@puzzle-ui/auth 0.0.0-stage → 0.5.1

package/dist/auth.storage.js

@@ -0,0 +1,148 @@
+// src/auth.storage.ts
+const AUTH_USER_COLLECTION = "auth_users";
+const AUTH_CREDENTIAL_COLLECTION = "auth_credentials";
+const AUTH_ACTION_TOKEN_COLLECTION = "auth_action_tokens";
+const AUTH_AUDIT_COLLECTION = "auth_audit_events";
+const AUTH_RATE_LIMIT_COLLECTION = "auth_rate_limits";
+const AUTH_MFA_FACTOR_COLLECTION = "auth_mfa_factors";
+const AUTH_MFA_CHALLENGE_COLLECTION = "auth_mfa_challenges";
+const AUTH_RECOVERY_CODE_COLLECTION = "auth_recovery_codes";
+const authUserCollection = {
+	name: AUTH_USER_COLLECTION,
+	indexes: [{
+		name: "normalized_email_unique",
+		fields: ["normalizedEmail"],
+		unique: true
+	}]
+};
+const authCredentialCollection = {
+	name: AUTH_CREDENTIAL_COLLECTION,
+	indexes: [{
+		name: "user_kind_unique",
+		fields: ["userId", "kind"],
+		unique: true
+	}, {
+		name: "user_id",
+		fields: ["userId"]
+	}]
+};
+const authActionTokenCollection = {
+	name: AUTH_ACTION_TOKEN_COLLECTION,
+	indexes: [
+		{
+			name: "token_hash_unique",
+			fields: ["tokenHash"],
+			unique: true
+		},
+		{
+			name: "user_purpose",
+			fields: ["userId", "purpose"]
+		},
+		{
+			name: "token_expiration",
+			fields: ["expiresAt"]
+		}
+	]
+};
+const authAuditCollection = {
+	name: AUTH_AUDIT_COLLECTION,
+	indexes: [{
+		name: "user_created",
+		fields: ["userId", "createdAt"]
+	}, {
+		name: "action_created",
+		fields: ["action", "createdAt"]
+	}]
+};
+const authRateLimitCollection = {
+	name: AUTH_RATE_LIMIT_COLLECTION,
+	indexes: [{
+		name: "rate_limit_reset",
+		fields: ["resetAt"]
+	}]
+};
+const authMfaFactorCollection = {
+	name: AUTH_MFA_FACTOR_COLLECTION,
+	indexes: [
+		{
+			name: "factor_key_unique",
+			fields: ["factorKey"],
+			unique: true
+		},
+		{
+			name: "factor_user_status",
+			fields: ["userId", "status"]
+		},
+		{
+			name: "factor_credential_id",
+			fields: ["credentialId"]
+		}
+	]
+};
+const authMfaChallengeCollection = {
+	name: AUTH_MFA_CHALLENGE_COLLECTION,
+	indexes: [
+		{
+			name: "mfa_challenge_token_unique",
+			fields: ["tokenHash"],
+			unique: true
+		},
+		{
+			name: "mfa_challenge_user",
+			fields: ["userId", "purpose"]
+		},
+		{
+			name: "mfa_challenge_expiration",
+			fields: ["expiresAt"]
+		}
+	]
+};
+const authRecoveryCodeCollection = {
+	name: AUTH_RECOVERY_CODE_COLLECTION,
+	indexes: [{
+		name: "recovery_code_hash_unique",
+		fields: ["codeHash"],
+		unique: true
+	}, {
+		name: "recovery_code_user",
+		fields: ["userId", "consumedAt"]
+	}]
+};
+const initializeAuthStorage = async (storage, options = {}) => {
+	if (!storage.capabilities.uniqueConstraints || !storage.capabilities.atomicBatch) throw new Error("Authentication storage requires unique constraints and atomic batches.");
+	await storage.registerCollection({
+		...authUserCollection,
+		name: options.usersCollection ?? "auth_users"
+	});
+	await storage.registerCollection({
+		...authCredentialCollection,
+		name: options.credentialsCollection ?? "auth_credentials"
+	});
+	await storage.registerCollection({
+		...authActionTokenCollection,
+		name: options.actionTokensCollection ?? "auth_action_tokens"
+	});
+	await storage.registerCollection({
+		...authAuditCollection,
+		name: options.auditCollection ?? "auth_audit_events"
+	});
+	await storage.registerCollection({
+		...authRateLimitCollection,
+		name: options.rateLimitsCollection ?? "auth_rate_limits"
+	});
+	await storage.registerCollection({
+		...authMfaFactorCollection,
+		name: options.factorsCollection ?? "auth_mfa_factors"
+	});
+	await storage.registerCollection({
+		...authMfaChallengeCollection,
+		name: options.challengesCollection ?? "auth_mfa_challenges"
+	});
+	await storage.registerCollection({
+		...authRecoveryCodeCollection,
+		name: options.recoveryCodesCollection ?? "auth_recovery_codes"
+	});
+};
+export { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, authActionTokenCollection, authAuditCollection, authCredentialCollection, authMfaChallengeCollection, authMfaFactorCollection, authRateLimitCollection, authRecoveryCodeCollection, authUserCollection, initializeAuthStorage };
+
+//# sourceMappingURL=auth.storage.js.map

package/dist/auth.storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.storage.js","names":[],"sources":["../src/auth.storage.ts"],"sourcesContent":["import type {\n  StorageAdapter,\n  StorageCollection,\n  StorageRecord,\n} from \"@puzzle-ui/storage\";\n\nimport type { AuthUser } from \"./types/user.types\";\nimport type { PasswordCredentialStorageRecord } from \"./types/credential.types\";\n\nimport type {\n  AuthActionTokenStorageRecord,\n  AuthAuditEventStorageRecord,\n  AuthRateLimitStorageRecord,\n} from \"./types/auth-lifecycle.types\";\n\nimport type {\n  AuthMfaChallengeStorageRecord,\n  AuthMfaFactorStorageRecord,\n  AuthRecoveryCodeStorageRecord,\n} from \"./types/mfa.types\";\n\nexport const AUTH_USER_COLLECTION = \"auth_users\";\nexport const AUTH_CREDENTIAL_COLLECTION = \"auth_credentials\";\nexport const AUTH_ACTION_TOKEN_COLLECTION = \"auth_action_tokens\";\nexport const AUTH_AUDIT_COLLECTION = \"auth_audit_events\";\nexport const AUTH_RATE_LIMIT_COLLECTION = \"auth_rate_limits\";\n\nexport const AUTH_MFA_FACTOR_COLLECTION = \"auth_mfa_factors\";\nexport const AUTH_MFA_CHALLENGE_COLLECTION = \"auth_mfa_challenges\";\nexport const AUTH_RECOVERY_CODE_COLLECTION = \"auth_recovery_codes\";\n\nexport type AuthUserStorageRecord = AuthUser &\n  StorageRecord & {\n    readonly normalizedEmail: string;\n    readonly deactivatedAt: Date | null;\n    readonly sessionsInvalidatedAt: Date | null;\n  };\n\nexport const authUserCollection: StorageCollection<AuthUserStorageRecord> = {\n  name: AUTH_USER_COLLECTION,\n  indexes: [\n    {\n      name: \"normalized_email_unique\",\n      fields: [\"normalizedEmail\"],\n      unique: true,\n    },\n  ],\n};\n\nexport const authCredentialCollection: StorageCollection<PasswordCredentialStorageRecord> =\n  {\n    name: AUTH_CREDENTIAL_COLLECTION,\n    indexes: [\n      {\n        name: \"user_kind_unique\",\n        fields: [\"userId\", \"kind\"],\n        unique: true,\n      },\n      {\n        name: \"user_id\",\n        fields: [\"userId\"],\n      },\n    ],\n  };\n\nexport const authActionTokenCollection: StorageCollection<AuthActionTokenStorageRecord> =\n  {\n    name: AUTH_ACTION_TOKEN_COLLECTION,\n    indexes: [\n      {\n        name: \"token_hash_unique\",\n        fields: [\"tokenHash\"],\n        unique: true,\n      },\n      {\n        name: \"user_purpose\",\n        fields: [\"userId\", \"purpose\"],\n      },\n      {\n        name: \"token_expiration\",\n        fields: [\"expiresAt\"],\n      },\n    ],\n  };\n\nexport const authAuditCollection: StorageCollection<AuthAuditEventStorageRecord> =\n  {\n    name: AUTH_AUDIT_COLLECTION,\n    indexes: [\n      {\n        name: \"user_created\",\n        fields: [\"userId\", \"createdAt\"],\n      },\n      {\n        name: \"action_created\",\n        fields: [\"action\", \"createdAt\"],\n      },\n    ],\n  };\n\nexport const authRateLimitCollection: StorageCollection<AuthRateLimitStorageRecord> =\n  {\n    name: AUTH_RATE_LIMIT_COLLECTION,\n    indexes: [\n      {\n        name: \"rate_limit_reset\",\n        fields: [\"resetAt\"],\n      },\n    ],\n  };\n\nexport const authMfaFactorCollection: StorageCollection<AuthMfaFactorStorageRecord> =\n  {\n    name: AUTH_MFA_FACTOR_COLLECTION,\n    indexes: [\n      {\n        name: \"factor_key_unique\",\n        fields: [\"factorKey\"],\n        unique: true,\n      },\n      {\n        name: \"factor_user_status\",\n        fields: [\"userId\", \"status\"],\n      },\n      {\n        name: \"factor_credential_id\",\n        fields: [\"credentialId\"],\n      },\n    ],\n  };\n\nexport const authMfaChallengeCollection: StorageCollection<AuthMfaChallengeStorageRecord> =\n  {\n    name: AUTH_MFA_CHALLENGE_COLLECTION,\n    indexes: [\n      {\n        name: \"mfa_challenge_token_unique\",\n        fields: [\"tokenHash\"],\n        unique: true,\n      },\n      {\n        name: \"mfa_challenge_user\",\n        fields: [\"userId\", \"purpose\"],\n      },\n      {\n        name: \"mfa_challenge_expiration\",\n        fields: [\"expiresAt\"],\n      },\n    ],\n  };\n\nexport const authRecoveryCodeCollection: StorageCollection<AuthRecoveryCodeStorageRecord> =\n  {\n    name: AUTH_RECOVERY_CODE_COLLECTION,\n    indexes: [\n      {\n        name: \"recovery_code_hash_unique\",\n        fields: [\"codeHash\"],\n        unique: true,\n      },\n      {\n        name: \"recovery_code_user\",\n        fields: [\"userId\", \"consumedAt\"],\n      },\n    ],\n  };\n\nexport type InitializeAuthStorageOptions = {\n  readonly usersCollection?: string;\n  readonly credentialsCollection?: string;\n  readonly actionTokensCollection?: string;\n  readonly auditCollection?: string;\n  readonly rateLimitsCollection?: string;\n\n  readonly factorsCollection?: string;\n  readonly challengesCollection?: string;\n  readonly recoveryCodesCollection?: string;\n};\n\nexport const initializeAuthStorage = async (\n  storage: StorageAdapter,\n  options: InitializeAuthStorageOptions = {},\n): Promise<void> => {\n  if (\n    !storage.capabilities.uniqueConstraints ||\n    !storage.capabilities.atomicBatch\n  ) {\n    throw new Error(\n      \"Authentication storage requires unique constraints and atomic batches.\",\n    );\n  }\n\n  await storage.registerCollection({\n    ...authUserCollection,\n    name: options.usersCollection ?? AUTH_USER_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authCredentialCollection,\n    name: options.credentialsCollection ?? AUTH_CREDENTIAL_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authActionTokenCollection,\n    name: options.actionTokensCollection ?? AUTH_ACTION_TOKEN_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authAuditCollection,\n    name: options.auditCollection ?? AUTH_AUDIT_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authRateLimitCollection,\n    name: options.rateLimitsCollection ?? AUTH_RATE_LIMIT_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authMfaFactorCollection,\n    name: options.factorsCollection ?? AUTH_MFA_FACTOR_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authMfaChallengeCollection,\n    name: options.challengesCollection ?? AUTH_MFA_CHALLENGE_COLLECTION,\n  });\n\n  await storage.registerCollection({\n    ...authRecoveryCodeCollection,\n    name: options.recoveryCodesCollection ?? AUTH_RECOVERY_CODE_COLLECTION,\n  });\n};\n"],"mappings":";AAqBA,MAAa,uBAAuB;AACpC,MAAa,6BAA6B;AAC1C,MAAa,+BAA+B;AAC5C,MAAa,wBAAwB;AACrC,MAAa,6BAA6B;AAE1C,MAAa,6BAA6B;AAC1C,MAAa,gCAAgC;AAC7C,MAAa,gCAAgC;AAS7C,MAAa,qBAA+D;CAC1E,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,iBAAiB;EAC1B,QAAQ;CACV,CACF;AACF;AAEA,MAAa,2BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,MAAM;EACzB,QAAQ;CACV,GACA;EACE,MAAM;EACN,QAAQ,CAAC,QAAQ;CACnB,CACF;AACF;AAEF,MAAa,4BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,SAAS;EAC9B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;EACtB;CACF;AACF;AAEF,MAAa,sBACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,WAAW;CAChC,GACA;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,WAAW;CAChC,CACF;AACF;AAEF,MAAa,0BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,SAAS;CACpB,CACF;AACF;AAEF,MAAa,0BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,QAAQ;EAC7B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,cAAc;EACzB;CACF;AACF;AAEF,MAAa,6BACX;CACE,MAAM;CACN,SAAS;EACP;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;GACpB,QAAQ;EACV;EACA;GACE,MAAM;GACN,QAAQ,CAAC,UAAU,SAAS;EAC9B;EACA;GACE,MAAM;GACN,QAAQ,CAAC,WAAW;EACtB;CACF;AACF;AAEF,MAAa,6BACX;CACE,MAAM;CACN,SAAS,CACP;EACE,MAAM;EACN,QAAQ,CAAC,UAAU;EACnB,QAAQ;CACV,GACA;EACE,MAAM;EACN,QAAQ,CAAC,UAAU,YAAY;CACjC,CACF;AACF;AAcF,MAAa,wBAAwB,OACnC,SACA,UAAwC,CAAC,MACvB;CAClB,IACE,CAAC,QAAQ,aAAa,qBACtB,CAAC,QAAQ,aAAa,aAEtB,MAAM,IAAI,MACR,wEACF;CAGF,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,mBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,yBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,0BAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,mBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,wBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,qBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,wBAAA;CAChB,CAAC;CAED,MAAM,QAAQ,mBAAmB;EAC/B,GAAG;EACH,MAAM,QAAQ,2BAAA;CAChB,CAAC;AACH"}

package/dist/errors/auth.errors.cjs

@@ -0,0 +1,101 @@
+// src/errors/auth.errors.ts
+var AuthError = class extends Error {
+	code;
+	cause;
+	details;
+	constructor(code, message, options) {
+		super(message);
+		this.name = "AuthError";
+		this.code = code;
+		this.cause = options?.cause;
+		this.details = options?.details;
+	}
+};
+var AuthValidationError = class extends AuthError {
+	constructor(message) {
+		super("INVALID_INPUT", message);
+		this.name = "AuthValidationError";
+	}
+};
+var AuthInvalidCredentialsError = class extends AuthError {
+	constructor() {
+		super("INVALID_CREDENTIALS", "Invalid email or password.");
+		this.name = "AuthInvalidCredentialsError";
+	}
+};
+var AuthEmailVerificationRequiredError = class extends AuthError {
+	constructor() {
+		super("EMAIL_NOT_VERIFIED", "Verify your email address before signing in.");
+		this.name = "AuthEmailVerificationRequiredError";
+	}
+};
+var AuthAccountConflictError = class extends AuthError {
+	constructor(options) {
+		super("CONFLICT", "Unable to create an account with the supplied details.", options);
+		this.name = "AuthAccountConflictError";
+	}
+};
+var AuthRateLimitError = class extends AuthError {
+	resetAt;
+	constructor(resetAt) {
+		super("RATE_LIMITED", "Too many authentication attempts. Try again later.", { details: { resetAt } });
+		this.name = "AuthRateLimitError";
+		this.resetAt = resetAt;
+	}
+};
+var AuthConfigurationError = class extends AuthError {
+	constructor(message, options) {
+		super("CONFIGURATION", message, options);
+		this.name = "AuthConfigurationError";
+	}
+};
+var AuthProviderError = class extends AuthError {
+	constructor(message, options) {
+		super("PROVIDER", message, options);
+		this.name = "AuthProviderError";
+	}
+};
+var AuthSessionError = class extends AuthError {
+	constructor(message, options) {
+		super("SESSION", message, options);
+		this.name = "AuthSessionError";
+	}
+};
+var AuthTokenError = class extends AuthError {
+	constructor() {
+		super("INVALID_TOKEN", "This link is invalid or has expired.");
+		this.name = "AuthTokenError";
+	}
+};
+/**
+* Deliberately generic.
+*
+* Do not expose whether a challenge exists, which factor failed,
+* or whether a recovery code belonged to another account.
+*/
+var AuthMfaChallengeError = class extends AuthError {
+	constructor(options) {
+		super("MFA_CHALLENGE", "The authentication challenge is invalid or has expired.", options);
+		this.name = "AuthMfaChallengeError";
+	}
+};
+var AuthMfaFactorError = class extends AuthError {
+	constructor(message = "The authentication factor could not be used.", options) {
+		super("MFA_FACTOR", message, options);
+		this.name = "AuthMfaFactorError";
+	}
+};
+exports.AuthAccountConflictError = AuthAccountConflictError;
+exports.AuthConfigurationError = AuthConfigurationError;
+exports.AuthEmailVerificationRequiredError = AuthEmailVerificationRequiredError;
+exports.AuthError = AuthError;
+exports.AuthInvalidCredentialsError = AuthInvalidCredentialsError;
+exports.AuthMfaChallengeError = AuthMfaChallengeError;
+exports.AuthMfaFactorError = AuthMfaFactorError;
+exports.AuthProviderError = AuthProviderError;
+exports.AuthRateLimitError = AuthRateLimitError;
+exports.AuthSessionError = AuthSessionError;
+exports.AuthTokenError = AuthTokenError;
+exports.AuthValidationError = AuthValidationError;
+
+//# sourceMappingURL=auth.errors.cjs.map

package/dist/errors/auth.errors.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.errors.cjs","names":[],"sources":["../../src/errors/auth.errors.ts"],"sourcesContent":["export type AuthErrorCode =\n  | \"INVALID_INPUT\"\n  | \"INVALID_CREDENTIALS\"\n  | \"EMAIL_NOT_VERIFIED\"\n  | \"RATE_LIMITED\"\n  | \"CONFLICT\"\n  | \"CONFIGURATION\"\n  | \"PROVIDER\"\n  | \"SESSION\"\n  | \"INVALID_TOKEN\"\n  | \"MFA_CHALLENGE\"\n  | \"MFA_FACTOR\";\n\nexport class AuthError extends Error {\n  readonly code: AuthErrorCode;\n  override readonly cause?: unknown;\n  readonly details?: Readonly<Record<string, unknown>>;\n\n  constructor(\n    code: AuthErrorCode,\n    message: string,\n    options?: {\n      readonly cause?: unknown;\n      readonly details?: Readonly<Record<string, unknown>>;\n    },\n  ) {\n    super(message);\n\n    this.name = \"AuthError\";\n    this.code = code;\n    this.cause = options?.cause;\n    this.details = options?.details;\n  }\n}\n\nexport class AuthValidationError extends AuthError {\n  constructor(message: string) {\n    super(\"INVALID_INPUT\", message);\n    this.name = \"AuthValidationError\";\n  }\n}\n\nexport class AuthInvalidCredentialsError extends AuthError {\n  constructor() {\n    super(\"INVALID_CREDENTIALS\", \"Invalid email or password.\");\n    this.name = \"AuthInvalidCredentialsError\";\n  }\n}\n\nexport class AuthEmailVerificationRequiredError extends AuthError {\n  constructor() {\n    super(\"EMAIL_NOT_VERIFIED\", \"Verify your email address before signing in.\");\n    this.name = \"AuthEmailVerificationRequiredError\";\n  }\n}\n\nexport class AuthAccountConflictError extends AuthError {\n  constructor(options?: { readonly cause?: unknown }) {\n    super(\n      \"CONFLICT\",\n      \"Unable to create an account with the supplied details.\",\n      options,\n    );\n\n    this.name = \"AuthAccountConflictError\";\n  }\n}\n\nexport class AuthRateLimitError extends AuthError {\n  readonly resetAt: Date;\n\n  constructor(resetAt: Date) {\n    super(\n      \"RATE_LIMITED\",\n      \"Too many authentication attempts. Try again later.\",\n      {\n        details: { resetAt },\n      },\n    );\n\n    this.name = \"AuthRateLimitError\";\n    this.resetAt = resetAt;\n  }\n}\n\nexport class AuthConfigurationError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"CONFIGURATION\", message, options);\n    this.name = \"AuthConfigurationError\";\n  }\n}\n\nexport class AuthProviderError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"PROVIDER\", message, options);\n    this.name = \"AuthProviderError\";\n  }\n}\n\nexport class AuthSessionError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"SESSION\", message, options);\n    this.name = \"AuthSessionError\";\n  }\n}\n\nexport class AuthTokenError extends AuthError {\n  constructor() {\n    super(\"INVALID_TOKEN\", \"This link is invalid or has expired.\");\n    this.name = \"AuthTokenError\";\n  }\n}\n\n/**\n * Deliberately generic.\n *\n * Do not expose whether a challenge exists, which factor failed,\n * or whether a recovery code belonged to another account.\n */\nexport class AuthMfaChallengeError extends AuthError {\n  constructor(options?: { readonly cause?: unknown }) {\n    super(\n      \"MFA_CHALLENGE\",\n      \"The authentication challenge is invalid or has expired.\",\n      options,\n    );\n\n    this.name = \"AuthMfaChallengeError\";\n  }\n}\n\nexport class AuthMfaFactorError extends AuthError {\n  constructor(\n    message = \"The authentication factor could not be used.\",\n    options?: {\n      readonly cause?: unknown;\n    },\n  ) {\n    super(\"MFA_FACTOR\", message, options);\n    this.name = \"AuthMfaFactorError\";\n  }\n}\n"],"mappings":";AAaA,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA;CACA;CAEA,YACE,MACA,SACA,SAIA;EACA,MAAM,OAAO;EAEb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,QAAQ,SAAS;EACtB,KAAK,UAAU,SAAS;CAC1B;AACF;AAEA,IAAa,sBAAb,cAAyC,UAAU;CACjD,YAAY,SAAiB;EAC3B,MAAM,iBAAiB,OAAO;EAC9B,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,UAAU;CACzD,cAAc;EACZ,MAAM,uBAAuB,4BAA4B;EACzD,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qCAAb,cAAwD,UAAU;CAChE,cAAc;EACZ,MAAM,sBAAsB,8CAA8C;EAC1E,KAAK,OAAO;CACd;AACF;AAEA,IAAa,2BAAb,cAA8C,UAAU;CACtD,YAAY,SAAwC;EAClD,MACE,YACA,0DACA,OACF;EAEA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD;CAEA,YAAY,SAAe;EACzB,MACE,gBACA,sDACA,EACE,SAAS,EAAE,QAAQ,EACrB,CACF;EAEA,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;AACF;AAEA,IAAa,yBAAb,cAA4C,UAAU;CACpD,YAAY,SAAiB,SAAwC;EACnE,MAAM,iBAAiB,SAAS,OAAO;EACvC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YAAY,SAAiB,SAAwC;EACnE,MAAM,YAAY,SAAS,OAAO;EAClC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,mBAAb,cAAsC,UAAU;CAC9C,YAAY,SAAiB,SAAwC;EACnE,MAAM,WAAW,SAAS,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,cAAc;EACZ,MAAM,iBAAiB,sCAAsC;EAC7D,KAAK,OAAO;CACd;AACF;;;;;;;AAQA,IAAa,wBAAb,cAA2C,UAAU;CACnD,YAAY,SAAwC;EAClD,MACE,iBACA,2DACA,OACF;EAEA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,YACE,UAAU,gDACV,SAGA;EACA,MAAM,cAAc,SAAS,OAAO;EACpC,KAAK,OAAO;CACd;AACF"}

package/dist/errors/auth.errors.d.cts

@@ -0,0 +1,62 @@
+export type AuthErrorCode = "INVALID_INPUT" | "INVALID_CREDENTIALS" | "EMAIL_NOT_VERIFIED" | "RATE_LIMITED" | "CONFLICT" | "CONFIGURATION" | "PROVIDER" | "SESSION" | "INVALID_TOKEN" | "MFA_CHALLENGE" | "MFA_FACTOR";
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  readonly cause?: unknown;
+  readonly details?: Readonly<Record<string, unknown>>;
+  constructor(code: AuthErrorCode, message: string, options?: {
+    readonly cause?: unknown;
+    readonly details?: Readonly<Record<string, unknown>>;
+  });
+}
+export declare class AuthValidationError extends AuthError {
+  constructor(message: string);
+}
+export declare class AuthInvalidCredentialsError extends AuthError {
+  constructor();
+}
+export declare class AuthEmailVerificationRequiredError extends AuthError {
+  constructor();
+}
+export declare class AuthAccountConflictError extends AuthError {
+  constructor(options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthRateLimitError extends AuthError {
+  readonly resetAt: Date;
+  constructor(resetAt: Date);
+}
+export declare class AuthConfigurationError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthProviderError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthSessionError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthTokenError extends AuthError {
+  constructor();
+}
+/**
+ * Deliberately generic.
+ *
+ * Do not expose whether a challenge exists, which factor failed,
+ * or whether a recovery code belonged to another account.
+ */
+export declare class AuthMfaChallengeError extends AuthError {
+  constructor(options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthMfaFactorError extends AuthError {
+  constructor(message?: string, options?: {
+    readonly cause?: unknown;
+  });
+}

package/dist/errors/auth.errors.d.ts

@@ -0,0 +1,62 @@
+export type AuthErrorCode = "INVALID_INPUT" | "INVALID_CREDENTIALS" | "EMAIL_NOT_VERIFIED" | "RATE_LIMITED" | "CONFLICT" | "CONFIGURATION" | "PROVIDER" | "SESSION" | "INVALID_TOKEN" | "MFA_CHALLENGE" | "MFA_FACTOR";
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  readonly cause?: unknown;
+  readonly details?: Readonly<Record<string, unknown>>;
+  constructor(code: AuthErrorCode, message: string, options?: {
+    readonly cause?: unknown;
+    readonly details?: Readonly<Record<string, unknown>>;
+  });
+}
+export declare class AuthValidationError extends AuthError {
+  constructor(message: string);
+}
+export declare class AuthInvalidCredentialsError extends AuthError {
+  constructor();
+}
+export declare class AuthEmailVerificationRequiredError extends AuthError {
+  constructor();
+}
+export declare class AuthAccountConflictError extends AuthError {
+  constructor(options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthRateLimitError extends AuthError {
+  readonly resetAt: Date;
+  constructor(resetAt: Date);
+}
+export declare class AuthConfigurationError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthProviderError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthSessionError extends AuthError {
+  constructor(message: string, options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthTokenError extends AuthError {
+  constructor();
+}
+/**
+ * Deliberately generic.
+ *
+ * Do not expose whether a challenge exists, which factor failed,
+ * or whether a recovery code belonged to another account.
+ */
+export declare class AuthMfaChallengeError extends AuthError {
+  constructor(options?: {
+    readonly cause?: unknown;
+  });
+}
+export declare class AuthMfaFactorError extends AuthError {
+  constructor(message?: string, options?: {
+    readonly cause?: unknown;
+  });
+}

package/dist/errors/auth.errors.js

@@ -0,0 +1,90 @@
+// src/errors/auth.errors.ts
+var AuthError = class extends Error {
+	code;
+	cause;
+	details;
+	constructor(code, message, options) {
+		super(message);
+		this.name = "AuthError";
+		this.code = code;
+		this.cause = options?.cause;
+		this.details = options?.details;
+	}
+};
+var AuthValidationError = class extends AuthError {
+	constructor(message) {
+		super("INVALID_INPUT", message);
+		this.name = "AuthValidationError";
+	}
+};
+var AuthInvalidCredentialsError = class extends AuthError {
+	constructor() {
+		super("INVALID_CREDENTIALS", "Invalid email or password.");
+		this.name = "AuthInvalidCredentialsError";
+	}
+};
+var AuthEmailVerificationRequiredError = class extends AuthError {
+	constructor() {
+		super("EMAIL_NOT_VERIFIED", "Verify your email address before signing in.");
+		this.name = "AuthEmailVerificationRequiredError";
+	}
+};
+var AuthAccountConflictError = class extends AuthError {
+	constructor(options) {
+		super("CONFLICT", "Unable to create an account with the supplied details.", options);
+		this.name = "AuthAccountConflictError";
+	}
+};
+var AuthRateLimitError = class extends AuthError {
+	resetAt;
+	constructor(resetAt) {
+		super("RATE_LIMITED", "Too many authentication attempts. Try again later.", { details: { resetAt } });
+		this.name = "AuthRateLimitError";
+		this.resetAt = resetAt;
+	}
+};
+var AuthConfigurationError = class extends AuthError {
+	constructor(message, options) {
+		super("CONFIGURATION", message, options);
+		this.name = "AuthConfigurationError";
+	}
+};
+var AuthProviderError = class extends AuthError {
+	constructor(message, options) {
+		super("PROVIDER", message, options);
+		this.name = "AuthProviderError";
+	}
+};
+var AuthSessionError = class extends AuthError {
+	constructor(message, options) {
+		super("SESSION", message, options);
+		this.name = "AuthSessionError";
+	}
+};
+var AuthTokenError = class extends AuthError {
+	constructor() {
+		super("INVALID_TOKEN", "This link is invalid or has expired.");
+		this.name = "AuthTokenError";
+	}
+};
+/**
+* Deliberately generic.
+*
+* Do not expose whether a challenge exists, which factor failed,
+* or whether a recovery code belonged to another account.
+*/
+var AuthMfaChallengeError = class extends AuthError {
+	constructor(options) {
+		super("MFA_CHALLENGE", "The authentication challenge is invalid or has expired.", options);
+		this.name = "AuthMfaChallengeError";
+	}
+};
+var AuthMfaFactorError = class extends AuthError {
+	constructor(message = "The authentication factor could not be used.", options) {
+		super("MFA_FACTOR", message, options);
+		this.name = "AuthMfaFactorError";
+	}
+};
+export { AuthAccountConflictError, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, AuthInvalidCredentialsError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthRateLimitError, AuthSessionError, AuthTokenError, AuthValidationError };
+
+//# sourceMappingURL=auth.errors.js.map

package/dist/errors/auth.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.errors.js","names":[],"sources":["../../src/errors/auth.errors.ts"],"sourcesContent":["export type AuthErrorCode =\n  | \"INVALID_INPUT\"\n  | \"INVALID_CREDENTIALS\"\n  | \"EMAIL_NOT_VERIFIED\"\n  | \"RATE_LIMITED\"\n  | \"CONFLICT\"\n  | \"CONFIGURATION\"\n  | \"PROVIDER\"\n  | \"SESSION\"\n  | \"INVALID_TOKEN\"\n  | \"MFA_CHALLENGE\"\n  | \"MFA_FACTOR\";\n\nexport class AuthError extends Error {\n  readonly code: AuthErrorCode;\n  override readonly cause?: unknown;\n  readonly details?: Readonly<Record<string, unknown>>;\n\n  constructor(\n    code: AuthErrorCode,\n    message: string,\n    options?: {\n      readonly cause?: unknown;\n      readonly details?: Readonly<Record<string, unknown>>;\n    },\n  ) {\n    super(message);\n\n    this.name = \"AuthError\";\n    this.code = code;\n    this.cause = options?.cause;\n    this.details = options?.details;\n  }\n}\n\nexport class AuthValidationError extends AuthError {\n  constructor(message: string) {\n    super(\"INVALID_INPUT\", message);\n    this.name = \"AuthValidationError\";\n  }\n}\n\nexport class AuthInvalidCredentialsError extends AuthError {\n  constructor() {\n    super(\"INVALID_CREDENTIALS\", \"Invalid email or password.\");\n    this.name = \"AuthInvalidCredentialsError\";\n  }\n}\n\nexport class AuthEmailVerificationRequiredError extends AuthError {\n  constructor() {\n    super(\"EMAIL_NOT_VERIFIED\", \"Verify your email address before signing in.\");\n    this.name = \"AuthEmailVerificationRequiredError\";\n  }\n}\n\nexport class AuthAccountConflictError extends AuthError {\n  constructor(options?: { readonly cause?: unknown }) {\n    super(\n      \"CONFLICT\",\n      \"Unable to create an account with the supplied details.\",\n      options,\n    );\n\n    this.name = \"AuthAccountConflictError\";\n  }\n}\n\nexport class AuthRateLimitError extends AuthError {\n  readonly resetAt: Date;\n\n  constructor(resetAt: Date) {\n    super(\n      \"RATE_LIMITED\",\n      \"Too many authentication attempts. Try again later.\",\n      {\n        details: { resetAt },\n      },\n    );\n\n    this.name = \"AuthRateLimitError\";\n    this.resetAt = resetAt;\n  }\n}\n\nexport class AuthConfigurationError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"CONFIGURATION\", message, options);\n    this.name = \"AuthConfigurationError\";\n  }\n}\n\nexport class AuthProviderError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"PROVIDER\", message, options);\n    this.name = \"AuthProviderError\";\n  }\n}\n\nexport class AuthSessionError extends AuthError {\n  constructor(message: string, options?: { readonly cause?: unknown }) {\n    super(\"SESSION\", message, options);\n    this.name = \"AuthSessionError\";\n  }\n}\n\nexport class AuthTokenError extends AuthError {\n  constructor() {\n    super(\"INVALID_TOKEN\", \"This link is invalid or has expired.\");\n    this.name = \"AuthTokenError\";\n  }\n}\n\n/**\n * Deliberately generic.\n *\n * Do not expose whether a challenge exists, which factor failed,\n * or whether a recovery code belonged to another account.\n */\nexport class AuthMfaChallengeError extends AuthError {\n  constructor(options?: { readonly cause?: unknown }) {\n    super(\n      \"MFA_CHALLENGE\",\n      \"The authentication challenge is invalid or has expired.\",\n      options,\n    );\n\n    this.name = \"AuthMfaChallengeError\";\n  }\n}\n\nexport class AuthMfaFactorError extends AuthError {\n  constructor(\n    message = \"The authentication factor could not be used.\",\n    options?: {\n      readonly cause?: unknown;\n    },\n  ) {\n    super(\"MFA_FACTOR\", message, options);\n    this.name = \"AuthMfaFactorError\";\n  }\n}\n"],"mappings":";AAaA,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA;CACA;CAEA,YACE,MACA,SACA,SAIA;EACA,MAAM,OAAO;EAEb,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,QAAQ,SAAS;EACtB,KAAK,UAAU,SAAS;CAC1B;AACF;AAEA,IAAa,sBAAb,cAAyC,UAAU;CACjD,YAAY,SAAiB;EAC3B,MAAM,iBAAiB,OAAO;EAC9B,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,UAAU;CACzD,cAAc;EACZ,MAAM,uBAAuB,4BAA4B;EACzD,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qCAAb,cAAwD,UAAU;CAChE,cAAc;EACZ,MAAM,sBAAsB,8CAA8C;EAC1E,KAAK,OAAO;CACd;AACF;AAEA,IAAa,2BAAb,cAA8C,UAAU;CACtD,YAAY,SAAwC;EAClD,MACE,YACA,0DACA,OACF;EAEA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD;CAEA,YAAY,SAAe;EACzB,MACE,gBACA,sDACA,EACE,SAAS,EAAE,QAAQ,EACrB,CACF;EAEA,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;AACF;AAEA,IAAa,yBAAb,cAA4C,UAAU;CACpD,YAAY,SAAiB,SAAwC;EACnE,MAAM,iBAAiB,SAAS,OAAO;EACvC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,oBAAb,cAAuC,UAAU;CAC/C,YAAY,SAAiB,SAAwC;EACnE,MAAM,YAAY,SAAS,OAAO;EAClC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,mBAAb,cAAsC,UAAU;CAC9C,YAAY,SAAiB,SAAwC;EACnE,MAAM,WAAW,SAAS,OAAO;EACjC,KAAK,OAAO;CACd;AACF;AAEA,IAAa,iBAAb,cAAoC,UAAU;CAC5C,cAAc;EACZ,MAAM,iBAAiB,sCAAsC;EAC7D,KAAK,OAAO;CACd;AACF;;;;;;;AAQA,IAAa,wBAAb,cAA2C,UAAU;CACnD,YAAY,SAAwC;EAClD,MACE,iBACA,2DACA,OACF;EAEA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qBAAb,cAAwC,UAAU;CAChD,YACE,UAAU,gDACV,SAGA;EACA,MAAM,cAAc,SAAS,OAAO;EACpC,KAAK,OAAO;CACd;AACF"}

package/dist/index.cjs

@@ -0,0 +1,54 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_manager = require("./auth.manager.cjs");
+const require_auth_lifecycle_manager = require("./auth.lifecycle.manager.cjs");
+const require_auth_rate_limit = require("./auth.rate-limit.cjs");
+const require_auth_mfa_manager = require("./auth.mfa.manager.cjs");
+const require_auth_step_up_manager = require("./auth.step-up.manager.cjs");
+const require_auth_storage = require("./auth.storage.cjs");
+const require_webcrypto_secret_protector = require("./providers/webcrypto-secret-protector.cjs");
+const require_simplewebauthn_provider = require("./providers/simplewebauthn-provider.cjs");
+const require_auth_errors = require("./errors/auth.errors.cjs");
+const require_email_utils = require("./utils/email.utils.cjs");
+const require_auth_crypto_utils = require("./utils/auth-crypto.utils.cjs");
+const require_totp_utils = require("./utils/totp.utils.cjs");
+exports.AUTH_ACTION_TOKEN_COLLECTION = require_auth_storage.AUTH_ACTION_TOKEN_COLLECTION;
+exports.AUTH_AUDIT_COLLECTION = require_auth_storage.AUTH_AUDIT_COLLECTION;
+exports.AUTH_CREDENTIAL_COLLECTION = require_auth_storage.AUTH_CREDENTIAL_COLLECTION;
+exports.AUTH_MFA_CHALLENGE_COLLECTION = require_auth_storage.AUTH_MFA_CHALLENGE_COLLECTION;
+exports.AUTH_MFA_FACTOR_COLLECTION = require_auth_storage.AUTH_MFA_FACTOR_COLLECTION;
+exports.AUTH_MFA_STEP_UP_COLLECTION = require_auth_step_up_manager.AUTH_MFA_STEP_UP_COLLECTION;
+exports.AUTH_RATE_LIMIT_COLLECTION = require_auth_storage.AUTH_RATE_LIMIT_COLLECTION;
+exports.AUTH_RECOVERY_CODE_COLLECTION = require_auth_storage.AUTH_RECOVERY_CODE_COLLECTION;
+exports.AUTH_USER_COLLECTION = require_auth_storage.AUTH_USER_COLLECTION;
+exports.AuthAccountConflictError = require_auth_errors.AuthAccountConflictError;
+exports.AuthConfigurationError = require_auth_errors.AuthConfigurationError;
+exports.AuthEmailVerificationRequiredError = require_auth_errors.AuthEmailVerificationRequiredError;
+exports.AuthError = require_auth_errors.AuthError;
+exports.AuthInvalidCredentialsError = require_auth_errors.AuthInvalidCredentialsError;
+exports.AuthMfaChallengeError = require_auth_errors.AuthMfaChallengeError;
+exports.AuthMfaFactorError = require_auth_errors.AuthMfaFactorError;
+exports.AuthProviderError = require_auth_errors.AuthProviderError;
+exports.AuthRateLimitError = require_auth_errors.AuthRateLimitError;
+exports.AuthSessionError = require_auth_errors.AuthSessionError;
+exports.AuthTokenError = require_auth_errors.AuthTokenError;
+exports.AuthValidationError = require_auth_errors.AuthValidationError;
+exports.SimpleWebAuthnProvider = require_simplewebauthn_provider.SimpleWebAuthnProvider;
+exports.StorageAuthLifecycleManager = require_auth_lifecycle_manager.StorageAuthLifecycleManager;
+exports.StorageAuthManager = require_auth_manager.StorageAuthManager;
+exports.StorageAuthMfaManager = require_auth_mfa_manager.StorageAuthMfaManager;
+exports.StorageAuthStepUpManager = require_auth_step_up_manager.StorageAuthStepUpManager;
+exports.StorageRateLimitProvider = require_auth_rate_limit.StorageRateLimitProvider;
+exports.WebCryptoAuthSecretProtector = require_webcrypto_secret_protector.WebCryptoAuthSecretProtector;
+exports.createRateLimitKey = require_auth_crypto_utils.createRateLimitKey;
+exports.createTotpUri = require_totp_utils.createTotpUri;
+exports.decodeBase32 = require_totp_utils.decodeBase32;
+exports.encodeBase32 = require_totp_utils.encodeBase32;
+exports.generateAuthId = require_auth_crypto_utils.generateAuthId;
+exports.generateSecureAuthToken = require_auth_crypto_utils.generateSecureAuthToken;
+exports.generateTotpCode = require_totp_utils.generateTotpCode;
+exports.generateTotpSecret = require_totp_utils.generateTotpSecret;
+exports.hashAuthToken = require_auth_crypto_utils.hashAuthToken;
+exports.initializeAuthStorage = require_auth_storage.initializeAuthStorage;
+exports.normalizeDisplayName = require_email_utils.normalizeDisplayName;
+exports.normalizeEmail = require_email_utils.normalizeEmail;
+exports.verifyTotpCode = require_totp_utils.verifyTotpCode;

package/dist/index.d.cts

@@ -0,0 +1,21 @@
+import { StorageAuthManager, StorageAuthManagerDependencies } from "./auth.manager.cjs";
+import { ChangePasswordInput, DeactivateAuthAccountInput, DeleteAuthAccountInput, RequestEmailChangeInput, RequestEmailVerificationInput, RequestPasswordResetInput, ResetPasswordInput, StorageAuthLifecycleManager, StorageAuthLifecycleManagerDependencies, UpdateAuthProfileInput } from "./auth.lifecycle.manager.cjs";
+import { StorageRateLimitProvider, StorageRateLimitProviderOptions } from "./auth.rate-limit.cjs";
+import { StorageAuthMfaManager, StorageAuthMfaManagerDependencies } from "./auth.mfa.manager.cjs";
+import { AUTH_MFA_STEP_UP_COLLECTION, AuthStepUpChallengeStorageRecord, AuthStepUpManagerOptions, AuthStepUpPendingState, BeginStepUpInput, BeginStepUpPasskeyInput, CompleteStepUpInput, FinishStepUpPasskeyInput, StorageAuthStepUpManager, StorageAuthStepUpManagerDependencies } from "./auth.step-up.manager.cjs";
+import { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, AuthUserStorageRecord, InitializeAuthStorageOptions, initializeAuthStorage } from "./auth.storage.cjs";
+import { AuthUser } from "./types/user.types.cjs";
+import { AuthState } from "./types/state.types.cjs";
+import { PasswordCredentialStorageRecord } from "./types/credential.types.cjs";
+import { AuthManager, AuthManagerDependencies, AuthManagerOptions, AuthMfaPolicy, AuthRateLimitPolicies, AuthRateLimitRule, AuthRateLimitScopePolicy, AuthRegisterInput, AuthRegisterResult, AuthResult, AuthSession, AuthSignInInput, AuthSignInResult } from "./types/auth-manager.types.cjs";
+import { AuthActionTokenPurpose, AuthActionTokenStorageRecord, AuthAuditAction, AuthAuditEventStorageRecord, AuthLifecycleManagerOptions, AuthLifecycleRateLimitAction, AuthLifecycleRateLimitPolicies, AuthLifecycleRateLimitPolicy, AuthRateLimitStorageRecord } from "./types/auth-lifecycle.types.cjs";
+import { EmailMessage, EmailProvider, PasswordHash, PasswordHasher, RateLimitProvider } from "./providers/provider.types.cjs";
+import { AuthSecretProtector, ProtectedAuthSecret, WebAuthnAuthenticationVerification, WebAuthnOptionsJSON, WebAuthnProvider, WebAuthnRegistrationCredential, WebAuthnRegistrationVerification } from "./providers/mfa-provider.types.cjs";
+import { WebCryptoAuthSecretProtector, WebCryptoAuthSecretProtectorOptions } from "./providers/webcrypto-secret-protector.cjs";
+import { SimpleWebAuthnProvider } from "./providers/simplewebauthn-provider.cjs";
+import { AuthAccountConflictError, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, AuthErrorCode, AuthInvalidCredentialsError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthRateLimitError, AuthSessionError, AuthTokenError, AuthValidationError } from "./errors/auth.errors.cjs";
+import { AuthMfaAvailableFactor, AuthMfaChallengePurpose, AuthMfaChallengeStorageRecord, AuthMfaEnrollmentCompleted, AuthMfaEnrollmentFactor, AuthMfaEnrollmentPendingResult, AuthMfaFactor, AuthMfaFactorStatus, AuthMfaFactorStorageRecord, AuthMfaFactorType, AuthMfaGateway, AuthMfaManagerOptions, AuthMfaPendingResult, AuthMfaTotpOptions, AuthMfaWebAuthnOptions, AuthRecoveryCodeStorageRecord, BeginPasskeyRegistrationInput, BeginPasskeySignInInput, BeginRequiredMfaEnrollmentInput, BeginTotpEnrollmentInput, CompleteMfaSignInInput, FinishPasskeyRegistrationInput, FinishRequiredPasskeyEnrollmentInput, MfaEnrollmentCompleted, PasskeyMfaCompletedInput, PasskeyMfaStarted, PasskeyRegistrationStarted, PasskeySignInStarted, RegenerateRecoveryCodesInput, RemoveMfaFactorInput, TotpEnrollmentStarted, VerifyRequiredTotpEnrollmentInput, VerifyTotpEnrollmentInput } from "./types/mfa.types.cjs";
+import { normalizeDisplayName, normalizeEmail } from "./utils/email.utils.cjs";
+import { createRateLimitKey, generateAuthId, generateSecureAuthToken, hashAuthToken } from "./utils/auth-crypto.utils.cjs";
+import { createTotpUri, decodeBase32, encodeBase32, generateTotpCode, generateTotpSecret, verifyTotpCode } from "./utils/totp.utils.cjs";
+export { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_MFA_STEP_UP_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, AuthAccountConflictError, type AuthActionTokenPurpose, type AuthActionTokenStorageRecord, type AuthAuditAction, type AuthAuditEventStorageRecord, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, type AuthErrorCode, AuthInvalidCredentialsError, type AuthLifecycleManagerOptions, type AuthLifecycleRateLimitAction, type AuthLifecycleRateLimitPolicies, type AuthLifecycleRateLimitPolicy, type AuthManager, type AuthManagerDependencies, type AuthManagerOptions, type AuthMfaAvailableFactor, AuthMfaChallengeError, type AuthMfaChallengePurpose, type AuthMfaChallengeStorageRecord, type AuthMfaEnrollmentCompleted, type AuthMfaEnrollmentFactor, type AuthMfaEnrollmentPendingResult, type AuthMfaFactor, AuthMfaFactorError, type AuthMfaFactorStatus, type AuthMfaFactorStorageRecord, type AuthMfaFactorType, type AuthMfaGateway, type AuthMfaManagerOptions, type AuthMfaPendingResult, type AuthMfaPolicy, type AuthMfaTotpOptions, type AuthMfaWebAuthnOptions, AuthProviderError, AuthRateLimitError, type AuthRateLimitPolicies, type AuthRateLimitRule, type AuthRateLimitScopePolicy, type AuthRateLimitStorageRecord, type AuthRecoveryCodeStorageRecord, type AuthRegisterInput, type AuthRegisterResult, type AuthResult, type AuthSecretProtector, type AuthSession, AuthSessionError, type AuthSignInInput, type AuthSignInResult, type AuthState, type AuthStepUpChallengeStorageRecord, type AuthStepUpManagerOptions, type AuthStepUpPendingState, AuthTokenError, type AuthUser, type AuthUserStorageRecord, AuthValidationError, type BeginPasskeyRegistrationInput, type BeginPasskeySignInInput, type BeginRequiredMfaEnrollmentInput, type BeginStepUpInput, type BeginStepUpPasskeyInput, type BeginTotpEnrollmentInput, type ChangePasswordInput, type CompleteMfaSignInInput, type CompleteStepUpInput, type DeactivateAuthAccountInput, type DeleteAuthAccountInput, type EmailMessage, type EmailProvider, type FinishPasskeyRegistrationInput, type FinishRequiredPasskeyEnrollmentInput, type FinishStepUpPasskeyInput, type InitializeAuthStorageOptions, type MfaEnrollmentCompleted, type PasskeyMfaCompletedInput, type PasskeyMfaStarted, type PasskeyRegistrationStarted, type PasskeySignInStarted, type PasswordCredentialStorageRecord, type PasswordHash, type PasswordHasher, type ProtectedAuthSecret, type RateLimitProvider, type RegenerateRecoveryCodesInput, type RemoveMfaFactorInput, type RequestEmailChangeInput, type RequestEmailVerificationInput, type RequestPasswordResetInput, type ResetPasswordInput, SimpleWebAuthnProvider, StorageAuthLifecycleManager, type StorageAuthLifecycleManagerDependencies, StorageAuthManager, type StorageAuthManagerDependencies, StorageAuthMfaManager, type StorageAuthMfaManagerDependencies, StorageAuthStepUpManager, type StorageAuthStepUpManagerDependencies, StorageRateLimitProvider, type StorageRateLimitProviderOptions, type TotpEnrollmentStarted, type UpdateAuthProfileInput, type VerifyRequiredTotpEnrollmentInput, type VerifyTotpEnrollmentInput, type WebAuthnAuthenticationVerification, type WebAuthnOptionsJSON, type WebAuthnProvider, type WebAuthnRegistrationCredential, type WebAuthnRegistrationVerification, WebCryptoAuthSecretProtector, type WebCryptoAuthSecretProtectorOptions, createRateLimitKey, createTotpUri, decodeBase32, encodeBase32, generateAuthId, generateSecureAuthToken, generateTotpCode, generateTotpSecret, hashAuthToken, initializeAuthStorage, normalizeDisplayName, normalizeEmail, verifyTotpCode };

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import { StorageAuthManager, StorageAuthManagerDependencies } from "./auth.manager.js";
+import { ChangePasswordInput, DeactivateAuthAccountInput, DeleteAuthAccountInput, RequestEmailChangeInput, RequestEmailVerificationInput, RequestPasswordResetInput, ResetPasswordInput, StorageAuthLifecycleManager, StorageAuthLifecycleManagerDependencies, UpdateAuthProfileInput } from "./auth.lifecycle.manager.js";
+import { StorageRateLimitProvider, StorageRateLimitProviderOptions } from "./auth.rate-limit.js";
+import { StorageAuthMfaManager, StorageAuthMfaManagerDependencies } from "./auth.mfa.manager.js";
+import { AUTH_MFA_STEP_UP_COLLECTION, AuthStepUpChallengeStorageRecord, AuthStepUpManagerOptions, AuthStepUpPendingState, BeginStepUpInput, BeginStepUpPasskeyInput, CompleteStepUpInput, FinishStepUpPasskeyInput, StorageAuthStepUpManager, StorageAuthStepUpManagerDependencies } from "./auth.step-up.manager.js";
+import { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, AuthUserStorageRecord, InitializeAuthStorageOptions, initializeAuthStorage } from "./auth.storage.js";
+import { AuthUser } from "./types/user.types.js";
+import { AuthState } from "./types/state.types.js";
+import { PasswordCredentialStorageRecord } from "./types/credential.types.js";
+import { AuthManager, AuthManagerDependencies, AuthManagerOptions, AuthMfaPolicy, AuthRateLimitPolicies, AuthRateLimitRule, AuthRateLimitScopePolicy, AuthRegisterInput, AuthRegisterResult, AuthResult, AuthSession, AuthSignInInput, AuthSignInResult } from "./types/auth-manager.types.js";
+import { AuthActionTokenPurpose, AuthActionTokenStorageRecord, AuthAuditAction, AuthAuditEventStorageRecord, AuthLifecycleManagerOptions, AuthLifecycleRateLimitAction, AuthLifecycleRateLimitPolicies, AuthLifecycleRateLimitPolicy, AuthRateLimitStorageRecord } from "./types/auth-lifecycle.types.js";
+import { EmailMessage, EmailProvider, PasswordHash, PasswordHasher, RateLimitProvider } from "./providers/provider.types.js";
+import { AuthSecretProtector, ProtectedAuthSecret, WebAuthnAuthenticationVerification, WebAuthnOptionsJSON, WebAuthnProvider, WebAuthnRegistrationCredential, WebAuthnRegistrationVerification } from "./providers/mfa-provider.types.js";
+import { WebCryptoAuthSecretProtector, WebCryptoAuthSecretProtectorOptions } from "./providers/webcrypto-secret-protector.js";
+import { SimpleWebAuthnProvider } from "./providers/simplewebauthn-provider.js";
+import { AuthAccountConflictError, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, AuthErrorCode, AuthInvalidCredentialsError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthRateLimitError, AuthSessionError, AuthTokenError, AuthValidationError } from "./errors/auth.errors.js";
+import { AuthMfaAvailableFactor, AuthMfaChallengePurpose, AuthMfaChallengeStorageRecord, AuthMfaEnrollmentCompleted, AuthMfaEnrollmentFactor, AuthMfaEnrollmentPendingResult, AuthMfaFactor, AuthMfaFactorStatus, AuthMfaFactorStorageRecord, AuthMfaFactorType, AuthMfaGateway, AuthMfaManagerOptions, AuthMfaPendingResult, AuthMfaTotpOptions, AuthMfaWebAuthnOptions, AuthRecoveryCodeStorageRecord, BeginPasskeyRegistrationInput, BeginPasskeySignInInput, BeginRequiredMfaEnrollmentInput, BeginTotpEnrollmentInput, CompleteMfaSignInInput, FinishPasskeyRegistrationInput, FinishRequiredPasskeyEnrollmentInput, MfaEnrollmentCompleted, PasskeyMfaCompletedInput, PasskeyMfaStarted, PasskeyRegistrationStarted, PasskeySignInStarted, RegenerateRecoveryCodesInput, RemoveMfaFactorInput, TotpEnrollmentStarted, VerifyRequiredTotpEnrollmentInput, VerifyTotpEnrollmentInput } from "./types/mfa.types.js";
+import { normalizeDisplayName, normalizeEmail } from "./utils/email.utils.js";
+import { createRateLimitKey, generateAuthId, generateSecureAuthToken, hashAuthToken } from "./utils/auth-crypto.utils.js";
+import { createTotpUri, decodeBase32, encodeBase32, generateTotpCode, generateTotpSecret, verifyTotpCode } from "./utils/totp.utils.js";
+export { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_MFA_STEP_UP_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, AuthAccountConflictError, type AuthActionTokenPurpose, type AuthActionTokenStorageRecord, type AuthAuditAction, type AuthAuditEventStorageRecord, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, type AuthErrorCode, AuthInvalidCredentialsError, type AuthLifecycleManagerOptions, type AuthLifecycleRateLimitAction, type AuthLifecycleRateLimitPolicies, type AuthLifecycleRateLimitPolicy, type AuthManager, type AuthManagerDependencies, type AuthManagerOptions, type AuthMfaAvailableFactor, AuthMfaChallengeError, type AuthMfaChallengePurpose, type AuthMfaChallengeStorageRecord, type AuthMfaEnrollmentCompleted, type AuthMfaEnrollmentFactor, type AuthMfaEnrollmentPendingResult, type AuthMfaFactor, AuthMfaFactorError, type AuthMfaFactorStatus, type AuthMfaFactorStorageRecord, type AuthMfaFactorType, type AuthMfaGateway, type AuthMfaManagerOptions, type AuthMfaPendingResult, type AuthMfaPolicy, type AuthMfaTotpOptions, type AuthMfaWebAuthnOptions, AuthProviderError, AuthRateLimitError, type AuthRateLimitPolicies, type AuthRateLimitRule, type AuthRateLimitScopePolicy, type AuthRateLimitStorageRecord, type AuthRecoveryCodeStorageRecord, type AuthRegisterInput, type AuthRegisterResult, type AuthResult, type AuthSecretProtector, type AuthSession, AuthSessionError, type AuthSignInInput, type AuthSignInResult, type AuthState, type AuthStepUpChallengeStorageRecord, type AuthStepUpManagerOptions, type AuthStepUpPendingState, AuthTokenError, type AuthUser, type AuthUserStorageRecord, AuthValidationError, type BeginPasskeyRegistrationInput, type BeginPasskeySignInInput, type BeginRequiredMfaEnrollmentInput, type BeginStepUpInput, type BeginStepUpPasskeyInput, type BeginTotpEnrollmentInput, type ChangePasswordInput, type CompleteMfaSignInInput, type CompleteStepUpInput, type DeactivateAuthAccountInput, type DeleteAuthAccountInput, type EmailMessage, type EmailProvider, type FinishPasskeyRegistrationInput, type FinishRequiredPasskeyEnrollmentInput, type FinishStepUpPasskeyInput, type InitializeAuthStorageOptions, type MfaEnrollmentCompleted, type PasskeyMfaCompletedInput, type PasskeyMfaStarted, type PasskeyRegistrationStarted, type PasskeySignInStarted, type PasswordCredentialStorageRecord, type PasswordHash, type PasswordHasher, type ProtectedAuthSecret, type RateLimitProvider, type RegenerateRecoveryCodesInput, type RemoveMfaFactorInput, type RequestEmailChangeInput, type RequestEmailVerificationInput, type RequestPasswordResetInput, type ResetPasswordInput, SimpleWebAuthnProvider, StorageAuthLifecycleManager, type StorageAuthLifecycleManagerDependencies, StorageAuthManager, type StorageAuthManagerDependencies, StorageAuthMfaManager, type StorageAuthMfaManagerDependencies, StorageAuthStepUpManager, type StorageAuthStepUpManagerDependencies, StorageRateLimitProvider, type StorageRateLimitProviderOptions, type TotpEnrollmentStarted, type UpdateAuthProfileInput, type VerifyRequiredTotpEnrollmentInput, type VerifyTotpEnrollmentInput, type WebAuthnAuthenticationVerification, type WebAuthnOptionsJSON, type WebAuthnProvider, type WebAuthnRegistrationCredential, type WebAuthnRegistrationVerification, WebCryptoAuthSecretProtector, type WebCryptoAuthSecretProtectorOptions, createRateLimitKey, createTotpUri, decodeBase32, encodeBase32, generateAuthId, generateSecureAuthToken, generateTotpCode, generateTotpSecret, hashAuthToken, initializeAuthStorage, normalizeDisplayName, normalizeEmail, verifyTotpCode };

package/dist/index.js

@@ -0,0 +1,13 @@
+import { StorageAuthManager } from "./auth.manager.js";
+import { StorageAuthLifecycleManager } from "./auth.lifecycle.manager.js";
+import { StorageRateLimitProvider } from "./auth.rate-limit.js";
+import { StorageAuthMfaManager } from "./auth.mfa.manager.js";
+import { AUTH_MFA_STEP_UP_COLLECTION, StorageAuthStepUpManager } from "./auth.step-up.manager.js";
+import { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, initializeAuthStorage } from "./auth.storage.js";
+import { WebCryptoAuthSecretProtector } from "./providers/webcrypto-secret-protector.js";
+import { SimpleWebAuthnProvider } from "./providers/simplewebauthn-provider.js";
+import { AuthAccountConflictError, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, AuthInvalidCredentialsError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthRateLimitError, AuthSessionError, AuthTokenError, AuthValidationError } from "./errors/auth.errors.js";
+import { normalizeDisplayName, normalizeEmail } from "./utils/email.utils.js";
+import { createRateLimitKey, generateAuthId, generateSecureAuthToken, hashAuthToken } from "./utils/auth-crypto.utils.js";
+import { createTotpUri, decodeBase32, encodeBase32, generateTotpCode, generateTotpSecret, verifyTotpCode } from "./utils/totp.utils.js";
+export { AUTH_ACTION_TOKEN_COLLECTION, AUTH_AUDIT_COLLECTION, AUTH_CREDENTIAL_COLLECTION, AUTH_MFA_CHALLENGE_COLLECTION, AUTH_MFA_FACTOR_COLLECTION, AUTH_MFA_STEP_UP_COLLECTION, AUTH_RATE_LIMIT_COLLECTION, AUTH_RECOVERY_CODE_COLLECTION, AUTH_USER_COLLECTION, AuthAccountConflictError, AuthConfigurationError, AuthEmailVerificationRequiredError, AuthError, AuthInvalidCredentialsError, AuthMfaChallengeError, AuthMfaFactorError, AuthProviderError, AuthRateLimitError, AuthSessionError, AuthTokenError, AuthValidationError, SimpleWebAuthnProvider, StorageAuthLifecycleManager, StorageAuthManager, StorageAuthMfaManager, StorageAuthStepUpManager, StorageRateLimitProvider, WebCryptoAuthSecretProtector, createRateLimitKey, createTotpUri, decodeBase32, encodeBase32, generateAuthId, generateSecureAuthToken, generateTotpCode, generateTotpSecret, hashAuthToken, initializeAuthStorage, normalizeDisplayName, normalizeEmail, verifyTotpCode };