@bajustone/fortress 1.0.0-rc.1

package/dist/plugins/data-isolation.d.cts

@@ -0,0 +1,49 @@
+import { e as PluginContext, F as FortressPlugin } from '../config-GtlVt6ZD.cjs';
+import '../index-CxEkfCA0.cjs';
+import '../jwt.cjs';
+import '../types-et0R8tsC.cjs';
+import '../auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Row-level data isolation plugin for fortress.
+ *
+ * Lets you scope read/write access to a database row by per-user assignments,
+ * for example "user can only see rows where `org_id` equals their assigned
+ * org". Works with any database adapter via the core `scopeRules` capability.
+ *
+ * @module
+ */
+
+interface DataIsolationScope {
+    /** Scope name for identification and bypass control */
+    name: string;
+    /** Column name that holds the scoping value in the target tables */
+    field: string;
+    /** Which models (tables) this scope applies to. Use ['*'] for all models. */
+    models: string[];
+    /** Resolve the current user's value for this scope */
+    resolveValue: (userId: string, ctx: PluginContext) => Promise<unknown>;
+}
+interface DataIsolationConfig {
+    scopes: DataIsolationScope[];
+    /**
+     * Behavior when an applicable scope resolves to `null` or `undefined`.
+     * Defaults to `'deny'`. `'skip'` is an unsafe legacy compatibility mode
+     * that removes that scope's row isolation for the operation.
+     */
+    unresolvedScope?: 'deny' | 'skip';
+}
+interface DataIsolationMethods {
+    withoutScope: <T>(scopeName: string, fn: () => Promise<T>) => Promise<T>;
+    unscoped: <T>(fn: () => Promise<T>) => Promise<T>;
+}
+/**
+ * Data isolation plugin factory. Returns a {@link FortressPlugin} that scopes
+ * read and write access to a database row by per-user scope assignments,
+ * enforcing isolation through the core `scopeRules` capability.
+ */
+declare function dataIsolation(config: DataIsolationConfig): FortressPlugin & {
+    readonly name: 'data-isolation';
+};
+
+export { type DataIsolationConfig, type DataIsolationMethods, type DataIsolationScope, dataIsolation };

package/dist/plugins/data-isolation.d.ts

@@ -0,0 +1,49 @@
+import { e as PluginContext, F as FortressPlugin } from '../config-B2366s_G.js';
+import '../index-CxEkfCA0.js';
+import '../jwt.js';
+import '../types-et0R8tsC.js';
+import '../auth-service-BkzZkWfH.js';
+
+/**
+ * Row-level data isolation plugin for fortress.
+ *
+ * Lets you scope read/write access to a database row by per-user assignments,
+ * for example "user can only see rows where `org_id` equals their assigned
+ * org". Works with any database adapter via the core `scopeRules` capability.
+ *
+ * @module
+ */
+
+interface DataIsolationScope {
+    /** Scope name for identification and bypass control */
+    name: string;
+    /** Column name that holds the scoping value in the target tables */
+    field: string;
+    /** Which models (tables) this scope applies to. Use ['*'] for all models. */
+    models: string[];
+    /** Resolve the current user's value for this scope */
+    resolveValue: (userId: string, ctx: PluginContext) => Promise<unknown>;
+}
+interface DataIsolationConfig {
+    scopes: DataIsolationScope[];
+    /**
+     * Behavior when an applicable scope resolves to `null` or `undefined`.
+     * Defaults to `'deny'`. `'skip'` is an unsafe legacy compatibility mode
+     * that removes that scope's row isolation for the operation.
+     */
+    unresolvedScope?: 'deny' | 'skip';
+}
+interface DataIsolationMethods {
+    withoutScope: <T>(scopeName: string, fn: () => Promise<T>) => Promise<T>;
+    unscoped: <T>(fn: () => Promise<T>) => Promise<T>;
+}
+/**
+ * Data isolation plugin factory. Returns a {@link FortressPlugin} that scopes
+ * read and write access to a database row by per-user scope assignments,
+ * enforcing isolation through the core `scopeRules` capability.
+ */
+declare function dataIsolation(config: DataIsolationConfig): FortressPlugin & {
+    readonly name: 'data-isolation';
+};
+
+export { type DataIsolationConfig, type DataIsolationMethods, type DataIsolationScope, dataIsolation };

package/dist/plugins/data-isolation.js

@@ -0,0 +1,186 @@
+// src/plugins/data-isolation/index.ts
+import { AsyncLocalStorage } from "async_hooks";
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/data-isolation/index.ts
+var bypassStore = new AsyncLocalStorage();
+function currentBypassState() {
+  return bypassStore.getStore();
+}
+function dataIsolation(config) {
+  return {
+    name: "data-isolation",
+    models: [{
+      name: "user_scope_assignment",
+      fields: {
+        id: { type: "number", required: true },
+        userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+        scopeName: { type: "string", required: true },
+        scopeValue: { type: "string", required: true },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    async scopeRules(userId, model, ctx) {
+      const state = currentBypassState();
+      if (state?.all)
+        return null;
+      const filters = [];
+      const defaults = {};
+      for (const scope of config.scopes) {
+        if (state?.scopes.has(scope.name))
+          continue;
+        const applies = scope.models.includes("*") || scope.models.includes(model);
+        if (!applies)
+          continue;
+        const value = await scope.resolveValue(userId, ctx);
+        if (value === void 0 || value === null) {
+          if (config.unresolvedScope === "skip")
+            continue;
+          throw Errors.forbidden(`Data isolation scope '${scope.name}' could not be resolved`);
+        }
+        filters.push({ field: scope.field, operator: "=", value });
+        defaults[scope.field] = value;
+      }
+      return filters.length > 0 ? { filters, defaults } : null;
+    },
+    methods: () => ({
+      /**
+       * Execute a callback with a specific scope bypassed.
+       * Queries within the callback will not have the named scope filter applied.
+       *
+       * The bypass is async-context-local: it applies only to async work
+       * spawned inside `fn` and never leaks across concurrent requests.
+       */
+      async withoutScope(scopeName, fn) {
+        const existing = currentBypassState();
+        const nextScopes = new Set(existing?.scopes ?? []);
+        nextScopes.add(scopeName);
+        const next = { all: existing?.all ?? false, scopes: nextScopes };
+        return bypassStore.run(next, fn);
+      },
+      /**
+       * Execute a callback with all scopes bypassed.
+       * Use with caution \u2014 no row-level isolation is applied.
+       *
+       * The bypass is async-context-local. Calls outside the callback (and
+       * concurrent requests running on different async contexts) are
+       * unaffected.
+       */
+      async unscoped(fn) {
+        const existing = currentBypassState();
+        const next = { all: true, scopes: new Set(existing?.scopes ?? []) };
+        return bypassStore.run(next, fn);
+      }
+    })
+  };
+}
+export {
+  dataIsolation
+};

package/dist/plugins/email-verification.cjs

@@ -0,0 +1,273 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/email-verification/index.ts
+var email_verification_exports = {};
+__export(email_verification_exports, {
+  emailVerification: () => emailVerification
+});
+module.exports = __toCommonJS(email_verification_exports);
+
+// src/core/auth/refresh-token.ts
+async function generateRefreshToken() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  const raw = base64UrlEncode(bytes);
+  const hash = await hashToken(raw);
+  return { raw, hash };
+}
+async function hashToken(raw) {
+  const data = new TextEncoder().encode(raw);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return hexEncode(new Uint8Array(hashBuffer));
+}
+function base64UrlEncode(bytes) {
+  const binString = Array.from(bytes, (b) => String.fromCodePoint(b)).join("");
+  return btoa(binString).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function hexEncode(bytes) {
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/plugins/email-verification/index.ts
+function emailVerification(config = {}) {
+  const tokenExpirySeconds = config.tokenExpirySeconds ?? 86400;
+  const requireVerification = config.requireVerification ?? true;
+  async function consumeVerificationToken(db, rawToken, expectedUserId) {
+    const hash = await hashToken(rawToken);
+    const usedAt = /* @__PURE__ */ new Date();
+    const record = await db.update({
+      model: "email_verification_token",
+      where: [
+        { field: "token", operator: "=", value: hash },
+        { field: "usedAt", operator: "isNull", value: null },
+        { field: "expiresAt", operator: "gt", value: usedAt },
+        ...expectedUserId ? [{ field: "userId", operator: "=", value: expectedUserId }] : []
+      ],
+      data: { usedAt }
+    });
+    if (!record)
+      throw Errors.notFound("Invalid or expired verification token");
+    await db.update({
+      model: "user",
+      where: [{ field: "id", operator: "=", value: record.userId }],
+      data: { email: record.email, emailVerified: true }
+    });
+    return record;
+  }
+  return {
+    name: "email-verification",
+    models: [{
+      name: "email_verification_token",
+      fields: {
+        id: { type: "number", required: true },
+        userId: { type: "number", required: true, references: { model: "user", field: "id" } },
+        token: { type: "string", required: true },
+        email: { type: "string", required: true },
+        expiresAt: { type: "date", required: true },
+        usedAt: { type: "date" },
+        createdAt: { type: "date", required: true }
+      }
+    }],
+    hooks: {
+      postAuthGate: {
+        reason: "email-verification",
+        async evaluate(ctx) {
+          if (!requireVerification || ctx.user.emailVerified)
+            return;
+          const tokens = await ctx.db.findMany({
+            model: "email_verification_token",
+            where: [{ field: "userId", operator: "=", value: ctx.user.id }]
+          });
+          return tokens.some((token) => token.usedAt !== null) ? void 0 : { pluginData: { requiresEmailVerification: true } };
+        },
+        async verify(ctx, completion) {
+          if (typeof completion !== "string")
+            throw Errors.unauthorized("Invalid verification token");
+          await consumeVerificationToken(ctx.db, completion, ctx.user.id);
+        }
+      },
+      async afterRegister(ctx, user) {
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "email_verification_token",
+          data: {
+            userId: user.id,
+            token: hash,
+            email: user.email,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendVerification) {
+          await config.onSendVerification(user.email, raw, user.id);
+        }
+      }
+    },
+    methods: (ctx) => ({
+      async sendVerification(userId, email) {
+        const user = await ctx.db.findOne({
+          model: "user",
+          where: [{ field: "id", operator: "=", value: userId }]
+        });
+        if (!user)
+          throw Errors.notFound("User not found");
+        const targetEmail = email ?? user.email;
+        const { raw, hash } = await generateRefreshToken();
+        const expiresAt = new Date(Date.now() + tokenExpirySeconds * 1e3);
+        await ctx.db.create({
+          model: "email_verification_token",
+          data: {
+            userId,
+            token: hash,
+            email: targetEmail,
+            expiresAt,
+            usedAt: null
+          }
+        });
+        if (config.onSendVerification) {
+          await config.onSendVerification(targetEmail, raw, userId);
+        }
+        return { sent: true };
+      },
+      async verify(rawToken) {
+        const record = await ctx.db.transaction((tx) => consumeVerificationToken(tx, rawToken));
+        return { userId: record.userId, email: record.email };
+      },
+      async completeVerification(continuationToken, verificationToken, meta) {
+        if (!ctx.auth)
+          throw Errors.badRequest("Auth service is unavailable");
+        return ctx.auth.completePendingAuth(continuationToken, verificationToken, meta);
+      }
+    })
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  emailVerification
+});

package/dist/plugins/email-verification.d.cts

@@ -0,0 +1,44 @@
+import { F as FortressPlugin } from '../config-GtlVt6ZD.cjs';
+import { R as RequestMeta, A as AuthResult } from '../types-et0R8tsC.cjs';
+import '../index-CxEkfCA0.cjs';
+import '../jwt.cjs';
+import '../auth-service-BcyQ2PuZ.cjs';
+
+/**
+ * Email verification plugin for fortress.
+ *
+ * Issues hashed, time-limited verification tokens, exposes
+ * `requestVerification` and `verifyEmail` methods on the fortress instance,
+ * and adds the corresponding HTTP routes when mounted via a framework adapter.
+ *
+ * @module
+ */
+
+interface EmailVerificationConfig {
+    /** Token expiry in seconds (default: 86400 = 24h) */
+    tokenExpirySeconds?: number;
+    /** Block login for unverified users (default: true) */
+    requireVerification?: boolean;
+    /** Called when a verification token is created */
+    onSendVerification?: (email: string, token: string, userId: string) => Promise<void>;
+}
+interface EmailVerificationMethods {
+    sendVerification: (userId: string, email?: string) => Promise<{
+        sent: true;
+    }>;
+    verify: (rawToken: string) => Promise<{
+        userId: string;
+        email: string;
+    }>;
+    completeVerification: (continuationToken: string, verificationToken: string, meta?: RequestMeta) => Promise<AuthResult>;
+}
+/**
+ * Email verification plugin factory. Returns a {@link FortressPlugin} that
+ * issues hashed verification tokens, exposes `requestVerification` /
+ * `verifyEmail` methods, and (when mounted) the corresponding HTTP routes.
+ */
+declare function emailVerification(config?: EmailVerificationConfig): FortressPlugin & {
+    readonly name: 'email-verification';
+};
+
+export { type EmailVerificationConfig, type EmailVerificationMethods, emailVerification };

package/dist/plugins/email-verification.d.ts

@@ -0,0 +1,44 @@
+import { F as FortressPlugin } from '../config-B2366s_G.js';
+import { R as RequestMeta, A as AuthResult } from '../types-et0R8tsC.js';
+import '../index-CxEkfCA0.js';
+import '../jwt.js';
+import '../auth-service-BkzZkWfH.js';
+
+/**
+ * Email verification plugin for fortress.
+ *
+ * Issues hashed, time-limited verification tokens, exposes
+ * `requestVerification` and `verifyEmail` methods on the fortress instance,
+ * and adds the corresponding HTTP routes when mounted via a framework adapter.
+ *
+ * @module
+ */
+
+interface EmailVerificationConfig {
+    /** Token expiry in seconds (default: 86400 = 24h) */
+    tokenExpirySeconds?: number;
+    /** Block login for unverified users (default: true) */
+    requireVerification?: boolean;
+    /** Called when a verification token is created */
+    onSendVerification?: (email: string, token: string, userId: string) => Promise<void>;
+}
+interface EmailVerificationMethods {
+    sendVerification: (userId: string, email?: string) => Promise<{
+        sent: true;
+    }>;
+    verify: (rawToken: string) => Promise<{
+        userId: string;
+        email: string;
+    }>;
+    completeVerification: (continuationToken: string, verificationToken: string, meta?: RequestMeta) => Promise<AuthResult>;
+}
+/**
+ * Email verification plugin factory. Returns a {@link FortressPlugin} that
+ * issues hashed verification tokens, exposes `requestVerification` /
+ * `verifyEmail` methods, and (when mounted) the corresponding HTTP routes.
+ */
+declare function emailVerification(config?: EmailVerificationConfig): FortressPlugin & {
+    readonly name: 'email-verification';
+};
+
+export { type EmailVerificationConfig, type EmailVerificationMethods, emailVerification };