@fonoster/identity 0.27.0 → 0.31.0

package/dist/config/schemas.d.ts

@@ -0,0 +1,392 @@
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { z } from "zod";
+/** RS256 keys, inline or by path. Paths default to the container mount. */
+declare const keysSchema: z.ZodEffects<z.ZodDefault<z.ZodObject<{
+    privateKey: z.ZodOptional<z.ZodString>;
+    publicKey: z.ZodOptional<z.ZodString>;
+    privateKeyPath: z.ZodOptional<z.ZodString>;
+    publicKeyPath: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    privateKey?: string;
+    publicKey?: string;
+    privateKeyPath?: string;
+    publicKeyPath?: string;
+}, {
+    privateKey?: string;
+    publicKey?: string;
+    privateKeyPath?: string;
+    publicKeyPath?: string;
+}>>, {
+    privateKey: string;
+    publicKey: string;
+    privateKeyPath: string;
+    publicKeyPath: string;
+}, {
+    privateKey?: string;
+    publicKey?: string;
+    privateKeyPath?: string;
+    publicKeyPath?: string;
+}>;
+declare const encryptionKeySchema: z.ZodString;
+/** Outgoing email. Optional: without it, anything that sends email fails clearly. */
+declare const smtpSchema: z.ZodObject<{
+    host: z.ZodString;
+    port: z.ZodDefault<z.ZodNumber>;
+    secure: z.ZodDefault<z.ZodBoolean>;
+    sender: z.ZodString;
+    user: z.ZodDefault<z.ZodString>;
+    password: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    user?: string;
+    password?: string;
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    sender?: string;
+}, {
+    user?: string;
+    password?: string;
+    host?: string;
+    port?: number;
+    secure?: boolean;
+    sender?: string;
+}>;
+/** SMS for phone verification. */
+declare const twilioSchema: z.ZodObject<{
+    phoneNumber: z.ZodString;
+    accountSid: z.ZodString;
+    authToken: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    phoneNumber?: string;
+    accountSid?: string;
+    authToken?: string;
+}, {
+    phoneNumber?: string;
+    accountSid?: string;
+    authToken?: string;
+}>;
+/** How people sign in and who may create an account. Community defaults. */
+declare const authFeaturesSchema: z.ZodDefault<z.ZodObject<{
+    methods: z.ZodDefault<z.ZodArray<z.ZodEnum<["password", "email_code", "github"]>, "atleastone">>;
+    signup: z.ZodDefault<z.ZodEnum<["invite", "open"]>>;
+}, "strip", z.ZodTypeAny, {
+    methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+    signup?: "invite" | "open";
+}, {
+    methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+    signup?: "invite" | "open";
+}>>;
+declare const tokensSchema: z.ZodDefault<z.ZodObject<{
+    accessTokenExpiresIn: z.ZodDefault<z.ZodString>;
+    idTokenExpiresIn: z.ZodDefault<z.ZodString>;
+    refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    accessTokenExpiresIn?: string;
+    idTokenExpiresIn?: string;
+    refreshTokenExpiresIn?: string;
+}, {
+    accessTokenExpiresIn?: string;
+    idTokenExpiresIn?: string;
+    refreshTokenExpiresIn?: string;
+}>>;
+declare const securitySchema: z.ZodDefault<z.ZodObject<{
+    contactVerificationRequired: z.ZodDefault<z.ZodBoolean>;
+    twoFactorAuthenticationRequired: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    contactVerificationRequired?: boolean;
+    twoFactorAuthenticationRequired?: boolean;
+}, {
+    contactVerificationRequired?: boolean;
+    twoFactorAuthenticationRequired?: boolean;
+}>>;
+declare const invitesSchema: z.ZodDefault<z.ZodObject<{
+    /** Defaults to <appUrl>/invites. */
+    url: z.ZodOptional<z.ZodString>;
+    /** Defaults to <appUrl>/invites/failed. */
+    failUrl: z.ZodOptional<z.ZodString>;
+    expiration: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    url?: string;
+    failUrl?: string;
+    expiration?: string;
+}, {
+    url?: string;
+    failUrl?: string;
+    expiration?: string;
+}>>;
+declare const oauth2Schema: z.ZodOptional<z.ZodObject<{
+    github: z.ZodObject<{
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+        /** Where users authorize and codes are exchanged. Change only for tests (a fake GitHub). */
+        url: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+        /** GitHub's REST API, for the user and their emails. */
+        apiUrl: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        url?: string;
+        clientId?: string;
+        clientSecret?: string;
+        apiUrl?: string;
+    }, {
+        url?: string;
+        clientId?: string;
+        clientSecret?: string;
+        apiUrl?: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    github?: {
+        url?: string;
+        clientId?: string;
+        clientSecret?: string;
+        apiUrl?: string;
+    };
+}, {
+    github?: {
+        url?: string;
+        clientId?: string;
+        clientSecret?: string;
+        apiUrl?: string;
+    };
+}>>;
+/** First admin, created on first boot. */
+declare const ownerSchema: z.ZodOptional<z.ZodObject<{
+    name: z.ZodDefault<z.ZodString>;
+    email: z.ZodString;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name?: string;
+    email?: string;
+    password?: string;
+}, {
+    name?: string;
+    email?: string;
+    password?: string;
+}>>;
+/**
+ * fonoster.yaml's `identity:` section. Standalone Identity's identity.json has
+ * the same fields at its root (see server/config.ts).
+ */
+declare const identitySectionSchema: z.ZodDefault<z.ZodObject<{
+    /** Defaults to the top-level database. */
+    database: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url?: string;
+    }, {
+        url?: string;
+    }>>;
+    /** Defaults to the app URL. */
+    issuer: z.ZodOptional<z.ZodString>;
+    audience: z.ZodDefault<z.ZodString>;
+    keys: z.ZodEffects<z.ZodDefault<z.ZodObject<{
+        privateKey: z.ZodOptional<z.ZodString>;
+        publicKey: z.ZodOptional<z.ZodString>;
+        privateKeyPath: z.ZodOptional<z.ZodString>;
+        publicKeyPath: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        privateKey?: string;
+        publicKey?: string;
+        privateKeyPath?: string;
+        publicKeyPath?: string;
+    }, {
+        privateKey?: string;
+        publicKey?: string;
+        privateKeyPath?: string;
+        publicKeyPath?: string;
+    }>>, {
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
+    }, {
+        privateKey?: string;
+        publicKey?: string;
+        privateKeyPath?: string;
+        publicKeyPath?: string;
+    }>;
+    tokens: z.ZodDefault<z.ZodObject<{
+        accessTokenExpiresIn: z.ZodDefault<z.ZodString>;
+        idTokenExpiresIn: z.ZodDefault<z.ZodString>;
+        refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
+        refreshTokenExpiresIn?: string;
+    }, {
+        accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
+        refreshTokenExpiresIn?: string;
+    }>>;
+    security: z.ZodDefault<z.ZodObject<{
+        contactVerificationRequired: z.ZodDefault<z.ZodBoolean>;
+        twoFactorAuthenticationRequired: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        contactVerificationRequired?: boolean;
+        twoFactorAuthenticationRequired?: boolean;
+    }, {
+        contactVerificationRequired?: boolean;
+        twoFactorAuthenticationRequired?: boolean;
+    }>>;
+    invites: z.ZodDefault<z.ZodObject<{
+        /** Defaults to <appUrl>/invites. */
+        url: z.ZodOptional<z.ZodString>;
+        /** Defaults to <appUrl>/invites/failed. */
+        failUrl: z.ZodOptional<z.ZodString>;
+        expiration: z.ZodDefault<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
+    }, {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
+    }>>;
+    oauth2: z.ZodOptional<z.ZodObject<{
+        github: z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            /** Where users authorize and codes are exchanged. Change only for tests (a fake GitHub). */
+            url: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+            /** GitHub's REST API, for the user and their emails. */
+            apiUrl: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+        }, "strip", z.ZodTypeAny, {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        }, {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
+    }, {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
+    }>>;
+    owner: z.ZodOptional<z.ZodObject<{
+        name: z.ZodDefault<z.ZodString>;
+        email: z.ZodString;
+        password: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name?: string;
+        email?: string;
+        password?: string;
+    }, {
+        name?: string;
+        email?: string;
+        password?: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    keys?: {
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
+    };
+    owner?: {
+        name?: string;
+        email?: string;
+        password?: string;
+    };
+    database?: {
+        url?: string;
+    };
+    issuer?: string;
+    audience?: string;
+    tokens?: {
+        accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
+        refreshTokenExpiresIn?: string;
+    };
+    security?: {
+        contactVerificationRequired?: boolean;
+        twoFactorAuthenticationRequired?: boolean;
+    };
+    invites?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
+    };
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
+    };
+}, {
+    keys?: {
+        privateKey?: string;
+        publicKey?: string;
+        privateKeyPath?: string;
+        publicKeyPath?: string;
+    };
+    owner?: {
+        name?: string;
+        email?: string;
+        password?: string;
+    };
+    database?: {
+        url?: string;
+    };
+    issuer?: string;
+    audience?: string;
+    tokens?: {
+        accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
+        refreshTokenExpiresIn?: string;
+    };
+    security?: {
+        contactVerificationRequired?: boolean;
+        twoFactorAuthenticationRequired?: boolean;
+    };
+    invites?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
+    };
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
+    };
+}>>;
+type IdentitySection = z.infer<typeof identitySectionSchema>;
+type SmtpConfigSection = z.infer<typeof smtpSchema>;
+type TwilioConfigSection = z.infer<typeof twilioSchema>;
+type AuthFeatures = z.infer<typeof authFeaturesSchema>;
+export { authFeaturesSchema, encryptionKeySchema, invitesSchema, oauth2Schema, ownerSchema, securitySchema, tokensSchema, AuthFeatures, identitySectionSchema, IdentitySection, keysSchema, smtpSchema, SmtpConfigSection, twilioSchema, TwilioConfigSection };

package/dist/config/schemas.js

@@ -0,0 +1,163 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.twilioSchema = exports.smtpSchema = exports.keysSchema = exports.identitySectionSchema = exports.tokensSchema = exports.securitySchema = exports.ownerSchema = exports.oauth2Schema = exports.invitesSchema = exports.encryptionKeySchema = exports.authFeaturesSchema = void 0;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const zod_1 = require("zod");
+const DEFAULT_PRIVATE_KEY_PATH = "/opt/fonoster/keys/private.pem";
+const DEFAULT_PUBLIC_KEY_PATH = "/opt/fonoster/keys/public.pem";
+/** RS256 keys, inline or by path. Paths default to the container mount. */
+const keysSchema = zod_1.z
+    .object({
+    privateKey: zod_1.z.string().optional(),
+    publicKey: zod_1.z.string().optional(),
+    privateKeyPath: zod_1.z.string().optional(),
+    publicKeyPath: zod_1.z.string().optional()
+})
+    .default({})
+    .transform((keys) => {
+    var _a, _b;
+    return ({
+        privateKey: keys.privateKey,
+        publicKey: keys.publicKey,
+        privateKeyPath: keys.privateKey === undefined
+            ? ((_a = keys.privateKeyPath) !== null && _a !== void 0 ? _a : DEFAULT_PRIVATE_KEY_PATH)
+            : undefined,
+        publicKeyPath: keys.publicKey === undefined
+            ? ((_b = keys.publicKeyPath) !== null && _b !== void 0 ? _b : DEFAULT_PUBLIC_KEY_PATH)
+            : undefined
+    });
+});
+exports.keysSchema = keysSchema;
+/**
+ * Key for the encrypted database fields (prisma-field-encryption / cloak):
+ * `k1.aesgcm256.<base64url of 32 bytes>`. Generate one with
+ * `npx @47ng/cloak generate`. The pattern is cloak's own `cloakKeyRegex`
+ * (@47ng/cloak 1.x): base64url (`-` and `_`, never `+` or `/`), 43 characters,
+ * optional `=` padding. A key that fails it would crash at startup with
+ * "Unknown key format", so it is rejected here instead.
+ */
+const CLOAK_KEY_REGEX = /^k1\.aesgcm256\.[A-Za-z0-9_-]{43}=?$/;
+const encryptionKeySchema = zod_1.z.string().regex(CLOAK_KEY_REGEX, {
+    message: 'must look like "k1.aesgcm256.<43 base64url characters>" (A-Z a-z 0-9 - _, no + or /); generate one with `npx @47ng/cloak generate`'
+});
+exports.encryptionKeySchema = encryptionKeySchema;
+/** Outgoing email. Optional: without it, anything that sends email fails clearly. */
+const smtpSchema = zod_1.z.object({
+    host: zod_1.z.string().min(1),
+    port: zod_1.z.number().int().positive().default(587),
+    secure: zod_1.z.boolean().default(false),
+    sender: zod_1.z.string().min(1),
+    user: zod_1.z.string().default(""),
+    password: zod_1.z.string().default("")
+});
+exports.smtpSchema = smtpSchema;
+/** SMS for phone verification. */
+const twilioSchema = zod_1.z.object({
+    phoneNumber: zod_1.z.string().min(1),
+    accountSid: zod_1.z.string().min(1),
+    authToken: zod_1.z.string().min(1)
+});
+exports.twilioSchema = twilioSchema;
+/** How people sign in and who may create an account. Community defaults. */
+const authFeaturesSchema = zod_1.z
+    .object({
+    methods: zod_1.z
+        .array(zod_1.z.enum(["password", "email_code", "github"]))
+        .nonempty()
+        .default(["password"]),
+    signup: zod_1.z.enum(["invite", "open"]).default("invite")
+})
+    .default({});
+exports.authFeaturesSchema = authFeaturesSchema;
+const tokensSchema = zod_1.z
+    .object({
+    accessTokenExpiresIn: zod_1.z.string().default("15m"),
+    idTokenExpiresIn: zod_1.z.string().default("15m"),
+    refreshTokenExpiresIn: zod_1.z.string().default("24h")
+})
+    .default({});
+exports.tokensSchema = tokensSchema;
+const securitySchema = zod_1.z
+    .object({
+    contactVerificationRequired: zod_1.z.boolean().default(false),
+    twoFactorAuthenticationRequired: zod_1.z.boolean().default(false)
+})
+    .default({});
+exports.securitySchema = securitySchema;
+const invitesSchema = zod_1.z
+    .object({
+    /** Defaults to <appUrl>/invites. */
+    url: zod_1.z.string().optional(),
+    /** Defaults to <appUrl>/invites/failed. */
+    failUrl: zod_1.z.string().optional(),
+    expiration: zod_1.z.string().default("1d")
+})
+    .default({});
+exports.invitesSchema = invitesSchema;
+const oauth2Schema = zod_1.z
+    .object({
+    github: zod_1.z.object({
+        clientId: zod_1.z.string().min(1),
+        clientSecret: zod_1.z.string().min(1),
+        /** Where users authorize and codes are exchanged. Change only for tests (a fake GitHub). */
+        url: zod_1.z
+            .string()
+            .url()
+            .default("https://github.com")
+            .transform((v) => v.replace(/\/+$/, "")),
+        /** GitHub's REST API, for the user and their emails. */
+        apiUrl: zod_1.z
+            .string()
+            .url()
+            .default("https://api.github.com")
+            .transform((v) => v.replace(/\/+$/, ""))
+    })
+})
+    .optional();
+exports.oauth2Schema = oauth2Schema;
+/** First admin, created on first boot. */
+const ownerSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().default("Admin"),
+    email: zod_1.z.string().email(),
+    password: zod_1.z.string().min(8)
+})
+    .optional();
+exports.ownerSchema = ownerSchema;
+/**
+ * fonoster.yaml's `identity:` section. Standalone Identity's identity.json has
+ * the same fields at its root (see server/config.ts).
+ */
+const identitySectionSchema = zod_1.z
+    .object({
+    /** Defaults to the top-level database. */
+    database: zod_1.z.object({ url: zod_1.z.string().min(1) }).optional(),
+    /** Defaults to the app URL. */
+    issuer: zod_1.z.string().min(1).optional(),
+    audience: zod_1.z.string().min(1).default("api"),
+    keys: keysSchema,
+    tokens: tokensSchema,
+    security: securitySchema,
+    invites: invitesSchema,
+    oauth2: oauth2Schema,
+    owner: ownerSchema
+})
+    .default({});
+exports.identitySectionSchema = identitySectionSchema;

package/dist/config/toIdentityConfig.d.ts

@@ -0,0 +1,19 @@
+import { IdentityConfig } from "../exchanges/types";
+import { AuthFeatures, IdentitySection, SmtpConfigSection, TwilioConfigSection } from "./schemas";
+type IdentityConfigInputs = {
+    identity: IdentitySection;
+    /** Public base URL, e.g. https://voice.acme.com. Used for issuer and invite links. */
+    appUrl: string;
+    /** Database used when identity.database is not set. */
+    databaseUrl: string;
+    encryptionKey: string;
+    smtp?: SmtpConfigSection;
+    twilio?: TwilioConfigSection;
+    auth?: AuthFeatures;
+};
+/**
+ * Builds the runtime IdentityConfig from validated config sections. Shared by
+ * the apiserver (fonoster.yaml) and standalone Identity (identity.json).
+ */
+declare function toIdentityConfig(inputs: IdentityConfigInputs): IdentityConfig;
+export { toIdentityConfig, IdentityConfigInputs };

package/dist/config/toIdentityConfig.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toIdentityConfig = toIdentityConfig;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const publishedKeys_1 = require("./publishedKeys");
+function readKey(inline, path) {
+    if (inline !== undefined) {
+        return inline;
+    }
+    const fullPath = (0, path_1.resolve)(process.cwd(), path);
+    try {
+        return (0, fs_1.readFileSync)(fullPath, "utf8");
+    }
+    catch (e) {
+        throw new Error(`unable to read identity key at ${fullPath}: ${e.message}`);
+    }
+}
+const trimSlash = (url) => url.replace(/\/+$/, "");
+/**
+ * Builds the runtime IdentityConfig from validated config sections. Shared by
+ * the apiserver (fonoster.yaml) and standalone Identity (identity.json).
+ */
+function toIdentityConfig(inputs) {
+    var _a, _b, _c, _d, _e, _f, _g;
+    const { identity, smtp, twilio } = inputs;
+    const appUrl = trimSlash(inputs.appUrl);
+    const privateKey = readKey(identity.keys.privateKey, identity.keys.privateKeyPath);
+    const publicKey = readKey(identity.keys.publicKey, identity.keys.publicKeyPath);
+    (0, publishedKeys_1.assertUnpublishedKeys)({
+        privateKey,
+        publicKey,
+        encryptionKey: inputs.encryptionKey
+    });
+    return {
+        dbUrl: (_b = (_a = identity.database) === null || _a === void 0 ? void 0 : _a.url) !== null && _b !== void 0 ? _b : inputs.databaseUrl,
+        issuer: (_c = identity.issuer) !== null && _c !== void 0 ? _c : appUrl,
+        audience: identity.audience,
+        privateKey,
+        publicKey,
+        encryptionKey: inputs.encryptionKey,
+        accessTokenExpiresIn: identity.tokens.accessTokenExpiresIn,
+        refreshTokenExpiresIn: identity.tokens.refreshTokenExpiresIn,
+        idTokenExpiresIn: identity.tokens.idTokenExpiresIn,
+        workspaceInviteExpiration: identity.invites.expiration,
+        workspaceInviteUrl: (_d = identity.invites.url) !== null && _d !== void 0 ? _d : `${appUrl}/invites`,
+        workspaceInviteFailUrl: (_e = identity.invites.failUrl) !== null && _e !== void 0 ? _e : `${appUrl}/invites/failed`,
+        resetPasswordUrl: `${appUrl}/reset-password`,
+        contactVerificationRequired: identity.security.contactVerificationRequired,
+        twoFactorAuthenticationRequired: identity.security.twoFactorAuthenticationRequired,
+        smtpConfig: smtp
+            ? {
+                host: smtp.host,
+                port: smtp.port,
+                secure: smtp.secure,
+                sender: smtp.sender,
+                auth: { user: smtp.user, pass: smtp.password }
+            }
+            : undefined,
+        twilioSmsConfig: twilio
+            ? {
+                accountSid: twilio.accountSid,
+                authToken: twilio.authToken,
+                sender: twilio.phoneNumber
+            }
+            : undefined,
+        // Validated by the schema; casts only bridge zod's inference under this
+        // package's non-strict tsconfig.
+        githubOauth2Config: (_f = identity.oauth2) === null || _f === void 0 ? void 0 : _f.github,
+        auth: ((_g = inputs.auth) !== null && _g !== void 0 ? _g : {
+            methods: ["password"],
+            signup: "invite"
+        })
+    };
+}

package/dist/constants.d.ts

@@ -18,3 +18,31 @@
  */
 export declare const SIGN_ALGORITHM = "RS256";
 export declare const VERIFICATION_CODE_EXPIRATION: number;
+/** Wrong guesses allowed before a code stops working. */
+export declare const VERIFICATION_CODE_MAX_ATTEMPTS = 5;
+/** Codes sent per email, and per client IP, within the window. */
+export declare const VERIFICATION_CODE_SEND_LIMITS: {
+    perEmail: number;
+    perIp: number;
+    windowMs: number;
+};
+/** ResetPassword attempts per email, and per client IP, within the window. */
+export declare const RESET_PASSWORD_ATTEMPT_LIMITS: {
+    perEmail: number;
+    perIp: number;
+    windowMs: number;
+};
+/**
+ * Failed sign-ins (ExchangeCredentials, ExchangeVerificationCode) per email,
+ * and per client IP, before sign-in is refused for the rest of the window.
+ */
+export declare const SIGN_IN_FAILURE_LIMITS: {
+    perEmail: number;
+    perIp: number;
+    windowMs: number;
+};
+/**
+ * How long a just-used refresh token may be used again (concurrent renewals,
+ * e.g. two browser tabs). Later reuse revokes the token's family.
+ */
+export declare const REFRESH_TOKEN_REUSE_GRACE_MS: number;