@nxgt/janus 0.11.0 → 0.13.0

package/README.md

@@ -165,7 +165,7 @@ async function signIn(email: string, password: string): Promise<Response> {
 ```
 
 `JanusError` is the base of everything thrown at call time. It extends `Error`,
-so no consumer has to order their `catch` blocks. `code` is a union of nineteen
+so no consumer has to order their `catch` blocks. `code` is a union of twenty
 string literals, so a `switch` over it is exhaustive and adding a code breaks the
 compilation of callers that exhaust it. `statusOf(code)` answers the status
 below, as `JanusErrorStatus` — a union of the eight literals, which a
@@ -190,6 +190,7 @@ if (error instanceof JanusError) {
 | `CODE_INVALID` | 401 — a one-time code that does not match: a second factor's, or one sent by e-mail; `attemptsLeft` from either `confirm` belongs in the body |
 | `SECOND_FACTOR_NOT_ENROLLED`, `SECOND_FACTOR_ACTIVE` | 409 — the factor is not in the state the call needs |
 | `USER_INACTIVE` | 403 |
+| `STEP_UP_REQUIRED` | 403 — the session proved who it is too long ago for this action: ask for a step-up, then send the request again |
 | `TOKEN_UNKNOWN`, `TOKEN_SPENT`, `TOKEN_EXPIRED`, `TOKEN_STALE` | 400 |
 | `INVALID_CURSOR` | 400 |
 | `UNSUPPORTED` | 501 — a wiring mistake, and the message names the store to change |
@@ -197,7 +198,7 @@ if (error instanceof JanusError) {
 
 Each code has its class, all exported: `StoreFailure`, `StoreConflict` (`on:
 'login' | 'version'`), `NotFoundError`, `UserInvalidError`, `CredentialError`,
-`UserInactiveError`, `TokenError` (the `TOKEN_*` codes and `CODE_INVALID`),
+`UserInactiveError`, `StepUpRequiredError`, `TokenError` (the `TOKEN_*` codes and `CODE_INVALID`),
 `SecondFactorError`, `InvalidCursorError`, `UnsupportedError` and
 `PermissionDepthError`. `StoreFailure` and `StoreConflict` are exported
 **because an adapter throws them**. An adapter defines no error class of its own, so `instanceof` holds
@@ -323,6 +324,8 @@ await auth.resetPassword.request(email);           // … | null
 await auth.resetPassword.confirm(token, newPassword);
 await auth.signInCode.request(email);              // { code, challenge, email, expiresAt, user } | null
 await auth.signInCode.confirm(challenge, code);    // { status: 'signedIn', user, session, token }
+await auth.stepUp.request(user);                   // { via: 'email', code, challenge, email, expiresAt, user }
+await auth.stepUp.confirm(request, challenge, code); // the request's session, authenticatedAt: now
 
 // Several user types
 const clinic = janus({
@@ -465,12 +468,38 @@ await tokens.spendUserTokens(userId, 'signInCode', now); // 1: `kept`, now
 await tokens.spendUserTokens(userId, 'signInCode', now); // 0: none left unspent
 ```
 
+`reauthenticateSession(id, at)` moves a standing session's `authenticatedAt`
+— what a step-up writes once a signed-in user proved again who they are —
+and answers `null` for a revoked one, which it never brings back:
+
+```ts
+const { sessions } = createMemoryStores();
+const session = {
+	id: mintId(),
+	tokenHash: 'f'.repeat(64),
+	userId: mintId(),
+	authenticatedAt: new Date('2026-01-01T00:00:00.000Z'),
+	expiresAt: new Date(Date.now() + 86_400_000),
+	revokedAt: null,
+	createdAt: new Date('2026-01-01T00:00:00.000Z'),
+};
+await sessions.insertSession(session);
+await sessions.reauthenticateSession(session.id, new Date()); // { …, authenticatedAt: now }
+```
+
+A token of kind `stepUp` is that confirmation's challenge: kept apart from
+`signInCode`, so neither is ever redeemed as the other.
+
 An adapter written against `@nxgt/janus` 0.3 does not compile against this
 port until it implements `countAttempt`, nor one written against 0.6 until it
-implements `spendUserTokens`, and `janus()` refuses either at wiring —
+implements `spendUserTokens`, nor one written against 0.11 until it
+implements `reauthenticateSession`, and `janus()` refuses each at wiring —
 [Writing an adapter](docs/guide/adapters.md) has the contracts:
-[`countAttempt`](docs/guide/adapters.md#tokenstorecountattempt) and
-[`spendUserTokens`](docs/guide/adapters.md#tokenstorespendusertokens).
+[`countAttempt`](docs/guide/adapters.md#tokenstorecountattempt),
+[`spendUserTokens`](docs/guide/adapters.md#tokenstorespendusertokens) and
+[`reauthenticateSession`](docs/guide/adapters.md#sessionstorereauthenticatesession).
+A store that lists the token kinds — a `CHECK`, a validator's enum — adds
+`stepUp`.
 
 ### Second factor — `secondFactor`
 
@@ -591,6 +620,46 @@ A six-digit code sent to the user's e-mail signs them in, with no password.
 [The sign-in code guide](docs/guide/sign-in-code.md) has the request that
 tells nobody who exists, the challenge in a cookie, every error, and a test.
 
+### Step-up — `stepUp` and `assertFresh`
+
+```ts
+import { assertFresh } from '@nxgt/janus';
+
+// A sensitive route asks for a recent proof: signed in, or confirmed since.
+const current = await auth.authenticate(request);
+if (current === null) return new Response(null, { status: 401 });
+assertFresh(current.session, '10m'); // StepUpRequiredError, STEP_UP_REQUIRED (403), past ten minutes
+
+// The client, told STEP_UP_REQUIRED, asks for a step-up:
+const issued = await auth.stepUp.request(current.user);
+if (issued.via === 'email') await sendMail(issued.email, `Confirm it is you: ${issued.code}`);
+// …keeps issued.challenge, and sends it back with the code:
+const session = await auth.stepUp.confirm(request, challenge, code); // authenticatedAt: now
+```
+
+A signed-in user proves again who they are before something a stolen
+session should not do alone.
+
+- **On every user type with an e-mail**, as `signInCode`. A type with no
+  e-mail has no `stepUp`.
+- **`request(user)` answers `via: 'email'`** — a six-digit `code` to send to
+  `email` — or, for a user whose second factor is active, **`via:
+  'secondFactor'`**: nothing to send, ask for their app's code. A step-up is
+  never weaker than the sign-in the account asks for. One step-up is live
+  per user; a challenge lives `'10m'` (`tokens.stepUp`).
+- **`confirm(request, challenge, code)` stamps the session the request
+  presents**: its `authenticatedAt` moves to now, and it is answered. It
+  opens no session and hands out no token. Five attempts per challenge; an
+  app's codes are also counted per user, five per 15-minute window, with
+  `regenerateRecoveryCodes`. A request whose session is not a standing one
+  of the challenge's user is `TOKEN_UNKNOWN`.
+- **`assertFresh(session, maxAge, clock?)`** reads `authenticatedAt` and
+  nothing else: `STEP_UP_REQUIRED` (403) when it is `maxAge` old or more. A
+  fresh sign-in is fresh too.
+
+[The step-up guide](docs/guide/step-up.md) has the two requests, every
+error, and the codes an app confirms.
+
 ### User events — `events`
 
 ```ts
@@ -784,7 +853,7 @@ describeJanusStores({
 });
 ```
 
-There are 49 cases. They cover:
+There are 54 cases. They cover:
 - round-trip, byte for byte — including every edge character the core lets
   through (control characters, U+FFFF, a surrogate pair);
 - uniqueness, as a constraint: of twenty concurrent inserts of one login,
@@ -793,10 +862,15 @@ There are 49 cases. They cover:
 - versions: a refused update writes nothing;
 - **omission**, named after the Kratos `PUT` trap;
 - pagination;
-- sessions;
-- one-time tokens: of twenty concurrent redemptions, exactly one succeeds;
-  of twenty concurrent `countAttempt` calls, each answers a distinct count,
-  and none is counted once a racing redemption spent the token;
+- sessions: `reauthenticateSession` moves `authenticatedAt` and nothing else,
+  and never brings back a revoked session, even one revoked at the same
+  moment;
+- one-time tokens: a token of every kind the port names is stored, counted
+  and spent — a `CHECK` or an enum that forgot `stepUp` fails here — and a
+  step-up is never counted, spent nor answered as a sign-in code; of twenty
+  concurrent redemptions, exactly one succeeds; of twenty concurrent
+  `countAttempt` calls, each answers a distinct count, and none is counted
+  once a racing redemption spent the token;
 - spending a user's tokens of one kind — `spendUserTokens` — spends only the
   unspent ones of that user and kind, spares the one named by `except`, and
   never spends the same token as a racing redemption;
@@ -805,7 +879,7 @@ There are 49 cases. They cover:
   removed by one that names `null`;
 - deletion: a user's logins are freed, and every session and token of theirs
   goes, with a replay answering `false` or `0` rather than failing;
-- **outages**, one case for each of the thirteen methods whose honest answer can
+- **outages**, one case for each of the fourteen methods whose honest answer can
   be "nothing".
 
 The suite imports no test framework and no assertion library. It runs under
@@ -852,6 +926,18 @@ the body of the code form — never in the e-mail, never in a URL, where logs,
 proxies and the `Referer` header see it, and never in a log. The e-mail holds
 the code and nothing else.
 
+**Confirm a step-up on the request that asked for it.** `stepUp.confirm`
+stamps the session the request presents, and only a standing session of
+the challenge's user: a challenge carried to another browser, or confirmed
+after a sign-out, is `TOKEN_UNKNOWN`. Its challenge is a secret like
+`signInCode`'s — and check freshness on the server with `assertFresh`, never
+from a flag the client keeps.
+
+**Rate-limit `stepUp.request` per user.** An app's codes are counted per
+user and window, but an e-mailed code gets five guesses per challenge and a
+new challenge takes only a new `request`: without a limit, a stolen session
+can keep asking — and fill the user's inbox while it does.
+
 **Answer `signInCode.request` the same whether it issued a code or not** —
 the same status, body and cookie: set a random challenge when it answered
 `null`. The code route then still tells a decoy (`TOKEN_UNKNOWN`) from a
@@ -939,6 +1025,14 @@ waiting on its second factor is spent with them — as it is by `setPassword`
 and `changePassword`; what the visitor does next is
 your policy. A password refused for its length does not spend the token.
 
+**Only the last reset link works, and only until the password changes.** A
+`resetPassword.request` spends the user's earlier links, and any password
+written — by a link, `changePassword` or `setPassword` — spends every link
+still live, so an older e-mail's link answers `TOKEN_SPENT`. Tell the visitor
+to use the latest e-mail, and rate-limit `resetPassword.request` per address:
+each request cancels the link before it. **Nothing limits password guesses**: rate-limit
+`signIn` per login and per client ([passwords](docs/guide/passwords.md#rate-limit-password-guessing)).
+
 **A sign-in can move a user's `version`.** Rewriting a stale hash is a write. A
 user object read before that sign-in, and then passed as `ifVersion`, gets
 `VERSION_CONFLICT`. That is the conflict doing its job: read the user again.
@@ -1016,17 +1110,17 @@ that sends one, since it is awaited: queue the event and return.
 
 ## Type safety, counted
 
-**One hundred and twenty-four plausible mistakes, one hundred and twenty-four refused at compile time — and
+**One hundred and twenty-nine plausible mistakes, one hundred and twenty-nine refused at compile time — and
 two gaps, named.**
 
 The lists are typechecked and never run, with one `@ts-expect-error` per
 mistake beside the shapes that must keep compiling. One is a single file:
 `test/types/refusals.ts` (fifteen, on the shared vocabulary). The other three
-are folders with one file per behaviour: `test/types/port/` (twenty-three, on
+are folders with one file per behaviour: `test/types/port/` (twenty-four, on
 the identity stores' port, from the point of view of the person implementing
-it), `test/types/auth/` (thirty-eight, on `janus()`, from the point of view of
+it), `test/types/auth/` (forty-two, on `janus()`, from the point of view of
 the application — twelve of them on the second factor, three on sign-in codes,
-three on user events) and `test/types/permissions/` (forty-eight, on the
+three on user events, four on step-ups) and `test/types/permissions/` (forty-eight, on the
 permission model and the questions asked of it). The rule comes from
 `nxgt-data`, and so does the reason to distrust the claim without the files:
 when it was last measured on `@nxgt/mongo`, *seven of twelve plausible

package/dist/auth/config/janus-config.d.ts

@@ -48,6 +48,8 @@ interface SharedConfig {
         readonly resetPassword?: Duration;
         /** How long an e-mailed sign-in code waits. `'10m'` when absent. */
         readonly signInCode?: Duration;
+        /** How long a step-up's challenge waits, e-mailed or not. `'10m'` when absent. */
+        readonly stepUp?: Duration;
     };
     /**
      * A TOTP second factor, for every user type with a password. Absent, no

package/dist/auth/config/janus-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;KAC/B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC/B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC3B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}

package/dist/auth/config/resolved-config.d.ts

@@ -25,6 +25,7 @@ export interface ResolvedConfig {
         readonly verifyEmail: number;
         readonly resetPassword: number;
         readonly signInCode: number;
+        readonly stepUp: number;
     };
     readonly secondFactor: {
         readonly issuer: string;

package/dist/auth/config/resolved-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}
+{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}

package/dist/auth/email-flows/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/reset-password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAOZ,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,KAAK,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,aAAa,CA4Bf"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/reset-password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAOZ,MAAM,YAAY,CAAC;AAKpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,KAAK,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,aAAa,CAqCf"}

package/dist/auth/index.d.ts

@@ -6,6 +6,7 @@ export { assertStores } from './port/assert-stores';
 export { createMemoryStores } from './port/memory';
 export type { JanusStores, Json, JsonObject, PasswordRecord, SecondFactorRecord, SessionId, SessionRecord, SessionStore, StoreCapabilities, TokenKind, TokenRecord, TokenStore, UserPageRequest, UserPatch, UserRecord, UserStore, } from './port/types';
 export type { SealingKey } from './sealing';
+export { assertFresh } from './sessions/fresh';
 export type { StandardSchemaV1 } from './standard-schema';
-export type { Authenticated, Checked, EmailOf, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, PasswordApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInResult, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
+export type { Authenticated, Checked, EmailOf, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, PasswordApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}

package/dist/auth/password-written.d.ts

@@ -4,12 +4,28 @@ import { type AnyUser, type Context } from './context';
 import type { UserRecord } from './port/types';
 import type { SignInResult } from './types';
 /**
- * What writing a password ends besides: every second-factor challenge of the
- * user still open, so a sign-in started with the old password cannot be
- * finished. Called **after** the write — the other half of
- * {@link heldByPassword}, which reads **after** it issued.
+ * What writing a password ends besides. A reset, a change and a set each call
+ * it **after** the write, and a failure here throws — it is never ignored:
+ *
+ * - The user's reset links still unspent. A link answers a request to
+ *   replace the password; once it is replaced, an older link would replace
+ *   it again, without knowing the new one.
+ * - Every second-factor challenge still open, so a sign-in started with the
+ *   old password cannot be finished — the other half of
+ *   {@link heldByPassword}, which reads **after** it issued.
+ *
+ * Both spends are attempted even when one fails, so a store failing one kind
+ * still spends the other; the first failure is then thrown.
+ *
+ * After the write, not before: a link issued while the password is written
+ * is spent too, where one issued between an earlier spend and the write
+ * would survive. So an outage here leaves the password written and the
+ * older links live, and the caller is told, with `STORE_FAILED`; the next
+ * `resetPassword.request` spends them. Sign-in codes and step-ups are left
+ * alone: the password proves neither, and a step-up belongs to a session,
+ * which a reset revokes.
  */
-export declare function endSignInsWaiting(context: Context, userId: Id): Promise<void>;
+export declare function endWhatThePasswordOpened(context: Context, userId: Id): Promise<void>;
 /**
  * Whether the password a sign-in verified is still the user's, once the
  * sign-in answered. A password written meanwhile ends the sign-in: its

package/dist/auth/password-written.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-written.d.ts","sourceRoot":"","sources":["../../src/auth/password-written.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAGZ,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,EAAE,GACR,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB"}
+{"version":3,"file":"password-written.d.ts","sourceRoot":"","sources":["../../src/auth/password-written.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAGZ,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,EAAE,GACR,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/auth/port/assert-stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assert-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/port/assert-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAmC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,CAmCnB"}
+{"version":3,"file":"assert-stores.d.ts","sourceRoot":"","sources":["../../../src/auth/port/assert-stores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAoC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC3B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,CAmCnB"}

package/dist/auth/port/memory/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/memory/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,YAAY,EAAE,MAAM,UAAU,CAAC;AASvE,mCAAmC;AACnC,wBAAgB,kBAAkB,IAAI,YAAY,CAsEjD"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/memory/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,YAAY,EAAE,MAAM,UAAU,CAAC;AASvE,mCAAmC;AACnC,wBAAgB,kBAAkB,IAAI,YAAY,CAkEjD"}

package/dist/auth/port/types/sessions.d.ts

@@ -20,7 +20,10 @@ export interface SessionRecord {
     /** `sha256` of the session token, hex. Unique across the store. */
     readonly tokenHash: string;
     readonly userId: Id;
-    /** When credentials were last presented — not when the session was last extended. */
+    /**
+     * When credentials were last presented — at the sign-in, or since by a
+     * step-up on this session — not when the session was last extended.
+     */
     readonly authenticatedAt: Date;
     readonly expiresAt: Date;
     /** `null` while the session stands. */
@@ -53,6 +56,18 @@ export interface SessionStore {
      * *allowed* to be extended yet is the core's decision, made before the call.
      */
     extendSession(id: SessionId, expiresAt: Date): Promise<SessionRecord | null>;
+    /**
+     * Moves `authenticatedAt` to `at`, **only while the session is not
+     * revoked**, and answers the record as written: what a step-up calls once
+     * the user proved again, on this session, who they are. `expiresAt` and
+     * every other field stay as they were.
+     *
+     * `null` when there is no such session or it has been revoked — a
+     * confirmation racing a revocation must never bring the session back.
+     * Whether the session may be confirmed — standing, not lapsed — is the
+     * core's decision, made before the call.
+     */
+    reauthenticateSession(id: SessionId, at: Date): Promise<SessionRecord | null>;
     /**
      * Revokes one session. `true` when the session exists — revoked by this call
      * or already — and `false` when there is none.

package/dist/auth/port/types/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,mEAAmE;IACnE,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9E;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;OAQG;IACH,qBAAqB,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C,mEAAmE;AACnE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,mEAAmE;IACnE,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE7E;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD;;;;OAIG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9E;;;;;OAKG;IACH,kBAAkB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;OAQG;IACH,qBAAqB,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD"}

package/dist/auth/port/types/tokens.d.ts

@@ -16,8 +16,12 @@ import type { Id } from '../../../ids/id';
  *   attempts at `regenerateRecoveryCodes`, a token of this kind whose secret
  *   nobody is given, never redeemed, only counted.
  * - `signInCode`: a code sent by e-mail to sign in without a password.
+ * - `stepUp`: a signed-in user's confirmation of a sensitive action — a code
+ *   sent by e-mail, or, with an active second factor, a code from their app.
+ *   A kind of its own, so a sign-in code never confirms an action nor an
+ *   action's code signs anyone in.
  */
-export type TokenKind = 'verifyEmail' | 'resetPassword' | 'secondFactor' | 'signInCode';
+export type TokenKind = 'verifyEmail' | 'resetPassword' | 'secondFactor' | 'signInCode' | 'stepUp';
 /** A one-time token, as a store holds it: its hash, never its secret. */
 export interface TokenRecord {
     /** `sha256` of the token's secret, hex. Unique across the store. */
@@ -30,7 +34,8 @@ export interface TokenRecord {
      */
     readonly address: string;
     /**
-     * For a token redeemed with a code — `signInCode` — the code's hash, keyed
+     * For a token redeemed with an e-mailed code — `signInCode`, and a
+     * `stepUp` sent by e-mail — the code's hash, keyed
      * by the token's secret, so the tokens alone do not reveal it. `null` for
      * every other kind: the core writes it so, and a store keeps what it is
      * given.
@@ -99,8 +104,9 @@ export interface TokenStore {
      * Spends every **unspent** token of one user and one `kind` at `at` —
      * but the one whose hash is `except`, when given — and answers how many
      * it spent. What issuing a sign-in code calls, sparing the code it just
-     * issued, so only the last code sent works; and what writing a password
-     * calls, so no second-factor challenge opened with the old one survives.
+     * issued, so only the last code sent works — and so for a reset link and
+     * a step-up; and what writing a password calls, so no reset link and no
+     * second-factor challenge opened with the old one survives.
      *
      * - A spent token keeps its `spentAt`: it never changes once set.
      * - A token of another `kind`, or of another user, is not touched.

package/dist/auth/port/types/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,CAAC;AAEhB,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,QAAQ,CAAC;AAEZ,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}

package/dist/auth/second-factor/{regenerate-attempts.d.ts → app-code-attempts.d.ts}

@@ -2,9 +2,11 @@ import type { Context } from '../context';
 import type { UserRecord } from '../port/types';
 import type { Sealer } from '../sealing';
 /**
- * The attempts at `regenerateRecoveryCodes`, counted by the store — the same
- * {@link CODE_ATTEMPTS} a challenge takes, per user and per window, so a
- * stolen session cannot guess the app's code at leisure.
+ * The attempts at an app's code outside a sign-in — `regenerateRecoveryCodes`
+ * and a step-up confirmed with the app — counted by the store, in one count
+ * both share: the same {@link CODE_ATTEMPTS} a challenge takes, per user and
+ * per window, so a stolen session cannot guess the app's code at leisure,
+ * nor buy more guesses by switching from one to the other.
  *
  * **No port of its own.** The count is a one-time token of kind
  * `secondFactor`, counted by `countAttempt` like a challenge's: one
@@ -13,7 +15,7 @@ import type { Sealer } from '../sealing';
  * without the sealing keys can name it — nor redeem it as a challenge.
  *
  * What it is for decides when it starts again: the **window**, a fixed
- * {@link REGENERATE_WINDOW_MS} slice of the clock, and the factor's
+ * {@link APP_CODE_WINDOW_MS} slice of the clock, and the factor's
  * `lastStep`, which **any code accepted** moves — a regenerate that
  * succeeded starts the count again, and so does a sign-in finished with the
  * app.
@@ -24,11 +26,12 @@ import type { Sealer } from '../sealing';
  * from them — a password written between guesses buys none.
  */
 /** How long the attempts of one window last: fifteen minutes. */
-export declare const REGENERATE_WINDOW_MS: number;
+export declare const APP_CODE_WINDOW_MS: number;
 /**
- * Counts one attempt at regenerating the user's recovery codes, before the
- * code is compared, and answers how many are left. Past the last one, it
- * refuses — the right code included — until the window ends.
+ * Counts one attempt at the app's code — to regenerate the user's recovery
+ * codes, or to confirm a step-up — before the code is compared, and
+ * answers how many are left. Past the last one, it refuses — the right
+ * code included — until the window ends.
  */
-export declare function countRegenerateAttempt(context: Context, sealer: Sealer, record: UserRecord, where: string): Promise<number>;
-//# sourceMappingURL=regenerate-attempts.d.ts.map
+export declare function countAppCodeAttempt(context: Context, sealer: Sealer, record: UserRecord, where: string): Promise<number>;
+//# sourceMappingURL=app-code-attempts.d.ts.map

package/dist/auth/second-factor/app-code-attempts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-code-attempts.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/app-code-attempts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAAc,CAAC;AA8C9C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/dist/auth/sessions/authenticate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/authenticate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,YAAY,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI3D,oFAAoF;AACpF,wBAAsB,YAAY,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAqDxC"}
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/authenticate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,YAAY,CAAC;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI3D,oFAAoF;AACpF,wBAAsB,YAAY,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CA0CxC"}

package/dist/auth/sessions/fresh.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `assertFresh`: whether a session proved who it is recently enough for a
+ * sensitive action — signed in, or confirmed by a step-up, less than
+ * `maxAge` ago.
+ */
+import { type Clock } from '../../time/clock';
+import { type Duration } from '../../time/duration';
+import type { Session } from '../types';
+/**
+ * Refuses a session whose credentials were last presented `maxAge` ago or
+ * more — at its sign-in, or since by `stepUp.confirm` — with
+ * `STEP_UP_REQUIRED` (403): ask for a step-up, then run the action again. One
+ * field of the session `authenticate` already answered, so no store is read.
+ *
+ * ```ts
+ * const current = await auth.authenticate(request);
+ * if (current === null) return new Response(null, { status: 401 });
+ * assertFresh(current.session, '10m'); // STEP_UP_REQUIRED past ten minutes
+ * ```
+ *
+ * Pass the `clock` given to `janus()` when it is not the system's. A
+ * `maxAge` that is not a duration is a `TypeError`: it is written in the
+ * code, never read from a request.
+ */
+export declare function assertFresh(session: Pick<Session, 'authenticatedAt' | 'userId'>, maxAge: Duration, clock?: Clock): void;
+//# sourceMappingURL=fresh.d.ts.map

package/dist/auth/sessions/fresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fresh.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/fresh.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,KAAK,QAAQ,EAAiB,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAC1B,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CAAC,EACpD,MAAM,EAAE,QAAQ,EAChB,KAAK,GAAE,KAAmB,GACxB,IAAI,CASN"}

package/dist/auth/sessions/standing.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The standing session a request presents — one rule for `authenticate` and
+ * `stepUp.confirm`, so the two never disagree on what "signed in" means.
+ */
+import type { Context } from '../context';
+import type { SessionRecord } from '../port/types';
+import type { RequestLike } from '../types';
+/** A standing session, and the session token that presented it. */
+export interface Presented {
+    readonly token: string;
+    readonly session: SessionRecord;
+}
+/**
+ * Answers the session `request` presents, with its token — or `null` when
+ * none stands: no token, or a session gone, revoked or lapsed. Expiry is
+ * decided here, against the context's clock: a store may still hold a
+ * session past its term.
+ */
+export declare function standingSession(context: Context, request: RequestLike): Promise<Presented | null>;
+//# sourceMappingURL=standing.d.ts.map

package/dist/auth/sessions/standing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.d.ts","sourceRoot":"","sources":["../../../src/auth/sessions/standing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,WAAW,GAClB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAa3B"}

package/dist/auth/step-up/codes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The two codes that confirm a step-up: the one e-mailed with the challenge,
+ * and, for a user whose second factor is active, the one their app shows.
+ * Each spends the challenge once it matched.
+ */
+import type { ResolvedType } from '../config';
+import type { Context } from '../context';
+import type { TokenRecord, UserRecord } from '../port/types';
+/** A challenge counted: the token as counted, its secret, and what is left of its attempts. */
+export interface CountedStepUp {
+    readonly token: TokenRecord;
+    readonly secret: string;
+    readonly attemptsLeft: number;
+}
+/**
+ * Checks the e-mailed code. Refused when the user's second factor became
+ * active since it was sent — their app is what confirms now — and when the
+ * e-mail it was sent to is not theirs any more.
+ */
+export declare function checkEmailedCode(context: Context, type: ResolvedType, user: UserRecord, counted: CountedStepUp, code: string, where: string): Promise<void>;
+/**
+ * Checks a code from the user's app. Its attempts are counted twice before it
+ * is compared: against the challenge, and per user and window, as
+ * `regenerateRecoveryCodes`' are — a stolen session asking for challenge
+ * after challenge still gets five guesses per window, not five per
+ * challenge. The code accepted is written, so it confirms nothing else.
+ */
+export declare function checkAppCode(context: Context, type: ResolvedType, user: UserRecord, counted: CountedStepUp, code: string, where: string): Promise<void>;
+//# sourceMappingURL=codes.d.ts.map

package/dist/auth/step-up/codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codes.d.ts","sourceRoot":"","sources":["../../../src/auth/step-up/codes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAI7D,+FAA+F;AAC/F,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAKD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/dist/auth/step-up/flows.d.ts

@@ -0,0 +1,19 @@
+/**
+ * A step-up: a signed-in user proving again who they are before a sensitive
+ * action, with a code sent by e-mail — or from their app, when their second
+ * factor is active — and **the session they are on stamped as freshly
+ * confirmed**. It opens no session: its `authenticatedAt` moves, which is
+ * what a route checks with `assertFresh`.
+ *
+ * The same six digits, challenge and five attempts as a sign-in code, on a
+ * token kind of its own: a sign-in code never confirms an action, nor an
+ * action's code signs anyone in.
+ */
+import type { At } from '../at';
+import type { ResolvedType } from '../config';
+import type { AnyUser, Context } from '../context';
+import type { StepUpApi } from '../types';
+import { type IssuedStepUp } from './request';
+/** The step-up of one user type. */
+export declare function stepUpFlows(context: Context, type: ResolvedType, at: At): StepUpApi<AnyUser, IssuedStepUp>['stepUp'];
+//# sourceMappingURL=flows.d.ts.map

package/dist/auth/step-up/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../../src/auth/step-up/flows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,KAAK,EAAwB,SAAS,EAAE,MAAM,UAAU,CAAC;AAGhE,OAAO,EAAE,KAAK,YAAY,EAAiB,MAAM,WAAW,CAAC;AAE7D,oCAAoC;AACpC,wBAAgB,WAAW,CAC1B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAiB5C"}