@nxgt/janus 0.1.0

package/dist/auth/port/types.d.ts

@@ -0,0 +1,393 @@
+/**
+ * The store port: what an adapter implements, and nothing else.
+ *
+ * **This is the contract strangers are asked to implement**, so every line of
+ * it is a promise. It is small on purpose — anything the core can derive from
+ * what the port already offers (merging fields, deciding that an e-mail is no
+ * longer verified, deciding that a session has lapsed) lives in the core, where
+ * it is written once, rather than here, where every adapter would write it
+ * again, differently.
+ *
+ * ## The six rules an implementation keeps
+ *
+ * All of them are checked by `@nxgt/janus/conformance`.
+ *
+ * 1. **An absence is `null`. A failure throws.** A method that can
+ *    legitimately find nothing answers `null`, `false`, `0` or an empty page.
+ *    Everything else — a refused connection, a timeout, a primary stepping
+ *    down, a bug in the adapter — **throws**, preferably `StoreFailure` with
+ *    the driver error as `cause`. Never write `try { … } catch { return null }`
+ *    in an implementation of this port: that one line turns an outage into
+ *    "no such account", and every caller above it answers 404 to somebody
+ *    whose account exists.
+ * 2. **`null`, not `undefined`.** `undefined` is what a missing property and a
+ *    function with no `return` both produce, so a store that forgot to answer
+ *    would report "not found" by accident. `null` has to be written on purpose.
+ * 3. **Uniqueness is yours, and it is a constraint.** A unique index, a
+ *    constraint, an atomic `SET NX` — never a read followed by a write, which
+ *    two concurrent sign-ups both pass.
+ * 4. **Bytes round-trip.** Logins, hashes and fields come back exactly as they
+ *    were written: no normalisation, no trimming, no `1` turned into `'1'`. The
+ *    core normalises a login before a store ever sees it, so uniqueness is
+ *    uniqueness of bytes and no adapter needs a collation.
+ * 5. **Every method is atomic on its own.** Nothing composes into a
+ *    transaction, and the core never opens one. An adapter may open one
+ *    *inside* a method — a normalised SQL schema writes several rows per
+ *    user — but the port exposes none.
+ * 6. **Schema management is not on this interface.** An adapter exposes its own
+ *    `sync()`; the core never calls it.
+ *
+ * ## Why three stores and not one
+ *
+ * The seam is **where atomicity is not required**. A user and their password
+ * are written together — a sign-up that stores the user and loses the hash is
+ * an account nobody can enter — so they are one record. A session is derived
+ * state: losing them all signs everybody out, which recovers. A one-time token
+ * is ephemeral by construction. So `sessions` and `tokens` may live in Redis
+ * while `users` lives in MongoDB, with no distributed transaction anywhere.
+ *
+ * ## Why the port is not generic
+ *
+ * A store does not know the application's schemas, and must not have to:
+ * fields are a {@link JsonObject} here, and the core casts once, at the
+ * boundary, after the schema has validated them. That is the shape `nxgt-data`
+ * uses — a generic public form, a degenericised mirror inside — and it keeps
+ * every adapter free of type parameters it could only pass through.
+ */
+import type { Id } from '../../ids/id';
+import type { CursorPage } from '../../pagination/cursor-page';
+/**
+ * A value a store must be able to round-trip byte for byte.
+ *
+ * JSON and nothing else. A `Date` inside fields round-trips through MongoDB and
+ * not through a JSON column or Redis, so an adapter could pass the conformance
+ * suite on one database and corrupt fields on the next. The record's own
+ * timestamps are `Date`s, because every adapter stores those in a column it
+ * chose for them.
+ */
+export type Json = string | number | boolean | null | readonly Json[] | JsonObject;
+/**
+ * An object of {@link Json} values.
+ *
+ * An `interface` declared by the application is not assignable to this — an
+ * index signature is only satisfied by a type alias. The core never asks a
+ * caller to write one: it casts at the boundary, after validation.
+ */
+export type JsonObject = {
+    readonly [key: string]: Json;
+};
+/** A password, as the store holds it: a self-describing hash, never the plain text. */
+export interface PasswordRecord {
+    /** Self-describing — `$argon2id$…`, `$scrypt$…` — so any wired verifier can read it. */
+    readonly hash: string;
+    readonly updatedAt: Date;
+}
+/**
+ * A user, as a store holds it.
+ *
+ * Everything is `readonly`: the core hands records to application code, and a
+ * mutation would not reach the store — it could only mislead whoever wrote it.
+ */
+export interface UserRecord {
+    /** A UUIDv7 minted by the core. The store never mints an id. */
+    readonly id: Id;
+    /**
+     * Which of the application's user types — `'patient'`, `'staff'`, or
+     * `'user'` when it declares one. Never changes after insertion.
+     */
+    readonly type: string;
+    /**
+     * Which version of the type's schema these fields were last validated
+     * against.
+     *
+     * **Nothing reads it yet**, and it is here from v1 on purpose. Tightening a
+     * schema changes what an update accepts, and every stored user was validated
+     * against the old one: without this field there is no way to find the users
+     * that are now unmodifiable. Adding a field to the port later breaks every
+     * adapter; adding it now costs one column.
+     */
+    readonly schemaVersion: string;
+    /** `false` keeps the record and its password, and refuses every sign-in. */
+    readonly active: boolean;
+    /** The application's own fields, as the type's schema validated them. */
+    readonly fields: JsonObject;
+    /**
+     * What the user signs in with, **already normalised** by the core. Unique
+     * per `type`, and that uniqueness is a constraint the store enforces
+     * (rule 3): the same e-mail may hold a patient account and a staff account,
+     * and never two of either.
+     */
+    readonly logins: readonly string[];
+    /** `null` when the user has no password. */
+    readonly password: PasswordRecord | null;
+    /**
+     * When the user proved they hold their current e-mail, or `null`. The core
+     * sets it back to `null` in the same write that changes the e-mail.
+     */
+    readonly emailVerifiedAt: Date | null;
+    /**
+     * `0` at insertion, and one more on every accepted write. What
+     * {@link UserStore.updateUser}'s `ifVersion` is compared against.
+     */
+    readonly version: number;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+}
+/**
+ * What one {@link UserStore.updateUser} changes.
+ *
+ * **A field the patch does not name is left as it is.** There is no full
+ * replacement of a record anywhere on this port: in Kratos, an update that
+ * omits `state` deactivates the account, and an edit form that omits a trait
+ * deletes it. A conformance case carries that trap's name.
+ *
+ * A field the patch *does* name is replaced whole — `fields` and `logins`
+ * included. A deep merge would make every adapter implement a merge on nested
+ * values, differently on every database. The core computes the next value from
+ * the record it just read, under `ifVersion`, so no write is lost by it.
+ *
+ * `password: null` removes the password; a patch that does not name `password`
+ * keeps it.
+ *
+ * `id`, `type`, `version` and `createdAt` are not patchable. `updatedAt` is
+ * **required**, and comes from the core's clock rather than the database's, so
+ * every timestamp on a record comes from one clock.
+ *
+ * A key present with the value `undefined` is absent. This package is compiled
+ * with `exactOptionalPropertyTypes`, so the core cannot write one; an adapter
+ * receiving one from JavaScript still treats it as absent, never as an erasure.
+ */
+export interface UserPatch {
+    readonly updatedAt: Date;
+    readonly schemaVersion?: string;
+    readonly active?: boolean;
+    readonly fields?: JsonObject;
+    readonly logins?: readonly string[];
+    readonly password?: PasswordRecord | null;
+    readonly emailVerifiedAt?: Date | null;
+}
+/** Which users a page lists, where it starts, and how much of it to read. */
+export interface UserPageRequest {
+    /** Only users of this type. */
+    readonly type: string;
+    /**
+     * The last id of the previous page, or `null` for the first.
+     *
+     * Already checked by the core to be an id this package could have minted,
+     * so the store never parses a cursor. It need not name a stored user: the
+     * page is every id strictly greater than it.
+     */
+    readonly after: Id | null;
+    /** Already bounded by the core, between 1 and `MAX_PAGE_SIZE`. */
+    readonly limit: number;
+}
+/** Users and their passwords: one unit of atomicity. */
+export interface UserStore {
+    /**
+     * Stores a new user, verbatim, and answers what is stored.
+     *
+     * **Idempotent under retry.** When a user with this `id` already exists, it
+     * answers the stored record and writes nothing — a retry after a timeout
+     * whose first attempt landed is a success, not a conflict. That includes the
+     * logins: a login held by the user with this same `id` is not taken.
+     *
+     * A login held by **another** user of the same type rejects with
+     * `StoreConflict('login', …)`, carrying `login` and `userType`, and writes
+     * nothing. That refusal comes from the store's own constraint, never from a
+     * read made first.
+     */
+    insertUser(record: UserRecord): Promise<UserRecord>;
+    /** The user with this id, whatever their type, or `null`. */
+    findUser(id: Id): Promise<UserRecord | null>;
+    /**
+     * The user of this type holding this login, or `null`.
+     *
+     * `login` is compared byte for byte: the core normalised it with the same
+     * rule it used when the login was written.
+     */
+    findUserByLogin(type: string, login: string): Promise<UserRecord | null>;
+    /**
+     * One page of users of one type, in ascending id order — which is creation
+     * order.
+     *
+     * `nextCursor` is the last id of the page when more follow, and `null` on
+     * the last page. An empty store answers an empty page, never `null`.
+     */
+    listUsers(page: UserPageRequest): Promise<CursorPage<UserRecord>>;
+    /**
+     * Applies a patch, **only if the stored version is exactly `ifVersion`**,
+     * and answers the record as written, with `version` one higher.
+     *
+     * `ifVersion` is required: every update in the core comes from a record it
+     * has just read, so a version is always at hand — and an optional check is
+     * the one somebody forgets on the one write where it mattered. An adapter
+     * therefore has no unchecked path to write.
+     *
+     * Rejects, **writing nothing**, with:
+     *
+     * - `NotFoundError` when no user has this id. The one method on this port
+     *   that throws for an absence: it always follows a read, so an absence here
+     *   is a race, not an answer;
+     * - `StoreConflict('version', …)` with `expectedVersion` and
+     *   `actualVersion` when the version moved. A conditional write cannot tell
+     *   this from an absent id on its own, so the adapter reads again after a
+     *   write that matched nothing;
+     * - `StoreConflict('login', …)` when the patch's logins collide with another
+     *   user's of the same type.
+     */
+    updateUser(id: Id, patch: UserPatch, ifVersion: number): Promise<UserRecord>;
+    /**
+     * Deletes the user with this id, whatever their type, and frees their
+     * logins. `true` when there was one, `false` when there was none.
+     *
+     * **Idempotent**, so a deletion interrupted half-way can be replayed: the
+     * replay answers `false` here and goes on to the sessions and the tokens.
+     * This deletes the record only — those two are other stores', and the core
+     * deletes them next.
+     */
+    deleteUser(id: Id): Promise<boolean>;
+}
+/** A session's id: a UUIDv7 minted by the core, as a user's is. */
+export type SessionId = string;
+/**
+ * A session, as a store holds it.
+ *
+ * **No secret is stored, ever.** The core mints 32 random bytes, hands the store
+ * `sha256(secret)` as `tokenHash`, and gives the plain secret to the
+ * application once. A dump of the store cannot be replayed.
+ */
+export interface SessionRecord {
+    readonly id: SessionId;
+    /** `sha256` of the session token, hex. Unique across the store. */
+    readonly tokenHash: string;
+    readonly userId: Id;
+    /** When credentials were last presented — not when the session was last extended. */
+    readonly authenticatedAt: Date;
+    readonly expiresAt: Date;
+    /** `null` while the session stands. */
+    readonly revokedAt: Date | null;
+    readonly createdAt: Date;
+}
+/**
+ * Sessions. Derived state: losing them all signs everybody out, which recovers.
+ *
+ * **Expiry is the core's decision, not the store's.** A store may still hold a
+ * lapsed session or may already have dropped it — a TTL index is an
+ * optimisation, and this interface treats it as one. A read answers a present
+ * record **verbatim**, lapsed or revoked, and may answer `null` once its expiry
+ * has passed. What it must never do is answer a record it has *changed*.
+ */
+export interface SessionStore {
+    /**
+     * Stores a new session. Idempotent under retry: when a session with this id
+     * exists, it writes nothing.
+     */
+    insertSession(record: SessionRecord): Promise<void>;
+    /** The session whose token hashes to this, verbatim, or `null`. */
+    findSessionByTokenHash(tokenHash: string): Promise<SessionRecord | null>;
+    /**
+     * Moves `expiresAt`, **only while the session is not revoked**, and answers
+     * the record as written.
+     *
+     * `null` when there is no such session or it has been revoked — an extension
+     * racing a revocation must never bring the session back. Whether it is
+     * *allowed* to be extended yet is the core's decision, made before the call.
+     */
+    extendSession(id: SessionId, expiresAt: Date): Promise<SessionRecord | null>;
+    /**
+     * Revokes one session. `true` when the session exists — revoked by this call
+     * or already — and `false` when there is none.
+     *
+     * A session already revoked keeps its first `revokedAt`.
+     */
+    revokeSession(id: SessionId, at: Date): Promise<boolean>;
+    /**
+     * Revokes every standing session of one user, except `except` when given —
+     * "sign out everywhere else". Answers how many this call revoked; `0` is an
+     * answer, not a failure.
+     */
+    revokeUserSessions(userId: Id, at: Date, except?: SessionId): Promise<number>;
+    /**
+     * Deletes every session of one user — standing, revoked or lapsed — and
+     * answers how many. `0` is an answer, not a failure. What deleting a user
+     * calls: a revoked session still names who held it.
+     */
+    deleteUserSessions(userId: Id): Promise<number>;
+    /**
+     * **Optional capability.** Deletes every session whose `expiresAt` is at or
+     * before `before`, and answers how many.
+     *
+     * A store with its own expiry — a TTL index, a key TTL — does not implement
+     * it. The core reads its presence rather than assuming it, and
+     * `collectExpired()` throws `UNSUPPORTED`, naming this method and the
+     * `sessions` slot, when it is absent.
+     */
+    deleteExpiredSessions?(before: Date): Promise<number>;
+}
+/** What a one-time token is for. A token redeemed for the other purpose is unknown. */
+export type TokenKind = 'verifyEmail' | 'resetPassword';
+/** A one-time token, as a store holds it: its hash, never its secret. */
+export interface TokenRecord {
+    /** `sha256` of the token's secret, hex. Unique across the store. */
+    readonly tokenHash: string;
+    readonly kind: TokenKind;
+    readonly userId: Id;
+    /** The e-mail the token was sent to — the one a verification marks verified. */
+    readonly address: string;
+    readonly expiresAt: Date;
+    /** `null` until spent. Once set, never changes. */
+    readonly spentAt: Date | null;
+    readonly createdAt: Date;
+}
+/** One-time tokens. Ephemeral by construction. */
+export interface TokenStore {
+    /**
+     * Stores a new token. Idempotent under retry: when a token with this hash
+     * exists, it writes nothing.
+     */
+    insertToken(record: TokenRecord): Promise<void>;
+    /**
+     * **The most important method on this port.** Spends the token and answers
+     * it **as it was before this call**.
+     *
+     * - `spentAt: null` in the answer means *this call* spent it. Exactly one
+     *   call ever sees that.
+     * - `spentAt` set means it was already spent, and nothing was written.
+     * - `null` means no token of this `kind` has this hash — including one the
+     *   store has already dropped. A token of the other kind is not touched.
+     *
+     * **One conditional write, never a read followed by a write.** A reset code
+     * two concurrent requests both redeem is an account takeover: twenty
+     * concurrent calls must produce exactly one answer with `spentAt: null`, and
+     * the conformance suite runs exactly that. In MongoDB this is one
+     * `findOneAndUpdate` returning the document *before* the update.
+     *
+     * A lapsed token is spent all the same. Comparing `expiresAt` is the core's
+     * job, after the call, so a lapsed token can never be retried.
+     */
+    consumeToken(tokenHash: string, kind: TokenKind, at: Date): Promise<TokenRecord | null>;
+    /**
+     * Deletes every token of one user, spent or not, and answers how many.
+     * What deleting a user calls: a token holds the e-mail it was sent to, which
+     * must not outlive the user until its expiry.
+     */
+    deleteUserTokens(userId: Id): Promise<number>;
+}
+/**
+ * The three stores `janus()` takes.
+ *
+ * Each slot may come from a different adapter. That is the point of the seam:
+ * `@nxgt/janus-redis` can serve `sessions` and `tokens` while
+ * `@nxgt/janus-mongo` serves `users`.
+ */
+export interface JanusStores {
+    readonly users: UserStore;
+    readonly sessions: SessionStore;
+    readonly tokens: TokenStore;
+}
+/** What `assertStores` found beyond the required methods. */
+export interface StoreCapabilities {
+    /** Whether `sessions.deleteExpiredSessions` is implemented. */
+    readonly collectExpired: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/port/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/port/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,MAAM,IAAI,GACb,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,IAAI,EAAE,GACf,UAAU,CAAC;AAEd;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE1D,uFAAuF;AACvF,MAAM,WAAW,cAAc;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACvC;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACzB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEpD,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAElE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7E;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAED,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,mEAAmE;IACnE,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9E;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;OAQG;IACH,qBAAqB,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AAED,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,eAAe,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC5B;AAED,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CACjC"}

package/dist/auth/secrets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A fresh secret: 32 random bytes, base64url — safe in a header, a cookie and a
+ * URL without escaping.
+ *
+ * Given to the application **once**. No store ever holds it.
+ */
+export declare function mintSecret(): string;
+/**
+ * What a store holds instead of the secret: `sha256`, hex.
+ *
+ * SHA-256 and not argon2, on purpose. The secret carries 256 bits of entropy, so
+ * there is nothing to brute-force, and an argon2 per request would put ~50 ms on
+ * every authenticated call. What the hash buys is that a dump of the store
+ * cannot be replayed.
+ */
+export declare function hashSecret(secret: string): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/auth/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/auth/secrets.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,31 @@
+import type { ResolvedType } from './config';
+import { type AnyUser, type Context } from './context';
+import type { SessionRecord, UserRecord } from './port/types';
+import type { Authenticated, RequestLike, Session, SharedApi, SignedIn } from './types';
+/** `SharedApi`, degenericised: `janus()` casts it to the typed form once. */
+export type InternalSharedApi = Omit<SharedApi<AnyUser>, 'authenticate'> & {
+    authenticate(request: RequestLike, options?: {
+        readonly type?: string;
+    }): Promise<Authenticated<AnyUser> | null>;
+};
+/** A session as application code sees it: everything but the token's hash. */
+export declare function toSession(record: SessionRecord): Session;
+/**
+ * Opens a session for a user who just proved who they are. The token is in
+ * the answer and nowhere else: the store holds its hash.
+ */
+export declare function openSession(context: Context, type: ResolvedType, user: UserRecord): Promise<SignedIn<AnyUser>>;
+/** Everything `janus()` answers whatever its user types. */
+export declare function sharedApi(context: Context): InternalSharedApi;
+/**
+ * The session token a request presents: `Authorization: Bearer`, then
+ * `X-Session-Token`, then the cookie.
+ *
+ * **The first credential present wins, not the first valid one.** A browser
+ * sending a lapsed bearer beside a live cookie is anonymous, and should fix its
+ * header rather than be rescued in silence — the rule `resolve` in `nxgt-ory`'s
+ * SDK learned. An `Authorization` header of another scheme (`Basic`) is not a
+ * session credential, and does not count as one.
+ */
+export declare function presentedToken(request: RequestLike, cookieName: string): string | null;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EACX,aAAa,EAEb,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,MAAM,SAAS,CAAC;AAEjB,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG;IAC1E,YAAY,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAGxD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAe5B;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CA4G7D;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC7B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CA+Bf"}

package/dist/auth/standard-schema.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The Standard Schema interface, v1 — copied, as the specification asks.
+ *
+ * <https://standardschema.dev>. Zod 4, Valibot and ArkType implement it, so a
+ * definition accepts whichever the application already uses and this package
+ * has **no validation peer at all**. The specification is written to be copied
+ * rather than depended on: it is a type, and a type has nothing to install.
+ */
+export interface StandardSchemaV1<Input = unknown, Output = Input> {
+    readonly '~standard': StandardSchemaV1.Props<Input, Output>;
+}
+export declare namespace StandardSchemaV1 {
+    interface Props<Input = unknown, Output = Input> {
+        readonly version: 1;
+        readonly vendor: string;
+        readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
+        readonly types?: Types<Input, Output> | undefined;
+    }
+    type Result<Output> = SuccessResult<Output> | FailureResult;
+    interface SuccessResult<Output> {
+        readonly value: Output;
+        readonly issues?: undefined;
+    }
+    interface FailureResult {
+        readonly issues: ReadonlyArray<Issue>;
+    }
+    interface Issue {
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
+    }
+    interface PathSegment {
+        readonly key: PropertyKey;
+    }
+    interface Types<Input = unknown, Output = Input> {
+        readonly input: Input;
+        readonly output: Output;
+    }
+    type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['input'];
+    type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['output'];
+}
+//# sourceMappingURL=standard-schema.d.ts.map

package/dist/auth/standard-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standard-schema.d.ts","sourceRoot":"","sources":["../../src/auth/standard-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;IAChE,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;CAC5D;AAED,MAAM,CAAC,OAAO,WAAW,gBAAgB,CAAC;IACzC,UAAiB,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;QACrD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,CAClB,KAAK,EAAE,OAAO,KACV,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KAClD;IAED,KAAY,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC;IAEnE,UAAiB,aAAa,CAAC,MAAM;QACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC5B;IAED,UAAiB,aAAa;QAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;KACtC;IAED,UAAiB,KAAK;QACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,SAAS,CAAC;KACrE;IAED,UAAiB,WAAW;QAC3B,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;KAC1B;IAED,UAAiB,KAAK,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,KAAK;QACrD,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB;IAED,KAAY,UAAU,CAAC,MAAM,SAAS,gBAAgB,IAAI,WAAW,CACpE,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAC5B,CAAC,OAAO,CAAC,CAAC;IAEX,KAAY,WAAW,CAAC,MAAM,SAAS,gBAAgB,IAAI,WAAW,CACrE,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAC5B,CAAC,QAAQ,CAAC,CAAC;CACZ"}