@breadstone/archipel-mcp 0.0.15 → 0.0.16

package/data/packages/platform-cryptography/api/Class.InvalidOtpError.md

@@ -0,0 +1,52 @@
+---
+title: 'Class: InvalidOtpError'
+generated: true
+editUrl: false
+---
+# Class: InvalidOtpError
+
+Defined in: [errors/InvalidOtpError.ts:12](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/InvalidOtpError.ts#L12)
+
+Thrown when an OTP token fails verification.
+
+## Extends
+
+- [`CryptographyError`](Class.CryptographyError)
+
+## Constructors
+
+### Constructor
+
+```ts
+new InvalidOtpError(message?): InvalidOtpError;
+```
+
+Defined in: [errors/InvalidOtpError.ts:15](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/InvalidOtpError.ts#L15)
+
+#### Parameters
+
+| Parameter | Type | Default value |
+| ------ | ------ | ------ |
+| `message` | `string` | `'The provided OTP token is invalid or expired.'` |
+
+#### Returns
+
+`InvalidOtpError`
+
+#### Overrides
+
+[`CryptographyError`](Class.CryptographyError).[`constructor`](Class.CryptographyError#constructor)
+
+## Properties
+
+### code
+
+```ts
+readonly code: string;
+```
+
+Defined in: [errors/CryptographyError.ts:10](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/CryptographyError.ts#L10)
+
+#### Inherited from
+
+[`CryptographyError`](Class.CryptographyError).[`code`](Class.CryptographyError#code)

package/data/packages/platform-cryptography/api/Class.OtpService.md

@@ -0,0 +1,155 @@
+---
+title: 'Class: OtpService'
+generated: true
+editUrl: false
+---
+# Class: OtpService
+
+Defined in: [otp/OtpService.ts:58](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L58)
+
+OTP service implementation backed by otplib v13.
+
+Wraps the otplib standalone functions behind the generic
+[IOtpService](Interface.IOtpService) interface so consumers are decoupled from
+the library version.
+
+## Implements
+
+- [`IOtpService`](Interface.IOtpService)
+
+## Constructors
+
+### Constructor
+
+```ts
+new OtpService(options?): OtpService;
+```
+
+Defined in: [otp/OtpService.ts:74](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L74)
+
+Initializes a new instance of the `OtpService` class.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `options?` | [`IOtpOptions`](Interface.IOtpOptions) | Optional OTP configuration. When omitted, defaults to a tolerance of 30 seconds. |
+
+#### Returns
+
+`OtpService`
+
+## Methods
+
+### generateSecret()
+
+```ts
+generateSecret(): string;
+```
+
+Defined in: [otp/OtpService.ts:88](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L88)
+
+Generates a cryptographically random secret suitable for TOTP.
+
+#### Returns
+
+`string`
+
+The generated secret string.
+
+#### Implementation of
+
+[`IOtpService`](Interface.IOtpService).[`generateSecret`](Interface.IOtpService#generatesecret)
+
+***
+
+### generateUri()
+
+```ts
+generateUri(options): string;
+```
+
+Defined in: [otp/OtpService.ts:93](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L93)
+
+Generates an `otpauth://` URI for QR code enrollment.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `options` | [`IOtpUriOptions`](Interface.IOtpUriOptions) | The URI generation options. |
+
+#### Returns
+
+`string`
+
+The formatted `otpauth://` URI.
+
+#### Implementation of
+
+[`IOtpService`](Interface.IOtpService).[`generateUri`](Interface.IOtpService#generateuri)
+
+***
+
+### verify()
+
+```ts
+verify(token, secret): boolean;
+```
+
+Defined in: [otp/OtpService.ts:105](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L105)
+
+Verifies a TOTP token against the given secret.
+
+The underlying comparison is **constant-time** (handled by the
+otplib implementation), preventing timing-based side-channel attacks.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `token` | `string` | The one-time password to verify. |
+| `secret` | `string` | The shared secret. |
+
+#### Returns
+
+`boolean`
+
+`true` if the token is valid within the configured tolerance window.
+
+#### Implementation of
+
+[`IOtpService`](Interface.IOtpService).[`verify`](Interface.IOtpService#verify)
+
+***
+
+### verifyHotp()
+
+```ts
+verifyHotp(
+   token, 
+   secret, 
+counter): Promise<boolean>;
+```
+
+Defined in: [otp/OtpService.ts:112](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L112)
+
+Verifies an HOTP (counter-based) token against the given secret and counter.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `token` | `string` | The one-time password to verify. |
+| `secret` | `string` | The shared secret. |
+| `counter` | `number` | The expected HOTP counter value. |
+
+#### Returns
+
+`Promise`\<`boolean`\>
+
+`true` if the token is valid for the given counter.
+
+#### Implementation of
+
+[`IOtpService`](Interface.IOtpService).[`verifyHotp`](Interface.IOtpService#verifyhotp)

package/data/packages/platform-cryptography/api/Class.WeakPasswordError.md

@@ -0,0 +1,52 @@
+---
+title: 'Class: WeakPasswordError'
+generated: true
+editUrl: false
+---
+# Class: WeakPasswordError
+
+Defined in: [errors/WeakPasswordError.ts:12](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/WeakPasswordError.ts#L12)
+
+Thrown when a password does not meet the minimum strength requirements.
+
+## Extends
+
+- [`CryptographyError`](Class.CryptographyError)
+
+## Constructors
+
+### Constructor
+
+```ts
+new WeakPasswordError(message?): WeakPasswordError;
+```
+
+Defined in: [errors/WeakPasswordError.ts:15](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/WeakPasswordError.ts#L15)
+
+#### Parameters
+
+| Parameter | Type | Default value |
+| ------ | ------ | ------ |
+| `message` | `string` | `'The provided password does not meet the minimum strength requirements.'` |
+
+#### Returns
+
+`WeakPasswordError`
+
+#### Overrides
+
+[`CryptographyError`](Class.CryptographyError).[`constructor`](Class.CryptographyError#constructor)
+
+## Properties
+
+### code
+
+```ts
+readonly code: string;
+```
+
+Defined in: [errors/CryptographyError.ts:10](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/errors/CryptographyError.ts#L10)
+
+#### Inherited from
+
+[`CryptographyError`](Class.CryptographyError).[`code`](Class.CryptographyError#code)

package/data/packages/platform-cryptography/api/Interface.IBcryptOptions.md

@@ -0,0 +1,45 @@
+---
+title: 'Interface: IBcryptOptions'
+generated: true
+editUrl: false
+---
+# Interface: IBcryptOptions
+
+Defined in: [IBcryptOptions.ts:6](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/IBcryptOptions.ts#L6)
+
+Configuration options for [BcryptService](Class.BcryptService).
+
+## Properties
+
+### pepper?
+
+```ts
+readonly optional pepper?: string;
+```
+
+Defined in: [IBcryptOptions.ts:24](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/IBcryptOptions.ts#L24)
+
+Optional server-side pepper used as an HMAC key. When provided,
+every password is HMAC-SHA-256'd with this pepper before bcrypt
+hashing, adding a server-side secret layer and normalizing the
+password length to 64 hex characters (well within the 72-byte limit).
+
+***
+
+### rounds?
+
+```ts
+readonly optional rounds?: number;
+```
+
+Defined in: [IBcryptOptions.ts:14](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/IBcryptOptions.ts#L14)
+
+Number of bcrypt salt rounds. Must be ≥ 12 (OWASP recommendation).
+Values below the minimum are clamped to 12.
+
+#### Default Value
+
+```ts
+12
+@public
+```

package/data/packages/platform-cryptography/api/Interface.IOtpOptions.md

@@ -0,0 +1,31 @@
+---
+title: 'Interface: IOtpOptions'
+generated: true
+editUrl: false
+---
+# Interface: IOtpOptions
+
+Defined in: [otp/IOtpOptions.ts:6](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpOptions.ts#L6)
+
+Configuration options for [OtpService](Class.OtpService).
+
+## Properties
+
+### epochTolerance?
+
+```ts
+readonly optional epochTolerance?: number;
+```
+
+Defined in: [otp/IOtpOptions.ts:15](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpOptions.ts#L15)
+
+TOTP verification tolerance expressed in **seconds**.
+Determines how many time steps before/after the current moment
+are accepted during TOTP verification.
+
+#### Default Value
+
+```ts
+30
+@public
+```

package/data/packages/platform-cryptography/api/Interface.IOtpService.md

@@ -0,0 +1,113 @@
+---
+title: 'Interface: IOtpService'
+generated: true
+editUrl: false
+---
+# Interface: IOtpService
+
+Defined in: [otp/IOtpService.ts:38](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L38)
+
+Abstraction over OTP (One-Time Password) operations.
+
+Decouples consumers from any specific OTP library, making it easy
+to swap implementations (e.g. upgrading from otplib v12 to v13)
+without changing consumer code.
+
+## Methods
+
+### generateSecret()
+
+```ts
+generateSecret(): string;
+```
+
+Defined in: [otp/IOtpService.ts:45](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L45)
+
+Generates a cryptographically random secret suitable for TOTP.
+
+#### Returns
+
+`string`
+
+The generated secret string.
+
+***
+
+### generateUri()
+
+```ts
+generateUri(options): string;
+```
+
+Defined in: [otp/IOtpService.ts:54](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L54)
+
+Generates an `otpauth://` URI for QR code enrollment.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `options` | [`IOtpUriOptions`](Interface.IOtpUriOptions) | The URI generation options. |
+
+#### Returns
+
+`string`
+
+The formatted `otpauth://` URI.
+
+***
+
+### verify()
+
+```ts
+verify(token, secret): boolean;
+```
+
+Defined in: [otp/IOtpService.ts:67](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L67)
+
+Verifies a TOTP token against the given secret.
+
+The underlying comparison is **constant-time** (handled by the
+otplib implementation), preventing timing-based side-channel attacks.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `token` | `string` | The one-time password to verify. |
+| `secret` | `string` | The shared secret. |
+
+#### Returns
+
+`boolean`
+
+`true` if the token is valid within the configured tolerance window.
+
+***
+
+### verifyHotp()
+
+```ts
+verifyHotp(
+   token, 
+   secret, 
+counter): Promise<boolean>;
+```
+
+Defined in: [otp/IOtpService.ts:78](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L78)
+
+Verifies an HOTP (counter-based) token against the given secret and counter.
+
+#### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `token` | `string` | The one-time password to verify. |
+| `secret` | `string` | The shared secret. |
+| `counter` | `number` | The expected HOTP counter value. |
+
+#### Returns
+
+`Promise`\<`boolean`\>
+
+`true` if the token is valid for the given counter.

package/data/packages/platform-cryptography/api/Interface.IOtpUriOptions.md

@@ -0,0 +1,46 @@
+---
+title: 'Interface: IOtpUriOptions'
+generated: true
+editUrl: false
+---
+# Interface: IOtpUriOptions
+
+Defined in: [otp/IOtpService.ts:6](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L6)
+
+Options for generating an OTP authentication URI (otpauth://).
+
+## Properties
+
+### issuer
+
+```ts
+readonly issuer: string;
+```
+
+Defined in: [otp/IOtpService.ts:12](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L12)
+
+The issuer name displayed in the authenticator app.
+
+***
+
+### label
+
+```ts
+readonly label: string;
+```
+
+Defined in: [otp/IOtpService.ts:19](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L19)
+
+The account label (e.g. email or username) shown in the authenticator app.
+
+***
+
+### secret
+
+```ts
+readonly secret: string;
+```
+
+Defined in: [otp/IOtpService.ts:26](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/IOtpService.ts#L26)
+
+The shared secret used for TOTP generation.

package/data/packages/platform-cryptography/api/Variable.BCRYPT_OPTIONS.md

@@ -0,0 +1,14 @@
+---
+title: 'Variable: BCRYPT\_OPTIONS'
+generated: true
+editUrl: false
+---
+# Variable: BCRYPT\_OPTIONS
+
+```ts
+const BCRYPT_OPTIONS: typeof BCRYPT_OPTIONS;
+```
+
+Defined in: [BcryptService.ts:15](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/BcryptService.ts#L15)
+
+Injection token for [IBcryptOptions](Interface.IBcryptOptions).

package/data/packages/platform-cryptography/api/Variable.MAX_BCRYPT_PASSWORD_BYTES.md

@@ -0,0 +1,14 @@
+---
+title: 'Variable: MAX\_BCRYPT\_PASSWORD\_BYTES'
+generated: true
+editUrl: false
+---
+# Variable: MAX\_BCRYPT\_PASSWORD\_BYTES
+
+```ts
+const MAX_BCRYPT_PASSWORD_BYTES: 72 = 72;
+```
+
+Defined in: [BcryptService.ts:29](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/BcryptService.ts#L29)
+
+Maximum password byte length that bcrypt processes without truncation.

package/data/packages/platform-cryptography/api/Variable.MIN_BCRYPT_ROUNDS.md

@@ -0,0 +1,14 @@
+---
+title: 'Variable: MIN\_BCRYPT\_ROUNDS'
+generated: true
+editUrl: false
+---
+# Variable: MIN\_BCRYPT\_ROUNDS
+
+```ts
+const MIN_BCRYPT_ROUNDS: 12 = 12;
+```
+
+Defined in: [BcryptService.ts:22](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/BcryptService.ts#L22)
+
+Minimum number of bcrypt salt rounds enforced by the service (OWASP ≥ 12).

package/data/packages/platform-cryptography/api/Variable.OTP_OPTIONS.md

@@ -0,0 +1,14 @@
+---
+title: 'Variable: OTP\_OPTIONS'
+generated: true
+editUrl: false
+---
+# Variable: OTP\_OPTIONS
+
+```ts
+const OTP_OPTIONS: typeof OTP_OPTIONS;
+```
+
+Defined in: [otp/OtpService.ts:30](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L30)
+
+Injection token for [IOtpOptions](Interface.IOtpOptions).

package/data/packages/platform-cryptography/api/Variable.OTP_SERVICE_TOKEN.md

@@ -0,0 +1,14 @@
+---
+title: 'Variable: OTP\_SERVICE\_TOKEN'
+generated: true
+editUrl: false
+---
+# Variable: OTP\_SERVICE\_TOKEN
+
+```ts
+const OTP_SERVICE_TOKEN: typeof OTP_SERVICE_TOKEN;
+```
+
+Defined in: [otp/OtpService.ts:23](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L23)
+
+Injection token for [IOtpService](Interface.IOtpService).

package/data/packages/platform-cryptography/api/Variable.TOTP_EPOCH_TOLERANCE.md

@@ -0,0 +1,23 @@
+---
+title: 'Variable: TOTP\_EPOCH\_TOLERANCE'
+generated: true
+editUrl: false
+---
+# Variable: TOTP\_EPOCH\_TOLERANCE
+
+```ts
+const TOTP_EPOCH_TOLERANCE: 30 = 30;
+```
+
+Defined in: [otp/OtpService.ts:46](https://github.com/RueDeRennes/archipel/blob/main/libs/platform-cryptography/src/otp/OtpService.ts#L46)
+
+Default TOTP verification tolerance expressed in **seconds** (otplib v13 `epochTolerance`).
+
+Each time step equals 30 seconds by default (RFC 6238).
+
+| `epochTolerance` | Accepted range          |
+|------------------|-------------------------|
+| 0                | current step only       |
+| 30               | ±1 step (±30 s)         |
+| 60               | ±2 steps (±60 s)        |
+| 90               | ±3 steps (±90 s)        |

package/data/packages/platform-cryptography/api/index.md

@@ -0,0 +1,37 @@
+---
+title: '@breadstone/archipel-platform-cryptography'
+generated: true
+editUrl: false
+---
+# @breadstone/archipel-platform-cryptography
+
+## Classes
+
+| Class | Description |
+| ------ | ------ |
+| [BcryptService](Class.BcryptService) | The `BcryptService` class. Provides bcrypt hashing and comparison with configurable salt rounds, optional pepper (HMAC pre-hash), and SHA-256 pre-hash for passwords exceeding bcrypt's 72-byte input limit. |
+| [CryptographyError](Class.CryptographyError) | Base class for cryptography-related domain errors. |
+| [CryptoService](Class.CryptoService) | The `CryptoService` class. Represents the service that provides cryptographic operations. |
+| [InvalidOtpError](Class.InvalidOtpError) | Thrown when an OTP token fails verification. |
+| [OtpService](Class.OtpService) | OTP service implementation backed by otplib v13. |
+| [WeakPasswordError](Class.WeakPasswordError) | Thrown when a password does not meet the minimum strength requirements. |
+
+## Interfaces
+
+| Interface | Description |
+| ------ | ------ |
+| [IBcryptOptions](Interface.IBcryptOptions) | Configuration options for [BcryptService](Class.BcryptService). |
+| [IOtpOptions](Interface.IOtpOptions) | Configuration options for [OtpService](Class.OtpService). |
+| [IOtpService](Interface.IOtpService) | Abstraction over OTP (One-Time Password) operations. |
+| [IOtpUriOptions](Interface.IOtpUriOptions) | Options for generating an OTP authentication URI (otpauth://). |
+
+## Variables
+
+| Variable | Description |
+| ------ | ------ |
+| [BCRYPT\_OPTIONS](Variable.BCRYPT_OPTIONS) | Injection token for [IBcryptOptions](Interface.IBcryptOptions). |
+| [MAX\_BCRYPT\_PASSWORD\_BYTES](Variable.MAX_BCRYPT_PASSWORD_BYTES) | Maximum password byte length that bcrypt processes without truncation. |
+| [MIN\_BCRYPT\_ROUNDS](Variable.MIN_BCRYPT_ROUNDS) | Minimum number of bcrypt salt rounds enforced by the service (OWASP ≥ 12). |
+| [OTP\_OPTIONS](Variable.OTP_OPTIONS) | Injection token for [IOtpOptions](Interface.IOtpOptions). |
+| [OTP\_SERVICE\_TOKEN](Variable.OTP_SERVICE_TOKEN) | Injection token for [IOtpService](Interface.IOtpService). |
+| [TOTP\_EPOCH\_TOLERANCE](Variable.TOTP_EPOCH_TOLERANCE) | Default TOTP verification tolerance expressed in **seconds** (otplib v13 `epochTolerance`). |