@azlib/identity 0.2.0

package/dist/node.d.cts

@@ -0,0 +1,260 @@
+import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-C2xZAatu.cjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-CLzKx8Z7.cjs";
+import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
+
+//#region core/lockout.d.ts
+/**
+ * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}
+ * when the lockout is active (i.e. `lockedUntil` is in the future).
+ *
+ * Note: if `lockedUntil` is in the past the lock has expired — the user may proceed and
+ * the stale lock will be cleared on successful login.
+ */
+declare function checkLockout(user: IdentityUser, config: LockoutConfig, now: () => Date): void;
+/**
+ * Records a failed login attempt. When the threshold is reached the account is locked
+ * for `config.durationSeconds` seconds (or permanently when `durationSeconds` is 0).
+ */
+declare function recordFailedAttempt(store: IdentityStore, user: IdentityUser, config: LockoutConfig, now: () => Date): Promise<void>;
+/**
+ * Clears lockout state after a successful login. Resets the failure counter and any
+ * active lockout so the account returns to `active` status.
+ */
+declare function clearLockout(store: IdentityStore, user: IdentityUser): Promise<void>;
+//#endregion
+//#region core/refresh-service.d.ts
+/** Dependencies for the refresh flow. */
+interface RefreshDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  tokenService: TokenService;
+  audit: AuditLogger;
+}
+/**
+ * Rotates a refresh session: validates the presented refresh token against the stored
+ * hash, issues a new access token, and replaces the stored refresh-token hash.
+ *
+ * Detects refresh-token reuse (a token whose session exists but whose hash no longer
+ * matches) and revokes the session as a precaution.
+ */
+declare function refreshSession(deps: RefreshDeps, presentedToken: string): Promise<AuthResult>;
+/** Revokes a single session (logout). */
+declare function revokeSession(deps: Pick<RefreshDeps, "config" | "store" | "tokenService" | "audit">, presentedToken: string): Promise<void>;
+//#endregion
+//#region core/oauth/providers/google.d.ts
+/** Configuration for {@link createGoogleOAuthProvider}. */
+interface GoogleOAuthConfig {
+  /** OAuth 2.0 Client ID from Google Cloud Console. */
+  clientId: string;
+  /**
+   * OAuth 2.0 Client Secret. Must be kept server-side — never expose in client code or
+   * commit to source control.
+   */
+  clientSecret: string;
+  /**
+   * Override the default OpenID Connect scopes. Defaults to `["openid", "email", "profile"]`.
+   */
+  scopes?: string[];
+}
+/**
+ * Creates an {@link OAuthProvider} configured for Google OAuth 2.0 / OpenID Connect.
+ *
+ * Security notes:
+ * - The client secret is used only during server-side code exchange.
+ * - The userinfo endpoint is called with the access token to fetch user data, providing
+ *   a verified source of truth over the network (HTTPS).
+ * - The `state` parameter is required and must be verified by the caller to prevent CSRF.
+ */
+declare function createGoogleOAuthProvider(config: GoogleOAuthConfig): OAuthProvider;
+//#endregion
+//#region core/oauth/providers/microsoft.d.ts
+/** Configuration for {@link createMicrosoftOAuthProvider}. */
+interface MicrosoftOAuthConfig {
+  /** Application (client) ID from the Azure / Entra app registration. */
+  clientId: string;
+  /**
+   * Client secret from the Azure / Entra app registration. Must be kept server-side —
+   * never expose in client code or commit to source control.
+   */
+  clientSecret: string;
+  /**
+   * Tenant identifier. Use `"common"` (default) to accept personal and work/school
+   * accounts, `"organizations"` for work/school only, `"consumers"` for personal
+   * accounts only, or your specific tenant GUID / domain.
+   */
+  tenantId?: string;
+  /**
+   * Override the default Microsoft Graph scopes. Defaults to
+   * `["openid", "email", "profile", "User.Read"]`.
+   */
+  scopes?: string[];
+}
+/**
+ * Creates an {@link OAuthProvider} configured for Microsoft Entra ID OAuth 2.0 / OIDC.
+ *
+ * Security notes:
+ * - The client secret is used only during server-side code exchange.
+ * - User data is fetched from the Microsoft Graph API using the access token, providing
+ *   a verified source of truth over HTTPS.
+ * - The `state` parameter is required and must be verified by the caller to prevent CSRF.
+ */
+declare function createMicrosoftOAuthProvider(config: MicrosoftOAuthConfig): OAuthProvider;
+//#endregion
+//#region core/email-verification.d.ts
+/** Raised when an email verification token is missing, expired, or already used. */
+declare class EmailVerificationError extends IdentityError {
+  constructor(message?: string);
+}
+interface EmailVerificationDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  audit: AuditLogger;
+}
+/**
+ * Generates and persists a verification token, then calls the notification service.
+ *
+ * Safe to call after registration or when the user explicitly requests a resend.
+ * Returns silently when the email is already verified.
+ */
+declare function requestEmailVerification(deps: EmailVerificationDeps, userId: string): Promise<void>;
+/**
+ * Verifies the user's email address using the token from the verification link.
+ *
+ * Throws {@link EmailVerificationError} for unknown, expired, or already-used tokens.
+ */
+declare function verifyEmail(deps: EmailVerificationDeps, rawToken: string): Promise<void>;
+//#endregion
+//#region core/password-reset.d.ts
+/** Raised when a password reset token is missing, expired, or already used. */
+declare class PasswordResetError extends IdentityError {
+  constructor(message?: string);
+}
+interface PasswordResetDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  hasher: PasswordHasher;
+  audit: AuditLogger;
+}
+/**
+ * Generates a password reset token and dispatches the notification.
+ *
+ * Never reveals whether the email address exists in the system (returns silently for
+ * unknown addresses) to prevent account enumeration.
+ */
+declare function requestPasswordReset(deps: PasswordResetDeps, email: string): Promise<void>;
+/**
+ * Validates the reset token and sets a new password.
+ *
+ * On success, bumps `authVersion` and revokes all existing sessions so outstanding
+ * refresh tokens are immediately invalidated.
+ */
+declare function resetPassword(deps: PasswordResetDeps, rawToken: string, newPassword: string): Promise<void>;
+//#endregion
+//#region core/totp.d.ts
+/** Encodes a Buffer to a base32 string (no padding). */
+declare function base32Encode(buffer: Buffer): string;
+/** Decodes a base32 string (case-insensitive, padding stripped) to a Buffer. */
+declare function base32Decode(encoded: string): Buffer;
+/**
+ * Generates a 160-bit random TOTP secret and returns it base32-encoded.
+ * 160 bits (20 bytes) aligns with the SHA-1 block size and is standard for TOTP.
+ */
+declare function generateTotpSecret(): string;
+/**
+ * Generates the current TOTP code for the given base32 secret (RFC 6238).
+ */
+declare function generateTotp(secretBase32: string, now?: Date): string;
+/**
+ * Verifies a 6-digit TOTP code.
+ * Accepts codes from the previous, current, or next time step (±1 window) to
+ * tolerate clock skew between server and authenticator app.
+ */
+declare function verifyTotp(code: string, secretBase32: string, now?: Date): boolean;
+/**
+ * Builds an `otpauth://totp/` URI suitable for QR code scanning in authenticator apps
+ * (Google Authenticator, Authy, 1Password, etc.).
+ */
+declare function buildOtpAuthUri(params: {
+  secret: string;
+  accountName: string;
+  issuer: string;
+}): string;
+//#endregion
+//#region core/two-factor.d.ts
+/** Raised when a TOTP code is absent or incorrect. */
+declare class TwoFactorError extends IdentityError {
+  constructor(message?: string);
+}
+/**
+ * Raised during login when the user has 2FA enabled and the TOTP challenge has not yet
+ * been completed. HTTP 403 signals "authenticated but additional factor required".
+ */
+declare class TwoFactorRequiredError extends IdentityError {
+  constructor();
+}
+interface TwoFactorDeps extends SessionDeps {
+  audit: AuditLogger;
+}
+/**
+ * Begins the 2FA setup flow. Generates a new TOTP secret (stored as pending, not yet
+ * active) and returns the secret + QR URI for display in an authenticator app.
+ *
+ * The caller must then call {@link enable2FA} with a valid TOTP code to activate 2FA.
+ */
+declare function setup2FA(deps: TwoFactorDeps, userId: string): Promise<TotpSetupResult>;
+/**
+ * Confirms and enables 2FA. A valid TOTP code from the authenticator app is required.
+ * Idempotent when 2FA is already enabled for the user.
+ */
+declare function enable2FA(deps: TwoFactorDeps, userId: string, totpCode: string): Promise<void>;
+/**
+ * Disables 2FA for the user. Requires a valid TOTP code as confirmation.
+ * After disabling, login flows no longer issue MFA challenges for the account.
+ */
+declare function disable2FA(deps: TwoFactorDeps, userId: string, totpCode: string): Promise<void>;
+/**
+ * Issues a short-lived signed JWT that encodes a pending MFA session.
+ * The client must present this token together with a TOTP code to complete login.
+ */
+declare function issueMfaChallengeToken(config: IdentityConfig, userId: string): Promise<string>;
+/**
+ * Verifies an MFA challenge token and TOTP code, then issues a full auth session.
+ *
+ * Throws {@link InvalidTokenError} for an expired/invalid challenge token and
+ * {@link TwoFactorError} for a wrong TOTP code.
+ */
+declare function verifyMfaChallenge(deps: TwoFactorDeps, mfaToken: string, totpCode: string): Promise<AuthResult>;
+//#endregion
+//#region core/account-admin.d.ts
+/** Raised when the target user does not exist. */
+declare class AccountAdminError extends IdentityError {
+  constructor(message: string);
+}
+interface AccountAdminDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  audit: AuditLogger;
+}
+/**
+ * Locks a user account. Sets `status` to `"locked"` and immediately revokes all active
+ * sessions so existing refresh tokens stop working.
+ *
+ * Typically called by an admin. The `AccountUnavailableError` is thrown during any
+ * subsequent login or token verification attempt for the account.
+ */
+declare function lockAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+/**
+ * Unlocks a user account. Resets `status` to `"active"` and clears any stale lockout
+ * counters so the user can log in immediately.
+ */
+declare function unlockAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+/**
+ * Disables a user account. Sets `status` to `"disabled"` and revokes all sessions.
+ * Unlike `lockAccount`, disabled accounts are not automatically unlockable by the
+ * lockout timer — an explicit call to `unlockAccount` is required.
+ */
+declare function disableAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+//#endregion
+export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyEmail, verifyMfaChallenge, verifyTotp };
+//# sourceMappingURL=node.d.cts.map

package/dist/node.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.cts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;AAYA;;;;iBAAgB,YAAA,CACd,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA;;;;;iBAYS,mBAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA,GACV,OAAA;;;;;iBAwBmB,YAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,GACL,OAAA;;;;UClDc,WAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,YAAA,EAAc,YAAA;EACd,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,cAAA,CACpB,IAAA,EAAM,WAAA,EACN,cAAA,WACC,OAAA,CAAQ,UAAA;;iBAoDW,aAAA,CACpB,IAAA,EAAM,IAAA,CAAK,WAAA,kDACX,cAAA,WACC,OAAA;;;;UCjDc,iBAAA;EFjBf;EEmBA,QAAA;EFnBe;AAYjB;;;EEYE,YAAA;EFVM;;;EEcN,MAAA;AAAA;;;;;;;;;;iBA+Bc,yBAAA,CAA0B,MAAA,EAAQ,iBAAA,GAAoB,aAAa;;;;UC3ClE,oBAAA;EHJK;EGMpB,QAAA;;;;;EAKA,YAAA;EHNC;;;;;EGYD,QAAA;EHfA;;;;EGoBA,MAAA;AAAA;;AHjBQ;AAwBV;;;;;;;iBGwBgB,4BAAA,CAA6B,MAAA,EAAQ,oBAAA,GAAuB,aAAa;;;;cCrE5E,sBAAA,SAA+B,aAAa;cAC3C,OAAA;AAAA;AAAA,UAKG,qBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,wBAAA,CACpB,IAAA,EAAM,qBAAA,EACN,MAAA,WACC,OAAO;;AJjBO;AAYjB;;;iBIsCsB,WAAA,CACpB,IAAA,EAAM,qBAAA,EACN,QAAA,WACC,OAAO;;;;cCrDG,kBAAA,SAA2B,aAAa;cACvC,OAAA;AAAA;AAAA,UAKG,iBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,oBAAA,CACpB,IAAA,EAAM,iBAAA,EACN,KAAA,WACC,OAAO;ALVV;;;;;;AAAA,iBKgDsB,aAAA,CACpB,IAAA,EAAM,iBAAA,EACN,QAAA,UACA,WAAA,WACC,OAAO;;;;iBCtEM,YAAA,CAAa,MAAc,EAAN,MAAM;;iBAoB3B,YAAA,CAAa,OAAA,WAAkB,MAAM;;;ANjBrD;;iBMiEgB,kBAAA,CAAA;;;;iBAOA,YAAA,CAAa,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;;;;iBAUzD,UAAA,CAAW,IAAA,UAAc,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;AN/EpE;AAYjB;iBM6EgB,eAAA,CAAgB,MAAA;EAC9B,MAAA;EACA,WAAA;EACA,MAAA;AAAA;;;;cC5FW,cAAA,SAAuB,aAAa;cACnC,OAAA;AAAA;;;;;cASD,sBAAA,SAA+B,aAAa;EAAb,WAAA,CAAA;AAAA;AAAA,UAU3B,aAAA,SAAsB,WAAW;EAChD,KAAA,EAAO,WAAA;AAAA;;;APrBQ;AAYjB;;;iBOsBsB,QAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,WACC,OAAA,CAAQ,eAAA;;;;;iBAoCW,SAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA2BY,UAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA6BY,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,MAAA,WACC,OAAO;;AP3HA;AAwBV;;;;iBOwHsB,kBAAA,CACpB,IAAA,EAAM,aAAA,EACN,QAAA,UACA,QAAA,WACC,OAAA,CAAQ,UAAA;;;;cC9KE,iBAAA,SAA0B,aAAa;cACtC,OAAA;AAAA;AAAA,UAKG,gBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,WAAA,CAAY,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;ARVjE;AAYjB;;;AAZiB,iBQ2BK,aAAA,CAAc,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;;;;;;iBAoB9D,cAAA,CAAe,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO"}

package/dist/node.d.mts

@@ -0,0 +1,260 @@
+import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-BGMwaW5s.mjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-B9zrvE9z.mjs";
+import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
+
+//#region core/lockout.d.ts
+/**
+ * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}
+ * when the lockout is active (i.e. `lockedUntil` is in the future).
+ *
+ * Note: if `lockedUntil` is in the past the lock has expired — the user may proceed and
+ * the stale lock will be cleared on successful login.
+ */
+declare function checkLockout(user: IdentityUser, config: LockoutConfig, now: () => Date): void;
+/**
+ * Records a failed login attempt. When the threshold is reached the account is locked
+ * for `config.durationSeconds` seconds (or permanently when `durationSeconds` is 0).
+ */
+declare function recordFailedAttempt(store: IdentityStore, user: IdentityUser, config: LockoutConfig, now: () => Date): Promise<void>;
+/**
+ * Clears lockout state after a successful login. Resets the failure counter and any
+ * active lockout so the account returns to `active` status.
+ */
+declare function clearLockout(store: IdentityStore, user: IdentityUser): Promise<void>;
+//#endregion
+//#region core/refresh-service.d.ts
+/** Dependencies for the refresh flow. */
+interface RefreshDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  tokenService: TokenService;
+  audit: AuditLogger;
+}
+/**
+ * Rotates a refresh session: validates the presented refresh token against the stored
+ * hash, issues a new access token, and replaces the stored refresh-token hash.
+ *
+ * Detects refresh-token reuse (a token whose session exists but whose hash no longer
+ * matches) and revokes the session as a precaution.
+ */
+declare function refreshSession(deps: RefreshDeps, presentedToken: string): Promise<AuthResult>;
+/** Revokes a single session (logout). */
+declare function revokeSession(deps: Pick<RefreshDeps, "config" | "store" | "tokenService" | "audit">, presentedToken: string): Promise<void>;
+//#endregion
+//#region core/oauth/providers/google.d.ts
+/** Configuration for {@link createGoogleOAuthProvider}. */
+interface GoogleOAuthConfig {
+  /** OAuth 2.0 Client ID from Google Cloud Console. */
+  clientId: string;
+  /**
+   * OAuth 2.0 Client Secret. Must be kept server-side — never expose in client code or
+   * commit to source control.
+   */
+  clientSecret: string;
+  /**
+   * Override the default OpenID Connect scopes. Defaults to `["openid", "email", "profile"]`.
+   */
+  scopes?: string[];
+}
+/**
+ * Creates an {@link OAuthProvider} configured for Google OAuth 2.0 / OpenID Connect.
+ *
+ * Security notes:
+ * - The client secret is used only during server-side code exchange.
+ * - The userinfo endpoint is called with the access token to fetch user data, providing
+ *   a verified source of truth over the network (HTTPS).
+ * - The `state` parameter is required and must be verified by the caller to prevent CSRF.
+ */
+declare function createGoogleOAuthProvider(config: GoogleOAuthConfig): OAuthProvider;
+//#endregion
+//#region core/oauth/providers/microsoft.d.ts
+/** Configuration for {@link createMicrosoftOAuthProvider}. */
+interface MicrosoftOAuthConfig {
+  /** Application (client) ID from the Azure / Entra app registration. */
+  clientId: string;
+  /**
+   * Client secret from the Azure / Entra app registration. Must be kept server-side —
+   * never expose in client code or commit to source control.
+   */
+  clientSecret: string;
+  /**
+   * Tenant identifier. Use `"common"` (default) to accept personal and work/school
+   * accounts, `"organizations"` for work/school only, `"consumers"` for personal
+   * accounts only, or your specific tenant GUID / domain.
+   */
+  tenantId?: string;
+  /**
+   * Override the default Microsoft Graph scopes. Defaults to
+   * `["openid", "email", "profile", "User.Read"]`.
+   */
+  scopes?: string[];
+}
+/**
+ * Creates an {@link OAuthProvider} configured for Microsoft Entra ID OAuth 2.0 / OIDC.
+ *
+ * Security notes:
+ * - The client secret is used only during server-side code exchange.
+ * - User data is fetched from the Microsoft Graph API using the access token, providing
+ *   a verified source of truth over HTTPS.
+ * - The `state` parameter is required and must be verified by the caller to prevent CSRF.
+ */
+declare function createMicrosoftOAuthProvider(config: MicrosoftOAuthConfig): OAuthProvider;
+//#endregion
+//#region core/email-verification.d.ts
+/** Raised when an email verification token is missing, expired, or already used. */
+declare class EmailVerificationError extends IdentityError {
+  constructor(message?: string);
+}
+interface EmailVerificationDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  audit: AuditLogger;
+}
+/**
+ * Generates and persists a verification token, then calls the notification service.
+ *
+ * Safe to call after registration or when the user explicitly requests a resend.
+ * Returns silently when the email is already verified.
+ */
+declare function requestEmailVerification(deps: EmailVerificationDeps, userId: string): Promise<void>;
+/**
+ * Verifies the user's email address using the token from the verification link.
+ *
+ * Throws {@link EmailVerificationError} for unknown, expired, or already-used tokens.
+ */
+declare function verifyEmail(deps: EmailVerificationDeps, rawToken: string): Promise<void>;
+//#endregion
+//#region core/password-reset.d.ts
+/** Raised when a password reset token is missing, expired, or already used. */
+declare class PasswordResetError extends IdentityError {
+  constructor(message?: string);
+}
+interface PasswordResetDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  hasher: PasswordHasher;
+  audit: AuditLogger;
+}
+/**
+ * Generates a password reset token and dispatches the notification.
+ *
+ * Never reveals whether the email address exists in the system (returns silently for
+ * unknown addresses) to prevent account enumeration.
+ */
+declare function requestPasswordReset(deps: PasswordResetDeps, email: string): Promise<void>;
+/**
+ * Validates the reset token and sets a new password.
+ *
+ * On success, bumps `authVersion` and revokes all existing sessions so outstanding
+ * refresh tokens are immediately invalidated.
+ */
+declare function resetPassword(deps: PasswordResetDeps, rawToken: string, newPassword: string): Promise<void>;
+//#endregion
+//#region core/totp.d.ts
+/** Encodes a Buffer to a base32 string (no padding). */
+declare function base32Encode(buffer: Buffer): string;
+/** Decodes a base32 string (case-insensitive, padding stripped) to a Buffer. */
+declare function base32Decode(encoded: string): Buffer;
+/**
+ * Generates a 160-bit random TOTP secret and returns it base32-encoded.
+ * 160 bits (20 bytes) aligns with the SHA-1 block size and is standard for TOTP.
+ */
+declare function generateTotpSecret(): string;
+/**
+ * Generates the current TOTP code for the given base32 secret (RFC 6238).
+ */
+declare function generateTotp(secretBase32: string, now?: Date): string;
+/**
+ * Verifies a 6-digit TOTP code.
+ * Accepts codes from the previous, current, or next time step (±1 window) to
+ * tolerate clock skew between server and authenticator app.
+ */
+declare function verifyTotp(code: string, secretBase32: string, now?: Date): boolean;
+/**
+ * Builds an `otpauth://totp/` URI suitable for QR code scanning in authenticator apps
+ * (Google Authenticator, Authy, 1Password, etc.).
+ */
+declare function buildOtpAuthUri(params: {
+  secret: string;
+  accountName: string;
+  issuer: string;
+}): string;
+//#endregion
+//#region core/two-factor.d.ts
+/** Raised when a TOTP code is absent or incorrect. */
+declare class TwoFactorError extends IdentityError {
+  constructor(message?: string);
+}
+/**
+ * Raised during login when the user has 2FA enabled and the TOTP challenge has not yet
+ * been completed. HTTP 403 signals "authenticated but additional factor required".
+ */
+declare class TwoFactorRequiredError extends IdentityError {
+  constructor();
+}
+interface TwoFactorDeps extends SessionDeps {
+  audit: AuditLogger;
+}
+/**
+ * Begins the 2FA setup flow. Generates a new TOTP secret (stored as pending, not yet
+ * active) and returns the secret + QR URI for display in an authenticator app.
+ *
+ * The caller must then call {@link enable2FA} with a valid TOTP code to activate 2FA.
+ */
+declare function setup2FA(deps: TwoFactorDeps, userId: string): Promise<TotpSetupResult>;
+/**
+ * Confirms and enables 2FA. A valid TOTP code from the authenticator app is required.
+ * Idempotent when 2FA is already enabled for the user.
+ */
+declare function enable2FA(deps: TwoFactorDeps, userId: string, totpCode: string): Promise<void>;
+/**
+ * Disables 2FA for the user. Requires a valid TOTP code as confirmation.
+ * After disabling, login flows no longer issue MFA challenges for the account.
+ */
+declare function disable2FA(deps: TwoFactorDeps, userId: string, totpCode: string): Promise<void>;
+/**
+ * Issues a short-lived signed JWT that encodes a pending MFA session.
+ * The client must present this token together with a TOTP code to complete login.
+ */
+declare function issueMfaChallengeToken(config: IdentityConfig, userId: string): Promise<string>;
+/**
+ * Verifies an MFA challenge token and TOTP code, then issues a full auth session.
+ *
+ * Throws {@link InvalidTokenError} for an expired/invalid challenge token and
+ * {@link TwoFactorError} for a wrong TOTP code.
+ */
+declare function verifyMfaChallenge(deps: TwoFactorDeps, mfaToken: string, totpCode: string): Promise<AuthResult>;
+//#endregion
+//#region core/account-admin.d.ts
+/** Raised when the target user does not exist. */
+declare class AccountAdminError extends IdentityError {
+  constructor(message: string);
+}
+interface AccountAdminDeps {
+  config: IdentityConfig;
+  store: IdentityStore;
+  audit: AuditLogger;
+}
+/**
+ * Locks a user account. Sets `status` to `"locked"` and immediately revokes all active
+ * sessions so existing refresh tokens stop working.
+ *
+ * Typically called by an admin. The `AccountUnavailableError` is thrown during any
+ * subsequent login or token verification attempt for the account.
+ */
+declare function lockAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+/**
+ * Unlocks a user account. Resets `status` to `"active"` and clears any stale lockout
+ * counters so the user can log in immediately.
+ */
+declare function unlockAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+/**
+ * Disables a user account. Sets `status` to `"disabled"` and revokes all sessions.
+ * Unlike `lockAccount`, disabled accounts are not automatically unlockable by the
+ * lockout timer — an explicit call to `unlockAccount` is required.
+ */
+declare function disableAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
+//#endregion
+export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyEmail, verifyMfaChallenge, verifyTotp };
+//# sourceMappingURL=node.d.mts.map

package/dist/node.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.mts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;AAYA;;;;iBAAgB,YAAA,CACd,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA;;;;;iBAYS,mBAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA,GACV,OAAA;;;;;iBAwBmB,YAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,GACL,OAAA;;;;UClDc,WAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,YAAA,EAAc,YAAA;EACd,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,cAAA,CACpB,IAAA,EAAM,WAAA,EACN,cAAA,WACC,OAAA,CAAQ,UAAA;;iBAoDW,aAAA,CACpB,IAAA,EAAM,IAAA,CAAK,WAAA,kDACX,cAAA,WACC,OAAA;;;;UCjDc,iBAAA;EFjBf;EEmBA,QAAA;EFnBe;AAYjB;;;EEYE,YAAA;EFVM;;;EEcN,MAAA;AAAA;;;;;;;;;;iBA+Bc,yBAAA,CAA0B,MAAA,EAAQ,iBAAA,GAAoB,aAAa;;;;UC3ClE,oBAAA;EHJK;EGMpB,QAAA;;;;;EAKA,YAAA;EHNC;;;;;EGYD,QAAA;EHfA;;;;EGoBA,MAAA;AAAA;;AHjBQ;AAwBV;;;;;;;iBGwBgB,4BAAA,CAA6B,MAAA,EAAQ,oBAAA,GAAuB,aAAa;;;;cCrE5E,sBAAA,SAA+B,aAAa;cAC3C,OAAA;AAAA;AAAA,UAKG,qBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,wBAAA,CACpB,IAAA,EAAM,qBAAA,EACN,MAAA,WACC,OAAO;;AJjBO;AAYjB;;;iBIsCsB,WAAA,CACpB,IAAA,EAAM,qBAAA,EACN,QAAA,WACC,OAAO;;;;cCrDG,kBAAA,SAA2B,aAAa;cACvC,OAAA;AAAA;AAAA,UAKG,iBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,oBAAA,CACpB,IAAA,EAAM,iBAAA,EACN,KAAA,WACC,OAAO;ALVV;;;;;;AAAA,iBKgDsB,aAAA,CACpB,IAAA,EAAM,iBAAA,EACN,QAAA,UACA,WAAA,WACC,OAAO;;;;iBCtEM,YAAA,CAAa,MAAc,EAAN,MAAM;;iBAoB3B,YAAA,CAAa,OAAA,WAAkB,MAAM;;;ANjBrD;;iBMiEgB,kBAAA,CAAA;;;;iBAOA,YAAA,CAAa,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;;;;iBAUzD,UAAA,CAAW,IAAA,UAAc,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;AN/EpE;AAYjB;iBM6EgB,eAAA,CAAgB,MAAA;EAC9B,MAAA;EACA,WAAA;EACA,MAAA;AAAA;;;;cC5FW,cAAA,SAAuB,aAAa;cACnC,OAAA;AAAA;;;;;cASD,sBAAA,SAA+B,aAAa;EAAb,WAAA,CAAA;AAAA;AAAA,UAU3B,aAAA,SAAsB,WAAW;EAChD,KAAA,EAAO,WAAA;AAAA;;;APrBQ;AAYjB;;;iBOsBsB,QAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,WACC,OAAA,CAAQ,eAAA;;;;;iBAoCW,SAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA2BY,UAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA6BY,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,MAAA,WACC,OAAO;;AP3HA;AAwBV;;;;iBOwHsB,kBAAA,CACpB,IAAA,EAAM,aAAA,EACN,QAAA,UACA,QAAA,WACC,OAAA,CAAQ,UAAA;;;;cC9KE,iBAAA,SAA0B,aAAa;cACtC,OAAA;AAAA;AAAA,UAKG,gBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,WAAA,CAAY,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;ARVjE;AAYjB;;;AAZiB,iBQ2BK,aAAA,CAAc,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;;;;;;iBAoB9D,cAAA,CAAe,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO"}