@furystack/security 8.0.0 → 8.0.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [8.0.2] - 2026-06-05
+
+### 👷 CI
+
+- Raised the minimum supported Node.js to `>=24.0.0` (Node 24 LTS) in `engines`, dropping Node 22.
+
+### ⬆️ Dependencies
+
+- Bumped dev `vitest` to `^4.1.8`. No source changes — dev-tooling bump only.
+
+## [8.0.1] - 2026-05-21
+
+### 📚 Documentation
+
+- Rewrote JSDoc on the error classes (`PasswordComplexityError`, `UnauthenticatedError`), the model types (`PasswordCredential`, `PasswordResetToken`), and the bundled password-complexity rules (`containsLowercase`, `containsUppercase`, `minLength`, `maxLength`) to follow the new value-test guidance: dropped restate-the-type narration, kept intent / trade-offs / constraints.
+
+### ⬆️ Dependencies
+
+- Bump dev `vitest` to `^4.1.5`.
+- Bumped `@types/node` to `^25.9.1` and `vitest` to `^4.1.7`. No source changes — dev-tooling bump only.
+
 ## [8.0.0] - 2026-04-25
 
 ### 💥 Breaking Changes

package/esm/errors/password-complexity-error.d.ts

@@ -1,12 +1,13 @@
+/**
+ * Thrown by password-setting flows when the candidate password fails one or
+ * more configured {@link PasswordComplexityRule}s. `result` carries the
+ * per-rule failures so callers can render targeted user feedback.
+ */
 export declare class PasswordComplexityError extends Error {
     readonly result: Array<{
         message: string;
         rule: string;
     }>;
-    /**
-     * @param result A detailed error result array
-     * @param message The Error message
-     */
     constructor(result: Array<{
         message: string;
         rule: string;

package/esm/errors/password-complexity-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-complexity-error.d.ts","sourceRoot":"","sources":["../../src/errors/password-complexity-error.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;aAM9B,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IALlE;;;OAGG;gBAEe,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAChE,OAAO,CAAC,EAAE,MAAM;CAInB"}
+{"version":3,"file":"password-complexity-error.d.ts","sourceRoot":"","sources":["../../src/errors/password-complexity-error.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;gBAAhD,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAChE,OAAO,CAAC,EAAE,MAAM;CAInB"}

package/esm/errors/password-complexity-error.js

@@ -1,9 +1,10 @@
+/**
+ * Thrown by password-setting flows when the candidate password fails one or
+ * more configured {@link PasswordComplexityRule}s. `result` carries the
+ * per-rule failures so callers can render targeted user feedback.
+ */
 export class PasswordComplexityError extends Error {
     result;
-    /**
-     * @param result A detailed error result array
-     * @param message The Error message
-     */
     constructor(result, message) {
         super(message);
         this.result = result;

package/esm/errors/password-complexity-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-complexity-error.js","sourceRoot":"","sources":["../../src/errors/password-complexity-error.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAM9B;IALlB;;;OAGG;IACH,YACkB,MAAgD,EAChE,OAAgB;QAEhB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,WAAM,GAAN,MAAM,CAA0C;IAIlE,CAAC;CACF"}
+{"version":3,"file":"password-complexity-error.js","sourceRoot":"","sources":["../../src/errors/password-complexity-error.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAE9B;IADlB,YACkB,MAAgD,EAChE,OAAgB;QAEhB,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,WAAM,GAAN,MAAM,CAA0C;IAIlE,CAAC;CACF"}

package/esm/errors/unauthenticated-error.d.ts

@@ -1,5 +1,7 @@
 /**
- * Error that can be thrown if an authentication is required but not provided
+ * Thrown when credential verification fails: bad username/password, expired
+ * password, or expired/invalid reset token. REST handlers should map this
+ * to a 401 response.
  */
 export declare class UnauthenticatedError extends Error {
 }

package/esm/errors/unauthenticated-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unauthenticated-error.d.ts","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;CAAG"}
+{"version":3,"file":"unauthenticated-error.d.ts","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;CAAG"}

package/esm/errors/unauthenticated-error.js

@@ -1,5 +1,7 @@
 /**
- * Error that can be thrown if an authentication is required but not provided
+ * Thrown when credential verification fails: bad username/password, expired
+ * password, or expired/invalid reset token. REST handlers should map this
+ * to a 401 response.
  */
 export class UnauthenticatedError extends Error {
 }

package/esm/errors/unauthenticated-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"unauthenticated-error.js","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG"}
+{"version":3,"file":"unauthenticated-error.js","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG"}

package/esm/models/password-credential.d.ts

@@ -1,22 +1,12 @@
 /**
- * Entry that stores credential info for password login
+ * Persisted password credential. `passwordHash` and `salt` are produced by
+ * the configured {@link PasswordHasher}; `creationDate` (ISO 8601 string)
+ * is the source of truth for password-expiration policies.
  */
 export declare class PasswordCredential {
-    /**
-     * The unique name of the user
-     */
     userName: string;
-    /**
-     * The hashed password value
-     */
     passwordHash: string;
-    /**
-     * Salt value for password hashing // TODO
-     */
     salt: string;
-    /**
-     * The Creation date in ISO String format
-     */
     creationDate: string;
 }
 //# sourceMappingURL=password-credential.d.ts.map

package/esm/models/password-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-credential.d.ts","sourceRoot":"","sources":["../../src/models/password-credential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,kBAAkB;IAC7B;;OAEG;IACK,QAAQ,EAAE,MAAM,CAAA;IACxB;;OAEG;IACK,YAAY,EAAE,MAAM,CAAA;IAE5B;;OAEG;IACK,IAAI,EAAE,MAAM,CAAA;IAEpB;;OAEG;IACK,YAAY,EAAE,MAAM,CAAA;CAC7B"}
+{"version":3,"file":"password-credential.d.ts","sourceRoot":"","sources":["../../src/models/password-credential.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,kBAAkB;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;CAC7B"}

package/esm/models/password-credential.js

@@ -1,5 +1,7 @@
 /**
- * Entry that stores credential info for password login
+ * Persisted password credential. `passwordHash` and `salt` are produced by
+ * the configured {@link PasswordHasher}; `creationDate` (ISO 8601 string)
+ * is the source of truth for password-expiration policies.
  */
 export class PasswordCredential {
 }

package/esm/models/password-credential.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-credential.js","sourceRoot":"","sources":["../../src/models/password-credential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,kBAAkB;CAmB9B"}
+{"version":3,"file":"password-credential.js","sourceRoot":"","sources":["../../src/models/password-credential.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;CAK9B"}

package/esm/models/password-reset-token.d.ts

@@ -1,15 +1,11 @@
+/**
+ * Single-use password reset token. `token` is the URL-safe identifier
+ * shared with the user (e.g. via email). `createdAt` (ISO 8601) is the
+ * expiration anchor honoured by `SecurityPolicyManager.hasTokenExpired`.
+ */
 export declare class PasswordResetToken {
-    /**
-     * The related user name
-     */
     userName: string;
-    /**
-     * The Token value - should be some kind of generated UUID that can be included e.g. in URLs
-     */
     token: string;
-    /**
-     * The creation date in an ISO datetime format
-     */
     createdAt: string;
 }
 //# sourceMappingURL=password-reset-token.d.ts.map

package/esm/models/password-reset-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-token.d.ts","sourceRoot":"","sources":["../../src/models/password-reset-token.ts"],"names":[],"mappings":"AAAA,qBAAa,kBAAkB;IAC7B;;OAEG;IACK,QAAQ,EAAE,MAAM,CAAA;IACxB;;OAEG;IACK,KAAK,EAAE,MAAM,CAAA;IACrB;;OAEG;IACK,SAAS,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"password-reset-token.d.ts","sourceRoot":"","sources":["../../src/models/password-reset-token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,kBAAkB;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAC1B"}

package/esm/models/password-reset-token.js

@@ -1,3 +1,8 @@
+/**
+ * Single-use password reset token. `token` is the URL-safe identifier
+ * shared with the user (e.g. via email). `createdAt` (ISO 8601) is the
+ * expiration anchor honoured by `SecurityPolicyManager.hasTokenExpired`.
+ */
 export class PasswordResetToken {
 }
 //# sourceMappingURL=password-reset-token.js.map

package/esm/models/password-reset-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset-token.js","sourceRoot":"","sources":["../../src/models/password-reset-token.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,kBAAkB;CAa9B"}
+{"version":3,"file":"password-reset-token.js","sourceRoot":"","sources":["../../src/models/password-reset-token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;CAI9B"}

package/esm/password-complexity-rules/contains-lowercase.d.ts

@@ -1,7 +1,7 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js';
 /**
- * @param lowerCaseCount The minimum lower case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `lowerCaseCount` lowercase
+ * characters. Diacritics are stripped before counting.
  */
 export declare const createContainsLowercasePolicy: (lowerCaseCount: number) => PasswordComplexityRule;
 //# sourceMappingURL=contains-lowercase.d.ts.map

package/esm/password-complexity-rules/contains-lowercase.js

@@ -1,6 +1,6 @@
 /**
- * @param lowerCaseCount The minimum lower case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `lowerCaseCount` lowercase
+ * characters. Diacritics are stripped before counting.
  */
 export const createContainsLowercasePolicy = (lowerCaseCount) => ({
     name: 'containsLowercase',

package/esm/password-complexity-rules/contains-uppercase.d.ts

@@ -1,7 +1,7 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js';
 /**
- * @param upperCaseCount The minimum upper case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `upperCaseCount` uppercase
+ * characters. Diacritics are stripped before counting (`Á` counts as `A`).
  */
 export declare const createContainsUppercasePolicy: (upperCaseCount: number) => PasswordComplexityRule;
 //# sourceMappingURL=contains-uppercase.d.ts.map

package/esm/password-complexity-rules/contains-uppercase.js

@@ -1,6 +1,6 @@
 /**
- * @param upperCaseCount The minimum upper case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `upperCaseCount` uppercase
+ * characters. Diacritics are stripped before counting (`Á` counts as `A`).
  */
 export const createContainsUppercasePolicy = (upperCaseCount) => ({
     name: 'containsUppercase',

package/esm/password-complexity-rules/max-length.d.ts

@@ -1,7 +1,4 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js';
-/**
- * @param maxLength The maximum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is longer than `maxLength`. */
 export declare const createMaxLengthComplexityRule: (maxLength: number) => PasswordComplexityRule;
 //# sourceMappingURL=max-length.d.ts.map

package/esm/password-complexity-rules/max-length.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"max-length.d.ts","sourceRoot":"","sources":["../../src/password-complexity-rules/max-length.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAEnF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GAAI,WAAW,MAAM,KAAG,sBAShE,CAAA"}
+{"version":3,"file":"max-length.d.ts","sourceRoot":"","sources":["../../src/password-complexity-rules/max-length.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAEnF,wFAAwF;AACxF,eAAO,MAAM,6BAA6B,GAAI,WAAW,MAAM,KAAG,sBAShE,CAAA"}

package/esm/password-complexity-rules/max-length.js

@@ -1,7 +1,4 @@
-/**
- * @param maxLength The maximum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is longer than `maxLength`. */
 export const createMaxLengthComplexityRule = (maxLength) => ({
     name: 'maxLength',
     check: async (passwordString) => {

package/esm/password-complexity-rules/max-length.js.map

@@ -1 +1 @@
-{"version":3,"file":"max-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/max-length.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAChH,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"max-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/max-length.ts"],"names":[],"mappings":"AAEA,wFAAwF;AACxF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,kCAAkC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAChH,CAAC;CACF,CAAC,CAAA"}

package/esm/password-complexity-rules/min-length.d.ts

@@ -1,7 +1,4 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js';
-/**
- * @param minLength The minimum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is shorter than `minLength`. */
 export declare const createMinLengthComplexityRule: (minLength: number) => PasswordComplexityRule;
 //# sourceMappingURL=min-length.d.ts.map

package/esm/password-complexity-rules/min-length.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"min-length.d.ts","sourceRoot":"","sources":["../../src/password-complexity-rules/min-length.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAEnF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,GAAI,WAAW,MAAM,KAAG,sBAShE,CAAA"}
+{"version":3,"file":"min-length.d.ts","sourceRoot":"","sources":["../../src/password-complexity-rules/min-length.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AAEnF,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,GAAI,WAAW,MAAM,KAAG,sBAShE,CAAA"}

package/esm/password-complexity-rules/min-length.js

@@ -1,7 +1,4 @@
-/**
- * @param minLength The minimum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is shorter than `minLength`. */
 export const createMinLengthComplexityRule = (minLength) => ({
     name: 'minLength',
     check: async (passwordString) => {

package/esm/password-complexity-rules/min-length.js.map

@@ -1 +1 @@
-{"version":3,"file":"min-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/min-length.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACjH,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"min-length.js","sourceRoot":"","sources":["../../src/password-complexity-rules/min-length.ts"],"names":[],"mappings":"AAEA,yFAAyF;AACzF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAiB,EAA0B,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,WAAoB;IAC1B,KAAK,EAAE,KAAK,EAAE,cAAsB,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,SAAS,CAAA;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,CAAA;QACpB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IACjH,CAAC;CACF,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@furystack/security",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "description": "Security, password management and authorization related stuff for FuryStack",
   "type": "module",
   "scripts": {
@@ -37,19 +37,19 @@
     "url": "https://github.com/furystack/furystack/issues"
   },
   "dependencies": {
-    "@furystack/core": "^17.0.0",
-    "@furystack/inject": "^13.0.0",
-    "@furystack/repository": "^11.0.0"
+    "@furystack/core": "^17.1.1",
+    "@furystack/inject": "^13.0.2",
+    "@furystack/repository": "^11.0.2"
   },
   "homepage": "https://github.com/furystack/furystack",
   "devDependencies": {
-    "@furystack/utils": "^9.0.0",
-    "@types/node": "^25.6.0",
+    "@furystack/utils": "^9.0.2",
+    "@types/node": "^25.9.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.8"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=24.0.0"
   },
   "sideEffects": false
 }

package/src/errors/password-complexity-error.ts

@@ -1,8 +1,11 @@
+import type { PasswordComplexityRule } from '../models/password-complexity-rule.js'
+
+/**
+ * Thrown by password-setting flows when the candidate password fails one or
+ * more configured {@link PasswordComplexityRule}s. `result` carries the
+ * per-rule failures so callers can render targeted user feedback.
+ */
 export class PasswordComplexityError extends Error {
-  /**
-   * @param result A detailed error result array
-   * @param message The Error message
-   */
   constructor(
     public readonly result: Array<{ message: string; rule: string }>,
     message?: string,

package/src/errors/unauthenticated-error.ts

@@ -1,4 +1,6 @@
 /**
- * Error that can be thrown if an authentication is required but not provided
+ * Thrown when credential verification fails: bad username/password, expired
+ * password, or expired/invalid reset token. REST handlers should map this
+ * to a 401 response.
  */
 export class UnauthenticatedError extends Error {}

package/src/models/password-credential.ts

@@ -1,23 +1,13 @@
+import type { PasswordHasher } from '../password-hasher.js'
+
 /**
- * Entry that stores credential info for password login
+ * Persisted password credential. `passwordHash` and `salt` are produced by
+ * the configured {@link PasswordHasher}; `creationDate` (ISO 8601 string)
+ * is the source of truth for password-expiration policies.
  */
 export class PasswordCredential {
-  /**
-   * The unique name of the user
-   */
   declare userName: string
-  /**
-   * The hashed password value
-   */
   declare passwordHash: string
-
-  /**
-   * Salt value for password hashing // TODO
-   */
   declare salt: string
-
-  /**
-   * The Creation date in ISO String format
-   */
   declare creationDate: string
 }

package/src/models/password-reset-token.ts

@@ -1,14 +1,10 @@
+/**
+ * Single-use password reset token. `token` is the URL-safe identifier
+ * shared with the user (e.g. via email). `createdAt` (ISO 8601) is the
+ * expiration anchor honoured by `SecurityPolicyManager.hasTokenExpired`.
+ */
 export class PasswordResetToken {
-  /**
-   * The related user name
-   */
   declare userName: string
-  /**
-   * The Token value - should be some kind of generated UUID that can be included e.g. in URLs
-   */
   declare token: string
-  /**
-   * The creation date in an ISO datetime format
-   */
   declare createdAt: string
 }

package/src/password-complexity-rules/contains-lowercase.ts

@@ -1,8 +1,8 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js'
 
 /**
- * @param lowerCaseCount The minimum lower case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `lowerCaseCount` lowercase
+ * characters. Diacritics are stripped before counting.
  */
 export const createContainsLowercasePolicy = (lowerCaseCount: number): PasswordComplexityRule => ({
   name: 'containsLowercase' as const,

package/src/password-complexity-rules/contains-uppercase.ts

@@ -1,8 +1,8 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js'
 
 /**
- * @param upperCaseCount The minimum upper case characters length
- * @returns The created Password Policy object
+ * Builds a complexity rule that requires at least `upperCaseCount` uppercase
+ * characters. Diacritics are stripped before counting (`Á` counts as `A`).
  */
 export const createContainsUppercasePolicy = (upperCaseCount: number): PasswordComplexityRule => ({
   name: 'containsUppercase' as const,

package/src/password-complexity-rules/max-length.ts

@@ -1,9 +1,6 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js'
 
-/**
- * @param maxLength The maximum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is longer than `maxLength`. */
 export const createMaxLengthComplexityRule = (maxLength: number): PasswordComplexityRule => ({
   name: 'maxLength' as const,
   check: async (passwordString: string) => {

package/src/password-complexity-rules/min-length.ts

@@ -1,9 +1,6 @@
 import type { PasswordComplexityRule } from '../models/password-complexity-rule.js'
 
-/**
- * @param minLength The minimum password length
- * @returns The created Password Policy object
- */
+/** Builds a complexity rule that fails when the password is shorter than `minLength`. */
 export const createMinLengthComplexityRule = (minLength: number): PasswordComplexityRule => ({
   name: 'minLength' as const,
   check: async (passwordString: string) => {