@breadstone/archipel-platform-authentication 0.0.13 → 0.0.14

package/README.md

@@ -27,8 +27,35 @@ For the full list (including MFA/OAuth callback defaults), see [`../../ENVIRONME
 
 ```typescript
 import { AuthModule } from '@breadstone/archipel-platform-authentication';
+
+@Module({
+  imports: [
+    AuthModule.register({
+      authSubject: PrismaAuthSubjectAdapter,
+      mfaSubject: PrismaMfaSubjectAdapter,
+      sessionPersistence: PrismaSessionAdapter,
+      verificationSubject: PrismaVerificationAdapter,
+      challengeStore: RedisChallengeStore, // optional — defaults to in-memory
+      socialAuth: PrismaSocialAuthAdapter, // optional — enables OAuth
+      tokenEnricher: AppTokenEnricherAdapter, // optional — enriches JWT claims
+    }),
+  ],
+})
+export class AppModule {}
 ```
 
+## Ports
+
+| Port                      | Required | Description                                       |
+| ------------------------- | -------- | ------------------------------------------------- |
+| `AuthSubjectPort`         | Yes      | User lookup for JWT, Local, and Anonymous         |
+| `MfaSubjectPort`          | Yes      | MFA state persistence                             |
+| `SessionPersistencePort`  | Yes      | Session storage and invalidation                  |
+| `VerificationSubjectPort` | Yes      | Email/PIN verification lifecycle                  |
+| `ChallengeStorePort`      | No       | MFA challenge state. Defaults to in-memory store. |
+| `SocialAuthPort`          | No       | OAuth user creation/linking                       |
+| `TokenEnricherPort`       | No       | Custom JWT claim injection                        |
+
 ## Documentation
 
 📖 **Auth Module:** [`docs/backend/modules/auth.md`](../../../docs/backend/modules/auth.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@breadstone/archipel-platform-authentication",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -81,8 +81,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@breadstone/archipel-platform-core": "0.0.13",
-    "@breadstone/archipel-platform-cryptography": "0.0.13",
+    "@breadstone/archipel-platform-configuration": "0.0.14",
+    "@breadstone/archipel-platform-core": "0.0.14",
+    "@breadstone/archipel-platform-cryptography": "0.0.14",
     "passport": "0.7.0",
     "passport-custom": "1.1.1",
     "passport-jwt": "4.0.1",

package/src/AuthModule.d.ts

@@ -1,6 +1,7 @@
-import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 import { DynamicModule, MiddlewareConsumer, Type, type Provider } from '@nestjs/common';
 import { AuthSubjectPort } from './contracts/AuthSubjectPort';
+import { ChallengeStorePort } from './contracts/ChallengeStorePort';
 import { MfaSubjectPort } from './contracts/MfaSubjectPort';
 import { SessionPersistencePort } from './contracts/SessionPersistencePort';
 import { SocialAuthPort } from './contracts/SocialAuthPort';
@@ -65,11 +66,26 @@ export interface IAuthModuleOptions {
      * (e.g. `TOTP_MFA_PROVIDERS` from `@breadstone/archipel-platform-authentication/mfa/totp`).
      */
     additionalProviders?: Array<Provider>;
+    /**
+     * Optional implementation of the challenge store port.
+     * Defaults to an in-memory store suitable for single-instance deployments.
+     * For multi-instance deployments, provide a Redis-backed implementation.
+     */
+    challengeStore?: Type<ChallengeStorePort>;
 }
 /**
  * The `AuthModule` handles JWT-based authentication,
  * including token creation and validation.
  *
+ * **Rate Limiting:** This library does not expose controllers. Consumers should
+ * apply `@nestjs/throttler` guards on their auth endpoints (login, MFA verify)
+ * to prevent brute-force attacks (recommended: 5 req/min per IP + username).
+ *
+ * **OAuth CSRF Protection:** All social connectors use `state: true` which requires
+ * a session middleware (e.g. `express-session`) to store and verify OAuth state
+ * parameters. Ensure your application configures session middleware before using
+ * social connectors.
+ *
  * @public
  */
 export declare class AuthModule {

package/src/AuthModule.js

@@ -4,6 +4,7 @@ var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthModule = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
@@ -13,6 +14,7 @@ const AnonymousConnector_1 = require("./connectors/AnonymousConnector");
 const JwtConnector_1 = require("./connectors/JwtConnector");
 const LocalConnector_1 = require("./connectors/LocalConnector");
 const AuthSubjectPort_1 = require("./contracts/AuthSubjectPort");
+const ChallengeStorePort_1 = require("./contracts/ChallengeStorePort");
 const MfaSubjectPort_1 = require("./contracts/MfaSubjectPort");
 const SessionPersistencePort_1 = require("./contracts/SessionPersistencePort");
 const SocialAuthPort_1 = require("./contracts/SocialAuthPort");
@@ -35,12 +37,22 @@ const middlewares_1 = require("./middlewares");
 const SessionSerializer_1 = require("./serializer/SessionSerializer");
 const AuthTokenService_1 = require("./services/AuthTokenService");
 const ChallengeService_1 = require("./services/ChallengeService");
+const InMemoryChallengeStore_1 = require("./services/InMemoryChallengeStore");
 const SessionService_1 = require("./services/SessionService");
 const VerificationService_1 = require("./services/VerificationService");
 /**
  * The `AuthModule` handles JWT-based authentication,
  * including token creation and validation.
  *
+ * **Rate Limiting:** This library does not expose controllers. Consumers should
+ * apply `@nestjs/throttler` guards on their auth endpoints (login, MFA verify)
+ * to prevent brute-force attacks (recommended: 5 req/min per IP + username).
+ *
+ * **OAuth CSRF Protection:** All social connectors use `state: true` which requires
+ * a session middleware (e.g. `express-session`) to store and verify OAuth state
+ * parameters. Ensure your application configures session middleware before using
+ * social connectors.
+ *
  * @public
  */
 let AuthModule = AuthModule_1 = class AuthModule {
@@ -65,6 +77,10 @@ let AuthModule = AuthModule_1 = class AuthModule {
         if (options.tokenEnricher) {
             portProviders.push({ provide: TokenEnricherPort_1.TokenEnricherPort, useClass: options.tokenEnricher });
         }
+        portProviders.push({
+            provide: ChallengeStorePort_1.ChallengeStorePort,
+            useClass: options.challengeStore ?? InMemoryChallengeStore_1.InMemoryChallengeStore,
+        });
         const connectors = [JwtConnector_1.JwtConnector, LocalConnector_1.LocalConnector, AnonymousConnector_1.AnonymousConnector];
         if (options.socialConnectors) {
             connectors.push(...options.socialConnectors);
@@ -78,7 +94,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
         return {
             module: AuthModule_1,
             imports: [
-                archipel_platform_core_1.ConfigModule.register('platform-authentication', configEntries),
+                archipel_platform_configuration_1.ConfigModule.register('platform-authentication', configEntries),
                 archipel_platform_core_1.EventModule,
                 archipel_platform_core_1.IdentifierModule,
                 archipel_platform_core_1.HostModule,
@@ -86,10 +102,21 @@ let AuthModule = AuthModule_1 = class AuthModule {
                     defaultStrategy: 'jwt',
                     session: true,
                 }),
-                jwt_1.JwtModule.register({
-                    secret: process.env['AUTH_JWT_SECRET'],
-                    signOptions: {
-                        expiresIn: archipel_platform_core_1.DateTimeUtils.parse(process.env['AUTH_JWT_EXPIRES_IN']),
+                jwt_1.JwtModule.registerAsync({
+                    imports: [archipel_platform_configuration_1.ConfigModule.register('platform-authentication', configEntries)],
+                    inject: [archipel_platform_configuration_1.ConfigService],
+                    useFactory: (configService) => {
+                        const secret = configService.get(env_1.AUTH_JWT_SECRET.key);
+                        const MIN_SECRET_LENGTH = 32;
+                        if (secret.length < MIN_SECRET_LENGTH) {
+                            throw new Error(`AUTH_JWT_SECRET must be at least ${MIN_SECRET_LENGTH} characters (256 bits). Current length: ${secret.length}`);
+                        }
+                        return {
+                            secret,
+                            signOptions: {
+                                expiresIn: archipel_platform_core_1.DateTimeUtils.parse(configService.get(env_1.AUTH_JWT_EXPIRES_IN.key)),
+                            },
+                        };
                     },
                 }),
                 archipel_platform_core_1.MappingModule.withProfiles([SessionMappingProfile_1.SessionMappingProfile]),

package/src/connectors/AnonymousConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 declare const AnonymousConnector_base: (abstract new (...args: any[]) => {

package/src/connectors/AnonymousConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AnonymousConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_custom_1 = require("passport-custom");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
@@ -49,6 +49,6 @@ let AnonymousConnector = class AnonymousConnector extends (0, ConnectorBase_1.Co
 exports.AnonymousConnector = AnonymousConnector;
 exports.AnonymousConnector = AnonymousConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_configuration_1.ConfigService])
 ], AnonymousConnector);
 //# sourceMappingURL=AnonymousConnector.js.map

package/src/connectors/AppleConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import type { Profile as PassportProfile } from 'passport';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';

package/src/connectors/AppleConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AppleConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_apple_1 = require("passport-apple");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
@@ -80,6 +80,6 @@ let AppleConnector = class AppleConnector extends (0, ConnectorBase_1.ConnectorB
 exports.AppleConnector = AppleConnector;
 exports.AppleConnector = AppleConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_configuration_1.ConfigService])
 ], AppleConnector);
 //# sourceMappingURL=AppleConnector.js.map

package/src/connectors/GithubConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { type Profile } from 'passport-github2';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';

package/src/connectors/GithubConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GithubConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_github2_1 = require("passport-github2");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
@@ -31,6 +31,7 @@ let GithubConnector = class GithubConnector extends (0, ConnectorBase_1.Connecto
             clientSecret: configService.get(env_1.AUTH_GITHUB_CLIENT_SECRET.key),
             callbackURL: configService.tryGet(env_1.AUTH_GITHUB_CALLBACK_URL.key, '/auth/github/callback'),
             scope,
+            state: true,
         });
         this._socialAuth = socialAuth;
     }
@@ -60,6 +61,6 @@ let GithubConnector = class GithubConnector extends (0, ConnectorBase_1.Connecto
 exports.GithubConnector = GithubConnector;
 exports.GithubConnector = GithubConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_configuration_1.ConfigService])
 ], GithubConnector);
 //# sourceMappingURL=GithubConnector.js.map

package/src/connectors/GoogleConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { Profile } from 'passport-google-oauth20';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';

package/src/connectors/GoogleConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GoogleConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_google_oauth20_1 = require("passport-google-oauth20");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
@@ -75,6 +75,6 @@ let GoogleConnector = class GoogleConnector extends (0, ConnectorBase_1.Connecto
 exports.GoogleConnector = GoogleConnector;
 exports.GoogleConnector = GoogleConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_configuration_1.ConfigService])
 ], GoogleConnector);
 //# sourceMappingURL=GoogleConnector.js.map

package/src/connectors/JwtConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { JwtPayloadBase } from '../models/JwtPayloadBase';

package/src/connectors/JwtConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_jwt_1 = require("passport-jwt");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
@@ -51,6 +51,6 @@ let JwtConnector = class JwtConnector extends (0, ConnectorBase_1.ConnectorBase)
 exports.JwtConnector = JwtConnector;
 exports.JwtConnector = JwtConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_configuration_1.ConfigService])
 ], JwtConnector);
 //# sourceMappingURL=JwtConnector.js.map

package/src/connectors/MicrosoftConnector.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import type { Profile as PassportProfile } from 'passport';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';

package/src/connectors/MicrosoftConnector.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MicrosoftConnector = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const passport_microsoft_1 = require("passport-microsoft");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
@@ -76,6 +76,6 @@ let MicrosoftConnector = class MicrosoftConnector extends (0, ConnectorBase_1.Co
 exports.MicrosoftConnector = MicrosoftConnector;
 exports.MicrosoftConnector = MicrosoftConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_configuration_1.ConfigService])
 ], MicrosoftConnector);
 //# sourceMappingURL=MicrosoftConnector.js.map

package/src/connectors/apple/env.d.ts

@@ -1,3 +1,3 @@
-import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 /** Configuration entries required by Apple Sign-In authentication. */
 export declare const APPLE_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/connectors/github/env.d.ts

@@ -1,3 +1,3 @@
-import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 /** Configuration entries required by GitHub OAuth authentication. */
 export declare const GITHUB_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/connectors/google/env.d.ts

@@ -1,3 +1,3 @@
-import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 /** Configuration entries required by Google OAuth authentication. */
 export declare const GOOGLE_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/connectors/microsoft/env.d.ts

@@ -1,3 +1,3 @@
-import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 /** Configuration entries required by Microsoft OAuth authentication. */
 export declare const MICROSOFT_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/contracts/ChallengeStorePort.d.ts

@@ -0,0 +1,32 @@
+import type { IMfaChallengeState } from '../services/ChallengeService';
+/**
+ * Abstract port for persisting MFA challenge state.
+ *
+ * The default implementation stores challenges in-memory (single instance only).
+ * For multi-instance deployments, provide a Redis-backed implementation
+ * via `IAuthModuleOptions.challengeStore`.
+ *
+ * @public
+ */
+export declare abstract class ChallengeStorePort {
+    /**
+     * Store a challenge.
+     *
+     * @param id - The challenge identifier.
+     * @param challenge - The challenge state to persist.
+     */
+    abstract set(id: string, challenge: IMfaChallengeState): Promise<void>;
+    /**
+     * Retrieve a challenge by its identifier.
+     *
+     * @param id - The challenge identifier.
+     * @returns The challenge state, or `undefined` if not found.
+     */
+    abstract get(id: string): Promise<IMfaChallengeState | undefined>;
+    /**
+     * Remove a challenge by its identifier.
+     *
+     * @param id - The challenge identifier.
+     */
+    abstract delete(id: string): Promise<void>;
+}

package/src/contracts/ChallengeStorePort.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeStorePort = void 0;
+/**
+ * Abstract port for persisting MFA challenge state.
+ *
+ * The default implementation stores challenges in-memory (single instance only).
+ * For multi-instance deployments, provide a Redis-backed implementation
+ * via `IAuthModuleOptions.challengeStore`.
+ *
+ * @public
+ */
+class ChallengeStorePort {
+}
+exports.ChallengeStorePort = ChallengeStorePort;
+//# sourceMappingURL=ChallengeStorePort.js.map

package/src/contracts/index.d.ts

@@ -1,4 +1,5 @@
 export { AuthSubjectPort } from './AuthSubjectPort';
+export { ChallengeStorePort } from './ChallengeStorePort';
 export type { IAuthSubject } from './IAuthSubject';
 export type { IMfaSubject } from './IMfaSubject';
 export type { IMfaSubjectUpdate } from './IMfaSubjectUpdate';

package/src/contracts/index.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerificationSubjectPort = exports.TokenEnricherPort = exports.SocialAuthPort = exports.SessionPersistencePort = exports.MfaSubjectPort = exports.AuthSubjectPort = void 0;
+exports.VerificationSubjectPort = exports.TokenEnricherPort = exports.SocialAuthPort = exports.SessionPersistencePort = exports.MfaSubjectPort = exports.ChallengeStorePort = exports.AuthSubjectPort = void 0;
 var AuthSubjectPort_1 = require("./AuthSubjectPort");
 Object.defineProperty(exports, "AuthSubjectPort", { enumerable: true, get: function () { return AuthSubjectPort_1.AuthSubjectPort; } });
+var ChallengeStorePort_1 = require("./ChallengeStorePort");
+Object.defineProperty(exports, "ChallengeStorePort", { enumerable: true, get: function () { return ChallengeStorePort_1.ChallengeStorePort; } });
 var MfaSubjectPort_1 = require("./MfaSubjectPort");
 Object.defineProperty(exports, "MfaSubjectPort", { enumerable: true, get: function () { return MfaSubjectPort_1.MfaSubjectPort; } });
 var SessionPersistencePort_1 = require("./SessionPersistencePort");

package/src/env.d.ts

@@ -1,69 +1,69 @@
-import { IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+import { IConfigRegistryEntry } from '@breadstone/archipel-platform-configuration';
 /** Secret used to sign JWTs. */
-export declare const AUTH_JWT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_JWT_SECRET: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Lifetime of access tokens (e.g. `'15m'`, `'1h'`). */
-export declare const AUTH_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Lifetime of email-verification JWTs. */
-export declare const AUTH_VERIFY_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_VERIFY_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** AES encryption key used to encrypt MFA secrets at rest. */
-export declare const AUTH_MFA_ENCRYPTION_KEY: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_ENCRYPTION_KEY: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** How long an MFA challenge stays valid (e.g. `'5m'`). */
-export declare const AUTH_MFA_CHALLENGE_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_CHALLENGE_EXPIRES_IN: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Maximum number of failed MFA attempts before lockout. */
-export declare const AUTH_MFA_MAX_ATTEMPTS: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_MAX_ATTEMPTS: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Issuer name shown in authenticator apps for TOTP MFA. */
-export declare const AUTH_MFA_ISSUER: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_ISSUER: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
-export declare const AUTH_MFA_SMS_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_SMS_CODE_TTL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Minimum interval between SMS resend requests (e.g. `'30s'`). */
-export declare const AUTH_MFA_SMS_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_SMS_MIN_RESEND: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Time-to-live for email OTP codes (e.g. `'10m'`). */
-export declare const AUTH_MFA_EMAIL_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_EMAIL_CODE_TTL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Minimum interval between email OTP resend requests (e.g. `'30s'`). */
-export declare const AUTH_MFA_EMAIL_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_EMAIL_MIN_RESEND: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Time-to-live for push OTP codes (e.g. `'10m'`). */
-export declare const AUTH_MFA_PUSH_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_PUSH_CODE_TTL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Minimum interval between push OTP resend requests (e.g. `'30s'`). */
-export declare const AUTH_MFA_PUSH_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MFA_PUSH_MIN_RESEND: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Google OAuth2 client ID. */
-export declare const AUTH_GOOGLE_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GOOGLE_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Google OAuth2 client secret. */
-export declare const AUTH_GOOGLE_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GOOGLE_CLIENT_SECRET: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Google OAuth2 callback URL. */
-export declare const AUTH_GOOGLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GOOGLE_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
-export declare const AUTH_GOOGLE_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GOOGLE_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Microsoft OAuth2 client ID. */
-export declare const AUTH_MICROSOFT_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MICROSOFT_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Microsoft OAuth2 client secret. */
-export declare const AUTH_MICROSOFT_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MICROSOFT_CLIENT_SECRET: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Microsoft OAuth2 callback URL. */
-export declare const AUTH_MICROSOFT_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MICROSOFT_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Microsoft tenant ID or `'common'` for multi-tenant. */
-export declare const AUTH_MICROSOFT_TENANT: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MICROSOFT_TENANT: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
-export declare const AUTH_MICROSOFT_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_MICROSOFT_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Apple Sign-In private key (PEM string). */
-export declare const AUTH_APPLE_PRIVATE_KEY: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_PRIVATE_KEY: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Apple Sign-In client (service) ID. */
-export declare const AUTH_APPLE_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Apple developer team ID. */
-export declare const AUTH_APPLE_TEAM_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_TEAM_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Apple Sign-In key ID. */
-export declare const AUTH_APPLE_KEY_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_KEY_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Apple Sign-In callback URL. */
-export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
-export declare const AUTH_APPLE_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_APPLE_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** GitHub OAuth client ID. */
-export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** GitHub OAuth client secret. */
-export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** GitHub OAuth callback URL. */
-export declare const AUTH_GITHUB_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GITHUB_CALLBACK_URL: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
-export declare const AUTH_GITHUB_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const AUTH_GITHUB_SCOPE: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Username used for the anonymous seed user. */
-export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-configuration").IConfigKey<string>;
 /** Core configuration entries required by `platform-authentication`. */
 export declare const PLATFORM_AUTHENTICATION_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;