@nxgt/janus 0.12.0 → 0.14.0

package/README.md

@@ -186,7 +186,7 @@ if (error instanceof JanusError) {
 | `LOGIN_TAKEN`, `VERSION_CONFLICT` | 409 |
 | `USER_INVALID` | 400, field by field from `issues` |
 | `PASSWORD_TOO_SHORT`, `HASH_UNSUPPORTED` | 400 |
-| `CREDENTIALS_INVALID` | 401 — one code for an unknown login, no password and a wrong one |
+| `CREDENTIALS_INVALID` | 401 — one code for an unknown login, no password, a wrong one and a login throttled for too many; `retryAfter`, when set, belongs in the body and a `Retry-After` header |
 | `CODE_INVALID` | 401 — a one-time code that does not match: a second factor's, or one sent by e-mail; `attemptsLeft` from either `confirm` belongs in the body |
 | `SECOND_FACTOR_NOT_ENROLLED`, `SECOND_FACTOR_ACTIVE` | 409 — the factor is not in the state the call needs |
 | `USER_INACTIVE` | 403 |
@@ -384,6 +384,20 @@ else reaches the store and is asynchronous.
   `findUser` and `getUser` across types, `cookie.serialize(token, session)` and
   `cookie.clear()` — `HttpOnly; SameSite=Lax; Secure` unless you say otherwise
   — and `collectExpired`.
+- **Password guessing is throttled**, on by default: past ten passwords
+  tried at one login in a 15-minute window, `signIn` refuses every one — the
+  right password included — with `CREDENTIALS_INVALID`, `reason:
+  'throttled'` and `retryAfter`, the seconds until the next window. Nothing
+  locks, a login nobody holds is counted alike, and a password sign-in that
+  opens a session — after its second factor, when one is active — starts
+  the count again. `signIn: { throttle: { attempts, window } }`
+  changes it, `signIn: { throttle: false }` turns it off; a store that
+  cannot count throws `STORE_FAILED`
+  ([passwords](docs/guide/passwords.md#password-guessing-is-throttled)).
+
+  ```ts
+  janus({ user, password: { login: 'email' }, store, hasher, signIn: { throttle: { attempts: 5, window: '1h' } } });
+  ```
 - **Sessions** last `'7d'` and slide: `authenticate` renews one once `renewAfter`
   (`'1d'`) has passed, writing at most once per period, and says so with
   `renewed`. The token is handed back once; the store only holds its `sha256`.
@@ -687,34 +701,45 @@ await auth.signUp({ email, password }); // the listener has the event before thi
 | `user.created` | `create`, `signUp` |
 | `user.emailVerified` | `verifyEmail.confirm`; `resetPassword.confirm` and `signInCode.confirm`, whose link or code proves the e-mail too — never for an e-mail already verified |
 | `user.passwordReset` | `resetPassword.confirm` |
+| `user.passwordChanged` | `changePassword`, `setPassword` — never a reset, which is `user.passwordReset` alone |
+| `user.emailChanged` | `update`, when it changed the e-mail — carrying `formerEmail`, the address before (`null` for none) |
 | `user.secondFactorEnabled` | `secondFactor.activate`, once the factor is active — not `enroll`, which leaves it waiting |
 | `user.secondFactorDisabled` | `secondFactor.disable`, when it removed an active factor — never for a user who had none, or one still waiting |
 | `user.recoveryCodesRegenerated` | `secondFactor.regenerateRecoveryCodes` — not `activate`, whose codes come with `user.secondFactorEnabled` |
 | `user.recoveryCodeUsed` | `secondFactor.recover`, once the recovery code is spent: a sign-in without the user's phone |
 | `user.deleted` | `delete`, once — a replay that deletes nobody sends nothing |
 
-- **The user is named by id, and nothing else**: no login, no e-mail, no
-  field, no password, no token. Whoever receives the event reads the rest
-  from where it is kept, if they may.
+- **The user is named by id, and nothing else**: no login, no field, no
+  password, no token. Whoever receives the event reads the rest from where it
+  is kept, if they may. One exception: `user.emailChanged` carries
+  `formerEmail`, which nothing keeps once the write landed, so a notice can
+  reach the inbox the account just left. `@nxgt/janus-webhooks` never posts
+  it.
 - **Each event has an `id` of its own**, a UUIDv7: the key to deliver it once.
 - **The listener runs after the write, and is awaited** before the
   flow answers, so a durable queue has the event by then. `occurredAt` is the
   write's own time. A refused flow sends nothing.
 - **Typed**: `events` is a `UserEventListener`; `UserEventType` is the closed
-  union of the eight types, so a `switch` on `event.type` is exhaustive — and
-  a new type, like the two recovery-code ones in 0.10, breaks it until handled.
+  union of the ten types, so a `switch` on `event.type` is exhaustive — and
+  a new type, like the two recovery-code ones in 0.10 or the two change ones
+  in 0.14, breaks it until handled.
 - **A listener that throws fails no flow** — the write happened. It is a
   `JANUS_EVENT_FAILED` warning naming the event's type, its id and the user's
   id, never the failure's message.
 
-To tell the user their second factor was turned on or off, or that a
-recovery code was used, send
+To tell the user their password or e-mail changed, their second factor was
+turned on or off, or that a recovery code was used, send
 [`@nxgt/janus-mail`](https://www.npmjs.com/package/@nxgt/janus-mail)'s notice
 from the listener — or from a queue it feeds:
 
 ```ts
 // `mail` is janusMail({ … }), and the user schema holds a name and a locale.
 async events(event) {
+	if (event.type === 'user.emailChanged' && event.formerEmail != null) {
+		const user = await auth.get(event.userId);
+		// To the former address: the new one belongs to whoever changed it.
+		await mail.emailChanged({ name: user.name, locale: user.locale, formerEmail: event.formerEmail, newEmail: user.email });
+	}
 	if (event.type === 'user.secondFactorDisabled') {
 		const user = await auth.get(event.userId);
 		await mail.twoFactorDisabled({ name: user.name, locale: user.locale, email: user.email });
@@ -733,8 +758,8 @@ async events(event) {
 
 To post them as signed webhooks:
 [`@nxgt/janus-webhooks`](https://www.npmjs.com/package/@nxgt/janus-webhooks).
-[The user events guide](docs/guide/events.md) has the listener, the eight
-types, mail for a recovery code used, what a failure costs, and a test.
+[The user events guide](docs/guide/events.md) has the listener, the ten
+types, mail for a recovery code used or a password or e-mail changed, what a failure costs, and a test.
 
 ### Permissions — `@nxgt/janus/permissions`
 
@@ -1025,6 +1050,30 @@ waiting on its second factor is spent with them — as it is by `setPassword`
 and `changePassword`; what the visitor does next is
 your policy. A password refused for its length does not spend the token.
 
+**Only the last reset link works, and only until the password changes.** A
+`resetPassword.request` spends the user's earlier links, and any password
+written — by a link, `changePassword` or `setPassword` — spends every link
+still live, so an older e-mail's link answers `TOKEN_SPENT`. Tell the visitor
+to use the latest e-mail, and rate-limit `resetPassword.request` per address:
+each request cancels the link before it.
+
+**`signIn` throttles each login, not each client.** Ten passwords per login
+per 15 minutes, then `CREDENTIALS_INVALID` with `retryAfter` until the window
+ends — the right password too, so tell the visitor to wait `retryAfter`
+seconds rather than that the password is wrong. `CredentialRefusal` gained
+`'throttled'`: an exhaustive `switch` over `error.reason` must handle it. A
+test that tries more than ten wrong passwords at one login over a
+`fixedClock` is throttled too: advance the clock past `retryAfter`, or wire
+`signIn: { throttle: false }`. **Somebody who knows a login can keep its
+password sign-in shut**, ten tries a window; a sign-in code, when you wire them, still opens it.
+On PostgreSQL, delete lapsed tokens on a schedule: every login tried adds a
+row per window. One password tried against
+many logins is not counted: rate-limit `signIn` per client address yourself
+([passwords](docs/guide/passwords.md#what-you-still-limit-yourself)). The
+counts live in the tokens store: a flushed or evicting Redis forgets them,
+and a tokens store that cannot answer fails every password sign-in with
+`STORE_FAILED`.
+
 **A sign-in can move a user's `version`.** Rewriting a stale hash is a write. A
 user object read before that sign-in, and then passed as `ifVersion`, gets
 `VERSION_CONFLICT`. That is the conflict doing its job: read the user again.
@@ -1102,7 +1151,7 @@ that sends one, since it is awaited: queue the event and return.
 
 ## Type safety, counted
 
-**One hundred and twenty-nine plausible mistakes, one hundred and twenty-nine refused at compile time — and
+**One hundred and thirty-seven plausible mistakes, one hundred and thirty-seven refused at compile time — and
 two gaps, named.**
 
 The lists are typechecked and never run, with one `@ts-expect-error` per
@@ -1110,9 +1159,9 @@ mistake beside the shapes that must keep compiling. One is a single file:
 `test/types/refusals.ts` (fifteen, on the shared vocabulary). The other three
 are folders with one file per behaviour: `test/types/port/` (twenty-four, on
 the identity stores' port, from the point of view of the person implementing
-it), `test/types/auth/` (forty-two, on `janus()`, from the point of view of
+it), `test/types/auth/` (fifty, on `janus()`, from the point of view of
 the application — twelve of them on the second factor, three on sign-in codes,
-three on user events, four on step-ups) and `test/types/permissions/` (forty-eight, on the
+five on user events, four on step-ups, six on the sign-in throttle) and `test/types/permissions/` (forty-eight, on the
 permission model and the questions asked of it). The rule comes from
 `nxgt-data`, and so does the reason to distrust the claim without the files:
 when it was last measured on `@nxgt/mongo`, *seven of twelve plausible

package/dist/auth/config/index.d.ts

@@ -9,7 +9,7 @@
  * Gathered here from the files beside this one.
  */
 export type { PasswordHasher } from './hasher';
-export type { CookieConfig, JanusConfig, MultiTypeConfig, SecondFactorConfig, SingleTypeConfig, } from './janus-config';
+export type { CookieConfig, JanusConfig, MultiTypeConfig, SecondFactorConfig, SignInConfig, SignInThrottleConfig, SingleTypeConfig, } from './janus-config';
 export { type Normalize, normalizeEmail } from './normalize';
 export type { PasswordConfig } from './password-config';
 export { RESERVED_FIELDS, RESERVED_TYPES, SINGLE_TYPE } from './reserved';

package/dist/auth/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EACX,UAAU,EACV,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EACX,UAAU,EACV,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,aAAa,CAAC"}

package/dist/auth/config/janus-config.d.ts

@@ -51,6 +51,13 @@ interface SharedConfig {
         /** How long a step-up's challenge waits, e-mailed or not. `'10m'` when absent. */
         readonly stepUp?: Duration;
     };
+    /**
+     * How `signIn` answers password guessing. **On by default**: past ten
+     * passwords tried at one login in a 15-minute window, `signIn` answers
+     * `CREDENTIALS_INVALID` with `retryAfter` — the right password included —
+     * until the next window. Nothing locks: the next window signs in.
+     */
+    readonly signIn?: SignInConfig;
     /**
      * A TOTP second factor, for every user type with a password. Absent, no
      * `secondFactor` flows exist and `signIn` answers a session directly.
@@ -66,6 +73,22 @@ interface SharedConfig {
      */
     readonly events?: UserEventListener;
 }
+/** What `signIn` does with password guessing. */
+export interface SignInConfig {
+    /**
+     * The passwords one login may try per window. `{ attempts: 10, window:
+     * '15m' }` when absent; `false` counts nothing — rate-limit `signIn`
+     * yourself then.
+     */
+    readonly throttle?: SignInThrottleConfig | false;
+}
+/** How many passwords one login may try, and per how long. */
+export interface SignInThrottleConfig {
+    /** Passwords tried per login and per window, the right one included. `10` when absent. */
+    readonly attempts?: number;
+    /** How long one window lasts. `'15m'` when absent. */
+    readonly window?: Duration;
+}
 /** What a TOTP second factor needs: a name for the app, and the keys that seal. */
 export interface SecondFactorConfig {
     /** Shown in the authenticator app beside the account: your product's name. */

package/dist/auth/config/janus-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC/B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC3B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC/B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC3B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CACjD;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACpC,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}

package/dist/auth/config/resolve-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EACX,WAAW,EAGX,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,mBAAmB,CAAC;AAGtE,qFAAqF;AACrF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,cAAc,CAuBhB"}
+{"version":3,"file":"resolve-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EACX,WAAW,EAGX,MAAM,gBAAgB,CAAC;AAOxB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,mBAAmB,CAAC;AAGtE,qFAAqF;AACrF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,cAAc,CAwBhB"}

package/dist/auth/config/resolve-sign-in.d.ts

@@ -0,0 +1,5 @@
+/** Resolves `signIn.throttle`: on unless `false`, ten passwords per login per fifteen minutes. */
+import type { SignInConfig } from './janus-config';
+import type { ResolvedConfig } from './resolved-config';
+export declare function resolveSignInThrottle(config: SignInConfig | undefined, where: string): ResolvedConfig['signInThrottle'];
+//# sourceMappingURL=resolve-sign-in.d.ts.map

package/dist/auth/config/resolve-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-sign-in.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-sign-in.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAGlG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,KAAK,EAAE,MAAM,GACX,cAAc,CAAC,gBAAgB,CAAC,CAoBlC"}

package/dist/auth/config/resolved-config.d.ts

@@ -27,6 +27,11 @@ export interface ResolvedConfig {
         readonly signInCode: number;
         readonly stepUp: number;
     };
+    /** `null` when `signIn.throttle` is `false`. */
+    readonly signInThrottle: {
+        readonly attempts: number;
+        readonly windowMs: number;
+    } | null;
     readonly secondFactor: {
         readonly issuer: string;
         readonly sealer: Sealer;

package/dist/auth/config/resolved-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}
+{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}

package/dist/auth/derived-keys.d.ts

@@ -0,0 +1,9 @@
+import type { Sealer } from './sealing';
+/**
+ * The key `keyId` lends `purpose` — the first key by default — derived once
+ * per key, or `undefined` when the sealer no longer holds that key.
+ */
+export declare function derivedKey(sealer: Sealer, purpose: string, keyId?: string): Buffer | undefined;
+/** HMAC-SHA256 of `parts`, joined by a NUL — which no part may hold. */
+export declare function keyedHash(key: Buffer, parts: readonly string[]): Buffer;
+//# sourceMappingURL=derived-keys.d.ts.map

package/dist/auth/derived-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-keys.d.ts","sourceRoot":"","sources":["../../src/auth/derived-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAWxC;;;GAGG;AACH,wBAAgB,UAAU,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,MAAwB,GAC7B,MAAM,GAAG,SAAS,CAepB;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvE"}

package/dist/auth/email-flows/reset-password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/reset-password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAOZ,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,KAAK,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,aAAa,CA4Bf"}
+{"version":3,"file":"reset-password.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/reset-password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAOZ,MAAM,YAAY,CAAC;AAKpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAGjD,KAAK,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,aAAa,CAqCf"}

package/dist/auth/events.d.ts

@@ -8,6 +8,11 @@ import type { Context } from './context';
  *   `resetPassword.confirm` or the code of `signInCode.confirm`, which prove
  *   the e-mail too; never for an e-mail already verified;
  * - `user.passwordReset` — by `resetPassword.confirm`;
+ * - `user.passwordChanged` — by `changePassword` and `setPassword`; never by a
+ *   reset, which is `user.passwordReset` alone;
+ * - `user.emailChanged` — by `update`, when it changed the e-mail — compared
+ *   normalised, the same test that makes the new one unverified. The one
+ *   event that carries more than the user: `formerEmail`;
  * - `user.secondFactorEnabled` — by `secondFactor.activate`, once the factor
  *   is active: not by `enroll`, which leaves it waiting for its first code;
  * - `user.secondFactorDisabled` — by `secondFactor.disable`, when it removed
@@ -19,11 +24,12 @@ import type { Context } from './context';
  *   spent: a sign-in without the user's phone;
  * - `user.deleted` — by `delete`, once; a replay that finds nobody is none.
  */
-export type UserEventType = 'user.created' | 'user.emailVerified' | 'user.passwordReset' | 'user.secondFactorEnabled' | 'user.secondFactorDisabled' | 'user.recoveryCodesRegenerated' | 'user.recoveryCodeUsed' | 'user.deleted';
+export type UserEventType = 'user.created' | 'user.emailVerified' | 'user.passwordReset' | 'user.passwordChanged' | 'user.emailChanged' | 'user.secondFactorEnabled' | 'user.secondFactorDisabled' | 'user.recoveryCodesRegenerated' | 'user.recoveryCodeUsed' | 'user.deleted';
 /**
  * A user event: **the user named by id, and nothing else** — no login, no
- * e-mail, no field, no password, no token. Whoever receives it reads the rest
- * from where it is kept, if they may.
+ * field, no password, no token. Whoever receives it reads the rest from where
+ * it is kept, if they may. One exception, `formerEmail` on
+ * `user.emailChanged`: once the write landed, the old address is kept nowhere.
  */
 export interface UserEvent {
     /** A UUIDv7 minted for this event: the key to deliver it once. */
@@ -36,7 +42,16 @@ export interface UserEvent {
     readonly occurredAt: Date;
     readonly userId: Id;
     readonly userType: string;
+    /**
+     * On `user.emailChanged` only: the address the user had before, as it was
+     * stored — `null` when they had none. So a notice can reach the inbox the
+     * account was just taken from; the new address is on the user. Absent
+     * from every other type, and from an event a webhook delivered.
+     */
+    readonly formerEmail?: string | null;
 }
+/** What an event carries beyond the user, on the one type that does. */
+export type EventExtras = Pick<UserEvent, 'formerEmail'>;
 /**
  * What `janus({ events })` takes: called once per event, **after** the write
  * landed and before the flow answers — awaited, so a queue that stores the
@@ -57,5 +72,5 @@ export declare function resolveEvents(events: unknown, where: string): UserEvent
 export declare function emit(context: Context, type: UserEventType, user: {
     readonly id: Id;
     readonly type: string;
-}, occurredAt: Date): Promise<void>;
+}, occurredAt: Date, extras?: EventExtras): Promise<void>;
 //# sourceMappingURL=events.d.ts.map

package/dist/auth/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/auth/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,0BAA0B,GAC1B,2BAA2B,GAC3B,+BAA+B,GAC/B,uBAAuB,GACvB,cAAc,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3E,oFAAoF;AACpF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,GAAG,IAAI,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CACzB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAChD,UAAU,EAAE,IAAI,GACd,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/auth/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,2BAA2B,GAC3B,+BAA+B,GAC/B,uBAAuB,GACvB,cAAc,CAAC;AAElB;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3E,oFAAoF;AACpF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,GAAG,IAAI,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CACzB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAChD,UAAU,EAAE,IAAI,EAChB,MAAM,GAAE,WAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/auth/index.d.ts

@@ -1,4 +1,4 @@
-export type { CookieConfig, FieldsJson, JanusConfig, MultiTypeConfig, Normalize, PasswordConfig, PasswordHasher, SecondFactorConfig, SessionConfig, SingleTypeConfig, UserSchema, UserTypeConfig, } from './config';
+export type { CookieConfig, FieldsJson, JanusConfig, MultiTypeConfig, Normalize, PasswordConfig, PasswordHasher, SecondFactorConfig, SessionConfig, SignInConfig, SignInThrottleConfig, SingleTypeConfig, UserSchema, UserTypeConfig, } from './config';
 export type { UserEvent, UserEventListener, UserEventType, } from './events';
 export { bunHasher, scryptHasher } from './hashers';
 export { janus } from './janus';

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}

package/dist/auth/one-time/index.d.ts

@@ -2,7 +2,8 @@
  * What every one-time token shares — an e-mail link, a sign-in code, a
  * second-factor challenge — kept in one place so they cannot drift apart:
  * issuing it (`issue.ts`), spending it (`spend.ts`), refusing it
- * (`refusals.ts`) and the code it may carry (`codes.ts`).
+ * (`refusals.ts`), the code it may carry (`codes.ts`) and the attempts a
+ * window counts in tokens of its own (`window.ts`).
  *
  * Gathered here from the files beside this one.
  */
@@ -10,4 +11,5 @@ export { CODE_ATTEMPTS, codeInvalid, codeMatches, countCodeAttempt, hashCode, un
 export { issueCode, issueOneTime } from './issue';
 export { type OneTimeNoun, refuseStale, refuseUnusable, unknownOneTime, } from './refusals';
 export { burnOneTime, spendOneTime } from './spend';
+export { type AttemptWindow, type CountedAttempt, countInWindow, MAX_LINKS, } from './window';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/one-time/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/one-time/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACN,aAAa,EACb,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,WAAW,EAChB,WAAW,EACX,cAAc,EACd,cAAc,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/one-time/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,aAAa,EACb,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,WAAW,EAChB,WAAW,EACX,cAAc,EACd,cAAc,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,aAAa,EACb,SAAS,GACT,MAAM,UAAU,CAAC"}

package/dist/auth/one-time/window.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Attempts counted by the store in fixed windows of the clock — what bounds
+ * the codes tried at an app outside a sign-in (`second-factor/app-code-attempts.ts`)
+ * and the passwords tried at one login (`../sign-in-attempts.ts`).
+ *
+ * **No port of its own.** The count is a one-time token of kind
+ * `secondFactor`, counted by `countAttempt` like a challenge's: one
+ * conditional write per attempt, never read then written, so twenty guesses
+ * at once are twenty distinct counts. Its secret is never given out: each
+ * caller names it by a keyed hash of what the count is for, so it cannot be
+ * redeemed as a challenge.
+ *
+ * A token once spent counts nothing more. So the count is a **chain** of
+ * links, and what a spent link means is the caller's to say: `carry`, and the
+ * next link carries on from the attempts it holds — a password written, which
+ * spends every `secondFactor` token of the user, buys no guess; `restart`,
+ * and the next link starts from zero — a sign-in that succeeded spends the
+ * link it counted on, and the login's count starts again.
+ */
+import type { Context } from '../context';
+/**
+ * More links than this in one window, for `carry`: more passwords written
+ * than guesses, and the count is past any limit.
+ */
+export declare const MAX_LINKS = 32;
+/** What {@link countInWindow} counts, and how. */
+export interface AttemptWindow {
+    /** How long one window lasts, in milliseconds. */
+    readonly windowMs: number;
+    /** What a spent link means: its attempts carried on, or a count started again. */
+    readonly spent: 'carry' | 'restart';
+    /** The `userId` each link is stored under. */
+    readonly userId: string;
+    /** A link's token hash in one window: never given out, and never a secret. */
+    readonly linkHash: (window: number, link: number) => string;
+    /** What to throw when a link is gone right after it was stored, or the links never end. */
+    readonly vanished: () => Error;
+}
+/** One attempt, counted. */
+export interface CountedAttempt {
+    /** The attempts of this window, this one included. */
+    readonly attempts: number;
+    /** The link it was counted on — what spending restarts — or `null` past the last one. */
+    readonly link: string | null;
+    /** When the window ends, in milliseconds since the epoch. */
+    readonly endsAt: number;
+}
+/** Counts one attempt in the current window, before anything is compared. */
+export declare function countInWindow(context: Context, counting: AttemptWindow): Promise<CountedAttempt>;
+//# sourceMappingURL=window.d.ts.map

package/dist/auth/one-time/window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.d.ts","sourceRoot":"","sources":["../../../src/auth/one-time/window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAG1C;;;GAGG;AACH,eAAO,MAAM,SAAS,KAAK,CAAC;AAQ5B,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5D,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,CAAC;CAC/B;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAUD,6EAA6E;AAC7E,wBAAsB,aAAa,CAClC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC,CAazB"}

package/dist/auth/password-written.d.ts

@@ -4,12 +4,35 @@ import { type AnyUser, type Context } from './context';
 import type { UserRecord } from './port/types';
 import type { SignInResult } from './types';
 /**
- * What writing a password ends besides: every second-factor challenge of the
- * user still open, so a sign-in started with the old password cannot be
- * finished. Called **after** the write — the other half of
- * {@link heldByPassword}, which reads **after** it issued.
+ * What writing a password ends besides. A reset, a change and a set each call
+ * it **after** the write, and a failure here throws — it is never ignored:
+ *
+ * - The user's reset links still unspent. A link answers a request to
+ *   replace the password; once it is replaced, an older link would replace
+ *   it again, without knowing the new one.
+ * - Every second-factor challenge still open, so a sign-in started with the
+ *   old password cannot be finished — the other half of
+ *   {@link heldByPassword}, which reads **after** it issued.
+ *
+ * Both spends are attempted even when one fails, so a store failing one kind
+ * still spends the other; the first failure is then thrown.
+ *
+ * After the write, not before: a link issued while the password is written
+ * is spent too, where one issued between an earlier spend and the write
+ * would survive. So an outage here leaves the password written and the
+ * older links live, and the caller is told, with `STORE_FAILED`; the next
+ * `resetPassword.request` spends them. Sign-in codes and step-ups are left
+ * alone: the password proves neither, and a step-up belongs to a session,
+ * which a reset revokes.
+ */
+export declare function endWhatThePasswordOpened(context: Context, userId: Id): Promise<void>;
+/**
+ * What a change and a set do once the password is written: end what the
+ * old one opened, then send `user.passwordChanged` — from a `finally`, so an
+ * outage ending them still reports the write, which a retry would not make
+ * again. A reset sends `user.passwordReset` instead, from its own flow.
  */
-export declare function endSignInsWaiting(context: Context, userId: Id): Promise<void>;
+export declare function passwordChanged(context: Context, written: UserRecord): Promise<void>;
 /**
  * Whether the password a sign-in verified is still the user's, once the
  * sign-in answered. A password written meanwhile ends the sign-in: its

package/dist/auth/password-written.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-written.d.ts","sourceRoot":"","sources":["../../src/auth/password-written.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAGZ,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,EAAE,GACR,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB"}
+{"version":3,"file":"password-written.d.ts","sourceRoot":"","sources":["../../src/auth/password-written.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAGZ,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,EAAE,GACR,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/auth/port/types/tokens.d.ts

@@ -104,8 +104,9 @@ export interface TokenStore {
      * Spends every **unspent** token of one user and one `kind` at `at` —
      * but the one whose hash is `except`, when given — and answers how many
      * it spent. What issuing a sign-in code calls, sparing the code it just
-     * issued, so only the last code sent works; and what writing a password
-     * calls, so no second-factor challenge opened with the old one survives.
+     * issued, so only the last code sent works — and so for a reset link and
+     * a step-up; and what writing a password calls, so no reset link and no
+     * second-factor challenge opened with the old one survives.
      *
      * - A spent token keeps its `spentAt`: it never changes once set.
      * - A token of another `kind`, or of another user, is not touched.

package/dist/auth/port/types/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,QAAQ,CAAC;AAEZ,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../src/auth/port/types/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,YAAY,GACZ,QAAQ,CAAC;AAEZ,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IAC1B;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,GACN,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CACd,MAAM,EAAE,EAAE,EACV,IAAI,EAAE,SAAS,EACf,EAAE,EAAE,IAAI,EACR,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,gBAAgB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}

package/dist/auth/second-factor/app-code-attempts.d.ts

@@ -8,11 +8,9 @@ import type { Sealer } from '../sealing';
  * per window, so a stolen session cannot guess the app's code at leisure,
  * nor buy more guesses by switching from one to the other.
  *
- * **No port of its own.** The count is a one-time token of kind
- * `secondFactor`, counted by `countAttempt` like a challenge's: one
- * conditional write per attempt, never read then written. Its secret is
- * never given out; it is a keyed hash of what the count is for, so nobody
- * without the sealing keys can name it — nor redeem it as a challenge.
+ * Counted in an attempt window (`../one-time/window.ts`): a `secondFactor`
+ * token named by a keyed hash of what the count is for, so nobody without
+ * the sealing keys can name it — nor redeem it as a challenge.
  *
  * What it is for decides when it starts again: the **window**, a fixed
  * {@link APP_CODE_WINDOW_MS} slice of the clock, and the factor's
@@ -21,9 +19,8 @@ import type { Sealer } from '../sealing';
  * app.
  *
  * Writing a password spends every `secondFactor` token of the user, this one
- * included, and a spent token counts nothing more. So the count is a chain:
- * a spent link keeps the attempts it holds, and the next one carries on
- * from them — a password written between guesses buys none.
+ * included. So a spent link **carries** its attempts on to the next — a
+ * password written between guesses buys none.
  */
 /** How long the attempts of one window last: fifteen minutes. */
 export declare const APP_CODE_WINDOW_MS: number;

package/dist/auth/second-factor/app-code-attempts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-code-attempts.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/app-code-attempts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAAc,CAAC;AA8C9C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAgBjB"}
+{"version":3,"file":"app-code-attempts.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/app-code-attempts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAG1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,QAAc,CAAC;AA6B9C;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/auth/second-factor/challenge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAI/D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE;kBAGhE,UAAU,SACX,MAAM,GACX,OAAO,CAAC,oBAAoB,CAAC;uBAqBP,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;EAI3E"}
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAI/D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE;kBAGhE,UAAU,SACX,MAAM,GACX,OAAO,CAAC,oBAAoB,CAAC;uBAqBP,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;EAI3E"}

package/dist/auth/second-factor/recovery-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery-codes.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/recovery-codes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;;;;;GAYG;AAEH,sEAAsE;AACtE,eAAO,MAAM,cAAc,KAAK,CAAC;AASjC,kEAAkE;AAClE,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAQ5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7D;AAwBD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACV,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACX,MAAM,CA6BR"}
+{"version":3,"file":"recovery-codes.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/recovery-codes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;;;;;GAYG;AAEH,sEAAsE;AACtE,eAAO,MAAM,cAAc,KAAK,CAAC;AASjC,kEAAkE;AAClE,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAQ5C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7D;AASD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACV,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACX,MAAM,CA6BR"}

package/dist/auth/second-factor/recovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,EAAE,GACJ,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAmCnC"}
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAInD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAIhD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,EAAE,GACJ,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAoCnC"}

package/dist/auth/sign-in-attempts.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The passwords tried at one login, counted by the store per window —
+ * `janus({ signIn: { throttle } })`, ten per fifteen minutes by default.
+ * Past the last one, `signIn` answers `CREDENTIALS_INVALID` with
+ * `retryAfter`, the right password included, until the window ends. **Nothing
+ * locks** past a window — but somebody who keeps trying a login keeps its
+ * password sign-in shut, window after window: a per-client limit is the
+ * application's, and a sign-in code still opens the account.
+ *
+ * Counted per login, **known or not**: an unknown login is counted as a
+ * registered one is, so the throttle does not tell them apart. Counted
+ * before anything is looked up or compared, so of twenty guesses at once,
+ * exactly as many as the limit are compared.
+ *
+ * Counted in an attempt window (`one-time/window.ts`), in `secondFactor`
+ * tokens stored under no user: the `userId` of each is a keyed hash of the
+ * login, never the login. The key is derived from the sealing keys when
+ * `secondFactor` is configured; without them it is a fixed one, and the hash
+ * only keeps the login out of plain sight — safe because a `secondFactor`
+ * token is redeemed only by the second factor's flows, which do not exist
+ * without the keys. A sign-in that opens a session spends the link it
+ * counts on, and the login's count **restarts** from zero.
+ *
+ * A store that cannot count throws `STORE_FAILED`: never a refusal, and
+ * never a sign-in let through uncounted.
+ */
+import type { ResolvedType } from './config';
+import type { Context } from './context';
+import type { UserRecord } from './port/types';
+/**
+ * Counts one password tried at `login` — already normalised — before it is
+ * looked up, and refuses past the last one: the right password included.
+ */
+export declare function countSignInAttempt(context: Context, type: ResolvedType, login: string, where: string): Promise<void>;
+/**
+ * Starts the user's count again, once a sign-in opens a session: after the
+ * password alone, or after the second factor's code — never after the
+ * password of a user whose second factor is still to come, so knowing the
+ * password buys no more challenges. It counts one attempt on the current
+ * link, and spends it: the next one counts from zero.
+ */
+export declare function restartSignInCount(context: Context, type: ResolvedType, record: UserRecord, where: string): Promise<void>;
+//# sourceMappingURL=sign-in-attempts.d.ts.map

package/dist/auth/sign-in-attempts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-attempts.d.ts","sourceRoot":"","sources":["../../src/auth/sign-in-attempts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AA8C/C;;;GAGG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAWf"}