@portaidentity/server 1.7.0

package/dist/users/claims.js

@@ -0,0 +1,104 @@
+/**
+ * OIDC Standard Claims builder.
+ *
+ * Builds OIDC Standard Claims from a User profile based on the granted
+ * OAuth2 scopes. Follows the scope-to-claims mapping defined in
+ * OpenID Connect Core 1.0, §5.4:
+ *
+ *   - openid  → sub (always included)
+ *   - profile → name, given_name, family_name, middle_name, nickname,
+ *               preferred_username, profile, picture, website, gender,
+ *               birthdate, zoneinfo, locale, updated_at
+ *   - email   → email, email_verified
+ *   - phone   → phone_number, phone_number_verified
+ *   - address → address (structured object per §5.1.1)
+ *
+ * Custom claims (org_id, org_slug, roles) are handled in RD-08, not here.
+ * This module only handles the OIDC Standard Claims specification.
+ */
+// ---------------------------------------------------------------------------
+// Claims builder
+// ---------------------------------------------------------------------------
+/**
+ * Build OIDC Standard Claims from a user profile based on granted scopes.
+ *
+ * The `sub` claim is always included. Additional claims are added based
+ * on which scopes are present in the `scopes` array. Null profile fields
+ * are included as null (not omitted) — per the OIDC spec, null indicates
+ * "no value" which is different from "not requested".
+ *
+ * The `updated_at` claim is a Unix timestamp (seconds since epoch) per
+ * the OIDC specification, not an ISO 8601 string.
+ *
+ * @param user - User whose profile claims to build
+ * @param scopes - Array of granted OAuth2 scope strings
+ * @returns Claims object with `sub` and scope-dependent fields
+ */
+export function buildUserClaims(user, scopes) {
+    // sub is always included (required by OIDC)
+    const claims = { sub: user.id };
+    // profile scope — OIDC §5.4 profile claims
+    if (scopes.includes('profile')) {
+        // Derive "name" from given_name + middle_name + family_name parts
+        const nameParts = [user.givenName, user.middleName, user.familyName].filter(Boolean);
+        if (nameParts.length > 0) {
+            claims.name = nameParts.join(' ');
+        }
+        claims.given_name = user.givenName;
+        claims.family_name = user.familyName;
+        claims.middle_name = user.middleName;
+        claims.nickname = user.nickname;
+        claims.preferred_username = user.preferredUsername;
+        claims.profile = user.profileUrl;
+        claims.picture = user.pictureUrl;
+        claims.website = user.websiteUrl;
+        claims.gender = user.gender;
+        claims.birthdate = user.birthdate;
+        claims.zoneinfo = user.zoneinfo;
+        claims.locale = user.locale;
+        // updated_at must be Unix timestamp (seconds) per OIDC spec
+        claims.updated_at = Math.floor(user.updatedAt.getTime() / 1000);
+    }
+    // email scope — OIDC §5.4 email claims
+    if (scopes.includes('email')) {
+        claims.email = user.email;
+        claims.email_verified = user.emailVerified;
+    }
+    // phone scope — OIDC §5.4 phone claims
+    if (scopes.includes('phone')) {
+        claims.phone_number = user.phoneNumber;
+        claims.phone_number_verified = user.phoneNumberVerified;
+    }
+    // address scope — OIDC §5.1.1 structured address (only if any field present)
+    if (scopes.includes('address') && hasAddress(user)) {
+        claims.address = {
+            street_address: user.addressStreet,
+            locality: user.addressLocality,
+            region: user.addressRegion,
+            postal_code: user.addressPostalCode,
+            country: user.addressCountry,
+        };
+    }
+    return claims;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Check if a user has any address fields populated.
+ *
+ * Returns true if at least one address field is non-null/non-empty.
+ * Used to decide whether to include the address claim object —
+ * per the spec, the address claim should not be an empty object.
+ *
+ * @param user - User to check
+ * @returns true if any address field has a value
+ */
+export function hasAddress(user) {
+    return !!(user.addressStreet ||
+        user.addressLocality ||
+        user.addressRegion ||
+        user.addressPostalCode ||
+        user.addressCountry);
+}
+//# sourceMappingURL=claims.js.map

package/dist/users/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/users/claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA8BH,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU,EAAE,MAAgB;IAC1D,4CAA4C;IAC5C,MAAM,MAAM,GAAe,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAE5C,2CAA2C;IAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,kEAAkE;QAClE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACnC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACnD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,4DAA4D;QAC5D,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,OAAO,GAAG;YACf,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,WAAW,EAAE,IAAI,CAAC,iBAAiB;YACnC,OAAO,EAAE,IAAI,CAAC,cAAc;SACd,CAAC;IACnB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,iBAAiB;QACtB,IAAI,CAAC,cAAc,CACpB,CAAC;AACJ,CAAC"}

package/dist/users/errors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * User domain error types.
+ *
+ * Custom error classes for user-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - UserNotFoundError → 404
+ *   - UserValidationError → 400
+ */
+/**
+ * Thrown when a user cannot be found by ID or email.
+ * Maps to HTTP 404 in route handlers.
+ */
+export declare class UserNotFoundError extends Error {
+    constructor(identifier: string);
+}
+/**
+ * Thrown when an operation violates user business rules.
+ * Examples: duplicate email within org, invalid status transition,
+ * invalid password format, missing required fields.
+ * Maps to HTTP 400 in route handlers.
+ */
+export declare class UserValidationError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/users/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/users/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,UAAU,EAAE,MAAM,EAG7B;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/users/errors.js

@@ -0,0 +1,31 @@
+/**
+ * User domain error types.
+ *
+ * Custom error classes for user-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - UserNotFoundError → 404
+ *   - UserValidationError → 400
+ */
+/**
+ * Thrown when a user cannot be found by ID or email.
+ * Maps to HTTP 404 in route handlers.
+ */
+export class UserNotFoundError extends Error {
+    constructor(identifier) {
+        super(`User not found: ${identifier}`);
+        this.name = 'UserNotFoundError';
+    }
+}
+/**
+ * Thrown when an operation violates user business rules.
+ * Examples: duplicate email within org, invalid status transition,
+ * invalid password format, missing required fields.
+ * Maps to HTTP 400 in route handlers.
+ */
+export class UserValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'UserValidationError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/users/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/users/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,UAAkB;QAC5B,KAAK,CAAC,mBAAmB,UAAU,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/dist/users/gdpr.d.ts

@@ -0,0 +1,110 @@
+/**
+ * GDPR data export and purge for users.
+ *
+ * Implements Article 17 (right to erasure) and Article 20 (data portability)
+ * capabilities for Porta's user data. These functions collect all user-related
+ * data across multiple tables for export, or anonymize/delete it for purge.
+ *
+ * **Export** collects: user profile, role assignments, custom claim values,
+ * audit log entries (as actor or target), 2FA enrollment status (NOT secrets),
+ * and active OIDC sessions/grants.
+ *
+ * **Purge** anonymizes the user record and audit entries, deletes all
+ * related data (roles, claims, 2FA, OIDC sessions), and writes the compliance
+ * audit event in the same transaction before commit.
+ *
+ * Safety: Purging super-admin org users is blocked to prevent lock-out.
+ *
+ * @module users/gdpr
+ */
+import type { User } from './types.js';
+/** Complete GDPR data export for a user */
+export interface UserDataExport {
+    exportedAt: string;
+    user: {
+        id: string;
+        email: string;
+        givenName: string | null;
+        familyName: string | null;
+        middleName: string | null;
+        nickname: string | null;
+        preferredUsername: string | null;
+        locale: string | null;
+        phoneNumber: string | null;
+        status: string;
+        createdAt: string;
+        lastLoginAt: string | null;
+    };
+    organization: {
+        id: string;
+        name: string;
+        slug: string;
+    };
+    roles: Array<{
+        roleId: string;
+        roleName: string;
+        roleSlug: string;
+        applicationId: string;
+        assignedAt: string;
+    }>;
+    customClaims: Array<{
+        claimName: string;
+        value: unknown;
+        applicationId: string;
+    }>;
+    auditLog: Array<{
+        id: string;
+        eventType: string;
+        eventCategory: string;
+        description: string | null;
+        createdAt: string;
+    }>;
+    twoFactor: {
+        enabled: boolean;
+        method: string | null;
+    };
+    oidcSessions: number;
+}
+/** Result from a purge operation */
+export interface PurgeResult {
+    userId: string;
+    anonymizedEmail: string;
+    deletedRoles: number;
+    deletedClaims: number;
+    deletedTwoFactor: number;
+    deletedOidcPayloads: number;
+    anonymizedAuditEntries: number;
+}
+/**
+ * Export all data Porta holds for a user as a structured JSON document.
+ *
+ * Collects data from: users, organizations, user_roles + roles,
+ * user_claim_values + claim_definitions, audit_log, user 2FA columns,
+ * and oidc_payloads. Does NOT export TOTP secrets or recovery codes
+ * (security-sensitive material).
+ *
+ * @param user - The user to export data for (must be a full User object)
+ * @returns Complete GDPR export document
+ */
+export declare function exportUserData(user: User): Promise<UserDataExport>;
+/**
+ * Irreversibly purge all PII for a user.
+ *
+ * Anonymizes the user record (email → purged-{id}@purged.local, clears
+ * name fields, sets status to 'inactive'). Deletes related records: role
+ * assignments, custom claim values, 2FA data, OIDC sessions/grants.
+ * Anonymizes audit log entries (actor_email → [purged]).
+ *
+ * Fires a `user.purged` audit event BEFORE anonymization for compliance trail.
+ *
+ * Safety checks:
+ * - Cannot purge users belonging to the super-admin organization
+ * - Requires explicit confirmation (caller responsibility)
+ *
+ * @param user - The user to purge (must be a full User object)
+ * @param actorId - ID of the admin performing the purge
+ * @returns Summary of what was deleted/anonymized
+ * @throws Error if user belongs to super-admin org
+ */
+export declare function purgeUserData(user: User, actorId: string): Promise<PurgeResult>;
+//# sourceMappingURL=gdpr.d.ts.map

package/dist/users/gdpr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gdpr.d.ts","sourceRoot":"","sources":["../../src/users/gdpr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAMvC,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC;IACF,YAAY,EAAE;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,KAAK,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,YAAY,EAAE,KAAK,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC,CAAC;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAkHxE;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkGrF"}

package/dist/users/gdpr.js

@@ -0,0 +1,211 @@
+/**
+ * GDPR data export and purge for users.
+ *
+ * Implements Article 17 (right to erasure) and Article 20 (data portability)
+ * capabilities for Porta's user data. These functions collect all user-related
+ * data across multiple tables for export, or anonymize/delete it for purge.
+ *
+ * **Export** collects: user profile, role assignments, custom claim values,
+ * audit log entries (as actor or target), 2FA enrollment status (NOT secrets),
+ * and active OIDC sessions/grants.
+ *
+ * **Purge** anonymizes the user record and audit entries, deletes all
+ * related data (roles, claims, 2FA, OIDC sessions), and writes the compliance
+ * audit event in the same transaction before commit.
+ *
+ * Safety: Purging super-admin org users is blocked to prevent lock-out.
+ *
+ * @module users/gdpr
+ */
+import { getDatabaseTransactionClient, getPool, runDatabaseTransaction } from '../lib/database.js';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+// ---------------------------------------------------------------------------
+// Export — collect all user data (Article 20)
+// ---------------------------------------------------------------------------
+/**
+ * Export all data Porta holds for a user as a structured JSON document.
+ *
+ * Collects data from: users, organizations, user_roles + roles,
+ * user_claim_values + claim_definitions, audit_log, user 2FA columns,
+ * and oidc_payloads. Does NOT export TOTP secrets or recovery codes
+ * (security-sensitive material).
+ *
+ * @param user - The user to export data for (must be a full User object)
+ * @returns Complete GDPR export document
+ */
+export async function exportUserData(user) {
+    const pool = getPool();
+    // Parallel queries for all user-related data
+    const [orgResult, rolesResult, claimsResult, auditResult, oidcResult] = await Promise.all([
+        // Organization the user belongs to
+        pool.query('SELECT id, name, slug FROM organizations WHERE id = $1', [user.organizationId]),
+        // Role assignments with role details
+        pool.query(`SELECT r.id AS role_id, r.name, r.slug, r.application_id, ur.created_at
+       FROM user_roles ur
+       JOIN roles r ON r.id = ur.role_id
+       WHERE ur.user_id = $1
+       ORDER BY ur.created_at`, [user.id]),
+        // Custom claim values with definition names
+        pool.query(`SELECT cd.claim_name, ucv.value, cd.application_id
+       FROM user_claim_values ucv
+       JOIN claim_definitions cd ON cd.id = ucv.definition_id
+       WHERE ucv.user_id = $1
+       ORDER BY cd.claim_name`, [user.id]),
+        // Audit log entries where user is actor or target (limited to 500)
+        pool.query(`SELECT id, event_type, event_category, description, created_at
+       FROM audit_log
+       WHERE actor_id = $1 OR user_id = $1
+       ORDER BY created_at DESC
+       LIMIT 500`, [user.id]),
+        // Count of active OIDC sessions/grants for user
+        pool.query(`SELECT COUNT(*) AS count FROM oidc_payloads
+       WHERE payload->>'accountId' = $1
+         AND (expires_at IS NULL OR expires_at > NOW())`, [user.id]),
+    ]);
+    const org = orgResult.rows[0] ?? { id: user.organizationId, name: 'Unknown', slug: 'unknown' };
+    return {
+        exportedAt: new Date().toISOString(),
+        user: {
+            id: user.id,
+            email: user.email,
+            givenName: user.givenName,
+            familyName: user.familyName,
+            middleName: user.middleName,
+            nickname: user.nickname,
+            preferredUsername: user.preferredUsername,
+            locale: user.locale,
+            phoneNumber: user.phoneNumber,
+            status: user.status,
+            createdAt: user.createdAt.toISOString(),
+            lastLoginAt: user.lastLoginAt?.toISOString() ?? null,
+        },
+        organization: {
+            id: org.id,
+            name: org.name,
+            slug: org.slug,
+        },
+        roles: rolesResult.rows.map((r) => ({
+            roleId: r.role_id,
+            roleName: r.name,
+            roleSlug: r.slug,
+            applicationId: r.application_id,
+            assignedAt: String(r.created_at),
+        })),
+        customClaims: claimsResult.rows.map((r) => ({
+            claimName: r.claim_name,
+            value: r.value,
+            applicationId: r.application_id,
+        })),
+        auditLog: auditResult.rows.map((r) => ({
+            id: r.id,
+            eventType: r.event_type,
+            eventCategory: r.event_category,
+            description: r.description,
+            createdAt: String(r.created_at),
+        })),
+        twoFactor: {
+            enabled: user.twoFactorEnabled,
+            method: user.twoFactorMethod ?? null,
+        },
+        oidcSessions: parseInt(oidcResult.rows[0]?.count ?? '0', 10),
+    };
+}
+// ---------------------------------------------------------------------------
+// Purge — anonymize/delete all user data (Article 17)
+// ---------------------------------------------------------------------------
+/**
+ * Irreversibly purge all PII for a user.
+ *
+ * Anonymizes the user record (email → purged-{id}@purged.local, clears
+ * name fields, sets status to 'inactive'). Deletes related records: role
+ * assignments, custom claim values, 2FA data, OIDC sessions/grants.
+ * Anonymizes audit log entries (actor_email → [purged]).
+ *
+ * Fires a `user.purged` audit event BEFORE anonymization for compliance trail.
+ *
+ * Safety checks:
+ * - Cannot purge users belonging to the super-admin organization
+ * - Requires explicit confirmation (caller responsibility)
+ *
+ * @param user - The user to purge (must be a full User object)
+ * @param actorId - ID of the admin performing the purge
+ * @returns Summary of what was deleted/anonymized
+ * @throws Error if user belongs to super-admin org
+ */
+export async function purgeUserData(user, actorId) {
+    return runDatabaseTransaction(async () => {
+        const client = getDatabaseTransactionClient();
+        if (!client)
+            throw new Error('GDPR purge transaction is unavailable');
+        // The authority check and destructive changes share the same transaction.
+        const orgCheck = await client.query('SELECT is_super_admin FROM organizations WHERE id = $1 FOR SHARE', [user.organizationId]);
+        if (orgCheck.rows[0]?.is_super_admin) {
+            throw new Error('Cannot purge users belonging to the super-admin organization');
+        }
+        // 1. Revoke all active OIDC sessions/grants
+        const oidcDelete = await client.query(`DELETE FROM oidc_payloads WHERE payload->>'accountId' = $1`, [user.id]);
+        // 2. Delete 2FA data (TOTP secrets, OTP codes, recovery codes)
+        await client.query('DELETE FROM user_totp WHERE user_id = $1', [user.id]);
+        await client.query('DELETE FROM two_factor_otp_codes WHERE user_id = $1', [user.id]);
+        const twoFactorDelete = await client.query('DELETE FROM two_factor_recovery_codes WHERE user_id = $1', [user.id]);
+        // 3. Delete custom claim values
+        const claimsDelete = await client.query('DELETE FROM user_claim_values WHERE user_id = $1', [
+            user.id,
+        ]);
+        // 4. Delete role assignments
+        const rolesDelete = await client.query('DELETE FROM user_roles WHERE user_id = $1', [user.id]);
+        // 5. Anonymize audit log entries referencing this user
+        const auditUpdate = await client.query(`UPDATE audit_log
+       SET metadata = metadata || '{"purged": true}'::jsonb
+       WHERE actor_id = $1 OR user_id = $1`, [user.id]);
+        // 6. Anonymize user record — clear PII, keep ID for referential integrity
+        const anonymizedEmail = `purged-${user.id}@purged.local`;
+        await client.query(`UPDATE users SET
+         email = $2,
+         email_verified = false,
+         password_hash = NULL,
+         given_name = NULL,
+         family_name = NULL,
+         middle_name = NULL,
+         nickname = NULL,
+         preferred_username = NULL,
+         profile_url = NULL,
+         picture_url = NULL,
+         website_url = NULL,
+         gender = NULL,
+         birthdate = NULL,
+         zoneinfo = NULL,
+         locale = NULL,
+         phone_number = NULL,
+         phone_number_verified = false,
+         address_street = NULL,
+         address_locality = NULL,
+         address_region = NULL,
+         address_postal_code = NULL,
+         address_country = NULL,
+         status = 'inactive',
+         two_factor_enabled = false,
+         two_factor_method = NULL,
+         updated_at = NOW()
+       WHERE id = $1`, [user.id, anonymizedEmail]);
+        await writeAuditLogInTransaction(client, {
+            organizationId: user.organizationId,
+            userId: user.id,
+            actorId,
+            eventType: 'user.purged',
+            eventCategory: 'gdpr',
+            description: 'GDPR purge committed',
+            metadata: { userId: user.id },
+        });
+        return {
+            userId: user.id,
+            anonymizedEmail,
+            deletedRoles: rolesDelete.rowCount ?? 0,
+            deletedClaims: claimsDelete.rowCount ?? 0,
+            deletedTwoFactor: twoFactorDelete.rowCount ?? 0,
+            deletedOidcPayloads: oidcDelete.rowCount ?? 0,
+            anonymizedAuditEntries: auditUpdate.rowCount ?? 0,
+        };
+    });
+}
+//# sourceMappingURL=gdpr.js.map

package/dist/users/gdpr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gdpr.js","sourceRoot":"","sources":["../../src/users/gdpr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAkEjE,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAU;IAC7C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,6CAA6C;IAC7C,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxF,mCAAmC;QACnC,IAAI,CAAC,KAAK,CACR,wDAAwD,EACxD,CAAC,IAAI,CAAC,cAAc,CAAC,CACtB;QAED,qCAAqC;QACrC,IAAI,CAAC,KAAK,CAOR;;;;8BAIwB,EACxB,CAAC,IAAI,CAAC,EAAE,CAAC,CACV;QAED,4CAA4C;QAC5C,IAAI,CAAC,KAAK,CAKR;;;;8BAIwB,EACxB,CAAC,IAAI,CAAC,EAAE,CAAC,CACV;QAED,mEAAmE;QACnE,IAAI,CAAC,KAAK,CAOR;;;;iBAIW,EACX,CAAC,IAAI,CAAC,EAAE,CAAC,CACV;QAED,gDAAgD;QAChD,IAAI,CAAC,KAAK,CACR;;wDAEkD,EAClD,CAAC,IAAI,CAAC,EAAE,CAAC,CACV;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAE/F,OAAO;QACL,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;SACrD;QACD,YAAY,EAAE;YACZ,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf;QACD,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,EAAE,CAAC,CAAC,OAAO;YACjB,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,aAAa,EAAE,CAAC,CAAC,cAAc;YAC/B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SACjC,CAAC,CAAC;QACH,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,cAAc;SAChC,CAAC,CAAC;QACH,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,aAAa,EAAE,CAAC,CAAC,cAAc;YAC/B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;SAChC,CAAC,CAAC;QACH,SAAS,EAAE;YACT,OAAO,EAAE,IAAI,CAAC,gBAAgB;YAC9B,MAAM,EAAE,IAAI,CAAC,eAAe,IAAI,IAAI;SACrC;QACD,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAU,EAAE,OAAe;IAC7D,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,4BAA4B,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAEtE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,kEAAkE,EAClE,CAAC,IAAI,CAAC,cAAc,CAAC,CACtB,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,4DAA4D,EAC5D,CAAC,IAAI,CAAC,EAAE,CAAC,CACV,CAAC;QAEF,+DAA+D;QAC/D,MAAM,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC,0DAA0D,EAC1D,CAAC,IAAI,CAAC,EAAE,CAAC,CACV,CAAC;QAEF,gCAAgC;QAChC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YAC1F,IAAI,CAAC,EAAE;SACR,CAAC,CAAC;QAEH,6BAA6B;QAC7B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/F,uDAAuD;QACvD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CACpC;;2CAEqC,EACrC,CAAC,IAAI,CAAC,EAAE,CAAC,CACV,CAAC;QAEF,0EAA0E;QAC1E,MAAM,eAAe,GAAG,UAAU,IAAI,CAAC,EAAE,eAAe,CAAC;QACzD,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA2Be,EACf,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,CAC3B,CAAC;QAEF,MAAM,0BAA0B,CAAC,MAAM,EAAE;YACvC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO;YACP,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,sBAAsB;YACnC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC9B,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,eAAe;YACf,YAAY,EAAE,WAAW,CAAC,QAAQ,IAAI,CAAC;YACvC,aAAa,EAAE,YAAY,CAAC,QAAQ,IAAI,CAAC;YACzC,gBAAgB,EAAE,eAAe,CAAC,QAAQ,IAAI,CAAC;YAC/C,mBAAmB,EAAE,UAAU,CAAC,QAAQ,IAAI,CAAC;YAC7C,sBAAsB,EAAE,WAAW,CAAC,QAAQ,IAAI,CAAC;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/users/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Users module — public API barrel export.
+ *
+ * Re-exports the types, service functions, claims builder, error classes,
+ * and password utilities that other modules need. Internal implementation
+ * details (repository, cache) are NOT exported — they are consumed only
+ * by the service layer.
+ */
+export type { User, UserRow, UserStatus, CreateUserInput, UpdateUserInput, AddressInput, UserListOptions, PaginatedResult, } from './types.js';
+export { createUser, getUserById, getUserByEmail, updateUser, listUsersByOrganization, listUsersCursor, deactivateUser, reactivateUser, suspendUser, unsuspendUser, lockUser, unlockUser, setUserPassword, verifyUserPassword, clearUserPassword, markEmailVerified, markEmailUnverified, recordLogin, recordFailedLogin, checkAutoUnlock, findUserForOidc, } from './service.js';
+export { buildUserClaims, hasAddress } from './claims.js';
+export type { OidcClaims, OidcAddress } from './claims.js';
+export type { ListUsersCursorOptions } from './repository.js';
+export type { CursorPaginatedResult } from '../lib/cursor.js';
+export { UserNotFoundError, UserValidationError } from './errors.js';
+export { validatePassword, MIN_PASSWORD_LENGTH, MAX_PASSWORD_LENGTH, } from './password.js';
+export type { PasswordValidationResult } from './password.js';
+export { exportUserData, purgeUserData } from './gdpr.js';
+export type { UserDataExport, PurgeResult } from './gdpr.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/users/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/users/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,IAAI,EACJ,OAAO,EACP,UAAU,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,eAAe,EACf,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,QAAQ,EACR,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG3D,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGrE,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG9D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/users/index.js

@@ -0,0 +1,19 @@
+/**
+ * Users module — public API barrel export.
+ *
+ * Re-exports the types, service functions, claims builder, error classes,
+ * and password utilities that other modules need. Internal implementation
+ * details (repository, cache) are NOT exported — they are consumed only
+ * by the service layer.
+ */
+// Service functions
+export { createUser, getUserById, getUserByEmail, updateUser, listUsersByOrganization, listUsersCursor, deactivateUser, reactivateUser, suspendUser, unsuspendUser, lockUser, unlockUser, setUserPassword, verifyUserPassword, clearUserPassword, markEmailVerified, markEmailUnverified, recordLogin, recordFailedLogin, checkAutoUnlock, findUserForOidc, } from './service.js';
+// Claims builder
+export { buildUserClaims, hasAddress } from './claims.js';
+// Error types
+export { UserNotFoundError, UserValidationError } from './errors.js';
+// Password utilities (for external consumers like CLI)
+export { validatePassword, MIN_PASSWORD_LENGTH, MAX_PASSWORD_LENGTH, } from './password.js';
+// GDPR export/purge (Article 17 + Article 20)
+export { exportUserData, purgeUserData } from './gdpr.js';
+//# sourceMappingURL=index.js.map

package/dist/users/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/users/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,oBAAoB;AACpB,OAAO,EACL,UAAU,EACV,WAAW,EACX,cAAc,EACd,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACb,QAAQ,EACR,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAO1D,cAAc;AACd,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAErE,uDAAuD;AACvD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,8CAA8C;AAC9C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/users/password.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Password management utilities.
+ *
+ * Provides password validation (NIST SP 800-63B compliant length checks),
+ * Argon2id hashing, and verification. Follows the same pattern as
+ * `src/clients/crypto.ts` but with password-specific naming and a
+ * validation function.
+ *
+ * Design decisions:
+ * - No complexity rules (uppercase, special chars) per NIST SP 800-63B
+ *   guidance — length is the primary strength factor
+ * - Argon2id with library defaults (OWASP compliant parameters)
+ * - verifyPassword returns false on any error (invalid hash format, etc.)
+ *   to prevent timing side-channels from leaking hash validity info
+ */
+/** Minimum password length per NIST SP 800-63B recommendation */
+export declare const MIN_PASSWORD_LENGTH = 8;
+/** Maximum password length to prevent denial-of-service via huge inputs */
+export declare const MAX_PASSWORD_LENGTH = 128;
+/** Result of password validation — includes error message when invalid */
+export interface PasswordValidationResult {
+    isValid: boolean;
+    error?: string;
+}
+/**
+ * Validate a password against length constraints.
+ *
+ * Checks min/max length per NIST SP 800-63B. No complexity rules
+ * (uppercase, numbers, special chars) are enforced — NIST recommends
+ * against them as they don't meaningfully improve security and
+ * frustrate users.
+ *
+ * @param password - The plaintext password to validate
+ * @returns Validation result with `isValid` flag and optional `error` message
+ */
+export declare function validatePassword(password: string): PasswordValidationResult;
+/**
+ * Hash a password using Argon2id.
+ *
+ * Argon2id combines Argon2d (GPU-resistant) and Argon2i (side-channel
+ * resistant). The argon2 library's default parameters follow OWASP
+ * recommendations for password hashing.
+ *
+ * The returned hash string includes the algorithm, salt, and parameters
+ * in PHC format — everything needed for verification.
+ *
+ * @param plaintext - The password to hash
+ * @returns Argon2id hash string (PHC format)
+ */
+export declare function hashPassword(plaintext: string): Promise<string>;
+/**
+ * Initialize the process-owned Argon2id dummy hash.
+ *
+ * Startup awaits this operation so an authentication process never serves requests with a cheap
+ * missing-account branch. Repeated calls are idempotent for the lifetime of the process.
+ */
+export declare function initializeDummyPasswordHash(): Promise<void>;
+/**
+ * Read the initialized process-owned dummy hash.
+ *
+ * @returns Argon2id hash with no authentication authority.
+ * @throws Error when startup did not initialize the dummy hash.
+ */
+export declare function getDummyPasswordHash(): string;
+/**
+ * Return the process-owned dummy hash, initializing it when an embedded app bypassed the entry
+ * point. Production startup still awaits initialization before listening.
+ *
+ * @returns Initialized non-authoritative Argon2id hash.
+ */
+export declare function ensureDummyPasswordHash(): Promise<string>;
+/**
+ * Verify a plaintext password against a stored Argon2id hash.
+ *
+ * Returns true if the password matches, false otherwise. Any errors
+ * during verification (e.g., invalid hash format) are caught and
+ * treated as a non-match to prevent timing side-channels from
+ * leaking information about hash validity.
+ *
+ * @param hash - Stored Argon2id hash (PHC format)
+ * @param plaintext - Password to verify
+ * @returns true if the password matches the hash, false otherwise
+ */
+export declare function verifyPassword(hash: string, plaintext: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/users/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/users/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAYvC,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CAgB3E;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAK7C;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAG/D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtF"}