@owlmeans/auth-email 0.0.0-stage → 0.1.19-rc.0

package/README.md

@@ -1,3 +1,152 @@
-# Temporary Holding Version
+# @owlmeans/auth-email
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The shared contracts of OwlMeans e-mail sign-in — a mailed PIN, an optional password, remembered
+devices and an optional captcha: the protocol factory `makeEmailAuthProtocols`, the AJV request
+schemas, the views, the constants and the error family. Server and browser both depend on it so
+they agree on every route, field and value. It contains no runtime behaviour: a server serves the
+routes with `@owlmeans/server-auth-email`, a browser signs in with `@owlmeans/web-auth-email`.
+
+## Installation
+
+```bash
+bun add @owlmeans/auth-email@^0.1.19-rc.0
+```
+
+`ajv` and `ajv-formats` are peer dependencies (the schemas use `format: 'email'`).
+
+## Concepts
+
+- **PIN sign-in** — `pin` mails a 6-digit PIN and answers a signed `challenge`, identically for a
+  known and a new address; `signIn` with `challenge` + `pin` signs the person in (registering the
+  account on first use) and remembers the device.
+- **Password sign-in** — `signIn` with `password` (+ `captcha`). On a remembered device it answers a
+  `token`; on an unknown one the password is NOT checked: a PIN is mailed and the answer is
+  `{ challenge, reason: 'device' }`, the same for a wrong password, a right one and no account.
+- **One sign-in body** — `EmailSignInRequest` carries both modes' optional fields; the server
+  accepts exactly one mode (`challenge` + `pin`, or `password`) and refuses anything else.
+- **Device** — a random id the browser keeps (`EMAIL_DEVICE_ID_PATTERN`); remembered for
+  `EMAIL_DEVICE_TTL_DAYS`, at most `EMAIL_DEVICE_LIMIT` per account.
+- **Offer** — a PIN sign-in of a person without a password who has not declined one also answers a
+  one-use `offer` ticket (`EMAIL_OFFER_TTL_SECONDS`): `password.set` with it needs no second PIN.
+  Later set/change/remove are confirmed by a PIN from `password.pin`.
+- **Tech routes** — developer tooling (`GUARD_ED25519` + the `EMAIL_AUTH_TECH_GATE` gate): rewrite
+  a pending PIN, or get a signed waiver (`EMAIL_WAIVER_HEADER`) that skips captcha and throttles.
+- **No organization on the wire** — no request body carries `entitySlug` or `source`; the address
+  alone decides the account.
+
+## Routes
+
+`makeEmailAuthProtocols(opts)` — default base `/auth/email`:
+
+| Protocol | Alias | Method + path | Guard | Body → answer |
+|---|---|---|---|---|
+| `options` | `auth-email:options` | GET `/options` | none | → `EmailAuthOptionsView` |
+| `pin` | `auth-email:pin` | POST `/pin` | none | `EmailPinRequest` → `EmailChallengeView` |
+| `signIn` | `auth-email:sign-in` | POST `/sign-in` | none | `EmailSignInRequest` → `EmailSignInView` |
+| `password.status` | `auth-email:password:status` | GET `/password` | `opts.guards` + `opts.gate` | → `EmailPasswordStatusView` |
+| `password.pin` | `auth-email:password:pin` | POST `/password/pin` | same | `EmailPasswordPinRequest` → `EmailChallengeView` |
+| `password.set` | `auth-email:password:set` | POST `/password/set` | same | `EmailPasswordSetRequest` → `EmailPasswordStatusView` |
+| `password.remove` | `auth-email:password:remove` | POST `/password/remove` | same | `EmailPasswordRemoveRequest` → `EmailPasswordStatusView` |
+| `password.decline` | `auth-email:password:decline` | POST `/password/decline` | same | `{}` → `EmailPasswordStatusView` |
+| `tech.pin` | `auth-email:tech:pin` | POST `/tech/pin` | `GUARD_ED25519` + tech gate | `EmailTechPinRequest` → `EmailTechPinView` |
+| `tech.waiver` | `auth-email:tech:waiver` | POST `/tech/waiver` | same | `{}` → `EmailTechWaiverView` |
+| `offer` | `auth-email:offer` | screen `/login/password` | — | frontend, sticky |
+
+The bases `base` (`auth-email:base`), `password.base` (`auth-email:password`) and `tech.base`
+(`auth-email:tech`) carry the guards their children inherit and have no handler.
+
+## Usage
+
+```typescript
+import { DEFAULT_GUARD } from '@owlmeans/auth-common'
+import { makeEmailAuthProtocols } from '@owlmeans/auth-email'
+
+// One tree, shared by the server and the browser.
+export const emailAuthProtocols = makeEmailAuthProtocols({
+  guards: DEFAULT_GUARD,                    // the password routes need the app's session
+  gate: { alias: APP_AUTH_GATE },
+})
+```
+
+| Option | Default | Effect |
+|---|---|---|
+| `path` / `parent` | `/auth/email` / none | where the guest base sits |
+| `guards` + `gate` | — | the password subtree's guards; required unless `passwordParent` |
+| `passwordParent` | the guest base | mount `/password` under an already guarded route instead |
+| `techGuards` / `techGate` | `[GUARD_ED25519]` / `{ alias: EMAIL_AUTH_TECH_GATE }` | the tech subtree's guards |
+| `screen` | `{ path: '/login/password' }`, top level | the offer screen |
+
+Neither `guards` nor `passwordParent` throws a `SyntaxError` at declaration time.
+
+## API
+
+### Constants
+
+| Symbol | Value |
+|---|---|
+| `EMAIL_LOGIN_METHOD` | `'email'` — client plugin type and login method id |
+| `EMAIL_PIN_AUTH_TYPE` / `EMAIL_PASSWORD_AUTH_TYPE` | `'email-pin'` / `'email-password'` — private server plugins and token types |
+| `EMAIL_CONFIRM_ENVELOPE` / `EMAIL_WAIVER_ENVELOPE` | `'email-confirm'` / `'email-waiver'` |
+| `EMAIL_WAIVER_HEADER` | `'x-owlmeans-email-waiver'` |
+| `EMAIL_CAPTCHA_ACTION_PIN` / `EMAIL_CAPTCHA_ACTION_PASSWORD` | `'email_pin'` / `'email_password'` |
+| `EMAIL_CAPTCHA_PROVIDER` | `'recaptcha-v3'` |
+| `EMAIL_IDENTITY_TYPE` | `'email-otp'` — the identity-linking details type (equals `OTP_AUTH_TYPE`), never a token type |
+| `EMAIL_PIN_LENGTH` / `EMAIL_PIN_PATTERN` | `6` / `'^[0-9]{6}$'` |
+| `EMAIL_DEVICE_TTL_DAYS` / `EMAIL_DEVICE_LIMIT` / `EMAIL_DEVICE_ID_PATTERN` | `30` / `10` / `'^[A-Za-z0-9_-]{22,64}$'` |
+| `EMAIL_OFFER_TTL_SECONDS` / `EMAIL_WAIVER_TTL_SECONDS` | `900` / `7200` |
+| `EMAIL_PASSWORD_MIN_LENGTH` / `EMAIL_PASSWORD_MAX_LENGTH` | `8` / `128` (policy, checked by the server) |
+| `EMAIL_ADDRESS_MAX_LENGTH`, `EMAIL_PASSWORD_WIRE_MAX_LENGTH`, `EMAIL_TOKEN_MAX_LENGTH`, `EMAIL_LOCALE_MAX_LENGTH` | `254`, `1024`, `4096`, `16` — wire bounds |
+| `EMAIL_AUTH_LOCALES` | `['en', 'pl', 'ru', 'be', 'uk', 'es', 'de', 'fr']` (frozen) |
+| `EmailPasswordPurpose` | `Set = 'set'`, `Change = 'change'`, `Remove = 'remove'` |
+| `EmailSignInReason` | `Device = 'device'` |
+| `EMAIL_AUTH_SERVICE` / `EMAIL_LOGIN_SERVICE` / `EMAIL_AUTH_TECH_GATE` | `'auth-email'` / `'auth-email-client'` / `'auth-email:tech-gate'` |
+| `EMAIL_AUTH_API_PATH` / `EMAIL_AUTH_OFFER_PATH` | `'/auth/email'` / `'/login/password'` |
+| `EMAIL_AUTH_*` aliases | `BASE`, `OPTIONS`, `PIN`, `SIGN_IN`, `PASSWORD`, `PASSWORD_STATUS`, `PASSWORD_PIN`, `PASSWORD_SET`, `PASSWORD_REMOVE`, `PASSWORD_DECLINE`, `TECH`, `TECH_PIN`, `TECH_WAIVER`, `OFFER` |
+
+### Schemas
+
+`EmailPinRequestSchema`, `EmailSignInRequestSchema`, `EmailPasswordPinRequestSchema`,
+`EmailPasswordSetRequestSchema`, `EmailPasswordRemoveRequestSchema`, `EmailTechPinRequestSchema`,
+`EmailEmptyRequestSchema` — every one `additionalProperties: false`; `email` is `format: 'email'`
+up to 254 characters, `pin` six digits, `device` the device-id pattern, `password` 1–1024 characters.
+
+### Errors
+
+| Class | Status | Meaning |
+|---|---|---|
+| `EmailAuthError` | — | base, message `auth-email:<reason>` |
+| `EmailPasswordDisabled` | 404 | passwords are not offered here |
+| `EmailPasswordWeak` | 422 | the new password breaks the policy |
+| `EmailOfferExpired` | 409 | the offer ticket is spent, expired or another account's |
+| `EmailTechDisabled` | 404 | the developer routes are off |
+| `EmailAuthUnavailable` | 503 | a store, mailer or captcha authority failed; fail closed |
+
+A wrong PIN or password is `AuthenFailed` from `@owlmeans/auth`, never one of these.
+
+## Common pitfalls
+
+- Do not send `entitySlug` or `source` in a body — every schema refuses unknown fields.
+- Trim and lowercase the address before sending it; `format: 'email'` refuses surrounding spaces.
+- Never bind the tech routes where developer tooling is off; the server checks its flag per request.
+
+## Related packages
+
+- [`@owlmeans/auth-otp`](../auth-otp) — the PIN issuance and verification contract
+- [`@owlmeans/auth-common`](../auth-common) — `GUARD_ED25519` and `signBasicEd25519Request` for the tech routes
+- [`@owlmeans/entrypoint`](../entrypoint) / [`@owlmeans/route`](../route) — the protocol DSL
+
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded agent skills under `agent-meta/`. After installing your
+`@owlmeans/*` packages, run the OwlMeans agent-skills installer to place them into
+your project's skill store (`.agents/skills/`):
+
+```sh
+npx @owlmeans/agent-skills@^0.1.19-rc.0
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/manifest.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": 3,
+  "package": "@owlmeans/auth-email",
+  "version": "0.1.19-rc.0",
+  "generatedAt": "2026-11-01T17:08:08.394Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "auth-email",
+      "category": "package-specific",
+      "file": "skills/auth-email/SKILL.md",
+      "canonicalPath": ".agents/skills/auth-email/SKILL.md"
+    }
+  ]
+}

package/agent-meta/skills/auth-email/SKILL.md

@@ -0,0 +1,107 @@
+---
+name: auth-email
+description: How to use @owlmeans/auth-email — the runtime-free contracts of OwlMeans e-mail sign-in (a mailed PIN, an optional password, remembered devices, an optional captcha, developer tech routes). Covers makeEmailAuthProtocols and its options (guest base, guarded password subtree, Ed25519 tech subtree, the offer screen), the wire shapes and AJV schemas, the EMAIL_* constants (token types email-pin / email-password, the email-otp identity type, waiver header, captcha actions, device/offer/waiver limits) and the error family. Auto-invoked when declaring the e-mail sign-in routes of an app, importing any EMAIL_* constant, Email* view/request/schema or error, or deciding where the password routes are guarded.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/auth-email
+
+**Layer:** Auth shared (L6 — `auth`, `auth-common`, `context`, `entrypoint`, `error`, `route`; `ajv` + `ajv-formats` peers)
+**Install:** `"@owlmeans/auth-email": "^0.1.19-rc.0"` in `dependencies`
+**Halves:** `@owlmeans/server-auth-email` serves the routes, `@owlmeans/web-auth-email` signs a
+person in. This package holds no behaviour — the tree, schemas, views, constants and errors both
+sides must agree on.
+
+## The model in one paragraph
+
+`pin` mails a 6-digit PIN and answers a signed `challenge`, identically for a known and a new
+address; `signIn` with `challenge` + `pin` signs the person in, registering the account on first
+use, and remembers the device. `signIn` with `password` answers a token on a REMEMBERED device; on
+any other device the password is NOT checked — a PIN is mailed and the answer is
+`{ challenge, reason: 'device' }`, the same for a wrong password, a right one and no account. A PIN
+sign-in of a person without a password who has not declined one also answers a one-use `offer`
+ticket; `password.set` with it needs no second PIN. Later set/change/remove are confirmed by a PIN
+from `password.pin`. No body carries `entitySlug` or `source`: the address alone decides the account.
+
+## The tree — `makeEmailAuthProtocols(opts)`
+
+Default base `/auth/email` (`EMAIL_AUTH_API_PATH`):
+
+| Protocol | Method + path | Guard | Body → answer |
+|---|---|---|---|
+| `options` | GET `/options` | none | → `{ password, captcha: { provider, siteKey } \| null, pinLength }` |
+| `pin` | POST `/pin` | none | `{ email, locale?, captcha? }` → `{ challenge }` |
+| `signIn` | POST `/sign-in` | none | PIN `{ email, device, challenge, pin }` or password `{ email, device, password, captcha? }` → `{ token?, offer?, challenge?, reason? }` |
+| `password.status` | GET `/password` | `opts.guards` + `opts.gate` | → `{ enabled, set, declined, updatedAt? }` |
+| `password.pin` | POST `/password/pin` | same | `{ purpose: set\|change\|remove, locale? }` → `{ challenge }` |
+| `password.set` | POST `/password/set` | same | `{ password, offer }` or `{ password, challenge, pin }` (+ `device?`) → status |
+| `password.remove` | POST `/password/remove` | same | `{ challenge, pin, device? }` → status |
+| `password.decline` | POST `/password/decline` | same | `{}` → status |
+| `tech.pin` | POST `/tech/pin` | `opts.techGuards` + `opts.techGate` | `{ challenge, pin }` → `{ ok }` |
+| `tech.waiver` | POST `/tech/waiver` | same | `{}` → `{ waiver, expiresAt }` |
+| `offer` | screen `/login/password` | — | frontend, sticky: the post-sign-in "set a password" step |
+
+The bases (`base`, `password.base`, `tech.base`) carry the guards their children inherit and have no
+handler. Aliases are `auth-email:<name>` (`EMAIL_AUTH_*` constants).
+
+| Option | Default | Effect |
+|---|---|---|
+| `path` / `parent` | `/auth/email` / none | where the guest base sits — keep it UNGUARDED: a guest calls it |
+| `guards` + `gate` | — | the password subtree's guards; required unless `passwordParent` (neither → `SyntaxError` at declaration) |
+| `passwordParent` | the guest base | mount `/password` under an already guarded route instead |
+| `techGuards` / `techGate` | `[GUARD_ED25519]` / `{ alias: EMAIL_AUTH_TECH_GATE }` | the developer subtree |
+| `screen` | `{ path: '/login/password' }` | the offer screen |
+
+```typescript
+import { DEFAULT_GUARD } from '@owlmeans/auth-common'
+import { makeEmailAuthProtocols } from '@owlmeans/auth-email'
+
+export const emailAuthProtocols = makeEmailAuthProtocols({ guards: [DEFAULT_GUARD], gate: { alias: APP_GATE } })
+```
+
+**Declare it as a tree of its own**, never inside an app tree whose guarding is copied onto every
+leaf (an access-token coguard, a tree-wide gate): the guest routes must stay unguarded, and an access
+token must never set or remove a password. Pin it to the one service that serves it. The frozen tree
+interface has no index signature — cast it for `bindAll`, as for marketing consent.
+
+## Constants that are contracts
+
+| Symbol | Value | Meaning |
+|---|---|---|
+| `EMAIL_LOGIN_METHOD` | `'email'` | client plugin type and login method id |
+| `EMAIL_PIN_AUTH_TYPE` / `EMAIL_PASSWORD_AUTH_TYPE` | `'email-pin'` / `'email-password'` | the private server plugins and the signed token types — never `email-otp` |
+| `EMAIL_IDENTITY_TYPE` | `'email-otp'` | the identity-LINKING details type (= `OTP_AUTH_TYPE`), so OTP and e-mail sign-in land on one account per address; never a token type |
+| `EMAIL_CONFIRM_ENVELOPE` / `EMAIL_WAIVER_ENVELOPE` | `'email-confirm'` / `'email-waiver'` | signed envelope types |
+| `EMAIL_WAIVER_HEADER` | `'x-owlmeans-email-waiver'` | where a developer waiver travels |
+| `EMAIL_CAPTCHA_ACTION_PIN` / `_PASSWORD` | `'email_pin'` / `'email_password'` | the exact reCAPTCHA actions |
+| `EMAIL_PIN_LENGTH` / `EMAIL_PIN_PATTERN` | `6` / `'^[0-9]{6}$'` | |
+| `EMAIL_DEVICE_TTL_DAYS` / `EMAIL_DEVICE_LIMIT` / `EMAIL_DEVICE_ID_PATTERN` | `30` / `10` / `'^[A-Za-z0-9_-]{22,64}$'` | the device id is 16 random bytes, base64url |
+| `EMAIL_OFFER_TTL_SECONDS` / `EMAIL_WAIVER_TTL_SECONDS` | `900` / `7200` | |
+| `EMAIL_PASSWORD_MIN_LENGTH` / `_MAX_LENGTH` | `8` / `128` | policy, checked by the server; the wire admits 1–1024 |
+| `EMAIL_AUTH_LOCALES` | `en pl ru be uk es de fr` | the built-in mail and UI languages |
+| `EMAIL_AUTH_SERVICE` / `EMAIL_LOGIN_SERVICE` / `EMAIL_AUTH_TECH_GATE` | `'auth-email'` / `'auth-email-client'` / `'auth-email:tech-gate'` | service aliases |
+| `EmailPasswordPurpose`, `EmailSignInReason` | `set`/`change`/`remove`; `device` | enums |
+
+## Schemas and errors
+
+Every request schema (`Email*RequestSchema`, `EmailEmptyRequestSchema`) is
+`additionalProperties: false`; `email` is `format: 'email'` ≤ 254 characters — trim and lowercase it
+before sending. A body with both modes or neither is refused by the server (`AuthUnknown`, 400).
+
+| Class | Status | Meaning |
+|---|---|---|
+| `EmailAuthError` | — | base, message `auth-email:<reason>` |
+| `EmailPasswordDisabled` | 404 | passwords are not offered here |
+| `EmailPasswordWeak` | 422 | the new password breaks the policy |
+| `EmailOfferExpired` | 409 | the offer ticket is spent, expired or another account's |
+| `EmailTechDisabled` | 404 | the developer routes are off |
+| `EmailAuthUnavailable` | 503 | a store, mailer or captcha authority failed — fail closed |
+
+A wrong PIN, password or captcha is an `AuthenFailed` from `@owlmeans/auth` (the server's
+`EmailCredentialRefused` 401 / `EmailVerificationRefused` 403), never one of these.
+
+## Related
+
+`server-auth-email` · `web-auth-email` · `server-auth-otp` (the PIN store and its five attempts) ·
+`captcha` · `marketing-consent` (the same tree + screen + step pattern)

package/build/consts.d.ts

@@ -0,0 +1,78 @@
+/** The client `AuthenticationPlugin` type and the login method id of e-mail sign-in. */
+export declare const EMAIL_LOGIN_METHOD = "email";
+/** The private server plugin of a PIN sign-in, and the type its signed token carries. */
+export declare const EMAIL_PIN_AUTH_TYPE = "email-pin";
+/** The private server plugin of a password sign-in, and the type its signed token carries. */
+export declare const EMAIL_PASSWORD_AUTH_TYPE = "email-password";
+/** A purpose-bound confirmation challenge (set, change or remove a password). */
+export declare const EMAIL_CONFIRM_ENVELOPE = "email-confirm";
+/** A developer's captcha and throttle waiver. */
+export declare const EMAIL_WAIVER_ENVELOPE = "email-waiver";
+/** The request header that carries an `EMAIL_WAIVER_ENVELOPE`. */
+export declare const EMAIL_WAIVER_HEADER = "x-owlmeans-email-waiver";
+/** The captcha action of a send-PIN request. */
+export declare const EMAIL_CAPTCHA_ACTION_PIN = "email_pin";
+/** The captcha action of a password sign-in. */
+export declare const EMAIL_CAPTCHA_ACTION_PASSWORD = "email_password";
+/**
+ * The identity-linking details type of an account's e-mail credential — the same value as
+ * `OTP_AUTH_TYPE` (`@owlmeans/auth-otp`), so e-mail sign-in and e-mail OTP land on one account.
+ * It names a credential, never a token type.
+ */
+export declare const EMAIL_IDENTITY_TYPE = "email-otp";
+/** The captcha provider an options view may name. */
+export declare const EMAIL_CAPTCHA_PROVIDER = "recaptcha-v3";
+/** Digits in a PIN — the same as `OTP_CODE_LENGTH` (`@owlmeans/auth-otp`). */
+export declare const EMAIL_PIN_LENGTH = 6;
+export declare const EMAIL_PIN_PATTERN = "^[0-9]{6}$";
+/** How long a device stays remembered after a successful sign-in on it. */
+export declare const EMAIL_DEVICE_TTL_DAYS = 30;
+/** Remembered devices per account; the oldest beyond it are forgotten. */
+export declare const EMAIL_DEVICE_LIMIT = 10;
+/** A device id: 22 base64url characters (16 random bytes) from the client, up to 64 accepted. */
+export declare const EMAIL_DEVICE_ID_PATTERN = "^[A-Za-z0-9_-]{22,64}$";
+/** Lifetime of the one-use "set a password" offer ticket a PIN sign-in returns. */
+export declare const EMAIL_OFFER_TTL_SECONDS = 900;
+/** Lifetime of a developer waiver. */
+export declare const EMAIL_WAIVER_TTL_SECONDS = 7200;
+export declare const EMAIL_PASSWORD_MIN_LENGTH = 8;
+export declare const EMAIL_PASSWORD_MAX_LENGTH = 128;
+/** Wire bounds of the request fields (the password policy above is checked by the server). */
+export declare const EMAIL_ADDRESS_MAX_LENGTH = 254;
+export declare const EMAIL_PASSWORD_WIRE_MAX_LENGTH = 1024;
+export declare const EMAIL_TOKEN_MAX_LENGTH = 4096;
+export declare const EMAIL_LOCALE_MAX_LENGTH = 16;
+/** The languages the sign-in mails are written in; any other locale falls back to `en`. */
+export declare const EMAIL_AUTH_LOCALES: readonly ["en", "pl", "ru", "be", "uk", "es", "de", "fr"];
+export declare enum EmailPasswordPurpose {
+    Set = "set",
+    Change = "change",
+    Remove = "remove"
+}
+export declare enum EmailSignInReason {
+    /** The password was not checked: the device is unknown, so a PIN was mailed instead. */
+    Device = "device"
+}
+/** The server service alias. */
+export declare const EMAIL_AUTH_SERVICE = "auth-email";
+/** The client service alias. */
+export declare const EMAIL_LOGIN_SERVICE = "auth-email-client";
+/** The gate service standing over the developer (tech) routes. */
+export declare const EMAIL_AUTH_TECH_GATE = "auth-email:tech-gate";
+export declare const EMAIL_AUTH_API_PATH = "/auth/email";
+export declare const EMAIL_AUTH_OFFER_PATH = "/login/password";
+export declare const EMAIL_AUTH_BASE = "auth-email:base";
+export declare const EMAIL_AUTH_OPTIONS = "auth-email:options";
+export declare const EMAIL_AUTH_PIN = "auth-email:pin";
+export declare const EMAIL_AUTH_SIGN_IN = "auth-email:sign-in";
+export declare const EMAIL_AUTH_PASSWORD = "auth-email:password";
+export declare const EMAIL_AUTH_PASSWORD_STATUS = "auth-email:password:status";
+export declare const EMAIL_AUTH_PASSWORD_PIN = "auth-email:password:pin";
+export declare const EMAIL_AUTH_PASSWORD_SET = "auth-email:password:set";
+export declare const EMAIL_AUTH_PASSWORD_REMOVE = "auth-email:password:remove";
+export declare const EMAIL_AUTH_PASSWORD_DECLINE = "auth-email:password:decline";
+export declare const EMAIL_AUTH_TECH = "auth-email:tech";
+export declare const EMAIL_AUTH_TECH_PIN = "auth-email:tech:pin";
+export declare const EMAIL_AUTH_TECH_WAIVER = "auth-email:tech:waiver";
+export declare const EMAIL_AUTH_OFFER = "auth-email:offer";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,UAAU,CAAA;AAEzC,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,cAAc,CAAA;AAE9C,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,mBAAmB,CAAA;AAExD,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAErD,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iBAAiB,CAAA;AAEnD,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,4BAA4B,CAAA;AAE5D,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,cAAc,CAAA;AAEnD,gDAAgD;AAChD,eAAO,MAAM,6BAA6B,mBAAmB,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAA;AAE9C,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,iBAAiB,CAAA;AAIpD,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,IAAI,CAAA;AACjC,eAAO,MAAM,iBAAiB,eAAe,CAAA;AAE7C,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,KAAK,CAAA;AACpC,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,2BAA2B,CAAA;AAE/D,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C,sCAAsC;AACtC,eAAO,MAAM,wBAAwB,OAAO,CAAA;AAE5C,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAC3C,eAAO,MAAM,8BAA8B,OAAO,CAAA;AAClD,eAAO,MAAM,sBAAsB,OAAO,CAAA;AAC1C,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,2DAA2E,CAAA;AAE1G,oBAAY,oBAAoB;IAC9B,GAAG,QAAQ;IACX,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,iBAAiB;IAC3B,wFAAwF;IACxF,MAAM,WAAW;CAClB;AAID,gCAAgC;AAChC,eAAO,MAAM,kBAAkB,eAAe,CAAA;AAC9C,gCAAgC;AAChC,eAAO,MAAM,mBAAmB,sBAAsB,CAAA;AACtD,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAI1D,eAAO,MAAM,mBAAmB,gBAAgB,CAAA;AAChD,eAAO,MAAM,qBAAqB,oBAAoB,CAAA;AAItD,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAChD,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAC9C,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AACxD,eAAO,MAAM,0BAA0B,+BAA+B,CAAA;AACtE,eAAO,MAAM,uBAAuB,4BAA4B,CAAA;AAChE,eAAO,MAAM,uBAAuB,4BAA4B,CAAA;AAChE,eAAO,MAAM,0BAA0B,+BAA+B,CAAA;AACtE,eAAO,MAAM,2BAA2B,gCAAgC,CAAA;AACxE,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAChD,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AACxD,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAC9D,eAAO,MAAM,gBAAgB,qBAAqB,CAAA"}

package/build/consts.js

@@ -0,0 +1,85 @@
+// --- Methods, auth types and envelopes ---------------------------------------------------------
+/** The client `AuthenticationPlugin` type and the login method id of e-mail sign-in. */
+export const EMAIL_LOGIN_METHOD = 'email';
+/** The private server plugin of a PIN sign-in, and the type its signed token carries. */
+export const EMAIL_PIN_AUTH_TYPE = 'email-pin';
+/** The private server plugin of a password sign-in, and the type its signed token carries. */
+export const EMAIL_PASSWORD_AUTH_TYPE = 'email-password';
+/** A purpose-bound confirmation challenge (set, change or remove a password). */
+export const EMAIL_CONFIRM_ENVELOPE = 'email-confirm';
+/** A developer's captcha and throttle waiver. */
+export const EMAIL_WAIVER_ENVELOPE = 'email-waiver';
+/** The request header that carries an `EMAIL_WAIVER_ENVELOPE`. */
+export const EMAIL_WAIVER_HEADER = 'x-owlmeans-email-waiver';
+/** The captcha action of a send-PIN request. */
+export const EMAIL_CAPTCHA_ACTION_PIN = 'email_pin';
+/** The captcha action of a password sign-in. */
+export const EMAIL_CAPTCHA_ACTION_PASSWORD = 'email_password';
+/**
+ * The identity-linking details type of an account's e-mail credential — the same value as
+ * `OTP_AUTH_TYPE` (`@owlmeans/auth-otp`), so e-mail sign-in and e-mail OTP land on one account.
+ * It names a credential, never a token type.
+ */
+export const EMAIL_IDENTITY_TYPE = 'email-otp';
+/** The captcha provider an options view may name. */
+export const EMAIL_CAPTCHA_PROVIDER = 'recaptcha-v3';
+// --- Policy ------------------------------------------------------------------------------------
+/** Digits in a PIN — the same as `OTP_CODE_LENGTH` (`@owlmeans/auth-otp`). */
+export const EMAIL_PIN_LENGTH = 6;
+export const EMAIL_PIN_PATTERN = '^[0-9]{6}$';
+/** How long a device stays remembered after a successful sign-in on it. */
+export const EMAIL_DEVICE_TTL_DAYS = 30;
+/** Remembered devices per account; the oldest beyond it are forgotten. */
+export const EMAIL_DEVICE_LIMIT = 10;
+/** A device id: 22 base64url characters (16 random bytes) from the client, up to 64 accepted. */
+export const EMAIL_DEVICE_ID_PATTERN = '^[A-Za-z0-9_-]{22,64}$';
+/** Lifetime of the one-use "set a password" offer ticket a PIN sign-in returns. */
+export const EMAIL_OFFER_TTL_SECONDS = 900;
+/** Lifetime of a developer waiver. */
+export const EMAIL_WAIVER_TTL_SECONDS = 7200;
+export const EMAIL_PASSWORD_MIN_LENGTH = 8;
+export const EMAIL_PASSWORD_MAX_LENGTH = 128;
+/** Wire bounds of the request fields (the password policy above is checked by the server). */
+export const EMAIL_ADDRESS_MAX_LENGTH = 254;
+export const EMAIL_PASSWORD_WIRE_MAX_LENGTH = 1024;
+export const EMAIL_TOKEN_MAX_LENGTH = 4096;
+export const EMAIL_LOCALE_MAX_LENGTH = 16;
+/** The languages the sign-in mails are written in; any other locale falls back to `en`. */
+export const EMAIL_AUTH_LOCALES = Object.freeze(['en', 'pl', 'ru', 'be', 'uk', 'es', 'de', 'fr']);
+export var EmailPasswordPurpose;
+(function (EmailPasswordPurpose) {
+    EmailPasswordPurpose["Set"] = "set";
+    EmailPasswordPurpose["Change"] = "change";
+    EmailPasswordPurpose["Remove"] = "remove";
+})(EmailPasswordPurpose || (EmailPasswordPurpose = {}));
+export var EmailSignInReason;
+(function (EmailSignInReason) {
+    /** The password was not checked: the device is unknown, so a PIN was mailed instead. */
+    EmailSignInReason["Device"] = "device";
+})(EmailSignInReason || (EmailSignInReason = {}));
+// --- Service aliases ---------------------------------------------------------------------------
+/** The server service alias. */
+export const EMAIL_AUTH_SERVICE = 'auth-email';
+/** The client service alias. */
+export const EMAIL_LOGIN_SERVICE = 'auth-email-client';
+/** The gate service standing over the developer (tech) routes. */
+export const EMAIL_AUTH_TECH_GATE = 'auth-email:tech-gate';
+// --- Paths -------------------------------------------------------------------------------------
+export const EMAIL_AUTH_API_PATH = '/auth/email';
+export const EMAIL_AUTH_OFFER_PATH = '/login/password';
+// --- Protocol tree aliases ---------------------------------------------------------------------
+export const EMAIL_AUTH_BASE = 'auth-email:base';
+export const EMAIL_AUTH_OPTIONS = 'auth-email:options';
+export const EMAIL_AUTH_PIN = 'auth-email:pin';
+export const EMAIL_AUTH_SIGN_IN = 'auth-email:sign-in';
+export const EMAIL_AUTH_PASSWORD = 'auth-email:password';
+export const EMAIL_AUTH_PASSWORD_STATUS = 'auth-email:password:status';
+export const EMAIL_AUTH_PASSWORD_PIN = 'auth-email:password:pin';
+export const EMAIL_AUTH_PASSWORD_SET = 'auth-email:password:set';
+export const EMAIL_AUTH_PASSWORD_REMOVE = 'auth-email:password:remove';
+export const EMAIL_AUTH_PASSWORD_DECLINE = 'auth-email:password:decline';
+export const EMAIL_AUTH_TECH = 'auth-email:tech';
+export const EMAIL_AUTH_TECH_PIN = 'auth-email:tech:pin';
+export const EMAIL_AUTH_TECH_WAIVER = 'auth-email:tech:waiver';
+export const EMAIL_AUTH_OFFER = 'auth-email:offer';
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAEzC,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE9C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,gBAAgB,CAAA;AAExD,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAA;AAErD,iDAAiD;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAA;AAEnD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAA;AAE5D,gDAAgD;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAA;AAEnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAE9C,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAA;AAEpD,kGAAkG;AAElG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AACjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAE7C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAA;AACpC,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAA;AAE/D,mFAAmF;AACnF,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAC1C,sCAAsC;AACtC,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAE5C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAC1C,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAE5C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAC3C,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAA;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAA;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAEzC,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC,CAAA;AAE1G,MAAM,CAAN,IAAY,oBAIX;AAJD,WAAY,oBAAoB;IAC9B,mCAAW,CAAA;IACX,yCAAiB,CAAA;IACjB,yCAAiB,CAAA;AACnB,CAAC,EAJW,oBAAoB,KAApB,oBAAoB,QAI/B;AAED,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,wFAAwF;IACxF,sCAAiB,CAAA;AACnB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED,kGAAkG;AAElG,gCAAgC;AAChC,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAC9C,gCAAgC;AAChC,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAA;AACtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAA;AAE1D,kGAAkG;AAElG,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAA;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAA;AAEtD,kGAAkG;AAElG,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAChD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAA;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAA;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAA;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAA;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAA;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AACxD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAA"}

package/build/entrypoints.d.ts

@@ -0,0 +1,16 @@
+import type { EmailAuthEntrypointOptions, EmailAuthEntrypoints } from './types.js';
+/**
+ * The e-mail sign-in surface:
+ *
+ * - the guest base (`opts.path`, default `/auth/email`, under `opts.parent`) carries NO guards —
+ *   `options` GET `/options`, `pin` POST `/pin`, `signIn` POST `/sign-in`;
+ * - `password` (`/password`, under the guest base or `opts.passwordParent`) acts on the caller's own
+ *   account, so it needs the application's session: `opts.guards` (+ `opts.gate`) or a guarded
+ *   `opts.passwordParent` — neither is a declaration error, not a runtime one. `status` GET `/`,
+ *   `pin` POST `/pin`, `set` POST `/set`, `remove` POST `/remove`, `decline` POST `/decline`;
+ * - `tech` (`/tech`, developer tooling) defaults to `GUARD_ED25519` + the `EMAIL_AUTH_TECH_GATE`
+ *   gate: `pin` POST `/pin`, `waiver` POST `/waiver`;
+ * - `offer`, the top-level sticky frontend screen of the post-sign-in password offer.
+ */
+export declare const makeEmailAuthProtocols: (opts?: EmailAuthEntrypointOptions) => EmailAuthEntrypoints;
+//# sourceMappingURL=entrypoints.d.ts.map

package/build/entrypoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.d.ts","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,0BAA0B,EAAE,oBAAoB,EAGjD,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,UAAU,0BAA0B,KAAQ,oBAmF9E,CAAA"}

package/build/entrypoints.js

@@ -0,0 +1,58 @@
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
+import { backend, frontend, route, RouteMethod } from '@owlmeans/route';
+import { GUARD_ED25519 } from '@owlmeans/auth-common';
+import { EMAIL_AUTH_API_PATH, EMAIL_AUTH_BASE, EMAIL_AUTH_OFFER, EMAIL_AUTH_OFFER_PATH, EMAIL_AUTH_OPTIONS, EMAIL_AUTH_PASSWORD, EMAIL_AUTH_PASSWORD_DECLINE, EMAIL_AUTH_PASSWORD_PIN, EMAIL_AUTH_PASSWORD_REMOVE, EMAIL_AUTH_PASSWORD_SET, EMAIL_AUTH_PASSWORD_STATUS, EMAIL_AUTH_PIN, EMAIL_AUTH_SIGN_IN, EMAIL_AUTH_TECH, EMAIL_AUTH_TECH_GATE, EMAIL_AUTH_TECH_PIN, EMAIL_AUTH_TECH_WAIVER, } from './consts.js';
+import { EmailEmptyRequestSchema, EmailPasswordPinRequestSchema, EmailPasswordRemoveRequestSchema, EmailPasswordSetRequestSchema, EmailPinRequestSchema, EmailSignInRequestSchema, EmailTechPinRequestSchema, } from './schemas.js';
+/**
+ * The e-mail sign-in surface:
+ *
+ * - the guest base (`opts.path`, default `/auth/email`, under `opts.parent`) carries NO guards —
+ *   `options` GET `/options`, `pin` POST `/pin`, `signIn` POST `/sign-in`;
+ * - `password` (`/password`, under the guest base or `opts.passwordParent`) acts on the caller's own
+ *   account, so it needs the application's session: `opts.guards` (+ `opts.gate`) or a guarded
+ *   `opts.passwordParent` — neither is a declaration error, not a runtime one. `status` GET `/`,
+ *   `pin` POST `/pin`, `set` POST `/set`, `remove` POST `/remove`, `decline` POST `/decline`;
+ * - `tech` (`/tech`, developer tooling) defaults to `GUARD_ED25519` + the `EMAIL_AUTH_TECH_GATE`
+ *   gate: `pin` POST `/pin`, `waiver` POST `/waiver`;
+ * - `offer`, the top-level sticky frontend screen of the post-sign-in password offer.
+ */
+export const makeEmailAuthProtocols = (opts = {}) => {
+    if (opts.passwordParent == null && opts.guards == null) {
+        throw new SyntaxError('auth-email: the password routes need either a passwordParent or explicit guards');
+    }
+    const get = (alias, path, parent) => route(alias, path, backend({ parent, method: RouteMethod.GET }));
+    const post = (alias, path, parent) => route(alias, path, backend({ parent, method: RouteMethod.POST }));
+    const base = openProtocol(route(EMAIL_AUTH_BASE, opts.path ?? EMAIL_AUTH_API_PATH, backend({ parent: opts.parent })));
+    const passwordOptions = {
+        ...(opts.guards != null ? { guards: opts.guards } : {}),
+        ...(opts.gate != null ? { gate: opts.gate } : {}),
+    };
+    const passwordBase = openProtocol(route(EMAIL_AUTH_PASSWORD, '/password', backend({ parent: opts.passwordParent ?? base })), passwordOptions);
+    const techBase = openProtocol(route(EMAIL_AUTH_TECH, '/tech', backend({ parent: base })), {
+        guards: opts.techGuards ?? [GUARD_ED25519],
+        gate: opts.techGate ?? { alias: EMAIL_AUTH_TECH_GATE },
+    });
+    return {
+        base,
+        options: protocol(get(EMAIL_AUTH_OPTIONS, '/options', base), contract(typed())),
+        pin: protocol(post(EMAIL_AUTH_PIN, '/pin', base), contract.request({ body: typed(EmailPinRequestSchema) }, typed())),
+        signIn: protocol(post(EMAIL_AUTH_SIGN_IN, '/sign-in', base), contract.request({ body: typed(EmailSignInRequestSchema) }, typed())),
+        password: {
+            base: passwordBase,
+            status: protocol(get(EMAIL_AUTH_PASSWORD_STATUS, '/', passwordBase), contract(typed())),
+            pin: protocol(post(EMAIL_AUTH_PASSWORD_PIN, '/pin', passwordBase), contract.request({ body: typed(EmailPasswordPinRequestSchema) }, typed())),
+            set: protocol(post(EMAIL_AUTH_PASSWORD_SET, '/set', passwordBase), contract.request({ body: typed(EmailPasswordSetRequestSchema) }, typed())),
+            remove: protocol(post(EMAIL_AUTH_PASSWORD_REMOVE, '/remove', passwordBase), contract.request({ body: typed(EmailPasswordRemoveRequestSchema) }, typed())),
+            decline: protocol(post(EMAIL_AUTH_PASSWORD_DECLINE, '/decline', passwordBase), contract.request({ body: typed(EmailEmptyRequestSchema) }, typed())),
+        },
+        tech: {
+            base: techBase,
+            pin: protocol(post(EMAIL_AUTH_TECH_PIN, '/pin', techBase), contract.request({ body: typed(EmailTechPinRequestSchema) }, typed())),
+            waiver: protocol(post(EMAIL_AUTH_TECH_WAIVER, '/waiver', techBase), contract.request({ body: typed(EmailEmptyRequestSchema) }, typed())),
+        },
+        // A top-level frontend screen, `sticky` so the router keeps it regardless of `cfg.service`
+        // filtering — the same shape as marketing consent's screen.
+        offer: openProtocol(route(EMAIL_AUTH_OFFER, opts.screen?.path ?? EMAIL_AUTH_OFFER_PATH, frontend({ parent: opts.screen?.parent })), { sticky: true }),
+    };
+};
+//# sourceMappingURL=entrypoints.js.map

package/build/entrypoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoints.js","sourceRoot":"","sources":["../src/entrypoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAE9E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EACL,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EACjG,mBAAmB,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,0BAA0B,EACrG,uBAAuB,EAAE,0BAA0B,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EACxG,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,GAClE,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,uBAAuB,EAAE,6BAA6B,EAAE,gCAAgC,EACxF,6BAA6B,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,yBAAyB,GAC1G,MAAM,cAAc,CAAA;AAOrB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAI,GAA+B,EAAE,EAAwB,EAAE;IACpG,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,WAAW,CAAC,iFAAiF,CAAC,CAAA;IAC1G,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAoC,EAAE,EAAE,CAChF,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAoC,EAAE,EAAE,CACjF,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAEnE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,IAAI,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IAErH,MAAM,eAAe,GAAsB;QACzC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAA;IACD,MAAM,YAAY,GAAG,YAAY,CAC/B,KAAK,CAAC,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,eAAe,CAC3G,CAAA;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QACxF,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACvD,CAAC,CAAA;IAEF,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAwB,CAAC,CAAC;QACrG,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,EAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAkB,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAsB,CAAC,CACvG;QACD,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,EAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAqB,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAmB,CAAC,CAC1G;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,QAAQ,CACd,GAAG,CAAC,0BAA0B,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,EAA2B,CAAC,CAC/F;YACD,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,uBAAuB,EAAE,MAAM,EAAE,YAAY,CAAC,EACnD,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAA0B,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAsB,CACrG,CACF;YACD,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,uBAAuB,EAAE,MAAM,EAAE,YAAY,CAAC,EACnD,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAA0B,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAA2B,CAC1G,CACF;YACD,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,0BAA0B,EAAE,SAAS,EAAE,YAAY,CAAC,EACzD,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAA6B,gCAAgC,CAAC,EAAE,EAC7E,KAAK,EAA2B,CACjC,CACF;YACD,OAAO,EAAE,QAAQ,CACf,IAAI,CAAC,2BAA2B,EAAE,UAAU,EAAE,YAAY,CAAC,EAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAoB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAA2B,CAAC,CAChH;SACF;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAsB,yBAAyB,CAAC,EAAE,EAAE,KAAK,EAAoB,CAAC,CAC7G;YACD,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,sBAAsB,EAAE,SAAS,EAAE,QAAQ,CAAC,EACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAoB,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAuB,CAAC,CAC5G;SACF;QACD,2FAA2F;QAC3F,4DAA4D;QAC5D,KAAK,EAAE,YAAY,CACjB,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,qBAAqB,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAC9G,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB;KACF,CAAA;AACH,CAAC,CAAA"}

package/build/errors.d.ts

@@ -0,0 +1,43 @@
+import { ResilientError } from '@owlmeans/error';
+/**
+ * The e-mail sign-in error family, shared by the server that throws and the client that reads it
+ * back (each class is registered, so it survives the wire). A failed PIN or password check is
+ * `AuthenFailed` from `@owlmeans/auth`, never one of these: no answer here may tell an unknown
+ * address from a wrong credential.
+ */
+export declare class EmailAuthError extends ResilientError {
+    static typeName: string;
+    constructor(message?: string);
+}
+/** A password sign-in or a password route on a deployment that does not offer passwords. */
+export declare class EmailPasswordDisabled extends EmailAuthError {
+    static typeName: string;
+    static httpStatus: number;
+    constructor(message?: string);
+}
+/** A new password the policy refuses (length bounds); the message names the rule. */
+export declare class EmailPasswordWeak extends EmailAuthError {
+    static typeName: string;
+    static httpStatus: number;
+    constructor(message?: string);
+}
+/** The one-use offer ticket is spent, expired or another account's — confirm with a PIN instead. */
+export declare class EmailOfferExpired extends EmailAuthError {
+    static typeName: string;
+    static httpStatus: number;
+    constructor(message?: string);
+}
+/** A developer (tech) route on a deployment where they are off: answers as if it did not exist. */
+export declare class EmailTechDisabled extends EmailAuthError {
+    static typeName: string;
+    static httpStatus: number;
+    constructor(message?: string);
+}
+/** A store, mailer or captcha authority could not be consulted, so the request fails closed. */
+export declare class EmailAuthUnavailable extends EmailAuthError {
+    static typeName: string;
+    static httpStatus: number;
+    static allowServerErrorStatus: boolean;
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,cAAc;IAChD,OAAuB,QAAQ,EAAE,MAAM,CAAmB;IAE1D,YAAY,OAAO,GAAE,MAAgB,EAEpC;CACF;AAED,4FAA4F;AAC5F,qBAAa,qBAAsB,SAAQ,cAAc;IACvD,OAAuB,QAAQ,EAAE,MAAM,CAA+C;IACtF,OAAc,UAAU,SAAM;IAE9B,YAAY,OAAO,GAAE,MAAmB,EAGvC;CACF;AAED,qFAAqF;AACrF,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,OAAuB,QAAQ,EAAE,MAAM,CAA2C;IAClF,OAAc,UAAU,SAAM;IAE9B,YAAY,OAAO,GAAE,MAAiB,EAGrC;CACF;AAED,oGAAoG;AACpG,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,OAAuB,QAAQ,EAAE,MAAM,CAA2C;IAClF,OAAc,UAAU,SAAM;IAE9B,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF;AAED,mGAAmG;AACnG,qBAAa,iBAAkB,SAAQ,cAAc;IACnD,OAAuB,QAAQ,EAAE,MAAM,CAA2C;IAClF,OAAc,UAAU,SAAM;IAE9B,YAAY,OAAO,GAAE,MAAe,EAGnC;CACF;AAED,gGAAgG;AAChG,qBAAa,oBAAqB,SAAQ,cAAc;IACtD,OAAuB,QAAQ,EAAE,MAAM,CAA0C;IACjF,OAAc,UAAU,SAAM;IAC9B,OAAc,sBAAsB,UAAO;IAE3C,YAAY,OAAO,GAAE,MAAsB,EAG1C;CACF"}