@madauth/server 0.3.0-beta.2 → 0.5.0-beta.1

package/dist/chunk-TI35AZ2U.js

@@ -1,660 +0,0 @@
-import {
-  assertPrivateSigningJwk,
-  generateSigningKey
-} from "./chunk-JDQLSL36.js";
-import {
-  DEV_WEBHOOK_RECEIVER_URL,
-  REQUIRED_EMAIL_TYPES,
-  WEBHOOK_TYPES,
-  checkWebhookSecret,
-  generateWebhookSecret
-} from "./chunk-3QRKWLR7.js";
-
-// src/claims.ts
-var ADMIN_ROLE = "admin";
-var MAX_ROLES = 20;
-var MAX_CLAIMS_LENGTH = 2048;
-var ROLE_NAME = /^[a-z][a-z0-9_-]{0,31}$/;
-var CLAIM_NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,63}$/;
-function parseRoles(input) {
-  if (!Array.isArray(input)) return null;
-  if (!input.every((role) => typeof role === "string" && ROLE_NAME.test(role))) return null;
-  const roles = [...new Set(input)].sort();
-  return roles.length <= MAX_ROLES ? roles : null;
-}
-function parseClaims(input) {
-  if (!isJsonObject(input)) return null;
-  const claims = {};
-  for (const key of Object.keys(input).sort()) {
-    const value = input[key];
-    if (!CLAIM_NAME.test(key) || !isJsonValue(value)) return null;
-    if (key === "roles") {
-      const roles = parseRoles(value);
-      if (!roles) return null;
-      claims[key] = roles;
-    } else {
-      claims[key] = value;
-    }
-  }
-  return JSON.stringify(claims).length <= MAX_CLAIMS_LENGTH ? claims : null;
-}
-function isJsonObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function isJsonValue(value) {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-  if (typeof value === "number") return Number.isFinite(value);
-  if (Array.isArray(value)) return value.every(isJsonValue);
-  return isJsonObject(value) && Object.values(value).every(isJsonValue);
-}
-function sameClaims(a, b) {
-  return JSON.stringify(a ?? {}) === JSON.stringify(b ?? {});
-}
-function claimsFromJson(json) {
-  if (!json) return {};
-  try {
-    const parsed = JSON.parse(json);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function rolesOf(user) {
-  const roles = user.claims?.roles;
-  return Array.isArray(roles) ? roles.filter((role) => typeof role === "string") : [];
-}
-function isAdmin(user) {
-  return rolesOf(user).includes(ADMIN_ROLE);
-}
-
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
-  }
-  return settings;
-}
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
-  }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
-      if (written) return next;
-    }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
-  }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
-}
-
-// src/config.ts
-var envVars = {
-  MADAUTH_ISSUER: true,
-  MADAUTH_SIGNING_KEY: true,
-  ALLOWED_ORIGINS: true,
-  GOOGLE_CLIENT_ID: false,
-  GOOGLE_CLIENT_SECRET: false,
-  DATABASE_URL: true,
-  PASSWORD_MIN_LENGTH: false,
-  WEBHOOK_URL: false,
-  WEBHOOK_SECRET: false,
-  WEBHOOK_EVENTS: false,
-  SESSION_TTL: false,
-  SESSION_RENEWAL_TTL: false,
-  COOKIE_DOMAIN: false
-};
-async function resolveEnv(source = process.env) {
-  return typeof source === "function" ? source() : source;
-}
-var DEFAULT_SESSION_TTL = 8 * 60 * 60;
-var DEFAULT_RENEWAL_TTL = 30 * 24 * 60 * 60;
-var DEFAULT_PASSWORD_MIN_LENGTH = 8;
-var ConfigError = class extends Error {
-  constructor() {
-    super(...arguments);
-    this.name = "ConfigError";
-  }
-};
-function parseOrigin(name, value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new ConfigError(`${name}: "${value}" is not a URL.`);
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new ConfigError(`${name}: "${value}" must be an http(s) URL.`);
-  }
-  return url.origin;
-}
-function readEnv(env, name) {
-  return env[name]?.trim().replace(/^(['"])(.*)\1$/s, "$2").trim() || void 0;
-}
-async function loadConfig(env, overrides = {}) {
-  const read = (name) => readEnv(env, name);
-  const require2 = (name) => {
-    const value = read(name);
-    if (!value) throw new ConfigError(`${name} is not set. See docs/server.md.`);
-    return value;
-  };
-  const issuerValue = require2("MADAUTH_ISSUER");
-  parseOrigin("MADAUTH_ISSUER", issuerValue);
-  const issuer = issuerValue.replace(/\/+$/, "");
-  const keyValue = read("MADAUTH_SIGNING_KEY");
-  if (!keyValue) {
-    const key = await generateSigningKey();
-    throw new ConfigError(
-      `MADAUTH_SIGNING_KEY is not set. Here is a newly generated key you can use (keep it secret and use the same key on every instance):
-
-MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
-`
-    );
-  }
-  let signingKey;
-  try {
-    signingKey = JSON.parse(keyValue);
-    assertPrivateSigningJwk(signingKey);
-  } catch (e) {
-    const reason = e instanceof SyntaxError ? "is not valid JSON" : e.message;
-    throw new ConfigError(`MADAUTH_SIGNING_KEY ${reason}. Generate one with: npx @madauth/server generate-key`);
-  }
-  const allowedOrigins = require2("ALLOWED_ORIGINS").split(",").map((o) => o.trim()).filter(Boolean).map((o) => parseOrigin("ALLOWED_ORIGINS", o));
-  const clientId = read("GOOGLE_CLIENT_ID");
-  if (clientId && !clientId.endsWith(".apps.googleusercontent.com")) {
-    throw new ConfigError(`GOOGLE_CLIENT_ID must end with ".apps.googleusercontent.com" but is "${clientId}".`);
-  }
-  const webhook = webhookFromEnv(read("WEBHOOK_URL"), read("WEBHOOK_SECRET"), read("WEBHOOK_EVENTS"));
-  const sendsEmails = !!webhook && REQUIRED_EMAIL_TYPES.every((type) => webhook.events.has(type));
-  const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
-  if (!clientId && !password) {
-    throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
-    );
-  }
-  const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
-  if (!store) {
-    throw new ConfigError(
-      "DATABASE_URL is not set. madAuth stores every user, whichever way they sign in: set e.g. DATABASE_URL=sqlite:./madauth.db or DATABASE_URL=dynamodb:<table>. See docs/server.md."
-    );
-  }
-  const ttlValue = read("SESSION_TTL");
-  const sessionTtlSeconds = ttlValue ? Number(ttlValue) : DEFAULT_SESSION_TTL;
-  if (!Number.isInteger(sessionTtlSeconds) || sessionTtlSeconds < 60) {
-    throw new ConfigError(`SESSION_TTL must be a whole number of seconds (at least 60) but is "${ttlValue}".`);
-  }
-  const renewalValue = read("SESSION_RENEWAL_TTL");
-  const renewalTtlSeconds = renewalValue ? Number(renewalValue) : Math.max(DEFAULT_RENEWAL_TTL, sessionTtlSeconds);
-  if (!Number.isInteger(renewalTtlSeconds) || renewalTtlSeconds < sessionTtlSeconds) {
-    throw new ConfigError(
-      `SESSION_RENEWAL_TTL must be a whole number of seconds, not less than SESSION_TTL (${sessionTtlSeconds}), but is "${renewalValue}".`
-    );
-  }
-  return {
-    issuer,
-    signingKey,
-    allowedOrigins,
-    sessionTtlSeconds,
-    renewalTtlSeconds,
-    cookieDomain: read("COOKIE_DOMAIN"),
-    google: clientId ? { clientId, clientSecret: read("GOOGLE_CLIENT_SECRET") } : void 0,
-    store,
-    password,
-    webhook
-  };
-}
-async function loadUserStoreConfig(env) {
-  return { store: await loadStore(env), minLength: passwordMinLength(readEnv(env, "PASSWORD_MIN_LENGTH")) };
-}
-async function loadStore(env) {
-  const store = await storeFromDatabaseUrl(readEnv(env, "DATABASE_URL"));
-  if (!store) throw new ConfigError("Set DATABASE_URL to manage users.");
-  return store;
-}
-function passwordMinLength(value) {
-  const minLength = value ? Number(value) : DEFAULT_PASSWORD_MIN_LENGTH;
-  if (!Number.isInteger(minLength) || minLength < 1 || minLength > 128) {
-    throw new ConfigError(`PASSWORD_MIN_LENGTH must be a whole number from 1 to 128 but is "${value}".`);
-  }
-  return minLength;
-}
-async function storeFromDatabaseUrl(url) {
-  if (!url) return void 0;
-  if (url.startsWith("dynamodb:")) return dynamoDbStore(url.slice("dynamodb:".length));
-  if (!url.startsWith("sqlite:")) {
-    throw new ConfigError(
-      `DATABASE_URL must start with "sqlite:" (e.g. sqlite:/data/madauth.db) or "dynamodb:" (e.g. dynamodb:madauth) but is "${url}". For other databases, pass your own store adapter (see "Custom store adapter" in docs/server.md).`
-    );
-  }
-  const path = url.slice("sqlite:".length);
-  if (!path) throw new ConfigError("DATABASE_URL needs a file path, e.g. sqlite:/data/madauth.db");
-  const { createSqliteAdapter } = await import("./sqlite.js");
-  try {
-    return createSqliteAdapter(path);
-  } catch (e) {
-    throw new ConfigError(`DATABASE_URL: could not open "${path}": ${e.message}`);
-  }
-}
-async function dynamoDbStore(tableName) {
-  if (!tableName) throw new ConfigError("DATABASE_URL needs a table name, e.g. dynamodb:madauth");
-  if (!/^[\w.-]{3,255}$/.test(tableName)) {
-    throw new ConfigError(
-      `DATABASE_URL=dynamodb: needs a DynamoDB table name (3 to 255 letters, digits, _ . -) but has "${tableName}"`
-    );
-  }
-  try {
-    await import("@aws-sdk/client-dynamodb");
-  } catch (e) {
-    throw new ConfigError(
-      `DATABASE_URL=dynamodb: needs the AWS SDK. Install it next to madAuth: npm install @aws-sdk/client-dynamodb (${e.message})`
-    );
-  }
-  const { createDynamoDbAdapter } = await import("./dynamodb.js");
-  return createDynamoDbAdapter({ tableName });
-}
-var RENAMED_TYPES = { "password.reset": "email.password_reset", "roles.changed": "user.claims_changed" };
-var LOCAL_HOSTS = ["localhost", "127.0.0.1", "[::1]", "host.docker.internal"];
-function webhookFromEnv(url, secret, events) {
-  if (!url) {
-    if (secret || events) throw new ConfigError("WEBHOOK_SECRET and WEBHOOK_EVENTS need WEBHOOK_URL.");
-    return void 0;
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new ConfigError(`WEBHOOK_URL: "${url}" is not a URL.`);
-  }
-  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && LOCAL_HOSTS.includes(parsed.hostname))) {
-    throw new ConfigError(`WEBHOOK_URL must be an https URL (http only for localhost) but is "${url}".`);
-  }
-  if (!secret) {
-    throw new ConfigError(
-      `WEBHOOK_SECRET is not set. Here is a newly generated secret you can use (keep it secret; your webhook receiver needs the same one):
-
-WEBHOOK_SECRET=${generateWebhookSecret()}
-`
-    );
-  }
-  const problem = checkWebhookSecret(secret);
-  if (problem) {
-    throw new ConfigError(`WEBHOOK_SECRET ${problem}. Generate one with: npx @madauth/server generate-webhook-secret`);
-  }
-  const selected = new Set((events ?? "").split(",").map((e) => e.trim()).filter(Boolean));
-  const allTypes = `All types: ${WEBHOOK_TYPES.join(", ")}. See "Webhooks" in docs/server.md.`;
-  if (!selected.size) {
-    throw new ConfigError(
-      `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
-
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
-
-For one that only wants to know who signed in:
-
-WEBHOOK_EVENTS=user.signed_in
-
-` + allTypes
-    );
-  }
-  const unknown = [...selected].filter((e) => !WEBHOOK_TYPES.includes(e));
-  if (unknown.length) {
-    const renamed = unknown.filter((e) => e in RENAMED_TYPES).map((e) => `${e} is now ${RENAMED_TYPES[e]}`);
-    throw new ConfigError(
-      `WEBHOOK_EVENTS: unknown type ${unknown.join(", ")}. ${renamed.length ? `${renamed.join("; ")}. ` : ""}Known types: ${WEBHOOK_TYPES.join(", ")}.`
-    );
-  }
-  return { url: parsed.href, secret, events: selected };
-}
-
-// src/password.ts
-import { createHash, createHmac, hkdfSync, randomBytes, randomInt, scrypt, timingSafeEqual } from "crypto";
-var HASH_PARAMS = { logN: 15, r: 8, p: 3 };
-var KEY_LENGTH = 64;
-var SALT_LENGTH = 16;
-var MAX_PASSWORD_LENGTH = 256;
-var MAX_EMAIL_LENGTH = 254;
-function derive(password, salt, { logN, r, p }) {
-  const N = 2 ** logN;
-  return new Promise(
-    (resolve, reject) => scrypt(
-      password.normalize("NFC"),
-      salt,
-      KEY_LENGTH,
-      { N, r, p, maxmem: 256 * N * r + 1024 * 1024 },
-      (err, key) => err ? reject(err) : resolve(key)
-    )
-  );
-}
-async function hashPassword(password, params = HASH_PARAMS) {
-  const salt = randomBytes(SALT_LENGTH);
-  const key = await derive(password, salt, params);
-  return ["scrypt", params.logN, params.r, params.p, salt.toString("base64url"), key.toString("base64url")].join("$");
-}
-async function verifyPassword(password, stored) {
-  const [scheme, logN, r, p, salt, hash] = stored.split("$");
-  const params = { logN: Number(logN), r: Number(r), p: Number(p) };
-  if (scheme !== "scrypt" || !salt || !hash || !Object.values(params).every((n) => Number.isInteger(n) && n > 0)) {
-    return { ok: false, needsRehash: false };
-  }
-  const expected = Buffer.from(hash, "base64url");
-  const key = await derive(password, Buffer.from(salt, "base64url"), params);
-  const ok = key.length === expected.length && timingSafeEqual(key, expected);
-  const needsRehash = params.logN !== HASH_PARAMS.logN || params.r !== HASH_PARAMS.r || params.p !== HASH_PARAMS.p;
-  return { ok, needsRehash };
-}
-var dummyHash;
-async function verifyAgainstDummy(password) {
-  dummyHash ??= hashPassword(randomBytes(16).toString("hex"));
-  await verifyPassword(password, await dummyHash);
-}
-function checkPasswordPolicy(password, minLength) {
-  if (typeof password !== "string") return "password is missing";
-  const length = [...password].length;
-  if (length < minLength) return `The password must have at least ${minLength} characters.`;
-  if (length > MAX_PASSWORD_LENGTH) return `The password must have at most ${MAX_PASSWORD_LENGTH} characters.`;
-  return null;
-}
-function normalizeEmail(email) {
-  return email.trim().toLowerCase();
-}
-function isValidEmail(email) {
-  return typeof email === "string" && email.trim().length <= MAX_EMAIL_LENGTH && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim());
-}
-function generateLinkToken() {
-  return randomBytes(32).toString("base64url");
-}
-function hashLinkToken(token) {
-  return createHash("sha256").update(token).digest("base64url");
-}
-function generateCode() {
-  return randomInt(0, 1e6).toString().padStart(6, "0");
-}
-function deriveCodeKey(signingKeyD) {
-  return Buffer.from(hkdfSync("sha256", Buffer.from(signingKeyD, "base64url"), "", "madauth e-mail code", 32));
-}
-function hashCode(key, code) {
-  return createHmac("sha256", key).update(code).digest("base64url");
-}
-function safeEqual(a, b) {
-  const x = Buffer.from(a);
-  const y = Buffer.from(b);
-  return x.length === y.length && timingSafeEqual(x, y);
-}
-
-// src/users.ts
-import { randomBytes as randomBytes2 } from "crypto";
-var MAX_CODE_ATTEMPTS = 5;
-var MAX_WRONG_CODES = 10;
-var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
-function passwordAccountKey(userId) {
-  return `password:${userId}`;
-}
-function googleAccountKey(sub) {
-  return `google:${sub}`;
-}
-function toMadauthUser(user, profile = {}) {
-  const result = { id: user.id, email: user.email };
-  const name = user.name ?? profile.name;
-  if (name) result.name = name;
-  if (profile.picture) result.picture = profile.picture;
-  const claims = claimsFromJson(user.claims);
-  if (Object.keys(claims).length) result.claims = claims;
-  return result;
-}
-var Users = class {
-  /** `codeKey` keys the e-mail codes (see deriveCodeKey); only needed to issue and check them. */
-  constructor(store, codeKey) {
-    this.store = store;
-    this.codeKey = codeKey;
-  }
-  get key() {
-    if (!this.codeKey) throw new Error("Users needs a code key to issue or check e-mail codes.");
-    return this.codeKey;
-  }
-  async findByEmail(emailNormalized) {
-    return await this.store.findOne("user", { emailNormalized });
-  }
-  async findById(id) {
-    return await this.store.findOne("user", { id });
-  }
-  async passwordAccount(userId) {
-    return this.findAccountByKey(passwordAccountKey(userId));
-  }
-  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
-  async signInMethods(userId) {
-    const accounts = await this.store.findMany("account", { userId });
-    const methods = accounts.map((account) => String(account.key).split(":")[0]);
-    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
-  }
-  async findAccountByKey(key) {
-    return await this.store.findOne("account", { key });
-  }
-  /**
-   * Creates a user with their first account. Resolves to null if the e-mail address or the account key is
-   * taken. `account.key` is `password:<userId>` for a password (its hash as `secret`), or e.g. `google:<sub>`.
-   */
-  async createUser(data) {
-    const user = {
-      id: newId("usr"),
-      email: data.email,
-      emailNormalized: data.emailNormalized,
-      emailVerified: data.emailVerified,
-      name: data.name,
-      sessionVersion: 0,
-      lastMailAt: 0,
-      wrongCodes: 0,
-      claims: null,
-      createdAt: Date.now()
-    };
-    if (!await this.store.create("user", user)) return null;
-    const account = typeof data.account === "function" ? data.account(user.id) : data.account;
-    if (!await this.linkAccount(user.id, account)) {
-      await this.store.delete("user", { id: user.id });
-      return null;
-    }
-    return user;
-  }
-  /**
-   * A provider verified the user's address: an unconfirmed password sign-up with it, whose password nobody
-   * has proven, is dropped (the account and its pending links and codes), and the user counts as verified.
-   */
-  async verifyByProvider(user) {
-    if (user.emailVerified) return;
-    await this.store.delete("account", { key: passwordAccountKey(user.id) });
-    await this.clearVerifications(user.id);
-    await this.updateUser(user.id, { emailVerified: true, wrongCodes: 0 });
-  }
-  /** Removes an account record, e.g. one left behind by a deletion that did not finish. */
-  async deleteAccount(id) {
-    await this.store.delete("account", { id });
-  }
-  /** Adds a sign-in method to a user. Resolves to null if the account key is taken. */
-  async linkAccount(userId, account) {
-    const record = {
-      id: newId("acc"),
-      userId,
-      key: account.key,
-      secret: account.secret ?? null,
-      failedAttempts: 0,
-      lockedUntil: 0,
-      email: account.email ?? null,
-      createdAt: Date.now()
-    };
-    return await this.store.create("account", record) ? record : null;
-  }
-  /**
-   * Deletes the user and everything stored for them. Resolves to false if there is no such user (any more).
-   */
-  async deleteById(id) {
-    const user = await this.findById(id);
-    if (!user) return false;
-    if (await this.store.delete("user", { id: user.id }) !== 1) return false;
-    try {
-      await this.store.delete("account", { userId: user.id });
-      await this.store.delete("verification", { userId: user.id });
-    } catch (e) {
-      console.error(`[madauth] Deleted user ${user.id}, but not all of their records: ${e.message}`);
-    }
-    return true;
-  }
-  async updateUser(id, patch) {
-    await this.store.update("user", { id }, patch);
-  }
-  /** Changes an account. Resolves to false if it is gone meanwhile. */
-  async updateAccount(id, patch) {
-    return await this.store.update("account", { id }, patch) === 1;
-  }
-  /**
-   * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
-   * was read. Resolves to false if another request counted an attempt meanwhile.
-   */
-  async countAttempt(account, patch) {
-    const changed = await this.store.update("account", { id: account.id, failedAttempts: account.failedAttempts }, patch);
-    return changed === 1;
-  }
-  /** Deletes the user's pending verifications and password resets; their links and codes stop working. */
-  async clearVerifications(userId) {
-    await this.store.delete("verification", { userId });
-  }
-  /**
-   * Starts a verification or password reset: replaces the user's earlier one for the same purpose and
-   * returns the link token and the code for the e-mail. Only their hashes are stored.
-   */
-  async issueVerification(userId, purpose, ttlMs) {
-    await this.store.delete("verification", { userId, purpose });
-    const token = generateLinkToken();
-    const code = generateCode();
-    const record = {
-      id: hashLinkToken(token),
-      userId,
-      purpose,
-      codeHash: hashCode(this.key, code),
-      attempts: 0,
-      expiresAt: Date.now() + ttlMs
-    };
-    await this.store.create("verification", record);
-    return { token, code };
-  }
-  /** Uses up the verification a link token belongs to. Resolves to its user ID, or null if invalid, expired or used. */
-  async consumeLinkToken(token, purpose) {
-    const id = hashLinkToken(token);
-    const record = await this.store.findOne("verification", { id, purpose });
-    return record ? this.consume(record) : null;
-  }
-  /**
-   * Uses up the user's verification if `code` matches. Too many wrong codes delete it, and after
-   * MAX_WRONG_CODES wrong codes in a row the user's codes stop working until an e-mail link is used.
-   */
-  async consumeCode(user, purpose, code) {
-    if ((user.wrongCodes ?? 0) >= MAX_WRONG_CODES) return { userId: null, locked: true };
-    const record = await this.store.findOne("verification", { userId: user.id, purpose });
-    if (!record) return { userId: null, locked: false };
-    const attempts = record.attempts + 1;
-    if (await this.store.update("verification", { id: record.id, attempts: record.attempts }, { attempts }) !== 1) {
-      return { userId: null, locked: false };
-    }
-    const wrongCodes = await this.countWrongCode(user);
-    if (wrongCodes === null) return { userId: null, locked: false };
-    if (wrongCodes > MAX_WRONG_CODES) return { userId: null, locked: true };
-    if (!safeEqual(hashCode(this.key, code), record.codeHash)) {
-      if (attempts >= MAX_CODE_ATTEMPTS) await this.store.delete("verification", { id: record.id });
-      return { userId: null, locked: wrongCodes >= MAX_WRONG_CODES };
-    }
-    return { userId: await this.consume(record), locked: false };
-  }
-  /** Counts a code for the user and resolves to the new count; null if other requests kept changing it. */
-  async countWrongCode(user) {
-    let current = user;
-    for (let attempt = 0; attempt < 3 && current; attempt++) {
-      const wrongCodes = (current.wrongCodes ?? 0) + 1;
-      if (await this.store.update("user", { id: user.id, wrongCodes: current.wrongCodes ?? null }, { wrongCodes }) === 1) {
-        return wrongCodes;
-      }
-      current = await this.findById(user.id);
-    }
-    return null;
-  }
-  async consume(record) {
-    const deleted = await this.store.delete("verification", { id: record.id });
-    if (deleted !== 1 || record.expiresAt <= Date.now()) return null;
-    return record.userId;
-  }
-};
-
-export {
-  ADMIN_ROLE,
-  parseRoles,
-  parseClaims,
-  sameClaims,
-  claimsFromJson,
-  isAdmin,
-  MAX_PASSWORD_LENGTH,
-  hashPassword,
-  verifyPassword,
-  verifyAgainstDummy,
-  checkPasswordPolicy,
-  normalizeEmail,
-  isValidEmail,
-  deriveCodeKey,
-  SIGN_IN_METHODS,
-  parseMethodSettings,
-  Settings,
-  isOn,
-  anyOn,
-  passwordAccountKey,
-  googleAccountKey,
-  toMadauthUser,
-  Users,
-  envVars,
-  resolveEnv,
-  ConfigError,
-  loadConfig,
-  loadUserStoreConfig,
-  loadStore
-};