@nxgt/janus-drizzle 0.2.0 → 0.2.1

package/README.md

@@ -113,9 +113,9 @@ table plays that role, written in the same transaction as the user.
 
 Every key column is `text collate "C"`, compared byte for byte as the port
 requires. No secret is stored: sessions and tokens hold `sha256` of the secret,
-passwords a self-describing hash, and `second_factor_secret` a TOTP secret the
-store keeps byte for byte, which `@nxgt/janus` will seal with your
-application's key before the store sees it, once the second factor ships.
+passwords a self-describing hash, and `second_factor_secret` a TOTP secret
+`@nxgt/janus` has already sealed with your application's key —
+`v1.<key id>.…` — which the store keeps byte for byte.
 
 ## Traps
 

package/docs/guide/migrations.md

@@ -134,9 +134,11 @@ migration creates is what the conformance suites ran on.
 - **A second factor in four columns, checked whole.** A method and a secret,
   or neither; a confirmation date and a last step only beside them; `totp`
   the only method, and a last step never negative. The
-  secret is opaque to the store and kept byte for byte: once the second
-  factor ships, `@nxgt/janus` will seal it before the store sees it, so a
-  dump of `users` cannot produce a code.
+  secret is opaque to the store and kept byte for byte: `@nxgt/janus` seals
+  it before the store sees it, so a dump of `users` cannot produce a code.
+  Its key id is the second part of the value, so
+  `where second_factor_secret like 'v1.<id>.%'` finds the secrets still sealed
+  with a key being [rotated out](https://github.com/softistx/nxgt-janus/blob/develop/packages/janus/docs/guide/second-factor.md#rotating-the-keys).
 - **`attempts` is `not null default 0`**, checked `>= 0`, so the rows an upgrade finds read
   as tokens with no attempt counted yet.
 - **No foreign key from sessions and tokens to users.** Deleting a user
@@ -214,6 +216,6 @@ const patients = row?.patients ?? 0;
 ```
 
 **Read, never write.** A row written behind the store's back skips its
-invariants: the logins' uniqueness, `version`, the password check, and,
-once the second factor ships, the sealing of its secret. Write through
+invariants: the logins' uniqueness, `version`, the password check, and the
+sealing of a second factor's secret. Write through
 `auth` and `access`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nxgt/janus-drizzle",
-	"version": "0.2.0",
+	"version": "0.2.1",
 	"description": "The PostgreSQL adapter for @nxgt/janus on Drizzle and @nxgt/drizzle: users, sessions, one-time tokens and permission tuples",
 	"license": "MIT",
 	"type": "module",
@@ -51,7 +51,7 @@
 	"devDependencies": {
 		"@electric-sql/pglite": "0.5.8",
 		"@nxgt/drizzle": "0.6.1",
-		"@nxgt/janus": "^0.4.0",
+		"@nxgt/janus": "^0.5.0",
 		"@types/bun": "^1.4.2",
 		"@types/pg": "^8.23.1",
 		"drizzle-kit": "1.0.0-rc.4",
@@ -62,7 +62,7 @@
 	},
 	"peerDependencies": {
 		"@nxgt/drizzle": ">=0.6.1 <1",
-		"@nxgt/janus": "^0.4.0",
+		"@nxgt/janus": "^0.5.0",
 		"drizzle-orm": ">=1.0.0-rc.4 <2",
 		"typescript": "^6.0.3"
 	}