@shware/security 7.1.1 → 8.0.1

package/dist/auth/email-codes.cjs

@@ -0,0 +1,77 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_error = require("./error.cjs");
+const require_auth_respond = require("./respond.cjs");
+let node_crypto = require("node:crypto");
+// src/auth/email-codes.ts
+/** Seconds an email verification code, and its attempt counter, stay valid. */
+const EMAIL_VERIFICATION_CODE_TTL = 600;
+/**
+* The six-digit codes mailed to prove an address, in the KV store: one pending code per email,
+* its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the
+* login route and a host flow that only needs proof of the address (verifying or changing a
+* signed-in user's email) share it.
+*/
+var EmailVerificationCodes = class {
+	kv;
+	maxAttempts;
+	resendCooldown;
+	constructor(kv, options) {
+		this.kv = kv;
+		this.maxAttempts = options.maxAttempts;
+		this.resendCooldown = options.resendCooldown;
+	}
+	codeKey(email) {
+		return `email:verification:${email}`;
+	}
+	attemptsKey(email) {
+		return `email:verification-attempts:${email}`;
+	}
+	cooldownKey(email) {
+		return `email:verification-cooldown:${email}`;
+	}
+	/**
+	* Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,
+	* so of concurrent requests exactly one sends. A failed delivery releases it again: no code was
+	* stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user
+	* out of signing in for the whole cooldown.
+	*/
+	async send(email, sender) {
+		const cooldownKey = this.cooldownKey(email);
+		if (await this.kv.increment(cooldownKey, this.resendCooldown) > 1) throw require_auth_respond.resourceExhausted("VERIFICATION_CODE_RESEND_TOO_SOON", "A code was sent recently");
+		const verificationCode = (0, node_crypto.randomInt)(1e6).toString().padStart(6, "0");
+		try {
+			await sender({
+				email,
+				verificationCode
+			});
+		} catch (error) {
+			console.error("Failed to send email verification code", error);
+			await this.kv.removeItem(cooldownKey);
+			throw require_auth_respond.unavailable("EMAIL_DELIVERY_FAILED", "The verification email could not be sent");
+		}
+		await this.kv.removeItem(this.attemptsKey(email));
+		await this.kv.setItem(this.codeKey(email), verificationCode, 600);
+	}
+	/**
+	* Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:
+	* `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`
+	* once more than `maxAttempts` guesses were made, which discards the code.
+	*/
+	async verify(email, verificationCode) {
+		const codeKey = this.codeKey(email);
+		const attemptsKey = this.attemptsKey(email);
+		const stored = await this.kv.getItem(codeKey);
+		if (typeof stored !== "string") throw new require_auth_error.AuthenticationError("INVALID_VERIFICATION_CODE");
+		if (await this.kv.increment(attemptsKey, 600) > this.maxAttempts) {
+			await this.kv.removeItem(codeKey);
+			throw new require_auth_error.AuthenticationError("VERIFICATION_CODE_ATTEMPTS_EXCEEDED");
+		}
+		if (stored.length !== verificationCode.length || !(0, node_crypto.timingSafeEqual)(Buffer.from(stored), Buffer.from(verificationCode))) throw new require_auth_error.AuthenticationError("INVALID_VERIFICATION_CODE");
+		await this.kv.removeItem(codeKey);
+		await this.kv.removeItem(attemptsKey);
+	}
+};
+exports.EMAIL_VERIFICATION_CODE_TTL = EMAIL_VERIFICATION_CODE_TTL;
+exports.EmailVerificationCodes = EmailVerificationCodes;
+
+//# sourceMappingURL=email-codes.cjs.map

package/dist/auth/email-codes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-codes.cjs","names":["resourceExhausted","randomInt","unavailable","AuthenticationError","timingSafeEqual"],"sources":["../../src/auth/email-codes.ts"],"sourcesContent":["import { randomInt, timingSafeEqual } from 'node:crypto';\nimport type { KVRepository } from '../session/types';\nimport { AuthenticationError } from './error';\nimport { resourceExhausted, unavailable } from './respond';\n\n/** Seconds an email verification code, and its attempt counter, stay valid. */\nexport const EMAIL_VERIFICATION_CODE_TTL = 10 * 60;\n\nexport type EmailSender = (data: { email: string; verificationCode: string }) => Promise<void>;\n\n/**\n * The six-digit codes mailed to prove an address, in the KV store: one pending code per email,\n * its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the\n * login route and a host flow that only needs proof of the address (verifying or changing a\n * signed-in user's email) share it.\n */\nexport class EmailVerificationCodes {\n  private readonly kv: KVRepository;\n  private readonly maxAttempts: number;\n  private readonly resendCooldown: number;\n\n  constructor(kv: KVRepository, options: { maxAttempts: number; resendCooldown: number }) {\n    this.kv = kv;\n    this.maxAttempts = options.maxAttempts;\n    this.resendCooldown = options.resendCooldown;\n  }\n\n  private codeKey(email: string) {\n    return `email:verification:${email}`;\n  }\n\n  private attemptsKey(email: string) {\n    return `email:verification-attempts:${email}`;\n  }\n\n  private cooldownKey(email: string) {\n    return `email:verification-cooldown:${email}`;\n  }\n\n  /**\n   * Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,\n   * so of concurrent requests exactly one sends. A failed delivery releases it again: no code was\n   * stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user\n   * out of signing in for the whole cooldown.\n   */\n  async send(email: string, sender: EmailSender): Promise<void> {\n    const cooldownKey = this.cooldownKey(email);\n    if ((await this.kv.increment(cooldownKey, this.resendCooldown)) > 1) {\n      throw resourceExhausted('VERIFICATION_CODE_RESEND_TOO_SOON', 'A code was sent recently');\n    }\n    const verificationCode = randomInt(1_000_000).toString().padStart(6, '0');\n    try {\n      // Sent before it is stored, so a failed delivery leaves the previous code usable.\n      await sender({ email, verificationCode });\n    } catch (error) {\n      console.error('Failed to send email verification code', error);\n      await this.kv.removeItem(cooldownKey);\n      throw unavailable('EMAIL_DELIVERY_FAILED', 'The verification email could not be sent');\n    }\n    // The new code gets the full attempt budget; the cooldown bounds how often that happens.\n    // Reset before storing, so every comparison against the new code is counted.\n    await this.kv.removeItem(this.attemptsKey(email));\n    await this.kv.setItem(this.codeKey(email), verificationCode, EMAIL_VERIFICATION_CODE_TTL);\n  }\n\n  /**\n   * Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:\n   * `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`\n   * once more than `maxAttempts` guesses were made, which discards the code.\n   */\n  async verify(email: string, verificationCode: string): Promise<void> {\n    const codeKey = this.codeKey(email);\n    const attemptsKey = this.attemptsKey(email);\n    const stored = await this.kv.getItem(codeKey);\n    if (typeof stored !== 'string') throw new AuthenticationError('INVALID_VERIFICATION_CODE');\n\n    // Count the attempt before comparing: the atomic increment hands every request, parallel ones\n    // included, a distinct count, so at most maxAttempts comparisons are ever made against a code.\n    const attempts = await this.kv.increment(attemptsKey, EMAIL_VERIFICATION_CODE_TTL);\n    if (attempts > this.maxAttempts) {\n      // Only the code is discarded. The counter stays until it expires (or a new code is sent):\n      // removing it would hand requests that already read the code a fresh budget.\n      await this.kv.removeItem(codeKey);\n      throw new AuthenticationError('VERIFICATION_CODE_ATTEMPTS_EXCEEDED');\n    }\n    if (\n      stored.length !== verificationCode.length ||\n      !timingSafeEqual(Buffer.from(stored), Buffer.from(verificationCode))\n    ) {\n      throw new AuthenticationError('INVALID_VERIFICATION_CODE');\n    }\n    await this.kv.removeItem(codeKey);\n    await this.kv.removeItem(attemptsKey);\n  }\n}\n"],"mappings":";;;;;;AAMA,MAAa,8BAA8B;;;;;;;AAU3C,IAAa,yBAAb,MAAoC;CAClC;CACA;CACA;CAEA,YAAY,IAAkB,SAA0D;EACtF,KAAK,KAAK;EACV,KAAK,cAAc,QAAQ;EAC3B,KAAK,iBAAiB,QAAQ;CAChC;CAEA,QAAgB,OAAe;EAC7B,OAAO,sBAAsB;CAC/B;CAEA,YAAoB,OAAe;EACjC,OAAO,+BAA+B;CACxC;CAEA,YAAoB,OAAe;EACjC,OAAO,+BAA+B;CACxC;;;;;;;CAQA,MAAM,KAAK,OAAe,QAAoC;EAC5D,MAAM,cAAc,KAAK,YAAY,KAAK;EAC1C,IAAK,MAAM,KAAK,GAAG,UAAU,aAAa,KAAK,cAAc,IAAK,GAChE,MAAMA,qBAAAA,kBAAkB,qCAAqC,0BAA0B;EAEzF,MAAM,oBAAA,GAAmBC,YAAAA,UAAAA,CAAU,GAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACxE,IAAI;GAEF,MAAM,OAAO;IAAE;IAAO;GAAiB,CAAC;EAC1C,SAAS,OAAO;GACd,QAAQ,MAAM,0CAA0C,KAAK;GAC7D,MAAM,KAAK,GAAG,WAAW,WAAW;GACpC,MAAMC,qBAAAA,YAAY,yBAAyB,0CAA0C;EACvF;EAGA,MAAM,KAAK,GAAG,WAAW,KAAK,YAAY,KAAK,CAAC;EAChD,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,KAAK,GAAG,kBAAA,GAA6C;CAC1F;;;;;;CAOA,MAAM,OAAO,OAAe,kBAAyC;EACnE,MAAM,UAAU,KAAK,QAAQ,KAAK;EAClC,MAAM,cAAc,KAAK,YAAY,KAAK;EAC1C,MAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,OAAO;EAC5C,IAAI,OAAO,WAAW,UAAU,MAAM,IAAIC,mBAAAA,oBAAoB,2BAA2B;EAKzF,IAAI,MADmB,KAAK,GAAG,UAAU,aAAA,GAAwC,IAClE,KAAK,aAAa;GAG/B,MAAM,KAAK,GAAG,WAAW,OAAO;GAChC,MAAM,IAAIA,mBAAAA,oBAAoB,qCAAqC;EACrE;EACA,IACE,OAAO,WAAW,iBAAiB,UACnC,EAAA,GAACC,YAAAA,gBAAAA,CAAgB,OAAO,KAAK,MAAM,GAAG,OAAO,KAAK,gBAAgB,CAAC,GAEnE,MAAM,IAAID,mBAAAA,oBAAoB,2BAA2B;EAE3D,MAAM,KAAK,GAAG,WAAW,OAAO;EAChC,MAAM,KAAK,GAAG,WAAW,WAAW;CACtC;AACF"}

package/dist/auth/email-codes.d.cts

@@ -0,0 +1,39 @@
+import { KVRepository } from "../session/types.cjs";
+/** Seconds an email verification code, and its attempt counter, stay valid. */
+export declare const EMAIL_VERIFICATION_CODE_TTL: number;
+export type EmailSender = (data: {
+  email: string;
+  verificationCode: string;
+}) => Promise<void>;
+/**
+ * The six-digit codes mailed to prove an address, in the KV store: one pending code per email,
+ * its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the
+ * login route and a host flow that only needs proof of the address (verifying or changing a
+ * signed-in user's email) share it.
+ */
+export declare class EmailVerificationCodes {
+  private readonly kv;
+  private readonly maxAttempts;
+  private readonly resendCooldown;
+  constructor(kv: KVRepository, options: {
+    maxAttempts: number;
+    resendCooldown: number;
+  });
+  private codeKey;
+  private attemptsKey;
+  private cooldownKey;
+  /**
+   * Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,
+   * so of concurrent requests exactly one sends. A failed delivery releases it again: no code was
+   * stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user
+   * out of signing in for the whole cooldown.
+   */
+  send(email: string, sender: EmailSender): Promise<void>;
+  /**
+   * Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:
+   * `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`
+   * once more than `maxAttempts` guesses were made, which discards the code.
+   */
+  verify(email: string, verificationCode: string): Promise<void>;
+}
+//# sourceMappingURL=email-codes.d.cts.map

package/dist/auth/email-codes.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-codes.d.cts","names":[],"sources":["../../src/auth/email-codes.ts"],"mappings":";;qBAMa;YAED,eAAe;EAAQ;EAAe;MAA+B;;;;;;;qBAQpE;mBACM;mBACA;mBACA;EAEjB,YAAY,IAAI,cAAc;IAAW;IAAqB;;UAMtD;UAIA;UAIA;;;;;;;EAUF,KAAK,eAAe,QAAQ,cAAc;;;;;;EAyB1C,OAAO,eAAe,2BAA2B"}

package/dist/auth/email-codes.d.mts

@@ -0,0 +1,39 @@
+import { KVRepository } from "../session/types.mjs";
+/** Seconds an email verification code, and its attempt counter, stay valid. */
+export declare const EMAIL_VERIFICATION_CODE_TTL: number;
+export type EmailSender = (data: {
+  email: string;
+  verificationCode: string;
+}) => Promise<void>;
+/**
+ * The six-digit codes mailed to prove an address, in the KV store: one pending code per email,
+ * its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the
+ * login route and a host flow that only needs proof of the address (verifying or changing a
+ * signed-in user's email) share it.
+ */
+export declare class EmailVerificationCodes {
+  private readonly kv;
+  private readonly maxAttempts;
+  private readonly resendCooldown;
+  constructor(kv: KVRepository, options: {
+    maxAttempts: number;
+    resendCooldown: number;
+  });
+  private codeKey;
+  private attemptsKey;
+  private cooldownKey;
+  /**
+   * Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,
+   * so of concurrent requests exactly one sends. A failed delivery releases it again: no code was
+   * stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user
+   * out of signing in for the whole cooldown.
+   */
+  send(email: string, sender: EmailSender): Promise<void>;
+  /**
+   * Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:
+   * `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`
+   * once more than `maxAttempts` guesses were made, which discards the code.
+   */
+  verify(email: string, verificationCode: string): Promise<void>;
+}
+//# sourceMappingURL=email-codes.d.mts.map

package/dist/auth/email-codes.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-codes.d.mts","names":[],"sources":["../../src/auth/email-codes.ts"],"mappings":";;qBAMa;YAED,eAAe;EAAQ;EAAe;MAA+B;;;;;;;qBAQpE;mBACM;mBACA;mBACA;EAEjB,YAAY,IAAI,cAAc;IAAW;IAAqB;;UAMtD;UAIA;UAIA;;;;;;;EAUF,KAAK,eAAe,QAAQ,cAAc;;;;;;EAyB1C,OAAO,eAAe,2BAA2B"}

package/dist/auth/email-codes.mjs

@@ -0,0 +1,75 @@
+import { AuthenticationError } from "./error.mjs";
+import { resourceExhausted, unavailable } from "./respond.mjs";
+import { randomInt, timingSafeEqual } from "node:crypto";
+// src/auth/email-codes.ts
+/** Seconds an email verification code, and its attempt counter, stay valid. */
+const EMAIL_VERIFICATION_CODE_TTL = 600;
+/**
+* The six-digit codes mailed to prove an address, in the KV store: one pending code per email,
+* its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the
+* login route and a host flow that only needs proof of the address (verifying or changing a
+* signed-in user's email) share it.
+*/
+var EmailVerificationCodes = class {
+	kv;
+	maxAttempts;
+	resendCooldown;
+	constructor(kv, options) {
+		this.kv = kv;
+		this.maxAttempts = options.maxAttempts;
+		this.resendCooldown = options.resendCooldown;
+	}
+	codeKey(email) {
+		return `email:verification:${email}`;
+	}
+	attemptsKey(email) {
+		return `email:verification-attempts:${email}`;
+	}
+	cooldownKey(email) {
+		return `email:verification-cooldown:${email}`;
+	}
+	/**
+	* Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,
+	* so of concurrent requests exactly one sends. A failed delivery releases it again: no code was
+	* stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user
+	* out of signing in for the whole cooldown.
+	*/
+	async send(email, sender) {
+		const cooldownKey = this.cooldownKey(email);
+		if (await this.kv.increment(cooldownKey, this.resendCooldown) > 1) throw resourceExhausted("VERIFICATION_CODE_RESEND_TOO_SOON", "A code was sent recently");
+		const verificationCode = randomInt(1e6).toString().padStart(6, "0");
+		try {
+			await sender({
+				email,
+				verificationCode
+			});
+		} catch (error) {
+			console.error("Failed to send email verification code", error);
+			await this.kv.removeItem(cooldownKey);
+			throw unavailable("EMAIL_DELIVERY_FAILED", "The verification email could not be sent");
+		}
+		await this.kv.removeItem(this.attemptsKey(email));
+		await this.kv.setItem(this.codeKey(email), verificationCode, 600);
+	}
+	/**
+	* Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:
+	* `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`
+	* once more than `maxAttempts` guesses were made, which discards the code.
+	*/
+	async verify(email, verificationCode) {
+		const codeKey = this.codeKey(email);
+		const attemptsKey = this.attemptsKey(email);
+		const stored = await this.kv.getItem(codeKey);
+		if (typeof stored !== "string") throw new AuthenticationError("INVALID_VERIFICATION_CODE");
+		if (await this.kv.increment(attemptsKey, 600) > this.maxAttempts) {
+			await this.kv.removeItem(codeKey);
+			throw new AuthenticationError("VERIFICATION_CODE_ATTEMPTS_EXCEEDED");
+		}
+		if (stored.length !== verificationCode.length || !timingSafeEqual(Buffer.from(stored), Buffer.from(verificationCode))) throw new AuthenticationError("INVALID_VERIFICATION_CODE");
+		await this.kv.removeItem(codeKey);
+		await this.kv.removeItem(attemptsKey);
+	}
+};
+export { EMAIL_VERIFICATION_CODE_TTL, EmailVerificationCodes };
+
+//# sourceMappingURL=email-codes.mjs.map

package/dist/auth/email-codes.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-codes.mjs","names":[],"sources":["../../src/auth/email-codes.ts"],"sourcesContent":["import { randomInt, timingSafeEqual } from 'node:crypto';\nimport type { KVRepository } from '../session/types';\nimport { AuthenticationError } from './error';\nimport { resourceExhausted, unavailable } from './respond';\n\n/** Seconds an email verification code, and its attempt counter, stay valid. */\nexport const EMAIL_VERIFICATION_CODE_TTL = 10 * 60;\n\nexport type EmailSender = (data: { email: string; verificationCode: string }) => Promise<void>;\n\n/**\n * The six-digit codes mailed to prove an address, in the KV store: one pending code per email,\n * its guess counter, and the resend cooldown. `send` and `verify` are the whole protocol, so the\n * login route and a host flow that only needs proof of the address (verifying or changing a\n * signed-in user's email) share it.\n */\nexport class EmailVerificationCodes {\n  private readonly kv: KVRepository;\n  private readonly maxAttempts: number;\n  private readonly resendCooldown: number;\n\n  constructor(kv: KVRepository, options: { maxAttempts: number; resendCooldown: number }) {\n    this.kv = kv;\n    this.maxAttempts = options.maxAttempts;\n    this.resendCooldown = options.resendCooldown;\n  }\n\n  private codeKey(email: string) {\n    return `email:verification:${email}`;\n  }\n\n  private attemptsKey(email: string) {\n    return `email:verification-attempts:${email}`;\n  }\n\n  private cooldownKey(email: string) {\n    return `email:verification-cooldown:${email}`;\n  }\n\n  /**\n   * Mails a fresh code, at most once per `resendCooldown`. The cooldown is claimed before sending,\n   * so of concurrent requests exactly one sends. A failed delivery releases it again: no code was\n   * stored, so an immediate retry gains an attacker nothing, while keeping it would lock the user\n   * out of signing in for the whole cooldown.\n   */\n  async send(email: string, sender: EmailSender): Promise<void> {\n    const cooldownKey = this.cooldownKey(email);\n    if ((await this.kv.increment(cooldownKey, this.resendCooldown)) > 1) {\n      throw resourceExhausted('VERIFICATION_CODE_RESEND_TOO_SOON', 'A code was sent recently');\n    }\n    const verificationCode = randomInt(1_000_000).toString().padStart(6, '0');\n    try {\n      // Sent before it is stored, so a failed delivery leaves the previous code usable.\n      await sender({ email, verificationCode });\n    } catch (error) {\n      console.error('Failed to send email verification code', error);\n      await this.kv.removeItem(cooldownKey);\n      throw unavailable('EMAIL_DELIVERY_FAILED', 'The verification email could not be sent');\n    }\n    // The new code gets the full attempt budget; the cooldown bounds how often that happens.\n    // Reset before storing, so every comparison against the new code is counted.\n    await this.kv.removeItem(this.attemptsKey(email));\n    await this.kv.setItem(this.codeKey(email), verificationCode, EMAIL_VERIFICATION_CODE_TTL);\n  }\n\n  /**\n   * Spends the pending code if `verificationCode` is it; otherwise throws `AuthenticationError`:\n   * `INVALID_VERIFICATION_CODE` (wrong, or none pending), or `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`\n   * once more than `maxAttempts` guesses were made, which discards the code.\n   */\n  async verify(email: string, verificationCode: string): Promise<void> {\n    const codeKey = this.codeKey(email);\n    const attemptsKey = this.attemptsKey(email);\n    const stored = await this.kv.getItem(codeKey);\n    if (typeof stored !== 'string') throw new AuthenticationError('INVALID_VERIFICATION_CODE');\n\n    // Count the attempt before comparing: the atomic increment hands every request, parallel ones\n    // included, a distinct count, so at most maxAttempts comparisons are ever made against a code.\n    const attempts = await this.kv.increment(attemptsKey, EMAIL_VERIFICATION_CODE_TTL);\n    if (attempts > this.maxAttempts) {\n      // Only the code is discarded. The counter stays until it expires (or a new code is sent):\n      // removing it would hand requests that already read the code a fresh budget.\n      await this.kv.removeItem(codeKey);\n      throw new AuthenticationError('VERIFICATION_CODE_ATTEMPTS_EXCEEDED');\n    }\n    if (\n      stored.length !== verificationCode.length ||\n      !timingSafeEqual(Buffer.from(stored), Buffer.from(verificationCode))\n    ) {\n      throw new AuthenticationError('INVALID_VERIFICATION_CODE');\n    }\n    await this.kv.removeItem(codeKey);\n    await this.kv.removeItem(attemptsKey);\n  }\n}\n"],"mappings":";;;;;AAMA,MAAa,8BAA8B;;;;;;;AAU3C,IAAa,yBAAb,MAAoC;CAClC;CACA;CACA;CAEA,YAAY,IAAkB,SAA0D;EACtF,KAAK,KAAK;EACV,KAAK,cAAc,QAAQ;EAC3B,KAAK,iBAAiB,QAAQ;CAChC;CAEA,QAAgB,OAAe;EAC7B,OAAO,sBAAsB;CAC/B;CAEA,YAAoB,OAAe;EACjC,OAAO,+BAA+B;CACxC;CAEA,YAAoB,OAAe;EACjC,OAAO,+BAA+B;CACxC;;;;;;;CAQA,MAAM,KAAK,OAAe,QAAoC;EAC5D,MAAM,cAAc,KAAK,YAAY,KAAK;EAC1C,IAAK,MAAM,KAAK,GAAG,UAAU,aAAa,KAAK,cAAc,IAAK,GAChE,MAAM,kBAAkB,qCAAqC,0BAA0B;EAEzF,MAAM,mBAAmB,UAAU,GAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,GAAG,GAAG;EACxE,IAAI;GAEF,MAAM,OAAO;IAAE;IAAO;GAAiB,CAAC;EAC1C,SAAS,OAAO;GACd,QAAQ,MAAM,0CAA0C,KAAK;GAC7D,MAAM,KAAK,GAAG,WAAW,WAAW;GACpC,MAAM,YAAY,yBAAyB,0CAA0C;EACvF;EAGA,MAAM,KAAK,GAAG,WAAW,KAAK,YAAY,KAAK,CAAC;EAChD,MAAM,KAAK,GAAG,QAAQ,KAAK,QAAQ,KAAK,GAAG,kBAAA,GAA6C;CAC1F;;;;;;CAOA,MAAM,OAAO,OAAe,kBAAyC;EACnE,MAAM,UAAU,KAAK,QAAQ,KAAK;EAClC,MAAM,cAAc,KAAK,YAAY,KAAK;EAC1C,MAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,OAAO;EAC5C,IAAI,OAAO,WAAW,UAAU,MAAM,IAAI,oBAAoB,2BAA2B;EAKzF,IAAI,MADmB,KAAK,GAAG,UAAU,aAAA,GAAwC,IAClE,KAAK,aAAa;GAG/B,MAAM,KAAK,GAAG,WAAW,OAAO;GAChC,MAAM,IAAI,oBAAoB,qCAAqC;EACrE;EACA,IACE,OAAO,WAAW,iBAAiB,UACnC,CAAC,gBAAgB,OAAO,KAAK,MAAM,GAAG,OAAO,KAAK,gBAAgB,CAAC,GAEnE,MAAM,IAAI,oBAAoB,2BAA2B;EAE3D,MAAM,KAAK,GAAG,WAAW,OAAO;EAChC,MAAM,KAAK,GAAG,WAAW,WAAW;CACtC;AACF"}

package/dist/auth/error.cjs

@@ -0,0 +1,47 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+// src/auth/error.ts
+/** The built-in reasons, for a client's message table or a check that every reason is handled. */
+const AUTHENTICATION_REASONS = [
+	"INVALID_VERIFICATION_CODE",
+	"VERIFICATION_CODE_ATTEMPTS_EXCEEDED",
+	"NONCE_MISSING",
+	"NONCE_MISMATCH",
+	"INVALID_DESKTOP_CODE",
+	"ACCOUNT_DISABLED",
+	"ACCOUNT_LOCKED",
+	"EMAIL_ALREADY_USED",
+	"EMAIL_NOT_VERIFIED",
+	"SIGNUP_DISABLED"
+];
+/**
+* Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an
+* address another account holds, a banned user, a closed beta. `reason` is the code the client
+* branches on, `metadata` what it needs to act (the provider to sign in with instead); both
+* travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,
+* in the shape of the route it came through:
+*
+* - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;
+* - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose
+*   `ErrorInfo` holds `reason` and `metadata`.
+*
+* The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed
+* nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server
+* fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.
+*/
+var AuthenticationError = class AuthenticationError extends Error {
+	reason;
+	metadata;
+	constructor(reason, ...[options]) {
+		const { message, cause, metadata = {} } = options ?? {};
+		super(message ?? `Sign-in refused: ${reason}`, { cause });
+		this.name = "AuthenticationError";
+		this.reason = reason;
+		this.metadata = {};
+		for (const [key, value] of Object.entries(metadata)) if (typeof value === "string") this.metadata[key] = value;
+		Object.setPrototypeOf(this, AuthenticationError.prototype);
+	}
+};
+exports.AUTHENTICATION_REASONS = AUTHENTICATION_REASONS;
+exports.AuthenticationError = AuthenticationError;
+
+//# sourceMappingURL=error.cjs.map

package/dist/auth/error.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.cjs","names":["given"],"sources":["../../src/auth/error.ts"],"sourcesContent":["type Metadata = Record<string, string>;\n/** A reason that carries no metadata. */\ntype NoMetadata = { [key: string]: never };\n\n/**\n * The reasons `onAuthorized` may refuse a sign-in with, each with the metadata it carries (string\n * fields only: metadata travels as URL parameters and JSON). The built-in ones cover the account\n * states every host meets; add your own by augmenting the interface, and `AuthenticationError`\n * accepts exactly these reasons, requiring the metadata when one of its fields is required:\n *\n * ```ts\n * declare module '@shware/security' {\n *   interface AuthenticationReasons {\n *     CLOSED_BETA: { invite?: string };\n *   }\n * }\n * ```\n */\nexport interface AuthenticationReasons {\n  // Thrown by the SDK itself.\n  /** The emailed code is wrong, or none is pending for the address. */\n  INVALID_VERIFICATION_CODE: NoMetadata;\n  /** More than `verificationCode.maxAttempts` guesses at the code; it is discarded. */\n  VERIFICATION_CODE_ATTEMPTS_EXCEEDED: NoMetadata;\n  /** The id token carries no nonce and one is required (`oauth2.onetap.requireNonce`). */\n  NONCE_MISSING: NoMetadata;\n  /** The id token's nonce was not issued for this provider, or was used already. */\n  NONCE_MISMATCH: NoMetadata;\n  /** The desktop sign-in code is unknown, expired, used, or its verifier does not match. */\n  INVALID_DESKTOP_CODE: NoMetadata;\n\n  // For the host's `onAuthorized`.\n  /** The account is disabled: banned, or closed by its owner. */\n  ACCOUNT_DISABLED: NoMetadata;\n  /** The account is locked for now; `until` is when it opens again, when known. */\n  ACCOUNT_LOCKED: { until?: string };\n  /** The address belongs to another account; `provider` is the one to sign in with instead. */\n  EMAIL_ALREADY_USED: { provider?: string };\n  /** The host accepts only verified addresses and this provider did not verify it. */\n  EMAIL_NOT_VERIFIED: { provider?: string };\n  /** No new accounts: registration is closed or by invitation. */\n  SIGNUP_DISABLED: NoMetadata;\n}\n\n/** The built-in reasons, for a client's message table or a check that every reason is handled. */\nexport const AUTHENTICATION_REASONS = [\n  'INVALID_VERIFICATION_CODE',\n  'VERIFICATION_CODE_ATTEMPTS_EXCEEDED',\n  'NONCE_MISSING',\n  'NONCE_MISMATCH',\n  'INVALID_DESKTOP_CODE',\n  'ACCOUNT_DISABLED',\n  'ACCOUNT_LOCKED',\n  'EMAIL_ALREADY_USED',\n  'EMAIL_NOT_VERIFIED',\n  'SIGNUP_DISABLED',\n] as const satisfies readonly (keyof AuthenticationReasons)[];\n\n/**\n * Each reason's metadata as declared; a field that is not a string makes the reason unusable\n * (`never`).\n */\ntype Reasons = {\n  [K in keyof AuthenticationReasons]: AuthenticationReasons[K] extends Partial<Metadata>\n    ? AuthenticationReasons[K]\n    : never;\n};\n\n/** A reason `onAuthorized` may refuse with: the keys of `AuthenticationReasons`. */\nexport type AuthenticationReason = keyof Reasons;\n\n/** `true` when the reason's metadata has no required field, so it may be left out. */\ntype Optional<R extends AuthenticationReason> = Reasons[R] extends NoMetadata\n  ? true\n  : Partial<Reasons[R]> extends Reasons[R]\n    ? true\n    : false;\ntype Options<R extends AuthenticationReason> = {\n  message?: string;\n  cause?: unknown;\n} & (Optional<R> extends true ? { metadata?: Reasons[R] } : { metadata: Reasons[R] });\n\n/**\n * Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an\n * address another account holds, a banned user, a closed beta. `reason` is the code the client\n * branches on, `metadata` what it needs to act (the provider to sign in with instead); both\n * travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,\n * in the shape of the route it came through:\n *\n * - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;\n * - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose\n *   `ErrorInfo` holds `reason` and `metadata`.\n *\n * The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed\n * nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server\n * fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.\n */\nexport class AuthenticationError<\n  R extends AuthenticationReason = AuthenticationReason,\n> extends Error {\n  readonly reason: R;\n  readonly metadata: Metadata;\n\n  constructor(reason: R, ...[options]: Optional<R> extends true ? [Options<R>?] : [Options<R>]) {\n    const given = options;\n    const { message, cause, metadata = {} } = given ?? {};\n    super(message ?? `Sign-in refused: ${reason}`, { cause });\n    this.name = 'AuthenticationError';\n    this.reason = reason;\n    this.metadata = {};\n    for (const [key, value] of Object.entries(metadata)) {\n      if (typeof value === 'string') this.metadata[key] = value;\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;;AA6CA,MAAa,yBAAyB;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;AAyCA,IAAa,sBAAb,MAAa,4BAEH,MAAM;CACd;CACA;CAEA,YAAY,QAAW,GAAG,CAAC,UAAmE;EAE5F,MAAM,EAAE,SAAS,OAAO,WAAW,CAAC,MAAMA,WAAS,CAAC;EACpD,MAAM,WAAW,oBAAoB,UAAU,EAAE,MAAM,CAAC;EACxD,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,WAAW,CAAC;EACjB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAChD,IAAI,OAAO,UAAU,UAAU,KAAK,SAAS,OAAO;EAEtD,OAAO,eAAe,MAAM,oBAAoB,SAAS;CAC3D;AACF"}

package/dist/auth/error.d.cts

@@ -0,0 +1,88 @@
+type Metadata = Record<string, string>;
+/** A reason that carries no metadata. */
+type NoMetadata = {
+  [key: string]: never;
+};
+/**
+ * The reasons `onAuthorized` may refuse a sign-in with, each with the metadata it carries (string
+ * fields only: metadata travels as URL parameters and JSON). The built-in ones cover the account
+ * states every host meets; add your own by augmenting the interface, and `AuthenticationError`
+ * accepts exactly these reasons, requiring the metadata when one of its fields is required:
+ *
+ * ```ts
+ * declare module '@shware/security' {
+ *   interface AuthenticationReasons {
+ *     CLOSED_BETA: { invite?: string };
+ *   }
+ * }
+ * ```
+ */
+export interface AuthenticationReasons {
+  /** The emailed code is wrong, or none is pending for the address. */
+  INVALID_VERIFICATION_CODE: NoMetadata;
+  /** More than `verificationCode.maxAttempts` guesses at the code; it is discarded. */
+  VERIFICATION_CODE_ATTEMPTS_EXCEEDED: NoMetadata;
+  /** The id token carries no nonce and one is required (`oauth2.onetap.requireNonce`). */
+  NONCE_MISSING: NoMetadata;
+  /** The id token's nonce was not issued for this provider, or was used already. */
+  NONCE_MISMATCH: NoMetadata;
+  /** The desktop sign-in code is unknown, expired, used, or its verifier does not match. */
+  INVALID_DESKTOP_CODE: NoMetadata;
+  /** The account is disabled: banned, or closed by its owner. */
+  ACCOUNT_DISABLED: NoMetadata;
+  /** The account is locked for now; `until` is when it opens again, when known. */
+  ACCOUNT_LOCKED: {
+    until?: string;
+  };
+  /** The address belongs to another account; `provider` is the one to sign in with instead. */
+  EMAIL_ALREADY_USED: {
+    provider?: string;
+  };
+  /** The host accepts only verified addresses and this provider did not verify it. */
+  EMAIL_NOT_VERIFIED: {
+    provider?: string;
+  };
+  /** No new accounts: registration is closed or by invitation. */
+  SIGNUP_DISABLED: NoMetadata;
+}
+/** The built-in reasons, for a client's message table or a check that every reason is handled. */
+export declare const AUTHENTICATION_REASONS: readonly ["INVALID_VERIFICATION_CODE", "VERIFICATION_CODE_ATTEMPTS_EXCEEDED", "NONCE_MISSING", "NONCE_MISMATCH", "INVALID_DESKTOP_CODE", "ACCOUNT_DISABLED", "ACCOUNT_LOCKED", "EMAIL_ALREADY_USED", "EMAIL_NOT_VERIFIED", "SIGNUP_DISABLED"];
+/**
+ * Each reason's metadata as declared; a field that is not a string makes the reason unusable
+ * (`never`).
+ */
+type Reasons = { [K in keyof AuthenticationReasons]: AuthenticationReasons[K] extends Partial<Metadata> ? AuthenticationReasons[K] : never; };
+/** A reason `onAuthorized` may refuse with: the keys of `AuthenticationReasons`. */
+export type AuthenticationReason = keyof Reasons;
+/** `true` when the reason's metadata has no required field, so it may be left out. */
+type Optional<R extends AuthenticationReason> = Reasons[R] extends NoMetadata ? true : Partial<Reasons[R]> extends Reasons[R] ? true : false;
+type Options<R extends AuthenticationReason> = {
+  message?: string;
+  cause?: unknown;
+} & (Optional<R> extends true ? {
+  metadata?: Reasons[R];
+} : {
+  metadata: Reasons[R];
+});
+/**
+ * Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an
+ * address another account holds, a banned user, a closed beta. `reason` is the code the client
+ * branches on, `metadata` what it needs to act (the provider to sign in with instead); both
+ * travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,
+ * in the shape of the route it came through:
+ *
+ * - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;
+ * - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose
+ *   `ErrorInfo` holds `reason` and `metadata`.
+ *
+ * The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed
+ * nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server
+ * fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.
+ */
+export declare class AuthenticationError<R extends AuthenticationReason = AuthenticationReason> extends Error {
+  readonly reason: R;
+  readonly metadata: Metadata;
+  constructor(reason: R, ...[options]: Optional<R> extends true ? [Options<R>?] : [Options<R>]);
+}
+export {};
+//# sourceMappingURL=error.d.cts.map

package/dist/auth/error.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.cts","names":[],"sources":["../../src/auth/error.ts"],"mappings":"A,KAAK,WAAW;;KAEX;GAAgB;;;;;;;;;;;;;;;;iBAgBJ;;EAGf,2BAA2B;;EAE3B,qCAAqC;;EAErC,eAAe;;EAEf,gBAAgB;;EAEhB,sBAAsB;;EAItB,kBAAkB;;EAElB;IAAkB;;;EAElB;IAAsB;;;EAEtB;IAAsB;;;EAEtB,iBAAiB;;;qBAIN;;;;;KAiBR,aACF,WAAW,wBAAwB,sBAAsB,WAAW,QAAQ,YACzE,sBAAsB;;YAKhB,6BAA6B;;KAGpC,SAAS,UAAU,wBAAwB,QAAQ,WAAW,oBAE/D,QAAQ,QAAQ,YAAY,QAAQ;KAGnC,QAAQ,UAAU;EACrB;EACA;KACG,SAAS;EAAoB,WAAW,QAAQ;;EAAS,UAAU,QAAQ;;;;;;;;;;;;;;;;;qBAiBnE,oBACX,UAAU,uBAAuB,8BACzB;WACC,QAAQ;WACR,UAAU;EAEnB,YAAY,QAAQ,OAAO,UAAU,SAAS,mBAAmB,QAAQ,QAAQ,QAAQ"}

package/dist/auth/error.d.mts

@@ -0,0 +1,88 @@
+type Metadata = Record<string, string>;
+/** A reason that carries no metadata. */
+type NoMetadata = {
+  [key: string]: never;
+};
+/**
+ * The reasons `onAuthorized` may refuse a sign-in with, each with the metadata it carries (string
+ * fields only: metadata travels as URL parameters and JSON). The built-in ones cover the account
+ * states every host meets; add your own by augmenting the interface, and `AuthenticationError`
+ * accepts exactly these reasons, requiring the metadata when one of its fields is required:
+ *
+ * ```ts
+ * declare module '@shware/security' {
+ *   interface AuthenticationReasons {
+ *     CLOSED_BETA: { invite?: string };
+ *   }
+ * }
+ * ```
+ */
+export interface AuthenticationReasons {
+  /** The emailed code is wrong, or none is pending for the address. */
+  INVALID_VERIFICATION_CODE: NoMetadata;
+  /** More than `verificationCode.maxAttempts` guesses at the code; it is discarded. */
+  VERIFICATION_CODE_ATTEMPTS_EXCEEDED: NoMetadata;
+  /** The id token carries no nonce and one is required (`oauth2.onetap.requireNonce`). */
+  NONCE_MISSING: NoMetadata;
+  /** The id token's nonce was not issued for this provider, or was used already. */
+  NONCE_MISMATCH: NoMetadata;
+  /** The desktop sign-in code is unknown, expired, used, or its verifier does not match. */
+  INVALID_DESKTOP_CODE: NoMetadata;
+  /** The account is disabled: banned, or closed by its owner. */
+  ACCOUNT_DISABLED: NoMetadata;
+  /** The account is locked for now; `until` is when it opens again, when known. */
+  ACCOUNT_LOCKED: {
+    until?: string;
+  };
+  /** The address belongs to another account; `provider` is the one to sign in with instead. */
+  EMAIL_ALREADY_USED: {
+    provider?: string;
+  };
+  /** The host accepts only verified addresses and this provider did not verify it. */
+  EMAIL_NOT_VERIFIED: {
+    provider?: string;
+  };
+  /** No new accounts: registration is closed or by invitation. */
+  SIGNUP_DISABLED: NoMetadata;
+}
+/** The built-in reasons, for a client's message table or a check that every reason is handled. */
+export declare const AUTHENTICATION_REASONS: readonly ["INVALID_VERIFICATION_CODE", "VERIFICATION_CODE_ATTEMPTS_EXCEEDED", "NONCE_MISSING", "NONCE_MISMATCH", "INVALID_DESKTOP_CODE", "ACCOUNT_DISABLED", "ACCOUNT_LOCKED", "EMAIL_ALREADY_USED", "EMAIL_NOT_VERIFIED", "SIGNUP_DISABLED"];
+/**
+ * Each reason's metadata as declared; a field that is not a string makes the reason unusable
+ * (`never`).
+ */
+type Reasons = { [K in keyof AuthenticationReasons]: AuthenticationReasons[K] extends Partial<Metadata> ? AuthenticationReasons[K] : never; };
+/** A reason `onAuthorized` may refuse with: the keys of `AuthenticationReasons`. */
+export type AuthenticationReason = keyof Reasons;
+/** `true` when the reason's metadata has no required field, so it may be left out. */
+type Optional<R extends AuthenticationReason> = Reasons[R] extends NoMetadata ? true : Partial<Reasons[R]> extends Reasons[R] ? true : false;
+type Options<R extends AuthenticationReason> = {
+  message?: string;
+  cause?: unknown;
+} & (Optional<R> extends true ? {
+  metadata?: Reasons[R];
+} : {
+  metadata: Reasons[R];
+});
+/**
+ * Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an
+ * address another account holds, a banned user, a closed beta. `reason` is the code the client
+ * branches on, `metadata` what it needs to act (the provider to sign in with instead); both
+ * travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,
+ * in the shape of the route it came through:
+ *
+ * - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;
+ * - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose
+ *   `ErrorInfo` holds `reason` and `metadata`.
+ *
+ * The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed
+ * nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server
+ * fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.
+ */
+export declare class AuthenticationError<R extends AuthenticationReason = AuthenticationReason> extends Error {
+  readonly reason: R;
+  readonly metadata: Metadata;
+  constructor(reason: R, ...[options]: Optional<R> extends true ? [Options<R>?] : [Options<R>]);
+}
+export {};
+//# sourceMappingURL=error.d.mts.map

package/dist/auth/error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.mts","names":[],"sources":["../../src/auth/error.ts"],"mappings":"A,KAAK,WAAW;;KAEX;GAAgB;;;;;;;;;;;;;;;;iBAgBJ;;EAGf,2BAA2B;;EAE3B,qCAAqC;;EAErC,eAAe;;EAEf,gBAAgB;;EAEhB,sBAAsB;;EAItB,kBAAkB;;EAElB;IAAkB;;;EAElB;IAAsB;;;EAEtB;IAAsB;;;EAEtB,iBAAiB;;;qBAIN;;;;;KAiBR,aACF,WAAW,wBAAwB,sBAAsB,WAAW,QAAQ,YACzE,sBAAsB;;YAKhB,6BAA6B;;KAGpC,SAAS,UAAU,wBAAwB,QAAQ,WAAW,oBAE/D,QAAQ,QAAQ,YAAY,QAAQ;KAGnC,QAAQ,UAAU;EACrB;EACA;KACG,SAAS;EAAoB,WAAW,QAAQ;;EAAS,UAAU,QAAQ;;;;;;;;;;;;;;;;;qBAiBnE,oBACX,UAAU,uBAAuB,8BACzB;WACC,QAAQ;WACR,UAAU;EAEnB,YAAY,QAAQ,OAAO,UAAU,SAAS,mBAAmB,QAAQ,QAAQ,QAAQ"}

package/dist/auth/error.mjs

@@ -0,0 +1,45 @@
+// src/auth/error.ts
+/** The built-in reasons, for a client's message table or a check that every reason is handled. */
+const AUTHENTICATION_REASONS = [
+	"INVALID_VERIFICATION_CODE",
+	"VERIFICATION_CODE_ATTEMPTS_EXCEEDED",
+	"NONCE_MISSING",
+	"NONCE_MISMATCH",
+	"INVALID_DESKTOP_CODE",
+	"ACCOUNT_DISABLED",
+	"ACCOUNT_LOCKED",
+	"EMAIL_ALREADY_USED",
+	"EMAIL_NOT_VERIFIED",
+	"SIGNUP_DISABLED"
+];
+/**
+* Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an
+* address another account holds, a banned user, a closed beta. `reason` is the code the client
+* branches on, `metadata` what it needs to act (the provider to sign in with instead); both
+* travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,
+* in the shape of the route it came through:
+*
+* - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;
+* - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose
+*   `ErrorInfo` holds `reason` and `metadata`.
+*
+* The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed
+* nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server
+* fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.
+*/
+var AuthenticationError = class AuthenticationError extends Error {
+	reason;
+	metadata;
+	constructor(reason, ...[options]) {
+		const { message, cause, metadata = {} } = options ?? {};
+		super(message ?? `Sign-in refused: ${reason}`, { cause });
+		this.name = "AuthenticationError";
+		this.reason = reason;
+		this.metadata = {};
+		for (const [key, value] of Object.entries(metadata)) if (typeof value === "string") this.metadata[key] = value;
+		Object.setPrototypeOf(this, AuthenticationError.prototype);
+	}
+};
+export { AUTHENTICATION_REASONS, AuthenticationError };
+
+//# sourceMappingURL=error.mjs.map

package/dist/auth/error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.mjs","names":["given"],"sources":["../../src/auth/error.ts"],"sourcesContent":["type Metadata = Record<string, string>;\n/** A reason that carries no metadata. */\ntype NoMetadata = { [key: string]: never };\n\n/**\n * The reasons `onAuthorized` may refuse a sign-in with, each with the metadata it carries (string\n * fields only: metadata travels as URL parameters and JSON). The built-in ones cover the account\n * states every host meets; add your own by augmenting the interface, and `AuthenticationError`\n * accepts exactly these reasons, requiring the metadata when one of its fields is required:\n *\n * ```ts\n * declare module '@shware/security' {\n *   interface AuthenticationReasons {\n *     CLOSED_BETA: { invite?: string };\n *   }\n * }\n * ```\n */\nexport interface AuthenticationReasons {\n  // Thrown by the SDK itself.\n  /** The emailed code is wrong, or none is pending for the address. */\n  INVALID_VERIFICATION_CODE: NoMetadata;\n  /** More than `verificationCode.maxAttempts` guesses at the code; it is discarded. */\n  VERIFICATION_CODE_ATTEMPTS_EXCEEDED: NoMetadata;\n  /** The id token carries no nonce and one is required (`oauth2.onetap.requireNonce`). */\n  NONCE_MISSING: NoMetadata;\n  /** The id token's nonce was not issued for this provider, or was used already. */\n  NONCE_MISMATCH: NoMetadata;\n  /** The desktop sign-in code is unknown, expired, used, or its verifier does not match. */\n  INVALID_DESKTOP_CODE: NoMetadata;\n\n  // For the host's `onAuthorized`.\n  /** The account is disabled: banned, or closed by its owner. */\n  ACCOUNT_DISABLED: NoMetadata;\n  /** The account is locked for now; `until` is when it opens again, when known. */\n  ACCOUNT_LOCKED: { until?: string };\n  /** The address belongs to another account; `provider` is the one to sign in with instead. */\n  EMAIL_ALREADY_USED: { provider?: string };\n  /** The host accepts only verified addresses and this provider did not verify it. */\n  EMAIL_NOT_VERIFIED: { provider?: string };\n  /** No new accounts: registration is closed or by invitation. */\n  SIGNUP_DISABLED: NoMetadata;\n}\n\n/** The built-in reasons, for a client's message table or a check that every reason is handled. */\nexport const AUTHENTICATION_REASONS = [\n  'INVALID_VERIFICATION_CODE',\n  'VERIFICATION_CODE_ATTEMPTS_EXCEEDED',\n  'NONCE_MISSING',\n  'NONCE_MISMATCH',\n  'INVALID_DESKTOP_CODE',\n  'ACCOUNT_DISABLED',\n  'ACCOUNT_LOCKED',\n  'EMAIL_ALREADY_USED',\n  'EMAIL_NOT_VERIFIED',\n  'SIGNUP_DISABLED',\n] as const satisfies readonly (keyof AuthenticationReasons)[];\n\n/**\n * Each reason's metadata as declared; a field that is not a string makes the reason unusable\n * (`never`).\n */\ntype Reasons = {\n  [K in keyof AuthenticationReasons]: AuthenticationReasons[K] extends Partial<Metadata>\n    ? AuthenticationReasons[K]\n    : never;\n};\n\n/** A reason `onAuthorized` may refuse with: the keys of `AuthenticationReasons`. */\nexport type AuthenticationReason = keyof Reasons;\n\n/** `true` when the reason's metadata has no required field, so it may be left out. */\ntype Optional<R extends AuthenticationReason> = Reasons[R] extends NoMetadata\n  ? true\n  : Partial<Reasons[R]> extends Reasons[R]\n    ? true\n    : false;\ntype Options<R extends AuthenticationReason> = {\n  message?: string;\n  cause?: unknown;\n} & (Optional<R> extends true ? { metadata?: Reasons[R] } : { metadata: Reasons[R] });\n\n/**\n * Thrown by the host's `onAuthorized` to refuse a sign-in it could complete but will not: an\n * address another account holds, a banned user, a closed beta. `reason` is the code the client\n * branches on, `metadata` what it needs to act (the provider to sign in with instead); both\n * travel as they are, so keep them short and free of secrets. `Auth` answers a refusal itself,\n * in the shape of the route it came through:\n *\n * - redirect flow (`loginOAuth2Code`): `errorUri?error=access_denied&reason=<reason>&<metadata>`;\n * - JSON routes (native, One Tap, email, desktop): `403` with a google.rpc error body whose\n *   `ErrorInfo` holds `reason` and `metadata`.\n *\n * The SDK throws it too, for a credential it checked itself (a wrong emailed code, a replayed\n * nonce), so a client handles both the same way. Anything else `onAuthorized` throws is a server\n * fault: `server_error` on the redirect, rethrown to the host's error handler on the JSON routes.\n */\nexport class AuthenticationError<\n  R extends AuthenticationReason = AuthenticationReason,\n> extends Error {\n  readonly reason: R;\n  readonly metadata: Metadata;\n\n  constructor(reason: R, ...[options]: Optional<R> extends true ? [Options<R>?] : [Options<R>]) {\n    const given = options;\n    const { message, cause, metadata = {} } = given ?? {};\n    super(message ?? `Sign-in refused: ${reason}`, { cause });\n    this.name = 'AuthenticationError';\n    this.reason = reason;\n    this.metadata = {};\n    for (const [key, value] of Object.entries(metadata)) {\n      if (typeof value === 'string') this.metadata[key] = value;\n    }\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;AA6CA,MAAa,yBAAyB;CACpC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;;;;;;;;;;;;AAyCA,IAAa,sBAAb,MAAa,4BAEH,MAAM;CACd;CACA;CAEA,YAAY,QAAW,GAAG,CAAC,UAAmE;EAE5F,MAAM,EAAE,SAAS,OAAO,WAAW,CAAC,MAAMA,WAAS,CAAC;EACpD,MAAM,WAAW,oBAAoB,UAAU,EAAE,MAAM,CAAC;EACxD,KAAK,OAAO;EACZ,KAAK,SAAS;EACd,KAAK,WAAW,CAAC;EACjB,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAChD,IAAI,OAAO,UAAU,UAAU,KAAK,SAAS,OAAO;EAEtD,OAAO,eAAe,MAAM,oBAAoB,SAAS;CAC3D;AACF"}