@cogenta/auth 0.1.2 → 0.3.0

package/dist/api-keys.d.ts

@@ -0,0 +1,19 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import type { ApiKey, CreateApiKeyInput, IssuedApiKey } from './types.js';
+/** A raw bearer token is an API key only if it has this shape — checked before any DB lookup. */
+export declare function looksLikeApiKey(token: string): boolean;
+export interface ApiKeyStore {
+    /** Mints a key and returns the raw secret once. It is never stored or returned again. */
+    create(input: CreateApiKeyInput): Promise<IssuedApiKey>;
+    /** Never the raw key or its hash — a prefix is all a list ever shows. */
+    list(): Promise<readonly ApiKey[]>;
+    revoke(id: string): Promise<void>;
+    /**
+     * Resolves a raw bearer token to the key it names, or `null` if it does not
+     * exist, is revoked, or has expired. Touches `lastUsedAt` on success, the
+     * same sliding-window courtesy a session gets.
+     */
+    verify(rawKey: string): Promise<ApiKey | null>;
+}
+export declare function createApiKeyStore(db: DatabaseHandle, now?: () => number): ApiKeyStore;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAEzF,OAAO,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAkCzE,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD;AAsCD,MAAM,WAAW,WAAW;IAC1B,yFAAyF;IACzF,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvD,yEAAyE;IACzE,IAAI,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IAClC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,WAAW,CA8D/F"}

package/dist/api-keys.js

@@ -0,0 +1,112 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { CogentaError, identifier, newId, sql } from '@cogenta/core';
+import { TABLES } from './tables.js';
+/**
+ * Machine-to-machine bearer credentials (L13 task 8).
+ *
+ * `resolveActor` in `@cogenta/api` already recognises one bearer-token shape:
+ * a session, minted at sign-in for a human. This store mints the other
+ * shape — a long-lived key, minted once by an admin for a script or an
+ * integration — kept deliberately close to `sessions.ts` in every way that
+ * matters: an opaque random secret, hashed before it ever reaches disk, and
+ * looked up by that hash, never by the secret itself.
+ *
+ * A key is not a password. A password is chosen by a person and has to
+ * survive being typed and remembered, which is exactly what makes it
+ * guessable and worth slowing down with scrypt. A key is generated here,
+ * 256 bits of randomness no human ever picks — the same property a session
+ * token has — so it is hashed the same fast way a session is, and the
+ * defence against guessing is the key space, not the hash cost.
+ */
+const KEY_BYTES = 32;
+const KEY_PREFIX = 'cogenta_sk_';
+/** How much of the raw key stays visible forever, so a list of keys is recognisable. */
+const VISIBLE_PREFIX_LENGTH = 12;
+function issueKey() {
+    return `${KEY_PREFIX}${randomBytes(KEY_BYTES).toString('base64url')}`;
+}
+/** Stored hashed, like a session token — a leaked table hands out nothing live. */
+function hashKey(key) {
+    return createHash('sha256').update(key).digest('base64url');
+}
+/** A raw bearer token is an API key only if it has this shape — checked before any DB lookup. */
+export function looksLikeApiKey(token) {
+    return token.startsWith(KEY_PREFIX) && token.length > KEY_PREFIX.length;
+}
+function fromRow(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        prefix: row.key_prefix,
+        scope: JSON.parse(row.scope),
+        createdBy: row.created_by,
+        createdAt: row.created_at,
+        expiresAt: row.expires_at ?? undefined,
+        revokedAt: row.revoked_at ?? undefined,
+        lastUsedAt: row.last_used_at ?? undefined,
+    };
+}
+function assertScope(scope) {
+    if (scope.length === 0 || scope.some((role) => role.trim().length === 0)) {
+        throw new CogentaError({
+            code: 'QUERY_INVALID',
+            message: 'An API key must be granted at least one non-empty role name.',
+            hint: 'A key with no role can authenticate and do nothing at all — pass at least one role in "scope".',
+        });
+    }
+}
+export function createApiKeyStore(db, now = Date.now) {
+    const table = identifier(TABLES.apiKeys, db.dialect);
+    return {
+        create: async (input) => {
+            assertScope(input.scope);
+            const key = issueKey();
+            const id = newId(now);
+            const created = new Date(now()).toISOString();
+            const prefix = key.slice(0, VISIBLE_PREFIX_LENGTH);
+            await db.query(sql `
+        insert into ${table}
+          (id, name, key_hash, key_prefix, scope, created_by, created_at, expires_at, revoked_at, last_used_at)
+        values
+          (${id}, ${input.name}, ${hashKey(key)}, ${prefix}, ${JSON.stringify(input.scope)},
+           ${input.createdBy}, ${created}, ${input.expiresAt ?? null}, ${null}, ${null})`);
+            return {
+                id,
+                name: input.name,
+                prefix,
+                scope: input.scope,
+                createdBy: input.createdBy,
+                createdAt: created,
+                expiresAt: input.expiresAt,
+                revokedAt: undefined,
+                lastUsedAt: undefined,
+                key,
+            };
+        },
+        list: async () => {
+            const result = await db.query(sql `select * from ${table} order by created_at desc`);
+            return result.rows.map(fromRow);
+        },
+        revoke: async (id) => {
+            const revokedAt = new Date(now()).toISOString();
+            await db.query(sql `update ${table} set revoked_at = ${revokedAt} where id = ${id} and revoked_at is null`);
+        },
+        verify: async (rawKey) => {
+            if (!looksLikeApiKey(rawKey))
+                return null;
+            const targetHash = hashKey(rawKey);
+            const result = await db.query(sql `select * from ${table} where key_hash = ${targetHash}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return null;
+            if (row.revoked_at !== null)
+                return null;
+            if (row.expires_at !== null && new Date(row.expires_at).getTime() <= now())
+                return null;
+            const lastUsedAt = new Date(now()).toISOString();
+            await db.query(sql `update ${table} set last_used_at = ${lastUsedAt} where id = ${row.id}`);
+            return fromRow({ ...row, last_used_at: lastUsedAt });
+        },
+    };
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,aAAa,CAAA;AAChC,wFAAwF;AACxF,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEhC,SAAS,QAAQ;IACf,OAAO,GAAG,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC7D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAA;AACzE,CAAC;AAcD,SAAS,OAAO,CAAC,GAAc;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAsB;QACjD,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;QACtC,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,SAAS;QACtC,UAAU,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS;KAC1C,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,8DAA8D;YACvE,IAAI,EAAE,gGAAgG;SACvG,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAgBD,MAAM,UAAU,iBAAiB,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAEpD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACxB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;YACtB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAA;YAElD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;;;aAGd,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;aAC7E,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,IAAI,KAAK,IAAI,KAAK,IAAI,GAAG,CAAC,CAAA;YAEpF,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,SAAS;gBACrB,GAAG;aACJ,CAAA;QACH,CAAC;QAED,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAY,GAAG,CAAA,iBAAiB,KAAK,2BAA2B,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,EAAE,CAAC,KAAK,CACZ,GAAG,CAAA,UAAU,KAAK,qBAAqB,SAAS,eAAe,EAAE,yBAAyB,CAC3F,CAAA;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;YAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YAClC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,qBAAqB,UAAU,EAAE,CAC3D,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAClC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACxC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAA;YAEvF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,UAAU,KAAK,uBAAuB,UAAU,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;YAE1F,OAAO,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;QACtD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,8 @@
  * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
  * roles, and the hash-chained audit log L4's agents will write to as well.
  */
+export type { ApiKeyStore } from './api-keys.js';
+export { createApiKeyStore, looksLikeApiKey } from './api-keys.js';
 export type { AuditFilter, AuditLog } from './audit.js';
 export { createAuditLog } from './audit.js';
 export type { CredentialStore, WebAuthnCredentialData } from './credentials.js';
@@ -15,8 +17,10 @@ export type { AuthService, AuthServiceOptions, LoginResult } from './login.js';
 export { createAuthService } from './login.js';
 export { requiresMfa, sensitiveRoles } from './mfa.js';
 export { hashPassword, verifyPassword } from './password.js';
-export type { RateLimiter } from './rate-limit.js';
-export { createRateLimiter } from './rate-limit.js';
+export type { LoginAttemptSummary, RateLimiter } from './rate-limit.js';
+export { createRateLimiter, LOGIN_ATTEMPT_WINDOW_MS } from './rate-limit.js';
+export type { IssuedPasswordReset, PasswordResetOutcome, PasswordResetStore, } from './resets.js';
+export { createPasswordResetStore, PASSWORD_RESET_TTL_MS } from './resets.js';
 export type { SessionStore } from './sessions.js';
 export { createSessionStore } from './sessions.js';
 export type { AuthStore, AuthStoreOptions } from './store.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAClE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC5D,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC7E,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -7,12 +7,14 @@
  * bearer sessions, login-attempt backoff, MFA enforcement for sensitive
  * roles, and the hash-chained audit log L4's agents will write to as well.
  */
+export { createApiKeyStore, looksLikeApiKey } from './api-keys.js';
 export { createAuditLog } from './audit.js';
 export { createCredentialStore } from './credentials.js';
 export { createAuthService } from './login.js';
 export { requiresMfa, sensitiveRoles } from './mfa.js';
 export { hashPassword, verifyPassword } from './password.js';
-export { createRateLimiter } from './rate-limit.js';
+export { createRateLimiter, LOGIN_ATTEMPT_WINDOW_MS } from './rate-limit.js';
+export { createPasswordResetStore, PASSWORD_RESET_TTL_MS } from './resets.js';
 export { createSessionStore } from './sessions.js';
 export { createAuthStore } from './store.js';
 export { ensureAuthTables, TABLES as AUTH_TABLES } from './tables.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAM5E,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,aAAa,CAAA;AAErE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,OAAO,EACP,UAAU,GACX,MAAM,WAAW,CAAA;AAClB,cAAc,YAAY,CAAA;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAO5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,eAAe,CAAA"}

package/dist/login.d.ts

@@ -3,6 +3,15 @@ import type { CollectionDefinition } from '@cogenta/schema';
 import type { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '@simplewebauthn/server';
 import type { IssuedSession, User } from './types.js';
 import { type WebAuthnConfig } from './webauthn.js';
+/**
+ * Two outcomes, not three.
+ *
+ * There used to be a third, `totp_setup_required`: a sensitive role with no
+ * second factor was refused a session and handed a ticket to enrol one on the
+ * spot. ADR-0021 removed it. MFA is now something an account turns on from its
+ * own profile and the site *recommends* through a persistent admin notice —
+ * never something that stands between a correct password and a session.
+ */
 export type LoginResult = {
     readonly status: 'session';
     readonly session: IssuedSession;
@@ -11,15 +20,6 @@ export type LoginResult = {
     readonly status: 'mfa_required';
     readonly ticket: string;
     readonly availableFactors: readonly ('totp' | 'webauthn')[];
-} | {
-    /**
-     * A sensitive role with no second factor set up yet. Not an error: the
-     * password was correct, and the only thing standing between this
-     * attempt and a session is enrolling TOTP right now, with the ticket
-     * this result carries.
-     */
-    readonly status: 'totp_setup_required';
-    readonly ticket: string;
 };
 export interface TotpSetup {
     readonly secret: string;
@@ -38,7 +38,13 @@ export interface AuthServiceOptions {
     readonly db: DatabaseHandle;
     /** From `COGENTA_AUTH_SIGNING_KEY`, never from a config file (rule R7). */
     readonly signingKey: string;
-    /** What decides whether a role needs a second factor (`sensitiveRoles`). */
+    /**
+     * Kept for the shape `createAuthStore` already passes and for what callers
+     * build on top of it, not read by sign-in any more: since ADR-0021 the
+     * second-factor challenge follows what a person actually enrolled, not what
+     * their role is. `sensitiveRoles`/`requiresMfa` still read collections — for
+     * the recommendation, not for the gate.
+     */
     readonly collections: readonly CollectionDefinition[];
     /** Shown in the authenticator app next to the account name. Defaults to "Cogenta". */
     readonly issuer?: string;
@@ -51,10 +57,21 @@ export interface AuthService {
     totpLogin(ticket: string, token: string): Promise<LoginResult>;
     /** Issues a session directly: a verified passkey already proved a strong second factor. */
     sessionForVerifiedUser(userId: string): Promise<LoginResult>;
-    /** Generates a fresh TOTP secret for a `totp_setup_required` ticket and stores it, unconfirmed. */
-    beginTotpSetup(ticket: string): Promise<TotpSetup>;
-    /** Confirms the code from the authenticator app and, on success, signs the user in. */
-    confirmTotpSetup(ticket: string, token: string): Promise<LoginResult>;
+    /**
+     * Generates a fresh TOTP secret for an already-signed-in account and stores
+     * it, unconfirmed. `userId` comes from the caller's session, never from the
+     * request body — this is self-service, so the only account it can ever touch
+     * is the one making the call.
+     */
+    beginTotpEnrolment(userId: string): Promise<TotpSetup>;
+    /** Confirms the code from the authenticator app, which is what makes the factor real. */
+    confirmTotpEnrolment(userId: string, token: string): Promise<void>;
+    /**
+     * Turns TOTP back off. No second proof is asked for: the caller already
+     * holds a live session for this account, which — if TOTP was on — they could
+     * only have obtained by passing it.
+     */
+    disableTotp(userId: string): Promise<void>;
     /** Adding a passkey to an already-identified account — `userId` comes from an existing session. */
     beginWebAuthnRegistration(userId: string): Promise<WebAuthnRegistrationChallenge>;
     completeWebAuthnRegistration(ticket: string, response: RegistrationResponseJSON, label?: string): Promise<void>;

package/dist/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAM/B,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AA6EtB,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAA;CAC5D,GACD;IACE;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,CAAA;AAEL,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,2FAA2F;IAC3F,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D,mGAAmG;IACnG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAClD,uFAAuF;IACvF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACrE,mGAAmG;IACnG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACjF,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,yGAAyG;IACzG,kBAAkB,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC9D,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAClG;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAoQ1E"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,KAAK,EACV,0BAA0B,EAC1B,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACzB,MAAM,wBAAwB,CAAA;AAK/B,OAAO,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAA;AA6EtB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACpF;IACE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAA;CAC5D,CAAA;AAEL,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAA;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAA;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,2FAA2F;IAC3F,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACtD,yFAAyF;IACzF,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,mGAAmG;IACnG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAA;IACjF,4BAA4B,CAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,yGAAyG;IACzG,kBAAkB,IAAI,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC9D,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAClG;AAkBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA4P1E"}

package/dist/login.js

@@ -1,7 +1,6 @@
 import { createHmac, timingSafeEqual } from 'node:crypto';
 import { CogentaError } from '@cogenta/core';
 import { createCredentialStore } from './credentials.js';
-import { requiresMfa } from './mfa.js';
 import { createRateLimiter } from './rate-limit.js';
 import { createSessionStore } from './sessions.js';
 import { generateTotpSecret, totpUri, verifyTotp } from './totp.js';
@@ -22,7 +21,7 @@ const TICKET_TTL_MS = 5 * 60 * 1000;
  * something single-use that lives seconds.
  *
  * `purpose` is part of what gets signed, not a separate check layered on
- * top: a login ticket and a first-time TOTP-setup ticket (or a WebAuthn
+ * top: a login ticket and a WebAuthn registration ticket (or a WebAuthn
  * registration ticket and a WebAuthn login ticket) must not be
  * interchangeable, and folding the purpose into the signature is what makes
  * swapping one for another a signature mismatch rather than a bug to
@@ -73,7 +72,11 @@ function webauthnNotConfigured() {
     });
 }
 export function createAuthService(options) {
-    const { db, signingKey, collections, webauthn: webauthnConfig } = options;
+    // `options.collections` is deliberately not read here any more: since
+    // ADR-0021 the second-factor challenge follows what a person enrolled, not
+    // what their role is. It stays on the options type because `createAuthStore`
+    // passes it and the recommendation source still needs the same list.
+    const { db, signingKey, webauthn: webauthnConfig } = options;
     const issuer = options.issuer ?? 'Cogenta';
     const now = options.now ?? Date.now;
     const users = createUserStore(db, now);
@@ -84,28 +87,24 @@ export function createAuthService(options) {
         const session = await sessions.create(user.id);
         return { status: 'session', session, user };
     }
-    async function mfaChallenge(user) {
-        const kinds = await credentials.kinds(user.id);
+    /**
+     * The second factors this account has actually finished setting up.
+     *
+     * A TOTP secret only counts once it has been confirmed. An unconfirmed one
+     * means someone opened the enrolment screen and walked away; treating that as
+     * a usable factor would challenge them for a code their authenticator app
+     * never received, and there would be no way back.
+     */
+    async function enrolledFactors(userId) {
         const available = [];
-        if (kinds.includes('totp'))
+        const totp = await credentials.totpSecret(userId);
+        if (totp !== null && totp.verified)
             available.push('totp');
-        if (kinds.includes('webauthn'))
+        if ((await credentials.webAuthnCredentials(userId)).length > 0)
             available.push('webauthn');
-        if (available.length === 0) {
-            // A role that requires MFA and a user who never set one up: this is
-            // the one place that enrolment can start, with a ticket scoped to
-            // exactly that — it proves the password step happened, and nothing
-            // more, the same as the ordinary MFA ticket proves the same thing for
-            // completing a second factor that already exists.
-            return {
-                status: 'totp_setup_required',
-                ticket: signTicket(signingKey, {
-                    purpose: 'totp_setup',
-                    userId: user.id,
-                    expiresAt: now() + TICKET_TTL_MS,
-                }),
-            };
-        }
+        return available;
+    }
+    function mfaChallenge(user, available) {
         return {
             status: 'mfa_required',
             ticket: signTicket(signingKey, {
@@ -131,7 +130,13 @@ export function createAuthService(options) {
                 });
             }
             await rateLimit.clear(subject);
-            return requiresMfa(user.roles, collections) ? mfaChallenge(user) : issueSession(user);
+            // What decides the challenge is what this person enrolled, not what
+            // their role is (ADR-0021). A brand-new admin signs straight in; an
+            // account that turned TOTP on still has to produce a code, because
+            // ignoring a factor someone deliberately enabled would be a silent
+            // downgrade of their own security.
+            const factors = await enrolledFactors(user.id);
+            return factors.length === 0 ? issueSession(user) : mfaChallenge(user, factors);
         },
         totpLogin: async (ticket, token) => {
             const verified = verifyTicket(signingKey, 'login', ticket, now());
@@ -172,31 +177,23 @@ export function createAuthService(options) {
             }
             return issueSession(user);
         },
-        beginTotpSetup: async (ticket) => {
-            const verified = verifyTicket(signingKey, 'totp_setup', ticket, now());
-            if (verified === null || verified.userId === null)
-                throw invalidTicket();
-            const user = await users.byId(verified.userId);
-            if (user === null) {
+        beginTotpEnrolment: async (userId) => {
+            const user = await users.byId(userId);
+            if (user === null || user.status !== 'active') {
                 throw new CogentaError({
                     code: 'AUTH_USER_NOT_FOUND',
-                    message: 'This account no longer exists.',
-                    hint: 'It may have been deleted between the password step and this one. Sign in again.',
+                    message: 'This account no longer exists or is disabled.',
+                    hint: 'Sign in again.',
                 });
             }
-            // A fresh secret every time this is called, even for the same ticket:
-            // requesting the QR code again (a slow scan, a wrong app) must not
-            // let two different secrets both end up "current" — only the last one
-            // requested can ever be confirmed.
+            // A fresh secret on every call: asking for the QR code again (a slow
+            // scan, the wrong app) must not leave two different secrets both
+            // plausibly "current" — only the last one requested can be confirmed.
             const secret = generateTotpSecret();
             await credentials.setTotpSecret(user.id, secret);
             return { secret, uri: totpUri(secret, issuer, user.email) };
         },
-        confirmTotpSetup: async (ticket, token) => {
-            const verified = verifyTicket(signingKey, 'totp_setup', ticket, now());
-            if (verified === null || verified.userId === null)
-                throw invalidTicket();
-            const userId = verified.userId;
+        confirmTotpEnrolment: async (userId, token) => {
             await rateLimit.check(`totp-setup:${userId}`);
             const stored = await credentials.totpSecret(userId);
             const ok = stored !== null && verifyTotp(token, stored.secret, { now: Math.floor(now() / 1000) });
@@ -208,17 +205,11 @@ export function createAuthService(options) {
                     hint: 'Check the code from your authenticator app. Codes are valid for 30 seconds.',
                 });
             }
-            const user = await users.byId(userId);
-            if (user === null) {
-                throw new CogentaError({
-                    code: 'AUTH_USER_NOT_FOUND',
-                    message: 'This account no longer exists.',
-                    hint: 'It may have been deleted since the password step. Sign in again.',
-                });
-            }
             await rateLimit.clear(`totp-setup:${userId}`);
             await credentials.confirmTotp(userId);
-            return issueSession(user);
+        },
+        disableTotp: async (userId) => {
+            await credentials.removeTotp(userId);
         },
         beginWebAuthnRegistration: async (userId) => {
             if (webauthnConfig === undefined)

package/dist/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAA;AAQjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,eAAe,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAkBnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/E,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAAsB,EACtB,MAAc,EACd,GAAW;IAEX,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAKrE,CAAA;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAChF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAsED,SAAS,aAAa;IACpB,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,iDAAiD;QAC1D,IAAI,EAAE,oCAAoC;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,iFAAiF;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAE5C,KAAK,UAAU,YAAY,CAAC,IAAU;QACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAAU;QACpC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,sEAAsE;YACtE,kDAAkD;YAClD,OAAO;gBACL,MAAM,EAAE,qBAAqB;gBAC7B,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,YAAY;oBACrB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;aACjC,CAAC;YACF,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAE9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAEpF,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACvF,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAErE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;gBACvC,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YAExE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YAED,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,mCAAmC;YACnC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;YACnC,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC7D,CAAC;QAED,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACtE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAExF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,kEAAkE;iBACzE,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACrC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;YAC9D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,yBAAyB,CAC5D,cAAc,EACd,MAAM,EACN,IAAI,CAAC,KAAK,EACV,QAAQ,CACT,CAAA;YACD,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,mBAAmB;oBAC5B,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9D,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtF,MAAM,aAAa,EAAE,CAAA;YACvB,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CACN,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YACpF,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE,IAAI;oBACZ,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,aAAa,EAAE,CAAA;YAEhF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CAAC,IAAI,CACX,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAEnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAA;AAQjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAE7B,MAAM,eAAe,CAAA;AAEtB,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAkBnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAAsB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC/E,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,YAAY,CACnB,GAAW,EACX,OAAsB,EACtB,MAAc,EACd,GAAW;IAEX,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAEjE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAEhE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAKrE,CAAA;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAA;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC5E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAChF,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAsFD,SAAS,aAAa;IACpB,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,iDAAiD;QAC1D,IAAI,EAAE,oCAAoC;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,iFAAiF;KACxF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAA;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAE5C,KAAK,UAAU,YAAY,CAAC,IAAU;QACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC7C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,eAAe,CAAC,MAAc;QAC3C,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1F,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,SAAS,YAAY,CAAC,IAAU,EAAE,SAA2C;QAC3E,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;aACjC,CAAC;YACF,gBAAgB,EAAE,SAAS;SAC5B,CAAA;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAC1C,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAE9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACzC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;YAEpF,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC/B,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC9B,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC9C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAChF,CAAC;QAED,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,aAAa,EAAE,CAAA;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAE9B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI;gBACf,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAErE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;gBACvC,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;oBACzC,IAAI,EAAE,iFAAiF;iBACxF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,MAAM,EAAE,CAAC,CAAA;YACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;oBACxD,IAAI,EAAE,gBAAgB;iBACvB,CAAC,CAAA;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAA;YACnC,MAAM,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YAChD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAA;QAC7D,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YAC5C,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACnD,MAAM,EAAE,GACN,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;YAExF,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,SAAS,CAAC,MAAM,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,8BAA8B;oBACvC,IAAI,EAAE,6EAA6E;iBACpF,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAA;YAC7C,MAAM,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5B,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC;QAED,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;YAC9D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,yBAAyB,CAC5D,cAAc,EACd,MAAM,EACN,IAAI,CAAC,KAAK,EACV,QAAQ,CACT,CAAA;YACD,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,mBAAmB;oBAC5B,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,4BAA4B,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9D,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtF,MAAM,aAAa,EAAE,CAAA;YACvB,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,4BAA4B,CACnD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CACN,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,qDAAqD;YACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,2BAA2B,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YACpF,OAAO;gBACL,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE;oBAC7B,OAAO,EAAE,gBAAgB;oBACzB,MAAM,EAAE,IAAI;oBACZ,SAAS;oBACT,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa;iBACjC,CAAC;aACH,CAAA;QACH,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,cAAc,KAAK,SAAS;gBAAE,MAAM,qBAAqB,EAAE,CAAA;YAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,aAAa,EAAE,CAAA;YAEhF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,8BAA8B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,yFAAyF;iBAChG,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,cAAc,EACd,QAAQ,EACR,QAAQ,CAAC,SAAS,EAClB,KAAK,CAAC,IAAI,CACX,CAAA;YACD,MAAM,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;YAEnF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+CAA+C;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mfa.d.ts

@@ -1,4 +1,5 @@
 import type { CollectionDefinition } from '@cogenta/schema';
 export declare function sensitiveRoles(collections: readonly CollectionDefinition[]): ReadonlySet<string>;
+/** Whether this set of roles is one MFA is recommended for. Never a gate — see above. */
 export declare function requiresMfa(userRoles: readonly string[], collections: readonly CollectionDefinition[]): boolean;
 //# sourceMappingURL=mfa.d.ts.map

package/dist/mfa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAkB3D,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAMhG;AAED,wBAAgB,WAAW,CACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,OAAO,CAGT"}
+{"version":3,"file":"mfa.d.ts","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2B3D,wBAAgB,cAAc,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAMhG;AAED,yFAAyF;AACzF,wBAAgB,WAAW,CACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,OAAO,CAGT"}

package/dist/mfa.js

@@ -1,5 +1,5 @@
 /**
- * Whether a role must clear a second factor before it can act.
+ * Which roles are sensitive enough that a second factor is *recommended*.
  *
  * The spec names `content.publish` and `site.config_write` — contract C's
  * permission taxonomy, for an agent tool. L2 has no tool permissions yet; the
@@ -8,9 +8,18 @@
  * the `admin` role always, since site configuration has no dedicated model in
  * L2 and `admin` is where that power concentrates until it does.
  *
- * This is not configurable per site, on purpose — the spec says "non
- * contournable par configuration", and a setting that can be turned off is a
- * setting that will be, by whoever is in the biggest hurry the day it matters.
+ * ADR-0021 changed what this answer is *for*. It used to decide who was turned
+ * away at sign-in until they enrolled a second factor — which meant the very
+ * first admin of a brand-new site had to complete a TOTP ceremony before they
+ * could see a single screen, and an admin without a phone to hand could not get
+ * in at all. It now decides who *receives the recommendation* to turn MFA on
+ * (`@cogenta/api`'s notices), which is persistent and impossible to lose track
+ * of, but never blocks. Enrolment is still real and still enforced at sign-in
+ * once it exists — see `passwordLogin` in `login.ts`.
+ *
+ * Still not configurable per site, for the reason it never was: a setting that
+ * can be turned off is a setting that will be, by whoever is in the biggest
+ * hurry the day it matters.
  */
 const ALWAYS_SENSITIVE_ROLES = new Set(['admin']);
 export function sensitiveRoles(collections) {
@@ -21,6 +30,7 @@ export function sensitiveRoles(collections) {
     }
     return roles;
 }
+/** Whether this set of roles is one MFA is recommended for. Never a gate — see above. */
 export function requiresMfa(userRoles, collections) {
     const sensitive = sensitiveRoles(collections);
     return userRoles.some((role) => sensitive.has(role));

package/dist/mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAEjD,MAAM,UAAU,cAAc,CAAC,WAA4C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,SAA4B,EAC5B,WAA4C;IAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACtD,CAAC"}
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../src/mfa.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;AAEjD,MAAM,UAAU,cAAc,CAAC,WAA4C;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAC7C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,WAAW,CACzB,SAA4B,EAC5B,WAA4C;IAE5C,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,CAAA;IAC7C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;AACtD,CAAC"}

package/dist/rate-limit.d.ts

@@ -1,10 +1,43 @@
 import { type DatabaseHandle } from '@cogenta/core';
+/** How long failed attempts keep counting. Exported so a reader shares the exact window. */
+export declare const LOGIN_ATTEMPT_WINDOW_MS: number;
+/**
+ * What the failed attempts inside the window add up to, for one subject
+ * (L14 task 4).
+ *
+ * The table has been written to since L2 and never read by anything but the
+ * limiter's own counter, so "somebody is hammering this site" was information
+ * the site had and never showed anyone.
+ */
+export interface LoginAttemptSummary {
+    /** The email tried, or `mfa:<id>` / `totp-setup:<id>` for the second-factor limits. */
+    readonly subject: string;
+    readonly attempts: number;
+    readonly firstAt: string;
+    readonly lastAt: string;
+    /** True when the attempts have crossed a backoff threshold. */
+    readonly blocked: boolean;
+}
 export interface RateLimiter {
     /** Throws `AUTH_RATE_LIMITED` if the subject is currently backed off. */
     check(subject: string): Promise<void>;
     record(subject: string): Promise<void>;
     /** Called after a successful login: past failures stop counting against them. */
     clear(subject: string): Promise<void>;
+    /**
+     * Failed attempts still inside the window, worst first.
+     *
+     * Also prunes everything that has fallen out of the window. Nothing else
+     * ever deletes a row for a subject that never went on to succeed — `clear`
+     * only runs after a *successful* sign-in — so without this the table grows
+     * for as long as a script keeps guessing, which is exactly the case where it
+     * grows fastest.
+     */
+    recentFailures(options?: {
+        /** Ignore subjects below this count. Defaults to the first backoff threshold. */
+        readonly minAttempts?: number;
+        readonly limit?: number;
+    }): Promise<readonly LoginAttemptSummary[]>;
 }
 export declare function createRateLimiter(db: DatabaseHandle, now?: () => number): RateLimiter;
 //# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAmBzF,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,iFAAiF;IACjF,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,WAAW,CAkC/F"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAmBzF,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAKhD;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,iFAAiF;IACjF,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;;;;;OAQG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE;QACvB,iFAAiF;QACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KACxB,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAA;CAC5C;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,WAAW,CAoE/F"}

package/dist/rate-limit.js

@@ -15,6 +15,10 @@ const THRESHOLDS = [
     { attempts: 15, delayMs: 60_000 },
     { attempts: 20, delayMs: 15 * 60 * 1000 },
 ];
+/** How long failed attempts keep counting. Exported so a reader shares the exact window. */
+export const LOGIN_ATTEMPT_WINDOW_MS = WINDOW_MS;
+/** The number of attempts past which a subject is being backed off at all. */
+const FIRST_THRESHOLD = THRESHOLDS[0]?.attempts ?? 5;
 export function createRateLimiter(db, now = Date.now) {
     const table = identifier(TABLES.loginAttempts, db.dialect);
     async function countRecent(subject) {
@@ -42,6 +46,31 @@ export function createRateLimiter(db, now = Date.now) {
         clear: async (subject) => {
             await db.query(sql `delete from ${table} where subject = ${subject}`);
         },
+        recentFailures: async (options) => {
+            const since = new Date(now() - WINDOW_MS).toISOString();
+            const minAttempts = options?.minAttempts ?? FIRST_THRESHOLD;
+            const limit = options?.limit ?? 20;
+            // Pruned before counting, not after: a row outside the window can never
+            // change an answer, so deleting it first keeps the aggregate honest even
+            // if the delete and the select were to see slightly different clocks.
+            await db.query(sql `delete from ${table} where at < ${since}`);
+            const result = await db.query(sql `
+        select subject, count(*) as n, min(at) as first_at, max(at) as last_at
+        from ${table}
+        where at >= ${since}
+        group by subject
+        order by count(*) desc`);
+            return result.rows
+                .map((row) => ({
+                subject: row.subject,
+                attempts: Number(row.n),
+                firstAt: row.first_at,
+                lastAt: row.last_at,
+                blocked: Number(row.n) >= FIRST_THRESHOLD,
+            }))
+                .filter((summary) => summary.attempts >= minAttempts)
+                .slice(0, limit);
+        },
     };
 }
 //# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAChC,MAAM,UAAU,GAAuE;IACrF,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAC/B,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;IACjC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;IACjC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;CAC1C,CAAA;AAUD,MAAM,UAAU,iBAAiB,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE1D,KAAK,UAAU,WAAW,CAAC,OAAe;QACxC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,6BAA6B,KAAK,oBAAoB,OAAO,cAAc,KAAK,EAAE,CACtF,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;YACvF,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAM;YAEnC,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,sFAAsF;gBAC7I,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,OAAO,EAAE;aAC7C,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK,8BAA8B,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAChC,MAAM,UAAU,GAAuE;IACrF,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAC/B,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;IACjC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;IACjC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;CAC1C,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAA;AAEhD,8EAA8E;AAC9E,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAA;AA0CpD,MAAM,UAAU,iBAAiB,CAAC,EAAkB,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE1D,KAAK,UAAU,WAAW,CAAC,OAAe;QACxC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,6BAA6B,KAAK,oBAAoB,OAAO,cAAc,KAAK,EAAE,CACtF,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;YAC3C,MAAM,SAAS,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;YACvF,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAM;YAEnC,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EAAE,cAAc,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,sFAAsF;gBAC7I,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,OAAO,EAAE;aAC7C,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK,8BAA8B,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;QACjH,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACvB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;YACvD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,eAAe,CAAA;YAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAA;YAElC,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,eAAe,KAAK,EAAE,CAAC,CAAA;YAE7D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAK1B,GAAG,CAAA;;eAEG,KAAK;sBACE,KAAK;;+BAEI,CAAC,CAAA;YAE1B,OAAO,MAAM,CAAC,IAAI;iBACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACb,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,OAAO,EAAE,GAAG,CAAC,QAAQ;gBACrB,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,eAAe;aAC1C,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;iBACpD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/resets.d.ts

@@ -0,0 +1,53 @@
+import { type DatabaseHandle } from '@cogenta/core';
+/**
+ * 30 minutes. Long enough to walk to the inbox and back, short enough that a
+ * reset link sitting in a mailbox archive is worthless within the hour — a
+ * reset token is a full account takeover if it leaks, so it gets a far
+ * shorter life than the 30-day session it can be exchanged for.
+ */
+export declare const PASSWORD_RESET_TTL_MS: number;
+export interface IssuedPasswordReset {
+    readonly id: string;
+    readonly userId: string;
+    /** Shown once, to be put in the link. Never stored, never recoverable. */
+    readonly token: string;
+    readonly expiresAt: string;
+}
+/**
+ * What redeeming a token found. Separate cases rather than a boolean, so the
+ * caller can say *why* a link did not work — "this link has already been
+ * used" and "this link has expired" send a person to different next steps.
+ */
+export type PasswordResetOutcome = {
+    readonly kind: 'invalid';
+} | {
+    readonly kind: 'expired';
+} | {
+    readonly kind: 'used';
+} | {
+    readonly kind: 'ready';
+    readonly userId: string;
+    readonly resetId: string;
+};
+export interface PasswordResetStore {
+    /**
+     * Issues a token for a user, invalidating any still outstanding for them.
+     *
+     * Only one live reset per person: asking again because the first mail never
+     * arrived must not leave two working links behind, and the newest request
+     * is always the one the person is actually looking at.
+     */
+    issue(userId: string, options?: {
+        readonly ttlMs?: number;
+    }): Promise<IssuedPasswordReset>;
+    /**
+     * Consumes a token. Redeeming is the single-use point: a `ready` outcome is
+     * returned at most once for a given token, ever, even if two processes ask
+     * at the same instant.
+     */
+    redeem(token: string): Promise<PasswordResetOutcome>;
+    /** Invalidates every outstanding reset for a user, used or not. */
+    revokeAllFor(userId: string): Promise<void>;
+}
+export declare function createPasswordResetStore(db: DatabaseHandle, now?: () => number): PasswordResetStore;
+//# sourceMappingURL=resets.d.ts.map

package/dist/resets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resets.d.ts","sourceRoot":"","sources":["../src/resets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAoC3E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAiB,CAAA;AAEnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjF,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC1F;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACpD,mEAAmE;IACnE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAiBD,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,kBAAkB,CAmDpB"}

package/dist/resets.js

@@ -0,0 +1,89 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { identifier, newId, sql } from '@cogenta/core';
+import { TABLES } from './tables.js';
+/**
+ * Password reset: a single-use, short-lived token bound to one user.
+ *
+ * Until now a person who forgot their password had no way back in — the only
+ * account command was `users create`, so the recovery procedure was "ask an
+ * administrator to make you a second account". This is the missing half.
+ *
+ * The token is opaque random bytes stored only as a hash, for the same reason
+ * a session token is (`sessions.ts`): a leaked table must hand out nothing
+ * live. It is deliberately **not** a signed/HMAC'd payload. A signature would
+ * let a link be validated without touching the database, and that is exactly
+ * what must not happen here — single use and revocation are properties of a
+ * row, not of a signature, and a signed token that has already been used is
+ * still a valid signature. The database round trip is the feature.
+ */
+const TOKEN_BYTES = 32;
+/**
+ * Hex, not base64url — and that is not a stylistic preference.
+ *
+ * base64url's alphabet contains `-`. Roughly one token in sixty-four therefore
+ * *starts* with a dash, and `cogenta users reset-password --token -Xy...` is
+ * then parsed as an unknown option rather than as a value: the command refuses
+ * a perfectly valid token with a usage error, for one person in sixty-four.
+ * That is exactly the kind of defect that never shows up in a test written
+ * once and passes for months. Hex costs 32 characters of length and has no
+ * character that any shell, URL or argument parser treats as special.
+ */
+function encodeToken(bytes) {
+    return bytes.toString('hex');
+}
+/**
+ * 30 minutes. Long enough to walk to the inbox and back, short enough that a
+ * reset link sitting in a mailbox archive is worthless within the hour — a
+ * reset token is a full account takeover if it leaks, so it gets a far
+ * shorter life than the 30-day session it can be exchanged for.
+ */
+export const PASSWORD_RESET_TTL_MS = 30 * 60 * 1000;
+function issueToken() {
+    return encodeToken(randomBytes(TOKEN_BYTES));
+}
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('base64url');
+}
+export function createPasswordResetStore(db, now = Date.now) {
+    const table = identifier(TABLES.passwordResets, db.dialect);
+    async function markUsed(id, at) {
+        // The `used_at is null` guard is what makes single use real rather than
+        // hoped for: two concurrent redemptions both read a usable row, but only
+        // one UPDATE matches, and the other sees zero rows affected.
+        const result = await db.query(sql `update ${table} set used_at = ${at} where id = ${id} and used_at is null`);
+        return result.rowsAffected > 0;
+    }
+    return {
+        issue: async (userId, options) => {
+            await db.query(sql `delete from ${table} where user_id = ${userId} and used_at is null`);
+            const token = issueToken();
+            const id = newId(now);
+            const created = new Date(now()).toISOString();
+            const expires = new Date(now() + (options?.ttlMs ?? PASSWORD_RESET_TTL_MS)).toISOString();
+            await db.query(sql `
+        insert into ${table} (id, user_id, token_hash, created_at, expires_at, used_at)
+        values (${id}, ${userId}, ${hashToken(token)}, ${created}, ${expires}, ${null})`);
+            return { id, userId, token, expiresAt: expires };
+        },
+        redeem: async (token) => {
+            const result = await db.query(sql `select * from ${table} where token_hash = ${hashToken(token)}`);
+            const row = result.rows[0];
+            if (row === undefined)
+                return { kind: 'invalid' };
+            if (row.used_at !== null)
+                return { kind: 'used' };
+            const at = now();
+            if (new Date(row.expires_at).getTime() <= at)
+                return { kind: 'expired' };
+            const claimed = await markUsed(row.id, new Date(at).toISOString());
+            // Lost the race: another caller consumed it between the read and here.
+            if (!claimed)
+                return { kind: 'used' };
+            return { kind: 'ready', userId: row.user_id, resetId: row.id };
+        },
+        revokeAllFor: async (userId) => {
+            await db.query(sql `delete from ${table} where user_id = ${userId}`);
+        },
+    };
+}
+//# sourceMappingURL=resets.js.map

package/dist/resets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resets.js","sourceRoot":"","sources":["../src/resets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA+CnD,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE3D,KAAK,UAAU,QAAQ,CAAC,EAAU,EAAE,EAAU;QAC5C,wEAAwE;QACxE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,UAAU,KAAK,kBAAkB,EAAE,eAAe,EAAE,sBAAsB,CAC9E,CAAA;QACD,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAA;IAChC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;YAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,sBAAsB,CAAC,CAAA;YAEvF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;YAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC7C,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,qBAAqB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YAEzF,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,KAAK;kBACT,EAAE,KAAK,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,KAAK,OAAO,KAAK,IAAI,GAAG,CAAC,CAAA;YAEnF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;QAClD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAC3B,GAAG,CAAA,iBAAiB,KAAK,uBAAuB,SAAS,CAAC,KAAK,CAAC,EAAE,CACnE,CAAA;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YACjD,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAEjD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;YAExE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;YAClE,uEAAuE;YACvE,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;YAErC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAChE,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,KAAK,oBAAoB,MAAM,EAAE,CAAC,CAAA;QACrE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/store.d.ts

@@ -1,9 +1,11 @@
 import type { DatabaseHandle } from '@cogenta/core';
 import type { CollectionDefinition } from '@cogenta/schema';
+import { createApiKeyStore } from './api-keys.js';
 import { createAuditLog } from './audit.js';
 import { createCredentialStore } from './credentials.js';
 import { createAuthService } from './login.js';
 import { createRateLimiter } from './rate-limit.js';
+import { createPasswordResetStore } from './resets.js';
 import { createSessionStore } from './sessions.js';
 import { createUserStore } from './users.js';
 import type { WebAuthnConfig } from './webauthn.js';
@@ -25,6 +27,9 @@ export interface AuthStore {
     readonly audit: ReturnType<typeof createAuditLog>;
     readonly rateLimit: ReturnType<typeof createRateLimiter>;
     readonly login: ReturnType<typeof createAuthService>;
+    /** Self-service "forgot password" tokens (L13's HTTP route, `resets.ts`). */
+    readonly resets: ReturnType<typeof createPasswordResetStore>;
+    readonly apiKeys: ReturnType<typeof createApiKeyStore>;
 }
 export declare function createAuthStore(options: AuthStoreOptions): Promise<AuthStore>;
 //# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IAC9D,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;CACrD;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAmBnF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IAC9D,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAA;IACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IACxD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;IACpD,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;IAC5D,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;CACvD;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBnF"}

package/dist/store.js

@@ -1,7 +1,9 @@
+import { createApiKeyStore } from './api-keys.js';
 import { createAuditLog } from './audit.js';
 import { createCredentialStore } from './credentials.js';
 import { createAuthService } from './login.js';
 import { createRateLimiter } from './rate-limit.js';
+import { createPasswordResetStore } from './resets.js';
 import { createSessionStore } from './sessions.js';
 import { ensureAuthTables } from './tables.js';
 import { createUserStore } from './users.js';
@@ -14,6 +16,8 @@ export async function createAuthStore(options) {
         sessions: createSessionStore(options.db, now),
         audit: createAuditLog(options.db, now),
         rateLimit: createRateLimiter(options.db, now),
+        resets: createPasswordResetStore(options.db, now),
+        apiKeys: createApiKeyStore(options.db, now),
         login: createAuthService({
             db: options.db,
             signingKey: options.signingKey,

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAwB5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAEnC,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACvC,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACnD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACtC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,iBAAiB,CAAC;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC;KACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AA2B5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB;IAC7D,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAEnC,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACvC,WAAW,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACnD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACtC,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC7C,MAAM,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QACjD,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC;QAC3C,KAAK,EAAE,iBAAiB,CAAC;YACvB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC1E,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/tables.d.ts

@@ -4,7 +4,9 @@ export declare const TABLES: {
     readonly credentials: 'cogenta_credentials';
     readonly sessions: 'cogenta_sessions';
     readonly loginAttempts: 'cogenta_login_attempts';
+    readonly passwordResets: 'cogenta_password_resets';
     readonly auditLog: 'cogenta_audit_log';
+    readonly apiKeys: 'cogenta_api_keys';
 };
 /**
  * Every table this package owns.

package/dist/tables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,MAAM;aACjB,KAAK,EAAE,eAAe;aACtB,WAAW,EAAE,qBAAqB;aAClC,QAAQ,EAAE,kBAAkB;aAC5B,aAAa,EAAE,wBAAwB;aACvC,QAAQ,EAAE,mBAAmB;CACrB,CAAA;AAWV;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqFxE"}
+{"version":3,"file":"tables.d.ts","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EAKpB,MAAM,eAAe,CAAA;AAEtB,eAAO,MAAM,MAAM;aACjB,KAAK,EAAE,eAAe;aACtB,WAAW,EAAE,qBAAqB;aAClC,QAAQ,EAAE,kBAAkB;aAC5B,aAAa,EAAE,wBAAwB;aACvC,cAAc,EAAE,yBAAyB;aACzC,QAAQ,EAAE,mBAAmB;aAC7B,OAAO,EAAE,kBAAkB;CACnB,CAAA;AAWV;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6HxE"}

package/dist/tables.js

@@ -4,7 +4,9 @@ export const TABLES = {
     credentials: 'cogenta_credentials',
     sessions: 'cogenta_sessions',
     loginAttempts: 'cogenta_login_attempts',
+    passwordResets: 'cogenta_password_resets',
     auditLog: 'cogenta_audit_log',
+    apiKeys: 'cogenta_api_keys',
 };
 /** `varchar` on Postgres/MySQL, `text` on SQLite — encapsulated once, here. */
 function textColumn(dialect, length) {
@@ -26,7 +28,9 @@ export async function ensureAuthTables(db) {
     const credentials = identifier(TABLES.credentials, d);
     const sessions = identifier(TABLES.sessions, d);
     const loginAttempts = identifier(TABLES.loginAttempts, d);
+    const passwordResets = identifier(TABLES.passwordResets, d);
     const auditLog = identifier(TABLES.auditLog, d);
+    const apiKeys = identifier(TABLES.apiKeys, d);
     const t512 = textColumn(d, 512);
     const t255 = textColumn(d, 255);
     const t64 = textColumn(d, 64);
@@ -79,6 +83,19 @@ export async function ensureAuthTables(db) {
       at ${t64} not null
     )`);
     await db.query(sql `
+    create table if not exists ${passwordResets} (
+      id ${t64} not null primary key,
+      user_id ${t64} not null,
+      -- Hashed like a session token: a leaked table must not hand out a live
+      -- account takeover. Unique so the same token can never name two rows.
+      token_hash ${t512} not null unique,
+      created_at ${t64} not null,
+      expires_at ${t64} not null,
+      -- Null while the token is still usable; stamped once, and the stamping
+      -- is what makes the token single-use (see resets.ts).
+      used_at ${t64}
+    )`);
+    await db.query(sql `
     create table if not exists ${auditLog} (
       id ${t64} not null primary key,
       at ${t64} not null,
@@ -91,9 +108,32 @@ export async function ensureAuthTables(db) {
       hash ${t64} not null,
       previous_hash ${t64}
     )`);
+    await db.query(sql `
+    create table if not exists ${apiKeys} (
+      id ${t64} not null primary key,
+      name ${t255} not null,
+      -- Hashed like a session token (sha256 over a 256-bit random secret):
+      -- unlike a password, this secret is never chosen by a person, so there
+      -- is no low-entropy guess for a slow, memory-hard hash to protect
+      -- against. A leaked table still hands out nothing live.
+      key_hash ${t512} not null unique,
+      -- The first 12 characters of the raw key, stored in the clear so a
+      -- list of keys is recognisable without ever showing the rest again.
+      key_prefix ${t64} not null,
+      -- An open set of role names, exactly like a user's roles (contract A)
+      -- — a key acts as a machine actor scoped to exactly these roles, never
+      -- to more than it was granted.
+      scope text not null,
+      created_by ${t64},
+      created_at ${t64} not null,
+      expires_at ${t64},
+      revoked_at ${t64},
+      last_used_at ${t64}
+    )`);
     await createIndexIfMissing(db, 'cogenta_credentials_user', credentials, sql `(user_id)`);
     await createIndexIfMissing(db, 'cogenta_sessions_user', sessions, sql `(user_id)`);
     await createIndexIfMissing(db, 'cogenta_login_attempts_subject_at', loginAttempts, sql `(subject, at)`);
+    await createIndexIfMissing(db, 'cogenta_password_resets_user', passwordResets, sql `(user_id)`);
 }
 async function createIndexIfMissing(db, name, table, columns) {
     await db

package/dist/tables.js.map

@@ -1 +1 @@
-{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,kBAAkB;IAC5B,aAAa,EAAE,wBAAwB;IACvC,QAAQ,EAAE,mBAAmB;CACrB,CAAA;AAEV,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAkB;IACvD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAE7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,KAAK;WAC3B,GAAG;cACA,IAAI;;;;;;eAMH,GAAG;mBACC,GAAG;mBACH,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,WAAW;WACjC,GAAG;gBACE,GAAG;aACN,GAAG;;;;;;mBAMG,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;gBACE,GAAG;;;;mBAIA,IAAI;cACT,IAAI;mBACC,GAAG;mBACH,GAAG;qBACD,GAAG;gBACR,IAAI;MACd,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,aAAa;WACnC,GAAG;;;gBAGE,IAAI;WACT,GAAG;MACR,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;WACH,GAAG;iBACG,GAAG;;eAEL,IAAI;wBACK,IAAI;iBACX,GAAG;;aAEP,GAAG;sBACM,GAAG;MACnB,CAAC,CAAA;IAEL,MAAM,oBAAoB,CAAC,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACvF,MAAM,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACjF,MAAM,oBAAoB,CACxB,EAAE,EACF,mCAAmC,EACnC,aAAa,EACb,GAAG,CAAA,eAAe,CACnB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC"}
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../src/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,qBAAqB;IAClC,QAAQ,EAAE,kBAAkB;IAC5B,aAAa,EAAE,wBAAwB;IACvC,cAAc,EAAE,yBAAyB;IACzC,QAAQ,EAAE,mBAAmB;IAC7B,OAAO,EAAE,kBAAkB;CACnB,CAAA;AAEV,+EAA+E;AAC/E,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,OAAwB;IAC7C,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAkB;IACvD,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAE7B,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,KAAK;WAC3B,GAAG;cACA,IAAI;;;;;;eAMH,GAAG;mBACC,GAAG;mBACH,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,WAAW;WACjC,GAAG;gBACE,GAAG;aACN,GAAG;;;;;;mBAMG,GAAG;MAChB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;gBACE,GAAG;;;;mBAIA,IAAI;cACT,IAAI;mBACC,GAAG;mBACH,GAAG;qBACD,GAAG;gBACR,IAAI;MACd,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,aAAa;WACnC,GAAG;;;gBAGE,IAAI;WACT,GAAG;MACR,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,cAAc;WACpC,GAAG;gBACE,GAAG;;;mBAGA,IAAI;mBACJ,GAAG;mBACH,GAAG;;;gBAGN,GAAG;MACb,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;WAC9B,GAAG;WACH,GAAG;iBACG,GAAG;;eAEL,IAAI;wBACK,IAAI;iBACX,GAAG;;aAEP,GAAG;sBACM,GAAG;MACnB,CAAC,CAAA;IAEL,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,OAAO;WAC7B,GAAG;aACD,IAAI;;;;;iBAKA,IAAI;;;mBAGF,GAAG;;;;;mBAKH,GAAG;mBACH,GAAG;mBACH,GAAG;mBACH,GAAG;qBACD,GAAG;MAClB,CAAC,CAAA;IAEL,MAAM,oBAAoB,CAAC,EAAE,EAAE,0BAA0B,EAAE,WAAW,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACvF,MAAM,oBAAoB,CAAC,EAAE,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;IACjF,MAAM,oBAAoB,CACxB,EAAE,EACF,mCAAmC,EACnC,aAAa,EACb,GAAG,CAAA,eAAe,CACnB,CAAA;IACD,MAAM,oBAAoB,CAAC,EAAE,EAAE,8BAA8B,EAAE,cAAc,EAAE,GAAG,CAAA,WAAW,CAAC,CAAA;AAChG,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,EAAkB,EAClB,IAAY,EACZ,KAAkB,EAClB,OAAoB;IAEpB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,gBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,OAAO,EAAE,CAAC;SAC/E,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA,CAAC,0DAA0D;AACtF,CAAC"}

package/dist/types.d.ts

@@ -61,4 +61,34 @@ export interface RecordAuditInput {
     readonly entryId?: string | undefined;
     readonly diff?: Readonly<Record<string, unknown>> | undefined;
 }
+/**
+ * A machine-to-machine bearer credential (L13 task 8).
+ *
+ * A key is scoped to an explicit, open set of role names — exactly like a
+ * user's `roles` — chosen once at creation and never derived from the
+ * account that created it. A key can act with fewer permissions than an
+ * admin has, but never with more than it was granted.
+ */
+export interface ApiKey {
+    readonly id: string;
+    readonly name: string;
+    /** The first 12 characters of the raw key, safe to show forever. */
+    readonly prefix: string;
+    readonly scope: readonly string[];
+    readonly createdBy: string | null;
+    readonly createdAt: string;
+    readonly expiresAt: string | undefined;
+    readonly revokedAt: string | undefined;
+    readonly lastUsedAt: string | undefined;
+}
+export interface CreateApiKeyInput {
+    readonly name: string;
+    readonly scope: readonly string[];
+    readonly createdBy: string | null;
+    readonly expiresAt?: string | undefined;
+}
+/** An API key as returned once, at creation — `key` is never stored or shown again. */
+export interface IssuedApiKey extends ApiKey {
+    readonly key: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,YAAI,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAA;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CAC9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,YAAI,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAA;AACzE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAA;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CAC9D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAa,SAAQ,MAAM;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cogenta/auth",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "Identity, sessions and credentials: password, TOTP and WebAuthn, plus the append-only audit log.",
   "license": "MPL-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "@simplewebauthn/server": "^13.3.2",
-    "@cogenta/core": "0.2.0",
-    "@cogenta/schema": "0.1.2"
+    "@cogenta/core": "0.4.0",
+    "@cogenta/schema": "0.3.0"
   },
   "devDependencies": {
     "typescript": "^7.0.2",