@azlib/identity 0.2.0

package/dist/identity-store-BRRahxcS.d.mts

@@ -0,0 +1,272 @@
+//#region core/types.d.ts
+/**
+ * Shared, framework-agnostic domain types for `@azlib/identity`.
+ *
+ * These types describe the persistence model and the runtime principal. They do not
+ * depend on Node, Express, or NestJS so they can be imported from any surface.
+ */
+/** Lifecycle status for an identity user. */
+type IdentityUserStatus = "active" | "disabled" | "locked";
+/** A persisted identity user record. */
+interface IdentityUser {
+  userId: string;
+  email: string;
+  displayName: string | null;
+  status: IdentityUserStatus;
+  emailVerifiedAt: Date | null;
+  /**
+   * Whether TOTP-based two-factor authentication is currently active for this account.
+   */
+  twoFactorEnabled: boolean;
+  /**
+   * Incremented to invalidate previously issued access/refresh tokens (for example on
+   * password change or forced logout). Tokens carry this value and are rejected on mismatch.
+   */
+  authVersion: number;
+  /**
+   * Consecutive failed login attempts since the last successful login. Reset to 0 on success.
+   * Used by the account lockout feature.
+   */
+  failedLoginAttempts: number;
+  /**
+   * When set, the account is temporarily locked until this time. The lockout feature sets
+   * this after the configured `maxFailedAttempts` threshold is exceeded.
+   */
+  lockedUntil: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+/** Stored password credential for a user. The plaintext password is never persisted. */
+interface CredentialRecord {
+  userId: string;
+  /** Opaque, algorithm-tagged password hash. */
+  passwordHash: string;
+  updatedAt: Date;
+}
+/**
+ * A server-side refresh session. The raw refresh token is returned to the client once;
+ * only its hash is stored so a database leak does not expose usable tokens.
+ */
+interface AuthSession {
+  sessionId: string;
+  userId: string;
+  /** Hash of the current refresh token. Rotated on every refresh. */
+  refreshTokenHash: string;
+  createdAt: Date;
+  expiresAt: Date;
+  /** Set when the session has been rotated or revoked; such sessions are unusable. */
+  revokedAt: Date | null;
+}
+/** A coarse permission string, e.g. `documents:read`. */
+type Permission = string;
+/** A role groups permissions for assignment to users. */
+interface Role {
+  roleId: string;
+  name: string;
+  description: string | null;
+}
+/** Assignment of a role to a user. */
+interface UserRoleAssignment {
+  userId: string;
+  roleId: string;
+}
+/** Grant of a permission to a role. */
+interface RolePermissionGrant {
+  roleId: string;
+  permission: Permission;
+}
+/** Direct grant of a permission to a user, bypassing roles. */
+interface DirectPermissionGrant {
+  userId: string;
+  permission: Permission;
+}
+/** Names of the supported identity event types for auditing. */
+type IdentityEventType = "user.registered" | "user.login.succeeded" | "user.login.failed" | "user.login.mfa.challenged" | "user.account.locked" | "user.account.unlocked" | "user.email.verification.requested" | "user.email.verified" | "user.password.reset.requested" | "user.password.reset.completed" | "user.2fa.setup.started" | "user.2fa.enabled" | "user.2fa.disabled" | "user.oauth.linked" | "session.refreshed" | "session.revoked" | "authorization.denied";
+/** A linked OAuth / OIDC identity from an external provider (Google, Microsoft, etc.). */
+interface OAuthLinkedAccount {
+  userId: string;
+  /** Provider identifier, e.g. `"google"` or `"microsoft"`. */
+  provider: string;
+  /** The user's stable id on the provider side (`sub` claim). */
+  providerUserId: string;
+  email: string | null;
+  displayName: string | null;
+  linkedAt: Date;
+}
+/** An audit event emitted by identity flows. */
+interface IdentityEvent {
+  type: IdentityEventType;
+  userId: string | null;
+  /** Free-form, non-sensitive metadata. Never include passwords or raw tokens. */
+  metadata: Record<string, string | number | boolean | null>;
+  occurredAt: Date;
+}
+/**
+ * The authenticated principal hydrated from the store after a token is verified.
+ * Attached to the request by the Express middleware / NestJS guard.
+ */
+interface AuthenticatedIdentity {
+  userId: string;
+  email: string;
+  displayName: string | null;
+  status: IdentityUserStatus;
+  emailVerified: boolean;
+  roles: readonly string[];
+  permissions: readonly Permission[];
+}
+/** A successful authentication result containing tokens and the principal. */
+interface AuthTokens {
+  accessToken: string;
+  refreshToken: string;
+  accessTokenExpiresAt: Date;
+  refreshTokenExpiresAt: Date;
+}
+/** Result returned by register/login flows. */
+interface AuthResult {
+  user: AuthenticatedIdentity;
+  tokens: AuthTokens;
+}
+/**
+ * Returned by `login` when the user has 2FA enabled and the TOTP code has not yet
+ * been verified. The client must call `verifyMfaChallenge` to complete the login.
+ */
+interface MfaRequiredResult {
+  kind: "mfa_required";
+  /** Short-lived signed token identifying the pending MFA session. */
+  mfaToken: string;
+}
+/** Union return type for the login flow — either a full session or an MFA challenge. */
+type LoginResult = AuthResult | MfaRequiredResult;
+/** Token type for email verification or password reset links. */
+type VerificationTokenType = "email_verification" | "password_reset";
+/** A short-lived opaque token stored by hash, used for email verification and password reset. */
+interface VerificationToken {
+  /** SHA-256 hash of the raw token (stored; raw token is sent to the user). */
+  tokenHash: string;
+  userId: string;
+  type: VerificationTokenType;
+  expiresAt: Date;
+  /** Set when the token has been consumed; consumed tokens cannot be reused. */
+  usedAt: Date | null;
+}
+/** Persisted TOTP secret for a user. */
+interface TotpSecret {
+  userId: string;
+  /** Base32-encoded TOTP secret key. */
+  secretBase32: string;
+  /** Set once the user has confirmed the TOTP code after setup. */
+  enabledAt: Date | null;
+  createdAt: Date;
+}
+/** Returned by the 2FA setup flow. Display the QR code / secret to the user. */
+interface TotpSetupResult {
+  /** Base32-encoded secret to show to the user (or encode as a QR code). */
+  secret: string;
+  /** OTP Auth URI suitable for QR code display in authenticator apps. */
+  otpAuthUri: string;
+}
+/** Verified access-token claims. */
+interface AccessTokenClaims {
+  /** Subject — the user id. */
+  sub: string;
+  /** Auth version the token was minted against. */
+  authVersion: number;
+  /** Issued-at (seconds since epoch). */
+  iat: number;
+  /** Expiry (seconds since epoch). */
+  exp: number;
+}
+//#endregion
+//#region core/verification-token.d.ts
+/** Input for persisting a new verification token. */
+interface CreateVerificationTokenInput {
+  /** SHA-256 hash of the raw token (never store the raw token). */
+  tokenHash: string;
+  userId: string;
+  type: VerificationTokenType;
+  expiresAt: Date;
+}
+/**
+ * Generates a cryptographically random opaque token and its SHA-256 hash.
+ * Returns both: the raw token is sent to the user; only the hash is persisted.
+ */
+declare function generateVerificationToken(): {
+  token: string;
+  tokenHash: string;
+};
+/** Hashes a token presented by the user for secure lookup against stored hashes. */
+declare function hashVerificationToken(token: string): string;
+//#endregion
+//#region core/identity-store.d.ts
+/** Fields required to create a new user (ids/timestamps are assigned by the service). */
+interface CreateIdentityUserInput {
+  userId: string;
+  email: string;
+  displayName: string | null;
+  status: IdentityUser["status"];
+  authVersion: number;
+  createdAt: Date;
+  updatedAt: Date;
+}
+/** Fields required to create a new refresh session. */
+interface CreateAuthSessionInput {
+  sessionId: string;
+  userId: string;
+  refreshTokenHash: string;
+  createdAt: Date;
+  expiresAt: Date;
+}
+/**
+ * Storage contract for `@azlib/identity`. Implement this against your own database
+ * engine (Postgres, MySQL, SQLite, Prisma, etc.). The package ships predefined schema
+ * artifacts under `@azlib/identity/schema/*` you can apply directly.
+ *
+ * Implementations must treat email lookups as case-insensitive and enforce uniqueness
+ * on email. All methods may be async.
+ */
+interface IdentityStore {
+  findUserByEmail(email: string): Promise<IdentityUser | null>;
+  findUserById(userId: string): Promise<IdentityUser | null>;
+  createUser(input: CreateIdentityUserInput): Promise<IdentityUser>;
+  updateUser(userId: string, patch: Partial<Pick<IdentityUser, "displayName" | "status" | "emailVerifiedAt" | "twoFactorEnabled" | "authVersion" | "failedLoginAttempts" | "lockedUntil">>): Promise<IdentityUser>;
+  findCredential(userId: string): Promise<CredentialRecord | null>;
+  upsertCredential(record: CredentialRecord): Promise<void>;
+  createSession(input: CreateAuthSessionInput): Promise<AuthSession>;
+  findSessionById(sessionId: string): Promise<AuthSession | null>;
+  /** Marks a session revoked (used during rotation and logout). */
+  revokeSession(sessionId: string, revokedAt: Date): Promise<void>;
+  /** Replaces the stored refresh-token hash for a session during rotation. */
+  rotateSession(sessionId: string, refreshTokenHash: string, expiresAt: Date): Promise<void>;
+  /** Revokes every active session for a user (e.g. password change / global logout). */
+  revokeAllSessions(userId: string, revokedAt: Date): Promise<void>;
+  listRolesForUser(userId: string): Promise<readonly Role[]>;
+  listPermissionsForUser(userId: string): Promise<readonly Permission[]>;
+  assignRole(assignment: UserRoleAssignment): Promise<void>;
+  grantRolePermission(grant: RolePermissionGrant): Promise<void>;
+  grantDirectPermission(grant: DirectPermissionGrant): Promise<void>;
+  /** Persists a new short-lived verification/reset token (stored as hash). */
+  createVerificationToken?(input: CreateVerificationTokenInput): Promise<void>;
+  /** Looks up a stored token by its SHA-256 hash. */
+  findVerificationToken?(tokenHash: string): Promise<VerificationToken | null>;
+  /** Marks a token as consumed so it cannot be reused. */
+  markVerificationTokenUsed?(tokenHash: string, usedAt: Date): Promise<void>;
+  /** Returns the pending or active TOTP secret for a user, or null if none. */
+  findTotpSecret?(userId: string): Promise<TotpSecret | null>;
+  /** Creates or replaces the TOTP secret for a user. */
+  upsertTotpSecret?(record: TotpSecret): Promise<void>;
+  /** Removes the TOTP secret, effectively disabling 2FA at the storage layer. */
+  deleteTotpSecret?(userId: string): Promise<void>;
+  recordEvent?(event: IdentityEvent): Promise<void>;
+  /**
+   * Finds the local user linked to a provider + provider user id. Returns null when
+   * no OAuth link exists yet.
+   */
+  findUserByOAuthId?(provider: string, providerUserId: string): Promise<IdentityUser | null>;
+  /** Persists a new OAuth link between a local user and their provider identity. */
+  createOAuthLink?(link: OAuthLinkedAccount): Promise<void>;
+  /** Lists all provider links for a user. */
+  listOAuthLinks?(userId: string): Promise<readonly OAuthLinkedAccount[]>;
+}
+//#endregion
+export { RolePermissionGrant as C, VerificationToken as D, UserRoleAssignment as E, VerificationTokenType as O, Role as S, TotpSetupResult as T, IdentityUserStatus as _, generateVerificationToken as a, OAuthLinkedAccount as b, AuthResult as c, AuthenticatedIdentity as d, CredentialRecord as f, IdentityUser as g, IdentityEventType as h, CreateVerificationTokenInput as i, AuthSession as l, IdentityEvent as m, CreateIdentityUserInput as n, hashVerificationToken as o, DirectPermissionGrant as p, IdentityStore as r, AccessTokenClaims as s, CreateAuthSessionInput as t, AuthTokens as u, LoginResult as v, TotpSecret as w, Permission as x, MfaRequiredResult as y };
+//# sourceMappingURL=identity-store-BRRahxcS.d.mts.map

package/dist/identity-store-BRRahxcS.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-store-BRRahxcS.d.mts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;AAQA;;;;AAA8B;AAG9B;AAAA,KAHY,kBAAA;;UAGK,YAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,eAAA,EAAiB,IAAA;EAqBF;;;EAjBf,gBAAA;EALA;;;;EAUA,WAAA;EAAA;;;;EAKA,mBAAA;EAMW;;;;EADX,WAAA,EAAa,IAAA;EACb,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,gBAAA;EACf,MAAA;EAGA;EADA,YAAA;EACA,SAAA,EAAW,IAAI;AAAA;AAOjB;;;;AAAA,UAAiB,WAAA;EACf,SAAA;EACA,MAAA;EAMe;EAJf,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;EADX;EAGA,SAAA,EAAW,IAAA;AAAA;;KAID,UAAA;;UAGK,IAAA;EACf,MAAA;EACA,IAAA;EACA,WAAA;AAAA;;UAIe,kBAAA;EACf,MAAA;EACA,MAAM;AAAA;;UAIS,mBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZX;AAAA,UAgBI,qBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZhB;AAAA,KAgBI,iBAAA;;UAoBK,kBAAA;EACf,MAAA;EAhCA;EAkCA,QAAA;EAjCY;EAmCZ,cAAA;EACA,KAAA;EACA,WAAA;EACA,QAAA,EAAU,IAAI;AAAA;;UAIC,aAAA;EACf,IAAA,EAAM,iBAAA;EACN,MAAA;EAtCsB;EAwCtB,QAAA,EAAU,MAAA;EACV,UAAA,EAAY,IAAA;AAAA;;;AArCe;AAoB7B;UAwBiB,qBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,aAAA;EACA,KAAA;EACA,WAAA,WAAsB,UAAU;AAAA;;UAIjB,UAAA;EACf,WAAA;EACA,YAAA;EACA,oBAAA,EAAsB,IAAA;EACtB,qBAAA,EAAuB,IAAI;AAAA;;UAIZ,UAAA;EACf,IAAA,EAAM,qBAAA;EACN,MAAA,EAAQ,UAAU;AAAA;;;;;UAOH,iBAAA;EACf,IAAA;EApCgB;EAsChB,QAAQ;AAAA;;KAIE,WAAA,GAAc,UAAA,GAAa,iBAAiB;;KAG5C,qBAAA;;UAGK,iBAAA;EArCf;EAuCA,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAA;EAvCW;EAyCtB,MAAA,EAAQ,IAAA;AAAA;AArCV;AAAA,UAyCiB,UAAA;EACf,MAAA;EAtC2B;EAwC3B,YAAA;EA1CA;EA4CA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;UAIA,eAAA;EA/CY;EAiD3B,MAAA;EA7CyB;EA+CzB,UAAU;AAAA;;UAIK,iBAAA;EAjDf;EAmDA,GAAA;EAnDkB;EAqDlB,WAAA;EA9Ce;EAgDf,GAAA;;EAEA,GAAA;AAAA;;;;UC/Me,4BAAA;EDCa;ECC5B,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAI;AAAA;;;;;iBAOD,yBAAA,CAAA;EAA+B,KAAA;EAAe,SAAS;AAAA;;iBAOvD,qBAAA,CAAsB,KAAa;;;;UCTlC,uBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,YAAA;EACR,WAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,sBAAA;EACf,SAAA;EACA,MAAA;EACA,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;;;;;;;;UAWA,aAAA;EAEf,eAAA,CAAgB,KAAA,WAAgB,OAAA,CAAQ,YAAA;EACxC,YAAA,CAAa,MAAA,WAAiB,OAAA,CAAQ,YAAA;EACtC,UAAA,CAAW,KAAA,EAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;EACpD,UAAA,CACE,MAAA,UACA,KAAA,EAAO,OAAA,CACL,IAAA,CACE,YAAA,gIAUH,OAAA,CAAQ,YAAA;EAEX,cAAA,CAAe,MAAA,WAAiB,OAAA,CAAQ,gBAAA;EACxC,gBAAA,CAAiB,MAAA,EAAQ,gBAAA,GAAmB,OAAA;EAG5C,aAAA,CAAc,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,WAAA;EACtD,eAAA,CAAgB,SAAA,WAAoB,OAAA,CAAQ,WAAA;EFzB7B;EE2Bf,aAAA,CAAc,SAAA,UAAmB,SAAA,EAAW,IAAA,GAAO,OAAA;EF5BnD;EE8BA,aAAA,CAAc,SAAA,UAAmB,gBAAA,UAA0B,SAAA,EAAW,IAAA,GAAO,OAAA;EF7BlE;EE+BX,iBAAA,CAAkB,MAAA,UAAgB,SAAA,EAAW,IAAA,GAAO,OAAA;EAGpD,gBAAA,CAAiB,MAAA,WAAiB,OAAA,UAAiB,IAAA;EACnD,sBAAA,CAAuB,MAAA,WAAiB,OAAA,UAAiB,UAAA;EACzD,UAAA,CAAW,UAAA,EAAY,kBAAA,GAAqB,OAAA;EAC5C,mBAAA,CAAoB,KAAA,EAAO,mBAAA,GAAsB,OAAA;EACjD,qBAAA,CAAsB,KAAA,EAAO,qBAAA,GAAwB,OAAA;EFzB1C;EE6BX,uBAAA,EAAyB,KAAA,EAAO,4BAAA,GAA+B,OAAA;EF3BhD;EE6Bf,qBAAA,EAAuB,SAAA,WAAoB,OAAA,CAAQ,iBAAA;EFpCnD;EEsCA,yBAAA,EAA2B,SAAA,UAAmB,MAAA,EAAQ,IAAA,GAAO,OAAA;EFnC7D;EEuCA,cAAA,EAAgB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EFtC9B;EEwCX,gBAAA,EAAkB,MAAA,EAAQ,UAAA,GAAa,OAAA;EFvC5B;EEyCX,gBAAA,EAAkB,MAAA,WAAiB,OAAA;EAGnC,WAAA,EAAa,KAAA,EAAO,aAAA,GAAgB,OAAA;EF1CrB;AAAA;AAIjB;;EE6CE,iBAAA,EAAmB,QAAA,UAAkB,cAAA,WAAyB,OAAA,CAAQ,YAAA;EF7ClD;EE+CpB,eAAA,EAAiB,IAAA,EAAM,kBAAA,GAAqB,OAAA;EF5C7B;EE8Cf,cAAA,EAAgB,MAAA,WAAiB,OAAA,UAAiB,kBAAA;AAAA"}

package/dist/index-CpufYgyn.d.cts

@@ -0,0 +1,30 @@
+//#region schema/model.d.ts
+/**
+ * Logical description of the relational schema `@azlib/identity` expects.
+ *
+ * Concrete DDL is shipped alongside this module:
+ * - `@azlib/identity/schema/postgres.sql`
+ * - `@azlib/identity/schema/mysql.sql`
+ * - `@azlib/identity/schema/sqlite.sql`
+ * - `@azlib/identity/schema/prisma.schema`
+ *
+ * This object is documentation-as-data so consumers and tooling can introspect the
+ * expected tables without parsing SQL.
+ */
+interface SchemaColumn {
+  name: string;
+  description: string;
+  nullable: boolean;
+}
+interface SchemaTable {
+  name: string;
+  description: string;
+  columns: readonly SchemaColumn[];
+}
+interface SchemaModel {
+  tables: readonly SchemaTable[];
+}
+declare const identitySchemaModel: SchemaModel;
+//#endregion
+export { identitySchemaModel as t };
+//# sourceMappingURL=index-CpufYgyn.d.cts.map

package/dist/index-CpufYgyn.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CpufYgyn.d.cts","names":[],"sources":["../schema/model.ts"],"mappings":";;AAYA;;;;;;;;AAGU;AAGV;;UANiB,YAAA;EACf,IAAA;EACA,WAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;EACf,IAAA;EACA,WAAA;EACA,OAAA,WAAkB,YAAY;AAAA;AAAA,UAGf,WAAA;EACf,MAAA,WAAiB,WAAW;AAAA;AAAA,cAGjB,mBAAA,EAAqB,WAuEjC"}

package/dist/index-CpufYgyn.d.mts

@@ -0,0 +1,30 @@
+//#region schema/model.d.ts
+/**
+ * Logical description of the relational schema `@azlib/identity` expects.
+ *
+ * Concrete DDL is shipped alongside this module:
+ * - `@azlib/identity/schema/postgres.sql`
+ * - `@azlib/identity/schema/mysql.sql`
+ * - `@azlib/identity/schema/sqlite.sql`
+ * - `@azlib/identity/schema/prisma.schema`
+ *
+ * This object is documentation-as-data so consumers and tooling can introspect the
+ * expected tables without parsing SQL.
+ */
+interface SchemaColumn {
+  name: string;
+  description: string;
+  nullable: boolean;
+}
+interface SchemaTable {
+  name: string;
+  description: string;
+  columns: readonly SchemaColumn[];
+}
+interface SchemaModel {
+  tables: readonly SchemaTable[];
+}
+declare const identitySchemaModel: SchemaModel;
+//#endregion
+export { identitySchemaModel as t };
+//# sourceMappingURL=index-CpufYgyn.d.mts.map

package/dist/index-CpufYgyn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CpufYgyn.d.mts","names":[],"sources":["../schema/model.ts"],"mappings":";;AAYA;;;;;;;;AAGU;AAGV;;UANiB,YAAA;EACf,IAAA;EACA,WAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;EACf,IAAA;EACA,WAAA;EACA,OAAA,WAAkB,YAAY;AAAA;AAAA,UAGf,WAAA;EACf,MAAA,WAAiB,WAAW;AAAA;AAAA,cAGjB,mBAAA,EAAqB,WAuEjC"}

package/dist/index.cjs

@@ -0,0 +1,18 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-Bcjx9o6g.cjs");
+const require_identity = require("./identity-4eP45YIP.cjs");
+exports.AccountUnavailableError = require_errors.AccountUnavailableError;
+exports.EmailAlreadyRegisteredError = require_errors.EmailAlreadyRegisteredError;
+exports.ForbiddenError = require_errors.ForbiddenError;
+exports.IdentityConfigError = require_errors.IdentityConfigError;
+exports.IdentityError = require_errors.IdentityError;
+exports.InvalidCredentialsError = require_errors.InvalidCredentialsError;
+exports.InvalidTokenError = require_errors.InvalidTokenError;
+exports.OAuthProviderNotFoundError = require_identity.OAuthProviderNotFoundError;
+exports.OAuthStateMismatchError = require_identity.OAuthStateMismatchError;
+exports.UnauthenticatedError = require_errors.UnauthenticatedError;
+exports.createOAuthService = require_identity.createOAuthService;
+exports.evaluateAuthorization = require_identity.evaluateAuthorization;
+exports.identitySchemaModel = require_identity.identitySchemaModel;
+exports.isAuthorized = require_identity.isAuthorized;
+exports.resolveIdentityConfig = require_identity.resolveIdentityConfig;

package/dist/index.d.cts

@@ -0,0 +1,4 @@
+import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-C2xZAatu.cjs";
+import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
+export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };

package/dist/index.d.mts

@@ -0,0 +1,4 @@
+import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-BGMwaW5s.mjs";
+import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
+export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };

package/dist/index.mjs

@@ -0,0 +1,3 @@
+import { a as IdentityError, c as UnauthenticatedError, i as IdentityConfigError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError } from "./errors-CEmnZxIn.mjs";
+import { c as isAuthorized, i as createOAuthService, l as resolveIdentityConfig, n as OAuthProviderNotFoundError, r as OAuthStateMismatchError, s as evaluateAuthorization, t as identitySchemaModel } from "./identity-Bz9RDOvT.mjs";
+export { AccountUnavailableError, EmailAlreadyRegisteredError, ForbiddenError, IdentityConfigError, IdentityError, InvalidCredentialsError, InvalidTokenError, OAuthProviderNotFoundError, OAuthStateMismatchError, UnauthenticatedError, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };

package/dist/logger-Be1wDzBC.cjs

@@ -0,0 +1,48 @@
+//#region core/logger.ts
+/**
+* Default logger that writes to the Node.js console with an `[identity]` prefix.
+* Used when no custom logger is provided.
+*/
+const consoleLogger = {
+	debug: (msg, meta) => console.debug(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	info: (msg, meta) => console.info(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	warn: (msg, meta) => console.warn(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	error: (msg, meta) => console.error(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : [])
+};
+/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
+};
+/**
+* Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.
+*
+* - `false` → {@link noopLogger}
+* - `undefined` → {@link consoleLogger}
+* - anything else → returned as-is
+*/
+function resolveLogger(logger) {
+	if (logger === false) return noopLogger;
+	return logger ?? consoleLogger;
+}
+//#endregion
+Object.defineProperty(exports, "consoleLogger", {
+	enumerable: true,
+	get: function() {
+		return consoleLogger;
+	}
+});
+Object.defineProperty(exports, "noopLogger", {
+	enumerable: true,
+	get: function() {
+		return noopLogger;
+	}
+});
+Object.defineProperty(exports, "resolveLogger", {
+	enumerable: true,
+	get: function() {
+		return resolveLogger;
+	}
+});

package/dist/logger-CcCHJVVe.mjs

@@ -0,0 +1,33 @@
+//#region core/logger.ts
+/**
+* Default logger that writes to the Node.js console with an `[identity]` prefix.
+* Used when no custom logger is provided.
+*/
+const consoleLogger = {
+	debug: (msg, meta) => console.debug(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	info: (msg, meta) => console.info(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	warn: (msg, meta) => console.warn(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : []),
+	error: (msg, meta) => console.error(`[identity] ${msg}`, ...meta !== void 0 ? [meta] : [])
+};
+/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */
+const noopLogger = {
+	debug: () => {},
+	info: () => {},
+	warn: () => {},
+	error: () => {}
+};
+/**
+* Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.
+*
+* - `false` → {@link noopLogger}
+* - `undefined` → {@link consoleLogger}
+* - anything else → returned as-is
+*/
+function resolveLogger(logger) {
+	if (logger === false) return noopLogger;
+	return logger ?? consoleLogger;
+}
+//#endregion
+export { noopLogger as n, resolveLogger as r, consoleLogger as t };
+
+//# sourceMappingURL=logger-CcCHJVVe.mjs.map

package/dist/logger-CcCHJVVe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger-CcCHJVVe.mjs","names":[],"sources":["../core/logger.ts"],"sourcesContent":["/**\n * Pluggable logger interface for `@azlib/identity`.\n *\n * The package uses this interface for request/response logging in the Express router and\n * for operational messages throughout the module. Consumers can hook any structured\n * logging library (Winston, Pino, Bunyan, etc.) by implementing this interface.\n *\n * @example\n * ```ts\n * import pino from \"pino\";\n *\n * const logger = pino();\n * createIdentityRouter(service, { logger });\n * ```\n */\nexport interface IdentityLogger {\n  debug(message: string, meta?: Record<string, unknown>): void;\n  info(message: string, meta?: Record<string, unknown>): void;\n  warn(message: string, meta?: Record<string, unknown>): void;\n  error(message: string, meta?: Record<string, unknown>): void;\n}\n\n/**\n * Default logger that writes to the Node.js console with an `[identity]` prefix.\n * Used when no custom logger is provided.\n */\nexport const consoleLogger: IdentityLogger = {\n  debug: (msg, meta) => console.debug(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  info: (msg, meta) => console.info(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  warn: (msg, meta) => console.warn(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  error: (msg, meta) => console.error(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n};\n\n/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */\nexport const noopLogger: IdentityLogger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\n/**\n * Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.\n *\n * - `false` → {@link noopLogger}\n * - `undefined` → {@link consoleLogger}\n * - anything else → returned as-is\n */\nexport function resolveLogger(logger?: IdentityLogger | false): IdentityLogger {\n  if (logger === false) return noopLogger;\n  return logger ?? consoleLogger;\n}\n"],"mappings":";;;;;AA0BA,MAAa,gBAAgC;CAC3C,QAAQ,KAAK,SAAS,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC9F,OAAO,KAAK,SAAS,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC5F,OAAO,KAAK,SAAS,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC5F,QAAQ,KAAK,SAAS,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;AAChG;;AAGA,MAAa,aAA6B;CACxC,aAAa,CAAC;CACd,YAAY,CAAC;CACb,YAAY,CAAC;CACb,aAAa,CAAC;AAChB;;;;;;;;AASA,SAAgB,cAAc,QAAiD;CAC7E,IAAI,WAAW,OAAO,OAAO;CAC7B,OAAO,UAAU;AACnB"}