@puzzle-ui/fullstack 0.0.0-stage → 0.5.0

package/dist/auth/server/index.js

@@ -0,0 +1,88 @@
+import { AuthStepUpRequiredError, MFA_CHALLENGE_COOKIE_NAME, createAuthMfaHandlers, createMfaChallengeResponse, createMfaPendingResponse, hasRecentStepUp, readMfaChallengeCookie, requireRecentStepUp, serializeClearedMfaChallengeCookie, serializeMfaChallengeCookie } from "./mfa.js";
+import { createAuthLifecycleHandlers } from "./lifecycle.js";
+import { clearSessionResponse, createSessionResponse, getRequestSession, logoutAllRequest, logoutRequest, protectAuthenticatedRequest } from "./session.js";
+import { createAuthReadinessHandler } from "./health.js";
+// src/auth/server/index.ts
+const createInitializationErrorResponse = () => new Response(JSON.stringify({ error: {
+	code: "AUTH_INITIALIZATION_FAILED",
+	message: "Authentication is temporarily unavailable."
+} }), {
+	status: 503,
+	headers: {
+		"Content-Type": "application/json; charset=utf-8",
+		"Cache-Control": "no-store",
+		Pragma: "no-cache"
+	}
+});
+const createAuthServer = (options) => {
+	let initializationPromise = null;
+	const initialize = () => {
+		if (!initializationPromise) initializationPromise = (async () => {
+			await options.mfa.initialize();
+			await options.auth.initialize();
+			await options.stepUp.initialize();
+			if (options.lifecycle) await options.lifecycle.lifecycle.initialize();
+		})().catch((error) => {
+			initializationPromise = null;
+			throw error;
+		});
+		return initializationPromise;
+	};
+	const rawHandlers = {
+		...createAuthMfaHandlers(options),
+		...options.lifecycle ? createAuthLifecycleHandlers(options.lifecycle) : {}
+	};
+	return {
+		options,
+		handlers: Object.fromEntries(Object.entries(rawHandlers).map(([name, handler]) => [name, async (request) => {
+			try {
+				await initialize();
+			} catch {
+				return createInitializationErrorResponse();
+			}
+			return handler(request);
+		}])),
+		initialize
+	};
+};
+const createAuthRouteHandlers = (server, basePath = "/api/auth") => {
+	const prefix = basePath.replace(/\/+$/, "");
+	const route = (path) => `${prefix}${path}`;
+	const handlers = server.handlers;
+	return {
+		[route("/register")]: { POST: handlers.register },
+		[route("/sign-in")]: { POST: handlers.signIn },
+		[route("/state")]: { GET: handlers.getAuthState },
+		[route("/sign-out")]: { POST: handlers.signOut },
+		[route("/mfa/sign-in/totp")]: { POST: handlers.verifySignInTotp },
+		[route("/mfa/sign-in/recovery-code")]: { POST: handlers.verifySignInRecoveryCode },
+		[route("/mfa/passkey/sign-in/start")]: { POST: handlers.beginPasskeySignIn },
+		[route("/mfa/passkey/sign-in/finish")]: { POST: handlers.finishPasskeySignIn },
+		[route("/mfa/passkey/challenge/start")]: { POST: handlers.beginPasskeyMfa },
+		[route("/mfa/passkey/challenge/finish")]: { POST: handlers.finishPasskeyMfa },
+		[route("/mfa/totp/enrollment/start")]: { POST: handlers.beginTotpEnrollment },
+		[route("/mfa/totp/enrollment/finish")]: { POST: handlers.verifyTotpEnrollment },
+		[route("/mfa/passkey/enrollment/start")]: { POST: handlers.beginPasskeyRegistration },
+		[route("/mfa/passkey/enrollment/finish")]: { POST: handlers.finishPasskeyRegistration },
+		[route("/mfa/factors")]: { GET: handlers.listMfaFactors },
+		[route("/mfa/factors/remove")]: { POST: handlers.removeMfaFactor },
+		[route("/mfa/recovery-codes/regenerate")]: { POST: handlers.regenerateRecoveryCodes },
+		[route("/mfa/step-up/start")]: { POST: handlers.beginStepUp },
+		[route("/mfa/step-up/totp")]: { POST: handlers.verifyStepUpTotp },
+		[route("/mfa/step-up/recovery-code")]: { POST: handlers.verifyStepUpRecoveryCode },
+		[route("/mfa/step-up/passkey/start")]: { POST: handlers.beginStepUpPasskey },
+		[route("/mfa/step-up/passkey/finish")]: { POST: handlers.finishStepUpPasskey },
+		[route("/mfa/enrollment/required/totp/start")]: { POST: handlers.beginRequiredTotpEnrollment },
+		[route("/mfa/enrollment/required/totp/finish")]: { POST: handlers.verifyRequiredTotpEnrollment },
+		[route("/mfa/enrollment/required/passkey/start")]: { POST: handlers.beginRequiredPasskeyEnrollment },
+		[route("/mfa/enrollment/required/passkey/finish")]: { POST: handlers.finishRequiredPasskeyEnrollment },
+		...handlers.requestEmailVerification ? { [route("/email/verification/request")]: { POST: handlers.requestEmailVerification } } : {},
+		...handlers.verifyEmail ? { [route("/email/verification/verify")]: { POST: handlers.verifyEmail } } : {},
+		...handlers.requestPasswordReset ? { [route("/password/reset/request")]: { POST: handlers.requestPasswordReset } } : {},
+		...handlers.resetPassword ? { [route("/password/reset/finish")]: { POST: handlers.resetPassword } } : {},
+		...handlers.changePassword ? { [route("/password/change")]: { POST: handlers.changePassword } } : {}
+	};
+};
+export { AuthStepUpRequiredError, MFA_CHALLENGE_COOKIE_NAME, clearSessionResponse, createAuthLifecycleHandlers, createAuthMfaHandlers, createAuthReadinessHandler, createAuthRouteHandlers, createAuthServer, createMfaChallengeResponse, createMfaPendingResponse, createSessionResponse, getRequestSession, hasRecentStepUp, logoutAllRequest, logoutRequest, protectAuthenticatedRequest, readMfaChallengeCookie, requireRecentStepUp, serializeClearedMfaChallengeCookie, serializeMfaChallengeCookie };
+
+//# sourceMappingURL=index.js.map

package/dist/auth/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/auth/server/index.ts"],"sourcesContent":["import type {\n  EmailProvider,\n  PasswordHasher,\n  RateLimitProvider,\n} from \"@puzzle-ui/auth\";\n\nimport {\n  createAuthMfaHandlers,\n  type AuthMfaHandlers,\n  type AuthMfaHandlersOptions,\n} from \"./mfa\";\n\nimport {\n  createAuthLifecycleHandlers,\n  type AuthLifecycleHandlers,\n  type AuthLifecycleHandlersOptions,\n} from \"./lifecycle\";\n\nexport type AuthServerOptions = AuthMfaHandlersOptions & {\n  readonly passwordHasher?: PasswordHasher;\n  readonly emailProvider?: EmailProvider;\n  readonly rateLimitProvider?: RateLimitProvider;\n  readonly lifecycle?: AuthLifecycleHandlersOptions;\n};\n\nexport type AuthServerHandlers = AuthMfaHandlers &\n  Partial<AuthLifecycleHandlers>;\n\nexport type AuthServer = {\n  readonly options: AuthServerOptions;\n  readonly handlers: AuthServerHandlers;\n  initialize(): Promise<void>;\n};\n\nexport type AuthHttpMethod = \"GET\" | \"POST\";\n\nexport type AuthRouteHandlerMap = Readonly<\n  Record<\n    string,\n    Readonly<\n      Partial<Record<AuthHttpMethod, (request: Request) => Promise<Response>>>\n    >\n  >\n>;\n\nconst createInitializationErrorResponse = (): Response =>\n  new Response(\n    JSON.stringify({\n      error: {\n        code: \"AUTH_INITIALIZATION_FAILED\",\n        message: \"Authentication is temporarily unavailable.\",\n      },\n    }),\n    {\n      status: 503,\n      headers: {\n        \"Content-Type\": \"application/json; charset=utf-8\",\n        \"Cache-Control\": \"no-store\",\n        Pragma: \"no-cache\",\n      },\n    },\n  );\n\nexport const createAuthServer = (options: AuthServerOptions): AuthServer => {\n  let initializationPromise: Promise<void> | null = null;\n\n  const initialize = (): Promise<void> => {\n    if (!initializationPromise) {\n      const initialization = (async () => {\n        await options.mfa.initialize();\n        await options.auth.initialize();\n        await options.stepUp.initialize();\n\n        if (options.lifecycle) {\n          await options.lifecycle.lifecycle.initialize();\n        }\n      })();\n\n      initializationPromise = initialization.catch((error) => {\n        initializationPromise = null;\n        throw error;\n      });\n    }\n\n    return initializationPromise;\n  };\n\n  const rawHandlers: AuthServerHandlers = {\n    ...createAuthMfaHandlers(options),\n    ...(options.lifecycle\n      ? createAuthLifecycleHandlers(options.lifecycle)\n      : {}),\n  };\n\n  const handlers = Object.fromEntries(\n    Object.entries(rawHandlers).map(([name, handler]) => [\n      name,\n      async (request: Request): Promise<Response> => {\n        try {\n          await initialize();\n        } catch {\n          return createInitializationErrorResponse();\n        }\n\n        return handler!(request);\n      },\n    ]),\n  ) as AuthServerHandlers;\n\n  return {\n    options,\n    handlers,\n    initialize,\n  };\n};\n\nexport const createAuthRouteHandlers = (\n  server: AuthServer,\n  basePath = \"/api/auth\",\n): AuthRouteHandlerMap => {\n  const prefix = basePath.replace(/\\/+$/, \"\");\n\n  const route = (path: string): string => `${prefix}${path}`;\n\n  const handlers = server.handlers;\n\n  return {\n    [route(\"/register\")]: {\n      POST: handlers.register,\n    },\n\n    [route(\"/sign-in\")]: {\n      POST: handlers.signIn,\n    },\n\n    [route(\"/state\")]: {\n      GET: handlers.getAuthState,\n    },\n\n    [route(\"/sign-out\")]: {\n      POST: handlers.signOut,\n    },\n\n    [route(\"/mfa/sign-in/totp\")]: {\n      POST: handlers.verifySignInTotp,\n    },\n\n    [route(\"/mfa/sign-in/recovery-code\")]: {\n      POST: handlers.verifySignInRecoveryCode,\n    },\n\n    [route(\"/mfa/passkey/sign-in/start\")]: {\n      POST: handlers.beginPasskeySignIn,\n    },\n\n    [route(\"/mfa/passkey/sign-in/finish\")]: {\n      POST: handlers.finishPasskeySignIn,\n    },\n\n    [route(\"/mfa/passkey/challenge/start\")]: {\n      POST: handlers.beginPasskeyMfa,\n    },\n\n    [route(\"/mfa/passkey/challenge/finish\")]: {\n      POST: handlers.finishPasskeyMfa,\n    },\n\n    [route(\"/mfa/totp/enrollment/start\")]: {\n      POST: handlers.beginTotpEnrollment,\n    },\n\n    [route(\"/mfa/totp/enrollment/finish\")]: {\n      POST: handlers.verifyTotpEnrollment,\n    },\n\n    [route(\"/mfa/passkey/enrollment/start\")]: {\n      POST: handlers.beginPasskeyRegistration,\n    },\n\n    [route(\"/mfa/passkey/enrollment/finish\")]: {\n      POST: handlers.finishPasskeyRegistration,\n    },\n\n    [route(\"/mfa/factors\")]: {\n      GET: handlers.listMfaFactors,\n    },\n\n    [route(\"/mfa/factors/remove\")]: {\n      POST: handlers.removeMfaFactor,\n    },\n\n    [route(\"/mfa/recovery-codes/regenerate\")]: {\n      POST: handlers.regenerateRecoveryCodes,\n    },\n\n    [route(\"/mfa/step-up/start\")]: {\n      POST: handlers.beginStepUp,\n    },\n\n    [route(\"/mfa/step-up/totp\")]: {\n      POST: handlers.verifyStepUpTotp,\n    },\n\n    [route(\"/mfa/step-up/recovery-code\")]: {\n      POST: handlers.verifyStepUpRecoveryCode,\n    },\n\n    [route(\"/mfa/step-up/passkey/start\")]: {\n      POST: handlers.beginStepUpPasskey,\n    },\n\n    [route(\"/mfa/step-up/passkey/finish\")]: {\n      POST: handlers.finishStepUpPasskey,\n    },\n\n    [route(\"/mfa/enrollment/required/totp/start\")]: {\n      POST: handlers.beginRequiredTotpEnrollment,\n    },\n\n    [route(\"/mfa/enrollment/required/totp/finish\")]: {\n      POST: handlers.verifyRequiredTotpEnrollment,\n    },\n\n    [route(\"/mfa/enrollment/required/passkey/start\")]: {\n      POST: handlers.beginRequiredPasskeyEnrollment,\n    },\n\n    [route(\"/mfa/enrollment/required/passkey/finish\")]: {\n      POST: handlers.finishRequiredPasskeyEnrollment,\n    },\n\n    ...(handlers.requestEmailVerification\n      ? {\n          [route(\"/email/verification/request\")]: {\n            POST: handlers.requestEmailVerification,\n          },\n        }\n      : {}),\n\n    ...(handlers.verifyEmail\n      ? {\n          [route(\"/email/verification/verify\")]: {\n            POST: handlers.verifyEmail,\n          },\n        }\n      : {}),\n\n    ...(handlers.requestPasswordReset\n      ? {\n          [route(\"/password/reset/request\")]: {\n            POST: handlers.requestPasswordReset,\n          },\n        }\n      : {}),\n\n    ...(handlers.resetPassword\n      ? {\n          [route(\"/password/reset/finish\")]: {\n            POST: handlers.resetPassword,\n          },\n        }\n      : {}),\n\n    ...(handlers.changePassword\n      ? {\n          [route(\"/password/change\")]: {\n            POST: handlers.changePassword,\n          },\n        }\n      : {}),\n  };\n};\n\nexport {\n  getRequestSession,\n  protectAuthenticatedRequest,\n  createSessionResponse,\n  clearSessionResponse,\n  logoutRequest,\n  logoutAllRequest,\n} from \"./session\";\n\nexport type { SessionRequestOptions, SessionResponseOptions } from \"./session\";\n\nexport {\n  MFA_CHALLENGE_COOKIE_NAME,\n  serializeMfaChallengeCookie,\n  serializeClearedMfaChallengeCookie,\n  readMfaChallengeCookie,\n  createMfaPendingResponse,\n  createMfaChallengeResponse,\n  createAuthMfaHandlers,\n  hasRecentStepUp,\n  requireRecentStepUp,\n  AuthStepUpRequiredError,\n} from \"./mfa\";\n\nexport type {\n  AuthMfaHandlersOptions,\n  AuthMfaHandlers,\n  AuthMfaPendingResponse,\n  AuthClientUserResponse,\n} from \"./mfa\";\n\nexport { createAuthLifecycleHandlers } from \"./lifecycle\";\n\nexport type {\n  AuthLifecycleHandlers,\n  AuthLifecycleHandlersOptions,\n} from \"./lifecycle\";\n\nexport { createAuthReadinessHandler } from \"./health\";\n\nexport type {\n  AuthReadinessCheck,\n  AuthReadinessOptions,\n  AuthReadinessResult,\n} from \"./health\";\n"],"mappings":";;;;;AA6CA,MAAM,0CACJ,IAAI,SACF,KAAK,UAAU,EACb,OAAO;CACL,MAAM;CACN,SAAS;AACX,EACF,CAAC,GACD;CACE,QAAQ;CACR,SAAS;EACP,gBAAgB;EAChB,iBAAiB;EACjB,QAAQ;CACV;AACF,CACF;AAEF,MAAa,oBAAoB,YAA2C;CAC1E,IAAI,wBAA8C;CAElD,MAAM,mBAAkC;EACtC,IAAI,CAAC,uBAWH,yBAVwB,YAAY;GAClC,MAAM,QAAQ,IAAI,WAAW;GAC7B,MAAM,QAAQ,KAAK,WAAW;GAC9B,MAAM,QAAQ,OAAO,WAAW;GAEhC,IAAI,QAAQ,WACV,MAAM,QAAQ,UAAU,UAAU,WAAW;EAEjD,EAAA,CAEqC,CAAC,CAAC,OAAO,UAAU;GACtD,wBAAwB;GACxB,MAAM;EACR,CAAC;EAGH,OAAO;CACT;CAEA,MAAM,cAAkC;EACtC,GAAG,sBAAsB,OAAO;EAChC,GAAI,QAAQ,YACR,4BAA4B,QAAQ,SAAS,IAC7C,CAAC;CACP;CAiBA,OAAO;EACL;EACA,UAjBe,OAAO,YACtB,OAAO,QAAQ,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,aAAa,CACnD,MACA,OAAO,YAAwC;GAC7C,IAAI;IACF,MAAM,WAAW;GACnB,QAAQ;IACN,OAAO,kCAAkC;GAC3C;GAEA,OAAO,QAAS,OAAO;EACzB,CACF,CAAC,CAKM;EACP;CACF;AACF;AAEA,MAAa,2BACX,QACA,WAAW,gBACa;CACxB,MAAM,SAAS,SAAS,QAAQ,QAAQ,EAAE;CAE1C,MAAM,SAAS,SAAyB,GAAG,SAAS;CAEpD,MAAM,WAAW,OAAO;CAExB,OAAO;GACJ,MAAM,WAAW,IAAI,EACpB,MAAM,SAAS,SACjB;GAEC,MAAM,UAAU,IAAI,EACnB,MAAM,SAAS,OACjB;GAEC,MAAM,QAAQ,IAAI,EACjB,KAAK,SAAS,aAChB;GAEC,MAAM,WAAW,IAAI,EACpB,MAAM,SAAS,QACjB;GAEC,MAAM,mBAAmB,IAAI,EAC5B,MAAM,SAAS,iBACjB;GAEC,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,yBACjB;GAEC,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,mBACjB;GAEC,MAAM,6BAA6B,IAAI,EACtC,MAAM,SAAS,oBACjB;GAEC,MAAM,8BAA8B,IAAI,EACvC,MAAM,SAAS,gBACjB;GAEC,MAAM,+BAA+B,IAAI,EACxC,MAAM,SAAS,iBACjB;GAEC,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,oBACjB;GAEC,MAAM,6BAA6B,IAAI,EACtC,MAAM,SAAS,qBACjB;GAEC,MAAM,+BAA+B,IAAI,EACxC,MAAM,SAAS,yBACjB;GAEC,MAAM,gCAAgC,IAAI,EACzC,MAAM,SAAS,0BACjB;GAEC,MAAM,cAAc,IAAI,EACvB,KAAK,SAAS,eAChB;GAEC,MAAM,qBAAqB,IAAI,EAC9B,MAAM,SAAS,gBACjB;GAEC,MAAM,gCAAgC,IAAI,EACzC,MAAM,SAAS,wBACjB;GAEC,MAAM,oBAAoB,IAAI,EAC7B,MAAM,SAAS,YACjB;GAEC,MAAM,mBAAmB,IAAI,EAC5B,MAAM,SAAS,iBACjB;GAEC,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,yBACjB;GAEC,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,mBACjB;GAEC,MAAM,6BAA6B,IAAI,EACtC,MAAM,SAAS,oBACjB;GAEC,MAAM,qCAAqC,IAAI,EAC9C,MAAM,SAAS,4BACjB;GAEC,MAAM,sCAAsC,IAAI,EAC/C,MAAM,SAAS,6BACjB;GAEC,MAAM,wCAAwC,IAAI,EACjD,MAAM,SAAS,+BACjB;GAEC,MAAM,yCAAyC,IAAI,EAClD,MAAM,SAAS,gCACjB;EAEA,GAAI,SAAS,2BACT,GACG,MAAM,6BAA6B,IAAI,EACtC,MAAM,SAAS,yBACjB,EACF,IACA,CAAC;EAEL,GAAI,SAAS,cACT,GACG,MAAM,4BAA4B,IAAI,EACrC,MAAM,SAAS,YACjB,EACF,IACA,CAAC;EAEL,GAAI,SAAS,uBACT,GACG,MAAM,yBAAyB,IAAI,EAClC,MAAM,SAAS,qBACjB,EACF,IACA,CAAC;EAEL,GAAI,SAAS,gBACT,GACG,MAAM,wBAAwB,IAAI,EACjC,MAAM,SAAS,cACjB,EACF,IACA,CAAC;EAEL,GAAI,SAAS,iBACT,GACG,MAAM,kBAAkB,IAAI,EAC3B,MAAM,SAAS,eACjB,EACF,IACA,CAAC;CACP;AACF"}

package/dist/auth/server/lifecycle.cjs

@@ -0,0 +1,126 @@
+const require_session = require("./session.cjs");
+let _puzzle_ui_auth = require("@puzzle-ui/auth");
+let _puzzle_ui_session = require("@puzzle-ui/session");
+// src/auth/server/lifecycle.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const jsonResponse = (body, status = 200) => new Response(JSON.stringify(body), {
+	status,
+	headers: {
+		"Content-Type": "application/json; charset=utf-8",
+		"Cache-Control": "no-store",
+		Pragma: "no-cache"
+	}
+});
+const readBody = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		throw new Error("INVALID_REQUEST");
+	}
+	if (!isRecord(body)) throw new Error("INVALID_REQUEST");
+	return body;
+};
+const requiredString = (body, field, maximumLength = 2048) => {
+	const value = body[field];
+	if (typeof value !== "string" || !value.trim() || value.length > maximumLength) throw new Error("INVALID_REQUEST");
+	return value;
+};
+const getErrorResponse = (error) => {
+	if (error instanceof _puzzle_ui_auth.AuthError) {
+		const status = error.code === "RATE_LIMITED" ? 429 : error.code === "PROVIDER" ? 503 : error.code === "SESSION" ? 401 : 400;
+		return jsonResponse({ error: {
+			code: error.code,
+			message: error.message
+		} }, status);
+	}
+	if (error instanceof Error && error.message === "INVALID_REQUEST") return jsonResponse({ error: {
+		code: "INVALID_REQUEST",
+		message: "The request is invalid."
+	} }, 400);
+	return jsonResponse({ error: {
+		code: "INTERNAL_AUTH_ERROR",
+		message: "An authentication error occurred."
+	} }, 500);
+};
+const endpoint = (handler) => async (request) => {
+	try {
+		if (request.method !== "POST") return jsonResponse({ error: {
+			code: "METHOD_NOT_ALLOWED",
+			message: "Only POST requests are supported."
+		} }, 405);
+		return await handler(request);
+	} catch (error) {
+		return getErrorResponse(error);
+	}
+};
+const getSessionToken = (request, cookie) => (0, _puzzle_ui_session.readSessionCookie)(request.headers.get("cookie"), cookie.name);
+const createAuthLifecycleHandlers = (options) => {
+	const sessionOptions = {
+		sessions: options.sessions,
+		cookie: options.cookie
+	};
+	const protect = (request) => {
+		(0, _puzzle_ui_session.protectStateChangingRequest)(request, options.csrf);
+	};
+	return {
+		requestEmailVerification: endpoint(async (request) => {
+			protect(request);
+			const session = await require_session.getRequestSession(request, sessionOptions);
+			if (!session || session.kind !== "authenticated" || !session.userId) return jsonResponse({ error: {
+				code: "UNAUTHENTICATED",
+				message: "Authentication is required."
+			} }, 401);
+			await options.lifecycle.sendEmailVerification({
+				userId: session.userId,
+				verificationUrl: options.verificationUrl(request),
+				ipAddress: options.resolveClientIp(request)
+			});
+			return jsonResponse({ status: "verification-requested" });
+		}),
+		verifyEmail: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			const token = requiredString(body, "token");
+			await options.lifecycle.verifyEmail(token);
+			return jsonResponse({ status: "email-verified" });
+		}),
+		requestPasswordReset: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			await options.lifecycle.requestPasswordReset({
+				email: requiredString(body, "email", 320),
+				resetUrl: options.passwordResetUrl(request),
+				ipAddress: options.resolveClientIp(request)
+			});
+			return jsonResponse({ status: "password-reset-requested" });
+		}),
+		resetPassword: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			await options.lifecycle.resetPassword({
+				token: requiredString(body, "token"),
+				newPassword: requiredString(body, "newPassword")
+			});
+			return jsonResponse({ status: "password-reset" });
+		}),
+		changePassword: endpoint(async (request) => {
+			protect(request);
+			const sessionToken = getSessionToken(request, options.cookie);
+			if (!sessionToken) return jsonResponse({ error: {
+				code: "UNAUTHENTICATED",
+				message: "Authentication is required."
+			} }, 401);
+			const body = await readBody(request);
+			await options.lifecycle.changePassword({
+				sessionToken,
+				currentPassword: requiredString(body, "currentPassword"),
+				newPassword: requiredString(body, "newPassword")
+			});
+			return jsonResponse({ status: "password-changed" });
+		})
+	};
+};
+exports.createAuthLifecycleHandlers = createAuthLifecycleHandlers;
+
+//# sourceMappingURL=lifecycle.cjs.map

package/dist/auth/server/lifecycle.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.cjs","names":["AuthError","readSessionCookie","getRequestSession"],"sources":["../../../src/auth/server/lifecycle.ts"],"sourcesContent":["import { AuthError, type StorageAuthLifecycleManager } from \"@puzzle-ui/auth\";\n\nimport {\n  readSessionCookie,\n  protectStateChangingRequest,\n  type CsrfOptions,\n  type SessionCookieOptions,\n  type SessionManager,\n} from \"@puzzle-ui/session\";\n\nimport { getRequestSession, type SessionRequestOptions } from \"./session\";\n\nexport type AuthLifecycleHandlersOptions = {\n  readonly lifecycle: StorageAuthLifecycleManager;\n  readonly sessions: SessionManager;\n  readonly cookie: SessionCookieOptions;\n  readonly csrf: CsrfOptions;\n  readonly resolveClientIp: (request: Request) => string;\n  readonly verificationUrl: (request: Request) => string;\n  readonly passwordResetUrl: (request: Request) => string;\n};\n\nexport type AuthLifecycleHandlers = {\n  readonly requestEmailVerification: (request: Request) => Promise<Response>;\n  readonly verifyEmail: (request: Request) => Promise<Response>;\n  readonly requestPasswordReset: (request: Request) => Promise<Response>;\n  readonly resetPassword: (request: Request) => Promise<Response>;\n  readonly changePassword: (request: Request) => Promise<Response>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\nconst isRecord = (value: unknown): value is JsonObject =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst jsonResponse = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n\nconst readBody = async (request: Request): Promise<JsonObject> => {\n  let body: unknown;\n\n  try {\n    body = await request.json();\n  } catch {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  if (!isRecord(body)) {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  return body;\n};\n\nconst requiredString = (\n  body: JsonObject,\n  field: string,\n  maximumLength = 2048,\n): string => {\n  const value = body[field];\n\n  if (\n    typeof value !== \"string\" ||\n    !value.trim() ||\n    value.length > maximumLength\n  ) {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  return value;\n};\n\nconst getErrorResponse = (error: unknown): Response => {\n  if (error instanceof AuthError) {\n    const status =\n      error.code === \"RATE_LIMITED\"\n        ? 429\n        : error.code === \"PROVIDER\"\n          ? 503\n          : error.code === \"SESSION\"\n            ? 401\n            : 400;\n\n    return jsonResponse(\n      {\n        error: {\n          code: error.code,\n          message: error.message,\n        },\n      },\n      status,\n    );\n  }\n\n  if (error instanceof Error && error.message === \"INVALID_REQUEST\") {\n    return jsonResponse(\n      {\n        error: {\n          code: \"INVALID_REQUEST\",\n          message: \"The request is invalid.\",\n        },\n      },\n      400,\n    );\n  }\n\n  return jsonResponse(\n    {\n      error: {\n        code: \"INTERNAL_AUTH_ERROR\",\n        message: \"An authentication error occurred.\",\n      },\n    },\n    500,\n  );\n};\n\nconst endpoint =\n  (handler: (request: Request) => Promise<Response>) =>\n  async (request: Request): Promise<Response> => {\n    try {\n      if (request.method !== \"POST\") {\n        return jsonResponse(\n          {\n            error: {\n              code: \"METHOD_NOT_ALLOWED\",\n              message: \"Only POST requests are supported.\",\n            },\n          },\n          405,\n        );\n      }\n\n      return await handler(request);\n    } catch (error) {\n      return getErrorResponse(error);\n    }\n  };\n\nconst getSessionToken = (\n  request: Request,\n  cookie: SessionCookieOptions,\n): string | null =>\n  readSessionCookie(request.headers.get(\"cookie\"), cookie.name);\n\nconst createAuthLifecycleHandlers = (\n  options: AuthLifecycleHandlersOptions,\n): AuthLifecycleHandlers => {\n  const sessionOptions: SessionRequestOptions = {\n    sessions: options.sessions,\n    cookie: options.cookie,\n  };\n\n  const protect = (request: Request) => {\n    protectStateChangingRequest(request, options.csrf);\n  };\n\n  const requestEmailVerification = endpoint(async (request) => {\n    protect(request);\n\n    const session = await getRequestSession(request, sessionOptions);\n\n    if (!session || session.kind !== \"authenticated\" || !session.userId) {\n      return jsonResponse(\n        {\n          error: {\n            code: \"UNAUTHENTICATED\",\n            message: \"Authentication is required.\",\n          },\n        },\n        401,\n      );\n    }\n\n    await options.lifecycle.sendEmailVerification({\n      userId: session.userId,\n      verificationUrl: options.verificationUrl(request),\n      ipAddress: options.resolveClientIp(request),\n    });\n\n    return jsonResponse({\n      status: \"verification-requested\",\n    });\n  });\n\n  const verifyEmail = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n    const token = requiredString(body, \"token\");\n\n    await options.lifecycle.verifyEmail(token);\n\n    return jsonResponse({\n      status: \"email-verified\",\n    });\n  });\n\n  const requestPasswordReset = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n\n    await options.lifecycle.requestPasswordReset({\n      email: requiredString(body, \"email\", 320),\n      resetUrl: options.passwordResetUrl(request),\n      ipAddress: options.resolveClientIp(request),\n    });\n\n    // The public result must never reveal whether an account exists.\n    return jsonResponse({\n      status: \"password-reset-requested\",\n    });\n  });\n\n  const resetPassword = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n\n    await options.lifecycle.resetPassword({\n      token: requiredString(body, \"token\"),\n      newPassword: requiredString(body, \"newPassword\"),\n    });\n\n    return jsonResponse({\n      status: \"password-reset\",\n    });\n  });\n\n  const changePassword = endpoint(async (request) => {\n    protect(request);\n\n    const sessionToken = getSessionToken(request, options.cookie);\n\n    if (!sessionToken) {\n      return jsonResponse(\n        {\n          error: {\n            code: \"UNAUTHENTICATED\",\n            message: \"Authentication is required.\",\n          },\n        },\n        401,\n      );\n    }\n\n    const body = await readBody(request);\n\n    await options.lifecycle.changePassword({\n      sessionToken,\n      currentPassword: requiredString(body, \"currentPassword\"),\n      newPassword: requiredString(body, \"newPassword\"),\n    });\n\n    return jsonResponse({\n      status: \"password-changed\",\n    });\n  });\n\n  return {\n    requestEmailVerification,\n    verifyEmail,\n    requestPasswordReset,\n    resetPassword,\n    changePassword,\n  };\n};\n\nexport { createAuthLifecycleHandlers };\n"],"mappings":";;;;AAgCA,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,gBAAgB,MAAe,SAAS,QAC5C,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS;EACP,gBAAgB;EAChB,iBAAiB;EACjB,QAAQ;CACV;AACF,CAAC;AAEH,MAAM,WAAW,OAAO,YAA0C;CAChE,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,QAAQ;EACN,MAAM,IAAI,MAAM,iBAAiB;CACnC;CAEA,IAAI,CAAC,SAAS,IAAI,GAChB,MAAM,IAAI,MAAM,iBAAiB;CAGnC,OAAO;AACT;AAEA,MAAM,kBACJ,MACA,OACA,gBAAgB,SACL;CACX,MAAM,QAAQ,KAAK;CAEnB,IACE,OAAO,UAAU,YACjB,CAAC,MAAM,KAAK,KACZ,MAAM,SAAS,eAEf,MAAM,IAAI,MAAM,iBAAiB;CAGnC,OAAO;AACT;AAEA,MAAM,oBAAoB,UAA6B;CACrD,IAAI,iBAAiBA,gBAAAA,WAAW;EAC9B,MAAM,SACJ,MAAM,SAAS,iBACX,MACA,MAAM,SAAS,aACb,MACA,MAAM,SAAS,YACb,MACA;EAEV,OAAO,aACL,EACE,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,MAAM;EACjB,EACF,GACA,MACF;CACF;CAEA,IAAI,iBAAiB,SAAS,MAAM,YAAY,mBAC9C,OAAO,aACL,EACE,OAAO;EACL,MAAM;EACN,SAAS;CACX,EACF,GACA,GACF;CAGF,OAAO,aACL,EACE,OAAO;EACL,MAAM;EACN,SAAS;CACX,EACF,GACA,GACF;AACF;AAEA,MAAM,YACH,YACD,OAAO,YAAwC;CAC7C,IAAI;EACF,IAAI,QAAQ,WAAW,QACrB,OAAO,aACL,EACE,OAAO;GACL,MAAM;GACN,SAAS;EACX,EACF,GACA,GACF;EAGF,OAAO,MAAM,QAAQ,OAAO;CAC9B,SAAS,OAAO;EACd,OAAO,iBAAiB,KAAK;CAC/B;AACF;AAEF,MAAM,mBACJ,SACA,YAAA,GAEAC,mBAAAA,kBAAAA,CAAkB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,OAAO,IAAI;AAE9D,MAAM,+BACJ,YAC0B;CAC1B,MAAM,iBAAwC;EAC5C,UAAU,QAAQ;EAClB,QAAQ,QAAQ;CAClB;CAEA,MAAM,WAAW,YAAqB;EACpC,CAAA,GAAA,mBAAA,4BAAA,CAA4B,SAAS,QAAQ,IAAI;CACnD;CAyGA,OAAO;EACL,0BAxG+B,SAAS,OAAO,YAAY;GAC3D,QAAQ,OAAO;GAEf,MAAM,UAAU,MAAMC,gBAAAA,kBAAkB,SAAS,cAAc;GAE/D,IAAI,CAAC,WAAW,QAAQ,SAAS,mBAAmB,CAAC,QAAQ,QAC3D,OAAO,aACL,EACE,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,GACA,GACF;GAGF,MAAM,QAAQ,UAAU,sBAAsB;IAC5C,QAAQ,QAAQ;IAChB,iBAAiB,QAAQ,gBAAgB,OAAO;IAChD,WAAW,QAAQ,gBAAgB,OAAO;GAC5C,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,yBACV,CAAC;EACH,CA8EyB;EACvB,aA7EkB,SAAS,OAAO,YAAY;GAC9C,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GACnC,MAAM,QAAQ,eAAe,MAAM,OAAO;GAE1C,MAAM,QAAQ,UAAU,YAAY,KAAK;GAEzC,OAAO,aAAa,EAClB,QAAQ,iBACV,CAAC;EACH,CAkEY;EACV,sBAjE2B,SAAS,OAAO,YAAY;GACvD,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,qBAAqB;IAC3C,OAAO,eAAe,MAAM,SAAS,GAAG;IACxC,UAAU,QAAQ,iBAAiB,OAAO;IAC1C,WAAW,QAAQ,gBAAgB,OAAO;GAC5C,CAAC;GAGD,OAAO,aAAa,EAClB,QAAQ,2BACV,CAAC;EACH,CAkDqB;EACnB,eAjDoB,SAAS,OAAO,YAAY;GAChD,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,cAAc;IACpC,OAAO,eAAe,MAAM,OAAO;IACnC,aAAa,eAAe,MAAM,aAAa;GACjD,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,iBACV,CAAC;EACH,CAoCc;EACZ,gBAnCqB,SAAS,OAAO,YAAY;GACjD,QAAQ,OAAO;GAEf,MAAM,eAAe,gBAAgB,SAAS,QAAQ,MAAM;GAE5D,IAAI,CAAC,cACH,OAAO,aACL,EACE,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,GACA,GACF;GAGF,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,eAAe;IACrC;IACA,iBAAiB,eAAe,MAAM,iBAAiB;IACvD,aAAa,eAAe,MAAM,aAAa;GACjD,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,mBACV,CAAC;EACH,CAOe;CACf;AACF"}

package/dist/auth/server/lifecycle.d.cts

@@ -0,0 +1,20 @@
+import { StorageAuthLifecycleManager } from "@puzzle-ui/auth";
+import { CsrfOptions, SessionCookieOptions, SessionManager } from "@puzzle-ui/session";
+export type AuthLifecycleHandlersOptions = {
+  readonly lifecycle: StorageAuthLifecycleManager;
+  readonly sessions: SessionManager;
+  readonly cookie: SessionCookieOptions;
+  readonly csrf: CsrfOptions;
+  readonly resolveClientIp: (request: Request) => string;
+  readonly verificationUrl: (request: Request) => string;
+  readonly passwordResetUrl: (request: Request) => string;
+};
+export type AuthLifecycleHandlers = {
+  readonly requestEmailVerification: (request: Request) => Promise<Response>;
+  readonly verifyEmail: (request: Request) => Promise<Response>;
+  readonly requestPasswordReset: (request: Request) => Promise<Response>;
+  readonly resetPassword: (request: Request) => Promise<Response>;
+  readonly changePassword: (request: Request) => Promise<Response>;
+};
+declare const createAuthLifecycleHandlers: (options: AuthLifecycleHandlersOptions) => AuthLifecycleHandlers;
+export { createAuthLifecycleHandlers };

package/dist/auth/server/lifecycle.d.ts

@@ -0,0 +1,20 @@
+import { StorageAuthLifecycleManager } from "@puzzle-ui/auth";
+import { CsrfOptions, SessionCookieOptions, SessionManager } from "@puzzle-ui/session";
+export type AuthLifecycleHandlersOptions = {
+  readonly lifecycle: StorageAuthLifecycleManager;
+  readonly sessions: SessionManager;
+  readonly cookie: SessionCookieOptions;
+  readonly csrf: CsrfOptions;
+  readonly resolveClientIp: (request: Request) => string;
+  readonly verificationUrl: (request: Request) => string;
+  readonly passwordResetUrl: (request: Request) => string;
+};
+export type AuthLifecycleHandlers = {
+  readonly requestEmailVerification: (request: Request) => Promise<Response>;
+  readonly verifyEmail: (request: Request) => Promise<Response>;
+  readonly requestPasswordReset: (request: Request) => Promise<Response>;
+  readonly resetPassword: (request: Request) => Promise<Response>;
+  readonly changePassword: (request: Request) => Promise<Response>;
+};
+declare const createAuthLifecycleHandlers: (options: AuthLifecycleHandlersOptions) => AuthLifecycleHandlers;
+export { createAuthLifecycleHandlers };

package/dist/auth/server/lifecycle.js

@@ -0,0 +1,126 @@
+import { getRequestSession } from "./session.js";
+import { AuthError } from "@puzzle-ui/auth";
+import { protectStateChangingRequest, readSessionCookie } from "@puzzle-ui/session";
+// src/auth/server/lifecycle.ts
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const jsonResponse = (body, status = 200) => new Response(JSON.stringify(body), {
+	status,
+	headers: {
+		"Content-Type": "application/json; charset=utf-8",
+		"Cache-Control": "no-store",
+		Pragma: "no-cache"
+	}
+});
+const readBody = async (request) => {
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		throw new Error("INVALID_REQUEST");
+	}
+	if (!isRecord(body)) throw new Error("INVALID_REQUEST");
+	return body;
+};
+const requiredString = (body, field, maximumLength = 2048) => {
+	const value = body[field];
+	if (typeof value !== "string" || !value.trim() || value.length > maximumLength) throw new Error("INVALID_REQUEST");
+	return value;
+};
+const getErrorResponse = (error) => {
+	if (error instanceof AuthError) {
+		const status = error.code === "RATE_LIMITED" ? 429 : error.code === "PROVIDER" ? 503 : error.code === "SESSION" ? 401 : 400;
+		return jsonResponse({ error: {
+			code: error.code,
+			message: error.message
+		} }, status);
+	}
+	if (error instanceof Error && error.message === "INVALID_REQUEST") return jsonResponse({ error: {
+		code: "INVALID_REQUEST",
+		message: "The request is invalid."
+	} }, 400);
+	return jsonResponse({ error: {
+		code: "INTERNAL_AUTH_ERROR",
+		message: "An authentication error occurred."
+	} }, 500);
+};
+const endpoint = (handler) => async (request) => {
+	try {
+		if (request.method !== "POST") return jsonResponse({ error: {
+			code: "METHOD_NOT_ALLOWED",
+			message: "Only POST requests are supported."
+		} }, 405);
+		return await handler(request);
+	} catch (error) {
+		return getErrorResponse(error);
+	}
+};
+const getSessionToken = (request, cookie) => readSessionCookie(request.headers.get("cookie"), cookie.name);
+const createAuthLifecycleHandlers = (options) => {
+	const sessionOptions = {
+		sessions: options.sessions,
+		cookie: options.cookie
+	};
+	const protect = (request) => {
+		protectStateChangingRequest(request, options.csrf);
+	};
+	return {
+		requestEmailVerification: endpoint(async (request) => {
+			protect(request);
+			const session = await getRequestSession(request, sessionOptions);
+			if (!session || session.kind !== "authenticated" || !session.userId) return jsonResponse({ error: {
+				code: "UNAUTHENTICATED",
+				message: "Authentication is required."
+			} }, 401);
+			await options.lifecycle.sendEmailVerification({
+				userId: session.userId,
+				verificationUrl: options.verificationUrl(request),
+				ipAddress: options.resolveClientIp(request)
+			});
+			return jsonResponse({ status: "verification-requested" });
+		}),
+		verifyEmail: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			const token = requiredString(body, "token");
+			await options.lifecycle.verifyEmail(token);
+			return jsonResponse({ status: "email-verified" });
+		}),
+		requestPasswordReset: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			await options.lifecycle.requestPasswordReset({
+				email: requiredString(body, "email", 320),
+				resetUrl: options.passwordResetUrl(request),
+				ipAddress: options.resolveClientIp(request)
+			});
+			return jsonResponse({ status: "password-reset-requested" });
+		}),
+		resetPassword: endpoint(async (request) => {
+			protect(request);
+			const body = await readBody(request);
+			await options.lifecycle.resetPassword({
+				token: requiredString(body, "token"),
+				newPassword: requiredString(body, "newPassword")
+			});
+			return jsonResponse({ status: "password-reset" });
+		}),
+		changePassword: endpoint(async (request) => {
+			protect(request);
+			const sessionToken = getSessionToken(request, options.cookie);
+			if (!sessionToken) return jsonResponse({ error: {
+				code: "UNAUTHENTICATED",
+				message: "Authentication is required."
+			} }, 401);
+			const body = await readBody(request);
+			await options.lifecycle.changePassword({
+				sessionToken,
+				currentPassword: requiredString(body, "currentPassword"),
+				newPassword: requiredString(body, "newPassword")
+			});
+			return jsonResponse({ status: "password-changed" });
+		})
+	};
+};
+export { createAuthLifecycleHandlers };
+
+//# sourceMappingURL=lifecycle.js.map

package/dist/auth/server/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","names":[],"sources":["../../../src/auth/server/lifecycle.ts"],"sourcesContent":["import { AuthError, type StorageAuthLifecycleManager } from \"@puzzle-ui/auth\";\n\nimport {\n  readSessionCookie,\n  protectStateChangingRequest,\n  type CsrfOptions,\n  type SessionCookieOptions,\n  type SessionManager,\n} from \"@puzzle-ui/session\";\n\nimport { getRequestSession, type SessionRequestOptions } from \"./session\";\n\nexport type AuthLifecycleHandlersOptions = {\n  readonly lifecycle: StorageAuthLifecycleManager;\n  readonly sessions: SessionManager;\n  readonly cookie: SessionCookieOptions;\n  readonly csrf: CsrfOptions;\n  readonly resolveClientIp: (request: Request) => string;\n  readonly verificationUrl: (request: Request) => string;\n  readonly passwordResetUrl: (request: Request) => string;\n};\n\nexport type AuthLifecycleHandlers = {\n  readonly requestEmailVerification: (request: Request) => Promise<Response>;\n  readonly verifyEmail: (request: Request) => Promise<Response>;\n  readonly requestPasswordReset: (request: Request) => Promise<Response>;\n  readonly resetPassword: (request: Request) => Promise<Response>;\n  readonly changePassword: (request: Request) => Promise<Response>;\n};\n\ntype JsonObject = Record<string, unknown>;\n\nconst isRecord = (value: unknown): value is JsonObject =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nconst jsonResponse = (body: unknown, status = 200): Response =>\n  new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"Content-Type\": \"application/json; charset=utf-8\",\n      \"Cache-Control\": \"no-store\",\n      Pragma: \"no-cache\",\n    },\n  });\n\nconst readBody = async (request: Request): Promise<JsonObject> => {\n  let body: unknown;\n\n  try {\n    body = await request.json();\n  } catch {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  if (!isRecord(body)) {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  return body;\n};\n\nconst requiredString = (\n  body: JsonObject,\n  field: string,\n  maximumLength = 2048,\n): string => {\n  const value = body[field];\n\n  if (\n    typeof value !== \"string\" ||\n    !value.trim() ||\n    value.length > maximumLength\n  ) {\n    throw new Error(\"INVALID_REQUEST\");\n  }\n\n  return value;\n};\n\nconst getErrorResponse = (error: unknown): Response => {\n  if (error instanceof AuthError) {\n    const status =\n      error.code === \"RATE_LIMITED\"\n        ? 429\n        : error.code === \"PROVIDER\"\n          ? 503\n          : error.code === \"SESSION\"\n            ? 401\n            : 400;\n\n    return jsonResponse(\n      {\n        error: {\n          code: error.code,\n          message: error.message,\n        },\n      },\n      status,\n    );\n  }\n\n  if (error instanceof Error && error.message === \"INVALID_REQUEST\") {\n    return jsonResponse(\n      {\n        error: {\n          code: \"INVALID_REQUEST\",\n          message: \"The request is invalid.\",\n        },\n      },\n      400,\n    );\n  }\n\n  return jsonResponse(\n    {\n      error: {\n        code: \"INTERNAL_AUTH_ERROR\",\n        message: \"An authentication error occurred.\",\n      },\n    },\n    500,\n  );\n};\n\nconst endpoint =\n  (handler: (request: Request) => Promise<Response>) =>\n  async (request: Request): Promise<Response> => {\n    try {\n      if (request.method !== \"POST\") {\n        return jsonResponse(\n          {\n            error: {\n              code: \"METHOD_NOT_ALLOWED\",\n              message: \"Only POST requests are supported.\",\n            },\n          },\n          405,\n        );\n      }\n\n      return await handler(request);\n    } catch (error) {\n      return getErrorResponse(error);\n    }\n  };\n\nconst getSessionToken = (\n  request: Request,\n  cookie: SessionCookieOptions,\n): string | null =>\n  readSessionCookie(request.headers.get(\"cookie\"), cookie.name);\n\nconst createAuthLifecycleHandlers = (\n  options: AuthLifecycleHandlersOptions,\n): AuthLifecycleHandlers => {\n  const sessionOptions: SessionRequestOptions = {\n    sessions: options.sessions,\n    cookie: options.cookie,\n  };\n\n  const protect = (request: Request) => {\n    protectStateChangingRequest(request, options.csrf);\n  };\n\n  const requestEmailVerification = endpoint(async (request) => {\n    protect(request);\n\n    const session = await getRequestSession(request, sessionOptions);\n\n    if (!session || session.kind !== \"authenticated\" || !session.userId) {\n      return jsonResponse(\n        {\n          error: {\n            code: \"UNAUTHENTICATED\",\n            message: \"Authentication is required.\",\n          },\n        },\n        401,\n      );\n    }\n\n    await options.lifecycle.sendEmailVerification({\n      userId: session.userId,\n      verificationUrl: options.verificationUrl(request),\n      ipAddress: options.resolveClientIp(request),\n    });\n\n    return jsonResponse({\n      status: \"verification-requested\",\n    });\n  });\n\n  const verifyEmail = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n    const token = requiredString(body, \"token\");\n\n    await options.lifecycle.verifyEmail(token);\n\n    return jsonResponse({\n      status: \"email-verified\",\n    });\n  });\n\n  const requestPasswordReset = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n\n    await options.lifecycle.requestPasswordReset({\n      email: requiredString(body, \"email\", 320),\n      resetUrl: options.passwordResetUrl(request),\n      ipAddress: options.resolveClientIp(request),\n    });\n\n    // The public result must never reveal whether an account exists.\n    return jsonResponse({\n      status: \"password-reset-requested\",\n    });\n  });\n\n  const resetPassword = endpoint(async (request) => {\n    protect(request);\n\n    const body = await readBody(request);\n\n    await options.lifecycle.resetPassword({\n      token: requiredString(body, \"token\"),\n      newPassword: requiredString(body, \"newPassword\"),\n    });\n\n    return jsonResponse({\n      status: \"password-reset\",\n    });\n  });\n\n  const changePassword = endpoint(async (request) => {\n    protect(request);\n\n    const sessionToken = getSessionToken(request, options.cookie);\n\n    if (!sessionToken) {\n      return jsonResponse(\n        {\n          error: {\n            code: \"UNAUTHENTICATED\",\n            message: \"Authentication is required.\",\n          },\n        },\n        401,\n      );\n    }\n\n    const body = await readBody(request);\n\n    await options.lifecycle.changePassword({\n      sessionToken,\n      currentPassword: requiredString(body, \"currentPassword\"),\n      newPassword: requiredString(body, \"newPassword\"),\n    });\n\n    return jsonResponse({\n      status: \"password-changed\",\n    });\n  });\n\n  return {\n    requestEmailVerification,\n    verifyEmail,\n    requestPasswordReset,\n    resetPassword,\n    changePassword,\n  };\n};\n\nexport { createAuthLifecycleHandlers };\n"],"mappings":";;;;AAgCA,MAAM,YAAY,UAChB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,MAAM,gBAAgB,MAAe,SAAS,QAC5C,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CACjC;CACA,SAAS;EACP,gBAAgB;EAChB,iBAAiB;EACjB,QAAQ;CACV;AACF,CAAC;AAEH,MAAM,WAAW,OAAO,YAA0C;CAChE,IAAI;CAEJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK;CAC5B,QAAQ;EACN,MAAM,IAAI,MAAM,iBAAiB;CACnC;CAEA,IAAI,CAAC,SAAS,IAAI,GAChB,MAAM,IAAI,MAAM,iBAAiB;CAGnC,OAAO;AACT;AAEA,MAAM,kBACJ,MACA,OACA,gBAAgB,SACL;CACX,MAAM,QAAQ,KAAK;CAEnB,IACE,OAAO,UAAU,YACjB,CAAC,MAAM,KAAK,KACZ,MAAM,SAAS,eAEf,MAAM,IAAI,MAAM,iBAAiB;CAGnC,OAAO;AACT;AAEA,MAAM,oBAAoB,UAA6B;CACrD,IAAI,iBAAiB,WAAW;EAC9B,MAAM,SACJ,MAAM,SAAS,iBACX,MACA,MAAM,SAAS,aACb,MACA,MAAM,SAAS,YACb,MACA;EAEV,OAAO,aACL,EACE,OAAO;GACL,MAAM,MAAM;GACZ,SAAS,MAAM;EACjB,EACF,GACA,MACF;CACF;CAEA,IAAI,iBAAiB,SAAS,MAAM,YAAY,mBAC9C,OAAO,aACL,EACE,OAAO;EACL,MAAM;EACN,SAAS;CACX,EACF,GACA,GACF;CAGF,OAAO,aACL,EACE,OAAO;EACL,MAAM;EACN,SAAS;CACX,EACF,GACA,GACF;AACF;AAEA,MAAM,YACH,YACD,OAAO,YAAwC;CAC7C,IAAI;EACF,IAAI,QAAQ,WAAW,QACrB,OAAO,aACL,EACE,OAAO;GACL,MAAM;GACN,SAAS;EACX,EACF,GACA,GACF;EAGF,OAAO,MAAM,QAAQ,OAAO;CAC9B,SAAS,OAAO;EACd,OAAO,iBAAiB,KAAK;CAC/B;AACF;AAEF,MAAM,mBACJ,SACA,WAEA,kBAAkB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,OAAO,IAAI;AAE9D,MAAM,+BACJ,YAC0B;CAC1B,MAAM,iBAAwC;EAC5C,UAAU,QAAQ;EAClB,QAAQ,QAAQ;CAClB;CAEA,MAAM,WAAW,YAAqB;EACpC,4BAA4B,SAAS,QAAQ,IAAI;CACnD;CAyGA,OAAO;EACL,0BAxG+B,SAAS,OAAO,YAAY;GAC3D,QAAQ,OAAO;GAEf,MAAM,UAAU,MAAM,kBAAkB,SAAS,cAAc;GAE/D,IAAI,CAAC,WAAW,QAAQ,SAAS,mBAAmB,CAAC,QAAQ,QAC3D,OAAO,aACL,EACE,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,GACA,GACF;GAGF,MAAM,QAAQ,UAAU,sBAAsB;IAC5C,QAAQ,QAAQ;IAChB,iBAAiB,QAAQ,gBAAgB,OAAO;IAChD,WAAW,QAAQ,gBAAgB,OAAO;GAC5C,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,yBACV,CAAC;EACH,CA8EyB;EACvB,aA7EkB,SAAS,OAAO,YAAY;GAC9C,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GACnC,MAAM,QAAQ,eAAe,MAAM,OAAO;GAE1C,MAAM,QAAQ,UAAU,YAAY,KAAK;GAEzC,OAAO,aAAa,EAClB,QAAQ,iBACV,CAAC;EACH,CAkEY;EACV,sBAjE2B,SAAS,OAAO,YAAY;GACvD,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,qBAAqB;IAC3C,OAAO,eAAe,MAAM,SAAS,GAAG;IACxC,UAAU,QAAQ,iBAAiB,OAAO;IAC1C,WAAW,QAAQ,gBAAgB,OAAO;GAC5C,CAAC;GAGD,OAAO,aAAa,EAClB,QAAQ,2BACV,CAAC;EACH,CAkDqB;EACnB,eAjDoB,SAAS,OAAO,YAAY;GAChD,QAAQ,OAAO;GAEf,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,cAAc;IACpC,OAAO,eAAe,MAAM,OAAO;IACnC,aAAa,eAAe,MAAM,aAAa;GACjD,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,iBACV,CAAC;EACH,CAoCc;EACZ,gBAnCqB,SAAS,OAAO,YAAY;GACjD,QAAQ,OAAO;GAEf,MAAM,eAAe,gBAAgB,SAAS,QAAQ,MAAM;GAE5D,IAAI,CAAC,cACH,OAAO,aACL,EACE,OAAO;IACL,MAAM;IACN,SAAS;GACX,EACF,GACA,GACF;GAGF,MAAM,OAAO,MAAM,SAAS,OAAO;GAEnC,MAAM,QAAQ,UAAU,eAAe;IACrC;IACA,iBAAiB,eAAe,MAAM,iBAAiB;IACvD,aAAa,eAAe,MAAM,aAAa;GACjD,CAAC;GAED,OAAO,aAAa,EAClB,QAAQ,mBACV,CAAC;EACH,CAOe;CACf;AACF"}