@zephkelly/nuxt-authkit 0.0.1

package/dist/runtime/types/callbacks.d.ts

@@ -0,0 +1,133 @@
+import type { H3Event } from 'h3';
+import type { AuthErrorCode } from '.';
+import type { TokenSet } from './token.js';
+import type { AuthkitCredentials, AuthkitUser } from './../types/authkit-types.js';
+/**
+ * Result of an `onGetRefreshToken` lookup.
+ *
+ * Returning a plain string (the stored token) or `null` is still supported and
+ * behaves exactly as before: the library compares it against the presented
+ * token in constant time. Returning this object instead lets the store answer
+ * the questions only it can answer — was this token *reused* after rotation,
+ * and what are the user's roles/claims *right now*.
+ */
+export interface RefreshTokenLookup {
+    /** Whether the presented refresh token is currently valid. */
+    valid: boolean;
+    /**
+     * The token was recognised but has already been rotated away — a replay of
+     * a superseded token. Signals theft: the library will call
+     * `onRevokeTokenFamily` for the token's family.
+     */
+    reused?: boolean;
+    /**
+     * The token was superseded moments ago by a refresh that is still in flight
+     * (two tabs refreshing at once), rather than replayed by an attacker.
+     *
+     * Distinguishing this from `reused` matters: the library leaves the refresh
+     * cookie alone — the winning request has already set a fresh one — and
+     * returns a *recoverable* `REFRESH_TOKEN_RACE` so the client can retry with
+     * the new cookie instead of being logged out. Treating a benign race as
+     * theft would revoke the whole family and end the session.
+     *
+     * Your store decides the window: typically "this token was rotated away less
+     * than ~10s ago".
+     */
+    gracePeriodRace?: boolean;
+    /**
+     * Authoritative roles for this user, read fresh from your store. Embedded
+     * in the newly-minted access token. Without this (or `onGetRoles`) a
+     * refresh cannot reflect a role change or a ban.
+     */
+    roles?: string[];
+    /** Authoritative custom claims for this user, embedded in the new access token. */
+    claims?: Record<string, unknown>;
+    /**
+     * Lifetime, in seconds, for the *rotated* refresh token.
+     *
+     * Without this, rotation resets the refresh token to the configured
+     * `tokens.refresh.expiresIn`. An app that issues per-user refresh lifetimes
+     * at login (say, long-lived for a mobile user, short for staff) would
+     * otherwise see them silently collapse to the global default on the first
+     * refresh. Return the same value your login path used.
+     */
+    refreshExpiresIn?: number;
+}
+export type RefreshTokenLookupResult = string | null | RefreshTokenLookup;
+/**
+ * Callbacks that developers implement for custom logic
+ */
+export interface AuthCallbacksGeneral {
+    /**
+     * Verify user credentials
+     * Called during initial authentication
+     */
+    onAuthenticate(credentials: AuthkitCredentials, event: H3Event): Promise<string | {
+        id: string;
+        roles?: string[];
+        user?: AuthkitUser;
+        claims?: Record<string, unknown>;
+    } | null>;
+    /**
+     * Called after successful authentication
+     * Good for logging, analytics, etc.
+     */
+    onAuthenticated?(tokens: TokenSet, event: H3Event): Promise<void> | void;
+    /**
+     * Called when authentication fails
+     */
+    onAuthenticationFailed?(reason: AuthErrorCode, event: H3Event): Promise<void> | void;
+    /**
+     * Called when tokens are refreshed
+     */
+    onTokenRefreshed?(tokens: TokenSet, event: H3Event): Promise<void> | void;
+    /**
+     * Store refresh token securely.
+     *
+     * Called on authentication and on every rotation. Storing a hash of the
+     * token rather than the token itself is strongly recommended.
+     */
+    onStoreRefreshToken(refreshToken: string, identifier: string, event: H3Event): Promise<void>;
+    /**
+     * Look up a presented refresh token in your store.
+     *
+     * @returns the stored token string (legacy), `null` if unknown, or a
+     * {@link RefreshTokenLookup} for reuse detection and fresh roles/claims.
+     */
+    onGetRefreshToken(refreshToken: string, identifier: string, event: H3Event): Promise<RefreshTokenLookupResult>;
+    /**
+     * Delete a refresh token from your store.
+     *
+     * Called on logout (`revoke()`) and on every rotation, for the token being
+     * superseded. Without this callback a session cannot be terminated
+     * server-side: the refresh token stays redeemable until it expires on its
+     * own. The library logs a one-time warning at startup if it is missing.
+     */
+    onRemoveRefreshToken?(refreshToken: string, identifier: string, event: H3Event): Promise<void>;
+    /**
+     * Re-read this user's authoritative roles, called during `refresh()`.
+     *
+     * This is the hook that makes bans and role changes take effect on the next
+     * refresh instead of on the next login. If neither this nor a
+     * {@link RefreshTokenLookup} `roles` value is supplied, roles are carried
+     * forward from the presented refresh token.
+     */
+    onGetRoles?(userId: string, event: H3Event): Promise<string[] | undefined> | string[] | undefined;
+    /**
+     * A refresh token was replayed after it had already been rotated away.
+     * The standard theft signal: revoke every token in `family`.
+     */
+    onRevokeTokenFamily?(family: string, userId: string, event: H3Event): Promise<void>;
+    /**
+     * Server-initiated revocation (e.g. an admin force-logout or a scheduled
+     * task). `revokeServer()` throws if this is not implemented, rather than
+     * silently reporting success.
+     */
+    onRevokeServer?(options: unknown, event?: H3Event): Promise<void>;
+    /**
+     * Called when user logs out
+     */
+    onLogout?(userId: string, event: H3Event): Promise<void> | void;
+}
+export interface AuthCallbacks extends AuthCallbacksGeneral {
+}

package/dist/runtime/types/cookie.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Options for the refresh-token cookie.
+ *
+ * The `@default` values below are the ones actually shipped in
+ * `DEFAULT_RUNTIME_CONFIG` — keep them in step with it. Overrides are deep-merged
+ * (defu), so setting one key does not drop the others.
+ */
+export interface NuxtAuthkitCookieOptions {
+    /**
+     * Cookie domain
+     * @default undefined
+     */
+    domain?: string;
+    /**
+     * Whether the cookie is only sent over HTTPS.
+     * @default true
+     */
+    secure?: boolean;
+    /**
+     * SameSite attribute for the cookie.
+     *
+     * Relaxing this to 'lax' or 'none' is the app's call, but it is what stands
+     * between the refresh endpoint and cross-site invocation.
+     * @default 'strict'
+     */
+    sameSite?: 'lax' | 'strict' | 'none';
+    /**
+     * Max age of the cookie in seconds
+     * @default 604800 (7 days)
+     */
+    maxAge?: number;
+    /**
+     * Name of the cookie
+     * @default 'refreshToken'
+     */
+    name?: string;
+    /**
+     * Keep the cookie unreadable from JavaScript.
+     *
+     * Forced to `true` when the cookie is written — the refresh token is a
+     * long-lived credential and must stay out of reach of XSS. This option cannot
+     * be used to turn it off.
+     *
+     * @default true
+     */
+    httpOnly?: boolean;
+}

package/dist/runtime/types/expand.d.ts

@@ -0,0 +1,3 @@
+export type Expand<T> = T extends infer U ? {
+    [K in keyof U]: U[K];
+} : never;

package/dist/runtime/types/index.d.ts

@@ -0,0 +1,52 @@
+import type { H3Event } from 'h3';
+import type { TokenSet, TokenPayload } from './token.js';
+import type { VerificationType, TwoFactorChallenge } from './2fac.js';
+/**
+ * Context passed through authentication operations
+ * Provides access to request/response and environment info
+ */
+export interface AuthContext {
+    /** H3 event (server-side only) */
+    event: H3Event;
+    /** Client info for logging/security */
+    client?: {
+        ip?: string;
+        userAgent?: string;
+        deviceId?: string;
+    };
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+export interface AuthResult {
+    /** Whether authentication was successful */
+    success: boolean;
+    /** Authentication tokens (if successful) */
+    tokens?: TokenSet;
+    /** Requires additional step (2FA, email verification, etc.) */
+    requiresVerification?: boolean;
+    /** Type of verification required */
+    verificationType?: VerificationType;
+    /** Temporary token for completing verification */
+    verificationToken?: string;
+    /** Challenge data for verification */
+    challenge?: TwoFactorChallenge;
+    error?: AuthError;
+    metadata?: Record<string, unknown>;
+}
+export interface VerifyAuthResult {
+    valid: boolean;
+    payload?: TokenPayload;
+    user?: unknown;
+    error?: AuthError;
+    /** Token is valid but expired */
+    expired?: boolean;
+    /** Token needs refresh soon */
+    shouldRefresh?: boolean;
+}
+export type AuthErrorCode = 'INVALID_CREDENTIALS' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'TOKEN_REVOKED' | 'REFRESH_TOKEN_INVALID' | 'REFRESH_TOKEN_EXPIRED' | 'REFRESH_TOKEN_RACE' | 'TWO_FACTOR_REQUIRED' | 'TWO_FACTOR_INVALID' | 'TWO_FACTOR_EXPIRED' | 'USER_NOT_FOUND' | 'USER_DISABLED' | 'RATE_LIMIT_EXCEEDED' | 'SESSION_EXPIRED' | 'INVALID_GRANT' | 'NETWORK_ERROR' | 'EVENT_UNAVAILABLE' | 'UNKNOWN_ERROR';
+export interface AuthError {
+    code: AuthErrorCode;
+    message: string;
+    details?: unknown;
+    recoverable?: boolean;
+}

package/dist/runtime/types/module-options.d.ts

@@ -0,0 +1,33 @@
+import type { JwtStrategyConfig } from '../strategy/jwt/types.js';
+import type { ScryptConfig } from '@adonisjs/hash/types';
+export interface ModuleOptions {
+    /**
+     * List of authentication strategies to enable
+     * This determines which parameters are available in revokeServer()
+     */
+    strategies: Array<'jwt'>;
+    strategy: JwtStrategyConfig;
+    /**
+     * scrypt cost parameters for `hashPassword` / `verifyPassword`.
+     * Defaults are in `DEFAULT_RUNTIME_CONFIG`.
+     */
+    scrypt?: ScryptConfig;
+    /**
+     * Register the bundled client fetch plugin, which attaches the access token
+     * to same-origin requests and transparently refreshes on 401.
+     *
+     * The plugin assigns `globalThis.$fetch`. An app that already owns its own
+     * `$fetch` wrapper must set this to `false`, or the two will fight over the
+     * same global and the last one registered wins.
+     *
+     * @default true
+     */
+    clientPlugin?: boolean;
+}
+export interface NuxtAuthkitRuntimeConfig {
+    nuxtAuthkit: {
+        strategy: JwtStrategyConfig;
+        strategies?: Array<'jwt'>;
+        scrypt?: ScryptConfig;
+    };
+}

package/dist/runtime/types/runtime-config.d.ts

@@ -0,0 +1,2 @@
+import type { NuxtAuthkitRuntimeConfig } from "./module-options.js";
+export declare const DEFAULT_RUNTIME_CONFIG: NuxtAuthkitRuntimeConfig;

package/dist/runtime/types/runtime-config.js

@@ -0,0 +1,47 @@
+export const DEFAULT_RUNTIME_CONFIG = {
+  nuxtAuthkit: {
+    strategy: {
+      name: "jwt",
+      tokens: {
+        access: {
+          expiresIn: 900
+        },
+        refresh: {
+          expiresIn: 604800,
+          storageKey: "auth.refresh_token",
+          rotate: true,
+          cookie: {
+            name: "refreshToken",
+            secure: true,
+            sameSite: "strict",
+            httpOnly: true,
+            maxAge: 604800
+          }
+        }
+      },
+      autoRefresh: {
+        enabled: true,
+        beforeExpiry: 60
+      }
+    },
+    /**
+     * scrypt cost parameters. These match the @adonisjs/hash driver defaults, and
+     * are stated explicitly because they were previously dropped on the way into
+     * runtimeConfig — a custom `scrypt` option had no effect at all.
+     *
+     * OWASP's current guidance is stronger than this (N=2^17 at p=1, or N=2^14 at
+     * p≥5). Raising `cost` is safe to do at any time: the parameters are embedded
+     * in each stored PHC hash string, so hashes made under the old settings keep
+     * verifying. It costs CPU and memory per login — measure before raising it on
+     * a busy API.
+     */
+    scrypt: {
+      cost: 16384,
+      blockSize: 8,
+      parallelization: 1,
+      saltSize: 16,
+      keyLength: 64,
+      maxMemory: 33554432
+    }
+  }
+};

package/dist/runtime/types/token.d.ts

@@ -0,0 +1,42 @@
+export interface TokenSet {
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresAt?: number;
+    expiresIn?: number;
+    tokenType?: string;
+    scope?: string[];
+}
+export interface TokenMetadata {
+    issuedAt: number;
+    expiresAt: number;
+    userId?: string;
+    sessionId?: string;
+    [key: string]: unknown;
+}
+/**
+ * Distinguishes an access token from a refresh token.
+ *
+ * Both token kinds are signed with the same key, so without this claim a
+ * refresh token is structurally replayable as a Bearer access token.
+ */
+export type TokenUse = 'access' | 'refresh';
+/**
+ * Claim names the library computes itself. A value supplied through
+ * `jwt.claims` (or an `onAuthenticate` / `onGetRoles` claims object) can never
+ * override one of these — see `assertNoReservedClaims`.
+ */
+export declare const RESERVED_CLAIMS: readonly ["sub", "iat", "exp", "nbf", "iss", "aud", "jti", "roles", "typ", "family"];
+export interface TokenPayload {
+    sub?: string;
+    iat?: number;
+    exp?: number;
+    nbf?: number;
+    iss?: string;
+    aud?: string | string[];
+    jti?: string;
+    roles?: string[];
+    typ?: TokenUse;
+    family?: string;
+    [key: string]: unknown;
+}

package/dist/runtime/types/token.js

@@ -0,0 +1,12 @@
+export const RESERVED_CLAIMS = [
+  "sub",
+  "iat",
+  "exp",
+  "nbf",
+  "iss",
+  "aud",
+  "jti",
+  "roles",
+  "typ",
+  "family"
+];

package/dist/runtime/utils/context-helpers.d.ts

@@ -0,0 +1,4 @@
+import type { H3Event } from 'h3';
+export declare function storeContextData<T>(event: H3Event, key: string, value: T): void;
+export declare function getContextData<T>(event: H3Event, key: string): T | undefined;
+export declare function clearContextData(event: H3Event, key: string): void;

package/dist/runtime/utils/context-helpers.js

@@ -0,0 +1,10 @@
+const CONTEXT_KEY_PREFIX = "authkit_";
+export function storeContextData(event, key, value) {
+  event.context[`${CONTEXT_KEY_PREFIX}${key}`] = value;
+}
+export function getContextData(event, key) {
+  return event.context[`${CONTEXT_KEY_PREFIX}${key}`];
+}
+export function clearContextData(event, key) {
+  delete event.context[`${CONTEXT_KEY_PREFIX}${key}`];
+}

package/dist/runtime/utils/get-module-options.d.ts

@@ -0,0 +1,2 @@
+import type { ModuleOptions } from '../types/module-options.js';
+export declare function mergeRuntimeConfig(moduleOptions: ModuleOptions): Record<string, unknown>;

package/dist/runtime/utils/get-module-options.js

@@ -0,0 +1,18 @@
+import { defu } from "defu";
+import { DEFAULT_RUNTIME_CONFIG as defaultRuntime } from "../types/runtime-config.js";
+export function mergeRuntimeConfig(moduleOptions) {
+  const moduleOptionsToRuntimeConfig = {
+    nuxtAuthkit: {
+      strategy: moduleOptions.strategy,
+      strategies: moduleOptions.strategies,
+      // Without this the `scrypt` module option never reaches runtimeConfig, and
+      // password hashing silently falls back to the driver defaults — an operator
+      // hardening the cost parameters would see their config quietly ignored.
+      scrypt: moduleOptions.scrypt
+    }
+  };
+  return defu(
+    moduleOptionsToRuntimeConfig,
+    defaultRuntime
+  );
+}

package/dist/runtime/utils/password.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Hash a password using scrypt
+ * @param password - The plain text password to hash
+ * @returns The hashed password
+ * @example
+ * ```ts
+ * const hashedPassword = await hashPassword('user_password')
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against a hashed password
+ * @param hashedPassword - The hashed password to verify against
+ * @param plainPassword - The plain text password to verify
+ * @returns `true` if the password is valid, `false` otherwise
+ * @example
+ * ```ts
+ * const isValid = await verifyPassword(hashedPassword, 'user_password')
+ * ```
+ * @more you can configure the scrypt options in `auth.hash.scrypt`
+ */
+export declare function verifyPassword(hashedPassword: string, plainPassword: string): Promise<boolean>;

package/dist/runtime/utils/password.js

@@ -0,0 +1,18 @@
+import { Hash } from "@adonisjs/hash";
+import { Scrypt } from "@adonisjs/hash/drivers/scrypt";
+import { useRuntimeConfig } from "#imports";
+let _hash;
+function getHash() {
+  if (!_hash) {
+    const options = useRuntimeConfig().nuxtAuthkit?.scrypt;
+    const scrypt = new Scrypt(options);
+    _hash = new Hash(scrypt);
+  }
+  return _hash;
+}
+export async function hashPassword(password) {
+  return await getHash().make(password);
+}
+export async function verifyPassword(hashedPassword, plainPassword) {
+  return await getHash().verify(hashedPassword, plainPassword);
+}

package/dist/runtime/utils/uuid.d.ts

@@ -0,0 +1,187 @@
+/**
+ * uuidv7: A JavaScript implementation of UUID version 7
+ *
+ * Copyright 2021-2024 LiosK
+ *
+ * @license Apache-2.0
+ * @packageDocumentation
+ */
+/** Represents a UUID as a 16-byte byte array. */
+export declare class UUID {
+    readonly bytes: Readonly<Uint8Array>;
+    /** @param bytes - The 16-byte byte array representation. */
+    private constructor();
+    /**
+     * Creates an object from the internal representation, a 16-byte byte array
+     * containing the binary UUID representation in the big-endian byte order.
+     *
+     * This method does NOT shallow-copy the argument, and thus the created object
+     * holds the reference to the underlying buffer.
+     *
+     * @throws TypeError if the length of the argument is not 16.
+     */
+    static ofInner(bytes: Readonly<Uint8Array>): UUID;
+    /**
+     * Builds a byte array from UUIDv7 field values.
+     *
+     * @param unixTsMs - A 48-bit `unix_ts_ms` field value.
+     * @param randA - A 12-bit `rand_a` field value.
+     * @param randBHi - The higher 30 bits of 62-bit `rand_b` field value.
+     * @param randBLo - The lower 32 bits of 62-bit `rand_b` field value.
+     * @throws RangeError if any field value is out of the specified range.
+     */
+    static fromFieldsV7(unixTsMs: number, randA: number, randBHi: number, randBLo: number): UUID;
+    /**
+     * Builds a byte array from a string representation.
+     *
+     * This method accepts the following formats:
+     *
+     * - 32-digit hexadecimal format without hyphens: `0189dcd553117d408db09496a2eef37b`
+     * - 8-4-4-4-12 hyphenated format: `0189dcd5-5311-7d40-8db0-9496a2eef37b`
+     * - Hyphenated format with surrounding braces: `{0189dcd5-5311-7d40-8db0-9496a2eef37b}`
+     * - RFC 9562 URN format: `urn:uuid:0189dcd5-5311-7d40-8db0-9496a2eef37b`
+     *
+     * Leading and trailing whitespaces represents an error.
+     *
+     * @throws SyntaxError if the argument could not parse as a valid UUID string.
+     */
+    static parse(uuid: string): UUID;
+    /**
+     * @returns The 8-4-4-4-12 canonical hexadecimal string representation
+     * (`0189dcd5-5311-7d40-8db0-9496a2eef37b`).
+     */
+    toString(): string;
+    /**
+     * @returns The 32-digit hexadecimal representation without hyphens
+     * (`0189dcd553117d408db09496a2eef37b`).
+     */
+    toHex(): string;
+    /** @returns The 8-4-4-4-12 canonical hexadecimal string representation. */
+    toJSON(): string;
+    /**
+     * Reports the variant field value of the UUID or, if appropriate, "NIL" or
+     * "MAX".
+     *
+     * For convenience, this method reports "NIL" or "MAX" if `this` represents
+     * the Nil or Max UUID, although the Nil and Max UUIDs are technically
+     * subsumed under the variants `0b0` and `0b111`, respectively.
+     */
+    getVariant(): "VAR_0" | "VAR_10" | "VAR_110" | "VAR_RESERVED" | "NIL" | "MAX";
+    /**
+     * Returns the version field value of the UUID or `undefined` if the UUID does
+     * not have the variant field value of `0b10`.
+     */
+    getVersion(): number | undefined;
+    /** Creates an object from `this`. */
+    clone(): UUID;
+    /** Returns true if `this` is equivalent to `other`. */
+    equals(other: UUID): boolean;
+    /**
+     * Returns a negative integer, zero, or positive integer if `this` is less
+     * than, equal to, or greater than `other`, respectively.
+     */
+    compareTo(other: UUID): number;
+}
+/**
+ * Encapsulates the monotonic counter state.
+ *
+ * This class provides APIs to utilize a separate counter state from that of the
+ * global generator used by {@link uuidv7} and {@link uuidv7obj}. In addition to
+ * the default {@link generate} method, this class has {@link generateOrAbort}
+ * that is useful to absolutely guarantee the monotonically increasing order of
+ * generated UUIDs. See their respective documentation for details.
+ */
+export declare class V7Generator {
+    private timestamp;
+    private counter;
+    /** The random number generator used by the generator. */
+    private readonly random;
+    /**
+     * Creates a generator object with the default random number generator, or
+     * with the specified one if passed as an argument. The specified random
+     * number generator should be cryptographically strong and securely seeded.
+     */
+    constructor(randomNumberGenerator?: {
+        /** Returns a 32-bit random unsigned integer. */
+        nextUint32(): number;
+    });
+    /**
+     * Generates a new UUIDv7 object from the current timestamp, or resets the
+     * generator upon significant timestamp rollback.
+     *
+     * This method returns a monotonically increasing UUID by reusing the previous
+     * timestamp even if the up-to-date timestamp is smaller than the immediately
+     * preceding UUID's. However, when such a clock rollback is considered
+     * significant (i.e., by more than ten seconds), this method resets the
+     * generator and returns a new UUID based on the given timestamp, breaking the
+     * increasing order of UUIDs.
+     *
+     * See {@link generateOrAbort} for the other mode of generation and
+     * {@link generateOrResetCore} for the low-level primitive.
+     */
+    generate(): UUID;
+    /**
+     * Generates a new UUIDv7 object from the current timestamp, or returns
+     * `undefined` upon significant timestamp rollback.
+     *
+     * This method returns a monotonically increasing UUID by reusing the previous
+     * timestamp even if the up-to-date timestamp is smaller than the immediately
+     * preceding UUID's. However, when such a clock rollback is considered
+     * significant (i.e., by more than ten seconds), this method aborts and
+     * returns `undefined` immediately.
+     *
+     * See {@link generate} for the other mode of generation and
+     * {@link generateOrAbortCore} for the low-level primitive.
+     */
+    generateOrAbort(): UUID | undefined;
+    /**
+     * Generates a new UUIDv7 object from the `unixTsMs` passed, or resets the
+     * generator upon significant timestamp rollback.
+     *
+     * This method is equivalent to {@link generate} except that it takes a custom
+     * timestamp and clock rollback allowance.
+     *
+     * @param rollbackAllowance - The amount of `unixTsMs` rollback that is
+     * considered significant. A suggested value is `10_000` (milliseconds).
+     * @throws RangeError if `unixTsMs` is not a 48-bit positive integer.
+     */
+    generateOrResetCore(unixTsMs: number, rollbackAllowance: number): UUID;
+    /**
+     * Generates a new UUIDv7 object from the `unixTsMs` passed, or returns
+     * `undefined` upon significant timestamp rollback.
+     *
+     * This method is equivalent to {@link generateOrAbort} except that it takes a
+     * custom timestamp and clock rollback allowance.
+     *
+     * @param rollbackAllowance - The amount of `unixTsMs` rollback that is
+     * considered significant. A suggested value is `10_000` (milliseconds).
+     * @throws RangeError if `unixTsMs` is not a 48-bit positive integer.
+     */
+    generateOrAbortCore(unixTsMs: number, rollbackAllowance: number): UUID | undefined;
+    /** Initializes the counter at a 42-bit random integer. */
+    private resetCounter;
+    /**
+     * Generates a new UUIDv4 object utilizing the random number generator inside.
+     *
+     * @internal
+     */
+    generateV4(): UUID;
+}
+/**
+ * Generates a UUIDv7 string.
+ *
+ * @returns The 8-4-4-4-12 canonical hexadecimal string representation
+ * ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx").
+ */
+export declare const uuidv7: () => string;
+/** Generates a UUIDv7 object. */
+export declare const uuidv7obj: () => UUID;
+/**
+ * Generates a UUIDv4 string.
+ *
+ * @returns The 8-4-4-4-12 canonical hexadecimal string representation
+ * ("xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx").
+ */
+export declare const uuidv4: () => string;
+/** Generates a UUIDv4 object. */
+export declare const uuidv4obj: () => UUID;