@bajustone/fortress 1.0.0-rc.1

package/dist/otel.cjs

@@ -0,0 +1,108 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/otel/index.ts
+var otel_exports = {};
+__export(otel_exports, {
+  createOtelTelemetry: () => createOtelTelemetry
+});
+module.exports = __toCommonJS(otel_exports);
+async function createOtelTelemetry(options = {}) {
+  let api;
+  try {
+    api = await import("@opentelemetry/api");
+  } catch (cause) {
+    throw new Error(
+      "@opentelemetry/api is not installed. Add it to your dependencies to use createOtelTelemetry().",
+      { cause }
+    );
+  }
+  const name = options.name ?? "fortress";
+  const version = options.version ?? "0.0.x";
+  const otelTracer = api.trace.getTracer(name, version);
+  const otelMeter = api.metrics.getMeter(name, version);
+  const { SpanStatusCode } = api;
+  const wrapSpan = (span) => ({
+    setAttribute: (k, v) => {
+      span.setAttribute(k, v);
+    },
+    recordException: (err) => {
+      span.recordException(err);
+    },
+    setStatus: (s) => {
+      span.setStatus({
+        code: s.code === "ok" ? SpanStatusCode.OK : SpanStatusCode.ERROR,
+        message: s.message
+      });
+    },
+    end: () => {
+      span.end();
+    }
+  });
+  return {
+    tracer: {
+      startSpan(spanName, attrs) {
+        return wrapSpan(otelTracer.startSpan(spanName, { attributes: attrs }));
+      },
+      startActiveSpan(spanName, attrs, callback) {
+        return otelTracer.startActiveSpan(
+          spanName,
+          { attributes: attrs },
+          async (span) => callback(wrapSpan(span))
+        );
+      }
+    },
+    meter: {
+      createCounter(metricName, opts) {
+        const c = otelMeter.createCounter(metricName, opts);
+        return {
+          add: (v, a) => {
+            c.add(v, a);
+          }
+        };
+      },
+      createHistogram(metricName, opts) {
+        const h = otelMeter.createHistogram(metricName, {
+          description: opts?.description,
+          unit: opts?.unit,
+          advice: opts?.boundaries ? { explicitBucketBoundaries: opts.boundaries } : void 0
+        });
+        return {
+          record: (v, a) => {
+            h.record(v, a);
+          }
+        };
+      }
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createOtelTelemetry
+});

package/dist/otel.d.cts

@@ -0,0 +1,62 @@
+import { T as TelemetryProvider } from './auth-service-BcyQ2PuZ.cjs';
+export { A as AttributeValue, a as Attributes, b as AuthEvent, c as AuthEventListener, C as Counter, F as FortressLogger, H as Histogram, I as IamEvent, d as IamEventListener, M as Meter, P as PermissionCheckEvent, e as PermissionCheckListener, S as Span, f as Tracer, U as Unsubscribe } from './auth-service-BcyQ2PuZ.cjs';
+import './types-et0R8tsC.cjs';
+
+/**
+ * OpenTelemetry adapter for Fortress.
+ *
+ * This is the **only file in the repository that imports `@opentelemetry/api`**.
+ * Core Fortress code depends on the internal {@link TelemetryProvider}
+ * interface in `src/core/observability/types.ts`; this sub-path exists so
+ * runtimes that never opt in (Cloudflare Workers, Deno without OTel, etc.)
+ * never resolve `@opentelemetry/api` at all.
+ *
+ * The import is dynamic (`await import(...)`) as a belt-and-suspenders
+ * guarantee: even if a bundler or package resolver attempts to evaluate
+ * this module, `@opentelemetry/api` is not referenced until
+ * {@link createOtelTelemetry} is actually called.
+ *
+ * Usage:
+ * ```ts
+ * import { createFortress } from '@bajustone/fortress';
+ * import { createOtelTelemetry } from '@bajustone/fortress/otel';
+ * import pino from 'pino';
+ *
+ * const observability = await createOtelTelemetry({ name: 'my-app-auth' });
+ * const fortress = createFortress({
+ *   // ...config
+ *   logger: pino(),
+ *   observability,
+ * });
+ * ```
+ *
+ * The returned provider satisfies Fortress's internal
+ * {@link TelemetryProvider} interface and can be wired into any
+ * `FortressConfig.observability` slot. Because Fortress's metric catalog
+ * uses the stable OTel semantic convention for database operations
+ * (`db.client.operation.duration`), Grafana/Prometheus dashboards that
+ * know about that name will automatically pick up Fortress's DB queries.
+ */
+
+interface OtelTelemetryOptions {
+    /** Instrumentation scope name. Defaults to `'fortress'`. */
+    name?: string;
+    /** Instrumentation scope version. Defaults to `'0.0.x'`. */
+    version?: string;
+}
+/**
+ * Create a Fortress {@link TelemetryProvider} backed by OpenTelemetry's
+ * global tracer and meter providers.
+ *
+ * If `@opentelemetry/api` is not installed, this function throws with a
+ * clear error message pointing at the missing peer dependency. The
+ * dynamic import ensures the failure mode is a controlled throw at call
+ * time — not a module-load crash.
+ *
+ * When no OTel SDK is registered globally, the returned provider's spans
+ * and metric instruments will resolve to OTel's own no-op implementations
+ * and impose no measurable overhead.
+ */
+declare function createOtelTelemetry(options?: OtelTelemetryOptions): Promise<TelemetryProvider>;
+
+export { type OtelTelemetryOptions, TelemetryProvider, createOtelTelemetry };

package/dist/otel.d.ts

@@ -0,0 +1,62 @@
+import { T as TelemetryProvider } from './auth-service-BkzZkWfH.js';
+export { A as AttributeValue, a as Attributes, b as AuthEvent, c as AuthEventListener, C as Counter, F as FortressLogger, H as Histogram, I as IamEvent, d as IamEventListener, M as Meter, P as PermissionCheckEvent, e as PermissionCheckListener, S as Span, f as Tracer, U as Unsubscribe } from './auth-service-BkzZkWfH.js';
+import './types-et0R8tsC.js';
+
+/**
+ * OpenTelemetry adapter for Fortress.
+ *
+ * This is the **only file in the repository that imports `@opentelemetry/api`**.
+ * Core Fortress code depends on the internal {@link TelemetryProvider}
+ * interface in `src/core/observability/types.ts`; this sub-path exists so
+ * runtimes that never opt in (Cloudflare Workers, Deno without OTel, etc.)
+ * never resolve `@opentelemetry/api` at all.
+ *
+ * The import is dynamic (`await import(...)`) as a belt-and-suspenders
+ * guarantee: even if a bundler or package resolver attempts to evaluate
+ * this module, `@opentelemetry/api` is not referenced until
+ * {@link createOtelTelemetry} is actually called.
+ *
+ * Usage:
+ * ```ts
+ * import { createFortress } from '@bajustone/fortress';
+ * import { createOtelTelemetry } from '@bajustone/fortress/otel';
+ * import pino from 'pino';
+ *
+ * const observability = await createOtelTelemetry({ name: 'my-app-auth' });
+ * const fortress = createFortress({
+ *   // ...config
+ *   logger: pino(),
+ *   observability,
+ * });
+ * ```
+ *
+ * The returned provider satisfies Fortress's internal
+ * {@link TelemetryProvider} interface and can be wired into any
+ * `FortressConfig.observability` slot. Because Fortress's metric catalog
+ * uses the stable OTel semantic convention for database operations
+ * (`db.client.operation.duration`), Grafana/Prometheus dashboards that
+ * know about that name will automatically pick up Fortress's DB queries.
+ */
+
+interface OtelTelemetryOptions {
+    /** Instrumentation scope name. Defaults to `'fortress'`. */
+    name?: string;
+    /** Instrumentation scope version. Defaults to `'0.0.x'`. */
+    version?: string;
+}
+/**
+ * Create a Fortress {@link TelemetryProvider} backed by OpenTelemetry's
+ * global tracer and meter providers.
+ *
+ * If `@opentelemetry/api` is not installed, this function throws with a
+ * clear error message pointing at the missing peer dependency. The
+ * dynamic import ensures the failure mode is a controlled throw at call
+ * time — not a module-load crash.
+ *
+ * When no OTel SDK is registered globally, the returned provider's spans
+ * and metric instruments will resolve to OTel's own no-op implementations
+ * and impose no measurable overhead.
+ */
+declare function createOtelTelemetry(options?: OtelTelemetryOptions): Promise<TelemetryProvider>;
+
+export { type OtelTelemetryOptions, TelemetryProvider, createOtelTelemetry };

package/dist/otel.js

@@ -0,0 +1,73 @@
+// src/otel/index.ts
+async function createOtelTelemetry(options = {}) {
+  let api;
+  try {
+    api = await import("@opentelemetry/api");
+  } catch (cause) {
+    throw new Error(
+      "@opentelemetry/api is not installed. Add it to your dependencies to use createOtelTelemetry().",
+      { cause }
+    );
+  }
+  const name = options.name ?? "fortress";
+  const version = options.version ?? "0.0.x";
+  const otelTracer = api.trace.getTracer(name, version);
+  const otelMeter = api.metrics.getMeter(name, version);
+  const { SpanStatusCode } = api;
+  const wrapSpan = (span) => ({
+    setAttribute: (k, v) => {
+      span.setAttribute(k, v);
+    },
+    recordException: (err) => {
+      span.recordException(err);
+    },
+    setStatus: (s) => {
+      span.setStatus({
+        code: s.code === "ok" ? SpanStatusCode.OK : SpanStatusCode.ERROR,
+        message: s.message
+      });
+    },
+    end: () => {
+      span.end();
+    }
+  });
+  return {
+    tracer: {
+      startSpan(spanName, attrs) {
+        return wrapSpan(otelTracer.startSpan(spanName, { attributes: attrs }));
+      },
+      startActiveSpan(spanName, attrs, callback) {
+        return otelTracer.startActiveSpan(
+          spanName,
+          { attributes: attrs },
+          async (span) => callback(wrapSpan(span))
+        );
+      }
+    },
+    meter: {
+      createCounter(metricName, opts) {
+        const c = otelMeter.createCounter(metricName, opts);
+        return {
+          add: (v, a) => {
+            c.add(v, a);
+          }
+        };
+      },
+      createHistogram(metricName, opts) {
+        const h = otelMeter.createHistogram(metricName, {
+          description: opts?.description,
+          unit: opts?.unit,
+          advice: opts?.boundaries ? { explicitBucketBoundaries: opts.boundaries } : void 0
+        });
+        return {
+          record: (v, a) => {
+            h.record(v, a);
+          }
+        };
+      }
+    }
+  };
+}
+export {
+  createOtelTelemetry
+};

package/dist/plugins/account-lockout.cjs

@@ -0,0 +1,322 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/account-lockout/index.ts
+var account_lockout_exports = {};
+__export(account_lockout_exports, {
+  accountLockout: () => accountLockout
+});
+module.exports = __toCommonJS(account_lockout_exports);
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/account-lockout/index.ts
+function accountLockout(config = {}) {
+  const maxFailedAttempts = config.maxFailedAttempts ?? 5;
+  const lockoutDurationSeconds = config.lockoutDurationSeconds ?? 900;
+  const escalation = config.escalation ?? true;
+  const maxLockoutSeconds = config.maxLockoutSeconds ?? 3600;
+  function normalizeIdentifier(identifier) {
+    return identifier.trim().normalize("NFC").toLowerCase();
+  }
+  function calculateLockoutDuration(lockoutCount) {
+    if (!escalation) {
+      return lockoutDurationSeconds;
+    }
+    const duration = lockoutDurationSeconds * 2 ** lockoutCount;
+    return Math.min(duration, maxLockoutSeconds);
+  }
+  return {
+    name: "account-lockout",
+    models: [{
+      name: "account_lockout",
+      fields: {
+        id: { type: "number", required: true },
+        identifier: { type: "string", required: true, unique: true },
+        failedAttempts: { type: "number", required: true },
+        lastFailedAt: { type: "date" },
+        lockedUntil: { type: "date" },
+        lockoutCount: { type: "number", required: true },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    hooks: {
+      async beforeLogin(ctx) {
+        const identifier = normalizeIdentifier(ctx.email);
+        const record = await ctx.db.findOne({
+          model: "account_lockout",
+          where: [{ field: "identifier", operator: "=", value: identifier }]
+        });
+        if (!record) {
+          return void 0;
+        }
+        const now = /* @__PURE__ */ new Date();
+        if (record.lockedUntil && record.lockedUntil > now) {
+          throw Errors.unauthorized("Account temporarily locked. Try again later.");
+        }
+        if (record.lockedUntil && record.lockedUntil <= now) {
+          await ctx.db.update({
+            model: "account_lockout",
+            where: [{ field: "id", operator: "=", value: record.id }],
+            data: { failedAttempts: 0, lockedUntil: null, lastFailedAt: null }
+          });
+        }
+        return void 0;
+      },
+      async onLoginFailure(ctx) {
+        if (ctx.error.message.includes("temporarily locked"))
+          return;
+        const identifier = normalizeIdentifier(ctx.identifier);
+        for (let attempt = 0; attempt < 5; attempt++) {
+          const now = /* @__PURE__ */ new Date();
+          let record = await ctx.db.findOne({
+            model: "account_lockout",
+            where: [{ field: "identifier", operator: "=", value: identifier }]
+          });
+          if (!record) {
+            const newFailedAttempts2 = 1;
+            const updateData2 = {
+              identifier,
+              failedAttempts: newFailedAttempts2,
+              lastFailedAt: now,
+              lockedUntil: null,
+              lockoutCount: 0
+            };
+            if (newFailedAttempts2 >= maxFailedAttempts) {
+              updateData2.lockedUntil = new Date(now.getTime() + calculateLockoutDuration(0) * 1e3);
+              updateData2.lockoutCount = 1;
+            }
+            try {
+              await ctx.db.create({ model: "account_lockout", data: updateData2 });
+              return;
+            } catch {
+              continue;
+            }
+          }
+          const expired = record.lockedUntil !== null && record.lockedUntil <= now;
+          const observedFailedAttempts = record.failedAttempts;
+          const observedLockoutCount = record.lockoutCount;
+          if (expired) {
+            record = { ...record, failedAttempts: 0, lockedUntil: null, lastFailedAt: null };
+          }
+          const newFailedAttempts = record.failedAttempts + 1;
+          const updateData = {
+            failedAttempts: newFailedAttempts,
+            lastFailedAt: now,
+            lockedUntil: expired ? null : record.lockedUntil
+          };
+          if (newFailedAttempts >= maxFailedAttempts) {
+            const duration = calculateLockoutDuration(record.lockoutCount);
+            updateData.lockedUntil = new Date(now.getTime() + duration * 1e3);
+            updateData.lockoutCount = record.lockoutCount + 1;
+          } else if (expired) {
+            updateData.lockoutCount = record.lockoutCount;
+          }
+          const updated = await ctx.db.update({
+            model: "account_lockout",
+            where: [
+              { field: "id", operator: "=", value: record.id },
+              { field: "failedAttempts", operator: "=", value: observedFailedAttempts },
+              { field: "lockoutCount", operator: "=", value: observedLockoutCount }
+            ],
+            data: updateData
+          });
+          if (updated)
+            return;
+        }
+      },
+      async afterLogin(ctx, result) {
+        const identifier = normalizeIdentifier(ctx.identifier ?? result.user.email);
+        const record = await ctx.db.findOne({
+          model: "account_lockout",
+          where: [{ field: "identifier", operator: "=", value: identifier }]
+        });
+        if (record && record.failedAttempts > 0) {
+          await ctx.db.update({
+            model: "account_lockout",
+            where: [{ field: "id", operator: "=", value: record.id }],
+            data: {
+              failedAttempts: 0,
+              lockedUntil: null
+            }
+          });
+        }
+        return result;
+      }
+    },
+    methods: (ctx) => ({
+      async getLockoutStatus(identifier) {
+        const normalized = normalizeIdentifier(identifier);
+        const record = await ctx.db.findOne({
+          model: "account_lockout",
+          where: [{ field: "identifier", operator: "=", value: normalized }]
+        });
+        if (!record) {
+          return {
+            identifier: normalized,
+            failedAttempts: 0,
+            lockoutCount: 0,
+            lockedUntil: null,
+            lastFailedAt: null,
+            isLocked: false
+          };
+        }
+        const isLocked = record.lockedUntil !== null && record.lockedUntil > /* @__PURE__ */ new Date();
+        return {
+          identifier: record.identifier,
+          failedAttempts: record.failedAttempts,
+          lockoutCount: record.lockoutCount,
+          lockedUntil: record.lockedUntil,
+          lastFailedAt: record.lastFailedAt,
+          isLocked
+        };
+      },
+      async resetLockout(identifier) {
+        const normalized = normalizeIdentifier(identifier);
+        const record = await ctx.db.findOne({
+          model: "account_lockout",
+          where: [{ field: "identifier", operator: "=", value: normalized }]
+        });
+        if (!record) {
+          return;
+        }
+        await ctx.db.update({
+          model: "account_lockout",
+          where: [{ field: "id", operator: "=", value: record.id }],
+          data: {
+            failedAttempts: 0,
+            lockedUntil: null,
+            lockoutCount: 0,
+            lastFailedAt: null
+          }
+        });
+      }
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  accountLockout
+});

package/dist/plugins/account-lockout.d.cts

@@ -0,0 +1,42 @@
+import { F as FortressPlugin } from '../config-GtlVt6ZD.cjs';
+import '../index-CxEkfCA0.cjs';
+import '../jwt.cjs';
+import '../types-et0R8tsC.cjs';
+import '../auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Account lockout plugin for fortress.
+ *
+ * Tracks failed sign-in attempts per identifier and applies a progressive
+ * lockout (each successive lockout extends the cooldown). Hooks into the
+ * sign-in flow to reject attempts during a lockout window.
+ *
+ * @module
+ */
+
+interface AccountLockoutConfig {
+    /** Max failed attempts before lockout. Default: 5. */
+    maxFailedAttempts?: number;
+    /** Initial lockout duration in seconds. Default: 900 (15 minutes). */
+    lockoutDurationSeconds?: number;
+    /** Double lockout duration on repeated lockouts. Default: true. */
+    escalation?: boolean;
+    /** Maximum lockout duration in seconds. Default: 3600 (1 hour). */
+    maxLockoutSeconds?: number;
+}
+interface LockoutStatus {
+    identifier: string;
+    failedAttempts: number;
+    lockoutCount: number;
+    lockedUntil: Date | null;
+    lastFailedAt: Date | null;
+    isLocked: boolean;
+}
+/**
+ * Account lockout plugin factory. Returns a {@link FortressPlugin} that
+ * tracks failed sign-in attempts per identifier and applies a progressive
+ * lockout (each successive lockout extends the cooldown window).
+ */
+declare function accountLockout(config?: AccountLockoutConfig): FortressPlugin;
+
+export { type AccountLockoutConfig, type LockoutStatus, accountLockout };