@vsaas/loopback 12.1.1 → 12.2.0

package/dist/lib/two-factor/config.cjs

@@ -0,0 +1,199 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_errors = require("../rate-limit/errors.cjs");
+const require_config = require("../rate-limit/config.cjs");
+//#region src/lib/two-factor/config.ts
+function integer(value, fallback, name, minimum = 1, maximum = 31536e3) {
+	const result = value == null ? fallback : value;
+	if (!Number.isSafeInteger(result) || result < minimum || result > maximum) throw require_errors.rateLimitConfigurationError(`${name} is invalid`);
+	return result;
+}
+function parseKeyring(input, name, exactBytes) {
+	if (!input || !KEY_ID.test(input.currentKeyId || "") || !input.keys) throw require_errors.rateLimitConfigurationError(`${name} is invalid`);
+	const keys = {};
+	for (const [keyId, encoded] of Object.entries(input.keys)) {
+		if (!KEY_ID.test(keyId) || typeof encoded !== "string") throw require_errors.rateLimitConfigurationError(`${name} is invalid`);
+		const key = Buffer.from(encoded, "base64");
+		if (exactBytes != null && key.length !== exactBytes || exactBytes == null && key.length < 32) throw require_errors.rateLimitConfigurationError(`${name} contains an invalid key`);
+		keys[keyId] = key;
+	}
+	if (!keys[input.currentKeyId]) throw require_errors.rateLimitConfigurationError(`${name}.currentKeyId was not found`);
+	return Object.freeze({
+		currentKeyId: input.currentKeyId,
+		keys: Object.freeze(keys)
+	});
+}
+function sessionPolicy(value, fallback, name) {
+	const result = value || fallback;
+	if (result !== "revoke-all" && result !== "revoke-others") throw require_errors.rateLimitConfigurationError(`${name} is invalid`);
+	return result;
+}
+function normalizeTwoFactorConfig(input) {
+	if (input == null) return null;
+	const mode = input.mode || "disabled";
+	if (![
+		"disabled",
+		"verify-only",
+		"enroll-and-verify"
+	].includes(mode)) throw require_errors.rateLimitConfigurationError("twoFactor.mode is invalid");
+	if (mode === "disabled") return Object.freeze({ mode });
+	const algorithm = String(input.totp?.algorithm || "SHA1").toUpperCase();
+	if (algorithm !== "SHA1" && algorithm !== "SHA256") throw require_errors.rateLimitConfigurationError("twoFactor.totp.algorithm is invalid");
+	const digits = integer(input.totp?.digits, 6, "twoFactor.totp.digits", 6, 8);
+	if (digits !== 6 && digits !== 8) throw require_errors.rateLimitConfigurationError("twoFactor.totp.digits is invalid");
+	const challengeTtl = integer(input.challengeTtl, 300, "twoFactor.challengeTtl", 60, 600);
+	const issuer = String(input.issuer || "").trim();
+	if (!issuer) throw require_errors.rateLimitConfigurationError("twoFactor.issuer is required");
+	const leaseTtl = integer(input.verificationLeaseTtl, 30, "twoFactor.verificationLeaseTtl", 1, challengeTtl - 1);
+	const encryption = parseKeyring(input.encryption, "twoFactor.encryption", 32);
+	const recoveryCodeHmac = parseKeyring(input.recoveryCodeHmac, "twoFactor.recoveryCodeHmac");
+	const principalBindingHmac = parseKeyring(input.principalBindingHmac, "twoFactor.principalBindingHmac");
+	for (const recoveryKey of Object.values(recoveryCodeHmac.keys)) for (const bindingKey of Object.values(principalBindingHmac.keys)) if (crypto.timingSafeEqual(crypto.createHash("sha256").update(recoveryKey).digest(), crypto.createHash("sha256").update(bindingKey).digest())) throw require_errors.rateLimitConfigurationError("Two-factor HMAC keyrings must use distinct keys");
+	return Object.freeze({
+		mode,
+		issuer,
+		challengeTtlMs: challengeTtl * 1e3,
+		verificationLeaseTtlMs: leaseTtl * 1e3,
+		enrollmentTtlMs: integer(input.enrollmentTtl, 600, "twoFactor.enrollmentTtl", 60, 3600) * 1e3,
+		maxAttempts: integer(input.maxAttempts, 5, "twoFactor.maxAttempts", 1, 10),
+		maxClockSkewSteps: integer(input.maxClockSkewSteps, 1, "twoFactor.maxClockSkewSteps", 0, 2),
+		totp: Object.freeze({
+			algorithm,
+			digits,
+			period: integer(input.totp?.period, 30, "twoFactor.totp.period", 15, 120),
+			secretBytes: integer(input.totp?.secretBytes, 20, "twoFactor.totp.secretBytes", 20, 64)
+		}),
+		recoveryCodeCount: integer(input.recoveryCodeCount, 10, "twoFactor.recoveryCodeCount", 1, 32),
+		recoveryCodeBytes: integer(input.recoveryCodeBytes, 16, "twoFactor.recoveryCodeBytes", 10, 32),
+		loginContextMaxBytes: integer(input.loginContextMaxBytes, 8192, "twoFactor.loginContextMaxBytes", 256, 65536),
+		sessions: Object.freeze({
+			onEnable: sessionPolicy(input.sessions?.onEnable, "revoke-others", "sessions.onEnable"),
+			onDisable: sessionPolicy(input.sessions?.onDisable, "revoke-all", "sessions.onDisable"),
+			onRecoveryCodesRegenerated: sessionPolicy(input.sessions?.onRecoveryCodesRegenerated, "revoke-others", "sessions.onRecoveryCodesRegenerated")
+		}),
+		encryption,
+		recoveryCodeHmac,
+		principalBindingHmac
+	});
+}
+function failurePolicy(input, defaults, name, stateTtlMs) {
+	const merged = {
+		...defaults,
+		...input || {}
+	};
+	const strategy = merged.strategy || "exponential";
+	if (strategy !== "fixed" && strategy !== "exponential") throw require_errors.rateLimitConfigurationError(`${name}.strategy is invalid`);
+	return Object.freeze(require_config.normalizeFailureLockoutPolicy({
+		policyId: merged.policyId,
+		policyVersion: String(merged.policyVersion || "1"),
+		maxFailedAttempts: integer(merged.maxFailedAttempts, defaults.maxFailedAttempts, `${name}.maxFailedAttempts`, 1, 100),
+		observationWindowMs: integer(merged.observationWindow, defaults.observationWindow, `${name}.observationWindow`) * 1e3,
+		blockDurationMs: integer(merged.blockDuration, defaults.blockDuration, `${name}.blockDuration`) * 1e3,
+		strategy,
+		multiplier: integer(merged.multiplier, defaults.multiplier || 2, `${name}.multiplier`, 1, 10),
+		maxBlockDurationMs: integer(merged.maxBlockDuration, defaults.maxBlockDuration, `${name}.maxBlockDuration`) * 1e3,
+		backoffResetAfterMs: integer(merged.backoffResetAfter, defaults.backoffResetAfter, `${name}.backoffResetAfter`) * 1e3,
+		stateTtlMs: merged.stateTtl == null ? stateTtlMs : integer(merged.stateTtl, 0, `${name}.stateTtl`) * 1e3
+	}));
+}
+function volumePolicy(input, defaults, name, stateTtlMs) {
+	const merged = {
+		...defaults,
+		...input || {}
+	};
+	return Object.freeze(require_config.normalizeFixedWindowPolicy({
+		policyId: merged.policyId,
+		policyVersion: String(merged.policyVersion || "1"),
+		maxAttempts: integer(merged.maxAttempts, defaults.maxAttempts, `${name}.maxAttempts`, 1, 1e5),
+		observationWindowMs: integer(merged.observationWindow, defaults.observationWindow, `${name}.observationWindow`) * 1e3,
+		blockDurationMs: integer(merged.blockDuration, defaults.blockDuration, `${name}.blockDuration`) * 1e3,
+		stateTtlMs: merged.stateTtl == null ? stateTtlMs : integer(merged.stateTtl, 0, `${name}.stateTtl`) * 1e3
+	}));
+}
+function normalizeAuthenticationRateLimitConfig(input, modelName, applicationRateLimit = {}) {
+	if (input == null || input.enabled !== true) return null;
+	const usesApplicationStore = typeof input.store === "string";
+	const store = usesApplicationStore ? applicationRateLimit.stores?.[input.store] : input.store;
+	if (!store || typeof store.namespace !== "string" || !store.namespace.trim()) throw require_errors.rateLimitConfigurationError(`${modelName}.authenticationRateLimit.store is invalid`);
+	const stateTtlMs = integer(input.stateTtl, 604800, "authenticationRateLimit.stateTtl") * 1e3;
+	const storeName = usesApplicationStore ? input.store : `authentication-${modelName}`;
+	const keyringName = `authentication-${modelName}`;
+	const policies = input.policies || input;
+	return Object.freeze({
+		enabled: true,
+		namespace: store.namespace,
+		storeName,
+		keyringName,
+		store: Object.freeze({ ...store }),
+		usesApplicationStore,
+		subjectHash: parseKeyring(input.subjectHash, "authenticationRateLimit.subjectHash"),
+		retryAfterGranularity: integer(input.retryAfterGranularity, 30, "authenticationRateLimit.retryAfterGranularity", 1, 3600),
+		stateTtlMs,
+		password: failurePolicy(policies.password, {
+			policyId: "authentication-password",
+			maxFailedAttempts: 5,
+			observationWindow: 900,
+			blockDuration: 60,
+			multiplier: 2,
+			maxBlockDuration: 3600,
+			backoffResetAfter: 86400
+		}, "authenticationRateLimit.password", stateTtlMs),
+		secondFactor: failurePolicy(policies.secondFactor, {
+			policyId: "authentication-second-factor",
+			maxFailedAttempts: 5,
+			observationWindow: 300,
+			blockDuration: 30,
+			multiplier: 2,
+			maxBlockDuration: 900,
+			backoffResetAfter: 86400
+		}, "authenticationRateLimit.secondFactor", stateTtlMs),
+		challengeIssuance: volumePolicy(policies.challengeIssuance, {
+			policyId: "authentication-challenge-issuance",
+			maxAttempts: 10,
+			observationWindow: 300,
+			blockDuration: 300
+		}, "authenticationRateLimit.challengeIssuance", stateTtlMs),
+		management: failurePolicy(policies.management, {
+			policyId: "authentication-management",
+			maxFailedAttempts: 3,
+			observationWindow: 600,
+			blockDuration: 300,
+			strategy: "fixed",
+			multiplier: 1,
+			maxBlockDuration: 300,
+			backoffResetAfter: 86400
+		}, "authenticationRateLimit.management", stateTtlMs),
+		source: Object.freeze({
+			enabled: input.source?.enabled !== false,
+			login: volumePolicy(input.source?.login, {
+				policyId: "authentication-source-login",
+				maxAttempts: 100,
+				observationWindow: 60,
+				blockDuration: 60
+			}, "authenticationRateLimit.source.login", stateTtlMs),
+			secondFactor: volumePolicy(input.source?.secondFactor, {
+				policyId: "authentication-source-second-factor",
+				maxAttempts: 60,
+				observationWindow: 60,
+				blockDuration: 60
+			}, "authenticationRateLimit.source.secondFactor", stateTtlMs)
+		})
+	});
+}
+var crypto, KEY_ID;
+var init_config = require_runtime.__esmMin((() => {
+	require_config.init_config();
+	require_errors.init_errors();
+	crypto = require("crypto");
+	KEY_ID = /^[A-Za-z0-9._-]{1,64}$/;
+}));
+//#endregion
+init_config();
+Object.defineProperty(exports, "init_config", {
+	enumerable: true,
+	get: function() {
+		return init_config;
+	}
+});
+exports.normalizeAuthenticationRateLimitConfig = normalizeAuthenticationRateLimitConfig;
+exports.normalizeTwoFactorConfig = normalizeTwoFactorConfig;

package/dist/lib/two-factor/config.d.cts

@@ -0,0 +1,55 @@
+//#region src/lib/two-factor/config.d.ts
+interface BinaryKeyring {
+  currentKeyId: string;
+  keys: Record<string, Buffer>;
+}
+interface NormalizedTwoFactorConfig {
+  mode: 'disabled' | 'verify-only' | 'enroll-and-verify';
+  issuer: string;
+  challengeTtlMs: number;
+  verificationLeaseTtlMs: number;
+  enrollmentTtlMs: number;
+  maxAttempts: number;
+  maxClockSkewSteps: number;
+  totp: {
+    algorithm: 'SHA1' | 'SHA256';
+    digits: 6 | 8;
+    period: number;
+    secretBytes: number;
+  };
+  recoveryCodeCount: number;
+  recoveryCodeBytes: number;
+  loginContextMaxBytes: number;
+  sessions: {
+    onEnable: 'revoke-all' | 'revoke-others';
+    onDisable: 'revoke-all' | 'revoke-others';
+    onRecoveryCodesRegenerated: 'revoke-all' | 'revoke-others';
+  };
+  encryption: BinaryKeyring;
+  recoveryCodeHmac: BinaryKeyring;
+  principalBindingHmac: BinaryKeyring;
+}
+interface NormalizedAuthenticationRateLimitConfig {
+  enabled: boolean;
+  namespace: string;
+  storeName: string;
+  keyringName: string;
+  store: Record<string, any>;
+  usesApplicationStore: boolean;
+  subjectHash: BinaryKeyring;
+  retryAfterGranularity: number;
+  stateTtlMs: number;
+  password: Record<string, any>;
+  secondFactor: Record<string, any>;
+  challengeIssuance: Record<string, any>;
+  management: Record<string, any>;
+  source: {
+    enabled: boolean;
+    login: Record<string, any>;
+    secondFactor: Record<string, any>;
+  };
+}
+declare function normalizeTwoFactorConfig(input: any): NormalizedTwoFactorConfig | null;
+declare function normalizeAuthenticationRateLimitConfig(input: any, modelName: string, applicationRateLimit?: any): NormalizedAuthenticationRateLimitConfig | null;
+//#endregion
+export { BinaryKeyring, NormalizedAuthenticationRateLimitConfig, NormalizedTwoFactorConfig, normalizeAuthenticationRateLimitConfig, normalizeTwoFactorConfig };

package/dist/lib/two-factor/crypto.cjs

@@ -0,0 +1,68 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_subject = require("../rate-limit/subject.cjs");
+//#region src/lib/two-factor/crypto.ts
+function sha256(value) {
+	return crypto.createHash("sha256").update(value).digest("base64url");
+}
+function randomToken(bytes = 32) {
+	return crypto.randomBytes(bytes).toString("base64url");
+}
+function encrypt(plaintext, keyring, aadParts) {
+	const keyId = keyring.currentKeyId;
+	const nonce = crypto.randomBytes(12);
+	const cipher = crypto.createCipheriv("aes-256-gcm", keyring.keys[keyId], nonce);
+	cipher.setAAD(require_subject.encodeLengthPrefixed(aadParts));
+	const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	const envelope = {
+		v: 1,
+		k: keyId,
+		n: nonce.toString("base64url"),
+		c: ciphertext.toString("base64url"),
+		t: cipher.getAuthTag().toString("base64url")
+	};
+	return {
+		envelope: Buffer.from(JSON.stringify(envelope)).toString("base64url"),
+		keyId
+	};
+}
+function decrypt(encoded, keyring, aadParts) {
+	const envelope = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+	if (envelope.v !== 1 || !keyring.keys[envelope.k]) throw new Error("Invalid encrypted envelope");
+	const decipher = crypto.createDecipheriv("aes-256-gcm", keyring.keys[envelope.k], Buffer.from(envelope.n, "base64url"));
+	decipher.setAAD(require_subject.encodeLengthPrefixed(aadParts));
+	decipher.setAuthTag(Buffer.from(envelope.t, "base64url"));
+	return Buffer.concat([decipher.update(Buffer.from(envelope.c, "base64url")), decipher.final()]);
+}
+function keyedDigest(domain, parts, keyring, keyId = keyring.currentKeyId) {
+	const key = keyring.keys[keyId];
+	if (!key) throw new Error("Unknown HMAC key");
+	return {
+		digest: crypto.createHmac("sha256", key).update(require_subject.encodeLengthPrefixed([domain, ...parts])).digest("base64url"),
+		keyId
+	};
+}
+function timingSafeEqual(left, right) {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+var crypto;
+var init_crypto = require_runtime.__esmMin((() => {
+	require_subject.init_subject();
+	crypto = require("crypto");
+}));
+//#endregion
+init_crypto();
+exports.decrypt = decrypt;
+exports.encrypt = encrypt;
+Object.defineProperty(exports, "init_crypto", {
+	enumerable: true,
+	get: function() {
+		return init_crypto;
+	}
+});
+exports.keyedDigest = keyedDigest;
+exports.randomToken = randomToken;
+exports.sha256 = sha256;
+exports.timingSafeEqual = timingSafeEqual;

package/dist/lib/two-factor/crypto.d.cts

@@ -0,0 +1,16 @@
+import { BinaryKeyring } from "./config.cjs";
+//#region src/lib/two-factor/crypto.d.ts
+declare function sha256(value: string | Buffer): string;
+declare function randomToken(bytes?: number): string;
+declare function encrypt(plaintext: string | Buffer, keyring: BinaryKeyring, aadParts: ReadonlyArray<string | Buffer>): {
+  envelope: string;
+  keyId: string;
+};
+declare function decrypt(encoded: string, keyring: BinaryKeyring, aadParts: ReadonlyArray<string | Buffer>): Buffer;
+declare function keyedDigest(domain: string, parts: ReadonlyArray<string | Buffer>, keyring: BinaryKeyring, keyId?: string): {
+  digest: string;
+  keyId: string;
+};
+declare function timingSafeEqual(left: string, right: string): boolean;
+//#endregion
+export { decrypt, encrypt, keyedDigest, randomToken, sha256, timingSafeEqual };

package/dist/lib/two-factor/errors.cjs

@@ -0,0 +1,58 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+//#region src/lib/two-factor/errors.ts
+function authError(code, statusCode, message = "Authentication failed") {
+	return new AuthenticationSecurityError(code, message, statusCode);
+}
+function invalidChallenge() {
+	return authError("INVALID_TWO_FACTOR_CHALLENGE", 401, "Invalid two-factor challenge");
+}
+function invalidFactor() {
+	return authError("INVALID_TWO_FACTOR_CODE", 401, "Invalid two-factor code");
+}
+function twoFactorRequired(challenge, expiresIn, methods = ["totp"]) {
+	return new AuthenticationSecurityError("TWO_FACTOR_REQUIRED", "Two-factor authentication is required", 403, { details: {
+		challengeId: challenge,
+		methods,
+		expiresIn
+	} });
+}
+function authRateLimited(blockedUntilMs, granularitySeconds = 1) {
+	const raw = blockedUntilMs == null ? 1 : Math.max(1, Math.ceil((blockedUntilMs - Date.now()) / 1e3));
+	const retryAfter = Math.ceil(raw / granularitySeconds) * granularitySeconds;
+	return new AuthenticationSecurityError("AUTHENTICATION_RATE_LIMITED", "Too many authentication attempts", 429, {
+		retryAfter,
+		details: { retryAfter }
+	});
+}
+var AuthenticationSecurityError;
+var init_errors = require_runtime.__esmMin((() => {
+	AuthenticationSecurityError = class extends Error {
+		code;
+		statusCode;
+		details;
+		retryAfter;
+		constructor(code, message, statusCode, options = {}) {
+			super(message);
+			this.name = "AuthenticationSecurityError";
+			this.code = code;
+			this.statusCode = statusCode;
+			this.details = options.details;
+			this.retryAfter = options.retryAfter;
+		}
+	};
+}));
+//#endregion
+init_errors();
+exports.AuthenticationSecurityError = AuthenticationSecurityError;
+exports.authError = authError;
+exports.authRateLimited = authRateLimited;
+Object.defineProperty(exports, "init_errors", {
+	enumerable: true,
+	get: function() {
+		return init_errors;
+	}
+});
+exports.invalidChallenge = invalidChallenge;
+exports.invalidFactor = invalidFactor;
+exports.twoFactorRequired = twoFactorRequired;

package/dist/lib/two-factor/errors.d.cts

@@ -0,0 +1,18 @@
+//#region src/lib/two-factor/errors.d.ts
+declare class AuthenticationSecurityError extends Error {
+  code: string;
+  statusCode: number;
+  details?: Record<string, unknown>;
+  retryAfter?: number;
+  constructor(code: string, message: string, statusCode: number, options?: {
+    details?: Record<string, unknown>;
+    retryAfter?: number;
+  });
+}
+declare function authError(code: string, statusCode: number, message?: string): AuthenticationSecurityError;
+declare function invalidChallenge(): AuthenticationSecurityError;
+declare function invalidFactor(): AuthenticationSecurityError;
+declare function twoFactorRequired(challenge: string, expiresIn: number, methods?: string[]): AuthenticationSecurityError;
+declare function authRateLimited(blockedUntilMs: number | null, granularitySeconds?: number): AuthenticationSecurityError;
+//#endregion
+export { AuthenticationSecurityError, authError, authRateLimited, invalidChallenge, invalidFactor, twoFactorRequired };

package/dist/lib/two-factor/rate-limit.cjs

@@ -0,0 +1,153 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_config = require("../rate-limit/config.cjs");
+const require_lib_two_factor_errors = require("./errors.cjs");
+//#region src/lib/two-factor/rate-limit.ts
+function resolvedPolicy(config, bucket) {
+	const value = config[bucket];
+	if (bucket === "challengeIssuance") return require_config.normalizeFixedWindowPolicy({
+		policyId: value.policyId || `authentication-${bucket}`,
+		policyVersion: value.policyVersion,
+		maxAttempts: value.maxAttempts,
+		observationWindowMs: value.observationWindowMs,
+		blockDurationMs: value.blockDurationMs,
+		stateTtlMs: value.stateTtlMs
+	});
+	return require_config.normalizeFailureLockoutPolicy({
+		policyId: value.policyId || `authentication-${bucket}`,
+		policyVersion: value.policyVersion,
+		maxFailedAttempts: value.maxFailedAttempts,
+		observationWindowMs: value.observationWindowMs,
+		blockDurationMs: value.blockDurationMs,
+		strategy: value.strategy,
+		multiplier: value.multiplier,
+		maxBlockDurationMs: value.maxBlockDurationMs,
+		backoffResetAfterMs: value.backoffResetAfterMs,
+		stateTtlMs: value.stateTtlMs
+	});
+}
+function sourcePolicy(config, bucket) {
+	const value = config.source[bucket];
+	return require_config.normalizeFixedWindowPolicy({
+		policyId: value.policyId || `authentication-source-${bucket}`,
+		policyVersion: value.policyVersion,
+		maxAttempts: value.maxAttempts,
+		observationWindowMs: value.observationWindowMs,
+		blockDurationMs: value.blockDurationMs,
+		stateTtlMs: value.stateTtlMs
+	});
+}
+var AuthenticationRateLimiter;
+var init_rate_limit = require_runtime.__esmMin((() => {
+	require_config.init_config();
+	require_lib_two_factor_errors.init_errors();
+	AuthenticationRateLimiter = class {
+		modelName;
+		config;
+		limiter;
+		constructor(modelName, config, limiter) {
+			this.modelName = modelName;
+			this.config = config;
+			this.limiter = limiter;
+		}
+		get sourceEnabled() {
+			return this.config.source.enabled;
+		}
+		rule(bucket, subjectType, canonicalValue) {
+			return {
+				ruleId: `authentication-${bucket}-${subjectType}`,
+				store: this.config.storeName,
+				subjectKeyring: this.config.keyringName,
+				subject: {
+					namespace: this.config.namespace,
+					scope: this.modelName,
+					subjectType,
+					canonicalValue
+				},
+				bucket,
+				policy: resolvedPolicy(this.config, bucket),
+				cost: 1,
+				onStoreError: "deny",
+				phase: subjectType === "identifier" ? "early" : "resolved",
+				order: 0,
+				shortCircuitOnDeny: false
+			};
+		}
+		sourceRule(bucket, source) {
+			return {
+				ruleId: `authentication-source-${bucket}`,
+				store: this.config.storeName,
+				subjectKeyring: this.config.keyringName,
+				subject: {
+					namespace: this.config.namespace,
+					scope: this.modelName,
+					subjectType: "source",
+					canonicalValue: source
+				},
+				bucket: `source-${bucket}`,
+				policy: sourcePolicy(this.config, bucket),
+				cost: 1,
+				onStoreError: "deny",
+				phase: "early",
+				order: -100,
+				shortCircuitOnDeny: true
+			};
+		}
+		async inspect(rule) {
+			let result;
+			try {
+				result = await this.limiter.inspect(rule);
+			} catch (error) {
+				throw this.translateStoreError(error);
+			}
+			if (!result.decision.allowed) throw require_lib_two_factor_errors.authRateLimited(result.decision.blockedUntilMs, this.config.retryAfterGranularity);
+			return result;
+		}
+		async consume(rule) {
+			let result;
+			try {
+				result = await this.limiter.consume(rule);
+			} catch (error) {
+				throw this.translateStoreError(error);
+			}
+			if (!result.decision.allowed) throw require_lib_two_factor_errors.authRateLimited(result.decision.blockedUntilMs, this.config.retryAfterGranularity);
+			return result;
+		}
+		async reset(observed) {
+			for (const item of observed) {
+				let result;
+				try {
+					result = await this.limiter.reset(item.rule, item.revision);
+				} catch (error) {
+					throw this.translateStoreError(error);
+				}
+				if (!result.allowed) throw require_lib_two_factor_errors.authRateLimited(result.blockedUntilMs, this.config.retryAfterGranularity);
+			}
+		}
+		async deletePrincipal(principalId) {
+			try {
+				await this.limiter.delete([
+					this.rule("password", "principal", principalId),
+					this.rule("secondFactor", "principal", principalId),
+					this.rule("challengeIssuance", "principal", principalId),
+					this.rule("management", "principal", principalId)
+				]);
+			} catch (error) {
+				throw this.translateStoreError(error);
+			}
+		}
+		translateStoreError(error) {
+			if (error?.code === "RATE_LIMIT_UNAVAILABLE" || error?.code === "RATE_LIMIT_CONFIGURATION_INVALID") return require_lib_two_factor_errors.authError("AUTHENTICATION_RATE_LIMIT_UNAVAILABLE", 503, "Authentication rate limit service unavailable");
+			return error;
+		}
+	};
+}));
+//#endregion
+init_rate_limit();
+exports.AuthenticationRateLimiter = AuthenticationRateLimiter;
+Object.defineProperty(exports, "init_rate_limit", {
+	enumerable: true,
+	get: function() {
+		return init_rate_limit;
+	}
+});

package/dist/lib/two-factor/rate-limit.d.cts

@@ -0,0 +1,22 @@
+import { ResolvedRateLimitRule } from "../rate-limit/types.cjs";
+import { NormalizedAuthenticationRateLimitConfig } from "./config.cjs";
+//#region src/lib/two-factor/rate-limit.d.ts
+declare class AuthenticationRateLimiter {
+  private readonly modelName;
+  private readonly config;
+  private readonly limiter;
+  constructor(modelName: string, config: NormalizedAuthenticationRateLimitConfig, limiter: any);
+  get sourceEnabled(): boolean;
+  rule(bucket: 'password' | 'secondFactor' | 'challengeIssuance' | 'management', subjectType: 'identifier' | 'principal', canonicalValue: string): ResolvedRateLimitRule;
+  sourceRule(bucket: 'login' | 'secondFactor', source: string): ResolvedRateLimitRule;
+  inspect(rule: ResolvedRateLimitRule): Promise<any>;
+  consume(rule: ResolvedRateLimitRule): Promise<any>;
+  reset(observed: Array<{
+    rule: ResolvedRateLimitRule;
+    revision: number;
+  }>): Promise<void>;
+  deletePrincipal(principalId: string): Promise<void>;
+  private translateStoreError;
+}
+//#endregion
+export { AuthenticationRateLimiter };

package/dist/lib/two-factor/recovery-codes.cjs

@@ -0,0 +1,49 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_runtime = require("../../_virtual/_rolldown/runtime.cjs");
+const require_lib_two_factor_crypto = require("./crypto.cjs");
+//#region src/lib/two-factor/recovery-codes.ts
+function normalizeRecoveryCode(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.replace(/[\s-]/g, "").toUpperCase();
+	return /^[A-Z2-7]+$/.test(normalized) ? normalized : null;
+}
+function formatRecoveryCode(value) {
+	return value.match(/.{1,5}/g).join("-");
+}
+function generateRecoveryCodes(count, bytes) {
+	const unique = /* @__PURE__ */ new Set();
+	for (let attempts = 0; unique.size < count && attempts < count * 10; attempts++) unique.add(otplib.generateSecret({ length: bytes }));
+	if (unique.size !== count) throw new Error("Unable to generate unique recovery codes");
+	const normalized = Array.from(unique);
+	return {
+		setId: require_lib_two_factor_crypto.randomToken(24),
+		codes: normalized.map(formatRecoveryCode),
+		normalized
+	};
+}
+function recoveryCodeId(credentialId, setId, normalizedCode, keyring, keyId = keyring.currentKeyId) {
+	return require_lib_two_factor_crypto.keyedDigest("two-factor-recovery-code:v1", [
+		credentialId,
+		setId,
+		normalizedCode
+	], keyring, keyId);
+}
+var otplib, RECOVERY_CODE_FORMAT_VERSION;
+var init_recovery_codes = require_runtime.__esmMin((() => {
+	require_lib_two_factor_crypto.init_crypto();
+	otplib = require("otplib");
+	RECOVERY_CODE_FORMAT_VERSION = 1;
+}));
+//#endregion
+init_recovery_codes();
+exports.RECOVERY_CODE_FORMAT_VERSION = RECOVERY_CODE_FORMAT_VERSION;
+exports.formatRecoveryCode = formatRecoveryCode;
+exports.generateRecoveryCodes = generateRecoveryCodes;
+Object.defineProperty(exports, "init_recovery_codes", {
+	enumerable: true,
+	get: function() {
+		return init_recovery_codes;
+	}
+});
+exports.normalizeRecoveryCode = normalizeRecoveryCode;
+exports.recoveryCodeId = recoveryCodeId;

package/dist/lib/two-factor/recovery-codes.d.cts

@@ -0,0 +1,16 @@
+import { BinaryKeyring } from "./config.cjs";
+//#region src/lib/two-factor/recovery-codes.d.ts
+declare const RECOVERY_CODE_FORMAT_VERSION = 1;
+declare function normalizeRecoveryCode(value: unknown): string | null;
+declare function formatRecoveryCode(value: string): string;
+declare function generateRecoveryCodes(count: number, bytes: number): {
+  setId: string;
+  codes: string[];
+  normalized: string[];
+};
+declare function recoveryCodeId(credentialId: string, setId: string, normalizedCode: string, keyring: BinaryKeyring, keyId?: string): {
+  digest: string;
+  keyId: string;
+};
+//#endregion
+export { RECOVERY_CODE_FORMAT_VERSION, formatRecoveryCode, generateRecoveryCodes, normalizeRecoveryCode, recoveryCodeId };