@ambushsoftworks/nestjs-auth-graphql 0.17.0-rc.1 → 0.17.0

package/CHANGELOG.md

@@ -27,6 +27,133 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.17.0] - 2026-10-02
+
+Passwordless sign-up with a passkey, a step-up token on sign-in, and fixes for
+**account enumeration in password reset and email verification** (present in
+every earlier version). Identical to `0.17.0-rc.2`, which LiftIQ piloted on
+staging and an Android device. This entry is the summary for anyone coming from
+0.16.x; the two release-candidate entries below have the detail.
+
+### ⚠ Security
+
+- **Password reset and email verification revealed which addresses have
+  accounts**: through a lock or social-only error, a cooldown only real accounts
+  had, account checks before the code, a password-strength error, response
+  timing, and "already verified". Every signed-out, email-keyed flow now answers
+  alike for every address. **If you are on 0.16.x or earlier, upgrade.**
+
+### ⚠ External configuration required
+
+Only for passwordless sign-up:
+- `PasskeyChallenge.userId` must not be a foreign key to users
+  (`assertPasskeyRepositoryContract` checks it).
+- `IUserRepository.create` must store the `emailVerified` it is given, and
+  `IUserRepository.delete` must work.
+- The email service needs `sendSignupCodeEmail` (`ConfigurableEmailService` has
+  it with the default renderer).
+
+### Added
+
+- **Passwordless sign-up**: `performStartPasskeySignup` →
+  `performVerifyPasskeySignupCode` (returns a verified `signupId`) →
+  `performCompletePasskeySignup`, plus `performPasskeySignupOptions` to retry
+  the passkey step without the code. The account exists only once its passkey
+  does.
+- **`stepUp.issueOnLogin`**: fresh sign-ins return a step-up token, so an app can
+  offer "Create a passkey?" without a second proof. Never from a refresh or the
+  biometric login.
+- **`retryAfterSeconds` on every `RATE_LIMIT_EXCEEDED`.**
+- New codes: `PASSWORD_RESET_CODE_INVALID`, `EMAIL_VERIFICATION_CODE_INVALID`,
+  the `PASSKEY_SIGNUP_*` family; `VERIFICATION_CODE_*` now used for signed-in
+  code checks.
+
+### Changed — breaking
+
+- **Code failures are no longer `UNAUTHENTICATED`.** Password reset and
+  verify-email each report one code for every failure (no remaining-attempts
+  count); verify-phone and step-up by email report `VERIFICATION_CODE_INVALID` /
+  `_EXPIRED` / `_EXHAUSTED`. Update any client logic that matched
+  `UNAUTHENTICATED` or the old messages.
+- `requestPasswordReset` no longer throws for a locked account, and its cooldown
+  applies to every address. `verifyEmail` refuses an already verified address.
+  `resendVerificationEmail` answers alike for every address.
+- A misconfigured per-realm `verification.baseUrl` is logged through
+  `IAuthLogger.error` instead of failing the request.
+- `PasskeyChallengePurpose` includes `'signup'`; `StepUpMethod` includes
+  `'oauth'`; `AuthRateLimitException` requires `retryAfterSeconds`.
+
+### Upgrading from an RC
+
+From rc.1: read the rc.2 entry (codes changed, and step 3 of sign-up needs the
+verified `signupId`). From rc.2: nothing changes.
+
+## [0.17.0-rc.2] - 2026-10-02
+
+Fixes from LiftIQ's pilot of rc.1, chiefly **account enumeration in password
+reset and email verification**. Those flaws are older than 0.17: every released
+version has them. Still a release candidate on `next`.
+
+### ⚠ Security
+
+- **Password reset revealed which addresses have accounts.**
+  `requestPasswordReset` answered an existing account differently: a locked one
+  with `AccountLockedException`, and a second request within a minute with a 429
+  (the cooldown lived on the user record, so only real accounts had one). It also
+  answered a real account slower, because it waited for the email.
+  `resetPassword` looked the account up before checking the code: an unknown
+  address, a locked account, a social-only account and a weak new password each
+  answered differently to a junk code. Now:
+  - one answer for every address from `requestPasswordReset`, a locked or
+    social-only account included (no code sent to either);
+  - the 60-second cooldown per email address, for every address, in the rate
+    limiter;
+  - the email sent in the background;
+  - in `resetPassword`, password strength checked first (for everyone; it no
+    longer spends a valid code), then the code, then account state;
+  - **every** reset refusal is `PASSWORD_RESET_CODE_INVALID` (400), with no
+    remaining-attempts count, since anyone can request a reset for any address
+    first and probe.
+- **Email verification revealed the same.** `verifyEmail` and
+  `resendVerificationEmail` answered `Invalid email address` for an unknown
+  address and `Email is already verified` for a verified one. Now resend answers
+  alike for every address (per-email cooldown in the rate limiter, send in the
+  background), and verify refuses every failure with
+  `EMAIL_VERIFICATION_CODE_INVALID` (400), an already verified address included.
+
+### Changed — breaking
+
+- **Code failures are no longer `UNAUTHENTICATED`.** Clients read that as an
+  expired session and refresh-and-retry. Verify-phone and step-up by email now
+  report `VERIFICATION_CODE_INVALID` (with `remainingAttempts`),
+  `VERIFICATION_CODE_EXPIRED` or `VERIFICATION_CODE_EXHAUSTED`; password reset
+  and verify-email report their single codes above.
+- **Passwordless sign-up: step 2 returns a verified `signupId`, and completion
+  requires it.** Keep the one `performVerifyPasskeySignupCode` returns. With it,
+  the new `performPasskeySignupOptions({ signupId })` fetches fresh passkey
+  options without the code and without spending an attempt, for a cancelled or
+  timed-out device sheet. The verified id keeps the original 15-minute expiry.
+  Completion failures are now `PASSKEY_SIGNUP_CHALLENGE_EXPIRED` (fetch new
+  options) or `PASSKEY_SIGNUP_VERIFICATION_FAILED`, not a bare
+  `Passkey registration failed`; and `PASSKEY_SIGNUP_CODE_REQUIRED` for an
+  unverified id.
+- A misconfigured per-realm `verification.baseUrl` no longer fails the
+  `requestPasswordReset` / `resendVerificationEmail` call (only real accounts
+  could reach it, so the error revealed them). It is logged through
+  `IAuthLogger.error` and no unusable email is sent.
+
+### Added
+
+- **`retryAfterSeconds` on every `RATE_LIMIT_EXCEEDED`**: login and OAuth IP
+  limits, passkey options, passwordless sign-up, step-up.
+  `AuthRateLimitException` now requires it.
+  `BruteForceProtectionService.checkIpRateLimitWithRetry` returns it;
+  `checkIpRateLimit` keeps its boolean.
+- `PasswordResetCodeInvalidException`, `EmailVerificationCodeInvalidException`,
+  `PasskeySignupCodeRequiredException`,
+  `PasskeySignupChallengeExpiredException`,
+  `PasskeySignupVerificationFailedException`.
+
 ## [0.17.0-rc.1] - 2026-10-01
 
 Passwordless sign-up with a passkey, and an optional step-up token on sign-in.

package/README.md

@@ -288,7 +288,8 @@ When cookie auth is enabled, pass the GraphQL `context` so tokens are set as Htt
 | `performRenamePasskey(user, input, context?)` | Rename one |
 | `performRemovePasskey(user, input, context?)` | Remove one (refused for the last way in) |
 | `performStartPasskeySignup(input, context?)` | Passwordless sign-up, step 1: email a code (public) |
-| `performVerifyPasskeySignupCode(input, context?)` | Step 2: check the code, get passkey creation options (public) |
+| `performVerifyPasskeySignupCode(input, context?)` | Step 2: check the code, get passkey creation options and a verified `signupId` (public) |
+| `performPasskeySignupOptions(input, context?)` | Fresh options for a verified sign-up, no code (public) |
 | `performCompletePasskeySignup(input, context?)` | Step 3: create the account with its passkey and sign in (public) |
 
 **Other:**
@@ -925,7 +926,11 @@ It sits beside `useFactory` because Nest fixes a module's controllers before asy
 | 409 | `OAUTH_ACCOUNT_ALREADY_LINKED` | The account has a different ID linked for this provider | `provider` |
 | 403 | `ACCOUNT_LOCKED` | Brute-force lockout | `remainingLockoutTime` (seconds) |
 | 403 | `ACCOUNT_INACTIVE` | The account is suspended or deleted | -- |
-| 429 | `RATE_LIMIT_EXCEEDED` | The client IP exceeded `bruteForce.ipRateLimit` | -- |
+| 429 | `RATE_LIMIT_EXCEEDED` | The client IP exceeded `bruteForce.ipRateLimit` | `retryAfterSeconds` |
+
+Every `RATE_LIMIT_EXCEEDED` the package raises, here and over GraphQL (login,
+passkey, sign-up, step-up), carries `retryAfterSeconds`, the time left in the
+window, for a countdown.
 
 With realms enabled, a request without a realm gets `400 Realm required` first. Before 0.10.0 the lockout, inactive-account, rate-limit and unconfigured-provider cases answered 500.
 
@@ -1356,11 +1361,18 @@ abandoned sign-up leaves nothing behind.
 
 ```
 performStartPasskeySignup({ email })                     -> { signupId, expiresAt }   (emails a 6-digit code)
-performVerifyPasskeySignupCode({ signupId, code })       -> { challengeId, optionsJson }
+performVerifyPasskeySignupCode({ signupId, code })       -> { challengeId, optionsJson, signupId }   (verified)
 client: navigator.credentials.create(...)
 performCompletePasskeySignup({ signupId, challengeId, responseJson, name? }) -> AuthResponse
+
+after a cancelled or timed-out device sheet (PASSKEY_SIGNUP_CHALLENGE_EXPIRED):
+performPasskeySignupOptions({ signupId })                -> { challengeId, optionsJson, signupId }   (no code)
 ```
 
+**Keep the `signupId` step 2 returns**: it is marked as having passed its code,
+with the same expiry. Completion and fresh options accept only that one, and
+neither spends a code attempt, so a cancelled sheet costs the user nothing.
+
 The result is an account with no password, `emailVerified: true`, and one
 passkey, signed in exactly as `performLogin` signs in (cookies included).
 Available when passkeys are configured and the email service has
@@ -1384,8 +1396,19 @@ renderer); otherwise `PASSKEY_SIGNUP_UNAVAILABLE`.
 | `PASSKEY_SIGNUP_CODE_EXHAUSTED` | 429 | Third attempt used |
 | `PASSKEY_SIGNUP_EXPIRED` | 400 | `signupId` expired, malformed, or from another realm |
 | `PASSKEY_SIGNUP_EMAIL_TAKEN` | 409 | The email gained an account during the sign-up (only reachable with the code) |
+| `PASSKEY_SIGNUP_CODE_REQUIRED` | 400 | Options or completion with a `signupId` whose code was not checked: use the one step 2 returned |
+| `PASSKEY_SIGNUP_CHALLENGE_EXPIRED` | 400 | The passkey options expired or were used: fetch new ones with `performPasskeySignupOptions` |
+| `PASSKEY_SIGNUP_VERIFICATION_FAILED` | 400 | The created passkey did not verify |
 | `PASSKEY_SIGNUP_UNAVAILABLE` | 503 | No passkeys, or no `sendSignupCodeEmail` |
 
+**An expired challenge can leave an orphaned passkey.** If the options expire
+(`passkey.registrationTimeoutSeconds`, 300 s by default) while the device's
+passkey sheet is still open, the platform may already have saved the passkey
+when the app gets `PASSKEY_SIGNUP_CHALLENGE_EXPIRED`. The retry then creates a
+second one, and the first stays in the user's password manager with no account
+behind it. Neither side can prevent this; it is rare at the default timeout.
+Reported by LiftIQ on Android.
+
 **What your repositories must do for it:**
 - `IUserRepository.create` must store the `emailVerified` it is given (the
   OAuth sign-up already relies on this).
@@ -1577,27 +1600,59 @@ None of this is configurable, and most of it is invisible until it bites:
 | Code | 6 digits, HMAC-SHA256 hashed at rest, never logged |
 | Expiry | 15 minutes |
 | Attempts | **3**, then the code is destroyed and a new one must be requested |
-| Per-user cooldown | 60 seconds, tracked on `passwordResetSentAt` |
+| Per-email cooldown | 60 seconds, for **every** address, in the rate limiter (`retryAfterSeconds` on the 429) |
 | Per-IP limit | 5 per hour, checked **before** the user lookup |
+| Sending | In the background, so a real account does not answer slower than an unknown one |
+| New-password strength | Checked first, for everyone, before the account or the code |
 | On success | **every refresh token for that user is revoked** — all devices are signed out |
 | Comparison | constant-time |
 
 The IP limit runs before the lookup deliberately: checking it afterwards would
 make a request for a non-existent address measurably faster than one for a real
 address, which is the enumeration leak the generic message exists to prevent.
+The same reasoning moved the cooldown off the user record and the email into
+the background in 0.17.0.
 
 #### The response never tells you what happened
 
 `requestPasswordReset` returns the same success payload whether the address does
-not exist, belongs to a social-login account, or was actually sent a code. That
-is deliberate — the mutation is reachable unauthenticated, so any distinguishable
-result is an oracle for whether an address is registered.
+not exist, belongs to a social-login or a locked account, or was actually sent a
+code. `resetPassword` refuses **every** failure with the same
+`PASSWORD_RESET_CODE_INVALID` (400): an unknown address, a wrong, expired or
+exhausted code, a locked or social-only account; no remaining-attempts count.
+That is deliberate — both are reachable unauthenticated, and anyone may request a
+reset for any address first, so any distinguishable result is an oracle for
+whether an address is registered. Show "Code invalid or expired. Request a new
+one." Until 0.17.0 a locked account, a social-only account, the cooldown and
+the password-strength check each answered differently.
 
 If you need to know, read your `IAuthLogger`. A skip is reported as
-`PASSWORD_RESET_REQUESTED` with `result: 'SKIPPED_SOCIAL_ONLY'` and the user ID.
+`PASSWORD_RESET_REQUESTED` with `result: 'SKIPPED_SOCIAL_ONLY'` or
+`'SKIPPED_LOCKED'` and the user ID.
 An operator tool that creates accounts and invites by reset should assert on that
 event, not on the mutation's return value.
 
+#### Verify-email works the same way
+
+`performVerifyEmail(email, code)` and `performResendVerificationEmail(email)`
+are keyed by an address and reachable signed out, so since 0.17.0 they follow
+the same rules: resend answers alike for every address (unknown and already
+verified ones are sent nothing), with the per-email cooldown in the rate limiter
+and the send in the background; verify refuses every failure with
+`EMAIL_VERIFICATION_CODE_INVALID` (400), including an address that is already
+verified.
+
+#### Which code a verification failure reports
+
+None is `UNAUTHENTICATED`, which clients treat as an expired session to refresh
+and retry.
+
+| Flow | Caller | Failures |
+|---|---|---|
+| Password reset | Signed out, keyed by email | `PASSWORD_RESET_CODE_INVALID`, always |
+| Verify email | Signed out, keyed by email | `EMAIL_VERIFICATION_CODE_INVALID`, always |
+| Verify phone, step-up by email | Signed in | `VERIFICATION_CODE_INVALID` (with `remainingAttempts`), `VERIFICATION_CODE_EXPIRED`, `VERIFICATION_CODE_EXHAUSTED` |
+
 #### Accounts with no password
 
 An account is refused only if it has an actual social identity — `googleId`,

package/dist/dto/passkey.dto.d.ts

@@ -51,6 +51,14 @@ export interface IAuthVerifyPasskeySignupCodeInput {
     signupId: string;
     code: string;
 }
+export interface IAuthPasskeySignupOptionsResponse {
+    challengeId: string;
+    optionsJson: string;
+    signupId: string;
+}
+export interface IAuthPasskeySignupOptionsInput {
+    signupId: string;
+}
 export interface IAuthCompletePasskeySignupInput {
     signupId: string;
     challengeId: string;

package/dist/dto/passkey.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.dto.d.ts","sourceRoot":"","sources":["../../src/dto/passkey.dto.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAGlD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oCAAoC;IAEnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;IAErB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,cAAc,GAAG,aAAa,CAAC;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAGD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;IAErB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"passkey.dto.d.ts","sourceRoot":"","sources":["../../src/dto/passkey.dto.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAGlD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oCAAoC;IAEnD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;IAErB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,cAAc,GAAG,aAAa,CAAC;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAGD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAOD,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAEpB,YAAY,EAAE,MAAM,CAAC;IAErB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/exceptions/passkey.exceptions.d.ts

@@ -23,4 +23,13 @@ export declare class PasskeySignupEmailTakenException extends GraphQLError {
 export declare class PasskeySignupUnavailableException extends GraphQLError {
     constructor();
 }
+export declare class PasskeySignupCodeRequiredException extends GraphQLError {
+    constructor();
+}
+export declare class PasskeySignupChallengeExpiredException extends GraphQLError {
+    constructor();
+}
+export declare class PasskeySignupVerificationFailedException extends GraphQLError {
+    constructor();
+}
 //# sourceMappingURL=passkey.exceptions.d.ts.map

package/dist/exceptions/passkey.exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/passkey.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,qBAAa,oCAAqC,SAAQ,YAAY;;CAMrE;AAOD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE;AAQD,qBAAa,mCAAoC,SAAQ,YAAY;;CAMpE;AAQD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE;AAMD,qBAAa,mCAAoC,SAAQ,YAAY;;CAMpE;AAMD,qBAAa,6BAA8B,SAAQ,YAAY;;CAM9D;AAOD,qBAAa,gCAAiC,SAAQ,YAAY;;CAMjE;AAQD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE"}
+{"version":3,"file":"passkey.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/passkey.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,qBAAa,oCAAqC,SAAQ,YAAY;;CAMrE;AAOD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE;AAQD,qBAAa,mCAAoC,SAAQ,YAAY;;CAMpE;AAQD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE;AAMD,qBAAa,mCAAoC,SAAQ,YAAY;;CAMpE;AAMD,qBAAa,6BAA8B,SAAQ,YAAY;;CAM9D;AAOD,qBAAa,gCAAiC,SAAQ,YAAY;;CAMjE;AAQD,qBAAa,iCAAkC,SAAQ,YAAY;;CAMlE;AAOD,qBAAa,kCAAmC,SAAQ,YAAY;;CAMnE;AAOD,qBAAa,sCAAuC,SAAQ,YAAY;;CAMvE;AAOD,qBAAa,wCAAyC,SAAQ,YAAY;;CAMzE"}

package/dist/exceptions/passkey.exceptions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PasskeySignupUnavailableException = exports.PasskeySignupEmailTakenException = exports.PasskeySignupExpiredException = exports.PasskeySignupCodeExhaustedException = exports.PasskeySignupCodeInvalidException = exports.CannotRemoveLastAuthMethodException = exports.PasskeyAlreadyRegisteredException = exports.PasskeyAuthenticationFailedException = void 0;
+exports.PasskeySignupVerificationFailedException = exports.PasskeySignupChallengeExpiredException = exports.PasskeySignupCodeRequiredException = exports.PasskeySignupUnavailableException = exports.PasskeySignupEmailTakenException = exports.PasskeySignupExpiredException = exports.PasskeySignupCodeExhaustedException = exports.PasskeySignupCodeInvalidException = exports.CannotRemoveLastAuthMethodException = exports.PasskeyAlreadyRegisteredException = exports.PasskeyAuthenticationFailedException = void 0;
 const graphql_1 = require("graphql");
 class PasskeyAuthenticationFailedException extends graphql_1.GraphQLError {
     constructor() {
@@ -66,4 +66,28 @@ class PasskeySignupUnavailableException extends graphql_1.GraphQLError {
     }
 }
 exports.PasskeySignupUnavailableException = PasskeySignupUnavailableException;
+class PasskeySignupCodeRequiredException extends graphql_1.GraphQLError {
+    constructor() {
+        super('Enter the emailed code first', {
+            extensions: { code: 'PASSKEY_SIGNUP_CODE_REQUIRED', statusCode: 400 },
+        });
+    }
+}
+exports.PasskeySignupCodeRequiredException = PasskeySignupCodeRequiredException;
+class PasskeySignupChallengeExpiredException extends graphql_1.GraphQLError {
+    constructor() {
+        super('The passkey request expired. Try again', {
+            extensions: { code: 'PASSKEY_SIGNUP_CHALLENGE_EXPIRED', statusCode: 400 },
+        });
+    }
+}
+exports.PasskeySignupChallengeExpiredException = PasskeySignupChallengeExpiredException;
+class PasskeySignupVerificationFailedException extends graphql_1.GraphQLError {
+    constructor() {
+        super('The passkey could not be verified', {
+            extensions: { code: 'PASSKEY_SIGNUP_VERIFICATION_FAILED', statusCode: 400 },
+        });
+    }
+}
+exports.PasskeySignupVerificationFailedException = PasskeySignupVerificationFailedException;
 //# sourceMappingURL=passkey.exceptions.js.map

package/dist/exceptions/passkey.exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/passkey.exceptions.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAgBvC,MAAa,oCAAqC,SAAQ,sBAAY;IACpE;QACE,KAAK,CAAC,+BAA+B,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,GAAG,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;CACF;AAND,oFAMC;AAOD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,oCAAoC,EAAE;YAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC;AAQD,MAAa,mCAAoC,SAAQ,sBAAY;IACnE;QACE,KAAK,CAAC,wCAAwC,EAAE;YAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,UAAU,EAAE,GAAG,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;CACF;AAND,kFAMC;AAQD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,uBAAuB,EAAE;YAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC;AAMD,MAAa,mCAAoC,SAAQ,sBAAY;IACnE;QACE,KAAK,CAAC,2DAA2D,EAAE;YACjE,UAAU,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,GAAG,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;CACF;AAND,kFAMC;AAMD,MAAa,6BAA8B,SAAQ,sBAAY;IAC7D;QACE,KAAK,CAAC,uCAAuC,EAAE;YAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;CACF;AAND,sEAMC;AAOD,MAAa,gCAAiC,SAAQ,sBAAY;IAChE;QACE,KAAK,CAAC,2CAA2C,EAAE;YACjD,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,4EAMC;AAQD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,kCAAkC,EAAE;YACxC,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC"}
+{"version":3,"file":"passkey.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/passkey.exceptions.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAgBvC,MAAa,oCAAqC,SAAQ,sBAAY;IACpE;QACE,KAAK,CAAC,+BAA+B,EAAE;YACrC,UAAU,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,GAAG,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;CACF;AAND,oFAMC;AAOD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,oCAAoC,EAAE;YAC1C,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC;AAQD,MAAa,mCAAoC,SAAQ,sBAAY;IACnE;QACE,KAAK,CAAC,wCAAwC,EAAE;YAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,UAAU,EAAE,GAAG,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;CACF;AAND,kFAMC;AAQD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,uBAAuB,EAAE;YAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC;AAMD,MAAa,mCAAoC,SAAQ,sBAAY;IACnE;QACE,KAAK,CAAC,2DAA2D,EAAE;YACjE,UAAU,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,UAAU,EAAE,GAAG,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;CACF;AAND,kFAMC;AAMD,MAAa,6BAA8B,SAAQ,sBAAY;IAC7D;QACE,KAAK,CAAC,uCAAuC,EAAE;YAC7C,UAAU,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE;SAChE,CAAC,CAAC;IACL,CAAC;CACF;AAND,sEAMC;AAOD,MAAa,gCAAiC,SAAQ,sBAAY;IAChE;QACE,KAAK,CAAC,2CAA2C,EAAE;YACjD,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,4EAMC;AAQD,MAAa,iCAAkC,SAAQ,sBAAY;IACjE;QACE,KAAK,CAAC,kCAAkC,EAAE;YACxC,UAAU,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF;AAND,8EAMC;AAOD,MAAa,kCAAmC,SAAQ,sBAAY;IAClE;QACE,KAAK,CAAC,8BAA8B,EAAE;YACpC,UAAU,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;CACF;AAND,gFAMC;AAOD,MAAa,sCAAuC,SAAQ,sBAAY;IACtE;QACE,KAAK,CAAC,wCAAwC,EAAE;YAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,UAAU,EAAE,GAAG,EAAE;SAC1E,CAAC,CAAC;IACL,CAAC;CACF;AAND,wFAMC;AAOD,MAAa,wCAAyC,SAAQ,sBAAY;IACxE;QACE,KAAK,CAAC,mCAAmC,EAAE;YACzC,UAAU,EAAE,EAAE,IAAI,EAAE,oCAAoC,EAAE,UAAU,EAAE,GAAG,EAAE;SAC5E,CAAC,CAAC;IACL,CAAC;CACF;AAND,4FAMC"}

package/dist/exceptions/password-reset.exceptions.d.ts

@@ -5,4 +5,7 @@ export declare class PasswordResetRateLimitException extends CodedHttpException
 export declare class WeakPasswordException extends CodedHttpException {
     constructor(errors: string[]);
 }
+export declare class PasswordResetCodeInvalidException extends CodedHttpException {
+    constructor();
+}
 //# sourceMappingURL=password-reset.exceptions.d.ts.map

package/dist/exceptions/password-reset.exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/password-reset.exceptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAS5D,qBAAa,+BAAgC,SAAQ,kBAAkB;gBACzD,iBAAiB,EAAE,MAAM;CAUtC;AAYD,qBAAa,qBAAsB,SAAQ,kBAAkB;gBAC/C,MAAM,EAAE,MAAM,EAAE;CAU7B"}
+{"version":3,"file":"password-reset.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/password-reset.exceptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAS5D,qBAAa,+BAAgC,SAAQ,kBAAkB;gBACzD,iBAAiB,EAAE,MAAM;CAUtC;AAYD,qBAAa,qBAAsB,SAAQ,kBAAkB;gBAC/C,MAAM,EAAE,MAAM,EAAE;CAU7B;AAUD,qBAAa,iCAAkC,SAAQ,kBAAkB;;CAOxE"}

package/dist/exceptions/password-reset.exceptions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WeakPasswordException = exports.PasswordResetRateLimitException = void 0;
+exports.PasswordResetCodeInvalidException = exports.WeakPasswordException = exports.PasswordResetRateLimitException = void 0;
 const common_1 = require("@nestjs/common");
 const coded_http_exception_1 = require("./coded-http.exception");
 class PasswordResetRateLimitException extends coded_http_exception_1.CodedHttpException {
@@ -23,4 +23,10 @@ class WeakPasswordException extends coded_http_exception_1.CodedHttpException {
     }
 }
 exports.WeakPasswordException = WeakPasswordException;
+class PasswordResetCodeInvalidException extends coded_http_exception_1.CodedHttpException {
+    constructor() {
+        super({ message: 'Invalid or expired reset code.', code: 'PASSWORD_RESET_CODE_INVALID' }, common_1.HttpStatus.BAD_REQUEST);
+    }
+}
+exports.PasswordResetCodeInvalidException = PasswordResetCodeInvalidException;
 //# sourceMappingURL=password-reset.exceptions.js.map

package/dist/exceptions/password-reset.exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/password-reset.exceptions.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,iEAA4D;AAS5D,MAAa,+BAAgC,SAAQ,yCAAkB;IACrE,YAAY,iBAAyB;QACnC,KAAK,CACH;YACE,OAAO,EAAE,iDAAiD,iBAAiB,+BAA+B;YAC1G,IAAI,EAAE,2BAA2B;YACjC,iBAAiB;SAClB,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAXD,0EAWC;AAYD,MAAa,qBAAsB,SAAQ,yCAAkB;IAC3D,YAAY,MAAgB;QAC1B,KAAK,CACH;YACE,OAAO,EAAE,8CAA8C;YACvD,IAAI,EAAE,eAAe;YACrB,MAAM;SACP,EACD,mBAAU,CAAC,WAAW,CACvB,CAAC;IACJ,CAAC;CACF;AAXD,sDAWC"}
+{"version":3,"file":"password-reset.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/password-reset.exceptions.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,iEAA4D;AAS5D,MAAa,+BAAgC,SAAQ,yCAAkB;IACrE,YAAY,iBAAyB;QACnC,KAAK,CACH;YACE,OAAO,EAAE,iDAAiD,iBAAiB,+BAA+B;YAC1G,IAAI,EAAE,2BAA2B;YACjC,iBAAiB;SAClB,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAXD,0EAWC;AAYD,MAAa,qBAAsB,SAAQ,yCAAkB;IAC3D,YAAY,MAAgB;QAC1B,KAAK,CACH;YACE,OAAO,EAAE,8CAA8C;YACvD,IAAI,EAAE,eAAe;YACrB,MAAM;SACP,EACD,mBAAU,CAAC,WAAW,CACvB,CAAC;IACJ,CAAC;CACF;AAXD,sDAWC;AAUD,MAAa,iCAAkC,SAAQ,yCAAkB;IACvE;QACE,KAAK,CACH,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAClF,mBAAU,CAAC,WAAW,CACvB,CAAC;IACJ,CAAC;CACF;AAPD,8EAOC"}

package/dist/exceptions/step-up.exceptions.d.ts

@@ -6,7 +6,7 @@ export declare class StepUpUnavailableException extends GraphQLError {
     constructor(method?: string);
 }
 export declare class AuthRateLimitException extends GraphQLError {
-    constructor(message: string, retryAfterSeconds?: number);
+    constructor(message: string, retryAfterSeconds: number);
 }
 export declare class StepUpFailedException extends GraphQLError {
     constructor();

package/dist/exceptions/step-up.exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-up.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/step-up.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,qBAAa,uBAAwB,SAAQ,YAAY;;CAMxD;AAUD,qBAAa,0BAA2B,SAAQ,YAAY;gBAC9C,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAMD,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM;CASxD;AAaD,qBAAa,qBAAsB,SAAQ,YAAY;;CAMtD"}
+{"version":3,"file":"step-up.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/step-up.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgBvC,qBAAa,uBAAwB,SAAQ,YAAY;;CAMxD;AAUD,qBAAa,0BAA2B,SAAQ,YAAY;gBAC9C,MAAM,CAAC,EAAE,MAAM;CAQ5B;AAQD,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM;CAKvD;AAaD,qBAAa,qBAAsB,SAAQ,YAAY;;CAMtD"}

package/dist/exceptions/step-up.exceptions.js

@@ -21,11 +21,7 @@ exports.StepUpUnavailableException = StepUpUnavailableException;
 class AuthRateLimitException extends graphql_1.GraphQLError {
     constructor(message, retryAfterSeconds) {
         super(message, {
-            extensions: {
-                code: 'RATE_LIMIT_EXCEEDED',
-                statusCode: 429,
-                ...(retryAfterSeconds !== undefined ? { retryAfterSeconds } : {}),
-            },
+            extensions: { code: 'RATE_LIMIT_EXCEEDED', statusCode: 429, retryAfterSeconds },
         });
     }
 }

package/dist/exceptions/step-up.exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"step-up.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/step-up.exceptions.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAgBvC,MAAa,uBAAwB,SAAQ,sBAAY;IACvD;QACE,KAAK,CAAC,4BAA4B,EAAE;YAClC,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;CACF;AAND,0DAMC;AAUD,MAAa,0BAA2B,SAAQ,sBAAY;IAC1D,YAAY,MAAe;QACzB,KAAK,CACH,MAAM;YACJ,CAAC,CAAC,wBAAwB,MAAM,oCAAoC;YACpE,CAAC,CAAC,2DAA2D,EAC/D,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;CACF;AATD,gEASC;AAMD,MAAa,sBAAuB,SAAQ,sBAAY;IACtD,YAAY,OAAe,EAAE,iBAA0B;QACrD,KAAK,CAAC,OAAO,EAAE;YACb,UAAU,EAAE;gBACV,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,GAAG;gBACf,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAVD,wDAUC;AAaD,MAAa,qBAAsB,SAAQ,sBAAY;IACrD;QACE,KAAK,CAAC,0BAA0B,EAAE;YAChC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;CACF;AAND,sDAMC"}
+{"version":3,"file":"step-up.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/step-up.exceptions.ts"],"names":[],"mappings":";;;AAAA,qCAAuC;AAgBvC,MAAa,uBAAwB,SAAQ,sBAAY;IACvD;QACE,KAAK,CAAC,4BAA4B,EAAE;YAClC,UAAU,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,GAAG,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;CACF;AAND,0DAMC;AAUD,MAAa,0BAA2B,SAAQ,sBAAY;IAC1D,YAAY,MAAe;QACzB,KAAK,CACH,MAAM;YACJ,CAAC,CAAC,wBAAwB,MAAM,oCAAoC;YACpE,CAAC,CAAC,2DAA2D,EAC/D,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;CACF;AATD,gEASC;AAQD,MAAa,sBAAuB,SAAQ,sBAAY;IACtD,YAAY,OAAe,EAAE,iBAAyB;QACpD,KAAK,CAAC,OAAO,EAAE;YACb,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,iBAAiB,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;CACF;AAND,wDAMC;AAaD,MAAa,qBAAsB,SAAQ,sBAAY;IACrD;QACE,KAAK,CAAC,0BAA0B,EAAE;YAChC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;CACF;AAND,sDAMC"}

package/dist/exceptions/verification.exceptions.d.ts

@@ -3,7 +3,7 @@ export declare class VerificationCodeExpiredException extends CodedHttpException
     constructor();
 }
 export declare class VerificationCodeInvalidException extends CodedHttpException {
-    constructor(remainingAttempts: number);
+    constructor(remainingAttempts?: number);
 }
 export declare class VerificationCodeExhaustedException extends CodedHttpException {
     constructor();
@@ -11,4 +11,7 @@ export declare class VerificationCodeExhaustedException extends CodedHttpExcepti
 export declare class VerificationEmailRateLimitException extends CodedHttpException {
     constructor(retryAfterSeconds: number);
 }
+export declare class EmailVerificationCodeInvalidException extends CodedHttpException {
+    constructor();
+}
 //# sourceMappingURL=verification.exceptions.d.ts.map

package/dist/exceptions/verification.exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/verification.exceptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,qBAAa,gCAAiC,SAAQ,kBAAkB;;CAUvE;AAED,qBAAa,gCAAiC,SAAQ,kBAAkB;gBAC1D,iBAAiB,EAAE,MAAM;CAUtC;AAED,qBAAa,kCAAmC,SAAQ,kBAAkB;;CAUzE;AAED,qBAAa,mCAAoC,SAAQ,kBAAkB;gBAC7D,iBAAiB,EAAE,MAAM;CAUtC"}
+{"version":3,"file":"verification.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/verification.exceptions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,qBAAa,gCAAiC,SAAQ,kBAAkB;;CAUvE;AAED,qBAAa,gCAAiC,SAAQ,kBAAkB;gBAE1D,iBAAiB,CAAC,EAAE,MAAM;CAYvC;AAED,qBAAa,kCAAmC,SAAQ,kBAAkB;;CAUzE;AAED,qBAAa,mCAAoC,SAAQ,kBAAkB;gBAC7D,iBAAiB,EAAE,MAAM;CAUtC;AAQD,qBAAa,qCAAsC,SAAQ,kBAAkB;;CAO5E"}

package/dist/exceptions/verification.exceptions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerificationEmailRateLimitException = exports.VerificationCodeExhaustedException = exports.VerificationCodeInvalidException = exports.VerificationCodeExpiredException = void 0;
+exports.EmailVerificationCodeInvalidException = exports.VerificationEmailRateLimitException = exports.VerificationCodeExhaustedException = exports.VerificationCodeInvalidException = exports.VerificationCodeExpiredException = void 0;
 const common_1 = require("@nestjs/common");
 const coded_http_exception_1 = require("./coded-http.exception");
 class VerificationCodeExpiredException extends coded_http_exception_1.CodedHttpException {
@@ -14,11 +14,13 @@ class VerificationCodeExpiredException extends coded_http_exception_1.CodedHttpE
 exports.VerificationCodeExpiredException = VerificationCodeExpiredException;
 class VerificationCodeInvalidException extends coded_http_exception_1.CodedHttpException {
     constructor(remainingAttempts) {
-        super({
-            message: `Invalid verification code. ${remainingAttempts} attempt(s) remaining.`,
-            code: 'VERIFICATION_CODE_INVALID',
-            remainingAttempts,
-        }, common_1.HttpStatus.UNAUTHORIZED);
+        super(remainingAttempts === undefined
+            ? { message: 'Invalid verification code.', code: 'VERIFICATION_CODE_INVALID' }
+            : {
+                message: `Invalid verification code. ${remainingAttempts} attempt(s) remaining.`,
+                code: 'VERIFICATION_CODE_INVALID',
+                remainingAttempts,
+            }, common_1.HttpStatus.UNAUTHORIZED);
     }
 }
 exports.VerificationCodeInvalidException = VerificationCodeInvalidException;
@@ -41,4 +43,10 @@ class VerificationEmailRateLimitException extends coded_http_exception_1.CodedHt
     }
 }
 exports.VerificationEmailRateLimitException = VerificationEmailRateLimitException;
+class EmailVerificationCodeInvalidException extends coded_http_exception_1.CodedHttpException {
+    constructor() {
+        super({ message: 'Invalid or expired verification code.', code: 'EMAIL_VERIFICATION_CODE_INVALID' }, common_1.HttpStatus.BAD_REQUEST);
+    }
+}
+exports.EmailVerificationCodeInvalidException = EmailVerificationCodeInvalidException;
 //# sourceMappingURL=verification.exceptions.js.map

package/dist/exceptions/verification.exceptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/verification.exceptions.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,iEAA4D;AAE5D,MAAa,gCAAiC,SAAQ,yCAAkB;IACtE;QACE,KAAK,CACH;YACE,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,2BAA2B;SAClC,EACD,mBAAU,CAAC,YAAY,CACxB,CAAC;IACJ,CAAC;CACF;AAVD,4EAUC;AAED,MAAa,gCAAiC,SAAQ,yCAAkB;IACtE,YAAY,iBAAyB;QACnC,KAAK,CACH;YACE,OAAO,EAAE,8BAA8B,iBAAiB,wBAAwB;YAChF,IAAI,EAAE,2BAA2B;YACjC,iBAAiB;SAClB,EACD,mBAAU,CAAC,YAAY,CACxB,CAAC;IACJ,CAAC;CACF;AAXD,4EAWC;AAED,MAAa,kCAAmC,SAAQ,yCAAkB;IACxE;QACE,KAAK,CACH;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,6BAA6B;SACpC,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAVD,gFAUC;AAED,MAAa,mCAAoC,SAAQ,yCAAkB;IACzE,YAAY,iBAAyB;QACnC,KAAK,CACH;YACE,OAAO,EAAE,eAAe,iBAAiB,0CAA0C;YACnF,IAAI,EAAE,+BAA+B;YACrC,iBAAiB;SAClB,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAXD,kFAWC"}
+{"version":3,"file":"verification.exceptions.js","sourceRoot":"","sources":["../../src/exceptions/verification.exceptions.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,iEAA4D;AAE5D,MAAa,gCAAiC,SAAQ,yCAAkB;IACtE;QACE,KAAK,CACH;YACE,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,2BAA2B;SAClC,EACD,mBAAU,CAAC,YAAY,CACxB,CAAC;IACJ,CAAC;CACF;AAVD,4EAUC;AAED,MAAa,gCAAiC,SAAQ,yCAAkB;IAEtE,YAAY,iBAA0B;QACpC,KAAK,CACH,iBAAiB,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,IAAI,EAAE,2BAA2B,EAAE;YAC9E,CAAC,CAAC;gBACE,OAAO,EAAE,8BAA8B,iBAAiB,wBAAwB;gBAChF,IAAI,EAAE,2BAA2B;gBACjC,iBAAiB;aAClB,EACL,mBAAU,CAAC,YAAY,CACxB,CAAC;IACJ,CAAC;CACF;AAdD,4EAcC;AAED,MAAa,kCAAmC,SAAQ,yCAAkB;IACxE;QACE,KAAK,CACH;YACE,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,6BAA6B;SACpC,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAVD,gFAUC;AAED,MAAa,mCAAoC,SAAQ,yCAAkB;IACzE,YAAY,iBAAyB;QACnC,KAAK,CACH;YACE,OAAO,EAAE,eAAe,iBAAiB,0CAA0C;YACnF,IAAI,EAAE,+BAA+B;YACrC,iBAAiB;SAClB,EACD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;CACF;AAXD,kFAWC;AAQD,MAAa,qCAAsC,SAAQ,yCAAkB;IAC3E;QACE,KAAK,CACH,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,iCAAiC,EAAE,EAC7F,mBAAU,CAAC,WAAW,CACvB,CAAC;IACJ,CAAC;CACF;AAPD,sFAOC"}

package/dist/resolvers/base-auth.resolver.d.ts

@@ -24,7 +24,7 @@ import { IAuthLogger } from '../interfaces/auth-logger.interface';
 import { PasskeyService } from '../services/passkey.service';
 import { StepUpService } from '../services/step-up.service';
 import { StepUpMethod } from '../services/step-up-token.service';
-import { IAuthPasskey, IAuthPasskeyOptionsResponse, IAuthPasskeyRegistrationOptionsInput, IAuthReauthenticateInput, IAuthRemovePasskeyInput, IAuthRenamePasskeyInput, IAuthStepUpTokenResponse, IAuthVerifyPasskeyAuthenticationInput, IAuthVerifyPasskeyRegistrationInput, IAuthStartPasskeySignupInput, IAuthPasskeySignupStarted, IAuthVerifyPasskeySignupCodeInput, IAuthCompletePasskeySignupInput } from '../dto/passkey.dto';
+import { IAuthPasskey, IAuthPasskeyOptionsResponse, IAuthPasskeyRegistrationOptionsInput, IAuthReauthenticateInput, IAuthRemovePasskeyInput, IAuthRenamePasskeyInput, IAuthStepUpTokenResponse, IAuthVerifyPasskeyAuthenticationInput, IAuthVerifyPasskeyRegistrationInput, IAuthStartPasskeySignupInput, IAuthPasskeySignupStarted, IAuthVerifyPasskeySignupCodeInput, IAuthCompletePasskeySignupInput, IAuthPasskeySignupOptionsResponse, IAuthPasskeySignupOptionsInput } from '../dto/passkey.dto';
 export declare abstract class BaseAuthResolver<T extends IAuthUser> {
     protected readonly authService: AuthService;
     protected readonly bruteForceProtection: BruteForceProtectionService;
@@ -76,7 +76,8 @@ export declare abstract class BaseAuthResolver<T extends IAuthUser> {
     protected performPasskeyAuthenticationOptions(context?: any): Promise<IAuthPasskeyOptionsResponse>;
     protected performVerifyPasskeyAuthentication(input: IAuthVerifyPasskeyAuthenticationInput, context?: any): Promise<AuthResponseBase<T>>;
     protected performStartPasskeySignup(input: IAuthStartPasskeySignupInput, context?: any): Promise<IAuthPasskeySignupStarted>;
-    protected performVerifyPasskeySignupCode(input: IAuthVerifyPasskeySignupCodeInput, context?: any): Promise<IAuthPasskeyOptionsResponse>;
+    protected performVerifyPasskeySignupCode(input: IAuthVerifyPasskeySignupCodeInput, context?: any): Promise<IAuthPasskeySignupOptionsResponse>;
+    protected performPasskeySignupOptions(input: IAuthPasskeySignupOptionsInput, context?: any): Promise<IAuthPasskeySignupOptionsResponse>;
     protected performCompletePasskeySignup(input: IAuthCompletePasskeySignupInput, context?: any): Promise<AuthResponseBase<T>>;
     protected performListPasskeys(user: IAuthUser, context?: any): Promise<IAuthPasskey[]>;
     protected performRenamePasskey(user: IAuthUser, input: IAuthRenamePasskeyInput, context?: any): Promise<IAuthPasskey>;

package/dist/resolvers/base-auth.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-auth.resolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/base-auth.resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EAKP,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAMjF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAe,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,oCAAoC,EACpC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,4BAA4B,EAC5B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAEhC,MAAM,oBAAoB,CAAC;AAyC5B,8BAAsB,gBAAgB,CAAC,CAAC,SAAS,SAAS;IAItD,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,2BAA2B;IAEpE,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC;IAE7D,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW;IARhD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAqC;gBAGzC,WAAW,EAAE,WAAW,EACxB,oBAAoB,EAAE,2BAA2B,EAEjD,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,EAE1C,cAAc,EAAE,WAAW;IAWhD,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IAIjD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IAQ9C,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS;IAY/D,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS;IAQ/D,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;IAYjD,SAAS,CAAC,iBAAiB,CACzB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,SAAS,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,EACD,OAAO,CAAC,EAAE,GAAG,GACZ,gBAAgB,CAAC,CAAC,CAAC;IA6BtB,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;cAmCpC,aAAa,CAC3B,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAkCf,YAAY,CAC1B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,GAAG,GACX,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAoCf,mBAAmB,CACjC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAiB/B,OAAO,CAAC,mBAAmB;cAmCX,aAAa,CAC3B,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,CAAC,EACP,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,mBAAmB,CAAC;cAuCf,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,sBAAsB,CAAC;cAoCzE,6BAA6B,CAC3C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC;cAgClB,kBAAkB,CAChC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cA0BpB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cA2BpB,4BAA4B,CAC1C,KAAK,EAAE,+BAA+B,EACtC,IAAI,EAAE,CAAC,EACP,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,8BAA8B,CAAC;cA6B1B,kBAAkB,CAChC,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,wBAAwB,CAAC;cAuBpB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,8BAA8B,CAAC;cAsB1B,wBAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC;cAsBpE,8BAA8B,CAC5C,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,4BAA4B,CAAC;cAqDxB,2BAA2B,CACzC,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,0BAA0B,CAAC;cAoCtB,oBAAoB,CAClC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,0BAA0B,CAAC;cA6DtB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cA2BjC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;cAqDjD,6BAA6B,CAC3C,KAAK,EAAE,gCAAgC,EACvC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAoCf,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;cAKhF,6BAA6B,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;cAM/E,2BAA2B,CACzC,IAAI,EAAE,SAAS,EACf,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAuBvB,qBAAqB,CACnC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,wBAAwB,EAC/B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cAepB,iCAAiC,CAC/C,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,oCAAoC,EAC3C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAUvB,gCAAgC,CAC9C,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,mCAAmC,EAC1C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,YAAY,CAAC;cAoBR,mCAAmC,CACjD,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAevB,kCAAkC,CAChD,KAAK,EAAE,qCAAqC,EAC5C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAiCf,yBAAyB,CACvC,KAAK,EAAE,4BAA4B,EACnC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,yBAAyB,CAAC;cAQrB,8BAA8B,CAC5C,KAAK,EAAE,iCAAiC,EACxC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAavB,4BAA4B,CAC1C,KAAK,EAAE,+BAA+B,EACtC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAef,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;cAK5E,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,YAAY,CAAC;cAQR,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,OAAO,CAAC;IAMnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,iBAAiB;CAM1B"}
+{"version":3,"file":"base-auth.resolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/base-auth.resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EAKP,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAMjF,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAe,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,oCAAoC,EACpC,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,4BAA4B,EAC5B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,8BAA8B,EAE/B,MAAM,oBAAoB,CAAC;AAyC5B,8BAAsB,gBAAgB,CAAC,CAAC,SAAS,SAAS;IAItD,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,2BAA2B;IAEpE,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC;IAE7D,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW;IARhD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAqC;gBAGzC,WAAW,EAAE,WAAW,EACxB,oBAAoB,EAAE,2BAA2B,EAEjD,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,EAE1C,cAAc,EAAE,WAAW;IAWhD,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IAIjD,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IAQ9C,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS;IAY/D,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS;IAQ/D,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;IAYjD,SAAS,CAAC,iBAAiB,CACzB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,SAAS,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,IAAI,CAAC;KACxB,EACD,OAAO,CAAC,EAAE,GAAG,GACZ,gBAAgB,CAAC,CAAC,CAAC;IA6BtB,SAAS,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;cAmCpC,aAAa,CAC3B,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAkCf,YAAY,CAC1B,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,GAAG,GACX,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAoCf,mBAAmB,CACjC,KAAK,EAAE,sBAAsB,EAC7B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAiB/B,OAAO,CAAC,mBAAmB;cAmCX,aAAa,CAC3B,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,CAAC,EACP,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,mBAAmB,CAAC;cAuCf,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,sBAAsB,CAAC;cAoCzE,6BAA6B,CAC3C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sBAAsB,CAAC;cAgClB,kBAAkB,CAChC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cA0BpB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cA2BpB,4BAA4B,CAC1C,KAAK,EAAE,+BAA+B,EACtC,IAAI,EAAE,CAAC,EACP,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,8BAA8B,CAAC;cA6B1B,kBAAkB,CAChC,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,wBAAwB,CAAC;cAuBpB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,8BAA8B,CAAC;cAsB1B,wBAAwB,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC;cAsBpE,8BAA8B,CAC5C,IAAI,EAAE,CAAC,GACN,OAAO,CAAC,4BAA4B,CAAC;cAqDxB,2BAA2B,CACzC,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,0BAA0B,CAAC;cAoCtB,oBAAoB,CAClC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,0BAA0B,CAAC;cA6DtB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cA2BjC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;cAqDjD,6BAA6B,CAC3C,KAAK,EAAE,gCAAgC,EACvC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAoCf,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;cAKhF,6BAA6B,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;cAM/E,2BAA2B,CACzC,IAAI,EAAE,SAAS,EACf,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAuBvB,qBAAqB,CACnC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,wBAAwB,EAC/B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,wBAAwB,CAAC;cAepB,iCAAiC,CAC/C,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,oCAAoC,EAC3C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAUvB,gCAAgC,CAC9C,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,mCAAmC,EAC1C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,YAAY,CAAC;cAoBR,mCAAmC,CACjD,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,2BAA2B,CAAC;cAevB,kCAAkC,CAChD,KAAK,EAAE,qCAAqC,EAC5C,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAiCf,yBAAyB,CACvC,KAAK,EAAE,4BAA4B,EACnC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,yBAAyB,CAAC;cAWrB,8BAA8B,CAC5C,KAAK,EAAE,iCAAiC,EACxC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,iCAAiC,CAAC;cAa7B,2BAA2B,CACzC,KAAK,EAAE,8BAA8B,EACrC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,iCAAiC,CAAC;cAa7B,4BAA4B,CAC1C,KAAK,EAAE,+BAA+B,EACtC,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;cAef,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;cAK5E,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,YAAY,CAAC;cAQR,oBAAoB,CAClC,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,GAAG,GACZ,OAAO,CAAC,OAAO,CAAC;IAMnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,iBAAiB;CAM1B"}

package/dist/resolvers/base-auth.resolver.js

@@ -263,8 +263,12 @@ let BaseAuthResolver = class BaseAuthResolver {
         return this.requireAuthPasskeys().startSignup({ email: input.email }, { realm: this.getRealmFromContext(context), ipAddress: this.authClientIp(context) });
     }
     async performVerifyPasskeySignupCode(input, context) {
-        const { challengeId, options } = await this.requireAuthPasskeys().verifySignupCode({ signupId: input.signupId, code: input.code }, { realm: this.getRealmFromContext(context), ipAddress: this.authClientIp(context) });
-        return { challengeId, optionsJson: JSON.stringify(options) };
+        const { challengeId, options, signupId } = await this.requireAuthPasskeys().verifySignupCode({ signupId: input.signupId, code: input.code }, { realm: this.getRealmFromContext(context), ipAddress: this.authClientIp(context) });
+        return { challengeId, optionsJson: JSON.stringify(options), signupId };
+    }
+    async performPasskeySignupOptions(input, context) {
+        const { challengeId, options } = await this.requireAuthPasskeys().signupOptions({ signupId: input.signupId }, { realm: this.getRealmFromContext(context), ipAddress: this.authClientIp(context) });
+        return { challengeId, optionsJson: JSON.stringify(options), signupId: input.signupId };
     }
     async performCompletePasskeySignup(input, context) {
         assertResponseSize(input.responseJson);