@aooth/user 0.2.1 → 0.2.3

package/dist/index.d.cts

@@ -1,14 +1,11 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.cjs";
-//#region src/errors.d.ts
-declare class UserAuthError extends Error {
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-Ds7Ye9qJ.cjs";
+export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "UserAuthError";
   constructor(type: UserAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/password/hasher.d.ts
-declare class PasswordHasher {
+export declare class PasswordHasher {
   private readonly pepper;
   private readonly N;
   private readonly r;
@@ -19,9 +16,7 @@ declare class PasswordHasher {
   verify(password: string, encoded: string): Promise<boolean>;
   generatePassword(length?: number): string;
 }
-//#endregion
-//#region src/password/policy.d.ts
-declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
+export declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
 /**
  * Helper that builds a `PasswordPolicyDef` from a real backend function plus
  * its bound positional arguments. The function runs directly on the server
@@ -43,13 +38,13 @@ declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolic
  * `undefined` and `transferable` is false; frontend pre-validation skips it
  * and only the server check enforces the rule.
  */
-declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
+export declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
   rule: (v: string, ...args: A) => boolean | Promise<boolean>;
   args?: A;
   description?: string;
   errorMessage?: string;
 }): PasswordPolicyDef;
-declare class PasswordPolicy implements PasswordPolicyInstance {
+export declare class PasswordPolicy implements PasswordPolicyInstance {
   readonly rule: PasswordPolicyEvalFn;
   readonly serialized?: string;
   readonly description: string;
@@ -58,8 +53,6 @@ declare class PasswordPolicy implements PasswordPolicyInstance {
   evaluate(password: string, context?: PasswordPolicyContext): boolean | Promise<boolean>;
   get transferable(): boolean;
 }
-//#endregion
-//#region src/user-service.d.ts
 interface ResolvedConfig {
   password: Required<Omit<PasswordConfig, "policies">> & {
     policies: PasswordPolicy[];
@@ -71,7 +64,7 @@ interface ResolvedConfig {
   };
   emailField?: string;
 }
-declare const SEEN_DEVICES_DEFAULT_CAP = 5;
+export declare const SEEN_DEVICES_DEFAULT_CAP = 5;
 /**
  * Orchestrates user credentials over a pluggable {@link UserStore}.
  *
@@ -81,7 +74,7 @@ declare const SEEN_DEVICES_DEFAULT_CAP = 5;
  * handle-driven entry points) take a `username`/`email` login handle, resolved
  * via `UserStore.findByHandle`.
  */
-declare class UserService<T extends object = object> {
+export declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
@@ -113,8 +106,8 @@ declare class UserService<T extends object = object> {
   getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
-   * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-   * inactive until they accept). For setup scripts / seeders / tests that
+   * on this default (pending invitees stay inactive until they accept the
+   * invite). For setup scripts / seeders / tests that
    * don't go through invite, follow up with `activateAccount(id)` or `login()`
    * will throw `UserAuthError("INACTIVE")` — which the login workflow
    * deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -167,15 +160,15 @@ declare class UserService<T extends object = object> {
   setPassword(id: string, newPassword: string): Promise<void>;
   /**
    * Hard-delete the user row by `id`. Returns nothing on success. Throws
-   * `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-   * workflow's `auth/invite/cancel` to revoke a pending invitation.
+   * `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+   * invitation use {@link revokeInvitation}, which never deletes an account
+   * whose invite was accepted meanwhile.
    */
   deleteUser(id: string): Promise<void>;
   /**
    * Deep-merge `patch` into the user record (top-level fields are shallow-
    * merged; `account` / `mfa` / `password` are merged per their
    * `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-   * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
   /**
@@ -187,6 +180,24 @@ declare class UserService<T extends object = object> {
    * the same account can never both complete.
    */
   acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
+  /**
+   * Revoke a pending invitation: delete the invited account, so its invite
+   * link stops working (the invite workflow answers it with 410
+   * `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+   * is not pending — the invite was already accepted — or when the row
+   * changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+   * row matches `id`.
+   *
+   * Safe against a concurrent acceptance or re-invite: one compare-and-set
+   * write first rotates `account.inviteNonce` while the row is still pending
+   * (an accept racing it fails), and the delete is conditional on the row's
+   * `version` still being the one that write produced — any write in between
+   * (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+   * honour the conditional delete; a custom store whose `delete()` ignores
+   * `expectedVersion` leaves a window of one round-trip between the re-check
+   * and the delete.
+   */
+  revokeInvitation(id: string): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -386,9 +397,7 @@ declare class UserService<T extends object = object> {
    */
   private incrementAndMaybeLock;
 }
-//#endregion
-//#region src/store/memory.d.ts
-declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
+export declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   /** Keyed by the stable surrogate `id` (the token subject). */
   private store;
   /**
@@ -424,11 +433,11 @@ declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
    */
   private assertHandlesUnique;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store-memory.d.ts
 interface FederatedIdentityStoreMemoryOptions {
   /** Injectable clock for deterministic `linkedAt` / `lastLoginAt`. Defaults to `Date.now`. */
   clock?: () => number;
@@ -439,7 +448,7 @@ interface FederatedIdentityStoreMemoryOptions {
  * `structuredClone` on every read/write isolates callers from later mutation
  * (mirrors `UserStoreMemory`).
  */
-declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   /** Keyed by `compositeKey(provider, subject)`. */
   private store;
   private clock;
@@ -451,28 +460,22 @@ declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/password/policies.d.ts
-declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
-declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
-declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
-declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
-//#endregion
-//#region src/mfa/totp.d.ts
-declare function generateTotpSecret(bytes?: number): string;
-declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
-declare function generateTotpCode(secret: string, config?: TotpConfig): string;
+export declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
+export declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
+export declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
+export declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
+export declare function generateTotpSecret(bytes?: number): string;
+export declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
+export declare function generateTotpCode(secret: string, config?: TotpConfig): string;
 /**
  * Returns the matched HOTP counter when `code` is valid within the verification
  * window, otherwise `null`. Returning the counter (not a bool) lets the caller
  * persist `lastUsedWindow` and reject same-window replays (RFC 6238 §5.2 SHOULD).
  */
-declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
-declare function generateMfaCode(length?: number): string;
-//#endregion
-//#region src/mfa/codes.d.ts
+export declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
+export declare function generateMfaCode(length?: number): string;
 /**
  * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
  *
@@ -480,7 +483,7 @@ declare function generateMfaCode(length?: number): string;
  * Use {@link verifyMfaCode} to compare a submitted plaintext code against the
  * stored hash in constant time.
  */
-declare function hashMfaCode(code: string): string;
+export declare function hashMfaCode(code: string): string;
 /**
  * Constant-time comparison of a submitted plaintext code against an
  * expected SHA-256 hex hash (as produced by {@link hashMfaCode}).
@@ -488,12 +491,9 @@ declare function hashMfaCode(code: string): string;
  * Returns false for malformed/empty expected hashes (timingSafeEqual
  * requires equal-length, non-empty buffers).
  */
-declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
-//#endregion
-//#region src/utils.d.ts
-declare function maskEmail(email: string): string;
-declare function maskPhone(phone: string): string;
-declare function maskMfaValue(method: MfaMethod): string;
-declare function setAtPath(obj: object, path: string, value: unknown): void;
-//#endregion
-export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, FederatedIdentityStoreMemory, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, PasswordHasher, PasswordPolicy, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, SEEN_DEVICES_DEFAULT_CAP, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, UserAuthError, type UserAuthErrorType, type UserCredentials, UserService, type UserServiceConfig, UserStore, UserStoreMemory, type UserStoreUpdate, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };
+export declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
+export declare function maskEmail(email: string): string;
+export declare function maskPhone(phone: string): string;
+export declare function maskMfaValue(method: MfaMethod): string;
+export declare function setAtPath(obj: object, path: string, value: unknown): void;
+export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, type UserAuthErrorType, type UserCredentials, type UserServiceConfig, UserStore, type UserStoreUpdate, pickDefinedProfile };

package/dist/index.d.mts

@@ -1,14 +1,11 @@
-import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-B_jEkl-a.mjs";
-//#region src/errors.d.ts
-declare class UserAuthError extends Error {
+import { C as TotpConfig, D as UserCredentials, E as UserAuthErrorType, O as UserServiceConfig, S as PolicyCheckResult, T as TrustedDeviceRecord, _ as PasswordData, a as pickDefinedProfile, b as PasswordPolicyEvalFn, c as AccountData, d as LockoutConfig, f as LoginResult, g as PasswordConfig, h as MfaMethodInfo, i as NewFederatedIdentity, k as UserStoreUpdate, l as DeepPartial, m as MfaMethod, n as FederatedIdentityStore, o as UserStore, p as MfaData, r as FederatedProfileSnapshot, s as WithCasOptions, t as FederatedIdentity, u as LockStatus, v as PasswordPolicyContext, w as TransferablePolicy, x as PasswordPolicyInstance, y as PasswordPolicyDef } from "./federated-identity-store-Ds7Ye9qJ.mjs";
+export declare class UserAuthError extends Error {
   readonly type: UserAuthErrorType;
   readonly details?: Record<string, unknown> | undefined;
   readonly name = "UserAuthError";
   constructor(type: UserAuthErrorType, message?: string, details?: Record<string, unknown> | undefined);
 }
-//#endregion
-//#region src/password/hasher.d.ts
-declare class PasswordHasher {
+export declare class PasswordHasher {
   private readonly pepper;
   private readonly N;
   private readonly r;
@@ -19,9 +16,7 @@ declare class PasswordHasher {
   verify(password: string, encoded: string): Promise<boolean>;
   generatePassword(length?: number): string;
 }
-//#endregion
-//#region src/password/policy.d.ts
-declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
+export declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolicyInstance)[]): PasswordPolicy[];
 /**
  * Helper that builds a `PasswordPolicyDef` from a real backend function plus
  * its bound positional arguments. The function runs directly on the server
@@ -43,13 +38,13 @@ declare function normalizePolicies(policies?: (PasswordPolicyDef | PasswordPolic
  * `undefined` and `transferable` is false; frontend pre-validation skips it
  * and only the server check enforces the rule.
  */
-declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
+export declare function definePasswordPolicy<A extends readonly unknown[]>(opts: {
   rule: (v: string, ...args: A) => boolean | Promise<boolean>;
   args?: A;
   description?: string;
   errorMessage?: string;
 }): PasswordPolicyDef;
-declare class PasswordPolicy implements PasswordPolicyInstance {
+export declare class PasswordPolicy implements PasswordPolicyInstance {
   readonly rule: PasswordPolicyEvalFn;
   readonly serialized?: string;
   readonly description: string;
@@ -58,8 +53,6 @@ declare class PasswordPolicy implements PasswordPolicyInstance {
   evaluate(password: string, context?: PasswordPolicyContext): boolean | Promise<boolean>;
   get transferable(): boolean;
 }
-//#endregion
-//#region src/user-service.d.ts
 interface ResolvedConfig {
   password: Required<Omit<PasswordConfig, "policies">> & {
     policies: PasswordPolicy[];
@@ -71,7 +64,7 @@ interface ResolvedConfig {
   };
   emailField?: string;
 }
-declare const SEEN_DEVICES_DEFAULT_CAP = 5;
+export declare const SEEN_DEVICES_DEFAULT_CAP = 5;
 /**
  * Orchestrates user credentials over a pluggable {@link UserStore}.
  *
@@ -81,7 +74,7 @@ declare const SEEN_DEVICES_DEFAULT_CAP = 5;
  * handle-driven entry points) take a `username`/`email` login handle, resolved
  * via `UserStore.findByHandle`.
  */
-declare class UserService<T extends object = object> {
+export declare class UserService<T extends object = object> {
   protected readonly store: UserStore<T>;
   protected readonly config: ResolvedConfig;
   protected readonly hasher: PasswordHasher;
@@ -113,8 +106,8 @@ declare class UserService<T extends object = object> {
   getUserSnapshot(id: string, scope: object): Promise<UserCredentials & T>;
   /**
    * Creates a user with `account.active: false`. The invite workflow relies
-   * on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-   * inactive until they accept). For setup scripts / seeders / tests that
+   * on this default (pending invitees stay inactive until they accept the
+   * invite). For setup scripts / seeders / tests that
    * don't go through invite, follow up with `activateAccount(id)` or `login()`
    * will throw `UserAuthError("INACTIVE")` — which the login workflow
    * deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -167,15 +160,15 @@ declare class UserService<T extends object = object> {
   setPassword(id: string, newPassword: string): Promise<void>;
   /**
    * Hard-delete the user row by `id`. Returns nothing on success. Throws
-   * `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-   * workflow's `auth/invite/cancel` to revoke a pending invitation.
+   * `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+   * invitation use {@link revokeInvitation}, which never deletes an account
+   * whose invite was accepted meanwhile.
    */
   deleteUser(id: string): Promise<void>;
   /**
    * Deep-merge `patch` into the user record (top-level fields are shallow-
    * merged; `account` / `mfa` / `password` are merged per their
    * `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-   * Used by the invite workflow's `applyProfile` default fallback.
    */
   update(id: string, patch: Partial<UserCredentials & T>): Promise<UserCredentials & T>;
   /**
@@ -187,6 +180,24 @@ declare class UserService<T extends object = object> {
    * the same account can never both complete.
    */
   acceptInvitation(id: string, nonce: string | undefined): Promise<boolean>;
+  /**
+   * Revoke a pending invitation: delete the invited account, so its invite
+   * link stops working (the invite workflow answers it with 410
+   * `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+   * is not pending — the invite was already accepted — or when the row
+   * changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+   * row matches `id`.
+   *
+   * Safe against a concurrent acceptance or re-invite: one compare-and-set
+   * write first rotates `account.inviteNonce` while the row is still pending
+   * (an accept racing it fails), and the delete is conditional on the row's
+   * `version` still being the one that write produced — any write in between
+   * (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+   * honour the conditional delete; a custom store whose `delete()` ignores
+   * `expectedVersion` leaves a window of one round-trip between the re-check
+   * and the delete.
+   */
+  revokeInvitation(id: string): Promise<boolean>;
   /**
    * Flip the account active. `opts.verifiedEmail` lets callers that just
    * proved an inbox (invite magic link, signup OTP) record the correspondence
@@ -386,9 +397,7 @@ declare class UserService<T extends object = object> {
    */
   private incrementAndMaybeLock;
 }
-//#endregion
-//#region src/store/memory.d.ts
-declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
+export declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
   /** Keyed by the stable surrogate `id` (the token subject). */
   private store;
   /**
@@ -424,11 +433,11 @@ declare class UserStoreMemory<T extends object = object> extends UserStore<T> {
    */
   private assertHandlesUnique;
   update(id: string, update: UserStoreUpdate): Promise<boolean>;
-  delete(id: string): Promise<boolean>;
+  delete(id: string, opts?: {
+    expectedVersion?: number;
+  }): Promise<boolean>;
   withCas(id: string, mutator: (current: UserCredentials & T) => UserStoreUpdate | null, opts?: WithCasOptions): Promise<void>;
 }
-//#endregion
-//#region src/store/federated-identity-store-memory.d.ts
 interface FederatedIdentityStoreMemoryOptions {
   /** Injectable clock for deterministic `linkedAt` / `lastLoginAt`. Defaults to `Date.now`. */
   clock?: () => number;
@@ -439,7 +448,7 @@ interface FederatedIdentityStoreMemoryOptions {
  * `structuredClone` on every read/write isolates callers from later mutation
  * (mirrors `UserStoreMemory`).
  */
-declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
+export declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   /** Keyed by `compositeKey(provider, subject)`. */
   private store;
   private clock;
@@ -451,28 +460,22 @@ declare class FederatedIdentityStoreMemory extends FederatedIdentityStore {
   touchLogin(provider: string, subject: string, profile?: FederatedProfileSnapshot): Promise<void>;
   deleteAllForUser(userId: string): Promise<number>;
 }
-//#endregion
-//#region src/password/policies.d.ts
-declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
-declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
-declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
-declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
-declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
-//#endregion
-//#region src/mfa/totp.d.ts
-declare function generateTotpSecret(bytes?: number): string;
-declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
-declare function generateTotpCode(secret: string, config?: TotpConfig): string;
+export declare const ppHasMinLength: (min?: number) => PasswordPolicyDef;
+export declare const ppHasUpperCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasLowerCase: (n?: number) => PasswordPolicyDef;
+export declare const ppHasNumber: (n?: number) => PasswordPolicyDef;
+export declare const ppHasSpecialChar: (n?: number) => PasswordPolicyDef;
+export declare const ppMaxRepeatedChars: (maxRepeated?: number) => PasswordPolicyDef;
+export declare function generateTotpSecret(bytes?: number): string;
+export declare function generateTotpUri(secret: string, issuer: string, account: string, config?: Pick<TotpConfig, "period" | "digits">): string;
+export declare function generateTotpCode(secret: string, config?: TotpConfig): string;
 /**
  * Returns the matched HOTP counter when `code` is valid within the verification
  * window, otherwise `null`. Returning the counter (not a bool) lets the caller
  * persist `lastUsedWindow` and reject same-window replays (RFC 6238 §5.2 SHOULD).
  */
-declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
-declare function generateMfaCode(length?: number): string;
-//#endregion
-//#region src/mfa/codes.d.ts
+export declare function verifyTotpCode(secret: string, code: string, config?: TotpConfig): number | null;
+export declare function generateMfaCode(length?: number): string;
 /**
  * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
  *
@@ -480,7 +483,7 @@ declare function generateMfaCode(length?: number): string;
  * Use {@link verifyMfaCode} to compare a submitted plaintext code against the
  * stored hash in constant time.
  */
-declare function hashMfaCode(code: string): string;
+export declare function hashMfaCode(code: string): string;
 /**
  * Constant-time comparison of a submitted plaintext code against an
  * expected SHA-256 hex hash (as produced by {@link hashMfaCode}).
@@ -488,12 +491,9 @@ declare function hashMfaCode(code: string): string;
  * Returns false for malformed/empty expected hashes (timingSafeEqual
  * requires equal-length, non-empty buffers).
  */
-declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
-//#endregion
-//#region src/utils.d.ts
-declare function maskEmail(email: string): string;
-declare function maskPhone(phone: string): string;
-declare function maskMfaValue(method: MfaMethod): string;
-declare function setAtPath(obj: object, path: string, value: unknown): void;
-//#endregion
-export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, FederatedIdentityStoreMemory, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, PasswordHasher, PasswordPolicy, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, SEEN_DEVICES_DEFAULT_CAP, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, UserAuthError, type UserAuthErrorType, type UserCredentials, UserService, type UserServiceConfig, UserStore, UserStoreMemory, type UserStoreUpdate, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };
+export declare function verifyMfaCode(submitted: string, expectedHash: string): boolean;
+export declare function maskEmail(email: string): string;
+export declare function maskPhone(phone: string): string;
+export declare function maskMfaValue(method: MfaMethod): string;
+export declare function setAtPath(obj: object, path: string, value: unknown): void;
+export { type AccountData, type DeepPartial, type FederatedIdentity, FederatedIdentityStore, type FederatedIdentityStoreMemoryOptions, type FederatedProfileSnapshot, type LockStatus, type LockoutConfig, type LoginResult, type MfaData, type MfaMethod, type MfaMethodInfo, type NewFederatedIdentity, type PasswordConfig, type PasswordData, type PasswordPolicyContext, type PasswordPolicyDef, type PasswordPolicyEvalFn, type PasswordPolicyInstance, type PolicyCheckResult, type TotpConfig, type TransferablePolicy, type TrustedDeviceRecord, type UserAuthErrorType, type UserCredentials, type UserServiceConfig, UserStore, type UserStoreUpdate, pickDefinedProfile };

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { a as maskEmail, c as setAtPath, i as incrementAtPath, l as UserStore, n as pickDefinedProfile, o as maskMfaValue, r as deepMerge, s as maskPhone, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-CRycYlMj.mjs";
+import { a as maskEmail, c as setAtPath, i as incrementAtPath, l as UserStore, n as pickDefinedProfile, o as maskMfaValue, r as deepMerge, s as maskPhone, t as FederatedIdentityStore, u as UserAuthError } from "./federated-identity-store-BZRvw9Pz.mjs";
 import { createHash, createHmac, randomBytes, randomInt, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
-//#region src/base-x/base32.ts
+// src/base-x/base32.ts
 /**
 * Partially copied from "thirty-two" library, all credits to Chris Umbel.
 *
@@ -71,8 +71,7 @@ function decode(input) {
 	}
 	return output.subarray(0, index);
 }
-//#endregion
-//#region src/mfa/totp.ts
+// src/mfa/totp.ts
 function generateTotpSecret(bytes = 20) {
 	return encode(randomBytes(bytes)).toString().replace(/=+$/, "").toUpperCase();
 }
@@ -126,8 +125,7 @@ function hotpCode(key, counter, digits) {
 	const offset = hmacResult[hmacResult.length - 1] & 15;
 	return (((hmacResult[offset] & 127) << 24 | (hmacResult[offset + 1] & 255) << 16 | (hmacResult[offset + 2] & 255) << 8 | hmacResult[offset + 3] & 255) % 10 ** digits).toString().padStart(digits, "0");
 }
-//#endregion
-//#region src/password/hasher.ts
+// src/password/hasher.ts
 const DEFAULTS = {
 	N: 16384,
 	r: 8,
@@ -137,11 +135,11 @@ const DEFAULTS = {
 };
 const PREFIX = "$scrypt$";
 /** Node's default scrypt memory cap (32 MiB) — kept as the floor. */
-const DEFAULT_MAXMEM = 32 * 1024 * 1024;
+const DEFAULT_MAXMEM = 33554432;
 /** Upper bound for the memory a (possibly stored, untrusted) parameter set may ask for. */
-const MAX_MAXMEM = 1024 * 1024 * 1024;
+const MAX_MAXMEM = 1073741824;
 function scryptAsync(password, salt, keyLength, options) {
-	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1024 * 1024));
+	const maxmem = Math.min(MAX_MAXMEM, Math.max(DEFAULT_MAXMEM, 256 * options.N * options.r + 1048576));
 	return new Promise((resolve, reject) => {
 		scrypt(password, salt, keyLength, {
 			...options,
@@ -211,7 +209,7 @@ var PasswordHasher = class {
 		const upper = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 		const digits = "0123456789";
 		const special = "!@#$%^&*()-_=+";
-		const all = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_=+";
+		const all = lower + upper + digits + special;
 		const bytes = randomBytes(minLen);
 		const result = Array.from({ length: minLen });
 		result[0] = lower[bytes[0] % 26];
@@ -227,8 +225,7 @@ var PasswordHasher = class {
 		return result.join("");
 	}
 };
-//#endregion
-//#region src/password/policy.ts
+// src/password/policy.ts
 function normalizePolicies(policies) {
 	return (policies || []).map((p) => p instanceof PasswordPolicy ? p : new PasswordPolicy(p));
 }
@@ -282,8 +279,7 @@ var PasswordPolicy = class {
 		return this.serialized !== void 0;
 	}
 };
-//#endregion
-//#region src/user-service.ts
+// src/user-service.ts
 function resolveConfig(config) {
 	return {
 		password: {
@@ -413,8 +409,8 @@ var UserService = class {
 	}
 	/**
 	* Creates a user with `account.active: false`. The invite workflow relies
-	* on this default (see `InviteWorkflow.acceptInvite` — pending invitees stay
-	* inactive until they accept). For setup scripts / seeders / tests that
+	* on this default (pending invitees stay inactive until they accept the
+	* invite). For setup scripts / seeders / tests that
 	* don't go through invite, follow up with `activateAccount(id)` or `login()`
 	* will throw `UserAuthError("INACTIVE")` — which the login workflow
 	* deliberately re-maps to `"Invalid credentials"` to avoid account
@@ -543,8 +539,9 @@ var UserService = class {
 	}
 	/**
 	* Hard-delete the user row by `id`. Returns nothing on success. Throws
-	* `UserAuthError("NOT_FOUND")` when no row matches. Used by the invite
-	* workflow's `auth/invite/cancel` to revoke a pending invitation.
+	* `UserAuthError("NOT_FOUND")` when no row matches. To revoke a pending
+	* invitation use {@link revokeInvitation}, which never deletes an account
+	* whose invite was accepted meanwhile.
 	*/
 	async deleteUser(id) {
 		if (!await this.store.delete(id)) throw new UserAuthError("NOT_FOUND");
@@ -553,7 +550,6 @@ var UserService = class {
 	* Deep-merge `patch` into the user record (top-level fields are shallow-
 	* merged; `account` / `mfa` / `password` are merged per their
 	* `@db.patch.strategy 'merge'` declaration). Returns the patched record.
-	* Used by the invite workflow's `applyProfile` default fallback.
 	*/
 	async update(id, patch) {
 		if (!await this.store.update(id, { set: patch })) throw new UserAuthError("NOT_FOUND");
@@ -580,6 +576,36 @@ var UserService = class {
 		return accepted;
 	}
 	/**
+	* Revoke a pending invitation: delete the invited account, so its invite
+	* link stops working (the invite workflow answers it with 410
+	* `INVITE_CANCELLED`). Returns `false` and deletes nothing when the account
+	* is not pending — the invite was already accepted — or when the row
+	* changed while the revoke ran. Throws `UserAuthError("NOT_FOUND")` when no
+	* row matches `id`.
+	*
+	* Safe against a concurrent acceptance or re-invite: one compare-and-set
+	* write first rotates `account.inviteNonce` while the row is still pending
+	* (an accept racing it fails), and the delete is conditional on the row's
+	* `version` still being the one that write produced — any write in between
+	* (a re-invite, an acceptance) makes it delete nothing. The bundled stores
+	* honour the conditional delete; a custom store whose `delete()` ignores
+	* `expectedVersion` leaves a window of one round-trip between the re-check
+	* and the delete.
+	*/
+	async revokeInvitation(id) {
+		const nonce = randomBytes(16).toString("base64url");
+		let pending = false;
+		await this.store.withCas(id, (user) => {
+			pending = user.account.pendingInvitation === true;
+			if (!pending) return null;
+			return { set: { account: { inviteNonce: nonce } } };
+		});
+		if (!pending) return false;
+		const claimed = await this.store.findById(id);
+		if (!claimed?.account.pendingInvitation || claimed.account.inviteNonce !== nonce) return false;
+		return this.store.delete(id, { expectedVersion: claimed.version ?? 0 });
+	}
+	/**
 	* Flip the account active. `opts.verifiedEmail` lets callers that just
 	* proved an inbox (invite magic link, signup OTP) record the correspondence
 	* address in the same store write — see {@link setVerifiedEmail}.
@@ -1107,8 +1133,7 @@ function observeWrites(store, hooks) {
 		return fn;
 	} });
 }
-//#endregion
-//#region src/store/memory.ts
+// src/store/memory.ts
 var UserStoreMemory = class extends UserStore {
 	/** Keyed by the stable surrogate `id` (the token subject). */
 	store = /* @__PURE__ */ new Map();
@@ -1204,7 +1229,10 @@ var UserStoreMemory = class extends UserStore {
 		user.version = (user.version ?? 0) + 1;
 		return true;
 	}
-	async delete(id) {
+	async delete(id, opts) {
+		const user = this.store.get(id);
+		if (!user) return false;
+		if (opts?.expectedVersion !== void 0 && (user.version ?? 0) !== opts.expectedVersion) return false;
 		return this.store.delete(id);
 	}
 	async withCas(id, mutator, opts) {
@@ -1222,8 +1250,7 @@ var UserStoreMemory = class extends UserStore {
 		throw new UserAuthError("CAS_EXHAUSTED");
 	}
 };
-//#endregion
-//#region src/store/federated-identity-store-memory.ts
+// src/store/federated-identity-store-memory.ts
 /**
 * In-memory {@link FederatedIdentityStore} — the offline-testable reference
 * impl (RFC IDP.md §9). Keyed by the composite `(provider, subject)`;
@@ -1281,8 +1308,7 @@ var FederatedIdentityStoreMemory = class extends FederatedIdentityStore {
 function compositeKey(provider, subject) {
 	return `${provider}${subject}`;
 }
-//#endregion
-//#region src/password/policies.ts
+// src/password/policies.ts
 const ppHasMinLength = (min = 8) => definePasswordPolicy({
 	rule: (v, min) => v.length >= min,
 	args: [min],
@@ -1319,8 +1345,7 @@ const ppMaxRepeatedChars = (maxRepeated = 2) => definePasswordPolicy({
 	description: `No more than ${maxRepeated} consecutive repeated characters`,
 	errorMessage: `Password must not have more than ${maxRepeated} consecutive repeated characters`
 });
-//#endregion
-//#region src/mfa/codes.ts
+// src/mfa/codes.ts
 /**
 * SHA-256 hash of an MFA code (e.g. one-time email/SMS code or backup code).
 *
@@ -1345,5 +1370,4 @@ function verifyMfaCode(submitted, expectedHash) {
 	if (a.length !== b.length) return false;
 	return timingSafeEqual(a, b);
 }
-//#endregion
 export { FederatedIdentityStore, FederatedIdentityStoreMemory, PasswordHasher, PasswordPolicy, SEEN_DEVICES_DEFAULT_CAP, UserAuthError, UserService, UserStore, UserStoreMemory, definePasswordPolicy, generateMfaCode, generateTotpCode, generateTotpSecret, generateTotpUri, hashMfaCode, maskEmail, maskMfaValue, maskPhone, normalizePolicies, pickDefinedProfile, ppHasLowerCase, ppHasMinLength, ppHasNumber, ppHasSpecialChar, ppHasUpperCase, ppMaxRepeatedChars, setAtPath, verifyMfaCode, verifyTotpCode };