@venturekit/auth 0.0.1 → 0.0.2

package/dist/server/handoff.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Cross-domain session handoff — core primitives.
+ *
+ * **Why this exists.** Browser cookies cannot span registrable domains:
+ * a session on `app.platform.com` can never be read by `tenant.io`, no
+ * matter what `Domain=` attribute it carries. Multi-tenant products
+ * with white-label custom domains therefore need an SSO-style handoff
+ * to "move" a session between hosts: the host WITH a session mints a
+ * short-lived, single-use **handoff code** bound to the target host;
+ * the target host redeems it server-side and mints its own first-party
+ * cookies. The user's refresh token travels server-to-server through
+ * the app's {@link HandoffStore} — only the opaque code ever appears
+ * in a URL.
+ *
+ * **Security properties**
+ *   - Codes are 256-bit `crypto.randomBytes` values — unguessable.
+ *   - The store is keyed by the **SHA-256 hash** of the code, so a
+ *     leaked store (DB dump, logs) cannot be replayed into sessions.
+ *   - Codes are single-use: {@link HandoffStore.take} must delete
+ *     atomically (e.g. SQL `DELETE … RETURNING`).
+ *   - Codes expire after {@link DEFAULT_HANDOFF_TTL_SECONDS}; expiry is
+ *     enforced BOTH by the store's TTL mechanism and re-checked here on
+ *     redeem, so a lagging store cleanup can't extend the window.
+ *   - Codes are bound to the target host at issue time; redeeming on
+ *     any other host fails — and a wrong-host attempt BURNS the code,
+ *     so it cannot be probed and then replayed on the right host.
+ *     Combined with the route factory's `authorize` hook this
+ *     guarantees a session can only ever materialize on hosts the app
+ *     explicitly approved for THIS user.
+ *   - The `complete` redirects carry `Cache-Control: no-store` and
+ *     `Referrer-Policy: no-referrer` so the code-bearing URL never
+ *     sits in a shared cache and never leaks via `Referer`.
+ *
+ * **Residual risks — know what this does NOT protect against**
+ *   - *Login CSRF*: like every URL-based SSO handoff (OAuth code flow
+ *     included), an attacker can mint a code for THEIR OWN session and
+ *     lure a victim into opening the complete URL, logging the victim
+ *     in as the attacker on that host. The 60s single-use window and
+ *     the membership-gated `authorize` hook narrow this to hosts the
+ *     ATTACKER belongs to; apps for which this matters should show the
+ *     signed-in identity prominently post-handoff.
+ *   - *Store contents*: payloads hold live refresh tokens. The hashed
+ *     key prevents lookup-by-code, rows die in ≤60s, but a hostile DBA
+ *     window exists — encrypt payloads at rest if that is in scope.
+ *
+ * The route-level flow lives in `handoff-routes.ts`
+ * ({@link createSessionHandoffRoutes}); apps supply the storage
+ * (Postgres / DynamoDB / Redis — anything with atomic take).
+ */
+/** Default lifetime of a handoff code: one browser redirect, not more. */
+export declare const DEFAULT_HANDOFF_TTL_SECONDS = 60;
+/**
+ * What the issuing host stashes for the target host to redeem.
+ *
+ * Contains the user's **refresh token** — treat stored payloads as
+ * secrets (the code-hash key already prevents lookup-by-code, and rows
+ * are deleted on redeem / expiry, but encrypt at rest if your store's
+ * threat model calls for it).
+ */
+export interface HandoffPayload {
+    /** Cognito subject of the user the session belongs to. */
+    sub: string;
+    /** The session's refresh token — used by the target host to mint fresh tokens. */
+    refreshToken: string;
+    /** Host (including port, lowercased) the code was issued FOR. */
+    targetHost: string;
+    /** Epoch millis after which the code is dead even if the store still has it. */
+    expiresAt: number;
+}
+/**
+ * Storage the app provides for in-flight handoff codes.
+ *
+ * Keys are code **hashes** (see module docs). Implementations must make
+ * `take` atomic — two concurrent redeems of the same code must never
+ * both succeed:
+ *
+ * ```sql
+ * -- Postgres example
+ * DELETE FROM auth_handoff_codes WHERE code_hash = $1 RETURNING payload;
+ * ```
+ */
+export interface HandoffStore {
+    /** Persist a payload under `codeHash`, expiring after `ttlSeconds`. */
+    put(codeHash: string, payload: HandoffPayload, ttlSeconds: number): Promise<void>;
+    /** Atomically fetch AND delete. Returns null when absent (or already taken). */
+    take(codeHash: string): Promise<HandoffPayload | null>;
+}
+/** Generate an unguessable handoff code (256-bit, base64url). */
+export declare function generateHandoffCode(): string;
+/** Hash a handoff code for use as a store key. */
+export declare function hashHandoffCode(code: string): string;
+/**
+ * Issue a handoff code for `targetHost`.
+ *
+ * @returns the RAW code — put it in the redirect URL. Only its hash
+ *          touches the store.
+ */
+export declare function issueHandoffCode(store: HandoffStore, input: {
+    sub: string;
+    refreshToken: string;
+    targetHost: string;
+}, ttlSeconds?: number): Promise<string>;
+/**
+ * Redeem a handoff code on `currentHost`.
+ *
+ * Returns the payload when the code exists, hasn't expired, and was
+ * issued for exactly this host — null otherwise. The code is consumed
+ * either way (single-use: a failed redeem must burn it too, so an
+ * attacker can't probe).
+ */
+export declare function redeemHandoffCode(store: HandoffStore, code: string, currentHost: string): Promise<HandoffPayload | null>;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/server/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../../src/server/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,gFAAgF;IAChF,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACxD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,kDAAkD;AAClD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAOD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAChE,UAAU,GAAE,MAAoC,GAC/C,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAOhC"}

package/dist/server/handoff.js

@@ -0,0 +1,102 @@
+/**
+ * Cross-domain session handoff — core primitives.
+ *
+ * **Why this exists.** Browser cookies cannot span registrable domains:
+ * a session on `app.platform.com` can never be read by `tenant.io`, no
+ * matter what `Domain=` attribute it carries. Multi-tenant products
+ * with white-label custom domains therefore need an SSO-style handoff
+ * to "move" a session between hosts: the host WITH a session mints a
+ * short-lived, single-use **handoff code** bound to the target host;
+ * the target host redeems it server-side and mints its own first-party
+ * cookies. The user's refresh token travels server-to-server through
+ * the app's {@link HandoffStore} — only the opaque code ever appears
+ * in a URL.
+ *
+ * **Security properties**
+ *   - Codes are 256-bit `crypto.randomBytes` values — unguessable.
+ *   - The store is keyed by the **SHA-256 hash** of the code, so a
+ *     leaked store (DB dump, logs) cannot be replayed into sessions.
+ *   - Codes are single-use: {@link HandoffStore.take} must delete
+ *     atomically (e.g. SQL `DELETE … RETURNING`).
+ *   - Codes expire after {@link DEFAULT_HANDOFF_TTL_SECONDS}; expiry is
+ *     enforced BOTH by the store's TTL mechanism and re-checked here on
+ *     redeem, so a lagging store cleanup can't extend the window.
+ *   - Codes are bound to the target host at issue time; redeeming on
+ *     any other host fails — and a wrong-host attempt BURNS the code,
+ *     so it cannot be probed and then replayed on the right host.
+ *     Combined with the route factory's `authorize` hook this
+ *     guarantees a session can only ever materialize on hosts the app
+ *     explicitly approved for THIS user.
+ *   - The `complete` redirects carry `Cache-Control: no-store` and
+ *     `Referrer-Policy: no-referrer` so the code-bearing URL never
+ *     sits in a shared cache and never leaks via `Referer`.
+ *
+ * **Residual risks — know what this does NOT protect against**
+ *   - *Login CSRF*: like every URL-based SSO handoff (OAuth code flow
+ *     included), an attacker can mint a code for THEIR OWN session and
+ *     lure a victim into opening the complete URL, logging the victim
+ *     in as the attacker on that host. The 60s single-use window and
+ *     the membership-gated `authorize` hook narrow this to hosts the
+ *     ATTACKER belongs to; apps for which this matters should show the
+ *     signed-in identity prominently post-handoff.
+ *   - *Store contents*: payloads hold live refresh tokens. The hashed
+ *     key prevents lookup-by-code, rows die in ≤60s, but a hostile DBA
+ *     window exists — encrypt payloads at rest if that is in scope.
+ *
+ * The route-level flow lives in `handoff-routes.ts`
+ * ({@link createSessionHandoffRoutes}); apps supply the storage
+ * (Postgres / DynamoDB / Redis — anything with atomic take).
+ */
+import { createHash, randomBytes } from 'node:crypto';
+/** Default lifetime of a handoff code: one browser redirect, not more. */
+export const DEFAULT_HANDOFF_TTL_SECONDS = 60;
+/** Generate an unguessable handoff code (256-bit, base64url). */
+export function generateHandoffCode() {
+    return randomBytes(32).toString('base64url');
+}
+/** Hash a handoff code for use as a store key. */
+export function hashHandoffCode(code) {
+    return createHash('sha256').update(code).digest('base64url');
+}
+/** Lowercase a host for comparison. Ports are significant (dev hosts). */
+function normalizeHost(host) {
+    return host.trim().toLowerCase();
+}
+/**
+ * Issue a handoff code for `targetHost`.
+ *
+ * @returns the RAW code — put it in the redirect URL. Only its hash
+ *          touches the store.
+ */
+export async function issueHandoffCode(store, input, ttlSeconds = DEFAULT_HANDOFF_TTL_SECONDS) {
+    const code = generateHandoffCode();
+    const payload = {
+        sub: input.sub,
+        refreshToken: input.refreshToken,
+        targetHost: normalizeHost(input.targetHost),
+        expiresAt: Date.now() + ttlSeconds * 1000,
+    };
+    await store.put(hashHandoffCode(code), payload, ttlSeconds);
+    return code;
+}
+/**
+ * Redeem a handoff code on `currentHost`.
+ *
+ * Returns the payload when the code exists, hasn't expired, and was
+ * issued for exactly this host — null otherwise. The code is consumed
+ * either way (single-use: a failed redeem must burn it too, so an
+ * attacker can't probe).
+ */
+export async function redeemHandoffCode(store, code, currentHost) {
+    if (!code)
+        return null;
+    const payload = await store.take(hashHandoffCode(code));
+    if (!payload)
+        return null;
+    if (Date.now() > payload.expiresAt)
+        return null;
+    if (payload.targetHost !== normalizeHost(currentHost))
+        return null;
+    return payload;
+}
+//# sourceMappingURL=handoff.js.map

package/dist/server/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../../src/server/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAwC9C,iEAAiE;AACjE,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAmB,EACnB,KAAgE,EAChE,aAAqB,2BAA2B;IAEhD,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAmB;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI;KAC1C,CAAC;IACF,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAmB,EACnB,IAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server/index.d.ts

@@ -34,19 +34,26 @@ export type { AdminInviteUserInput, AdminInviteUserResult, AdminUpdateAttributes
 export { adminInviteUser, adminUpdateUserAttributes, adminDisableUser, adminEnableUser, adminDeleteUser, } from './admin-users.js';
 export type { RefreshResult } from './refresh.js';
 export { refreshSession } from './refresh.js';
-export { revokeRefreshToken } from './revoke.js';
+export { revokeRefreshToken, globalSignOut } from './revoke.js';
+export type { EnsureUserForVerifiedEmailInput, EnsureUserForVerifiedEmailResult, } from './passwordless.js';
+export { ensureUserForVerifiedEmail, mintSessionForVerifiedEmail, } from './passwordless.js';
 export type { ChangePasswordInput } from './change-password.js';
 export { changePassword } from './change-password.js';
 export type { ForgotPasswordInput, ForgotPasswordResult, ConfirmForgotPasswordInput, CodeDeliveryDetails, } from './forgot-password.js';
 export { forgotPassword, confirmForgotPassword } from './forgot-password.js';
 export type { VerifyOptions } from './verify.js';
 export { verifyAndDecode } from './verify.js';
-export type { SessionTokens, CookieOptions, OAuthStateCookieOptions, } from './cookies.js';
-export { ID_TOKEN_COOKIE, ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE, buildSessionCookies, buildClearSessionCookies, readCookieFromHeader, buildOAuthStateCookie, clearOAuthStateCookie, oauthStateCookieName, } from './cookies.js';
+export { decodeJwtClaims } from './token-utils.js';
+export type { SessionTokens, CookieOptions, CookieDomainOptions, OAuthStateCookieOptions, } from './cookies.js';
+export { ID_TOKEN_COOKIE, ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE, buildSessionCookies, buildClearSessionCookies, readCookieFromHeader, buildOAuthStateCookie, clearOAuthStateCookie, oauthStateCookieName, resolveCookieDomain, } from './cookies.js';
 export type { CookieAuthMiddlewareOptions } from './middleware.js';
 export { cookieAuthMiddleware, extractToken, defaultScopeMapper } from './middleware.js';
 export type { FederatedAuthRoutes, FederatedAuthRoutesOptions, FederatedCallbackBody, FederatedCallbackResult, FederatedOnSignInArgs, FederatedOnSignInResult, FederatedStartBody, } from './federated-routes.js';
 export { createFederatedAuthRoutes } from './federated-routes.js';
+export type { HandoffPayload, HandoffStore } from './handoff.js';
+export { DEFAULT_HANDOFF_TTL_SECONDS, generateHandoffCode, hashHandoffCode, issueHandoffCode, redeemHandoffCode, } from './handoff.js';
+export type { HandoffAuthorizeArgs, HandoffStartBody, SessionHandoffRoutes, SessionHandoffRoutesOptions, } from './handoff-routes.js';
+export { createSessionHandoffRoutes, DEFAULT_HANDOFF_COMPLETE_PATH, } from './handoff-routes.js';
 export type { FederatedProvider, FederatedProfile, FederatedProviderCredentials, SignInAsFederatedUserInput, BuildAuthorizeUrlInput, ExchangeAuthorizationCodeInput, } from './federated.js';
 export { loadFederatedProviderCredentials, generateOAuthState, verifyOAuthState, buildAuthorizeUrl, exchangeAuthorizationCode, signInAsFederatedUser, } from './federated.js';
 export type { VerificationChannel, VerificationCodeStore, VerificationCodeRecord, RequestVerificationCodeInput, RequestVerificationCodeResult, VerifyVerificationCodeInput, } from './verification.js';

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EACV,aAAa,EACb,aAAa,EACb,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEzF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAExB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIhE,YAAY,EACV,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI9C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEzF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC"}

package/dist/server/index.js

@@ -28,13 +28,19 @@ export { signInWithPasswordOrChallenge, respondToNewPasswordChallenge, } from '.
 export { signUpUser } from './sign-up.js';
 export { adminInviteUser, adminUpdateUserAttributes, adminDisableUser, adminEnableUser, adminDeleteUser, } from './admin-users.js';
 export { refreshSession } from './refresh.js';
-export { revokeRefreshToken } from './revoke.js';
+export { revokeRefreshToken, globalSignOut } from './revoke.js';
+export { ensureUserForVerifiedEmail, mintSessionForVerifiedEmail, } from './passwordless.js';
 export { changePassword } from './change-password.js';
 export { forgotPassword, confirmForgotPassword } from './forgot-password.js';
 export { verifyAndDecode } from './verify.js';
-export { ID_TOKEN_COOKIE, ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE, buildSessionCookies, buildClearSessionCookies, readCookieFromHeader, buildOAuthStateCookie, clearOAuthStateCookie, oauthStateCookieName, } from './cookies.js';
+// Unverified claim extraction — ONLY for tokens received directly
+// from the provider (e.g. reading profile claims right after sign-in).
+export { decodeJwtClaims } from './token-utils.js';
+export { ID_TOKEN_COOKIE, ACCESS_TOKEN_COOKIE, REFRESH_TOKEN_COOKIE, buildSessionCookies, buildClearSessionCookies, readCookieFromHeader, buildOAuthStateCookie, clearOAuthStateCookie, oauthStateCookieName, resolveCookieDomain, } from './cookies.js';
 export { cookieAuthMiddleware, extractToken, defaultScopeMapper } from './middleware.js';
 export { createFederatedAuthRoutes } from './federated-routes.js';
+export { DEFAULT_HANDOFF_TTL_SECONDS, generateHandoffCode, hashHandoffCode, issueHandoffCode, redeemHandoffCode, } from './handoff.js';
+export { createSessionHandoffRoutes, DEFAULT_HANDOFF_COMPLETE_PATH, } from './handoff-routes.js';
 export { loadFederatedProviderCredentials, generateOAuthState, verifyOAuthState, buildAuthorizeUrl, exchangeAuthorizationCode, signInAsFederatedUser, } from './federated.js';
 export { generateVerificationCode, hashVerificationCode, requestVerificationCode, verifyVerificationCode, createInMemoryVerificationCodeStore, } from './verification.js';
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO1C,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQtD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAWzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAUlE,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAOlD,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAO1C,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQhE,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQtD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,kEAAkE;AAClE,uEAAuE;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAWzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAQtB,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAU7B,OAAO,EACL,gCAAgC,EAChC,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAUxB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,GACpC,MAAM,mBAAmB,CAAC"}

package/dist/server/passwordless.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Server-verified (passwordless) identity flows.
+ *
+ * For UXes where the APP proves address ownership out-of-band — magic
+ * links, OAuth/OIDC callbacks, emailed one-time codes — and Cognito is
+ * only the identity/token backend, never the credential UI:
+ *
+ *   1. {@link ensureUserForVerifiedEmail} — idempotently create the
+ *      Cognito user (invite email suppressed, `email_verified=true`)
+ *      or fetch the existing one; the returned `sub` doubles as the
+ *      app's `users.id`.
+ *   2. {@link mintSessionForVerifiedEmail} — rotate the user's
+ *      password to a throwaway strong secret (`AdminSetUserPassword`,
+ *      permanent) and immediately sign in via
+ *      `InitiateAuth(USER_PASSWORD_AUTH)`. The password is discarded;
+ *      only the tokens leave the function.
+ *
+ * Requirements:
+ *   - the app client must allow `ALLOW_USER_PASSWORD_AUTH`;
+ *   - the caller's IAM role needs the `cognito-idp:Admin*` actions
+ *     used below (VentureKit's auth intent grants them to the API
+ *     Lambdas).
+ *
+ * Security notes:
+ *   - the rotated password never leaves the server and satisfies the
+ *     default "strong" policy (length + upper/lower/digit/symbol);
+ *   - replays are benign: re-minting just issues another valid token
+ *     set for the same identity — revoke on sign-out;
+ *   - concurrent mints race harmlessly (last rotation wins, every
+ *     token set issued stays valid until expiry/revocation).
+ */
+import type { AuthServerConfig } from './config.js';
+import { type SignInResult } from './tokens.js';
+export interface EnsureUserForVerifiedEmailInput {
+    /** Address the app has already proven ownership of. */
+    email: string;
+    /** Optional standard attributes copied onto the Cognito record. */
+    firstName?: string;
+    lastName?: string;
+    /**
+     * Additional attributes (e.g. `{ 'custom:tenantRoles': '…' }`).
+     * Applied on create AND refreshed on subsequent calls.
+     */
+    attributes?: Record<string, string>;
+}
+export interface EnsureUserForVerifiedEmailResult {
+    /** Cognito `sub` (UUID) — commonly reused as the app's user id. */
+    sub: string;
+    /** True when this call created the Cognito user. */
+    created: boolean;
+}
+/**
+ * Idempotently ensure a Cognito user exists for a server-verified
+ * email. New users are auto-confirmed with `email_verified=true` and
+ * the invite email suppressed — the app owns the UX. On subsequent
+ * calls the profile attributes are refreshed best-effort.
+ */
+export declare function ensureUserForVerifiedEmail(input: EnsureUserForVerifiedEmailInput, config?: AuthServerConfig): Promise<EnsureUserForVerifiedEmailResult>;
+/**
+ * Mint a full token set (id + access + refresh) for a user whose
+ * email the app just verified: rotate the password server-side, sign
+ * in with it, discard it.
+ *
+ * Throws {@link AuthError} when the rotation or sign-in fails (e.g.
+ * `USER_PASSWORD_AUTH` not enabled on the app client).
+ */
+export declare function mintSessionForVerifiedEmail(email: string, config?: AuthServerConfig): Promise<SignInResult>;
+//# sourceMappingURL=passwordless.d.ts.map

package/dist/server/passwordless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless.d.ts","sourceRoot":"","sources":["../../src/server/passwordless.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAaH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAWrE,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,+BAA+B,EACtC,MAAM,GAAE,gBAAyC,GAChD,OAAO,CAAC,gCAAgC,CAAC,CAgE3C;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,gBAAyC,GAChD,OAAO,CAAC,YAAY,CAAC,CAyBvB"}

package/dist/server/passwordless.js

@@ -0,0 +1,136 @@
+/**
+ * Server-verified (passwordless) identity flows.
+ *
+ * For UXes where the APP proves address ownership out-of-band — magic
+ * links, OAuth/OIDC callbacks, emailed one-time codes — and Cognito is
+ * only the identity/token backend, never the credential UI:
+ *
+ *   1. {@link ensureUserForVerifiedEmail} — idempotently create the
+ *      Cognito user (invite email suppressed, `email_verified=true`)
+ *      or fetch the existing one; the returned `sub` doubles as the
+ *      app's `users.id`.
+ *   2. {@link mintSessionForVerifiedEmail} — rotate the user's
+ *      password to a throwaway strong secret (`AdminSetUserPassword`,
+ *      permanent) and immediately sign in via
+ *      `InitiateAuth(USER_PASSWORD_AUTH)`. The password is discarded;
+ *      only the tokens leave the function.
+ *
+ * Requirements:
+ *   - the app client must allow `ALLOW_USER_PASSWORD_AUTH`;
+ *   - the caller's IAM role needs the `cognito-idp:Admin*` actions
+ *     used below (VentureKit's auth intent grants them to the API
+ *     Lambdas).
+ *
+ * Security notes:
+ *   - the rotated password never leaves the server and satisfies the
+ *     default "strong" policy (length + upper/lower/digit/symbol);
+ *   - replays are benign: re-minting just issues another valid token
+ *     set for the same identity — revoke on sign-out;
+ *   - concurrent mints race harmlessly (last rotation wins, every
+ *     token set issued stays valid until expiry/revocation).
+ */
+import { AdminCreateUserCommand, AdminGetUserCommand, AdminSetUserPasswordCommand, AdminUpdateUserAttributesCommand, InitiateAuthCommand, MessageActionType, UsernameExistsException, } from '@aws-sdk/client-cognito-identity-provider';
+import { randomBytes } from 'node:crypto';
+import { loadAuthServerConfig } from './config.js';
+import { getCognitoClient } from './cognito-client.js';
+import { AuthError, mapProviderError } from './errors.js';
+import { extractSignInTokens } from './tokens.js';
+/**
+ * Cryptographically random password satisfying Cognito's default
+ * "strong" policy: 40 base64url chars + `Aa1!` to guarantee the
+ * character-class mix. Internal — the value is never surfaced.
+ */
+function generateRotatingPassword() {
+    return `${randomBytes(30).toString('base64url')}Aa1!`;
+}
+/**
+ * Idempotently ensure a Cognito user exists for a server-verified
+ * email. New users are auto-confirmed with `email_verified=true` and
+ * the invite email suppressed — the app owns the UX. On subsequent
+ * calls the profile attributes are refreshed best-effort.
+ */
+export async function ensureUserForVerifiedEmail(input, config = loadAuthServerConfig()) {
+    const client = getCognitoClient(config.region, config.endpoint);
+    const email = input.email.trim().toLowerCase();
+    const attributes = [
+        { Name: 'email', Value: email },
+        { Name: 'email_verified', Value: 'true' },
+    ];
+    if (input.firstName)
+        attributes.push({ Name: 'given_name', Value: input.firstName });
+    if (input.lastName)
+        attributes.push({ Name: 'family_name', Value: input.lastName });
+    for (const [name, value] of Object.entries(input.attributes ?? {})) {
+        attributes.push({ Name: name, Value: value });
+    }
+    try {
+        const res = await client.send(new AdminCreateUserCommand({
+            UserPoolId: config.userPoolId,
+            Username: email,
+            UserAttributes: attributes,
+            MessageAction: MessageActionType.SUPPRESS,
+        }));
+        const sub = res.User?.Attributes?.find((a) => a.Name === 'sub')?.Value;
+        if (!sub) {
+            throw new AuthError('incomplete_auth_result', 'AdminCreateUser did not return a sub', 500);
+        }
+        return { sub, created: true };
+    }
+    catch (err) {
+        if (!(err instanceof UsernameExistsException)) {
+            throw err instanceof AuthError ? err : mapProviderError(err, 'sign_up_failed');
+        }
+    }
+    // Already present — fetch the sub and refresh mutable attributes.
+    const existing = await client.send(new AdminGetUserCommand({ UserPoolId: config.userPoolId, Username: email }));
+    const sub = existing.UserAttributes?.find((a) => a.Name === 'sub')?.Value;
+    if (!sub) {
+        throw new AuthError('incomplete_auth_result', 'AdminGetUser did not return a sub', 500);
+    }
+    const updates = attributes.filter((a) => a.Name !== 'email' && a.Name !== 'email_verified');
+    if (updates.length) {
+        try {
+            await client.send(new AdminUpdateUserAttributesCommand({
+                UserPoolId: config.userPoolId,
+                Username: email,
+                UserAttributes: updates,
+            }));
+        }
+        catch {
+            // Best-effort — stale profile attributes are not worth failing
+            // an authentication flow over.
+        }
+    }
+    return { sub, created: false };
+}
+/**
+ * Mint a full token set (id + access + refresh) for a user whose
+ * email the app just verified: rotate the password server-side, sign
+ * in with it, discard it.
+ *
+ * Throws {@link AuthError} when the rotation or sign-in fails (e.g.
+ * `USER_PASSWORD_AUTH` not enabled on the app client).
+ */
+export async function mintSessionForVerifiedEmail(email, config = loadAuthServerConfig()) {
+    const client = getCognitoClient(config.region, config.endpoint);
+    const normalized = email.trim().toLowerCase();
+    const password = generateRotatingPassword();
+    try {
+        await client.send(new AdminSetUserPasswordCommand({
+            UserPoolId: config.userPoolId,
+            Username: normalized,
+            Password: password,
+            Permanent: true,
+        }));
+        const res = await client.send(new InitiateAuthCommand({
+            AuthFlow: 'USER_PASSWORD_AUTH',
+            ClientId: config.appClientId,
+            AuthParameters: { USERNAME: normalized, PASSWORD: password },
+        }));
+        return extractSignInTokens(res.AuthenticationResult);
+    }
+    catch (err) {
+        throw err instanceof AuthError ? err : mapProviderError(err, 'sign_in_failed');
+    }
+}
+//# sourceMappingURL=passwordless.js.map

package/dist/server/passwordless.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless.js","sourceRoot":"","sources":["../../src/server/passwordless.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,gCAAgC,EAChC,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAqB,MAAM,aAAa,CAAC;AAErE;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,OAAO,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC;AACxD,CAAC;AAsBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAsC,EACtC,SAA2B,oBAAoB,EAAE;IAEjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE/C,MAAM,UAAU,GAAoB;QAClC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;QAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE;KAC1C,CAAC;IACF,IAAI,KAAK,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,sBAAsB,CAAC;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,KAAK;YACf,cAAc,EAAE,UAAU;YAC1B,aAAa,EAAE,iBAAiB,CAAC,QAAQ;SAC1C,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;QACvE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,SAAS,CACjB,wBAAwB,EACxB,sCAAsC,EACtC,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,IAAI,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5E,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;IAC1E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,CACzD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,gCAAgC,CAAC;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,OAAO;aACxB,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,+BAA+B;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAa,EACb,SAA2B,oBAAoB,EAAE;IAEjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,2BAA2B,CAAC;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,IAAI;SAChB,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAC3B,IAAI,mBAAmB,CAAC;YACtB,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,cAAc,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC7D,CAAC,CACH,CAAC;QACF,OAAO,mBAAmB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/server/revoke.d.ts

@@ -15,4 +15,14 @@ import type { AuthServerConfig } from './config.js';
  * the function never throws.
  */
 export declare function revokeRefreshToken(refreshToken: string, config?: AuthServerConfig): Promise<void>;
+/**
+ * Invalidate EVERY outstanding refresh token for the caller via
+ * Cognito's `GlobalSignOut` (keyed by a valid access token, unlike
+ * {@link revokeRefreshToken} which revokes one refresh token). Already
+ * issued access tokens keep working until natural expiry.
+ *
+ * **Best-effort**, same contract as {@link revokeRefreshToken}: sign-out
+ * must never fail the user, so errors are logged and swallowed.
+ */
+export declare function globalSignOut(accessToken: string, config?: AuthServerConfig): Promise<void>;
 //# sourceMappingURL=revoke.d.ts.map

package/dist/server/revoke.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/server/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,gBAAyC,GAChD,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../src/server/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,gBAAyC,GAChD,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,gBAAyC,GAChD,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/server/revoke.js

@@ -7,7 +7,7 @@
  * because the server-side revoke had a hiccup — the cookies clear
  * regardless.
  */
-import { RevokeTokenCommand } from '@aws-sdk/client-cognito-identity-provider';
+import { GlobalSignOutCommand, RevokeTokenCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { loadAuthServerConfig } from './config.js';
 import { getCognitoClient } from './cognito-client.js';
 /**
@@ -28,4 +28,22 @@ export async function revokeRefreshToken(refreshToken, config = loadAuthServerCo
         console.warn('[@venturekit/auth/server] refresh-token revoke failed (ignored):', err);
     }
 }
+/**
+ * Invalidate EVERY outstanding refresh token for the caller via
+ * Cognito's `GlobalSignOut` (keyed by a valid access token, unlike
+ * {@link revokeRefreshToken} which revokes one refresh token). Already
+ * issued access tokens keep working until natural expiry.
+ *
+ * **Best-effort**, same contract as {@link revokeRefreshToken}: sign-out
+ * must never fail the user, so errors are logged and swallowed.
+ */
+export async function globalSignOut(accessToken, config = loadAuthServerConfig()) {
+    const client = getCognitoClient(config.region, config.endpoint);
+    try {
+        await client.send(new GlobalSignOutCommand({ AccessToken: accessToken }));
+    }
+    catch (err) {
+        console.warn('[@venturekit/auth/server] global sign-out failed (ignored):', err);
+    }
+}
 //# sourceMappingURL=revoke.js.map

package/dist/server/revoke.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/server/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,SAA2B,oBAAoB,EAAE;IAEjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,kBAAkB,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,KAAK,EAAE,YAAY;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAEb,OAAO,CAAC,IAAI,CAAC,kEAAkE,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../src/server/revoke.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,SAA2B,oBAAoB,EAAE;IAEjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,kBAAkB,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,KAAK,EAAE,YAAY;SACpB,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAEb,OAAO,CAAC,IAAI,CAAC,kEAAkE,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAA2B,oBAAoB,EAAE;IAEjD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAEb,OAAO,CAAC,IAAI,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/server/store/postgres.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @venturekit/auth — Postgres VerificationCodeStore
+ *
+ * Production {@link VerificationCodeStore} backing the OTP primitives
+ * ({@link requestVerificationCode} / {@link verifyVerificationCode}).
+ * Talks to the project's primary Postgres database via
+ * `@venturekit/data`'s `query()` — or any `Querier`, so the caller can
+ * enlist code writes in an already-open transaction (pass a
+ * `Transaction`'s `query`; the default is the global connection pool).
+ *
+ * The backing table `vk_verification_codes` is shipped by this package's
+ * `migrations/vk_auth_001_verification_codes.sql` and applied by the
+ * in-VPC migration runner `@venturekit/infra` provisions — so consumers
+ * get the table and this store from the same package.
+ *
+ * `@venturekit/data` is an OPTIONAL peer dependency: importing THIS
+ * module is what opts a project into the Postgres store, so apps on a
+ * different backend (DynamoDB, the in-memory dev store) never load it
+ * and `@venturekit/auth/server` stays storage-agnostic.
+ *
+ * `expires_at` crosses the store boundary as ms-epoch to satisfy
+ * {@link VerificationCodeRecord}'s numeric contract: `to_timestamp` on
+ * write, `EXTRACT(EPOCH …) * 1000` on read.
+ */
+import { type Querier } from '@venturekit/data';
+import type { VerificationCodeStore } from '../verification.js';
+/**
+ * Build a Postgres-backed {@link VerificationCodeStore} bound to `q`.
+ *
+ * Pass a transaction's `query` (see `beginTransaction` /
+ * `withTransaction` in `@venturekit/data`) to make code writes
+ * participate in an open transaction; omit it to use the global pool.
+ */
+export declare function createPostgresVerificationCodeStore(q?: Querier): VerificationCodeStore;
+//# sourceMappingURL=postgres.d.ts.map

package/dist/server/store/postgres.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/server/store/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAS,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAwB5B;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,CAAC,GAAE,OAAe,GACjB,qBAAqB,CAgEvB"}