@krizaka/auth 0.7.0 → 0.9.0

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contract.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * « Who is here »: the one contract of `GET /api/me` for every product (krizaka-ui#551). Browser-safe: zod and the web-standard\n * `Response` only, so the product's route and the bar island of `@krizaka/ui` import the same file.\n *\n * A public page asking who is there is not an error: signed out is 200 with `signedIn: false`, never a 401. The answer is a hint for the\n * bar; it authorises nothing, and every page and route checks the session itself.\n */\n\n/** The path every product serves. */\nexport const ME_PATH = \"/api/me\";\n\n/** What the bar shows of the signed-in person. */\nexport const meAccountSchema = z.object({\n  id: z.string().min(1),\n  name: z.string().nullable(),\n  email: z.string().min(1),\n  avatarSeed: z.string().nullable(),\n});\n\nexport const meSchema = z\n  .object({\n    signedIn: z.boolean(),\n    signupOpen: z.boolean(),\n    account: meAccountSchema.optional(),\n  })\n  .refine((me) => me.signedIn === (me.account !== undefined), { message: \"account is present exactly when signedIn\" });\n\nexport type MeAccount = z.infer<typeof meAccountSchema>;\nexport type Me = z.infer<typeof meSchema>;\n\n/** Never cached, never shared: the answer depends on the cookie. */\nexport const ME_HEADERS = { \"Cache-Control\": \"private, no-store\", Vary: \"Cookie\" } as const;\n\n/**\n * The answer of `GET /api/me`: 200, the body checked against the contract, `Cache-Control: private, no-store` and `Vary: Cookie`.\n * @param input whether sign-up is open, and the signed-in account when there is one\n * @throws ZodError when the body breaks the contract (a signed-in answer without an account)\n */\nexport function meResponse(input: { signupOpen: boolean; account?: MeAccount | null | undefined }): Response {\n  const body: Me = meSchema.parse({ signedIn: !!input.account, signupOpen: input.signupOpen, ...(input.account ? { account: input.account } : {}) });\n  return Response.json(body, { headers: ME_HEADERS });\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAWX,IAAM,UAAU;AAGhB,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,IAAM,WAAW,EACrB,OAAO;AAAA,EACN,UAAU,EAAE,QAAQ;AAAA,EACpB,YAAY,EAAE,QAAQ;AAAA,EACtB,SAAS,gBAAgB,SAAS;AACpC,CAAC,EACA,OAAO,CAAC,OAAO,GAAG,cAAc,GAAG,YAAY,SAAY,EAAE,SAAS,2CAA2C,CAAC;AAM9G,IAAM,aAAa,EAAE,iBAAiB,qBAAqB,MAAM,SAAS;AAO1E,SAAS,WAAW,OAAkF;AAC3G,QAAM,OAAW,SAAS,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,SAAS,YAAY,MAAM,YAAY,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC,EAAG,CAAC;AACjJ,SAAO,SAAS,KAAK,MAAM,EAAE,SAAS,WAAW,CAAC;AACpD;","names":[]}

package/dist/index.d.ts

@@ -1,5 +1,228 @@
-import { E as ExternalIdentity, I as IdentityLinkStore, a as IdentityProvider } from './identity-links-C5AG7Fbp.js';
-export { A as AccountDeps, b as AccountError, c as AccountProfile, d as AccountService, C as CompleteOptions, e as EMAIL_CHANGE_TTL_HOURS, F as FEDERATED_PROVIDERS, f as FEDERATION_CODE, g as FederatedProvider, h as FederationCode, i as FederationError, j as IdentityLinkError, M as Mail, k as MailLink, P as PASSWORD_RESET_MAX_MINUTES, l as PASSWORD_RESET_MIN_MINUTES, m as PASSWORD_RESET_TTL_MINUTES, n as ProfilePatch, Q as Query, S as SessionSummary, o as StartOptions, p as StartedSignIn, T as Theme, q as dbAccounts, r as dbIdentityLinks, s as emailChangeMail, t as emailChangeToken, u as identityLinksMigration, v as isEmailChangeToken, w as isFederatedProvider, x as isLinkToken, y as isLocalReturn, z as linkToken, B as memoryIdentityLinks, D as memoryIdentityProvider, G as passwordResetMail, H as pkceChallenge, J as postgresAccounts } from './identity-links-C5AG7Fbp.js';
+import { Query, ModuleSchema } from '@krizaka/db';
+export { Query } from '@krizaka/db';
+import { E as ExternalIdentity, I as IdentityLinkStore, S as SessionStore, N as NewSession, a as IdentityProvider } from './sessions-B9YKXs0i.js';
+export { C as CompleteOptions, F as FEDERATED_PROVIDERS, b as FEDERATION_CODE, c as FederatedProvider, d as FederationCode, e as FederationError, f as IdentityLinkError, g as Session, h as SessionCookie, i as Sessions, j as SessionsDeps, k as StartOptions, l as StartedSignIn, m as clearedSessionCookie, n as createSessions, o as dbIdentityLinks, p as identityLinksMigration, q as isFederatedProvider, r as isLocalReturn, s as memoryIdentityLinks, t as memoryIdentityProvider, u as pkceChallenge, v as sessionCookie, w as sessionTokenOf } from './sessions-B9YKXs0i.js';
+
+/**
+ * The account PORT (ADR-0008 of Yomizaka, now shared). A product's account — name, language, theme, avatar, e-mail change with
+ * verification, password (changed when signed in, or reset by a mailed link), sessions, export, deletion — behind one interface. Every product keeps its OWN accounts: no central
+ * service, no runtime dependency between products.
+ */
+type Theme = "light" | "dark" | "system";
+interface AccountProfile {
+    id: string;
+    email: string;
+    name: string | null;
+    locale: "en" | "fr";
+    /** The theme the person chose; null = follow the device. */
+    theme: Theme | null;
+    /** A seed of the default avatars (the UI draws it); null = derived from the e-mail address. */
+    avatarSeed: string | null;
+    emailVerified: boolean;
+    /** An address awaiting its verification link, if the person asked to change it. */
+    pendingEmail: string | null;
+}
+interface ProfilePatch {
+    name?: string | null;
+    locale?: "en" | "fr";
+    theme?: Theme | null;
+    avatarSeed?: string | null;
+}
+/** A sign-in of the person: where from and when. Never the token. */
+interface SessionSummary {
+    id: string;
+    createdAt: Date;
+    expiresAt: Date;
+    ip: string | null;
+    userAgent: string | null;
+    current: boolean;
+}
+interface AccountService {
+    profile(accountId: string): Promise<AccountProfile>;
+    updateProfile(accountId: string, patch: ProfilePatch): Promise<AccountProfile>;
+    /** Asks to change the address: the password is checked, a link is mailed to the NEW address. Answers the same whether or not it is already taken (no enumeration). */
+    requestEmailChange(accountId: string, input: {
+        newEmail: string;
+        password: string;
+    }, now: Date): Promise<void>;
+    /** Applies the change from the mailed link (single use, expires); the new address is verified by that very act. */
+    confirmEmailChange(token: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Changes the password (the current one is checked) and signs every other session out; `keepSessionId` stays. */
+    changePassword(accountId: string, input: {
+        current: string;
+        next: string;
+    }, keepSessionId?: string): Promise<void>;
+    /** Asks for a reset link, mailed (in the person's language) when an account with a password has this address; answers the same either way (no enumeration). */
+    requestPasswordReset(email: string, now: Date): Promise<void>;
+    /** Sets a new password from the mailed link — single use, expires — and signs every session out. The new password is checked before the link is used up. */
+    resetPassword(token: string, next: string, now: Date): Promise<"CHANGED" | "INVALID">;
+    /** Checks the password. Throws `AccountError(403, "WRONG_PASSWORD")`. */
+    confirmPassword(accountId: string, password: string): Promise<void>;
+    /** The person's live sign-ins, newest first; `currentSessionId` is flagged. */
+    sessions(accountId: string, now: Date, currentSessionId?: string): Promise<SessionSummary[]>;
+    /** Signs every other session out (and returns how many); `keepSessionId` stays. */
+    signOutOthers(accountId: string, keepSessionId: string): Promise<number>;
+    /** What the product keeps about the person, as one JSON-able document: the profile, the live sign-ins, and what `extra` adds. */
+    exportAccount(accountId: string, now: Date, extra?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
+    /** Deletes the identity: the account, its sessions and everything that hangs on it (the product erases its own data first). */
+    deleteAccount(accountId: string): Promise<void>;
+}
+declare class AccountError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+
+interface Mail {
+    to: string;
+    /** The language of the mail (the person's). */
+    locale: "en" | "fr";
+    subject: string;
+    text: string;
+    /**
+     * The link this mail carries, as data: a product that sends branded HTML (`@krizaka/email`: `passwordReset`, `emailChange`)
+     * renders it from this instead of from `text`. Absent on a mail that is not a link.
+     */
+    link?: MailLink;
+}
+/** A mailed link: what it is for, where it goes, and how long it lives. */
+interface MailLink {
+    kind: "passwordReset" | "emailChange";
+    url: string;
+    /** `passwordReset`: the lifetime in minutes. */
+    minutes?: number;
+    /** `emailChange`: the lifetime in hours. */
+    hours?: number;
+}
+interface AccountDeps {
+    query: Query;
+    /**
+     * Runs `work` in one transaction on one connection (BEGIN … COMMIT, rolled back when `work` throws) — the product's pool
+     * knows how. The password reset runs under it: the account row is locked, the links retired and issued, the token claimed,
+     * the password set and the sessions ended as one. Without it, the statements run one by one on `query` (one process, no
+     * concurrent requests): give it in production.
+     */
+    transaction?: <T>(work: (query: Query) => Promise<T>) => Promise<T>;
+    mail: (mail: Mail) => Promise<void>;
+    /** `https://www.akinaza.com`: the e-mail change link is `<baseUrl>/<locale>/confirm-email?token=…`, the reset link `<baseUrl>/<locale>/reset-password?token=…`. */
+    baseUrl: string;
+    /** The product's name, in the words of the mail (« Akinaza »). */
+    product: string;
+    /** The product's token prefix, two or three letters (`ye1.` for Yomizaka: `ye`). The tokens are `<prefix>1.<43 base64url>`. */
+    tokenPrefix: string;
+    passwords: {
+        hash: (password: string) => Promise<string>;
+        verify: (password: string, stored: string) => Promise<boolean>;
+    };
+    /** How a token is kept: the product's own keyed hash, the one its sessions use. */
+    tokenHash: (token: string) => string;
+    /**
+     * How long a password reset link lives, in minutes: a whole number from 5 to 1440 (`PASSWORD_RESET_MIN_MINUTES`–`PASSWORD_RESET_MAX_MINUTES`),
+     * default `PASSWORD_RESET_TTL_MINUTES` (30). The product reads it from its settings; the expiry and the mailed text both use it.
+     * Out of range, `dbAccounts` throws.
+     */
+    passwordResetTtlMinutes?: number;
+    /** Test seam: the token to issue. */
+    token?: () => string;
+}
+declare const EMAIL_CHANGE_TTL_HOURS = 24;
+/** The default lifetime of a password reset link, in minutes (`AccountDeps.passwordResetTtlMinutes` changes it). */
+declare const PASSWORD_RESET_TTL_MINUTES = 30;
+declare const PASSWORD_RESET_MIN_MINUTES = 5;
+declare const PASSWORD_RESET_MAX_MINUTES = 1440;
+/** One format for every mailed link (an e-mail change, a password reset): the product's prefix, a version, 256 random bits. */
+declare const linkToken: (prefix: string) => string;
+declare const isLinkToken: (prefix: string, value: string | undefined | null) => value is string;
+declare const emailChangeToken: (prefix: string) => string;
+declare const isEmailChangeToken: (prefix: string, value: string | undefined | null) => value is string;
+declare function passwordResetMail(product: string, locale: "en" | "fr", url: string, ttlMinutes?: number): {
+    subject: string;
+    text: string;
+};
+declare function emailChangeMail(product: string, locale: "en" | "fr", url: string): {
+    subject: string;
+    text: string;
+};
+/** The adapter over the product's own PostgreSQL (`accounts`, `sessions`, `email_changes`, `password_resets`; see `accountsMigration`). */
+declare function dbAccounts(deps: AccountDeps): AccountService;
+/** @deprecated The old name of `dbAccounts` (a name says what a thing does, not the technology). Removed in the next major. */
+declare const postgresAccounts: typeof dbAccounts;
+
+/**
+ * The administration's locks, as one pure decision every product shares (it was copied in each product's `lib/access.ts`): a session,
+ * the ADMIN role, and an address on the allowed list. A pure function of its inputs: the product reads the session and the address
+ * and maps the verdict to its own answer.
+ */
+/** Stable codes of a refusal. */
+declare const ADMIN_REFUSAL: {
+    readonly unauthenticated: "UNAUTHENTICATED";
+    readonly forbidden: "FORBIDDEN";
+    readonly ipNotAllowed: "IP_NOT_ALLOWED";
+    readonly notFound: "NOT_FOUND";
+};
+type AdminRefusal = (typeof ADMIN_REFUSAL)[keyof typeof ADMIN_REFUSAL];
+/** The verdict: let in, or the status and code to answer. */
+type AdminDecision = {
+    ok: true;
+} | {
+    ok: false;
+    status: 401 | 403 | 404;
+    code: AdminRefusal;
+};
+/**
+ * The list the administration's address lock reads, from the environment's value (`AUTH_ALLOWED_IPS`): an empty list is « nobody » in
+ * production and « anybody » in development, so a forgotten setting never opens the console.
+ * @param list the configured addresses
+ * @returns the list to hand to `requireAdmin`, or null (anybody)
+ */
+declare function allowedIps(list: readonly string[], options: {
+    production: boolean;
+}): readonly string[] | null;
+/** Whether an address may use the administration: `null` allowed means anybody, an empty list nobody, and a missing address is never allowed by a list. */
+declare function ipAllowed(ip: string | null, allowed: readonly string[] | null): boolean;
+interface AdminGateInput {
+    /** The caller's session, or null when there is none. Only its account's role is read. */
+    session: {
+        account: {
+            role: string;
+        };
+    } | null;
+    /** The caller's address (see `clientIp`). */
+    ip: string | null;
+    /** The addresses allowed (see `allowedIps`); null = anybody. */
+    allowedIps: readonly string[] | null;
+    /** `api` (default): 401 without a session, 403 with the reason. `page`: the administration does not announce itself, so every failed lock is a 404. */
+    surface?: "api" | "page";
+    /** The role that administers. Default `ADMIN`. */
+    role?: string;
+}
+/**
+ * The administration's three locks. The first that fails decides.
+ * @returns `{ ok: true }`, or the status (401, 403 or 404 on a page) and the code to answer
+ */
+declare function requireAdmin(input: AdminGateInput): AdminDecision;
+
+/** How a deployment tells the client's address: the header its edge sets, and how many proxies append to `X-Forwarded-For`. */
+interface ClientIpRules {
+    /** A header the edge sets and overwrites with the client's address (`do-connecting-ip` on DigitalOcean App Platform, `cf-connecting-ip` behind Cloudflare). Read first when present. */
+    header?: string | undefined;
+    /** How many trusted proxies append to `X-Forwarded-For`: 1 (the default) to 10. */
+    trustedProxyHops?: number | undefined;
+}
+/**
+ * The client's IP address, as far as this deployment can trust it. `X-Forwarded-For` is a list each proxy appends to: its LEFT end is
+ * whatever the client sent (anyone can write `X-Forwarded-For: 1.2.3.4`), so a limit keyed on it is a limit the attacker chooses. The
+ * address the last trusted proxy saw is read from the RIGHT:
+ *
+ * - the `header` the edge sets and overwrites, when present;
+ * - otherwise the entry `trustedProxyHops` (default 1: one proxy) from the right of `X-Forwarded-For`, then `X-Real-IP`;
+ * - otherwise null (local development without a proxy).
+ *
+ * The product reads its environment (`ABUSE_CLIENT_IP_HEADER`, `ABUSE_TRUSTED_PROXY_HOPS`) and passes the values: this function reads none.
+ * @param headers the request's headers
+ * @returns a valid IPv4 or IPv6 address, or null
+ */
+declare function clientIp(headers: Headers, rules?: ClientIpRules): string | null;
 
 /** What federated sign-in needs from the product's accounts: no second user table, just a look-up and, when registration is open, a creation. */
 interface FederatedAccounts {
@@ -51,24 +274,40 @@ declare function createFederatedSignIn({ links, accounts, clock }: FederatedSign
 type FederatedSignIn = ReturnType<typeof createFederatedSignIn>;
 
 /**
- * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:
- * a display name, a theme, an avatar seed, the verified-address flag, and the table of e-mail changes (a link mailed to the NEW
- * address) and the table of password resets (a link mailed to the account's address). `accounts` needs `id`, `email`, `locale`, `password_hash`; `sessions` needs `account_id`, `created_at`, `expires_at`, `ip`, `user_agent`.
- * `backfillVerified`: for accounts that exist already, treat the address as verified (invitation-only products).
+ * The SQL of version 1 of the accounts tables, for a product that runs it by hand (idempotent).
+ * @deprecated Use `accountsSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`: the SQL gets a version, a checksum and a marker. Removed in the next major.
  */
 declare function accountsMigration(options?: {
     backfillVerified?: boolean;
 }): string;
 /**
- * Memberships (who has which role in which scope) and invitations (an e-mail address invited with a role, by a link used once), from the
- * product's role model. `scopeTable` is the table of the scope (shops, workspaces): when given, a membership and an invitation point at it.
- * Idempotent.
+ * The SQL of version 1 of the memberships and invitations tables, for a product that runs it by hand (idempotent).
+ * @deprecated Use `rolesSchema` with `emitMigration` or `adoptMigration` from `@krizaka/db`. Removed in the next major.
  */
 declare function rolesMigration(roles: readonly string[], options?: {
     ownerTable?: string;
     scopeTable?: string;
 }): string;
 
+/** The shortest password the products accept. */
+declare const PASSWORD_MIN_LENGTH = 12;
+/** The longest: a longer one is refused before any work is done (a very long password is a way to make the server spend time). */
+declare const PASSWORD_MAX_LENGTH = 256;
+/** Why a new password is refused, or null when its length is acceptable. */
+declare function passwordProblem(password: string): "TOO_SHORT" | "TOO_LONG" | null;
+/**
+ * Hashes a password with a fresh salt.
+ * @returns `scrypt$N$r$p$salt$hash`
+ */
+declare function hashPassword(password: string): Promise<string>;
+/**
+ * Checks a password against a stored hash, in constant time. A hash of another scheme, a malformed one or an over-long password is `false`.
+ * The cost parameters are read from the stored value, so an older hash still verifies after the default changes.
+ */
+declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/** A hash to verify against when the address has no account: the same work, the same time, the same answer. */
+declare const decoyHash: () => Promise<string>;
+
 /**
  * Roles per scope (a shop, a workspace), as DATA: a model says which roles exist, which permissions each holds and who may hand which
  * role to whom. The code asks `can(role, "invoices:write")`, never `if (role === "owner")`. One person may belong to several scopes, with
@@ -97,9 +336,8 @@ declare class RolesError extends Error {
     readonly status: number;
     constructor(code: RolesCode);
 }
-interface RolesQuery {
-    <T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
-}
+/** The SQL executor the roles take: `@krizaka/db`'s `Query`. */
+type RolesQuery = Query;
 interface RolesDeps<Role extends string, Permission extends string> {
     query: RolesQuery;
     model: RoleModel<Role, Permission>;
@@ -171,6 +409,74 @@ declare function createRoles<Role extends string, Permission extends string>(dep
 };
 type Roles<Role extends string = string, Permission extends string = string> = ReturnType<typeof createRoles<Role, Permission>>;
 
+/**
+ * The tables of « auth », declared as modules (ADR-001 §3). They are added to a product's own `accounts` and `sessions` tables, which
+ * existed before the module schemas: they stay in `public`, un-qualified, and a product that has them adopts version 1
+ * (`adoptMigration`, markers only) while one that does not emits it (`emitMigration`). Version 1 of each is frozen once released:
+ * a change is version 2. The one product table every one of them references is declared by the product (`accounts`, `owner`).
+ */
+/**
+ * What the account adapter needs from a product's database, safe to run on a database that already has `accounts` and `sessions`:
+ * a display name, a theme, an avatar seed, the verified-address flag, and the table of e-mail changes (a link mailed to the NEW
+ * address) and the table of password resets (a link mailed to the account's address). `accounts` needs `id`, `email`, `locale`, `password_hash`;
+ * `sessions` needs `account_id`, `created_at`, `expires_at`, `ip`, `user_agent`.
+ * @param options `backfillVerified`: for accounts that exist already, treat the address as verified (invitation-only products)
+ */
+declare function accountsSchema(options?: {
+    backfillVerified?: boolean;
+}): ModuleSchema;
+/**
+ * Memberships (who has which role in which scope) and invitations (an e-mail address invited with a role, by a link used once), from the
+ * product's role model. Declares the account table (`owner`) and, when the roles are scoped, the scope table (`scope`: shops, workspaces):
+ * a membership and an invitation then point at it. Idempotent.
+ * @param roles the role names of the model: each becomes a value of the `role` check, so each must be a safe identifier
+ * @param options `scoped`: true when the product declares a `scope` table
+ * @throws Error for a role that is not a safe SQL identifier
+ */
+declare function rolesSchema(roles: readonly string[], options?: {
+    scoped?: boolean;
+}): ModuleSchema;
+/** Which external identity belongs to which account (federated sign-in): `(issuer, subject) → account`, never a second user table. Idempotent. */
+declare const identityLinksSchema: ModuleSchema;
+/**
+ * The table of web sessions: the cookie holds a random token, the table its keyed hash (a leaked table opens nothing). The shape the
+ * products' own `sessions` table has, so a product that has it adopts version 1 (`adoptMigration`) and one that does not emits it.
+ * Idempotent.
+ */
+declare const sessionsSchema: ModuleSchema;
+
+/**
+ * An in-memory session store, for unit tests and demos. `accountOf` plays the accounts table: it answers the account of an id, or null
+ * when it does not exist or is not active.
+ */
+declare function memorySessionStore<Account>(accountOf: (accountId: string) => Account | null): SessionStore<Account> & {
+    rows(): readonly NewSession[];
+};
+
+interface DbSessionStoreOptions<Account> {
+    /** The product's session table. Default `sessions` (`id`, `account_id`, `token_hash` unique, `created_at`, `expires_at`, `ip`, `user_agent`). */
+    sessions?: string;
+    /** The product's account table. Default `accounts`. */
+    accounts?: string;
+    /** The account columns the session carries (`id`, `email`, `role`, `locale`, `name`…): all checked, all read in one query with the session. */
+    columns: readonly string[];
+    /** Builds the product's account from a row holding exactly `columns`. */
+    toAccount: (row: Record<string, unknown>) => Account;
+    /** An account that is not active signs nobody in (a suspension applies at once): the column and the value it must have (`status` = `ACTIVE`). */
+    active?: {
+        column: string;
+        equals: string;
+    };
+}
+/**
+ * The session store over the product's own tables (`sessions` joined to `accounts`): the declared tables and columns are checked by
+ * `ident()` and nothing else reaches SQL. The expiry is compared with the clock's `now`, not the database's.
+ * @param query the product's query
+ * @param options the table names, the account columns and how the account is built
+ * @throws DbError `DB_UNSAFE_IDENTIFIER` for a table or column name that is not a safe identifier
+ */
+declare function dbSessionStore<Account>(query: Query, options: DbSessionStoreOptions<Account>): SessionStore<Account>;
+
 /** The `fetch` the adapter calls krizaka-users with (injected: no global, no network in tests). */
 type Fetcher = (url: string, init: {
     method: "POST";
@@ -196,4 +502,4 @@ declare function parseExternalIdentity(body: unknown): ExternalIdentity;
  */
 declare function usersIdentityProvider({ baseUrl, appUrl, fetch }: UsersFederationOptions): IdentityProvider;
 
-export { ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Member, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, type UsersFederationOptions, accountsMigration, can, createFederatedSignIn, createRoles, defineRoles, parseExternalIdentity, rolesMigration, usersIdentityProvider };
+export { ADMIN_REFUSAL, type AccountDeps, AccountError, type AccountProfile, type AccountService, type AdminDecision, type AdminGateInput, type AdminRefusal, type ClientIpRules, type DbSessionStoreOptions, EMAIL_CHANGE_TTL_HOURS, ExternalIdentity, FEDERATED_REFUSAL, type FederatedAccounts, type FederatedRefusal, type FederatedSignIn, type FederatedSignInDeps, type FederatedSignInResult, type Fetcher, IdentityLinkStore, IdentityProvider, type Invitation, type Mail, type MailLink, type Member, NewSession, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_MAX_MINUTES, PASSWORD_RESET_MIN_MINUTES, PASSWORD_RESET_TTL_MINUTES, type ProfilePatch, ROLES_CODE, type RoleModel, type Roles, type RolesCode, type RolesDeps, RolesError, type RolesQuery, SessionStore, type SessionSummary, type Theme, type UsersFederationOptions, accountsMigration, accountsSchema, allowedIps, can, clientIp, createFederatedSignIn, createRoles, dbAccounts, dbSessionStore, decoyHash, defineRoles, emailChangeMail, emailChangeToken, hashPassword, identityLinksSchema, ipAllowed, isEmailChangeToken, isLinkToken, linkToken, memorySessionStore, parseExternalIdentity, passwordProblem, passwordResetMail, postgresAccounts, requireAdmin, rolesMigration, rolesSchema, sessionsSchema, usersIdentityProvider, verifyPassword };