@ultimabase/password 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,13 @@
+# @ultimabase/password
+
+## 0.1.0
+
+### Minor Changes
+
+- 0e885c4: The first release: the kernel, its adapters, transports and plugins, the testing helpers and the starter.
+
+### Patch Changes
+
+- Updated dependencies [0e885c4]
+  - @ultimabase/auth@0.1.0
+  - ultimabase@0.1.0

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @ultimabase/password
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A sign-in method for `@ultimabase/auth`: a user signs up and signs in with an email and a password, hashed with Argon2id.
+
+Documentation: [Password](https://ultimabase.dev/docs/password).

package/dist/core.d.ts

@@ -0,0 +1,57 @@
+import type { AuthApi } from '@ultimabase/auth';
+import type { Client, ExposedModel, Logger, Row } from 'ultimabase';
+import type { Attempt } from './models.ts';
+/** The method `AuthAccount` links a password's email with (D-113). */
+export declare const method = "password";
+/** What each running application's password reads, by auth's API. */
+export interface State {
+    readonly auth: AuthApi;
+    readonly users: ExposedModel;
+    /** The fields a sign-up other than Master's takes, `false` when closed. */
+    readonly signUp: ReadonlySet<string> | false;
+    readonly logger: Logger;
+    /** The sends under way, which stopping waits for (D-117). */
+    readonly sending: Set<Promise<void>>;
+}
+/** What a sign-in returns: its session, and the user read as itself. */
+export interface SignedIn<U = Row> {
+    /**
+     * The session's token, there even when the cookie carries it: a mobile
+     * client needs it, and a function cannot tell one client from another
+     * (D-115).
+     */
+    readonly token: string;
+    readonly expiresAt: Date;
+    readonly user: U | null;
+}
+/** The attempt a client makes for `subject`; server code is not counted. */
+export declare const attemptOf: (subject: string, client: Client | undefined) => Attempt;
+/**
+ * Creates the user, its account and its hash in one transaction, as Master:
+ * the caller's fields were checked against the list (D-113).
+ */
+export declare function createUser(state: State, email: string, password: string, data: object): Promise<{
+    readonly user: Row;
+    readonly stamp: string;
+}>;
+/** A user whose password checked, and the stamp it checked against. */
+export interface Verified {
+    readonly userId: string;
+    readonly stamp: string;
+}
+/** The user `email` and `password` sign in as, counting the attempt. */
+export declare function verified(state: State, email: string, password: string, attempt: Attempt): Promise<Verified>;
+/** Checks `userId`'s current password, counting the attempt. */
+export declare function checkCurrent(userId: string, password: string, attempt: Attempt): Promise<void>;
+/**
+ * Replaces `userId`'s hash, ends every session of the user and deletes its
+ * pending reset tokens (D-117); the new stamp.
+ */
+export declare function setPassword(state: State, userId: string, password: string): Promise<string>;
+/**
+ * Opens a session for the user, with its cookie when a client is given. The
+ * stamp is read after: a password set since the check ends the user's
+ * sessions and fails, an older read means `setPassword` ends this one (D-113).
+ */
+export declare function signedIn(state: State, { userId, stamp }: Verified, client: Client | undefined): Promise<SignedIn>;
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,EACX,MAAM,EAEN,YAAY,EACZ,MAAM,EAEN,GAAG,EAEH,MAAM,YAAY,CAAA;AAInB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAK1C,sEAAsE;AACtE,eAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,qEAAqE;AACrE,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,GAAG;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;CACvB;AAKD,4EAA4E;AAC5E,eAAO,MAAM,SAAS,YACZ,MAAM,UACP,MAAM,GAAG,SAAS,KACxB,OACqE,CAAA;AAExE;;;GAGG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASzD;AAyCD,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAChC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAaD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,QAAQ,CAAC,CAQnB"}

package/dist/core.js

@@ -0,0 +1,124 @@
+// What the functions and the commands share (D-113): signing a user up,
+// checking a password, setting one, and the session a success opens.
+import { randomUUID } from 'node:crypto';
+import { master, PublicError, transaction } from 'ultimabase';
+import { dummyHash, hashPassword, verifyPassword } from './hash.js';
+import { normalized } from './input.js';
+import { limited, PasswordHash } from './models.js';
+import { PasswordToken } from './tokens.js';
+const M = { as: master };
+/** The method `AuthAccount` links a password's email with (D-113). */
+export const method = 'password';
+const invalid = () => new PublicError('INVALID_CREDENTIALS', 'Wrong email or password.');
+/** The attempt a client makes for `subject`; server code is not counted. */
+export const attemptOf = (subject, client) => client === undefined ? undefined : { subject, address: client.address };
+/**
+ * Creates the user, its account and its hash in one transaction, as Master:
+ * the caller's fields were checked against the list (D-113).
+ */
+export async function createUser(state, email, password, data) {
+    const hash = await hashPassword(password);
+    const stamp = randomUUID();
+    return transaction(async () => {
+        const user = await state.users.queries.create({ data }, M);
+        await state.auth.linkAccount(user.id, method, email);
+        await PasswordHash.create({ data: { userId: user.id, hash, stamp } }, M);
+        return { user, stamp };
+    });
+}
+/** Rehashes the password `stamp` names, unless it was set since. */
+async function rehash(stamp, password) {
+    const hash = await hashPassword(password);
+    try {
+        await PasswordHash.update({ where: { stamp }, data: { hash } }, M);
+    }
+    catch (error) {
+        if (!(error instanceof PublicError && error.code === 'NOT_FOUND')) {
+            throw error;
+        }
+    }
+}
+/** No stored password is longer, so a longer one is not hashed. */
+const longest = 256;
+/**
+ * The stamp of `userId`'s password when `password` is it, rehashing a stale
+ * hash; `undefined` otherwise.
+ */
+async function matches(userId, typed) {
+    const password = normalized(typed);
+    if (Array.from(password).length > longest)
+        return undefined;
+    const stored = userId === undefined
+        ? null
+        : await PasswordHash.findUnique({ where: { userId } }, M);
+    // An unknown user costs a hash too, so the time tells nothing (D-113).
+    const { valid, stale } = await verifyPassword(password, stored?.hash ?? (await dummyHash()));
+    if (stored === null || !valid)
+        return undefined;
+    if (stale)
+        await rehash(stored.stamp, password);
+    return stored.stamp;
+}
+/** The user `email` and `password` sign in as, counting the attempt. */
+export async function verified(state, email, password, attempt) {
+    return limited(attempt, async () => {
+        const account = await state.auth.accountOf(method, email);
+        const stamp = await matches(account?.userId, password);
+        if (stamp === undefined || account === undefined)
+            throw invalid();
+        return { userId: account.userId, stamp };
+    });
+}
+/** Checks `userId`'s current password, counting the attempt. */
+export async function checkCurrent(userId, password, attempt) {
+    await limited(attempt, async () => {
+        if ((await matches(userId, password)) === undefined)
+            throw invalid();
+    });
+}
+/**
+ * Replaces `userId`'s hash, ends every session of the user and deletes its
+ * pending reset tokens (D-117); the new stamp.
+ */
+export async function setPassword(state, userId, password) {
+    const stored = await PasswordHash.findUnique({ where: { userId } }, M);
+    if (stored === null) {
+        throw new PublicError('NOT_FOUND', `User ${userId} has no password: sign it up with signUp.`);
+    }
+    const hash = await hashPassword(password);
+    const stamp = randomUUID();
+    await transaction(async () => {
+        await PasswordHash.update({ where: { userId }, data: { hash, stamp } }, M);
+        await PasswordToken.deleteMany({ where: { userId, kind: 'reset' } }, M);
+        await state.auth.revokeSessions(userId);
+    });
+    // Again once the stamp is visible: a sign-in that read the old one opened
+    // its session before, so this ends it (see `signedIn`).
+    await state.auth.revokeSessions(userId);
+    return stamp;
+}
+/** The user as it reads itself, so its own field rules apply (D-113). */
+async function asItself(state, userId) {
+    const { queries } = state.users;
+    // A transport's queries are untyped; this is the user model's row.
+    const user = await queries.findUnique({ where: { id: userId } }, M);
+    if (user === null)
+        return null;
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- the user model is the one the application registers (D-62, D-80).
+    const caller = { kind: 'user', user: user };
+    return queries.findUnique({ where: { id: userId } }, { as: caller });
+}
+/**
+ * Opens a session for the user, with its cookie when a client is given. The
+ * stamp is read after: a password set since the check ends the user's
+ * sessions and fails, an older read means `setPassword` ends this one (D-113).
+ */
+export async function signedIn(state, { userId, stamp }, client) {
+    const { token, expiresAt } = await state.auth.signIn(userId, client);
+    const stored = await PasswordHash.findUnique({ where: { userId } }, M);
+    if (stored?.stamp !== stamp) {
+        await state.auth.revokeSessions(userId);
+        throw invalid();
+    }
+    return { token, expiresAt, user: await asItself(state, userId) };
+}

package/dist/email-functions.d.ts

@@ -0,0 +1,20 @@
+import type { FunctionShape } from 'ultimabase';
+import { PublicError } from 'ultimabase';
+import type { State } from './core.ts';
+import type { Email, EmailKind } from './tokens.ts';
+/**
+ * Runs `work` after the response, so its time tells nothing; a failure is
+ * logged, and stopping the application waits for it.
+ */
+export declare function later(state: State, work: () => Promise<void>): void;
+/** The application's `sendEmail` (D-117). */
+export type SendEmail = (email: Email) => Promise<void>;
+/**
+ * Sends `userId` an email of `kind` to `to`, with a new token; past the
+ * account's hourly limit, the refusal instead.
+ */
+export type Mailer = (kind: EmailKind, userId: string, to: string) => Promise<PublicError | undefined>;
+export declare const mailerOf: (sendEmail: SendEmail) => Mailer;
+/** The functions that send an email or redeem its token; each is public. */
+export declare function emailFunctions(stateOf: () => State, mail: Mailer): readonly FunctionShape[];
+//# sourceMappingURL=email-functions.d.ts.map

package/dist/email-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-functions.d.ts","sourceRoot":"","sources":["../src/email-functions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAiC,WAAW,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAStC,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAGnD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAUnE;AAED,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,MAAM,GAAG,CACpB,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,KACN,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;AAErC,eAAO,MAAM,QAAQ,cACR,SAAS,KAAG,MAOvB,CAAA;AAWF,4EAA4E;AAC5E,wBAAgB,cAAc,CAC7B,OAAO,EAAE,MAAM,KAAK,EACpB,IAAI,EAAE,MAAM,GACV,SAAS,aAAa,EAAE,CAmE1B"}

package/dist/email-functions.js

@@ -0,0 +1,107 @@
+import { allow, defineFunction, master, PublicError } from 'ultimabase';
+import { method, setPassword } from './core.js';
+import { outputSchema, requestResetInput, resetPasswordInput, verifyEmailInput, } from './input.js';
+import { requestLimited } from './models.js';
+import { emailLimited, issueToken, redeemToken } from './tokens.js';
+/**
+ * Runs `work` after the response, so its time tells nothing; a failure is
+ * logged, and stopping the application waits for it.
+ */
+export function later(state, work) {
+    const task = Promise.resolve()
+        .then(work)
+        .catch((error) => {
+        state.logger.error({ err: error }, 'An email failed to send.');
+    })
+        .finally(() => {
+        state.sending.delete(task);
+    });
+    state.sending.add(task);
+}
+export const mailerOf = (sendEmail) => async (kind, userId, to) => {
+    const refused = await emailLimited(userId);
+    if (refused !== undefined)
+        return refused;
+    const token = await issueToken(userId, kind);
+    await sendEmail({ kind, to, token, userId });
+    return undefined;
+};
+const done = outputSchema({ type: 'boolean' });
+const M = { as: master };
+/** Marks `userId`'s email verified: the user received an email (D-117). */
+async function verify(state, userId) {
+    const where = { id: userId };
+    await state.users.queries.update({ where, data: { emailVerified: true } }, M);
+}
+/** The functions that send an email or redeem its token; each is public. */
+export function emailFunctions(stateOf, mail) {
+    const requestPasswordReset = defineFunction({
+        name: 'requestPasswordReset',
+        input: requestResetInput,
+        output: done,
+        run: async ({ input: { input }, client }) => {
+            const state = stateOf();
+            if (client !== undefined)
+                await requestLimited('reset', client.address);
+            const { email } = input;
+            // The same answer, and no wait, whether the email has an account.
+            later(state, async () => {
+                const account = await state.auth.accountOf(method, email);
+                if (account === undefined)
+                    return;
+                await mail('reset', account.userId, email);
+            });
+            return true;
+        },
+    }).with({ access: allow.public });
+    const resetPassword = defineFunction({
+        name: 'resetPassword',
+        input: resetPasswordInput,
+        output: done,
+        run: async ({ input: { input } }) => {
+            const state = stateOf();
+            const userId = await redeemToken(input.token, 'reset');
+            await setPassword(state, userId, input.password);
+            await verify(state, userId);
+            return true;
+        },
+    }).with({ access: allow.public });
+    const verifyEmail = defineFunction({
+        name: 'verifyEmail',
+        input: verifyEmailInput,
+        output: done,
+        run: async ({ input: { input } }) => {
+            await verify(stateOf(), await redeemToken(input.token, 'verify'));
+            return true;
+        },
+    }).with({ access: allow.public });
+    const sendVerificationEmail = defineFunction({
+        name: 'sendVerificationEmail',
+        output: done,
+        run: async ({ caller, client }) => {
+            if (caller.kind !== 'user') {
+                throw new PublicError('UNAUTHENTICATED', 'sendVerificationEmail needs a signed-in user.');
+            }
+            if (client !== undefined)
+                await requestLimited('verify', client.address);
+            const { user } = caller;
+            // The user's row, read as Master, holds the field password adds.
+            if (Reflect.get(user, 'emailVerified') === true)
+                return true;
+            const to = await stateOf().auth.subjectOf(user.id, method);
+            // A user signed in another way has no email to verify.
+            if (to === undefined)
+                return true;
+            const refused = await mail('verify', user.id, to);
+            if (refused !== undefined)
+                throw refused;
+            return true;
+        },
+    }).with({ access: allow.public });
+    return [
+        requestPasswordReset,
+        resetPassword,
+        verifyEmail,
+        sendVerificationEmail,
+    ];
+}

package/dist/functions.d.ts

@@ -0,0 +1,10 @@
+import type { ExposedModel, FunctionShape } from 'ultimabase';
+import type { State } from './core.ts';
+import type { Mailer } from './email-functions.ts';
+import type { Property } from './input.ts';
+/**
+ * The functions, `signUp` only when sign-up is open; each is public. With a
+ * `mailer`, `signUp` sends the verification email (D-117).
+ */
+export declare function passwordFunctions(stateOf: () => State, users: ExposedModel, fields: ReadonlyMap<string, Property> | false, mailer: Mailer | undefined): readonly FunctionShape[];
+//# sourceMappingURL=functions.d.ts.map

package/dist/functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../src/functions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAc,MAAM,YAAY,CAAA;AAEzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAStC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAElD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAkB1C;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,MAAM,KAAK,EACpB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,KAAK,EAC7C,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,SAAS,aAAa,EAAE,CA2D1B"}

package/dist/functions.js

@@ -0,0 +1,75 @@
+import { allow, defineFunction, defineType, PublicError } from 'ultimabase';
+import { attemptOf, checkCurrent, createUser, setPassword, signedIn, verified, } from './core.js';
+import { later } from './email-functions.js';
+import { requestLimited } from './models.js';
+import { changePasswordInput, outputSchema, signInInput, signUpInput, } from './input.js';
+/** `User.nullable()`, which `ExposedModel.model` holds but does not type. */
+function nullable(model) {
+    const make = Reflect.get(model, 'nullable');
+    if (typeof make !== 'function')
+        throw new TypeError(`${model.name} is not a model.`);
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion -- a `defineModel` value's `nullable()` (D-109).
+    return Reflect.apply(make, model, []);
+}
+/**
+ * The functions, `signUp` only when sign-up is open; each is public. With a
+ * `mailer`, `signUp` sends the verification email (D-117).
+ */
+export function passwordFunctions(stateOf, users, fields, mailer) {
+    const SignedIn = defineType({
+        name: 'SignedIn',
+        fields: {
+            token: outputSchema({ type: 'string' }),
+            expiresAt: outputSchema({ type: 'string', format: 'date-time' }),
+            user: nullable(users.model),
+        },
+    });
+    const signUp = defineFunction({
+        name: 'signUp',
+        input: signUpInput(fields === false ? new Map() : fields),
+        output: SignedIn,
+        run: async ({ input: { input }, client }) => {
+            const state = stateOf();
+            if (client !== undefined)
+                await requestLimited('signUp', client.address);
+            const { email, password, ...data } = input;
+            const { user, stamp } = await createUser(state, email, password, data);
+            if (mailer !== undefined) {
+                later(state, async () => {
+                    await mailer('verify', user.id, email);
+                });
+            }
+            return signedIn(state, { userId: user.id, stamp }, client);
+        },
+    }).with({ access: allow.public });
+    const signIn = defineFunction({
+        name: 'signIn',
+        input: signInInput,
+        output: SignedIn,
+        run: async ({ input: { input }, client }) => {
+            const state = stateOf();
+            const { email, password } = input;
+            const attempt = attemptOf(email, client);
+            const checked = await verified(state, email, password, attempt);
+            return signedIn(state, checked, client);
+        },
+    }).with({ access: allow.public });
+    const changePassword = defineFunction({
+        name: 'changePassword',
+        input: changePasswordInput,
+        output: SignedIn,
+        run: async ({ input: { input }, caller, client }) => {
+            if (caller.kind !== 'user') {
+                throw new PublicError('UNAUTHENTICATED', 'changePassword needs a signed-in user.');
+            }
+            const state = stateOf();
+            const { id } = caller.user;
+            await checkCurrent(id, input.currentPassword, attemptOf(id, client));
+            const stamp = await setPassword(state, id, input.newPassword);
+            return signedIn(state, { userId: id, stamp }, client);
+        },
+    }).with({ access: allow.public });
+    return fields === false
+        ? [signIn, changePassword]
+        : [signUp, signIn, changePassword];
+}

package/dist/hash.d.ts

@@ -0,0 +1,16 @@
+/** The computations that run at once, and how many more may wait (D-114). */
+export declare const lanes: number;
+export declare const waiting = 64;
+/** The PHC string of `password`, with a new 16-byte salt. */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Whether `password` matches `stored`, and whether `stored` was made with
+ * other parameters, so a sign-in rehashes it.
+ */
+export declare function verifyPassword(password: string, stored: string): Promise<{
+    readonly valid: boolean;
+    readonly stale: boolean;
+}>;
+/** A hash no password matches, checked for an unknown email (D-113). */
+export declare function dummyHash(): Promise<string>;
+//# sourceMappingURL=hash.d.ts.map

package/dist/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAqBA,6EAA6E;AAC7E,eAAO,MAAM,KAAK,EAAE,MAA+B,CAAA;AACnD,eAAO,MAAM,OAAO,KAAK,CAAA;AAuDzB,6DAA6D;AAC7D,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAKpE;AAoBD;;;GAGG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CAyB/D;AAGD,wEAAwE;AACxE,wBAAsB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAGjD"}

package/dist/hash.js

@@ -0,0 +1,103 @@
+// Password hashes (D-113): Argon2id from `node:crypto`, stored as a PHC string,
+// a few at a time (D-114).
+import { argon2, randomBytes, timingSafeEqual } from 'node:crypto';
+import { availableParallelism } from 'node:os';
+import { PublicError } from 'ultimabase';
+/** OWASP's first Argon2id setting: 19 MiB, two passes, one lane. */
+const current = { memory: 19456, passes: 2, parallelism: 1 };
+const tagLength = 32;
+const phc = /^\$argon2id\$v=19\$m=(\d+),t=(\d+),p=(\d+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/;
+const unpadded = (bytes) => bytes.toString('base64').replace(/=+$/, '');
+/** The computations that run at once, and how many more may wait (D-114). */
+export const lanes = availableParallelism();
+export const waiting = 64;
+let running = 0;
+const queue = [];
+/** Runs `run` when a lane is free; refuses it when the queue is full. */
+async function queued(run) {
+    if (running < lanes)
+        running += 1;
+    else if (queue.length < waiting) {
+        await new Promise((resolve) => queue.push(resolve));
+    }
+    else {
+        throw new PublicError('TOO_MANY_ATTEMPTS', 'The server is busy: try again.', {
+            details: { retryAfter: 1 },
+        });
+    }
+    try {
+        return await run();
+    }
+    finally {
+        // The lane goes to the next computation waiting, or is freed.
+        const next = queue.shift();
+        if (next === undefined)
+            running -= 1;
+        else
+            next();
+    }
+}
+async function derive(password, nonce, parameters, length) {
+    return queued(async () => compute(password, nonce, parameters, length));
+}
+async function compute(password, nonce, parameters, length) {
+    return new Promise((resolve, reject) => {
+        argon2('argon2id', { message: password, nonce, tagLength: length, ...parameters }, (error, key) => {
+            if (error === null)
+                resolve(key);
+            else
+                reject(error);
+        });
+    });
+}
+/** The PHC string of `password`, with a new 16-byte salt. */
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await derive(password, salt, current, tagLength);
+    const { memory, passes, parallelism } = current;
+    return `$argon2id$v=19$m=${memory},t=${passes},p=${parallelism}$${unpadded(salt)}$${unpadded(key)}`;
+}
+/**
+ * Whether a stored hash is one this plugin could verify: up to 256 MiB, 16
+ * passes and 16 lanes, and a tag of 16 to 64 bytes, so a tampered row
+ * neither exhausts the server nor matches too easily.
+ */
+const bounded = ({ memory, passes, parallelism }, length) => parallelism >= 1 &&
+    parallelism <= 16 &&
+    memory >= 8 * parallelism &&
+    memory <= 262_144 &&
+    passes >= 1 &&
+    passes <= 16 &&
+    length >= 16 &&
+    length <= 64;
+/**
+ * Whether `password` matches `stored`, and whether `stored` was made with
+ * other parameters, so a sign-in rehashes it.
+ */
+export async function verifyPassword(password, stored) {
+    const parts = phc.exec(stored);
+    if (parts === null)
+        throw new Error('A stored password hash is not Argon2id.');
+    const [, m, t, p, salt = '', hash = ''] = parts;
+    const parameters = {
+        memory: Number(m),
+        passes: Number(t),
+        parallelism: Number(p),
+    };
+    const expected = Buffer.from(hash, 'base64');
+    if (!bounded(parameters, expected.length)) {
+        throw new Error('A stored password hash has out-of-bounds parameters.');
+    }
+    const key = await derive(password, Buffer.from(salt, 'base64'), parameters, expected.length);
+    const stale = parameters.memory !== current.memory ||
+        parameters.passes !== current.passes ||
+        parameters.parallelism !== current.parallelism ||
+        expected.length !== tagLength;
+    return { valid: timingSafeEqual(key, expected), stale };
+}
+let dummy;
+/** A hash no password matches, checked for an unknown email (D-113). */
+export async function dummyHash() {
+    dummy ??= hashPassword(randomBytes(32).toString('base64'));
+    return dummy;
+}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export type { SignedIn } from './core.ts';
+export type { SendEmail } from './email-functions.ts';
+export type { Credentials } from './input.ts';
+export type { Password, PasswordCommands, PasswordOptions, UserField, } from './plugin.ts';
+export type { Email, EmailKind } from './tokens.ts';
+export { password, passwordPlugin } from './plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACzC,YAAY,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EACX,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,SAAS,GACT,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1 @@
+export { password, passwordPlugin } from './plugin.js';