captify 0.1.15 → 0.1.18

package/dist/auth/api/handlers.d.ts

@@ -1,81 +0,0 @@
-/**
- * POST /api/registration
- *
- * Submit user registration data to Cognito.
- * Updates user attributes with registration data and sets account status to PENDING.
- *
- * Security: tenantId and username are set server-side from authenticated session
- * and cannot be overridden by client payload. The validated client data is spread
- * first, then tenantId/username are explicitly overwritten with server-derived values.
- *
- * @body firstName - User's first name
- * @body lastName - User's last name
- * @body jobTitle - User's job title
- * @body department - User's department
- * @body phoneNumber - User's phone number (10-digit US number)
- * @body organization - User's organization (optional)
- * @body clearanceFileKey - S3 key for uploaded clearance form
- *
- * @returns HTTP 204 No Content on success (no response body)
- * @throws 400 Bad Request - Invalid request body or validation errors
- * @throws 401 Unauthorized - Invalid or missing authentication
- * @throws 403 Forbidden - User already verified or clearance file doesn't belong to tenant
- * @throws 500 Internal Server Error - Cognito or server errors
- *
- * @example
- * POST /api/registration
- * Body: {
- *   "firstName": "John",
- *   "lastName": "Doe",
- *   "jobTitle": "Software Engineer",
- *   "department": "Engineering",
- *   "phoneNumber": "5551234567",
- *   "clearanceFileKey": "tenants/123/clearance/file.pdf"
- * }
- * Response: 204 No Content (empty body)
- */
-export declare const submitRegistration: (request: import("next/server").NextRequest, context: {
-    params: Promise<Record<string, unknown>>;
-}) => Promise<import("next/server").NextResponse<{
-    error: string;
-} | null>>;
-/**
- * GET /api/registration/status
- *
- * Check if user is approved to access the platform.
- * Fetches the current account status directly from Cognito to ensure
- * we have the latest value (tokens may be stale after attribute updates).
- *
- * @returns Object containing:
- *   - isApproved: Whether the user is approved (account_status = verified)
- *   - accountStatus: Current account status (unverified, pending, verified)
- *   - userEmail: User's email address
- *
- * @example
- * GET /api/registration/status
- *
- * Response:
- * {
- *   "isApproved": false,
- *   "accountStatus": "pending",
- *   "userEmail": "user@example.com"
- * }
- */
-export declare const getApprovalStatus: (request: import("next/server").NextRequest, context: {
-    params: Promise<Record<string, unknown>>;
-}) => Promise<import("next/server").NextResponse<import("../interfaces").ApprovalStatusResult | {
-    error: string;
-}>>;
-export declare const registrationHandlers: {
-    submit: (request: import("next/server").NextRequest, context: {
-        params: Promise<Record<string, unknown>>;
-    }) => Promise<import("next/server").NextResponse<{
-        error: string;
-    } | null>>;
-    getStatus: (request: import("next/server").NextRequest, context: {
-        params: Promise<Record<string, unknown>>;
-    }) => Promise<import("next/server").NextResponse<import("../interfaces").ApprovalStatusResult | {
-        error: string;
-    }>>;
-};
-//# sourceMappingURL=handlers.d.ts.map

package/dist/auth/api/handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../lib/auth/api/handlers.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,kBAAkB;;;;UAqB9B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB;;;;GAS7B,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;CAGhC,CAAC"}

package/dist/auth/api/handlers.js

@@ -1,82 +0,0 @@
-import { getCognitoUserService, getRegistrationService } from "../services";
-import { registrationDataSchema } from "../schemas";
-import { handleApi, withAuth } from "../../utils/api";
-/**
- * POST /api/registration
- *
- * Submit user registration data to Cognito.
- * Updates user attributes with registration data and sets account status to PENDING.
- *
- * Security: tenantId and username are set server-side from authenticated session
- * and cannot be overridden by client payload. The validated client data is spread
- * first, then tenantId/username are explicitly overwritten with server-derived values.
- *
- * @body firstName - User's first name
- * @body lastName - User's last name
- * @body jobTitle - User's job title
- * @body department - User's department
- * @body phoneNumber - User's phone number (10-digit US number)
- * @body organization - User's organization (optional)
- * @body clearanceFileKey - S3 key for uploaded clearance form
- *
- * @returns HTTP 204 No Content on success (no response body)
- * @throws 400 Bad Request - Invalid request body or validation errors
- * @throws 401 Unauthorized - Invalid or missing authentication
- * @throws 403 Forbidden - User already verified or clearance file doesn't belong to tenant
- * @throws 500 Internal Server Error - Cognito or server errors
- *
- * @example
- * POST /api/registration
- * Body: {
- *   "firstName": "John",
- *   "lastName": "Doe",
- *   "jobTitle": "Software Engineer",
- *   "department": "Engineering",
- *   "phoneNumber": "5551234567",
- *   "clearanceFileKey": "tenants/123/clearance/file.pdf"
- * }
- * Response: 204 No Content (empty body)
- */
-export const submitRegistration = withAuth(async (request, { userId, tenantId, accessToken }) => handleApi(async () => {
-    const body = await request.json();
-    const validated = registrationDataSchema.parse(body);
-    const cognitoUserService = getCognitoUserService();
-    const registrationService = getRegistrationService(cognitoUserService);
-    // Spread validated first, then set server-derived values last
-    // to ensure tenantId/username cannot be overridden by client payload
-    await registrationService.submitRegistration(Object.assign(Object.assign({}, validated), { tenantId, username: userId }), { accessToken });
-    return null;
-}));
-/**
- * GET /api/registration/status
- *
- * Check if user is approved to access the platform.
- * Fetches the current account status directly from Cognito to ensure
- * we have the latest value (tokens may be stale after attribute updates).
- *
- * @returns Object containing:
- *   - isApproved: Whether the user is approved (account_status = verified)
- *   - accountStatus: Current account status (unverified, pending, verified)
- *   - userEmail: User's email address
- *
- * @example
- * GET /api/registration/status
- *
- * Response:
- * {
- *   "isApproved": false,
- *   "accountStatus": "pending",
- *   "userEmail": "user@example.com"
- * }
- */
-export const getApprovalStatus = withAuth(async (_, { user, accessToken }) => handleApi(async () => {
-    const cognitoUserService = getCognitoUserService();
-    const registrationService = getRegistrationService(cognitoUserService);
-    const currentStatus = await registrationService.fetchCurrentAccountStatus(accessToken);
-    return registrationService.checkApprovalStatus(currentStatus !== null && currentStatus !== void 0 ? currentStatus : user.accountStatus, user.email);
-}));
-export const registrationHandlers = {
-    submit: submitRegistration,
-    getStatus: getApprovalStatus,
-};
-//# sourceMappingURL=handlers.js.map

package/dist/auth/api/handlers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../lib/auth/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAC9F,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAErD,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAEvE,8DAA8D;IAC9D,qEAAqE;IACrE,MAAM,mBAAmB,CAAC,kBAAkB,iCAErC,SAAS,KACZ,QAAQ,EACR,QAAQ,EAAE,MAAM,KAElB,EAAE,WAAW,EAAE,CAChB,CAAC;IAEF,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAC3E,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,kBAAkB,GAAG,qBAAqB,EAAE,CAAC;IACnD,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAEvE,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAEvF,OAAO,mBAAmB,CAAC,mBAAmB,CAAC,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AAClG,CAAC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,kBAAkB;IAC1B,SAAS,EAAE,iBAAiB;CAC7B,CAAC"}

package/dist/auth/api/schema.d.ts

@@ -1,25 +0,0 @@
-/**
- * API layer schemas and types for registration endpoints
- *
- * This file:
- * - Re-exports the base registration schema from service layer
- * - Infers API response types from handlers (single source of truth)
- *
- * Note: Success/failure is communicated via HTTP status codes.
- * Clients should throw on non-2xx responses rather than returning error objects.
- */
-import type { ApiRouteResponse } from "../../types";
-import type { registrationHandlers } from "./handlers";
-/**
- * Registration form schema - re-exported from service layer
- *
- * The base schema is defined in the service layer to maintain proper
- * dependency direction (API → Service, not Service → API).
- */
-export { registrationDataSchema as registrationFormSchema, type RegistrationData as RegistrationFormData, } from "../schemas";
-/**
- * API response for approval status check
- * Inferred from getStatus handler return type
- */
-export type ApprovalStatusApiResponse = ApiRouteResponse<typeof registrationHandlers.getStatus>;
-//# sourceMappingURL=schema.d.ts.map

package/dist/auth/api/schema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../lib/auth/api/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvD;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,IAAI,sBAAsB,EAChD,KAAK,gBAAgB,IAAI,oBAAoB,GAC9C,MAAM,oBAAoB,CAAC;AAM5B;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC"}

package/dist/auth/api/schema.js

@@ -1,21 +0,0 @@
-/**
- * API layer schemas and types for registration endpoints
- *
- * This file:
- * - Re-exports the base registration schema from service layer
- * - Infers API response types from handlers (single source of truth)
- *
- * Note: Success/failure is communicated via HTTP status codes.
- * Clients should throw on non-2xx responses rather than returning error objects.
- */
-// =============================================================================
-// Re-export base schema from service layer
-// =============================================================================
-/**
- * Registration form schema - re-exported from service layer
- *
- * The base schema is defined in the service layer to maintain proper
- * dependency direction (API → Service, not Service → API).
- */
-export { registrationDataSchema as registrationFormSchema, } from "../schemas";
-//# sourceMappingURL=schema.js.map

package/dist/auth/api/schema.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../lib/auth/api/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,gFAAgF;AAChF,2CAA2C;AAC3C,gFAAgF;AAEhF;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,IAAI,sBAAsB,GAEjD,MAAM,oBAAoB,CAAC"}

package/dist/auth/constants.d.ts

@@ -1,102 +0,0 @@
-/**
- * Constants for Auth module
- * Includes Cognito and Registration constants
- */
-export declare const COGNITO_ERROR_MESSAGES: {
-    readonly OPERATION_FAILED: "Cognito operation failed";
-    readonly CLIENT_ID_REQUIRED: "Cognito clientId is required";
-    readonly REGION_REQUIRED: "Cognito region is required";
-    readonly USER_POOL_ID_REQUIRED: "Cognito userPoolId is required for admin operations";
-    readonly IDENTITY_POOL_ID_REQUIRED: string;
-    readonly USER_NOT_FOUND: "User not found. The specified user does not exist.";
-    readonly USER_EXISTS: "A user with this email already exists. Please use a different email.";
-    readonly INVALID_PASSWORD: "Invalid password. Password must meet the requirements (minimum 8 characters with uppercase, lowercase, and number).";
-    readonly INVALID_PARAMETER: "Invalid input. Please check your data and try again.";
-    readonly ACCESS_DENIED: "Access denied. You don't have permission to perform this action.";
-    readonly NOT_AUTHORIZED: "Not authorized. Please check your credentials and try again.";
-    readonly GROUP_EXISTS: "A group with this name already exists. Please use a different name.";
-    readonly RESOURCE_NOT_FOUND: "Resource not found. The requested resource does not exist.";
-    readonly INVALID_ATTRIBUTE_VALUE: "Invalid attribute value. Please check the format and try again.";
-    readonly USER_LAMBDA_VALIDATION: "User validation failed. Please contact support.";
-    readonly TOO_MANY_REQUESTS: "Too many requests. Please wait a moment and try again.";
-    readonly LIMIT_EXCEEDED: "Rate limit exceeded. Please try again later.";
-    readonly TOO_MANY_FAILED_ATTEMPTS: "Too many failed attempts. Please try again later.";
-    readonly INTERNAL_ERROR: "Internal server error. Please try again.";
-    readonly UNKNOWN_ERROR: "An unexpected error occurred. Please try again or contact support.";
-};
-export declare const COGNITO_ADMIN_ERROR_CODES: {
-    readonly ACCESS_DENIED: "AccessDeniedException";
-    readonly INVALID_PARAMETER: "InvalidParameterException";
-    readonly USER_NOT_FOUND: "UserNotFoundException";
-    readonly USER_EXISTS: "UsernameExistsException";
-    readonly RESOURCE_NOT_FOUND: "ResourceNotFoundException";
-    readonly NOT_AUTHORIZED: "NotAuthorizedException";
-    readonly INVALID_PASSWORD: "InvalidPasswordException";
-    readonly PASSWORD_RESET_REQUIRED: "PasswordResetRequiredException";
-    readonly USER_NOT_CONFIRMED: "UserNotConfirmedException";
-    readonly USER_LAMBDA_VALIDATION: "UserLambdaValidationException";
-    readonly GROUP_EXISTS: "GroupExistsException";
-    readonly MFA_METHOD_NOT_FOUND: "MFAMethodNotFoundException";
-    readonly SOFTWARE_TOKEN_MFA_NOT_FOUND: "SoftwareTokenMFANotFoundException";
-    readonly TOO_MANY_REQUESTS: "TooManyRequestsException";
-    readonly LIMIT_EXCEEDED: "LimitExceededException";
-    readonly TOO_MANY_FAILED_ATTEMPTS: "TooManyFailedAttemptsException";
-    readonly INTERNAL_ERROR: "InternalErrorException";
-    readonly INVALID_LAMBDA_RESPONSE: "InvalidLambdaResponseException";
-    readonly UNEXPECTED_LAMBDA: "UnexpectedLambdaException";
-    readonly ALIAS_EXISTS: "AliasExistsException";
-    readonly CODE_MISMATCH: "CodeMismatchException";
-    readonly EXPIRED_CODE: "ExpiredCodeException";
-};
-export declare const COGNITO_ADMIN_FATAL_ERROR_CODES: readonly ["AccessDeniedException", "InvalidParameterException", "UserNotFoundException", "UsernameExistsException", "ResourceNotFoundException", "NotAuthorizedException", "InvalidPasswordException", "GroupExistsException", "AliasExistsException", "CodeMismatchException", "ExpiredCodeException", "MFAMethodNotFoundException", "SoftwareTokenMFANotFoundException"];
-export declare const COGNITO_ADMIN_RETRYABLE_ERROR_CODES: readonly ["TooManyRequestsException", "LimitExceededException", "InternalErrorException", "TooManyFailedAttemptsException"];
-/**
- * AWS Cognito limits and constraints
- * Reference: https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html
- */
-export declare const COGNITO_LIMITS: {
-    readonly USERNAME_MIN_LENGTH: 1;
-    readonly USERNAME_MAX_LENGTH: 128;
-    readonly PASSWORD_MIN_LENGTH: 6;
-    readonly PASSWORD_MAX_LENGTH: 256;
-    readonly EMAIL_MAX_LENGTH: 320;
-    readonly PHONE_NUMBER_MAX_LENGTH: 20;
-    readonly USER_POOL_ID_PATTERN: RegExp;
-    readonly GROUP_NAME_MIN_LENGTH: 1;
-    readonly GROUP_NAME_MAX_LENGTH: 128;
-    readonly CUSTOM_ATTRIBUTE_NAME_MAX_LENGTH: 20;
-    readonly ATTRIBUTE_VALUE_MAX_LENGTH: 2048;
-    readonly LIST_USERS_MAX_LIMIT: 60;
-    readonly LIST_GROUPS_MAX_LIMIT: 60;
-    readonly DESCRIPTION_MAX_LENGTH: 2048;
-};
-/**
- * Cognito username validation pattern
- * Usernames can contain: alphanumeric characters, plus (+), equals (=),
- * comma (,), period (.), at (@), hyphen (-), and underscore (_)
- */
-export declare const COGNITO_USERNAME_PATTERN: RegExp;
-/**
- * Cognito email validation pattern (simplified)
- */
-export declare const COGNITO_EMAIL_PATTERN: RegExp;
-/**
- * Cognito phone number pattern (E.164 format)
- * Must start with + and contain only digits
- */
-export declare const COGNITO_PHONE_PATTERN: RegExp;
-/**
- * Cognito group name for users who can manage users and groups
- */
-export declare const USER_ADMIN_GROUP = "User_Admin";
-export declare const REGISTRATION_LIMITS: {
-    /** Maximum length for username (Cognito sub) */
-    readonly MAX_USERNAME_LENGTH: 128;
-};
-export declare const REGISTRATION_ERROR_MESSAGES: {
-    readonly USERNAME_REQUIRED: "Username is required";
-    readonly USERNAME_TOO_LONG: "Username must not exceed 128 characters";
-    readonly INVALID_CLEARANCE_FILE: "The uploaded file does not belong to your account";
-    readonly ALREADY_VERIFIED: "Registration cannot be submitted for an already verified account";
-};
-//# sourceMappingURL=constants.d.ts.map

package/dist/auth/constants.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../lib/auth/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;CAkCzB,CAAC;AAMX,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;CAsC5B,CAAC;AAEX,eAAO,MAAM,+BAA+B,4WAclC,CAAC;AAEX,eAAO,MAAM,mCAAmC,6HAKtC,CAAC;AAMX;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;CAkCjB,CAAC;AAMX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAwB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,qBAAqB,QAA+B,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAsB,CAAC;AAMzD;;GAEG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAM7C,eAAO,MAAM,mBAAmB;IAC9B,gDAAgD;;CAExC,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;CAK9B,CAAC"}

package/dist/auth/constants.js

@@ -1,164 +0,0 @@
-/**
- * Constants for Auth module
- * Includes Cognito and Registration constants
- */
-// ============================================================================
-// Cognito Error Messages
-// ============================================================================
-export const COGNITO_ERROR_MESSAGES = {
-    OPERATION_FAILED: "Cognito operation failed",
-    CLIENT_ID_REQUIRED: "Cognito clientId is required",
-    REGION_REQUIRED: "Cognito region is required",
-    USER_POOL_ID_REQUIRED: "Cognito userPoolId is required for admin operations",
-    IDENTITY_POOL_ID_REQUIRED: "Cognito identityPoolId is required for user credential operations. " +
-        "Identity Pool enables user-level AWS access control for governance compliance.",
-    // User-specific errors
-    USER_NOT_FOUND: "User not found. The specified user does not exist.",
-    USER_EXISTS: "A user with this email already exists. Please use a different email.",
-    INVALID_PASSWORD: "Invalid password. Password must meet the requirements (minimum 8 characters with uppercase, lowercase, and number).",
-    INVALID_PARAMETER: "Invalid input. Please check your data and try again.",
-    ACCESS_DENIED: "Access denied. You don't have permission to perform this action.",
-    NOT_AUTHORIZED: "Not authorized. Please check your credentials and try again.",
-    // Group-specific errors
-    GROUP_EXISTS: "A group with this name already exists. Please use a different name.",
-    RESOURCE_NOT_FOUND: "Resource not found. The requested resource does not exist.",
-    // Attribute errors
-    INVALID_ATTRIBUTE_VALUE: "Invalid attribute value. Please check the format and try again.",
-    USER_LAMBDA_VALIDATION: "User validation failed. Please contact support.",
-    // Rate limiting
-    TOO_MANY_REQUESTS: "Too many requests. Please wait a moment and try again.",
-    LIMIT_EXCEEDED: "Rate limit exceeded. Please try again later.",
-    TOO_MANY_FAILED_ATTEMPTS: "Too many failed attempts. Please try again later.",
-    // Service errors
-    INTERNAL_ERROR: "Internal server error. Please try again.",
-    UNKNOWN_ERROR: "An unexpected error occurred. Please try again or contact support.",
-};
-// ============================================================================
-// Cognito Error Codes
-// ============================================================================
-export const COGNITO_ADMIN_ERROR_CODES = {
-    // Admin operation errors
-    ACCESS_DENIED: "AccessDeniedException",
-    INVALID_PARAMETER: "InvalidParameterException",
-    USER_NOT_FOUND: "UserNotFoundException",
-    USER_EXISTS: "UsernameExistsException",
-    RESOURCE_NOT_FOUND: "ResourceNotFoundException",
-    NOT_AUTHORIZED: "NotAuthorizedException",
-    // Password errors
-    INVALID_PASSWORD: "InvalidPasswordException",
-    PASSWORD_RESET_REQUIRED: "PasswordResetRequiredException",
-    // User state errors
-    USER_NOT_CONFIRMED: "UserNotConfirmedException",
-    USER_LAMBDA_VALIDATION: "UserLambdaValidationException",
-    // Group errors
-    GROUP_EXISTS: "GroupExistsException",
-    // MFA errors
-    MFA_METHOD_NOT_FOUND: "MFAMethodNotFoundException",
-    SOFTWARE_TOKEN_MFA_NOT_FOUND: "SoftwareTokenMFANotFoundException",
-    // Rate limiting errors
-    TOO_MANY_REQUESTS: "TooManyRequestsException",
-    LIMIT_EXCEEDED: "LimitExceededException",
-    TOO_MANY_FAILED_ATTEMPTS: "TooManyFailedAttemptsException",
-    // Service errors
-    INTERNAL_ERROR: "InternalErrorException",
-    INVALID_LAMBDA_RESPONSE: "InvalidLambdaResponseException",
-    UNEXPECTED_LAMBDA: "UnexpectedLambdaException",
-    // Other errors
-    ALIAS_EXISTS: "AliasExistsException",
-    CODE_MISMATCH: "CodeMismatchException",
-    EXPIRED_CODE: "ExpiredCodeException",
-};
-export const COGNITO_ADMIN_FATAL_ERROR_CODES = [
-    COGNITO_ADMIN_ERROR_CODES.ACCESS_DENIED,
-    COGNITO_ADMIN_ERROR_CODES.INVALID_PARAMETER,
-    COGNITO_ADMIN_ERROR_CODES.USER_NOT_FOUND,
-    COGNITO_ADMIN_ERROR_CODES.USER_EXISTS,
-    COGNITO_ADMIN_ERROR_CODES.RESOURCE_NOT_FOUND,
-    COGNITO_ADMIN_ERROR_CODES.NOT_AUTHORIZED,
-    COGNITO_ADMIN_ERROR_CODES.INVALID_PASSWORD,
-    COGNITO_ADMIN_ERROR_CODES.GROUP_EXISTS,
-    COGNITO_ADMIN_ERROR_CODES.ALIAS_EXISTS,
-    COGNITO_ADMIN_ERROR_CODES.CODE_MISMATCH,
-    COGNITO_ADMIN_ERROR_CODES.EXPIRED_CODE,
-    COGNITO_ADMIN_ERROR_CODES.MFA_METHOD_NOT_FOUND,
-    COGNITO_ADMIN_ERROR_CODES.SOFTWARE_TOKEN_MFA_NOT_FOUND,
-];
-export const COGNITO_ADMIN_RETRYABLE_ERROR_CODES = [
-    COGNITO_ADMIN_ERROR_CODES.TOO_MANY_REQUESTS,
-    COGNITO_ADMIN_ERROR_CODES.LIMIT_EXCEEDED,
-    COGNITO_ADMIN_ERROR_CODES.INTERNAL_ERROR,
-    COGNITO_ADMIN_ERROR_CODES.TOO_MANY_FAILED_ATTEMPTS,
-];
-// ============================================================================
-// Cognito Limits
-// ============================================================================
-/**
- * AWS Cognito limits and constraints
- * Reference: https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html
- */
-export const COGNITO_LIMITS = {
-    // Username constraints
-    USERNAME_MIN_LENGTH: 1,
-    USERNAME_MAX_LENGTH: 128,
-    // Password constraints (AWS defaults - can be customized in User Pool policy)
-    PASSWORD_MIN_LENGTH: 6,
-    PASSWORD_MAX_LENGTH: 256,
-    // Email constraints
-    EMAIL_MAX_LENGTH: 320, // RFC 5321
-    // Phone number constraints
-    PHONE_NUMBER_MAX_LENGTH: 20,
-    // User Pool ID format
-    USER_POOL_ID_PATTERN: /^[\w-]+_[a-zA-Z0-9]+$/,
-    // Group name constraints
-    GROUP_NAME_MIN_LENGTH: 1,
-    GROUP_NAME_MAX_LENGTH: 128,
-    // Attribute constraints
-    // Custom attribute names: max 20 characters (not including "custom:" prefix)
-    // Reference: AWS Cognito custom attribute name limit
-    CUSTOM_ATTRIBUTE_NAME_MAX_LENGTH: 20,
-    ATTRIBUTE_VALUE_MAX_LENGTH: 2048,
-    // List operations
-    LIST_USERS_MAX_LIMIT: 60,
-    LIST_GROUPS_MAX_LIMIT: 60,
-    // Description constraints
-    DESCRIPTION_MAX_LENGTH: 2048,
-};
-// ============================================================================
-// Cognito Validation Patterns
-// ============================================================================
-/**
- * Cognito username validation pattern
- * Usernames can contain: alphanumeric characters, plus (+), equals (=),
- * comma (,), period (.), at (@), hyphen (-), and underscore (_)
- */
-export const COGNITO_USERNAME_PATTERN = /^[a-zA-Z0-9+._@-]+$/;
-/**
- * Cognito email validation pattern (simplified)
- */
-export const COGNITO_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-/**
- * Cognito phone number pattern (E.164 format)
- * Must start with + and contain only digits
- */
-export const COGNITO_PHONE_PATTERN = /^\+[1-9]\d{1,14}$/;
-// ============================================================================
-// Permission Constants
-// ============================================================================
-/**
- * Cognito group name for users who can manage users and groups
- */
-export const USER_ADMIN_GROUP = "User_Admin";
-// ============================================================================
-// Registration Constants
-// ============================================================================
-export const REGISTRATION_LIMITS = {
-    /** Maximum length for username (Cognito sub) */
-    MAX_USERNAME_LENGTH: 128,
-};
-export const REGISTRATION_ERROR_MESSAGES = {
-    USERNAME_REQUIRED: "Username is required",
-    USERNAME_TOO_LONG: "Username must not exceed 128 characters",
-    INVALID_CLEARANCE_FILE: "The uploaded file does not belong to your account",
-    ALREADY_VERIFIED: "Registration cannot be submitted for an already verified account",
-};
-//# sourceMappingURL=constants.js.map

package/dist/auth/constants.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../lib/auth/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,gBAAgB,EAAE,0BAA0B;IAC5C,kBAAkB,EAAE,8BAA8B;IAClD,eAAe,EAAE,4BAA4B;IAC7C,qBAAqB,EAAE,qDAAqD;IAC5E,yBAAyB,EACvB,qEAAqE;QACrE,gFAAgF;IAElF,uBAAuB;IACvB,cAAc,EAAE,oDAAoD;IACpE,WAAW,EAAE,sEAAsE;IACnF,gBAAgB,EACd,qHAAqH;IACvH,iBAAiB,EAAE,sDAAsD;IACzE,aAAa,EAAE,kEAAkE;IACjF,cAAc,EAAE,8DAA8D;IAE9E,wBAAwB;IACxB,YAAY,EAAE,qEAAqE;IACnF,kBAAkB,EAAE,4DAA4D;IAEhF,mBAAmB;IACnB,uBAAuB,EAAE,iEAAiE;IAC1F,sBAAsB,EAAE,iDAAiD;IAEzE,gBAAgB;IAChB,iBAAiB,EAAE,wDAAwD;IAC3E,cAAc,EAAE,8CAA8C;IAC9D,wBAAwB,EAAE,mDAAmD;IAE7E,iBAAiB;IACjB,cAAc,EAAE,0CAA0C;IAC1D,aAAa,EAAE,oEAAoE;CAC3E,CAAC;AAEX,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,yBAAyB;IACzB,aAAa,EAAE,uBAAuB;IACtC,iBAAiB,EAAE,2BAA2B;IAC9C,cAAc,EAAE,uBAAuB;IACvC,WAAW,EAAE,yBAAyB;IACtC,kBAAkB,EAAE,2BAA2B;IAC/C,cAAc,EAAE,wBAAwB;IAExC,kBAAkB;IAClB,gBAAgB,EAAE,0BAA0B;IAC5C,uBAAuB,EAAE,gCAAgC;IAEzD,oBAAoB;IACpB,kBAAkB,EAAE,2BAA2B;IAC/C,sBAAsB,EAAE,+BAA+B;IAEvD,eAAe;IACf,YAAY,EAAE,sBAAsB;IAEpC,aAAa;IACb,oBAAoB,EAAE,4BAA4B;IAClD,4BAA4B,EAAE,mCAAmC;IAEjE,uBAAuB;IACvB,iBAAiB,EAAE,0BAA0B;IAC7C,cAAc,EAAE,wBAAwB;IACxC,wBAAwB,EAAE,gCAAgC;IAE1D,iBAAiB;IACjB,cAAc,EAAE,wBAAwB;IACxC,uBAAuB,EAAE,gCAAgC;IACzD,iBAAiB,EAAE,2BAA2B;IAE9C,eAAe;IACf,YAAY,EAAE,sBAAsB;IACpC,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAE,sBAAsB;CAC5B,CAAC;AAEX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,yBAAyB,CAAC,aAAa;IACvC,yBAAyB,CAAC,iBAAiB;IAC3C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,WAAW;IACrC,yBAAyB,CAAC,kBAAkB;IAC5C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,gBAAgB;IAC1C,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,aAAa;IACvC,yBAAyB,CAAC,YAAY;IACtC,yBAAyB,CAAC,oBAAoB;IAC9C,yBAAyB,CAAC,4BAA4B;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,yBAAyB,CAAC,iBAAiB;IAC3C,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,cAAc;IACxC,yBAAyB,CAAC,wBAAwB;CAC1C,CAAC;AAEX,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,uBAAuB;IACvB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IAExB,8EAA8E;IAC9E,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,GAAG;IAExB,oBAAoB;IACpB,gBAAgB,EAAE,GAAG,EAAE,WAAW;IAElC,2BAA2B;IAC3B,uBAAuB,EAAE,EAAE;IAE3B,sBAAsB;IACtB,oBAAoB,EAAE,uBAAuB;IAE7C,yBAAyB;IACzB,qBAAqB,EAAE,CAAC;IACxB,qBAAqB,EAAE,GAAG;IAE1B,wBAAwB;IACxB,6EAA6E;IAC7E,qDAAqD;IACrD,gCAAgC,EAAE,EAAE;IACpC,0BAA0B,EAAE,IAAI;IAEhC,kBAAkB;IAClB,oBAAoB,EAAE,EAAE;IACxB,qBAAqB,EAAE,EAAE;IAEzB,0BAA0B;IAC1B,sBAAsB,EAAE,IAAI;CACpB,CAAC;AAEX,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,gDAAgD;IAChD,mBAAmB,EAAE,GAAG;CAChB,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,iBAAiB,EAAE,sBAAsB;IACzC,iBAAiB,EAAE,yCAAyC;IAC5D,sBAAsB,EAAE,mDAAmD;IAC3E,gBAAgB,EAAE,kEAAkE;CAC5E,CAAC"}

package/dist/auth/errors.d.ts

@@ -1,15 +0,0 @@
-/**
- * Auth module errors
- */
-import { AWS_ERROR_KIND } from "../services/shared/constants";
-import { BaseAwsError } from "../services/shared/errors";
-export declare class CognitoError extends BaseAwsError {
-    constructor(message: string, kind: (typeof AWS_ERROR_KIND)[keyof typeof AWS_ERROR_KIND], opts?: {
-        cause?: unknown;
-        code?: string;
-        timestamp?: Date;
-    });
-}
-export declare function classifyCognitoError(err: unknown): CognitoError;
-export declare function isCognitoError(err: unknown): err is CognitoError;
-//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../lib/auth/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,qBAAa,YAAa,SAAQ,YAAY;gBAE1C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,EAC1D,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,IAAI,CAAC;KAClB;CAMJ;AA2BD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAuB/D;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAEhE"}

package/dist/auth/errors.js

@@ -1,51 +0,0 @@
-/**
- * Auth module errors
- */
-import { AWS_ERROR_KIND } from "../services/shared/constants";
-import { BaseAwsError } from "../services/shared/errors";
-import { COGNITO_ADMIN_RETRYABLE_ERROR_CODES, COGNITO_ERROR_MESSAGES } from "./constants";
-export class CognitoError extends BaseAwsError {
-    constructor(message, kind, opts) {
-        super(message, kind, opts);
-        this.name = "CognitoError";
-        Object.setPrototypeOf(this, CognitoError.prototype);
-    }
-}
-const COGNITO_ERROR_CODE_MAP = {
-    UserNotFoundException: COGNITO_ERROR_MESSAGES.USER_NOT_FOUND,
-    UsernameExistsException: COGNITO_ERROR_MESSAGES.USER_EXISTS,
-    InvalidPasswordException: COGNITO_ERROR_MESSAGES.INVALID_PASSWORD,
-    InvalidParameterException: COGNITO_ERROR_MESSAGES.INVALID_PARAMETER,
-    AccessDeniedException: COGNITO_ERROR_MESSAGES.ACCESS_DENIED,
-    NotAuthorizedException: COGNITO_ERROR_MESSAGES.NOT_AUTHORIZED,
-    GroupExistsException: COGNITO_ERROR_MESSAGES.GROUP_EXISTS,
-    ResourceNotFoundException: COGNITO_ERROR_MESSAGES.RESOURCE_NOT_FOUND,
-    InvalidAttributeValueException: COGNITO_ERROR_MESSAGES.INVALID_ATTRIBUTE_VALUE,
-    UserLambdaValidationException: COGNITO_ERROR_MESSAGES.USER_LAMBDA_VALIDATION,
-    TooManyRequestsException: COGNITO_ERROR_MESSAGES.TOO_MANY_REQUESTS,
-    LimitExceededException: COGNITO_ERROR_MESSAGES.LIMIT_EXCEEDED,
-    TooManyFailedAttemptsException: COGNITO_ERROR_MESSAGES.TOO_MANY_FAILED_ATTEMPTS,
-    InternalErrorException: COGNITO_ERROR_MESSAGES.INTERNAL_ERROR,
-};
-export function classifyCognitoError(err) {
-    var _a;
-    const cognitoErr = err;
-    const code = (cognitoErr === null || cognitoErr === void 0 ? void 0 : cognitoErr.code) || (cognitoErr === null || cognitoErr === void 0 ? void 0 : cognitoErr.name);
-    // Map error codes to user-friendly messages (never use raw error.message)
-    const message = code
-        ? ((_a = COGNITO_ERROR_CODE_MAP[code]) !== null && _a !== void 0 ? _a : COGNITO_ERROR_MESSAGES.UNKNOWN_ERROR)
-        : COGNITO_ERROR_MESSAGES.UNKNOWN_ERROR;
-    // Check if it's a retryable error
-    const isRetryable = code &&
-        COGNITO_ADMIN_RETRYABLE_ERROR_CODES.includes(code);
-    const kind = isRetryable ? AWS_ERROR_KIND.TRANSIENT : AWS_ERROR_KIND.FATAL;
-    return new CognitoError(message, kind, {
-        cause: err,
-        code,
-        timestamp: new Date(),
-    });
-}
-export function isCognitoError(err) {
-    return err instanceof CognitoError;
-}
-//# sourceMappingURL=errors.js.map

package/dist/auth/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../lib/auth/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnG,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC5C,YACE,OAAe,EACf,IAA0D,EAC1D,IAIC;QAED,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;CACF;AAUD,MAAM,sBAAsB,GAA2B;IACrD,qBAAqB,EAAE,sBAAsB,CAAC,cAAc;IAC5D,uBAAuB,EAAE,sBAAsB,CAAC,WAAW;IAC3D,wBAAwB,EAAE,sBAAsB,CAAC,gBAAgB;IACjE,yBAAyB,EAAE,sBAAsB,CAAC,iBAAiB;IACnE,qBAAqB,EAAE,sBAAsB,CAAC,aAAa;IAC3D,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;IAC7D,oBAAoB,EAAE,sBAAsB,CAAC,YAAY;IACzD,yBAAyB,EAAE,sBAAsB,CAAC,kBAAkB;IACpE,8BAA8B,EAAE,sBAAsB,CAAC,uBAAuB;IAC9E,6BAA6B,EAAE,sBAAsB,CAAC,sBAAsB;IAC5E,wBAAwB,EAAE,sBAAsB,CAAC,iBAAiB;IAClE,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;IAC7D,8BAA8B,EAAE,sBAAsB,CAAC,wBAAwB;IAC/E,sBAAsB,EAAE,sBAAsB,CAAC,cAAc;CAC9D,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAY;;IAC/C,MAAM,UAAU,GAAG,GAAwB,CAAC;IAE5C,MAAM,IAAI,GAAG,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,IAAI,MAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,IAAI,CAAA,CAAC;IAElD,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,CAAC,MAAA,sBAAsB,CAAC,IAAI,CAAC,mCAAI,sBAAsB,CAAC,aAAa,CAAC;QACxE,CAAC,CAAC,sBAAsB,CAAC,aAAa,CAAC;IAEzC,kCAAkC;IAClC,MAAM,WAAW,GACf,IAAI;QACJ,mCAAmC,CAAC,QAAQ,CAC1C,IAA4D,CAC7D,CAAC;IACJ,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;IAE3E,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE;QACrC,KAAK,EAAE,GAAG;QACV,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,GAAG,YAAY,YAAY,CAAC;AACrC,CAAC"}