@nxgt/janus 0.21.0 → 0.22.0

package/README.md

@@ -321,6 +321,7 @@ await auth.authenticate(request);                  // { user, session, token, re
 await auth.signOut(request);
 await auth.verifyEmail.send(user);                 // { token, email, expiresAt } — sending it is yours
 await auth.verifyEmail.confirm(token);
+await auth.verifyEmail.proveFirst(user);           // privileged: FirstProof — { user, proved }; drops a squatter's password and factor
 await auth.resetPassword.request(email);           // … | null
 await auth.resetPassword.confirm(token, newPassword);
 await auth.signInCode.request(email);              // { code, challenge, email, expiresAt, user } | null
@@ -783,6 +784,7 @@ has a route for each flow, with Hono.
 const invitation = await invitations.redeem(body.invitationToken); // yours: one use, expiring, hashed at rest
 if (invitation === null) return new Response(null, { status: 404 });
 
+// The invitation reached the inbox: call verifyEmail.proveFirst before this — see below.
 const result = await auth.signInProven(invitation.userId, { device: deviceCookie ?? null });
 if (result.status === 'secondFactor') return askForCode(result.challenge); // switch on status, as after signIn
 // result: { status: 'signedIn', user, session, token, newDevice, deviceToken }
@@ -810,7 +812,8 @@ with no password, code or link. Every user type has it.
   `magicLink.request` on the invitee's address cannot make it answer 429 —
   and links or codes already in the person's inbox still work. It proves
   no e-mail either: `emailVerified` stays as it was, and nothing is dropped
-  as on a first proof by link.
+  as on a first proof by link — call `verifyEmail.proveFirst` before it
+  when your proof reached the inbox, as an invitation does.
 
 [Sessions](docs/guide/sessions.md#signing-in-on-your-own-proof--signinproven)
 has the invitation route in full, and what to verify before the call.
@@ -825,6 +828,7 @@ if (invitation === null) return new Response(null, { status: 404 });
 const member =
 	(await auth.member.findByEmail(invitation.email)) ?? // User | null — counts nothing, sends nothing
 	(await auth.member.create({ email: invitation.email, name: '' }));
+await auth.member.verifyEmail.proveFirst(member); // the invitation reached the inbox: before signInProven
 const result = await auth.member.signInProven(member, { device: deviceCookie ?? null });
 ```
 
@@ -847,6 +851,43 @@ password and reset flows on it.
   `STORE_FAILED`, never `null`.
 - **Server-side only**: it tells whether an account exists. See *Traps*.
 
+### Proving an e-mail on your own proof — `verifyEmail.proveFirst`
+
+```ts
+// Accepting an invitation: the token YOUR server mailed to the address proves the inbox.
+const user = (await auth.findByEmail(invitation.email)) ?? (await auth.create({ email: invitation.email, name }));
+const { proved } = await auth.verifyEmail.proveFirst(user); // 1. first: drops a squatter's password, factor, sessions
+await auth.setPassword(user, body.password);                // 2. then the invitee's own password, if the type has one
+const result = await auth.signInProven(user);               // 3. last: proveFirst revokes every session
+```
+
+Answers `FirstProof<User>` — `{ user, proved }`, exported. Applies **the
+first proof of an e-mail** that `magicLink.confirm` and
+`signInCode.confirm` apply, when the proof is the application's — an
+invitation token it mailed to the address and the person followed. On every
+type with an e-mail; `signInProven` alone proves nothing.
+
+- **On an e-mail never proved, in one write**: marks it verified and drops
+  the password and the second factor — active or waiting, with its recovery
+  codes. It revokes every session and spends the reset links and
+  second-factor challenges, before the write and after it, and sends
+  `user.emailVerified`, then `user.passwordChanged` when a password was
+  dropped and `user.secondFactorDisabled` when an active factor was.
+  Answers `{ user, proved: true }`.
+- **On an e-mail already proved, nothing**: no write, no event, no session
+  revoked — `{ user, proved: false }`.
+- **Sends nothing, counts nothing**: no e-mail, no token, no mail-throttle
+  or sign-in-throttle count.
+- **Refused as `signInProven` refuses**: an inactive user is
+  `USER_INACTIVE`; a malformed id, an unknown one or one of another type is
+  `NOT_FOUND`. A user written between its read and its write is
+  `VERSION_CONFLICT`, with nothing proved; an outage is `STORE_FAILED`.
+- **Privileged, and the order matters**: see *Traps*.
+
+[E-mail flows](docs/guide/email-flows.md#proving-an-e-mail-on-your-own-proof--provefirst)
+has the details; [sessions](docs/guide/sessions.md#accepting-an-invitation)
+has the invitation route in full.
+
 ### Step-up — `stepUp` and `assertFresh`
 
 ```ts
@@ -959,12 +1000,12 @@ await auth.signUp({ email, password }); // the listener has the event before thi
 | `type` | Sent by |
 | --- | --- |
 | `user.created` | `create`, `signUp` |
-| `user.emailVerified` | `verifyEmail.confirm`; `resetPassword.confirm`, `magicLink.confirm` and `signInCode.confirm`, whose link or code proves the e-mail too — never for an e-mail already verified |
+| `user.emailVerified` | `verifyEmail.confirm` and `verifyEmail.proveFirst`; `resetPassword.confirm`, `magicLink.confirm` and `signInCode.confirm`, whose link or code proves the e-mail too — never for an e-mail already verified |
 | `user.passwordReset` | `resetPassword.confirm` |
-| `user.passwordChanged` | `changePassword`, `setPassword`; `signInCode.confirm` and `magicLink.confirm` when their first proof of the e-mail dropped a password — never a reset, which is `user.passwordReset` alone |
+| `user.passwordChanged` | `changePassword`, `setPassword`; `signInCode.confirm`, `magicLink.confirm` and `verifyEmail.proveFirst` when their first proof of the e-mail dropped a password — never a reset, which is `user.passwordReset` alone |
 | `user.emailChanged` | `update`, when it changed the e-mail — carrying `formerEmail`, the address before (`null` for none) |
 | `user.secondFactorEnabled` | `secondFactor.activate`, once the factor is active — not `enroll`, which leaves it waiting |
-| `user.secondFactorDisabled` | `secondFactor.disable`, when it removed an active factor; `signInCode.confirm` and `magicLink.confirm` when their first proof of the e-mail removed one, after `user.emailVerified` and any `user.passwordChanged` — never for a user who had none, or one still waiting |
+| `user.secondFactorDisabled` | `secondFactor.disable`, when it removed an active factor; `signInCode.confirm`, `magicLink.confirm` and `verifyEmail.proveFirst` when their first proof of the e-mail removed one, after `user.emailVerified` and any `user.passwordChanged` — never for a user who had none, or one still waiting |
 | `user.recoveryCodesRegenerated` | `secondFactor.regenerateRecoveryCodes` — not `activate`, whose codes come with `user.secondFactorEnabled` |
 | `user.recoveryCodeUsed` | `secondFactor.recover`, once the recovery code is spent: a sign-in without the user's phone |
 | `user.newDeviceSignedIn` | `signIn`, `secondFactor.confirm`, `secondFactor.recover`, `signInCode.confirm` and `magicLink.confirm`, given a `device` its token did not prove, once the sign-in is complete — carrying `sessionId`, the new session's. Never `signUp`, nor a call given no device |
@@ -1259,6 +1300,21 @@ id from that proof's record. For an invitation, it replaces
 five anonymous requests for the invitee's address would make the
 acceptance answer 429.
 
+**Call `verifyEmail.proveFirst` first: it drops the password and revokes
+every session.** On an e-mail never proved, it does what a first sign-in by
+link does, so a password set before it is erased — the invitee's own,
+chosen on your acceptance form, included — and a session opened before it
+is revoked. Accept an invitation in this order: `findByEmail` (or
+`create`), then `verifyEmail.proveFirst`, then `setPassword` on a type with
+a password, then `signInProven`. Called after `setPassword`, the person
+signs in once and then finds `signIn` answering `CREDENTIALS_INVALID`
+(`reason: 'noPassword'`). **It is privileged, like `signInProven`**: it
+checks no credential, so call it only right after your server verified
+its own proof of the inbox — an invitation token it mailed to that
+address — on the user that proof names, whose e-mail is the address the
+proof reached; never with an id a request supplied, or anybody can wipe
+anybody's password and second factor and sign them out.
+
 **`findByEmail` is an account-existence oracle — never expose it to an
 anonymous client.** It answers whether somebody of the type holds an
 address, at once, with no throttle: a route that calls it on an address a
@@ -1561,7 +1617,7 @@ that sends one, since it is awaited: queue the event and return.
 
 ## Type safety, counted
 
-**One hundred and sixty-six plausible mistakes, one hundred and sixty-six refused at compile time — and
+**One hundred and sixty-nine plausible mistakes, one hundred and sixty-nine refused at compile time — and
 two gaps, named.**
 
 The lists are typechecked and never run, with one `@ts-expect-error` per
@@ -1569,10 +1625,10 @@ mistake beside the shapes that must keep compiling. One is a single file:
 `test/types/refusals.ts` (fifteen, on the shared vocabulary). The other three
 are folders with one file per behaviour: `test/types/port/` (twenty-five, on
 the identity stores' port, from the point of view of the person implementing
-it), `test/types/auth/` (seventy-eight, on `janus()`, from the point of view of
+it), `test/types/auth/` (eighty-one, on `janus()`, from the point of view of
 the application — twelve of them on the second factor, three on sign-in codes,
 five on user events, four on step-ups, six on the sign-in throttle, five on the mail throttle, four on
-sign-in links, six on devices, two on `findMany`, five on requests in two steps, three on signing in on the application's proof, three on finding a user by e-mail) and `test/types/permissions/` (forty-eight, on the
+sign-in links, six on devices, two on `findMany`, five on requests in two steps, three on signing in on the application's proof, three on finding a user by e-mail, three on proving an e-mail on the application's proof) and `test/types/permissions/` (forty-eight, on the
 permission model and the questions asked of it). The rule comes from
 `nxgt-data`, and so does the reason to distrust the claim without the files:
 when it was last measured on `@nxgt/mongo`, *seven of twelve plausible

package/dist/auth/context/index.d.ts

@@ -12,6 +12,6 @@ export { type Context, createContext } from './create-context';
 export { emailOf, holderOfEmail, loginsOf } from './logins';
 export { checkPassword, passwordMatches, passwordRule, rehashed, requireHasher, } from './password';
 export { findRecord, getRecord, writeUser } from './records';
-export { type AnyUser, idOf, toUser } from './user';
+export { type AnyUser, idOf, refId, toUser } from './user';
 export { validateFields } from './validate-fields';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/context/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/context/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACN,aAAa,EACb,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,aAAa,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/context/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACN,aAAa,EACb,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,aAAa,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/auth/context/user.d.ts

@@ -11,4 +11,11 @@ export type AnyUser = User<string, Record<string, unknown>>;
 export declare function toUser(record: UserRecord): AnyUser;
 /** The id a {@link UserRef} names. */
 export declare const idOf: (user: UserRef) => string;
+/**
+ * The id a JavaScript caller's reference names, or `''` — malformed, and
+ * so `NOT_FOUND` without reaching the store — for anything that names none:
+ * what the privileged calls read, `signInProven` and
+ * `verifyEmail.proveFirst`, which must never mistake a bad value for a user.
+ */
+export declare function refId(user: UserRef): string;
 //# sourceMappingURL=user.d.ts.map

package/dist/auth/context/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/auth/context/user.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAalD;AAED,sCAAsC;AACtC,eAAO,MAAM,IAAI,GAAI,MAAM,OAAO,KAAG,MACK,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/auth/context/user.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE9C,kEAAkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAalD;AAED,sCAAsC;AACtC,eAAO,MAAM,IAAI,GAAI,MAAM,OAAO,KAAG,MACK,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAK3C"}

package/dist/auth/email-flows/prove-first.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Proving an e-mail on the application's own proof of the inbox — an
+ * invitation token it issued to the address — with the ending a first
+ * sign-in by link or code gives an e-mail never proved (`../first-proof`).
+ */
+import type { At } from '../at';
+import type { ResolvedType } from '../config';
+import { type AnyUser, type Context } from '../context';
+import type { VerifyEmailApi } from '../types';
+/**
+ * `verifyEmail.proveFirst` for one user type: the user read by id —
+ * `NOT_FOUND` for nobody, as `signInProven` — refused when inactive, then,
+ * when the e-mail was never proved, `proveFirstEmail` exactly as
+ * `magicLink.confirm` and `signInCode.confirm` run it, decided the same way:
+ * on the record read, `emailVerifiedAt === null`. An e-mail already proved
+ * is answered as it is, with nothing written.
+ *
+ * No throttle is counted and no count restarted, no e-mail sent and no
+ * token issued; the only tokens spent are the ones `proveFirstEmail`
+ * spends, what the password opened.
+ */
+export declare function proveFirstFlow(context: Context, type: ResolvedType, at: At): VerifyEmailApi<AnyUser>['verifyEmail']['proveFirst'];
+//# sourceMappingURL=prove-first.d.ts.map

package/dist/auth/email-flows/prove-first.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prove-first.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/prove-first.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAIZ,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAgBtD"}

package/dist/auth/email-flows/verify-email.d.ts

@@ -1,11 +1,15 @@
 /**
  * Verifying an e-mail: send a token to it, then redeem the token to mark the
- * address verified.
+ * address verified — or prove it on the application's own proof
+ * (`prove-first.ts`).
  */
 import type { At } from '../at';
 import type { ResolvedType } from '../config';
 import { type AnyUser, type Context } from '../context';
 import type { VerifyEmailApi } from '../types';
-/** `verifyEmail` of one user type: `send` a token to its e-mail, then `confirm` it. */
+/**
+ * `verifyEmail` of one user type: `send` a token to its e-mail, then
+ * `confirm` it; or `proveFirst`, on the application's own proof.
+ */
 export declare function verifyEmailFlows(context: Context, type: ResolvedType, at: At): VerifyEmailApi<AnyUser>['verifyEmail'];
 //# sourceMappingURL=verify-email.d.ts.map

package/dist/auth/email-flows/verify-email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/verify-email.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,uFAAuF;AACvF,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAwCxC"}
+{"version":3,"file":"verify-email.d.ts","sourceRoot":"","sources":["../../../src/auth/email-flows/verify-email.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,YAAY,CAAC;AAIpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAI/C;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,GACJ,cAAc,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CA0CxC"}

package/dist/auth/index.d.ts

@@ -8,5 +8,5 @@ export type { JanusStores, Json, JsonObject, PasswordRecord, SecondFactorRecord,
 export type { SealingKey } from './sealing';
 export { assertFresh } from './sessions/fresh';
 export type { StandardSchemaV1 } from './standard-schema';
-export type { Authenticated, Checked, EmailOf, FindByEmailApi, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, MagicLinkApi, PasswordApi, PreparedCode, PreparedRequest, ProvenSignInApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInOptions, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
+export type { Authenticated, Checked, EmailOf, FindByEmailApi, FirstProof, HeaderRecord, IssuedCode, IssuedToken, Janus, LoginOf, MagicLinkApi, PasswordApi, PreparedCode, PreparedRequest, ProvenSignInApi, RecoveredSignIn, RecoveryCodesIssued, RequestLike, RequiredStringKeys, ResetPasswordApi, SecondFactorApi, SecondFactorEnrolment, SecondFactorRequired, Session, SharedApi, SignedIn, SignInCodeApi, SignInOptions, SignInResult, StepUpApi, StepUpByApp, StepUpByEmail, TypeApi, TypesOf, User, UserBase, UserOf, UserRef, UserTypeApi, VerifyEmailApi, WriteOptions, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,YAAY,EACZ,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,cAAc,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,SAAS,EACT,iBAAiB,EACjB,aAAa,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,YAAY,EACX,WAAW,EACX,IAAI,EACJ,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,SAAS,EACT,WAAW,EACX,UAAU,EACV,eAAe,EACf,SAAS,EACT,UAAU,EACV,SAAS,GACT,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,cAAc,EACd,UAAU,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,KAAK,EACL,OAAO,EACP,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,QAAQ,EACR,aAAa,EACb,aAAa,EACb,YAAY,EACZ,SAAS,EACT,WAAW,EACX,aAAa,EACb,OAAO,EACP,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,OAAO,EACP,WAAW,EACX,cAAc,EACd,YAAY,GACZ,MAAM,SAAS,CAAC"}

package/dist/auth/proven-sign-in.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proven-sign-in.d.ts","sourceRoot":"","sources":["../../src/auth/proven-sign-in.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAW,MAAM,SAAS,CAAC;AAEtE;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACZ,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAiBjD"}
+{"version":3,"file":"proven-sign-in.d.ts","sourceRoot":"","sources":["../../src/auth/proven-sign-in.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,WAAW,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE7D;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACZ,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAiBjD"}

package/dist/auth/types/email-flows.d.ts

@@ -91,8 +91,51 @@ export interface VerifyEmailApi<U> {
          * e-mail the user has since changed is `TOKEN_STALE`.
          */
         confirm(token: string): Promise<U>;
+        /**
+         * Applies the first proof of the user's e-mail **the application made
+         * itself** — an invitation token it issued to the address and the
+         * person followed: exactly what `magicLink.confirm` and
+         * `signInCode.confirm` do to an e-mail never proved, with no link and
+         * no code. In one write it marks the e-mail verified and drops the
+         * password and the second factor — active or waiting, with its
+         * recovery codes — and it revokes every session and spends the reset
+         * links and second-factor challenges, before the write and after it.
+         * Sends `user.emailVerified`, then `user.passwordChanged` when a
+         * password was dropped and `user.secondFactorDisabled` when an active
+         * factor was. Answers `{ user, proved: true }`.
+         *
+         * An e-mail already proved changes nothing and sends nothing:
+         * `{ user, proved: false }`.
+         *
+         * **Privileged: janus checks no credential.** Call it only after your
+         * server verified its own proof of the inbox, with the user from that
+         * proof's record — never with an id a request supplied: whoever
+         * chooses it drops anybody's password and second factor.
+         *
+         * **Call it before `setPassword` and before `signInProven`**: it drops
+         * the password and revokes every session, so a password set or a
+         * session opened before it is gone after it.
+         *
+         * Counts nothing in the mail or the sign-in throttle, sends no e-mail
+         * and issues no token. An inactive user is `USER_INACTIVE`; a
+         * malformed id, an unknown one or one of another type is `NOT_FOUND`;
+         * a user written since it was read is `VERSION_CONFLICT`, and nothing
+         * is proved.
+         */
+        proveFirst(user: UserRef): Promise<FirstProof<U>>;
     };
 }
+/** What `verifyEmail.proveFirst` answers: the user, and whether this call proved the e-mail. */
+export interface FirstProof<U> {
+    /** The user after the call: `emailVerified` is `true` either way. */
+    readonly user: U;
+    /**
+     * `true` when the e-mail had never been proved and this call proved it,
+     * dropping the password and the second factor and revoking every
+     * session; `false` when it was already proved, and nothing changed.
+     */
+    readonly proved: boolean;
+}
 /** What a user type with an e-mail and a password answers besides. */
 export interface ResetPasswordApi<U> {
     readonly resetPassword: {

package/dist/auth/types/email-flows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-flows.d.ts","sourceRoot":"","sources":["../../../src/auth/types/email-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAgB,MAAM,WAAW,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE;QACpB;;;;;;;;;;;;WAYG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtD;;;;;;WAMG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD;;;;;;;;;;;;WAYG;QACH,OAAO,CACN,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CAAC;KACnB,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE;QACrB;;;;;WAKG;QACH,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C;;;WAGG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE;QACvB;;;;;;;;WAQG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD;;;;;WAKG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC,CAAC;QAChE;;;;;;WAMG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACF"}
+{"version":3,"file":"email-flows.d.ts","sourceRoot":"","sources":["../../../src/auth/types/email-flows.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAgB,MAAM,WAAW,CAAC;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEtC,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE;QACpB;;;;;;;;;;;;WAYG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACtD;;;;;;WAMG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD;;;;;;;;;;;;WAYG;QACH,OAAO,CACN,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,MAAM,CAAC,CAAC;KACnB,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE;QACrB;;;;;WAKG;QACH,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C;;;WAGG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;KAClD,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,WAAW,UAAU,CAAC,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CACzB;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE;QACvB;;;;;;;;WAQG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD;;;;;WAKG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,CAAC,CAAC;QAChE;;;;;;WAMG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACF"}

package/dist/auth/types/index.d.ts

@@ -8,7 +8,7 @@
  * dragging a type parameter through every internal function.
  */
 export type { Checked } from './checks';
-export type { IssuedCode, IssuedToken, ResetPasswordApi, SignInCodeApi, VerifyEmailApi, } from './email-flows';
+export type { FirstProof, IssuedCode, IssuedToken, ResetPasswordApi, SignInCodeApi, VerifyEmailApi, } from './email-flows';
 export type { FindByEmailApi } from './find-by-email';
 export type { EmailOf, LoginOf, RequiredStringKeys, TypesOf, UserOf, } from './inference';
 export type { Janus, SharedApi, TypeApi } from './janus';

package/dist/auth/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACX,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,cAAc,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACX,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,MAAM,GACN,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EACX,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,qBAAqB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACX,aAAa,EACb,YAAY,EACZ,WAAW,EACX,OAAO,GACP,MAAM,WAAW,CAAC;AACnB,YAAY,EACX,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,YAAY,EACX,UAAU,EACV,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,cAAc,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,YAAY,EACX,OAAO,EACP,OAAO,EACP,kBAAkB,EAClB,OAAO,EACP,MAAM,GACN,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,YAAY,EACX,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,qBAAqB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACX,aAAa,EACb,YAAY,EACZ,WAAW,EACX,OAAO,GACP,MAAM,WAAW,CAAC;AACnB,YAAY,EACX,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -612,6 +612,12 @@ function toUser(record) {
   };
 }
 var idOf = (user) => typeof user === "string" ? user : user.id;
+function refId(user) {
+  if (typeof user === "string")
+    return user;
+  const id = typeof user === "object" && user !== null ? user.id : undefined;
+  return typeof id === "string" ? id : "";
+}
 
 // src/auth/context/records.ts
 var notFound = (where, id, type) => new NotFoundError2(`${where}: no ${type ?? "user"} has this id`, type === null ? { userId: id, operation: where } : { userId: id, userType: type, operation: where });
@@ -1391,39 +1397,6 @@ async function confirmReset(context, type, secret, password, where) {
   return toUser(written);
 }
 
-// src/auth/email-flows/verify-email.ts
-function verifyEmailFlows(context, type, at) {
-  return {
-    async send(user) {
-      const where = at("verifyEmail.send");
-      const record = await getRecord(context, idOf(user), type.name, where);
-      await countMailByUser(context, type, "verifyEmail", record.id, where);
-      return issueEmailToken(context, type, "verifyEmail", record, where);
-    },
-    async confirm(secret) {
-      const where = at("verifyEmail.confirm");
-      const { token, user } = await redeemEmailToken(context, type, "verifyEmail", secret, where);
-      let newlyVerified = false;
-      const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
-        refuseStale(type, record, token, where, "token");
-        newlyVerified = record.emailVerifiedAt === null;
-        return { emailVerifiedAt: now };
-      });
-      if (newlyVerified) {
-        await emit(context, "user.emailVerified", written, written.updatedAt);
-      }
-      return toUser(written);
-    }
-  };
-}
-
-// src/auth/email-flows/flows.ts
-function emailFlows(context, type, at) {
-  return {
-    verifyEmail: verifyEmailFlows(context, type, at),
-    resetPassword: resetPasswordFlows(context, type, at)
-  };
-}
 // src/auth/totp.ts
 import { createHmac as createHmac2, randomBytes as randomBytes5 } from "node:crypto";
 var TOTP = { digits: 6, stepMs: 30000, drift: 1 };
@@ -1558,6 +1531,59 @@ async function endWhatTheSquatterOpened(context, userId) {
   await endWhatThePasswordOpened(context, userId);
 }
 
+// src/auth/email-flows/prove-first.ts
+function proveFirstFlow(context, type, at) {
+  return async (user) => {
+    const where = at("verifyEmail.proveFirst");
+    const record = await getRecord(context, refId(user), type.name, where);
+    if (!record.active) {
+      throw new UserInactiveError2(`${where}: the user is inactive`, {
+        userId: record.id,
+        userType: type.name
+      });
+    }
+    if (record.emailVerifiedAt !== null) {
+      return { user: toUser(record), proved: false };
+    }
+    const proved = await proveFirstEmail(context, type, record, where);
+    return { user: toUser(proved), proved: true };
+  };
+}
+
+// src/auth/email-flows/verify-email.ts
+function verifyEmailFlows(context, type, at) {
+  return {
+    async send(user) {
+      const where = at("verifyEmail.send");
+      const record = await getRecord(context, idOf(user), type.name, where);
+      await countMailByUser(context, type, "verifyEmail", record.id, where);
+      return issueEmailToken(context, type, "verifyEmail", record, where);
+    },
+    async confirm(secret) {
+      const where = at("verifyEmail.confirm");
+      const { token, user } = await redeemEmailToken(context, type, "verifyEmail", secret, where);
+      let newlyVerified = false;
+      const written = await writeUser(context, user.id, type, undefined, where, (record, now) => {
+        refuseStale(type, record, token, where, "token");
+        newlyVerified = record.emailVerifiedAt === null;
+        return { emailVerifiedAt: now };
+      });
+      if (newlyVerified) {
+        await emit(context, "user.emailVerified", written, written.updatedAt);
+      }
+      return toUser(written);
+    },
+    proveFirst: proveFirstFlow(context, type, at)
+  };
+}
+
+// src/auth/email-flows/flows.ts
+function emailFlows(context, type, at) {
+  return {
+    verifyEmail: verifyEmailFlows(context, type, at),
+    resetPassword: resetPasswordFlows(context, type, at)
+  };
+}
 // src/auth/email-sign-in.ts
 async function signInHolder(context, type, email) {
   const record = await holderOfEmail(context, type, email);
@@ -1636,7 +1662,7 @@ function provenSignInFlows(context, type, at, finish) {
     async signInProven(user, options) {
       const where = at("signInProven");
       const device = deviceHint(context, options, where);
-      const record = await getRecord(context, idOf2(user), type.name, where);
+      const record = await getRecord(context, refId(user), type.name, where);
       if (!record.active) {
         throw new UserInactiveError2(`${where}: the user is inactive`, {
           userId: record.id,
@@ -1649,12 +1675,6 @@ function provenSignInFlows(context, type, at, finish) {
     }
   };
 }
-function idOf2(user) {
-  if (typeof user === "string")
-    return user;
-  const id = typeof user === "object" && user !== null ? user.id : undefined;
-  return typeof id === "string" ? id : "";
-}
 
 // src/auth/sign-in-attempts.ts
 var PURPOSE3 = "janus/sign-in/attempts/v1";
@@ -2628,5 +2648,5 @@ export {
   systemClock
 };
 
-//# debugId=8864B5F285AA35A664756E2164756E21
+//# debugId=D104C8FB67042A0864756E2164756E21
 //# sourceMappingURL=index.js.map