@spinajs/authn-orm 0.0.0-stage → 3.0.1

package/lib/cjs/mfa/db-mfa-store.d.ts

@@ -0,0 +1,51 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+/** One MFA step of an identity as stored. */
+export interface MfaRecord {
+    /** Cipher text exactly as `putPending` was given it; this store never encrypts or decrypts. */
+    readonly secretEnc: string;
+    readonly keyId: string;
+    readonly confirmedAt: Date | null;
+    /** The last accepted time step. */
+    readonly lastStep: number | null;
+    readonly createdAt: Date;
+}
+/**
+ * `authn_mfa` and `authn_recovery_code` for MFA steps (authn-totp, N5). Rows are keyed by `identityKey(id)` and
+ * the step name. The store keeps cipher text and its key id only (SR-09); recovery codes are stored as hex SHA-256,
+ * never raw, and callers normalise a code before passing it. Replay and single use are decided in SQL (SR-15, D10).
+ *
+ * Without transactions (the sqlite driver shares one handle) `replaceRecoveryCodes` deletes and then inserts: two
+ * parallel calls for one identity may leave both sets.
+ */
+export declare class DbMfaStore {
+    get(id: IdentityRef, step: string): Promise<MfaRecord | null>;
+    /**
+     * Stores the step unconfirmed, with no accepted time step and created now, replacing a pending one. A confirmed
+     * step is never overwritten: false means a confirmed row exists and nothing changed. The
+     * replacing update is conditional on `confirmed_at IS NULL`, so a confirmation that lands first always wins.
+     */
+    putPending(id: IdentityRef, step: string, secretEnc: string, keyId: string): Promise<boolean>;
+    /**
+     * Sets `confirmed_at` (default now); true when the step exists. With `expectedSecretEnc`, only an unconfirmed step
+     * holding that cipher text is confirmed, so the answer is true for exactly the call that confirmed it.
+     */
+    confirm(id: IdentityRef, step: string, at?: Date, expectedSecretEnc?: string): Promise<boolean>;
+    /** True once per time step, and never for a step at or below the last accepted one (SR-15); false when the step does not exist. */
+    acceptStep(id: IdentityRef, step: string, timeStep: number): Promise<boolean>;
+    remove(id: IdentityRef, step: string): Promise<void>;
+    /** The names of the identity's confirmed steps. */
+    confirmedSteps(id: IdentityRef): Promise<string[]>;
+    /**
+     * Each step name with a confirmed row of any identity, once. Deduplicated here, not with DISTINCT, which folds
+     * `totp` and `TOTP` into one under a case-blind collation (MySQL's default); one row per confirmed enrolment.
+     */
+    confirmedStepNames(): Promise<string[]>;
+    /** Deletes the identity's codes, then stores the SHA-256 of each new one. Empty or repeated codes throw. */
+    replaceRecoveryCodes(id: IdentityRef, rawCodes: readonly string[]): Promise<void>;
+    /** Spends the code in one conditional update; true for exactly one caller. */
+    redeemRecoveryCode(id: IdentityRef, raw: string): Promise<boolean>;
+    /** Unused codes. */
+    countRecoveryCodes(id: IdentityRef): Promise<number>;
+    removeRecoveryCodes(id: IdentityRef): Promise<void>;
+}
+//# sourceMappingURL=db-mfa-store.d.ts.map

package/lib/cjs/mfa/db-mfa-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-store.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAmB5D,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAkBD;;;;;;;GAOG;AACH,qBAEa,UAAU;IACR,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAczE;IAED;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBzG;IAED;;;OAGG;IACU,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAavH;IAED,mIAAmI;IACtH,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUzF;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAED,mDAAmD;IACtC,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAK9D;IAED;;;OAGG;IACU,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAInD;IAED,4GAA4G;IAC/F,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7F;IAED,8EAA8E;IACjE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9E;IAED,oBAAoB;IACP,kBAAkB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE;IAEY,mBAAmB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;CACF"}

package/lib/cjs/mfa/db-mfa-store.js

@@ -0,0 +1,190 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbMfaStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const di_1 = require("@spinajs/di");
+const exceptions_1 = require("@spinajs/exceptions");
+const orm_1 = require("@spinajs/orm");
+const util_1 = require("@spinajs/util");
+const identity_js_1 = require("../identity.js");
+const AuthnMfa_js_1 = require("../models/AuthnMfa.js");
+const AuthnRecoveryCode_js_1 = require("../models/AuthnRecoveryCode.js");
+const sql_js_1 = require("../support/sql.js");
+const values_js_1 = require("../support/values.js");
+/** Each retry means a parallel `remove` deleted the row between this call's insert and update. */
+const MAX_TRIES = 8;
+/** As DbSecretStore: longer input is refused before hashing. */
+const RAW_MAX = 1024;
+const stepName = (step) => (0, sql_js_1.checkedText)(step, 32, 'DbMfaStore: step');
+function lastStepOf(value) {
+    if (value === null || value === undefined)
+        return null;
+    const n = typeof value === 'number' ? value : Number(String(value));
+    if (!Number.isSafeInteger(n))
+        throw new exceptions_1.UnexpectedServerError(`DbMfaStore: last_step ${String(value)} is not a safe integer`);
+    return n;
+}
+const confirmed = (r) => r.confirmed_at !== null && r.confirmed_at !== undefined;
+/** The columns `putPending` writes: unconfirmed, no accepted time step. */
+function pending(secretEnc, keyId, createdAt) {
+    return (0, values_js_1.columnValues)({ secret_enc: secretEnc, secret_hash: (0, sql_js_1.sha256hex)(secretEnc), key_id: keyId, confirmed_at: null, last_step: null, created_at: createdAt });
+}
+/**
+ * `authn_mfa` and `authn_recovery_code` for MFA steps (authn-totp, N5). Rows are keyed by `identityKey(id)` and
+ * the step name. The store keeps cipher text and its key id only (SR-09); recovery codes are stored as hex SHA-256,
+ * never raw, and callers normalise a code before passing it. Replay and single use are decided in SQL (SR-15, D10).
+ *
+ * Without transactions (the sqlite driver shares one handle) `replaceRecoveryCodes` deletes and then inserts: two
+ * parallel calls for one identity may leave both sets.
+ */
+let DbMfaStore = class DbMfaStore {
+    async get(id, step) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        const name = stepName(step);
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnMfa_js_1.AuthnMfa.query().columns(['identity', 'step', 'secret_enc', 'key_id', 'last_step', 'confirmed_at', 'created_at']).where('identity', identity).where('step', name);
+        const r = rows.find((x) => x.identity === identity && x.step === name);
+        if (!r)
+            return null;
+        return {
+            secretEnc: r.secret_enc,
+            keyId: r.key_id,
+            confirmedAt: r.confirmed_at ? (0, sql_js_1.dateOf)(r.confirmed_at) : null,
+            lastStep: lastStepOf(r.last_step),
+            createdAt: (0, sql_js_1.dateOf)(r.created_at),
+        };
+    }
+    /**
+     * Stores the step unconfirmed, with no accepted time step and created now, replacing a pending one. A confirmed
+     * step is never overwritten: false means a confirmed row exists and nothing changed. The
+     * replacing update is conditional on `confirmed_at IS NULL`, so a confirmation that lands first always wins.
+     */
+    async putPending(id, step, secretEnc, keyId) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        const name = stepName(step);
+        (0, sql_js_1.checkedText)(secretEnc, Number.MAX_SAFE_INTEGER, 'DbMfaStore: secretEnc');
+        (0, sql_js_1.checkedText)(keyId, 32, 'DbMfaStore: keyId');
+        const ms = (0, sql_js_1.checkedMs)(new Date(), 'DbMfaStore.putPending: the clock');
+        await (0, orm_1.ormReady)();
+        const fields = pending(secretEnc, keyId, (0, sql_js_1.instant)(ms));
+        for (let i = 0; i < MAX_TRIES; i++) {
+            try {
+                await AuthnMfa_js_1.AuthnMfa.insert({ identity, step: name, ...fields });
+                return true;
+            }
+            catch (err) {
+                if (!(err instanceof orm_1.UniqueViolation))
+                    throw err;
+            }
+            if ((await AuthnMfa_js_1.AuthnMfa.update(fields).where('identity', identity).where('step', name).whereNull('confirmed_at')).RowsAffected === 1)
+                return true;
+            // No row updated: either it is confirmed, or a parallel remove deleted it and the insert is worth retrying.
+            if ((await this.get(id, name))?.confirmedAt)
+                return false;
+        }
+        throw new exceptions_1.UnexpectedServerError(`DbMfaStore.putPending: the ${name} row kept changing under this call`);
+    }
+    /**
+     * Sets `confirmed_at` (default now); true when the step exists. With `expectedSecretEnc`, only an unconfirmed step
+     * holding that cipher text is confirmed, so the answer is true for exactly the call that confirmed it.
+     */
+    async confirm(id, step, at = new Date(), expectedSecretEnc) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        const name = stepName(step);
+        const ms = (0, sql_js_1.checkedMs)(at, 'DbMfaStore.confirm: at');
+        if (expectedSecretEnc !== undefined)
+            (0, sql_js_1.checkedText)(expectedSecretEnc, Number.MAX_SAFE_INTEGER, 'DbMfaStore: expectedSecretEnc');
+        await (0, orm_1.ormReady)();
+        const q = AuthnMfa_js_1.AuthnMfa.update({ confirmed_at: (0, sql_js_1.instant)(ms) })
+            .where('identity', identity)
+            .where('step', name);
+        if (expectedSecretEnc !== undefined) {
+            q.whereNull('confirmed_at').where('secret_hash', (0, sql_js_1.sha256hex)(expectedSecretEnc));
+        }
+        return (await q).RowsAffected === 1;
+    }
+    /** True once per time step, and never for a step at or below the last accepted one (SR-15); false when the step does not exist. */
+    async acceptStep(id, step, timeStep) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        const name = stepName(step);
+        (0, util_1._check_arg)((0, util_1._is_number)((0, util_1._integer)(), (0, util_1._between)(0, Number.MAX_SAFE_INTEGER)))(timeStep, 'timeStep');
+        await (0, orm_1.ormReady)();
+        const older = function () {
+            this.whereNull('last_step');
+            this.orWhere('last_step', '<', timeStep);
+        };
+        return (await AuthnMfa_js_1.AuthnMfa.update({ last_step: timeStep }).where('identity', identity).where('step', name).where(older)).RowsAffected === 1;
+    }
+    async remove(id, step) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        const name = stepName(step);
+        await (0, orm_1.ormReady)();
+        await AuthnMfa_js_1.AuthnMfa.destroy().where('identity', identity).where('step', name);
+    }
+    /** The names of the identity's confirmed steps. */
+    async confirmedSteps(id) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnMfa_js_1.AuthnMfa.query().columns(['identity', 'step', 'confirmed_at']).where('identity', identity).whereNotNull('confirmed_at');
+        return rows.filter((r) => r.identity === identity && confirmed(r)).map((r) => r.step);
+    }
+    /**
+     * Each step name with a confirmed row of any identity, once. Deduplicated here, not with DISTINCT, which folds
+     * `totp` and `TOTP` into one under a case-blind collation (MySQL's default); one row per confirmed enrolment.
+     */
+    async confirmedStepNames() {
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnMfa_js_1.AuthnMfa.query().columns(['step', 'confirmed_at']).whereNotNull('confirmed_at');
+        return [...new Set(rows.filter(confirmed).map((r) => r.step))];
+    }
+    /** Deletes the identity's codes, then stores the SHA-256 of each new one. Empty or repeated codes throw. */
+    async replaceRecoveryCodes(id, rawCodes) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        (0, util_1._check_arg)((0, util_1._is_array)())(rawCodes, 'rawCodes');
+        const hashes = rawCodes.map((code) => (0, sql_js_1.sha256hex)((0, sql_js_1.checkedText)(code, Number.MAX_SAFE_INTEGER, 'DbMfaStore: a recovery code')));
+        if (new Set(hashes).size !== hashes.length)
+            throw new exceptions_1.InvalidArgument('DbMfaStore.replaceRecoveryCodes: the codes repeat');
+        await (0, orm_1.ormReady)();
+        await AuthnRecoveryCode_js_1.AuthnRecoveryCode.destroy().where('identity', identity);
+        if (hashes.length === 0)
+            return;
+        await AuthnRecoveryCode_js_1.AuthnRecoveryCode.insert(hashes.map((code_hash) => (0, values_js_1.columnValues)({ id: (0, node_crypto_1.randomUUID)(), identity, code_hash, used_at: null })));
+    }
+    /** Spends the code in one conditional update; true for exactly one caller. */
+    async redeemRecoveryCode(id, raw) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        if (!(0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._non_empty)(), (0, util_1._max_length)(RAW_MAX)))(raw, 'raw')[0])
+            return false;
+        const ms = (0, sql_js_1.checkedMs)(new Date(), 'DbMfaStore.redeemRecoveryCode: the clock');
+        await (0, orm_1.ormReady)();
+        const r = await AuthnRecoveryCode_js_1.AuthnRecoveryCode.update({ used_at: (0, sql_js_1.instant)(ms) })
+            .where('identity', identity)
+            .where('code_hash', (0, sql_js_1.sha256hex)(raw))
+            .whereNull('used_at');
+        return r.RowsAffected > 0;
+    }
+    /** Unused codes. */
+    async countRecoveryCodes(id) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        await (0, orm_1.ormReady)();
+        const rows = await AuthnRecoveryCode_js_1.AuthnRecoveryCode.query().columns(['identity']).where('identity', identity).whereNull('used_at');
+        return rows.filter((r) => r.identity === identity).length;
+    }
+    async removeRecoveryCodes(id) {
+        const identity = (0, identity_js_1.identityKey)(id);
+        await (0, orm_1.ormReady)();
+        await AuthnRecoveryCode_js_1.AuthnRecoveryCode.destroy().where('identity', identity);
+    }
+};
+exports.DbMfaStore = DbMfaStore;
+exports.DbMfaStore = DbMfaStore = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)()
+], DbMfaStore);
+//# sourceMappingURL=db-mfa-store.js.map

package/lib/cjs/mfa/db-mfa-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-store.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAyC;AAGzC,oCAA2D;AAC3D,oDAA6E;AAC7E,sCAAyD;AACzD,wCAA2I;AAI3I,gDAA6C;AAC7C,uDAAiD;AACjD,yEAAmE;AACnE,8CAAuF;AACvF,oDAAoD;AAEpD,kGAAkG;AAClG,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,gEAAgE;AAChE,MAAM,OAAO,GAAG,IAAI,CAAC;AAarB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAA,oBAAW,EAAC,IAAI,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;AAErF,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,kCAAqB,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAW,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC;AAEpG,2EAA2E;AAC3E,SAAS,OAAO,CAAC,SAAiB,EAAE,KAAa,EAAE,SAAmB;IACpE,OAAO,IAAA,wBAAY,EAAW,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,IAAA,kBAAS,EAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AACzK,CAAC;AAED;;;;;;;GAOG;AAGI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACd,KAAK,CAAC,GAAG,CAAC,EAAe,EAAE,IAAY;QAC5C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,sBAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrL,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,UAAU;YACvB,KAAK,EAAE,CAAC,CAAC,MAAM;YACf,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,eAAM,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3D,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,SAAS,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,UAAU,CAAC;SAChC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,UAAU,CAAC,EAAe,EAAE,IAAY,EAAE,SAAiB,EAAE,KAAa;QACrF,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAA,oBAAW,EAAC,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;QACzE,IAAA,oBAAW,EAAC,KAAK,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACrE,MAAM,IAAA,cAAQ,GAAE,CAAC;QAEjB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,CAAC,CAAC;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,sBAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,qBAAe,CAAC;oBAAE,MAAM,GAAG,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,MAAM,sBAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,4GAA4G;YAC5G,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW;gBAAE,OAAO,KAAK,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,kCAAqB,CAAC,8BAA8B,IAAI,oCAAoC,CAAC,CAAC;IAC1G,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO,CAAC,EAAe,EAAE,IAAY,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE,EAAE,iBAA0B;QACnG,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACnD,IAAI,iBAAiB,KAAK,SAAS;YAAE,IAAA,oBAAW,EAAC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QAC9H,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,sBAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,EAAE,CAAC;aACrD,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC3B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,IAAA,kBAAS,EAAC,iBAAiB,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,mIAAmI;IAC5H,KAAK,CAAC,UAAU,CAAC,EAAe,EAAE,IAAY,EAAE,QAAgB;QACrE,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,GAAE,EAAE,IAAA,eAAQ,EAAC,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/F,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,sBAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IAC1I,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAe,EAAE,IAAY;QAC/C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,sBAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,cAAc,CAAC,EAAe;QACzC,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,sBAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAC3I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB;QAC7B,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,sBAAQ,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,4GAA4G;IACrG,KAAK,CAAC,oBAAoB,CAAC,EAAe,EAAE,QAA2B;QAC5E,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,IAAA,iBAAU,EAAC,IAAA,gBAAS,GAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,kBAAS,EAAC,IAAA,oBAAW,EAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC,CAAC;QAC5H,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,4BAAe,CAAC,mDAAmD,CAAC,CAAC;QAC3H,MAAM,IAAA,cAAQ,GAAE,CAAC;QAEjB,MAAM,wCAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,wCAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,wBAAY,EAAoB,EAAE,EAAE,EAAE,IAAA,wBAAU,GAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvJ,CAAC;IAED,8EAA8E;IACvE,KAAK,CAAC,kBAAkB,CAAC,EAAe,EAAE,GAAW;QAC1D,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC7E,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,wCAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,EAAE,CAAC;aAC/D,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC3B,KAAK,CAAC,WAAW,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC;aAClC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,oBAAoB;IACb,KAAK,CAAC,kBAAkB,CAAC,EAAe;QAC7C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,wCAAiB,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,EAAe;QAC9C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QACjC,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,wCAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;;qBA7IY,UAAU;IAFtB,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,GAAE;GACA,UAAU,CA6ItB"}

package/lib/cjs/mfa/index.d.ts

@@ -0,0 +1,4 @@
+export * from './db-mfa-store.js';
+export * from './db-mfa-enrolments.js';
+export * from './cipher.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/mfa/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC"}

package/lib/cjs/mfa/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./db-mfa-store.js"), exports);
+__exportStar(require("./db-mfa-enrolments.js"), exports);
+__exportStar(require("./cipher.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/mfa/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,yDAAuC;AACvC,8CAA4B"}

package/lib/cjs/migrations/AuthnInitial_2026_10_02_00_00_00.d.ts

@@ -0,0 +1,10 @@
+import { OrmDriver, OrmMigration } from '@spinajs/orm';
+/**
+ * The authn-orm tables of design §22.16, plus `authn_recovery_code_owner`. The schema builder has no `char`
+ * type, so the `char(64)` hash columns are `varchar(64)`.
+ */
+export declare class AuthnInitial_2026_10_02_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=AuthnInitial_2026_10_02_00_00_00.d.ts.map

package/lib/cjs/migrations/AuthnInitial_2026_10_02_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnInitial_2026_10_02_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/AuthnInitial_2026_10_02_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIlE;;;GAGG;AACH,qBACa,gCAAiC,SAAQ,YAAY;IACnD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAItD;CACF"}

package/lib/cjs/migrations/AuthnInitial_2026_10_02_00_00_00.js

@@ -0,0 +1,98 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnInitial_2026_10_02_00_00_00 = void 0;
+const orm_1 = require("@spinajs/orm");
+const TABLES = ['authn_identity', 'authn_throttle', 'authn_audit', 'authn_secret', 'authn_mfa', 'authn_recovery_code', 'authn_nonce'];
+/**
+ * The authn-orm tables of design §22.16, plus `authn_recovery_code_owner`. The schema builder has no `char`
+ * type, so the `char(64)` hash columns are `varchar(64)`.
+ */
+let AuthnInitial_2026_10_02_00_00_00 = class AuthnInitial_2026_10_02_00_00_00 extends orm_1.OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('authn_identity', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity_type', 16).notNull();
+            table.string('identity_id', 64).notNull();
+            table.string('provider', 128).notNull();
+            table.string('subject', 255).notNull();
+            table.string('email', 255);
+            table.boolean('email_verified').notNull().default().value(0);
+            table.text('attributes');
+            table.dateTime('linked_at').notNull();
+            table.dateTime('last_used_at');
+        });
+        await connection.index().unique().table('authn_identity').name('authn_identity_subject').columns(['provider', 'subject']);
+        await connection.index().table('authn_identity').name('authn_identity_owner').columns(['identity_type', 'identity_id']);
+        await connection.schema().createTable('authn_throttle', (table) => {
+            table.string('k', 255).notNull().primaryKey();
+            table.int('attempts').notNull();
+            table.dateTime('last_attempt_at').notNull();
+            table.dateTime('next_allowed_at').notNull();
+            table.dateTime('updated_at').notNull();
+        });
+        await connection.schema().createTable('authn_audit', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.dateTime('at').notNull();
+            table.string('type', 32).notNull();
+            table.string('outcome', 8).notNull();
+            table.string('identity', 100);
+            table.string('actor', 100);
+            table.string('strategy', 64);
+            table.string('reason', 64);
+            table.string('ip', 64);
+            table.string('user_agent', 255);
+            table.string('session', 64);
+            table.text('data');
+        });
+        await connection.index().table('authn_audit').name('authn_audit_at').columns(['at']);
+        await connection.index().table('authn_audit').name('authn_audit_identity').columns(['identity', 'at']);
+        await connection.schema().createTable('authn_secret', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity', 100).notNull();
+            table.string('purpose', 32).notNull();
+            table.string('secret_hash', 64).notNull();
+            table.dateTime('expires_at').notNull();
+            table.dateTime('used_at');
+            table.dateTime('created_at').notNull();
+        });
+        await connection.index().unique().table('authn_secret').name('authn_secret_hash').columns(['secret_hash']);
+        await connection.index().table('authn_secret').name('authn_secret_owner').columns(['identity', 'purpose']);
+        await connection.schema().createTable('authn_mfa', (table) => {
+            table.string('identity', 100).notNull().primaryKey();
+            table.string('step', 32).notNull().primaryKey();
+            table.text('secret_enc').notNull();
+            table.string('secret_hash', 64).notNull();
+            table.string('key_id', 32).notNull();
+            table.dateTime('confirmed_at');
+            table.bigint('last_step');
+            table.dateTime('created_at').notNull();
+        });
+        await connection.schema().createTable('authn_recovery_code', (table) => {
+            table.string('id', 36).notNull().primaryKey();
+            table.string('identity', 100).notNull();
+            table.string('code_hash', 64).notNull();
+            table.dateTime('used_at');
+        });
+        await connection.index().table('authn_recovery_code').name('authn_recovery_code_owner').columns(['identity']);
+        await connection.schema().createTable('authn_nonce', (table) => {
+            table.string('k', 160).notNull().primaryKey();
+            table.dateTime('expires_at').notNull();
+        });
+    }
+    async down(connection) {
+        for (const table of [...TABLES].reverse()) {
+            await connection.schema().dropTable(table);
+        }
+    }
+};
+exports.AuthnInitial_2026_10_02_00_00_00 = AuthnInitial_2026_10_02_00_00_00;
+exports.AuthnInitial_2026_10_02_00_00_00 = AuthnInitial_2026_10_02_00_00_00 = __decorate([
+    (0, orm_1.Migration)('default')
+], AuthnInitial_2026_10_02_00_00_00);
+//# sourceMappingURL=AuthnInitial_2026_10_02_00_00_00.js.map

package/lib/cjs/migrations/AuthnInitial_2026_10_02_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnInitial_2026_10_02_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/AuthnInitial_2026_10_02_00_00_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sCAAkE;AAElE,MAAM,MAAM,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,CAAC,CAAC;AAEtI;;;GAGG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,kBAAY;IACzD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1H,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;QAExH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAChE,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAChC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACvB,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAEvG,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;YAC9D,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3G,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAE3G,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3D,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YACrD,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAChD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,EAAE;YACrE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAE9G,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE;YAC7D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,CAAC;YAC9C,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1C,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF,CAAA;;2CApFY,gCAAgC;IAD5C,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,gCAAgC,CAoF5C"}

package/lib/cjs/migrations/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthnInitial_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC"}

package/lib/cjs/migrations/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AuthnInitial_2026_10_02_00_00_00.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wEAAsD"}

package/lib/cjs/models/AuthnAudit.d.ts

@@ -0,0 +1,18 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnAudit extends ModelBase<AuthnAudit> {
+    id: string;
+    at: DateTime;
+    type: string;
+    outcome: string;
+    identity?: string | null;
+    actor?: string | null;
+    strategy?: string | null;
+    reason?: string | null;
+    ip?: string | null;
+    user_agent?: string | null;
+    session?: string | null;
+    /** JSON text. */
+    data?: string | null;
+}
+//# sourceMappingURL=AuthnAudit.d.ts.map

package/lib/cjs/models/AuthnAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnAudit.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,EAAE,EAAE,MAAM,CAAC;IAGX,EAAE,EAAE,QAAQ,CAAC;IAEb,IAAI,EAAE,MAAM,CAAC;IAEb,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,iBAAiB;IACV,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B"}

package/lib/cjs/models/AuthnAudit.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnAudit = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+let AuthnAudit = class AuthnAudit extends orm_1.ModelBase {
+};
+exports.AuthnAudit = AuthnAudit;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnAudit.prototype, "id", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnAudit.prototype, "at", void 0);
+exports.AuthnAudit = AuthnAudit = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_audit')
+], AuthnAudit);
+//# sourceMappingURL=AuthnAudit.js.map

package/lib/cjs/models/AuthnAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnAudit.js","sourceRoot":"","sources":["../../../src/models/AuthnAudit.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAI1B,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAqB;CA2BpD,CAAA;;AAzBQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;sCACjB;AAGX;IADN,IAAA,cAAE,GAAE;8BACM,gBAAQ;sCAAC;qBALT,UAAU;IAFtB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,aAAa,CAAC;GACR,UAAU,CA2BtB"}

package/lib/cjs/models/AuthnIdentity.d.ts

@@ -0,0 +1,16 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A link from an external subject to an identity (design §22.16). */
+export declare class AuthnIdentity extends ModelBase<AuthnIdentity> {
+    id: string;
+    identity_type: string;
+    identity_id: string;
+    provider: string;
+    subject: string;
+    email?: string | null;
+    email_verified: boolean;
+    attributes?: string | null;
+    linked_at: DateTime;
+    last_used_at?: DateTime;
+}
+//# sourceMappingURL=AuthnIdentity.d.ts.map

package/lib/cjs/models/AuthnIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnIdentity.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,SAAS,EAAW,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,sEAAsE;AACtE,qBAEa,aAAc,SAAQ,SAAS,CAAC,aAAa,CAAC;IAElD,EAAE,EAAE,MAAM,CAAC;IAEX,aAAa,EAAE,MAAM,CAAC;IAEtB,WAAW,EAAE,MAAM,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGtB,cAAc,EAAE,OAAO,CAAC;IAExB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,SAAS,EAAE,QAAQ,CAAC;IAIpB,YAAY,CAAC,EAAE,QAAQ,CAAC;CAChC"}

package/lib/cjs/models/AuthnIdentity.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnIdentity = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+/** A link from an external subject to an identity (design §22.16). */
+let AuthnIdentity = class AuthnIdentity extends orm_1.ModelBase {
+};
+exports.AuthnIdentity = AuthnIdentity;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnIdentity.prototype, "id", void 0);
+__decorate([
+    (0, orm_1.Bool)(),
+    __metadata("design:type", Boolean)
+], AuthnIdentity.prototype, "email_verified", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnIdentity.prototype, "linked_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnIdentity.prototype, "last_used_at", void 0);
+exports.AuthnIdentity = AuthnIdentity = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_identity')
+], AuthnIdentity);
+//# sourceMappingURL=AuthnIdentity.js.map

package/lib/cjs/models/AuthnIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnIdentity.js","sourceRoot":"","sources":["../../../src/models/AuthnIdentity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA2F;AAC3F,iCAAiC;AAEjC,sEAAsE;AAG/D,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,eAAwB;CAyB1D,CAAA;;AAvBQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;yCACjB;AAaX;IADN,IAAA,UAAI,GAAE;;qDACwB;AAKxB;IADN,IAAA,cAAE,GAAE;8BACa,gBAAQ;gDAAC;AAIpB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;mDAAC;wBAxBpB,aAAa;IAFzB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,gBAAgB,CAAC;GACX,aAAa,CAyBzB"}

package/lib/cjs/models/AuthnMfa.d.ts

@@ -0,0 +1,16 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** One MFA step of an identity; the primary key is (identity, step). */
+export declare class AuthnMfa extends ModelBase<AuthnMfa> {
+    identity: string;
+    step: string;
+    secret_enc: string;
+    /** Hex SHA-256 of `secret_enc`: `confirm` compares this, since TEXT is not comparable on MSSQL and case-blind on MySQL. */
+    secret_hash: string;
+    key_id: string;
+    confirmed_at?: DateTime;
+    /** Postgres returns bigint as a string. */
+    last_step?: number | string | null;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnMfa.d.ts.map

package/lib/cjs/models/AuthnMfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnMfa.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnMfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,wEAAwE;AACxE,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAExC,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAE,MAAM,CAAC;IAEb,UAAU,EAAE,MAAM,CAAC;IAE1B,2HAA2H;IACpH,WAAW,EAAE,MAAM,CAAC;IAEpB,MAAM,EAAE,MAAM,CAAC;IAIf,YAAY,CAAC,EAAE,QAAQ,CAAC;IAE/B,2CAA2C;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAGnC,UAAU,EAAE,QAAQ,CAAC;CAC7B"}