@aweftjs/auth 0.1.0

package/dist/modules/Session.js

@@ -0,0 +1,159 @@
+// auth/Session: sessions as documents, the cookie, who a request is (design 074), and the
+// sweep that removes a session once it has been over for `keep` days (design 275).
+import { codecError } from '@aweftjs/codec';
+import { atomic } from '@aweftjs/core';
+import { userOf } from "../context.js";
+import { cookiesOf, setCookie } from "../cookie.js";
+import { json, storeOf } from "../props.js";
+import { isToken, mintToken } from "../token.js";
+export const defaults = { cookie: 'session', keep: 30, sweepMs: 3_600_000 };
+const refuse = (detail, fix) => codecError('invalid-config', `auth/Session was given ${detail}`, fix);
+// Over 2^31 - 1 milliseconds Node fires a timer after one millisecond instead.
+const MAX_TIMER = 2_147_483_647;
+export default async ({ config, ...props }) => {
+    const store = storeOf(props);
+    const cookie = String(config.cookie);
+    // Configuration is typed by hand in a same-named file, so a lifetime that is not a positive
+    // number is a mistake to stop here rather than a session that quietly never expires.
+    if (config.sessionMs !== undefined
+        && !(typeof config.sessionMs === 'number' && Number.isFinite(config.sessionMs) && config.sessionMs > 0)) {
+        throw refuse(`sessionMs ${JSON.stringify(config.sessionMs)}`, 'Set sessionMs to a positive number of milliseconds, or leave it out.');
+    }
+    const sessionMs = config.sessionMs;
+    if (typeof config.keep !== 'number' || !(config.keep > 0) || !Number.isFinite(config.keep)) {
+        throw refuse(`keep ${JSON.stringify(config.keep)}`, 'Set keep to a positive number of days.');
+    }
+    if (typeof config.sweepMs !== 'number' || !(config.sweepMs > 0) || config.sweepMs > MAX_TIMER) {
+        throw refuse(`sweepMs ${JSON.stringify(config.sweepMs)}`, 'Set sweepMs to a positive number of milliseconds, at most 2147483647.');
+    }
+    const keep = config.keep;
+    const sweepMs = config.sweepMs;
+    const doc = (token) => `session:${token}`;
+    // A document that was never written has no commits, and `open` would create it. Nothing
+    // in the store says whether a document exists without opening it, so the head stands in.
+    const read = async (token) => {
+        if (await store.head(doc(token)) === 0)
+            return undefined;
+        const handle = await store.open(doc(token));
+        const held = { ...handle.root };
+        await store.close(handle);
+        return held;
+    };
+    const issue = async (user) => {
+        const token = mintToken();
+        const handle = await store.open(doc(token));
+        const now = Date.now();
+        atomic(() => {
+            Object.assign(handle.root, {
+                user, expires: sessionMs === undefined ? null : now + sessionMs, status: 'active', createdAt: now,
+            });
+        });
+        await store.settled(handle);
+        await store.close(handle);
+        return token;
+    };
+    const revoke = async (token) => {
+        if (await store.head(doc(token)) === 0)
+            return false;
+        const handle = await store.open(doc(token));
+        const held = handle.root;
+        // The sweep can remove the document between the head and the open, and the open then
+        // makes an empty one; a session with no user was never issued, and nothing is written.
+        if (held.user === undefined) {
+            await store.close(handle);
+            await store.remove(doc(token));
+            return false;
+        }
+        const was = held.status === 'active';
+        // `expires` becomes the moment it ended, so one declared path says when any session was
+        // last valid and the sweep needs no second one.
+        if (was) {
+            atomic(() => {
+                held.status = 'revoked';
+                held.expires = Date.now();
+            });
+        }
+        await store.settled(handle);
+        await store.close(handle);
+        return was;
+    };
+    // The `user` path is declared for every document, so the answer is filtered to this
+    // battery's own sessions; `revoke` says which of them were still active.
+    const revokeAll = async (user, except) => {
+        let ended = 0;
+        for (const { doc: name } of await store.find({ where: [{ field: 'user', op: 'eq', value: user }] })) {
+            if (!name.startsWith('session:'))
+                continue;
+            const token = name.slice('session:'.length);
+            if (token === except)
+                continue;
+            if (await revoke(token))
+                ended += 1;
+        }
+        return ended;
+    };
+    // Every cookie of the name, in order: the first that is a token naming a live session wins,
+    // and none is anonymous. A value that is not a token is skipped rather than refused, since
+    // a cookie of the same name from another path or another application is not tampering, and
+    // refusing would lock the client out of the one route that clears it (design 074).
+    const whoIs = async (request, peer) => {
+        const address = peer?.address;
+        for (const token of cookiesOf(request, cookie)) {
+            if (!isToken(token))
+                continue;
+            const session = await read(token);
+            if (session === undefined || session.status !== 'active')
+                continue;
+            if (session.expires !== null && session.expires <= Date.now())
+                continue;
+            return { context: { user: session.user, session: token, address } };
+        }
+        // A fresh object each time: the server hands the same reference to every hook and event
+        // of one connection, and a module keys connections apart by it (design 260).
+        return { context: { user: null, session: null, address } };
+    };
+    const sweep = async () => {
+        const cutoff = Date.now() - keep * 86_400_000;
+        let removed = 0;
+        for (const { doc: name, fields } of await store.find({ where: [{ field: 'expires', op: 'lt', value: cutoff }] })) {
+            // The path is declared for every document, so the answer is filtered to this
+            // battery's own; a session with no end carries null, which is never under the cutoff.
+            if (!name.startsWith('session:') || typeof fields.expires !== 'number' || fields.expires >= cutoff)
+                continue;
+            await store.remove(name);
+            removed += 1;
+        }
+        return removed;
+    };
+    // Loud at load rather than at the first sweep an hour in: the sweep queries a declared
+    // path, and a store that has not declared it refuses the query.
+    try {
+        await store.find({ where: [{ field: 'expires', op: 'lt', value: 0 }], limit: 1 });
+    }
+    catch {
+        throw codecError('undeclared', 'the store does not declare the paths this battery queries', 'Spread paths from @aweftjs/auth into the store\'s declare.');
+    }
+    await sweep();
+    const timer = setInterval(() => { void sweep().catch(() => undefined); }, sweepMs);
+    timer.unref?.();
+    return {
+        public: true,
+        issue,
+        revoke,
+        revokeAll,
+        whoIs,
+        setCookie: (token, request) => setCookie(cookie, token, request, sessionMs),
+        // The only moment a page can learn who it is comes after its socket opens, because
+        // identity is fixed at the handshake (design 185).
+        call: (_args, context) => ({ user: userOf(context) }),
+        sweep,
+        stop: async () => { clearInterval(timer); },
+        routes: {
+            'DELETE /api/session': async (request, context) => {
+                if (context.session !== null)
+                    await revoke(context.session);
+                return json(200, { user: null }, { 'set-cookie': setCookie(cookie, null, request) });
+            },
+        },
+    };
+};

package/dist/modules/State.d.ts

@@ -0,0 +1,8 @@
+import type { ModuleProps } from '@aweftjs/modules';
+import { type Connection } from '@aweftjs/server';
+import { type AuthContext } from '../context.ts';
+export interface State {
+    connection(connection: Connection<AuthContext>): Promise<() => Promise<void>>;
+}
+declare const _default: (props: ModuleProps) => State;
+export default _default;

package/dist/modules/State.js

@@ -0,0 +1,22 @@
+// auth/State: the user's own state document, shared on every connection of theirs. Private,
+// so the gate never lets an anonymous connection this far (design 074).
+import { open } from '@aweftjs/server';
+import { userOf } from "../context.js";
+import { notGated, storeOf } from "../props.js";
+export default (props) => {
+    const store = storeOf(props);
+    return {
+        connection: async ({ link, context }) => {
+            const user = userOf(context);
+            if (user === null) {
+                // Only a gate that is not the auth gate lets an anonymous connection reach a private
+                // module. Loud, because sharing nothing in silence would look like an empty state.
+                throw notGated();
+            }
+            const handle = await store.open(`state:${user}`);
+            // The user's own document: whatever they write is theirs to write.
+            link.share('state', handle.root, open);
+            return async () => { await store.close(handle); };
+        },
+    };
+};

package/dist/modules/Verify.d.ts

@@ -0,0 +1,32 @@
+import type { ModuleProps } from '@aweftjs/modules';
+import { type Refusal } from '@aweftjs/server';
+import { type AuthContext } from '../context.ts';
+import { type Outcome } from '../mail.ts';
+export declare const deps: string[];
+export declare const defaults: {
+    subject: string;
+    url: null;
+    verifyMs: number;
+    sendsPerUser: number;
+    sendsWindowMs: number;
+    resendMs: number;
+    sweepMs: number;
+};
+/** The name a verified person holds. */
+export declare const VERIFIED = "verified";
+export type Confirmed = {
+    readonly user: string;
+} | {
+    readonly refused: readonly Refusal[];
+};
+export interface Verify {
+    readonly public: true;
+    /** Mail the person a link. Refuses `verified` for a person already verified, and `mail` when it did not go. */
+    send(user: string): Promise<Outcome>;
+    /** Take a link: `emailVerified` is written and `verified` granted. Refuses `taken` for a link already used and `token` for one that never was or is past its end. */
+    confirm(token: unknown): Promise<Confirmed>;
+    stop(): void;
+    readonly routes: Record<string, (request: Request, context: AuthContext) => Promise<Response>>;
+}
+declare const _default: ({ imports, config, ...props }: ModuleProps) => Verify;
+export default _default;

package/dist/modules/Verify.js

@@ -0,0 +1,97 @@
+// auth/Verify: a one-time link by mail, and the name `verified` once it is clicked (design 290).
+import { atomic } from '@aweftjs/core';
+import { sliding } from '@aweftjs/server';
+import { userOf } from "../context.js";
+import { NOT_LIVE, TAKEN, links } from "../links.js";
+import { mailLink, textOf, urlOf } from "../mail.js";
+import { bodyOf, json, numberOf, storeOf } from "../props.js";
+import { userDoc } from "../users.js";
+export const deps = ['auth/Roles', 'notify/Send'];
+export const defaults = {
+    subject: 'Verify your email address',
+    url: null,
+    verifyMs: 86_400_000,
+    sendsPerUser: 5,
+    sendsWindowMs: 86_400_000,
+    resendMs: 60_000,
+    sweepMs: 3_600_000,
+};
+/** The name a verified person holds. */
+export const VERIFIED = 'verified';
+const MODULE = 'auth/Verify';
+export default ({ imports, config, ...props }) => {
+    const store = storeOf(props);
+    const Roles = imports.Roles;
+    const mailer = imports.Send;
+    const subject = textOf(MODULE, config, 'subject');
+    const url = urlOf(MODULE, config);
+    const perUser = sliding({ count: numberOf(MODULE, config, 'sendsPerUser'), windowMs: numberOf(MODULE, config, 'sendsWindowMs') });
+    const resend = sliding({ count: 1, windowMs: numberOf(MODULE, config, 'resendMs') });
+    const held = links(store, 'verify', numberOf(MODULE, config, 'verifyMs'), numberOf(MODULE, config, 'sweepMs'));
+    const verified = async (user) => {
+        if (await store.head(userDoc(user)) === 0)
+            return false;
+        const handle = await store.open(userDoc(user));
+        const is = handle.root.emailVerified === true;
+        await store.close(handle);
+        return is;
+    };
+    const send = async (user) => {
+        if (await verified(user))
+            return { refused: [{ code: 'verified', message: 'this email is already verified' }] };
+        const token = await held.issue(user);
+        const failed = await mailLink(mailer, user, subject, 'Confirm your email address by opening this link:', url(token));
+        return failed === undefined ? { ok: true } : { refused: [failed] };
+    };
+    const confirm = async (token) => {
+        const link = await held.take(token);
+        if (link === undefined)
+            return { refused: [NOT_LIVE] };
+        if ('taken' in link)
+            return { refused: [TAKEN] };
+        const { user } = link;
+        const handle = await store.open(userDoc(user));
+        atomic(() => {
+            const root = handle.root;
+            root.emailVerified = true;
+            root.modifiedAt = Date.now();
+        });
+        await store.settled(handle);
+        await store.close(handle);
+        await Roles.grant(user, VERIFIED);
+        return { user };
+    };
+    const tooMany = (retryAfter) => json(429, { reasons: [{ code: 'attempts', message: 'too many verification mails; wait and try again' }] }, { 'retry-after': String(retryAfter) });
+    return {
+        public: true,
+        send,
+        confirm,
+        stop: () => { held.stop(); },
+        routes: {
+            'POST /api/verify/send': async (_request, context) => {
+                const user = userOf(context);
+                if (user === null)
+                    return json(401, { reasons: [{ code: 'private', message: 'sign in to verify your email' }] });
+                const inWindow = perUser.take(user);
+                if (!inWindow.ok)
+                    return tooMany(inWindow.retryAfter);
+                const since = resend.take(user);
+                if (!since.ok)
+                    return tooMany(since.retryAfter);
+                const outcome = await send(user);
+                if ('refused' in outcome) {
+                    const [reason] = outcome.refused;
+                    return json(reason?.code === 'mail' ? 502 : 409, { reasons: outcome.refused });
+                }
+                return json(200, { ok: true });
+            },
+            'POST /api/verify': async (request) => {
+                const body = await bodyOf(request);
+                const outcome = await confirm(body?.token);
+                if ('refused' in outcome)
+                    return json(400, { reasons: outcome.refused });
+                return json(200, outcome);
+            },
+        },
+    };
+};

package/dist/names.d.ts

@@ -0,0 +1,25 @@
+/** A table from a name to the names it implies. */
+export type Implies = Readonly<Record<string, readonly string[]>>;
+/** Non-empty text with no whitespace in it. */
+export declare const isName: (value: unknown) => value is string;
+/**
+ * Does a person who was granted `granted` hold `name`.
+ *
+ * True when a granted name covers it, or a name the table says a granted name implies does,
+ * transitively. Holding a name covers every name under it: `products` covers
+ * `products.abc123.read`, and `*` covers everything. The table is keyed by the exact name held,
+ * so holding `admin.super` implies what `admin.super` lists and not what `admin` does.
+ *
+ * Params:
+ *   granted: the names the person was granted
+ *   implies: the table, from a name to the names it implies; a cycle in it is fine
+ *   name: the name asked about
+ *
+ * Returns: whether the person holds it.
+ *
+ * Example:
+ *   holds(['admin'], { admin: ['*'] }, 'posts.delete');            // true
+ *   holds(['products.abc123'], {}, 'products.abc123.read');        // true
+ *   holds(['products.abc123'], {}, 'products.def456.read');        // false
+ */
+export declare const holds: (granted: readonly string[], implies: Implies, name: string) => boolean;

package/dist/names.js

@@ -0,0 +1,44 @@
+// Names: the one kind of thing a person can hold, and the check over them (design 289).
+//
+// Pure, and shared by both planes: the server module reads the store and hands the list here,
+// the page reads the shared document and does the same, so one function is the answer.
+/** Non-empty text with no whitespace in it. */
+export const isName = (value) => typeof value === 'string' && value !== '' && !/\s/.test(value);
+/** Does holding `held` cover `name`: the same, everything, or a dotted parent of it. */
+const covers = (held, name) => held === '*' || held === name || name.startsWith(`${held}.`);
+/**
+ * Does a person who was granted `granted` hold `name`.
+ *
+ * True when a granted name covers it, or a name the table says a granted name implies does,
+ * transitively. Holding a name covers every name under it: `products` covers
+ * `products.abc123.read`, and `*` covers everything. The table is keyed by the exact name held,
+ * so holding `admin.super` implies what `admin.super` lists and not what `admin` does.
+ *
+ * Params:
+ *   granted: the names the person was granted
+ *   implies: the table, from a name to the names it implies; a cycle in it is fine
+ *   name: the name asked about
+ *
+ * Returns: whether the person holds it.
+ *
+ * Example:
+ *   holds(['admin'], { admin: ['*'] }, 'posts.delete');            // true
+ *   holds(['products.abc123'], {}, 'products.abc123.read');        // true
+ *   holds(['products.abc123'], {}, 'products.def456.read');        // false
+ */
+export const holds = (granted, implies, name) => {
+    const seen = new Set();
+    const queue = [...granted];
+    while (queue.length > 0) {
+        const held = queue.pop();
+        if (seen.has(held))
+            continue;
+        seen.add(held);
+        if (covers(held, name))
+            return true;
+        const more = Object.hasOwn(implies, held) ? implies[held] : [];
+        for (const implied of more)
+            queue.push(implied);
+    }
+    return false;
+};

package/dist/password.d.ts

@@ -0,0 +1,4 @@
+/** The text to store for a password. Never the password. */
+export declare const hashPassword: (password: string) => Promise<string>;
+/** Does the password match the stored text? False, never a throw, for text that is not a hash. */
+export declare const verifyPassword: (password: string, stored: unknown) => Promise<boolean>;

package/dist/password.js

@@ -0,0 +1,41 @@
+// Passwords: hashed with Node's own scrypt, compared with Node's own `timingSafeEqual`
+// (design 074). No test here measures the comparison's timing; the claim is which function
+// is called, and that is all.
+//
+// The stored text carries the parameters and the salt beside the hash, so a later change of
+// parameters is a re-hash on the next sign-in and never a migration.
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+// Node's own defaults for scrypt, written into every hash so they can change.
+const COST = 16384;
+const BLOCK = 8;
+const PARALLEL = 1;
+const SALT_BYTES = 16;
+const KEY_BYTES = 64;
+const derive = (password, salt, N, r, p, length) => new Promise((done, fail) => {
+    scrypt(password, salt, length, { N, r, p, maxmem: 128 * N * r * 2 }, (error, key) => (error ? fail(error) : done(key)));
+});
+/** The text to store for a password. Never the password. */
+export const hashPassword = async (password) => {
+    const salt = randomBytes(SALT_BYTES);
+    const key = await derive(password, salt, COST, BLOCK, PARALLEL, KEY_BYTES);
+    return ['scrypt', COST, BLOCK, PARALLEL, salt.toString('base64url'), key.toString('base64url')].join('$');
+};
+/** Does the password match the stored text? False, never a throw, for text that is not a hash. */
+export const verifyPassword = async (password, stored) => {
+    if (typeof stored !== 'string')
+        return false;
+    const [kind, N, r, p, salt, hash] = stored.split('$');
+    if (kind !== 'scrypt' || salt === undefined || hash === undefined)
+        return false;
+    const expected = Buffer.from(hash, 'base64url');
+    if (expected.length === 0)
+        return false;
+    let key;
+    try {
+        key = await derive(password, Buffer.from(salt, 'base64url'), Number(N), Number(r), Number(p), expected.length);
+    }
+    catch {
+        return false;
+    }
+    return key.length === expected.length && timingSafeEqual(key, expected);
+};

package/dist/props.d.ts

@@ -0,0 +1,15 @@
+import type { Store } from '@aweftjs/store';
+/**
+ * The store the loader was made with. Loud when it was not, rather than undefined at the first write.
+ *
+ * Throws: `no-store` when the loader's props carry no store.
+ */
+export declare const storeOf: (props: Readonly<Record<string, unknown>>) => Store;
+export declare const invalidConfig: (module: string, detail: string, fix: string) => Error;
+/** A positive finite number out of a module's config, or `invalid-config` naming the module. */
+export declare const numberOf: (module: string, config: Readonly<Record<string, unknown>>, key: string) => number;
+export declare const json: (status: number, body: unknown, headers?: Record<string, string>) => Response;
+/** The JSON body of a request, or undefined when there is none worth the name. */
+export declare const bodyOf: (request: Request) => Promise<Record<string, unknown> | undefined>;
+/** The refusal a private module raises when a gate that is not this battery's let an anonymous connection reach it. */
+export declare const notGated: () => Error;

package/dist/props.js

@@ -0,0 +1,35 @@
+// What every module here reads off the loader's props: the application's store.
+import { codecError } from '@aweftjs/codec';
+/**
+ * The store the loader was made with. Loud when it was not, rather than undefined at the first write.
+ *
+ * Throws: `no-store` when the loader's props carry no store.
+ */
+export const storeOf = (props) => {
+    const store = props.store;
+    if (store === undefined || typeof store.open !== 'function') {
+        throw codecError('no-store', 'the loader needs a store in its props', 'Pass store to createServer, or props: { store } to a loader you build yourself.');
+    }
+    return store;
+};
+export const invalidConfig = (module, detail, fix) => codecError('invalid-config', `${module} was given ${detail}`, fix);
+/** A positive finite number out of a module's config, or `invalid-config` naming the module. */
+export const numberOf = (module, config, key) => {
+    const held = config[key];
+    if (typeof held !== 'number' || !(held > 0) || !Number.isFinite(held))
+        throw invalidConfig(module, `${key} ${JSON.stringify(held)}`, 'Give that setting a number above zero.');
+    return held;
+};
+export const json = (status, body, headers = {}) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', ...headers } });
+/** The JSON body of a request, or undefined when there is none worth the name. */
+export const bodyOf = async (request) => {
+    try {
+        const body = await request.json();
+        return body !== null && typeof body === 'object' && !Array.isArray(body) ? body : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** The refusal a private module raises when a gate that is not this battery's let an anonymous connection reach it. */
+export const notGated = () => codecError('not-gated', 'an anonymous connection reached a private module', 'Put auth/Gate in front of the server, or make the module public.');

package/dist/token.d.ts

@@ -0,0 +1,3 @@
+export declare const mintToken: () => string;
+/** Is this text shaped like a token this battery minted. */
+export declare const isToken: (value: unknown) => value is string;

package/dist/token.js

@@ -0,0 +1,11 @@
+// A token: what a session, a verification link and a reset link are named by (designs 275, 290).
+//
+// Sixteen random bytes of its own, not an id: an id is twelve bytes, the width a document
+// needs, and a credential needs 128 bits. Sixteen bytes are exactly twenty-two base64url
+// characters with no padding.
+import { randomBytes } from 'node:crypto';
+const TOKEN_BYTES = 16;
+const TOKEN = /^[A-Za-z0-9_-]{22}$/;
+export const mintToken = () => randomBytes(TOKEN_BYTES).toString('base64url');
+/** Is this text shaped like a token this battery minted. */
+export const isToken = (value) => typeof value === 'string' && TOKEN.test(value);

package/dist/users.d.ts

@@ -0,0 +1,9 @@
+import type { Store } from '@aweftjs/store';
+/** One address, one spelling: trimmed and lowercased, which is what the index holds. */
+export declare const normalEmail: (email: string) => string;
+/** Enough of a check to keep a string with no address in it out of the index. */
+export declare const looksLikeEmail: (email: string) => boolean;
+/** The document name of the user with this email, or undefined. */
+export declare const findUser: (store: Store, email: string) => Promise<string | undefined>;
+export declare const userDoc: (id: string) => string;
+export declare const idOfUserDoc: (doc: string) => string;

package/dist/users.js

@@ -0,0 +1,12 @@
+// User documents: `user:<id>`, found by the declared `email` path (design 074).
+/** One address, one spelling: trimmed and lowercased, which is what the index holds. */
+export const normalEmail = (email) => email.trim().toLowerCase();
+/** Enough of a check to keep a string with no address in it out of the index. */
+export const looksLikeEmail = (email) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+/** The document name of the user with this email, or undefined. */
+export const findUser = async (store, email) => {
+    const hits = await store.find({ where: [{ field: 'email', op: 'eq', value: normalEmail(email) }] });
+    return hits.find((hit) => hit.doc.startsWith('user:'))?.doc;
+};
+export const userDoc = (id) => `user:${id}`;
+export const idOfUserDoc = (doc) => doc.slice('user:'.length);

package/errors.txt

@@ -0,0 +1,29 @@
+anonymous: Wait for user to read a string, or call enter first; an anonymous connection has no state.
+change-failed: Check the server is running and that auth/Password is loaded from the mail source, then try again.
+closed: Make a new client with createClient, and a new auth over it.
+enter-failed: Check the server is running and that auth/Enter is loaded, then try again.
+forgot-failed: Check the server is running and that auth/Password is loaded from the mail source, then try again.
+invalid-config: A name is non-empty text with no whitespace: admin, verified, products.abc123.
+invalid-config: Give first, and each entry of implies, a list of names: non-empty text with no whitespace.
+invalid-config: Give implies an object from a name to the list of names it implies.
+invalid-config: Give passwordMax at least passwordMin.
+invalid-config: Give refusePassword a function of the password answering true to refuse it, or null.
+invalid-config: Give refuseSignUp a function of the sign-up answering a refusal to refuse it and nothing to allow it, or null.
+invalid-config: Give that setting a number above zero.
+invalid-config: Give that setting some text.
+invalid-config: Give url a function of the token answering the address of the page that takes it: (token) => `https://app.example/verify?token=${token}`.
+invalid-config: Set keep to a positive number of days.
+invalid-config: Set sessionMs to a positive number of milliseconds, or leave it out.
+invalid-config: Set sweepMs to a positive number of milliseconds, at most 2147483647.
+invalid-name: A name is non-empty text with no whitespace: admin, verified, products.abc123.
+invalid-user: Hand it the id the gate put on the context, which is text.
+leave-failed: Check the server is running and that auth/Session is loaded, then try again.
+malformed: Call it as { email: "someone@example.com" }.
+no-client: Pass the client createClient answered as the StageContext client, or none at all.
+no-origin: Pass origin to createAuth; outside a page there is no origin to read one from.
+no-store: Pass store to createServer, or props: { store } to a loader you build yourself.
+not-gated: Put auth/Gate in front of the server, or make the module public.
+reset-failed: Check the server is running and that auth/Password is loaded from the mail source, then try again.
+stopped: Make a new auth with createAuth; a stopped one follows no connection.
+undeclared: Spread paths from @aweftjs/auth into the store's declare.
+verify-failed: Check the server is running and that auth/Verify is loaded from the mail source, then try again.

package/package.json

@@ -0,0 +1,62 @@
+{
+	"name": "@aweftjs/auth",
+	"version": "0.1.0",
+	"type": "module",
+	"license": "MIT",
+	"engines": {
+		"node": ">=24.12.0"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/torrinworx/aweft.git",
+		"directory": "packages/auth"
+	},
+	"files": [
+		"dist",
+		"src",
+		"README.md",
+		"surface.txt",
+		"errors.txt",
+		"text.json"
+	],
+	"description": "The first battery: a gate that reads public, sessions as documents, sign-in and sign-up by email and password, and a per-user state document, as server modules, with the page half as client modules.",
+	"exports": {
+		".": {
+			"aweft-source": "./src/index.ts",
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./client": {
+			"aweft-source": "./src/client.ts",
+			"types": "./dist/client.d.ts",
+			"default": "./dist/client.js"
+		},
+		"./text.json": "./text.json"
+	},
+	"scripts": {
+		"prepack": "node ../build/scripts/build-package.ts",
+		"test": "node --import @aweftjs/build/loader --test tests/*.test.ts"
+	},
+	"dependencies": {
+		"@aweftjs/client": "^0.1.0",
+		"@aweftjs/codec": "^0.1.0",
+		"@aweftjs/core": "^0.1.0",
+		"@aweftjs/modules": "^0.1.0",
+		"@aweftjs/server": "^0.1.0",
+		"@aweftjs/store": "^0.1.0",
+		"@aweftjs/ui": "^0.1.0"
+	},
+	"devDependencies": {
+		"@aweftjs/build": "^0.1.0",
+		"@aweftjs/notify": "^0.1.0",
+		"@aweftjs/sync": "^0.1.0",
+		"@aweftjs/testing": "^0.1.0"
+	},
+	"aweft": {
+		"tier": "integrator",
+		"branchCoverage": 80
+	},
+	"publishConfig": {
+		"access": "public"
+	}
+}