@spfn/auth 0.3.0-beta.5 → 0.3.0-beta.7

package/README.md

@@ -154,6 +154,8 @@ real secret values out of band, never commit them.
 | `SPFN_AUTH_OAUTH_SUCCESS_URL` | `.env.server` | — | default `/auth/callback` |
 | `SPFN_AUTH_OAUTH_ERROR_URL` | `.env.server` | — | default `/auth/error?error={error}` |
 | `SPFN_AUTH_RESERVED_USERNAMES` / `_USERNAME_MIN_LENGTH` / `_USERNAME_MAX_LENGTH` | `.env.server` | — | username rules |
+| `SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES` / `_SETUP_TTL_MINUTES` | `.env.server` | — | defaults `30` / `15` — see [Verified-email signup](#verified-email-signup) |
+| `SPFN_AUTH_SIGNUP_CONFIRM_PATH` | `.env.server` | — | default `/signup/confirm`; the page in your app the emailed link opens |
 | `NEXT_PUBLIC_SPFN_API_URL` / `NEXT_PUBLIC_SPFN_APP_URL` | `.env.local` | — | browser-facing URLs for OAuth redirects |
 
 Read validated values via `import { env } from '@spfn/auth/config'` (a proxy validated at
@@ -178,6 +180,9 @@ routes use `.skip(['auth'])`; the rest require `Authorization: Bearer <client-si
 | `sendVerificationCode` | POST `/_auth/codes` | public | send 6-digit OTP |
 | `verifyCode` | POST `/_auth/codes/verify` | public | verify OTP → verification token |
 | `register` | POST `/_auth/register` | public | create user + register public key |
+| `requestSignupLink` | POST `/_auth/signup/email` | public | email a one-time signup confirmation link — see [Verified-email signup](#verified-email-signup) |
+| `confirmSignupLink` | POST `/_auth/signup/email/confirm` | public | exchange the link for a password-setup session |
+| `completeSignup` | POST `/_auth/signup/password` | setup session | set the password, which creates the account and signs in |
 | `login` | POST `/_auth/login` | public | password login + new session key |
 | `logout` | POST `/_auth/logout` | yes | revoke current key |
 | `rotateKey` | POST `/_auth/keys/rotate` | yes | rotate public key before 90-day expiry |
@@ -205,6 +210,83 @@ sends the public key on register/login, signs request JWTs locally, and the serv
 with the stored public key (`keyId` carried in the JWT). The server never holds a private key.
 Keys expire after 90 days — rotate with `rotateKey`.
 
+### Verified-email signup
+
+A second way in, alongside the six-digit code. The address is proven before a password
+exists, so nothing is stored for someone who never confirms.
+
+```
+request  → a one-time link is emailed
+confirm  → the link becomes a short-lived, HttpOnly password-setup session
+password → the account is created, the device registered, the user signed in
+```
+
+The six-digit-code path (`sendVerificationCode` → `verifyCode` → `register`) is unchanged.
+Offer whichever suits your product, or both.
+
+**1 — request the link.** The response is identical whether or not the address already has
+an account, so it cannot be used to probe for accounts. When one exists, the owner gets a
+"you already have an account" notice instead of a usable link.
+
+```typescript
+await authApi.requestSignupLink.call({
+    body: { email: 'user@example.com', returnPath: '/welcome' },   // returnPath optional
+});
+// → { success: true, expiresAt }
+```
+
+Calling it again is how a resend works: it invalidates the previous link and any setup
+session opened from it. `returnPath` must be a path inside your app — absolute URLs,
+`//host`, and `..` are refused, so the link cannot become an open redirect.
+
+**2 — the page the link opens.** The email points at a page in *your* app
+(`SPFN_AUTH_SIGNUP_CONFIRM_PATH`, default `/signup/confirm`), not at an API route. That page
+reads the token from the query string and posts it:
+
+```typescript
+'use client';
+
+const token = useSearchParams().get('token');
+
+const { email, returnPath } = await authApi.confirmSignupLink.call({ body: { token } });
+
+// Drop the token from the URL so it does not linger in history or a Referer header.
+window.history.replaceState({}, '', window.location.pathname);
+```
+
+The setup session comes back as an HttpOnly cookie — the proxy interceptor moves it there
+and strips it from the response body, so page script never holds it. Serve this page with
+`Referrer-Policy: no-referrer`.
+
+**3 — set the password.** This is the step that creates the account. The setup cookie
+authorizes it; the device keypair is injected by the interceptor exactly as it is for
+`register`.
+
+```typescript
+await authApi.completeSignup.call({ body: { password } });
+// → { userId, publicId, email }  + session cookie, same as register
+```
+
+Creating the user, registering the device key, and marking the setup session used all commit
+together. A password that fails the strength policy leaves the session usable, so the user
+retypes rather than requesting a fresh email.
+
+**Settings.**
+
+| Variable | Default | Meaning |
+|----------|---------|---------|
+| `SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES` | `30` | how long the emailed link works |
+| `SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES` | `15` | how long the password-setup session works |
+| `SPFN_AUTH_SIGNUP_CONFIRM_PATH` | `/signup/confirm` | the page in your app the link opens |
+
+The link URL is built on `NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL`, the same resolution the
+OAuth callbacks use. Delivery uses the `signup-link` template in `@spfn/notification` —
+override it there to change the copy.
+
+**What is stored.** Only SHA-256 hashes of the link token and the setup secret, in
+`spfn_auth.signup_link_tokens`. Neither credential is recoverable from the database, and
+both are one-time: a link opens one setup session, and a setup session sets one password.
+
 ### Registered devices (key management)
 
 Keys are per-device, so a login never revokes the previous key and they accumulate on purpose.
@@ -1096,6 +1178,70 @@ app.post('/v1/echo', createClientProofGuard(state), (c) => { /* handler */ });
 Responses and errors MUST be canonical bytes with the contract envelope — build them with
 `encodeCanonicalJson`/`ClientProofRefusal`, never `c.json()` (key order and int64 differ).
 
+## Custom auth profiles (`registerAuthProfile`)
+
+`clientProofV1` is not a special case in the middleware — it is one entry in a registry
+`authenticate` and `optionalAuth` dispatch on. An app registers its own scheme the same way,
+without forking the middleware or wrapping it:
+
+```typescript
+import { registerAuthProfile, type AuthContext } from '@spfn/auth/server';
+import { UnauthorizedError } from '@spfn/core/errors';
+
+// At boot — server.config.ts, before the server starts taking requests.
+registerAuthProfile('serviceTokenV1', {
+    verify: async (c): Promise<AuthContext> =>
+    {
+        const user = await findServiceAccount(c.req.header('x-acme-service-token'));
+        if (user === null)
+        {
+            // A refusal leaves the verifier as a throw. It reaches the app's
+            // error handler exactly as the Bearer path's does.
+            throw new UnauthorizedError({ message: 'Invalid service token' });
+        }
+
+        return {
+            user,
+            userId: String(user.id),
+            keyId: 'service-token',
+            role: null,
+            locale: 'en',
+            scheme: 'serviceTokenV1',
+        };
+    },
+});
+```
+
+A request naming the profile is then answered by that verifier:
+
+```http
+POST /v1/reports
+x-spfn-auth-profile: serviceTokenV1
+x-acme-service-token: <the app's own credential>
+```
+
+- **Register at boot, before the first request.** The registry is read on every dispatch, so a
+  profile registered later is simply a profile the requests before it did not have. Registration
+  is not frozen after startup — it is a contract, not a runtime check.
+- **A duplicate name throws**, `clientProofV1` included. Replacing a registered verifier silently
+  is how an import order or a copied profile name swaps the code that decides who is admitted, so
+  there is no override — and no unregistration API for the same reason.
+- **The verifier must expose a callable `verify`**, and what it resolves must carry a `userId` — a
+  verifier that cannot admit anyone is refused at boot, and a resolve without a principal (`null`,
+  the JS idiom for "no user") is refused as a throw rather than routed as authenticated.
+- **An unknown profile is still refused** (`PROFILE_REJECTED`, 400): registering one name does not
+  open the header to others.
+- **Mixing is still refused.** A request carrying both `x-spfn-auth-profile` and `Authorization` is
+  rejected before either path runs; a custom verifier never sees it.
+- **A verifier's throw propagates**, and only the internal clientProofV1 contract refusal is
+  answered with the canonical envelope. Under `optionalAuth` too: credentials that were presented
+  and refused are never downgraded to anonymous passage — only "presented nothing" continues
+  without an auth context.
+- **`AuthContext.scheme` is an open union** — `'bearer' | 'clientProofV1' | 'oneTimeToken' | (string
+  & {})`. The built-in names keep their autocomplete and a registered profile names its own scheme.
+  The field stays informational: downstream permission and tenant code takes one principal shape and
+  never branches on how it was produced.
+
 ## Account Deletion & Recovery
 
 Grace-period deletion with in-window recovery, an admin/GDPR-response entry point for immediate

package/dist/{authenticate-Ctul07Sc.d.ts → authenticate-Mg9D7Nys.d.ts}

@@ -214,6 +214,93 @@ declare function verifyCodeService(params: VerifyCodeParams): Promise<{
     verificationToken: string;
 }>;
 
+/**
+ * @spfn/auth - Verified-Email Signup Service
+ *
+ * A signup where the address is proven before a password exists:
+ *
+ *   request  -> a one-time link is emailed
+ *   confirm  -> the link is exchanged for a short-lived password-setup session
+ *   password -> the account is created, the device registered, the user signed in
+ *
+ * The link token and the setup secret are bearer credentials, so neither is ever
+ * stored. Only their SHA-256 hashes are, and lookup is by hash. A database dump
+ * therefore yields nothing that can be presented to either step.
+ *
+ * The six-digit-code registration path is untouched and remains the default; this
+ * is a second entry point to the same account creation, not a replacement.
+ */
+
+/**
+ * Whether a return path can be handed back to the browser.
+ *
+ * Only a path within the app is allowed. The rejected shapes are the ones that
+ * turn a return path into an open redirect: an absolute URL, a protocol-relative
+ * `//host` that a browser reads as another origin, a backslash that some
+ * browsers normalize into a slash, and any `..` traversal.
+ */
+declare function isSafeReturnPath(returnPath: string): boolean;
+interface RequestSignupLinkParams {
+    email: string;
+    returnPath?: string;
+}
+interface RequestSignupLinkResult {
+    success: boolean;
+    expiresAt: string;
+}
+/**
+ * Step 1 — issue a confirmation link for an address.
+ *
+ * Answers identically whether or not the address already has an account. When it
+ * does, the owner gets a notice instead of a usable link, through the same
+ * dedupe window the six-digit-code path uses.
+ *
+ * Requesting again is how a resend works: every live link for the address is
+ * superseded first, so the newest link is the only one that opens, and any setup
+ * session already opened from an older link dies with it.
+ */
+declare function requestSignupLinkService(params: RequestSignupLinkParams): Promise<RequestSignupLinkResult>;
+interface ConfirmSignupLinkParams {
+    token: string;
+}
+interface ConfirmSignupLinkResult {
+    email: string;
+    returnPath: string | null;
+    /** Handed to the proxy interceptor, which moves it into an HttpOnly cookie. */
+    setupSecret: string;
+    setupExpiresAt: string;
+}
+/**
+ * Step 2 — exchange a link for a password-setup session.
+ *
+ * Nothing binds the row to a device or a browser, which is what lets someone
+ * request the link on a laptop and open it on a phone.
+ */
+declare function confirmSignupLinkService(params: ConfirmSignupLinkParams): Promise<ConfirmSignupLinkResult>;
+interface CompleteSignupParams {
+    setupSecret?: string;
+    password: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm?: KeyAlgorithmType;
+    deviceName?: string;
+    platform?: KeyPlatformType;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Step 3 — set the password, which is what creates the account.
+ *
+ * Run under `Transactional()`: the user row, the device key and the completion
+ * mark commit together. A device-key failure must not leave an account nobody
+ * can sign into, and a completion mark must not survive a rolled-back account.
+ *
+ * A refusal that is the user's to fix — a weak password, an app policy that
+ * rejects the registration — leaves the setup session usable, so the fix is
+ * retyping the password rather than requesting a fresh email.
+ */
+declare function completeSignupService(params: CompleteSignupParams): Promise<RegisterResult>;
+
 /**
  * @spfn/auth - Key Service
  *
@@ -814,6 +901,33 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
     }, RegisterResult>;
+    requestSignupLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            email: _sinclair_typebox.TString;
+            returnPath: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, RequestSignupLinkResult>;
+    confirmSignupLink: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            token: _sinclair_typebox.TString;
+        }>;
+    }, {}, ConfirmSignupLinkResult>;
+    completeSignup: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            password: _sinclair_typebox.TString;
+            metadata: _sinclair_typebox.TOptional<_sinclair_typebox.TRecord<_sinclair_typebox.TString, _sinclair_typebox.TUnknown>>;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            setupSecret: _sinclair_typebox.TString;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+            deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
+        }>;
+    }, RegisterResult>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -879,7 +993,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             id: number;
             name: string;
             displayName: string;
-            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
+            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
         }[];
         userId: number;
         publicId: string;
@@ -1179,8 +1293,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1201,8 +1315,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1225,8 +1339,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            name: string;
             id: number;
+            name: string;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1310,6 +1424,11 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
  * downstream permission/tenant code consumes one principal shape and never
  * branches on how it was authenticated.
  *
+ * An app adds its own scheme with `registerAuthProfile` at boot. The dispatch
+ * it joins is the one below, unchanged: a name nobody registered is still
+ * refused, and profile credentials mixed with an Authorization header are
+ * still refused before either path runs.
+ *
  * The clientProofV1 verifier reuses the phase-1 admission pieces (header
  * shape, canonical body, proof-input assembly, ECDSA verification) with two
  * production substitutions: the key directory is `user_public_keys` via
@@ -1330,8 +1449,13 @@ interface AuthContext {
     keyId: string;
     role: string | null;
     locale: string;
-    /** How the principal was authenticated. Informational — downstream code never branches on it. */
-    scheme: 'bearer' | 'clientProofV1' | 'oneTimeToken';
+    /**
+     * How the principal was authenticated. Informational — downstream code
+     * never branches on it. The union stays open for the profiles an app
+     * registers itself: the built-in names keep their autocomplete, and a
+     * registered profile names its own scheme without editing this file.
+     */
+    scheme: 'bearer' | 'clientProofV1' | 'oneTimeToken' | (string & {});
 }
 /** A profile's verifier: admits the request and returns the principal, or throws. */
 interface AuthProfileVerifier {
@@ -1378,6 +1502,49 @@ type AuthProfileOutcome = {
  * handed to the generic error handler is classified by its class name instead.
  */
 declare function runAuthProfile(c: Context): Promise<AuthProfileOutcome>;
+/**
+ * Registers an app's own verifier under a profile name.
+ *
+ * Call it at boot, before the first request: the registry is a module-global
+ * read on every dispatch, so a profile registered later is simply a profile
+ * the requests before it did not have. There is no freeze and no
+ * unregistration — an auth surface that can be rearranged at runtime is a
+ * surface an app bug can rearrange.
+ *
+ * A duplicate name throws rather than replacing the verifier that holds it,
+ * `clientProofV1` included. A silent override is how a second import order, or
+ * a copied profile name, quietly swaps the code that decides who is admitted.
+ *
+ * The verifier must expose a callable `verify` — a value that cannot admit
+ * anyone is refused at boot rather than becoming a registry entry the dispatch
+ * reads as "no profile header", which is anonymous passage under
+ * `optionalAuth` for a request that presented profile credentials.
+ *
+ * The verifier returns the same `AuthContext` the Bearer path sets and refuses
+ * by throwing. A resolve that carries no `userId` is refused as a throw too —
+ * "no user" is a refusal, never a principal. A throw is not caught here:
+ * `runAuthProfile` answers the internal clientProofV1 contract refusal and
+ * nothing else, so a verifier's own error reaches the app's generic error
+ * handler exactly as the Bearer path's `UnauthorizedError` does — and never
+ * becomes anonymous passage, not even under `optionalAuth`.
+ *
+ * @example
+ * ```typescript
+ * registerAuthProfile('serviceTokenV1', {
+ *     verify: async (c) =>
+ *     {
+ *         const user = await authenticateServiceToken(c.req.header('x-acme-service-token'));
+ *         if (user === null)
+ *         {
+ *             throw new UnauthorizedError({ message: 'Invalid service token' });
+ *         }
+ *
+ *         return { user, userId: String(user.id), keyId: 'service', role: null, locale: 'en', scheme: 'serviceTokenV1' };
+ *     },
+ * });
+ * ```
+ */
+declare function registerAuthProfile(profileId: string, verifier: AuthProfileVerifier): void;
 
 declare module 'hono' {
     interface ContextVariableMap {
@@ -1444,4 +1611,4 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { type UnlinkNotifyResult as $, type AuthInitOptions as A, PasswordSchema as B, type ChangePasswordParams as C, DeviceNameSchema as D, EmailSchema as E, PhoneSchema as F, PlatformSchema as G, type RegisterParams as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RevokeAllKeysParams as M, type NativeVerifyOptions as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeKeyParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type RotateKeyParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type SendVerificationCodeParams as W, TargetTypeSchema as X, type UnlinkNotification as Y, UnlinkNotifyRejection as Z, type UnlinkNotifyRequest as _, type RegisterResult as a, VerificationPurposeSchema as a0, type VerifyCodeParams as a1, type VerifyCodeResult as a2, authenticate as a3, buildOAuthErrorUrl as a4, changePasswordService as a5, getEnabledOAuthProviders as a6, getGoogleAccessToken as a7, getOAuthProvider as a8, getRegisteredProviders as a9, isOAuthProviderEnabled as aa, issueOneTimeTokenService as ab, listKeysService as ac, loginService as ad, logoutService as ae, oauthCallbackService as af, oauthNativeService as ag, oauthStartService as ah, oauthUnlinkNotifyService as ai, optionalAuth as aj, registerOAuthProvider as ak, registerPublicKeyService as al, registerService as am, requireEnabledProvider as an, resolveAuthenticatedUser as ao, revokeAllKeysService as ap, revokeKeyService as aq, rotateKeyService as ar, runAuthProfile as as, selectAuthProfile as at, sendVerificationCodeService as au, verifyCodeService as av, verifyOneTimeTokenService as aw, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type AuthSession as f, PERMISSION_CATEGORIES as g, type PermissionCategory as h, VERIFICATION_TARGET_TYPES as i, type VerificationPurpose as j, type VerificationTargetType as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, type AuthProfileOutcome as o, type AuthProfileVerifier as p, KEY_FINGERPRINT_PREFIX_LENGTH as q, type LoginParams as r, type LogoutParams as s, type NormalizedIdentity as t, type OAuthCallbackParams as u, type OAuthCallbackResult as v, type OAuthCodeExchangeOptions as w, type OAuthNativeParams as x, type OAuthStartParams as y, type OAuthTokens as z };
+export { type SendVerificationCodeParams as $, type AuthInitOptions as A, type OAuthCodeExchangeOptions as B, type ConfirmSignupLinkResult as C, DeviceNameSchema as D, EmailSchema as E, type OAuthNativeParams as F, type OAuthStartParams as G, type OAuthTokens as H, type IssueOneTimeTokenResult as I, PasswordSchema as J, type KeySummary as K, type LoginResult as L, PhoneSchema as M, type NativeVerifyOptions as N, type OAuthStartResult as O, type PermissionConfig as P, PlatformSchema as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type RegisterParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type RegisterPublicKeyParams as W, type RequestSignupLinkParams as X, type RevokeAllKeysParams as Y, type RevokeKeyParams as Z, type RotateKeyParams as _, type RegisterResult as a, TargetTypeSchema as a0, type UnlinkNotification as a1, UnlinkNotifyRejection as a2, type UnlinkNotifyRequest as a3, type UnlinkNotifyResult as a4, VerificationPurposeSchema as a5, type VerifyCodeParams as a6, type VerifyCodeResult as a7, authenticate as a8, buildOAuthErrorUrl as a9, revokeKeyService as aA, rotateKeyService as aB, runAuthProfile as aC, selectAuthProfile as aD, sendVerificationCodeService as aE, verifyCodeService as aF, verifyOneTimeTokenService as aG, changePasswordService as aa, completeSignupService as ab, confirmSignupLinkService as ac, getEnabledOAuthProviders as ad, getGoogleAccessToken as ae, getOAuthProvider as af, getRegisteredProviders as ag, isOAuthProviderEnabled as ah, isSafeReturnPath as ai, issueOneTimeTokenService as aj, listKeysService as ak, loginService as al, logoutService as am, oauthCallbackService as an, oauthNativeService as ao, oauthStartService as ap, oauthUnlinkNotifyService as aq, optionalAuth as ar, registerAuthProfile as as, registerOAuthProvider as at, registerPublicKeyService as au, registerService as av, requestSignupLinkService as aw, requireEnabledProvider as ax, resolveAuthenticatedUser as ay, revokeAllKeysService as az, type RequestSignupLinkResult as b, type RotateKeyResult as c, type RevokeAllKeysResult as d, type OAuthNativeResult as e, type ProfileInfo as f, type AuthSession as g, PERMISSION_CATEGORIES as h, type PermissionCategory as i, VERIFICATION_TARGET_TYPES as j, type VerificationPurpose as k, type VerificationTargetType as l, mainAuthRouter as m, type OAuthProvider as n, type AuthContext as o, type AuthProfileOutcome as p, type AuthProfileVerifier as q, type ChangePasswordParams as r, type CompleteSignupParams as s, type ConfirmSignupLinkParams as t, KEY_FINGERPRINT_PREFIX_LENGTH as u, type LoginParams as v, type LogoutParams as w, type NormalizedIdentity as x, type OAuthCallbackParams as y, type OAuthCallbackResult as z };

package/dist/config.d.ts

@@ -195,6 +195,36 @@ declare const authEnvSchema: {
     } & {
         key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
     };
+    SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_CONFIRM_PATH";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;
@@ -609,6 +639,36 @@ declare const env: _spfn_core_env.InferEnvType<{
     } & {
         key: "SPFN_AUTH_USERNAME_MAX_LENGTH";
     };
+    SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+        description: string;
+        default: number;
+        required: boolean;
+        examples: number[];
+        type: "number";
+        validator: (value: string) => number;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES";
+    };
+    SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+        description: string;
+        default: string;
+        required: boolean;
+        examples: string[];
+        type: "string";
+        validator: (value: string) => string;
+    } & {
+        key: "SPFN_AUTH_SIGNUP_CONFIRM_PATH";
+    };
     SPFN_API_URL: {
         description: string;
         default: string;

package/dist/config.js

@@ -201,6 +201,33 @@ var authEnvSchema = defineEnvSchema({
     })
   },
   // ============================================================================
+  // Verified-email signup
+  // ============================================================================
+  SPFN_AUTH_SIGNUP_LINK_TTL_MINUTES: {
+    ...envNumber({
+      description: "How long an emailed signup confirmation link stays valid. Long enough to survive a mail delay, short enough that a link left in an inbox stops working.",
+      default: 30,
+      required: false,
+      examples: [15, 30, 60]
+    })
+  },
+  SPFN_AUTH_SIGNUP_SETUP_TTL_MINUTES: {
+    ...envNumber({
+      description: "How long the password-setup session opened by a confirmation link stays valid. Covers one sitting at the password form, not an abandoned tab.",
+      default: 15,
+      required: false,
+      examples: [10, 15, 30]
+    })
+  },
+  SPFN_AUTH_SIGNUP_CONFIRM_PATH: {
+    ...envString({
+      description: "App page the emailed confirmation link opens, as a path on {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}. The page reads the token from the query string and posts it to /_auth/signup/email/confirm; it is a page in your app, not an API route.",
+      default: "/signup/confirm",
+      required: false,
+      examples: ["/signup/confirm", "/auth/confirm", "/join/verify"]
+    })
+  },
+  // ============================================================================
   // API Configuration
   // ============================================================================
   SPFN_API_URL: {