@nxgt/janus 0.25.0 → 0.27.0

package/dist/index.js

@@ -155,7 +155,8 @@ var RESERVED_TYPES = [
   "getUser",
   "cookie",
   "collectExpired",
-  "types"
+  "types",
+  "changeEmail"
 ];
 // src/time/duration.ts
 var UNITS = {
@@ -749,66 +750,6 @@ async function emit(context, type, user, occurredAt, extras = {}) {
   }
 }
 
-// src/auth/port/assert-stores.ts
-var REQUIRED = {
-  users: [
-    "insertUser",
-    "findUser",
-    "findUserByLogin",
-    "listUsers",
-    "updateUser",
-    "deleteUser"
-  ],
-  sessions: [
-    "insertSession",
-    "findSessionByTokenHash",
-    "extendSession",
-    "reauthenticateSession",
-    "revokeSession",
-    "revokeUserSessions",
-    "deleteUserSessions"
-  ],
-  tokens: [
-    "insertToken",
-    "consumeToken",
-    "countAttempt",
-    "spendUserTokens",
-    "deleteUserTokens"
-  ]
-};
-function assertStores(stores, where) {
-  if (typeof stores !== "object" || stores === null) {
-    throw new TypeError(`${where}: store must be an object with users, sessions and tokens`);
-  }
-  for (const slot of Object.keys(REQUIRED)) {
-    const store = stores[slot];
-    if (typeof store !== "object" || store === null) {
-      throw new TypeError(`${where}: store.${slot} is missing`);
-    }
-    for (const method of REQUIRED[slot]) {
-      if (typeof store[method] !== "function") {
-        throw new TypeError(`${where}: store.${slot} has no method ${method}, which the port requires`);
-      }
-    }
-  }
-  const slots = stores;
-  return {
-    collectExpired: optional(slots, "sessions", "deleteExpiredSessions", where),
-    collectExpiredTokens: optional(slots, "tokens", "deleteExpiredTokens", where),
-    findUsers: optional(slots, "users", "findUsers", where)
-  };
-}
-function optional(stores, slot, method, where) {
-  const found = stores[slot][method];
-  if (found !== undefined && typeof found !== "function") {
-    throw new TypeError(`${where}: store.${slot}.${method} must be a function or absent`);
-  }
-  return found !== undefined;
-}
-
-// src/auth/devices/token.ts
-import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
-
 // src/auth/derived-keys.ts
 import { createHmac, hkdfSync } from "node:crypto";
 var derived = new WeakMap;
@@ -833,317 +774,69 @@ function keyedHash(key, parts) {
   return createHmac("sha256", key).update(parts.join("\x00")).digest();
 }
 
-// src/auth/devices/token.ts
-var PURPOSE = "janus/devices/v1";
-var TOKEN = /^d1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{22})\.([A-Za-z0-9_-]{43})$/;
-function macOf(key, userId, deviceId) {
-  return keyedHash(key, [userId, deviceId]);
-}
-function signed(sealer, userId, deviceId) {
-  const key = derivedKey(sealer, PURPOSE);
-  const mac = macOf(key, userId, deviceId).toString("base64url");
-  return `d1.${sealer.sealWith}.${deviceId}.${mac}`;
-}
-function mintDeviceToken(sealer, userId) {
-  return signed(sealer, userId, randomBytes3(16).toString("base64url"));
-}
-function knownDeviceToken(sealer, userId, presented) {
-  const [, keyId, deviceId, mac] = TOKEN.exec(presented) ?? [];
-  if (keyId === undefined || deviceId === undefined || mac === undefined) {
-    return null;
-  }
-  const key = derivedKey(sealer, PURPOSE, keyId);
-  if (key === undefined)
-    return null;
-  const expected = macOf(key, userId, deviceId);
-  const given = Buffer.from(mac, "base64url");
-  if (given.length !== expected.length || !timingSafeEqual2(given, expected)) {
-    return null;
-  }
-  return keyId === sealer.sealWith ? presented : signed(sealer, userId, deviceId);
+// src/auth/counter-key.ts
+function counterKey(context, purpose) {
+  const sealer = context.config.secondFactor?.sealer;
+  return sealer === undefined ? Buffer.from(purpose) : derivedKey(sealer, purpose);
 }
+var keyed = (key, parts) => keyedHash(key, parts).toString("base64url");
+
+// src/auth/one-time/codes.ts
+import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 
-// src/auth/devices/hint.ts
-var UNTRACKED = Object.freeze({
-  newDevice: false,
-  deviceToken: null
-});
-function deviceHint(context, options, where) {
-  if (options !== undefined && (typeof options !== "object" || options === null)) {
-    throw new TypeError(`${where}: options must be { device }, or left out — the token goes under device`);
-  }
-  const device = options?.device;
-  if (device === undefined)
-    return;
-  if (device !== null && typeof device !== "string") {
-    throw new TypeError(`${where}: options.device must be the device token the client holds, or null when it holds none`);
-  }
-  if (context.config.devices === null) {
-    throw new TypeError(`${where}: a device was given, but janus() has no devices — pass devices: { keys }`);
-  }
-  return device;
-}
-function deviceOutcome(context, userId, hint, signUp) {
-  const sealer = context.config.devices?.sealer;
-  if (hint === undefined || sealer === undefined)
-    return UNTRACKED;
-  const known = hint === null || signUp ? null : knownDeviceToken(sealer, userId, hint);
-  if (known !== null)
-    return { newDevice: false, deviceToken: known };
-  return {
-    newDevice: !signUp,
-    deviceToken: mintDeviceToken(sealer, userId)
-  };
-}
-// src/auth/devices/report.ts
-async function reportNewDevice(context, result) {
-  if (result.status !== "signedIn" || !result.newDevice)
-    return;
-  await emit(context, "user.newDeviceSignedIn", result.user, result.session.createdAt, { sessionId: result.session.id });
-}
 // src/auth/secrets.ts
-import { createHash, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash, randomBytes as randomBytes3 } from "node:crypto";
 function mintSecret() {
-  return randomBytes4(32).toString("base64url");
+  return randomBytes3(32).toString("base64url");
 }
 function hashSecret(secret) {
   return createHash("sha256").update(secret).digest("hex");
 }
 
-// src/auth/sessions/open-session.ts
-function toSession(record) {
-  const { tokenHash: _, ...session } = record;
-  return session;
-}
-async function openSession(context, type, user, device, signUp = false) {
-  const now = context.clock.now();
-  const token = mintSecret();
-  const record = {
-    id: mintId2(now.getTime()),
-    tokenHash: hashSecret(token),
-    userId: user.id,
-    authenticatedAt: now,
-    expiresAt: new Date(now.getTime() + type.lifespanMs),
-    revokedAt: null,
-    createdAt: now
-  };
-  await context.store.sessions.insertSession(record);
-  return {
-    status: "signedIn",
-    user: toUser(user),
-    session: toSession(record),
-    token,
-    ...deviceOutcome(context, user.id, device, signUp)
-  };
+// src/auth/one-time/refusals.ts
+function refuseStale(type, user, token, where, noun) {
+  const email = emailOf(type, user.fields);
+  if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
+    throw new TokenError2("TOKEN_STALE", `${where}: the ${noun} was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+  }
 }
-// src/auth/sessions/presented-token.ts
-function presentedToken(request, cookieName) {
-  const headers = headersOf(request);
-  const read = (name) => {
-    if (headers instanceof Headers)
-      return headers.get(name);
-    for (const [key, value] of Object.entries(headers)) {
-      if (key.toLowerCase() !== name || value === undefined)
-        continue;
-      return typeof value === "string" ? value : value.join(", ");
-    }
-    return null;
-  };
-  const authorization = read("authorization");
-  if (authorization !== null) {
-    const match = /^bearer(?:\s+(.*))?$/i.exec(authorization.trim());
-    if (match)
-      return match[1]?.trim() ?? "";
+function refuseUnusable(token, now, where, noun) {
+  if (token === null) {
+    throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
+      operation: where
+    });
   }
-  const header = read("x-session-token");
-  if (header !== null)
-    return header.trim();
-  const cookie = read("cookie");
-  if (cookie !== null) {
-    for (const pair of cookie.split(";")) {
-      const at = pair.indexOf("=");
-      if (at !== -1 && pair.slice(0, at).trim() === cookieName) {
-        return pair.slice(at + 1).trim();
-      }
-    }
+  if (token.spentAt !== null) {
+    throw new TokenError2("TOKEN_SPENT", `${where}: the ${noun} was already used`, { operation: where });
+  }
+  if (token.expiresAt.getTime() <= now.getTime()) {
+    throw new TokenError2("TOKEN_EXPIRED", `${where}: the ${noun} has expired`, {
+      operation: where
+    });
   }
-  return null;
 }
-function headersOf(request) {
-  if (request instanceof Headers)
-    return request;
-  const inner = request.headers;
-  if (inner instanceof Headers)
-    return inner;
-  if (typeof inner === "object" && inner !== null)
-    return inner;
-  return request;
+var unknownOneTime = (where, noun) => new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
+  operation: where
+});
+
+// src/auth/one-time/spend.ts
+async function spendOneTime(context, secret, kind, where, noun) {
+  const now = context.clock.now();
+  const token = await context.store.tokens.consumeToken(hashSecret(secret), kind, now);
+  refuseUnusable(token, now, where, noun);
+  return token;
 }
-// src/auth/sessions/standing.ts
-async function standingSession(context, request) {
-  const token = presentedToken(request, context.config.cookie.name);
-  if (token === null)
-    return null;
-  const session = await context.store.sessions.findSessionByTokenHash(hashSecret(token));
-  const now = context.clock.now().getTime();
-  return session === null || session.revokedAt !== null || session.expiresAt.getTime() <= now ? null : { token, session };
+async function burnOneTime(context, secret, kind) {
+  await context.store.tokens.consumeToken(hashSecret(secret), kind, context.clock.now());
 }
 
-// src/auth/sessions/authenticate.ts
-async function authenticate(context, request, options) {
-  const { store, clock, config } = context;
-  const presented = await standingSession(context, request);
-  if (presented === null)
-    return null;
-  const { token, session } = presented;
-  const now = clock.now().getTime();
-  const user = await store.users.findUser(session.userId);
-  if (user === null || !user.active || options?.type !== undefined && user.type !== options.type) {
-    return null;
-  }
-  const type = config.types.get(user.type);
-  if (type === undefined || !renewalDue(type, session, now)) {
-    return {
-      user: toUser(user),
-      session: toSession(session),
-      token,
-      renewed: false
-    };
-  }
-  const extended = await store.sessions.extendSession(session.id, new Date(now + type.lifespanMs));
-  if (extended === null)
-    return null;
-  return {
-    user: toUser(user),
-    session: toSession(extended),
-    token,
-    renewed: true
-  };
-}
-function renewalDue(type, session, now) {
-  return type.renewAfterMs !== null && type.lifespanMs - (session.expiresAt.getTime() - now) >= type.renewAfterMs;
-}
-
-// src/auth/sessions/collect-expired.ts
-async function collectExpired(context) {
-  const { store, clock, capabilities } = context;
-  const sessions = capabilities.collectExpired ? store.sessions.deleteExpiredSessions : undefined;
-  const tokens = capabilities.collectExpiredTokens ? store.tokens.deleteExpiredTokens : undefined;
-  if (sessions === undefined && tokens === undefined) {
-    throw new UnsupportedError2("collectExpired: store.sessions does not implement deleteExpiredSessions, nor store.tokens deleteExpiredTokens — their stores expire records on their own, or implement the methods", { slot: "sessions", operation: "deleteExpiredSessions" });
-  }
-  const before = clock.now();
-  const collected = sessions === undefined ? 0 : await sessions(before);
-  return collected + (tokens === undefined ? 0 : await tokens(before));
-}
-
-// src/auth/sessions/cookie.ts
-function cookieOf(context) {
-  const { name, domain, path, sameSite, secure } = context.config.cookie;
-  const attributes = [
-    `Path=${path}`,
-    ...domain === null ? [] : [`Domain=${domain}`],
-    "HttpOnly",
-    `SameSite=${sameSite[0]?.toUpperCase()}${sameSite.slice(1)}`,
-    ...secure ? ["Secure"] : []
-  ].join("; ");
-  return {
-    name,
-    serialize: (token, session) => `${name}=${token}; Expires=${session.expiresAt.toUTCString()}; ${attributes}`,
-    clear: () => `${name}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; ${attributes}`
-  };
-}
-
-// src/auth/sessions/shared-api.ts
-function sharedApi(context) {
-  const { store, clock, config } = context;
-  return {
-    async authenticate(request, options) {
-      return authenticate(context, request, options);
-    },
-    async signOut(request) {
-      const token = presentedToken(request, config.cookie.name);
-      if (token === null)
-        return false;
-      const session = await store.sessions.findSessionByTokenHash(hashSecret(token));
-      if (session === null)
-        return false;
-      return store.sessions.revokeSession(session.id, clock.now());
-    },
-    async signOutEverywhere(user, options) {
-      const id = idOf(user);
-      if (!isId2(id))
-        return 0;
-      return options?.except === undefined || !isId2(options.except) ? store.sessions.revokeUserSessions(id, clock.now()) : store.sessions.revokeUserSessions(id, clock.now(), options.except);
-    },
-    async findUser(id) {
-      const record = await findRecord(context, id, null);
-      return record === null ? null : toUser(record);
-    },
-    async getUser(id) {
-      return toUser(await getRecord(context, id, null, "getUser"));
-    },
-    cookie: cookieOf(context),
-    async collectExpired() {
-      return collectExpired(context);
-    },
-    types: [...config.types.keys()]
-  };
-}
-// src/auth/counter-key.ts
-function counterKey(context, purpose) {
-  const sealer = context.config.secondFactor?.sealer;
-  return sealer === undefined ? Buffer.from(purpose) : derivedKey(sealer, purpose);
-}
-var keyed = (key, parts) => keyedHash(key, parts).toString("base64url");
-
-// src/auth/one-time/codes.ts
-import { timingSafeEqual as timingSafeEqual3 } from "node:crypto";
-
-// src/auth/one-time/refusals.ts
-function refuseStale(type, user, token, where, noun) {
-  const email = emailOf(type, user.fields);
-  if (email === null || normalizeEmail(email) !== normalizeEmail(token.address)) {
-    throw new TokenError2("TOKEN_STALE", `${where}: the ${noun} was sent to an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
-  }
-}
-function refuseUnusable(token, now, where, noun) {
-  if (token === null) {
-    throw new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
-      operation: where
-    });
-  }
-  if (token.spentAt !== null) {
-    throw new TokenError2("TOKEN_SPENT", `${where}: the ${noun} was already used`, { operation: where });
-  }
-  if (token.expiresAt.getTime() <= now.getTime()) {
-    throw new TokenError2("TOKEN_EXPIRED", `${where}: the ${noun} has expired`, {
-      operation: where
-    });
-  }
-}
-var unknownOneTime = (where, noun) => new TokenError2("TOKEN_UNKNOWN", `${where}: no such ${noun}`, {
-  operation: where
-});
-
-// src/auth/one-time/spend.ts
-async function spendOneTime(context, secret, kind, where, noun) {
-  const now = context.clock.now();
-  const token = await context.store.tokens.consumeToken(hashSecret(secret), kind, now);
-  refuseUnusable(token, now, where, noun);
-  return token;
-}
-async function burnOneTime(context, secret, kind) {
-  await context.store.tokens.consumeToken(hashSecret(secret), kind, context.clock.now());
-}
-
-// src/auth/one-time/codes.ts
-var CODE_ATTEMPTS = 5;
-async function countCodeAttempt(context, secret, kind, where, userType) {
-  const token = await context.store.tokens.countAttempt(hashSecret(secret), kind);
-  refuseUnusable(token, context.clock.now(), where, "challenge");
-  if (token.attempts > CODE_ATTEMPTS) {
-    throw codeInvalid(where, token.userId, userType, 0);
+// src/auth/one-time/codes.ts
+var CODE_ATTEMPTS = 5;
+async function countCodeAttempt(context, secret, kind, where, userType) {
+  const token = await context.store.tokens.countAttempt(hashSecret(secret), kind);
+  refuseUnusable(token, context.clock.now(), where, "challenge");
+  if (token.attempts > CODE_ATTEMPTS) {
+    throw codeInvalid(where, token.userId, userType, 0);
   }
   return { token, attemptsLeft: CODE_ATTEMPTS - token.attempts };
 }
@@ -1167,7 +860,7 @@ function codeMatches(token, challenge, code) {
     return false;
   const given = Buffer.from(hashCode(challenge, code));
   const held = Buffer.from(token.codeHash);
-  return given.length === held.length && timingSafeEqual3(given, held);
+  return given.length === held.length && timingSafeEqual2(given, held);
 }
 // src/auth/one-time/issue.ts
 import { randomInt } from "node:crypto";
@@ -1263,7 +956,7 @@ async function insertLink(links, tokenHash) {
   throw links.counting.vanished();
 }
 // src/auth/mail-requests.ts
-var PURPOSE2 = "janus/mail/requests/v1";
+var PURPOSE = "janus/mail/requests/v1";
 async function countMailByAddress(context, type, flow, email, where, userId) {
   await countMail(context, type, flow, {
     address: normalizeEmail(email),
@@ -1277,7 +970,7 @@ async function countMail(context, type, flow, counted, where) {
   const throttle = context.config.mailThrottle;
   if (throttle === null)
     return;
-  const key = counterKey(context, PURPOSE2);
+  const key = counterKey(context, PURPOSE);
   const subject = "address" in counted ? keyed(key, [flow, "address", counted.address]) : keyed(key, [flow, "user", counted.userId]);
   const { attempts, endsAt } = await countInWindow(context, {
     windowMs: throttle.windowMs,
@@ -1301,110 +994,428 @@ var normalized = (email) => email === null ? null : normalizeEmail(email);
 function emailChanged(type, before, after) {
   return normalized(emailOf(type, before)) !== normalized(emailOf(type, after));
 }
-async function fieldsPatch(type, record, patch, where) {
-  const fields = await validateFields(type, { ...record.fields, ...patch }, where);
+async function fieldsPatch(type, record, patch, where) {
+  const fields = await validateFields(type, { ...record.fields, ...patch }, where);
+  return {
+    fields,
+    logins: loginsOf(type, fields, where),
+    schemaVersion: type.schemaVersion,
+    ...emailChanged(type, record.fields, fields) ? { emailVerifiedAt: null } : {}
+  };
+}
+
+// src/auth/email-flows/change-email-token.ts
+var formerHash = (secret, former) => hashSecret(`janus/changeEmail/former\x00${secret}\x00${normalizeEmail(former ?? "")}`);
+async function newAddressOf(type, user, email, where) {
+  const fields = await validateFields(type, { ...user.fields, [type.email]: email }, where);
+  const address = emailOf(type, fields);
+  if (address === null) {
+    throw new TypeError(`janus: email "${type.email}" did not name a string in validated ${type.name} fields — the schema must keep the e-mail field a required string`);
+  }
+  if (normalizeEmail(address) === normalizeEmail(emailOf(type, user.fields) ?? "")) {
+    throw new UserInvalidError2(`${where}: the new e-mail is the user's current one — a change moves to another address; verifyEmail proves the current one`, {
+      issues: [
+        { path: [type.email], message: "is the current e-mail of the user" }
+      ],
+      userType: type.name
+    });
+  }
+  return address;
+}
+async function issueChangeEmailToken(context, type, user, address) {
+  const secret = mintSecret();
+  const { expiresAt } = await issueOneTime(context, {
+    kind: "changeEmail",
+    userId: user.id,
+    address,
+    ttlMs: context.config.tokenTtlMs.changeEmail,
+    secret,
+    boundHash: formerHash(secret, emailOf(type, user.fields))
+  });
+  await context.store.tokens.spendUserTokens(user.id, "changeEmail", context.clock.now(), hashSecret(secret));
+  return { token: secret, email: address, expiresAt };
+}
+function refuseMoved(type, user, token, secret, where) {
+  if (token.codeHash !== formerHash(secret, emailOf(type, user.fields))) {
+    throw new TokenError2("TOKEN_STALE", `${where}: the token was asked from an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+  }
+}
+async function redeemChangeEmailToken(context, type, secret, where) {
+  const token = await spendOneTime(context, secret, "changeEmail", where, "token");
+  const user = await findRecord(context, token.userId, type?.name ?? null);
+  const owner = type ?? context.config.types.get(user?.type ?? "");
+  if (user === null || owner === undefined)
+    throw unknownOneTime(where, "token");
+  if (emailOf(owner, user.fields) === null)
+    throw unknownOneTime(where, "token");
+  refuseMoved(owner, user, token, secret, where);
+  return { token, user, type: owner };
+}
+
+// src/auth/email-flows/change-email.ts
+var inactive = (type, user, where) => new UserInactiveError2(`${where}: the user is inactive`, {
+  userId: user.id,
+  userType: type.name
+});
+function changeEmailFlows(context, type, at) {
+  return {
+    async send(user, email) {
+      const where = at("changeEmail.send");
+      const record = await getRecord(context, idOf(user), type.name, where);
+      if (!record.active)
+        throw inactive(type, record, where);
+      const address = await newAddressOf(type, record, email, where);
+      await countMailByUser(context, type, "changeEmail", record.id, where);
+      await countMailByAddress(context, type, "changeEmail", address, where, record.id);
+      return issueChangeEmailToken(context, type, record, address);
+    },
+    async confirm(secret) {
+      return confirmChange(context, type, secret, at("changeEmail.confirm"));
+    }
+  };
+}
+async function confirmChange(context, asked, secret, where) {
+  const { token, user, type } = await redeemChangeEmailToken(context, asked, secret, where);
+  if (!user.active)
+    throw inactive(type, user, where);
+  const seen = { replaced: null };
+  const written = await writeUser(context, user.id, type, undefined, where, async (record, now) => {
+    if (!record.active)
+      throw inactive(type, record, where);
+    refuseMoved(type, record, token, secret, where);
+    seen.replaced = record;
+    const patch = await fieldsPatch(type, record, { [type.email]: token.address }, where);
+    const proved = record.emailVerifiedAt === null || emailChanged(type, record.fields, patch.fields);
+    return proved ? { ...patch, emailVerifiedAt: now } : patch;
+  });
+  const { replaced } = seen;
+  const moved = replaced !== null && emailChanged(type, replaced.fields, written.fields);
+  if (replaced !== null && moved) {
+    await emit(context, "user.emailChanged", written, written.updatedAt, {
+      formerEmail: emailOf(type, replaced.fields)
+    });
+  }
+  if (moved || replaced?.emailVerifiedAt === null) {
+    await emit(context, "user.emailVerified", written, written.updatedAt);
+  }
+  return toUser(written);
+}
+
+// src/auth/email-flows/any-type-change-email.ts
+function anyTypeChangeEmail(context) {
+  return {
+    changeEmail: {
+      confirm: (secret) => confirmChange(context, null, secret, "changeEmail.confirm")
+    }
+  };
+}
+
+// src/auth/port/assert-stores.ts
+var REQUIRED = {
+  users: [
+    "insertUser",
+    "findUser",
+    "findUserByLogin",
+    "listUsers",
+    "updateUser",
+    "deleteUser"
+  ],
+  sessions: [
+    "insertSession",
+    "findSessionByTokenHash",
+    "extendSession",
+    "reauthenticateSession",
+    "revokeSession",
+    "revokeUserSessions",
+    "deleteUserSessions"
+  ],
+  tokens: [
+    "insertToken",
+    "consumeToken",
+    "countAttempt",
+    "spendUserTokens",
+    "deleteUserTokens"
+  ]
+};
+function assertStores(stores, where) {
+  if (typeof stores !== "object" || stores === null) {
+    throw new TypeError(`${where}: store must be an object with users, sessions and tokens`);
+  }
+  for (const slot of Object.keys(REQUIRED)) {
+    const store = stores[slot];
+    if (typeof store !== "object" || store === null) {
+      throw new TypeError(`${where}: store.${slot} is missing`);
+    }
+    for (const method of REQUIRED[slot]) {
+      if (typeof store[method] !== "function") {
+        throw new TypeError(`${where}: store.${slot} has no method ${method}, which the port requires`);
+      }
+    }
+  }
+  const slots = stores;
+  return {
+    collectExpired: optional(slots, "sessions", "deleteExpiredSessions", where),
+    collectExpiredTokens: optional(slots, "tokens", "deleteExpiredTokens", where),
+    findUsers: optional(slots, "users", "findUsers", where)
+  };
+}
+function optional(stores, slot, method, where) {
+  const found = stores[slot][method];
+  if (found !== undefined && typeof found !== "function") {
+    throw new TypeError(`${where}: store.${slot}.${method} must be a function or absent`);
+  }
+  return found !== undefined;
+}
+
+// src/auth/devices/token.ts
+import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+var PURPOSE2 = "janus/devices/v1";
+var TOKEN = /^d1\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{22})\.([A-Za-z0-9_-]{43})$/;
+function macOf(key, userId, deviceId) {
+  return keyedHash(key, [userId, deviceId]);
+}
+function signed(sealer, userId, deviceId) {
+  const key = derivedKey(sealer, PURPOSE2);
+  const mac = macOf(key, userId, deviceId).toString("base64url");
+  return `d1.${sealer.sealWith}.${deviceId}.${mac}`;
+}
+function mintDeviceToken(sealer, userId) {
+  return signed(sealer, userId, randomBytes4(16).toString("base64url"));
+}
+function knownDeviceToken(sealer, userId, presented) {
+  const [, keyId, deviceId, mac] = TOKEN.exec(presented) ?? [];
+  if (keyId === undefined || deviceId === undefined || mac === undefined) {
+    return null;
+  }
+  const key = derivedKey(sealer, PURPOSE2, keyId);
+  if (key === undefined)
+    return null;
+  const expected = macOf(key, userId, deviceId);
+  const given = Buffer.from(mac, "base64url");
+  if (given.length !== expected.length || !timingSafeEqual3(given, expected)) {
+    return null;
+  }
+  return keyId === sealer.sealWith ? presented : signed(sealer, userId, deviceId);
+}
+
+// src/auth/devices/hint.ts
+var UNTRACKED = Object.freeze({
+  newDevice: false,
+  deviceToken: null
+});
+function deviceHint(context, options, where) {
+  if (options !== undefined && (typeof options !== "object" || options === null)) {
+    throw new TypeError(`${where}: options must be { device }, or left out — the token goes under device`);
+  }
+  const device = options?.device;
+  if (device === undefined)
+    return;
+  if (device !== null && typeof device !== "string") {
+    throw new TypeError(`${where}: options.device must be the device token the client holds, or null when it holds none`);
+  }
+  if (context.config.devices === null) {
+    throw new TypeError(`${where}: a device was given, but janus() has no devices — pass devices: { keys }`);
+  }
+  return device;
+}
+function deviceOutcome(context, userId, hint, signUp) {
+  const sealer = context.config.devices?.sealer;
+  if (hint === undefined || sealer === undefined)
+    return UNTRACKED;
+  const known = hint === null || signUp ? null : knownDeviceToken(sealer, userId, hint);
+  if (known !== null)
+    return { newDevice: false, deviceToken: known };
+  return {
+    newDevice: !signUp,
+    deviceToken: mintDeviceToken(sealer, userId)
+  };
+}
+// src/auth/devices/report.ts
+async function reportNewDevice(context, result) {
+  if (result.status !== "signedIn" || !result.newDevice)
+    return;
+  await emit(context, "user.newDeviceSignedIn", result.user, result.session.createdAt, { sessionId: result.session.id });
+}
+// src/auth/sessions/open-session.ts
+function toSession(record) {
+  const { tokenHash: _, ...session } = record;
+  return session;
+}
+async function openSession(context, type, user, device, signUp = false) {
+  const now = context.clock.now();
+  const token = mintSecret();
+  const record = {
+    id: mintId2(now.getTime()),
+    tokenHash: hashSecret(token),
+    userId: user.id,
+    authenticatedAt: now,
+    expiresAt: new Date(now.getTime() + type.lifespanMs),
+    revokedAt: null,
+    createdAt: now
+  };
+  await context.store.sessions.insertSession(record);
   return {
-    fields,
-    logins: loginsOf(type, fields, where),
-    schemaVersion: type.schemaVersion,
-    ...emailChanged(type, record.fields, fields) ? { emailVerifiedAt: null } : {}
+    status: "signedIn",
+    user: toUser(user),
+    session: toSession(record),
+    token,
+    ...deviceOutcome(context, user.id, device, signUp)
+  };
+}
+// src/auth/sessions/presented-token.ts
+function presentedToken(request, cookieName) {
+  const headers = headersOf(request);
+  const read = (name) => {
+    if (headers instanceof Headers)
+      return headers.get(name);
+    for (const [key, value] of Object.entries(headers)) {
+      if (key.toLowerCase() !== name || value === undefined)
+        continue;
+      return typeof value === "string" ? value : value.join(", ");
+    }
+    return null;
   };
+  const authorization = read("authorization");
+  if (authorization !== null) {
+    const match = /^bearer(?:\s+(.*))?$/i.exec(authorization.trim());
+    if (match)
+      return match[1]?.trim() ?? "";
+  }
+  const header = read("x-session-token");
+  if (header !== null)
+    return header.trim();
+  const cookie = read("cookie");
+  if (cookie !== null) {
+    for (const pair of cookie.split(";")) {
+      const at = pair.indexOf("=");
+      if (at !== -1 && pair.slice(0, at).trim() === cookieName) {
+        return pair.slice(at + 1).trim();
+      }
+    }
+  }
+  return null;
+}
+function headersOf(request) {
+  if (request instanceof Headers)
+    return request;
+  const inner = request.headers;
+  if (inner instanceof Headers)
+    return inner;
+  if (typeof inner === "object" && inner !== null)
+    return inner;
+  return request;
+}
+// src/auth/sessions/standing.ts
+async function standingSession(context, request) {
+  const token = presentedToken(request, context.config.cookie.name);
+  if (token === null)
+    return null;
+  const session = await context.store.sessions.findSessionByTokenHash(hashSecret(token));
+  const now = context.clock.now().getTime();
+  return session === null || session.revokedAt !== null || session.expiresAt.getTime() <= now ? null : { token, session };
 }
 
-// src/auth/email-flows/change-email-token.ts
-var formerHash = (secret, former) => hashSecret(`janus/changeEmail/former\x00${secret}\x00${normalizeEmail(former ?? "")}`);
-async function newAddressOf(type, user, email, where) {
-  const fields = await validateFields(type, { ...user.fields, [type.email]: email }, where);
-  const address = emailOf(type, fields);
-  if (address === null) {
-    throw new TypeError(`janus: email "${type.email}" did not name a string in validated ${type.name} fields — the schema must keep the e-mail field a required string`);
+// src/auth/sessions/authenticate.ts
+async function authenticate(context, request, options) {
+  const { store, clock, config } = context;
+  const presented = await standingSession(context, request);
+  if (presented === null)
+    return null;
+  const { token, session } = presented;
+  const now = clock.now().getTime();
+  const user = await store.users.findUser(session.userId);
+  if (user === null || !user.active || options?.type !== undefined && user.type !== options.type) {
+    return null;
   }
-  if (normalizeEmail(address) === normalizeEmail(emailOf(type, user.fields) ?? "")) {
-    throw new UserInvalidError2(`${where}: the new e-mail is the user's current one — a change moves to another address; verifyEmail proves the current one`, {
-      issues: [
-        { path: [type.email], message: "is the current e-mail of the user" }
-      ],
-      userType: type.name
-    });
+  const type = config.types.get(user.type);
+  if (type === undefined || !renewalDue(type, session, now)) {
+    return {
+      user: toUser(user),
+      session: toSession(session),
+      token,
+      renewed: false
+    };
   }
-  return address;
+  const extended = await store.sessions.extendSession(session.id, new Date(now + type.lifespanMs));
+  if (extended === null)
+    return null;
+  return {
+    user: toUser(user),
+    session: toSession(extended),
+    token,
+    renewed: true
+  };
 }
-async function issueChangeEmailToken(context, type, user, address) {
-  const secret = mintSecret();
-  const { expiresAt } = await issueOneTime(context, {
-    kind: "changeEmail",
-    userId: user.id,
-    address,
-    ttlMs: context.config.tokenTtlMs.changeEmail,
-    secret,
-    boundHash: formerHash(secret, emailOf(type, user.fields))
-  });
-  await context.store.tokens.spendUserTokens(user.id, "changeEmail", context.clock.now(), hashSecret(secret));
-  return { token: secret, email: address, expiresAt };
+function renewalDue(type, session, now) {
+  return type.renewAfterMs !== null && type.lifespanMs - (session.expiresAt.getTime() - now) >= type.renewAfterMs;
 }
-function refuseMoved(type, user, token, secret, where) {
-  if (token.codeHash !== formerHash(secret, emailOf(type, user.fields))) {
-    throw new TokenError2("TOKEN_STALE", `${where}: the token was asked from an e-mail the user no longer has`, { operation: where, userId: user.id, userType: type.name });
+
+// src/auth/sessions/collect-expired.ts
+async function collectExpired(context) {
+  const { store, clock, capabilities } = context;
+  const sessions = capabilities.collectExpired ? store.sessions.deleteExpiredSessions : undefined;
+  const tokens = capabilities.collectExpiredTokens ? store.tokens.deleteExpiredTokens : undefined;
+  if (sessions === undefined && tokens === undefined) {
+    throw new UnsupportedError2("collectExpired: store.sessions does not implement deleteExpiredSessions, nor store.tokens deleteExpiredTokens — their stores expire records on their own, or implement the methods", { slot: "sessions", operation: "deleteExpiredSessions" });
   }
+  const before = clock.now();
+  const collected = sessions === undefined ? 0 : await sessions(before);
+  return collected + (tokens === undefined ? 0 : await tokens(before));
 }
-async function redeemChangeEmailToken(context, type, secret, where) {
-  const token = await spendOneTime(context, secret, "changeEmail", where, "token");
-  const user = await findRecord(context, token.userId, type.name);
-  if (user === null)
-    throw unknownOneTime(where, "token");
-  refuseMoved(type, user, token, secret, where);
-  return { token, user };
+
+// src/auth/sessions/cookie.ts
+function cookieOf(context) {
+  const { name, domain, path, sameSite, secure } = context.config.cookie;
+  const attributes = [
+    `Path=${path}`,
+    ...domain === null ? [] : [`Domain=${domain}`],
+    "HttpOnly",
+    `SameSite=${sameSite[0]?.toUpperCase()}${sameSite.slice(1)}`,
+    ...secure ? ["Secure"] : []
+  ].join("; ");
+  return {
+    name,
+    serialize: (token, session) => `${name}=${token}; Expires=${session.expiresAt.toUTCString()}; ${attributes}`,
+    clear: () => `${name}=; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=0; ${attributes}`
+  };
 }
 
-// src/auth/email-flows/change-email.ts
-var inactive = (type, user, where) => new UserInactiveError2(`${where}: the user is inactive`, {
-  userId: user.id,
-  userType: type.name
-});
-function changeEmailFlows(context, type, at) {
+// src/auth/sessions/shared-api.ts
+function sharedApi(context) {
+  const { store, clock, config } = context;
   return {
-    async send(user, email) {
-      const where = at("changeEmail.send");
-      const record = await getRecord(context, idOf(user), type.name, where);
-      if (!record.active)
-        throw inactive(type, record, where);
-      const address = await newAddressOf(type, record, email, where);
-      await countMailByUser(context, type, "changeEmail", record.id, where);
-      await countMailByAddress(context, type, "changeEmail", address, where, record.id);
-      return issueChangeEmailToken(context, type, record, address);
+    async authenticate(request, options) {
+      return authenticate(context, request, options);
     },
-    async confirm(secret) {
-      return confirmChange(context, type, secret, at("changeEmail.confirm"));
-    }
+    async signOut(request) {
+      const token = presentedToken(request, config.cookie.name);
+      if (token === null)
+        return false;
+      const session = await store.sessions.findSessionByTokenHash(hashSecret(token));
+      if (session === null)
+        return false;
+      return store.sessions.revokeSession(session.id, clock.now());
+    },
+    async signOutEverywhere(user, options) {
+      const id = idOf(user);
+      if (!isId2(id))
+        return 0;
+      return options?.except === undefined || !isId2(options.except) ? store.sessions.revokeUserSessions(id, clock.now()) : store.sessions.revokeUserSessions(id, clock.now(), options.except);
+    },
+    async findUser(id) {
+      const record = await findRecord(context, id, null);
+      return record === null ? null : toUser(record);
+    },
+    async getUser(id) {
+      return toUser(await getRecord(context, id, null, "getUser"));
+    },
+    cookie: cookieOf(context),
+    async collectExpired() {
+      return collectExpired(context);
+    },
+    types: [...config.types.keys()]
   };
 }
-async function confirmChange(context, type, secret, where) {
-  const { token, user } = await redeemChangeEmailToken(context, type, secret, where);
-  if (!user.active)
-    throw inactive(type, user, where);
-  const seen = { replaced: null };
-  const written = await writeUser(context, user.id, type, undefined, where, async (record, now) => {
-    if (!record.active)
-      throw inactive(type, record, where);
-    refuseMoved(type, record, token, secret, where);
-    seen.replaced = record;
-    const patch = await fieldsPatch(type, record, { [type.email]: token.address }, where);
-    const proved = record.emailVerifiedAt === null || emailChanged(type, record.fields, patch.fields);
-    return proved ? { ...patch, emailVerifiedAt: now } : patch;
-  });
-  const { replaced } = seen;
-  const moved = replaced !== null && emailChanged(type, replaced.fields, written.fields);
-  if (replaced !== null && moved) {
-    await emit(context, "user.emailChanged", written, written.updatedAt, {
-      formerEmail: emailOf(type, replaced.fields)
-    });
-  }
-  if (moved || replaced?.emailVerifiedAt === null) {
-    await emit(context, "user.emailVerified", written, written.updatedAt);
-  }
-  return toUser(written);
-}
-
 // src/auth/password-written.ts
 async function endWhatThePasswordOpened(context, userId) {
   const now = context.clock.now();
@@ -2543,10 +2554,14 @@ function findOrCreateFlows(context, type, at) {
 
 // src/auth/users/change-password.ts
 async function changePassword(context, type, user, change, options, where) {
-  passwordRule(type, where);
+  const rule = passwordRule(type, where);
   checkPassword(type, change?.next, where);
   const hasher = requireHasher(context, where);
   const written = await writeUser(context, user, type, options, where, async (record, now) => {
+    const login = rule.login in record.fields ? record.fields[rule.login] : undefined;
+    if (typeof login === "string") {
+      await countSignInAttempt(context, type, rule.normalize(login), where);
+    }
     if (record.password === null || !await passwordMatches(context, record, change.current, where)) {
       throw new CredentialError2("CREDENTIALS_INVALID", `${where}: the current password does not match`, {
         reason: record.password === null ? "noPassword" : "wrongPassword",
@@ -2562,6 +2577,7 @@ async function changePassword(context, type, user, change, options, where) {
     };
   });
   await passwordChanged(context, written);
+  await restartSignInCount(context, type, written, where);
   return written;
 }
 
@@ -2820,7 +2836,11 @@ function janus(config) {
     type.name,
     typeApi(context, type)
   ]));
-  const surface = resolved.single ? { ...shared, ...types["user"] } : { ...shared, ...types };
+  const surface = resolved.single ? { ...shared, ...types["user"] } : {
+    ...shared,
+    ...types,
+    ...anyTypeChangeEmail(context)
+  };
   return surface;
 }
 // src/auth/sessions/fresh.ts
@@ -2874,5 +2894,5 @@ export {
   systemClock
 };
 
-//# debugId=D10ED7160A09120864756E2164756E21
+//# debugId=56A97558DCD21E4F64756E2164756E21
 //# sourceMappingURL=index.js.map