@nxgt/janus-mongo 0.4.3 → 0.5.0

package/README.md

@@ -44,6 +44,10 @@ error class and throws the peer's own, so `instanceof StoreFailure` holds in
 your code. Like it, this package expects `"moduleResolution": "bundler"`: the
 declarations import without extensions, so `nodenext` is not supported.
 
+The `@nxgt/mongo` floor is tested, not claimed: the package's specs and its
+typecheck run on `@nxgt/mongo` 0.17.0 as well, in the Floors job, on every CI
+run.
+
 ## API
 
 | Export | What it is |
@@ -74,7 +78,9 @@ encoded. A document read in a shell reads like the record in the code.
 No secret is stored: sessions and tokens hold `sha256` of the secret,
 passwords a self-describing hash, and a user's `secondFactor.secret` a TOTP
 secret `@nxgt/janus` has already sealed with your application's key —
-`v1.<key id>.…` — which the store keeps byte for byte.
+`v1.<key id>.…` — which the store keeps byte for byte. Its
+`secondFactor.recoveryCodes` are keyed hashes of the recovery codes, never a
+code, kept in order; a factor without the field reads as having none.
 
 `countAttempt` counts an attempt at a code in one `findOneAndUpdate` with
 `$inc`, so twenty concurrent attempts answer twenty distinct counts.
@@ -106,6 +112,14 @@ spend the same one.
   run, every sign-up and every one-time token fails with `STORE_FAILED`,
   caused by `Document failed validation`.
   [Upgrading](docs/guide/sync.md#upgrading-sync-before-you-deploy) has the steps.
+- **Upgrading to 0.5: run the sync before deploying, again.** No document is
+  rewritten — a second factor without `recoveryCodes` reads as having none —
+  but the validator the previous sync wrote refuses the new field. Until
+  `syncMongoAdapter(db)` has run, every write of a second factor — `enroll`,
+  `activate`, a confirmed code — fails with `STORE_FAILED`, caused by
+  `Document failed validation`. And finish the rollout before users hold
+  recovery codes: an instance still on 0.4 writes a factor back without
+  them when it accepts a code.
 - **The TTL indexes are storage hygiene, not the expiry.** MongoDB's TTL monitor
   runs every sixty seconds, so a lapsed session can stay readable for up to a
   minute. The core compares `expiresAt` on every read, and that is what expires

package/dist/collections.d.ts

@@ -15,6 +15,7 @@ export declare const users: import("@nxgt/mongo").CollectionDefinition<import("@
         secret: z.ZodString;
         confirmedAt: z.ZodNullable<z.ZodDate>;
         lastStep: z.ZodNullable<z.ZodInt>;
+        recoveryCodes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
     emailVerifiedAt: z.ZodNullable<z.ZodDate>;
     version: z.ZodInt;
@@ -63,6 +64,7 @@ export declare const janusCollections: readonly [import("@nxgt/mongo").Collectio
         secret: z.ZodString;
         confirmedAt: z.ZodNullable<z.ZodDate>;
         lastStep: z.ZodNullable<z.ZodInt>;
+        recoveryCodes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>>;
     emailVerifiedAt: z.ZodNullable<z.ZodDate>;
     version: z.ZodInt;

package/dist/collections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;+FAgDhB,CAAC;AAEH,eAAO,MAAM,QAAQ;;;;;;;;+FA6BnB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;+FA2BjB,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gGAAqC,CAAC"}
+{"version":3,"file":"collections.d.ts","sourceRoot":"","sources":["../src/collections.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;+FAqDhB,CAAC;AAEH,eAAO,MAAM,QAAQ;;;;;;;;+FA6BnB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;+FA2BjB,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gGAAqC,CAAC"}

package/dist/index.js

@@ -22,7 +22,8 @@ var users = defineCollection({
       method: z.literal("totp"),
       secret: z.string(),
       confirmedAt: at.nullable(),
-      lastStep: z.int().nonnegative().nullable()
+      lastStep: z.int().nonnegative().nullable(),
+      recoveryCodes: z.array(z.string()).optional()
     }).nullable().optional(),
     emailVerifiedAt: at.nullable(),
     version: z.int().nonnegative(),
@@ -89,16 +90,11 @@ var tokens = defineCollection({
 });
 var janusCollections = [users, sessions, tokens];
 
-// src/relations.ts
+// src/relations/index.ts
 import {
-  isSubjectSet
-} from "@nxgt/janus";
-import {
-  defineCollection as defineCollection2,
   getCollection,
   syncCollections
 } from "@nxgt/mongo";
-import { z as z2 } from "zod";
 
 // src/translate.ts
 import { JanusError, StoreConflict, StoreFailure } from "@nxgt/janus";
@@ -135,11 +131,17 @@ function takenLogin(duplicate) {
 function loginTaken(operation, { type, login }, cause) {
   return new StoreConflict("login", `${operation}: the login is taken by another ${type}`, { login, userType: type, operation, cause });
 }
+function refuseDuplicate(operation, duplicate) {
+  const taken = takenLogin(duplicate);
+  return taken === null ? unexpectedDuplicate("users", operation, duplicate) : loginTaken(operation, taken, duplicate);
+}
 function unexpectedDuplicate(slot, operation, duplicate) {
   return new StoreFailure(`${slot}.${operation}: a duplicate key on ${Object.keys(duplicate.keyPattern ?? {}).join(", ") || "an unknown index"}, which this adapter never writes on purpose`, { slot, operation, cause: duplicate });
 }
 
-// src/relations.ts
+// src/relations/collection.ts
+import { defineCollection as defineCollection2 } from "@nxgt/mongo";
+import { z as z2 } from "zod";
 var relations = defineCollection2({
   name: "relations",
   schema: z2.object({
@@ -171,82 +173,14 @@ var relations = defineCollection2({
     }
   ]
 });
-function createMongoRelations(db) {
-  const collection = getCollection(db, relations).raw;
-  const run$ = (operation, body) => run("relations", operation, body);
-  const holding = async (object, relation, sets) => (await collection.find({
-    "_id.object.type": object.type,
-    "_id.object.id": object.id,
-    "_id.relation": relation,
-    "_id.subject.relation": { $exists: sets }
-  }).toArray()).map((document) => document._id.subject);
-  return {
-    write: ({ add = [], remove = [] }) => run$("write", async () => {
-      const removals = remove.map(keyOf);
-      const additions = add.map(keyOf);
-      const apply = async (session) => {
-        if (removals.length > 0) {
-          await collection.deleteMany({ _id: { $in: removals } }, session === undefined ? {} : { session });
-        }
-        if (additions.length > 0) {
-          await collection.bulkWrite(additions.map((key) => ({
-            replaceOne: {
-              filter: { _id: key },
-              replacement: { _id: key },
-              upsert: true
-            }
-          })), session === undefined ? {} : { session });
-        }
-      };
-      if (removals.length + additions.length <= 1)
-        return apply();
-      const session = db.client.startSession();
-      try {
-        session.startTransaction();
-        await apply(session);
-        await session.commitTransaction();
-      } finally {
-        await session.endSession();
-      }
-    }),
-    has: (tuple) => run$("has", async () => await collection.findOne({ _id: keyOf(tuple) }, { projection: { _id: 1 } }) !== null),
-    findSubjectSets: (object, relation) => run$("findSubjectSets", async () => (await holding(object, relation, true)).map((subject) => ({
-      type: subject.type,
-      id: subject.id,
-      relation: subject.relation
-    }))),
-    findEntities: (object, relation) => run$("findEntities", async () => (await holding(object, relation, false)).map((subject) => ({ type: subject.type, id: subject.id }))),
-    findObjects: ({ type, relation, subject, after, limit }) => run$("findObjects", async () => {
-      const filter = {
-        "_id.subject.type": subject.type,
-        "_id.subject.id": subject.id,
-        "_id.subject.relation": isSubjectSet(subject) ? subject.relation : null,
-        "_id.relation": relation,
-        "_id.object.type": type,
-        ...after === null ? {} : { "_id.object.id": { $gt: after } }
-      };
-      const found = await collection.find(filter, { projection: { "_id.object.id": 1 } }).sort({ "_id.object.id": 1 }).limit(limit + 1).toArray();
-      const items = found.slice(0, limit).map((document) => document._id.object.id);
-      const last = items.at(-1);
-      return {
-        items,
-        nextCursor: found.length > limit && last !== undefined ? last : null
-      };
-    }),
-    deleteEntity: (entity) => run$("deleteEntity", async () => {
-      const result = await collection.deleteMany({
-        $or: [
-          { "_id.object.type": entity.type, "_id.object.id": entity.id },
-          { "_id.subject.type": entity.type, "_id.subject.id": entity.id }
-        ]
-      });
-      return result.deletedCount;
-    })
-  };
-}
-function syncMongoRelations(db, options) {
-  return syncCollections(db, [relations], options);
-}
+
+// src/relations/reads.ts
+import {
+  isSubjectSet as isSubjectSet2
+} from "@nxgt/janus";
+
+// src/relations/tuples.ts
+import { isSubjectSet } from "@nxgt/janus";
 function keyOf(tuple) {
   return {
     object: { type: tuple.object.type, id: tuple.object.id },
@@ -258,158 +192,115 @@ function subjectKey(subject) {
   return isSubjectSet(subject) ? { type: subject.type, id: subject.id, relation: subject.relation } : { type: subject.type, id: subject.id };
 }
 
-// src/stores.ts
-import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
-import {
-  getCollection as getCollection2,
-  syncCollections as syncCollections2
-} from "@nxgt/mongo";
-function createMongoStores(db) {
-  return {
-    users: userStore(db),
-    sessions: sessionStore(db),
-    tokens: tokenStore(db)
-  };
+// src/relations/reads.ts
+async function has({ collection }, tuple) {
+  return await collection.findOne({ _id: keyOf(tuple) }, { projection: { _id: 1 } }) !== null;
 }
-function syncMongoStores(db, options) {
-  return syncCollections2(db, janusCollections, options);
+async function findSubjectSets(context, object, relation) {
+  return (await holding(context, object, relation, true)).map((subject) => ({
+    type: subject.type,
+    id: subject.id,
+    relation: subject.relation
+  }));
 }
-function userStore(db) {
-  const collection = getCollection2(db, users);
-  const run$ = (operation, body) => run("users", operation, body);
-  const find = async (id) => {
-    const found = await collection.findById(id);
-    return found === undefined ? null : toUser(found);
-  };
-  const refuse = (operation, duplicate) => {
-    const taken = takenLogin(duplicate);
-    return taken === null ? unexpectedDuplicate("users", operation, duplicate) : loginTaken(operation, taken, duplicate);
+async function findEntities(context, object, relation) {
+  return (await holding(context, object, relation, false)).map((subject) => ({ type: subject.type, id: subject.id }));
+}
+async function holding({ collection }, object, relation, sets) {
+  return (await collection.find({
+    "_id.object.type": object.type,
+    "_id.object.id": object.id,
+    "_id.relation": relation,
+    "_id.subject.relation": { $exists: sets }
+  }).toArray()).map((document) => document._id.subject);
+}
+async function findObjects({ collection }, { type, relation, subject, after, limit }) {
+  const filter = {
+    "_id.subject.type": subject.type,
+    "_id.subject.id": subject.id,
+    "_id.subject.relation": isSubjectSet2(subject) ? subject.relation : null,
+    "_id.relation": relation,
+    "_id.object.type": type,
+    ...after === null ? {} : { "_id.object.id": { $gt: after } }
   };
+  const found = await collection.find(filter, { projection: { "_id.object.id": 1 } }).sort({ "_id.object.id": 1 }).limit(limit + 1).toArray();
+  const items = found.slice(0, limit).map((document) => document._id.object.id);
+  const last = items.at(-1);
   return {
-    insertUser: (record) => run$("insertUser", async () => {
-      const document = toUserDocument(record);
-      const outcome = await settle(collection.raw.insertOne(document));
-      if (!("duplicate" in outcome))
-        return toUser(document);
-      const stored = await find(record.id);
-      if (stored !== null)
-        return stored;
-      throw refuse("insertUser", outcome.duplicate);
-    }),
-    findUser: (id) => run$("findUser", () => find(id)),
-    findUserByLogin: (type, login) => run$("findUserByLogin", async () => {
-      const found = await collection.findFirst({ type, logins: login });
-      return found === undefined ? null : toUser(found);
-    }),
-    listUsers: ({ type, after, limit }) => run$("listUsers", async () => {
-      const found = await collection.findMany({
-        filter: after === null ? { type } : { type, _id: { $gt: after } },
-        sort: { _id: 1 },
-        limit: limit + 1
-      });
-      const items = found.slice(0, limit).map(toUser);
-      const last = items.at(-1);
-      return {
-        items,
-        nextCursor: found.length > limit && last !== undefined ? last.id : null
-      };
-    }),
-    updateUser: (id, patch, ifVersion) => run$("updateUser", async () => {
-      const outcome = await settle(collection.raw.findOneAndUpdate({ _id: id, version: ifVersion }, { $set: toUserSet(patch), $inc: { version: 1 } }, { returnDocument: "after" }));
-      if ("duplicate" in outcome) {
-        throw refuse("updateUser", outcome.duplicate);
-      }
-      if (outcome.written !== null)
-        return toUser(outcome.written);
-      const stored = await find(id);
-      if (stored === null) {
-        throw new NotFoundError("updateUser: no user has this id", {
-          userId: id,
-          operation: "updateUser"
-        });
-      }
-      throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
-        userId: id,
-        expectedVersion: ifVersion,
-        actualVersion: stored.version,
-        operation: "updateUser"
-      });
-    }),
-    deleteUser: (id) => run$("deleteUser", async () => {
-      const result = await collection.raw.deleteOne({ _id: id });
-      return result.deletedCount === 1;
-    })
+    items,
+    nextCursor: found.length > limit && last !== undefined ? last : null
   };
 }
-function sessionStore(db) {
-  const collection = getCollection2(db, sessions);
-  const run$ = (operation, body) => run("sessions", operation, body);
-  return {
-    insertSession: (record) => run$("insertSession", async () => {
-      const outcome = await settle(collection.raw.insertOne(toSessionDocument(record)));
-      if (!("duplicate" in outcome))
-        return;
-      if (await collection.findById(record.id) !== undefined)
-        return;
-      throw unexpectedDuplicate("sessions", "insertSession", outcome.duplicate);
-    }),
-    findSessionByTokenHash: (tokenHash) => run$("findSessionByTokenHash", async () => {
-      const found = await collection.findFirst({ tokenHash });
-      return found === undefined ? null : toSession(found);
-    }),
-    extendSession: (id, expiresAt) => run$("extendSession", async () => {
-      const written = await collection.raw.findOneAndUpdate({ _id: id, revokedAt: null }, { $set: { expiresAt } }, { returnDocument: "after" });
-      return written === null ? null : toSession(written);
-    }),
-    revokeSession: (id, at) => run$("revokeSession", async () => {
-      const result = await collection.raw.updateOne({ _id: id }, [
-        { $set: { revokedAt: { $ifNull: ["$revokedAt", at] } } }
-      ]);
-      return result.matchedCount === 1;
-    }),
-    revokeUserSessions: (userId, at, except) => run$("revokeUserSessions", async () => {
-      const result = await collection.raw.updateMany(except === undefined ? { userId, revokedAt: null } : { userId, revokedAt: null, _id: { $ne: except } }, { $set: { revokedAt: at } });
-      return result.modifiedCount;
-    }),
-    deleteUserSessions: (userId) => run$("deleteUserSessions", async () => {
-      const result = await collection.raw.deleteMany({ userId });
-      return result.deletedCount;
-    })
-  };
+
+// src/relations/writes.ts
+async function write({ db, collection }, add, remove) {
+  const removals = remove.map(keyOf);
+  const additions = add.map(keyOf);
+  if (removals.length + additions.length <= 1) {
+    return apply(collection, additions, removals);
+  }
+  const session = db.client.startSession();
+  try {
+    session.startTransaction();
+    await apply(collection, additions, removals, session);
+    await session.commitTransaction();
+  } finally {
+    await session.endSession();
+  }
 }
-function tokenStore(db) {
-  const collection = getCollection2(db, tokens);
-  const run$ = (operation, body) => run("tokens", operation, body);
+async function apply(collection, additions, removals, session) {
+  if (removals.length > 0) {
+    await collection.deleteMany({ _id: { $in: removals } }, session === undefined ? {} : { session });
+  }
+  if (additions.length > 0) {
+    await collection.bulkWrite(additions.map((key) => ({
+      replaceOne: {
+        filter: { _id: key },
+        replacement: { _id: key },
+        upsert: true
+      }
+    })), session === undefined ? {} : { session });
+  }
+}
+async function deleteEntity({ collection }, entity) {
+  const result = await collection.deleteMany({
+    $or: [
+      { "_id.object.type": entity.type, "_id.object.id": entity.id },
+      { "_id.subject.type": entity.type, "_id.subject.id": entity.id }
+    ]
+  });
+  return result.deletedCount;
+}
+
+// src/relations/index.ts
+function createMongoRelations(db) {
+  const context = {
+    db,
+    collection: getCollection(db, relations).raw
+  };
+  const run$ = (operation, body) => run("relations", operation, body);
   return {
-    insertToken: (record) => run$("insertToken", async () => {
-      await settle(collection.raw.insertOne(toTokenDocument(record)));
-    }),
-    consumeToken: (tokenHash, kind, at) => run$("consumeToken", async () => {
-      const before = await collection.raw.findOneAndUpdate({ _id: tokenHash, kind }, [{ $set: { spentAt: { $ifNull: ["$spentAt", at] } } }], { returnDocument: "before" });
-      return before === null ? null : toToken(before);
-    }),
-    countAttempt: (tokenHash, kind) => run$("countAttempt", async () => {
-      const after = await collection.raw.findOneAndUpdate({ _id: tokenHash, kind, spentAt: null }, { $inc: { attempts: 1 } }, { returnDocument: "after" });
-      if (after !== null)
-        return toToken(after);
-      const spent = await collection.raw.findOne({ _id: tokenHash, kind });
-      return spent === null ? null : toToken(spent);
-    }),
-    spendUserTokens: (userId, kind, at, except) => run$("spendUserTokens", async () => {
-      const result = await collection.raw.updateMany({
-        userId,
-        kind,
-        spentAt: null,
-        ...except === undefined ? {} : { _id: { $ne: except } }
-      }, { $set: { spentAt: at } });
-      return result.modifiedCount;
-    }),
-    deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
-      const result = await collection.raw.deleteMany({ userId });
-      return result.deletedCount;
-    })
+    write: ({ add = [], remove = [] }) => run$("write", () => write(context, add, remove)),
+    has: (tuple) => run$("has", () => has(context, tuple)),
+    findSubjectSets: (object, relation) => run$("findSubjectSets", () => findSubjectSets(context, object, relation)),
+    findEntities: (object, relation) => run$("findEntities", () => findEntities(context, object, relation)),
+    findObjects: ({ type, relation, subject, after, limit }) => run$("findObjects", () => findObjects(context, { type, relation, subject, after, limit })),
+    deleteEntity: (entity) => run$("deleteEntity", () => deleteEntity(context, entity))
   };
 }
+function syncMongoRelations(db, options) {
+  return syncCollections(db, [relations], options);
+}
+
+// src/stores/index.ts
+import {
+  syncCollections as syncCollections2
+} from "@nxgt/mongo";
+
+// src/stores/sessions.ts
+import { getCollection as getCollection2 } from "@nxgt/mongo";
+
+// src/stores/records.ts
 function toUserDocument(record) {
   return structuredClone({
     _id: record.id,
@@ -419,7 +310,10 @@ function toUserDocument(record) {
     fields: record.fields,
     logins: [...record.logins],
     password: record.password,
-    secondFactor: record.secondFactor,
+    secondFactor: record.secondFactor === null ? null : {
+      ...record.secondFactor,
+      recoveryCodes: [...record.secondFactor.recoveryCodes]
+    },
     emailVerifiedAt: record.emailVerifiedAt,
     version: record.version,
     createdAt: record.createdAt,
@@ -457,7 +351,8 @@ function toUser(document) {
       method: secondFactor.method,
       secret: secondFactor.secret,
       confirmedAt: secondFactor.confirmedAt,
-      lastStep: secondFactor.lastStep
+      lastStep: secondFactor.lastStep,
+      recoveryCodes: [...secondFactor.recoveryCodes ?? []]
     },
     emailVerifiedAt: document.emailVerifiedAt,
     version: document.version,
@@ -514,6 +409,165 @@ function toToken(document) {
   };
 }
 
+// src/stores/sessions.ts
+function sessionStore(db) {
+  const collection = getCollection2(db, sessions);
+  const run$ = (operation, body) => run("sessions", operation, body);
+  return {
+    insertSession: (record) => run$("insertSession", async () => {
+      const outcome = await settle(collection.raw.insertOne(toSessionDocument(record)));
+      if (!("duplicate" in outcome))
+        return;
+      if (await collection.findById(record.id) !== undefined)
+        return;
+      throw unexpectedDuplicate("sessions", "insertSession", outcome.duplicate);
+    }),
+    findSessionByTokenHash: (tokenHash) => run$("findSessionByTokenHash", async () => {
+      const found = await collection.findFirst({ tokenHash });
+      return found === undefined ? null : toSession(found);
+    }),
+    extendSession: (id, expiresAt) => run$("extendSession", async () => {
+      const written = await collection.raw.findOneAndUpdate({ _id: id, revokedAt: null }, { $set: { expiresAt } }, { returnDocument: "after" });
+      return written === null ? null : toSession(written);
+    }),
+    revokeSession: (id, at) => run$("revokeSession", () => revokeSession(collection, id, at)),
+    revokeUserSessions: (userId, at, except) => run$("revokeUserSessions", () => revokeUserSessions(collection, userId, at, except)),
+    deleteUserSessions: (userId) => run$("deleteUserSessions", async () => {
+      const result = await collection.raw.deleteMany({ userId });
+      return result.deletedCount;
+    })
+  };
+}
+async function revokeSession(collection, id, at) {
+  const result = await collection.raw.updateOne({ _id: id }, [
+    { $set: { revokedAt: { $ifNull: ["$revokedAt", at] } } }
+  ]);
+  return result.matchedCount === 1;
+}
+async function revokeUserSessions(collection, userId, at, except) {
+  const result = await collection.raw.updateMany(except === undefined ? { userId, revokedAt: null } : { userId, revokedAt: null, _id: { $ne: except } }, { $set: { revokedAt: at } });
+  return result.modifiedCount;
+}
+
+// src/stores/tokens.ts
+import { getCollection as getCollection3 } from "@nxgt/mongo";
+function tokenStore(db) {
+  const collection = getCollection3(db, tokens);
+  const run$ = (operation, body) => run("tokens", operation, body);
+  return {
+    insertToken: (record) => run$("insertToken", async () => {
+      await settle(collection.raw.insertOne(toTokenDocument(record)));
+    }),
+    consumeToken: (tokenHash, kind, at) => run$("consumeToken", () => consumeToken(collection, tokenHash, kind, at)),
+    countAttempt: (tokenHash, kind) => run$("countAttempt", () => countAttempt(collection, tokenHash, kind)),
+    spendUserTokens: (userId, kind, at, except) => run$("spendUserTokens", async () => {
+      const result = await collection.raw.updateMany({
+        userId,
+        kind,
+        spentAt: null,
+        ...except === undefined ? {} : { _id: { $ne: except } }
+      }, { $set: { spentAt: at } });
+      return result.modifiedCount;
+    }),
+    deleteUserTokens: (userId) => run$("deleteUserTokens", async () => {
+      const result = await collection.raw.deleteMany({ userId });
+      return result.deletedCount;
+    })
+  };
+}
+async function consumeToken(collection, tokenHash, kind, at) {
+  const before = await collection.raw.findOneAndUpdate({ _id: tokenHash, kind }, [{ $set: { spentAt: { $ifNull: ["$spentAt", at] } } }], { returnDocument: "before" });
+  return before === null ? null : toToken(before);
+}
+async function countAttempt(collection, tokenHash, kind) {
+  const after = await collection.raw.findOneAndUpdate({ _id: tokenHash, kind, spentAt: null }, { $inc: { attempts: 1 } }, { returnDocument: "after" });
+  if (after !== null)
+    return toToken(after);
+  const spent = await collection.raw.findOne({ _id: tokenHash, kind });
+  return spent === null ? null : toToken(spent);
+}
+
+// src/stores/users.ts
+import { NotFoundError, StoreConflict as StoreConflict2 } from "@nxgt/janus";
+import { getCollection as getCollection4 } from "@nxgt/mongo";
+function userStore(db) {
+  const collection = getCollection4(db, users);
+  const run$ = (operation, body) => run("users", operation, body);
+  return {
+    insertUser: (record) => run$("insertUser", () => insertUser(collection, record)),
+    findUser: (id) => run$("findUser", () => findUser(collection, id)),
+    findUserByLogin: (type, login) => run$("findUserByLogin", async () => {
+      const found = await collection.findFirst({ type, logins: login });
+      return found === undefined ? null : toUser(found);
+    }),
+    listUsers: ({ type, after, limit }) => run$("listUsers", async () => {
+      const found = await collection.findMany({
+        filter: after === null ? { type } : { type, _id: { $gt: after } },
+        sort: { _id: 1 },
+        limit: limit + 1
+      });
+      const items = found.slice(0, limit).map(toUser);
+      const last = items.at(-1);
+      return {
+        items,
+        nextCursor: found.length > limit && last !== undefined ? last.id : null
+      };
+    }),
+    updateUser: (id, patch, ifVersion) => run$("updateUser", () => updateUser(collection, id, patch, ifVersion)),
+    deleteUser: (id) => run$("deleteUser", async () => {
+      const result = await collection.raw.deleteOne({ _id: id });
+      return result.deletedCount === 1;
+    })
+  };
+}
+async function findUser(collection, id) {
+  const found = await collection.findById(id);
+  return found === undefined ? null : toUser(found);
+}
+async function insertUser(collection, record) {
+  const document = toUserDocument(record);
+  const outcome = await settle(collection.raw.insertOne(document));
+  if (!("duplicate" in outcome))
+    return toUser(document);
+  const stored = await findUser(collection, record.id);
+  if (stored !== null)
+    return stored;
+  throw refuseDuplicate("insertUser", outcome.duplicate);
+}
+async function updateUser(collection, id, patch, ifVersion) {
+  const outcome = await settle(collection.raw.findOneAndUpdate({ _id: id, version: ifVersion }, { $set: toUserSet(patch), $inc: { version: 1 } }, { returnDocument: "after" }));
+  if ("duplicate" in outcome) {
+    throw refuseDuplicate("updateUser", outcome.duplicate);
+  }
+  if (outcome.written !== null)
+    return toUser(outcome.written);
+  const stored = await findUser(collection, id);
+  if (stored === null) {
+    throw new NotFoundError("updateUser: no user has this id", {
+      userId: id,
+      operation: "updateUser"
+    });
+  }
+  throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
+    userId: id,
+    expectedVersion: ifVersion,
+    actualVersion: stored.version,
+    operation: "updateUser"
+  });
+}
+
+// src/stores/index.ts
+function createMongoStores(db) {
+  return {
+    users: userStore(db),
+    sessions: sessionStore(db),
+    tokens: tokenStore(db)
+  };
+}
+function syncMongoStores(db, options) {
+  return syncCollections2(db, janusCollections, options);
+}
+
 // src/adapter.ts
 function createMongoAdapter(db) {
   return { store: createMongoStores(db), relations: createMongoRelations(db) };
@@ -535,5 +589,5 @@ export {
   users
 };
 
-//# debugId=2B060AC3ACC055FA64756E2164756E21
+//# debugId=2F309D39329EBE5364756E2164756E21
 //# sourceMappingURL=index.js.map