@baseplate-dev/plugin-auth 0.6.17 → 0.6.19

package/dist/local-auth/admin/schema/invite-user-action.d.ts

@@ -0,0 +1,12 @@
+import type { def } from '@baseplate-dev/project-builder-lib';
+import { z } from 'zod';
+export declare const createAdminCrudInviteUserActionSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodObject<{
+    id: z.ZodDefault<z.ZodString>;
+    position: z.ZodDefault<z.ZodEnum<{
+        inline: "inline";
+        dropdown: "dropdown";
+    }>>;
+    type: z.ZodLiteral<"invite-user">;
+}, z.core.$loose>;
+export type AdminCrudInviteUserActionDefinition = def.InferOutput<typeof createAdminCrudInviteUserActionSchema>;
+//# sourceMappingURL=invite-user-action.d.ts.map

package/dist/local-auth/admin/schema/invite-user-action.js

@@ -0,0 +1,6 @@
+import { baseAdminCrudActionSchema, definitionSchema, } from '@baseplate-dev/project-builder-lib';
+import { z } from 'zod';
+export const createAdminCrudInviteUserActionSchema = definitionSchema(() => baseAdminCrudActionSchema.extend({
+    type: z.literal('invite-user'),
+}));
+//# sourceMappingURL=invite-user-action.js.map

package/dist/local-auth/admin/web.js

@@ -25,6 +25,14 @@ export default createPluginModule({
                     LOCAL_AUTH_MODELS.user,
                 getNewAction: () => ({ type: 'reset-password', position: 'dropdown' }),
             },
+            {
+                pluginKey,
+                name: 'invite-user',
+                label: 'Send Invite',
+                isAvailableForModel: (definition, modelId) => ModelUtils.byIdOrThrow(definition, modelId).name ===
+                    LOCAL_AUTH_MODELS.user,
+                getNewAction: () => ({ type: 'invite-user', position: 'dropdown' }),
+            },
         ]);
         adminCrudColumnWeb.columns.add({
             pluginKey,

package/dist/local-auth/core/common.js

@@ -1,20 +1,25 @@
-import { authModelsSpec, createPluginModule, definitionIssueCheckerSpec, pluginConfigSpec, } from '@baseplate-dev/project-builder-lib';
+import { authModelsSpec, createPluginModule, definitionIssueCheckerSpec, pluginConfigSpec, webAppSchemaExtensionSpec, } from '@baseplate-dev/project-builder-lib';
 import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
+import { LOCAL_AUTH_PLUGIN_CONFIG_MIGRATIONS } from './schema/migrations.js';
 import { createLocalAuthPluginDefinitionSchema } from './schema/plugin-definition.js';
 import { createLocalAuthSchemaChecker } from './schema/schema-issue-checker.js';
+import { createLocalAuthWebAppSchema } from './schema/web-app-schema.js';
 export default createPluginModule({
     name: 'common',
     dependencies: {
         pluginConfig: pluginConfigSpec,
         authModels: authModelsSpec,
         issueCheckers: definitionIssueCheckerSpec,
+        webAppSchemaExtension: webAppSchemaExtensionSpec,
     },
-    initialize: ({ pluginConfig, authModels, issueCheckers }, { pluginKey }) => {
+    initialize: ({ pluginConfig, authModels, issueCheckers, webAppSchemaExtension }, { pluginKey }) => {
         pluginConfig.schemas.set(pluginKey, createLocalAuthPluginDefinitionSchema);
+        pluginConfig.migrations.set(pluginKey, LOCAL_AUTH_PLUGIN_CONFIG_MIGRATIONS);
         authModels.getAuthModels.set(() => ({
             user: LOCAL_AUTH_MODELS.user,
         }));
         issueCheckers.checkers.set(pluginKey, createLocalAuthSchemaChecker(pluginKey));
+        webAppSchemaExtension.schemas.set(pluginKey, createLocalAuthWebAppSchema);
     },
 });
 //# sourceMappingURL=common.js.map

package/dist/local-auth/core/components/local-auth-definition-editor.js

@@ -26,6 +26,7 @@ export function LocalAuthDefinitionEditor({ definition: pluginMetadata, metadata
         return {
             additionalUserAdminRoles: [],
             requireNameOnRegistration: false,
+            emailOtp: false,
         };
     }, [pluginMetadata?.config]);
     const form = useResettableForm({
@@ -58,6 +59,6 @@ export function LocalAuthDefinitionEditor({ definition: pluginMetadata, metadata
     useBlockUnsavedChangesNavigate({ control, reset, onSubmit });
     return (_jsxs("div", { className: "auth:relative auth:flex auth:h-full auth:flex-1 auth:flex-col auth:gap-4 auth:overflow-hidden", children: [_jsx(AuthConfigTabs, {}), _jsx("div", { className: "auth:mb-[--action-bar-height] auth:flex auth:flex-1 auth:overflow-y-auto", style: {
                     '--action-bar-height': '52px',
-                }, children: _jsxs("form", { onSubmit: onSubmit, className: "auth:max-w-6xl auth:flex-1", children: [_jsx("div", { className: "auth:pb-16", children: _jsxs(SectionList, { children: [_jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Local Auth User Models" }), _jsx(SectionListSectionDescription, { children: "The plugin will automatically configure the models it needs." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(DefinitionDiffAlert, { diff: diff }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "User Management Permissions" }), _jsx(SectionListSectionDescription, { children: "The \"admin\" role always has user management permissions. Optionally add more roles that can manage users and assign roles in the admin interface." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(MultiComboboxFieldController, { label: "Additional User Admin Roles", name: "additionalUserAdminRoles", control: control, options: roles, description: "Additional roles (beyond admin) that can manage users and assign roles." }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Registration Settings" }), _jsx(SectionListSectionDescription, { children: "Configure what information is collected during user registration." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(SwitchFieldController, { label: "Require Name on Registration", name: "requireNameOnRegistration", control: control, description: "When enabled, users must provide their name when registering." }) })] })] }) }), _jsx(FormActionBar, { form: form, allowSaveWithoutDirty: !pluginMetadata || diff.hasChanges })] }) })] }));
+                }, children: _jsxs("form", { onSubmit: onSubmit, className: "auth:max-w-6xl auth:flex-1", children: [_jsx("div", { className: "auth:pb-16", children: _jsxs(SectionList, { children: [_jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Local Auth User Models" }), _jsx(SectionListSectionDescription, { children: "The plugin will automatically configure the models it needs." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(DefinitionDiffAlert, { diff: diff }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "User Management Permissions" }), _jsx(SectionListSectionDescription, { children: "The \"admin\" role always has user management permissions. Optionally add more roles that can manage users and assign roles in the admin interface." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(MultiComboboxFieldController, { label: "Additional User Admin Roles", name: "additionalUserAdminRoles", control: control, options: roles, description: "Additional roles (beyond admin) that can manage users and assign roles." }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Registration Settings" }), _jsx(SectionListSectionDescription, { children: "Configure what information is collected during user registration." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(SwitchFieldController, { label: "Require Name on Registration", name: "requireNameOnRegistration", control: control, description: "When enabled, users must provide their name when registering." }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Sign-in Methods" }), _jsx(SectionListSectionDescription, { children: "Choose how users can sign in, in addition to email and password." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(SwitchFieldController, { label: "Email Sign-in Codes", name: "emailOtp", control: control, description: "When enabled, users can sign in with a single-use code emailed to them instead of a password. Signing in with a code creates an account if the address is new." }) })] })] }) }), _jsx(FormActionBar, { form: form, allowSaveWithoutDirty: !pluginMetadata || diff.hasChanges })] }) })] }));
 }
 //# sourceMappingURL=local-auth-definition-editor.js.map

package/dist/local-auth/core/components/local-auth-web-app-settings-form.d.ts

@@ -0,0 +1,9 @@
+import type { WebAppSettingsFormProps } from '@baseplate-dev/project-builder-lib/web';
+import type React from 'react';
+/**
+ * Renders the local-auth per-app settings (disable registration toggle) in
+ * the web app settings page. Bound to `pluginData[pluginKey]` on the shared
+ * web app form.
+ */
+export declare function LocalAuthWebAppSettingsForm({ formProps, pluginKey, }: WebAppSettingsFormProps): React.JSX.Element;
+//# sourceMappingURL=local-auth-web-app-settings-form.d.ts.map

package/dist/local-auth/core/components/local-auth-web-app-settings-form.js

@@ -0,0 +1,11 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { SwitchFieldController } from '@baseplate-dev/ui-components';
+/**
+ * Renders the local-auth per-app settings (disable registration toggle) in
+ * the web app settings page. Bound to `pluginData[pluginKey]` on the shared
+ * web app form.
+ */
+export function LocalAuthWebAppSettingsForm({ formProps, pluginKey, }) {
+    return (_jsx(SwitchFieldController, { label: "Disable Registration", description: "When enabled, this site's sign-up page and link are hidden so users can only be added via an invite.", control: formProps.control, name: `pluginData.${pluginKey}.disableRegistration` }));
+}
+//# sourceMappingURL=local-auth-web-app-settings-form.js.map

package/dist/local-auth/core/generators/auth-email-password/auth-email-password.generator.d.ts

@@ -3,8 +3,10 @@
  */
 export declare const authEmailPasswordGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
     adminRoles: string[];
-    devWebDomainPort: number;
+    webAppName: string;
     requireNameOnRegistration: boolean;
+    emailOtp?: boolean | undefined;
+    disableRegistration?: boolean | undefined;
 }, {
     paths: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthEmailPasswordPaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
@@ -14,7 +16,6 @@ export declare const authEmailPasswordGenerator: import("@baseplate-dev/sync").G
     imports: import("@baseplate-dev/sync").GeneratorTask<{
         authEmailPasswordImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             authenticateUserWithEmailAndPassword: {};
-            cleanupExpiredPasswordResetTokens: {};
             completePasswordReset: {};
             createUserWithEmailAndPassword: {};
             PASSWORD_MAX_LENGTH: {};
@@ -30,14 +31,26 @@ export declare const authEmailPasswordGenerator: import("@baseplate-dev/sync").G
     renderers: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthEmailPasswordRenderers: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
     }, {
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             getConfig: {};
@@ -104,16 +117,12 @@ export declare const authEmailPasswordGenerator: import("@baseplate-dev/sync").G
             };
         }>>;
     }, undefined>;
-    config: import("@baseplate-dev/sync").GeneratorTask<undefined, {
-        provider: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
-            configFields: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").ConfigServiceField>;
-        }>, "getValues">>;
-    }, undefined>;
     appModule: import("@baseplate-dev/sync").GeneratorTask<any, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
         appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;
     }, any>;
     main: import("@baseplate-dev/sync").GeneratorTask<any, {
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
         renderers: import("@baseplate-dev/sync").ProviderType<import("./generated/template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
         transactionalLibConfig: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/plugin-email").TransactionalLibConfigProvider>;
         userObjectType: import("@baseplate-dev/sync").ProviderDependency<import("@baseplate-dev/fastify-generators").PothosTypeOutputProvider>;

package/dist/local-auth/core/generators/auth-email-password/auth-email-password.generator.js

@@ -1,15 +1,18 @@
-import { tsCodeFragment, TsCodeUtils } from '@baseplate-dev/core-generators';
-import { appModuleProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, } from '@baseplate-dev/fastify-generators';
+import { tsCodeFragment, TsCodeUtils, tsImportBuilder, } from '@baseplate-dev/core-generators';
+import { appModuleProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, } from '@baseplate-dev/fastify-generators';
 import { transactionalLibConfigProvider } from '@baseplate-dev/plugin-email';
-import { createGenerator, createGeneratorTask, createProviderTask, } from '@baseplate-dev/sync';
+import { createGenerator, createGeneratorTask } from '@baseplate-dev/sync';
 import { quot } from '@baseplate-dev/utils';
 import { z } from 'zod';
 import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
 import { LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
 const descriptorSchema = z.object({
     adminRoles: z.array(z.string()),
-    devWebDomainPort: z.number(),
+    /** Web app the links in auth emails point at. */
+    webAppName: z.string(),
     requireNameOnRegistration: z.boolean(),
+    emailOtp: z.boolean().default(false),
+    disableRegistration: z.boolean().default(false),
 });
 /**
  * Sets up email / password authentication
@@ -18,45 +21,72 @@ export const authEmailPasswordGenerator = createGenerator({
     name: 'local-auth/core/auth-email-password',
     generatorFileUrl: import.meta.url,
     descriptorSchema,
-    buildTasks: ({ adminRoles, devWebDomainPort, requireNameOnRegistration, }) => ({
+    buildTasks: ({ adminRoles, webAppName, requireNameOnRegistration, emailOtp, disableRegistration, }) => ({
         paths: GENERATED_TEMPLATES.paths.task,
         imports: GENERATED_TEMPLATES.imports.task,
         renderers: GENERATED_TEMPLATES.renderers.task,
-        config: createProviderTask(configServiceProvider, (configService) => {
-            configService.configFields.set('AUTH_FRONTEND_URL', {
-                validator: tsCodeFragment('z.url()'),
-                comment: 'Frontend URL for authentication flows including password reset and email verification (e.g., https://app.example.com)',
-                exampleValue: `http://localhost:${devWebDomainPort}`,
-            });
-        }),
         appModule: createGeneratorTask({
             dependencies: {
                 paths: GENERATED_TEMPLATES.paths.provider,
                 appModule: appModuleProvider,
             },
             run({ paths, appModule }) {
-                appModule.moduleImports.push(paths.schemaUserPasswordMutations, paths.schemaPasswordResetMutations, paths.schemaEmailVerificationMutations);
+                appModule.moduleImports.push(paths.schemaUserPasswordMutations, paths.schemaPasswordResetMutations, paths.schemaInviteMutations, paths.schemaEmailVerificationMutations);
+                if (emailOtp) {
+                    appModule.moduleImports.push(paths.schemaEmailOtpMutations);
+                }
             },
         }),
         main: createGeneratorTask({
             dependencies: {
+                paths: GENERATED_TEMPLATES.paths.provider,
                 renderers: GENERATED_TEMPLATES.renderers.provider,
                 transactionalLibConfig: transactionalLibConfigProvider,
                 userObjectType: pothosTypeOutputProvider
                     .dependency()
                     .reference(createPothosPrismaObjectTypeOutputName(LOCAL_AUTH_MODELS.user)),
             },
-            run({ renderers, transactionalLibConfig, userObjectType }) {
+            run({ paths, renderers, transactionalLibConfig, userObjectType }) {
                 const transactionalLibPackageName = transactionalLibConfig.getTransactionalLibPackageName();
+                const adminRolesFragment = TsCodeUtils.mergeFragmentsAsArrayPresorted(adminRoles.map((r) => quot(r)).toSorted());
+                const userObjectTypeFragment = userObjectType.getTypeReference().fragment;
+                // Kept as its own fragment (rather than a separate mutations file)
+                // since the backend serves every web app, and only one field needs
+                // to disappear when every web app has registration disabled.
+                const registerMutationFragment = disableRegistration
+                    ? ''
+                    : tsCodeFragment(`builder.mutationField('registerWithEmailPassword', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+      name: t.input.field({ required: false, type: 'String' }),
+      password: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      registerUserWithEmailAndPassword({
+        input: {
+          ...input,
+          name: input.name ?? undefined,
+        },
+        context,
+      }),
+  }),
+);`, tsImportBuilder(['registerUserWithEmailAndPassword']).from(paths.servicesUserPassword));
                 return {
                     build: async (builder) => {
                         await builder.apply(renderers.moduleGroup.render({
                             variables: {
                                 schemaUserPasswordMutations: {
-                                    TPL_ADMIN_ROLES: TsCodeUtils.mergeFragmentsAsArrayPresorted(adminRoles.map((r) => quot(r)).toSorted()),
-                                    TPL_USER_OBJECT_TYPE: userObjectType.getTypeReference().fragment,
+                                    TPL_ADMIN_ROLES: adminRolesFragment,
+                                    TPL_REGISTER_MUTATION: registerMutationFragment,
+                                    TPL_USER_OBJECT_TYPE: userObjectTypeFragment,
                                 },
                                 servicesPasswordReset: {
+                                    TPL_AUTH_WEB_APP: quot(webAppName),
                                     TPL_PASSWORD_RESET_EMAIL: TsCodeUtils.importFragment('PasswordResetEmail', transactionalLibPackageName),
                                     TPL_PASSWORD_CHANGED_EMAIL: TsCodeUtils.importFragment('PasswordChangedEmail', transactionalLibPackageName),
                                 },
@@ -67,12 +97,39 @@ export const authEmailPasswordGenerator = createGenerator({
                                 },
                             },
                         }));
+                        await builder.apply(renderers.servicesInvite.render({
+                            variables: {
+                                TPL_AUTH_WEB_APP: quot(webAppName),
+                                TPL_INVITE_EMAIL: TsCodeUtils.importFragment('InviteEmail', transactionalLibPackageName),
+                            },
+                        }));
+                        await builder.apply(renderers.schemaInviteMutations.render({
+                            variables: {
+                                TPL_ADMIN_ROLES: adminRolesFragment,
+                                TPL_USER_OBJECT_TYPE: userObjectTypeFragment,
+                            },
+                        }));
                         await builder.apply(renderers.servicesEmailVerification.render({
                             variables: {
+                                TPL_AUTH_WEB_APP: quot(webAppName),
                                 TPL_ACCOUNT_VERIFICATION_EMAIL: TsCodeUtils.importFragment('AccountVerificationEmail', transactionalLibPackageName),
                             },
                         }));
                         await builder.apply(renderers.schemaEmailVerificationMutations.render({}));
+                        if (emailOtp) {
+                            await builder.apply(renderers.constantsOtp.render({}));
+                            await builder.apply(renderers.servicesEmailOtp.render({
+                                variables: {
+                                    TPL_EMAIL_OTP_EMAIL: TsCodeUtils.importFragment('EmailOtpEmail', transactionalLibPackageName),
+                                    // The user lookup lives inside the fragment so it is not
+                                    // left unused when names are not required.
+                                    TPL_NAME_REQUIRED_CHECK: requireNameOnRegistration
+                                        ? tsCodeFragment("const existingUser = await prisma.user.findUnique({\n    where: { email },\n    select: { id: true },\n  });\n\n  if (!existingUser && !name) {\n    throw new BadRequestError('Name is required', 'name-required');\n  }")
+                                        : '',
+                                },
+                            }));
+                            await builder.apply(renderers.schemaEmailOtpMutations.render({}));
+                        }
                     },
                 };
             },

package/dist/local-auth/core/generators/auth-email-password/generated/index.d.ts

@@ -1,9 +1,9 @@
 export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
     imports: {
+        generatorName: string;
         task: import("@baseplate-dev/sync").GeneratorTask<{
             authEmailPasswordImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 authenticateUserWithEmailAndPassword: {};
-                cleanupExpiredPasswordResetTokens: {};
                 completePasswordReset: {};
                 createUserWithEmailAndPassword: {};
                 PASSWORD_MAX_LENGTH: {};
@@ -30,14 +30,26 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             localAuthCoreAuthEmailPasswordRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
         }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 getConfig: {};
@@ -106,6 +118,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
         }, undefined>;
     };
     templates: {
+        constantsOtp: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         moduleGroup: {
             constantsPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
             schemaPasswordResetMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
@@ -117,16 +130,20 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
             }>;
             schemaUserPasswordMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{
                 TPL_ADMIN_ROLES: {};
+                TPL_REGISTER_MUTATION: {};
                 TPL_USER_OBJECT_TYPE: {};
             }, {
                 authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     cleanupAuthVerificationQueue: {};
                     cleanupAuthVerificationWorker: {};
                     cleanupExpiredAuthVerifications: {};
+                    consumeCodeVerification: {};
                     CookieUserSessionService: {};
                     createAuthVerification: {};
+                    createCodeVerification: {};
                     userSessionPayload: {};
                     validateAuthVerification: {};
+                    validateCodeVerification: {};
                 }>>;
                 pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     builder: {};
@@ -135,21 +152,30 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                 servicesUserPassword: {};
             }>;
             servicesPasswordReset: import("@baseplate-dev/core-generators").TsTemplateFile<{
+                TPL_AUTH_WEB_APP: {};
                 TPL_PASSWORD_CHANGED_EMAIL: {};
                 TPL_PASSWORD_RESET_EMAIL: {};
             }, {
+                appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                    getApiUrl: {};
+                    getWebAppForUrl: {};
+                    getWebOrigins: {};
+                    getWebUrl: {};
+                    WebAppName: {
+                        isTypeOnly: true;
+                    };
+                }>>;
                 authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     cleanupAuthVerificationQueue: {};
                     cleanupAuthVerificationWorker: {};
                     cleanupExpiredAuthVerifications: {};
+                    consumeCodeVerification: {};
                     CookieUserSessionService: {};
                     createAuthVerification: {};
+                    createCodeVerification: {};
                     userSessionPayload: {};
                     validateAuthVerification: {};
-                }>>;
-                configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                    getConfig: {};
-                    isDevelopment: {};
+                    validateCodeVerification: {};
                 }>>;
                 errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     BadRequestError: {};
@@ -259,6 +285,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                 servicesEmailVerification: {};
             }>;
         };
+        schemaEmailOtpMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+            authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
+                cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
+                CookieUserSessionService: {};
+                createAuthVerification: {};
+                createCodeVerification: {};
+                userSessionPayload: {};
+                validateAuthVerification: {};
+                validateCodeVerification: {};
+            }>>;
+            pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                builder: {};
+            }>>;
+        }, {
+            servicesEmailOtp: {};
+        }>;
         schemaEmailVerificationMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 builder: {};
@@ -266,17 +311,43 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
         }, {
             servicesEmailVerification: {};
         }>;
-        servicesEmailVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{
-            TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+        schemaInviteMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_ADMIN_ROLES: {};
+            TPL_USER_OBJECT_TYPE: {};
+        }, {
+            authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
+                cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
+                CookieUserSessionService: {};
+                createAuthVerification: {};
+                createCodeVerification: {};
+                userSessionPayload: {};
+                validateAuthVerification: {};
+                validateCodeVerification: {};
+            }>>;
+            pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                builder: {};
+            }>>;
+        }, {
+            servicesInvite: {};
+        }>;
+        servicesEmailOtp: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_EMAIL_OTP_EMAIL: {};
+            TPL_NAME_REQUIRED_CHECK: {};
         }, {
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 getConfig: {};
@@ -319,6 +390,150 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                     isTypeOnly: true;
                 };
             }>>;
+            userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                UserSessionPayload: {
+                    isTypeOnly: true;
+                };
+                UserSessionService: {
+                    isTypeOnly: true;
+                };
+            }>>;
+        }, {
+            constantsOtp: {};
+            constantsPassword: {};
+        }>;
+        servicesEmailVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+            TPL_AUTH_WEB_APP: {};
+        }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
+                cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
+                CookieUserSessionService: {};
+                createAuthVerification: {};
+                createCodeVerification: {};
+                userSessionPayload: {};
+                validateAuthVerification: {};
+                validateCodeVerification: {};
+            }>>;
+            errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                BadRequestError: {};
+                ForbiddenError: {};
+                handleZodRequestValidationError: {};
+                HttpError: {};
+                InternalServerError: {};
+                logError: {};
+                NotFoundError: {};
+                throwIfPrismaNotFound: {};
+                TooManyRequestsError: {};
+                UnauthorizedError: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+            rateLimitImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createRateLimiter: {};
+                memoizeRateLimiter: {};
+                RateLimiter: {
+                    isTypeOnly: true;
+                };
+                RateLimiterConfig: {
+                    isTypeOnly: true;
+                };
+                RateLimitResult: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createContextFromRequest: {};
+                RequestServiceContext: {
+                    isTypeOnly: true;
+                };
+                RequestServiceContextWith: {
+                    isTypeOnly: true;
+                };
+            }>>;
+        }, {
+            constantsPassword: {};
+        }>;
+        servicesInvite: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_AUTH_WEB_APP: {};
+            TPL_INVITE_EMAIL: {};
+        }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
+                cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
+                CookieUserSessionService: {};
+                createAuthVerification: {};
+                createCodeVerification: {};
+                userSessionPayload: {};
+                validateAuthVerification: {};
+                validateCodeVerification: {};
+            }>>;
+            errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                BadRequestError: {};
+                ForbiddenError: {};
+                handleZodRequestValidationError: {};
+                HttpError: {};
+                InternalServerError: {};
+                logError: {};
+                NotFoundError: {};
+                throwIfPrismaNotFound: {};
+                TooManyRequestsError: {};
+                UnauthorizedError: {};
+            }>>;
+            passwordHasherServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createPasswordHash: {};
+                verifyPasswordHash: {};
+            }>>;
+            prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                PrismaClient: {};
+                Prisma: {};
+                '*': {};
+                $Enums: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+            requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createContextFromRequest: {};
+                RequestServiceContext: {
+                    isTypeOnly: true;
+                };
+                RequestServiceContextWith: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                UserSessionPayload: {
+                    isTypeOnly: true;
+                };
+                UserSessionService: {
+                    isTypeOnly: true;
+                };
+            }>>;
         }, {
             constantsPassword: {};
         }>;