@jimhoyd/urlcode-auth 0.1.0-alpha.1 → 0.1.0-alpha.2

package/dist/auth-core.js

@@ -0,0 +1,1066 @@
+import { createAdminAccountOperations } from "./admin-account-operations.js";
+import { isIP } from 'node:net';
+import { abuseKey, normalizeAbusePolicy } from "./abuse.js";
+import { validateUserQuery } from "./user-query.js";
+import { validateRecoveryEvidence } from "./manual-recovery.js";
+import { isDisposableEmailDomain, disposableDomainsRevision } from "./disposable-domains.js";
+import { randomBytes, randomInt, randomUUID, createHash, createHmac, createCipheriv, createDecipheriv, scrypt, pbkdf2, timingSafeEqual } from 'node:crypto';
+import { compare as bcryptCompare } from 'bcryptjs';
+import { domainToASCII } from 'node:url';
+import { TOTP, Secret } from 'otpauth';
+import { createRegistrationPolicy } from "./registration.js";
+import { AuthError, openAuthStore } from "./auth-store.js";
+export { AuthError };
+const fail = (status, code) => { throw new AuthError(status, code); };
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+const token = () => randomBytes(32).toString('base64url');
+const validToken = (value) => typeof value === 'string' && /^[A-Za-z0-9_-]{43}$/.test(value);
+const id = (value) => {
+    if (typeof value !== 'string' || value.length > 256 || !value || /[\x00-\x20\x7f]/.test(value))
+        fail(400, 'invalid_identifier');
+    return value;
+};
+export function normalizeEmail(value) {
+    if (typeof value !== 'string' || value.length > 254)
+        fail(400, 'invalid_email');
+    const parts = value.normalize('NFKC').trim().split('@');
+    if (parts.length !== 2)
+        fail(400, 'invalid_email');
+    const local = parts[0].toLowerCase(), domain = domainToASCII(parts[1]).toLowerCase();
+    if (!local || local.length > 64 || /[\s\x00-\x1f\x7f"(),:;<>\[\]\\]/.test(local) || !domain || domain.length > 253 || domain.split('.').some(label => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) || local.length + domain.length + 1 > 254)
+        fail(400, 'invalid_email');
+    return local + '@' + domain;
+}
+function password(value) {
+    if (typeof value !== 'string' || value.length > 1024 || [...value].length < 15 || [...value].length > 256 || Buffer.byteLength(value) > 1024)
+        fail(400, 'password_length_invalid');
+}
+let hashing = 0;
+let passwordChecks = 0;
+let lifecycleActive = 0;
+async function derive(value, salt) {
+    if (hashing >= 2)
+        fail(503, 'password_hash_busy');
+    hashing++;
+    try {
+        return await new Promise((resolve, reject) => scrypt(value, salt, 32, { N: 131072, r: 8, p: 1, maxmem: 160 * 1024 * 1024 }, (error, key) => error ? reject(new AuthError(503, 'password_hash_unavailable')) : resolve(key)));
+    }
+    finally {
+        hashing--;
+    }
+}
+async function hashPassword(value, validate = true) {
+    if (validate)
+        password(value);
+    const salt = randomBytes(16), key = await derive(value, salt);
+    return `scrypt-v1$${salt.toString('base64url')}$${key.toString('base64url')}`;
+}
+function validPasswordHash(encoded) {
+    if (typeof encoded !== 'string' || encoded.length > 512)
+        return false;
+    if (/^scrypt-v1\$[A-Za-z0-9_-]{22}\$[A-Za-z0-9_-]{43}$/.test(encoded))
+        return true;
+    const bcrypt = /^\$2[aby]\$(\d{2})\$[./A-Za-z0-9]{53}$/.exec(encoded);
+    if (bcrypt)
+        return Number(bcrypt[1]) >= 10 && Number(bcrypt[1]) <= 14;
+    const pb = /^pbkdf2-sha256\$(\d{6,7})\$([A-Za-z0-9_-]{22,86})\$([A-Za-z0-9_-]{43})$/.exec(encoded);
+    return Boolean(pb) && Number(pb[1]) >= 600000 && Number(pb[1]) <= 1000000;
+}
+async function verifyPassword(value, encoded) {
+    if (typeof value !== 'string' || Buffer.byteLength(value) > 1024)
+        fail(401, 'invalid_credentials');
+    if (encoded && validPasswordHash(encoded) && !encoded.startsWith('scrypt-v1$')) {
+        if (hashing >= 2)
+            fail(503, 'password_hash_busy');
+        hashing++;
+        try {
+            if (encoded.startsWith('$2')) {
+                if (Buffer.byteLength(value) > 72)
+                    return false;
+                return await bcryptCompare(value, encoded);
+            }
+            const parts = encoded.split('$'), derived = await new Promise((resolve, reject) => pbkdf2(value, Buffer.from(parts[2], 'base64url'), Number(parts[1]), 32, 'sha256', (error, key) => error ? reject(new AuthError(503, 'password_hash_unavailable')) : resolve(key)));
+            return timingSafeEqual(derived, Buffer.from(parts[3], 'base64url'));
+        }
+        finally {
+            hashing--;
+        }
+    }
+    const parts = encoded?.split('$'), valid = encoded && validPasswordHash(encoded) && parts?.[0] === 'scrypt-v1';
+    const key = await derive(value, valid ? Buffer.from(parts[1], 'base64url') : Buffer.alloc(16));
+    return Boolean(valid) && timingSafeEqual(key, Buffer.from(parts[2], 'base64url'));
+}
+const basePublicUser = (user) => ({ id: user.id, email: user.email, emailVerified: user.emailVerified, status: user.status, roles: [...user.roles], created: user.created, totpEnabled: Boolean(user.totpSecret) });
+export async function createAuthService(options) {
+    if (options.approveConfigurationChangeFrom !== undefined && (typeof options.approveConfigurationChangeFrom !== 'string' || !/^[a-f0-9]{64}$/.test(options.approveConfigurationChangeFrom)))
+        fail(400, 'invalid_configuration_approval');
+    if (options.configurationTag !== undefined && (typeof options.configurationTag !== 'string' || options.configurationTag.length < 1 || options.configurationTag.length > 128 || /[\x00-\x1f\x7f]/.test(options.configurationTag)))
+        fail(400, 'invalid_configuration_tag');
+    for (const value of [options.requireEmailVerification, options.requireMfa, options.blockDisposableEmails])
+        if (value !== undefined && typeof value !== 'boolean')
+            fail(400, 'invalid_security_policy');
+    const deletionGraceMs = options.deletionGraceMs ?? 604800000;
+    if (!Number.isSafeInteger(deletionGraceMs) || deletionGraceMs < 86400000 || deletionGraceMs > 2592000000)
+        fail(400, 'invalid_deletion_grace');
+    if (options.allowManualRecovery !== undefined && typeof options.allowManualRecovery !== 'boolean')
+        fail(400, 'invalid_manual_recovery_policy');
+    if (options.allowEmailFactorRecovery !== undefined && typeof options.allowEmailFactorRecovery !== 'boolean')
+        fail(400, 'invalid_factor_recovery_policy');
+    if (options.allowPasskeySecondFactor !== undefined && typeof options.allowPasskeySecondFactor !== 'boolean')
+        fail(400, 'invalid_security_policy');
+    const trustedDeviceTtlMs = options.trustedDeviceTtlMs ?? 0;
+    if (!Number.isSafeInteger(trustedDeviceTtlMs) || trustedDeviceTtlMs < 0 || trustedDeviceTtlMs > 2592000000 || trustedDeviceTtlMs > 0 && trustedDeviceTtlMs < 60000)
+        fail(400, 'invalid_trusted_device_policy');
+    const abusePolicy = normalizeAbusePolicy(options.abuse);
+    const securityPolicy = Object.freeze({ ...(abusePolicy ? { abuse: abusePolicy } : {}), ...(options.allowManualRecovery === true ? { allowManualRecovery: true } : {}), ...(options.allowPasskeySecondFactor ? { allowPasskeySecondFactor: true } : {}), ...(trustedDeviceTtlMs ? { trustedDeviceTtlMs } : {}), ...(options.allowEmailFactorRecovery === true ? { allowEmailFactorRecovery: true } : {}), requireEmailVerification: options.requireEmailVerification === true, requireMfa: options.requireMfa === true, deletionGraceMs });
+    const supplied = options.encryptionKeys ?? (options.encryptionKey ? { legacy: options.encryptionKey } : {}), activeKey = options.activeEncryptionKey ?? 'legacy';
+    const keys = Object.create(null);
+    if (Object.keys(supplied).length < 1 || Object.keys(supplied).length > 8)
+        fail(400, 'auth_encryption_key_required');
+    for (const [name, value] of Object.entries(supplied)) {
+        if (!/^[a-zA-Z0-9_-]{1,32}$/.test(name) || !(value instanceof Uint8Array) || value.byteLength !== 32)
+            fail(400, 'auth_encryption_key_required');
+        keys[name] = Buffer.from(value);
+    }
+    if (!keys[activeKey])
+        fail(400, 'auth_encryption_key_required');
+    if (!options.roles || typeof options.roles !== 'object' || Array.isArray(options.roles) || Object.keys(options.roles).length > 64)
+        fail(400, 'invalid_roles');
+    const roles = Object.create(null);
+    for (const [name, list] of Object.entries(options.roles)) {
+        if (!/^[a-z][a-z0-9_-]{0,63}$/.test(name) || !Array.isArray(list) || list.length > 128 || list.some(p => typeof p !== 'string' || !/^\*$|^[a-z][a-z0-9_.:-]{0,127}$/.test(p)))
+            fail(400, 'invalid_roles');
+        roles[name] = [...new Set(list)];
+    }
+    const defaultRole = options.defaultRole ?? 'user';
+    if (!Object.hasOwn(roles, defaultRole) || roles[defaultRole].some(p => p === '*' || p.startsWith('auth.')))
+        fail(400, 'unsafe_default_role');
+    const mode = options.registrationMode ?? 'open';
+    if (!['open', 'invite-only', 'waitlist', 'off'].includes(mode))
+        fail(400, 'invalid_registration_mode');
+    const domains = (values) => {
+        if (values !== undefined && (!Array.isArray(values) || values.length > 100))
+            fail(400, 'invalid_email_domains');
+        return (values ?? []).map(value => normalizeEmail('test@' + value).split('@')[1]);
+    };
+    const emailList = (values) => {
+        if (values !== undefined && (!Array.isArray(values) || values.length > 1000))
+            fail(400, 'invalid_email_list');
+        return (values ?? []).map(normalizeEmail);
+    };
+    const allowedEmails = emailList(options.allowedEmails), blockedEmails = emailList(options.blockedEmails);
+    const allowed = domains(options.allowedEmailDomains), blocked = domains(options.blockedEmailDomains);
+    const permittedEmail = (value) => {
+        const email = normalizeEmail(value), domain = email.split('@')[1];
+        if (options.blockDisposableEmails && isDisposableEmailDomain(domain) || blockedEmails.includes(email) || (allowedEmails.length && !allowedEmails.includes(email)) || blocked.includes(domain) || (allowed.length && !allowed.includes(domain)))
+            fail(403, 'registration_unavailable');
+        return email;
+    };
+    const ttl = options.sessionTtlMs ?? 86400000;
+    if (!Number.isSafeInteger(ttl) || ttl < 60000 || ttl > 2592000000)
+        fail(400, 'invalid_session_ttl');
+    const idle = options.sessionIdleMs ?? Math.min(ttl, 1800000);
+    if (!Number.isSafeInteger(idle) || idle < 60000 || idle > ttl)
+        fail(400, 'invalid_session_idle');
+    const key = keys[activeKey], now = () => {
+        const value = (options.now ?? Date.now)();
+        if (!Number.isSafeInteger(value) || value < 0)
+            fail(503, 'invalid_clock');
+        return value;
+    };
+    const store = await openAuthStore({ database: options.database, ...(options.approveConfigurationChangeFrom ? { approveConfigurationChangeFrom: options.approveConfigurationChangeFrom } : {}), configurationChangeAt: now(), ...(options.configurationTag !== undefined ? { configurationTag: options.configurationTag } : {}), roles, defaultRole, sessionTtlMs: ttl, sessionIdleMs: idle, securityPolicy, registration: { ...(options.blockDisposableEmails ? { disposableDomainsRevision } : {}), mode, allowed, blocked, allowedEmails, blockedEmails, allowImpersonation: options.allowImpersonation === true }, activeKey, keyFingerprints: Object.fromEntries(Object.entries(keys).map(([name, value]) => [name, createHmac('sha256', value).update('urlcode-auth-store-v1').digest('hex')])) });
+    let closed = false;
+    const hookStats = { accepted: 0, dropped: 0, failed: 0, timedOut: 0 };
+    const hookControllers = new Set();
+    const lifecycle = (event) => {
+        if (!options.onLifecycle)
+            return;
+        if (closed || lifecycleActive >= 4) {
+            hookStats.dropped++;
+            return;
+        }
+        lifecycleActive++;
+        hookStats.accepted++;
+        const controller = new AbortController();
+        hookControllers.add(controller);
+        let timedOut = false;
+        const timer = setTimeout(() => { timedOut = true; hookStats.timedOut++; controller.abort(); }, 5000);
+        timer.unref();
+        void Promise.resolve().then(() => options.onLifecycle({ ...event }, { signal: controller.signal })).catch(() => {
+            if (!timedOut)
+                hookStats.failed++;
+        }).finally(() => { clearTimeout(timer); hookControllers.delete(controller); lifecycleActive--; });
+    };
+    const check = () => {
+        if (closed)
+            fail(503, 'auth_service_closed');
+    };
+    const profilePolicy = options.registrationPolicy ?? createRegistrationPolicy();
+    const validateProfile = (input, existing) => {
+        try {
+            return profilePolicy.validate(input, { now: now(), ...(existing ? { existing } : {}) });
+        }
+        catch {
+            return fail(400, 'invalid_registration_profile');
+        }
+    };
+    const publicUser = (user) => ({ ...basePublicUser(user), ...(securityPolicy.allowPasskeySecondFactor && user.mfaPasskeys?.length ? { passkeyMfaEnabled: true } : {}), ...(user.profile ? { profile: profilePolicy.publicProfile(user.profile) } : {}) });
+    const newPassword = async (value) => {
+        password(value);
+        if (options.checkPassword) {
+            if (passwordChecks >= 4)
+                fail(503, 'password_check_busy');
+            passwordChecks++;
+            const controller = new AbortController();
+            let timer;
+            const pending = Promise.resolve().then(() => options.checkPassword(value, { signal: controller.signal }));
+            void pending.finally(() => { passwordChecks--; }).catch(() => { });
+            try {
+                await Promise.race([pending, new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new AuthError(503, 'password_check_unavailable')); }, 5000); })]);
+            }
+            catch (error) {
+                if (error instanceof AuthError && error.code === 'password_check_unavailable')
+                    throw error;
+                fail(400, 'password_not_allowed');
+            }
+            finally {
+                if (timer)
+                    clearTimeout(timer);
+            }
+        }
+        return hashPassword(value);
+    };
+    const perms = (names) => [...new Set(names.flatMap(name => roles[name] || []))];
+    const restrictions = (user) => [...(securityPolicy.requireEmailVerification && !user.emailVerified ? ['verify-email'] : []), ...((user.mfaRecoveryRequired || securityPolicy.requireMfa && !user.totpSecret && !(securityPolicy.allowPasskeySecondFactor && user.mfaPasskeys?.length)) ? ['enroll-mfa'] : [])];
+    const principal = (user, session) => { const pending = restrictions(user); return { id: user.id, email: user.email, emailVerified: user.emailVerified, roles: pending.length ? [] : [...user.roles], permissions: pending.length ? [] : session.impersonatorId ? perms(user.roles).filter(p => p !== '*' && !p.startsWith('auth.') && !p.startsWith('admin.')) : perms(user.roles), ...(pending.length ? { restrictions: pending } : {}), ...(session.impersonatorId ? { impersonatorId: session.impersonatorId } : {}), sessionId: session.id, authenticatedAt: session.authenticatedAt }; };
+    const sessionFor = (accountId, device) => {
+        if (device && (!validToken(device.id) || device.label !== undefined && (typeof device.label !== 'string' || device.label.length > 160 || /[\x00-\x1f\x7f]/.test(device.label))))
+            fail(400, 'invalid_device');
+        const raw = token(), created = now();
+        return { raw, value: { id: randomUUID(), hash: digest(raw), accountId, created, authenticatedAt: created, primaryMethod: 'password', expires: created + ttl, ...(device ? { deviceHash: digest(device.id), deviceLabel: device.label ?? 'Browser' } : {}) } };
+    };
+    const seal = (value, context) => { const nonce = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key, nonce); cipher.setAAD(Buffer.from(context)); const bytes = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]); return activeKey + '.' + Buffer.concat([nonce, cipher.getAuthTag(), bytes]).toString('base64url'); };
+    const unseal = (value, context) => {
+        try {
+            const parts = value.split('.'), keyId = parts.length === 2 ? parts[0] : 'legacy', secretKey = keys[keyId];
+            if (!secretKey)
+                throw new Error();
+            const bytes = Buffer.from(parts.at(-1), 'base64url');
+            if (bytes.length < 29)
+                throw new Error();
+            const cipher = createDecipheriv('aes-256-gcm', secretKey, bytes.subarray(0, 12));
+            cipher.setAuthTag(bytes.subarray(12, 28));
+            cipher.setAAD(Buffer.from(context));
+            return Buffer.concat([cipher.update(bytes.subarray(28)), cipher.final()]).toString('utf8');
+        }
+        catch {
+            return fail(503, 'auth_secret_unavailable');
+        }
+    };
+    const lookupSession = async (raw, fresh = false, enrollment = false) => {
+        check();
+        if (!validToken(raw))
+            return fail(401, 'invalid_credentials');
+        const value = await store.call('authenticate', { hash: digest(raw), now: now() });
+        if (!value)
+            return fail(401, 'invalid_credentials');
+        if (value.session.impersonatorId && fresh)
+            fail(403, 'impersonation_restricted');
+        if (fresh && now() - value.session.authenticatedAt > 300000)
+            fail(401, 'fresh_authentication_required');
+        if (enrollment && value.user.mfaRecoveryRequired && !value.session.recoveryEnrollment)
+            fail(403, 'recovery_enrollment_proof_required');
+        if (fresh) {
+            const pending = restrictions(value.user);
+            if (pending.length && (!enrollment || pending.includes('verify-email')))
+                fail(403, 'enrollment_required');
+        }
+        return value;
+    };
+    const attempt = async (value) => { const attemptKey = createHash('sha256').update('urlcode-auth-attempt:' + value).digest('hex'); await store.call('attempt', { key: attemptKey, now: now() }); return attemptKey; };
+    const counter = (secret, code, accountId) => {
+        if (typeof code !== 'string' || !/^\d{6}$/.test(code))
+            return fail(401, 'invalid_credentials');
+        const totp = new TOTP({ secret: unseal(secret, 'totp:' + accountId), algorithm: 'SHA1', digits: 6, period: 30 });
+        const timestamp = now(), delta = totp.validate({ token: code, window: 1, timestamp });
+        if (delta === null)
+            return fail(401, 'invalid_credentials');
+        return Math.floor(timestamp / 30000) + delta;
+    };
+    const factor = (user, input, allowTrusted = false) => {
+        if (input.secondFactor) {
+            if (!securityPolicy.allowPasskeySecondFactor || !validToken(input.secondFactor.token) || !/^[a-f0-9]{64}$/.test(input.secondFactor.browserHash))
+                fail(401, 'invalid_second_factor');
+            return { secondFactorHash: digest(input.secondFactor.token), secondFactorBrowser: input.secondFactor.browserHash };
+        }
+        if (allowTrusted && input.trustedDevice && !input.totp && !input.recoveryCode && (user.totpSecret || securityPolicy.allowPasskeySecondFactor && user.mfaPasskeys?.length)) {
+            if (!trustedDeviceTtlMs || !validToken(input.trustedDevice))
+                fail(401, 'invalid_trusted_device');
+            return { trustedDeviceHash: digest(input.trustedDevice) };
+        }
+        if (!user.totpSecret) {
+            if (securityPolicy.allowPasskeySecondFactor && user.mfaPasskeys?.length)
+                fail(401, 'second_factor_required');
+            return {};
+        }
+        if (input.recoveryCode) {
+            if (!/^[A-Za-z0-9_-]{22}$/.test(input.recoveryCode))
+                fail(401, 'invalid_credentials');
+            return { recoveryHash: digest(input.recoveryCode) };
+        }
+        return { counter: counter(user.totpSecret, input.totp ?? '', user.id) };
+    };
+    const create = async (input, bootstrap = false) => {
+        check();
+        if (!bootstrap && (mode === 'off' || mode === 'waitlist' || mode === 'invite-only' && !validToken(input.invitationToken)))
+            fail(403, 'registration_unavailable');
+        const email = permittedEmail(input.email), passwordHash = await newPassword(input.password), created = now(), accountId = randomUUID();
+        let assigned = [defaultRole];
+        if (bootstrap) {
+            const admin = Object.keys(roles).find(name => roles[name].includes('*'));
+            if (!admin)
+                fail(400, 'administrator_role_required');
+            assigned = [admin];
+        }
+        const user = { id: accountId, email, emailVerified: false, status: 'active', roles: assigned, created, passwordHash, version: 1, totpCounter: -1, ...(!bootstrap && (options.registrationPolicy || input.profile) ? { profile: validateProfile(input.profile ?? {}) } : {}) }, session = sessionFor(accountId, input.device);
+        const stored = await store.call('create', { user, session: session.value, bootstrap, ...(!bootstrap && mode === 'invite-only' ? { invitationHash: digest(input.invitationToken) } : {}), now: now() });
+        lifecycle({ type: 'sign-up', accountId: stored.id });
+        return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value), ...(stored.newDevice ? { newDevice: true } : {}) };
+    };
+    const login = async (input, oldToken) => {
+        check();
+        const email = normalizeEmail(input.email), backoffKey = abuseKey('password', email);
+        if (abusePolicy?.passwordBackoff && await store.call('abuseBackoffCheck', { key: backoffKey, now: now() }))
+            return fail(429, 'auth_backoff');
+        try {
+            const attemptKey = await attempt('login:' + email), user = await store.call('email', { email });
+            const verified = await verifyPassword(input.password, user?.passwordHash);
+            if (!verified || !user || user.status !== 'active')
+                return fail(401, 'invalid_credentials');
+            const fact = factor(user, input, !oldToken), session = sessionFor(user.id, input.device), upgradedHash = !user.passwordHash.startsWith('scrypt-v1$') ? await hashPassword(input.password, false) : undefined;
+            if (fact.trustedDeviceHash)
+                session.value.authenticatedAt = 0;
+            const stored = await store.call('login', { accountId: user.id, version: user.version, passwordHash: user.passwordHash, ...(upgradedHash ? { upgradedHash } : {}), ...fact, session: session.value, attemptKey, ...(abusePolicy?.passwordBackoff ? { abuseKey: backoffKey } : {}), ...(oldToken ? { oldHash: digest(oldToken) } : {}), now: now() });
+            return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value), ...(stored.newDevice ? { newDevice: true } : {}) };
+        }
+        catch (error) {
+            if (abusePolicy?.passwordBackoff && error instanceof AuthError && error.status === 401)
+                await store.call('abuseFailure', { key: backoffKey, now: now() });
+            throw error;
+        }
+    };
+    const pagination = (options = {}) => {
+        const limit = options.limit ?? 50;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 100 || typeof (options.after ?? '') !== 'string' || (options.after?.length ?? 0) > 256)
+            fail(400, 'invalid_page');
+        return { limit, after: options.after ?? '' };
+    };
+    const reason = (value) => {
+        if (value !== undefined && (typeof value !== 'string' || value.length > 256 || /[\x00-\x1f\x7f]/.test(value)))
+            fail(400, 'invalid_reason');
+        return value ?? '';
+    };
+    const external = (provider, subject) => {
+        if (!/^[a-z][a-z0-9_-]{0,63}$/.test(provider) || typeof subject !== 'string' || !subject || subject.length > 512 || /[\x00-\x1f\x7f]/.test(subject))
+            fail(400, 'invalid_external_identity');
+    };
+    const validateProof = (value, method) => {
+        if (!value || value.kind !== method || !Number.isSafeInteger(value.version) || value.version < 1)
+            fail(400, 'invalid_auth_proof');
+        if (value.kind === 'oidc')
+            external(value.provider, value.subject);
+        else if (value.kind === 'passkey') {
+            if (typeof value.credentialId !== 'string' || !value.credentialId || value.credentialId.length > 2048 || !(/^[a-f0-9]{64}$/.test(value.publicKeyHash)) || ![value.expectedCounter, value.newCounter].every(counter => Number.isSafeInteger(counter) && counter >= 0 && counter <= 4294967295) || !(value.expectedCounter === 0 && value.newCounter === 0) && value.newCounter <= value.expectedCounter)
+                fail(400, 'invalid_auth_proof');
+        }
+        else
+            fail(400, 'invalid_auth_proof');
+        return structuredClone(value);
+    };
+    const signupBinding = (input) => {
+        check();
+        if (!validToken(input.flowId) || typeof input.browserHash !== 'string' || !/^[a-f0-9]{64}$/.test(input.browserHash))
+            fail(400, 'invalid_signup_flow');
+        return { hash: digest(input.flowId), browser: input.browserHash, now: now() };
+    };
+    const signupState = (row, flowId) => ({ flowId, accountId: row.account_id, email: row.email, step: row.step, expires: row.expires });
+    const signupRead = async (input, step) => {
+        const row = await store.call('signupRead', signupBinding(input));
+        if (!row || step && row.step !== step)
+            fail(400, 'invalid_signup_flow');
+        return row;
+    };
+    const service = {
+        ...createAdminAccountOperations({ store, check, now, roles, permittedEmail }),
+        getAbusePolicy: () => abusePolicy ? structuredClone(abusePolicy) : undefined,
+        async admitAuthRequest(input) {
+            check();
+            const limits = [];
+            const needsClient = abusePolicy?.client || input.signupEmail !== undefined && abusePolicy?.signupClient;
+            if (needsClient && (typeof input.client !== 'string' || !isIP(input.client)))
+                return fail(503, 'trusted_client_required');
+            if (abusePolicy?.client)
+                limits.push({ ...abusePolicy.client, key: abuseKey('client', input.client), ...(abusePolicy.challengeAfter !== undefined ? { challengeAfter: abusePolicy.challengeAfter } : {}) });
+            if (input.signupEmail !== undefined) {
+                const email = permittedEmail(input.signupEmail), domain = email.slice(email.lastIndexOf('@') + 1);
+                if (abusePolicy?.signupClient)
+                    limits.push({ ...abusePolicy.signupClient, key: abuseKey('signup-client', input.client) });
+                if (abusePolicy?.signupDomain)
+                    limits.push({ ...abusePolicy.signupDomain, key: abuseKey('signup-domain', domain) });
+            }
+            return limits.length ? store.call('abuseAdmit', { limits, now: now() }) : { challengeRequired: false };
+        },
+        async createSecondFactorProof(input) {
+            check();
+            if (!securityPolicy.allowPasskeySecondFactor || typeof input.browserHash !== 'string' || !/^[a-f0-9]{64}$/.test(input.browserHash))
+                fail(400, 'invalid_second_factor');
+            const proof = validateProof(input.proof, 'passkey'), raw = token();
+            await store.call('factorProof', { hash: digest(raw), browser: input.browserHash, proof, now: now() });
+            return raw;
+        },
+        async setPasskeySecondFactor(input) {
+            if (!securityPolicy.allowPasskeySecondFactor || !validToken(input.token) || typeof input.enabled !== 'boolean' || typeof input.credentialId !== 'string' || !input.credentialId || input.credentialId.length > 2048)
+                fail(400, 'invalid_second_factor');
+            const { user } = await lookupSession(input.token, true, input.enabled);
+            const fact = input.enabled ? factor(user, input.secondFactor ? { secondFactor: input.secondFactor } : {}) : {};
+            if (input.enabled && !fact.secondFactorHash)
+                fail(401, 'second_factor_required');
+            await store.call('setPasskeyFactor', { hash: digest(input.token), credentialId: input.credentialId, enabled: input.enabled, ...fact, now: now() });
+        },
+        async rememberDevice(input) {
+            if (!trustedDeviceTtlMs || !validToken(input.token) || input.label !== undefined && (typeof input.label !== 'string' || input.label.length > 160 || /[\x00-\x1f\x7f]/.test(input.label)))
+                fail(400, 'invalid_trusted_device');
+            const raw = token(), expires = now() + trustedDeviceTtlMs;
+            await store.call('rememberDevice', { hash: digest(input.token), deviceHash: digest(raw), deviceId: randomUUID(), label: input.label ?? 'Browser', expires, now: now() });
+            return { token: raw, expires };
+        },
+        async listTrustedDevices(raw) {
+            if (!validToken(raw))
+                fail(401, 'invalid_credentials');
+            return store.call('trustedDevices', { hash: digest(raw), now: now() });
+        },
+        async revokeTrustedDevice(input) {
+            if (!validToken(input.token))
+                fail(401, 'invalid_credentials');
+            await store.call('revokeTrustedDevice', { hash: digest(input.token), deviceId: id(input.deviceId), now: now() });
+        },
+        getManualRecoveryEnabled: () => securityPolicy.allowManualRecovery === true,
+        async createRecoveryCase(input) { check(); if (!securityPolicy.allowManualRecovery)
+            fail(403, 'manual_recovery_disabled'); if (!validToken(input.actorToken))
+            fail(401, 'invalid_credentials'); const why = reason(input.reason); if (!why.trim())
+            fail(400, 'invalid_case'); let evidence; try {
+            evidence = validateRecoveryEvidence(input.evidence);
+        }
+        catch {
+            fail(400, 'invalid_recovery_evidence');
+        } return store.call('manualRecoveryCreate', { hash: digest(input.actorToken), accountId: id(input.accountId), email: permittedEmail(input.email), evidence, reason: why, id: randomUUID(), now: now() }); },
+        async listRecoveryCases(options) { check(); const page = pagination(options), cases = await store.call('manualRecoveryList', { ...page, now: now() }); return { cases, ...(cases.length === page.limit ? { next: cases.at(-1).id } : {}) }; },
+        async approveRecoveryCase(input) { check(); if (!validToken(input.actorToken))
+            fail(401, 'invalid_credentials'); const why = reason(input.reason); if (!why.trim())
+            fail(400, 'invalid_case'); const raw = token(), result = await store.call('manualRecoveryApprove', { hash: digest(input.actorToken), id: id(input.caseId), reason: why, tokenHash: digest(raw), now: now() }); return { ...result, token: raw }; },
+        async activateRecoveryCase(input) { check(); if (!validToken(input.actorToken) || !validToken(input.token))
+            fail(401, 'invalid_credentials'); await store.call('manualRecoveryActivate', { hash: digest(input.actorToken), id: id(input.caseId), tokenHash: digest(input.token), now: now() }); },
+        async cancelRecoveryCredential(input) { check(); if (!validToken(input.actorToken) || !validToken(input.token))
+            fail(401, 'invalid_credentials'); await store.call('manualRecoveryCancel', { hash: digest(input.actorToken), id: id(input.caseId), tokenHash: digest(input.token), now: now() }); },
+        async redeemRecoveryCase(input) { check(); if (!securityPolicy.allowManualRecovery)
+            fail(403, 'manual_recovery_disabled'); if (!validToken(input.token))
+            fail(401, 'invalid_recovery'); await store.call('manualRecoveryCheck', { tokenHash: digest(input.token), now: now() }); await attempt('manual-recovery:' + digest(input.token)); const passwordHash = await newPassword(input.password), raw = token(), timestamp = now(), value = { id: randomUUID(), hash: digest(raw), accountId: '', created: timestamp, authenticatedAt: timestamp, expires: timestamp + Math.min(ttl, 1800000), recoveryEnrollment: 1, primaryMethod: 'recovery', mfaAuthenticatedAt: 0, mfaVersion: 0 }; const user = await store.call('manualRecoveryRedeem', { tokenHash: digest(input.token), passwordHash, session: value, now: timestamp }); value.accountId = user.id; return { user: publicUser(user), token: raw, principal: principal(user, value) }; },
+        getFactorRecoveryEnabled: () => securityPolicy.allowEmailFactorRecovery === true,
+        async beginFactorRecovery(input) {
+            check();
+            if (!securityPolicy.allowEmailFactorRecovery)
+                fail(403, 'factor_recovery_disabled');
+            if (!validToken(input.browserToken))
+                fail(400, 'invalid_recovery_browser');
+            const email = normalizeEmail(input.email);
+            await attempt('factor-recovery:' + email);
+            const verificationToken = token(), cancelToken = token();
+            const issued = await store.call('factorRecoveryBegin', { email, browser: digest(input.browserToken), verification: digest(verificationToken), cancellation: digest(cancelToken), now: now() });
+            return { verificationToken: issued ? verificationToken : null, cancelToken: issued ? cancelToken : null };
+        },
+        async confirmFactorRecovery(input) {
+            check();
+            if (!securityPolicy.allowEmailFactorRecovery)
+                fail(403, 'factor_recovery_disabled');
+            if (!validToken(input.token) || !validToken(input.browserToken))
+                fail(400, 'invalid_recovery_token');
+            return store.call('factorRecoveryConfirm', { verification: digest(input.token), browser: digest(input.browserToken), now: now() });
+        },
+        async cancelFactorRecovery(raw) {
+            check();
+            if (!securityPolicy.allowEmailFactorRecovery)
+                fail(403, 'factor_recovery_disabled');
+            if (!validToken(raw))
+                fail(400, 'invalid_recovery_token');
+            await store.call('factorRecoveryCancel', { cancellation: digest(raw), now: now() });
+        },
+        async completeFactorRecovery(input) {
+            check();
+            if (!securityPolicy.allowEmailFactorRecovery)
+                fail(403, 'factor_recovery_disabled');
+            if (!validToken(input.token) || !validToken(input.browserToken))
+                fail(400, 'invalid_recovery_token');
+            const raw = token(), timestamp = now();
+            const value = { id: randomUUID(), hash: digest(raw), accountId: '', created: timestamp, authenticatedAt: timestamp, expires: timestamp + Math.min(ttl, 1800000) };
+            const user = await store.call('factorRecoveryComplete', { verification: digest(input.token), browser: digest(input.browserToken), session: value, now: timestamp });
+            value.accountId = user.id;
+            return { user: publicUser(user), token: raw, principal: principal(user, value) };
+        },
+        async beginSignup(input) {
+            check();
+            if (typeof input.browserHash !== 'string' || !/^[a-f0-9]{64}$/.test(input.browserHash))
+                fail(400, 'invalid_signup_flow');
+            if (mode === 'off')
+                fail(403, 'registration_unavailable');
+            const email = normalizeEmail(input.email);
+            let eligible = true;
+            try {
+                permittedEmail(email);
+            }
+            catch {
+                eligible = false;
+            }
+            await attempt('signup:' + email);
+            const flowId = randomBytes(32).toString('base64url'), accountId = randomUUID(), code = String(randomInt(1000000)).padStart(6, '0');
+            const step = securityPolicy.requireEmailVerification ? 'verify-email' : 'credential';
+            const expires = now() + 1800000;
+            const result = await store.call('signupBegin', { hash: digest(flowId), browser: input.browserHash, email, accountId, codeHash: digest(flowId + ':' + code), step, expires, eligible, invitationHash: validToken(input.invitationToken) ? digest(input.invitationToken) : '', now: now() });
+            return { flowId, accountId, email, step, expires, ...(result.existing ? { delivery: { kind: 'registration-attempt', email } } : result.eligible && securityPolicy.requireEmailVerification ? { delivery: { kind: 'signup-code', email, code } } : {}) };
+        },
+        async getSignup(input) {
+            const row = await store.call('signupRead', signupBinding(input));
+            return row ? signupState(row, input.flowId) : null;
+        },
+        async verifySignup(input) {
+            const args = signupBinding(input);
+            const row = await store.call('signupVerify', { ...args, codeHash: digest(input.flowId + ':' + (typeof input.code === 'string' && /^\d{6}$/.test(input.code) ? input.code : 'invalid')) });
+            if (!row)
+                fail(400, 'invalid_signup_code');
+            return signupState(row, input.flowId);
+        },
+        async setSignupPassword(input) {
+            await signupRead(input, 'credential');
+            const passwordHash = await newPassword(input.password);
+            await store.call('signupCredential', { ...signupBinding(input), passwordHash });
+            return signupState(await signupRead(input, 'profile'), input.flowId);
+        },
+        async setSignupPasskeyChallenge(input) {
+            if (typeof input.challenge !== 'string' || !/^[A-Za-z0-9_-]{32,1024}$/.test(input.challenge))
+                fail(400, 'invalid_passkey');
+            await store.call('signupChallenge', { ...signupBinding(input), challenge: input.challenge });
+            return signupState(await signupRead(input, 'credential'), input.flowId);
+        },
+        async getSignupPasskeyChallenge(input) {
+            const row = await signupRead(input, 'credential');
+            if (!row.challenge)
+                fail(400, 'invalid_signup_flow');
+            return { state: signupState(row, input.flowId), challenge: row.challenge };
+        },
+        async setSignupPasskey(input) {
+            if (typeof input.challenge !== 'string' || !/^[A-Za-z0-9_-]{32,1024}$/.test(input.challenge))
+                fail(400, 'invalid_passkey');
+            const c = input.credential;
+            if (!c || typeof c.id !== 'string' || !c.id || c.id.length > 2048 || typeof c.publicKey !== 'string' || !c.publicKey || c.publicKey.length > 8192 || !Number.isSafeInteger(c.counter) || c.counter < 0 || c.transports && (!Array.isArray(c.transports) || c.transports.length > 8 || c.transports.some(t => !['ble', 'cable', 'hybrid', 'internal', 'nfc', 'smart-card', 'usb'].includes(t))))
+                fail(400, 'invalid_passkey');
+            const credential = { id: c.id, publicKey: c.publicKey, counter: c.counter, ...(c.transports ? { transports: c.transports } : {}) };
+            await store.call('signupCredential', { ...signupBinding(input), challenge: input.challenge, credential });
+            return signupState(await signupRead(input, 'profile'), input.flowId);
+        },
+        async completeSignup(input) {
+            const row = await signupRead(input, 'profile'), profile = validateProfile(input.profile ?? {}), session = sessionFor(row.account_id, input.device);
+            const stored = await store.call('signupComplete', { ...signupBinding(input), profile, session: session.value });
+            if (!stored)
+                return null;
+            lifecycle({ type: 'sign-up', accountId: stored.id });
+            return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value), ...(stored.newDevice ? { newDevice: true } : {}) };
+        },
+        register: input => create(input), bootstrapAdmin: input => create(input, true), login,
+        async stepUp(input) {
+            const value = await lookupSession(input.token);
+            if (value.session.impersonatorId)
+                fail(403, 'impersonation_restricted');
+            return login({ email: value.user.email, password: input.password, ...(input.totp ? { totp: input.totp } : {}), ...(input.recoveryCode ? { recoveryCode: input.recoveryCode } : {}), ...(input.secondFactor ? { secondFactor: input.secondFactor } : {}) }, input.token);
+        },
+        async authenticate(raw) {
+            check();
+            if (!validToken(raw))
+                return null;
+            const value = await store.call('authenticate', { hash: digest(raw), now: now() });
+            return value ? principal(value.user, value.session) : null;
+        },
+        async logout(raw) {
+            check();
+            if (validToken(raw))
+                await store.call('logout', { hash: digest(raw), now: now() });
+        },
+        async revokeSessions(accountId) { check(); await store.call('revoke', { accountId: id(accountId), now: now() }); },
+        async listUsers(options) {
+            check();
+            if (options?.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100))
+                fail(400, 'invalid_page');
+            let filters;
+            try {
+                filters = validateUserQuery(options);
+            }
+            catch {
+                return fail(400, 'invalid_user_filter');
+            }
+            if (filters.role !== undefined && !Object.hasOwn(roles, filters.role))
+                fail(400, 'invalid_filter');
+            const result = await store.call('users', { ...filters });
+            return { users: result.users.map(user => ({ ...publicUser(user), ...(typeof user.observedLastSeen === 'number' ? { observedLastSeen: user.observedLastSeen } : {}) })), ...(result.next ? { next: result.next } : {}) };
+        },
+        async getUser(accountId) { check(); const row = await store.call('account', { id: id(accountId) }); return row ? publicUser(row) : null; }, getRoles: () => structuredClone(roles),
+        async listDevices(accountId) {
+            check();
+            return store.call('devices', { accountId: id(accountId) });
+        },
+        async listSessions(accountId) { check(); return store.call('sessions', { accountId: id(accountId), now: now() }); },
+        async listAudit(options) {
+            check();
+            const page = pagination(options);
+            if (page.after && !/^\d{1,16}$/.test(page.after))
+                fail(400, 'invalid_page');
+            for (const value of [options?.actor, options?.subject, options?.action])
+                if (value !== undefined && (typeof value !== 'string' || value.length > 256 || /[\x00-\x1f]/.test(value)))
+                    fail(400, 'invalid_filter');
+            for (const value of [options?.from, options?.to])
+                if (value !== undefined && (!Number.isSafeInteger(value) || value < 0))
+                    fail(400, 'invalid_filter');
+            if (options?.from !== undefined && options?.to !== undefined && options.from > options.to)
+                fail(400, 'invalid_filter');
+            const rows = await store.call('audit', { ...page, actor: options?.actor ?? '', subject: options?.subject ?? '', action: options?.action ?? '', from: options?.from ?? 0, to: options?.to ?? Number.MAX_SAFE_INTEGER });
+            return { events: rows, ...(rows.length === page.limit ? { next: String(rows.at(-1).id) } : {}) };
+        },
+        async issueToken(input) {
+            check();
+            if (!['verify-email', 'reset-password'].includes(input.purpose))
+                fail(400, 'invalid_token_purpose');
+            const email = normalizeEmail(input.email);
+            await attempt('token:' + email);
+            const raw = token(), issued = await store.call('issueToken', { email, purpose: input.purpose, hash: digest(raw), now: now() });
+            return { token: issued ? raw : null };
+        },
+        async consumeVerification(raw) {
+            check();
+            if (!validToken(raw))
+                fail(400, 'invalid_token');
+            return publicUser(await store.call('consumeToken', { hash: digest(raw), purpose: 'verify-email', now: now() }));
+        },
+        async resetPassword(input) {
+            check();
+            if (!validToken(input.token))
+                fail(400, 'invalid_token');
+            const passwordHash = await newPassword(input.password);
+            return publicUser(await store.call('consumeToken', { hash: digest(input.token), purpose: 'reset-password', passwordHash, now: now() }));
+        },
+        async beginTotp(raw) { const { user } = await lookupSession(raw, true, true); await attempt('totp:' + user.id); const secret = new Secret({ size: 20 }), totp = new TOTP({ issuer: 'URLCode', label: user.email, secret }); await store.call('totpBegin', { hash: digest(raw), secret: seal(secret.base32, 'totp:' + user.id), now: now() }); return { secret: secret.base32, otpauthUrl: totp.toString() }; },
+        async confirmTotp(input) {
+            const { user } = await lookupSession(input.token, true, true);
+            await attempt('totp:' + user.id);
+            if (!user.totpPending)
+                fail(400, 'invalid_totp_setup');
+            const step = counter(user.totpPending, input.code, user.id), recoveryCodes = Array.from({ length: 10 }, () => randomBytes(16).toString('base64url'));
+            await store.call('totpConfirm', { hash: digest(input.token), version: user.version, counter: step, recoveryHashes: recoveryCodes.map(digest), now: now() });
+            return { recoveryCodes };
+        },
+        async disableTotp(input) {
+            const { user } = await lookupSession(input.token, true);
+            await attempt('totp:' + user.id);
+            if (user.passwordHash && !await verifyPassword(input.password, user.passwordHash) || !user.totpSecret)
+                fail(401, 'invalid_credentials');
+            const fact = input.secondFactor ? factor(user, input) : { counter: counter(user.totpSecret, input.code ?? '', user.id) };
+            await store.call('totpDisable', { hash: digest(input.token), version: user.version, ...fact, now: now() });
+        },
+        async adminSetRoles(input) {
+            check();
+            if (!validToken(input.actorToken) || !Array.isArray(input.roles) || !input.roles.length || input.roles.length > 32 || input.roles.some(name => !Object.hasOwn(roles, name)))
+                fail(400, 'invalid_roles');
+            return publicUser(await store.call('admin', { hash: digest(input.actorToken), accountId: id(input.accountId), roles: [...new Set(input.roles)], reason: reason(input.reason), now: now() }));
+        },
+        async adminSetStatus(input) {
+            check();
+            if (!validToken(input.actorToken) || !['active', 'locked'].includes(input.status))
+                fail(400, 'invalid_account_status');
+            return publicUser(await store.call('admin', { hash: digest(input.actorToken), accountId: id(input.accountId), status: input.status, reason: reason(input.reason), now: now() }));
+        },
+        async adminRevokeSessions(input) {
+            check();
+            if (!validToken(input.actorToken))
+                fail(401, 'invalid_credentials');
+            await store.call('adminRevoke', { hash: digest(input.actorToken), accountId: id(input.accountId), reason: reason(input.reason), now: now() });
+        },
+        async putFlow(input) {
+            check();
+            id(input.id);
+            id(input.kind);
+            const data = JSON.stringify(input.data);
+            if (typeof data !== 'string' || Buffer.byteLength(data) > 16384 || !Number.isSafeInteger(input.expires) || input.expires <= now() || input.expires > now() + 600000)
+                fail(400, 'invalid_auth_flow');
+            await store.call('putFlow', { id: input.id, kind: input.kind, data: seal(data, 'flow:' + input.id + ':' + input.kind), expires: input.expires, now: now() });
+        },
+        async consumeFlow(flowId, kind) { check(); id(flowId); id(kind); const value = await store.call('consumeFlow', { id: flowId, kind, now: now() }); return value === null ? null : JSON.parse(unseal(value, 'flow:' + flowId + ':' + kind)); },
+        async findExternal(provider, subject) { check(); external(provider, subject); const row = await store.call('external', { provider, subject }); return row ? publicUser(row) : null; },
+        async linkExternal(input) {
+            check();
+            external(input.provider, input.subject);
+            if (!validToken(input.actorToken))
+                fail(401, 'invalid_credentials');
+            await store.call('linkExternal', { hash: digest(input.actorToken), provider: input.provider, subject: input.subject, now: now() });
+        },
+        async createExternalAccount(input) {
+            check();
+            if (mode !== 'open')
+                fail(403, 'registration_unavailable');
+            external(input.provider, input.subject);
+            if (input.emailVerified !== true)
+                fail(400, 'verified_provider_email_required');
+            const user = { id: randomUUID(), email: permittedEmail(input.email), emailVerified: true, status: 'active', roles: [defaultRole], created: now(), passwordHash: '', version: 1, totpCounter: -1, ...(options.registrationPolicy || input.profile ? { profile: validateProfile(input.profile ?? {}) } : {}) };
+            const saved = await store.call('createExternal', { user, provider: input.provider, subject: input.subject, now: now() });
+            lifecycle({ type: 'sign-up', accountId: saved.id });
+            return publicUser(saved);
+        },
+        async getExternalProof(provider, subject) { check(); external(provider, subject); const user = await store.call('external', { provider, subject }); return user ? { user: publicUser(user), proof: { kind: 'oidc', version: user.version, provider, subject } } : null; },
+        async issueSession(accountId, input) {
+            check();
+            const proof = validateProof(input.proof, input.method);
+            if (!['passkey', 'oidc'].includes(input.method))
+                fail(400, 'invalid_auth_method');
+            const user = await store.call('account', { id: id(accountId) });
+            if (!user || user.status !== 'active')
+                fail(401, 'invalid_credentials');
+            const attemptKey = await attempt('login:' + user.email), fact = factor(user, input, true), session = sessionFor(accountId, input.device);
+            session.value.primaryMethod = input.method;
+            if (proof.kind === 'passkey')
+                session.value.primaryCredentialId = proof.credentialId;
+            if (fact.trustedDeviceHash)
+                session.value.authenticatedAt = 0;
+            const stored = await store.call('login', { accountId, proof, version: user.version, passwordHash: user.passwordHash, ...fact, session: session.value, attemptKey, now: now() });
+            return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value), ...(stored.newDevice ? { newDevice: true } : {}) };
+        },
+        async addPasskey(input) {
+            check();
+            if (!validToken(input.actorToken) || !input.credential || typeof input.credential.id !== 'string' || input.credential.id.length > 2048 || !input.credential.id || typeof input.credential.publicKey !== 'string' || input.credential.publicKey.length > 8192 || !Number.isSafeInteger(input.credential.counter) || input.credential.counter < 0 || (input.credential.transports && (input.credential.transports.length > 8 || input.credential.transports.some(t => !['ble', 'cable', 'hybrid', 'internal', 'nfc', 'smart-card', 'usb'].includes(t)))))
+                fail(400, 'invalid_passkey');
+            await store.call('addPasskey', { hash: digest(input.actorToken), credential: { id: input.credential.id, publicKey: input.credential.publicKey, counter: input.credential.counter, ...(input.credential.transports ? { transports: input.credential.transports } : {}) }, now: now() });
+        },
+        async getPasskey(credentialId) {
+            check();
+            if (typeof credentialId !== 'string' || credentialId.length > 2048)
+                fail(400, 'invalid_passkey');
+            return store.call('getPasskey', { id: credentialId });
+        },
+        async listPasskeys(accountId) { check(); return store.call('listPasskeys', { accountId: id(accountId) }); },
+        async advancePasskeyCounter(input) {
+            check();
+            if (typeof input.id !== 'string' || !input.id || input.id.length > 2048 || !Number.isSafeInteger(input.expectedCounter) || input.expectedCounter < 0 || !Number.isSafeInteger(input.newCounter) || input.newCounter < 0 || !(input.expectedCounter === 0 && input.newCounter === 0) && input.newCounter <= input.expectedCounter)
+                fail(400, 'invalid_passkey_counter');
+            await store.call('advancePasskey', { ...input, now: now() });
+        },
+        async changePassword(input) {
+            const { user } = await lookupSession(input.token, true);
+            await attempt('login:' + user.email);
+            if (!await verifyPassword(input.currentPassword, user.passwordHash))
+                fail(401, 'invalid_credentials');
+            const fact = factor(user, input), passwordHash = await newPassword(input.password);
+            await store.call('changePassword', { hash: digest(input.token), version: user.version, passwordHash, ...fact, now: now() });
+        },
+        async exportAccount(raw) {
+            const { user } = await lookupSession(raw, true);
+            return { user: publicUser(user), sessions: await service.listSessions(user.id), passkeys: (await service.listPasskeys(user.id)).map(({ id, transports }) => ({ id, ...(transports ? { transports } : {}) })), identities: await store.call('identities', { accountId: user.id }) };
+        },
+        async deleteAccount(input) {
+            const { user } = await lookupSession(input.token, true);
+            await attempt('login:' + user.email);
+            if (user.passwordHash && !await verifyPassword(input.password ?? '', user.passwordHash))
+                fail(401, 'invalid_credentials');
+            const cancelToken = token();
+            const deleted = await store.call('deleteAccount', { hash: digest(input.token), cancelHash: digest(cancelToken), version: user.version, ...factor(user, input), now: now() });
+            return { cancelToken, deleteAfter: deleted.deleteAfter };
+        },
+        async cancelDeletion(raw) {
+            check();
+            if (!validToken(raw))
+                fail(400, 'invalid_token');
+            await store.call('cancelDeletion', { hash: digest(raw), now: now() });
+        },
+        async purgeDeleted(options = {}) {
+            check();
+            const limit = options.limit ?? 100;
+            if (!Number.isInteger(limit) || limit < 1 || limit > 100)
+                fail(400, 'invalid_page');
+            const result = await store.call('purgeDeleted', { limit, now: now() });
+            for (const accountId of result.deleted)
+                lifecycle({ type: 'delete', accountId });
+            return { purged: result.purged };
+        },
+        async issueEmailCode(input) { check(); const email = normalizeEmail(input.email); await attempt('token:' + email); const flowId = token(), code = String(randomInt(1000000)).padStart(6, '0'); const issued = await store.call('issueEmailCode', { email, hash: digest(flowId), codeHash: digest(flowId + ':' + code), now: now() }); return { flowId, code: issued ? code : null }; },
+        async consumeEmailCode(input) {
+            check();
+            if (!validToken(input.flowId) || typeof input.code !== 'string' || !/^\d{6}$/.test(input.code))
+                fail(400, 'invalid_code');
+            const user = await store.call('checkEmailCode', { hash: digest(input.flowId), codeHash: digest(input.flowId + ':' + input.code), now: now() });
+            if (!user)
+                fail(400, 'invalid_code');
+            const session = sessionFor(user.id, input.device), fact = factor(user, input, true);
+            session.value.primaryMethod = 'email-code';
+            if (fact.trustedDeviceHash)
+                session.value.authenticatedAt = 0;
+            const stored = await store.call('codeLogin', { hash: digest(input.flowId), codeHash: digest(input.flowId + ':' + input.code), version: user.version, ...fact, session: session.value, now: now() });
+            return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value), ...(stored.newDevice ? { newDevice: true } : {}) };
+        },
+        async createCase(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken) || !['reset-factors', 'lock', 'unlock', 'roles'].includes(input.action) || input.action === 'roles' && (!Array.isArray(input.roles) || !input.roles.length || input.roles.length > 32 || input.roles.some(name => !Object.hasOwn(roles, name))))
+                fail(400, 'invalid_case');
+            return store.call('createCase', { hash: digest(input.actorToken), accountId: id(input.accountId), action: input.action, ...(input.roles ? { roles: input.roles } : {}), reason: why, id: randomUUID(), now: now() });
+        },
+        async listCases(options) { check(); const page = pagination(options), cases = await store.call('cases', page); return { cases, ...(cases.length === page.limit ? { next: cases.at(-1).id } : {}) }; },
+        async getCase(caseId) { check(); return store.call('case', { id: id(caseId) }); },
+        async approveCase(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_case');
+            return store.call('approveCase', { hash: digest(input.actorToken), id: id(input.caseId), reason: why, now: now() });
+        },
+        async createImpersonation(input) {
+            check();
+            const why = reason(input.reason);
+            if (options.allowImpersonation !== true || !why.trim() || !validToken(input.actorToken))
+                fail(403, 'impersonation_denied');
+            const session = sessionFor(id(input.accountId));
+            session.value.expires = now() + 600000;
+            session.value.authenticatedAt = 0;
+            const result = await store.call('impersonate', { hash: digest(input.actorToken), accountId: input.accountId, session: session.value, reason: why, now: now() });
+            return { user: publicUser(result.user), token: session.raw, principal: principal(result.user, result.session) };
+        },
+        async adminBulk(input) {
+            check();
+            const why = reason(input.reason);
+            if (!validToken(input.actorToken) || !why.trim() || !['lock', 'unlock', 'revoke-sessions'].includes(input.action) || !Array.isArray(input.accountIds) || input.accountIds.length < 1 || input.accountIds.length > 50 || new Set(input.accountIds).size !== input.accountIds.length)
+                fail(400, 'invalid_bulk_action');
+            const accountIds = input.accountIds.map(id);
+            return store.call('adminBulk', { hash: digest(input.actorToken), accountIds, action: input.action, reason: why, now: now() });
+        },
+        async dashboard() {
+            check();
+            return store.call('dashboard', { now: now() });
+        },
+        async listAllSessions(options) {
+            check();
+            const filters = options ?? {};
+            if (filters.accountId !== undefined)
+                id(filters.accountId);
+            if (filters.device !== undefined && (typeof filters.device !== 'string' || filters.device.length > 128 || /[\x00-\x1f\x7f]/.test(filters.device)))
+                fail(400, 'invalid_session_filter');
+            for (const value of [filters.createdFrom, filters.createdTo])
+                if (value !== undefined && (!Number.isSafeInteger(value) || value < 0))
+                    fail(400, 'invalid_session_filter');
+            if (filters.createdFrom !== undefined && filters.createdTo !== undefined && filters.createdFrom > filters.createdTo)
+                fail(400, 'invalid_session_filter');
+            const page = pagination(options), sessions = await store.call('allSessions', { ...page, accountId: filters.accountId ?? '', device: filters.device ?? '', createdFrom: filters.createdFrom ?? 0, createdTo: filters.createdTo ?? Number.MAX_SAFE_INTEGER, now: now() });
+            return { sessions, ...(sessions.length === page.limit ? { next: sessions.at(-1).id } : {}) };
+        },
+        async importUsers(users) {
+            check();
+            if (!Array.isArray(users) || !users.length || users.length > 100)
+                fail(400, 'invalid_import');
+            const rows = users.map(input => {
+                if (!input || !validPasswordHash(input.passwordHash) || input.emailVerified !== undefined && typeof input.emailVerified !== 'boolean')
+                    fail(400, 'invalid_import');
+                return { id: randomUUID(), email: permittedEmail(input.email), emailVerified: input.emailVerified ?? false, status: 'active', roles: [defaultRole], created: now(), passwordHash: input.passwordHash, version: 1, totpCounter: -1 };
+            });
+            const result = await store.call('importUsers', { users: rows, now: now() });
+            for (const user of rows)
+                lifecycle({ type: 'sign-up', accountId: user.id });
+            return result;
+        },
+        async getProfile(raw) { const { user } = await lookupSession(raw, true); return profilePolicy.publicProfile(user.profile ?? { metadata: {} }); },
+        async updateProfile(input) { const { user } = await lookupSession(input.token, true), profile = validateProfile(input.profile, user.profile); await store.call('updateProfile', { hash: digest(input.token), profile, version: user.version, now: now() }); return profilePolicy.publicProfile(profile); },
+        async getConfigurationRevision() { check(); return store.call('configurationRevision'); },
+        getSecurityPolicy: () => ({ ...securityPolicy }),
+        getHookStats: () => ({ ...hookStats }),
+        getRegistrationSchema: () => profilePolicy.publicSchema(),
+        getRegistrationMode: () => mode,
+        async requestRegistration(input) {
+            check();
+            if (mode !== 'waitlist')
+                fail(403, 'registration_unavailable');
+            const email = permittedEmail(input.email), passwordHash = await newPassword(input.password);
+            return store.call('requestRegistration', { id: randomUUID(), email, passwordHash, ...(options.registrationPolicy || input.profile ? { profile: validateProfile(input.profile ?? {}) } : {}), now: now() });
+        },
+        async listRegistrationRequests(options) {
+            check();
+            const page = pagination(options), requests = await store.call('registrationRequests', page);
+            return { requests, ...(requests.length === page.limit ? { next: requests.at(-1).id } : {}) };
+        },
+        async approveRegistration(input) {
+            check();
+            if (mode !== 'waitlist' || !validToken(input.actorToken))
+                fail(403, 'registration_unavailable');
+            const user = await store.call('approveRegistration', { hash: digest(input.actorToken), requestId: id(input.requestId), reason: reason(input.reason), now: now() });
+            lifecycle({ type: 'sign-up', accountId: user.id });
+            return publicUser(user);
+        },
+        async invite(input) {
+            check();
+            if (mode !== 'invite-only' || !validToken(input.actorToken))
+                fail(403, 'registration_unavailable');
+            const raw = token();
+            await store.call('invite', { actorHash: digest(input.actorToken), email: permittedEmail(input.email), hash: digest(raw), now: now() });
+            return { token: raw };
+        },
+        async completeStepUp(input) {
+            const proof = validateProof(input.proof, input.method), { user, session: previous } = await lookupSession(input.token);
+            if (input.method !== 'passkey' || user.id !== input.accountId)
+                fail(403, 'step_up_denied');
+            if (previous.impersonatorId)
+                fail(403, 'impersonation_restricted');
+            const attemptKey = await attempt('login:' + user.email), fact = factor(user, input), session = sessionFor(user.id);
+            session.value.primaryMethod = 'passkey';
+            if (proof.kind === 'passkey')
+                session.value.primaryCredentialId = proof.credentialId;
+            const stored = await store.call('login', { accountId: user.id, proof, version: user.version, passwordHash: user.passwordHash, ...fact, session: session.value, oldHash: digest(input.token), attemptKey, now: now() });
+            return { user: publicUser(stored), token: session.raw, principal: principal(stored, session.value) };
+        },
+        async removePasskey(input) {
+            check();
+            if (!validToken(input.token) || typeof input.credentialId !== 'string' || !input.credentialId || input.credentialId.length > 2048)
+                fail(400, 'invalid_passkey');
+            await store.call('removeMethod', { hash: digest(input.token), credentialId: input.credentialId, now: now() });
+        },
+        async unlinkExternal(input) {
+            check();
+            external(input.provider, input.subject);
+            if (!validToken(input.token))
+                fail(401, 'invalid_credentials');
+            await store.call('removeMethod', { hash: digest(input.token), provider: input.provider, subject: input.subject, now: now() });
+        },
+        async closeCase(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_case');
+            return store.call('caseEdit', { hash: digest(input.actorToken), id: id(input.caseId), reason: why, close: true, now: now() });
+        },
+        async addCaseNote(input) {
+            check();
+            const note = reason(input.note);
+            if (!note.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_case');
+            return store.call('caseEdit', { hash: digest(input.actorToken), id: id(input.caseId), reason: note, now: now() });
+        },
+        async cleanup(options = {}) {
+            check();
+            const limit = options.limit ?? 100;
+            if (!Number.isInteger(limit) || limit < 1 || limit > 1000)
+                fail(400, 'invalid_page');
+            return store.call('cleanup', { limit, now: now() });
+        },
+        async requestEmailChange(input) {
+            const { user } = await lookupSession(input.token, true);
+            await attempt('login:' + user.email);
+            if (user.passwordHash && !await verifyPassword(input.password ?? '', user.passwordHash))
+                fail(401, 'invalid_credentials');
+            const email = permittedEmail(input.email), verificationToken = token(), cancelToken = token(), activateAfter = now() + 86400000;
+            await store.call('requestEmailChange', { hash: digest(input.token), version: user.version, email, verificationHash: digest(verificationToken), cancelHash: digest(cancelToken), ...factor(user, input), now: now() });
+            return { oldEmail: user.email, newEmail: email, verificationToken, cancelToken, activateAfter };
+        },
+        async confirmEmailChange(raw) {
+            check();
+            if (!validToken(raw))
+                fail(400, 'invalid_token');
+            return publicUser(await store.call('confirmEmailChange', { hash: digest(raw), now: now() }));
+        },
+        async cancelEmailChange(raw) {
+            check();
+            if (!validToken(raw))
+                fail(400, 'invalid_token');
+            await store.call('cancelEmailChange', { hash: digest(raw), now: now() });
+        },
+        async adminCreateUser(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_administration');
+            const setupToken = token(), user = { id: randomUUID(), email: permittedEmail(input.email), emailVerified: false, status: 'active', roles: [defaultRole], created: now(), passwordHash: '', version: 1, totpCounter: -1 };
+            const saved = await store.call('adminCreateUser', { hash: digest(input.actorToken), user, setupHash: digest(setupToken), reason: why, now: now() });
+            lifecycle({ type: 'sign-up', accountId: saved.id });
+            return { user: publicUser(saved), setupToken };
+        },
+        async revokeSession(input) {
+            check();
+            if (!validToken(input.token))
+                fail(401, 'invalid_credentials');
+            await store.call('revokeSession', { hash: digest(input.token), sessionId: id(input.sessionId), now: now() });
+        },
+        async adminRevokeSession(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_administration');
+            await store.call('revokeSession', { hash: digest(input.actorToken), sessionId: id(input.sessionId), admin: true, reason: why, now: now() });
+        },
+        async adminAddNote(input) {
+            check();
+            if (!validToken(input.actorToken))
+                fail(401, 'invalid_session');
+            if (typeof input.reason !== 'string' || !input.reason.trim() || input.reason.length > 256 || /[\x00-\x1f\x7f]/.test(input.reason))
+                fail(400, 'invalid_reason');
+            await store.call('adminAddNote', { hash: digest(input.actorToken), accountId: id(input.accountId), reason: input.reason.trim(), now: now() });
+        },
+        async adminReveal(input) {
+            check();
+            if (!validToken(input.actorToken))
+                fail(401, 'invalid_session');
+            if (typeof input.reason !== 'string' || !input.reason.trim() || input.reason.length > 256 || /[\x00-\x1f\x7f]/.test(input.reason))
+                fail(400, 'invalid_reason');
+            return store.call('adminReveal', { hash: digest(input.actorToken), accountId: id(input.accountId), reason: input.reason.trim(), now: now() });
+        },
+        async adminExport(input) {
+            check();
+            const why = reason(input.reason);
+            if (!why.trim() || !validToken(input.actorToken))
+                fail(400, 'invalid_administration');
+            const result = await store.call('adminExport', { hash: digest(input.actorToken), accountId: id(input.accountId), reason: why, now: now() });
+            return { ...result, user: publicUser(result.user) };
+        },
+        async rotateEncryptionKey() {
+            check();
+            const rows = await store.call('rotationRows', { activeKey });
+            const replacements = rows.map(row => ({ ...row, replacement: seal(unseal(row.value, row.context), row.context) }));
+            return store.call('rotationApply', { activeKey, replacements, now: now() });
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const controller of hookControllers)
+                controller.abort();
+            await store.close();
+            for (const value of Object.values(keys))
+                value.fill(0);
+        },
+    };
+    const withFailureMetric = async (method, run) => {
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (error instanceof AuthError && [400, 401, 429].includes(error.status)) {
+                try {
+                    await store.call('signInFailure', { method, now: now() });
+                }
+                catch { /* Observability cannot change the authentication result. */ }
+            }
+            throw error;
+        }
+    };
+    const passwordLogin = service.login, externalLogin = service.issueSession, codeLogin = service.consumeEmailCode;
+    service.login = input => withFailureMetric('password', () => passwordLogin(input));
+    service.issueSession = (accountId, input) => withFailureMetric(input.method === 'passkey' ? 'passkey' : 'oidc', () => externalLogin(accountId, input));
+    service.consumeEmailCode = input => withFailureMetric('email-code', () => codeLogin(input));
+    return service;
+}