@plumix/core 0.1.0

package/dist/auth/csrf.js

@@ -0,0 +1,80 @@
+/**
+ * Two-layered CSRF protection:
+ *
+ * 1. RPC + auth endpoints: require a custom `X-Plumix-Request: 1` header.
+ *    Browsers cannot set custom headers on cross-origin requests without a
+ *    CORS preflight, and Plumix does not enable CORS — so a forged request
+ *    from another origin cannot include this header.
+ *
+ * 2. Public route mutations (POST/PUT/PATCH/DELETE): validate the Origin
+ *    header (or Referer if Origin is absent) against the site origin. This
+ *    is stateless and CDN-cache compatible.
+ *
+ * Combined with `SameSite=Lax` on the session cookie this covers all modern
+ * browsers; Origin/Referer check covers older clients without SameSite support.
+ */
+export const CSRF_HEADER_NAME = "X-Plumix-Request";
+export const CSRF_HEADER_VALUE = "1";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+export function isSafeMethod(method) {
+    return SAFE_METHODS.has(method.toUpperCase());
+}
+/**
+ * True when the request includes the expected `X-Plumix-Request` header.
+ * Use on RPC and auth endpoints. Returns true for safe (non-mutating)
+ * methods so GETs aren't blocked.
+ */
+export function hasCsrfHeader(request) {
+    if (isSafeMethod(request.method))
+        return true;
+    return request.headers.get(CSRF_HEADER_NAME) === CSRF_HEADER_VALUE;
+}
+/**
+ * Validate Origin (or Referer) for non-safe methods. Returns false on
+ * mismatch / missing header. Safe methods always pass.
+ */
+export function hasMatchingOrigin(request, options) {
+    if (isSafeMethod(request.method))
+        return true;
+    const origin = request.headers.get("origin");
+    if (origin)
+        return options.allowed.includes(origin);
+    // Some legacy clients omit Origin on same-origin POSTs — fall back to Referer.
+    const referer = request.headers.get("referer");
+    if (!referer)
+        return false;
+    try {
+        const refOrigin = new URL(referer).origin;
+        return options.allowed.includes(refOrigin);
+    }
+    catch {
+        return false;
+    }
+}
+export class CsrfError extends Error {
+    static {
+        CsrfError.prototype.name = "CsrfError";
+    }
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+    static missingHeader() {
+        return new CsrfError("missing_header", `Missing required header ${CSRF_HEADER_NAME}: ${CSRF_HEADER_VALUE}`);
+    }
+    static originMismatch() {
+        return new CsrfError("origin_mismatch", "Origin / Referer does not match site");
+    }
+}
+export function requireCsrf(request) {
+    if (!hasCsrfHeader(request)) {
+        throw CsrfError.missingHeader();
+    }
+}
+export function requireMatchingOrigin(request, options) {
+    if (!hasMatchingOrigin(request, options)) {
+        throw CsrfError.originMismatch();
+    }
+}
+//# sourceMappingURL=csrf.js.map

package/dist/auth/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/auth/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,iBAAiB,CAAC;AACrE,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,OAA2B;IAE3B,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpD,+EAA+E;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC;QACE,SAAS,CAAC,SAAS,CAAC,IAAI,GAAG,WAAW,CAAC;IACzC,CAAC;IAEQ,IAAI,CAAuC;IAEpD,YACE,IAA0C,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,aAAa;QAClB,OAAO,IAAI,SAAS,CAClB,gBAAgB,EAChB,2BAA2B,gBAAgB,KAAK,iBAAiB,EAAE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc;QACnB,OAAO,IAAI,SAAS,CAClB,iBAAiB,EACjB,sCAAsC,CACvC,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,CAAC,aAAa,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgB,EAChB,OAA2B;IAE3B,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/auth/device-flow-routes.d.ts

@@ -0,0 +1,28 @@
+import type { AppContext } from "../context/app.js";
+import type { PlumixApp } from "../runtime/app.js";
+/**
+ * POST /_plumix/auth/device/code — RFC 8628 §3.1.
+ *
+ * Public endpoint a CLI hits to begin a device-flow session. No body
+ * required, no client auth, no caller identity. Returns the
+ * device_code (machine-side polling secret) + user_code (human-typed
+ * approval anchor) + the URI the human should visit to approve.
+ *
+ * Dispatcher's CSRF gate fires first (custom header + Origin check);
+ * CLIs are not browsers and trivially set `X-Plumix-Request: 1`.
+ */
+export declare function handleDeviceCodeRequest(ctx: AppContext, app: PlumixApp): Promise<Response>;
+/**
+ * POST /_plumix/auth/device/token — RFC 8628 §3.4.
+ *
+ * Public endpoint the CLI polls until the human approves on the admin.
+ * Standard OAuth 2.0 token-endpoint shape with the device-code grant.
+ * Errors follow §3.5: `authorization_pending` while waiting,
+ * `access_denied` if the human pressed Deny, `expired_token` past
+ * the TTL, `invalid_grant` for unknown device_codes,
+ * `invalid_request` for malformed bodies. We don't emit `slow_down`
+ * — we don't track per-client cadence, the polling client just
+ * keeps the spec-default 5s interval.
+ */
+export declare function handleDeviceTokenExchange(ctx: AppContext): Promise<Response>;
+//# sourceMappingURL=device-flow-routes.d.ts.map

package/dist/auth/device-flow-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-routes.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow-routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA4BnD;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAmBnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,QAAQ,CAAC,CA+BnB"}

package/dist/auth/device-flow-routes.js

@@ -0,0 +1,90 @@
+import * as v from "valibot";
+import { withBasePath } from "../base-path.js";
+import { jsonResponse } from "../runtime/http.js";
+import { exchangeDeviceCode, requestDeviceCode } from "./device-flow.js";
+// RFC 8628 §3.4 grant_type identifier.
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+// Path that the CLI prints to the user. Lands on the admin SPA, which
+// renders the approve flow at the same route. Keep aligned with the
+// admin router's `/auth/device` page.
+const VERIFICATION_PATH = "/_plumix/admin/auth/device";
+// Default name applied to the minted token when the approver didn't
+// type one — we do require it in the approval form, so this is just a
+// belt-and-braces fallback for the row's payload.
+const DEFAULT_TOKEN_NAME = "CLI";
+// Defensive bound on the inbound `device_code` body field. Our generator
+// emits 256-bit base64url (43 chars); 256 chars is generous for
+// future-proofing while bounding malformed-poll amplification.
+const MAX_DEVICE_CODE_LENGTH = 256;
+const exchangeInputSchema = v.object({
+    grant_type: v.literal(DEVICE_CODE_GRANT_TYPE),
+    device_code: v.pipe(v.string(), v.maxLength(MAX_DEVICE_CODE_LENGTH)),
+});
+/**
+ * POST /_plumix/auth/device/code — RFC 8628 §3.1.
+ *
+ * Public endpoint a CLI hits to begin a device-flow session. No body
+ * required, no client auth, no caller identity. Returns the
+ * device_code (machine-side polling secret) + user_code (human-typed
+ * approval anchor) + the URI the human should visit to approve.
+ *
+ * Dispatcher's CSRF gate fires first (custom header + Origin check);
+ * CLIs are not browsers and trivially set `X-Plumix-Request: 1`.
+ */
+export async function handleDeviceCodeRequest(ctx, app) {
+    const { deviceCode, userCode, expiresIn, interval } = await requestDeviceCode(ctx.db);
+    const verificationUri = new URL(withBasePath(VERIFICATION_PATH, app.basePath), app.origin).toString();
+    const verificationUriComplete = `${verificationUri}?user_code=${encodeURIComponent(userCode)}`;
+    return jsonResponse({
+        device_code: deviceCode,
+        user_code: userCode,
+        verification_uri: verificationUri,
+        verification_uri_complete: verificationUriComplete,
+        expires_in: expiresIn,
+        interval,
+    });
+}
+/**
+ * POST /_plumix/auth/device/token — RFC 8628 §3.4.
+ *
+ * Public endpoint the CLI polls until the human approves on the admin.
+ * Standard OAuth 2.0 token-endpoint shape with the device-code grant.
+ * Errors follow §3.5: `authorization_pending` while waiting,
+ * `access_denied` if the human pressed Deny, `expired_token` past
+ * the TTL, `invalid_grant` for unknown device_codes,
+ * `invalid_request` for malformed bodies. We don't emit `slow_down`
+ * — we don't track per-client cadence, the polling client just
+ * keeps the spec-default 5s interval.
+ */
+export async function handleDeviceTokenExchange(ctx) {
+    let body;
+    try {
+        body = await ctx.request.json();
+    }
+    catch {
+        return errorResponse("invalid_request");
+    }
+    const parsed = v.safeParse(exchangeInputSchema, body);
+    if (!parsed.success)
+        return errorResponse("invalid_request");
+    const result = await exchangeDeviceCode(ctx.db, parsed.output.device_code, DEFAULT_TOKEN_NAME);
+    switch (result.outcome) {
+        case "approved":
+            return jsonResponse({
+                access_token: result.secret,
+                token_type: "Bearer",
+            });
+        case "pending":
+            return errorResponse("authorization_pending");
+        case "denied":
+            return errorResponse("access_denied");
+        case "expired":
+            return errorResponse("expired_token");
+        case "invalid":
+            return errorResponse("invalid_grant");
+    }
+}
+function errorResponse(error) {
+    return jsonResponse({ error }, { status: 400 });
+}
+//# sourceMappingURL=device-flow-routes.js.map

package/dist/auth/device-flow-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow-routes.js","sourceRoot":"","sources":["../../src/auth/device-flow-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAI7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEzE,uCAAuC;AACvC,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAE9E,sEAAsE;AACtE,oEAAoE;AACpE,sCAAsC;AACtC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAEvD,oEAAoE;AACpE,sEAAsE;AACtE,kDAAkD;AAClD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,yEAAyE;AACzE,gEAAgE;AAChE,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;CACrE,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAe,EACf,GAAc;IAEd,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,CAC3E,GAAG,CAAC,EAAE,CACP,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,YAAY,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,EAC7C,GAAG,CAAC,MAAM,CACX,CAAC,QAAQ,EAAE,CAAC;IACb,MAAM,uBAAuB,GAAG,GAAG,eAAe,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAE/F,OAAO,YAAY,CAAC;QAClB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;QACnB,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,uBAAuB;QAClD,UAAU,EAAE,SAAS;QACrB,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAe;IAEf,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,GAAG,CAAC,EAAE,EACN,MAAM,CAAC,MAAM,CAAC,WAAW,EACzB,kBAAkB,CACnB,CAAC;IAEF,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,YAAY,CAAC;gBAClB,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,UAAU,EAAE,QAAQ;aACrB,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,uBAAuB,CAAC,CAAC;QAChD,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,eAAe,CAAC,CAAC;QACxC,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,eAAe,CAAC,CAAC;QACxC,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/auth/device-flow.d.ts

@@ -0,0 +1,111 @@
+import type { Db } from "../context/app.js";
+import type { DeviceCode } from "../db/schema/device_codes.js";
+export declare const DEVICE_FLOW_TTL_SECONDS: number;
+export declare const DEVICE_FLOW_INTERVAL_SECONDS = 5;
+interface DeviceCodeRequest {
+    /** What the client polls with. ~256 bits of entropy. */
+    readonly deviceCode: string;
+    /** What the human types into the admin to approve. ~30 bits. */
+    readonly userCode: string;
+    readonly expiresIn: number;
+    readonly interval: number;
+}
+/**
+ * Begin a device-flow session. The caller (raw route handler) returns
+ * the response shape directly to the client; this function only
+ * persists the DB row.
+ */
+export declare function requestDeviceCode(db: Db): Promise<DeviceCodeRequest>;
+export type LookupUserCodeResult = {
+    readonly outcome: "ok";
+    readonly id: string;
+    readonly row: DeviceCode;
+} | {
+    readonly outcome: "not_found";
+} | {
+    readonly outcome: "expired";
+} | {
+    readonly outcome: "already_approved";
+} | {
+    readonly outcome: "already_denied";
+};
+/**
+ * Find the device-code row matching a `user_code` typed by the
+ * authenticated browser user. Used by the admin's approval page —
+ * the user navigates to `/_plumix/admin/auth/device`, types their
+ * code, and the page calls this to render the confirm/deny prompt.
+ */
+export declare function lookupDeviceCodeByUserCode(db: Db, userCode: string): Promise<LookupUserCodeResult>;
+/**
+ * Approve a pending device-code row. Idempotent — the WHERE clause
+ * pins `status = pending` so two concurrent approves race on the
+ * primitive itself: the first transitions, the second updates zero
+ * rows and returns false. Same guard prevents `denied → approved`
+ * (a deny followed by a stale approve is a no-op) and re-approval
+ * after exchange (the row is gone).
+ *
+ * `scopes` may be null to let the minted token inherit the approver's
+ * full role caps; non-null narrows the token to that intersection.
+ *
+ * Returns true when a row transitioned, false when none did. Callers
+ * pre-check via `lookupDeviceCodeByUserCode` to surface the specific
+ * outcome (expired vs already_approved vs already_denied vs
+ * not_found); a `false` here despite a successful prior lookup means
+ * a concurrent approve/deny landed first.
+ */
+export declare function approveDeviceCode(db: Db, input: {
+    id: string;
+    userId: number;
+    tokenName?: string;
+    scopes?: readonly string[] | null;
+}): Promise<boolean>;
+/**
+ * Deny a pending device-code row. Same `status = pending` guard as
+ * `approveDeviceCode` — a deny on an already-approved row is a
+ * no-op (we don't revoke an active approval via deny), and a
+ * second-tab deny after the first deny lands is silently a no-op.
+ *
+ * The polling client gets `access_denied` on its next exchange and
+ * stops polling. The row is preserved (not deleted) until exchange
+ * so the polling client sees the deny outcome rather than a generic
+ * `invalid_grant` — exchange consumes denied rows the same way it
+ * consumes approved ones.
+ */
+export declare function denyDeviceCode(db: Db, input: {
+    id: string;
+}): Promise<boolean>;
+type ExchangeDeviceCodeResult = {
+    readonly outcome: "approved";
+    readonly secret: string;
+    readonly userId: number;
+} | {
+    readonly outcome: "pending";
+} | {
+    readonly outcome: "denied";
+} | {
+    readonly outcome: "expired";
+} | {
+    readonly outcome: "invalid";
+};
+/**
+ * Polled by the client. Returns the freshly-minted API token once a
+ * browser-side approval has set the row's `status`; the device-code
+ * row is consumed on success/deny/expiry so a leaked device_code
+ * can't be exchanged twice.
+ *
+ * Concurrency: the consume-then-mint path is `DELETE … RETURNING`,
+ * not `SELECT` then `DELETE` then `INSERT`. Two concurrent polls of
+ * the same approved row cannot both proceed — the second `DELETE`
+ * affects zero rows and returns `pending` (the row is gone, but the
+ * surface contract is "the human approved, your CLI got the token
+ * via the other poll" → effectively the protocol's success path
+ * from the *user's* perspective; the polling client sees `pending`
+ * once and `invalid_grant` thereafter, both terminal).
+ *
+ * Pending rows fall through with no DB write. A leaked device_code
+ * polling against a still-pending row burns one read per poll but
+ * can't race itself into a token.
+ */
+export declare function exchangeDeviceCode(db: Db, rawDeviceCode: string, defaultTokenName: string): Promise<ExchangeDeviceCodeResult>;
+export {};
+//# sourceMappingURL=device-flow.d.ts.map

package/dist/auth/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAyC/D,eAAO,MAAM,uBAAuB,QAA0B,CAAC;AAC/D,eAAO,MAAM,4BAA4B,IAAoC,CAAC;AAE9E,UAAU,iBAAiB;IACzB,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkB1E;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE3C;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAa/B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,GACA,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACpB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,KAAK,wBAAwB,GACzB;IACE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,EAAE,EACN,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,wBAAwB,CAAC,CAqDnC"}

package/dist/auth/device-flow.js

@@ -0,0 +1,221 @@
+import { encodeBase64urlNoPadding } from "@oslojs/encoding";
+import { and, eq } from "../db/index.js";
+import { deviceCodes } from "../db/schema/device_codes.js";
+import { createApiToken } from "./api-tokens.js";
+import { hashToken } from "./tokens.js";
+// OAuth 2.0 Device Authorization Grant — RFC 8628. Used by CLIs / MCP
+// servers / anything without a browser to bootstrap an API token via
+// the operator's existing browser session. Two secrets per flow:
+//
+//   device_code (high-entropy, machine-side) — what the client polls
+//                with; never shown to the human, never typed.
+//   user_code   (low-entropy, human-readable) — what the human types
+//                into the admin's `/auth/device` page to approve.
+//
+// Persistence (see `db/schema/device_codes.ts` for the full rationale):
+//   row.id        = SHA-256(device_code)         (PK)
+//   row.userCode  = "ABCD-EFGH"                  (unique, plaintext)
+//   row.userId    = null until approved
+//   row.status    = "pending" | "approved" | "denied"
+//   row.tokenName = approver-set token label
+//   row.scopes    = capability whitelist or null (inherit)
+//   row.expiresAt = now + 10min                  (RFC 8628 §3.5)
+//
+// Polling intervals follow the spec defaults:
+//   client polls every `interval` seconds (5).
+//   pre-approval: returns "authorization_pending" / "slow_down".
+//   post-approval: returns the API token, then deletes the device row.
+//   post-deny: returns "access_denied", deletes the row.
+//   post-expiry: returns "expired_token".
+const DEVICE_CODE_BYTES = 32;
+// Base32 alphabet, ambiguous-char-stripped: 0/O/1/I removed. 8 chars
+// in two groups of 4 ("ABCD-EFGH") gives 30 bits — enough that brute
+// force across the 10-minute TTL is infeasible without distinguishing
+// the device_code (~2^-19 odds per attempt with rate-limiting).
+const USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+const USER_CODE_LENGTH = 8;
+const DEVICE_CODE_TTL_SECONDS = 10 * 60;
+const DEVICE_CODE_POLL_INTERVAL_SECONDS = 5;
+export const DEVICE_FLOW_TTL_SECONDS = DEVICE_CODE_TTL_SECONDS;
+export const DEVICE_FLOW_INTERVAL_SECONDS = DEVICE_CODE_POLL_INTERVAL_SECONDS;
+/**
+ * Begin a device-flow session. The caller (raw route handler) returns
+ * the response shape directly to the client; this function only
+ * persists the DB row.
+ */
+export async function requestDeviceCode(db) {
+    const deviceCode = generateDeviceCode();
+    const userCode = generateUserCode();
+    const id = await hashToken(deviceCode);
+    const expiresAt = new Date(Date.now() + DEVICE_CODE_TTL_SECONDS * 1000);
+    await db.insert(deviceCodes).values({
+        id,
+        userCode,
+        expiresAt,
+    });
+    return {
+        deviceCode,
+        userCode,
+        expiresIn: DEVICE_CODE_TTL_SECONDS,
+        interval: DEVICE_CODE_POLL_INTERVAL_SECONDS,
+    };
+}
+/**
+ * Find the device-code row matching a `user_code` typed by the
+ * authenticated browser user. Used by the admin's approval page —
+ * the user navigates to `/_plumix/admin/auth/device`, types their
+ * code, and the page calls this to render the confirm/deny prompt.
+ */
+export async function lookupDeviceCodeByUserCode(db, userCode) {
+    const row = await db
+        .select()
+        .from(deviceCodes)
+        .where(eq(deviceCodes.userCode, userCode))
+        .get();
+    if (!row)
+        return { outcome: "not_found" };
+    if (row.expiresAt.getTime() < Date.now()) {
+        return { outcome: "expired" };
+    }
+    if (row.status === "approved")
+        return { outcome: "already_approved" };
+    if (row.status === "denied")
+        return { outcome: "already_denied" };
+    return { outcome: "ok", id: row.id, row };
+}
+/**
+ * Approve a pending device-code row. Idempotent — the WHERE clause
+ * pins `status = pending` so two concurrent approves race on the
+ * primitive itself: the first transitions, the second updates zero
+ * rows and returns false. Same guard prevents `denied → approved`
+ * (a deny followed by a stale approve is a no-op) and re-approval
+ * after exchange (the row is gone).
+ *
+ * `scopes` may be null to let the minted token inherit the approver's
+ * full role caps; non-null narrows the token to that intersection.
+ *
+ * Returns true when a row transitioned, false when none did. Callers
+ * pre-check via `lookupDeviceCodeByUserCode` to surface the specific
+ * outcome (expired vs already_approved vs already_denied vs
+ * not_found); a `false` here despite a successful prior lookup means
+ * a concurrent approve/deny landed first.
+ */
+export async function approveDeviceCode(db, input) {
+    const result = await db
+        .update(deviceCodes)
+        .set({
+        userId: input.userId,
+        status: "approved",
+        ...(input.tokenName !== undefined ? { tokenName: input.tokenName } : {}),
+        ...(input.scopes !== undefined ? { scopes: input.scopes } : {}),
+    })
+        .where(and(eq(deviceCodes.id, input.id), eq(deviceCodes.status, "pending")))
+        .returning({ id: deviceCodes.id });
+    return result.length > 0;
+}
+/**
+ * Deny a pending device-code row. Same `status = pending` guard as
+ * `approveDeviceCode` — a deny on an already-approved row is a
+ * no-op (we don't revoke an active approval via deny), and a
+ * second-tab deny after the first deny lands is silently a no-op.
+ *
+ * The polling client gets `access_denied` on its next exchange and
+ * stops polling. The row is preserved (not deleted) until exchange
+ * so the polling client sees the deny outcome rather than a generic
+ * `invalid_grant` — exchange consumes denied rows the same way it
+ * consumes approved ones.
+ */
+export async function denyDeviceCode(db, input) {
+    const result = await db
+        .update(deviceCodes)
+        .set({ status: "denied" })
+        .where(and(eq(deviceCodes.id, input.id), eq(deviceCodes.status, "pending")))
+        .returning({ id: deviceCodes.id });
+    return result.length > 0;
+}
+/**
+ * Polled by the client. Returns the freshly-minted API token once a
+ * browser-side approval has set the row's `status`; the device-code
+ * row is consumed on success/deny/expiry so a leaked device_code
+ * can't be exchanged twice.
+ *
+ * Concurrency: the consume-then-mint path is `DELETE … RETURNING`,
+ * not `SELECT` then `DELETE` then `INSERT`. Two concurrent polls of
+ * the same approved row cannot both proceed — the second `DELETE`
+ * affects zero rows and returns `pending` (the row is gone, but the
+ * surface contract is "the human approved, your CLI got the token
+ * via the other poll" → effectively the protocol's success path
+ * from the *user's* perspective; the polling client sees `pending`
+ * once and `invalid_grant` thereafter, both terminal).
+ *
+ * Pending rows fall through with no DB write. A leaked device_code
+ * polling against a still-pending row burns one read per poll but
+ * can't race itself into a token.
+ */
+export async function exchangeDeviceCode(db, rawDeviceCode, defaultTokenName) {
+    const id = await hashToken(rawDeviceCode);
+    const row = await db
+        .select()
+        .from(deviceCodes)
+        .where(eq(deviceCodes.id, id))
+        .get();
+    if (!row)
+        return { outcome: "invalid" };
+    if (row.expiresAt.getTime() < Date.now()) {
+        // Reap eagerly so the row doesn't sit until the prune pass.
+        await db.delete(deviceCodes).where(eq(deviceCodes.id, id));
+        return { outcome: "expired" };
+    }
+    if (row.status === "denied") {
+        // Consume on first poll so a leaked device_code can't keep
+        // discovering "user denied this" past the click.
+        await db.delete(deviceCodes).where(eq(deviceCodes.id, id));
+        return { outcome: "denied" };
+    }
+    if (row.status !== "approved" || row.userId === null) {
+        return { outcome: "pending" };
+    }
+    // Atomic consume: only the first concurrent poll on an approved
+    // row gets back the row. The second sees zero rows from
+    // DELETE…RETURNING and resolves to "pending" (which the polling
+    // client treats as continue-polling; the next poll sees no row at
+    // all and gets "invalid"). Without this, two concurrent polls
+    // could both mint a token from one approval.
+    const consumed = await db
+        .delete(deviceCodes)
+        .where(and(eq(deviceCodes.id, id), eq(deviceCodes.status, "approved")))
+        .returning({
+        userId: deviceCodes.userId,
+        tokenName: deviceCodes.tokenName,
+        scopes: deviceCodes.scopes,
+    });
+    const winner = consumed[0];
+    if (winner?.userId == null)
+        return { outcome: "pending" };
+    const minted = await createApiToken(db, {
+        userId: winner.userId,
+        name: winner.tokenName ?? defaultTokenName,
+        expiresAt: null,
+        scopes: winner.scopes ?? null,
+    });
+    return {
+        outcome: "approved",
+        secret: minted.secret,
+        userId: winner.userId,
+    };
+}
+function generateDeviceCode() {
+    const bytes = new Uint8Array(DEVICE_CODE_BYTES);
+    crypto.getRandomValues(bytes);
+    return encodeBase64urlNoPadding(bytes);
+}
+function generateUserCode() {
+    const bytes = new Uint8Array(USER_CODE_LENGTH);
+    crypto.getRandomValues(bytes);
+    let raw = "";
+    for (const byte of bytes) {
+        raw += USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];
+    }
+    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/auth/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAI5D,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,qEAAqE;AACrE,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,sDAAsD;AACtD,qEAAqE;AACrE,wCAAwC;AACxC,sDAAsD;AACtD,6CAA6C;AAC7C,2DAA2D;AAC3D,iEAAiE;AACjE,EAAE;AACF,8CAA8C;AAC9C,+CAA+C;AAC/C,iEAAiE;AACjE,uEAAuE;AACvE,yDAAyD;AACzD,0CAA0C;AAE1C,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,MAAM,kBAAkB,GAAG,kCAAkC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AACxC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,iCAAiC,CAAC;AAW9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAM;IAC5C,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAExE,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAClC,EAAE;QACF,QAAQ;QACR,SAAS;KACV,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,QAAQ;QACR,SAAS,EAAE,uBAAuB;QAClC,QAAQ,EAAE,iCAAiC;KAC5C,CAAC;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAM,EACN,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,EAAE;SACR,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;SACzC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,KAKC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC;QACH,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,UAAU;QAClB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SAC3E,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,KAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACzB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SAC3E,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAM,EACN,aAAqB,EACrB,gBAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,MAAM,EAAE;SACR,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAC7B,GAAG,EAAE,CAAC;IAET,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzC,4DAA4D;QAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,2DAA2D;QAC3D,iDAAiD;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,gEAAgE;IAChE,wDAAwD;IACxD,gEAAgE;IAChE,kEAAkE;IAClE,8DAA8D;IAC9D,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,WAAW,CAAC;SACnB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;SACtE,SAAS,CAAC;QACT,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,MAAM,EAAE,WAAW,CAAC,MAAM;KAC3B,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,EAAE,MAAM,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAE1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;QAC1C,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,IAAI,kBAAkB,CAAC,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC"}

package/dist/auth/email/messages.d.ts

@@ -0,0 +1,21 @@
+interface MagicLinkMessages {
+    readonly subject: (siteName: string) => string;
+    readonly body: (siteName: string, url: string, ttlSeconds: number) => string;
+}
+interface EmailChangeMessages {
+    readonly subject: (siteName: string) => string;
+    readonly body: (args: {
+        readonly siteName: string;
+        readonly oldEmail: string;
+        readonly newEmail: string;
+        readonly url: string;
+        readonly ttlSeconds: number;
+    }) => string;
+}
+interface EmailLocaleStrings {
+    readonly magicLink: MagicLinkMessages;
+    readonly emailChange: EmailChangeMessages;
+}
+export declare function emailStringsFor(locale: string | undefined): EmailLocaleStrings;
+export {};
+//# sourceMappingURL=messages.d.ts.map

package/dist/auth/email/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/auth/email/messages.ts"],"names":[],"mappings":"AAWA,UAAU,iBAAiB;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9E;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,KAAK,MAAM,CAAC;CACd;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;CAC3C;AAqFD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,kBAAkB,CAMpB"}