@happyvertical/smrt-users 0.53.4 → 0.53.6

package/dist/models/CliAuthApproveLimit.d.ts

@@ -4,7 +4,14 @@
  * @packageDocumentation
  */
 import { SmrtObject } from '@happyvertical/smrt-core';
-/** Private database arbiter shared by every terminal-auth process. */
+/**
+ * Private database arbiter shared by every terminal-auth process.
+ *
+ * @deprecated Since #3273 `TerminalAuthService` draws from the shared
+ * {@link UsersLoginAttempt} budget instead; this table is no longer written.
+ * The class stays exported so existing schemas and cleanup scripts keep
+ * resolving; it will be removed in a future major.
+ */
 export declare class UsersCliAuthApproveLimit extends SmrtObject {
     /** Approving browser user whose budget this row protects. */
     userId: string;

package/dist/models/CliAuthApproveLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CliAuthApproveLimit.d.ts","sourceRoot":"","sources":["../../src/models/CliAuthApproveLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAqB,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAE/E,sEAAsE;AACtE,qBAMa,wBAAyB,SAAQ,UAAU;IACtD,6DAA6D;IAE7D,MAAM,SAAM;IAEZ,0EAA0E;IAE1E,YAAY,SAAK;IAEjB,sDAAsD;IAEtD,eAAe,OAAc;CAC9B"}
+{"version":3,"file":"CliAuthApproveLimit.d.ts","sourceRoot":"","sources":["../../src/models/CliAuthApproveLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAqB,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAE/E;;;;;;;GAOG;AACH,qBAMa,wBAAyB,SAAQ,UAAU;IACtD,6DAA6D;IAE7D,MAAM,SAAM;IAEZ,0EAA0E;IAE1E,YAAY,SAAK;IAEjB,sDAAsD;IAEtD,eAAe,OAAc;CAC9B"}

package/dist/models/LoginAttempt.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Durable, shared-storage login attempt budget — one row per limiter key.
+ *
+ * Every credential-based sign-in (terminal approve, PIN, and any host-side
+ * password or passkey flow) reserves an attempt here before doing credential
+ * work, so the budget is enforced across every replica that shares the
+ * database (#3273). The row is the arbiter; nothing is cached in-process.
+ *
+ * Keys are hashes, never raw identifiers: a subject key is derived from the
+ * identifier the client *submitted* (an email key or user id), and a source
+ * key from the client address or device, so the table never becomes a
+ * plaintext index of emails and IPs, and an unknown subject costs exactly the
+ * same row as a known one.
+ *
+ * @packageDocumentation
+ */
+import { SmrtObject } from '@happyvertical/smrt-core';
+/** The two independent budgets a sign-in attempt draws from. */
+export type LoginAttemptScope = 'subject' | 'source';
+/** Private database arbiter shared by every process that authenticates. */
+export declare class UsersLoginAttempt extends SmrtObject {
+    /** `sha256(scope:normalizedKey)` — the UPSERT arbiter. */
+    limiterKey: string;
+    /** Which budget this row protects. Informational; the key already encodes it. */
+    scope: LoginAttemptScope;
+    /** Failed attempts plus currently reserved attempts inside the window. */
+    attemptCount: number;
+    /** Beginning of the current failed-attempt window. */
+    windowStartedAt: Date;
+    /**
+     * Consecutive failures that were not interrupted by a success. Drives the
+     * exponential lockout: each exhausted budget lengthens the next lockout.
+     */
+    failureStreak: number;
+    /**
+     * While set and in the future, every reservation for this key is refused
+     * regardless of the window. Null when the key is not locked out.
+     *
+     * Indexed: the retention sweep prunes idle rows by this and `retain_until`.
+     */
+    lockedUntil: Date | null;
+    /**
+     * When this key last failed. The whole streak is forgiven once this is
+     * older than the limiter's streak horizon — measured from the last
+     * FAILURE, not the last activity. A source key (a tablet, an office
+     * address) additionally sheds one failure per `sourceStreakDecaySeconds`
+     * since this time, so spaced-out mistakes on a busy shared device never
+     * accumulate.
+     */
+    lastFailedAt: Date | null;
+    /**
+     * When the limiter that last wrote this row stops reasoning about it (its
+     * own window and streak-forgiveness horizon). The retention sweep deletes
+     * only rows past this, so it honours each limiter's configuration rather
+     * than a process-wide default.
+     */
+    retainUntil: Date;
+}
+//# sourceMappingURL=LoginAttempt.d.ts.map

package/dist/models/LoginAttempt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginAttempt.d.ts","sourceRoot":"","sources":["../../src/models/LoginAttempt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,2EAA2E;AAC3E,qBASa,iBAAkB,SAAQ,UAAU;IAC/C,0DAA0D;IAE1D,UAAU,SAAM;IAEhB,iFAAiF;IAEjF,KAAK,EAAE,iBAAiB,CAAa;IAErC,0EAA0E;IAE1E,YAAY,SAAK;IAEjB,sDAAsD;IAEtD,eAAe,OAAc;IAE7B;;;OAGG;IAEH,aAAa,SAAK;IAElB;;;;;OAKG;IAEH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAQ;IAEhC;;;;;;;OAOG;IAEH,YAAY,EAAE,IAAI,GAAG,IAAI,CAAQ;IAEjC;;;;;OAKG;IAEH,WAAW,OAAc;CAC1B"}

package/dist/models/LoginAuditEvent.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Durable record of a credential sign-in outcome (#3273).
+ *
+ * This is the default {@link LoginAuditSink} target: one row per decision
+ * the {@link LoginAttemptLimiter} makes, written through the collection so it
+ * is visible to the change feed and the retention sweep like any other smrt
+ * object. Hosts with their own audit log supply a sink instead.
+ *
+ * @packageDocumentation
+ */
+import { SmrtObject } from '@happyvertical/smrt-core';
+/** What happened to a sign-in attempt. */
+export type LoginAuditOutcome = 
+/** Refused before credential work: budget exhausted or key locked out. */
+'denied'
+/** Credential work ran and the credential was wrong. */
+ | 'failed'
+/** Credential work ran and succeeded. */
+ | 'succeeded'
+/** A failure exhausted the budget and the key is now locked out. */
+ | 'locked'
+/** A credential was set, reset, or cleared (administrative). */
+ | 'managed';
+export declare class UsersLoginAuditEvent extends SmrtObject {
+    /** Credential kind: `terminal-approve`, `pin`, `password`, `passkey`, … */
+    kind: string;
+    outcome: LoginAuditOutcome;
+    /** Hashed subject key, or null when the attempt had no subject. */
+    subjectKeyHash: string | null;
+    /** Hashed source key (IP or device), or null when the attempt had no source. */
+    sourceKeyHash: string | null;
+    /** Set on `denied`/`locked`: how long the client was told to wait. */
+    retryAfterSeconds: number | null;
+    /**
+     * When the decision was made.
+     *
+     * Indexed: the retention sweep prunes by this column.
+     */
+    occurredAt: Date;
+    /**
+     * Free-form JSON the caller attached. Never credentials or session ids;
+     * subjects stay hashed. The one identifier that belongs here is the acting
+     * administrator on a `managed` event, since accountability is its purpose.
+     */
+    metadata: string;
+    getMetadata(): Record<string, unknown>;
+    setMetadata(value: Record<string, unknown>): void;
+}
+//# sourceMappingURL=LoginAuditEvent.d.ts.map

package/dist/models/LoginAuditEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginAuditEvent.d.ts","sourceRoot":"","sources":["../../src/models/LoginAuditEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAS,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAEnE,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB;AAC3B,0EAA0E;AACxE,QAAQ;AACV,wDAAwD;GACtD,QAAQ;AACV,yCAAyC;GACvC,WAAW;AACb,oEAAoE;GAClE,QAAQ;AACV,gEAAgE;GAC9D,SAAS,CAAC;AAEd,qBASa,oBAAqB,SAAQ,UAAU;IAClD,2EAA2E;IAE3E,IAAI,SAAM;IAGV,OAAO,EAAE,iBAAiB,CAAY;IAEtC,mEAAmE;IAEnE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAQ;IAErC,gFAAgF;IAEhF,aAAa,EAAE,MAAM,GAAG,IAAI,CAAQ;IAEpC,sEAAsE;IAEtE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAExC;;;;OAIG;IAEH,UAAU,OAAc;IAExB;;;;OAIG;IAEH,QAAQ,SAAQ;IAEhB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWtC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAGlD"}

package/dist/models/PinCredential.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Per-person PIN credential, usable only on an enrolled device (#3276).
+ *
+ * Deliberately its own object rather than a column on `User`, so the hash is
+ * never selected by the many existing user reads and never serialized by
+ * accident. One row per user.
+ *
+ * The hash is scrypt over `pepper || pin` with a per-row random salt. A PIN is
+ * a 4–8 digit secret: without a server-side pepper a leaked table would be
+ * brute-forced in seconds, and even with one the PIN is only accepted behind
+ * a live device bearer session and the login limiter — see
+ * {@link DeviceCredentialService}.
+ *
+ * @packageDocumentation
+ */
+import { SmrtObject } from '@happyvertical/smrt-core';
+export declare class UsersPinCredential extends SmrtObject {
+    /** The person this PIN signs in. */
+    userId: string;
+    /** Encoded hash: `scrypt$N$r$p$saltB64$hashB64`. */
+    pinHash: string;
+    /** Bumped on every set/reset so audits and sessions can reference a generation. */
+    version: number;
+    /** Set by an administrative reset; the person must choose a new PIN on next use. */
+    mustReset: boolean;
+    /** When the current hash was written. */
+    rotatedAt: Date | null;
+    /** `self`, or the user id of the administrator who last set it. */
+    rotatedBy: string | null;
+}
+//# sourceMappingURL=PinCredential.d.ts.map

package/dist/models/PinCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PinCredential.d.ts","sourceRoot":"","sources":["../../src/models/PinCredential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAqB,UAAU,EAAQ,MAAM,0BAA0B,CAAC;AAE/E,qBAQa,kBAAmB,SAAQ,UAAU;IAChD,oCAAoC;IAEpC,MAAM,SAAM;IAEZ,oDAAoD;IAEpD,OAAO,SAAM;IAEb,mFAAmF;IAEnF,OAAO,SAAK;IAEZ,oFAAoF;IAEpF,SAAS,UAAS;IAElB,yCAAyC;IAEzC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAQ;IAE9B,mEAAmE;IAEnE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAQ;CACjC"}

package/dist/models/Session.d.ts

@@ -18,11 +18,37 @@ export interface SessionOptions extends SmrtObjectOptions {
     /** Accepts a Date or any value the Date constructor can coerce. */
     lastAccessedAt?: Date | string | number;
     data?: Record<string, unknown>;
+    authMethod?: SessionAuthMethod | null;
+    parentSessionId?: string | null;
 }
+/**
+ * How a session was established. Server-set at mint time, never trusted from
+ * the client. Hosts may use any string for their own flows; these are the
+ * values this package mints.
+ */
+export type SessionAuthMethod = 'oidc' | 'magic-link' | 'terminal' | 'mobile' | 'pin' | (string & {});
 /**
  * Default session TTL: 7 days in seconds
  */
 export declare const DEFAULT_SESSION_TTL: number;
+/**
+ * Reserved {@link Session.data} keys this package writes at mint time and
+ * enforces on every load (#3276). Server-set only: never copy client input
+ * into them, and do not overwrite them through `setSessionData`.
+ */
+export declare const SESSION_DATA_KEYS: {
+    /** `string[]` of permission slugs the session's resolved set is intersected with. */
+    readonly permissionCeiling: "permissionCeiling";
+    /** ISO timestamp after which the session is invalid whatever its activity. */
+    readonly absoluteExpiresAt: "absoluteExpiresAt";
+    /** Sliding idle timeout in seconds, applied on every recorded activity. */
+    readonly idleSeconds: "idleSeconds";
+};
+/**
+ * Expiry for a session minted or extended now: `ttlSeconds` ahead, bounded by
+ * an absolute cap in `data` (an unreadable cap fails closed as already past).
+ */
+export declare function resolveSessionExpiry(ttlSeconds: number, data: Record<string, unknown> | undefined): Date;
 /**
  * Generate a cryptographically secure session ID
  */
@@ -82,9 +108,51 @@ export declare class Session extends SmrtObject {
      * Custom session data (JSON serializable)
      */
     data: Record<string, unknown>;
+    /**
+     * Authentication channel that established this session (#3276, #2944).
+     * Null for sessions minted before this column existed or by hosts that do
+     * not set it.
+     */
+    authMethod: SessionAuthMethod | null;
+    /**
+     * Session this one is layered on — the enrolled device's bearer session
+     * under a per-person PIN session, for instance. A child is valid only while
+     * its parent is, so revoking the device signs out everyone on it.
+     *
+     * A native UUID column where the engine has one, like every other session
+     * id reference, but deliberately not a foreign key: a self-referencing FK would cascade
+     * the retention sweep's parent deletes, and the liveness rule in
+     * `SessionService.loadSessionContext` already makes an orphan invalid.
+     *
+     * Sensitive: the value IS the parent's (longer-lived) bearer credential,
+     * so public serialization of a child must never reveal it — otherwise a
+     * stolen person credential could be traded up for the device's.
+     *
+     * Indexed: `SessionCollection.findChildren()` and the sign-out cascade
+     * query by this column.
+     */
+    parentSessionId: string | null;
     constructor(options?: SessionOptions);
+    /** True when this session is layered on another one. */
+    isLayered(): boolean;
+    /**
+     * Absolute expiry cap (`data.absoluteExpiresAt`), or null when the session
+     * has none. An unreadable value fails closed as "already passed".
+     */
+    getAbsoluteExpiry(): Date | null;
+    /**
+     * Sliding idle timeout (`data.idleSeconds`), or null when the session uses
+     * the resolving service's TTL policy.
+     */
+    getIdleSeconds(): number | null;
+    /**
+     * Permission ceiling (`data.permissionCeiling`), or null when the session
+     * has none. A present but malformed value fails closed as an empty ceiling.
+     */
+    getPermissionCeiling(): string[] | null;
     /**
-     * Check if the session is currently valid (active and not expired)
+     * Check if the session is currently valid (active, not expired, and not
+     * past its absolute cap)
      */
     isValid(): boolean;
     /**

package/dist/models/Session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/models/Session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AAEpD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAUa,OAAQ,SAAQ,UAAU;IACrC;;OAEG;IAEH,MAAM,EAAE,MAAM,CAAM;IAEpB;;;OAGG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAEH,MAAM,EAAE,aAAa,CAAwB;IAE7C;;;;;OAKG;IAEH,SAAS,EAAE,IAAI,CAAc;IAE7B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAc;IAElC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;gBAEvB,OAAO,GAAE,cAAmB;IAsBxC;;OAEG;IACH,OAAO,IAAI,OAAO;IAIlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,MAAM,CAAC,UAAU,GAAE,MAA4B,GAAG,IAAI;IAKtD,4EAA4E;IACtE,cAAc,CAClB,SAAS,UAAQ,EACjB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC;YAoBL,wBAAwB;IAQtC;;OAEG;IACH,MAAM,IAAI,IAAI;IAId;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIxC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAItC;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B"}
+{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../src/models/Session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,cAAc,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,YAAY,GACZ,UAAU,GACV,QAAQ,GACR,KAAK,GACL,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAmB,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B,qFAAqF;;IAErF,8EAA8E;;IAE9E,2EAA2E;;CAEnE,CAAC;AAEX;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACxC,IAAI,CASN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAUa,OAAQ,SAAQ,UAAU;IACrC;;OAEG;IAEH,MAAM,EAAE,MAAM,CAAM;IAEpB;;;OAGG;IAEH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE/B;;OAEG;IAEH,MAAM,EAAE,aAAa,CAAwB;IAE7C;;;;;OAKG;IAEH,SAAS,EAAE,IAAI,CAAc;IAE7B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAM;IAEvB;;OAEG;IACH,cAAc,EAAE,IAAI,CAAc;IAElC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;IAEnC;;;;OAIG;IAEH,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAE5C;;;;;;;;;;;;;;;;OAgBG;IAEH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAE1B,OAAO,GAAE,cAAmB;IA0BxC,wDAAwD;IACxD,SAAS,IAAI,OAAO;IAIpB;;;OAGG;IACH,iBAAiB,IAAI,IAAI,GAAG,IAAI;IAUhC;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,IAAI;IAO/B;;;OAGG;IACH,oBAAoB,IAAI,MAAM,EAAE,GAAG,IAAI;IAQvC;;;OAGG;IACH,OAAO,IAAI,OAAO;IAUlB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,MAAM,CAAC,UAAU,GAAE,MAA4B,GAAG,IAAI;IAOtD,4EAA4E;IACtE,cAAc,CAClB,SAAS,UAAQ,EACjB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,OAAO,CAAC;YAyBL,wBAAwB;IAQtC;;OAEG;IACH,MAAM,IAAI,IAAI;IAId;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIxC;;OAEG;IACH,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAItC;;OAEG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAI1C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAG9B"}

package/dist/models/index.d.ts

@@ -8,14 +8,17 @@ export { CliAuthRequest, type CliAuthRequestStatus, UsersCliAuthRequest, } from
 export { Group } from './Group.js';
 export { GroupMember } from './GroupMember.js';
 export { GroupRole } from './GroupRole.js';
+export { type LoginAttemptScope, UsersLoginAttempt } from './LoginAttempt.js';
+export { type LoginAuditOutcome, UsersLoginAuditEvent, } from './LoginAuditEvent.js';
 export { DEFAULT_TOKEN_EXPIRY_SECONDS, MagicLinkToken, UsersMagicLinkToken, } from './MagicLinkToken.js';
 export { Membership } from './Membership.js';
 export { MembershipOverride } from './MembershipOverride.js';
 export { isValidPermissionSlug, type ParsedPermissionSlug, Permission, parsePermissionSlug, } from './Permission.js';
+export { UsersPinCredential } from './PinCredential.js';
 export { ResourceGrant, type ResourceGrantEffect, type ResourceGrantOptions, } from './ResourceGrant.js';
 export { Role } from './Role.js';
 export { RolePermission } from './RolePermission.js';
-export { DEFAULT_SESSION_TTL, generateSessionId, Session, } from './Session.js';
+export { DEFAULT_SESSION_TTL, generateSessionId, SESSION_DATA_KEYS, Session, type SessionAuthMethod, } from './Session.js';
 export { MAX_TENANT_HIERARCHY_DEPTH, Tenant } from './Tenant.js';
 export { TenantIntegration, type TenantIntegrationCheckSummary, type TenantIntegrationOptions, type TenantIntegrationProvider, type TenantIntegrationStatus, } from './TenantIntegration.js';
 export { TenantPermissionOverride } from './TenantPermissionOverride.js';

package/dist/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,UAAU,EACV,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,OAAO,GACR,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/models/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,UAAU,EACV,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,EACP,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC"}

package/dist/retention.d.ts

@@ -28,8 +28,14 @@ export declare const SESSIONS_RETENTION_TASK = "users-sessions";
 export declare const MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
 /** Retention task name for expired CLI device-code requests. */
 export declare const CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
+/** Retention task name for idle login-attempt limiter rows (#3273). */
+export declare const LOGIN_ATTEMPTS_RETENTION_TASK = "users-login-attempts";
+/** Retention task name for login audit events (#3273). */
+export declare const LOGIN_AUDIT_RETENTION_TASK = "users-login-audit-events";
+/** How long login audit events are kept by default. */
+export declare const DEFAULT_LOGIN_AUDIT_RETENTION_DAYS = 90;
 /** Every task name {@link registerUserRetentionTasks} installs. */
-export declare const USER_RETENTION_TASKS: readonly ["users-sessions", "users-magic-link-tokens", "users-cli-auth-requests"];
+export declare const USER_RETENTION_TASKS: readonly ["users-sessions", "users-magic-link-tokens", "users-cli-auth-requests", "users-login-attempts", "users-login-audit-events"];
 /**
  * Register session and token expiry with the framework retention sweep.
  *

package/dist/retention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,mFAIvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CA4BjD;AAED,sEAAsE;AACtE,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAYH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,uEAAuE;AACvE,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AAEpE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,uDAAuD;AACvD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,uIAMvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAmDjD;AAED,sEAAsE;AACtE,wBAAgB,4BAA4B,IAAI,IAAI,CAInD"}