@nxgt/janus 0.3.0 → 0.5.0

package/dist/auth/second-factor/factor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factor.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/factor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIpE;;;;;;;GAOG;AAEH,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;AAEnE,KAAK,YAAY,GAAG,kBAAkB,GAAG;IAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;CAAE,CAAC;AAExE,eAAO,MAAM,QAAQ,GACpB,QAAQ,kBAAkB,GAAG,IAAI,KAC/B,MAAM,IAAI,YAA8D,CAAC;AAE5E,yEAAyE;AACzE,wBAAgB,eAAe,CAC9B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,GACT,QAAQ,CAQV;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACzB,UAAU,EAAE,QAAQ,EACpB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,EACT,KAAK,EAAE,MAAM,GACX,kBAAkB,GAAG,IAAI,CAiB3B;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAC1B,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,GACnB,UAAU,CAWZ"}

package/dist/auth/second-factor/flows.d.ts

@@ -0,0 +1,19 @@
+import type { ResolvedType } from '../config';
+import type { AnyUser, Context } from '../context';
+import type { UserRecord } from '../port/types';
+/**
+ * The second factor of one user type: the flows its API answers, and what
+ * `signIn` needs — whether to ask for a code, and the challenge to answer.
+ */
+export declare function secondFactorFlows(context: Context, type: ResolvedType, at: (operation: string) => string): {
+    api: {
+        enroll(user: import("..").UserRef, options?: import("..").WriteOptions): Promise<import("..").SecondFactorEnrolment>;
+        activate(user: import("..").UserRef, code: string, options?: import("..").WriteOptions): Promise<AnyUser>;
+        disable(user: import("..").UserRef, options?: import("..").WriteOptions): Promise<AnyUser>;
+        confirm(challenge: string, code: string): Promise<import("..").SignedIn<AnyUser>>;
+    };
+    challenge: (record: UserRecord, where: string) => Promise<import("..").SecondFactorRequired>;
+    /** Whether `signIn` must ask for a code before opening a session. */
+    required: (record: UserRecord) => boolean;
+};
+//# sourceMappingURL=flows.d.ts.map

package/dist/auth/second-factor/flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/flows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAMhD;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM;;;;;;;;IAWhC,qEAAqE;uBAClD,UAAU,KAAG,OAAO;EAExC"}

package/dist/auth/second-factor/lifecycle.d.ts

@@ -0,0 +1,8 @@
+import type { ResolvedType } from '../config';
+import { type AnyUser, type Context } from '../context';
+import type { SecondFactorApi } from '../types';
+type Lifecycle = Pick<SecondFactorApi<AnyUser>['secondFactor'], 'enroll' | 'activate' | 'disable'>;
+/** Enrolling, activating and disabling a factor: each one write under a version. */
+export declare function lifecycleFlows(context: Context, type: ResolvedType, at: (operation: string) => string): Lifecycle;
+export {};
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/auth/second-factor/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/auth/second-factor/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,OAAO,EAAqB,MAAM,YAAY,CAAC;AAI3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGhD,KAAK,SAAS,GAAG,IAAI,CACpB,eAAe,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,EACxC,QAAQ,GAAG,UAAU,GAAG,SAAS,CACjC,CAAC;AAEF,oFAAoF;AACpF,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAC/B,SAAS,CA0HX"}

package/dist/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EACX,aAAa,EAEb,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,MAAM,SAAS,CAAC;AAEjB,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG;IAC1E,YAAY,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAGxD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAe5B;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CA8G7D;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC7B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CA+Bf"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAKZ,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EACX,aAAa,EAEb,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,MAAM,SAAS,CAAC;AAEjB,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,GAAG;IAC1E,YAAY,CACX,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC1C,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAGxD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAChC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAoB5B;AAED,4DAA4D;AAC5D,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CA8G7D;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC7B,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CA+Bf"}

package/dist/auth/totp.d.ts

@@ -0,0 +1,36 @@
+/**
+ * RFC 6238 as every authenticator app reads it: HMAC-SHA-1, six digits, a
+ * thirty-second step. None of the three is configurable, on purpose — an app
+ * that ignores `algorithm` or `digits` in the URI, and several do, would show
+ * a code the server never accepts.
+ */
+export declare const TOTP: {
+    readonly digits: 6;
+    readonly stepMs: 30000;
+    readonly drift: 1;
+};
+/** A fresh TOTP secret: 20 random bytes — SHA-1's block of key — in base32. */
+export declare function mintTotpSecret(): string;
+/** RFC 4648 base32, without padding: what an `otpauth://` URI carries. */
+export declare function toBase32(bytes: Uint8Array): string;
+export declare function fromBase32(text: string): Buffer;
+/** The step a moment falls in: whole thirty-second periods since the epoch. */
+export declare const stepAt: (now: Date) => number;
+/** RFC 4226's code for one counter value, zero-padded to six digits. */
+export declare function codeAt(secret: Buffer, step: number): string;
+/**
+ * The step this code was shown at — the current one, or one either side for a
+ * clock that drifted — or `null`.
+ *
+ * **Only a step after `lastStep` counts**, so a code is used once: the caller
+ * writes the step it got back, and a replay of the same code finds nothing.
+ * Every candidate is computed, so the time taken does not say which matched.
+ */
+export declare function matchStep(secret: Buffer, code: string, now: Date, lastStep: number | null): number | null;
+/**
+ * The `otpauth://` URI an authenticator app reads from a QR code. The label is
+ * `issuer:account`, each part percent-encoded, and `issuer` is repeated as a
+ * parameter, as Google Authenticator requires.
+ */
+export declare function otpauthUri(issuer: string, account: string, secret: string): string;
+//# sourceMappingURL=totp.d.ts.map

package/dist/auth/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../src/auth/totp.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,IAAI;;;;CAAmD,CAAC;AAIrE,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAclD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAe/C;AAED,+EAA+E;AAC/E,eAAO,MAAM,MAAM,GAAI,KAAK,IAAI,KAAG,MACK,CAAC;AAEzC,wEAAwE;AACxE,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3D;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,EACT,QAAQ,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,IAAI,CAWf;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACZ,MAAM,CAUR"}

package/dist/auth/types.d.ts

@@ -26,6 +26,12 @@ export interface UserBase<Type extends string = string> {
      * that.
      */
     readonly hasPassword: boolean;
+    /**
+     * Whether a second factor is **active**: enrolled, and proved with a first
+     * code. A factor still waiting for that code does not count, and `signIn`
+     * does not ask for it.
+     */
+    readonly hasSecondFactor: boolean;
     /** One more on every write: what `ifVersion` is compared against. */
     readonly version: number;
     readonly createdAt: Date;
@@ -45,10 +51,34 @@ export type Session = Omit<SessionRecord, 'tokenHash'>;
  * to a client that sends it as `Authorization: Bearer`.
  */
 export interface SignedIn<U> {
+    readonly status: 'signedIn';
     readonly user: U;
     readonly session: Session;
     readonly token: string;
 }
+/**
+ * The password was right, and the user has a second factor: no session yet.
+ * Ask for a code, then call `secondFactor.confirm(challenge, code)`.
+ *
+ * **The challenge is a secret** like a session token: keep it where the
+ * visitor's next request can present it — a short-lived cookie, or the body
+ * of your code form — and never in a URL or a log.
+ */
+export interface SecondFactorRequired {
+    readonly status: 'secondFactor';
+    readonly challenge: string;
+    /** When the challenge lapses. Five minutes after `signIn`, by default. */
+    readonly expiresAt: Date;
+}
+/** What `signIn` answers once a second factor is configured: switch on `status`. */
+export type SignInResult<U> = SignedIn<U> | SecondFactorRequired;
+/** What `secondFactor.enroll` answers: show both, keep neither. */
+export interface SecondFactorEnrolment {
+    /** The TOTP secret, in base32: for a user who types it in instead of scanning. */
+    readonly secret: string;
+    /** The `otpauth://` URI to render as a QR code. */
+    readonly uri: string;
+}
 /** Who a request belongs to. */
 export interface Authenticated<U> {
     readonly user: U;
@@ -176,8 +206,13 @@ export interface UserTypeApi<U, In> {
      */
     delete(user: UserRef): Promise<boolean>;
 }
-/** What a user type that signs in with a password answers besides. */
-export interface PasswordApi<U, In, Login extends string> {
+/**
+ * What a user type that signs in with a password answers besides.
+ *
+ * `Answer` is what `signIn` answers: {@link SignedIn}, or {@link SignInResult}
+ * once `janus()` is given a `secondFactor`.
+ */
+export interface PasswordApi<U, In, Login extends string, Answer = SignedIn<U>> {
     /**
      * Creates the user and signs them in.
      *
@@ -197,12 +232,16 @@ export interface PasswordApi<U, In, Login extends string> {
      * so either. **The store's own latency stays observable**, and that limit is
      * documented rather than denied. An inactive user who gave the right
      * password is `USER_INACTIVE`.
+     *
+     * With a `secondFactor` configured, a user whose factor is active gets no
+     * session yet: `{ status: 'secondFactor', challenge }`, for
+     * `secondFactor.confirm`. Switch on `status`.
      */
     signIn(input: {
         readonly [K in Login]: string;
     } & {
         readonly password: string;
-    }): Promise<SignedIn<U>>;
+    }): Promise<Answer>;
     /** The user holding this login, normalised as sign-up normalised it, or `null`. */
     findByLogin(login: string): Promise<U | null>;
     /** Sets or replaces the password — an admin's call. `PASSWORD_TOO_SHORT` below the policy. */
@@ -217,6 +256,42 @@ export interface PasswordApi<U, In, Login extends string> {
         readonly next: string;
     }, options?: WriteOptions): Promise<U>;
 }
+/**
+ * What a user type with a password answers besides, once `janus()` is given a
+ * `secondFactor`: a TOTP second factor, from the first QR code to the code
+ * `signIn` asks for.
+ *
+ * A factor is **enrolled** by `enroll`, **active** once `activate` accepted a
+ * first code, and gone after `disable`. Only an active one is asked for.
+ */
+export interface SecondFactorApi<U> {
+    readonly secondFactor: {
+        /**
+         * Mints a TOTP secret, seals it onto the user, and answers it with the
+         * URI to show as a QR code. The factor waits for `activate`; a factor
+         * already waiting is replaced. `SECOND_FACTOR_ACTIVE` when one is active.
+         */
+        enroll(user: UserRef, options?: WriteOptions): Promise<SecondFactorEnrolment>;
+        /**
+         * Checks a first code from the app, and makes the factor active: from
+         * then on `signIn` asks for a code. `CODE_INVALID` when it does not match,
+         * `SECOND_FACTOR_NOT_ENROLLED` before `enroll`.
+         */
+        activate(user: UserRef, code: string, options?: WriteOptions): Promise<U>;
+        /** Removes the factor, active or waiting. A user without one is answered as is. */
+        disable(user: UserRef, options?: WriteOptions): Promise<U>;
+        /**
+         * Redeems `signIn`'s challenge with a code, and opens the session.
+         *
+         * A challenge takes **five attempts**: a code that does not match is
+         * `CODE_INVALID` with `attemptsLeft`, and the fifth spends the challenge.
+         * A code is accepted once, so a replay is `CODE_INVALID` too. An unknown,
+         * spent or lapsed challenge is `TOKEN_UNKNOWN`, `TOKEN_SPENT` or
+         * `TOKEN_EXPIRED`: sign in again.
+         */
+        confirm(challenge: string, code: string): Promise<SignedIn<U>>;
+    };
+}
 /** What a user type with an e-mail answers besides. */
 export interface VerifyEmailApi<U> {
     readonly verifyEmail: {
@@ -248,8 +323,11 @@ export interface ResetPasswordApi<U> {
         confirm(token: string, password: string): Promise<U>;
     };
 }
-/** The whole surface of one user type, with only the flows its configuration allows. */
-export type TypeApi<Name extends string, Def> = UserTypeApi<UserOfType<Name, Def>, FieldsInput<Def>> & ([LoginOf<Def>] extends [never] ? unknown : PasswordApi<UserOfType<Name, Def>, FieldsInput<Def>, LoginOf<Def>>) & ([EmailOf<Def>] extends [never] ? unknown : VerifyEmailApi<UserOfType<Name, Def>>) & ([LoginOf<Def>] extends [never] ? unknown : [EmailOf<Def>] extends [never] ? unknown : ResetPasswordApi<UserOfType<Name, Def>>);
+/**
+ * The whole surface of one user type, with only the flows its configuration
+ * allows. `TwoFactor` is whether `janus()` was given a `secondFactor`.
+ */
+export type TypeApi<Name extends string, Def, TwoFactor extends boolean = false> = UserTypeApi<UserOfType<Name, Def>, FieldsInput<Def>> & ([LoginOf<Def>] extends [never] ? unknown : TwoFactor extends true ? PasswordApi<UserOfType<Name, Def>, FieldsInput<Def>, LoginOf<Def>, SignInResult<UserOfType<Name, Def>>> & SecondFactorApi<UserOfType<Name, Def>> : PasswordApi<UserOfType<Name, Def>, FieldsInput<Def>, LoginOf<Def>>) & ([EmailOf<Def>] extends [never] ? unknown : VerifyEmailApi<UserOfType<Name, Def>>) & ([LoginOf<Def>] extends [never] ? unknown : [EmailOf<Def>] extends [never] ? unknown : ResetPasswordApi<UserOfType<Name, Def>>);
 /** What every configuration answers, whatever its user types. */
 export interface SharedApi<U extends {
     readonly type: string;
@@ -295,10 +373,16 @@ export interface SharedApi<U extends {
     /** The user type names, in the order they were declared. */
     readonly types: readonly U['type'][];
 }
+/**
+ * Whether a configuration may turn the second factor on. **A key that is
+ * there at all counts**, optional or not: a `secondFactor` set from the
+ * environment may be on at run time, and `signIn` must be typed for it.
+ */
+type TwoFactorOf<C> = 'secondFactor' extends keyof C ? true : false;
 /** What `janus(config)` answers. */
 export type Janus<C extends JanusConfig> = SharedApi<UserOf<C>> & (C extends MultiTypeConfig ? {
-    readonly [K in keyof C['users'] & string]: TypeApi<K, C['users'][K]>;
-} : C extends SingleTypeConfig ? TypeApi<'user', SingleAsType<C>> : never);
+    readonly [K in keyof C['users'] & string]: TypeApi<K, C['users'][K], TwoFactorOf<C>>;
+} : C extends SingleTypeConfig ? TypeApi<'user', SingleAsType<C>, TwoFactorOf<C>> : never);
 /**
  * Makes a value that names no key of `Keys` unassignable, and says why on that
  * key.

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EACf,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,MAAM,WAAW,QAAQ,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACrD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,gGAAgG;AAChG,MAAM,MAAM,IAAI,CACf,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,MAAM,GAAG,MAAM,IACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEtC,qEAAqE;AACrE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa,CAAC,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GACpB,OAAO,GACP,OAAO,GACP;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAA;CAAE,GAC5C,YAAY,CAAC;AAEhB,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAChE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAC1C,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,GAC/B,KAAK,CAAC;AACT,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GACzC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,GAC9B,KAAK,CAAC;AAET,0DAA0D;AAC1D,KAAK,YAAY,CAAC,CAAC,SAAS,gBAAgB,IAAI;IAC/C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;CAC3B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C,CAAC,CAAC,OAAO,CAAC,GACV,CAAC,SAAS,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GAClC,KAAK,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;KAClC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GACjD,KAAK,GACL,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAClB,CAAC,GACD,KAAK;CACT,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAEpB,uEAAuE;AACvE,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,CAAC;CAC9D,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;GAIG;AACH,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACvC,GACE,CAAC,GACD,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvC,OAAO,SAAS,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAC9C,OAAO,GACP,KAAK,GACN,KAAK,CAAC;AAEV,KAAK,UAAU,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzB,GACE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GACvB,KAAK,CAAC;AAET,sEAAsE;AACtE,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE7B,mEAAmE;AACnE,KAAK,WAAW,CAAC,GAAG,IAAI,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,CAAC,CAAC,GACV,KAAK,CAAC;AAIT,oCAAoC;AACpC,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,MAAM,CACL,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACnE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd,qGAAqG;IACrG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpC,6CAA6C;IAC7C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE5B,iHAAiH;IACjH,IAAI,CAAC,IAAI,CAAC,EAAE;QACX,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3B;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E,iFAAiF;IACjF,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,SAAS,MAAM;IACvD;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE;;;;;;;;;;OAUG;IACH,MAAM,CACL,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,MAAM;KAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExB,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,8FAA8F;IAC9F,WAAW,CACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;OAIG;IACH,cAAc,CACb,IAAI,EAAE,OAAO,EACb,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC3D,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE;QACrB,yEAAyE;QACzE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C;;;WAGG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE;QACvB;;;;WAIG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD;;;;WAIG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,MAAM,OAAO,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,IAAI,WAAW,CAC1D,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,WAAW,CAAC,GAAG,CAAC,CAChB,GACA,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GACtE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D;;;;;;;;;;OAUG;IACH,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnE,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,uEAAuE;IACvE,iBAAiB,CAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC,kEAAkE;IAClE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QACnD,KAAK,IAAI,MAAM,CAAC;KAChB,CAAC;IAEF;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;CACrC;AAED,oCAAoC;AACpC,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAC9D,CAAC,CAAC,SAAS,eAAe,GACvB;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACxE,CAAC,SAAS,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAChC,KAAK,CAAC,CAAC;AAIZ;;;;;;;;;GASG;AACH,KAAK,SAAS,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAC7E,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,YAAY,IAAI,eAAe,GAAG,IAAI;CACnE,CAAC;AAEJ,KAAK,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhF,+EAA+E;AAC/E,KAAK,SAAS,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG,SAAS;IAC5D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAC/C,GACE;IACA,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;KACF,CAAC;CACF,GACA,OAAO,CAAC,GACV,CAAC,GAAG,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GACrC;IACA,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;CACF,GACA,OAAO,CAAC,GACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAClD,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG;QAC1B,QAAQ,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,2CAA2C,GAAG,KAAK;KACjH;CACD,CAAC,CAAC;AAEN,KAAK,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,GAAG,SAAS;IAC1D,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG,MAAM,CAAC,SAAS,UAAU;CACrD,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C;IACA,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GACxE;YACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,kEAAkE,GAAG,KAAK;SACvG,GACA,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;KACrC,CAAC;CACF,GACA,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EACf,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mEAAmE;AACnE,MAAM,WAAW,QAAQ,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACrD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,gGAAgG;AAChG,MAAM,MAAM,IAAI,CACf,IAAI,SAAS,MAAM,GAAG,MAAM,EAC5B,MAAM,GAAG,MAAM,IACZ,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEtC,qEAAqE;AACrE,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,QAAQ,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,oFAAoF;AACpF,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;AAEjE,mEAAmE;AACnE,MAAM,WAAW,qBAAqB;IACrC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,gCAAgC;AAChC,MAAM,WAAW,aAAa,CAAC,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CACzB;AAED,mEAAmE;AACnE,MAAM,MAAM,WAAW,GACpB,OAAO,GACP,OAAO,GACP;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,CAAA;CAAE,GAC5C,YAAY,CAAC;AAEhB,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAChE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,KAAK,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GAC1C,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,GAC/B,KAAK,CAAC;AACT,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,gBAAgB,GACzC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,GAC9B,KAAK,CAAC;AAET,0DAA0D;AAC1D,KAAK,YAAY,CAAC,CAAC,SAAS,gBAAgB,IAAI;IAC/C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;CAC3B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C,CAAC,CAAC,OAAO,CAAC,GACV,CAAC,SAAS,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GAClC,KAAK,CAAC;AAEV;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;KAClC,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GACjD,KAAK,GACL,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAClB,CAAC,GACD,KAAK;CACT,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAEpB,uEAAuE;AACvE,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAA;KAAE,CAAC;CAC9D,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;GAIG;AACH,MAAM,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,MAAM,CAAC;CACvC,GACE,CAAC,GACD,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACvC,OAAO,SAAS,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAC9C,OAAO,GACP,KAAK,GACN,KAAK,CAAC;AAEV,KAAK,UAAU,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzB,GACE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GACvB,KAAK,CAAC;AAET,sEAAsE;AACtE,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC9D,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;AAE7B,mEAAmE;AACnE,KAAK,WAAW,CAAC,GAAG,IAAI,GAAG,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC7D,OAAO,CAAC,CAAC,CAAC,GACV,KAAK,CAAC;AAIT,oCAAoC;AACpC,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,MAAM,CACL,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACnE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd,qGAAqG;IACrG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpC,6CAA6C;IAC7C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE5B,iHAAiH;IACjH,IAAI,CAAC,IAAI,CAAC,EAAE;QACX,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3B;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E,iFAAiF;IACjF,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9E;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAC3B,CAAC,EACD,EAAE,EACF,KAAK,SAAS,MAAM,EACpB,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC;IAEpB;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAExE;;;;;;;;;;;;;;OAcG;IACH,MAAM,CACL,KAAK,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,GAAG,MAAM;KAAE,GAAG;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,mFAAmF;IACnF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,8FAA8F;IAC9F,WAAW,CACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;IAEd;;;;OAIG;IACH,cAAc,CACb,IAAI,EAAE,OAAO,EACb,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAC3D,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,CAAC,CAAC,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE;QACtB;;;;WAIG;QACH,MAAM,CACL,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAClC;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1E,mFAAmF;QACnF,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3D;;;;;;;;WAQG;QACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc,CAAC,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE;QACrB,yEAAyE;QACzE,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1C;;;WAGG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACnC,CAAC;CACF;AAED,sEAAsE;AACtE,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE;QACvB;;;;WAIG;QACH,OAAO,CACN,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,CAAC,WAAW,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;SAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD;;;;WAIG;QACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,CAClB,IAAI,SAAS,MAAM,EACnB,GAAG,EACH,SAAS,SAAS,OAAO,GAAG,KAAK,IAC9B,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GACvD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,SAAS,SAAS,IAAI,GACrB,WAAW,CACX,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,WAAW,CAAC,GAAG,CAAC,EAChB,OAAO,CAAC,GAAG,CAAC,EACZ,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACnC,GACA,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GACtC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GACvE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GACzC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC5B,OAAO,GACP,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC7B,OAAO,GACP,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;IAC7D;;;;;;;;;;OAUG;IACH,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAC3C,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,GAC7B,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEnE,gGAAgG;IAChG,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD,uEAAuE;IACvE,iBAAiB,CAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExC,kEAAkE;IAClE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;QACnD,KAAK,IAAI,MAAM,CAAC;KAChB,CAAC;IAEF;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,KAAK,WAAW,CAAC,CAAC,IAAI,cAAc,SAAS,MAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC;AAEpE,oCAAoC;AACpC,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,WAAW,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAC9D,CAAC,CAAC,SAAS,eAAe,GACvB;IACA,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CACjD,CAAC,EACD,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EACb,WAAW,CAAC,CAAC,CAAC,CACd;CACD,GACA,CAAC,SAAS,gBAAgB,GACzB,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAChD,KAAK,CAAC,CAAC;AAIZ;;;;;;;;;GASG;AACH,KAAK,SAAS,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,EAAE,IAAI,SAAS,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,GAC7E,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,YAAY,IAAI,eAAe,GAAG,IAAI;CACnE,CAAC;AAEJ,KAAK,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEhF,+EAA+E;AAC/E,KAAK,SAAS,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG,SAAS;IAC5D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CAC/C,GACE;IACA,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;KACF,CAAC;CACF,GACA,OAAO,CAAC,GACV,CAAC,GAAG,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GACrC;IACA,QAAQ,CAAC,KAAK,EAAE,SAAS,CACxB,CAAC,EACD,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EACtD,yBAAyB,CACzB,CAAC;CACF,GACA,OAAO,CAAC,GACX,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAClD,OAAO,GACP;IACA,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG;QAC1B,QAAQ,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,2CAA2C,GAAG,KAAK;KACjH;CACD,CAAC,CAAC;AAEN,KAAK,QAAQ,CAAC,GAAG,EAAE,SAAS,SAAS,MAAM,IAAI,GAAG,SAAS;IAC1D,QAAQ,EAAE,CAAC,IAAI,SAAS,GAAG,MAAM,CAAC,SAAS,UAAU;CACrD,GACE,CAAC,GACD,KAAK,CAAC;AAET;;;;;;;GAOG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,eAAe,GAC/C;IACA,QAAQ,CAAC,KAAK,EAAE;QACf,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,GACxE;YACA,QAAQ,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,MAAM,kEAAkE,GAAG,KAAK;SACvG,GACA,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;KACrC,CAAC;CACF,GACA,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC"}

package/dist/auth/users.d.ts

@@ -1,9 +1,9 @@
 import { type ResolvedType } from './config';
 import { type AnyUser, type Context } from './context';
-import type { PasswordApi, ResetPasswordApi, UserTypeApi, VerifyEmailApi } from './types';
+import type { PasswordApi, ResetPasswordApi, SecondFactorApi, SignInResult, UserTypeApi, VerifyEmailApi } from './types';
 type Input = Record<string, unknown>;
 /** Everything one user type answers. Which flows it has is decided by its types; all are built. */
-export type AnyTypeApi = UserTypeApi<AnyUser, Input> & PasswordApi<AnyUser, Input, string> & VerifyEmailApi<AnyUser> & ResetPasswordApi<AnyUser>;
+export type AnyTypeApi = UserTypeApi<AnyUser, Input> & PasswordApi<AnyUser, Input, string, SignInResult<AnyUser>> & SecondFactorApi<AnyUser> & VerifyEmailApi<AnyUser> & ResetPasswordApi<AnyUser>;
 export declare function typeApi(context: Context, type: ResolvedType): AnyTypeApi;
 export {};
 //# sourceMappingURL=users.d.ts.map

package/dist/auth/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAaZ,MAAM,WAAW,CAAC;AAInB,OAAO,KAAK,EAEX,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,MAAM,SAAS,CAAC;AAEjB,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErC,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACnC,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE3B,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CA8axE"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/auth/users.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7D,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,OAAO,EAaZ,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAEX,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,cAAc,EACd,MAAM,SAAS,CAAC;AAEjB,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErC,mGAAmG;AACnG,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,GACnD,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,GAC1D,eAAe,CAAC,OAAO,CAAC,GACxB,cAAc,CAAC,OAAO,CAAC,GACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE3B,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,UAAU,CAwYxE"}

package/dist/chunks/{index-qwfkhqkk.js → index-06vp9c5r.js}

@@ -17,6 +17,7 @@ class JanusError2 extends Error {
     this.slot = options?.slot;
     this.permission = options?.permission;
     this.maxDepth = options?.maxDepth;
+    this.attemptsLeft = options?.attemptsLeft;
   }
 }
 
@@ -77,6 +78,14 @@ class TokenError2 extends JanusError2 {
   }
 }
 
+class SecondFactorError2 extends JanusError2 {
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "SecondFactorError";
+    this.code = code;
+  }
+}
+
 class InvalidCursorError2 extends JanusError2 {
   constructor() {
     super(...arguments);
@@ -159,7 +168,7 @@ function parseSubject2(text) {
   return relation === undefined ? { type, id } : setOf2({ type, id }, relation);
 }
 
-export { JanusError2, StoreFailure2, StoreConflict2, NotFoundError2, UserInvalidError2, CredentialError2, UserInactiveError2, TokenError2, InvalidCursorError2, UnsupportedError2, PermissionDepthError2, isSubjectSet2, subjectOf2, setOf2, isSetOf2, formatEntity2, formatSubject2, formatTuple2, parseTuple2, parseSubject2 };
+export { JanusError2, StoreFailure2, StoreConflict2, NotFoundError2, UserInvalidError2, CredentialError2, UserInactiveError2, TokenError2, SecondFactorError2, InvalidCursorError2, UnsupportedError2, PermissionDepthError2, isSubjectSet2, subjectOf2, setOf2, isSetOf2, formatEntity2, formatSubject2, formatTuple2, parseTuple2, parseSubject2 };
 
-//# debugId=49525DE3EB2EE26A64756E2164756E21
-//# sourceMappingURL=index-qwfkhqkk.js.map
+//# debugId=350D8B960021CE8764756E2164756E21
+//# sourceMappingURL=index-06vp9c5r.js.map

package/dist/chunks/{index-qwfkhqkk.js.map → index-06vp9c5r.js.map}

@@ -2,11 +2,11 @@
   "version": 3,
   "sources": ["../src/errors/janus-error.ts", "../src/subjects/subject.ts", "../src/subjects/notation.ts"],
   "sourcesContent": [
-    "/**\n * What this package refuses, as a string a caller can switch on.\n *\n * Every code is a **refusal at call time, on a value that could have come from\n * a request** — which is the rule that decides whether something belongs here\n * or stays a bare `TypeError`. A refusal that can only come from how the\n * application was wired (`janus()` with no schema, a lifespan that is\n * not a duration, a store missing a method) throws a plain `TypeError`\n * instead: no request handler should ever answer one, so no handler needs to\n * tell it apart from the others.\n *\n * The codes are `SCREAMING_SNAKE`, and that is not an exception to this\n * repository's camelCase rule — they are data values, not API identifiers, the\n * same shape `code` has in `@nxgt/mongo` and `@nxgt/redis`. Every *key* in\n * this package is camelCase.\n */\nexport type JanusErrorCode =\n\t/**\n\t * The store could not answer — a refused connection, a timeout, a primary\n\t * stepping down, a deserialisation failure, a bug in the adapter.\n\t *\n\t * **Never a negative answer.** A handler answers 503 and lets the visitor\n\t * retry. Mapping this to a 404, to `null` or to `false` turns an outage\n\t * into a silent lockout: every user is told they do not exist.\n\t * That failure has been measured twice in this organisation, two days\n\t * apart, and it is the reason this package's port is specified rather than\n\t * merely documented.\n\t */\n\t| 'STORE_FAILED'\n\t/**\n\t * The store answered, and there is no such record.\n\t *\n\t * Raised by the `get*` calls, never by the `find*` calls — those return\n\t * `null`, which is a value the caller decides what to do with.\n\t */\n\t| 'NOT_FOUND'\n\t/**\n\t * The login — an e-mail, a username — is already held by another user of\n\t * the same type.\n\t *\n\t * Raised by the **store's own unique constraint** and surfaced here, never\n\t * decided by reading first: two concurrent sign-ups both pass a read, and\n\t * only a constraint refuses one of them. Carries `login` and `userType`.\n\t */\n\t| 'LOGIN_TAKEN'\n\t/**\n\t * The record changed since it was read: the version it was expected to\n\t * hold is no longer the version it holds, and **nothing was written**.\n\t * Read it again and retry. Carries `expectedVersion` and `actualVersion`.\n\t */\n\t| 'VERSION_CONFLICT'\n\t/**\n\t * The fields failed the user type's schema. Carries `issues`, whose paths\n\t * are the fields' own, so a handler can answer 400 field by field.\n\t */\n\t| 'USER_INVALID'\n\t/**\n\t * The password is shorter than the policy's minimum. Reports the policy,\n\t * never the password.\n\t */\n\t| 'PASSWORD_TOO_SHORT'\n\t/**\n\t * The login and the password do not match: no such login, no password set,\n\t * or the wrong one — **one code for the three**, so a response cannot tell\n\t * which accounts exist. `reason` tells them apart for your logs and your\n\t * rate limiter, and never belongs in a response body.\n\t */\n\t| 'CREDENTIALS_INVALID'\n\t/**\n\t * A stored hash whose prefix names no wired verifier — typically an import\n\t * from a system whose format this core cannot read. Reports the prefix,\n\t * never the hash.\n\t */\n\t| 'HASH_UNSUPPORTED'\n\t/**\n\t * The user is inactive: the record and its password are kept, and every\n\t * sign-in is refused. Only told to somebody who gave the right password.\n\t */\n\t| 'USER_INACTIVE'\n\t/** No token holds that secret. */\n\t| 'TOKEN_UNKNOWN'\n\t/**\n\t * The token was already spent. Told apart from `TOKEN_UNKNOWN` for the\n\t * message only — both are refusals, and the outcome is the same.\n\t */\n\t| 'TOKEN_SPENT'\n\t/**\n\t * The token existed and its expiry has passed. It is spent all the same,\n\t * so it cannot be retried.\n\t */\n\t| 'TOKEN_EXPIRED'\n\t/**\n\t * The token was sent to an e-mail the user no longer has. Confirming it\n\t * would verify an address nobody holds any more, so it is spent and refused.\n\t */\n\t| 'TOKEN_STALE'\n\t/** A cursor this store did not mint, or one written for another ordering.\n\t * Never a silent first page: a caller paging a list would loop for ever. */\n\t| 'INVALID_CURSOR'\n\t/**\n\t * The wired store does not implement the optional capability this call\n\t * needs. Names the method and the slot, so the sentence says which store to\n\t * change or which call to stop making.\n\t */\n\t| 'UNSUPPORTED'\n\t/**\n\t * A permission check walked deeper than `maxDepth` relations without an\n\t * answer. **Not a refusal**: an evaluation that stopped half-way has not\n\t * decided anything, and answering `false` would hide a model that is too\n\t * deep behind denials nobody can explain. A cycle in the data is not this —\n\t * it is cut, silently. Carries `permission` and `maxDepth`.\n\t */\n\t| 'PERMISSION_DEPTH';\n\n/** One thing that was wrong with a user's fields, at one path. */\nexport interface Issue {\n\t/** The path inside the fields, as the schema reported it: `['address', 'city']`. */\n\treadonly path: readonly (string | number)[];\n\treadonly message: string;\n}\n\n/**\n * Why a sign-in was refused, for your logs and rate limiter.\n *\n * **Never put it in a response body.** `unknownLogin` is an account\n * enumeration oracle.\n */\nexport type CredentialRefusal = 'unknownLogin' | 'noPassword' | 'wrongPassword';\n\n/**\n * What an error may carry beside its code.\n *\n * **No field here ever holds a secret.** Not a password, not a hash, not a\n * session token, not a token secret, not a token's hash, and not a connection\n * URI — a connection string holds a password, and the specs assert its absence\n * from every message. Nor a login: a message reports a shape, never a value,\n * and a conflict carries the login in `login`.\n */\nexport interface JanusErrorOptions {\n\treadonly userId?: string;\n\treadonly userType?: string;\n\t/** The login a conflict names: an address, never a secret. */\n\treadonly login?: string;\n\treadonly reason?: CredentialRefusal;\n\t/** The prefix of a hash whose format is unknown. Never the hash. */\n\treadonly hashPrefix?: string;\n\treadonly expectedVersion?: number;\n\treadonly actualVersion?: number;\n\treadonly issues?: readonly Issue[];\n\t/** The minimum the policy requires. Never the password that failed it. */\n\treadonly minLength?: number;\n\t/** The port method being called: `insertUser`, `consumeToken`. */\n\treadonly operation?: string;\n\t/** Which store slot: the sentence should say which store to change. */\n\treadonly slot?: 'users' | 'sessions' | 'tokens' | 'relations';\n\t/** The permission being checked, in the notation: `record:r1#view`. */\n\treadonly permission?: string;\n\t/** The depth a check may walk. */\n\treadonly maxDepth?: number;\n\treadonly cause?: unknown;\n}\n\n/**\n * The base of everything this package throws at call time.\n *\n * It extends `Error` and not `TypeError`, and the rule behind that is\n * `nxgt-data`'s: *extend whichever class the refusals it replaces already\n * threw, so no consumer's `catch` stops working*. These replace nothing — the\n * package is new — and `DataError`, `RedisError` and `S3Error` all extend\n * `Error`, so nobody has to order their `catch` blocks.\n *\n * **There is exactly one definition of this class**, and that matters more here\n * than it looks: an adapter in another package throws `StoreFailure` and this\n * package tests it with `instanceof`. Two copies and the product is wrong about\n * what an outage is. `build.ts` shares the module across entry points with\n * `splitting: true`, and `scripts/verify-artifacts.ts` fails the build if any\n * class name appears in two entry bundles of the packed tarball.\n */\nexport class JanusError extends Error {\n\toverride name = 'JanusError';\n\treadonly code: JanusErrorCode = 'STORE_FAILED';\n\treadonly userId: string | undefined;\n\treadonly userType: string | undefined;\n\treadonly login: string | undefined;\n\treadonly reason: CredentialRefusal | undefined;\n\treadonly hashPrefix: string | undefined;\n\treadonly expectedVersion: number | undefined;\n\treadonly actualVersion: number | undefined;\n\treadonly issues: readonly Issue[] | undefined;\n\treadonly minLength: number | undefined;\n\treadonly operation: string | undefined;\n\treadonly slot: 'users' | 'sessions' | 'tokens' | 'relations' | undefined;\n\treadonly permission: string | undefined;\n\treadonly maxDepth: number | undefined;\n\n\tconstructor(message: string, options?: JanusErrorOptions) {\n\t\tsuper(message, { cause: options?.cause });\n\t\tthis.userId = options?.userId;\n\t\tthis.userType = options?.userType;\n\t\tthis.login = options?.login;\n\t\tthis.reason = options?.reason;\n\t\tthis.hashPrefix = options?.hashPrefix;\n\t\tthis.expectedVersion = options?.expectedVersion;\n\t\tthis.actualVersion = options?.actualVersion;\n\t\tthis.issues = options?.issues;\n\t\tthis.minLength = options?.minLength;\n\t\tthis.operation = options?.operation;\n\t\tthis.slot = options?.slot;\n\t\tthis.permission = options?.permission;\n\t\tthis.maxDepth = options?.maxDepth;\n\t}\n}\n\n/**\n * The store could not answer.\n *\n * **This is the class an adapter throws**, and it is exported for that reason:\n * an adapter defines no error class of its own, so `instanceof` holds across\n * the two packages. Any other throw from a store is treated as a failure too —\n * throwing this one is how an adapter says so precisely, and sets `cause`.\n */\nexport class StoreFailure extends JanusError {\n\toverride name = 'StoreFailure';\n\toverride readonly code = 'STORE_FAILED' as const;\n}\n\n/**\n * A uniqueness or a version constraint the store refused.\n *\n * Also thrown by an adapter, and also for the `instanceof` reason. `on` says\n * which constraint, because the two are answered differently: a login\n * collision is the caller's to fix, a version conflict is a retry.\n */\nexport class StoreConflict extends JanusError {\n\toverride name = 'StoreConflict';\n\toverride readonly code: JanusErrorCode;\n\treadonly on: 'login' | 'version';\n\n\tconstructor(\n\t\ton: 'login' | 'version',\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.on = on;\n\t\tthis.code = on === 'login' ? 'LOGIN_TAKEN' : 'VERSION_CONFLICT';\n\t}\n}\n\n/** There is no such record, and the store said so. */\nexport class NotFoundError extends JanusError {\n\toverride name = 'NotFoundError';\n\toverride readonly code = 'NOT_FOUND' as const;\n}\n\n/** The fields failed the user type's schema. */\nexport class UserInvalidError extends JanusError {\n\toverride name = 'UserInvalidError';\n\toverride readonly code = 'USER_INVALID' as const;\n}\n\n/** A password too short, credentials that do not match, or a hash format nobody reads. */\nexport class CredentialError extends JanusError {\n\toverride name = 'CredentialError';\n\toverride readonly code: JanusErrorCode;\n\n\tconstructor(\n\t\tcode: Extract<\n\t\t\tJanusErrorCode,\n\t\t\t'PASSWORD_TOO_SHORT' | 'CREDENTIALS_INVALID' | 'HASH_UNSUPPORTED'\n\t\t>,\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n}\n\n/** The user is inactive, and the password given was the right one. */\nexport class UserInactiveError extends JanusError {\n\toverride name = 'UserInactiveError';\n\toverride readonly code = 'USER_INACTIVE' as const;\n}\n\n/** A one-time token that is unknown, already spent, lapsed, or sent to an e-mail the user no longer has. */\nexport class TokenError extends JanusError {\n\toverride name = 'TokenError';\n\toverride readonly code: JanusErrorCode;\n\n\tconstructor(\n\t\tcode: Extract<\n\t\t\tJanusErrorCode,\n\t\t\t'TOKEN_UNKNOWN' | 'TOKEN_SPENT' | 'TOKEN_EXPIRED' | 'TOKEN_STALE'\n\t\t>,\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n}\n\n/** A cursor this store did not mint, or one for another ordering. */\nexport class InvalidCursorError extends JanusError {\n\toverride name = 'InvalidCursorError';\n\toverride readonly code = 'INVALID_CURSOR' as const;\n}\n\n/** The wired store does not implement the optional capability asked for. */\nexport class UnsupportedError extends JanusError {\n\toverride name = 'UnsupportedError';\n\toverride readonly code = 'UNSUPPORTED' as const;\n}\n\n/** A permission check walked deeper than `maxDepth` without an answer. */\nexport class PermissionDepthError extends JanusError {\n\toverride name = 'PermissionDepthError';\n\toverride readonly code = 'PERMISSION_DEPTH' as const;\n}\n",
+    "/**\n * What this package refuses, as a string a caller can switch on.\n *\n * Every code is a **refusal at call time, on a value that could have come from\n * a request** — which is the rule that decides whether something belongs here\n * or stays a bare `TypeError`. A refusal that can only come from how the\n * application was wired (`janus()` with no schema, a lifespan that is\n * not a duration, a store missing a method) throws a plain `TypeError`\n * instead: no request handler should ever answer one, so no handler needs to\n * tell it apart from the others.\n *\n * The codes are `SCREAMING_SNAKE`, and that is not an exception to this\n * repository's camelCase rule — they are data values, not API identifiers, the\n * same shape `code` has in `@nxgt/mongo` and `@nxgt/redis`. Every *key* in\n * this package is camelCase.\n */\nexport type JanusErrorCode =\n\t/**\n\t * The store could not answer — a refused connection, a timeout, a primary\n\t * stepping down, a deserialisation failure, a bug in the adapter.\n\t *\n\t * **Never a negative answer.** A handler answers 503 and lets the visitor\n\t * retry. Mapping this to a 404, to `null` or to `false` turns an outage\n\t * into a silent lockout: every user is told they do not exist.\n\t * That failure has been measured twice in this organisation, two days\n\t * apart, and it is the reason this package's port is specified rather than\n\t * merely documented.\n\t */\n\t| 'STORE_FAILED'\n\t/**\n\t * The store answered, and there is no such record.\n\t *\n\t * Raised by the `get*` calls, never by the `find*` calls — those return\n\t * `null`, which is a value the caller decides what to do with.\n\t */\n\t| 'NOT_FOUND'\n\t/**\n\t * The login — an e-mail, a username — is already held by another user of\n\t * the same type.\n\t *\n\t * Raised by the **store's own unique constraint** and surfaced here, never\n\t * decided by reading first: two concurrent sign-ups both pass a read, and\n\t * only a constraint refuses one of them. Carries `login` and `userType`.\n\t */\n\t| 'LOGIN_TAKEN'\n\t/**\n\t * The record changed since it was read: the version it was expected to\n\t * hold is no longer the version it holds, and **nothing was written**.\n\t * Read it again and retry. Carries `expectedVersion` and `actualVersion`.\n\t */\n\t| 'VERSION_CONFLICT'\n\t/**\n\t * The fields failed the user type's schema. Carries `issues`, whose paths\n\t * are the fields' own, so a handler can answer 400 field by field.\n\t */\n\t| 'USER_INVALID'\n\t/**\n\t * The password is shorter than the policy's minimum. Reports the policy,\n\t * never the password.\n\t */\n\t| 'PASSWORD_TOO_SHORT'\n\t/**\n\t * The login and the password do not match: no such login, no password set,\n\t * or the wrong one — **one code for the three**, so a response cannot tell\n\t * which accounts exist. `reason` tells them apart for your logs and your\n\t * rate limiter, and never belongs in a response body.\n\t */\n\t| 'CREDENTIALS_INVALID'\n\t/**\n\t * A stored hash whose prefix names no wired verifier — typically an import\n\t * from a system whose format this core cannot read. Reports the prefix,\n\t * never the hash.\n\t */\n\t| 'HASH_UNSUPPORTED'\n\t/**\n\t * The user is inactive: the record and its password are kept, and every\n\t * sign-in is refused. Only told to somebody who gave the right password.\n\t */\n\t| 'USER_INACTIVE'\n\t/** No token holds that secret. */\n\t| 'TOKEN_UNKNOWN'\n\t/**\n\t * The token was already spent. Told apart from `TOKEN_UNKNOWN` for the\n\t * message only — both are refusals, and the outcome is the same.\n\t */\n\t| 'TOKEN_SPENT'\n\t/**\n\t * The token existed and its expiry has passed. It is spent all the same,\n\t * so it cannot be retried.\n\t */\n\t| 'TOKEN_EXPIRED'\n\t/**\n\t * The token was sent to an e-mail the user no longer has. Confirming it\n\t * would verify an address nobody holds any more, so it is spent and refused.\n\t */\n\t| 'TOKEN_STALE'\n\t/**\n\t * A one-time code that does not match: a wrong TOTP code, or one already\n\t * used. Carries `attemptsLeft` when the code was checked against a\n\t * challenge: what is left of its attempts, and `0` once the last one spent\n\t * it.\n\t */\n\t| 'CODE_INVALID'\n\t/** `activate` before `enroll`: the user has no second factor waiting. */\n\t| 'SECOND_FACTOR_NOT_ENROLLED'\n\t/**\n\t * `enroll` or `activate` on a user whose second factor is already active.\n\t * `disable` it first: enrolling again must not quietly switch it off.\n\t */\n\t| 'SECOND_FACTOR_ACTIVE'\n\t/** A cursor this store did not mint, or one written for another ordering.\n\t * Never a silent first page: a caller paging a list would loop for ever. */\n\t| 'INVALID_CURSOR'\n\t/**\n\t * The wired store does not implement the optional capability this call\n\t * needs. Names the method and the slot, so the sentence says which store to\n\t * change or which call to stop making.\n\t */\n\t| 'UNSUPPORTED'\n\t/**\n\t * A permission check walked deeper than `maxDepth` relations without an\n\t * answer. **Not a refusal**: an evaluation that stopped half-way has not\n\t * decided anything, and answering `false` would hide a model that is too\n\t * deep behind denials nobody can explain. A cycle in the data is not this —\n\t * it is cut, silently. Carries `permission` and `maxDepth`.\n\t */\n\t| 'PERMISSION_DEPTH';\n\n/** One thing that was wrong with a user's fields, at one path. */\nexport interface Issue {\n\t/** The path inside the fields, as the schema reported it: `['address', 'city']`. */\n\treadonly path: readonly (string | number)[];\n\treadonly message: string;\n}\n\n/**\n * Why a sign-in was refused, for your logs and rate limiter.\n *\n * **Never put it in a response body.** `unknownLogin` is an account\n * enumeration oracle.\n */\nexport type CredentialRefusal = 'unknownLogin' | 'noPassword' | 'wrongPassword';\n\n/**\n * What an error may carry beside its code.\n *\n * **No field here ever holds a secret.** Not a password, not a hash, not a\n * session token, not a token secret, not a token's hash, and not a connection\n * URI — a connection string holds a password, and the specs assert its absence\n * from every message. Nor a login: a message reports a shape, never a value,\n * and a conflict carries the login in `login`.\n */\nexport interface JanusErrorOptions {\n\treadonly userId?: string;\n\treadonly userType?: string;\n\t/** The login a conflict names: an address, never a secret. */\n\treadonly login?: string;\n\treadonly reason?: CredentialRefusal;\n\t/** The prefix of a hash whose format is unknown. Never the hash. */\n\treadonly hashPrefix?: string;\n\treadonly expectedVersion?: number;\n\treadonly actualVersion?: number;\n\treadonly issues?: readonly Issue[];\n\t/** The minimum the policy requires. Never the password that failed it. */\n\treadonly minLength?: number;\n\t/** The port method being called: `insertUser`, `consumeToken`. */\n\treadonly operation?: string;\n\t/** Which store slot: the sentence should say which store to change. */\n\treadonly slot?: 'users' | 'sessions' | 'tokens' | 'relations';\n\t/** The permission being checked, in the notation: `record:r1#view`. */\n\treadonly permission?: string;\n\t/** The depth a check may walk. */\n\treadonly maxDepth?: number;\n\t/** What is left of a challenge's attempts after a code that did not match. */\n\treadonly attemptsLeft?: number;\n\treadonly cause?: unknown;\n}\n\n/**\n * The base of everything this package throws at call time.\n *\n * It extends `Error` and not `TypeError`, and the rule behind that is\n * `nxgt-data`'s: *extend whichever class the refusals it replaces already\n * threw, so no consumer's `catch` stops working*. These replace nothing — the\n * package is new — and `DataError`, `RedisError` and `S3Error` all extend\n * `Error`, so nobody has to order their `catch` blocks.\n *\n * **There is exactly one definition of this class**, and that matters more here\n * than it looks: an adapter in another package throws `StoreFailure` and this\n * package tests it with `instanceof`. Two copies and the product is wrong about\n * what an outage is. `build.ts` shares the module across entry points with\n * `splitting: true`, and `scripts/verify-artifacts.ts` fails the build if any\n * class name appears in two entry bundles of the packed tarball.\n */\nexport class JanusError extends Error {\n\toverride name = 'JanusError';\n\treadonly code: JanusErrorCode = 'STORE_FAILED';\n\treadonly userId: string | undefined;\n\treadonly userType: string | undefined;\n\treadonly login: string | undefined;\n\treadonly reason: CredentialRefusal | undefined;\n\treadonly hashPrefix: string | undefined;\n\treadonly expectedVersion: number | undefined;\n\treadonly actualVersion: number | undefined;\n\treadonly issues: readonly Issue[] | undefined;\n\treadonly minLength: number | undefined;\n\treadonly operation: string | undefined;\n\treadonly slot: 'users' | 'sessions' | 'tokens' | 'relations' | undefined;\n\treadonly permission: string | undefined;\n\treadonly maxDepth: number | undefined;\n\treadonly attemptsLeft: number | undefined;\n\n\tconstructor(message: string, options?: JanusErrorOptions) {\n\t\tsuper(message, { cause: options?.cause });\n\t\tthis.userId = options?.userId;\n\t\tthis.userType = options?.userType;\n\t\tthis.login = options?.login;\n\t\tthis.reason = options?.reason;\n\t\tthis.hashPrefix = options?.hashPrefix;\n\t\tthis.expectedVersion = options?.expectedVersion;\n\t\tthis.actualVersion = options?.actualVersion;\n\t\tthis.issues = options?.issues;\n\t\tthis.minLength = options?.minLength;\n\t\tthis.operation = options?.operation;\n\t\tthis.slot = options?.slot;\n\t\tthis.permission = options?.permission;\n\t\tthis.maxDepth = options?.maxDepth;\n\t\tthis.attemptsLeft = options?.attemptsLeft;\n\t}\n}\n\n/**\n * The store could not answer.\n *\n * **This is the class an adapter throws**, and it is exported for that reason:\n * an adapter defines no error class of its own, so `instanceof` holds across\n * the two packages. Any other throw from a store is treated as a failure too —\n * throwing this one is how an adapter says so precisely, and sets `cause`.\n */\nexport class StoreFailure extends JanusError {\n\toverride name = 'StoreFailure';\n\toverride readonly code = 'STORE_FAILED' as const;\n}\n\n/**\n * A uniqueness or a version constraint the store refused.\n *\n * Also thrown by an adapter, and also for the `instanceof` reason. `on` says\n * which constraint, because the two are answered differently: a login\n * collision is the caller's to fix, a version conflict is a retry.\n */\nexport class StoreConflict extends JanusError {\n\toverride name = 'StoreConflict';\n\toverride readonly code: JanusErrorCode;\n\treadonly on: 'login' | 'version';\n\n\tconstructor(\n\t\ton: 'login' | 'version',\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.on = on;\n\t\tthis.code = on === 'login' ? 'LOGIN_TAKEN' : 'VERSION_CONFLICT';\n\t}\n}\n\n/** There is no such record, and the store said so. */\nexport class NotFoundError extends JanusError {\n\toverride name = 'NotFoundError';\n\toverride readonly code = 'NOT_FOUND' as const;\n}\n\n/** The fields failed the user type's schema. */\nexport class UserInvalidError extends JanusError {\n\toverride name = 'UserInvalidError';\n\toverride readonly code = 'USER_INVALID' as const;\n}\n\n/** A password too short, credentials that do not match, or a hash format nobody reads. */\nexport class CredentialError extends JanusError {\n\toverride name = 'CredentialError';\n\toverride readonly code: JanusErrorCode;\n\n\tconstructor(\n\t\tcode: Extract<\n\t\t\tJanusErrorCode,\n\t\t\t'PASSWORD_TOO_SHORT' | 'CREDENTIALS_INVALID' | 'HASH_UNSUPPORTED'\n\t\t>,\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n}\n\n/** The user is inactive, and the password given was the right one. */\nexport class UserInactiveError extends JanusError {\n\toverride name = 'UserInactiveError';\n\toverride readonly code = 'USER_INACTIVE' as const;\n}\n\n/**\n * A one-time token that is unknown, already spent, lapsed, or sent to an\n * e-mail the user no longer has — or a one-time code that does not match.\n */\nexport class TokenError extends JanusError {\n\toverride name = 'TokenError';\n\toverride readonly code: JanusErrorCode;\n\n\tconstructor(\n\t\tcode: Extract<\n\t\t\tJanusErrorCode,\n\t\t\t| 'TOKEN_UNKNOWN'\n\t\t\t| 'TOKEN_SPENT'\n\t\t\t| 'TOKEN_EXPIRED'\n\t\t\t| 'TOKEN_STALE'\n\t\t\t| 'CODE_INVALID'\n\t\t>,\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n}\n\n/** A second factor asked to change from a state it is not in. */\nexport class SecondFactorError extends JanusError {\n\toverride name = 'SecondFactorError';\n\toverride readonly code: JanusErrorCode;\n\n\tconstructor(\n\t\tcode: Extract<\n\t\t\tJanusErrorCode,\n\t\t\t'SECOND_FACTOR_NOT_ENROLLED' | 'SECOND_FACTOR_ACTIVE'\n\t\t>,\n\t\tmessage: string,\n\t\toptions?: JanusErrorOptions,\n\t) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n}\n\n/** A cursor this store did not mint, or one for another ordering. */\nexport class InvalidCursorError extends JanusError {\n\toverride name = 'InvalidCursorError';\n\toverride readonly code = 'INVALID_CURSOR' as const;\n}\n\n/** The wired store does not implement the optional capability asked for. */\nexport class UnsupportedError extends JanusError {\n\toverride name = 'UnsupportedError';\n\toverride readonly code = 'UNSUPPORTED' as const;\n}\n\n/** A permission check walked deeper than `maxDepth` without an answer. */\nexport class PermissionDepthError extends JanusError {\n\toverride name = 'PermissionDepthError';\n\toverride readonly code = 'PERMISSION_DEPTH' as const;\n}\n",
     "/**\n * The id every decision in this package hangs on: a user's `id`, as `janus()`\n * mints it.\n *\n * In Ory, the equality between a Kratos identity id and Keto's `subject_id` is\n * a comment and a convention, restated in three repositories and enforced\n * nowhere. Here a user **is** a subject — see {@link subjectOf} — and that\n * shared vocabulary is the whole reason users and permissions are one package\n * rather than two: two packages would make this contract implicit, and an\n * implicit contract between independently versioned packages breaks silently.\n *\n * Opaque: compared with `===`, carried in a URL, logged, never parsed.\n */\nexport type SubjectId = string;\n\n/**\n * Something a permission is about or held by — a user, a record, a team — by\n * its type and its id.\n *\n * **Typed, unlike Keto's subjects.** One application has patients and staff,\n * and an object can hold a relation too (a record's team), so an id alone does\n * not say who. `type` is a user type of `janus()` or an object type of the\n * permission model, and the same word as a user's own `type`.\n */\nexport interface Entity {\n\treadonly type: string;\n\treadonly id: string;\n}\n\n/**\n * Everyone who holds `relation` on an entity — `team:t1#member` — which is how\n * a permission is inherited rather than granted.\n *\n * A tuple whose subject is a subject set lets a whole group be given access\n * with one write: granting a record's `viewer` to `team:t1#member` means every\n * member of that team can view it, and no member holds a tuple on the record.\n */\nexport interface SubjectSet extends Entity {\n\treadonly relation: string;\n}\n\n/**\n * Who a tuple is about: one entity, or everyone who holds a relation on one.\n * {@link isSubjectSet} tells them apart.\n */\nexport type Subject = Entity | SubjectSet;\n\n/**\n * A relation tuple: `subject` holds `relation` on `object`.\n *\n * `relation` is Zanzibar's word, and a tuple is Zanzibar's unit. What is not\n * carried over is Keto's `namespace`/`object` pair: here the object is an\n * {@link Entity}, with the `type` and `id` a user already has.\n */\nexport interface RelationTuple {\n\treadonly object: Entity;\n\treadonly relation: string;\n\treadonly subject: Subject;\n}\n\n/**\n * Whether this subject is a set rather than one entity. Narrows.\n *\n * It reads the shape, so pass a user through {@link subjectOf} first: a user\n * whose fields include a string `relation` would otherwise read as a set.\n */\nexport function isSubjectSet(subject: Subject): subject is SubjectSet {\n\treturn typeof (subject as { relation?: unknown }).relation === 'string';\n}\n\n/**\n * The subject a user is: their `type` and `id`, and nothing else.\n *\n * One line, and the entire join between the two sides of the package. It\n * takes the narrowest shape it reads, so the permissions side never has to\n * know what a user is, and it copies those two fields so none of the user's\n * own fields ever reaches a tuple.\n */\nexport function subjectOf(user: {\n\treadonly type: string;\n\treadonly id: SubjectId;\n}): Entity {\n\treturn { type: user.type, id: user.id };\n}\n\n/**\n * The mark `setOf()` puts on a set: a symbol property, so it survives a spread\n * and `Object.assign`, and no value read from a database or from JSON can\n * carry it. Registered with `Symbol.for`, so two copies of this module — two\n * bundles, two entry points — still agree on it.\n */\nconst SET_OF: unique symbol = Symbol.for('@nxgt/janus/setOf');\n\n/**\n * A subject set `setOf()` made: everyone who holds `relation` on `type:id`.\n *\n * Marked, because a user is passed to `can()` and `grant()` as it is, fields\n * flat on it: a user whose fields include `relation` must stay that user, and\n * never read as the set of whoever holds that relation on them. For an object\n * type, `{ type, id, relation }` is a set as written; for a user type — one\n * the model also declares as an object type — only `setOf()` makes one.\n *\n * A spread keeps the mark. `JSON.stringify` and `structuredClone` drop it:\n * through either, a set comes back as a user — call `setOf()` again, or\n * `parseSubject()` on its notation.\n */\nexport type SetOf<\n\tType extends string = string,\n\tRelation extends string = string,\n> = SubjectSet & {\n\treadonly type: Type;\n\treadonly relation: Relation;\n\treadonly [SET_OF]: true;\n};\n\n/**\n * A user or an object, never a set `setOf()` made: where a relation admits\n * `staff` but not `staff#managers`, a set passed there is refused at compile\n * time as it is at run time.\n */\nexport type NotASet = { readonly [SET_OF]?: never };\n\n/**\n * Everyone who holds `relation` on this user or object — `staff:s1#managers`.\n *\n * ```ts\n * await access.grant(record, 'viewers', setOf(ada, 'managers'));\n * ```\n *\n * Copies `type` and `id` only, like {@link subjectOf}: none of a user's own\n * fields reaches a tuple.\n */\nexport function setOf<const Type extends string, const Relation extends string>(\n\tentity: { readonly type: Type; readonly id: SubjectId },\n\trelation: Relation,\n): SetOf<Type, Relation> {\n\tif (\n\t\ttypeof entity !== 'object' ||\n\t\tentity === null ||\n\t\ttypeof entity.type !== 'string' ||\n\t\ttypeof entity.id !== 'string'\n\t) {\n\t\tthrow new TypeError('setOf: pass a user or { type, id }, then a relation');\n\t}\n\tif (typeof relation !== 'string' || relation === '') {\n\t\tthrow new TypeError('setOf: the relation must be a non-empty string');\n\t}\n\treturn Object.freeze({\n\t\ttype: entity.type,\n\t\tid: entity.id,\n\t\trelation,\n\t\t[SET_OF]: true as const,\n\t});\n}\n\n/**\n * Whether `setOf()` made this value, or a spread of one — what `can()` and\n * `grant()` read to tell a set on a user type from a user.\n */\nexport function isSetOf(value: unknown): value is SetOf {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t(value as { readonly [SET_OF]?: unknown })[SET_OF] === true\n\t);\n}\n",
     "import {\n\ttype Entity,\n\tisSubjectSet,\n\ttype RelationTuple,\n\ttype SetOf,\n\ttype Subject,\n\tsetOf,\n} from './subject';\n\n/**\n * Zanzibar's notation, with typed subjects:\n *\n * ```\n * record:r1#viewer@staff:u1\n * record:r1#viewer@team:t1#member\n * ```\n *\n * It exists for **messages, logs and documentation**, not as a wire format:\n * nothing in this package parses a tuple off the network, and a tuple that\n * crosses a boundary crosses it as an object. Keeping the notation is worth it\n * because every piece of Zanzibar writing uses it, so an error message in it is\n * an error message a reader has already learned to read.\n *\n * A type holds no `:`, and no part holds `@`, `#` or a parenthesis, so a\n * subject set needs no parentheses: after the `@`, a `#` can only begin its\n * relation. {@link parseTuple} refuses a string where that would not hold,\n * rather than reading it two ways.\n */\nexport function formatEntity(entity: Entity): string {\n\treturn `${entity.type}:${entity.id}`;\n}\n\n/** One subject: `staff:u1`, or `team:t1#member`. */\nexport function formatSubject(subject: Subject): string {\n\treturn isSubjectSet(subject)\n\t\t? `${formatEntity(subject)}#${subject.relation}`\n\t\t: formatEntity(subject);\n}\n\n/** One relation tuple, in the notation above. */\nexport function formatTuple(tuple: RelationTuple): string {\n\treturn `${formatEntity(tuple.object)}#${tuple.relation}@${formatSubject(tuple.subject)}`;\n}\n\nconst TYPE = '([^:@#()]+)';\nconst ID = '([^@#()]+)';\nconst RELATION = '([^:@#()]+)';\n\nconst TUPLE = new RegExp(`^${TYPE}:${ID}#${RELATION}@(.+)$`);\nconst SUBJECT = new RegExp(`^${TYPE}:${ID}(?:#${RELATION})?$`);\n\n/**\n * Reads a tuple back. Refuses, with a `TypeError`, a string that is not one —\n * a permission question built from a malformed string is a question whose\n * answer means nothing, and no request is behind it: the string came from a\n * developer's own code.\n */\nexport function parseTuple(text: string): RelationTuple {\n\tconst match = TUPLE.exec(text);\n\n\tif (!match) {\n\t\tthrow new TypeError(\n\t\t\t`parseTuple: \"${text}\" is not a relation tuple; expected type:id#relation@subject`,\n\t\t);\n\t}\n\n\tconst [, type, id, relation, subject] = match as unknown as [\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t];\n\n\treturn { object: { type, id }, relation, subject: parseSubject(subject) };\n}\n\n/**\n * Reads one subject back: `staff:u1`, or `team:t1#member`. A set is answered\n * as `setOf()` makes it, so `can()` and `grant()` read it as the set it names\n * on a user type too.\n */\nexport function parseSubject(text: string): Entity | SetOf {\n\tconst match = SUBJECT.exec(text);\n\n\tif (!match) {\n\t\tthrow new TypeError(\n\t\t\t`parseSubject: \"${text}\" is not a subject; expected type:id, or type:id#relation for a subject set`,\n\t\t);\n\t}\n\n\tconst [, type, id, relation] = match as unknown as [\n\t\tstring,\n\t\tstring,\n\t\tstring,\n\t\tstring | undefined,\n\t];\n\n\treturn relation === undefined ? { type, id } : setOf({ type, id }, relation);\n}\n"
   ],
-  "mappings": ";AAkLO,MAAM,oBAAmB,MAAM;AAAA,EAiBrC,WAAW,CAAC,SAAiB,SAA6B;AAAA,IACzD,MAAM,SAAS,EAAE,OAAO,SAAS,MAAM,CAAC;AAAA,IAjBhC,YAAO;AAAA,IACP,YAAuB;AAAA,IAiB/B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,QAAQ,SAAS;AAAA,IACtB,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,kBAAkB,SAAS;AAAA,IAChC,KAAK,gBAAgB,SAAS;AAAA,IAC9B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,WAAW,SAAS;AAAA;AAE3B;AAAA;AAUO,MAAM,sBAAqB,YAAW;AAAA;AAAA;AAAA,IACnC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AASO,MAAM,uBAAsB,YAAW;AAAA,EAK7C,WAAW,CACV,IACA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IATd,YAAO;AAAA,IAUf,KAAK,KAAK;AAAA,IACV,KAAK,OAAO,OAAO,UAAU,gBAAgB;AAAA;AAE/C;AAAA;AAGO,MAAM,uBAAsB,YAAW;AAAA;AAAA;AAAA,IACpC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA;AAAA;AAAA,IACvC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,yBAAwB,YAAW;AAAA,EAI/C,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IAXd,YAAO;AAAA,IAYf,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA;AAAA;AAAA,IACxC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,oBAAmB,YAAW;AAAA,EAI1C,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IAXd,YAAO;AAAA,IAYf,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,4BAA2B,YAAW;AAAA;AAAA;AAAA,IACzC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA;AAAA;AAAA,IACvC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,8BAA6B,YAAW;AAAA;AAAA;AAAA,IAC3C,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;;;AC7PO,SAAS,aAAY,CAAC,SAAyC;AAAA,EACrE,OAAO,OAAQ,QAAmC,aAAa;AAAA;AAWzD,SAAS,UAAS,CAAC,MAGf;AAAA,EACV,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG;AAAA;AASvC,IAAM,SAAwB,OAAO,IAAI,mBAAmB;AAyCrD,SAAS,MAA+D,CAC9E,QACA,UACwB;AAAA,EACxB,IACC,OAAO,WAAW,YAClB,WAAW,QACX,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,OAAO,UACpB;AAAA,IACD,MAAM,IAAI,UAAU,qDAAqD;AAAA,EAC1E;AAAA,EACA,IAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAAA,IACpD,MAAM,IAAI,UAAU,gDAAgD;AAAA,EACrE;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,IAAI,OAAO;AAAA,IACX;AAAA,KACC,SAAS;AAAA,EACX,CAAC;AAAA;AAOK,SAAS,QAAO,CAAC,OAAgC;AAAA,EACvD,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA0C,YAAY;AAAA;;;ACvIlD,SAAS,aAAY,CAAC,QAAwB;AAAA,EACpD,OAAO,GAAG,OAAO,QAAQ,OAAO;AAAA;AAI1B,SAAS,cAAa,CAAC,SAA0B;AAAA,EACvD,OAAO,cAAa,OAAO,IACxB,GAAG,cAAa,OAAO,KAAK,QAAQ,aACpC,cAAa,OAAO;AAAA;AAIjB,SAAS,YAAW,CAAC,OAA8B;AAAA,EACzD,OAAO,GAAG,cAAa,MAAM,MAAM,KAAK,MAAM,YAAY,eAAc,MAAM,OAAO;AAAA;AAGtF,IAAM,OAAO;AACb,IAAM,KAAK;AACX,IAAM,WAAW;AAEjB,IAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,gBAAgB;AAC3D,IAAM,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,aAAa;AAQtD,SAAS,WAAU,CAAC,MAA6B;AAAA,EACvD,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,EAE7B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,gBAAgB,kEACjB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,UAAU,WAAW;AAAA,EAQxC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,UAAU,SAAS,cAAa,OAAO,EAAE;AAAA;AAQlE,SAAS,aAAY,CAAC,MAA8B;AAAA,EAC1D,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,EAE/B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,kBAAkB,iFACnB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,YAAY;AAAA,EAO/B,OAAO,aAAa,YAAY,EAAE,MAAM,GAAG,IAAI,OAAM,EAAE,MAAM,GAAG,GAAG,QAAQ;AAAA;",
-  "debugId": "49525DE3EB2EE26A64756E2164756E21",
+  "mappings": ";AAkMO,MAAM,oBAAmB,MAAM;AAAA,EAkBrC,WAAW,CAAC,SAAiB,SAA6B;AAAA,IACzD,MAAM,SAAS,EAAE,OAAO,SAAS,MAAM,CAAC;AAAA,IAlBhC,YAAO;AAAA,IACP,YAAuB;AAAA,IAkB/B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,QAAQ,SAAS;AAAA,IACtB,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,kBAAkB,SAAS;AAAA,IAChC,KAAK,gBAAgB,SAAS;AAAA,IAC9B,KAAK,SAAS,SAAS;AAAA,IACvB,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,YAAY,SAAS;AAAA,IAC1B,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,aAAa,SAAS;AAAA,IAC3B,KAAK,WAAW,SAAS;AAAA,IACzB,KAAK,eAAe,SAAS;AAAA;AAE/B;AAAA;AAUO,MAAM,sBAAqB,YAAW;AAAA;AAAA;AAAA,IACnC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AASO,MAAM,uBAAsB,YAAW;AAAA,EAK7C,WAAW,CACV,IACA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IATd,YAAO;AAAA,IAUf,KAAK,KAAK;AAAA,IACV,KAAK,OAAO,OAAO,UAAU,gBAAgB;AAAA;AAE/C;AAAA;AAGO,MAAM,uBAAsB,YAAW;AAAA;AAAA;AAAA,IACpC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA;AAAA;AAAA,IACvC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,yBAAwB,YAAW;AAAA,EAI/C,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IAXd,YAAO;AAAA,IAYf,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA;AAAA;AAAA,IACxC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAMO,MAAM,oBAAmB,YAAW;AAAA,EAI1C,WAAW,CACV,MAQA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IAfd,YAAO;AAAA,IAgBf,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,2BAA0B,YAAW;AAAA,EAIjD,WAAW,CACV,MAIA,SACA,SACC;AAAA,IACD,MAAM,SAAS,OAAO;AAAA,IAXd,YAAO;AAAA,IAYf,KAAK,OAAO;AAAA;AAEd;AAAA;AAGO,MAAM,4BAA2B,YAAW;AAAA;AAAA;AAAA,IACzC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,0BAAyB,YAAW;AAAA;AAAA;AAAA,IACvC,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;AAAA;AAGO,MAAM,8BAA6B,YAAW;AAAA;AAAA;AAAA,IAC3C,YAAO;AAAA,IACE,YAAO;AAAA;AAC1B;;;ACxSO,SAAS,aAAY,CAAC,SAAyC;AAAA,EACrE,OAAO,OAAQ,QAAmC,aAAa;AAAA;AAWzD,SAAS,UAAS,CAAC,MAGf;AAAA,EACV,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,KAAK,GAAG;AAAA;AASvC,IAAM,SAAwB,OAAO,IAAI,mBAAmB;AAyCrD,SAAS,MAA+D,CAC9E,QACA,UACwB;AAAA,EACxB,IACC,OAAO,WAAW,YAClB,WAAW,QACX,OAAO,OAAO,SAAS,YACvB,OAAO,OAAO,OAAO,UACpB;AAAA,IACD,MAAM,IAAI,UAAU,qDAAqD;AAAA,EAC1E;AAAA,EACA,IAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAAA,IACpD,MAAM,IAAI,UAAU,gDAAgD;AAAA,EACrE;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACpB,MAAM,OAAO;AAAA,IACb,IAAI,OAAO;AAAA,IACX;AAAA,KACC,SAAS;AAAA,EACX,CAAC;AAAA;AAOK,SAAS,QAAO,CAAC,OAAgC;AAAA,EACvD,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA0C,YAAY;AAAA;;;ACvIlD,SAAS,aAAY,CAAC,QAAwB;AAAA,EACpD,OAAO,GAAG,OAAO,QAAQ,OAAO;AAAA;AAI1B,SAAS,cAAa,CAAC,SAA0B;AAAA,EACvD,OAAO,cAAa,OAAO,IACxB,GAAG,cAAa,OAAO,KAAK,QAAQ,aACpC,cAAa,OAAO;AAAA;AAIjB,SAAS,YAAW,CAAC,OAA8B;AAAA,EACzD,OAAO,GAAG,cAAa,MAAM,MAAM,KAAK,MAAM,YAAY,eAAc,MAAM,OAAO;AAAA;AAGtF,IAAM,OAAO;AACb,IAAM,KAAK;AACX,IAAM,WAAW;AAEjB,IAAM,QAAQ,IAAI,OAAO,IAAI,QAAQ,MAAM,gBAAgB;AAC3D,IAAM,UAAU,IAAI,OAAO,IAAI,QAAQ,SAAS,aAAa;AAQtD,SAAS,WAAU,CAAC,MAA6B;AAAA,EACvD,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,EAE7B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,gBAAgB,kEACjB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,UAAU,WAAW;AAAA,EAQxC,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,UAAU,SAAS,cAAa,OAAO,EAAE;AAAA;AAQlE,SAAS,aAAY,CAAC,MAA8B;AAAA,EAC1D,MAAM,QAAQ,QAAQ,KAAK,IAAI;AAAA,EAE/B,IAAI,CAAC,OAAO;AAAA,IACX,MAAM,IAAI,UACT,kBAAkB,iFACnB;AAAA,EACD;AAAA,EAEA,SAAS,MAAM,IAAI,YAAY;AAAA,EAO/B,OAAO,aAAa,YAAY,EAAE,MAAM,GAAG,IAAI,OAAM,EAAE,MAAM,GAAG,GAAG,QAAQ;AAAA;",
+  "debugId": "350D8B960021CE8764756E2164756E21",
   "names": []
 }

package/dist/chunks/{index-53y1afjz.js → index-5vr13kkb.js}

@@ -2,7 +2,7 @@ import {
   JanusError2,
   StoreFailure2,
   InvalidCursorError2
-} from "./index-qwfkhqkk.js";
+} from "./index-06vp9c5r.js";
 
 // src/pagination/cursor-page.ts
 var DEFAULT_PAGE_SIZE2 = 20;
@@ -68,4 +68,4 @@ function guardRelations(store) {
 export { guardStore, guardRelations, DEFAULT_PAGE_SIZE2, MAX_PAGE_SIZE2, pageLimit2, invalidCursor2 };
 
 //# debugId=78C1EC4522BC50BD64756E2164756E21
-//# sourceMappingURL=index-53y1afjz.js.map
+//# sourceMappingURL=index-5vr13kkb.js.map

package/dist/chunks/{index-mgh85djb.js → index-c4v27jfr.js}

@@ -1,7 +1,7 @@
 import {
   isSubjectSet2,
   formatTuple2
-} from "./index-qwfkhqkk.js";
+} from "./index-06vp9c5r.js";
 
 // src/permissions/port/memory.ts
 function createMemoryRelations2() {
@@ -74,4 +74,4 @@ function copyTuple(tuple) {
 export { createMemoryRelations2 };
 
 //# debugId=9168B1A5A9C0688D64756E2164756E21
-//# sourceMappingURL=index-mgh85djb.js.map
+//# sourceMappingURL=index-c4v27jfr.js.map

package/dist/chunks/{index-8tksqzkr.js → index-gbwn2tts.js}

@@ -1,7 +1,7 @@
 import {
   StoreConflict2,
   NotFoundError2
-} from "./index-qwfkhqkk.js";
+} from "./index-06vp9c5r.js";
 
 // src/ids/id.ts
 var HEX = Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
@@ -155,6 +155,7 @@ function applyPatch(stored, patch) {
     fields: patch.fields ?? stored.fields,
     logins: patch.logins ?? stored.logins,
     password: patch.password === undefined ? stored.password : patch.password,
+    secondFactor: patch.secondFactor === undefined ? stored.secondFactor : patch.secondFactor,
     emailVerifiedAt: patch.emailVerifiedAt === undefined ? stored.emailVerifiedAt : patch.emailVerifiedAt,
     version: stored.version + 1,
     updatedAt: patch.updatedAt
@@ -250,6 +251,16 @@ function memoryTokenStore() {
       }
       return before;
     },
+    async countAttempt(tokenHash, kind) {
+      const stored = byTokenHash.get(tokenHash);
+      if (stored === undefined || stored.kind !== kind)
+        return null;
+      if (stored.spentAt !== null)
+        return copy(stored);
+      const counted = { ...stored, attempts: stored.attempts + 1 };
+      byTokenHash.set(tokenHash, counted);
+      return copy(counted);
+    },
     async deleteUserTokens(userId) {
       let deleted = 0;
       for (const [tokenHash, stored] of byTokenHash) {
@@ -265,5 +276,5 @@ function memoryTokenStore() {
 
 export { mintId2, isId2, mintedAt2, createMemoryStores2 };
 
-//# debugId=609E38330FBCD6ED64756E2164756E21
-//# sourceMappingURL=index-8tksqzkr.js.map
+//# debugId=A6E6F8D3147D2C5864756E2164756E21
+//# sourceMappingURL=index-gbwn2tts.js.map