@nxgt/janus 0.1.0

package/dist/auth/types.d.ts

@@ -0,0 +1,353 @@
+/**
+ * What `janus()` hands back, typed from the configuration it was given.
+ *
+ * The generic form lives here; the implementation works on a degenericised
+ * mirror and casts once, in `janus.ts`. That is `nxgt-data`'s shape, and it
+ * keeps each schema's type travelling through every public method without
+ * dragging a type parameter through every internal function.
+ */
+import type { Id } from '../ids/id';
+import type { CursorPage } from '../pagination/cursor-page';
+import type { JanusConfig, MultiTypeConfig, RESERVED_FIELDS, RESERVED_TYPES, SingleTypeConfig, UserSchema } from './config';
+import type { SessionRecord } from './port/types';
+import type { StandardSchemaV1 } from './standard-schema';
+/** What every user carries beside the application's own fields. */
+export interface UserBase<Type extends string = string> {
+    readonly id: Id;
+    /** Which user type — `'patient'`, `'staff'`, or `'user'` in the one-type form. */
+    readonly type: Type;
+    /** Whether the user proved they hold their current e-mail. */
+    readonly emailVerified: boolean;
+    /** `false`: the user is kept, and every sign-in is refused. */
+    readonly active: boolean;
+    /**
+     * Whether a password is set. **The hash itself never reaches a user**: no
+     * type that reaches a request handler carries it, and `test/types/` pins
+     * that.
+     */
+    readonly hasPassword: boolean;
+    /** One more on every write: what `ifVersion` is compared against. */
+    readonly version: number;
+    readonly createdAt: Date;
+    readonly updatedAt: Date;
+}
+/** A user as application code sees it: their fields, at the top level, and {@link UserBase}. */
+export type User<Type extends string = string, Fields = object> = Readonly<Fields> & UserBase<Type>;
+/** A user, or their id: every method that takes one takes either. */
+export type UserRef = string | {
+    readonly id: string;
+};
+/** A session, as application code sees it: everything but the token's hash. */
+export type Session = Omit<SessionRecord, 'tokenHash'>;
+/**
+ * A session just opened. **The token is here and nowhere else**: the store
+ * holds its hash. Put it in a cookie with `auth.cookie.serialize`, or hand it
+ * to a client that sends it as `Authorization: Bearer`.
+ */
+export interface SignedIn<U> {
+    readonly user: U;
+    readonly session: Session;
+    readonly token: string;
+}
+/** Who a request belongs to. */
+export interface Authenticated<U> {
+    readonly user: U;
+    readonly session: Session;
+    /** The token the request presented. */
+    readonly token: string;
+    /**
+     * Whether this call renewed the session. When it did, `session.expiresAt`
+     * moved: send the cookie again with `auth.cookie.serialize(token, session)`.
+     */
+    readonly renewed: boolean;
+}
+/** A one-time token, given to the application once, to send by e-mail. */
+export interface IssuedToken {
+    readonly token: string;
+    /** The address to send it to. */
+    readonly email: string;
+    readonly expiresAt: Date;
+}
+/** What `authenticate` and `signOut` read a session token from. */
+export type RequestLike = Request | Headers | {
+    readonly headers: Headers | HeaderRecord;
+} | HeaderRecord;
+/** Headers as Node's `IncomingMessage` and most frameworks hold them. */
+export type HeaderRecord = {
+    readonly [name: string]: string | readonly string[] | undefined;
+};
+/** Options every write that follows a read may take. */
+export interface WriteOptions {
+    /**
+     * The version the user must still hold, as read. A write to a user who
+     * changed since is `VERSION_CONFLICT`, and nothing is written.
+     */
+    readonly ifVersion?: number;
+}
+type OutputOf<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : never;
+type InputOf<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> : never;
+/** The single-type form, seen as one entry of `users`. */
+type SingleAsType<C extends SingleTypeConfig> = {
+    readonly schema: C['user'];
+    readonly password: C['password'];
+    readonly email: C['email'];
+};
+/** Every user type a configuration declares, by name. */
+export type TypesOf<C> = C extends MultiTypeConfig ? C['users'] : C extends SingleTypeConfig ? {
+    readonly user: SingleAsType<C>;
+} : never;
+/**
+ * Every **top-level, required** key of `T` whose value is a string: what a
+ * login or an e-mail may name. Required, because a login read from an
+ * optional field is a user who may have no way to sign in.
+ */
+export type RequiredStringKeys<T> = {
+    [K in keyof T & string]-?: object extends Pick<T, K> ? never : T[K] extends string ? K : never;
+}[keyof T & string];
+/** The login field of one user type, or `never` without a password. */
+export type LoginOf<Def> = Def extends {
+    readonly password: {
+        readonly login: infer L extends string;
+    };
+} ? L : never;
+/**
+ * The e-mail field of one user type: the one it names, or `'email'` when the
+ * schema has a required string `email` — or `never`, and then the e-mail flows
+ * do not exist on it.
+ */
+export type EmailOf<Def> = Def extends {
+    readonly email: infer E extends string;
+} ? E : Def extends {
+    readonly schema: infer S;
+} ? 'email' extends RequiredStringKeys<OutputOf<S>> ? 'email' : never : never;
+type UserOfType<Name extends string, Def> = Def extends {
+    readonly schema: infer S;
+} ? User<Name, OutputOf<S>> : never;
+/** Every user of a configuration: a union discriminated by `type`. */
+export type UserOf<C> = {
+    [K in keyof TypesOf<C> & string]: UserOfType<K, TypesOf<C>[K]>;
+}[keyof TypesOf<C> & string];
+/** What `create`, `signUp` and `update` take for one user type. */
+type FieldsInput<Def> = Def extends {
+    readonly schema: infer S;
+} ? InputOf<S> : never;
+/** What every user type answers. */
+export interface UserTypeApi<U, In> {
+    /**
+     * Creates a user without signing them in — for an import, an admin screen,
+     * an invitation. Validates the fields, and hashes the password when one is
+     * given.
+     *
+     * Rejects with `USER_INVALID`, `PASSWORD_TOO_SHORT`, `LOGIN_TAKEN`, or
+     * `STORE_FAILED`.
+     */
+    create(input: In & {
+        readonly password?: string;
+        readonly active?: boolean;
+    }): Promise<U>;
+    /** The user of this type, or `null` — for a malformed id, an unknown one, or one of another type. */
+    find(id: string): Promise<U | null>;
+    /** The user of this type, or `NOT_FOUND`. */
+    get(id: string): Promise<U>;
+    /** One page of users of this type, in creation order. A cursor this package did not mint is `INVALID_CURSOR`. */
+    list(page?: {
+        readonly after?: string | null;
+        readonly limit?: number;
+    }): Promise<CursorPage<U>>;
+    /**
+     * Changes some fields and keeps the others: the patch is merged over the
+     * stored fields, then **the whole result is validated**. Changing the e-mail
+     * sets `emailVerified` back to `false`.
+     */
+    update(user: UserRef, patch: Partial<In>, options?: WriteOptions): Promise<U>;
+    /** Activates or deactivates. An inactive user's sessions stop authenticating. */
+    setActive(user: UserRef, active: boolean, options?: WriteOptions): Promise<U>;
+    /**
+     * Deletes the user, **with every session and one-time token they had** —
+     * nothing of theirs is kept, the e-mail a token was sent to included.
+     * `true` when this call deleted them; `false` for a malformed id, an
+     * unknown one, or one of another type, which is left untouched.
+     *
+     * With `relations` wired into `janus()`, every tuple naming the user goes
+     * too, last.
+     *
+     * Idempotent: an outage half-way leaves sessions, tokens and tuples that
+     * name somebody who no longer exists, and calling it again deletes them.
+     */
+    delete(user: UserRef): Promise<boolean>;
+}
+/** What a user type that signs in with a password answers besides. */
+export interface PasswordApi<U, In, Login extends string> {
+    /**
+     * Creates the user and signs them in.
+     *
+     * Rejects with `USER_INVALID`, `PASSWORD_TOO_SHORT`, `LOGIN_TAKEN`, or
+     * `STORE_FAILED`.
+     */
+    signUp(input: In & {
+        readonly password: string;
+    }): Promise<SignedIn<U>>;
+    /**
+     * Checks the password and opens a session.
+     *
+     * Rejects with `CREDENTIALS_INVALID` — one code for an unknown login, a user
+     * with no password and a wrong password, so a response cannot tell which
+     * accounts exist; `reason` tells them apart for your logs. When nobody holds
+     * the login, a dummy hash is still compared, so the time taken does not say
+     * so either. **The store's own latency stays observable**, and that limit is
+     * documented rather than denied. An inactive user who gave the right
+     * password is `USER_INACTIVE`.
+     */
+    signIn(input: {
+        readonly [K in Login]: string;
+    } & {
+        readonly password: string;
+    }): Promise<SignedIn<U>>;
+    /** The user holding this login, normalised as sign-up normalised it, or `null`. */
+    findByLogin(login: string): Promise<U | null>;
+    /** Sets or replaces the password — an admin's call. `PASSWORD_TOO_SHORT` below the policy. */
+    setPassword(user: UserRef, password: string, options?: WriteOptions): Promise<U>;
+    /**
+     * Replaces the password after checking the current one — the user's call.
+     * `CREDENTIALS_INVALID` when `current` is wrong. Other sessions stay open:
+     * call `signOutEverywhere(user, { except })` for that.
+     */
+    changePassword(user: UserRef, change: {
+        readonly current: string;
+        readonly next: string;
+    }, options?: WriteOptions): Promise<U>;
+}
+/** What a user type with an e-mail answers besides. */
+export interface VerifyEmailApi<U> {
+    readonly verifyEmail: {
+        /** Issues a token for the user's current e-mail. Sending it is yours. */
+        send(user: UserRef): Promise<IssuedToken>;
+        /**
+         * Redeems a token and marks the e-mail verified. A token sent to an
+         * e-mail the user has since changed is `TOKEN_STALE`.
+         */
+        confirm(token: string): Promise<U>;
+    };
+}
+/** What a user type with an e-mail and a password answers besides. */
+export interface ResetPasswordApi<U> {
+    readonly resetPassword: {
+        /**
+         * Issues a reset token for the user of this type holding this e-mail, or
+         * answers `null` when there is none. **Never tell the visitor which**:
+         * answer the same page either way.
+         */
+        request(email: string): Promise<(IssuedToken & {
+            readonly user: U;
+        }) | null>;
+        /**
+         * Redeems the token, sets the password, marks the e-mail verified — the
+         * link proved it — and **signs the user out everywhere**. Opens no
+         * session: call `signIn` next if that is your policy.
+         */
+        confirm(token: string, password: string): Promise<U>;
+    };
+}
+/** The whole surface of one user type, with only the flows its configuration allows. */
+export type TypeApi<Name extends string, Def> = UserTypeApi<UserOfType<Name, Def>, FieldsInput<Def>> & ([LoginOf<Def>] extends [never] ? unknown : PasswordApi<UserOfType<Name, Def>, FieldsInput<Def>, LoginOf<Def>>) & ([EmailOf<Def>] extends [never] ? unknown : VerifyEmailApi<UserOfType<Name, Def>>) & ([LoginOf<Def>] extends [never] ? unknown : [EmailOf<Def>] extends [never] ? unknown : ResetPasswordApi<UserOfType<Name, Def>>);
+/** What every configuration answers, whatever its user types. */
+export interface SharedApi<U extends {
+    readonly type: string;
+}> {
+    /**
+     * Who a request belongs to, or `null` for an anonymous one.
+     *
+     * Reads `Authorization: Bearer`, then `X-Session-Token`, then the cookie:
+     * **the first credential present wins, not the first valid one.** A lapsed
+     * or revoked session, a user gone or inactive, or a user of another type
+     * than `options.type` is anonymous. Renews a sliding session in passing.
+     *
+     * **An outage is not anonymous**: a store that cannot answer rejects with
+     * `STORE_FAILED`. Answer 503, never 401.
+     */
+    authenticate<T extends U['type'] = U['type']>(request: RequestLike, options?: {
+        readonly type?: T;
+    }): Promise<Authenticated<Extract<U, {
+        readonly type: T;
+    }>> | null>;
+    /** Revokes the session a request presents. `false` when it presents none, or an unknown one. */
+    signOut(request: RequestLike): Promise<boolean>;
+    /** Revokes every session of a user, but `except`. Answers how many. */
+    signOutEverywhere(user: UserRef, options?: {
+        readonly except?: string;
+    }): Promise<number>;
+    /** The user with this id, whatever their type, or `null`. */
+    findUser(id: string): Promise<U | null>;
+    /** The user with this id, whatever their type, or `NOT_FOUND`. */
+    getUser(id: string): Promise<U>;
+    /** The session cookie, as `Set-Cookie` values. Synchronous. */
+    readonly cookie: {
+        readonly name: string;
+        serialize(token: string, session: Session): string;
+        clear(): string;
+    };
+    /**
+     * Deletes lapsed sessions. `UNSUPPORTED` when the sessions store does not
+     * implement `deleteExpiredSessions` — a store with its own TTL does not need
+     * to.
+     */
+    collectExpired(): Promise<number>;
+    /** The user type names, in the order they were declared. */
+    readonly types: readonly U['type'][];
+}
+/** What `janus(config)` answers. */
+export type Janus<C extends JanusConfig> = SharedApi<UserOf<C>> & (C extends MultiTypeConfig ? {
+    readonly [K in keyof C['users'] & string]: TypeApi<K, C['users'][K]>;
+} : C extends SingleTypeConfig ? TypeApi<'user', SingleAsType<C>> : never);
+/**
+ * Makes a value that names no key of `Keys` unassignable, and says why on that
+ * key.
+ *
+ * The reason is the **key** of an object type, and the valid names its value.
+ * A string-literal message would not survive: `'emial' & 'message'` reduces to
+ * `never`, which collapses the whole object and loses the sentence — measured
+ * while writing `from` in the first surface. A string intersected with an
+ * object does not reduce, so the compiler prints both.
+ */
+type CheckName<V, Keys extends string, What extends string> = [V] extends [Keys] ? unknown : {
+    readonly [K in `"${V & string}" is not ${What}; name one of`]: Keys;
+};
+type Reserved<S> = Extract<keyof OutputOf<S>, (typeof RESERVED_FIELDS)[number]>;
+/** The checks on one user type: its login, its e-mail, and its field names. */
+type CheckType<Def, SchemaKey extends string> = (Def extends {
+    readonly password: {
+        readonly login: infer L;
+    };
+} ? {
+    readonly password: {
+        readonly login: CheckName<L, RequiredStringKeys<OutputOf<SchemaOf<Def, SchemaKey>>>, 'a required string field'>;
+    };
+} : unknown) & (Def extends {
+    readonly email: infer E;
+} ? {
+    readonly email: CheckName<E, RequiredStringKeys<OutputOf<SchemaOf<Def, SchemaKey>>>, 'a required string field'>;
+} : unknown) & ([Reserved<SchemaOf<Def, SchemaKey>>] extends [never] ? unknown : {
+    readonly [K in SchemaKey]: {
+        readonly [M in `"${Reserved<SchemaOf<Def, SchemaKey>> & string}" is a field janus sets itself; rename it`]: never;
+    };
+});
+type SchemaOf<Def, SchemaKey extends string> = Def extends {
+    readonly [K in SchemaKey]: infer S extends UserSchema;
+} ? S : never;
+/**
+ * The compile-time checks `janus` intersects into its parameter.
+ *
+ * `janus` infers its argument, so an excess-property check never fires;
+ * intersecting `C & Checked<C>` makes a wrong value unassignable **on the
+ * offending key**, with the reason as the type the compiler prints. The pattern
+ * is measured in `nxgt-data/packages/mongo-kit/src/config/types.ts`.
+ */
+export type Checked<C> = C extends MultiTypeConfig ? {
+    readonly users: {
+        readonly [K in keyof C['users']]: K extends (typeof RESERVED_TYPES)[number] ? {
+            readonly [M in `"${K & string}" cannot name a user type: janus() answers a method of that name`]: never;
+        } : CheckType<C['users'][K], 'schema'>;
+    };
+} : CheckType<C, 'user'>;
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EACf,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,MAAM,WAAW,QAAQ,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACrD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,gGAAgG;AAChG,MAAM,MAAM,IAAI,CACf,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,MAAM,GAAG,MAAM,IACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEtC,qEAAqE;AACrE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa,CAAC,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GACpB,OAAO,GACP,OAAO,GACP;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAA;CAAE,GAC5C,YAAY,CAAC;AAEhB,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAChE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAC1C,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,GAC/B,KAAK,CAAC;AACT,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GACzC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,GAC9B,KAAK,CAAC;AAET,0DAA0D;AAC1D,KAAK,YAAY,CAAC,CAAC,SAAS,gBAAgB,IAAI;IAC/C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;CAC3B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C,CAAC,CAAC,OAAO,CAAC,GACV,CAAC,SAAS,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GAClC,KAAK,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;KAClC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GACjD,KAAK,GACL,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAClB,CAAC,GACD,KAAK;CACT,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAEpB,uEAAuE;AACvE,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,CAAC;CAC9D,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;GAIG;AACH,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACvC,GACE,CAAC,GACD,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvC,OAAO,SAAS,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAC9C,OAAO,GACP,KAAK,GACN,KAAK,CAAC;AAEV,KAAK,UAAU,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzB,GACE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GACvB,KAAK,CAAC;AAET,sEAAsE;AACtE,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE7B,mEAAmE;AACnE,KAAK,WAAW,CAAC,GAAG,IAAI,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,CAAC,CAAC,GACV,KAAK,CAAC;AAIT,oCAAoC;AACpC,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,MAAM,CACL,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACnE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd,qGAAqG;IACrG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpC,6CAA6C;IAC7C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE5B,iHAAiH;IACjH,IAAI,CAAC,IAAI,CAAC,EAAE;QACX,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3B;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E,iFAAiF;IACjF,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,SAAS,MAAM;IACvD;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE;;;;;;;;;;OAUG;IACH,MAAM,CACL,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,MAAM;KAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExB,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,8FAA8F;IAC9F,WAAW,CACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;OAIG;IACH,cAAc,CACb,IAAI,EAAE,OAAO,EACb,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC3D,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE;QACrB,yEAAyE;QACzE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C;;;WAGG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE;QACvB;;;;WAIG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD;;;;WAIG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,MAAM,OAAO,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,IAAI,WAAW,CAC1D,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,WAAW,CAAC,GAAG,CAAC,CAChB,GACA,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GACtE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D;;;;;;;;;;OAUG;IACH,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnE,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,uEAAuE;IACvE,iBAAiB,CAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC,kEAAkE;IAClE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QACnD,KAAK,IAAI,MAAM,CAAC;KAChB,CAAC;IAEF;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;CACrC;AAED,oCAAoC;AACpC,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAC9D,CAAC,CAAC,SAAS,eAAe,GACvB;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACxE,CAAC,SAAS,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAChC,KAAK,CAAC,CAAC;AAIZ;;;;;;;;;GASG;AACH,KAAK,SAAS,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAC7E,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,YAAY,IAAI,eAAe,GAAG,IAAI;CACnE,CAAC;AAEJ,KAAK,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhF,+EAA+E;AAC/E,KAAK,SAAS,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG,SAAS;IAC5D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAC/C,GACE;IACA,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;KACF,CAAC;CACF,GACA,OAAO,CAAC,GACV,CAAC,GAAG,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GACrC;IACA,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;CACF,GACA,OAAO,CAAC,GACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAClD,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG;QAC1B,QAAQ,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,2CAA2C,GAAG,KAAK;KACjH;CACD,CAAC,CAAC;AAEN,KAAK,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,GAAG,SAAS;IAC1D,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG,MAAM,CAAC,SAAS,UAAU;CACrD,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C;IACA,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GACxE;YACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,kEAAkE,GAAG,KAAK;SACvG,GACA,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;KACrC,CAAC;CACF,GACA,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC"}

package/dist/auth/users.d.ts

@@ -0,0 +1,9 @@
+import { type ResolvedType } from './config';
+import { type AnyUser, type Context } from './context';
+import type { PasswordApi, ResetPasswordApi, UserTypeApi, VerifyEmailApi } from './types';
+type Input = Record<string, unknown>;
+/** Everything one user type answers. Which flows it has is decided by its types; all are built. */
+export type AnyTypeApi = UserTypeApi<AnyUser, Input> & PasswordApi<AnyUser, Input, string> & VerifyEmailApi<AnyUser> & ResetPasswordApi<AnyUser>;
+export declare function typeApi(context: Context, type: ResolvedType): AnyTypeApi;
+export {};
+//# sourceMappingURL=users.d.ts.map

package/dist/auth/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAaZ,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,EAEX,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,MAAM,SAAS,CAAC;AAEjB,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErC,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACnC,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE3B,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CA2axE"}

package/dist/chunks/index-658b6mr2.js

@@ -0,0 +1,269 @@
+import {
+  StoreConflict2,
+  NotFoundError2
+} from "./index-6p56fpbe.js";
+
+// src/ids/id.ts
+var HEX = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+var lastMs = -1;
+var sequence = 0;
+var SEQUENCE_MAX = 4095;
+function mintId2(now = Date.now()) {
+  let ms = now;
+  if (ms === lastMs) {
+    sequence += 1;
+    if (sequence > SEQUENCE_MAX) {
+      ms = lastMs + 1;
+      sequence = 0;
+    }
+  } else if (ms > lastMs) {
+    sequence = 0;
+  } else {
+    ms = lastMs;
+    sequence += 1;
+    if (sequence > SEQUENCE_MAX) {
+      ms = lastMs + 1;
+      sequence = 0;
+    }
+  }
+  lastMs = ms;
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes.subarray(8));
+  bytes[0] = ms / 2 ** 40 & 255;
+  bytes[1] = ms / 2 ** 32 & 255;
+  bytes[2] = ms / 2 ** 24 & 255;
+  bytes[3] = ms / 2 ** 16 & 255;
+  bytes[4] = ms / 2 ** 8 & 255;
+  bytes[5] = ms & 255;
+  bytes[6] = 112 | sequence >> 8 & 15;
+  bytes[7] = sequence & 255;
+  bytes[8] = 128 | bytes[8] & 63;
+  return `${HEX[bytes[0]]}${HEX[bytes[1]]}${HEX[bytes[2]]}${HEX[bytes[3]]}-${HEX[bytes[4]]}${HEX[bytes[5]]}-${HEX[bytes[6]]}${HEX[bytes[7]]}-${HEX[bytes[8]]}${HEX[bytes[9]]}-${HEX[bytes[10]]}${HEX[bytes[11]]}${HEX[bytes[12]]}${HEX[bytes[13]]}${HEX[bytes[14]]}${HEX[bytes[15]]}`;
+}
+var UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function isId2(value) {
+  return UUID_V7.test(value);
+}
+function mintedAt2(id) {
+  const hex = id.replace(/-/g, "").slice(0, 12);
+  return new Date(Number.parseInt(hex, 16));
+}
+
+// src/auth/port/memory.ts
+function createMemoryStores2() {
+  return {
+    users: memoryUserStore(),
+    sessions: memorySessionStore(),
+    tokens: memoryTokenStore()
+  };
+}
+var copy = (value) => structuredClone(value);
+var keyOf = (type, login) => `${type}\x00${login}`;
+function memoryUserStore() {
+  const byId = new Map;
+  const byLogin = new Map;
+  const takenBy = (type, logins, id) => logins.find((login) => {
+    const holder = byLogin.get(keyOf(type, login));
+    return holder !== undefined && holder !== id;
+  });
+  const taken = (operation, type, login) => new StoreConflict2("login", `${operation}: the login "${login}" is taken by another ${type}`, { login, userType: type, operation });
+  return {
+    async insertUser(record) {
+      const stored = byId.get(record.id);
+      if (stored !== undefined)
+        return copy(stored);
+      const collision = takenBy(record.type, record.logins, record.id);
+      if (collision !== undefined) {
+        throw taken("insertUser", record.type, collision);
+      }
+      const written = copy(record);
+      byId.set(written.id, written);
+      for (const login of written.logins) {
+        byLogin.set(keyOf(written.type, login), written.id);
+      }
+      return copy(written);
+    },
+    async findUser(id) {
+      const stored = byId.get(id);
+      return stored === undefined ? null : copy(stored);
+    },
+    async findUserByLogin(type, login) {
+      const id = byLogin.get(keyOf(type, login));
+      const stored = id === undefined ? undefined : byId.get(id);
+      return stored === undefined ? null : copy(stored);
+    },
+    async listUsers({ type, after, limit }) {
+      const ids = [...byId.values()].filter((user) => user.type === type).map((user) => user.id).filter((id) => after === null || id > after).sort();
+      const pageIds = ids.slice(0, limit);
+      const last = pageIds.at(-1);
+      return {
+        items: pageIds.map((id) => copy(byId.get(id))),
+        nextCursor: ids.length > limit && last !== undefined ? last : null
+      };
+    },
+    async updateUser(id, patch, ifVersion) {
+      const stored = byId.get(id);
+      if (stored === undefined) {
+        throw new NotFoundError2("updateUser: no user has this id", {
+          userId: id,
+          operation: "updateUser"
+        });
+      }
+      if (stored.version !== ifVersion) {
+        throw new StoreConflict2("version", `updateUser: expected version ${ifVersion}, found ${stored.version}`, {
+          userId: id,
+          expectedVersion: ifVersion,
+          actualVersion: stored.version,
+          operation: "updateUser"
+        });
+      }
+      if (patch.logins !== undefined) {
+        const collision = takenBy(stored.type, patch.logins, id);
+        if (collision !== undefined) {
+          throw taken("updateUser", stored.type, collision);
+        }
+      }
+      const written = applyPatch(stored, copy(patch));
+      byId.set(id, written);
+      if (patch.logins !== undefined) {
+        for (const login of stored.logins) {
+          byLogin.delete(keyOf(stored.type, login));
+        }
+        for (const login of written.logins) {
+          byLogin.set(keyOf(written.type, login), id);
+        }
+      }
+      return copy(written);
+    },
+    async deleteUser(id) {
+      const stored = byId.get(id);
+      if (stored === undefined)
+        return false;
+      byId.delete(id);
+      for (const login of stored.logins) {
+        byLogin.delete(keyOf(stored.type, login));
+      }
+      return true;
+    }
+  };
+}
+function applyPatch(stored, patch) {
+  return {
+    ...stored,
+    schemaVersion: patch.schemaVersion ?? stored.schemaVersion,
+    active: patch.active ?? stored.active,
+    fields: patch.fields ?? stored.fields,
+    logins: patch.logins ?? stored.logins,
+    password: patch.password === undefined ? stored.password : patch.password,
+    emailVerifiedAt: patch.emailVerifiedAt === undefined ? stored.emailVerifiedAt : patch.emailVerifiedAt,
+    version: stored.version + 1,
+    updatedAt: patch.updatedAt
+  };
+}
+function memorySessionStore() {
+  const byId = new Map;
+  const byTokenHash = new Map;
+  const revoke = (id, stored, at) => {
+    byId.set(id, { ...stored, revokedAt: new Date(at) });
+  };
+  return {
+    async insertSession(record) {
+      if (byId.has(record.id))
+        return;
+      const written = copy(record);
+      byId.set(written.id, written);
+      byTokenHash.set(written.tokenHash, written.id);
+    },
+    async findSessionByTokenHash(tokenHash) {
+      const id = byTokenHash.get(tokenHash);
+      const stored = id === undefined ? undefined : byId.get(id);
+      return stored === undefined ? null : copy(stored);
+    },
+    async extendSession(id, expiresAt) {
+      const stored = byId.get(id);
+      if (stored === undefined || stored.revokedAt !== null)
+        return null;
+      const written = {
+        ...stored,
+        expiresAt: new Date(expiresAt)
+      };
+      byId.set(id, written);
+      return copy(written);
+    },
+    async revokeSession(id, at) {
+      const stored = byId.get(id);
+      if (stored === undefined)
+        return false;
+      if (stored.revokedAt === null)
+        revoke(id, stored, at);
+      return true;
+    },
+    async revokeUserSessions(userId, at, except) {
+      let revoked = 0;
+      for (const [id, stored] of byId) {
+        if (stored.userId === userId && stored.revokedAt === null && id !== except) {
+          revoke(id, stored, at);
+          revoked += 1;
+        }
+      }
+      return revoked;
+    },
+    async deleteUserSessions(userId) {
+      let deleted = 0;
+      for (const [id, stored] of byId) {
+        if (stored.userId === userId) {
+          byId.delete(id);
+          byTokenHash.delete(stored.tokenHash);
+          deleted += 1;
+        }
+      }
+      return deleted;
+    },
+    async deleteExpiredSessions(before) {
+      let deleted = 0;
+      for (const [id, stored] of byId) {
+        if (stored.expiresAt.getTime() <= before.getTime()) {
+          byId.delete(id);
+          byTokenHash.delete(stored.tokenHash);
+          deleted += 1;
+        }
+      }
+      return deleted;
+    }
+  };
+}
+function memoryTokenStore() {
+  const byTokenHash = new Map;
+  return {
+    async insertToken(record) {
+      if (byTokenHash.has(record.tokenHash))
+        return;
+      byTokenHash.set(record.tokenHash, copy(record));
+    },
+    async consumeToken(tokenHash, kind, at) {
+      const stored = byTokenHash.get(tokenHash);
+      if (stored === undefined || stored.kind !== kind)
+        return null;
+      const before = copy(stored);
+      if (stored.spentAt === null) {
+        byTokenHash.set(tokenHash, { ...stored, spentAt: new Date(at) });
+      }
+      return before;
+    },
+    async deleteUserTokens(userId) {
+      let deleted = 0;
+      for (const [tokenHash, stored] of byTokenHash) {
+        if (stored.userId === userId) {
+          byTokenHash.delete(tokenHash);
+          deleted += 1;
+        }
+      }
+      return deleted;
+    }
+  };
+}
+
+export { mintId2, isId2, mintedAt2, createMemoryStores2 };
+
+//# debugId=127433514BF2BB4B64756E2164756E21
+//# sourceMappingURL=index-658b6mr2.js.map