lastUsedWindow` and reject same-window replays (RFC 6238 §5.2 SHOULD).
  */
-declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
-declare function generateMfaCode(length?: number): string;
-//#endregion
-//#region src/mfa/codes.d.ts
+export declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
+export declare function generateMfaCode(length?: number): string;
 /**
  * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
  *
@@ -480,7 +463,7 @@ declare function generateMfaCode(length?: number): string;
  * Use {@link verifyMfaCode} to compare a submitted plaintext code against the
  * stored hash in constant time.
  */
-declare function hashMfaCode(code: string): string;
+export declare function hashMfaCode(code: string): string;
 /**
  * Constant-time comparison of a submitted plaintext code against an
  * expected SHA-256 hex hash (as produced by {@link hashMfaCode}).
@@ -488,12 +471,9 @@ declare function hashMfaCode(code: string): string;
  * Returns false for malformed/empty expected hashes (timingSafeEqual
  * requires equal-length, non-empty buffers).
  */
-declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
-//#endregion
-//#region src/utils.d.ts
-declare function maskEmail(email: string): string;
-declare function maskPhone(phone: string): string;
-declare function maskMfaValue(method: MfaMethod): string;
-declare function setAtPath(obj: object, path: string, value: unknown): void;
-//#endregion
-export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, FederatedIdentityStoreMemory, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, PasswordHasher, PasswordPolicy, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, SEEN_DEVICES_DEFAULT_CAP, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, UserAuthError, type UserAuthErrorType, type UserCredentials, UserService, type UserServiceConfig, UserStore, UserStoreMemory, type UserStoreUpdate, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };
+export declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
+export declare function maskEmail(email: string): string;
+export declare function maskPhone(phone: string): string;
+export declare function maskMfaValue(method: MfaMethod): string;
+export declare function setAtPath(obj: object, path: string, value: unknown): void;
+export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, type UserAuthErrorType, type UserCredentials, type UserServiceConfig, UserStore, type UserStoreUpdate, pickDefinedProfile };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { a as maskEmail, c as setAtPath, i as incrementAtPath, l as UserStore, n as pickDefinedProfile, o as maskMfaValue, r as deepMerge, s as maskPhone, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-CRycYlMj.mjs";
+import { a as maskEmail, c as setAtPath, i as incrementAtPath, l as UserStore, n as pickDefinedProfile, o as maskMfaValue, r as deepMerge, s as maskPhone, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-BZRvw9Pz.mjs";
 import { createHash, createHmac, randomBytes, randomInt, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
-//#region src/base-x/base32.ts
+// src/base-x/base32.ts
 /**
 * Partially copied from "thirty-two" library, all credits to Chris Umbel.
 *
@@ -71,8 +71,7 @@ function decode(input) {
 	}
 	return output.subarray(0, index);
 }
-//#endregion
-//#region src/mfa/totp.ts
+// src/mfa/totp.ts
 function generateTotpSecret(bytes = 20) {
 	return encode(randomBytes(bytes)).toString().replace(/=+$/, "").toUpperCase();
 }
@@ -126,8 +125,7 @@ function hotpCode(key, counter, digits) {
 	const offset = hmacResult[hmacResult.length - 1] & 15;
 	return (((hmacResult[offset] & 127) << 24 | (hmacResult[offset + 1] & 255) << 16 | (hmacResult[offset + 2] & 255) << 8 | hmacResult[offset + 3] & 255) % 10 ** digits).toString().padStart(digits, "0");
 }
-//#endregion
-//#region src/password/hasher.ts
+// src/password/hasher.ts
 const DEFAULTS = {
 	N: 16384,
 	r: 8,
@@ -137,11 +135,11 @@ const DEFAULTS = {
 };
 const PREFIX = "$scrypt$";
 /** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
-const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+const DEFAULT_MAXMEM = 33554432;
 /** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
-const MAX_MAXMEM = 1024 * 1024 * 1024;
+const MAX_MAXMEM = 1073741824;
 function scryptAsync(password, salt, keyLength, options) {
-	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1048576));
 	return new Promise((resolve, reject) => {
 		scrypt(password, salt, keyLength, {
 			...options,
@@ -211,7 +209,7 @@ var PasswordHasher = class {
 		const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		const digits = "0123456789";
 		const special = "!@#$%^&*()-_=+";
-		const all = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+";
+		const all = lower + upper + digits + special;
 		const bytes = randomBytes(minLen);
 		const result = Array.from({ length: minLen });
 		result[0] = lower[bytes[0] % 26];
@@ -227,8 +225,7 @@ var PasswordHasher = class {
 		return result.join("");
 	}
 };
-//#endregion
-//#region src/password/policy.ts
+// src/password/policy.ts
 function normalizePolicies(policies) {
 	return (policies || []).map((p) => p instanceof PasswordPolicy ? p : new PasswordPolicy(p));
 }
@@ -282,8 +279,7 @@ var PasswordPolicy = class {
 		return this.serialized !== void 0;
 	}
 };
-//#endregion
-//#region src/user-service.ts
+// src/user-service.ts
 function resolveConfig(config) {
 	return {
 		password: {
@@ -1107,8 +1103,7 @@ function observeWrites(store, hooks) {
 		return fn;
 	} });
 }
-//#endregion
-//#region src/store/memory.ts
+// src/store/memory.ts
 var UserStoreMemory = class extends UserStore {
 	/** Keyed by the stable surrogate `id` (the token subject). */
 	store = /* @__PURE__ */ new Map();
@@ -1222,8 +1217,7 @@ var UserStoreMemory = class extends UserStore {
 		throw new UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
-//#region src/store/federated-identity-store-memory.ts
+// src/store/federated-identity-store-memory.ts
 /**
 * In-memory {@link FederatedIdentityStore} — the offline-testable reference
 * impl (RFC IDP.md §9). Keyed by the composite `(provider, subject)`;
@@ -1281,8 +1275,7 @@ var FederatedIdentityStoreMemory = class extends FederatedIdentityStore {
 function compositeKey(provider, subject) {
 	return `${provider}${subject}`;
 }
-//#endregion
-//#region src/password/policies.ts
+// src/password/policies.ts
 const ppHasMinLength = (min = 8) => definePasswordPolicy({
 	rule: (v, min) => v.length >= min,
 	args: [min],
@@ -1319,8 +1312,7 @@ const ppMaxRepeatedChars = (maxRepeated = 2) => definePasswordPolicy({
 	description: `No more than ${maxRepeated} consecutive repeated characters`,
 	errorMessage: `Password must not have more than ${maxRepeated} consecutive repeated characters`
 });
-//#endregion
-//#region src/mfa/codes.ts
+// src/mfa/codes.ts
 /**
 * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
 *
@@ -1345,5 +1337,4 @@ function verifyMfaCode(submitted, expectedHash) {
 	if (a.length !== b.length) return false;
 	return timingSafeEqual(a, b);
 }
-//#endregion
 export { FederatedIdentityStore, FederatedIdentityStoreMemory, PasswordHasher, PasswordPolicy, SEEN_DEVICES_DEFAULT_CAP, UserAuthError, UserService, UserStore, UserStoreMemory, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/user",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "User credential primitives for aoothjs",
   "keywords": [
     "aoothjs",
@@ -60,18 +60,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.109",
-    "@atscript/db": "^0.1.164",
-    "@atscript/db-sql-tools": "^0.1.164",
-    "@atscript/db-sqlite": "^0.1.164",
-    "@atscript/typescript": "^0.1.109",
+    "@atscript/core": "^0.2.3",
+    "@atscript/db": "^0.1.167",
+    "@atscript/db-sql-tools": "^0.1.167",
+    "@atscript/db-sqlite": "^0.1.167",
+    "@atscript/typescript": "^0.2.3",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.15",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.109"
+    "unplugin-atscript": "^0.2.3"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.164"
+    "@atscript/db": "^0.1.167"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {

package/src/atscript-db/federated-identity.as.d.ts

@@ -7,7 +7,7 @@
  * Do not edit this file!
  */
 
-import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TAtscriptField, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
 
 /**
  * Atscript interface **AoothFederatedIdentity**

package/src/atscript-db/user-credentials.as.d.ts

@@ -7,7 +7,7 @@
  * Do not edit this file!
  */
 
-import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
+import type { TAtscriptTypeObject, TAtscriptTypeComplex, TAtscriptTypeFinal, TAtscriptTypeArray, TAtscriptAnnotatedType, TAtscriptField, TMetadataMap, Validator, TValidatorOptions } from "@atscript/typescript/utils"
 
 /**
  * Atscript interface **AoothUserCredentials**