@vunexa/lixa 0.1.6-alpha.12 → 0.1.6-alpha.14

package/dist/index.d.cts

@@ -101,33 +101,33 @@ interface ConnectedResource {
  */
 interface Session<TRaw = OAuthTokenResponse> {
     /**
-     * Unique session ID generated by Lixa upon authentication.
+     * Unique canonical session ID generated by Lixa upon authentication.
      */
-    id?: string;
+    sessionId?: string | undefined;
     /**
      * Linked identity provider accounts (AuthN) keyed by provider name.
      * Single source of truth for all authenticated user SSO identities.
      */
-    accounts?: Record<string, LinkedAccount>;
+    accounts?: Record<string, LinkedAccount> | undefined;
     /**
      * Connected third-party resource provider tokens (AuthZ) keyed by provider name.
      * Single source of truth for all post-login third-party API permissions.
      */
-    resources?: Record<string, ConnectedResource>;
+    resources?: Record<string, ConnectedResource> | undefined;
     /** Unique unified user ID across linked accounts */
-    userId?: string;
+    userId?: string | undefined;
     /** Primary user email */
-    email?: string;
+    email?: string | undefined;
     /**
      * Optional primary access token or custom session token identifier.
      */
-    token?: string;
+    token?: string | undefined;
     /** Optional current active auth provider for this session turn */
-    provider?: string;
+    provider?: string | undefined;
     /**
      * Optional raw session token response data from provider.
      */
-    raw?: TRaw;
+    raw?: TRaw | undefined;
 }
 /**
  * Provider metadata passed to session strategy.
@@ -427,6 +427,25 @@ interface ResourceStorage {
 interface ResourceHandler {
     resourceStorage?: ResourceStorage;
 }
+/**
+ * Interface for persistent linked account storage across user sessions.
+ *
+ * @public
+ */
+interface AccountStorage {
+    saveAccount(userId: string, provider: string, account: LinkedAccount): Promise<void>;
+    getAccount(userId: string, provider: string): Promise<LinkedAccount | null>;
+    getUserAccounts(userId: string): Promise<Record<string, LinkedAccount>>;
+    deleteAccount(userId: string, provider: string): Promise<void>;
+}
+/**
+ * Account handler configuration.
+ *
+ * @public
+ */
+interface AccountHandler {
+    accountStorage?: AccountStorage;
+}
 /**
  * Session handler for OAuth authentication.
  *
@@ -658,6 +677,776 @@ interface IProvider {
      * @example ['openid', 'email', 'profile'] or ['read:user', 'user:email']
      */
     authScopes?: string[];
+    /**
+     * Default OAuth scopes requested when not explicitly specified in ProviderConfig.
+     */
+    defaultScopes?: string[];
+}
+
+/**
+ * Standardized user identity representation across all identity providers
+ * (Self-Managed Database, AWS Cognito, Auth0, Okta, Firebase, etc.).
+ *
+ * @public
+ */
+interface UserIdentity {
+    /** Unique user identifier (UUID, Sub, Auth0 user_id, Okta id) */
+    id: string;
+    /** Primary unique lookup identifier (email or username) */
+    identifier: string;
+    /** Associated email address if available */
+    email?: string | undefined;
+    /** Username of the account if available */
+    username?: string | undefined;
+    /** Whether the email address has been verified by the identity provider */
+    emailVerified?: boolean | undefined;
+    /** Unix timestamp in milliseconds when user was created */
+    createdAt?: number | undefined;
+    /** Unix timestamp in milliseconds when user was last updated */
+    updatedAt?: number | undefined;
+    /** Custom user metadata or profile attributes */
+    metadata?: Record<string, unknown> | undefined;
+    /** Identity provider name (e.g. "self-managed", "cognito", "auth0", "okta") */
+    provider?: string | undefined;
+}
+/**
+ * Standardized token response from an identity provider.
+ *
+ * @public
+ */
+interface IdentityTokens {
+    /** OAuth / IdP Access Token (JWT or opaque token) */
+    accessToken?: string | undefined;
+    /** OpenID Connect ID Token containing user claims */
+    idToken?: string | undefined;
+    /** Refresh token for renewing expired credentials */
+    refreshToken?: string | undefined;
+    /** Token type (usually "Bearer") */
+    tokenType?: string | undefined;
+    /** Token expiration time in seconds */
+    expiresIn?: number | undefined;
+    /** Raw response object returned directly by the provider */
+    raw?: Record<string, unknown> | undefined;
+}
+/**
+ * Result of user authentication through an identity provider.
+ *
+ * @public
+ */
+interface IdentityAuthResult {
+    /** Authenticated user profile */
+    user: UserIdentity;
+    /** Optional tokens issued by the identity provider */
+    tokens?: IdentityTokens | undefined;
+}
+/**
+ * Parameters for requesting a password reset (forgot password).
+ *
+ * @public
+ */
+interface ForgotPasswordParams {
+    /** Username or email of the account requesting a password reset */
+    identifier: string;
+    /** Optional custom client metadata or redirect URL */
+    metadata?: Record<string, unknown> | undefined;
+}
+/**
+ * Result of a password reset request.
+ *
+ * @public
+ */
+interface ForgotPasswordResult {
+    /** Whether the password reset request was accepted */
+    success: boolean;
+    /** Delivery destination description (e.g. masked email: a***@example.com or phone) */
+    deliveryMedium?: string | undefined;
+    /** Optional message or status code from provider */
+    message?: string | undefined;
+}
+/**
+ * Parameters for confirming a password reset with a confirmation code or token.
+ *
+ * @public
+ */
+interface ConfirmPasswordResetParams {
+    /** Username or email of the account */
+    identifier: string;
+    /** Verification code (e.g. 6-digit OTP from email/SMS) or reset token */
+    confirmationCode: string;
+    /** New plaintext password */
+    newPassword: string;
+}
+/**
+ * Parameters for confirming user registration with a verification code.
+ *
+ * @public
+ */
+interface ConfirmSignUpParams {
+    /** Username or email of the account to confirm */
+    identifier: string;
+    /** Verification code (e.g. 6-digit OTP from email/SMS) */
+    confirmationCode: string;
+}
+/**
+ * Parameters for resending a sign up confirmation code.
+ *
+ * @public
+ */
+interface ResendConfirmationCodeParams {
+    /** Username or email of the account */
+    identifier: string;
+}
+/**
+ * Result of resending a sign up confirmation code.
+ *
+ * @public
+ */
+interface ResendConfirmationCodeResult {
+    /** True if code was dispatched */
+    success: boolean;
+    /** Delivery medium (e.g. 'EMAIL' or 'SMS') */
+    deliveryMedium?: string | undefined;
+    /** Obscured destination */
+    destination?: string | undefined;
+}
+/**
+ * Unified interface for Identity Providers in Lixa.
+ *
+ * @remarks
+ * Implement this interface to create custom identity providers (e.g. Supabase Auth,
+ * Firebase Auth, Keycloak, or proprietary enterprise directories).
+ *
+ * Built-in extensions for AWS Cognito, Auth0, and Okta are available in `@vunexa/lixa-extensions`.
+ *
+ * @public
+ */
+interface IIdentityProvider {
+    /**
+     * Unique name of the identity provider.
+     * Examples: 'self-managed', 'cognito', 'auth0', 'okta'
+     */
+    readonly name: string;
+    /**
+     * Registers a new user with the identity provider.
+     *
+     * @param params - User registration details (identifier, password, email, username, metadata)
+     * @returns Created user identity
+     */
+    signUp(params: SignUpParams): Promise<UserIdentity>;
+    /**
+     * Authenticates a user with credentials.
+     *
+     * @param params - Sign in credentials (identifier, password)
+     * @returns Authenticated user identity and optional provider tokens
+     */
+    signIn(params: SignInParams): Promise<IdentityAuthResult>;
+    /**
+     * Verifies credentials without necessarily creating a full session.
+     *
+     * @param params - Verification parameters
+     * @returns User identity if credentials are valid, null otherwise
+     */
+    verifyCredentials?(params: VerifyCredentialsParams): Promise<UserIdentity | null>;
+    /**
+     * Changes a user's password.
+     *
+     * @param params - Old password, new password, and user identifier
+     * @returns True if password was successfully updated
+     */
+    changePassword?(params: ChangePasswordParams): Promise<boolean>;
+    /**
+     * Requests a password reset (forgot password flow).
+     *
+     * @param params - Forgot password parameters
+     */
+    forgotPassword?(params: ForgotPasswordParams): Promise<ForgotPasswordResult>;
+    /**
+     * Confirms password reset with verification code and new password.
+     *
+     * @param params - Confirm password reset parameters
+     */
+    confirmPasswordReset?(params: ConfirmPasswordResetParams): Promise<boolean>;
+    /**
+     * Confirms user registration using a verification code.
+     *
+     * @param params - Confirm sign up parameters
+     */
+    confirmSignUp?(params: ConfirmSignUpParams): Promise<boolean>;
+    /**
+     * Resends the sign up confirmation code.
+     *
+     * @param params - Resend confirmation code parameters
+     */
+    resendConfirmationCode?(params: ResendConfirmationCodeParams): Promise<ResendConfirmationCodeResult>;
+    /**
+     * Retrieves a user by their unique ID.
+     *
+     * @param id - Unique user ID
+     */
+    getUserById?(id: string): Promise<UserIdentity | null>;
+    /**
+     * Retrieves a user by their identifier (email or username).
+     *
+     * @param identifier - Username or email string
+     */
+    getUserByIdentifier?(identifier: string): Promise<UserIdentity | null>;
+    /**
+     * Deletes a user account.
+     *
+     * @param id - Unique user ID
+     */
+    deleteUser?(id: string): Promise<void>;
+}
+/**
+ * Configuration options for Identity Providers in LixaConfig.
+ *
+ * @public
+ */
+type IdentityConfig = IIdentityProvider | ({
+    provider?: "self-managed";
+} & CredentialsConfig);
+
+/**
+ * User credentials entity representing stored account login information.
+ *
+ * @public
+ */
+interface UserCredentials {
+    /** Unique user identifier (UUID or Nanoid) */
+    id: string;
+    /** Primary unique lookup identifier (normalized lowercase username or email) */
+    identifier: string;
+    /** Username of the account */
+    username?: string | undefined;
+    /** Associated email address */
+    email?: string | undefined;
+    /** Securely hashed password string (e.g. Scrypt, Argon2, PBKDF2, Bcrypt) */
+    passwordHash: string;
+    /** Unix timestamp in milliseconds when user credentials were created */
+    createdAt: number;
+    /** Unix timestamp in milliseconds when user credentials were last updated */
+    updatedAt: number;
+    /** Optional custom user metadata or profile attributes */
+    metadata?: Record<string, unknown> | undefined;
+}
+/**
+ * Storage interface for managing user credentials.
+ *
+ * @remarks
+ * Implement this interface to persist credentials in custom databases
+ * (e.g. PostgreSQL, MySQL, SQLite, MongoDB, DynamoDB) or use provided adapters
+ * (PrismaCredentialsStorage, DrizzleCredentialsStorage).
+ *
+ * @public
+ */
+interface CredentialsStorage {
+    /**
+     * Persists a new user credential record.
+     *
+     * @param user - User credentials entity to save
+     */
+    saveUser(user: UserCredentials): Promise<void>;
+    /**
+     * Retrieves user credentials by normalized identifier (username or email).
+     *
+     * @param identifier - Normalized identifier string
+     * @returns UserCredentials record or null if not found
+     */
+    findUserByIdentifier(identifier: string): Promise<UserCredentials | null>;
+    /**
+     * Retrieves user credentials by unique user ID.
+     *
+     * @param id - Unique user ID
+     * @returns UserCredentials record or null if not found
+     */
+    findUserById(id: string): Promise<UserCredentials | null>;
+    /**
+     * Updates the password hash for a user by user ID.
+     *
+     * @param id - Unique user ID
+     * @param newPasswordHash - Newly computed password hash
+     */
+    updatePassword(id: string, newPasswordHash: string): Promise<void>;
+    /**
+     * Optional helper to delete a user by user ID.
+     *
+     * @param id - Unique user ID
+     */
+    deleteUser?(id: string): Promise<void>;
+    /**
+     * Optional helper to find user directly by username.
+     *
+     * @param username - Username string
+     */
+    findUserByUsername?(username: string): Promise<UserCredentials | null>;
+}
+/**
+ * Interface for password hashing and verification algorithms.
+ *
+ * @remarks
+ * Lixa defaults to ScryptPasswordHasher (Node.js crypto.scrypt, 0 dependencies).
+ * Implement this interface to use custom algorithms (e.g. bcrypt, argon2, pbkdf2).
+ *
+ * @public
+ */
+interface IPasswordHasher {
+    /**
+     * Computes a secure cryptographic hash for a plaintext password.
+     *
+     * @param password - Plaintext password
+     * @returns Formatted hash string containing salt and algorithm parameters
+     */
+    hash(password: string): Promise<string>;
+    /**
+     * Verifies a plaintext password against a stored hash string.
+     * Must use constant-time comparison to prevent timing attacks.
+     *
+     * @param password - Plaintext password to verify
+     * @param hash - Stored hash string
+     * @returns True if password matches hash, false otherwise
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+}
+/**
+ * Configuration options for password validation rules.
+ *
+ * @public
+ */
+interface PasswordPolicyConfig {
+    /**
+     * Minimum password length in characters.
+     *
+     * @default 8
+     */
+    minLength?: number | undefined;
+    /**
+     * Maximum password length in characters to prevent hashing DoS attacks.
+     *
+     * @default 128
+     */
+    maxLength?: number | undefined;
+    /**
+     * Require at least one uppercase letter [A-Z].
+     *
+     * @default false
+     */
+    requireUppercase?: boolean | undefined;
+    /**
+     * Require at least one lowercase letter [a-z].
+     *
+     * @default false
+     */
+    requireLowercase?: boolean | undefined;
+    /**
+     * Require at least one numeric digit [0-9].
+     *
+     * @default false
+     */
+    requireNumbers?: boolean | undefined;
+    /**
+     * Require at least one special symbol character.
+     *
+     * @default false
+     */
+    requireSpecialChars?: boolean | undefined;
+    /**
+     * Optional custom validator function for enterprise or custom rules.
+     * Return `true` if valid, or `false` / custom error message string if invalid.
+     */
+    customValidator?: ((password: string) => boolean | string | Promise<boolean | string>) | undefined;
+}
+/**
+ * Result of password policy validation.
+ *
+ * @public
+ */
+interface PasswordPolicyResult {
+    /** Whether the password satisfied all configured rules */
+    valid: boolean;
+    /** List of human-readable error descriptions if validation failed */
+    errors: string[];
+}
+/**
+ * Configuration options for Credentials authentication in Lixa.
+ *
+ * @public
+ */
+interface CredentialsConfig {
+    /**
+     * Explicitly enable or disable credentials authentication.
+     *
+     * @default true
+     */
+    enabled?: boolean | undefined;
+    /**
+     * Custom storage implementation for persisting user credentials.
+     * Defaults to LocalCredentialsStorage (in-memory, suitable for dev & testing).
+     */
+    storage?: CredentialsStorage | undefined;
+    /**
+     * Custom password hashing strategy.
+     * Defaults to ScryptPasswordHasher (Node.js crypto.scrypt).
+     */
+    hasher?: IPasswordHasher | undefined;
+    /**
+     * Password strength policy configuration.
+     */
+    policy?: PasswordPolicyConfig | undefined;
+    /**
+     * Supported identifier types for registration and sign-in:
+     * - 'email': Identifier must be a valid email format
+     * - 'username': Identifier can be any username string
+     * - 'both': Automatically detect email or username
+     *
+     * @default 'both'
+     */
+    identifierType?: ("email" | "username" | "both") | undefined;
+    /**
+     * Whether a username is strictly required during registration (signUp).
+     *
+     * @default false
+     */
+    requireUsername?: boolean | undefined;
+    /**
+     * Whether a valid email address is strictly required during registration (signUp).
+     *
+     * @default false
+     */
+    requireEmail?: boolean | undefined;
+    /**
+     * Whether to perform dummy hash verification on unknown users to mitigate timing attacks.
+     *
+     * @default true
+     */
+    timingAttackProtection?: boolean | undefined;
+    /**
+     * Whether to automatically generate and save a session upon successful registration (signUp).
+     *
+     * @default true
+     */
+    autoCreateSessionOnSignUp?: boolean | undefined;
+    /**
+     * Session expiration time in seconds for credentials-generated sessions.
+     *
+     * @default 86400 (24 hours)
+     */
+    sessionTtlSeconds?: number | undefined;
+}
+/**
+ * Parameters for user registration (signUp).
+ *
+ * @public
+ */
+interface SignUpParams {
+    /** Username for the user (can be used directly instead of identifier) */
+    username?: string | undefined;
+    /** Primary identifier (username or email) */
+    identifier?: string | undefined;
+    /** Plaintext password */
+    password: string;
+    /** Optional explicit email address */
+    email?: string | undefined;
+    /** Optional custom user metadata */
+    metadata?: Record<string, unknown> | undefined;
+}
+/**
+ * Result of user registration (signUp).
+ *
+ * @public
+ */
+interface SignUpResult<TSession = Session, TUser = UserIdentity> {
+    /** Created user profile / credentials (with passwordHash omitted for safety) */
+    user: TUser;
+    /** Created session ID if autoCreateSessionOnSignUp is enabled */
+    sessionId?: string | undefined;
+    /** Created session object if autoCreateSessionOnSignUp is enabled */
+    session?: TSession | undefined;
+}
+/**
+ * Parameters for user authentication (signIn).
+ *
+ * @public
+ */
+interface SignInParams {
+    /** Username or email of the account */
+    username?: string | undefined;
+    /** Primary identifier (username or email) */
+    identifier?: string | undefined;
+    /** Plaintext password */
+    password: string;
+}
+/**
+ * Result of user authentication (signIn).
+ *
+ * @public
+ */
+interface SignInResult<TSession = Session, TUser = UserIdentity> {
+    /** Authenticated user profile / credentials (with passwordHash omitted for safety) */
+    user: TUser;
+    /** Active session ID */
+    sessionId: string;
+    /** Active session object */
+    session: TSession;
+}
+/**
+ * Parameters for raw credential verification without session creation.
+ *
+ * @public
+ */
+interface VerifyCredentialsParams {
+    /** Username or email of the account */
+    username?: string | undefined;
+    /** Primary identifier (username or email) */
+    identifier?: string | undefined;
+    /** Plaintext password */
+    password: string;
+}
+/**
+ * Parameters for changing a user password.
+ *
+ * @public
+ */
+interface ChangePasswordParams {
+    /** Username (optional if identifier or userId is provided) */
+    username?: string | undefined;
+    /** Primary identifier (optional if username or userId is provided) */
+    identifier?: string | undefined;
+    /** Unique user ID (optional if identifier or username is provided) */
+    userId?: string | undefined;
+    /** Current plaintext password */
+    oldPassword: string;
+    /** New plaintext password */
+    newPassword: string;
+}
+
+/**
+ * Options for Scrypt password hashing.
+ *
+ * @public
+ */
+interface ScryptHasherOptions {
+    /** CPU/memory cost parameter (must be power of 2). Default: 16384 (2^14) */
+    cost?: number;
+    /** Block size parameter. Default: 8 */
+    blockSize?: number;
+    /** Parallelization parameter. Default: 1 */
+    parallelization?: number;
+    /** Salt length in bytes. Default: 16 */
+    saltLength?: number;
+    /** Derived key length in bytes. Default: 64 */
+    keyLength?: number;
+    /** Max memory allocated in bytes. Default: 32MB */
+    maxmem?: number;
+}
+/**
+ * Default secure password hasher utilizing Node.js native `crypto.scrypt`.
+ *
+ * @remarks
+ * Produces PHC-formatted strings: `$scrypt$N=16384,r=8,p=1$<saltHex>$<keyHex>`.
+ * Verification uses constant-time `crypto.timingSafeEqual` to prevent timing attacks.
+ *
+ * @public
+ */
+declare class ScryptPasswordHasher implements IPasswordHasher {
+    private readonly cost;
+    private readonly blockSize;
+    private readonly parallelization;
+    private readonly saltLength;
+    private readonly keyLength;
+    private readonly maxmem;
+    constructor(options?: ScryptHasherOptions);
+    /**
+     * Hashes a plaintext password using Scrypt.
+     *
+     * @param password - Plaintext password
+     * @returns Formatted Scrypt hash string
+     */
+    hash(password: string): Promise<string>;
+    /**
+     * Verifies a password against a stored Scrypt hash.
+     *
+     * @param password - Plaintext password
+     * @param hash - Formatted Scrypt hash string
+     * @returns True if password matches hash
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+    private deriveKey;
+}
+/**
+ * Options for PBKDF2 password hashing.
+ *
+ * @public
+ */
+interface Pbkdf2HasherOptions {
+    /** Iteration count. Default: 100000 */
+    iterations?: number;
+    /** HMAC digest algorithm. Default: 'sha512' */
+    digest?: string;
+    /** Salt length in bytes. Default: 16 */
+    saltLength?: number;
+    /** Derived key length in bytes. Default: 64 */
+    keyLength?: number;
+}
+/**
+ * Alternative password hasher using Node.js native `crypto.pbkdf2`.
+ *
+ * @remarks
+ * Produces PHC-formatted strings: `$pbkdf2$i=100000,d=sha512$<saltHex>$<keyHex>`.
+ *
+ * @public
+ */
+declare class Pbkdf2PasswordHasher implements IPasswordHasher {
+    private readonly iterations;
+    private readonly digest;
+    private readonly saltLength;
+    private readonly keyLength;
+    constructor(options?: Pbkdf2HasherOptions);
+    hash(password: string): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    private deriveKey;
+}
+
+/**
+ * Validates a plaintext password against configured password policy rules.
+ *
+ * @param password - Plaintext password to evaluate
+ * @param policy - Optional custom policy configuration
+ * @returns PasswordPolicyResult containing boolean valid flag and error messages
+ *
+ * @public
+ */
+declare function validatePasswordPolicy(password: string, policy?: PasswordPolicyConfig): Promise<PasswordPolicyResult>;
+
+/**
+ * In-memory credentials storage for development, testing, and isolated environments.
+ *
+ * @remarks
+ * Uses instance-isolated Maps to prevent state leakage across tests or Lixa instances.
+ *
+ * @public
+ */
+declare class LocalCredentialsStorage implements CredentialsStorage {
+    private usersById;
+    private identifierToId;
+    saveUser(user: UserCredentials): Promise<void>;
+    findUserByIdentifier(identifier: string): Promise<UserCredentials | null>;
+    findUserById(id: string): Promise<UserCredentials | null>;
+    updatePassword(id: string, newPasswordHash: string): Promise<void>;
+    deleteUser(id: string): Promise<void>;
+    clear(): void;
+}
+
+/**
+ * Coordinates user registration, authentication, password verification, policy enforcement,
+ * and timing attack protection.
+ *
+ * @public
+ */
+declare class CredentialsManager {
+    private readonly storage;
+    private readonly hasher;
+    private readonly policy;
+    private readonly identifierType;
+    private readonly requireUsername;
+    private readonly requireEmail;
+    private readonly timingAttackProtection;
+    private dummyHash;
+    constructor(config?: CredentialsConfig);
+    private initDummyHash;
+    /**
+     * Normalizes an identifier string.
+     */
+    private normalizeIdentifier;
+    /**
+     * Validates identifier format based on configured identifierType.
+     */
+    private validateIdentifierFormat;
+    /**
+     * Registers a new user with password hashing and policy enforcement.
+     *
+     * @param params - Registration parameters
+     * @returns Created user credentials without password hash
+     */
+    signUp(params: SignUpParams): Promise<Omit<UserCredentials, "passwordHash">>;
+    /**
+     * Verifies credentials against storage with timing attack protection.
+     *
+     * @param params - Verification parameters
+     * @returns User credentials without password hash, or null if verification fails
+     */
+    verifyCredentials(params: VerifyCredentialsParams): Promise<Omit<UserCredentials, "passwordHash"> | null>;
+    /**
+     * Changes a user's password with old password verification and new password policy enforcement.
+     *
+     * @param params - Change password parameters
+     * @returns True if password was successfully updated
+     */
+    changePassword(params: ChangePasswordParams): Promise<boolean>;
+    /**
+     * Finds a user by ID and returns safe user data.
+     */
+    getUserById(id: string): Promise<Omit<UserCredentials, "passwordHash"> | null>;
+    /**
+     * Finds a user by identifier and returns safe user data.
+     */
+    getUserByIdentifier(identifier: string): Promise<Omit<UserCredentials, "passwordHash"> | null>;
+    /**
+     * Gets the underlying storage instance.
+     */
+    getStorage(): CredentialsStorage;
+    /**
+     * Gets the underlying hasher instance.
+     */
+    getHasher(): IPasswordHasher;
+}
+
+/**
+ * Self-Managed Identity Provider implementation for Lixa.
+ *
+ * @remarks
+ * Backed by custom database storage (Prisma, Drizzle, PostgreSQL, SQLite, MongoDB)
+ * or local in-memory storage, with cryptographic password hashing (Scrypt, Argon2, PBKDF2)
+ * and configurable password policy enforcement.
+ *
+ * @public
+ */
+declare class SelfManagedIdentityProvider implements IIdentityProvider {
+    readonly name: string;
+    private readonly manager;
+    constructor(configOrManager?: CredentialsConfig | CredentialsManager);
+    private mapUser;
+    /**
+     * Registers a new user.
+     */
+    signUp(params: SignUpParams): Promise<UserIdentity>;
+    /**
+     * Authenticates a user with password.
+     */
+    signIn(params: SignInParams): Promise<IdentityAuthResult>;
+    /**
+     * Verifies credentials without throwing an error if invalid.
+     */
+    verifyCredentials(params: VerifyCredentialsParams): Promise<UserIdentity | null>;
+    /**
+     * Changes a user's password.
+     */
+    changePassword(params: ChangePasswordParams): Promise<boolean>;
+    /**
+     * Retrieves a user by their unique ID.
+     */
+    getUserById(id: string): Promise<UserIdentity | null>;
+    /**
+     * Retrieves a user by their identifier (email or username).
+     */
+    getUserByIdentifier(identifier: string): Promise<UserIdentity | null>;
+    /**
+     * Deletes a user from storage if supported by the storage adapter.
+     */
+    deleteUser(id: string): Promise<void>;
+    /**
+     * Returns the underlying CredentialsManager instance.
+     */
+    getCredentialsManager(): CredentialsManager;
 }
 
 /**
@@ -703,8 +1492,13 @@ type ProviderConfig = {
     clientSecret: string;
     /** The redirect URI registered with the provider */
     redirectUri: string;
-    /** Array of OAuth scopes to request */
-    scopes: string[];
+    /** Array of OAuth scopes to request. If omitted, uses provider default identity scopes. */
+    scopes?: string[];
+    /**
+     * Default scopes requested when connecting this provider as a third-party resource (AuthZ).
+     * Used automatically by getResourceAuthUrl() and handleResourceCallback() if not overridden at runtime.
+     */
+    resourceScopes?: string[];
     /**
      * Set to true to allow non-identity (resource) scopes during primary authentication flow.
      * By default (false), Lixa restricts primary AuthN scopes to identity scopes to maintain
@@ -822,6 +1616,18 @@ interface AccountLinkingConfig {
      */
     requireVerifiedEmail?: boolean;
 }
+/**
+ * Unified storage adapter interface (e.g. Prisma or Drizzle adapter).
+ * When provided to Lixa via config.storage, automatically configures session, state, and resource storage.
+ * @public
+ */
+interface StorageAdapter {
+    sessionStorage?: any;
+    resourceStorage?: any;
+    stateStorage?: any;
+    credentialsStorage?: any;
+    accountStorage?: any;
+}
 /**
  * Main configuration object for Lixa.
  * Provides type-safe provider name inference.
@@ -830,14 +1636,50 @@ interface AccountLinkingConfig {
  */
 interface LixaConfig<TProviders extends Record<string, ProviderConfig> = Record<string, ProviderConfig>> {
     /**
-     * Map of provider names to their configurations.
+     * Map of federated OAuth 2.0 / OIDC provider names to their configurations (Google, GitHub, etc.)
+     * that federate with and work alongside the primary identityProvider.
      * Provider names will be available for autocomplete in getAuthUrl() and handleCallback().
      */
-    providers: TProviders;
+    federatedOAuthProviders?: TProviders;
+    /**
+     * Alias for {@link LixaConfig.federatedOAuthProviders}.
+     */
+    providers?: TProviders;
+    /**
+     * Primary Identity Provider configuration (Self-Managed Database, AWS Cognito, Auth0, Okta, or custom IIdentityProvider).
+     *
+     * @example
+     * Self-managed with Prisma:
+     * ```typescript
+     * identityProvider: { storage: prismaAdapter.credentialsStorage }
+     * ```
+     *
+     * @example
+     * AWS Cognito:
+     * ```typescript
+     * identityProvider: new CognitoIdentityProvider({ userPoolId: '...', clientId: '...', region: 'us-east-1' })
+     * ```
+     */
+    identityProvider?: IIdentityProvider | IdentityConfig;
+    /**
+     * Alias for {@link LixaConfig.identityProvider}.
+     */
+    identity?: IIdentityProvider | IdentityConfig;
+    /**
+     * Credentials (username and password) authentication configuration.
+     * Automatically maps to a SelfManagedIdentityProvider.
+     */
+    credentials?: CredentialsConfig;
+    /**
+     * Unified database storage adapter (e.g. createPrismaAdapter or createDrizzleAdapter).
+     * Automatically configures sessionHandler, stateHandler, and resourceHandler.
+     */
+    storage?: StorageAdapter;
     /**
      * Account linking configuration for multi-SSO user linking.
+     * Pass `true` or `"linkByEmail"` for automatic email-verified linking.
      */
-    accountLinking?: AccountLinkingConfig;
+    accountLinking?: boolean | AccountLinkingMode | AccountLinkingConfig;
     /**
      * Optional custom state handler.
      * Handles state generation and storage during OAuth authorization flow.
@@ -881,7 +1723,30 @@ interface LixaConfig<TProviders extends Record<string, ProviderConfig> = Record<
      * If provided, all Lixa logs will be routed through this logger.
      */
     logger?: LixaLogger;
+    /**
+     * Session cookie name or dynamic resolution function.
+     * Can accept a static string or `(lixa: Lixa, req?: unknown) => string`.
+     * Automatically evaluated live against the instance when getSessionCookieName() is called.
+     */
+    sessionCookieName?: SessionCookieResolver;
 }
+/**
+ * Interface exposing identity information for dynamic session cookie name resolution.
+ * @public
+ */
+interface LixaCookieContext {
+    /**
+     * Retrieves the currently active identity provider.
+     */
+    getIdentityProvider(): IIdentityProvider | undefined;
+}
+/**
+ * Dynamic resolver for session cookie name.
+ * Can be a static string or a dynamic callback receiving the Lixa instance and an optional request context.
+ *
+ * @public
+ */
+type SessionCookieResolver<TContext extends LixaCookieContext = LixaCookieContext> = string | ((lixa: TContext, req?: unknown) => string);
 /**
  * Log level for Lixa structured logging.
  * @public
@@ -891,7 +1756,7 @@ type LogLevel = "INFO" | "WARN" | "ERROR" | "DEBUG";
  * Log context for Lixa structured logging.
  * @public
  */
-type LogContext = "Init" | "Auth" | "Token" | "Session" | "State" | "AccountLinking" | "Resource";
+type LogContext = "Init" | "Auth" | "Token" | "Session" | "State" | "AccountLinking" | "Resource" | "Credentials" | "Identity";
 /**
  * Custom logger interface for Lixa.
  * @public
@@ -915,7 +1780,7 @@ type SafeLixaConfig<TProviders extends Record<string, ProviderConfig>> = LixaCon
 /**
  * Type representing the keys of configured providers
  */
-type ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>> = keyof T['providers'];
+type ConfiguredProviderKey<TProviders extends Record<string, ProviderConfig>> = keyof TProviders & string;
 /**
  * A flexible, provider-agnostic OAuth 2.0 and OpenID Connect (OIDC) client library.
  *
@@ -968,19 +1833,25 @@ type ConfiguredProviderKey<T extends LixaConfig<Record<string, ProviderConfig>>>
  *
  * @public
  */
-declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> = LixaConfig> {
+declare class Lixa<TProviders extends Record<string, ProviderConfig> = Record<string, ProviderConfig>> {
     private static DEFAULT_PROVIDERS;
     private static CONFIGURED_PROVIDERS;
     private localStateHandler;
     private localSessionHandler;
     private localResourceHandler;
+    private localAccountHandler;
     private userResourceStore;
+    private userAccountStore;
     private refreshMutexes;
+    private identityProvider?;
+    private credentialsManager?;
     private config;
     private stateHandler;
     private sessionHandler;
     private resourceHandler;
+    private accountHandler;
     private debug;
+    private sessionCookieResolver?;
     /**
      * Creates a new Lixa instance with the provided configuration.
      *
@@ -994,7 +1865,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      * @throws Error when provider implementation is missing required properties
      * @throws Error when provider is not available and no inline implementation is provided
      */
-    constructor(config: TConfig);
+    constructor(config: LixaConfig<TProviders>);
     /**
      * Validates that a provider configuration has all required credentials.
      *
@@ -1015,7 +1886,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      * Structured logging with standardized format and custom logger support.
      *
      * @param level - Log level (INFO, WARN, ERROR, DEBUG)
-     * @param context - Context of the log (Init, Auth, Token, Session, State, AccountLinking, Resource)
+     * @param context - Context of the log (Init, Auth, Token, Session, State, AccountLinking, Resource, Credentials)
      * @param message - Log message
      * @param data - Optional data to log
      */
@@ -1035,7 +1906,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      * }
      * ```
      */
-    isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TConfig>;
+    isProviderConfigured<T extends string>(provider: T): provider is T & ConfiguredProviderKey<TProviders>;
     /**
      * Gets a provider implementation by name.
      * Resolution priority: inline custom provider \> default providers \> legacy registry
@@ -1109,7 +1980,9 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     static createConfig<T extends Record<string, ProviderConfig>>(config: LixaConfig<T> & {
         providers: T;
-    }): LixaConfig<T>;
+    }): LixaConfig<T> & {
+        providers: T;
+    };
     /**
      * Generates a cryptographically secure random state parameter for OAuth flows.
      *
@@ -1214,7 +2087,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      * res.redirect(authUrl);
      * ```
      */
-    getAuthUrl(provider: ConfiguredProviderKey<TConfig> | string, state?: string): Promise<string>;
+    getAuthUrl(provider: ConfiguredProviderKey<TProviders> | string, state?: string): Promise<string>;
     /**
      * Restricts primary authentication scopes strictly to AuthN identity scopes unless allowNonAuthScopes is true.
      */
@@ -1238,10 +2111,11 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      * });
      * ```
      */
-    handleCallback({ provider, code, state, }: {
-        provider: ConfiguredProviderKey<TConfig> | string;
+    handleCallback({ provider, code, state, sessionId, }: {
+        provider: ConfiguredProviderKey<TProviders> | string;
         code: string;
         state?: string;
+        sessionId?: string;
     }): Promise<string>;
     /**
      * Explicitly link a new OAuth provider account to an active session.
@@ -1251,7 +2125,7 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     linkAccount(params: {
         sessionId: string;
-        provider: ConfiguredProviderKey<TConfig> | string;
+        provider: ConfiguredProviderKey<TProviders> | string;
         code: string;
         state?: string;
     }): Promise<string>;
@@ -1276,8 +2150,8 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     getResourceAuthUrl(params: {
         sessionId: string;
-        provider: ConfiguredProviderKey<TConfig> | string;
-        scopes: string[];
+        provider: ConfiguredProviderKey<TProviders> | string;
+        scopes?: string[];
         state?: string;
         prompt?: string;
         extraConfig?: Record<string, string>;
@@ -1288,11 +2162,32 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     handleResourceCallback(params: {
         sessionId: string;
-        provider: ConfiguredProviderKey<TConfig> | string;
+        provider: ConfiguredProviderKey<TProviders> | string;
         code: string;
         state?: string;
         scopes?: string[];
     }): Promise<Session>;
+    /**
+     * Retrieves configured default resource scopes for a provider.
+     *
+     * @param provider - Provider name (e.g. 'github', 'google')
+     * @returns Array of configured resource scopes, or undefined if not configured
+     */
+    getResourceScopes(provider: ConfiguredProviderKey<TProviders> | string): string[] | undefined;
+    /**
+     * Returns the resolved session cookie name.
+     * Dynamically reflects any changes to the active identity provider.
+     *
+     * @param req - Optional request object for multi-tenant request-scoped cookie resolution
+     * @returns Resolved session cookie name
+     */
+    getSessionCookieName(req?: unknown): string;
+    /**
+     * Sets or updates the session cookie name or dynamic resolver on this instance.
+     *
+     * @param resolver - Static cookie name or dynamic resolver function
+     */
+    setSessionCookieName(resolver: SessionCookieResolver<Lixa<TProviders>>): void;
     /**
      * Retrieves a connected resource for a specific User ID / Email directly (independent of session IDs).
      * Automatically refreshes expired access tokens if a refresh token is present.
@@ -1347,6 +2242,126 @@ declare class Lixa<TConfig extends LixaConfig<Record<string, ProviderConfig>> =
      */
     deleteSession(sessionId: string): Promise<void>;
     private exchangeCodeForToken;
+    /**
+     * Checks if an identity provider (Self-Managed Database, AWS Cognito, Auth0, Okta, etc.) is configured.
+     *
+     * @returns True if identity provider is configured and available
+     */
+    isIdentityEnabled(): boolean;
+    /**
+     * Checks if credentials / identity authentication is configured and enabled.
+     *
+     * @returns True if credentials / identity authentication is available
+     */
+    isCredentialsEnabled(): boolean;
+    /**
+     * Returns the configured IdentityProvider instance.
+     */
+    getIdentityProvider(): IIdentityProvider | undefined;
+    /**
+     * Dynamically sets or updates the active identity provider (e.g. SelfManaged, Cognito, Auth0, Okta).
+     *
+     * @param provider - Identity provider instance or undefined to disable
+     */
+    setIdentityProvider(provider?: IIdentityProvider): void;
+    /**
+     * Returns the underlying CredentialsManager instance if using Self-Managed identity.
+     */
+    getCredentialsManager(): CredentialsManager | undefined;
+    /**
+     * Registers a new user with the configured identity provider (Self-Managed DB, Cognito, Auth0, Okta).
+     * Automatically creates an active session unless autoCreateSessionOnSignUp is explicitly set to false.
+     *
+     * @param params - Registration parameters (identifier, password, email, username, metadata)
+     * @returns Created user identity and optional active session
+     * @throws WeakPasswordError if password does not meet policy requirements
+     * @throws UserAlreadyExistsError if identifier is already registered
+     * @throws IdentityNotConfiguredError if identity authentication is not configured
+     */
+    signUp(params: SignUpParams): Promise<SignUpResult>;
+    /**
+     * Authenticates a user with credentials via the configured identity provider (Self-Managed DB, Cognito, Auth0, Okta).
+     * Creates an active session and automatically links with existing sessions when AUTO_LINK_BY_VERIFIED_EMAIL is configured.
+     *
+     * @param params - Sign-in parameters (identifier, password)
+     * @returns Authenticated user, session ID, and session object
+     * @throws InvalidCredentialsError if authentication fails
+     * @throws IdentityNotConfiguredError if identity authentication is not configured
+     */
+    signIn(params: SignInParams): Promise<SignInResult>;
+    /**
+     * Verifies username/email and password credentials without generating a session.
+     *
+     * @param params - Verification parameters (identifier, password)
+     * @returns User credentials/identity or null if invalid
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     */
+    verifyCredentials(params: VerifyCredentialsParams): Promise<UserIdentity | null>;
+    /**
+     * Updates a user's password after verifying the current password and enforcing policy on the new password.
+     *
+     * @param params - Change password parameters (userId/identifier, oldPassword, newPassword)
+     * @returns True if password was updated successfully
+     * @throws UserNotFoundError if user is not found
+     * @throws InvalidCredentialsError if current password is incorrect
+     * @throws WeakPasswordError if new password does not meet policy requirements
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     */
+    changePassword(params: ChangePasswordParams): Promise<boolean>;
+    /**
+     * Initiates a password reset (forgot password flow) through the configured identity provider.
+     *
+     * @param params - Forgot password parameters (identifier, optional metadata)
+     * @returns ForgotPasswordResult indicating status and delivery medium (email/SMS)
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     */
+    forgotPassword(params: ForgotPasswordParams): Promise<ForgotPasswordResult>;
+    /**
+     * Confirms a password reset using a verification code / token and sets the new password.
+     *
+     * @param params - Verification code, identifier, and new password
+     * @returns True if password reset was successfully confirmed
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     */
+    confirmPasswordReset(params: ConfirmPasswordResetParams): Promise<boolean>;
+    /**
+     * Confirms user account registration using a verification code.
+     *
+     * @param params - Verification parameters including identifier and confirmationCode
+     * @returns True if confirmation was successful
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     * @throws IdentityProviderError if identity provider does not support confirmation
+     */
+    confirmSignUp(params: ConfirmSignUpParams): Promise<boolean>;
+    /**
+     * Resends the sign up confirmation code to the user.
+     *
+     * @param params - Resend parameters including user identifier
+     * @returns Details about the code delivery (medium, destination)
+     * @throws IdentityNotConfiguredError if identity auth is not configured
+     * @throws IdentityProviderError if identity provider does not support resending codes
+     */
+    resendConfirmationCode(params: ResendConfirmationCodeParams): Promise<ResendConfirmationCodeResult>;
+    /**
+     * Retrieves a user by their unique ID from the configured identity provider.
+     *
+     * @param id - Unique user ID
+     * @returns UserIdentity or null if not found
+     */
+    getUserById(id: string): Promise<UserIdentity | null>;
+    /**
+     * Retrieves a user by their identifier (username or email) from the configured identity provider.
+     *
+     * @param identifier - Username or email string
+     * @returns UserIdentity or null if not found
+     */
+    getUserByIdentifier(identifier: string): Promise<UserIdentity | null>;
+    /**
+     * Deletes a user account from the configured identity provider.
+     *
+     * @param id - Unique user ID
+     */
+    deleteUser(id: string): Promise<void>;
     private findProviderByType;
 }
 
@@ -1520,6 +2535,67 @@ declare class AccountUnlinkError extends LixaError {
 declare class RefreshTokenError extends LixaError {
     constructor(message: string, details?: Record<string, unknown>);
 }
+/**
+ * Thrown when user credentials (username/email and password) are invalid during authentication.
+ *
+ * @public
+ */
+declare class InvalidCredentialsError extends LixaError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when attempting to register a user with an identifier that already exists.
+ *
+ * @public
+ */
+declare class UserAlreadyExistsError extends LixaError {
+    constructor(identifier: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when a user account cannot be found for credential verification or password change.
+ *
+ * @public
+ */
+declare class UserNotFoundError extends LixaError {
+    constructor(identifierOrId?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when a password does not satisfy configured password policy rules.
+ *
+ * @public
+ */
+declare class WeakPasswordError extends LixaError {
+    readonly validationErrors: string[];
+    constructor(validationErrors?: string[], details?: Record<string, unknown>);
+}
+/**
+ * Thrown when credentials operations (signUp, signIn, etc.) are invoked on a Lixa instance
+ * where credentials authentication is not enabled.
+ *
+ * @public
+ */
+declare class CredentialsNotConfiguredError extends LixaError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when an identity provider operation fails with an upstream provider error.
+ *
+ * @public
+ */
+declare class IdentityProviderError extends LixaError {
+    readonly provider: string | undefined;
+    readonly statusCode: number | undefined;
+    constructor(message: string, provider?: string, statusCode?: number, details?: Record<string, unknown>);
+}
+/**
+ * Thrown when identity operations (signUp, signIn, etc.) are invoked on a Lixa instance
+ * where neither identity nor credentials authentication is enabled.
+ *
+ * @public
+ */
+declare class IdentityNotConfiguredError extends CredentialsNotConfiguredError {
+    constructor(message?: string, details?: Record<string, unknown>);
+}
 
 /**
  * Sensible default cookie configuration options.
@@ -1663,4 +2739,48 @@ declare function createStateCookie(state: string, options?: CookieOptions): Cook
  */
 declare function clearStateCookie(options?: CookieOptions): CookiePayload;
 
-export { type AccountLinkingConfig, type AccountLinkingMode, AccountLinkingStrategy, AccountUnlinkError, type ConnectedResource, type CookieOptions, type CookiePayload, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_SESSION_MAX_AGE_SECONDS, DEFAULT_STATE_COOKIE_NAME, DEFAULT_STATE_MAX_AGE_SECONDS, EmailNotVerifiedError, type IProvider, InvalidOAuthCallbackError, InvalidProviderConfigError, InvalidStateError, Lixa, type LixaConfig, LixaError, type LixaLogger, type LogContext, type LogLevel, type OAuthTokenResponse, type ProviderConfig, type ProviderMetadata, ProviderNotConfiguredError, RefreshTokenError, type ResourceHandler, type ResourceStorage, type SafeLixaConfig, type Session, type SessionHandler, SessionNotFoundError, type SessionStorage, type StateData, type StateHandler, type StateStorage, TokenExchangeError, type UserInfo, clearSessionCookie, clearStateCookie, createSessionCookie, createStateCookie, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo, isProductionEnvironment, serializeCookie };
+type index$1_ChangePasswordParams = ChangePasswordParams;
+type index$1_CredentialsConfig = CredentialsConfig;
+type index$1_CredentialsManager = CredentialsManager;
+declare const index$1_CredentialsManager: typeof CredentialsManager;
+type index$1_CredentialsStorage = CredentialsStorage;
+type index$1_IPasswordHasher = IPasswordHasher;
+type index$1_LocalCredentialsStorage = LocalCredentialsStorage;
+declare const index$1_LocalCredentialsStorage: typeof LocalCredentialsStorage;
+type index$1_PasswordPolicyConfig = PasswordPolicyConfig;
+type index$1_PasswordPolicyResult = PasswordPolicyResult;
+type index$1_Pbkdf2HasherOptions = Pbkdf2HasherOptions;
+type index$1_Pbkdf2PasswordHasher = Pbkdf2PasswordHasher;
+declare const index$1_Pbkdf2PasswordHasher: typeof Pbkdf2PasswordHasher;
+type index$1_ScryptHasherOptions = ScryptHasherOptions;
+type index$1_ScryptPasswordHasher = ScryptPasswordHasher;
+declare const index$1_ScryptPasswordHasher: typeof ScryptPasswordHasher;
+type index$1_SignInParams = SignInParams;
+type index$1_SignInResult<TSession = Session, TUser = UserIdentity> = SignInResult<TSession, TUser>;
+type index$1_SignUpParams = SignUpParams;
+type index$1_SignUpResult<TSession = Session, TUser = UserIdentity> = SignUpResult<TSession, TUser>;
+type index$1_UserCredentials = UserCredentials;
+type index$1_VerifyCredentialsParams = VerifyCredentialsParams;
+declare const index$1_validatePasswordPolicy: typeof validatePasswordPolicy;
+declare namespace index$1 {
+  export { type index$1_ChangePasswordParams as ChangePasswordParams, type index$1_CredentialsConfig as CredentialsConfig, index$1_CredentialsManager as CredentialsManager, type index$1_CredentialsStorage as CredentialsStorage, type index$1_IPasswordHasher as IPasswordHasher, index$1_LocalCredentialsStorage as LocalCredentialsStorage, type index$1_PasswordPolicyConfig as PasswordPolicyConfig, type index$1_PasswordPolicyResult as PasswordPolicyResult, type index$1_Pbkdf2HasherOptions as Pbkdf2HasherOptions, index$1_Pbkdf2PasswordHasher as Pbkdf2PasswordHasher, type index$1_ScryptHasherOptions as ScryptHasherOptions, index$1_ScryptPasswordHasher as ScryptPasswordHasher, type index$1_SignInParams as SignInParams, type index$1_SignInResult as SignInResult, type index$1_SignUpParams as SignUpParams, type index$1_SignUpResult as SignUpResult, type index$1_UserCredentials as UserCredentials, type index$1_VerifyCredentialsParams as VerifyCredentialsParams, index$1_validatePasswordPolicy as validatePasswordPolicy };
+}
+
+type index_ConfirmPasswordResetParams = ConfirmPasswordResetParams;
+type index_ConfirmSignUpParams = ConfirmSignUpParams;
+type index_ForgotPasswordParams = ForgotPasswordParams;
+type index_ForgotPasswordResult = ForgotPasswordResult;
+type index_IIdentityProvider = IIdentityProvider;
+type index_IdentityAuthResult = IdentityAuthResult;
+type index_IdentityConfig = IdentityConfig;
+type index_IdentityTokens = IdentityTokens;
+type index_ResendConfirmationCodeParams = ResendConfirmationCodeParams;
+type index_ResendConfirmationCodeResult = ResendConfirmationCodeResult;
+type index_SelfManagedIdentityProvider = SelfManagedIdentityProvider;
+declare const index_SelfManagedIdentityProvider: typeof SelfManagedIdentityProvider;
+type index_UserIdentity = UserIdentity;
+declare namespace index {
+  export { type index_ConfirmPasswordResetParams as ConfirmPasswordResetParams, type index_ConfirmSignUpParams as ConfirmSignUpParams, type index_ForgotPasswordParams as ForgotPasswordParams, type index_ForgotPasswordResult as ForgotPasswordResult, type index_IIdentityProvider as IIdentityProvider, type index_IdentityAuthResult as IdentityAuthResult, type index_IdentityConfig as IdentityConfig, type index_IdentityTokens as IdentityTokens, type index_ResendConfirmationCodeParams as ResendConfirmationCodeParams, type index_ResendConfirmationCodeResult as ResendConfirmationCodeResult, index_SelfManagedIdentityProvider as SelfManagedIdentityProvider, type index_UserIdentity as UserIdentity };
+}
+
+export { type AccountHandler, type AccountLinkingConfig, type AccountLinkingMode, AccountLinkingStrategy, type AccountStorage, AccountUnlinkError, type ChangePasswordParams, type ConfirmPasswordResetParams, type ConfirmSignUpParams, type ConnectedResource, type CookieOptions, type CookiePayload, type CredentialsConfig, CredentialsManager, CredentialsNotConfiguredError, type CredentialsStorage, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_SESSION_MAX_AGE_SECONDS, DEFAULT_STATE_COOKIE_NAME, DEFAULT_STATE_MAX_AGE_SECONDS, EmailNotVerifiedError, type ForgotPasswordParams, type ForgotPasswordResult, type IIdentityProvider, type IPasswordHasher, type IProvider, type IdentityAuthResult, type IdentityConfig, IdentityNotConfiguredError, IdentityProviderError, type IdentityTokens, InvalidCredentialsError, InvalidOAuthCallbackError, InvalidProviderConfigError, InvalidStateError, type LinkedAccount, Lixa, type LixaConfig, type LixaCookieContext, LixaError, type LixaLogger, LocalCredentialsStorage, type LogContext, type LogLevel, type OAuthTokenResponse, type PasswordPolicyConfig, type PasswordPolicyResult, type Pbkdf2HasherOptions, Pbkdf2PasswordHasher, type ProviderConfig, type ProviderMetadata, ProviderNotConfiguredError, RefreshTokenError, type ResendConfirmationCodeParams, type ResendConfirmationCodeResult, type ResourceHandler, type ResourceStorage, type SafeLixaConfig, type ScryptHasherOptions, ScryptPasswordHasher, SelfManagedIdentityProvider, type Session, type SessionCookieResolver, type SessionHandler, SessionNotFoundError, type SessionStorage, type SignInParams, type SignInResult, type SignUpParams, type SignUpResult, type StateData, type StateHandler, type StateStorage, TokenExchangeError, UserAlreadyExistsError, type UserCredentials, type UserIdentity, type UserInfo, UserNotFoundError, type VerifyCredentialsParams, WeakPasswordError, clearSessionCookie, clearStateCookie, createSessionCookie, createStateCookie, index$1 as credentials, decodeIdToken, determineProviderFromIssuer, extractUserInfo, fetchUserInfo, index as identity, isProductionEnvironment, serializeCookie, validatePasswordPolicy };