@aweftjs/auth 0.1.0

package/src/modules/Session.ts

@@ -0,0 +1,196 @@
+// auth/Session: sessions as documents, the cookie, who a request is (design 074), and the
+// sweep that removes a session once it has been over for `keep` days (design 275).
+
+import { codecError } from '@aweftjs/codec';
+import { atomic } from '@aweftjs/core';
+import type { ModuleProps } from '@aweftjs/modules';
+import type { Identified, Peer } from '@aweftjs/server';
+
+import { type AuthContext, userOf } from '../context.ts';
+import { cookiesOf, setCookie } from '../cookie.ts';
+import { json, storeOf } from '../props.ts';
+import { isToken, mintToken } from '../token.ts';
+
+export const defaults = { cookie: 'session', keep: 30, sweepMs: 3_600_000 };
+
+/** What a `session:<token>` document holds. */
+export interface SessionDocument extends Record<string, unknown> {
+	user: string;
+	/** When it stopped, or stops, being valid: the lifetime's end, the moment of revocation, or null for never. */
+	expires: number | null;
+	status: 'active' | 'revoked';
+	createdAt: number;
+}
+
+export interface Session {
+	readonly public: true;
+	/** Mint a session for a user. Returns its token, which is the cookie's value. */
+	issue(user: string): Promise<string>;
+	/** End a session. True when it was active. */
+	revoke(token: string): Promise<boolean>;
+	/** End every active session of a user but the one named. Returns how many it ended. */
+	revokeAll(user: string, except?: string): Promise<number>;
+	/** Who a request is, from its cookies, and where it came from. Always a context: this gate refuses nobody at the door. */
+	whoIs(request: Request, peer?: Peer): Promise<Identified<AuthContext>>;
+	/** The `Set-Cookie` value that sets the cookie to a token, or clears it for null. */
+	setCookie(token: string | null, request: Request): string;
+	/** Who the asking connection is. The module is public, so an anonymous one hears `{ user: null }`. */
+	call(args: unknown, context: unknown): { user: string | null };
+	/** Remove every session that has been over for longer than `keep` days. Returns how many. */
+	sweep(): Promise<number>;
+	stop(): Promise<void>;
+	readonly routes: Record<string, (request: Request, context: AuthContext) => Promise<Response>>;
+}
+
+const refuse = (detail: string, fix: string): Error => codecError('invalid-config', `auth/Session was given ${detail}`, fix);
+
+// Over 2^31 - 1 milliseconds Node fires a timer after one millisecond instead.
+const MAX_TIMER = 2_147_483_647;
+
+export default async ({ config, ...props }: ModuleProps): Promise<Session> => {
+	const store = storeOf(props);
+	const cookie = String(config.cookie);
+	// Configuration is typed by hand in a same-named file, so a lifetime that is not a positive
+	// number is a mistake to stop here rather than a session that quietly never expires.
+	if (config.sessionMs !== undefined
+		&& !(typeof config.sessionMs === 'number' && Number.isFinite(config.sessionMs) && config.sessionMs > 0)) {
+		throw refuse(`sessionMs ${JSON.stringify(config.sessionMs)}`, 'Set sessionMs to a positive number of milliseconds, or leave it out.');
+	}
+	const sessionMs = config.sessionMs as number | undefined;
+	if (typeof config.keep !== 'number' || !(config.keep > 0) || !Number.isFinite(config.keep)) {
+		throw refuse(`keep ${JSON.stringify(config.keep)}`, 'Set keep to a positive number of days.');
+	}
+	if (typeof config.sweepMs !== 'number' || !(config.sweepMs > 0) || config.sweepMs > MAX_TIMER) {
+		throw refuse(`sweepMs ${JSON.stringify(config.sweepMs)}`, 'Set sweepMs to a positive number of milliseconds, at most 2147483647.');
+	}
+	const keep = config.keep;
+	const sweepMs = config.sweepMs;
+	const doc = (token: string): string => `session:${token}`;
+
+	// A document that was never written has no commits, and `open` would create it. Nothing
+	// in the store says whether a document exists without opening it, so the head stands in.
+	const read = async (token: string): Promise<SessionDocument | undefined> => {
+		if (await store.head(doc(token)) === 0) return undefined;
+		const handle = await store.open(doc(token));
+		const held = { ...(handle.root as SessionDocument) };
+		await store.close(handle);
+		return held;
+	};
+
+	const issue = async (user: string): Promise<string> => {
+		const token = mintToken();
+		const handle = await store.open(doc(token));
+		const now = Date.now();
+		atomic(() => {
+			Object.assign(handle.root, {
+				user, expires: sessionMs === undefined ? null : now + sessionMs, status: 'active', createdAt: now,
+			} satisfies SessionDocument);
+		});
+		await store.settled(handle);
+		await store.close(handle);
+		return token;
+	};
+
+	const revoke = async (token: string): Promise<boolean> => {
+		if (await store.head(doc(token)) === 0) return false;
+		const handle = await store.open(doc(token));
+		const held = handle.root as SessionDocument;
+		// The sweep can remove the document between the head and the open, and the open then
+		// makes an empty one; a session with no user was never issued, and nothing is written.
+		if (held.user === undefined) {
+			await store.close(handle);
+			await store.remove(doc(token));
+			return false;
+		}
+		const was = held.status === 'active';
+		// `expires` becomes the moment it ended, so one declared path says when any session was
+		// last valid and the sweep needs no second one.
+		if (was) {
+			atomic(() => {
+				held.status = 'revoked';
+				held.expires = Date.now();
+			});
+		}
+		await store.settled(handle);
+		await store.close(handle);
+		return was;
+	};
+
+	// The `user` path is declared for every document, so the answer is filtered to this
+	// battery's own sessions; `revoke` says which of them were still active.
+	const revokeAll = async (user: string, except?: string): Promise<number> => {
+		let ended = 0;
+		for (const { doc: name } of await store.find({ where: [{ field: 'user', op: 'eq', value: user }] })) {
+			if (!name.startsWith('session:')) continue;
+			const token = name.slice('session:'.length);
+			if (token === except) continue;
+			if (await revoke(token)) ended += 1;
+		}
+		return ended;
+	};
+
+	// Every cookie of the name, in order: the first that is a token naming a live session wins,
+	// and none is anonymous. A value that is not a token is skipped rather than refused, since
+	// a cookie of the same name from another path or another application is not tampering, and
+	// refusing would lock the client out of the one route that clears it (design 074).
+	const whoIs = async (request: Request, peer?: Peer): Promise<Identified<AuthContext>> => {
+		const address = peer?.address;
+		for (const token of cookiesOf(request, cookie)) {
+			if (!isToken(token)) continue;
+			const session = await read(token);
+			if (session === undefined || session.status !== 'active') continue;
+			if (session.expires !== null && session.expires <= Date.now()) continue;
+			return { context: { user: session.user, session: token, address } };
+		}
+		// A fresh object each time: the server hands the same reference to every hook and event
+		// of one connection, and a module keys connections apart by it (design 260).
+		return { context: { user: null, session: null, address } };
+	};
+
+	const sweep = async (): Promise<number> => {
+		const cutoff = Date.now() - keep * 86_400_000;
+		let removed = 0;
+		for (const { doc: name, fields } of await store.find({ where: [{ field: 'expires', op: 'lt', value: cutoff }] })) {
+			// The path is declared for every document, so the answer is filtered to this
+			// battery's own; a session with no end carries null, which is never under the cutoff.
+			if (!name.startsWith('session:') || typeof fields.expires !== 'number' || fields.expires >= cutoff) continue;
+			await store.remove(name);
+			removed += 1;
+		}
+		return removed;
+	};
+
+	// Loud at load rather than at the first sweep an hour in: the sweep queries a declared
+	// path, and a store that has not declared it refuses the query.
+	try {
+		await store.find({ where: [{ field: 'expires', op: 'lt', value: 0 }], limit: 1 });
+	} catch {
+		throw codecError(
+			'undeclared', 'the store does not declare the paths this battery queries',
+			'Spread paths from @aweftjs/auth into the store\'s declare.',
+		);
+	}
+	await sweep();
+	const timer = setInterval(() => { void sweep().catch(() => undefined); }, sweepMs);
+	timer.unref?.();
+
+	return {
+		public: true,
+		issue,
+		revoke,
+		revokeAll,
+		whoIs,
+		setCookie: (token, request) => setCookie(cookie, token, request, sessionMs),
+		// The only moment a page can learn who it is comes after its socket opens, because
+		// identity is fixed at the handshake (design 185).
+		call: (_args, context) => ({ user: userOf(context) }),
+		sweep,
+		stop: async () => { clearInterval(timer); },
+		routes: {
+			'DELETE /api/session': async (request, context) => {
+				if (context.session !== null) await revoke(context.session);
+				return json(200, { user: null }, { 'set-cookie': setCookie(cookie, null, request) });
+			},
+		},
+	};
+};

package/src/modules/State.ts

@@ -0,0 +1,30 @@
+// auth/State: the user's own state document, shared on every connection of theirs. Private,
+// so the gate never lets an anonymous connection this far (design 074).
+
+import type { ModuleProps } from '@aweftjs/modules';
+import { type Connection, open } from '@aweftjs/server';
+
+import { type AuthContext, userOf } from '../context.ts';
+import { notGated, storeOf } from '../props.ts';
+
+export interface State {
+	connection(connection: Connection<AuthContext>): Promise<() => Promise<void>>;
+}
+
+export default (props: ModuleProps): State => {
+	const store = storeOf(props);
+	return {
+		connection: async ({ link, context }) => {
+			const user = userOf(context);
+			if (user === null) {
+				// Only a gate that is not the auth gate lets an anonymous connection reach a private
+				// module. Loud, because sharing nothing in silence would look like an empty state.
+				throw notGated();
+			}
+			const handle = await store.open(`state:${user}`);
+			// The user's own document: whatever they write is theirs to write.
+			link.share('state', handle.root, open);
+			return async () => { await store.close(handle); };
+		},
+	};
+};

package/src/modules/Verify.ts

@@ -0,0 +1,118 @@
+// auth/Verify: a one-time link by mail, and the name `verified` once it is clicked (design 290).
+
+import { atomic } from '@aweftjs/core';
+import type { ModuleProps } from '@aweftjs/modules';
+import { type Refusal, sliding } from '@aweftjs/server';
+
+import { type AuthContext, userOf } from '../context.ts';
+import { type Links, NOT_LIVE, TAKEN, links } from '../links.ts';
+import { type Mailer, type Outcome, mailLink, textOf, urlOf } from '../mail.ts';
+import { bodyOf, json, numberOf, storeOf } from '../props.ts';
+import { userDoc } from '../users.ts';
+import type { UserDocument } from './Enter.ts';
+import type { Roles } from './Roles.ts';
+
+export const deps = ['auth/Roles', 'notify/Send'];
+
+export const defaults = {
+	subject: 'Verify your email address',
+	url: null,
+	verifyMs: 86_400_000,
+	sendsPerUser: 5,
+	sendsWindowMs: 86_400_000,
+	resendMs: 60_000,
+	sweepMs: 3_600_000,
+};
+
+/** The name a verified person holds. */
+export const VERIFIED = 'verified';
+
+export type Confirmed = { readonly user: string } | { readonly refused: readonly Refusal[] };
+
+export interface Verify {
+	readonly public: true;
+	/** Mail the person a link. Refuses `verified` for a person already verified, and `mail` when it did not go. */
+	send(user: string): Promise<Outcome>;
+	/** Take a link: `emailVerified` is written and `verified` granted. Refuses `taken` for a link already used and `token` for one that never was or is past its end. */
+	confirm(token: unknown): Promise<Confirmed>;
+	stop(): void;
+	readonly routes: Record<string, (request: Request, context: AuthContext) => Promise<Response>>;
+}
+
+const MODULE = 'auth/Verify';
+
+
+export default ({ imports, config, ...props }: ModuleProps): Verify => {
+	const store = storeOf(props);
+	const Roles = imports.Roles as Roles;
+	const mailer = imports.Send as Mailer;
+	const subject = textOf(MODULE, config, 'subject');
+	const url = urlOf(MODULE, config);
+	const perUser = sliding({ count: numberOf(MODULE, config, 'sendsPerUser'), windowMs: numberOf(MODULE, config, 'sendsWindowMs') });
+	const resend = sliding({ count: 1, windowMs: numberOf(MODULE, config, 'resendMs') });
+	const held: Links = links(store, 'verify', numberOf(MODULE, config, 'verifyMs'), numberOf(MODULE, config, 'sweepMs'));
+
+	const verified = async (user: string): Promise<boolean> => {
+		if (await store.head(userDoc(user)) === 0) return false;
+		const handle = await store.open(userDoc(user));
+		const is = (handle.root as Partial<UserDocument>).emailVerified === true;
+		await store.close(handle);
+		return is;
+	};
+
+	const send = async (user: string): Promise<Outcome> => {
+		if (await verified(user)) return { refused: [{ code: 'verified', message: 'this email is already verified' }] };
+		const token = await held.issue(user);
+		const failed = await mailLink(mailer, user, subject, 'Confirm your email address by opening this link:', url(token));
+		return failed === undefined ? { ok: true } : { refused: [failed] };
+	};
+
+	const confirm = async (token: unknown): Promise<Confirmed> => {
+		const link = await held.take(token);
+		if (link === undefined) return { refused: [NOT_LIVE] };
+		if ('taken' in link) return { refused: [TAKEN] };
+		const { user } = link;
+		const handle = await store.open(userDoc(user));
+		atomic(() => {
+			const root = handle.root as Partial<UserDocument>;
+			root.emailVerified = true;
+			root.modifiedAt = Date.now();
+		});
+		await store.settled(handle);
+		await store.close(handle);
+		await Roles.grant(user, VERIFIED);
+		return { user };
+	};
+
+	const tooMany = (retryAfter: number): Response =>
+		json(429, { reasons: [{ code: 'attempts', message: 'too many verification mails; wait and try again' }] }, { 'retry-after': String(retryAfter) });
+
+	return {
+		public: true,
+		send,
+		confirm,
+		stop: () => { held.stop(); },
+		routes: {
+			'POST /api/verify/send': async (_request, context) => {
+				const user = userOf(context);
+				if (user === null) return json(401, { reasons: [{ code: 'private', message: 'sign in to verify your email' }] });
+				const inWindow = perUser.take(user);
+				if (!inWindow.ok) return tooMany(inWindow.retryAfter);
+				const since = resend.take(user);
+				if (!since.ok) return tooMany(since.retryAfter);
+				const outcome = await send(user);
+				if ('refused' in outcome) {
+					const [reason] = outcome.refused;
+					return json(reason?.code === 'mail' ? 502 : 409, { reasons: outcome.refused });
+				}
+				return json(200, { ok: true });
+			},
+			'POST /api/verify': async (request) => {
+				const body = await bodyOf(request);
+				const outcome = await confirm(body?.token);
+				if ('refused' in outcome) return json(400, { reasons: outcome.refused });
+				return json(200, outcome);
+			},
+		},
+	};
+};

package/src/names.ts

@@ -0,0 +1,49 @@
+// Names: the one kind of thing a person can hold, and the check over them (design 289).
+//
+// Pure, and shared by both planes: the server module reads the store and hands the list here,
+// the page reads the shared document and does the same, so one function is the answer.
+
+/** A table from a name to the names it implies. */
+export type Implies = Readonly<Record<string, readonly string[]>>;
+
+/** Non-empty text with no whitespace in it. */
+export const isName = (value: unknown): value is string =>
+	typeof value === 'string' && value !== '' && !/\s/.test(value);
+
+/** Does holding `held` cover `name`: the same, everything, or a dotted parent of it. */
+const covers = (held: string, name: string): boolean =>
+	held === '*' || held === name || name.startsWith(`${held}.`);
+
+/**
+ * Does a person who was granted `granted` hold `name`.
+ *
+ * True when a granted name covers it, or a name the table says a granted name implies does,
+ * transitively. Holding a name covers every name under it: `products` covers
+ * `products.abc123.read`, and `*` covers everything. The table is keyed by the exact name held,
+ * so holding `admin.super` implies what `admin.super` lists and not what `admin` does.
+ *
+ * Params:
+ *   granted: the names the person was granted
+ *   implies: the table, from a name to the names it implies; a cycle in it is fine
+ *   name: the name asked about
+ *
+ * Returns: whether the person holds it.
+ *
+ * Example:
+ *   holds(['admin'], { admin: ['*'] }, 'posts.delete');            // true
+ *   holds(['products.abc123'], {}, 'products.abc123.read');        // true
+ *   holds(['products.abc123'], {}, 'products.def456.read');        // false
+ */
+export const holds = (granted: readonly string[], implies: Implies, name: string): boolean => {
+	const seen = new Set<string>();
+	const queue = [...granted];
+	while (queue.length > 0) {
+		const held = queue.pop()!;
+		if (seen.has(held)) continue;
+		seen.add(held);
+		if (covers(held, name)) return true;
+		const more = Object.hasOwn(implies, held) ? implies[held]! : [];
+		for (const implied of more) queue.push(implied);
+	}
+	return false;
+};

package/src/password.ts

@@ -0,0 +1,43 @@
+// Passwords: hashed with Node's own scrypt, compared with Node's own `timingSafeEqual`
+// (design 074). No test here measures the comparison's timing; the claim is which function
+// is called, and that is all.
+//
+// The stored text carries the parameters and the salt beside the hash, so a later change of
+// parameters is a re-hash on the next sign-in and never a migration.
+
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+
+// Node's own defaults for scrypt, written into every hash so they can change.
+const COST = 16384;
+const BLOCK = 8;
+const PARALLEL = 1;
+const SALT_BYTES = 16;
+const KEY_BYTES = 64;
+
+const derive = (password: string, salt: Buffer, N: number, r: number, p: number, length: number): Promise<Buffer> =>
+	new Promise((done, fail) => {
+		scrypt(password, salt, length, { N, r, p, maxmem: 128 * N * r * 2 }, (error, key) => (error ? fail(error) : done(key)));
+	});
+
+/** The text to store for a password. Never the password. */
+export const hashPassword = async (password: string): Promise<string> => {
+	const salt = randomBytes(SALT_BYTES);
+	const key = await derive(password, salt, COST, BLOCK, PARALLEL, KEY_BYTES);
+	return ['scrypt', COST, BLOCK, PARALLEL, salt.toString('base64url'), key.toString('base64url')].join('$');
+};
+
+/** Does the password match the stored text? False, never a throw, for text that is not a hash. */
+export const verifyPassword = async (password: string, stored: unknown): Promise<boolean> => {
+	if (typeof stored !== 'string') return false;
+	const [kind, N, r, p, salt, hash] = stored.split('$');
+	if (kind !== 'scrypt' || salt === undefined || hash === undefined) return false;
+	const expected = Buffer.from(hash, 'base64url');
+	if (expected.length === 0) return false;
+	let key: Buffer;
+	try {
+		key = await derive(password, Buffer.from(salt, 'base64url'), Number(N), Number(r), Number(p), expected.length);
+	} catch {
+		return false;
+	}
+	return key.length === expected.length && timingSafeEqual(key, expected);
+};

package/src/props.ts

@@ -0,0 +1,47 @@
+// What every module here reads off the loader's props: the application's store.
+
+import { codecError } from '@aweftjs/codec';
+import type { Store } from '@aweftjs/store';
+
+/**
+ * The store the loader was made with. Loud when it was not, rather than undefined at the first write.
+ *
+ * Throws: `no-store` when the loader's props carry no store.
+ */
+export const storeOf = (props: Readonly<Record<string, unknown>>): Store => {
+	const store = props.store as Store | undefined;
+	if (store === undefined || typeof store.open !== 'function') {
+		throw codecError(
+			'no-store', 'the loader needs a store in its props',
+			'Pass store to createServer, or props: { store } to a loader you build yourself.',
+		);
+	}
+	return store;
+};
+
+export const invalidConfig = (module: string, detail: string, fix: string): Error =>
+	codecError('invalid-config', `${module} was given ${detail}`, fix);
+
+/** A positive finite number out of a module's config, or `invalid-config` naming the module. */
+export const numberOf = (module: string, config: Readonly<Record<string, unknown>>, key: string): number => {
+	const held: unknown = config[key];
+	if (typeof held !== 'number' || !(held > 0) || !Number.isFinite(held)) throw invalidConfig(module, `${key} ${JSON.stringify(held)}`, 'Give that setting a number above zero.');
+	return held;
+};
+
+export const json = (status: number, body: unknown, headers: Record<string, string> = {}): Response =>
+	new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', ...headers } });
+
+/** The JSON body of a request, or undefined when there is none worth the name. */
+export const bodyOf = async (request: Request): Promise<Record<string, unknown> | undefined> => {
+	try {
+		const body: unknown = await request.json();
+		return body !== null && typeof body === 'object' && !Array.isArray(body) ? body as Record<string, unknown> : undefined;
+	} catch {
+		return undefined;
+	}
+};
+
+/** The refusal a private module raises when a gate that is not this battery's let an anonymous connection reach it. */
+export const notGated = (): Error =>
+	codecError('not-gated', 'an anonymous connection reached a private module', 'Put auth/Gate in front of the server, or make the module public.');

package/src/token.ts

@@ -0,0 +1,15 @@
+// A token: what a session, a verification link and a reset link are named by (designs 275, 290).
+//
+// Sixteen random bytes of its own, not an id: an id is twelve bytes, the width a document
+// needs, and a credential needs 128 bits. Sixteen bytes are exactly twenty-two base64url
+// characters with no padding.
+
+import { randomBytes } from 'node:crypto';
+
+const TOKEN_BYTES = 16;
+const TOKEN = /^[A-Za-z0-9_-]{22}$/;
+
+export const mintToken = (): string => randomBytes(TOKEN_BYTES).toString('base64url');
+
+/** Is this text shaped like a token this battery minted. */
+export const isToken = (value: unknown): value is string => typeof value === 'string' && TOKEN.test(value);

package/src/users.ts

@@ -0,0 +1,18 @@
+// User documents: `user:<id>`, found by the declared `email` path (design 074).
+
+import type { Store } from '@aweftjs/store';
+
+/** One address, one spelling: trimmed and lowercased, which is what the index holds. */
+export const normalEmail = (email: string): string => email.trim().toLowerCase();
+
+/** Enough of a check to keep a string with no address in it out of the index. */
+export const looksLikeEmail = (email: string): boolean => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+
+/** The document name of the user with this email, or undefined. */
+export const findUser = async (store: Store, email: string): Promise<string | undefined> => {
+	const hits = await store.find({ where: [{ field: 'email', op: 'eq', value: normalEmail(email) }] });
+	return hits.find((hit) => hit.doc.startsWith('user:'))?.doc;
+};
+
+export const userDoc = (id: string): string => `user:${id}`;
+export const idOfUserDoc = (doc: string): string => doc.slice('user:'.length);

package/surface.txt

@@ -0,0 +1,19 @@
+type AuthContext: interface AuthContext { readonly user: string | null; readonly session: string | null; readonly address?: string | undefined; }
+type Implies: type Implies = Readonly<Record<string, readonly string[]>>;
+type RefuseSignUp: type RefuseSignUp = (signUp: SignUp) => Refusal | undefined | Promise<Refusal | undefined>;
+type Roles: interface Roles { may(user: string, name: string): Promise<boolean>; grant(user: string, ...names: string[]): Promise<void>; revoke(user: string, ...names: string[]): Promise<void>; names(user: string): Promise<string[]>; first(user: string): Promise<boolean>; call(args: unknown, context: unknown): { implies: Implies; }; connection(connection: Connection<AuthContext>): Promise<() => Promise<void>>; }
+type SignUp: interface SignUp { readonly email: string; readonly extra: Readonly<Record<string, unknown>>; readonly context: AuthContext; readonly store: Store; }
+value auth: Source
+value holds: (granted: readonly string[], implies: Readonly<Record<string, readonly string[]>>, name: string) => boolean
+value mail: Source
+value paths: Readonly<Record<string, readonly string[]>>
+./client type Auth: interface Auth { readonly user: Derived<string | null | undefined>; readonly names: Derived<readonly string[] | undefined>; may(name: string): boolean; enter(email: string, password: string, extra?: Readonly<Record<string, unknown>>): Promise<Entered>; leave(): Promise<void>; state<T extends object>(): Handle<T>; check(email: string): Promise<boolean>; verify(token?: string): Promise<Outcome>; change(current: string, password: string): Promise<Outcome>; forgot(email: string): Promise<Outcome>; reset(token: string, password: string): Promise<Outcome>; stop(): void; }
+./client type AuthOptions: interface AuthOptions { readonly origin?: string | undefined; readonly fetch?: Fetcher | undefined; }
+./client type Entered: type Entered = { readonly user: string; readonly created: boolean; } | { readonly refused: readonly Refusal[]; };
+./client type FetchInit: interface FetchInit { method: string; headers: Record<string, string>; body?: string; credentials: 'same-origin'; }
+./client type FetchResponse: interface FetchResponse { status: number; ok: boolean; json(): Promise<unknown>; }
+./client type Fetcher: type Fetcher = (url: string, init: FetchInit) => Promise<FetchResponse>;
+./client type Outcome: type Outcome = { readonly ok: true; } | { readonly refused: Refusals; };
+./client value authClient: Source
+./client value createAuth: (client: Client, options?: AuthOptions) => Auth
+./text.json data ./text.json

package/text.json

@@ -0,0 +1,50 @@
+{
+	"Email": [
+		"src/client-modules/Reset.tsx",
+		"src/client-modules/SignIn.tsx"
+	],
+	"If that address has an account, a link is on its way.": [
+		"src/client-modules/Reset.tsx"
+	],
+	"New password": [
+		"src/client-modules/Reset.tsx"
+	],
+	"Password": [
+		"src/client-modules/SignIn.tsx"
+	],
+	"Reset your password": [
+		"src/client-modules/Reset.tsx"
+	],
+	"Send the link": [
+		"src/client-modules/Reset.tsx",
+		"src/client-modules/Verify.tsx"
+	],
+	"Set the password": [
+		"src/client-modules/Reset.tsx"
+	],
+	"Sign in": [
+		"src/client-modules/SignIn.tsx"
+	],
+	"Sign in first, then ask for the link.": [
+		"src/client-modules/Verify.tsx"
+	],
+	"The link is on its way. Open it from your mail.": [
+		"src/client-modules/Verify.tsx"
+	],
+	"Verify your email": [
+		"src/client-modules/Verify.tsx"
+	],
+	"We will send a link to your email address.": [
+		"src/client-modules/Verify.tsx"
+	],
+	"Your email address is verified.": [
+		"src/client-modules/Verify.tsx"
+	],
+	"Your password is set. Sign in with it.": [
+		"src/client-modules/Reset.tsx"
+	],
+	"you@example.com": [
+		"src/client-modules/Reset.tsx",
+		"src/client-modules/SignIn.tsx"
+	]
+}