@nxgt/janus 0.1.0

package/dist/auth/config.d.ts

@@ -0,0 +1,201 @@
+/**
+ * What `janus()` accepts, and how it is resolved at run time.
+ *
+ * The types refuse first, on the offending key (`checks.ts`). What follows at
+ * run time is the net for JavaScript callers, and every refusal is a bare
+ * `TypeError`: a configuration is written when the application is wired, never
+ * from a request.
+ */
+import type { RelationStore } from '../permissions/port/types';
+import type { Clock } from '../time/clock';
+import { type Duration } from '../time/duration';
+import type { JanusStores } from './port/types';
+import type { StandardSchemaV1 } from './standard-schema';
+/**
+ * How a login is normalised before any store sees it. `'lowercaseTrim'` when
+ * absent — right for an e-mail and for most usernames.
+ *
+ * A function is accepted for anything else. It must be deterministic: the same
+ * rule normalises at sign-up and at sign-in.
+ */
+export type Normalize = 'none' | 'lowercase' | 'lowercaseTrim' | 'nfkcLowercaseTrim' | ((value: string) => string);
+/**
+ * What a user schema may produce: JSON, where an object property may also be
+ * `undefined` — which is what every validator's optional field produces.
+ *
+ * The core drops an `undefined` property before a store sees the fields, so the
+ * port stays strict JSON: an optional field left out is **absent** in the
+ * store, and reads back absent, which the schema's output type already allows.
+ */
+export type FieldsJson = string | number | boolean | null | readonly FieldsJson[] | {
+    readonly [key: string]: FieldsJson | undefined;
+};
+/**
+ * A user type's schema: any Standard Schema — Zod 4, Valibot, ArkType — whose
+ * output is an object of JSON. A `Date` round-trips through one store and not
+ * the next, so a schema that produces one is refused at compile time.
+ */
+export type UserSchema = StandardSchemaV1<unknown, {
+    readonly [key: string]: FieldsJson | undefined;
+}>;
+/**
+ * A password hashing scheme — the second port.
+ *
+ * Hashes are self-describing, so **every wired hasher can verify, and exactly
+ * one hashes** new passwords. A database written under Bun reads under Node and
+ * back, as long as a verifier for each prefix is wired.
+ */
+export interface PasswordHasher {
+    /** The prefix every hash it writes starts with: `'$argon2id$'`, `'$scrypt$'`. */
+    readonly prefix: string;
+    hash(plain: string): Promise<string>;
+    verify(plain: string, hash: string): Promise<boolean>;
+    /**
+     * Whether a hash **this hasher** wrote should be written again: its
+     * parameters are not the ones `hash` uses now — a raised `cost`, say.
+     * Optional; without it only a hash from another hasher (a `verifiers` one)
+     * is rewritten. Called with hashes carrying this hasher's prefix only.
+     */
+    needsRehash?(hash: string): boolean;
+}
+/** Signing in with a password. */
+export interface PasswordConfig {
+    /**
+     * The field users sign in with: a **top-level, required string** field of
+     * the schema — `'email'`, `'username'`. A typo is a compile error.
+     */
+    readonly login: string;
+    /** `'lowercaseTrim'` when absent. */
+    readonly normalize?: Normalize;
+    /** At least 1. `8` when absent. */
+    readonly minLength?: number;
+}
+/** How long a session lives, and when it is renewed. */
+export interface SessionConfig {
+    /** `'7d'` when absent. */
+    readonly lifespan?: Duration;
+    /**
+     * `authenticate` renews a session once this much has passed since it was
+     * opened or last renewed — a sliding session, written at most once per
+     * period. `'1d'` when absent; `false` for a fixed lifespan.
+     */
+    readonly renewAfter?: Duration | false;
+}
+/** One kind of user: its schema, and how it signs in. */
+export interface UserTypeConfig {
+    readonly schema: UserSchema;
+    readonly password?: PasswordConfig;
+    /**
+     * The field holding the user's e-mail, which `verifyEmail` and
+     * `resetPassword` send to. `'email'` when absent — and when the schema has
+     * no required string `email` either, those two flows do not exist on the
+     * type.
+     */
+    readonly email?: string;
+    readonly session?: SessionConfig;
+    /**
+     * Recorded on every user written, and read by nothing yet. Bump it when the
+     * schema tightens, and the users validated against the old one can be found.
+     * `'1'` when absent.
+     */
+    readonly schemaVersion?: string;
+}
+/** The session cookie. Every default is the strict one. */
+export interface CookieConfig {
+    /** `'janus-session'` when absent. A cookie-name token: no space, no `;`, no `=`. */
+    readonly name?: string;
+    readonly domain?: string;
+    /** `'/'` when absent. */
+    readonly path?: string;
+    /** `'lax'` when absent. */
+    readonly sameSite?: 'lax' | 'strict' | 'none';
+    /** `true` when absent. `sameSite: 'none'` requires it. */
+    readonly secure?: boolean;
+}
+interface SharedConfig {
+    /** The three stores: `createMemoryStores()`, or an adapter's. */
+    readonly store: JanusStores;
+    /**
+     * The relation store `permissions()` is given, when the application has
+     * one. Wired here, deleting a user deletes every tuple naming them too — as
+     * a subject, and through no one else's memory of it.
+     */
+    readonly relations?: RelationStore;
+    /**
+     * Hashes new passwords. **Required as soon as a type signs in with a
+     * password** — there is no silent fallback. `scryptHasher()` runs on Node and
+     * Bun; `bunHasher()` is argon2id, on Bun only.
+     */
+    readonly hasher?: PasswordHasher;
+    /** Hashers that only verify: those a database was written with before. */
+    readonly verifiers?: readonly PasswordHasher[];
+    readonly clock?: Clock;
+    readonly cookie?: CookieConfig;
+    readonly tokens?: {
+        /** `'24h'` when absent. */
+        readonly verifyEmail?: Duration;
+        /** `'1h'` when absent. */
+        readonly resetPassword?: Duration;
+    };
+}
+/** An application with one kind of user: `user` is its schema. */
+export interface SingleTypeConfig extends SharedConfig, Omit<UserTypeConfig, 'schema'> {
+    readonly user: UserSchema;
+    readonly users?: never;
+}
+/** An application with several kinds of user — patients and staff. */
+export interface MultiTypeConfig extends SharedConfig {
+    readonly users: {
+        readonly [type: string]: UserTypeConfig;
+    };
+    readonly user?: never;
+    readonly password?: never;
+    readonly email?: never;
+    readonly session?: never;
+    readonly schemaVersion?: never;
+}
+export type JanusConfig = SingleTypeConfig | MultiTypeConfig;
+/** The type name the single-type form gives its users. */
+export declare const SINGLE_TYPE = "user";
+/**
+ * Keys `janus` sets on every user, so a schema may not declare them.
+ * `password` too: it is taken beside the fields, and never stored among them.
+ */
+export declare const RESERVED_FIELDS: readonly ["id", "type", "emailVerified", "active", "hasPassword", "version", "createdAt", "updatedAt", "password"];
+/** Names on `janus()`'s answer, so a user type may not take one. */
+export declare const RESERVED_TYPES: readonly ["authenticate", "signOut", "signOutEverywhere", "findUser", "getUser", "cookie", "collectExpired", "types"];
+/** One user type, with every default applied and every duration in milliseconds. */
+export interface ResolvedType {
+    readonly name: string;
+    readonly schema: UserSchema;
+    readonly schemaVersion: string;
+    readonly password: {
+        readonly login: string;
+        readonly normalize: (value: string) => string;
+        readonly minLength: number;
+    } | null;
+    readonly email: string;
+    readonly lifespanMs: number;
+    readonly renewAfterMs: number | null;
+}
+export interface ResolvedConfig {
+    readonly single: boolean;
+    readonly types: ReadonlyMap<string, ResolvedType>;
+    readonly tokenTtlMs: {
+        readonly verifyEmail: number;
+        readonly resetPassword: number;
+    };
+    readonly cookie: {
+        readonly name: string;
+        readonly domain: string | null;
+        readonly path: string;
+        readonly sameSite: 'lax' | 'strict' | 'none';
+        readonly secure: boolean;
+    };
+}
+/** How an e-mail is compared: always the same rule, whatever the login's. */
+export declare const normalizeEmail: (value: string) => string;
+/** Applies the defaults and refuses what cannot be wired. `where` names the call. */
+export declare function resolveConfig(config: JanusConfig, where: string): ResolvedConfig;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,KAAK,QAAQ,EAAiB,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAClB,MAAM,GACN,WAAW,GACX,eAAe,GACf,mBAAmB,GACnB,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GACnB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,UAAU,EAAE,GACrB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,gBAAgB,CACxC,OAAO,EACP;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAClD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;;;OAKG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACpC;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC7B,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;CACvC;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;KAClC,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE7D,0DAA0D;AAC1D,eAAO,MAAM,WAAW,SAAS,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,eAAe,oHAUlB,CAAC;AAEX,oEAAoE;AACpE,eAAO,MAAM,cAAc,uHASjB,CAAC;AAEX,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF;AAUD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,UANH,MAAM,WAMyB,CAAC;AAQxD,qFAAqF;AACrF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,cAAc,CAoEhB"}

package/dist/auth/context.d.ts

@@ -0,0 +1,87 @@
+/**
+ * What every operation of the core shares: the resolved configuration, the
+ * guarded stores, the clock, the hashers — and the handful of steps every
+ * operation takes the same way.
+ *
+ * Internal and degenericised: fields are a `JsonObject` here, and `janus()`
+ * casts once, at the boundary, after the schema has validated them.
+ */
+import type { RelationStore } from '../permissions/port/types';
+import type { Clock } from '../time/clock';
+import { type PasswordHasher, type ResolvedConfig, type ResolvedType } from './config';
+import type { JanusStores, JsonObject, StoreCapabilities, UserPatch, UserRecord } from './port/types';
+import type { User, UserRef, WriteOptions } from './types';
+export interface Context {
+    readonly config: ResolvedConfig;
+    /** Already guarded by `outage.ts`. */
+    readonly store: JanusStores;
+    /** Already guarded. `null` when no relation store is wired. */
+    readonly relations: RelationStore | null;
+    readonly capabilities: StoreCapabilities;
+    readonly clock: Clock;
+    readonly hasher: PasswordHasher | null;
+    /** The hasher first, then every verifier: whoever claims a prefix verifies it. */
+    readonly verifiers: readonly PasswordHasher[];
+    /** Hashed once, lazily: what a missing user's password is compared against. */
+    dummyHash(): Promise<string>;
+}
+export declare function createContext(config: ResolvedConfig, store: JanusStores, relations: RelationStore | null, capabilities: StoreCapabilities, clock: Clock, hasher: PasswordHasher | null, verifiers: readonly PasswordHasher[]): Context;
+/** A user of any type, as the degenericised core handles them. */
+export type AnyUser = User<string, Record<string, unknown>>;
+/**
+ * A user as application code sees it: their fields at the top level, then
+ * what `janus` sets — written last, so no stored key can shadow it. No password
+ * hash, ever.
+ */
+export declare function toUser(record: UserRecord): AnyUser;
+/** The id a {@link UserRef} names. */
+export declare const idOf: (user: UserRef) => string;
+/**
+ * Validates fields against the type's schema, and answers them as the port
+ * holds them: an `undefined` property dropped, at every depth.
+ */
+export declare function validateFields(type: ResolvedType, input: unknown, where: string): Promise<JsonObject>;
+/** The user's e-mail, as stored, or `null` when the schema let it be absent. */
+export declare function emailOf(type: ResolvedType, fields: JsonObject): string | null;
+/**
+ * What a user signs in with, normalised: the login field, by its own rule,
+ * and the e-mail, by the e-mail rule — so a user whose login is a username can
+ * still be found by the e-mail a reset is requested for.
+ */
+export declare function loginsOf(type: ResolvedType, fields: JsonObject): string[];
+/** Refuses a password shorter than the policy. Reports the policy, never the password. */
+export declare function checkPassword(type: ResolvedType, password: string, where: string): void;
+/** The hasher. `janus()` refused a password type without one, so this is a wiring net. */
+export declare function requireHasher(context: Context, where: string): PasswordHasher;
+/**
+ * Whether `password` matches the stored hash. A hash whose prefix no wired
+ * verifier claims is `HASH_UNSUPPORTED`, reporting the prefix, never the hash.
+ */
+export declare function passwordMatches(context: Context, record: UserRecord, password: string, where: string): Promise<boolean>;
+/**
+ * The record, with its password hash rewritten by the current hasher when the
+ * stored one is stale: written by another hasher — a `verifiers` one — or by
+ * this one with other parameters. Called only once `password` has matched.
+ *
+ * The rewrite is conditioned on the version just read. Losing that race to a
+ * concurrent update is not the sign-in's failure: the record is answered as
+ * read, and the next sign-in tries again. A store failure still throws.
+ */
+export declare function rehashed(context: Context, record: UserRecord, password: string): Promise<UserRecord>;
+/**
+ * The user — of this type, when one is given — or `null`. A malformed id is an
+ * absence decided without reaching the store: it arrives off a URL, and it is
+ * "no such user", not a query and not an outage. A user of another type is
+ * absent too: `auth.staff.find(patientId)` finds nobody.
+ */
+export declare function findRecord(context: Context, id: string, type: string | null): Promise<UserRecord | null>;
+/** The user, or `NOT_FOUND`. */
+export declare function getRecord(context: Context, id: string, type: string | null, where: string): Promise<UserRecord>;
+/**
+ * One write that follows a read, under a version: the core reads the user,
+ * checks `ifVersion` against what it read, computes the patch from the record,
+ * and writes under the version it read. A user who changed in between is
+ * `VERSION_CONFLICT`, and nothing is written.
+ */
+export declare function writeUser(context: Context, user: UserRef, type: ResolvedType, options: WriteOptions | undefined, where: string, patchOf: (record: UserRecord, now: Date) => Omit<UserPatch, 'updatedAt'> | Promise<Omit<UserPatch, 'updatedAt'>>): Promise<UserRecord>;
+//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/auth/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAEN,KAAK,cAAc,EAEnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EACX,WAAW,EAEX,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE3D,MAAM,WAAW,OAAO;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IAC9C,+EAA+E;IAC/E,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,wBAAgB,aAAa,CAC5B,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,aAAa,GAAG,IAAI,EAC/B,YAAY,EAAE,iBAAiB,EAC/B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,SAAS,EAAE,SAAS,cAAc,EAAE,GAClC,OAAO,CAmBT;AAED,kEAAkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAYlD;AAED,sCAAsC;AACtC,eAAO,MAAM,IAAI,GAAI,MAAM,OAAO,KAAG,MACK,CAAC;AAE3C;;;GAGG;AACH,wBAAsB,cAAc,CACnC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAkCrB;AAuBD,gFAAgF;AAChF,wBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAG7E;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,EAAE,CAiBzE;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAC5B,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACX,IAAI,CASN;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAO7E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CAyBrB;AAUD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC/B,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GAAG,IAAI,GACjB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM5B;AAED,gCAAgC;AAChC,wBAAsB,SAAS,CAC9B,OAAO,EAAE,OAAO,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CACR,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,IAAI,KACL,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,GACvE,OAAO,CAAC,UAAU,CAAC,CAyBrB"}

package/dist/auth/hashers.d.ts

@@ -0,0 +1,35 @@
+import type { PasswordHasher } from './config';
+/**
+ * scrypt through `node:crypto` — the hasher that runs **everywhere**: Node and
+ * Bun both implement it, and it needs no dependency.
+ *
+ * Measured before choosing it: `bun build --target node` leaves `Bun.password`
+ * in the output as it is — a target changes the bundle's format, not which
+ * APIs exist — and `crypto.argon2` is absent from Node 22. scrypt is the one
+ * memory-hard function both runtimes ship.
+ *
+ * The defaults are OWASP's: N = 2^17, r = 8, p = 1, about 128 MiB per hash.
+ * The parameters are written into the hash —
+ * `$scrypt$ln=17,r=8,p=1$<salt>$<key>` — and read back from it to verify, so
+ * raising `cost` later leaves every existing hash readable.
+ *
+ * `cost` is log2(N). Lower it only in tests: 10 is fast and still exercises
+ * every line.
+ *
+ * A hash written with other parameters than these is rewritten with these the
+ * next time its owner signs in (`needsRehash`), so raising `cost` reaches every
+ * active user without a migration.
+ */
+export declare function scryptHasher(options?: {
+    readonly cost?: number;
+}): PasswordHasher;
+/**
+ * argon2id through `Bun.password`.
+ *
+ * **Loaded only when named**: nothing reads `Bun` until this function is called,
+ * so the package imports cleanly under Node. On Node, `scryptHasher()` is the
+ * hasher; a hash written here reads anywhere a verifier for `$argon2id$` is
+ * wired, so a database can move between the two runtimes.
+ */
+export declare function bunHasher(): PasswordHasher;
+//# sourceMappingURL=hashers.d.ts.map

package/dist/auth/hashers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashers.d.ts","sourceRoot":"","sources":["../../src/auth/hashers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,cAAc,CAoDjB;AA+BD;;;;;;;GAOG;AACH,wBAAgB,SAAS,IAAI,cAAc,CAkB1C"}

package/dist/auth/index.d.ts

@@ -0,0 +1,9 @@
+export type { CookieConfig, FieldsJson, JanusConfig, MultiTypeConfig, Normalize, PasswordConfig, PasswordHasher, SessionConfig, SingleTypeConfig, UserSchema, UserTypeConfig, } from './config';
+export { bunHasher, scryptHasher } from './hashers';
+export { janus } from './janus';
+export { assertStores } from './port/assert-stores';
+export { createMemoryStores } from './port/memory';
+export type { JanusStores, Json, JsonObject, PasswordRecord, SessionId, SessionRecord, SessionStore, StoreCapabilities, TokenKind, TokenRecord, TokenStore, UserPageRequest, UserPatch, UserRecord, UserStore, } from './port/types';
+export type { StandardSchemaV1 } from './standard-schema';
+export type { Authenticated, Checked, EmailOf, HeaderRecord, IssuedToken, Janus, LoginOf, PasswordApi, RequestLike, RequiredStringKeys, ResetPasswordApi, Session, SharedApi, SignedIn, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}

package/dist/auth/janus.d.ts

@@ -0,0 +1,38 @@
+import { type JanusConfig } from './config';
+import type { Checked, Janus } from './types';
+/**
+ * Wires authentication over the store the application opened. **Synchronous,
+ * and does no I/O**: it connects to nothing.
+ *
+ * ```ts
+ * // One kind of user
+ * const auth = janus({
+ *   user: z.object({ email: z.email(), name: z.string() }),
+ *   password: { login: 'email' },
+ *   store: createMemoryStores(),
+ *   hasher: scryptHasher(),
+ * });
+ * const { user, token } = await auth.signUp({ email, name, password });
+ *
+ * // Several
+ * const auth = janus({
+ *   users: {
+ *     patient: { schema: Patient, password: { login: 'email' } },
+ *     staff: { schema: Staff, password: { login: 'email' }, session: { lifespan: '8h' } },
+ *   },
+ *   store, hasher,
+ * });
+ * await auth.staff.signIn({ email, password });
+ * const current = await auth.authenticate(request, { type: 'staff' });
+ * ```
+ *
+ * The types refuse first, on the offending key: a login or an e-mail that
+ * names no required string field, a schema declaring a field `janus` sets, a
+ * user type named like a method. What follows at run time is the net for
+ * JavaScript callers, each a bare `TypeError` because only wiring produces one:
+ * a store slot missing or incomplete; a password type with no hasher — there
+ * is no silent fallback; two hashers claiming the same prefix, which would make
+ * verification depend on the order they were listed in.
+ */
+export declare function janus<const C extends JanusConfig>(config: C & Checked<C>): Janus<C>;
+//# sourceMappingURL=janus.d.ts.map

package/dist/auth/janus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"janus.d.ts","sourceRoot":"","sources":["../../src/auth/janus.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,UAAU,CAAC;AAK3D,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,WAAW,EAChD,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACpB,KAAK,CAAC,CAAC,CAAC,CAyDV"}

package/dist/auth/outage.d.ts

@@ -0,0 +1,61 @@
+/**
+ * **The one place a store call is caught, and the one place a `null` becomes an
+ * error.**
+ *
+ * The transposition of `call.ts` in `nxgt-ory`'s SDK — "the only place a call
+ * is unwrapped" — into a core with no status codes. The invariant this whole
+ * package is built around is checked by reading this file:
+ *
+ * > An absence is `null`. A failure throws.
+ *
+ * `outage.spec.ts` reads every other file of `src/auth/` and fails if a
+ * `catch` appears in one, because the failure this design exists to prevent is
+ * a single careless `catch { return null }`. There are two `catch`es below: the
+ * guard's always rethrows, and {@link unlessVersionConflict}'s absorbs one
+ * named conflict and rethrows everything else. The spec holds both to that.
+ */
+import { type JanusError } from '../errors/janus-error';
+import type { RelationStore } from '../permissions/port/types';
+import type { JanusStores } from './port/types';
+/**
+ * The stores, with every method guarded.
+ *
+ * - A `JanusError` the adapter threw — `StoreFailure`, `StoreConflict`,
+ *   `NotFoundError` — passes through untouched, so `instanceof` still holds.
+ * - **Anything else it threw is a failure**: a driver error, a `TypeError` from
+ *   a bug in the adapter, a string. It becomes `StoreFailure` with the original
+ *   as `cause`, naming the slot and the method. It is never an absence.
+ * - A method that answers `undefined` where the port says `null` is a store
+ *   that forgot to answer, and becomes `StoreFailure` rather than "not found".
+ *   Rule 2 of the port, enforced at run time for the JavaScript adapter the
+ *   compiler never saw.
+ *
+ * The optional `deleteExpiredSessions` is guarded when present and left absent
+ * when absent, so capability detection still reads the truth.
+ */
+export declare function guardStores(stores: JanusStores): JanusStores;
+/**
+ * The relation store, guarded the same way: the permission engine's only way
+ * to a store, so a failure there is `STORE_FAILED` and never a denial.
+ */
+export declare function guardRelations(store: RelationStore): RelationStore;
+/**
+ * A value the caller requires, or the refusal an absence deserves.
+ *
+ * The only place in the core where a `null` from a store turns into an error —
+ * `get` becoming `NOT_FOUND`. Written as a function so that the conversion is
+ * visible at every call site and nowhere else.
+ */
+export declare function required<T>(value: T | null, absent: () => JanusError): T;
+/**
+ * A write that may lose a race, and is allowed to: its answer, or `null` when
+ * the record's version moved under it.
+ *
+ * **Only `StoreConflict('version')` is absorbed.** A failure still throws, a
+ * taken login still throws, `NOT_FOUND` still throws: an outage never reads as
+ * "somebody else wrote first". It exists for writes the caller did not ask for
+ * — rewriting a password hash on sign-in — where losing to a concurrent update
+ * means only that the next sign-in tries again.
+ */
+export declare function unlessVersionConflict<T>(write: Promise<T>): Promise<T | null>;
+//# sourceMappingURL=outage.d.ts.map

package/dist/auth/outage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outage.d.ts","sourceRoot":"","sources":["../../src/auth/outage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACN,KAAK,UAAU,EAIf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAWhD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAM5D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAElE;AA+DD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,UAAU,GAAG,CAAC,CAGxE;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC5C,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOnB"}

package/dist/auth/port/assert-stores.d.ts

@@ -0,0 +1,16 @@
+import type { StoreCapabilities } from './types';
+/**
+ * Checks that every slot answers every method the port declares, and reports
+ * the optional capabilities found.
+ *
+ * TypeScript already refuses a partial store and names the missing method;
+ * this is the net for a JavaScript caller, and for a store assembled from
+ * `any`. A bare `TypeError`, because a missing method can only come from how
+ * the application was wired — no request produces one, and no handler should
+ * answer one.
+ *
+ * `where` names the call the consumer wrote — `janus` — so the
+ * sentence says which call to fix and which slot to change.
+ */
+export declare function assertStores(stores: unknown, where: string): StoreCapabilities;
+//# sourceMappingURL=assert-stores.d.ts.map

package/dist/auth/port/assert-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/port/assert-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AA6B9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,CAmCnB"}

package/dist/auth/port/memory.d.ts

@@ -0,0 +1,25 @@
+import type { JanusStores } from './types';
+/**
+ * The reference implementation of the store port, in memory.
+ *
+ * **Shipped and documented, not a test helper.** It is what a consumer uses in
+ * their own unit tests, and what an adapter author compares against when a
+ * conformance case they do not understand turns red. So it keeps the six rules
+ * for real rather than approximately:
+ *
+ * - uniqueness is a constraint — an index checked and written inside the same
+ *   synchronous step, which is what atomic means on one event loop;
+ * - `consumeToken` reads and writes with no `await` between the two, so twenty
+ *   concurrent calls see exactly one unspent token;
+ * - every record is **copied in and copied out**, so a caller that mutates what
+ *   it passed or what it got back cannot reach the store — the in-memory
+ *   version of "bytes round-trip";
+ * - a patch applies only the fields it names, and only the fields the port
+ *   declares: a stray `version` or `id` in a patch from JavaScript is ignored,
+ *   not written.
+ *
+ * Every method is `async` even though none waits on anything: a caller that
+ * forgot an `await` must fail here the way it would against a real database.
+ */
+export declare function createMemoryStores(): JanusStores;
+//# sourceMappingURL=memory.d.ts.map

package/dist/auth/port/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/auth/port/memory.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,WAAW,EASX,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,CAMhD"}