pipework 0.61.0 → 0.63.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.63.0
+
+**Schema note: blueprint `email: {}` adds `pipework_email_messages` (`key` unique, `to_address`, `template`, `data`, `status`, `provider_message_id`, `error`, `trace_id`, `created_at`, `sent_at`, `sending_at`) and `pipework_email_suppressions` (`address` primary key, `reason`, `detail`, `created_at`) to generated migrations; not tenant-scoped. Run `pipework generate` and `pipework migrate` to add them.**
+
+- **New: `mail.create` sends transactional email through your job queue.** `send(db, { to, template, data, key })` records the message and enqueues its job in the caller's transaction (a rollback sends nothing); the same `key` sends once. Templates stay in the app as functions returning `{ subject, text, html? }`. Spread `mail.jobs` into your worker surface; the send runs in the trace of the flow that called `send`.
+- **New: providers.** `mail.ses({ region, credentials, configurationSet? })` calls the SES v2 API with SigV4 (no AWS SDK); `mail.devStandIn({ dir })` writes each message to a file and `mail.create` refuses it when the environment is production.
+- **New: bounces and complaints suppress the address.** `mail.snsWebhook({ path, topicArns, region? })` receives SES events through SNS, verifies the SNS signature, certificate host and topic, confirms the subscription, and puts the recipient of a permanent bounce or a complaint on a do-not-send list the job checks. Each one is audited (`Email`: `bounce`, `complaint`) with the original send's trace id. EventBridge delivery is not supported.
+
+## 0.62.0
+
+**Schema note: blueprint `passwords: {}` adds `pipework_signin_attempts` to generated migrations (`key` text primary key, `failures`, `first_failure_at`, `last_failure_at`, `locked_until`; not tenant-scoped). Run `pipework generate` and `pipework migrate` to add it.**
+
+- **New: `auth.passwords` hashes and verifies passwords.** scrypt with a PHC-string hash that records its parameters, constant-time verify, and `needsRehash` when the configured parameters were raised. No composition rules; passwords up to 4096 bytes (long passphrases, pasted passwords) work. `verifyNone` costs the same as a wrong password, so an unknown account is not distinguishable by timing.
+- **New: `auth.signIn` slows, then refuses, repeated failed sign-ins.** `attempt({ account, client?, password, lookup })` runs in the current Flow but outside the request transaction, so a route can throw `UnauthorizedError` and the count stays. Attempts are counted per account and per client address in Postgres (shared across processes, surviving restarts) before the password is checked, so parallel guesses are locked out; past the threshold each failure locks for a doubling, capped time and attempts are refused with `retryAfterSeconds`. A success resets the account's count. Failures, refusals and successes are logged and audited (`SignIn`: `fail`, `locked`, `success`).
+- **New: `errors.TooManyRequests` (`TooManyRequestsError`, 429).** The HTTP server sends `Retry-After` when an error carries `retryAfterSeconds`.
+
 ## 0.61.0
 
 **Schema note: apps using `auth.createSessions` / `auth.createMultiOrg` can now get their tables from `pipework generate`. Existing tables from the hand-copied SQL keep working (the statements are `IF NOT EXISTS`); to type their ids uuid, run `ALTER TABLE pipework_refresh_tokens ALTER COLUMN tenant_id TYPE uuid USING tenant_id::uuid` and `ALTER TABLE pipework_user_orgs ALTER COLUMN org_id TYPE uuid USING org_id::uuid` once.**

package/REFERENCE.md

@@ -27,6 +27,7 @@
 - [audit — Audit Logging](#audit-audit-logging)
 - [cache — Caching](#cache-caching)
 - [webhook — Inbound & Outbound Webhooks](#webhook-inbound-outbound-webhooks)
+- [mail — Transactional Email](#mail-transactional-email)
 - [accessLinks — Access Links](#accesslinks-access-links)
 - [behavior — Resource Decorators](#behavior-resource-decorators)
 - [fitting — Dependency Injection](#fitting-dependency-injection)
@@ -292,6 +293,24 @@ Creates multi-org session management — org selection, switching, membership CR
 
 Opt in with blueprint `orgs: {}` (plus `sessions: {}`). The generated migration then includes `pipework_user_orgs` (`user_id` text, `org_id` uuid, `role`, `joined_at`, `added_by`, unique on `(user_id, org_id)`). It is deliberately not tenant-scoped: a user's orgs are read across orgs at sign-in. An `orgId` that is not a uuid throws a `ValidationError`. The statements are `IF NOT EXISTS`; if your existing table has `org_id text` holding uuids, run once: `ALTER TABLE pipework_user_orgs ALTER COLUMN org_id TYPE uuid USING org_id::uuid`. The definition is for the default table name only: with a custom `table`, the app owns that table's DDL.
 
+### `auth.passwords`
+
+Hashes and verifies passwords with scrypt; reports when a stored hash needs rehashing.
+
+`auth.passwords({ scrypt?: { ln, r, p } })` returns `{ hash, verify, verifyNone }`. Defaults are `ln=15, r=8, p=3`. `hash(password)` returns a PHC string `$scrypt$ln=15,r=8,p=3$<salt>$<hash>` (16-byte salt, 32-byte key). Passwords are NFC-normalized; there are no composition rules, and up to 4096 bytes of UTF-8 are accepted (more throws a `ValidationError`), so long passphrases and pasted passwords work. `verify(stored, password)` compares in constant time and returns `{ ok, needsRehash }`; `needsRehash` is true when the password matched but the stored parameters differ from the configured ones. A malformed stored string returns `ok: false` and logs an error. `verifyNone(password)` spends the cost of a verify against a fixed dummy hash, so an unknown account takes as long as a wrong password.
+
+### `auth.signIn`
+
+Guarded password sign-in that slows, then refuses, repeated failures per account and per client.
+
+Opt in with blueprint `passwords: {}`; the generated migration adds `pipework_signin_attempts` (`key` text primary key, `failures`, `first_failure_at`, `last_failure_at`, `locked_until`), `IF NOT EXISTS`, not tenant-scoped (a sign-in happens before any tenant is known). Counts live in Postgres, so they survive restarts and are shared across processes. `attempt` needs an active Flow and runs every statement on `pipe.system()`, outside the request transaction, so the count is kept even when the route answers a bad password by throwing `UnauthorizedError`.
+
+`auth.signIn({ passwords, accountThreshold = 5, clientThreshold = 20, windowSeconds = 900, maxLockSeconds = 900 })` returns `{ attempt({ account, client?, password, lookup }) }`, where `lookup(db, account)` (given `pipe.system()`, a pre-tenant read) returns `{ userId, passwordHash }` or `null`. The result is `{ ok: true, userId, needsRehash }` or `{ ok: false, reason: 'invalid' | 'locked', retryAfterSeconds? }`. An unknown account runs a dummy verify and is reported as `'invalid'`, exactly like a wrong password. Keys are `account:<sha256 of the NFC-lowercased trimmed account>` and `client:<client>` (omitted when no client is given). At or above its threshold, each further failure locks the key for `2^(failures - threshold)` seconds, capped at `maxLockSeconds`; a failure more than `windowSeconds` after the first restarts the count. Each attempt is counted, atomically per key, before the password is checked, so a burst of parallel guesses is locked out rather than all verified. While any key is locked an attempt returns `reason: 'locked'` with `retryAfterSeconds` at once, without checking the password. A success deletes the account key and gives the client key its count back.
+
+Tradeoff: locking is per account, so anyone who knows an account name can lock it out by failing on purpose. Each lock is capped (15 minutes by default), and the client key limits how fast one address can do it.
+
+Every success, failure and refusal is logged, and audited (entity `SignIn`, verbs `success`, `fail`, `locked`; `entity_id` is the user id when known; `after` holds `accountKey`, `client`, `failures`, `retryAfterSeconds`, never the account string or password) when the Flow has an open trace step. For a route, turn a locked result into a 429 with `throw new errors.TooManyRequests(result.retryAfterSeconds)`.
+
 ### `auth.runChain`
 
 Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request.
@@ -586,6 +605,10 @@ Base error class with code, statusCode, and suggestion fields.
 
 409 — resource state conflict (duplicate, version mismatch).
 
+### `errors.TooManyRequests`
+
+429 — too many attempts; carries `retryAfterSeconds`, sent as a `Retry-After` header.
+
 ## lifecycle — Startup & Shutdown
 
 Application lifecycle namespace — startup orchestration with hooks and timeouts.
@@ -1097,6 +1120,36 @@ Creates an outbound webhook system — endpoint registration, payload signing, d
 
 Signs a payload with HMAC for outbound delivery — returns body, signature, timestamp, messageId.
 
+## mail — Transactional Email
+
+Mail namespace — transactional email through a job queue, SES v2 or a dev stand-in, bounce and complaint suppression.
+
+Opt in with blueprint `email: {}`; the generated migration adds `pipework_email_messages` (`key` unique, `to_address`, `template`, `data`, `status` `queued | sending | sent | suppressed | failed`, `provider_message_id`, `error`, `trace_id`, `created_at`, `sent_at`, `sending_at`) and `pipework_email_suppressions` (`address` primary key, lowercased; `reason` `bounce | complaint`; `detail`; `created_at`), both `IF NOT EXISTS` and not tenant-scoped.
+
+### `mail.create`
+
+Creates the transactional email interface: `send(db, { to, template, data, key })` in the caller's transaction, and the `jobs` that deliver.
+
+`mail.create({ provider, templates, from, queue, configurationSet?, environment?, sendingStaleSeconds? })` returns `{ send, jobs }`. `templates` is `{ [name]: (data) => { subject, text, html? } }`; `send` checks the template name and the data type. `send(db, ...)` inserts the message row (`ON CONFLICT (key) DO NOTHING`) and enqueues a `pipework.email.send` job on `queue` in the same `db`, so the caller's rollback drops both; it returns `{ messageId, queued }`, with `queued: false` and the earlier id when the key was used. Spread `mail.jobs` into the worker surface's `jobs` (on the same queue). The job skips a message already `sent`, `suppressed` or `failed`, marks an address on the suppression list `suppressed` without calling the provider, and otherwise renders, sends and marks `sent`. A provider error returns the row to `queued` with `error` set and rethrows, so the queue retries per its `maxAttempts`; if it gives up, the row keeps the error. A template that is missing or throws marks the row `failed` without retrying. The job claims the message with a conditional update (`queued`, or `sending` for longer than `sendingStaleSeconds`, default 600), so a reaper re-run of a job still in flight does not call the provider; a run that cannot claim returns and logs at info. Residual window: a crash mid-send leaves the message `sending` for the stale window, after which a retry may send it once more; likewise if the provider accepted the message and the process died before the row was marked `sent`. SES v2 has no idempotency token. The job runs in the trace of the flow that called `send` (`continueFlow`); the delivery is the step `pipework/email:deliver`, with `Email:sent`, `Email:suppressed` or `Email:failed` audit records under it. Message bodies and template data are never logged. `create` throws when `environment` is `production` and the provider is the stand-in; the job checks the instance's environment too.
+
+### `mail.ses`
+
+Amazon SES v2 provider, SigV4-signed without the AWS SDK.
+
+`mail.ses({ region, credentials: async () => ({ accessKeyId, secretAccessKey, sessionToken? }), configurationSet?, endpoint? })` posts JSON to `https://email.<region>.amazonaws.com/v2/email/outbound-emails` (`endpoint` replaces the base URL, for tests). Credentials come from the app, never from the environment, and are asked for on every send. A non-2xx answer throws with the status and AWS's message.
+
+### `mail.devStandIn`
+
+Development provider that writes each message to a file instead of sending; refused in production.
+
+`mail.devStandIn({ dir })` writes `<dir>/<messageId>.json` (`from`, `to`, `subject`, `text`, `html`) and logs one line with the address and file path.
+
+### `mail.snsWebhook`
+
+Inbound handler for SES bounce and complaint events delivered through SNS; suppresses the address.
+
+`mail.snsWebhook({ path, topicArns, region?, fetchCert?, confirm? })` returns a public POST handler for an SNS HTTP/S subscription to the SES event topic. `topicArns` is required: after the signature verifies, a message whose `TopicArn` is not listed is refused with 401, before a subscription is confirmed or an event processed (SNS signs every topic, so anyone could otherwise subscribe the endpoint to their own topic and forge bounces). Every message's signature (SignatureVersion 1 or 2) is verified against the certificate at `SigningCertURL`, which must be `https://sns.<region>.amazonaws.com/...pem` (any AWS region when `region` is omitted); otherwise the answer is 401. A `SubscriptionConfirmation` is confirmed by fetching its `SubscribeURL` (same host rule). A `Notification` with a permanent bounce or a complaint puts each recipient on `pipework_email_suppressions`; a transient or undetermined bounce is logged only. Each is the step `pipework/email:notification` with an `Email:bounce` or `Email:complaint` audit record (`entity_id` the message id when found by `provider_message_id`; `after` has `address`, `bounceType`, `suppressed`, `messageTraceId`, the trace of the original send). A suppression logs a warning `email suppressed`; the alert condition (#458) is not built yet. SES events delivered through EventBridge are not supported. `fetchCert` and `confirm` replace the default HTTP fetches (for tests).
+
 ## accessLinks — Access Links
 
 Short, revocable bearer links to a tenant's resource, for people with no account ("a public link that never expires", "a link for John that works once"). A tenant creates a link; anyone holding the code can resolve it on a public route with no tenant and no auth in the Flow; a use counts only when the app confirms it completed.

package/dist/REFERENCE.md

@@ -277,6 +277,14 @@ Creates a Sessions manager with JWT access/refresh tokens, rotation, and reuse d
 
 Creates multi-org session management — org selection, switching, membership CRUD.
 
+### `auth.passwords`
+
+Hashes and verifies passwords with scrypt; reports when a stored hash needs rehashing.
+
+### `auth.signIn`
+
+Guarded password sign-in that slows, then refuses, repeated failures per account and per client.
+
 ### `auth.runChain`
 
 Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request.
@@ -377,6 +385,54 @@ interface Sessions
 interface CookieConfig
 ```
 
+**`ScryptParams`**
+
+```typescript
+interface ScryptParams
+```
+
+**`PasswordsConfig`**
+
+```typescript
+interface PasswordsConfig
+```
+
+**`VerifyResult`**
+
+```typescript
+interface VerifyResult
+```
+
+**`Passwords`**
+
+```typescript
+interface Passwords
+```
+
+**`SignInConfig`**
+
+```typescript
+interface SignInConfig
+```
+
+**`SignInAttempt`**
+
+```typescript
+interface SignInAttempt
+```
+
+**`SignInResult`**
+
+```typescript
+type SignInResult =
+```
+
+**`SignIn`**
+
+```typescript
+interface SignIn
+```
+
 **`MultiOrgConfig`** — Configuration for multi-org sessions — base sessions, signing keys, org-select token TTL.
 
 ```typescript
@@ -572,6 +628,10 @@ Base error class with code, statusCode, and suggestion fields.
 
 409 — resource state conflict (duplicate, version mismatch).
 
+### `errors.TooManyRequests`
+
+429 — too many attempts; carries `retryAfterSeconds`, sent as a `Retry-After` header.
+
 ## lifecycle — Startup & Shutdown
 
 Application lifecycle namespace — startup orchestration with hooks and timeouts.
@@ -703,7 +763,7 @@ Field builders for domain definitions — uuid(), text(), integer(), etc.
 
 ### `pipe.define`
 
-Registers a domain definition with table, validators, and factory projections.
+Registers a domain definition with table, validators, and factory projections. The `auditEntity` option names the `@touches` entity writes to this table are audited under (see `__flowStep`).
 
 ### `pipe.definitions`
 
@@ -1037,7 +1097,11 @@ Creates an Audit instance that writes audit records to a Postgres table.
 
 ### `audit.query`
 
-Queries the framework-managed `audit_record` table. Tenant-scoped via the active Flow.
+Queries the framework-managed `audit_record` table. Tenant-scoped via the active Flow. `{ entity, entityId }` returns one row's history from an index; build a composite key's `entityId` with `audit.entityId`.
+
+### `audit.entityId`
+
+The `entityId` filter text for a written table's row: the primary key's value as text, or for a composite key a compact JSON array of the key values as strings in key order (`["a","7"]`). Pass the table and a row (or just its key fields). Dates become ISO strings.
 
 ### `audit.chainHead`
 
@@ -1209,7 +1273,7 @@ interface ErrorResponse
 interface PipeworkServer
 ```
 
-**`HttpRequest`** — Fastify request with pipework extensions — req.id (UUID), typed headers.
+**`HttpRequest`** — Fastify request with pipework extensions — req.id (UUID), typed headers, client address (`ip`, `ips`).
 
 ```typescript
 interface HttpRequest

package/dist/auth/auth/index.d.ts

@@ -7,4 +7,8 @@ export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
 export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
 export { createMultiOrgSessions } from './multi-org.js';
 export type { MultiOrgConfig, MultiOrgSessions, ResolveLoginResult, AuthenticatedResult, OrgSelectResult, OrgMembership, OrgInfo, OrgMembershipDetail } from './multi-org.js';
+export { createPasswords } from './passwords.js';
+export type { Passwords, PasswordsConfig, ScryptParams, VerifyResult } from './passwords.js';
+export { createSignIn } from './sign-in.js';
+export type { SignIn, SignInConfig, SignInAttempt, SignInResult } from './sign-in.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC7K,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC5F,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/auth/index.js

@@ -2,4 +2,6 @@ export { runAuthChain } from './chain.js';
 export { createSessions } from './sessions.js';
 export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
 export { createMultiOrgSessions } from './multi-org.js';
+export { createPasswords } from './passwords.js';
+export { createSignIn } from './sign-in.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA"}

package/dist/auth/auth/namespace.d.ts

@@ -1,5 +1,7 @@
 import { createSessions } from './sessions.js';
 import { createMultiOrgSessions } from './multi-org.js';
+import { createPasswords } from './passwords.js';
+import { createSignIn } from './sign-in.js';
 import { runAuthChain } from './chain.js';
 import { resolveCookieConfig, parseCookieHeader, buildSetCookieHeader, buildClearCookieHeader } from './cookie.js';
 /** Authentication namespace — session management, multi-org support, auth chain resolution. */
@@ -8,6 +10,10 @@ export declare const auth: {
     createSessions: typeof createSessions;
     /** Creates multi-org session management — org selection, switching, membership CRUD. */
     createMultiOrg: typeof createMultiOrgSessions;
+    /** Hashes and verifies passwords with scrypt; reports when a stored hash needs rehashing. */
+    passwords: typeof createPasswords;
+    /** Guarded password sign-in that slows, then refuses, repeated failures per account and per client. */
+    signIn: typeof createSignIn;
     /** Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request. */
     runChain: typeof runAuthChain;
     /** Resolves CookieConfig with defaults for secure cookie-based token delivery. */

package/dist/auth/auth/namespace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,eAAO,MAAM,IAAI;IACf,gGAAgG;;IAEhG,wFAAwF;;IAExF,0FAA0F;;IAE1F,kFAAkF;;IAElF,0DAA0D;;IAE1D,4EAA4E;;IAE5E,iEAAiE;;CAElE,CAAA"}
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,eAAO,MAAM,IAAI;IACf,gGAAgG;;IAEhG,wFAAwF;;IAExF,6FAA6F;;IAE7F,uGAAuG;;IAEvG,0FAA0F;;IAE1F,kFAAkF;;IAElF,0DAA0D;;IAE1D,4EAA4E;;IAE5E,iEAAiE;;CAElE,CAAA"}

package/dist/auth/auth/namespace.js

@@ -1,5 +1,7 @@
 import { createSessions } from './sessions.js';
 import { createMultiOrgSessions } from './multi-org.js';
+import { createPasswords } from './passwords.js';
+import { createSignIn } from './sign-in.js';
 import { runAuthChain } from './chain.js';
 import { resolveCookieConfig, parseCookieHeader, buildSetCookieHeader, buildClearCookieHeader } from './cookie.js';
 /** Authentication namespace — session management, multi-org support, auth chain resolution. */
@@ -8,6 +10,10 @@ export const auth = {
     createSessions,
     /** Creates multi-org session management — org selection, switching, membership CRUD. */
     createMultiOrg: createMultiOrgSessions,
+    /** Hashes and verifies passwords with scrypt; reports when a stored hash needs rehashing. */
+    passwords: createPasswords,
+    /** Guarded password sign-in that slows, then refuses, repeated failures per account and per client. */
+    signIn: createSignIn,
     /** Executes an auth chain (strategy pipeline) to resolve auth + tenant from a request. */
     runChain: runAuthChain,
     /** Resolves CookieConfig with defaults for secure cookie-based token delivery. */

package/dist/auth/auth/namespace.js.map

@@ -1 +1 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,gGAAgG;IAChG,cAAc;IACd,wFAAwF;IACxF,cAAc,EAAE,sBAAsB;IACtC,0FAA0F;IAC1F,QAAQ,EAAE,YAAY;IACtB,kFAAkF;IAClF,aAAa,EAAE,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,iBAAiB;IAC9B,4EAA4E;IAC5E,cAAc,EAAE,oBAAoB;IACpC,iEAAiE;IACjE,gBAAgB,EAAE,sBAAsB;CACzC,CAAA"}
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../../src/auth/auth/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAElH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,gGAAgG;IAChG,cAAc;IACd,wFAAwF;IACxF,cAAc,EAAE,sBAAsB;IACtC,6FAA6F;IAC7F,SAAS,EAAE,eAAe;IAC1B,uGAAuG;IACvG,MAAM,EAAE,YAAY;IACpB,0FAA0F;IAC1F,QAAQ,EAAE,YAAY;IACtB,kFAAkF;IAClF,aAAa,EAAE,mBAAmB;IAClC,0DAA0D;IAC1D,WAAW,EAAE,iBAAiB;IAC9B,4EAA4E;IAC5E,cAAc,EAAE,oBAAoB;IACpC,iEAAiE;IACjE,gBAAgB,EAAE,sBAAsB;CACzC,CAAA"}

package/dist/auth/auth/passwords.d.ts

@@ -0,0 +1,39 @@
+export interface ScryptParams {
+    /** log2 of the CPU/memory cost N. Default 15. */
+    readonly ln: number;
+    /** Block size. Default 8. */
+    readonly r: number;
+    /** Parallelism. Default 3. */
+    readonly p: number;
+}
+export interface PasswordsConfig {
+    readonly scrypt?: Partial<ScryptParams>;
+}
+export interface VerifyResult {
+    readonly ok: boolean;
+    /** True when the password matched but the stored hash used other parameters than the configured ones. */
+    readonly needsRehash: boolean;
+}
+export interface Passwords {
+    /** Returns a PHC string `$scrypt$ln=15,r=8,p=3$<salt>$<hash>` for the password. */
+    hash(password: string): Promise<string>;
+    /** Checks a password against a stored hash in constant time. A malformed stored hash is `ok: false`. */
+    verify(stored: string, password: string): Promise<VerifyResult>;
+    /** Spends the cost of a verify against a fixed dummy hash, for an account that does not exist. */
+    verifyNone(password: string): Promise<{
+        ok: false;
+    }>;
+}
+/**
+ * Creates the password hasher. Passwords are NFC-normalized and hashed with
+ * Node's scrypt (no dependency); there are no composition rules, and anything up
+ * to 4096 bytes of UTF-8 is accepted, so long passphrases and pasted passwords
+ * work. The hash records its own parameters, so raising `scrypt` later leaves old
+ * hashes verifiable and `verify` reports `needsRehash` for them.
+ *
+ * `verify` never throws on a bad stored string (it returns `ok: false` and logs),
+ * and `verifyNone` costs the same as a wrong password, so an unknown account is
+ * not distinguishable by timing.
+ */
+export declare function createPasswords(config?: PasswordsConfig): Passwords;
+//# sourceMappingURL=passwords.d.ts.map

package/dist/auth/auth/passwords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/passwords.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,yGAAyG;IACzG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,SAAS;IACxB,mFAAmF;IACnF,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,wGAAwG;IACxG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/D,kGAAkG;IAClG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CACrD;AAgCD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,MAAM,GAAE,eAAoB,GAAG,SAAS,CAoCvE"}

package/dist/auth/auth/passwords.js

@@ -0,0 +1,76 @@
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
+import { ValidationError } from '../../core/errors/index.js';
+import { getBaseLogger } from '../../core/logging/index.js';
+const DEFAULTS = { ln: 15, r: 8, p: 3 };
+const KEY_LENGTH = 32;
+const SALT_LENGTH = 16;
+const MAX_PASSWORD_BYTES = 4096;
+const STORED_RE = /^\$scrypt\$ln=(\d+),r=(\d+),p=(\d+)\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/;
+function derive(password, salt, params, length) {
+    const N = 2 ** params.ln;
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, length, { N, r: params.r, p: params.p, maxmem: 256 * N * params.r + (1 << 20) }, (err, key) => {
+            if (err !== null)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+}
+function normalize(password) {
+    const normalized = password.normalize('NFC');
+    if (Buffer.byteLength(normalized, 'utf8') > MAX_PASSWORD_BYTES) {
+        throw new ValidationError({ password: [`must be at most ${MAX_PASSWORD_BYTES} bytes`] }, 'Password is too long.');
+    }
+    return normalized;
+}
+function validParams(p) {
+    return Number.isInteger(p.ln) && p.ln >= 1 && p.ln <= 22
+        && Number.isInteger(p.r) && p.r >= 1 && p.r <= 32
+        && Number.isInteger(p.p) && p.p >= 1 && p.p <= 16;
+}
+/**
+ * Creates the password hasher. Passwords are NFC-normalized and hashed with
+ * Node's scrypt (no dependency); there are no composition rules, and anything up
+ * to 4096 bytes of UTF-8 is accepted, so long passphrases and pasted passwords
+ * work. The hash records its own parameters, so raising `scrypt` later leaves old
+ * hashes verifiable and `verify` reports `needsRehash` for them.
+ *
+ * `verify` never throws on a bad stored string (it returns `ok: false` and logs),
+ * and `verifyNone` costs the same as a wrong password, so an unknown account is
+ * not distinguishable by timing.
+ */
+export function createPasswords(config = {}) {
+    const params = { ...DEFAULTS, ...config.scrypt };
+    if (!validParams(params)) {
+        throw new ValidationError('auth.passwords scrypt params must satisfy 1<=ln<=22, 1<=r<=32, 1<=p<=16.');
+    }
+    const encode = (b) => b.toString('base64').replace(/=+$/, '');
+    let dummy;
+    async function hash(password) {
+        const salt = randomBytes(SALT_LENGTH);
+        const key = await derive(normalize(password), salt, params, KEY_LENGTH);
+        return `$scrypt$ln=${params.ln},r=${params.r},p=${params.p}$${encode(salt)}$${encode(key)}`;
+    }
+    async function verify(stored, password) {
+        const m = STORED_RE.exec(stored);
+        const storedParams = m === null ? null : { ln: Number(m[1]), r: Number(m[2]), p: Number(m[3]) };
+        if (m === null || storedParams === null || !validParams(storedParams)) {
+            getBaseLogger().error({ event: 'password hash malformed' }, 'stored password hash is malformed');
+            return { ok: false, needsRehash: false };
+        }
+        const salt = Buffer.from(m[4], 'base64');
+        const expected = Buffer.from(m[5], 'base64');
+        const key = await derive(normalize(password), salt, storedParams, expected.length);
+        const ok = key.length === expected.length && timingSafeEqual(key, expected);
+        const needsRehash = ok && (storedParams.ln !== params.ln || storedParams.r !== params.r || storedParams.p !== params.p);
+        return { ok, needsRehash };
+    }
+    async function verifyNone(password) {
+        dummy ??= hash(randomBytes(16).toString('hex'));
+        await verify(await dummy, password);
+        return { ok: false };
+    }
+    return { hash, verify, verifyNone };
+}
+//# sourceMappingURL=passwords.js.map

package/dist/auth/auth/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../../../src/auth/auth/passwords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AA8B3D,MAAM,QAAQ,GAAiB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAA;AACrD,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,WAAW,GAAG,EAAE,CAAA;AACtB,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAC/B,MAAM,SAAS,GAAG,0EAA0E,CAAA;AAE5F,SAAS,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,MAAoB,EAAE,MAAc;IAClF,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAA;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACnH,IAAI,GAAG,KAAK,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACxB,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,mBAAmB,kBAAkB,QAAQ,CAAC,EAAE,EAAE,uBAAuB,CAAC,CAAA;IACnH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,CAAe;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;WACnD,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;WAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,SAA0B,EAAE;IAC1D,MAAM,MAAM,GAAiB,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;IAC9D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CAAC,0EAA0E,CAAC,CAAA;IACvG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC7E,IAAI,KAAkC,CAAA;IAEtC,KAAK,UAAU,IAAI,CAAC,QAAgB;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;QACvE,OAAO,cAAc,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAC7F,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAc,EAAE,QAAgB;QACpD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChC,MAAM,YAAY,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/F,IAAI,CAAC,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YACtE,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,mCAAmC,CAAC,CAAA;YAChG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;QAC1C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClF,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC3E,MAAM,WAAW,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAA;QACvH,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAA;IAC5B,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,QAAgB;QACxC,KAAK,KAAK,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/C,MAAM,MAAM,CAAC,MAAM,KAAK,EAAE,QAAQ,CAAC,CAAA;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;AACrC,CAAC"}

package/dist/auth/auth/schema.d.ts

@@ -74,4 +74,31 @@ export declare const userOrgs: import("../../data/domain/types.js").DefinedTable
         nullable: true;
     }>;
 }, "pipework_user_orgs">;
+export declare const signinAttempts: import("../../data/domain/types.js").DefinedTable<{
+    key: import("../../data/domain/types.js").FieldDescriptor<string, {
+        primaryKey: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<string, {
+        primaryKey: true;
+    }>;
+    failures: import("../../data/domain/types.js").FieldDescriptor<number, {
+        hasDefault: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<number, {
+        hasDefault: true;
+    }>;
+    firstFailureAt: import("../../data/domain/types.js").FieldDescriptor<Date | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<Date | null, {
+        nullable: true;
+    }>;
+    lastFailureAt: import("../../data/domain/types.js").FieldDescriptor<Date | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<Date | null, {
+        nullable: true;
+    }>;
+    lockedUntil: import("../../data/domain/types.js").FieldDescriptor<Date | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<Date | null, {
+        nullable: true;
+    }>;
+}, "pipework_signin_attempts">;
 //# sourceMappingURL=schema.d.ts.map

package/dist/auth/auth/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/schema.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAA;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAexB,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;4BAIvB,CAAA;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAanB,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/schema.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAA;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAexB,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;4BAIvB,CAAA;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBAanB,CAAA;AAIF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;8BAMzB,CAAA"}

package/dist/auth/auth/schema.js

@@ -17,7 +17,7 @@ import { field } from '../../data/domain/field.js';
 import { sql } from '../../data/db/sql.js';
 import { index, unique } from '../../data/db/idx/index.js';
 export const AUTH_TABLE_NAMES = new Set([
-    'pipework_refresh_tokens', 'pipework_auth_versions', 'pipework_user_orgs',
+    'pipework_refresh_tokens', 'pipework_auth_versions', 'pipework_user_orgs', 'pipework_signin_attempts',
 ]);
 export const refreshTokens = define('pipework_refresh_tokens', {
     id: field.uuid().defaultRandom().primaryKey(),
@@ -54,4 +54,13 @@ export const userOrgs = define('pipework_user_orgs', {
         byOrg: index('idx_pipework_user_orgs_org').on(t['orgId']),
     }),
 });
+// Behind `auth.signIn`. Not tenant-scoped: a sign-in happens before any tenant
+// is known. `key` is 'account:<sha256 of the account>' or 'client:<address>'.
+export const signinAttempts = define('pipework_signin_attempts', {
+    key: field.text().primaryKey(),
+    failures: field.integer().default(0),
+    firstFailureAt: field.timestamp().nullable(),
+    lastFailureAt: field.timestamp().nullable(),
+    lockedUntil: field.timestamp().nullable(),
+});
 //# sourceMappingURL=schema.js.map

package/dist/auth/auth/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/auth/auth/schema.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,6EAA6E;AAC7E,gFAAgF;AAChF,qDAAqD;AACrD,EAAE;AACF,8EAA8E;AAC9E,6BAA6B;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB;CAC1E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,yBAAyB,EAAE;IAC7D,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC7C,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE;IACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;CAC7B,EAAE;IACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,oBAAoB,CAAC;QAChG,QAAQ,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;KACxE,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE;IAC3D,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE;IACjC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,EAAE;IACnD,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC7C,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;IACnB,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACjC,EAAE;IACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;KAC1D,CAAC;CACH,CAAC,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/auth/auth/schema.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,6EAA6E;AAC7E,gFAAgF;AAChF,qDAAqD;AACrD,EAAE;AACF,8EAA8E;AAC9E,6BAA6B;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,0BAA0B;CACtG,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,yBAAyB,EAAE;IAC7D,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC7C,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE;IACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;CAC7B,EAAE;IACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,oBAAoB,CAAC;QAChG,QAAQ,EAAE,KAAK,CAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;KACxE,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE;IAC3D,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE;IACjC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,EAAE;IACnD,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC7C,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;IACnB,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACjC,EAAE;IACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACvF,MAAM,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;KAC1D,CAAC;CACH,CAAC,CAAA;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,0BAA0B,EAAE;IAC/D,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE;IAC9B,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAA"}

package/dist/auth/auth/sign-in.d.ts

@@ -0,0 +1,64 @@
+import type { DB } from '../../data/db/index.js';
+import type { Passwords } from './passwords.js';
+export interface SignInConfig {
+    readonly passwords: Passwords;
+    /** Failures per account within the window before it is locked. Default 5. */
+    readonly accountThreshold?: number;
+    /** Failures per client address within the window before it is locked. Default 20. */
+    readonly clientThreshold?: number;
+    /** Window since the first failure after which the count restarts. Default 900 seconds. */
+    readonly windowSeconds?: number;
+    /** Longest single lock. Default 900 seconds. */
+    readonly maxLockSeconds?: number;
+}
+export interface SignInAttempt {
+    readonly account: string;
+    /** The client address; without it only the account is guarded. */
+    readonly client?: string;
+    readonly password: string;
+    /** Finds the account's user id and stored password hash, or null if there is no such account. */
+    readonly lookup: (db: DB, account: string) => Promise<{
+        userId: string;
+        passwordHash: string;
+    } | null>;
+}
+export type SignInResult = {
+    readonly ok: true;
+    readonly userId: string;
+    readonly needsRehash: boolean;
+} | {
+    readonly ok: false;
+    readonly reason: 'invalid' | 'locked';
+    readonly retryAfterSeconds?: number;
+};
+export interface SignIn {
+    attempt(input: SignInAttempt): Promise<SignInResult>;
+}
+/**
+ * Creates a guarded password sign-in. `attempt` needs an active Flow (a request,
+ * job or test context) and runs every statement, `lookup` included, on
+ * `pipe.system()`: outside the request transaction, committed on its own, so a
+ * route that answers a bad password by throwing `UnauthorizedError` (rolling the
+ * request back) still keeps the count. Failed attempts are counted per account and
+ * per client address in `pipework_signin_attempts` (blueprint `passwords: {}`), so
+ * counts survive restarts and are shared across processes. At the threshold each
+ * further failure locks the key for 2^(failures - threshold) seconds, capped at
+ * `maxLockSeconds`. Every attempt is counted, atomically per key, before the
+ * password is checked, so a burst of parallel guesses is locked out instead of
+ * all being verified. While any key is locked an attempt is refused with
+ * `reason: 'locked'` and `retryAfterSeconds`, without checking the password (a
+ * locked key is not counted further). A success deletes the account's key and
+ * gives the client key its count back. An unknown account runs a dummy verify
+ * and counts as a failure, reported as `'invalid'` like a wrong password.
+ *
+ * Tradeoff: locking is per account, so anyone who knows an account name can lock
+ * it out by failing on purpose. Each lock is capped (default 15 minutes) and the
+ * client key bounds how fast one address can do it.
+ *
+ * Every success, failure and refusal is logged, and audited (entity `SignIn`,
+ * verbs `success`, `fail`, `locked`; never the account string or password) when
+ * the Flow has an open trace step. Route a locked result to a 429 with
+ * `throw new TooManyRequestsError(result.retryAfterSeconds)`.
+ */
+export declare function createSignIn(config: SignInConfig): SignIn;
+//# sourceMappingURL=sign-in.d.ts.map

package/dist/auth/auth/sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.d.ts","sourceRoot":"","sources":["../../../src/auth/auth/sign-in.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAA;AAIhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,qFAAqF;IACrF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CACvG;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtG,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CACrD;AAID;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA0GzD"}