@nxgt/janus 0.13.0 → 0.15.0

package/README.md

@@ -46,7 +46,7 @@ a published entry point is a promise.
 ## Three ways to use it
 
 Janus has two sides. **Identities** answers *who is this?* — users, their
-logins and passwords, codes sent by e-mail, a TOTP second factor, sessions, one-time tokens. **Permissions** answers *may
+logins and passwords, codes and links sent by e-mail, a TOTP second factor, sessions, one-time tokens. **Permissions** answers *may
 they?* — a model, the tuples stored against it, and `can`. Each side is usable
 alone, and neither loads the other's code: a spec reads the import graph of
 each entry point and fails if one reaches into the other.
@@ -186,7 +186,7 @@ if (error instanceof JanusError) {
 | `LOGIN_TAKEN`, `VERSION_CONFLICT` | 409 |
 | `USER_INVALID` | 400, field by field from `issues` |
 | `PASSWORD_TOO_SHORT`, `HASH_UNSUPPORTED` | 400 |
-| `CREDENTIALS_INVALID` | 401 — one code for an unknown login, no password and a wrong one |
+| `CREDENTIALS_INVALID` | 401 — one code for an unknown login, no password, a wrong one and a login throttled for too many; `retryAfter`, when set, belongs in the body and a `Retry-After` header |
 | `CODE_INVALID` | 401 — a one-time code that does not match: a second factor's, or one sent by e-mail; `attemptsLeft` from either `confirm` belongs in the body |
 | `SECOND_FACTOR_NOT_ENROLLED`, `SECOND_FACTOR_ACTIVE` | 409 — the factor is not in the state the call needs |
 | `USER_INACTIVE` | 403 |
@@ -324,6 +324,8 @@ await auth.resetPassword.request(email);           // … | null
 await auth.resetPassword.confirm(token, newPassword);
 await auth.signInCode.request(email);              // { code, challenge, email, expiresAt, user } | null
 await auth.signInCode.confirm(challenge, code);    // { status: 'signedIn', user, session, token }
+await auth.magicLink.request(email);               // { token, email, expiresAt, user } | null
+await auth.magicLink.confirm(token);               // { status: 'signedIn', user, session, token }
 await auth.stepUp.request(user);                   // { via: 'email', code, challenge, email, expiresAt, user }
 await auth.stepUp.confirm(request, challenge, code); // the request's session, authenticatedAt: now
 
@@ -366,8 +368,8 @@ else reaches the store and is asynchronous.
   compile error on `login`, and the message lists the fields you could have
   meant. It is normalised with `'lowercaseTrim'` unless you say otherwise.
 - **`email`** defaults to the field named `email`. A type without one has no
-  `verifyEmail`, no `resetPassword` and no `signInCode` — they are absent from
-  its type, not failing at run time. Changing the e-mail sets `emailVerified`
+  `verifyEmail`, no `resetPassword`, no `signInCode` and no `magicLink` — they
+  are absent from its type, not failing at run time. Changing the e-mail sets `emailVerified`
   back to `false`.
 - **Per type**: `create`, `find` (or `null`), `get` (or `NOT_FOUND`), `list`,
   `update(user, patch)` — merged over the stored fields, then validated whole —
@@ -384,6 +386,20 @@ else reaches the store and is asynchronous.
   `findUser` and `getUser` across types, `cookie.serialize(token, session)` and
   `cookie.clear()` — `HttpOnly; SameSite=Lax; Secure` unless you say otherwise
   — and `collectExpired`.
+- **Password guessing is throttled**, on by default: past ten passwords
+  tried at one login in a 15-minute window, `signIn` refuses every one — the
+  right password included — with `CREDENTIALS_INVALID`, `reason:
+  'throttled'` and `retryAfter`, the seconds until the next window. Nothing
+  locks, a login nobody holds is counted alike, and a password sign-in that
+  opens a session — after its second factor, when one is active — starts
+  the count again. `signIn: { throttle: { attempts, window } }`
+  changes it, `signIn: { throttle: false }` turns it off; a store that
+  cannot count throws `STORE_FAILED`
+  ([passwords](docs/guide/passwords.md#password-guessing-is-throttled)).
+
+  ```ts
+  janus({ user, password: { login: 'email' }, store, hasher, signIn: { throttle: { attempts: 5, window: '1h' } } });
+  ```
 - **Sessions** last `'7d'` and slide: `authenticate` renews one once `renewAfter`
   (`'1d'`) has passed, writing at most once per period, and says so with
   `renewed`. The token is handed back once; the store only holds its `sha256`.
@@ -488,7 +504,11 @@ await sessions.reauthenticateSession(session.id, new Date()); // { …, authenti
 ```
 
 A token of kind `stepUp` is that confirmation's challenge: kept apart from
-`signInCode`, so neither is ever redeemed as the other.
+`signInCode`, so neither is ever redeemed as the other. A token of kind
+`magicLink`, new in 0.15, is a sign-in link's, kept apart from `signInCode`
+the same way: a sign-in code's challenge is held by whoever asked for it,
+and must never sign anyone in as a link. A store that lists the kinds — a
+`CHECK`, a validator's enum — adds `magicLink`.
 
 An adapter written against `@nxgt/janus` 0.3 does not compile against this
 port until it implements `countAttempt`, nor one written against 0.6 until it
@@ -620,6 +640,43 @@ A six-digit code sent to the user's e-mail signs them in, with no password.
 [The sign-in code guide](docs/guide/sign-in-code.md) has the request that
 tells nobody who exists, the challenge in a cookie, every error, and a test.
 
+### Sign-in links — `magicLink`
+
+```ts
+const issued = await auth.magicLink.request(email); // null for nobody, or an inactive user
+if (issued !== null) {
+	const link = `https://app.example/sign-in/link?token=${issued.token}`; // a page of yours
+	await sendMail(issued.email, `Sign in: ${link}`); // the token in the e-mail, and nowhere else
+}
+// answer the same page either way: nothing reaches the visitor, so there is nothing to forge
+
+// the page's button POSTs the token back — never confirm on the link's GET
+const signedIn = await auth.magicLink.confirm(token); // { status: 'signedIn', user, session, token }
+```
+
+A link sent to the user's e-mail signs them in: a sign-in code with nothing
+to type.
+
+- **On every user type with an e-mail**, with a password or without one, as
+  `signInCode`. A type with no e-mail has no `magicLink` at all.
+- **`request(email)` answers `null`** when nobody of this type holds that
+  e-mail, or the user is inactive — never say which. It answers a `token` of
+  32 random bytes, base64url, for a link; only its hash is stored. One link
+  is live per user: a new `request` spends the ones before. A link and a
+  code are separate: asking for one leaves the other live.
+- **`confirm(token)`** spends the token in one conditional write — of two
+  confirmations at once, one signs in — marks the e-mail verified and opens
+  the session. A link lives `'15m'` (`tokens.magicLink`); there are no
+  attempts, since there is nothing to guess. `TOKEN_STALE`, `USER_INACTIVE`
+  and an active second factor are handled as for a code.
+- **Not ended by a password write, nor limited by the sign-in throttle**:
+  the password proves nothing a link does, and the throttle counts
+  passwords. Rate-limit `request` per address and per client.
+
+[The sign-in link guide](docs/guide/magic-link.md) has the page that
+confirms from a `POST` so mail scanners spend nothing, every error, routes
+and a test.
+
 ### Step-up — `stepUp` and `assertFresh`
 
 ```ts
@@ -685,36 +742,47 @@ await auth.signUp({ email, password }); // the listener has the event before thi
 | `type` | Sent by |
 | --- | --- |
 | `user.created` | `create`, `signUp` |
-| `user.emailVerified` | `verifyEmail.confirm`; `resetPassword.confirm` and `signInCode.confirm`, whose link or code proves the e-mail too — never for an e-mail already verified |
+| `user.emailVerified` | `verifyEmail.confirm`; `resetPassword.confirm`, `magicLink.confirm` and `signInCode.confirm`, whose link or code proves the e-mail too — never for an e-mail already verified |
 | `user.passwordReset` | `resetPassword.confirm` |
+| `user.passwordChanged` | `changePassword`, `setPassword` — never a reset, which is `user.passwordReset` alone |
+| `user.emailChanged` | `update`, when it changed the e-mail — carrying `formerEmail`, the address before (`null` for none) |
 | `user.secondFactorEnabled` | `secondFactor.activate`, once the factor is active — not `enroll`, which leaves it waiting |
 | `user.secondFactorDisabled` | `secondFactor.disable`, when it removed an active factor — never for a user who had none, or one still waiting |
 | `user.recoveryCodesRegenerated` | `secondFactor.regenerateRecoveryCodes` — not `activate`, whose codes come with `user.secondFactorEnabled` |
 | `user.recoveryCodeUsed` | `secondFactor.recover`, once the recovery code is spent: a sign-in without the user's phone |
 | `user.deleted` | `delete`, once — a replay that deletes nobody sends nothing |
 
-- **The user is named by id, and nothing else**: no login, no e-mail, no
-  field, no password, no token. Whoever receives the event reads the rest
-  from where it is kept, if they may.
+- **The user is named by id, and nothing else**: no login, no field, no
+  password, no token. Whoever receives the event reads the rest from where it
+  is kept, if they may. One exception: `user.emailChanged` carries
+  `formerEmail`, which nothing keeps once the write landed, so a notice can
+  reach the inbox the account just left. `@nxgt/janus-webhooks` never posts
+  it.
 - **Each event has an `id` of its own**, a UUIDv7: the key to deliver it once.
 - **The listener runs after the write, and is awaited** before the
   flow answers, so a durable queue has the event by then. `occurredAt` is the
   write's own time. A refused flow sends nothing.
 - **Typed**: `events` is a `UserEventListener`; `UserEventType` is the closed
-  union of the eight types, so a `switch` on `event.type` is exhaustive — and
-  a new type, like the two recovery-code ones in 0.10, breaks it until handled.
+  union of the ten types, so a `switch` on `event.type` is exhaustive — and
+  a new type, like the two recovery-code ones in 0.10 or the two change ones
+  in 0.14, breaks it until handled.
 - **A listener that throws fails no flow** — the write happened. It is a
   `JANUS_EVENT_FAILED` warning naming the event's type, its id and the user's
   id, never the failure's message.
 
-To tell the user their second factor was turned on or off, or that a
-recovery code was used, send
+To tell the user their password or e-mail changed, their second factor was
+turned on or off, or that a recovery code was used, send
 [`@nxgt/janus-mail`](https://www.npmjs.com/package/@nxgt/janus-mail)'s notice
 from the listener — or from a queue it feeds:
 
 ```ts
 // `mail` is janusMail({ … }), and the user schema holds a name and a locale.
 async events(event) {
+	if (event.type === 'user.emailChanged' && event.formerEmail != null) {
+		const user = await auth.get(event.userId);
+		// To the former address: the new one belongs to whoever changed it.
+		await mail.emailChanged({ name: user.name, locale: user.locale, formerEmail: event.formerEmail, newEmail: user.email });
+	}
 	if (event.type === 'user.secondFactorDisabled') {
 		const user = await auth.get(event.userId);
 		await mail.twoFactorDisabled({ name: user.name, locale: user.locale, email: user.email });
@@ -733,8 +801,8 @@ async events(event) {
 
 To post them as signed webhooks:
 [`@nxgt/janus-webhooks`](https://www.npmjs.com/package/@nxgt/janus-webhooks).
-[The user events guide](docs/guide/events.md) has the listener, the eight
-types, mail for a recovery code used, what a failure costs, and a test.
+[The user events guide](docs/guide/events.md) has the listener, the ten
+types, mail for a recovery code used or a password or e-mail changed, what a failure costs, and a test.
 
 ### Permissions — `@nxgt/janus/permissions`
 
@@ -853,7 +921,7 @@ describeJanusStores({
 });
 ```
 
-There are 54 cases. They cover:
+There are 55 cases. They cover:
 - round-trip, byte for byte — including every edge character the core lets
   through (control characters, U+FFFF, a surrogate pair);
 - uniqueness, as a constraint: of twenty concurrent inserts of one login,
@@ -866,8 +934,9 @@ There are 54 cases. They cover:
   and never brings back a revoked session, even one revoked at the same
   moment;
 - one-time tokens: a token of every kind the port names is stored, counted
-  and spent — a `CHECK` or an enum that forgot `stepUp` fails here — and a
-  step-up is never counted, spent nor answered as a sign-in code; of twenty
+  and spent — a `CHECK` or an enum that forgot `stepUp` or `magicLink` fails
+  here — and neither a step-up nor a sign-in link is ever counted, spent nor
+  answered as a sign-in code; of twenty
   concurrent redemptions, exactly one succeeds; of twenty concurrent
   `countAttempt` calls, each answers a distinct count, and none is counted
   once a racing redemption spent the token;
@@ -913,9 +982,9 @@ runner-less layer.
 ## Traps
 
 **Once `secondFactor` is configured, switch on `signIn`'s `status`** — and
-on `signInCode.confirm`'s. A user whose factor is active gets
+on `signInCode.confirm`'s and `magicLink.confirm`'s. A user whose factor is active gets
 `{ status: 'secondFactor', challenge, expiresAt, userId }`, with no `token`
-and no `session`: an e-mailed code proves the e-mail, not the factor.
+and no `session`: an e-mailed code or link proves the e-mail, not the factor.
 `userId` is for your logs and rate limits — answer the visitor the
 challenge alone.
 `if (result.status === 'secondFactor') …` before anything reads them.
@@ -948,6 +1017,27 @@ address**: at most one code is live per user — a new `request` spends the one
 before — so without a limit anyone who knows an address can fill its inbox,
 or cancel its owner's code before they type it.
 
+**Confirm a sign-in link from a `POST`, never from its `GET`.** Mail
+scanners open every link in an e-mail before the user does: a route that
+calls `magicLink.confirm` on the link's `GET` spends it for the scanner, and
+the user's click answers `TOKEN_SPENT`. Link to a page that spends nothing,
+whose button posts the token — and echo into that page only a token of the
+token's shape. Refuse that `POST` from another site — check its `Origin`,
+or `Sec-Fetch-Site: same-origin` — or any page can sign a visitor into an
+account whose link it holds. Whoever opens the link signs in, on the device
+that opened it: where the sign-in must complete in the browser that asked,
+send a code.
+
+**A link or a code proves an e-mail someone else may have registered.**
+`signUp` does not wait for the address to be proved, and `signIn` does not
+ask whether it was: whoever registered the address with a password of theirs
+keeps that password, and their session, after its owner signs in by link or
+code and the e-mail turns verified. Where a password signs in before the
+e-mail is verified, require `verifyEmail` before `signIn` — or, on the
+`user.emailVerified` those confirmations send, sign the user out everywhere
+— the listener runs before the new session opens — and have them set a
+password of their own.
+
 **Every `janus()` that signs users in needs the same `secondFactor`.** An
 instance without keys never signs in a user whose factor is active: `signIn`
 throws a `TypeError` rather than open a session on the password alone. Build
@@ -1030,8 +1120,24 @@ your policy. A password refused for its length does not spend the token.
 written — by a link, `changePassword` or `setPassword` — spends every link
 still live, so an older e-mail's link answers `TOKEN_SPENT`. Tell the visitor
 to use the latest e-mail, and rate-limit `resetPassword.request` per address:
-each request cancels the link before it. **Nothing limits password guesses**: rate-limit
-`signIn` per login and per client ([passwords](docs/guide/passwords.md#rate-limit-password-guessing)).
+each request cancels the link before it.
+
+**`signIn` throttles each login, not each client.** Ten passwords per login
+per 15 minutes, then `CREDENTIALS_INVALID` with `retryAfter` until the window
+ends — the right password too, so tell the visitor to wait `retryAfter`
+seconds rather than that the password is wrong. `CredentialRefusal` gained
+`'throttled'`: an exhaustive `switch` over `error.reason` must handle it. A
+test that tries more than ten wrong passwords at one login over a
+`fixedClock` is throttled too: advance the clock past `retryAfter`, or wire
+`signIn: { throttle: false }`. **Somebody who knows a login can keep its
+password sign-in shut**, ten tries a window; a sign-in code or link, when you wire them, still opens it — the throttle counts passwords, never those.
+On PostgreSQL, delete lapsed tokens on a schedule: every login tried adds a
+row per window. One password tried against
+many logins is not counted: rate-limit `signIn` per client address yourself
+([passwords](docs/guide/passwords.md#what-you-still-limit-yourself)). The
+counts live in the tokens store: a flushed or evicting Redis forgets them,
+and a tokens store that cannot answer fails every password sign-in with
+`STORE_FAILED`.
 
 **A sign-in can move a user's `version`.** Rewriting a stale hash is a write. A
 user object read before that sign-in, and then passed as `ifVersion`, gets
@@ -1110,7 +1216,7 @@ that sends one, since it is awaited: queue the event and return.
 
 ## Type safety, counted
 
-**One hundred and twenty-nine plausible mistakes, one hundred and twenty-nine refused at compile time — and
+**One hundred and forty-one plausible mistakes, one hundred and forty-one refused at compile time — and
 two gaps, named.**
 
 The lists are typechecked and never run, with one `@ts-expect-error` per
@@ -1118,9 +1224,10 @@ mistake beside the shapes that must keep compiling. One is a single file:
 `test/types/refusals.ts` (fifteen, on the shared vocabulary). The other three
 are folders with one file per behaviour: `test/types/port/` (twenty-four, on
 the identity stores' port, from the point of view of the person implementing
-it), `test/types/auth/` (forty-two, on `janus()`, from the point of view of
+it), `test/types/auth/` (fifty-four, on `janus()`, from the point of view of
 the application — twelve of them on the second factor, three on sign-in codes,
-three on user events, four on step-ups) and `test/types/permissions/` (forty-eight, on the
+five on user events, four on step-ups, six on the sign-in throttle, four on
+sign-in links) and `test/types/permissions/` (forty-eight, on the
 permission model and the questions asked of it). The rule comes from
 `nxgt-data`, and so does the reason to distrust the claim without the files:
 when it was last measured on `@nxgt/mongo`, *seven of twelve plausible

package/dist/auth/config/index.d.ts

@@ -9,7 +9,7 @@
  * Gathered here from the files beside this one.
  */
 export type { PasswordHasher } from './hasher';
-export type { CookieConfig, JanusConfig, MultiTypeConfig, SecondFactorConfig, SingleTypeConfig, } from './janus-config';
+export type { CookieConfig, JanusConfig, MultiTypeConfig, SecondFactorConfig, SignInConfig, SignInThrottleConfig, SingleTypeConfig, } from './janus-config';
 export { type Normalize, normalizeEmail } from './normalize';
 export type { PasswordConfig } from './password-config';
 export { RESERVED_FIELDS, RESERVED_TYPES, SINGLE_TYPE } from './reserved';

package/dist/auth/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EACX,UAAU,EACV,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EACX,YAAY,EACZ,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtE,YAAY,EACX,UAAU,EACV,aAAa,EACb,UAAU,EACV,cAAc,GACd,MAAM,aAAa,CAAC"}

package/dist/auth/config/janus-config.d.ts

@@ -48,9 +48,18 @@ interface SharedConfig {
         readonly resetPassword?: Duration;
         /** How long an e-mailed sign-in code waits. `'10m'` when absent. */
         readonly signInCode?: Duration;
+        /** How long an e-mailed sign-in link waits. `'15m'` when absent. */
+        readonly magicLink?: Duration;
         /** How long a step-up's challenge waits, e-mailed or not. `'10m'` when absent. */
         readonly stepUp?: Duration;
     };
+    /**
+     * How `signIn` answers password guessing. **On by default**: past ten
+     * passwords tried at one login in a 15-minute window, `signIn` answers
+     * `CREDENTIALS_INVALID` with `retryAfter` — the right password included —
+     * until the next window. Nothing locks: the next window signs in.
+     */
+    readonly signIn?: SignInConfig;
     /**
      * A TOTP second factor, for every user type with a password. Absent, no
      * `secondFactor` flows exist and `signIn` answers a session directly.
@@ -66,6 +75,22 @@ interface SharedConfig {
      */
     readonly events?: UserEventListener;
 }
+/** What `signIn` does with password guessing. */
+export interface SignInConfig {
+    /**
+     * The passwords one login may try per window. `{ attempts: 10, window:
+     * '15m' }` when absent; `false` counts nothing — rate-limit `signIn`
+     * yourself then.
+     */
+    readonly throttle?: SignInThrottleConfig | false;
+}
+/** How many passwords one login may try, and per how long. */
+export interface SignInThrottleConfig {
+    /** Passwords tried per login and per window, the right one included. `10` when absent. */
+    readonly attempts?: number;
+    /** How long one window lasts. `'15m'` when absent. */
+    readonly window?: Duration;
+}
 /** What a TOTP second factor needs: a name for the app, and the keys that seal. */
 export interface SecondFactorConfig {
     /** Shown in the authenticator app beside the account: your product's name. */

package/dist/auth/config/janus-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC/B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC3B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"janus-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/janus-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,UAAU,YAAY;IACrB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,2BAA2B;QAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;QAChC,0BAA0B;QAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;QAClC,oEAAoE;QACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;QAC/B,oEAAoE;QACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;QAC9B,kFAAkF;QAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;KAC3B,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CACjD;AAED,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACpC,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,kBAAkB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAChB,SAAQ,YAAY,EACnB,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,eAAe,CAAC"}

package/dist/auth/config/resolve-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EACX,WAAW,EAGX,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,mBAAmB,CAAC;AAGtE,qFAAqF;AACrF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,cAAc,CAuBhB"}
+{"version":3,"file":"resolve-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EACX,WAAW,EAGX,MAAM,gBAAgB,CAAC;AAOxB,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,mBAAmB,CAAC;AAGtE,qFAAqF;AACrF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,MAAM,GACX,cAAc,CAwBhB"}

package/dist/auth/config/resolve-sign-in.d.ts

@@ -0,0 +1,5 @@
+/** Resolves `signIn.throttle`: on unless `false`, ten passwords per login per fifteen minutes. */
+import type { SignInConfig } from './janus-config';
+import type { ResolvedConfig } from './resolved-config';
+export declare function resolveSignInThrottle(config: SignInConfig | undefined, where: string): ResolvedConfig['signInThrottle'];
+//# sourceMappingURL=resolve-sign-in.d.ts.map

package/dist/auth/config/resolve-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-sign-in.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolve-sign-in.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAGlG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,wBAAgB,qBAAqB,CACpC,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,KAAK,EAAE,MAAM,GACX,cAAc,CAAC,gBAAgB,CAAC,CAoBlC"}

package/dist/auth/config/resolved-config.d.ts

@@ -25,8 +25,14 @@ export interface ResolvedConfig {
         readonly verifyEmail: number;
         readonly resetPassword: number;
         readonly signInCode: number;
+        readonly magicLink: number;
         readonly stepUp: number;
     };
+    /** `null` when `signIn.throttle` is `false`. */
+    readonly signInThrottle: {
+        readonly attempts: number;
+        readonly windowMs: number;
+    } | null;
     readonly secondFactor: {
         readonly issuer: string;
         readonly sealer: Sealer;

package/dist/auth/config/resolved-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}
+{"version":3,"file":"resolved-config.d.ts","sourceRoot":"","sources":["../../../src/auth/config/resolved-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,oFAAoF;AACpF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,gDAAgD;IAChD,QAAQ,CAAC,cAAc,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,YAAY,EAAE;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KAChC,GAAG,IAAI,CAAC;IACT,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;KACzB,CAAC;CACF"}

package/dist/auth/derived-keys.d.ts

@@ -0,0 +1,9 @@
+import type { Sealer } from './sealing';
+/**
+ * The key `keyId` lends `purpose` — the first key by default — derived once
+ * per key, or `undefined` when the sealer no longer holds that key.
+ */
+export declare function derivedKey(sealer: Sealer, purpose: string, keyId?: string): Buffer | undefined;
+/** HMAC-SHA256 of `parts`, joined by a NUL — which no part may hold. */
+export declare function keyedHash(key: Buffer, parts: readonly string[]): Buffer;
+//# sourceMappingURL=derived-keys.d.ts.map

package/dist/auth/derived-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-keys.d.ts","sourceRoot":"","sources":["../../src/auth/derived-keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAWxC;;;GAGG;AACH,wBAAgB,UAAU,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,MAAwB,GAC7B,MAAM,GAAG,SAAS,CAepB;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvE"}

package/dist/auth/email-sign-in.d.ts

@@ -0,0 +1,40 @@
+/**
+ * What the two sign-ins by e-mail share — a code typed back
+ * (`sign-in-code.ts`) and a link followed (`magic-link.ts`): who may be sent
+ * one, keeping only the last one live, and how a redeemed one ends — the
+ * e-mail proved, then the same session or second-factor challenge a
+ * password opens.
+ */
+import type { ResolvedType } from './config';
+import { type AnyUser, type Context } from './context';
+import type { TokenKind, TokenRecord, UserRecord } from './port/types';
+import type { SignInResult } from './types';
+/** What a sign-in answers once the user proved who they are: `secondFactor.finish`. */
+export type Finish = (record: UserRecord, where: string) => Promise<SignInResult<AnyUser>>;
+/**
+ * The user of this type holding `email`, when they may be sent a sign-in:
+ * `null` for nobody, and for an inactive user — the same answer, so the
+ * caller cannot tell them apart either.
+ */
+export declare function signInHolder(context: Context, type: ResolvedType, email: string): Promise<UserRecord | null>;
+/**
+ * Spends every other unspent token of this kind the user holds, sparing the
+ * one just issued. Issued first, spent after, so requests that race leave
+ * at most one live — maybe none, and the visitor asks again — never one each.
+ */
+export declare function keepOnlyLatest(context: Context, userId: string, kind: TokenKind, secret: string): Promise<void>;
+/**
+ * Ends a sign-in by e-mail whose token is spent: refuses an e-mail changed
+ * since it was sent and an inactive user, proves the e-mail — it reached the
+ * inbox — and finishes as a password would.
+ *
+ * The proof is written under the version read, so an address changed since
+ * is not the one proved: a `VERSION_CONFLICT` then, with the token spent.
+ */
+export declare function finishEmailSignIn(context: Context, type: ResolvedType, finish: Finish, signIn: {
+    readonly user: UserRecord;
+    readonly token: TokenRecord;
+    readonly where: string;
+    readonly noun: 'token' | 'code';
+}): Promise<SignInResult<AnyUser>>;
+//# sourceMappingURL=email-sign-in.d.ts.map

package/dist/auth/email-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-sign-in.d.ts","sourceRoot":"","sources":["../../src/auth/email-sign-in.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAGZ,MAAM,WAAW,CAAC;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,uFAAuF;AACvF,MAAM,MAAM,MAAM,GAAG,CACpB,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,KACT,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAEpC;;;;GAIG;AACH,wBAAsB,YAAY,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAG5B;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;CAChC,GACC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAqBhC"}

package/dist/auth/events.d.ts

@@ -5,9 +5,15 @@ import type { Context } from './context';
  *
  * - `user.created` — by `create` or `signUp`;
  * - `user.emailVerified` — by `verifyEmail.confirm`, or by the link of
- *   `resetPassword.confirm` or the code of `signInCode.confirm`, which prove
- *   the e-mail too; never for an e-mail already verified;
+ *   `resetPassword.confirm` or `magicLink.confirm`, or the code of
+ *   `signInCode.confirm`, which prove the e-mail too; never for an e-mail
+ *   already verified;
  * - `user.passwordReset` — by `resetPassword.confirm`;
+ * - `user.passwordChanged` — by `changePassword` and `setPassword`; never by a
+ *   reset, which is `user.passwordReset` alone;
+ * - `user.emailChanged` — by `update`, when it changed the e-mail — compared
+ *   normalised, the same test that makes the new one unverified. The one
+ *   event that carries more than the user: `formerEmail`;
  * - `user.secondFactorEnabled` — by `secondFactor.activate`, once the factor
  *   is active: not by `enroll`, which leaves it waiting for its first code;
  * - `user.secondFactorDisabled` — by `secondFactor.disable`, when it removed
@@ -19,11 +25,12 @@ import type { Context } from './context';
  *   spent: a sign-in without the user's phone;
  * - `user.deleted` — by `delete`, once; a replay that finds nobody is none.
  */
-export type UserEventType = 'user.created' | 'user.emailVerified' | 'user.passwordReset' | 'user.secondFactorEnabled' | 'user.secondFactorDisabled' | 'user.recoveryCodesRegenerated' | 'user.recoveryCodeUsed' | 'user.deleted';
+export type UserEventType = 'user.created' | 'user.emailVerified' | 'user.passwordReset' | 'user.passwordChanged' | 'user.emailChanged' | 'user.secondFactorEnabled' | 'user.secondFactorDisabled' | 'user.recoveryCodesRegenerated' | 'user.recoveryCodeUsed' | 'user.deleted';
 /**
  * A user event: **the user named by id, and nothing else** — no login, no
- * e-mail, no field, no password, no token. Whoever receives it reads the rest
- * from where it is kept, if they may.
+ * field, no password, no token. Whoever receives it reads the rest from where
+ * it is kept, if they may. One exception, `formerEmail` on
+ * `user.emailChanged`: once the write landed, the old address is kept nowhere.
  */
 export interface UserEvent {
     /** A UUIDv7 minted for this event: the key to deliver it once. */
@@ -36,7 +43,16 @@ export interface UserEvent {
     readonly occurredAt: Date;
     readonly userId: Id;
     readonly userType: string;
+    /**
+     * On `user.emailChanged` only: the address the user had before, as it was
+     * stored — `null` when they had none. So a notice can reach the inbox the
+     * account was just taken from; the new address is on the user. Absent
+     * from every other type, and from an event a webhook delivered.
+     */
+    readonly formerEmail?: string | null;
 }
+/** What an event carries beyond the user, on the one type that does. */
+export type EventExtras = Pick<UserEvent, 'formerEmail'>;
 /**
  * What `janus({ events })` takes: called once per event, **after** the write
  * landed and before the flow answers — awaited, so a queue that stores the
@@ -57,5 +73,5 @@ export declare function resolveEvents(events: unknown, where: string): UserEvent
 export declare function emit(context: Context, type: UserEventType, user: {
     readonly id: Id;
     readonly type: string;
-}, occurredAt: Date): Promise<void>;
+}, occurredAt: Date, extras?: EventExtras): Promise<void>;
 //# sourceMappingURL=events.d.ts.map

package/dist/auth/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/auth/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,0BAA0B,GAC1B,2BAA2B,GAC3B,+BAA+B,GAC/B,uBAAuB,GACvB,cAAc,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3E,oFAAoF;AACpF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,GAAG,IAAI,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CACzB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAChD,UAAU,EAAE,IAAI,GACd,OAAO,CAAC,IAAI,CAAC,CAoBf"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/auth/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,aAAa,GACtB,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,sBAAsB,GACtB,mBAAmB,GACnB,0BAA0B,GAC1B,2BAA2B,GAC3B,+BAA+B,GAC/B,uBAAuB,GACvB,cAAc,CAAC;AAElB;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wEAAwE;AACxE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3E,oFAAoF;AACpF,wBAAgB,aAAa,CAC5B,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,GACX,iBAAiB,GAAG,IAAI,CAQ1B;AAED;;;;;;GAMG;AACH,wBAAsB,IAAI,CACzB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAChD,UAAU,EAAE,IAAI,EAChB,MAAM,GAAE,WAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/auth/index.d.ts

@@ -1,4 +1,4 @@
-export type { CookieConfig, FieldsJson, JanusConfig, MultiTypeConfig, Normalize, PasswordConfig, PasswordHasher, SecondFactorConfig, SessionConfig, SingleTypeConfig, UserSchema, UserTypeConfig, } from './config';
+export type { CookieConfig, FieldsJson, JanusConfig, MultiTypeConfig, Normalize, PasswordConfig, PasswordHasher, SecondFactorConfig, SessionConfig, SignInConfig, SignInThrottleConfig, SingleTypeConfig, UserSchema, UserTypeConfig, } from './config';
 export type { UserEvent, UserEventListener, UserEventType, } from './events';
 export { bunHasher, scryptHasher } from './hashers';
 export { janus } from './janus';
@@ -8,5 +8,5 @@ export type { JanusStores, Json, JsonObject, PasswordRecord, SecondFactorRecord,
 export type { SealingKey } from './sealing';
 export { assertFresh } from './sessions/fresh';
 export type { StandardSchemaV1 } from './standard-schema';
-export type { Authenticated, Checked, EmailOf, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, PasswordApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
+export type { Authenticated, Checked, EmailOf, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, MagicLinkApi, PasswordApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}

package/dist/auth/magic-link.d.ts

@@ -0,0 +1,22 @@
+import type { At } from './at';
+import type { ResolvedType } from './config';
+import { type AnyUser, type Context } from './context';
+import { type Finish } from './email-sign-in';
+import type { MagicLinkApi, SignInResult } from './types';
+/**
+ * Signing in with a link sent to the user's e-mail: no password, and the
+ * link proves the address — a sign-in code with nothing to type.
+ *
+ * The token is 32 random bytes, so there is nothing to guess and no attempt
+ * to count: redeeming it is one conditional write, and of two redemptions
+ * at once exactly one signs in. **At most one link is live per user**, as
+ * for a sign-in code: `request` spends every other once it issued its own.
+ * A token of its own kind, `magicLink`, so a sign-in code's challenge — which
+ * the visitor holds — is never a link, nor a link a challenge.
+ *
+ * Whoever opens the link signs in, in the browser that opened it: the
+ * application confirms it from a `POST`, never from the `GET` of the link,
+ * which a mail scanner follows too.
+ */
+export declare function magicLinkFlows(context: Context, type: ResolvedType, at: At, finish: Finish): MagicLinkApi<AnyUser, SignInResult<AnyUser>>['magicLink'];
+//# sourceMappingURL=magic-link.d.ts.map

package/dist/auth/magic-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.d.ts","sourceRoot":"","sources":["../../src/auth/magic-link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,WAAW,CAAC;AAE/D,OAAO,EACN,KAAK,MAAM,EAIX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAe,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACZ,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAgB3D"}

package/dist/auth/one-time/index.d.ts

@@ -2,7 +2,8 @@
  * What every one-time token shares — an e-mail link, a sign-in code, a
  * second-factor challenge — kept in one place so they cannot drift apart:
  * issuing it (`issue.ts`), spending it (`spend.ts`), refusing it
- * (`refusals.ts`) and the code it may carry (`codes.ts`).
+ * (`refusals.ts`), the code it may carry (`codes.ts`) and the attempts a
+ * window counts in tokens of its own (`window.ts`).
  *
  * Gathered here from the files beside this one.
  */
@@ -10,4 +11,5 @@ export { CODE_ATTEMPTS, codeInvalid, codeMatches, countCodeAttempt, hashCode, un
 export { issueCode, issueOneTime } from './issue';
 export { type OneTimeNoun, refuseStale, refuseUnusable, unknownOneTime, } from './refusals';
 export { burnOneTime, spendOneTime } from './spend';
+export { type AttemptWindow, type CountedAttempt, countInWindow, MAX_LINKS, } from './window';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/one-time/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/one-time/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACN,aAAa,EACb,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,WAAW,EAChB,WAAW,EACX,cAAc,EACd,cAAc,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/one-time/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,aAAa,EACb,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,GAChB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EACN,KAAK,WAAW,EAChB,WAAW,EACX,cAAc,EACd,cAAc,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EACN,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,aAAa,EACb,SAAS,GACT,MAAM,UAAU,CAAC"}