@plumix/core 0.1.0

package/dist/auth/magic-link/request.js

@@ -0,0 +1,119 @@
+import { withBasePath } from "../../base-path.js";
+import { eq } from "../../db/index.js";
+import { allowedDomains } from "../../db/schema/allowed_domains.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { users } from "../../db/schema/users.js";
+import { emailStringsFor } from "../email/messages.js";
+import { extractDomain } from "../identity.js";
+import { generateToken, hashToken } from "../tokens.js";
+// 15-minute default — the Copenhagen Book / emdash convention for
+// passwordless sign-in tokens. Long enough to survive normal email
+// delivery, short enough that a stolen / leaked link is mostly stale.
+// Operators can lower via `auth.magicLink.ttlSeconds` (60–3600).
+const MAGIC_LINK_TTL_SECONDS = 15 * 60;
+// Artificial delay range when the recipient is unknown — adds enough
+// jitter that response timing alone can't tell a registered email apart
+// from an unregistered one. The 100-250ms band approximates the cost
+// of token generation + the mailer round-trip on the happy path.
+const TIMING_DELAY_MIN_MS = 100;
+const TIMING_DELAY_RANGE_MS = 150;
+/**
+ * Issue a magic-link for sign-in or domain-gated signup.
+ *
+ *   sign-in (existing user)        → token row carries `userId = user.id`.
+ *   signup (allowed-domain match)  → token row carries `userId = null`,
+ *                                    role omitted (resolved at verify).
+ *   neither                        → silent no-op + timing delay.
+ *
+ * Always behaves identically from the caller's perspective regardless of
+ * which branch fired — the route layer turns this into an "If an
+ * account exists or self-signup is open, we sent you a link" response.
+ * Per Copenhagen Book / emdash: don't reveal email existence via
+ * response timing or shape; honour that here at the function boundary.
+ *
+ * Bootstrap rail: signup is refused when the system has zero users
+ * (matches OAuth — first-admin must enrol via passkey).
+ *
+ * Errors from the mailer are swallowed (logged via input.logger when
+ * present). The function never throws; it returns normally regardless
+ * of outcome.
+ */
+export async function requestMagicLink(db, input) {
+    const email = input.email.trim().toLowerCase();
+    const ttlSeconds = input.ttlSeconds ?? MAGIC_LINK_TTL_SECONDS;
+    const user = await db.query.users.findFirst({
+        where: eq(users.email, email),
+    });
+    // Sign-in path — existing active user.
+    if (user && !user.disabledAt) {
+        await issueAndSend(db, input, ttlSeconds, {
+            userId: user.id,
+            email: user.email,
+        });
+        return;
+    }
+    if (user?.disabledAt) {
+        // Disabled user: no signup attempt, silent no-op + jitter.
+        await timingDelay();
+        return;
+    }
+    // Signup path — no user yet. Gate on allowed_domains + non-zero
+    // user count so the bootstrap-via-passkey rule holds.
+    const domain = extractDomain(email);
+    if (!domain) {
+        await timingDelay();
+        return;
+    }
+    const allowed = await db.query.allowedDomains.findFirst({
+        where: eq(allowedDomains.domain, domain),
+    });
+    if (!allowed?.isEnabled) {
+        await timingDelay();
+        return;
+    }
+    if (!input.bootstrapAllowed) {
+        const userCount = await db.$count(users);
+        if (userCount === 0) {
+            // Refuse signup before bootstrap completes. Same rail OAuth uses.
+            await timingDelay();
+            return;
+        }
+    }
+    await issueAndSend(db, input, ttlSeconds, { userId: null, email });
+}
+async function issueAndSend(db, input, ttlSeconds, target) {
+    const token = generateToken();
+    const hash = await hashToken(token);
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
+    await db.insert(authTokens).values({
+        hash,
+        userId: target.userId,
+        email: target.email,
+        type: "magic_link",
+        expiresAt,
+    });
+    const verifyUrl = new URL(withBasePath("/_plumix/auth/magic-link/verify", input.basePath), input.origin);
+    verifyUrl.searchParams.set("token", token);
+    try {
+        // Plain-text body only. Branded HTML / template rendering is the
+        // operator's call — they wrap their `Mailer` adapter and template
+        // however they like. Plumix is not in the email-design business.
+        const strings = emailStringsFor(input.locale);
+        await input.mailer.send({
+            to: target.email,
+            subject: strings.magicLink.subject(input.siteName),
+            text: strings.magicLink.body(input.siteName, verifyUrl.toString(), ttlSeconds),
+        });
+    }
+    catch (error) {
+        // Swallow toward the caller — surfacing this would leak that the
+        // recipient is registered. Log it server-side so the operator sees
+        // the failure (otherwise broken mail config would be silent).
+        input.logger?.warn("magic_link_mailer_failed", { error });
+    }
+}
+function timingDelay() {
+    const ms = TIMING_DELAY_MIN_MS + Math.random() * TIMING_DELAY_RANGE_MS;
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=request.js.map

package/dist/auth/magic-link/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/auth/magic-link/request.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAExD,kEAAkE;AAClE,mEAAmE;AACnE,sEAAsE;AACtE,iEAAiE;AACjE,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvC,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAkClC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,KAA4B;IAE5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,sBAAsB,CAAC;IAE9D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC;KAC9B,CAAC,CAAC;IAEH,uCAAuC;IACvC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE;YACxC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;QACrB,2DAA2D;QAC3D,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,gEAAgE;IAChE,sDAAsD;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC;QACtD,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,kEAAkE;YAClE,MAAM,WAAW,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AAOD,KAAK,UAAU,YAAY,CACzB,EAAM,EACN,KAA4B,EAC5B,UAAkB,EAClB,MAAyB;IAEzB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAE3D,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACjC,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,YAAY,CAAC,iCAAiC,EAAE,KAAK,CAAC,QAAQ,CAAC,EAC/D,KAAK,CAAC,MAAM,CACb,CAAC;IACF,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAClD,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAC1B,KAAK,CAAC,QAAQ,EACd,SAAS,CAAC,QAAQ,EAAE,EACpB,UAAU,CACX;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,mEAAmE;QACnE,8DAA8D;QAC9D,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,mBAAmB,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC;IACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/auth/magic-link/routes.d.ts

@@ -0,0 +1,20 @@
+import type { AppContext } from "../../context/app.js";
+import type { PlumixApp } from "../../runtime/app.js";
+/**
+ * POST /_plumix/auth/magic-link/request — JSON body `{ email }`.
+ *
+ * Always responds with 200 and a generic "If an account exists…"
+ * message regardless of whether the recipient is registered. The
+ * dispatcher's CSRF gate fires before this handler (custom header +
+ * Origin check); we don't need additional CSRF here.
+ */
+export declare function handleMagicLinkRequest(ctx: AppContext, app: PlumixApp): Promise<Response>;
+/**
+ * GET /_plumix/auth/magic-link/verify?token=…
+ *
+ * Top-level navigation from the user's email client; consumes the
+ * single-use token, mints a session, redirects to /admin. Errors
+ * redirect to /admin/login with a typed `magic_link_error=<code>`.
+ */
+export declare function handleMagicLinkVerify(ctx: AppContext, app: PlumixApp): Promise<Response>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/auth/magic-link/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/auth/magic-link/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AA+BtD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CAqDnB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,QAAQ,CAAC,CA+BnB"}

package/dist/auth/magic-link/routes.js

@@ -0,0 +1,121 @@
+import * as v from "valibot";
+import { withBasePath } from "../../base-path.js";
+import { jsonResponse, loginErrorRedirect, redirectTo, } from "../../runtime/http.js";
+import { mintSessionAndCookie } from "../sign-in.js";
+import { MagicLinkError } from "./errors.js";
+import { requestMagicLink } from "./request.js";
+import { verifyMagicLink } from "./verify.js";
+const ADMIN_PATH = "/_plumix/admin";
+const LOGIN_PATH = "/_plumix/admin/login";
+// Defensive bound on the inbound `token` query param. Our generator
+// emits 192-bit base64url (32 chars); 256 chars is generous for
+// future-proofing while bounding malformed-callback amplification.
+const MAX_TOKEN_LENGTH = 256;
+const requestInputSchema = v.object({
+    email: v.pipe(v.string(), v.trim(), v.toLowerCase(), v.email(), v.maxLength(255)),
+});
+/**
+ * POST /_plumix/auth/magic-link/request — JSON body `{ email }`.
+ *
+ * Always responds with 200 and a generic "If an account exists…"
+ * message regardless of whether the recipient is registered. The
+ * dispatcher's CSRF gate fires before this handler (custom header +
+ * Origin check); we don't need additional CSRF here.
+ */
+export async function handleMagicLinkRequest(ctx, app) {
+    // 503 distinguishes "plumix doesn't have magic-link wired up" (operator
+    // omission, should fail loudly) from "this email isn't registered"
+    // (always-success contract, intentionally silent). Don't fold them.
+    // The cross-field check in `plumix()` prevents `magicLink` from being
+    // configured without a top-level mailer, so `ctx.mailer` is reliably
+    // present here when `magicLink` is. Belt + braces: re-check both.
+    if (!app.config.auth.magicLink || !ctx.mailer) {
+        return jsonResponse({ error: "magic_link_not_configured" }, { status: 503 });
+    }
+    let body;
+    try {
+        body = await ctx.request.json();
+    }
+    catch {
+        return invalidInput();
+    }
+    const parsed = v.safeParse(requestInputSchema, body);
+    if (!parsed.success)
+        return invalidInput();
+    try {
+        await requestMagicLink(ctx.db, {
+            email: parsed.output.email,
+            origin: app.origin,
+            basePath: app.basePath,
+            mailer: ctx.mailer,
+            siteName: app.config.auth.magicLink.siteName,
+            ttlSeconds: app.config.auth.magicLink.ttlSeconds,
+            // `ctx.locale` already reflects the unified resolver — the user's
+            // pre-auth dropdown pick reaches us via `?lang=` or `plumix_locale`
+            // cookie, so the magic-link email goes out in the locale they were
+            // looking at the login form in.
+            locale: ctx.locale.code,
+            logger: ctx.logger,
+            bootstrapAllowed: ctx.bootstrapAllowed,
+        });
+    }
+    catch (error) {
+        // requestMagicLink swallows mailer errors internally; anything that
+        // reaches here is a programming error (DB outage, etc.). The
+        // always-success contract is non-negotiable — distinguishing
+        // success from "DB blew up while looking up your email" would let
+        // an attacker fingerprint the registered set via response codes.
+        // Log server-side; respond identically.
+        ctx.logger.error("magic_link_request_failed", { error });
+    }
+    return jsonResponse({
+        ok: true,
+        message: "If an account exists for this email, we sent a sign-in link.",
+    });
+}
+/**
+ * GET /_plumix/auth/magic-link/verify?token=…
+ *
+ * Top-level navigation from the user's email client; consumes the
+ * single-use token, mints a session, redirects to /admin. Errors
+ * redirect to /admin/login with a typed `magic_link_error=<code>`.
+ */
+export async function handleMagicLinkVerify(ctx, app) {
+    if (!app.config.auth.magicLink) {
+        return loginError(app.basePath, "token_invalid");
+    }
+    const url = new URL(ctx.request.url);
+    const token = url.searchParams.get("token");
+    if (!token)
+        return loginError(app.basePath, "missing_token");
+    if (token.length > MAX_TOKEN_LENGTH)
+        return loginError(app.basePath, "token_invalid");
+    try {
+        const { user, created } = await verifyMagicLink(ctx.db, token, {
+            bootstrapAllowed: ctx.bootstrapAllowed,
+        });
+        const { cookieHeader } = await mintSessionAndCookie(ctx, app, user.id);
+        await ctx.hooks.doAction("user:signed_in", user, {
+            method: "magic_link",
+            firstSignIn: created,
+        });
+        return redirectTo(withBasePath(ADMIN_PATH, app.basePath), {
+            "set-cookie": cookieHeader,
+        });
+    }
+    catch (error) {
+        if (error instanceof MagicLinkError) {
+            ctx.logger.warn("magic_link_verify_rejected", { code: error.code });
+            return loginError(app.basePath, error.code);
+        }
+        ctx.logger.error("magic_link_verify_failed", { error });
+        return loginError(app.basePath, "token_invalid");
+    }
+}
+function invalidInput() {
+    return jsonResponse({ error: "invalid_input" }, { status: 400 });
+}
+function loginError(basePath, code) {
+    return loginErrorRedirect(withBasePath(LOGIN_PATH, basePath), "magic_link_error", code);
+}
+//# sourceMappingURL=routes.js.map

package/dist/auth/magic-link/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/auth/magic-link/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAK7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,oEAAoE;AACpE,gEAAgE;AAChE,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CACX,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,WAAW,EAAE,EACf,CAAC,CAAC,KAAK,EAAE,EACT,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CACjB;CACF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAe,EACf,GAAc;IAEd,wEAAwE;IACxE,mEAAmE;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,2BAA2B,EAAE,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE;YAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ;YAC5C,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU;YAChD,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,gCAAgC;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oEAAoE;QACpE,6DAA6D;QAC7D,6DAA6D;QAC7D,kEAAkE;QAClE,iEAAiE;QACjE,wCAAwC;QACxC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,YAAY,CAAC;QAClB,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,8DAA8D;KACxE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAe,EACf,GAAc;IAEd,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QACjC,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE;YAC7D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;SACvC,CAAC,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,YAAY;YACpB,WAAW,EAAE,OAAO;SACrB,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE;YACxD,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAwB;IAC5D,OAAO,kBAAkB,CACvB,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAClC,kBAAkB,EAClB,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/auth/magic-link/verify.d.ts

@@ -0,0 +1,43 @@
+import type { Db } from "../../context/app.js";
+import type { User } from "../../db/schema/users.js";
+interface VerifyMagicLinkOptions {
+    /**
+     * When true, allow this magic-link verify to mint the very first
+     * admin (forwarded to `resolveExternalIdentity`). The route handler
+     * reads this from `ctx.bootstrapAllowed`, derived from
+     * `auth.bootstrapVia`. Default false keeps the bootstrap rail
+     * passkey-only.
+     */
+    readonly bootstrapAllowed?: boolean;
+}
+interface VerifyMagicLinkResult {
+    readonly user: User;
+    /**
+     * True when the click provisioned a brand-new user (signup path);
+     * false when the token bound to an existing user (sign-in path).
+     * The caller forwards this to `user:signed_in`'s `firstSignIn`
+     * field so audit logs and onboarding handlers can branch on
+     * first-vs-returning. Mirrors `resolveOAuthUser`'s `created`.
+     */
+    readonly created: boolean;
+}
+/**
+ * Consume a magic-link token and return the matching user + whether
+ * it was just created (signup) or pre-existing (sign-in).
+ *
+ *   userId set in the token row → sign-in; created=false.
+ *   userId null in the token row → signup; created comes from
+ *     `resolveExternalIdentity` (true on a fresh row, false when the
+ *     helper linked an existing user via verified-email match).
+ *
+ * Atomic compare-and-delete via `DELETE … RETURNING` — a concurrent
+ * second verify of the same token sees an empty result, never the same
+ * row twice. Scoped by `type='magic_link'` so a hash collision with
+ * another token type can't accidentally consume that row.
+ *
+ * The link click implicitly verifies that the user has access to the
+ * email's inbox — we always pass `emailVerified: true` to the helper.
+ */
+export declare function verifyMagicLink(db: Db, rawToken: string, options?: VerifyMagicLinkOptions): Promise<VerifyMagicLinkResult>;
+export {};
+//# sourceMappingURL=verify.d.ts.map

package/dist/auth/magic-link/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/auth/magic-link/verify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAQrD,UAAU,sBAAsB;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA+ChC"}

package/dist/auth/magic-link/verify.js

@@ -0,0 +1,80 @@
+import { and, eq } from "../../db/index.js";
+import { authTokens } from "../../db/schema/auth_tokens.js";
+import { users } from "../../db/schema/users.js";
+import { ExternalIdentityError, resolveExternalIdentity } from "../identity.js";
+import { hashToken } from "../tokens.js";
+import { MagicLinkError } from "./errors.js";
+/**
+ * Consume a magic-link token and return the matching user + whether
+ * it was just created (signup) or pre-existing (sign-in).
+ *
+ *   userId set in the token row → sign-in; created=false.
+ *   userId null in the token row → signup; created comes from
+ *     `resolveExternalIdentity` (true on a fresh row, false when the
+ *     helper linked an existing user via verified-email match).
+ *
+ * Atomic compare-and-delete via `DELETE … RETURNING` — a concurrent
+ * second verify of the same token sees an empty result, never the same
+ * row twice. Scoped by `type='magic_link'` so a hash collision with
+ * another token type can't accidentally consume that row.
+ *
+ * The link click implicitly verifies that the user has access to the
+ * email's inbox — we always pass `emailVerified: true` to the helper.
+ */
+export async function verifyMagicLink(db, rawToken, options = {}) {
+    const hash = await hashToken(rawToken);
+    const [row] = await db
+        .delete(authTokens)
+        .where(and(eq(authTokens.hash, hash), eq(authTokens.type, "magic_link")))
+        .returning();
+    if (!row)
+        throw MagicLinkError.tokenInvalid();
+    if (row.expiresAt.getTime() < Date.now()) {
+        throw MagicLinkError.tokenExpired();
+    }
+    if (row.email === null) {
+        // Defensive: every magic_link row written by `requestMagicLink`
+        // sets email. A null here means hand-rolled DB state.
+        throw MagicLinkError.tokenInvalid();
+    }
+    if (row.userId !== null) {
+        const user = await resolveExistingUser(db, row.userId);
+        return { user, created: false };
+    }
+    try {
+        const { user, created } = await resolveExternalIdentity(db, {
+            email: row.email,
+            emailVerified: true, // link click is the verification
+            bootstrapAllowed: options.bootstrapAllowed,
+        });
+        return { user, created };
+    }
+    catch (error) {
+        if (error instanceof ExternalIdentityError) {
+            switch (error.code) {
+                case "email_unverified":
+                    // Can't fire here (we always pass emailVerified: true);
+                    // re-throw as-is to surface the programming error if it ever does.
+                    throw error;
+                case "account_disabled":
+                    throw MagicLinkError.accountDisabled();
+                case "domain_not_allowed":
+                    throw MagicLinkError.domainNotAllowed();
+                case "registration_closed":
+                    throw MagicLinkError.registrationClosed();
+            }
+        }
+        throw error;
+    }
+}
+async function resolveExistingUser(db, userId) {
+    const user = await db.query.users.findFirst({
+        where: eq(users.id, userId),
+    });
+    if (!user)
+        throw MagicLinkError.tokenInvalid();
+    if (user.disabledAt)
+        throw MagicLinkError.accountDisabled();
+    return user;
+}
+//# sourceMappingURL=verify.js.map

package/dist/auth/magic-link/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/auth/magic-link/verify.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyB7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,QAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,UAAU,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;SACxE,SAAS,EAAE,CAAC;IAEf,IAAI,CAAC,GAAG;QAAE,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IAC9C,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACvB,gEAAgE;QAChE,sDAAsD;QACtD,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;YAC1D,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,aAAa,EAAE,IAAI,EAAE,iCAAiC;YACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,kBAAkB;oBACrB,wDAAwD;oBACxD,mEAAmE;oBACnE,MAAM,KAAK,CAAC;gBACd,KAAK,kBAAkB;oBACrB,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;gBACzC,KAAK,oBAAoB;oBACvB,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC;gBAC1C,KAAK,qBAAqB;oBACxB,MAAM,cAAc,CAAC,kBAAkB,EAAE,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,MAAc;IACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,MAAM,cAAc,CAAC,YAAY,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,cAAc,CAAC,eAAe,EAAE,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/mailer/console.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from "../../context/app.js";
+import type { Mailer } from "./types.js";
+interface ConsoleMailerOptions {
+    /**
+     * Logger to write the message through. Defaults to `console`. Pass
+     * the request `Logger` from a route handler when you want the
+     * message to appear with the rest of that request's structured logs.
+     */
+    readonly logger?: Pick<Logger, "info">;
+}
+/**
+ * Dev-only mailer that logs each outgoing message instead of sending.
+ * Intended for local development and tests — there's no hidden network
+ * call and no rate-limit. Production deploys should pass a real
+ * `Mailer` (Resend, Postmark, SES, SMTP, …).
+ *
+ * The full message body is dumped at `info` level so the operator can
+ * copy the magic-link URL out of the logs during local sign-in.
+ */
+export declare function consoleMailer(options?: ConsoleMailerOptions): Mailer;
+export {};
+//# sourceMappingURL=console.d.ts.map

package/dist/auth/mailer/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../src/auth/mailer/console.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAgB,MAAM,EAAE,MAAM,YAAY,CAAC;AAEvD,UAAU,oBAAoB;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CAaxE"}

package/dist/auth/mailer/console.js

@@ -0,0 +1,24 @@
+/**
+ * Dev-only mailer that logs each outgoing message instead of sending.
+ * Intended for local development and tests — there's no hidden network
+ * call and no rate-limit. Production deploys should pass a real
+ * `Mailer` (Resend, Postmark, SES, SMTP, …).
+ *
+ * The full message body is dumped at `info` level so the operator can
+ * copy the magic-link URL out of the logs during local sign-in.
+ */
+export function consoleMailer(options = {}) {
+    const logger = options.logger ?? console;
+    return {
+        send(message) {
+            logger.info("[mailer:console]", {
+                to: message.to,
+                subject: message.subject,
+                text: message.text,
+                ...(message.html === undefined ? {} : { html: message.html }),
+            });
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=console.js.map

package/dist/auth/mailer/console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../../../src/auth/mailer/console.ts"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IACzC,OAAO;QACL,IAAI,CAAC,OAAqB;YACxB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/mailer/index.d.ts

@@ -0,0 +1,4 @@
+export { consoleMailer } from "./console.js";
+export type { MailerInput } from "./resolve.js";
+export type { EmailMessage, Mailer } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/mailer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/mailer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/dist/auth/mailer/index.js

@@ -0,0 +1,2 @@
+export { consoleMailer } from "./console.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/mailer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/mailer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/auth/mailer/resolve.d.ts

@@ -0,0 +1,12 @@
+import type { PlumixEnv } from "../../runtime/bindings.js";
+import type { EnvInput } from "../../runtime/env-input.js";
+import type { Mailer } from "./types.js";
+/**
+ * The mailer config slot: a literal {@link Mailer}, or an `(env) => Mailer`
+ * resolver for a transport whose API key only exists in the per-request `env`
+ * (the Workers case). See {@link EnvInput} for the shared union + the typed
+ * `env`; resolution is memoized per resolver.
+ */
+export type MailerInput = EnvInput<Mailer>;
+export declare function resolveMailer(input: MailerInput | undefined, env: PlumixEnv): Mailer | undefined;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/auth/mailer/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/auth/mailer/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AAE3C,wBAAgB,aAAa,CAC3B,KAAK,EAAE,WAAW,GAAG,SAAS,EAC9B,GAAG,EAAE,SAAS,GACb,MAAM,GAAG,SAAS,CAEpB"}

package/dist/auth/mailer/resolve.js

@@ -0,0 +1,5 @@
+import { resolveEnvInput } from "../../runtime/env-input.js";
+export function resolveMailer(input, env) {
+    return input === undefined ? undefined : resolveEnvInput(input, env);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/auth/mailer/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/auth/mailer/resolve.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAU7D,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,GAAc;IAEd,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/auth/mailer/types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Outbound email message — the payload `Mailer.send` is invoked with.
+ * Plain text required; HTML optional. Subject + recipient are the two
+ * routing-relevant fields.
+ */
+export interface EmailMessage {
+    readonly to: string;
+    readonly subject: string;
+    readonly text: string;
+    readonly html?: string;
+}
+/**
+ * Pluggable outbound-email transport. Plumix needs this exactly when
+ * an auth feature wants to send mail (magic-link today; email-verify,
+ * invite-email, password-reset later). Implementations can wrap any
+ * provider — Resend, Postmark, SES, SMTP, a queue. Core never knows.
+ *
+ * The contract is one method, fail-fast: throw on send failure so the
+ * caller can react (the magic-link flow swallows + logs to avoid
+ * leaking whether the recipient is registered).
+ */
+export interface Mailer {
+    send(message: EmailMessage): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/mailer/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/mailer/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C"}

package/dist/auth/mailer/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/auth/mailer/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/mailer/types.ts"],"names":[],"mappings":""}

package/dist/auth/oauth/consumer.d.ts

@@ -0,0 +1,37 @@
+import type { Db } from "../../context/app.js";
+import type { PlumixEnv } from "../../runtime/bindings.js";
+import type { OAuthProfile, OAuthProviderClient } from "./types.js";
+interface BuildAuthorizeUrlInput {
+    readonly db: Db;
+    readonly providerKey: string;
+    readonly provider: OAuthProviderClient;
+    readonly redirectUri: string;
+    /** Request env, for resolving a `client` that's an `(env) => …` resolver. */
+    readonly env: PlumixEnv;
+}
+interface BuiltAuthorizeUrl {
+    readonly url: string;
+    readonly state: string;
+}
+/**
+ * Mint a PKCE verifier + state, persist them under `oauth_state`, and
+ * return the authorize URL. State is what the provider echoes back; it's
+ * the only way the callback ties the response to a verifier we can replay.
+ */
+export declare function buildAuthorizeUrl(input: BuildAuthorizeUrlInput): Promise<BuiltAuthorizeUrl>;
+interface ExchangeAndFetchInput {
+    readonly provider: OAuthProviderClient;
+    readonly code: string;
+    readonly redirectUri: string;
+    readonly codeVerifier: string;
+    /** Request env, for resolving a `client` that's an `(env) => …` resolver. */
+    readonly env: PlumixEnv;
+}
+/**
+ * Exchange the authorization code for tokens, then fetch the user's
+ * profile. Returns a normalised OAuthProfile or throws OAuthError on any
+ * step failure — the route layer maps codes to user-facing messages.
+ */
+export declare function exchangeAndFetchProfile(input: ExchangeAndFetchInput): Promise<OAuthProfile>;
+export {};
+//# sourceMappingURL=consumer.d.ts.map

package/dist/auth/oauth/consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAMpE,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CAsB5B;AAED,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAQD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,YAAY,CAAC,CA+BvB"}