@de-otio/trellis 0.4.0

package/dist/lib/metadata/metadata-sanitizer.d.ts

@@ -0,0 +1,9 @@
+export declare function sanitizeString(value: unknown): string | undefined;
+export declare function validateGPS(lat: unknown, lng: unknown): {
+    latitude: number;
+    longitude: number;
+} | undefined;
+export declare function validateKeywords(value: unknown): string[] | undefined;
+export declare function validateDate(value: unknown): string | undefined;
+export declare function validateMetadataSize(obj: unknown): void;
+//# sourceMappingURL=metadata-sanitizer.d.ts.map

package/dist/lib/metadata/metadata-sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-sanitizer.d.ts","sourceRoot":"","sources":["../../../src/lib/metadata/metadata-sanitizer.ts"],"names":[],"mappings":"AAGA,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWjE;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,OAAO,GACX;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQrD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAcrE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAuB/D;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuBvD"}

package/dist/lib/metadata/metadata-sanitizer.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeString = sanitizeString;
+exports.validateGPS = validateGPS;
+exports.validateKeywords = validateKeywords;
+exports.validateDate = validateDate;
+exports.validateMetadataSize = validateMetadataSize;
+const metadata_config_1 = require("./metadata-config");
+const metadata_errors_1 = require("./metadata-errors");
+function sanitizeString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    // Remove NULs and control chars (keep common whitespace)
+    const cleaned = value
+        .replace(/\u0000/g, "")
+        .replace(/[\u0001-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "")
+        .trim();
+    if (!cleaned)
+        return undefined;
+    if (cleaned.length <= metadata_config_1.METADATA_LIMITS.MAX_STRING_FIELD_LENGTH)
+        return cleaned;
+    return cleaned.slice(0, metadata_config_1.METADATA_LIMITS.MAX_STRING_FIELD_LENGTH);
+}
+function validateGPS(lat, lng) {
+    if (lat === null || lat === undefined || lng === null || lng === undefined)
+        return undefined;
+    if (typeof lat !== "number" || typeof lng !== "number")
+        return undefined;
+    if (!Number.isFinite(lat) || !Number.isFinite(lng))
+        return undefined;
+    if (lat < -90 || lat > 90)
+        return undefined;
+    if (lng < -180 || lng > 180)
+        return undefined;
+    return { latitude: lat, longitude: lng };
+}
+function validateKeywords(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const out = [];
+    for (const item of value) {
+        const s = sanitizeString(item);
+        if (!s)
+            continue;
+        const kw = s.length <= metadata_config_1.METADATA_LIMITS.MAX_KEYWORD_LENGTH
+            ? s
+            : s.slice(0, metadata_config_1.METADATA_LIMITS.MAX_KEYWORD_LENGTH);
+        out.push(kw);
+        if (out.length >= metadata_config_1.METADATA_LIMITS.MAX_KEYWORDS)
+            break;
+    }
+    return out.length ? out : undefined;
+}
+function validateDate(value) {
+    // Accept Date, ISO string, or epoch ms/seconds.
+    let d;
+    if (value instanceof Date)
+        d = value;
+    else if (typeof value === "string") {
+        const parsed = new Date(value);
+        if (!Number.isNaN(parsed.getTime()))
+            d = parsed;
+    }
+    else if (typeof value === "number" && Number.isFinite(value)) {
+        // Heuristic: treat 10-digit as seconds, 13-digit as ms
+        const ms = value < 2_000_000_000 ? value * 1000 : value;
+        const parsed = new Date(ms);
+        if (!Number.isNaN(parsed.getTime()))
+            d = parsed;
+    }
+    if (!d)
+        return undefined;
+    const min = new Date("1900-01-01T00:00:00.000Z").getTime();
+    const max = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000).getTime();
+    const t = d.getTime();
+    if (t < min || t > max)
+        return undefined;
+    return new Date(t).toISOString();
+}
+function validateMetadataSize(obj) {
+    try {
+        const json = JSON.stringify(obj ?? null);
+        const bytes = new TextEncoder().encode(json).byteLength;
+        if (bytes > metadata_config_1.METADATA_LIMITS.MAX_METADATA_SIZE_BYTES) {
+            throw new metadata_errors_1.MetadataValidationError("Metadata payload exceeds maximum size", {
+                code: "size_exceeded",
+                issues: { bytes, maxBytes: metadata_config_1.METADATA_LIMITS.MAX_METADATA_SIZE_BYTES },
+            });
+        }
+    }
+    catch (e) {
+        if (e instanceof metadata_errors_1.MetadataValidationError)
+            throw e;
+        // If serialization fails, treat as validation failure
+        throw new metadata_errors_1.MetadataValidationError("Failed to serialize metadata for size validation", {
+            issues: String(e),
+        });
+    }
+}
+//# sourceMappingURL=metadata-sanitizer.js.map

package/dist/lib/metadata/metadata-sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-sanitizer.js","sourceRoot":"","sources":["../../../src/lib/metadata/metadata-sanitizer.ts"],"names":[],"mappings":";;AAGA,wCAWC;AAED,kCAWC;AAED,4CAcC;AAED,oCAuBC;AAED,oDAuBC;AA7FD,uDAAoD;AACpD,uDAA4D;AAE5D,SAAgB,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK;SAClB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,iDAAiD,EAAE,EAAE,CAAC;SAC9D,IAAI,EAAE,CAAC;IAEV,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,IAAI,iCAAe,CAAC,uBAAuB;QAAE,OAAO,OAAO,CAAC;IAC9E,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAe,CAAC,uBAAuB,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,WAAW,CACzB,GAAY,EACZ,GAAY;IAEZ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QACxE,OAAO,SAAS,CAAC;IACnB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,EAAE,GACN,CAAC,CAAC,MAAM,IAAI,iCAAe,CAAC,kBAAkB;YAC5C,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAe,CAAC,kBAAkB,CAAC,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,GAAG,CAAC,MAAM,IAAI,iCAAe,CAAC,YAAY;YAAE,MAAM;IACxD,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,gDAAgD;IAChD,IAAI,CAAmB,CAAC;IAExB,IAAI,KAAK,YAAY,IAAI;QAAE,CAAC,GAAG,KAAK,CAAC;SAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,CAAC,GAAG,MAAM,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,uDAAuD;QACvD,MAAM,EAAE,GAAG,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,CAAC,GAAG,MAAM,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;QACxD,IAAI,KAAK,GAAG,iCAAe,CAAC,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,yCAAuB,CAC/B,uCAAuC,EACvC;gBACE,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,iCAAe,CAAC,uBAAuB,EAAE;aACrE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,yCAAuB;YAAE,MAAM,CAAC,CAAC;QAClD,sDAAsD;QACtD,MAAM,IAAI,yCAAuB,CAC/B,kDAAkD,EAClD;YACE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAClB,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/metadata/metadata-schemas.d.ts

@@ -0,0 +1,131 @@
+import { z } from "zod";
+export declare const GPSCoordsSchema: z.ZodObject<{
+    latitude: z.ZodEffects<z.ZodNumber, number, number>;
+    longitude: z.ZodEffects<z.ZodNumber, number, number>;
+}, "strict", z.ZodTypeAny, {
+    latitude: number;
+    longitude: number;
+}, {
+    latitude: number;
+    longitude: number;
+}>;
+export declare const EXIFDataSchema: z.ZodObject<{
+    make: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    lensModel: z.ZodOptional<z.ZodString>;
+    software: z.ZodOptional<z.ZodString>;
+    iso: z.ZodOptional<z.ZodNumber>;
+    fNumber: z.ZodOptional<z.ZodNumber>;
+    exposureTime: z.ZodOptional<z.ZodNumber>;
+    focalLength: z.ZodOptional<z.ZodNumber>;
+    dateTimeOriginal: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    gps: z.ZodOptional<z.ZodObject<{
+        latitude: z.ZodEffects<z.ZodNumber, number, number>;
+        longitude: z.ZodEffects<z.ZodNumber, number, number>;
+    }, "strict", z.ZodTypeAny, {
+        latitude: number;
+        longitude: number;
+    }, {
+        latitude: number;
+        longitude: number;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    model?: string | undefined;
+    make?: string | undefined;
+    lensModel?: string | undefined;
+    software?: string | undefined;
+    iso?: number | undefined;
+    fNumber?: number | undefined;
+    exposureTime?: number | undefined;
+    focalLength?: number | undefined;
+    dateTimeOriginal?: string | undefined;
+    gps?: {
+        latitude: number;
+        longitude: number;
+    } | undefined;
+}, {
+    model?: string | undefined;
+    make?: string | undefined;
+    lensModel?: string | undefined;
+    software?: string | undefined;
+    iso?: number | undefined;
+    fNumber?: number | undefined;
+    exposureTime?: number | undefined;
+    focalLength?: number | undefined;
+    dateTimeOriginal?: string | undefined;
+    gps?: {
+        latitude: number;
+        longitude: number;
+    } | undefined;
+}>;
+export declare const IPTCDataSchema: z.ZodObject<{
+    keywords: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    copyrightNotice: z.ZodOptional<z.ZodString>;
+    creator: z.ZodOptional<z.ZodString>;
+    caption: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    keywords?: string[] | undefined;
+    creator?: string | undefined;
+    copyrightNotice?: string | undefined;
+    caption?: string | undefined;
+}, {
+    keywords?: string[] | undefined;
+    creator?: string | undefined;
+    copyrightNotice?: string | undefined;
+    caption?: string | undefined;
+}>;
+export declare const VideoMetadataSchema: z.ZodObject<{
+    width: z.ZodOptional<z.ZodNumber>;
+    height: z.ZodOptional<z.ZodNumber>;
+    duration: z.ZodOptional<z.ZodNumber>;
+    dateTaken: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    gps: z.ZodOptional<z.ZodObject<{
+        latitude: z.ZodEffects<z.ZodNumber, number, number>;
+        longitude: z.ZodEffects<z.ZodNumber, number, number>;
+    }, "strict", z.ZodTypeAny, {
+        latitude: number;
+        longitude: number;
+    }, {
+        latitude: number;
+        longitude: number;
+    }>>;
+    codec: z.ZodOptional<z.ZodString>;
+    bitrate: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    width?: number | undefined;
+    height?: number | undefined;
+    duration?: number | undefined;
+    dateTaken?: string | undefined;
+    gps?: {
+        latitude: number;
+        longitude: number;
+    } | undefined;
+    codec?: string | undefined;
+    bitrate?: number | undefined;
+}, {
+    width?: number | undefined;
+    height?: number | undefined;
+    duration?: number | undefined;
+    dateTaken?: string | undefined;
+    gps?: {
+        latitude: number;
+        longitude: number;
+    } | undefined;
+    codec?: string | undefined;
+    bitrate?: number | undefined;
+}>;
+export declare const MetadataVisibilitySchema: z.ZodObject<{
+    metadataVisible: z.ZodBoolean;
+    locationVisible: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    metadataVisible: boolean;
+    locationVisible: boolean;
+}, {
+    metadataVisible: boolean;
+    locationVisible: boolean;
+}>;
+export type EXIFData = z.infer<typeof EXIFDataSchema>;
+export type IPTCData = z.infer<typeof IPTCDataSchema>;
+export type VideoMetadata = z.infer<typeof VideoMetadataSchema>;
+export type MetadataVisibility = z.infer<typeof MetadataVisibilitySchema>;
+//# sourceMappingURL=metadata-schemas.d.ts.map

package/dist/lib/metadata/metadata-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-schemas.d.ts","sourceRoot":"","sources":["../../../src/lib/metadata/metadata-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,eAAe;;;;;;;;;EAajB,CAAC;AAYZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBhB,CAAC;AAEZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;EAOhB,CAAC;AAEZ,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAarB,CAAC;AAEZ,eAAO,MAAM,wBAAwB;;;;;;;;;EAK1B,CAAC;AAEZ,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/lib/metadata/metadata-schemas.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MetadataVisibilitySchema = exports.VideoMetadataSchema = exports.IPTCDataSchema = exports.EXIFDataSchema = exports.GPSCoordsSchema = void 0;
+const zod_1 = require("zod");
+const FiniteNumber = zod_1.z
+    .number()
+    .refine((v) => Number.isFinite(v), "Must be finite");
+exports.GPSCoordsSchema = zod_1.z
+    .object({
+    latitude: zod_1.z
+        .number()
+        .min(-90)
+        .max(90)
+        .refine((v) => Number.isFinite(v), "Must be finite"),
+    longitude: zod_1.z
+        .number()
+        .min(-180)
+        .max(180)
+        .refine((v) => Number.isFinite(v), "Must be finite"),
+})
+    .strict();
+const ISODateString = zod_1.z
+    .string()
+    .datetime()
+    .refine((s) => {
+    const t = new Date(s).getTime();
+    const min = new Date("1900-01-01T00:00:00.000Z").getTime();
+    const max = Date.now() + 365 * 24 * 60 * 60 * 1000;
+    return t >= min && t <= max;
+}, "Date out of allowed range");
+exports.EXIFDataSchema = zod_1.z
+    .object({
+    make: zod_1.z.string().max(1024).optional(),
+    model: zod_1.z.string().max(1024).optional(),
+    lensModel: zod_1.z.string().max(1024).optional(),
+    software: zod_1.z.string().max(1024).optional(),
+    iso: zod_1.z.number().int().positive().optional(),
+    fNumber: zod_1.z.number().positive().optional(),
+    exposureTime: zod_1.z.number().positive().optional(),
+    focalLength: zod_1.z.number().positive().optional(),
+    dateTimeOriginal: ISODateString.optional(),
+    gps: exports.GPSCoordsSchema.optional(),
+})
+    .strict();
+exports.IPTCDataSchema = zod_1.z
+    .object({
+    keywords: zod_1.z.array(zod_1.z.string().max(64)).max(100).optional(),
+    copyrightNotice: zod_1.z.string().max(1024).optional(),
+    creator: zod_1.z.string().max(1024).optional(),
+    caption: zod_1.z.string().max(1024).optional(),
+})
+    .strict();
+exports.VideoMetadataSchema = zod_1.z
+    .object({
+    // Basic, Workers-friendly fields (best-effort)
+    width: zod_1.z.number().int().positive().optional(),
+    height: zod_1.z.number().int().positive().optional(),
+    duration: zod_1.z.number().int().positive().optional(),
+    dateTaken: ISODateString.optional(),
+    gps: exports.GPSCoordsSchema.optional(),
+    codec: zod_1.z.string().max(128).optional(),
+    bitrate: zod_1.z.number().int().positive().optional(),
+})
+    .strict();
+exports.MetadataVisibilitySchema = zod_1.z
+    .object({
+    metadataVisible: zod_1.z.boolean(),
+    locationVisible: zod_1.z.boolean(),
+})
+    .strict();
+//# sourceMappingURL=metadata-schemas.js.map

package/dist/lib/metadata/metadata-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata-schemas.js","sourceRoot":"","sources":["../../../src/lib/metadata/metadata-schemas.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,MAAM,YAAY,GAAG,OAAC;KACnB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAE1C,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,CAAC;SACR,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACtD,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,GAAG,CAAC;SACT,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,OAAC;KACpB,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;IACZ,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACnD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC;AAC9B,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAErB,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAEzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,aAAa,CAAC,QAAQ,EAAE;IAE1C,GAAG,EAAE,uBAAe,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,mBAAmB,GAAG,OAAC;KACjC,MAAM,CAAC;IACN,+CAA+C;IAC/C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEhD,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,uBAAe,CAAC,QAAQ,EAAE;IAE/B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC;IACN,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;IAC5B,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/lib/mfa/mfa-handler.d.ts

@@ -0,0 +1,60 @@
+/**
+ * MFA Handler (AUTH-1)
+ *
+ * Manages MFA enrollment, verification, and backup code operations.
+ * MFA is mandatory for SUPER_ADMIN and PARTNER_ADMIN roles,
+ * optional for other roles.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { Env } from "../../env";
+export declare class MfaHandler {
+    private logger;
+    constructor(env: Env);
+    /**
+     * Check if MFA is required for a given role.
+     */
+    isMfaRequired(role?: string): boolean;
+    /**
+     * Check if a user has MFA enrolled.
+     */
+    isEnrolled(prisma: PrismaClient, userId: string): Promise<boolean>;
+    /**
+     * Begin MFA enrollment: generate secret and backup codes.
+     * Returns the secret URI (for QR code) and plaintext backup codes.
+     * The caller must verify a TOTP code before finalizing enrollment.
+     */
+    beginEnrollment(email: string): Promise<{
+        secret: string;
+        otpauthUri: string;
+        backupCodes: string[];
+    }>;
+    /**
+     * Finalize enrollment after the user verifies a TOTP code.
+     * Stores the encrypted secret and hashed backup codes.
+     */
+    finalizeEnrollment(prisma: PrismaClient, userId: string, secret: string, backupCodes: string[], verificationCode: string, encryptionKey: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    /**
+     * Verify a TOTP code for an enrolled user.
+     */
+    verifyCode(prisma: PrismaClient, userId: string, code: string, encryptionKey: string): Promise<boolean>;
+    /**
+     * Verify a backup code (one-time use).
+     */
+    verifyBackupCode(prisma: PrismaClient, userId: string, code: string): Promise<boolean>;
+    /**
+     * Remove MFA enrollment (for account recovery by super-admin).
+     */
+    removeEnrollment(prisma: PrismaClient, userId: string): Promise<void>;
+    /**
+     * Get MFA status for a user.
+     */
+    getStatus(prisma: PrismaClient, userId: string, role?: string): Promise<{
+        enrolled: boolean;
+        required: boolean;
+        backupCodesRemaining?: number;
+    }>;
+}
+//# sourceMappingURL=mfa-handler.d.ts.map

package/dist/lib/mfa/mfa-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/mfa/mfa-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAcrC,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAS;gBAEX,GAAG,EAAE,GAAG;IAIpB;;OAEG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAIrC;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAQnB;;;;OAIG;IACG,eAAe,CACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC;IAQF;;;OAGG;IACG,kBAAkB,CACtB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,gBAAgB,EAAE,MAAM,EACxB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkChD;;OAEG;IACG,UAAU,CACd,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC;IAsBnB;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IA8BnB;;OAEG;IACG,gBAAgB,CACpB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAOhB;;OAEG;IACG,SAAS,CACb,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CAYH"}

package/dist/lib/mfa/mfa-handler.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * MFA Handler (AUTH-1)
+ *
+ * Manages MFA enrollment, verification, and backup code operations.
+ * MFA is mandatory for SUPER_ADMIN and PARTNER_ADMIN roles,
+ * optional for other roles.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MfaHandler = void 0;
+const logger_1 = require("../logger");
+const totp_service_1 = require("./totp-service");
+const MFA_REQUIRED_ROLES = ["SUPER_ADMIN", "PARTNER_ADMIN"];
+class MfaHandler {
+    logger;
+    constructor(env) {
+        this.logger = logger_1.Logger.getInstance(env);
+    }
+    /**
+     * Check if MFA is required for a given role.
+     */
+    isMfaRequired(role) {
+        return !!role && MFA_REQUIRED_ROLES.includes(role);
+    }
+    /**
+     * Check if a user has MFA enrolled.
+     */
+    async isEnrolled(prisma, userId) {
+        const enrollment = await prisma.mfaEnrollment.findUnique({
+            where: { userId },
+            select: { id: true },
+        });
+        return !!enrollment;
+    }
+    /**
+     * Begin MFA enrollment: generate secret and backup codes.
+     * Returns the secret URI (for QR code) and plaintext backup codes.
+     * The caller must verify a TOTP code before finalizing enrollment.
+     */
+    async beginEnrollment(email) {
+        const secret = (0, totp_service_1.generateSecret)();
+        const otpauthUri = (0, totp_service_1.buildOTPAuthURI)(secret, email);
+        const backupCodes = (0, totp_service_1.generateBackupCodes)(10);
+        return { secret, otpauthUri, backupCodes };
+    }
+    /**
+     * Finalize enrollment after the user verifies a TOTP code.
+     * Stores the encrypted secret and hashed backup codes.
+     */
+    async finalizeEnrollment(prisma, userId, secret, backupCodes, verificationCode, encryptionKey) {
+        // Verify the user can generate a valid code
+        const valid = await (0, totp_service_1.verifyTOTP)(secret, verificationCode);
+        if (!valid) {
+            return { success: false, error: "Invalid verification code" };
+        }
+        // Encrypt the secret for storage
+        const encrypted = await (0, totp_service_1.encryptSecret)(secret, encryptionKey);
+        // Hash all backup codes
+        const hashedCodes = await Promise.all(backupCodes.map((code) => (0, totp_service_1.hashBackupCode)(code)));
+        // Upsert enrollment (in case of re-enrollment)
+        await prisma.mfaEnrollment.upsert({
+            where: { userId },
+            create: {
+                userId,
+                encryptedSecret: encrypted,
+                backupCodes: hashedCodes,
+            },
+            update: {
+                encryptedSecret: encrypted,
+                backupCodes: hashedCodes,
+                lastUsedAt: null,
+            },
+        });
+        this.logger.info("[MFA] Enrollment finalized", { userId });
+        return { success: true };
+    }
+    /**
+     * Verify a TOTP code for an enrolled user.
+     */
+    async verifyCode(prisma, userId, code, encryptionKey) {
+        const enrollment = await prisma.mfaEnrollment.findUnique({
+            where: { userId },
+        });
+        if (!enrollment)
+            return false;
+        const secret = await (0, totp_service_1.decryptSecret)(enrollment.encryptedSecret, encryptionKey);
+        const valid = await (0, totp_service_1.verifyTOTP)(secret, code);
+        if (valid) {
+            await prisma.mfaEnrollment.update({
+                where: { userId },
+                data: { lastUsedAt: new Date() },
+            });
+        }
+        return valid;
+    }
+    /**
+     * Verify a backup code (one-time use).
+     */
+    async verifyBackupCode(prisma, userId, code) {
+        const enrollment = await prisma.mfaEnrollment.findUnique({
+            where: { userId },
+        });
+        if (!enrollment)
+            return false;
+        const codeHash = await (0, totp_service_1.hashBackupCode)(code);
+        const index = enrollment.backupCodes.indexOf(codeHash);
+        if (index === -1)
+            return false;
+        // Remove used backup code
+        const updatedCodes = [...enrollment.backupCodes];
+        updatedCodes.splice(index, 1);
+        await prisma.mfaEnrollment.update({
+            where: { userId },
+            data: {
+                backupCodes: updatedCodes,
+                lastUsedAt: new Date(),
+            },
+        });
+        this.logger.info("[MFA] Backup code used", {
+            userId,
+            remainingCodes: updatedCodes.length,
+        });
+        return true;
+    }
+    /**
+     * Remove MFA enrollment (for account recovery by super-admin).
+     */
+    async removeEnrollment(prisma, userId) {
+        await prisma.mfaEnrollment.deleteMany({
+            where: { userId },
+        });
+        this.logger.info("[MFA] Enrollment removed", { userId });
+    }
+    /**
+     * Get MFA status for a user.
+     */
+    async getStatus(prisma, userId, role) {
+        const enrollment = await prisma.mfaEnrollment.findUnique({
+            where: { userId },
+            select: { backupCodes: true },
+        });
+        return {
+            enrolled: !!enrollment,
+            required: this.isMfaRequired(role),
+            backupCodesRemaining: enrollment?.backupCodes.length,
+        };
+    }
+}
+exports.MfaHandler = MfaHandler;
+//# sourceMappingURL=mfa-handler.js.map

package/dist/lib/mfa/mfa-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-handler.js","sourceRoot":"","sources":["../../../src/lib/mfa/mfa-handler.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAIH,sCAAmC;AACnC,iDAQwB;AAExB,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AAE5D,MAAa,UAAU;IACb,MAAM,CAAS;IAEvB,YAAY,GAAQ;QAClB,IAAI,CAAC,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAa;QACzB,OAAO,CAAC,CAAC,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,MAAoB,EACpB,MAAc;QAEd,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,UAAU,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,KAAa;QAMb,MAAM,MAAM,GAAG,IAAA,6BAAc,GAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,MAAoB,EACpB,MAAc,EACd,MAAc,EACd,WAAqB,EACrB,gBAAwB,EACxB,aAAqB;QAErB,4CAA4C;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAA,yBAAU,EAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,MAAM,IAAA,4BAAa,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAE7D,wBAAwB;QACxB,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,6BAAc,EAAC,IAAI,CAAC,CAAC,CAChD,CAAC;QAEF,+CAA+C;QAC/C,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YAChC,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,MAAM,EAAE;gBACN,MAAM;gBACN,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,WAAW;aACzB;YACD,MAAM,EAAE;gBACN,eAAe,EAAE,SAAS;gBAC1B,WAAW,EAAE,WAAW;gBACxB,UAAU,EAAE,IAAI;aACjB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,MAAoB,EACpB,MAAc,EACd,IAAY,EACZ,aAAqB;QAErB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,MAAM,EAAE;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAa,EAChC,UAAU,CAAC,eAAe,EAC1B,aAAa,CACd,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAA,yBAAU,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAChC,KAAK,EAAE,EAAE,MAAM,EAAE;gBACjB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAoB,EACpB,MAAc,EACd,IAAY;QAEZ,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,MAAM,EAAE;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAE9B,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAc,EAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEvD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE/B,0BAA0B;QAC1B,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QACjD,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE9B,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YAChC,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,IAAI,EAAE;gBACJ,WAAW,EAAE,YAAY;gBACzB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACzC,MAAM;YACN,cAAc,EAAE,YAAY,CAAC,MAAM;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,MAAoB,EACpB,MAAc;QAEd,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,MAAM,EAAE;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,MAAoB,EACpB,MAAc,EACd,IAAa;QAMb,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,CAAC,CAAC,UAAU;YACtB,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAClC,oBAAoB,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM;SACrD,CAAC;IACJ,CAAC;CACF;AAnMD,gCAmMC"}

package/dist/lib/mfa/totp-service.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TOTP Service (AUTH-1)
+ *
+ * Implements RFC 6238 TOTP generation and verification using Web Crypto API.
+ * No external dependencies — uses only the Web Crypto API available in
+ * Cloudflare Workers and modern runtimes.
+ */
+/**
+ * Generate a random TOTP secret (base32-encoded).
+ */
+export declare function generateSecret(): string;
+/**
+ * Generate a TOTP code for a given secret and time.
+ */
+export declare function generateTOTP(secret: string, time?: number): Promise<string>;
+/**
+ * Verify a TOTP code against a secret.
+ * Allows a window of ±1 period to account for clock skew.
+ */
+export declare function verifyTOTP(secret: string, code: string, window?: number): Promise<boolean>;
+/**
+ * Build an otpauth:// URI for QR code generation.
+ */
+export declare function buildOTPAuthURI(secret: string, email: string, issuer?: string): string;
+/**
+ * Generate backup codes (10 codes, 8 alphanumeric chars each).
+ */
+export declare function generateBackupCodes(count?: number): string[];
+/**
+ * Hash a backup code for storage using SHA-256.
+ */
+export declare function hashBackupCode(code: string): Promise<string>;
+/**
+ * Encrypt a TOTP secret for database storage using AES-GCM.
+ */
+export declare function encryptSecret(secret: string, encryptionKey: string): Promise<string>;
+/**
+ * Decrypt a TOTP secret from database storage.
+ */
+export declare function decryptSecret(encryptedSecret: string, encryptionKey: string): Promise<string>;
+//# sourceMappingURL=totp-service.d.ts.map

package/dist/lib/mfa/totp-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-service.d.ts","sourceRoot":"","sources":["../../../src/lib/mfa/totp-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAU,GACjB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAkB,GACzB,MAAM,CAIR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,MAAW,GAAG,MAAM,EAAE,CAahE;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlE;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAuBjB"}