@nxgt/janus 0.1.0

package/dist/index.js

@@ -0,0 +1,962 @@
+import {
+  mintId2,
+  isId2,
+  mintedAt2,
+  createMemoryStores2
+} from "./chunks/index-658b6mr2.js";
+import {
+  guardStores,
+  guardRelations,
+  required,
+  unlessVersionConflict,
+  DEFAULT_PAGE_SIZE2,
+  MAX_PAGE_SIZE2,
+  pageLimit2,
+  invalidCursor2
+} from "./chunks/index-6dytvy3h.js";
+import {
+  JanusError2,
+  StoreFailure2,
+  StoreConflict2,
+  NotFoundError2,
+  UserInvalidError2,
+  CredentialError2,
+  UserInactiveError2,
+  TokenError2,
+  InvalidCursorError2,
+  UnsupportedError2,
+  PermissionDepthError2,
+  isSubjectSet2,
+  subjectOf2,
+  formatEntity2,
+  formatSubject2,
+  formatTuple2,
+  parseTuple2,
+  parseSubject2
+} from "./chunks/index-6p56fpbe.js";
+
+// src/auth/hashers.ts
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+function scryptHasher(options) {
+  const cost = options?.cost ?? 17;
+  if (!Number.isInteger(cost) || cost < 10 || cost > 20) {
+    throw new TypeError("scryptHasher: cost is log2(N), an integer from 10 to 20 — 17 is the recommended value");
+  }
+  return {
+    prefix: SCRYPT_PREFIX,
+    async hash(plain) {
+      const salt = randomBytes(16);
+      const key = await derive(plain, salt, cost, 8, 1);
+      return `${SCRYPT_PREFIX}ln=${cost},r=8,p=1$${salt.toString("base64")}$${key.toString("base64")}`;
+    },
+    async verify(plain, hash) {
+      const parsed = SCRYPT_HASH.exec(hash);
+      if (parsed === null) {
+        throw new TypeError("scryptHasher: the stored hash has the $scrypt$ prefix and not its format");
+      }
+      const [, ln, r, p, salt, key] = parsed;
+      const expected = Buffer.from(key, "base64");
+      const actual = await derive(plain, Buffer.from(salt, "base64"), Number(ln), Number(r), Number(p), expected.length);
+      return timingSafeEqual(actual, expected);
+    },
+    needsRehash(hash) {
+      const parsed = SCRYPT_HASH.exec(hash);
+      if (parsed === null)
+        return false;
+      const [, ln, r, p] = parsed;
+      return Number(ln) !== cost || r !== "8" || p !== "1";
+    }
+  };
+}
+var SCRYPT_PREFIX = "$scrypt$";
+var SCRYPT_HASH = /^\$scrypt\$ln=(\d+),r=(\d+),p=(\d+)\$([A-Za-z0-9+/=]+)\$([A-Za-z0-9+/=]+)$/;
+function derive(plain, salt, ln, r, p, length = 32) {
+  const n = 2 ** ln;
+  return new Promise((resolve, reject) => {
+    scrypt(plain, salt, length, { cost: n, blockSize: r, parallelization: p, maxmem: 256 * n * r }, (error, key) => error ? reject(error) : resolve(key));
+  });
+}
+function bunHasher() {
+  const password = typeof Bun === "undefined" ? undefined : Bun.password;
+  if (password === undefined) {
+    throw new TypeError("bunHasher: Bun.password is not available — this runtime is not Bun; wire scryptHasher() instead");
+  }
+  return {
+    prefix: "$argon2id$",
+    hash: (plain) => password.hash(plain, ARGON2ID),
+    verify: (plain, hash) => password.verify(plain, hash),
+    needsRehash: (hash) => !hash.startsWith(ARGON2ID_PARAMETERS)
+  };
+}
+var ARGON2ID = {
+  algorithm: "argon2id",
+  memoryCost: 65536,
+  timeCost: 2
+};
+var ARGON2ID_PARAMETERS = "$argon2id$v=19$m=65536,t=2,p=1$";
+// src/time/clock.ts
+var systemClock = {
+  now: () => new Date
+};
+function fixedClock(start = 0) {
+  let ms = start instanceof Date ? start.getTime() : start;
+  return {
+    now: () => new Date(ms),
+    advance: (by) => {
+      ms += by;
+    },
+    set: (at) => {
+      ms = at instanceof Date ? at.getTime() : at;
+    }
+  };
+}
+
+// src/time/duration.ts
+var UNITS = {
+  ms: 1,
+  s: 1000,
+  m: 60000,
+  h: 3600000,
+  d: 86400000
+};
+var PATTERN = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/;
+function parseDuration(value, where) {
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new TypeError(`${where}: a duration in milliseconds must be a finite number above zero`);
+    }
+    return value;
+  }
+  const match = PATTERN.exec(value);
+  if (!match) {
+    throw new TypeError(`${where}: "${value}" is not a duration; write a number followed by ms, s, m, h or d — for example "15m" or "720h"`);
+  }
+  const amount = Number(match[1]);
+  const unit = match[2];
+  const ms = amount * UNITS[unit];
+  if (ms <= 0) {
+    throw new TypeError(`${where}: a duration must be above zero`);
+  }
+  return ms;
+}
+
+// src/auth/config.ts
+var SINGLE_TYPE = "user";
+var RESERVED_FIELDS = [
+  "id",
+  "type",
+  "emailVerified",
+  "active",
+  "hasPassword",
+  "version",
+  "createdAt",
+  "updatedAt",
+  "password"
+];
+var RESERVED_TYPES = [
+  "authenticate",
+  "signOut",
+  "signOutEverywhere",
+  "findUser",
+  "getUser",
+  "cookie",
+  "collectExpired",
+  "types"
+];
+var NORMALIZERS = {
+  none: (value) => value,
+  lowercase: (value) => value.toLowerCase(),
+  lowercaseTrim: (value) => value.toLowerCase().trim(),
+  nfkcLowercaseTrim: (value) => value.normalize("NFKC").toLowerCase().trim()
+};
+var normalizeEmail = NORMALIZERS.lowercaseTrim;
+var COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var NAME = /^[A-Za-z][A-Za-z0-9]*$/;
+function resolveConfig(config, where) {
+  if (typeof config !== "object" || config === null) {
+    throw new TypeError(`${where}: expected a configuration object`);
+  }
+  const hasUser = config.user !== undefined;
+  const hasUsers = config.users !== undefined;
+  if (hasUser === hasUsers) {
+    throw new TypeError(`${where}: pass either user (one kind of user) or users (several kinds), and exactly one of them`);
+  }
+  const entries = hasUsers ? Object.entries(config.users) : [
+    [
+      SINGLE_TYPE,
+      {
+        ...config,
+        schema: config.user
+      }
+    ]
+  ];
+  if (entries.length === 0) {
+    throw new TypeError(`${where}: users declares no user type`);
+  }
+  const types = new Map;
+  for (const [name, type] of entries) {
+    const at = hasUsers ? `${where}: users.${name}` : where;
+    if (!NAME.test(name)) {
+      throw new TypeError(`${where}: the user type "${name}" must be a camelCase name — letters and digits, starting with a letter`);
+    }
+    if (RESERVED_TYPES.includes(name)) {
+      throw new TypeError(`${where}: "${name}" cannot name a user type — janus() answers a method of that name`);
+    }
+    types.set(name, resolveType(name, type, at, hasUsers ? "schema" : "user"));
+  }
+  const hashing = [...types.values()].some((type) => type.password !== null);
+  if (hashing && config.hasher === undefined) {
+    throw new TypeError(`${where}: a user type signs in with a password and no hasher is wired — pass hasher: scryptHasher(), or bunHasher() on Bun. There is no silent fallback`);
+  }
+  return {
+    single: !hasUsers,
+    types,
+    tokenTtlMs: {
+      verifyEmail: parseDuration(config.tokens?.verifyEmail ?? "24h", `${where}: tokens.verifyEmail`),
+      resetPassword: parseDuration(config.tokens?.resetPassword ?? "1h", `${where}: tokens.resetPassword`)
+    },
+    cookie: resolveCookie(config.cookie ?? {}, where)
+  };
+}
+function resolveType(name, type, at, schemaKey) {
+  if (typeof type?.schema !== "object" || type.schema === null || typeof type.schema["~standard"]?.validate !== "function") {
+    throw new TypeError(`${at}: ${schemaKey} must be a Standard Schema — a Zod 4, Valibot or ArkType schema`);
+  }
+  let password = null;
+  if (type.password !== undefined) {
+    const minLength = type.password.minLength ?? 8;
+    if (!Number.isInteger(minLength) || minLength < 1) {
+      throw new TypeError(`${at}: password.minLength must be an integer of at least 1`);
+    }
+    password = {
+      login: fieldName(type.password.login, `${at}: password.login`),
+      normalize: normalizer(type.password.normalize ?? "lowercaseTrim", `${at}: password.normalize`),
+      minLength
+    };
+  }
+  const renewAfter = type.session?.renewAfter ?? "1d";
+  return {
+    name,
+    schema: type.schema,
+    schemaVersion: type.schemaVersion ?? "1",
+    password,
+    email: fieldName(type.email ?? "email", `${at}: email`),
+    lifespanMs: parseDuration(type.session?.lifespan ?? "7d", `${at}: session.lifespan`),
+    renewAfterMs: renewAfter === false ? null : parseDuration(renewAfter, `${at}: session.renewAfter`)
+  };
+}
+function resolveCookie(cookie, where) {
+  const name = cookie.name ?? "janus-session";
+  if (!COOKIE_NAME.test(name)) {
+    throw new TypeError(`${where}: cookie.name must be a cookie-name token — letters, digits and !#$%&'*+-.^_\`|~, with no space, ";" or "="`);
+  }
+  const sameSite = cookie.sameSite ?? "lax";
+  const secure = cookie.secure ?? true;
+  if (sameSite === "none" && !secure) {
+    throw new TypeError(`${where}: cookie.sameSite "none" requires cookie.secure — browsers refuse the cookie otherwise`);
+  }
+  return {
+    name,
+    domain: cookie.domain ?? null,
+    path: cookie.path ?? "/",
+    sameSite,
+    secure
+  };
+}
+function fieldName(field, where) {
+  if (typeof field !== "string" || !NAME.test(field)) {
+    throw new TypeError(`${where} must name a top-level field of the schema, such as "email"`);
+  }
+  if (RESERVED_FIELDS.includes(field)) {
+    throw new TypeError(`${where}: "${field}" is a field janus sets itself`);
+  }
+  return field;
+}
+function normalizer(rule, where) {
+  if (typeof rule === "function")
+    return rule;
+  if (typeof rule === "string" && Object.hasOwn(NORMALIZERS, rule)) {
+    return NORMALIZERS[rule];
+  }
+  throw new TypeError(`${where} must be "none", "lowercase", "lowercaseTrim", "nfkcLowercaseTrim" or a function`);
+}
+
+// src/auth/context.ts
+function createContext(config, store, relations, capabilities, clock, hasher, verifiers) {
+  let dummy = null;
+  return {
+    config,
+    store,
+    relations,
+    capabilities,
+    clock,
+    hasher,
+    verifiers,
+    dummyHash: () => {
+      if (hasher === null) {
+        throw new TypeError("janus: no hasher to compare a dummy hash with");
+      }
+      dummy ??= hasher.hash(`janus-dummy-${mintId2()}`);
+      return dummy;
+    }
+  };
+}
+function toUser(record) {
+  return {
+    ...record.fields,
+    id: record.id,
+    type: record.type,
+    emailVerified: record.emailVerifiedAt !== null,
+    active: record.active,
+    hasPassword: record.password !== null,
+    version: record.version,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
+}
+var idOf = (user) => typeof user === "string" ? user : user.id;
+async function validateFields(type, input, where) {
+  const result = await type.schema["~standard"].validate(input);
+  const issues = result.issues === undefined ? [] : result.issues.map((issue) => ({
+    path: (issue.path ?? []).map(segmentKey),
+    message: issue.message
+  }));
+  if (result.issues === undefined) {
+    const value = result.value;
+    for (const key of RESERVED_FIELDS) {
+      if (Object.hasOwn(value, key)) {
+        issues.push({ path: [key], message: "set by janus, not by a request" });
+      }
+    }
+  }
+  if (issues.length > 0) {
+    throw new UserInvalidError2(`${where}: the fields do not match the ${type.name} schema (${issues.length} issue${issues.length === 1 ? "" : "s"}, at ${issues.map((i) => i.path.join(".") || "(root)").join(", ")})`, { issues, userType: type.name });
+  }
+  return withoutUndefined(result.value);
+}
+function segmentKey(segment) {
+  const key = typeof segment === "object" ? segment.key : segment;
+  return typeof key === "number" ? key : String(key);
+}
+function withoutUndefined(value) {
+  if (Array.isArray(value))
+    return value.map(withoutUndefined);
+  if (typeof value === "object" && value !== null) {
+    const out = {};
+    for (const [key, inner] of Object.entries(value)) {
+      if (inner !== undefined)
+        out[key] = withoutUndefined(inner);
+    }
+    return out;
+  }
+  return value;
+}
+function emailOf(type, fields) {
+  const value = fields[type.email];
+  return typeof value === "string" ? value : null;
+}
+function loginsOf(type, fields) {
+  const logins = new Set;
+  if (type.password !== null) {
+    const login = fields[type.password.login];
+    if (typeof login !== "string") {
+      throw new TypeError(`janus: password.login "${type.password.login}" did not name a string in validated ${type.name} fields — it must name a required string field`);
+    }
+    logins.add(type.password.normalize(login));
+  }
+  const email = emailOf(type, fields);
+  if (email !== null)
+    logins.add(normalizeEmail(email));
+  return [...logins];
+}
+function checkPassword(type, password, where) {
+  const minLength = type.password?.minLength ?? 8;
+  if (typeof password !== "string" || password.length < minLength) {
+    throw new CredentialError2("PASSWORD_TOO_SHORT", `${where}: the password is shorter than the policy's ${minLength} characters`, { minLength, userType: type.name });
+  }
+}
+function requireHasher(context, where) {
+  if (context.hasher === null) {
+    throw new TypeError(`${where}: no password hasher is wired — pass hasher: scryptHasher(), or bunHasher() on Bun`);
+  }
+  return context.hasher;
+}
+async function passwordMatches(context, record, password, where) {
+  const stored = record.password;
+  if (stored === null)
+    return false;
+  const verifier = context.verifiers.find((candidate) => stored.hash.startsWith(candidate.prefix));
+  if (verifier === undefined) {
+    const hashPrefix = /^\$[^$]*\$/.exec(stored.hash)?.[0] ?? "(none)";
+    throw new CredentialError2("HASH_UNSUPPORTED", `${where}: no wired verifier claims the prefix "${hashPrefix}"`, { hashPrefix, userId: record.id, userType: record.type });
+  }
+  return verifier.verify(password, stored.hash);
+}
+async function rehashed(context, record, password) {
+  const { hasher } = context;
+  const stored = record.password;
+  if (hasher === null || stored === null)
+    return record;
+  const stale = !stored.hash.startsWith(hasher.prefix) || hasher.needsRehash?.(stored.hash) === true;
+  if (!stale)
+    return record;
+  const written = await unlessVersionConflict(context.store.users.updateUser(record.id, {
+    updatedAt: context.clock.now(),
+    password: {
+      hash: await hasher.hash(password),
+      updatedAt: stored.updatedAt
+    }
+  }, record.version));
+  return written ?? record;
+}
+var notFound = (where, id, type) => new NotFoundError2(`${where}: no ${type ?? "user"} has this id`, type === null ? { userId: id, operation: where } : { userId: id, userType: type, operation: where });
+async function findRecord(context, id, type) {
+  if (!isId2(id))
+    return null;
+  const record = await context.store.users.findUser(id);
+  return record !== null && (type === null || record.type === type) ? record : null;
+}
+async function getRecord(context, id, type, where) {
+  return required(await findRecord(context, id, type), () => notFound(where, id, type));
+}
+async function writeUser(context, user, type, options, where, patchOf) {
+  const id = idOf(user);
+  const record = await getRecord(context, id, type.name, where);
+  const ifVersion = options?.ifVersion;
+  if (ifVersion !== undefined && ifVersion !== record.version) {
+    throw new StoreConflict2("version", `${where}: expected version ${ifVersion}, found ${record.version}`, {
+      userId: id,
+      expectedVersion: ifVersion,
+      actualVersion: record.version,
+      operation: where
+    });
+  }
+  const now = context.clock.now();
+  const patch = await patchOf(record, now);
+  return context.store.users.updateUser(record.id, { ...patch, updatedAt: now }, record.version);
+}
+
+// src/auth/port/assert-stores.ts
+var REQUIRED = {
+  users: [
+    "insertUser",
+    "findUser",
+    "findUserByLogin",
+    "listUsers",
+    "updateUser",
+    "deleteUser"
+  ],
+  sessions: [
+    "insertSession",
+    "findSessionByTokenHash",
+    "extendSession",
+    "revokeSession",
+    "revokeUserSessions",
+    "deleteUserSessions"
+  ],
+  tokens: ["insertToken", "consumeToken", "deleteUserTokens"]
+};
+function assertStores(stores, where) {
+  if (typeof stores !== "object" || stores === null) {
+    throw new TypeError(`${where}: store must be an object with users, sessions and tokens`);
+  }
+  for (const slot of Object.keys(REQUIRED)) {
+    const store = stores[slot];
+    if (typeof store !== "object" || store === null) {
+      throw new TypeError(`${where}: store.${slot} is missing`);
+    }
+    for (const method of REQUIRED[slot]) {
+      if (typeof store[method] !== "function") {
+        throw new TypeError(`${where}: store.${slot} has no method ${method}, which the port requires`);
+      }
+    }
+  }
+  const sessions = stores.sessions;
+  const collect = sessions.deleteExpiredSessions;
+  if (collect !== undefined && typeof collect !== "function") {
+    throw new TypeError(`${where}: store.sessions.deleteExpiredSessions must be a function or absent`);
+  }
+  return { collectExpired: collect !== undefined };
+}
+
+// src/auth/secrets.ts
+import { createHash, randomBytes as randomBytes2 } from "node:crypto";
+function mintSecret() {
+  return randomBytes2(32).toString("base64url");
+}
+function hashSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+
+// src/auth/sessions.ts
+function toSession(record) {
+  const { tokenHash: _, ...session } = record;
+  return session;
+}
+async function openSession(context, type, user) {
+  const now = context.clock.now();
+  const token = mintSecret();
+  const record = {
+    id: mintId2(now.getTime()),
+    tokenHash: hashSecret(token),
+    userId: user.id,
+    authenticatedAt: now,
+    expiresAt: new Date(now.getTime() + type.lifespanMs),
+    revokedAt: null,
+    createdAt: now
+  };
+  await context.store.sessions.insertSession(record);
+  return { user: toUser(user), session: toSession(record), token };
+}
+function sharedApi(context) {
+  const { store, clock, config } = context;
+  return {
+    async authenticate(request, options) {
+      const token = presentedToken(request, config.cookie.name);
+      if (token === null)
+        return null;
+      const session = await store.sessions.findSessionByTokenHash(hashSecret(token));
+      const now = clock.now().getTime();
+      if (session === null || session.revokedAt !== null || session.expiresAt.getTime() <= now) {
+        return null;
+      }
+      const user = await store.users.findUser(session.userId);
+      if (user === null || !user.active || options?.type !== undefined && user.type !== options.type) {
+        return null;
+      }
+      const type = config.types.get(user.type);
+      let current = session;
+      let renewed = false;
+      if (type !== undefined && type.renewAfterMs !== null && type.lifespanMs - (session.expiresAt.getTime() - now) >= type.renewAfterMs) {
+        const extended = await store.sessions.extendSession(session.id, new Date(now + type.lifespanMs));
+        if (extended === null)
+          return null;
+        current = extended;
+        renewed = true;
+      }
+      return {
+        user: toUser(user),
+        session: toSession(current),
+        token,
+        renewed
+      };
+    },
+    async signOut(request) {
+      const token = presentedToken(request, config.cookie.name);
+      if (token === null)
+        return false;
+      const session = await store.sessions.findSessionByTokenHash(hashSecret(token));
+      if (session === null)
+        return false;
+      return store.sessions.revokeSession(session.id, clock.now());
+    },
+    async signOutEverywhere(user, options) {
+      const id = idOf(user);
+      if (!isId2(id))
+        return 0;
+      return options?.except === undefined ? store.sessions.revokeUserSessions(id, clock.now()) : store.sessions.revokeUserSessions(id, clock.now(), options.except);
+    },
+    async findUser(id) {
+      const record = await findRecord(context, id, null);
+      return record === null ? null : toUser(record);
+    },
+    async getUser(id) {
+      return toUser(await getRecord(context, id, null, "getUser"));
+    },
+    cookie: cookieOf(context),
+    async collectExpired() {
+      const collect = store.sessions.deleteExpiredSessions;
+      if (!context.capabilities.collectExpired || collect === undefined) {
+        throw new UnsupportedError2("collectExpired: store.sessions does not implement deleteExpiredSessions — its store expires sessions on its own, or implement the method", { slot: "sessions", operation: "deleteExpiredSessions" });
+      }
+      return collect(clock.now());
+    },
+    types: [...config.types.keys()]
+  };
+}
+function cookieOf(context) {
+  const { name, domain, path, sameSite, secure } = context.config.cookie;
+  const attributes = [
+    `Path=${path}`,
+    ...domain === null ? [] : [`Domain=${domain}`],
+    "HttpOnly",
+    `SameSite=${sameSite[0]?.toUpperCase()}${sameSite.slice(1)}`,
+    ...secure ? ["Secure"] : []
+  ].join("; ");
+  return {
+    name,
+    serialize: (token, session) => `${name}=${token}; Expires=${session.expiresAt.toUTCString()}; ${attributes}`,
+    clear: () => `${name}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; ${attributes}`
+  };
+}
+function presentedToken(request, cookieName) {
+  const headers = headersOf(request);
+  const read = (name) => {
+    if (headers instanceof Headers)
+      return headers.get(name);
+    for (const [key, value] of Object.entries(headers)) {
+      if (key.toLowerCase() !== name || value === undefined)
+        continue;
+      return typeof value === "string" ? value : value.join(", ");
+    }
+    return null;
+  };
+  const authorization = read("authorization");
+  if (authorization !== null) {
+    const match = /^bearer(?:\s+(.*))?$/i.exec(authorization.trim());
+    if (match)
+      return match[1]?.trim() ?? "";
+  }
+  const header = read("x-session-token");
+  if (header !== null)
+    return header.trim();
+  const cookie = read("cookie");
+  if (cookie !== null) {
+    for (const pair of cookie.split(";")) {
+      const at = pair.indexOf("=");
+      if (at !== -1 && pair.slice(0, at).trim() === cookieName) {
+        return pair.slice(at + 1).trim();
+      }
+    }
+  }
+  return null;
+}
+function headersOf(request) {
+  if (request instanceof Headers)
+    return request;
+  const inner = request.headers;
+  if (inner instanceof Headers)
+    return inner;
+  if (typeof inner === "object" && inner !== null)
+    return inner;
+  return request;
+}
+
+// src/auth/users.ts
+function typeApi(context, type) {
+  const { store, clock } = context;
+  const at = (operation) => context.config.single ? operation : `${type.name}.${operation}`;
+  const insert = async (input, where) => {
+    const { password, active, ...rest } = input ?? {};
+    const now = clock.now();
+    const fields = await validateFields(type, rest, where);
+    let hash = null;
+    if (password !== undefined) {
+      checkPassword(type, password, where);
+      hash = {
+        hash: await requireHasher(context, where).hash(password),
+        updatedAt: now
+      };
+    }
+    return store.users.insertUser({
+      id: mintId2(now.getTime()),
+      type: type.name,
+      schemaVersion: type.schemaVersion,
+      active: active === undefined ? true : active === true,
+      fields,
+      logins: loginsOf(type, fields),
+      password: hash,
+      emailVerifiedAt: null,
+      version: 0,
+      createdAt: now,
+      updatedAt: now
+    });
+  };
+  const redeem = async (kind, secret, where) => {
+    const now = clock.now();
+    const token = await store.tokens.consumeToken(hashSecret(secret), kind, now);
+    if (token === null) {
+      throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such token`, {
+        operation: where
+      });
+    }
+    if (token.spentAt !== null) {
+      throw new TokenError2("TOKEN_SPENT", `${where}: the token was already used`, {
+        operation: where
+      });
+    }
+    if (token.expiresAt.getTime() <= now.getTime()) {
+      throw new TokenError2("TOKEN_EXPIRED", `${where}: the token has expired`, {
+        operation: where
+      });
+    }
+    const user = await findRecord(context, token.userId, type.name);
+    if (user === null) {
+      throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such token`, {
+        operation: where
+      });
+    }
+    const email = emailOf(type, user.fields);
+    if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
+      throw new TokenError2("TOKEN_STALE", `${where}: the token was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+    }
+    return { token, user };
+  };
+  const issue = async (kind, user, where) => {
+    const email = emailOf(type, user.fields);
+    if (email === null) {
+      throw new NotFoundError2(`${where}: the user has no e-mail`, {
+        userId: user.id,
+        userType: type.name,
+        operation: where
+      });
+    }
+    const now = clock.now();
+    const secret = mintSecret();
+    const expiresAt = new Date(now.getTime() + context.config.tokenTtlMs[kind]);
+    await store.tokens.insertToken({
+      tokenHash: hashSecret(secret),
+      kind,
+      userId: user.id,
+      address: email,
+      expiresAt,
+      spentAt: null,
+      createdAt: now
+    });
+    return { token: secret, email, expiresAt };
+  };
+  const passwordRule = (where) => {
+    if (type.password === null) {
+      throw new TypeError(`${where}: the ${type.name} type does not sign in with a password — add password: { login } to it`);
+    }
+    return type.password;
+  };
+  return {
+    async create(input) {
+      return toUser(await insert(input, at("create")));
+    },
+    async find(id) {
+      const record = await findRecord(context, id, type.name);
+      return record === null ? null : toUser(record);
+    },
+    async get(id) {
+      return toUser(await getRecord(context, id, type.name, at("get")));
+    },
+    async list(page) {
+      const after = page?.after ?? null;
+      if (after !== null && !isId2(after)) {
+        throw invalidCursor2(at("list"), after);
+      }
+      const answer = await store.users.listUsers({
+        type: type.name,
+        after,
+        limit: pageLimit2(page?.limit, at("list"))
+      });
+      return { items: answer.items.map(toUser), nextCursor: answer.nextCursor };
+    },
+    async update(user, patch, options) {
+      const where = at("update");
+      const written = await writeUser(context, user, type, options, where, async (record) => {
+        const fields = await validateFields(type, { ...record.fields, ...patch }, where);
+        const before = emailOf(type, record.fields);
+        const after = emailOf(type, fields);
+        const emailChanged = (before === null ? null : normalizeEmail(before)) !== (after === null ? null : normalizeEmail(after));
+        return {
+          fields,
+          logins: loginsOf(type, fields),
+          schemaVersion: type.schemaVersion,
+          ...emailChanged ? { emailVerifiedAt: null } : {}
+        };
+      });
+      return toUser(written);
+    },
+    async setActive(user, active, options) {
+      return toUser(await writeUser(context, user, type, options, at("setActive"), () => ({
+        active: active === true
+      })));
+    },
+    async delete(user) {
+      const id = idOf(user);
+      if (!isId2(id))
+        return false;
+      const record = await store.users.findUser(id);
+      if (record !== null && record.type !== type.name)
+        return false;
+      const deleted = record !== null && await store.users.deleteUser(id);
+      await store.sessions.deleteUserSessions(id);
+      await store.tokens.deleteUserTokens(id);
+      await context.relations?.deleteEntity({ type: type.name, id });
+      return deleted;
+    },
+    async signUp(input) {
+      const where = at("signUp");
+      passwordRule(where);
+      if (input?.password === undefined) {
+        checkPassword(type, undefined, where);
+      }
+      const record = await insert(input, where);
+      return openSession(context, type, record);
+    },
+    async signIn(input) {
+      const where = at("signIn");
+      const rule = passwordRule(where);
+      const hasher = requireHasher(context, where);
+      const login = input?.[rule.login];
+      const password = input?.password;
+      const record = typeof login === "string" ? await store.users.findUserByLogin(type.name, rule.normalize(login)) : null;
+      const refuse = (reason) => new CredentialError2("CREDENTIALS_INVALID", `${where}: the login and the password do not match`, { reason, userType: type.name });
+      if (record === null || record.password === null) {
+        await hasher.verify(String(password), await context.dummyHash());
+        throw refuse(record === null ? "unknownLogin" : "noPassword");
+      }
+      if (!await passwordMatches(context, record, String(password), where)) {
+        throw refuse("wrongPassword");
+      }
+      if (!record.active) {
+        throw new UserInactiveError2(`${where}: the user is inactive`, {
+          userId: record.id,
+          userType: type.name
+        });
+      }
+      return openSession(context, type, await rehashed(context, record, String(password)));
+    },
+    async findByLogin(login) {
+      const rule = passwordRule(at("findByLogin"));
+      const record = await store.users.findUserByLogin(type.name, rule.normalize(login));
+      return record === null ? null : toUser(record);
+    },
+    async setPassword(user, password, options) {
+      const where = at("setPassword");
+      passwordRule(where);
+      checkPassword(type, password, where);
+      const hash = await requireHasher(context, where).hash(password);
+      return toUser(await writeUser(context, user, type, options, where, (_, now) => ({
+        password: { hash, updatedAt: now }
+      })));
+    },
+    async changePassword(user, change, options) {
+      const where = at("changePassword");
+      passwordRule(where);
+      checkPassword(type, change?.next, where);
+      const hasher = requireHasher(context, where);
+      return toUser(await writeUser(context, user, type, options, where, async (record, now) => {
+        if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
+          throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
+            reason: record.password === null ? "noPassword" : "wrongPassword",
+            userId: record.id,
+            userType: type.name
+          });
+        }
+        return {
+          password: {
+            hash: await hasher.hash(change.next),
+            updatedAt: now
+          }
+        };
+      }));
+    },
+    verifyEmail: {
+      async send(user) {
+        const where = at("verifyEmail.send");
+        const record = await getRecord(context, idOf(user), type.name, where);
+        return issue("verifyEmail", record, where);
+      },
+      async confirm(secret) {
+        const where = at("verifyEmail.confirm");
+        const { user } = await redeem("verifyEmail", secret, where);
+        return toUser(await writeUser(context, user.id, type, undefined, where, (_, now) => ({
+          emailVerifiedAt: now
+        })));
+      }
+    },
+    resetPassword: {
+      async request(email) {
+        const where = at("resetPassword.request");
+        passwordRule(where);
+        const wanted = normalizeEmail(String(email));
+        const record = await store.users.findUserByLogin(type.name, wanted);
+        const held = record === null ? null : emailOf(type, record.fields);
+        if (record === null || held === null || normalizeEmail(held) !== wanted) {
+          return null;
+        }
+        const issued = await issue("resetPassword", record, where);
+        return { ...issued, user: toUser(record) };
+      },
+      async confirm(secret, password) {
+        const where = at("resetPassword.confirm");
+        passwordRule(where);
+        checkPassword(type, password, where);
+        const hash = await requireHasher(context, where).hash(password);
+        const { user } = await redeem("resetPassword", secret, where);
+        const written = await writeUser(context, user.id, type, undefined, where, (record, now) => ({
+          password: { hash, updatedAt: now },
+          ...record.emailVerifiedAt === null ? { emailVerifiedAt: now } : {}
+        }));
+        await store.sessions.revokeUserSessions(written.id, clock.now());
+        return toUser(written);
+      }
+    }
+  };
+}
+
+// src/auth/janus.ts
+function janus(config) {
+  const where = "janus";
+  const resolved = resolveConfig(config, where);
+  const capabilities = assertStores(config.store, where);
+  const hasher = config.hasher ?? null;
+  const verifiers = [
+    ...hasher === null ? [] : [hasher],
+    ...config.verifiers ?? []
+  ];
+  const prefixes = new Set;
+  for (const verifier of verifiers) {
+    if (typeof verifier?.prefix !== "string" || verifier.prefix === "") {
+      throw new TypeError(`${where}: every hasher needs a non-empty prefix`);
+    }
+    if (prefixes.has(verifier.prefix)) {
+      throw new TypeError(`${where}: two hashers claim the prefix "${verifier.prefix}" — which one verifies would depend on their order`);
+    }
+    prefixes.add(verifier.prefix);
+  }
+  const relations = config.relations ?? null;
+  if (relations !== null && typeof relations.deleteEntity !== "function") {
+    throw new TypeError(`${where}: relations must be a relation store — relations.deleteEntity is missing`);
+  }
+  const context = createContext(resolved, guardStores(config.store), relations === null ? null : guardRelations(relations), capabilities, config.clock ?? systemClock, hasher, verifiers);
+  const shared = sharedApi(context);
+  const types = Object.fromEntries([...resolved.types.values()].map((type) => [
+    type.name,
+    typeApi(context, type)
+  ]));
+  const surface = resolved.single ? { ...shared, ...types.user } : { ...shared, ...types };
+  return surface;
+}
+export {
+  CredentialError2 as CredentialError,
+  DEFAULT_PAGE_SIZE2 as DEFAULT_PAGE_SIZE,
+  InvalidCursorError2 as InvalidCursorError,
+  JanusError2 as JanusError,
+  MAX_PAGE_SIZE2 as MAX_PAGE_SIZE,
+  NotFoundError2 as NotFoundError,
+  PermissionDepthError2 as PermissionDepthError,
+  StoreConflict2 as StoreConflict,
+  StoreFailure2 as StoreFailure,
+  TokenError2 as TokenError,
+  UnsupportedError2 as UnsupportedError,
+  UserInactiveError2 as UserInactiveError,
+  UserInvalidError2 as UserInvalidError,
+  assertStores,
+  bunHasher,
+  createMemoryStores2 as createMemoryStores,
+  fixedClock,
+  formatEntity2 as formatEntity,
+  formatSubject2 as formatSubject,
+  formatTuple2 as formatTuple,
+  invalidCursor2 as invalidCursor,
+  isId2 as isId,
+  isSubjectSet2 as isSubjectSet,
+  janus,
+  mintId2 as mintId,
+  mintedAt2 as mintedAt,
+  pageLimit2 as pageLimit,
+  parseDuration,
+  parseSubject2 as parseSubject,
+  parseTuple2 as parseTuple,
+  scryptHasher,
+  subjectOf2 as subjectOf,
+  systemClock
+};
+
+//# debugId=ED5A2746E84B20BA64756E2164756E21
+//# sourceMappingURL=index.js.map