@_mustachio/openauth 0.9.2 → 0.10.0

package/dist/types/methods/oauth2-factory.d.ts

@@ -0,0 +1,133 @@
+/**
+ * `oauth2Factory` and `oidcFactory` — generic multi-tenant factories.
+ *
+ * Use these when each tenant brings its own OAuth 2.0 / OIDC issuer,
+ * client credentials, scopes, and endpoint URLs. The factory's
+ * `configSchema` accepts a per-tenant blob and `build()` delegates to
+ * `buildOauth2Method` / `buildOidcMethod` to produce the actual
+ * `AuthMethod`.
+ *
+ * For built-in vendor wrappers (Google, GitHub, Apple, etc.) see
+ * `./providers/*` — those bake in the issuer URL and provider quirks.
+ *
+ * For single-tenant deployments where the issuer / endpoints are
+ * compile-time constants, you can still call `buildOauth2Method` /
+ * `buildOidcMethod` directly inside your own `AuthMethodFactory` —
+ * those entry points are the underlying "build a static AuthMethod"
+ * primitives; this file just wraps them in the multi-tenant factory
+ * shape.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "./oauth2-generic";
+import type { AuthMethodFactory } from "../types/method";
+declare const oauth2ConfigSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString, "many">;
+    authorizationUrl: z.ZodString;
+    tokenUrl: z.ZodString;
+    jwksUri: z.ZodOptional<z.ZodString>;
+    expectedIssuer: z.ZodOptional<z.ZodString>;
+    extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    pkce: z.ZodOptional<z.ZodEnum<["S256", "none"]>>;
+    responseMode: z.ZodOptional<z.ZodEnum<["query", "form_post"]>>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    scopes: string[];
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientSecret?: string | undefined;
+    jwksUri?: string | undefined;
+    expectedIssuer?: string | undefined;
+    extraAuthorizeParams?: Record<string, string> | undefined;
+    pkce?: "S256" | "none" | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+}, {
+    clientId: string;
+    scopes: string[];
+    authorizationUrl: string;
+    tokenUrl: string;
+    clientSecret?: string | undefined;
+    jwksUri?: string | undefined;
+    expectedIssuer?: string | undefined;
+    extraAuthorizeParams?: Record<string, string> | undefined;
+    pkce?: "S256" | "none" | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+}>;
+export type Oauth2FactoryConfig = z.infer<typeof oauth2ConfigSchema>;
+/**
+ * Generic OAuth 2.0 factory.
+ *
+ * `kind: "oauth2"`. Use a different `MethodConfig.id` per instance to
+ * register multiple OAuth 2.0 upstreams against a single tenant.
+ */
+export declare const oauth2Factory: AuthMethodFactory<Oauth2Properties, Oauth2State, Oauth2FactoryConfig>;
+declare const oidcConfigSchema: z.ZodObject<{
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    pkce: z.ZodOptional<z.ZodEnum<["S256", "none"]>>;
+    responseMode: z.ZodOptional<z.ZodEnum<["query", "form_post"]>>;
+    /**
+     * Skip discovery and use these endpoints directly. Useful for
+     * providers with non-standard or fragmented discovery
+     * (Microsoft tenant-templated, legacy stacks).
+     */
+    endpoints: z.ZodOptional<z.ZodObject<{
+        authorization_endpoint: z.ZodString;
+        token_endpoint: z.ZodString;
+        jwks_uri: z.ZodString;
+        issuer: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+    }, {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    issuer: string;
+    clientId: string;
+    scopes?: string[] | undefined;
+    clientSecret?: string | undefined;
+    extraAuthorizeParams?: Record<string, string> | undefined;
+    pkce?: "S256" | "none" | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+    endpoints?: {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+    } | undefined;
+}, {
+    issuer: string;
+    clientId: string;
+    scopes?: string[] | undefined;
+    clientSecret?: string | undefined;
+    extraAuthorizeParams?: Record<string, string> | undefined;
+    pkce?: "S256" | "none" | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+    endpoints?: {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+    } | undefined;
+}>;
+export type OidcFactoryConfig = z.infer<typeof oidcConfigSchema>;
+/**
+ * Generic OIDC factory. Auto-discovers `<issuer>/.well-known/openid-
+ * configuration` unless `endpoints` is supplied.
+ *
+ * `kind: "oidc"`. Use a different `MethodConfig.id` per instance to
+ * register multiple OIDC upstreams against a single tenant.
+ */
+export declare const oidcFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, OidcFactoryConfig>;
+export {};
+//# sourceMappingURL=oauth2-factory.d.ts.map

package/dist/types/methods/oauth2-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-factory.d.ts","sourceRoot":"","sources":["../../../src/methods/oauth2-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAEpE,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWtB,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,mBAAmB,CA6BpB,CAAA;AAED,QAAA,MAAM,gBAAgB;;;;;;;;IAQpB;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASH,CAAA;AAEF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,EAAE,iBAAiB,CACzC,gBAAgB,EAChB,WAAW,EACX,iBAAiB,CAkClB,CAAA"}

package/dist/types/methods/oauth2-generic.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Decoded id_token claims surfaced through the public API. Structurally
+ * identical to `jose`'s `JWTPayload`, declared locally so consumers
+ * never depend on this package's specific `jose` version. All claim
+ * names are optional and weakly typed — runtime code should narrow with
+ * `typeof claims.sub === "string"` style checks before use.
+ */
+type IdTokenClaims = Record<string, unknown>;
+import type { AuthMethod } from "../types/method";
+import type { MethodType } from "../types/tenant";
+/** The payload every OAuth/OIDC method emits to the framework's `success` callback. */
+export type Oauth2Properties = {
+    tokens: {
+        access: string;
+        refresh?: string;
+        expiresIn?: number;
+        /** Present when the upstream returned an id_token (OIDC providers, some OAuth ones). */
+        idToken?: string;
+    };
+    /** Claims decoded from the id_token if one was returned. */
+    idTokenClaims?: IdTokenClaims;
+    /** Raw token-endpoint response. Surfaced for callers that need provider-specific fields. */
+    raw: Record<string, unknown>;
+};
+/** Method-private state carried on the FlowRecord through the round trip. */
+export type Oauth2State = {
+    /** PKCE verifier sent at /authorize; checked into the token-exchange body. */
+    pkceVerifier?: string;
+};
+export type Oauth2MethodInput = {
+    /** From `AuthMethodFactory.build({ id })`. */
+    id: string;
+    /** From `AuthMethodFactory.build({ kind })`. */
+    kind: string;
+    /** `MethodType` advertised in `MethodConfig.type`. Defaults to `"oauth2"`. */
+    type?: MethodType;
+    /** Upstream OAuth client id (per-tenant). */
+    clientId: string;
+    /** Upstream OAuth client secret (per-tenant). Public clients omit. */
+    clientSecret?: string;
+    /** Scopes to request. */
+    scopes: string[];
+    /** Upstream URLs. */
+    authorizationUrl: string;
+    tokenUrl: string;
+    /** JWKS URI for id_token verification. OIDC providers set this. */
+    jwksUri?: string;
+    /** Expected id_token issuer (used when `jwksUri` is set). */
+    expectedIssuer?: string;
+    /** Provider-specific query parameters appended to `/authorize`. */
+    extraAuthorizeParams?: Record<string, string>;
+    /**
+     * PKCE mode. `"S256"` is the OAuth 2.1 default; `"none"` skips PKCE for
+     * legacy upstreams that don't accept `code_challenge`.
+     */
+    pkce?: "S256" | "none";
+    /**
+     * `response_mode`. Apple requires `form_post` when requesting `name` /
+     * `email` scopes; most providers leave this unset.
+     */
+    responseMode?: "query" | "form_post";
+    /**
+     * Hook to map the token response + id_token claims into a stable
+     * provider subject id. Default: prefer `idTokenClaims.sub`, else
+     * `raw.user_id` / `raw.id`. Providers that compute the id differently
+     * (e.g. Discord stamps `id` on the userinfo) override here.
+     */
+    deriveSubject?: (input: {
+        raw: Record<string, unknown>;
+        idTokenClaims?: IdTokenClaims;
+    }) => string;
+};
+export declare function buildOauth2Method(opts: Oauth2MethodInput): Promise<AuthMethod<Oauth2Properties, Oauth2State>>;
+export {};
+//# sourceMappingURL=oauth2-generic.d.ts.map

package/dist/types/methods/oauth2-generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-generic.d.ts","sourceRoot":"","sources":["../../../src/methods/oauth2-generic.ts"],"names":[],"mappings":"AA8BA;;;;;;GAMG;AACH,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAG5C,OAAO,KAAK,EAAE,UAAU,EAA+B,MAAM,iBAAiB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,wFAAwF;QACxF,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;IACD,4DAA4D;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC7B,CAAA;AAED,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAA;IAEjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yBAAyB;IACzB,MAAM,EAAE,MAAM,EAAE,CAAA;IAEhB,qBAAqB;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC5B,aAAa,CAAC,EAAE,aAAa,CAAA;KAC9B,KAAK,MAAM,CAAA;CACb,CAAA;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CA6BpD"}

package/dist/types/methods/oidc-generic.d.ts

@@ -0,0 +1,26 @@
+import type { Oauth2MethodInput, Oauth2Properties, Oauth2State } from "./oauth2-generic";
+import type { AuthMethod } from "../types/method";
+type Endpoints = {
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    issuer: string;
+};
+export type OidcMethodInput = Omit<Oauth2MethodInput, "authorizationUrl" | "tokenUrl" | "jwksUri" | "expectedIssuer" | "type"> & {
+    /** Issuer URL — the framework appends `/.well-known/openid-configuration`. */
+    issuer: string;
+    /**
+     * Skip discovery and use these endpoints directly. Useful for providers
+     * with non-standard or fragmented discovery (Microsoft tenant-templated,
+     * legacy stacks).
+     */
+    endpoints?: Endpoints;
+};
+/**
+ * Async — the factory's `build()` awaits discovery if `endpoints` is not
+ * provided. Result is cached inside `MethodCache` until the tenant config
+ * is invalidated.
+ */
+export declare function buildOidcMethod(opts: OidcMethodInput): Promise<AuthMethod<Oauth2Properties, Oauth2State>>;
+export {};
+//# sourceMappingURL=oidc-generic.d.ts.map

package/dist/types/methods/oidc-generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-generic.d.ts","sourceRoot":"","sources":["../../../src/methods/oidc-generic.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACZ,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,KAAK,SAAS,GAAG;IACf,sBAAsB,EAAE,MAAM,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,iBAAiB,EACjB,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,CACxE,GAAG;IACF,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,UAAU,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAcpD"}

package/dist/types/methods/passkey.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `passkeyMethod` — WebAuthn factory using `@simplewebauthn/server`.
+ *
+ * Routes:
+ *   GET  /authorize                 → render the username form.
+ *   POST /authenticate-options      → mint challenge, return PublicKeyCredentialRequestOptionsJSON.
+ *   POST /authenticate-verify       → verify assertion, return success.
+ *   POST /register-options          → mint registration challenge, return options.
+ *   POST /register-verify           → verify attestation, persist credential.
+ *
+ * The framework knows nothing about credentials; the tenant supplies a
+ * `credentials` store. The method calls into it for lookups + writes. The
+ * RP id and origin are configured per factory at build time; multi-domain
+ * tenants instantiate multiple factories with distinct ids.
+ *
+ * Phase 4 ships the authentication ceremony end-to-end and exposes the
+ * registration helpers so the management console (Phase 7) can wire them
+ * up. Full registration UI / passkey enrollment flow polishes lands with
+ * the console.
+ */
+import { z } from "zod";
+import type { AuthMethodFactory } from "../types/method";
+export type PasskeyProperties = {
+    userId: string;
+    credentialId: string;
+};
+export type StoredCredential = {
+    /** Base64url credential id. */
+    credentialId: string;
+    /** Base64url public key. */
+    publicKey: string;
+    /** WebAuthn signature counter for replay protection. */
+    counter: number;
+    /** Optional transports hint stored at registration. */
+    transports?: string[];
+    userId: string;
+};
+export type PasskeyCredentialStore = {
+    findByUsername(username: string, tenantId: string): Promise<{
+        userId: string;
+        credentials: StoredCredential[];
+    } | null>;
+    findById(credentialId: string, tenantId: string): Promise<StoredCredential | null>;
+    /** Update the signature counter after a successful verification. */
+    updateCounter(input: {
+        credentialId: string;
+        counter: number;
+        tenantId: string;
+    }): Promise<void>;
+    /** Persist a newly-registered credential. */
+    create?(input: {
+        userId: string;
+        credential: StoredCredential;
+        tenantId: string;
+    }): Promise<void>;
+};
+export type PasskeyMethodOptions = {
+    /**
+     * Tenant-supplied credential store. The framework calls into it for
+     * lookups + writes; it knows nothing about how credentials are stored.
+     */
+    credentials: PasskeyCredentialStore;
+};
+export type PasskeyState = {
+    phase: "auth";
+    challenge: string;
+    username: string;
+} | {
+    phase: "register";
+    challenge: string;
+    userId: string;
+    username: string;
+};
+/**
+ * Per-tenant config. `rpID` is the WebAuthn Relying Party ID (the
+ * registrable domain — e.g. `"acme.example"`); each tenant typically
+ * runs on its own domain so this is per-tenant, not per-factory.
+ *
+ * `origins` is the list of accepted browser origins (HTTPS URLs).
+ * Multi-origin support is useful for tenants with both an app subdomain
+ * and a marketing domain that both terminate at the IdP.
+ */
+declare const configSchema: z.ZodObject<{
+    /** Display name shown by the authenticator UI. */
+    rpName: z.ZodString;
+    /** Relying Party ID — the registrable domain. */
+    rpID: z.ZodString;
+    /** Accepted origin(s). Either a single URL or an array of URLs. */
+    origins: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>;
+    /** Form title override. */
+    title: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    rpName: string;
+    rpID: string;
+    origins: string | string[];
+    title?: string | undefined;
+}, {
+    rpName: string;
+    rpID: string;
+    origins: string | string[];
+    title?: string | undefined;
+}>;
+type PasskeyConfig = z.infer<typeof configSchema>;
+export declare function passkeyMethod(opts: PasskeyMethodOptions): AuthMethodFactory<PasskeyProperties, PasskeyState, PasskeyConfig>;
+export {};
+//# sourceMappingURL=passkey.d.ts.map

package/dist/types/methods/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/methods/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAQvB,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,cAAc,CACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IACtE,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACnC,oEAAoE;IACpE,aAAa,CAAC,KAAK,EAAE;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjB,6CAA6C;IAC7C,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,MAAM,EAAE,MAAM,CAAA;QACd,UAAU,EAAE,gBAAgB,CAAA;QAC5B,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,WAAW,EAAE,sBAAsB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E;;;;;;;;GAQG;AACH,QAAA,MAAM,YAAY;IAChB,kDAAkD;;IAElD,iDAAiD;;IAEjD,mEAAmE;;IAEnE,2BAA2B;;;;;;;;;;;;EAE3B,CAAA;AACF,KAAK,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAkBjD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,iBAAiB,EAAE,YAAY,EAAE,aAAa,CAAC,CAiDnE"}

package/dist/types/methods/password-hash.d.ts

@@ -0,0 +1,25 @@
+export type PasswordHasher = {
+    /** Hash the password; output includes salt + parameters. */
+    hash(plain: string): Promise<string>;
+    /** Verify a plain password against a previously stored hash. */
+    verify(plain: string, stored: string): Promise<boolean>;
+};
+export type Argon2idParams = {
+    /** Time cost. RFC 9106 §4 recommends `t=3` for the 64 MiB profile. */
+    t: number;
+    /** Memory cost in KiB. RFC 9106 §4 recommends `65536` (64 MiB). */
+    m: number;
+    /** Parallelism. RFC 9106 §4 recommends `4`. */
+    p: number;
+    /** Output length in bytes. 32 is standard. */
+    dkLen: number;
+    /** Salt length in bytes. 16 is the RFC 9106 minimum. */
+    saltLen: number;
+};
+export declare const DEFAULT_ARGON2ID_PARAMS: Argon2idParams;
+/**
+ * Build an argon2id `PasswordHasher`. Stored hashes use the canonical PHC
+ * string format so they're interoperable with any RFC 9106 implementation.
+ */
+export declare function argon2idHasher(params?: Partial<Argon2idParams>): PasswordHasher;
+//# sourceMappingURL=password-hash.d.ts.map

package/dist/types/methods/password-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.d.ts","sourceRoot":"","sources":["../../../src/methods/password-hash.ts"],"names":[],"mappings":"AAwBA,MAAM,MAAM,cAAc,GAAG;IAC3B,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpC,gEAAgE;IAChE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,sEAAsE;IACtE,CAAC,EAAE,MAAM,CAAA;IACT,mEAAmE;IACnE,CAAC,EAAE,MAAM,CAAA;IACT,+CAA+C;IAC/C,CAAC,EAAE,MAAM,CAAA;IACT,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,cAMrC,CAAA;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,MAAM,GAAE,OAAO,CAAC,cAAc,CAAM,GACnC,cAAc,CAiChB"}

package/dist/types/methods/password.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `passwordMethod` — username + password credential factory.
+ *
+ * Routes:
+ *   GET  /authorize   → render login form
+ *   POST /login       → verify credentials
+ *   POST /register    → create user + sign in
+ *
+ * Forgot / reset flows land in Phase 5 alongside email-sender infra (they
+ * share the same `sendEmail`-style hook the magic-code method uses).
+ *
+ * Storage: the framework does NOT own the user record. Users supply a
+ * `users` interface (lookup / create / setPassword); the method calls into
+ * it. Hashes are stored via the supplied `users.setPassword` hook so apps
+ * can keep them in the same row as the rest of their user data.
+ *
+ * Hashing: argon2id by default (`@noble/hashes/argon2`). Pluggable via
+ * `passwordMethod({ hasher: customHasher })` for migrations.
+ */
+import { z } from "zod";
+import { type PasswordHasher } from "./password-hash";
+import type { AuthMethodFactory } from "../types/method";
+export type PasswordProperties = {
+    /** The user's lookup key (typically their email). */
+    email: string;
+    /** Optional extra claims the user store returned alongside the record. */
+    claims?: Record<string, unknown>;
+};
+export type PasswordState = {
+    /** Most-recent error message to surface on re-render. */
+    error?: string;
+};
+export type PasswordUser = {
+    /** Stable internal id (provider subject). */
+    id: string;
+    /** Argon2id-format hash. Compared via the configured hasher. */
+    passwordHash: string;
+    /** Optional extra claims that ride along to the IdP's success callback. */
+    claims?: Record<string, unknown>;
+};
+export type PasswordUserStore = {
+    /** Look up a user by email; `null` if unknown. */
+    findByEmail(email: string, tenantId: string): Promise<PasswordUser | null>;
+    /**
+     * Optional — only required if `enableRegistration: true`. Should create
+     * the row and return the persisted user. Implementations decide how to
+     * race with concurrent registrations.
+     */
+    create?(input: {
+        email: string;
+        passwordHash: string;
+        tenantId: string;
+    }): Promise<PasswordUser>;
+};
+export type PasswordMethodOptions = {
+    /** The tenant-supplied user store. */
+    users: PasswordUserStore;
+    /** Override the default argon2id hasher. */
+    hasher?: PasswordHasher;
+    /** Allow `POST /register` to create new users. Default: false. */
+    enableRegistration?: boolean;
+    /** Display title for the form. */
+    title?: string;
+};
+/** Tenant-supplied config is empty for password — users + hasher live on the factory closure. */
+declare const configSchema: z.ZodObject<{}, "strict", z.ZodTypeAny, {}, {}>;
+type PasswordConfig = z.infer<typeof configSchema>;
+export declare function passwordMethod(opts: PasswordMethodOptions): AuthMethodFactory<PasswordProperties, PasswordState, PasswordConfig>;
+export {};
+//# sourceMappingURL=password.d.ts.map

package/dist/types/methods/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../src/methods/password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrE,OAAO,KAAK,EAEV,iBAAiB,EAGlB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,kDAAkD;IAClD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC1E;;;;OAIG;IACH,MAAM,CAAC,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAA;QACb,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,sCAAsC;IACtC,KAAK,EAAE,iBAAiB,CAAA;IACxB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,kEAAkE;IAClE,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,kCAAkC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,iGAAiG;AACjG,QAAA,MAAM,YAAY,iDAAwB,CAAA;AAC1C,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAYlD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CAAC,kBAAkB,EAAE,aAAa,EAAE,cAAc,CAAC,CAwCtE"}

package/dist/types/methods/providers/apple.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Apple — OIDC. Auto-discovers from `https://appleid.apple.com`.
+ *
+ * Apple requires `response_mode=form_post` when `name` / `email` scopes
+ * are requested. Pass `responseMode: "form_post"` when those scopes are
+ * in play; default is `query`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    responseMode: z.ZodOptional<z.ZodEnum<["query", "form_post"]>>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    responseMode?: "query" | "form_post" | undefined;
+}>;
+export declare const appleFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=apple.d.ts.map

package/dist/types/methods/providers/apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/apple.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;EAKV,CAAA;AAEF,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAC1C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/cognito.d.ts

@@ -0,0 +1,36 @@
+/**
+ * AWS Cognito — OIDC. The `domain` is the Cognito user-pool domain
+ * (without protocol), e.g. `"my-pool.auth.us-east-1.amazoncognito.com"`.
+ *
+ * Cognito's OIDC discovery is at
+ * `https://cognito-idp.<region>.amazonaws.com/<userPoolId>/.well-known/openid-configuration`
+ * (NOT the user-pool domain). Callers supply the user-pool domain for the
+ * OAuth endpoints AND the issuer URL for discovery / id_token validation.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+    /** Cognito user-pool hosted UI domain (no protocol). */
+    domain: z.ZodString;
+    /** Issuer URL, e.g. `https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xyz`. */
+    issuer: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    issuer: string;
+    clientId: string;
+    domain: string;
+    scopes?: string[] | undefined;
+    clientSecret?: string | undefined;
+}, {
+    issuer: string;
+    clientId: string;
+    domain: string;
+    scopes?: string[] | undefined;
+    clientSecret?: string | undefined;
+}>;
+export declare const cognitoFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=cognito.d.ts.map

package/dist/types/methods/providers/cognito.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cognito.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/cognito.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;IAGV,wDAAwD;;IAExD,oFAAoF;;;;;;;;;;;;;;;EAGpF,CAAA;AAEF,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAC5C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CA0BvB,CAAA"}

package/dist/types/methods/providers/discord.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Discord — OAuth 2.0. Default scopes: `identify email`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const discordFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=discord.d.ts.map

package/dist/types/methods/providers/discord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/discord.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,cAAc,EAAE,iBAAiB,CAC5C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAkBvB,CAAA"}

package/dist/types/methods/providers/facebook.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Facebook — OAuth 2.0. Default scopes: `email public_profile`.
+ *
+ * Facebook also exposes an OIDC discovery doc at
+ * `https://graph.facebook.com`, but the canonical app integration uses
+ * the OAuth 2.0 endpoints below. Pass `useOidc: true` to switch to OIDC.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    useOidc: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    useOidc?: boolean | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    useOidc?: boolean | undefined;
+}>;
+export declare const facebookFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=facebook.d.ts.map

package/dist/types/methods/providers/facebook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facebook.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/facebook.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;EAKV,CAAA;AAEF,eAAO,MAAM,eAAe,EAAE,iBAAiB,CAC7C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CA6BvB,CAAA"}

package/dist/types/methods/providers/github.d.ts

@@ -0,0 +1,25 @@
+/**
+ * GitHub — OAuth 2.0. No id_token; user info via the REST API in the
+ * `success` callback if needed.
+ *
+ * Default scopes: `read:user user:email`.
+ */
+import { z } from "zod";
+import type { Oauth2Properties, Oauth2State } from "../oauth2-generic";
+import type { AuthMethodFactory } from "../../types/method";
+declare const schema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}, {
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+}>;
+export declare const githubFactory: AuthMethodFactory<Oauth2Properties, Oauth2State, z.infer<typeof schema>>;
+export {};
+//# sourceMappingURL=github.d.ts.map

package/dist/types/methods/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../../src/methods/providers/github.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEvE,QAAA,MAAM,MAAM;;;;;;;;;;;;EAIV,CAAA;AAEF,eAAO,MAAM,aAAa,EAAE,iBAAiB,CAC3C,gBAAgB,EAChB,WAAW,EACX,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAoBvB,CAAA"}