@openora/core 0.4.0 → 0.4.1-canary.100

package/dist/pam/identity/schema/index.d.ts

@@ -37,6 +37,23 @@ export declare const user: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        username: import("drizzle-orm/pg-core").PgColumn<{
+            name: "username";
+            tableName: "user";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         email: import("drizzle-orm/pg-core").PgColumn<{
             name: "email";
             tableName: "user";
@@ -224,6 +241,57 @@ export declare const user: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        phoneNumber: import("drizzle-orm/pg-core").PgColumn<{
+            name: "phoneNumber";
+            tableName: "user";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        phoneVerified: import("drizzle-orm/pg-core").PgColumn<{
+            name: "phoneVerified";
+            tableName: "user";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        phoneVerifiedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "phoneVerifiedAt";
+            tableName: "user";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         failedLoginAttempts: import("drizzle-orm/pg-core").PgColumn<{
             name: "failedLoginAttempts";
             tableName: "user";
@@ -258,6 +326,57 @@ export declare const user: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        lockoutCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lockoutCount";
+            tableName: "user";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastLockoutAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastLockoutAt";
+            tableName: "user";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastFailedLoginAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lastFailedLoginAt";
+            tableName: "user";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         rgBlocked: import("drizzle-orm/pg-core").PgColumn<{
             name: "rgBlocked";
             tableName: "user";
@@ -901,8 +1020,135 @@ export declare const twoFactor: import("drizzle-orm/pg-core").PgTableWithColumns
     };
     dialect: "pg";
 }>;
+export declare const smsOtpSession: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "sms_otp_session";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "sms_otp_session";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "userId";
+            tableName: "sms_otp_session";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        phone: import("drizzle-orm/pg-core").PgColumn<{
+            name: "phone";
+            tableName: "sms_otp_session";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        codeHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "codeHash";
+            tableName: "sms_otp_session";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expiresAt";
+            tableName: "sms_otp_session";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failedAttempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failedAttempts";
+            tableName: "sms_otp_session";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "createdAt";
+            tableName: "sms_otp_session";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export type User = typeof user.$inferSelect;
 export type Session = typeof session.$inferSelect;
+export type SmsOtpSession = typeof smsOtpSession.$inferSelect;
 export type Account = typeof account.$inferSelect;
 export type Verification = typeof verification.$inferSelect;
 export type TwoFactor = typeof twoFactor.$inferSelect;

package/dist/pam/identity/schema/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoChB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAerB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,aAAa,mEAA+B,CAAC;AAE1D,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmDhB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBnB,CAAC;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaxB,CAAC;AAGF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAerB,CAAC;AAKF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAezB,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,YAAY,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,YAAY,CAAC"}

package/dist/pam/identity/schema/index.js

@@ -1,10 +1,11 @@
 import { sql } from 'drizzle-orm';
-import { pgTable, pgEnum, uuid, text, boolean, timestamp, index, integer, } from 'drizzle-orm/pg-core';
+import { pgTable, pgEnum, uuid, text, boolean, timestamp, index, integer, uniqueIndex, } from 'drizzle-orm/pg-core';
 import { THEMES } from '@openora/core/contracts';
 export const userThemeEnum = pgEnum('user_theme', THEMES);
 export const user = pgTable('user', {
     id: uuid().primaryKey().defaultRandom(),
     name: text().notNull(),
+    username: text().notNull(),
     email: text().notNull().unique(),
     emailVerified: boolean().notNull().default(false),
     image: text(),
@@ -21,8 +22,17 @@ export const user = pgTable('user', {
     // Use logical JS property names only; drizzle.config.ts maps camelCase -> snake_case
     // for SQL identifiers so migrations and runtime are consistent.
     twoFactorEnabled: boolean().default(false),
+    phoneNumber: text().unique(),
+    phoneVerified: boolean().notNull().default(false),
+    phoneVerifiedAt: timestamp({ withTimezone: true }),
     failedLoginAttempts: integer().notNull().default(0),
     lockoutUntil: timestamp({ withTimezone: true }),
+    // Progressive lockout tiers: `lockoutCount` counts lockouts inside a rolling 24h
+    // window (reset once `lastLockoutAt` falls outside it), escalating the duration
+    // 1min -> 5min -> 15min. Shared by every login method.
+    lockoutCount: integer().notNull().default(0),
+    lastLockoutAt: timestamp({ withTimezone: true }),
+    lastFailedLoginAt: timestamp({ withTimezone: true }),
     // Responsible-Gambling login block (cooling-off / self-exclusion). Written only via
     // the LOGIN_ENFORCEMENT port. `rgBlockedUntil` null while blocked = indefinite
     // (self-exclusion); a Date is the cooling-off expiry the login gate auto-clears.
@@ -35,7 +45,12 @@ export const user = pgTable('user', {
 }, 
 // Trigram GIN index so the back-office player search (`ILIKE '%term%'` on email)
 // is index-backed instead of a seq scan. Requires the pg_trgm extension.
-(t) => [index('user_email_trgm_idx').using('gin', sql `${t.email} gin_trgm_ops`)]);
+(t) => [
+    uniqueIndex('user_username_unique').on(sql `lower(${t.username})`),
+    index('user_email_trgm_idx').using('gin', sql `${t.email} gin_trgm_ops`),
+    index('user_username_trgm_idx').using('gin', sql `${t.username} gin_trgm_ops`),
+    index('user_created_at_idx').on(t.createdAt),
+]);
 export const session = pgTable('session', {
     id: uuid().primaryKey().defaultRandom(),
     expiresAt: timestamp({ withTimezone: true }).notNull(),
@@ -92,4 +107,19 @@ export const twoFactor = pgTable('two_factor', {
     index('two_factor_user_id_idx').on(t.userId),
     index('two_factor_secret_idx').on(t.secret),
 ]);
+// One active OTP per user: `requestOtp` upserts by `userId`, so a new code overwrites the previous one.
+// `codeHash` is SHA-256 of the 6-digit code - the plaintext OTP is never stored.
+// `failedAttempts` caps guessing at 5 per session.
+export const smsOtpSession = pgTable('sms_otp_session', {
+    id: uuid().primaryKey().defaultRandom(),
+    userId: uuid()
+        .notNull()
+        .unique()
+        .references(() => user.id, { onDelete: 'cascade' }),
+    phone: text().notNull(),
+    codeHash: text().notNull(),
+    expiresAt: timestamp({ withTimezone: true }).notNull(),
+    failedAttempts: integer().notNull().default(0),
+    createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+}, (t) => [index('sms_otp_session_phone_idx').on(t.phone)]);
 //# sourceMappingURL=index.js.map

package/dist/pam/identity/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,GACR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CACjF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,OAAO,EACP,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,SAAS,EACT,KAAK,EACL,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CACzB,MAAM,EACN;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACtB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,KAAK,EAAE,IAAI,EAAE;IACb,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAClD,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,UAAU,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7C,kFAAkF;IAClF,qFAAqF;IACrF,gEAAgE;IAChE,gBAAgB,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,WAAW,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE;IAC5B,aAAa,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,eAAe,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAClD,mBAAmB,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,YAAY,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC/C,iFAAiF;IACjF,gFAAgF;IAChF,uDAAuD;IACvD,YAAY,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,aAAa,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,iBAAiB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACpD,oFAAoF;IACpF,+EAA+E;IAC/E,iFAAiF;IACjF,SAAS,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,cAAc,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC;AACD,iFAAiF;AACjF,yEAAyE;AACzE,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAA,SAAS,CAAC,CAAC,QAAQ,GAAG,CAAC;IACjE,KAAK,CAAC,qBAAqB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC;IACvE,KAAK,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAA,GAAG,CAAC,CAAC,QAAQ,eAAe,CAAC;IAC7E,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7C,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,SAAS,EAAE,IAAI,EAAE;IACjB,SAAS,EAAE,IAAI,EAAE;IACjB,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;CACtD,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,SAAS,EACT;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,SAAS,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,WAAW,EAAE,IAAI,EAAE;IACnB,YAAY,EAAE,IAAI,EAAE;IACpB,OAAO,EAAE,IAAI,EAAE;IACf,oBAAoB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACvD,qBAAqB,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACxD,KAAK,EAAE,IAAI,EAAE;IACb,QAAQ,EAAE,IAAI,EAAE;IAChB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CACjC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC5B,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;IACnE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,EAAE;SACT,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;CACjC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC/D,CAAC;AAEF,oGAAoG;AACpG,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAC9B,YAAY,EACZ;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC7B,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAClC,EACD,CAAC,CAAC,EAAE,EAAE,CAAC;IACL,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CAC5C,CACF,CAAC;AAEF,wGAAwG;AACxG,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAClC,iBAAiB,EACjB;IACE,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IACvC,MAAM,EAAE,IAAI,EAAE;SACX,OAAO,EAAE;SACT,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrD,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;IAC1B,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACtD,cAAc,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE;CACpE,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACxD,CAAC"}

package/dist/pam/identity/service/identity.service.d.ts

@@ -1,60 +1,86 @@
-import { ORPCError } from '@orpc/server';
 import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/server';
-import type { RateLimiterAdapter, SendEmailPort, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RequestPasswordResetInput, ResetPasswordInput, VerifyEmailInput, UpdateProfileInput, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig } from '@openora/core/contracts';
-export declare function createAccountLockedError(lockoutUntil: Date): ORPCError<"UNAUTHORIZED", {
-    code: string;
-    lockoutUntil: string;
-}>;
+import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, SendEmailPort, EmailTemplateRenderer, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning } from '@openora/core/contracts';
+export declare const UserNotFoundError: new (id: string) => Error;
+export declare const UsernameConflictError: new () => Error;
+export declare const SESSION_DURATION_IN_SECONDS: number;
 export type IdentityServiceDeps = {
     drizzle: DrizzleService;
     events: EventBus;
+    identityReader: IdentityReader;
     email?: SendEmailPort;
+    templateRenderer: EmailTemplateRenderer;
     options?: IdentityServiceOptions;
-    limiter?: RateLimiterAdapter;
+    limiter?: RateLimiterAdapter<RateLimitKey>;
     platformConfig?: PlatformConfig;
+    geoCheck?: GeoCheckCommands;
+    playerProvisioning?: PlayerProvisioning;
+    cache?: CacheAdapter;
 };
+/**
+ * Thin wrapper over the shared better-auth instance (register/login/2FA/
+ * password/email flows) that layers on platform-specific policy better-auth
+ * doesn't provide: per-account lockout after N failed logins, RG
+ * (responsible-gambling) login blocking, and rate limiting keyed by
+ * caller-identifier (email/token/session), never IP. better-auth calls use
+ * `asResponse: true` and return an error Response rather than throwing, so
+ * every call is routed through `ensureOk` to surface failures as `ORPCError`s.
+ */
 export declare class IdentityService {
     private readonly auth;
     private readonly drizzle;
     private readonly events;
+    private readonly identityReader;
     private readonly email?;
+    private readonly templateRenderer;
     private readonly options?;
     private readonly limiter?;
     private readonly platformConfig?;
-    constructor({ drizzle, events, email, options, limiter, platformConfig }: IdentityServiceDeps);
+    private readonly playerProvisioning?;
+    private readonly geoCheck?;
+    private readonly cache?;
+    constructor({ drizzle, events, identityReader, email, templateRenderer, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, }: IdentityServiceDeps);
+    private findUserByEmail;
+    private resolveUserLanguage;
     private get api();
+    private forwardCookies;
     private currentUserId;
-    register(input: RegisterInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        } | {
-            image: string | null;
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        };
+    register(input: RegisterInput, reqHeaders: NodeHeaders): Promise<{
+        status: "check-email";
     }>;
+    private findUserIdByUsername;
+    private findUserIdByEmail;
+    /**
+     * Better Auth commits the user inside its own transaction before returning, so a
+     * failure here would otherwise leave an account with no consent record. The user is
+     * deleted instead (sessions and accounts cascade), making registration all-or-nothing.
+     */
+    private recordRegistrationConsent;
+    usernameAvailable(username: string, reqHeaders: NodeHeaders): Promise<{
+        available: boolean;
+    }>;
+    /**
+     * Credentials are verified FIRST; the RG login block is checked only AFTER
+     * a pass, so a pre-auth probe can't distinguish a restricted account from a
+     * wrong password. An RG-blocked account still authenticates then has its
+     * fresh session immediately expired and the cookie withheld - it never
+     * counts toward the lockout budget. A 2FA-enrolled account returns
+     * `{ twoFactorRedirect: true }` instead of a session; the client completes
+     * via `verifyTwoFactor`. Failed-attempt counting only advances on a genuine
+     * credential rejection (never on a transient/backend error), via an atomic
+     * `UPDATE ... SET attempts = attempts + 1` so concurrent failures can't each
+     * read a stale count and slip past the lockout threshold.
+     */
     login(input: LoginInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         twoFactorRedirect: boolean;
         user?: undefined;
         session?: undefined;
+        security?: undefined;
     } | {
         user: {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
@@ -65,6 +91,7 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
@@ -75,10 +102,21 @@ export declare class IdentityService {
             token: string;
             expiresAt: string;
         };
+        security: {
+            attemptsRemaining: number;
+            lockoutUntil: string | null;
+        };
         twoFactorRedirect?: undefined;
     }>;
     private clearLockout;
-    unlockUser(userId: string, actorId: string): Promise<{
+    private resetLockoutTier;
+    private loginShadowGet;
+    private loginShadowSet;
+    private adminPasswordResetMarkerKey;
+    adminRequestPasswordReset(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    unlockUser(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;
     logout(reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
@@ -88,6 +126,7 @@ export declare class IdentityService {
         id: string;
         email: string;
         name: string;
+        username: string;
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
@@ -107,6 +146,9 @@ export declare class IdentityService {
     requestPasswordReset(input: RequestPasswordResetInput): Promise<{
         success: true;
     }>;
+    verifyPasswordResetOtp(input: VerifyPasswordResetOtpInput): Promise<{
+        success: true;
+    }>;
     resetPassword(input: ResetPasswordInput): Promise<{
         success: true;
     }>;
@@ -119,6 +161,12 @@ export declare class IdentityService {
     verifyEmail(input: VerifyEmailInput, reqHeaders: NodeHeaders): Promise<{
         success: true;
     }>;
+    /**
+     * Better Auth answers an unauthenticated verification with `user: null`, so the
+     * subject is recovered from the token it just accepted - otherwise the audit event
+     * would never fire for the ordinary click-the-link flow.
+     */
+    private userIdFromVerificationToken;
     changeEmail(input: ChangeEmailInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
@@ -127,6 +175,7 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
@@ -137,6 +186,7 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAGlB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAYjC,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,IAAI;;;GAQ1D;AA8ID,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;gBAErC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,mBAAmB;IAc7F,OAAO,KAAK,GAAG,GAId;YAEa,aAAa;IAKrB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;IAmB3E,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+I3E,OAAO,CAAC,YAAY;IAOd,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;;;IA+B1C,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAWnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;IAO1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAiBnF,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAqBrD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAmBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkBvF,qBAAqB,CAAC,UAAU,EAAE,WAAW;;;IAe7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW;;;IAkB5D,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;CAsB5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAK9B,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAqGjC,eAAO,MAAM,iBAAiB,2BAA4B,CAAC;AAC3D,eAAO,MAAM,qBAAqB,iBAA8D,CAAC;AAqCjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAsE7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;gBAE1B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,KAAK,EACL,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,GACN,EAAE,mBAAmB;YAsCR,eAAe;YAaf,mBAAmB;IAKjC,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;IAKrB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAuD9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiX3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAc5B,OAAO,CAAC,2BAA2B;IAI7B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAwCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAyBnF,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA2BrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkBvF,qBAAqB,CAAC,UAAU,EAAE,WAAW;;;IAe7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW;;;IA6BlE;;;;OAIG;YACW,2BAA2B;IAenC,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}