@tinyrack/issuary-server 0.20.0

package/dist/lib/crypto.d.ts

@@ -0,0 +1,106 @@
+export { getRandomBytes } from './base64url.ts';
+export declare function encrypt(data: string, keyHex: string): Promise<string>;
+export declare function decrypt(encoded: string, keyHex: string): Promise<string | null>;
+/**
+ * Compares two byte arrays in constant time to prevent timing side-channel attacks.
+ *
+ * Returns `false` immediately if the arrays differ in length, but the byte-level
+ * comparison always processes every element to avoid leaking positional information.
+ *
+ * @param left - The first byte array.
+ * @param right - The second byte array.
+ * @returns `true` if both arrays contain identical bytes, `false` otherwise.
+ */
+export declare function timingSafeEqualBytes(left: Uint8Array, right: Uint8Array): boolean;
+/**
+ * Parses a persisted PBKDF2 hash string into its constituent parameters.
+ *
+ * The expected format is: `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`
+ * where salt and digest are base64url-encoded.
+ *
+ * @param hash - The stored hash string to parse.
+ * @param expectedAlgorithm - The algorithm identifier to match (e.g. `'pbkdf2-sha256'`).
+ * @returns The parsed components, or `undefined` if the string is malformed.
+ */
+export declare function parsePbkdf2Hash(hash: string, expectedAlgorithm: string): {
+    version: number;
+    iterations: number;
+    salt: Uint8Array;
+    digest: Uint8Array;
+} | undefined;
+/**
+ * Encodes PBKDF2 hash parameters into a self-describing string for storage.
+ *
+ * @param params - The PBKDF2 parameters to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`.
+ */
+export declare function formatPbkdf2Hash(params: {
+    algorithm: string;
+    version: number;
+    iterations: number;
+    salt: Uint8Array;
+    digest: Uint8Array;
+}): string;
+/**
+ * Encodes an HMAC digest into a self-describing string for opaque token storage.
+ *
+ * @param params - The HMAC digest to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$h=<digest>`.
+ */
+export declare function formatOpaqueHash(params: {
+    algorithm: string;
+    version: number;
+    digest: Uint8Array;
+}): string;
+/**
+ * Normalizes a secret string to Unicode NFC form and encodes it as UTF-8 bytes.
+ * This ensures visually equivalent strings (e.g. `café` vs `cafe\u0301`) produce
+ * identical byte sequences across all runtimes.
+ *
+ * @param secret - The raw secret string.
+ * @returns The NFC-normalized, UTF-8-encoded byte representation.
+ */
+export declare function normalizeSecret(secret: string): Uint8Array;
+/**
+ * Derives a purpose-specific subkey from a master secret using HKDF-SHA-256.
+ *
+ * Each purpose produces a cryptographically isolated key, so compromising
+ * one purpose key does not affect others.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param masterSecret - The 32-byte master secret.
+ * @param hkdfSalt - The salt string for HKDF (e.g. application context identifier).
+ * @param hkdfInfo - The info string for HKDF (e.g. purpose label).
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived purpose key of the specified length.
+ */
+export declare function derivePurposeKeyBytes(crypto: Crypto, masterSecret: Uint8Array, hkdfSalt: string, hkdfInfo: string, derivedKeyBytes: number): Promise<Uint8Array>;
+/**
+ * Derives a PBKDF2-SHA-256 digest from a low-entropy secret (e.g. a password).
+ *
+ * The secret is first NFC-normalized and concatenated with the purpose key before
+ * being fed into PBKDF2, binding the derivation to a specific purpose.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param secret - The raw secret string (password, client secret, etc.).
+ * @param salt - A random salt (typically 16 bytes).
+ * @param iterations - The PBKDF2 iteration count.
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived key of the specified length.
+ */
+export declare function derivePbkdf2Bytes(crypto: Crypto, purposeKey: Uint8Array, secret: string, salt: Uint8Array, iterations: number, derivedKeyBytes: number): Promise<Uint8Array>;
+/**
+ * Computes an HMAC-SHA-256 signature over a high-entropy opaque value.
+ *
+ * Unlike PBKDF2, this is intended for values that are already cryptographically
+ * random (e.g. authorization codes, recovery tokens), where deterministic hashing
+ * enables efficient database lookups.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param value - The opaque value to sign.
+ * @returns A 32-byte HMAC signature.
+ */
+export declare function signOpaqueValue(crypto: Crypto, purposeKey: Uint8Array, value: string): Promise<Uint8Array>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/lib/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqChD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B3E;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BxB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,GAChB,OAAO,CAkBT;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,GAEvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GACD,SAAS,CAqCZ;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAMT;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,UAAU,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/lib/crypto.js

@@ -0,0 +1,263 @@
+import { bytesToString, concatBytes, fromBase64Url, getRandomBytes, hexToBytes, stringToBytes, toArrayBuffer, toBase64Url, } from "./base64url.js";
+export { getRandomBytes } from "./base64url.js";
+const ALGORITHM = 'AES-GCM';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+/**
+ * Import a hex-encoded key for AES-GCM operations
+ * using the Web Crypto API.
+ *
+ * @throws {Error} if the key is not valid hex or decodes to an
+ *   unsupported AES key length (must be 16, 24, or 32 bytes).
+ */
+async function importAesKey(keyHex, usage) {
+    if (!/^[0-9a-fA-F]*$/.test(keyHex) || keyHex.length % 2 !== 0) {
+        throw new Error('session_secret must be a valid hex string with an even number of characters');
+    }
+    const keyBytes = hexToBytes(keyHex);
+    if (![16, 24, 32].includes(keyBytes.byteLength)) {
+        throw new Error(`session_secret must decode to 16, 24, or 32 bytes for AES-128/192/256, got ${keyBytes.byteLength} bytes (${keyHex.length} hex characters)`);
+    }
+    return crypto.subtle.importKey('raw', toArrayBuffer(keyBytes), { name: ALGORITHM }, false, [usage]);
+}
+export async function encrypt(data, keyHex) {
+    const key = await importAesKey(keyHex, 'encrypt');
+    const iv = getRandomBytes(IV_LENGTH);
+    const plaintext = stringToBytes(data);
+    // Web Crypto AES-GCM appends the auth tag to the ciphertext
+    const cipherWithTag = new Uint8Array(await crypto.subtle.encrypt({
+        name: ALGORITHM,
+        iv: toArrayBuffer(iv),
+        tagLength: AUTH_TAG_LENGTH * 8,
+    }, key, toArrayBuffer(plaintext)));
+    // Split into ciphertext and auth tag to keep the same wire format:
+    // base64url(iv + authTag + encrypted)
+    const encrypted = cipherWithTag.slice(0, cipherWithTag.byteLength - AUTH_TAG_LENGTH);
+    const authTag = cipherWithTag.slice(cipherWithTag.byteLength - AUTH_TAG_LENGTH);
+    const combined = concatBytes(iv, authTag, encrypted);
+    return toBase64Url(combined);
+}
+export async function decrypt(encoded, keyHex) {
+    try {
+        const key = await importAesKey(keyHex, 'decrypt');
+        const combined = fromBase64Url(encoded);
+        if (combined.byteLength < IV_LENGTH + AUTH_TAG_LENGTH) {
+            return null;
+        }
+        const iv = combined.slice(0, IV_LENGTH);
+        const authTag = combined.slice(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+        const encrypted = combined.slice(IV_LENGTH + AUTH_TAG_LENGTH);
+        // Web Crypto expects ciphertext + authTag concatenated
+        const cipherWithTag = concatBytes(encrypted, authTag);
+        const plaintext = new Uint8Array(await crypto.subtle.decrypt({
+            name: ALGORITHM,
+            iv: toArrayBuffer(iv),
+            tagLength: AUTH_TAG_LENGTH * 8,
+        }, key, toArrayBuffer(cipherWithTag)));
+        return bytesToString(plaintext);
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Timing-safe comparison
+// ---------------------------------------------------------------------------
+/**
+ * Compares two byte arrays in constant time to prevent timing side-channel attacks.
+ *
+ * Returns `false` immediately if the arrays differ in length, but the byte-level
+ * comparison always processes every element to avoid leaking positional information.
+ *
+ * @param left - The first byte array.
+ * @param right - The second byte array.
+ * @returns `true` if both arrays contain identical bytes, `false` otherwise.
+ */
+export function timingSafeEqualBytes(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        const leftByte = left[index];
+        const rightByte = right[index];
+        if (leftByte === undefined || rightByte === undefined) {
+            return false;
+        }
+        diff |= leftByte ^ rightByte;
+    }
+    return diff === 0;
+}
+// ---------------------------------------------------------------------------
+// Secret hashing (PBKDF2 / HMAC)
+// ---------------------------------------------------------------------------
+/**
+ * Parses an integer key=value segment from the self-describing hash format.
+ *
+ * @example parseIntegerSegment('v=1', 'v') // => 1
+ */
+function parseIntegerSegment(segment, key) {
+    if (!segment.startsWith(`${key}=`)) {
+        return undefined;
+    }
+    const value = Number(segment.slice(key.length + 1));
+    if (!Number.isInteger(value) || value <= 0) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Parses a string key=value segment from the self-describing hash format.
+ *
+ * @example parseStringSegment('s=Zm9v', 's') // => 'Zm9v'
+ */
+function parseStringSegment(segment, key) {
+    if (!segment.startsWith(`${key}=`)) {
+        return undefined;
+    }
+    return segment.slice(key.length + 1);
+}
+/**
+ * Parses a persisted PBKDF2 hash string into its constituent parameters.
+ *
+ * The expected format is: `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`
+ * where salt and digest are base64url-encoded.
+ *
+ * @param hash - The stored hash string to parse.
+ * @param expectedAlgorithm - The algorithm identifier to match (e.g. `'pbkdf2-sha256'`).
+ * @returns The parsed components, or `undefined` if the string is malformed.
+ */
+export function parsePbkdf2Hash(hash, expectedAlgorithm) {
+    const [algorithm = '', version = '', iterations = '', salt = '', digest = '',] = hash.split('$');
+    if (algorithm !== expectedAlgorithm) {
+        return undefined;
+    }
+    const parsedVersion = parseIntegerSegment(version, 'v');
+    const parsedIterations = parseIntegerSegment(iterations, 'i');
+    const parsedSalt = parseStringSegment(salt, 's');
+    const parsedDigest = parseStringSegment(digest, 'h');
+    if (parsedVersion === undefined ||
+        parsedIterations === undefined ||
+        parsedSalt === undefined ||
+        parsedDigest === undefined) {
+        return undefined;
+    }
+    try {
+        return {
+            version: parsedVersion,
+            iterations: parsedIterations,
+            salt: fromBase64Url(parsedSalt),
+            digest: fromBase64Url(parsedDigest),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Encodes PBKDF2 hash parameters into a self-describing string for storage.
+ *
+ * @param params - The PBKDF2 parameters to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$i=<iterations>$s=<salt>$h=<digest>`.
+ */
+export function formatPbkdf2Hash(params) {
+    return [
+        params.algorithm,
+        `v=${params.version}`,
+        `i=${params.iterations}`,
+        `s=${toBase64Url(params.salt)}`,
+        `h=${toBase64Url(params.digest)}`,
+    ].join('$');
+}
+/**
+ * Encodes an HMAC digest into a self-describing string for opaque token storage.
+ *
+ * @param params - The HMAC digest to encode.
+ * @returns A string in the format `<algorithm>$v=<version>$h=<digest>`.
+ */
+export function formatOpaqueHash(params) {
+    return [
+        params.algorithm,
+        `v=${params.version}`,
+        `h=${toBase64Url(params.digest)}`,
+    ].join('$');
+}
+/**
+ * Normalizes a secret string to Unicode NFC form and encodes it as UTF-8 bytes.
+ * This ensures visually equivalent strings (e.g. `café` vs `cafe\u0301`) produce
+ * identical byte sequences across all runtimes.
+ *
+ * @param secret - The raw secret string.
+ * @returns The NFC-normalized, UTF-8-encoded byte representation.
+ */
+export function normalizeSecret(secret) {
+    return stringToBytes(secret.normalize('NFC'));
+}
+/**
+ * Derives a purpose-specific subkey from a master secret using HKDF-SHA-256.
+ *
+ * Each purpose produces a cryptographically isolated key, so compromising
+ * one purpose key does not affect others.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param masterSecret - The 32-byte master secret.
+ * @param hkdfSalt - The salt string for HKDF (e.g. application context identifier).
+ * @param hkdfInfo - The info string for HKDF (e.g. purpose label).
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived purpose key of the specified length.
+ */
+export async function derivePurposeKeyBytes(crypto, masterSecret, hkdfSalt, hkdfInfo, derivedKeyBytes) {
+    const baseKey = await crypto.subtle.importKey('raw', toArrayBuffer(masterSecret), 'HKDF', false, ['deriveBits']);
+    const bits = await crypto.subtle.deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: toArrayBuffer(stringToBytes(hkdfSalt)),
+        info: toArrayBuffer(stringToBytes(hkdfInfo)),
+    }, baseKey, derivedKeyBytes * 8);
+    return new Uint8Array(bits);
+}
+/**
+ * Derives a PBKDF2-SHA-256 digest from a low-entropy secret (e.g. a password).
+ *
+ * The secret is first NFC-normalized and concatenated with the purpose key before
+ * being fed into PBKDF2, binding the derivation to a specific purpose.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param secret - The raw secret string (password, client secret, etc.).
+ * @param salt - A random salt (typically 16 bytes).
+ * @param iterations - The PBKDF2 iteration count.
+ * @param derivedKeyBytes - The number of bytes to derive.
+ * @returns A derived key of the specified length.
+ */
+export async function derivePbkdf2Bytes(crypto, purposeKey, secret, salt, iterations, derivedKeyBytes) {
+    const keyMaterial = await crypto.subtle.importKey('raw', toArrayBuffer(concatBytes(normalizeSecret(secret), purposeKey)), 'PBKDF2', false, ['deriveBits']);
+    const derived = await crypto.subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        iterations,
+        salt: toArrayBuffer(salt),
+    }, keyMaterial, derivedKeyBytes * 8);
+    return new Uint8Array(derived);
+}
+/**
+ * Computes an HMAC-SHA-256 signature over a high-entropy opaque value.
+ *
+ * Unlike PBKDF2, this is intended for values that are already cryptographically
+ * random (e.g. authorization codes, recovery tokens), where deterministic hashing
+ * enables efficient database lookups.
+ *
+ * @param crypto - The Web Crypto API instance.
+ * @param purposeKey - The pre-derived purpose-specific key from {@link derivePurposeKeyBytes}.
+ * @param value - The opaque value to sign.
+ * @returns A 32-byte HMAC signature.
+ */
+export async function signOpaqueValue(crypto, purposeKey, value) {
+    const hmacKey = await crypto.subtle.importKey('raw', toArrayBuffer(purposeKey), {
+        name: 'HMAC',
+        hash: 'SHA-256',
+    }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', hmacKey, toArrayBuffer(normalizeSecret(value)));
+    return new Uint8Array(signature);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/lib/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,KAA4B;IAE5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,8EAA8E,QAAQ,CAAC,UAAU,WAAW,MAAM,CAAC,MAAM,kBAAkB,CAC5I,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,aAAa,CAAC,QAAQ,CAAC,EACvB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEtC,4DAA4D;IAC5D,MAAM,aAAa,GAAG,IAAI,UAAU,CAClC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACrB,SAAS,EAAE,eAAe,GAAG,CAAC;KAC/B,EACD,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,CACzB,CACF,CAAC;IAEF,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CACnC,CAAC,EACD,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CACjC,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAe,EACf,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,UAAU,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAE9D,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,eAAe,GAAG,CAAC;SAC/B,EACD,GAAG,EACH,aAAa,CAAC,aAAa,CAAC,CAC7B,CACF,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAgB,EAChB,KAAiB;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAW;IACtD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,iBAAyB;IASzB,MAAM,CACJ,SAAS,GAAG,EAAE,EACd,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,IAAI,GAAG,EAAE,EACT,MAAM,GAAG,EAAE,EACZ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,aAAa,KAAK,SAAS;QAC3B,gBAAgB,KAAK,SAAS;QAC9B,UAAU,KAAK,SAAS;QACxB,YAAY,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;YAC/B,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/B,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAIhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,eAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,YAAY,CAAC,EAC3B,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;KAC7C,EACD,OAAO,EACP,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,UAAsB,EACtB,MAAc,EACd,IAAgB,EAChB,UAAkB,EAClB,eAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,EAC/D,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,UAAU;QACV,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;KAC1B,EACD,WAAW,EACX,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAsB,EACtB,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,UAAU,CAAC,EACzB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;KAChB,EACD,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,OAAO,EACP,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}

package/dist/lib/database/entities.d.ts

@@ -0,0 +1,10 @@
+import type { EntityName } from '@mikro-orm/core';
+export interface RuntimeDatabaseEntity {
+    meta: {
+        tableName: string;
+        uniqueName: string;
+    };
+}
+export declare function getDatabaseEntities(): readonly EntityName[];
+export declare function getDatabaseEntitiesWithMetadata(): readonly RuntimeDatabaseEntity[];
+//# sourceMappingURL=entities.d.ts.map

package/dist/lib/database/entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAsBlD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,wBAAgB,mBAAmB,IAAI,SAAS,UAAU,EAAE,CAE3D;AAED,wBAAgB,+BAA+B,IAAI,SAAS,qBAAqB,EAAE,CAElF"}

package/dist/lib/database/entities.js

@@ -0,0 +1,51 @@
+import { BackgroundJobEntitySchema } from "../../entities/background-job.entity.js";
+import { BootstrapStateEntitySchema } from "../../entities/bootstrap-state.entity.js";
+import { EmailVerificationEntitySchema } from "../../entities/email-verification.entity.js";
+import { JwtKeyEntitySchema } from "../../entities/jwt-key.entity.js";
+import { OAuthClientEntitySchema } from "../../entities/oauth-client.entity.js";
+import { OAuthCodeEntitySchema } from "../../entities/oauth-code.entity.js";
+import { OAuthDeviceCodeEntitySchema } from "../../entities/oauth-device-code.entity.js";
+import { PasswordResetEntitySchema } from "../../entities/password-reset.entity.js";
+import { PendingOAuthRegistrationEntitySchema } from "../../entities/pending-oauth-registration.entity.js";
+import { RevokedTokenEntitySchema } from "../../entities/revoked-token.entity.js";
+import { SchedulerJobEntitySchema } from "../../entities/scheduler-job.entity.js";
+import { TermsEntitySchema } from "../../entities/terms.entity.js";
+import { TermsContentEntitySchema } from "../../entities/terms-content.entity.js";
+import { UserEntitySchema } from "../../entities/user.entity.js";
+import { UserConsentEntitySchema } from "../../entities/user-consent.entity.js";
+import { UserOAuthEntitySchema } from "../../entities/user-oauth.entity.js";
+import { UserPasskeyEntitySchema } from "../../entities/user-passkey.entity.js";
+import { UserTermsConsentEntitySchema } from "../../entities/user-terms-consent.entity.js";
+import { UserTotpEntitySchema } from "../../entities/user-totp.entity.js";
+import { UserTotpRecoveryCodeEntitySchema } from "../../entities/user-totp-recovery-code.entity.js";
+function createDatabaseEntities() {
+    return [
+        UserEntitySchema,
+        OAuthClientEntitySchema,
+        OAuthCodeEntitySchema,
+        OAuthDeviceCodeEntitySchema,
+        JwtKeyEntitySchema,
+        EmailVerificationEntitySchema,
+        PasswordResetEntitySchema,
+        PendingOAuthRegistrationEntitySchema,
+        RevokedTokenEntitySchema,
+        BackgroundJobEntitySchema,
+        SchedulerJobEntitySchema,
+        TermsEntitySchema,
+        TermsContentEntitySchema,
+        UserConsentEntitySchema,
+        UserOAuthEntitySchema,
+        UserPasskeyEntitySchema,
+        UserTermsConsentEntitySchema,
+        UserTotpRecoveryCodeEntitySchema,
+        UserTotpEntitySchema,
+        BootstrapStateEntitySchema,
+    ];
+}
+export function getDatabaseEntities() {
+    return createDatabaseEntities();
+}
+export function getDatabaseEntitiesWithMetadata() {
+    return createDatabaseEntities();
+}
+//# sourceMappingURL=entities.js.map

package/dist/lib/database/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AASpG,SAAS,sBAAsB;IAC7B,OAAO;QACL,gBAAgB;QAChB,uBAAuB;QACvB,qBAAqB;QACrB,2BAA2B;QAC3B,kBAAkB;QAClB,6BAA6B;QAC7B,yBAAyB;QACzB,oCAAoC;QACpC,wBAAwB;QACxB,yBAAyB;QACzB,wBAAwB;QACxB,iBAAiB;QACjB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;QAChC,oBAAoB;QACpB,0BAA0B;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/duration.d.ts

@@ -0,0 +1,44 @@
+import z from 'zod';
+/**
+ * Duration string pattern supporting multiple time units:
+ * - s: seconds (e.g., "30s")
+ * - m: minutes (e.g., "30m")
+ * - h: hours (e.g., "24h")
+ * - d: days (e.g., "7d")
+ * - y: years (e.g., "1y")
+ *
+ * Special value "0" means immediate (no retention).
+ */
+export declare const DurationString: z.ZodString;
+export type DurationString = z.infer<typeof DurationString>;
+export declare const MS_PER_SECOND = 1000;
+export declare const MS_PER_MINUTE: number;
+export declare const MS_PER_HOUR: number;
+export declare const MS_PER_DAY: number;
+export declare const MS_PER_YEAR: number;
+/**
+ * Parse duration string to milliseconds
+ * @param duration - Duration string like "30s", "30m", "24h", "7d", "1y" or "0"
+ * @returns Duration in milliseconds
+ */
+export declare function parseDurationToMs(duration: string): number;
+/**
+ * Calculate a cutoff date by subtracting a duration from now
+ * @param retention - Duration string for retention period
+ * @returns Date before which items should be cleaned up
+ */
+export declare function calculateCutoffDate(retention: string): Date;
+/**
+ * Format milliseconds as a human-readable duration
+ * @param ms - Duration in milliseconds
+ * @returns Human-readable string like "24 hours", "7 days", "30 days"
+ */
+export declare function formatDuration(ms: number): string;
+/**
+ * Calculate the permanent deletion date based on deleted_at and retention period
+ * @param deletedAt - The date when deletion was requested
+ * @param retentionPeriod - Retention period string like "30d"
+ * @returns Date when permanent deletion should occur
+ */
+export declare function calculatePermanentDeletionDate(deletedAt: Date, retentionPeriod: string): Date;
+//# sourceMappingURL=duration.d.ts.map

package/dist/lib/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../src/lib/duration.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,aAMyC,CAAC;AAErE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,aAAa,QAAqB,CAAC;AAChD,eAAO,MAAM,WAAW,QAAqB,CAAC;AAC9C,eAAO,MAAM,UAAU,QAAmB,CAAC;AAC3C,eAAO,MAAM,WAAW,QAAmB,CAAC;AAE5C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgC1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CA2BjD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,IAAI,EACf,eAAe,EAAE,MAAM,GACtB,IAAI,CAGN"}

package/dist/lib/duration.js

@@ -0,0 +1,103 @@
+import z from 'zod';
+/**
+ * Duration string pattern supporting multiple time units:
+ * - s: seconds (e.g., "30s")
+ * - m: minutes (e.g., "30m")
+ * - h: hours (e.g., "24h")
+ * - d: days (e.g., "7d")
+ * - y: years (e.g., "1y")
+ *
+ * Special value "0" means immediate (no retention).
+ */
+export const DurationString = z
+    .string()
+    .regex(/^(0|\d+[smhdy])$/, 'Duration must be "0" or format like "30s", "30m", "24h", "7d", "1y"')
+    .describe('Duration string (e.g., "0", "30m", "24h", "7d", "1y")');
+export const MS_PER_SECOND = 1000;
+export const MS_PER_MINUTE = 60 * MS_PER_SECOND;
+export const MS_PER_HOUR = 60 * MS_PER_MINUTE;
+export const MS_PER_DAY = 24 * MS_PER_HOUR;
+export const MS_PER_YEAR = 365 * MS_PER_DAY; // Approximate year as 365 days
+/**
+ * Parse duration string to milliseconds
+ * @param duration - Duration string like "30s", "30m", "24h", "7d", "1y" or "0"
+ * @returns Duration in milliseconds
+ */
+export function parseDurationToMs(duration) {
+    // Special case: "0" means immediate (no retention)
+    if (duration === '0') {
+        return 0;
+    }
+    const match = duration.match(/^(\d+)([smhdy])$/);
+    if (!match) {
+        throw new Error(`Invalid duration format: ${duration}`);
+    }
+    const valueStr = match[1];
+    const unit = match[2];
+    if (!valueStr || !unit) {
+        throw new Error(`Invalid duration format: ${duration}`);
+    }
+    const value = Number.parseInt(valueStr, 10);
+    switch (unit) {
+        case 's':
+            return value * MS_PER_SECOND;
+        case 'm':
+            return value * MS_PER_MINUTE;
+        case 'h':
+            return value * MS_PER_HOUR;
+        case 'd':
+            return value * MS_PER_DAY;
+        case 'y':
+            return value * MS_PER_YEAR;
+        default:
+            throw new Error(`Unknown duration unit: ${unit}`);
+    }
+}
+/**
+ * Calculate a cutoff date by subtracting a duration from now
+ * @param retention - Duration string for retention period
+ * @returns Date before which items should be cleaned up
+ */
+export function calculateCutoffDate(retention) {
+    const retentionMs = parseDurationToMs(retention);
+    return new Date(Date.now() - retentionMs);
+}
+/**
+ * Format milliseconds as a human-readable duration
+ * @param ms - Duration in milliseconds
+ * @returns Human-readable string like "24 hours", "7 days", "30 days"
+ */
+export function formatDuration(ms) {
+    if (ms === 0) {
+        return 'immediate';
+    }
+    if (ms < MS_PER_MINUTE) {
+        const seconds = Math.round(ms / MS_PER_SECOND);
+        return `${seconds} second${seconds !== 1 ? 's' : ''}`;
+    }
+    if (ms < MS_PER_HOUR) {
+        const minutes = Math.round(ms / MS_PER_MINUTE);
+        return `${minutes} minute${minutes !== 1 ? 's' : ''}`;
+    }
+    if (ms < MS_PER_DAY) {
+        const hours = Math.round(ms / MS_PER_HOUR);
+        return `${hours} hour${hours !== 1 ? 's' : ''}`;
+    }
+    if (ms < MS_PER_YEAR) {
+        const days = Math.round(ms / MS_PER_DAY);
+        return `${days} day${days !== 1 ? 's' : ''}`;
+    }
+    const years = Math.round(ms / MS_PER_YEAR);
+    return `${years} year${years !== 1 ? 's' : ''}`;
+}
+/**
+ * Calculate the permanent deletion date based on deleted_at and retention period
+ * @param deletedAt - The date when deletion was requested
+ * @param retentionPeriod - Retention period string like "30d"
+ * @returns Date when permanent deletion should occur
+ */
+export function calculatePermanentDeletionDate(deletedAt, retentionPeriod) {
+    const retentionMs = parseDurationToMs(retentionPeriod);
+    return new Date(deletedAt.getTime() + retentionMs);
+}
+//# sourceMappingURL=duration.js.map

package/dist/lib/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../src/lib/duration.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CACJ,kBAAkB,EAClB,qEAAqE,CACtE;KACA,QAAQ,CAAC,uDAAuD,CAAC,CAAC;AAIrE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,aAAa,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,aAAa,CAAC;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,GAAG,WAAW,CAAC;AAC3C,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,GAAG,UAAU,CAAC,CAAC,+BAA+B;AAE5E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,mDAAmD;IACnD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAE5C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,aAAa,CAAC;QAC/B,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,aAAa,CAAC;QAC/B,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,WAAW,CAAC;QAC7B,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,UAAU,CAAC;QAC5B,KAAK,GAAG;YACN,OAAO,KAAK,GAAG,WAAW,CAAC;QAC7B;YACE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACb,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC;QAC/C,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC;QAC/C,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,EAAE,GAAG,UAAU,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;QAC3C,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,EAAE,GAAG,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;QACzC,OAAO,GAAG,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IAC3C,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAe,EACf,eAAuB;IAEvB,MAAM,WAAW,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACvD,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AACrD,CAAC"}

package/dist/lib/email-pattern.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Check if an email address matches any of the allowed signup patterns.
+ *
+ * Supported patterns:
+ * - `*` — Allow all emails
+ * - `user@domain.com` — Exact email match (case-insensitive)
+ * - `*@domain.com` — Allow any email at the specified domain
+ *
+ * An empty patterns array means signup is disabled entirely.
+ *
+ * @param email - The email address to check
+ * @param patterns - Array of allowed email patterns
+ * @returns `true` if the email matches at least one pattern
+ */
+export declare function isEmailAllowed(email: string, patterns: readonly string[]): boolean;
+//# sourceMappingURL=email-pattern.d.ts.map

package/dist/lib/email-pattern.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-pattern.d.ts","sourceRoot":"","sources":["../../src/lib/email-pattern.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CA+BT"}