@warlock.js/auth 5.11.0 → 5.13.0

package/CHANGELOG.md

@@ -4,6 +4,71 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.13.0 - 2026-09-17
+
+### Added
+
+- **Email verification and password reset.** `sendEmailVerification(user)`, `verifyEmail(token)`, `requestPasswordReset(Model, email)` and `resetPassword(token, newPassword)`. Tokens are 32 random bytes, stored only as a SHA-256 hash, single-use (consumed with a conditional update, so of two concurrent uses exactly one succeeds), expiring (`auth.verification.expiresIn` default `"24h"`, `auth.passwordReset.expiresIn` default `"60m"`) and purpose-bound. A new reset request invalidates the user's earlier unused reset tokens. `requestPasswordReset` answers the same for unknown emails. `resetPassword` revokes every access token, refresh token and cookie session through `authService.revokeAllTokens`. Rejected tokens throw `InvalidOneTimeTokenError` (`400`, `EC008`).
+- New `one_time_tokens` table (`OneTimeToken` model, overridable via `auth.oneTimeToken.model`), shipped in `authMigrations`. **Run your migrations.**
+- Delivery goes through `@warlock.js/notifications`, now an **optional peer dependency**. Default mail notifications can be replaced via `auth.verification.notification` / `auth.passwordReset.notification`, and link builders set via `.url`. If the package is not installed or not configured, calls throw `NotificationsUnavailableError` before any token is issued.
+- `requireVerifiedEmail()` middleware — rejects users without `auth.verification.field` (default `emailVerifiedAt`) with `EmailNotVerifiedError` (`403`, `EC007`). `isEmailVerified(user)` helper.
+- `tokenIssueThrottleMiddleware()` (every request counts, per email + IP, 3/1h) and `tokenConsumeThrottleMiddleware()` (failures, per IP, 10/15m), both built on `loginThrottleMiddleware`.
+- `AuthErrorCodes.EmailNotVerified` (`"EC007"`) and `AuthErrorCodes.InvalidOneTimeToken` (`"EC008"`).
+- **Login with Google, passkeys and phone codes** (skill `login-with-providers`). Every method ends in the new `authService.completeLogin(user, deviceInfo?)`, which applies `auth.canAuthenticate` and then issues exactly what `authService.login` issues (same tokens, rows and `login.success` event). `login` now shares that ending.
+  - **Google:** `startProviderLogin(response, "google")` / `completeProviderLogin(Model, "google", request, response)`. Uses the OIDC authorization code flow with PKCE (S256), `state` and `nonce`, kept in a signed 10-minute HttpOnly cookie. The code is exchanged with `fetch`, and the id_token is verified with `jose` against Google's JWKS (signature, `iss`, `aud`, `exp`, `nonce`). Configure it under `auth.providers.google`. Other providers implement the `AuthProvider` contract and register under `auth.providers.custom`.
+  - **Account linking:** new `provider_accounts` table (`ProviderAccount`). A link always decides the user. Without one, only a provider-**verified** email links an existing user or creates a new one; an unverified email throws `ProviderEmailNotVerifiedError` (`403`, `EC010`). Callback rejections throw `InvalidProviderCallbackError` (`400`, `EC009`).
+  - **Passkeys:** `generatePasskeyRegistrationOptions` / `verifyPasskeyRegistration` / `generatePasskeyAuthenticationOptions` / `verifyPasskeyAuthentication`, built on `@simplewebauthn/server`. Challenges are stored hashed in `one_time_tokens`, expire, and are used once (consumed even when verification fails). The request `Origin` must be in `auth.passkeys.origin`, and a signature counter that does not advance is rejected. Credentials are stored in the new `passkey_credentials` table (`PasskeyCredential`). Rejections throw `InvalidPasskeyError` (`400`, `EC011`).
+  - **Phone OTP:** `requestOtp(Model, phone, { channel })` / `verifyOtp(Model, phone, code)`. Codes have 6 digits, are stored as a salted HMAC in `one_time_tokens` (purpose `otp`), expire after 5 minutes, and are invalidated after 5 attempts (counted atomically). Unknown phones get the same answer. Codes are delivered through the `@warlock.js/notifications` channel you configure (`auth.otp.channel`, default `"sms"`) or `auth.otp.send`; auth ships no SMS/WhatsApp driver. New `otpRequestThrottleMiddleware()` / `otpVerifyThrottleMiddleware()` presets are built on `loginThrottleMiddleware`.
+  - `jose` and `@simplewebauthn/server` are new **optional peer dependencies**, loaded lazily. When one is missing, the call throws `AuthProviderSdkMissingError`, whose message names `warlock add auth-google` / `warlock add auth-passkeys`.
+- `one_time_tokens` gains an `attempts` column, and `user_id` becomes nullable (passkey login challenges have no user yet). `authMigrations` now includes `ProviderAccountMigration` and `PasskeyCredentialMigration`. **Run your migrations.**
+- `auth.cleanup` / `authService.cleanupExpiredTokens()` also hard-deletes expired and consumed `one_time_tokens` rows via the new `OneTimeToken.purgeSpent()`. The delete is permanent on every driver, so MongoDB's default "trash" strategy does not copy token hashes into `one_time_tokensTrash`.
+- Local real-database integration suites (`tests/integration/local`, skipped unless `LOCAL_MONGO_*` / `LOCAL_PG_*` are set) prove on MongoDB and Postgres: a one-time token consumed 20 times concurrently succeeds once, 20 concurrent wrong OTP guesses count at most 5 attempts and invalidate the code, a passkey login challenge with no user persists and is consumed, the counter compare-and-set and regression rejection hold, and `provider_accounts` allows one link per identity.
+- Passkey specs now also run the real `@simplewebauthn/server` against a `node:crypto` software authenticator (`none` attestation, ES256 assertions).
+- `AuthErrorCodes.InvalidProviderCallback` (`"EC009"`), `AuthErrorCodes.ProviderEmailNotVerified` (`"EC010"`) and `AuthErrorCodes.InvalidPasskey` (`"EC011"`).
+
+### Security
+
+- **Access and refresh tokens (and one-time tokens, and passkey credentials) are no longer copied into MongoDB trash collections on delete.** `AccessToken`, `RefreshToken`, `OneTimeToken` and `PasskeyCredential` now declare `static deleteStrategy = "permanent"`, overriding the MongoDB driver's default `"trash"` strategy. Previously, `AccessToken.purgeExpired()`, `RefreshToken.purgeExpired()`/`purgeNeverExpiring()`, and `authMiddleware`'s expired-token cleanup all called `destroy()` without a strategy override, so on MongoDB every purge or invalidation copied the live JWT into `access_tokensTrash` / `refresh_tokensTrash` before deleting the original — leaving usable credential material behind after "revocation". `OneTimeToken.purgeSpent()` already forced `"permanent"` per-call (5.13.0 above); that override is now redundant and has been removed in favor of the model-level default. Apps that have been running on MongoDB may want to drop the `access_tokensTrash`, `refresh_tokensTrash` and `one_time_tokensTrash` collections, which may hold copies of now-revoked credentials.
+
+### Fixed
+
+- `verifyPasskeyAuthentication` reported a cloned authenticator as `reason: "authentication-verification-failed"`, because `@simplewebauthn/server` rejects a non-advancing counter itself before auth's own check runs. It now reports `"counter-regression"`. The response (`400`, `EC011`) is unchanged.
+
+## 5.12.0 - 2026-09-16
+
+### Added
+
+- `authService.setAuthCookie(response, token, options?)` and `authService.clearAuthCookie(response, options?)` — the write side of the `cookie:<name>` token source `authMiddleware([], "cookie:<name>")` has accepted since 5.0.0 (card 50bf4f1a). `setAuthCookie` accepts a raw token string or an `AccessTokenOutput` (deriving `Max-Age` from `expiresAt` automatically); both are explicit app-controller calls — `login`/`logout` never set cookies implicitly, so upgrading never starts emitting `Set-Cookie` for an existing bearer-only app. Cookie name/path are configurable via the new `auth.cookie` config block (defaults: `"access_token"` / `"/"`); attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) are not — they come from core's `secureCookieDefaults()`, the framework-wide floor.
+
+### Security
+
+- **CSRF Origin check for cookie-authenticated writes.** `authMiddleware` now automatically rejects, with `403` (`AuthErrorCodes.CsrfOriginMismatch`, `"EC006"`), any request whose credential came from a `cookie:` source and whose method is unsafe (`POST`/`PUT`/`PATCH`/`DELETE`) unless `Origin` (or, absent that, `Referer`) names the request's own origin or an entry in the new `auth.csrf.allowedOrigins` config (default `[]`). A request with neither header is rejected, fail-closed. Header-token authentication and safe methods (`GET`/`HEAD`/`OPTIONS`) are completely unaffected. This closes the residual CSRF gap `SameSite=Lax` alone leaves open for cookie auth (a same-site GET redirect chain, or a client that ignores `SameSite`); a double-submit token mechanism is deferred to a later release.
+- The CSRF Origin check's own-origin comparison includes the request's port (read from the `Host` header, since core's `request.hostname` never carries one), with default ports (`:80` on `http`, `:443` on `https`) normalised as equivalent to no port. A same-origin cookie-authenticated write on a non-default port — e.g. every `warlock dev` session — is now correctly allowed instead of being rejected with `403 EC006`.
+
+### Changed
+
+- **BREAKING:** the authenticated user now lives at `request.locals.user`, declared by `@warlock.js/auth`. `request.user` is removed (in development it throws with the new location). `@warlock.js/auth`'s middleware writes `request.locals.user` after a successful token resolution and clears it (`= undefined`) on a forged, malformed, expired, or wrong-type token; `RequestUser` — the augmentable, empty-by-default interface apps narrow to their own model — moved from `@warlock.js/core` into `@warlock.js/auth` alongside it.
+
+  ```typescript
+  // Before (removed)
+  declare module "@warlock.js/core" {
+    interface RequestUser {
+      id: string | number;
+    }
+  }
+  const user = request.user;
+
+  // After
+  declare module "@warlock.js/auth" {
+    interface RequestUser {
+      id: string | number;
+    }
+  }
+  const user = request.locals.user;
+  ```
+
+  A typed `currentUser<UserType extends Auth>()` helper is also exported, wrapping core's `useCurrentUser()` for callers that want `Auth`-derived typing without repeating the assertion at every call site.
+
 ## 5.11.0 - 2026-09-14
 
 _Released in lockstep with the `@warlock.js/*` family; no package-specific changes in 5.11.0._

package/README.md

@@ -1,86 +1,88 @@
-# Warlock Auth
-
-JWT authentication for [Warlock.js](https://github.com/warlockjs/core) applications — a base `Auth` model your user types extend, an `authMiddleware` route gate, an `authService` for login / logout / refresh (with refresh-token rotation + replay detection), persisted access + refresh tokens, multi-user-type support, lifecycle events, brute-force throttling, and three CLI commands.
-
-## Installation
-
-```bash
-yarn add @warlock.js/auth
-```
-
-`@warlock.js/auth` is coupled to `@warlock.js/core` — install it inside a Warlock project.
-
-## Server-only
-
-`@warlock.js/auth`'s entire runtime surface is server-only — its `package.json` declares `"warlock": { "environment": "server" }`. `@warlock.js/web`'s build treats this as a boundary: app client code cannot value-import this package (type-only imports are still allowed), while server loaders/controllers/modules can import it freely.
-
-## Configure
-
-```ts title="src/config/auth.ts"
-import { type AuthConfigurations } from "@warlock.js/auth";
-import { env } from "@warlock.js/core";
-import { User } from "app/users/models/user";
-
-const authConfigurations: AuthConfigurations = {
-  userType: { user: User },
-  accessToken: {
-    secret: env("JWT_SECRET"),
-    expiresIn: "1h",
-  },
-  refreshToken: {
-    secret: env("JWT_REFRESH_SECRET"),
-    expiresIn: "30d",
-    rotation: true,
-  },
-};
-
-export default authConfigurations;
-```
-
-The legacy `jwt: { secret, expiresIn, refresh: {…} }` block is still honored (with a deprecation warning), but prefer the `accessToken` / `refreshToken` blocks.
-
-`expiresIn` must be a duration string [`ms`](https://github.com/vercel/ms) parses to a positive value (`"1h"`, `"30 days"`, `NO_EXPIRATION`); anything else throws naming the key on the first token issue, rather than signing a token with no expiry.
-
-A token is only accepted while **both** its own `exp` claim and its stored `expires_at` are in the future — a JWT with no `exp` at all is rejected outright, since a verifier with no deadline to check succeeds forever. If any deployment ran a pre-4.12.0 version with an invalid `expiresIn`, tokens issued then may never expire and are still live: run `warlock auth.purge-never-expiring --dry-run` to find them. See the 4.12.0 entry in [`CHANGELOG.md`](./CHANGELOG.md).
-
-## Documentation
-
-Task-focused guides live under [`skills/`](./skills):
-
-- **overview** — what the package does and when to reach for it
-- **auth-basics** — the `Auth` model, middleware, and service
-- **handle-login-and-logout** — issue and revoke tokens
-- **register-user** — sign up + first token pair
-- **protect-routes** — gate routes with `authMiddleware`
-- **manage-tokens** — the full token lifecycle (rotation, revocation, cleanup)
-- **customize-user-type** — multiple user types in one system
-- **customize-token-storage** — override the token models (multi-tenant columns, custom storage)
-- **throttle-login-attempts** — brute-force protection via `loginThrottleMiddleware`
-- **run-auth-commands** — the bundled CLI commands
-
-## Generate the JWT secret
-
-Register the command in `warlock.config.ts`:
-
-```ts
-import { registerJWTSecretGeneratorCommand } from "@warlock.js/auth";
-import { defineConfig } from "@warlock.js/core";
-
-export default defineConfig({
-  cli: {
-    commands: [registerJWTSecretGeneratorCommand()],
-  },
-});
-```
-
-Then run:
-
-```bash
-warlock jwt.generate
-```
-
-It generates cryptographically-strong `JWT_SECRET` and `JWT_REFRESH_SECRET` values and writes them to your `.env` file. Existing values are left untouched, so it's safe to re-run.
-
-## License
-
-MIT © Hasan Zohdy
+# Warlock Auth
+
+JWT authentication for [Warlock.js](https://github.com/warlockjs/core) applications — a base `Auth` model your user types extend, an `authMiddleware` route gate, an `authService` for login / logout / refresh (with refresh-token rotation + replay detection), persisted access + refresh tokens, multi-user-type support, lifecycle events, brute-force throttling, and three CLI commands.
+
+## Installation
+
+```bash
+yarn add @warlock.js/auth
+```
+
+`@warlock.js/auth` is coupled to `@warlock.js/core` — install it inside a Warlock project.
+
+## Server-only
+
+`@warlock.js/auth`'s entire runtime surface is server-only — its `package.json` declares `"warlock": { "environment": "server" }`. `@warlock.js/web`'s build treats this as a boundary: app client code cannot value-import this package (type-only imports are still allowed), while server loaders/controllers/modules can import it freely.
+
+## Configure
+
+```ts title="src/config/auth.ts"
+import { type AuthConfigurations } from "@warlock.js/auth";
+import { env } from "@warlock.js/core";
+import { User } from "app/users/models/user";
+
+const authConfigurations: AuthConfigurations = {
+  userType: { user: User },
+  accessToken: {
+    secret: env("JWT_SECRET"),
+    expiresIn: "1h",
+  },
+  refreshToken: {
+    secret: env("JWT_REFRESH_SECRET"),
+    expiresIn: "30d",
+    rotation: true,
+  },
+};
+
+export default authConfigurations;
+```
+
+The legacy `jwt: { secret, expiresIn, refresh: {…} }` block is still honored (with a deprecation warning), but prefer the `accessToken` / `refreshToken` blocks.
+
+`expiresIn` must be a duration string [`ms`](https://github.com/vercel/ms) parses to a positive value (`"1h"`, `"30 days"`, `NO_EXPIRATION`); anything else throws naming the key on the first token issue, rather than signing a token with no expiry.
+
+A token is only accepted while **both** its own `exp` claim and its stored `expires_at` are in the future — a JWT with no `exp` at all is rejected outright, since a verifier with no deadline to check succeeds forever. If any deployment ran a pre-4.12.0 version with an invalid `expiresIn`, tokens issued then may never expire and are still live: run `warlock auth.purge-never-expiring --dry-run` to find them. See the 4.12.0 entry in [`CHANGELOG.md`](./CHANGELOG.md).
+
+## Documentation
+
+Task-focused guides live under [`skills/`](./skills):
+
+- **overview** — what the package does and when to reach for it
+- **auth-basics** — the `Auth` model, middleware, and service
+- **handle-login-and-logout** — issue and revoke tokens
+- **register-user** — sign up + first token pair
+- **protect-routes** — gate routes with `authMiddleware`
+- **manage-tokens** — the full token lifecycle (rotation, revocation, cleanup)
+- **customize-user-type** — multiple user types in one system
+- **customize-token-storage** — override the token models (multi-tenant columns, custom storage)
+- **throttle-login-attempts** — brute-force protection via `loginThrottleMiddleware`
+- **verify-email-and-reset-password** — email verification, password reset, `requireVerifiedEmail`
+- **login-with-providers** — Google, passkeys and phone one-time codes, all ending in `completeLogin`
+- **run-auth-commands** — the bundled CLI commands
+
+## Generate the JWT secret
+
+Register the command in `warlock.config.ts`:
+
+```ts
+import { registerJWTSecretGeneratorCommand } from "@warlock.js/auth";
+import { defineConfig } from "@warlock.js/core";
+
+export default defineConfig({
+  cli: {
+    commands: [registerJWTSecretGeneratorCommand()],
+  },
+});
+```
+
+Then run:
+
+```bash
+warlock jwt.generate
+```
+
+It generates cryptographically-strong `JWT_SECRET` and `JWT_REFRESH_SECRET` values and writes them to your `.env` file. Existing values are left untouched, so it's safe to re-run.
+
+## License
+
+MIT © Hasan Zohdy

package/esm/commands/auth-cleanup-command.mjs

@@ -14,7 +14,7 @@ import { command } from "@warlock.js/core";
 function registerAuthCleanupCommand() {
 	return command({
 		name: "auth.cleanup",
-		description: "Remove expired refresh tokens from the database",
+		description: "Remove expired access/refresh tokens and spent one-time tokens from the database",
 		preload: {
 			env: true,
 			config: ["auth", "database"],

package/esm/commands/auth-cleanup-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cleanup-command.mjs","names":[],"sources":["../../../../../../../auth/src/commands/auth-cleanup-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the auth:cleanup CLI command\n *\n * @example\n * ```bash\n * warlock auth:cleanup\n * ```\n */\nexport function registerAuthCleanupCommand() {\n  return command({\n    name: \"auth.cleanup\",\n    description: \"Remove expired refresh tokens from the database\",\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async () => {\n      console.log(colors.cyan(\"🧹 Cleaning up expired tokens...\"));\n\n      const count = await authService.cleanupExpiredTokens();\n\n      if (count === 0) {\n        console.log(colors.green(\"✅ No expired tokens found.\"));\n      } else {\n        console.log(colors.green(`✅ Removed ${count} expired token(s).`));\n      }\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,6BAA6B;CAC3C,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,YAAY;GAClB,QAAQ,IAAI,OAAO,KAAK,kCAAkC,CAAC;GAE3D,MAAM,QAAQ,MAAM,YAAY,qBAAqB;GAErD,IAAI,UAAU,GACZ,QAAQ,IAAI,OAAO,MAAM,4BAA4B,CAAC;QAEtD,QAAQ,IAAI,OAAO,MAAM,aAAa,MAAM,mBAAmB,CAAC;EAEpE;CACF,CAAC;AACH"}
+{"version":3,"file":"auth-cleanup-command.mjs","names":[],"sources":["../../../../../../../auth/src/commands/auth-cleanup-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the auth:cleanup CLI command\n *\n * @example\n * ```bash\n * warlock auth:cleanup\n * ```\n */\nexport function registerAuthCleanupCommand() {\n  return command({\n    name: \"auth.cleanup\",\n    description: \"Remove expired access/refresh tokens and spent one-time tokens from the database\",\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async () => {\n      console.log(colors.cyan(\"🧹 Cleaning up expired tokens...\"));\n\n      const count = await authService.cleanupExpiredTokens();\n\n      if (count === 0) {\n        console.log(colors.green(\"✅ No expired tokens found.\"));\n      } else {\n        console.log(colors.green(`✅ Removed ${count} expired token(s).`));\n      }\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,6BAA6B;CAC3C,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,YAAY;GAClB,QAAQ,IAAI,OAAO,KAAK,kCAAkC,CAAC;GAE3D,MAAM,QAAQ,MAAM,YAAY,qBAAqB;GAErD,IAAI,UAAU,GACZ,QAAQ,IAAI,OAAO,MAAM,4BAA4B,CAAC;QAEtD,QAAQ,IAAI,OAAO,MAAM,aAAa,MAAM,mBAAmB,CAAC;EAEpE;CACF,CAAC;AACH"}

package/esm/contracts/index.d.mts

@@ -1,2 +1,4 @@
-import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, CanAuthenticate, DeviceInfo, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshTokenConfig, TokenFrom, TokenPair } from "./types.mjs";
-import { Authenticable } from "./auth-contract.mjs";
+import { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig } from "./providers.mjs";
+import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
+import { Authenticable } from "./auth-contract.mjs";
+import { RequestUser } from "./request-locals.mjs";

package/esm/contracts/providers.d.mts

@@ -0,0 +1,101 @@
+import { Auth } from "../models/auth.model.mjs";
+import { ChildModel } from "@warlock.js/cascade";
+
+//#region ../auth/src/contracts/providers.d.ts
+/**
+ * The per-login secrets a redirect provider round-trips: `state` (CSRF),
+ * `nonce` (id_token replay binding) and the PKCE `codeVerifier`.
+ */
+type ProviderAuthorizationState = {
+  state: string;
+  nonce: string;
+  codeVerifier: string;
+};
+/**
+ * What a provider's callback hands {@link AuthProvider.handleCallback}: the
+ * callback query and the state that was stored when the login started. The
+ * caller has already checked `query.state` against `expected.state`.
+ */
+type ProviderCallbackParams = {
+  query: Record<string, unknown>;
+  expected: ProviderAuthorizationState;
+};
+/** The identity a provider asserts, normalized across providers. */
+type ProviderProfile = {
+  /** Provider name, e.g. `"google"`. */provider: string; /** The provider's stable user id (`sub`). The link key — never the email. */
+  providerUserId: string;
+  email?: string; /** Whether the PROVIDER verified `email`. Accounts are never linked on `false`. */
+  emailVerified: boolean;
+  name?: string;
+  avatar?: string; /** The verified claims the profile was built from. */
+  raw: Record<string, unknown>;
+};
+/**
+ * A redirect-style login provider (OAuth 2 / OIDC authorization code).
+ * Register an instance under `auth.providers.custom.<name>` to add one auth does
+ * not ship.
+ */
+interface AuthProvider {
+  readonly name: string;
+  /** The URL to send the browser to. */
+  authorizationUrl(state: ProviderAuthorizationState): string | Promise<string>;
+  /** Exchange the callback for a verified profile, or throw. */
+  handleCallback(params: ProviderCallbackParams): Promise<ProviderProfile>;
+}
+/** `auth.providers.google`. */
+type GoogleProviderConfig = {
+  clientId: string;
+  clientSecret: string; /** Must exactly match a redirect URI registered in the Google console. */
+  redirectUri: string; /** @default ["openid", "email", "profile"] */
+  scopes?: string[];
+};
+/** Creates the app user for a verified provider profile with no matching account. */
+type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
+/** `auth.providers`. */
+type ProvidersConfig = {
+  google?: GoogleProviderConfig;
+  /**
+   * User attribute a verified provider email is matched against.
+   * @default "email"
+   */
+  emailField?: string; /** Replace the default user creation (`{ email, name, <verification.field>: now }`). */
+  createUser?: ProviderUserCreator; /** Providers auth does not ship, by name. */
+  custom?: Record<string, AuthProvider>;
+};
+/** `auth.passkeys`. */
+type PasskeysConfig = {
+  /** Relying-party id — the site's registrable domain, e.g. `"example.com"`. */rpID: string; /** Name shown by the authenticator. */
+  rpName: string; /** Exact origin(s) the browser ceremony runs on, e.g. `"https://example.com"`. */
+  origin: string | string[];
+  /**
+   * Challenge lifetime — a positive `ms` duration string.
+   * @default "5m"
+   */
+  challengeExpiresIn?: string; /** Account name shown by the authenticator. @default user email, else id */
+  userName?: (user: Auth) => string;
+};
+/** Data an OTP delivery receives. */
+type OtpMessage = {
+  /** Ready-to-send text containing the code. */body: string;
+  code: string;
+  expiresAt: Date;
+};
+/** Delivers an OTP. Replaces the default `notify.channel(channel).send(phone, message)`. */
+type OtpSender = (phone: string, message: OtpMessage, channel: string) => unknown;
+/** `auth.otp`. */
+type OtpConfig = {
+  /**
+   * Notifications channel the code is sent through. The app registers it
+   * (auth ships no SMS/WhatsApp driver).
+   * @default "sms"
+   */
+  channel?: string; /** User attribute holding the phone number. @default "phone" */
+  phoneField?: string; /** Code lifetime. @default "5m" */
+  expiresIn?: string; /** Verify attempts before the code is invalidated. @default 5 */
+  maxAttempts?: number; /** Build the message text. @default "Your verification code is <code>" */
+  message?: (code: string) => string; /** Replace delivery entirely. */
+  send?: OtpSender;
+};
+//#endregion
+export { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig };
+//# sourceMappingURL=providers.d.mts.map

package/esm/contracts/providers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAEqD;EAA9D,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAEN;EAAxD,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UARiB;EAUjB,WAAA,UARA;EAUA,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EAjBqB;;;;EAsB9B,UAAA,WAlBA;EAoBA,UAAA,GAAa,mBAAA,EAlBP;EAoBN,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAnBD,8EAqBT,IAAA,UApBO;EAsBP,MAAA,UArBkB;EAuBlB,MAAA;EAvBiB;;;;EA4BjB,kBAAA,WA7BkB;EA+BlB,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EAlCY,8CAoCtB,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EAhCK;;;;;EAsCf,OAAA,WAxCa;EA0Cb,UAAA,WAxCS;EA0CT,SAAA,WA1CoC;EA4CpC,WAAA,WAxCU;EA0CV,OAAA,IAAW,IAAA;EAEX,IAAA,GAAO,SAAS;AAAA"}

package/esm/contracts/request-locals.d.mts

@@ -0,0 +1,43 @@
+//#region ../auth/src/contracts/request-locals.d.ts
+/**
+ * The authenticated user attached to the current request —
+ * `request.locals.user`.
+ *
+ * Moved here from `@warlock.js/core` in 5.12.0 (core's `Request` no longer
+ * has a `user` property at all — see `RequestUserMovedError`). Empty by
+ * default, exactly as it was in core, so any shape is assignable at the
+ * declaration site; an app narrows it via module augmentation:
+ *
+ * @example
+ * ```typescript
+ * declare module "@warlock.js/auth" {
+ *   interface RequestUser {
+ *     id: string | number;
+ *   }
+ * }
+ * ```
+ *
+ * Deliberately NOT `extends Auth<ModelSchema>` here: an `interface` can
+ * extend at most one class hierarchy, and a library-side
+ * `interface RequestUser extends Auth<ModelSchema>` would pre-claim that one
+ * extends slot, so an app's own `interface RequestUser extends User {}`
+ * would fail to compile (TS2320). See `access/src/middleware/gate.middleware.ts`
+ * for the same hazard documented at its call site.
+ */
+interface RequestUser {}
+/**
+ * Augments core's `RequestLocals` (`request.locals`) with the `user` key —
+ * done in the module that OWNS the key, per `RequestLocals`' own contract
+ * (`core/src/http/types.ts`). `authMiddleware` (`middleware/auth.middleware.ts`)
+ * is the sole writer: it sets `request.locals.user` after a successful token
+ * resolution and clears it (`= undefined`) on a forged, malformed, expired,
+ * or wrong-type token.
+ */
+declare module "@warlock.js/core" {
+  interface RequestLocals {
+    user?: RequestUser;
+  }
+} //# sourceMappingURL=request-locals.d.ts.map
+//#endregion
+export { RequestUser };
+//# sourceMappingURL=request-locals.d.mts.map

package/esm/contracts/request-locals.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;AAYT;;;;;;;;;;UAZL,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAW;EAAA;AAAA"}

package/esm/contracts/types.d.mts

@@ -1,5 +1,7 @@
 import { Auth } from "../models/auth.model.mjs";
 import { AccessToken } from "../models/access-token/access-token.model.mjs";
+import { OneTimeToken } from "../models/one-time-token/one-time-token.model.mjs";
+import { OtpConfig, PasskeysConfig, ProvidersConfig } from "./providers.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
 import { Algorithm } from "fast-jwt";
@@ -156,6 +158,73 @@ type PageAuthConfig = {
    */
   returnUrlParam?: string;
 };
+/**
+ * Data every email-verification / password-reset notification receives.
+ */
+type OneTimeTokenNotificationData = {
+  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */token: string; /** When the token stops working. */
+  expiresAt: Date; /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */
+  url?: string;
+};
+/**
+ * Anything auth can deliver a token through — a `defineNotification(...)`
+ * result satisfies it, as does any object with a compatible `send`.
+ */
+type AuthNotification = {
+  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;
+};
+/** Builds the link a token notification points at. */
+type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;
+/** Persists a new plaintext password for a user during a password reset. */
+type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;
+/**
+ * Email-verification configuration (`auth.verification`).
+ */
+type EmailVerificationConfig = {
+  /**
+   * Token lifetime — a positive `ms` duration string.
+   * @default "24h"
+   */
+  expiresIn?: string;
+  /**
+   * User attribute stamped with the verification `Date`. Declare it in the
+   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).
+   * @default "emailVerifiedAt"
+   */
+  field?: string; /** Replace the default verification email. */
+  notification?: AuthNotification; /** Build the verification link passed to the notification as `url`. */
+  url?: OneTimeTokenUrlBuilder;
+};
+/**
+ * Password-reset configuration (`auth.passwordReset`).
+ */
+type PasswordResetConfig = {
+  /**
+   * Token lifetime — a positive `ms` duration string.
+   * @default "60m"
+   */
+  expiresIn?: string;
+  /**
+   * User attribute `requestPasswordReset` looks the account up by.
+   * @default "email"
+   */
+  identifierField?: string; /** Replace the default reset email. */
+  notification?: AuthNotification; /** Build the reset link passed to the notification as `url`. */
+  url?: OneTimeTokenUrlBuilder;
+  /**
+   * Persist the new password yourself. By default auth saves a hash made by
+   * the same `hashPassword` login verifies against, and falls back to the
+   * plaintext when the model hashes on save (`useHashedPassword()`), checking
+   * the stored value with `verifyPassword` either way.
+   */
+  setPassword?: PasswordSetter;
+};
+/**
+ * One-time token storage configuration (`auth.oneTimeToken`).
+ */
+type OneTimeTokenConfig = {
+  /** Override the persisted model — extend {@link OneTimeToken}. */model?: typeof OneTimeToken;
+};
 type AuthConfigurations = {
   /**
    * Define all user types — maps a user-type slug to its `Auth` model class so
@@ -183,6 +252,40 @@ type AuthConfigurations = {
    * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.
    */
   pageAuth?: PageAuthConfig;
+  /**
+   * Cookie auth session config — read by `authService.setAuthCookie` /
+   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own
+   * defaults (`name: "access_token"`, `path: "/"`).
+   */
+  cookie?: CookieAuthConfig;
+  /**
+   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.
+   */
+  csrf?: CsrfConfig;
+  /**
+   * Email verification — token lifetime, verified field, notification override.
+   */
+  verification?: EmailVerificationConfig;
+  /**
+   * Password reset — token lifetime, lookup field, notification and password-writer overrides.
+   */
+  passwordReset?: PasswordResetConfig;
+  /**
+   * One-time token (verification / reset) storage — model override.
+   */
+  oneTimeToken?: OneTimeTokenConfig;
+  /**
+   * Redirect login providers (`google`, `custom`) and account-linking policy.
+   */
+  providers?: ProvidersConfig;
+  /**
+   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.
+   */
+  passkeys?: PasskeysConfig;
+  /**
+   * Phone one-time-code login — channel, lifetime, attempts, delivery.
+   */
+  otp?: OtpConfig;
   /**
    * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.
    */
@@ -241,6 +344,61 @@ type LoginResult<UserType extends Auth> = {
   user: UserType;
   tokens: TokenPair;
 };
+/**
+ * Configuration for the cookie an app opts into via `authService.setAuthCookie`
+ * / `clearAuthCookie` and reads back with `authMiddleware([], "cookie:<name>")`.
+ * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT
+ * configurable here — they come from core's `secureCookieDefaults()`, the
+ * same floor every `response.cookie()` call gets, so a cookie auth session can
+ * never be weakened to a laxer policy than the framework default.
+ */
+type CookieAuthConfig = {
+  /**
+   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a
+   * `cookie:<name>` token source must match to read it back.
+   * @default "access_token"
+   */
+  name?: string;
+  /**
+   * Cookie `Path` attribute.
+   * @default "/"
+   */
+  path?: string;
+};
+/**
+ * CSRF Origin-check configuration. Read via
+ * `authConfig.csrf.allowedOrigins()`.
+ */
+type CsrfConfig = {
+  /**
+   * Extra origins allowed on a cookie-authenticated unsafe-method request,
+   * in addition to the request's own origin.
+   * @default []
+   */
+  allowedOrigins?: string[];
+};
+/**
+ * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted
+ * falls back to `auth.cookie.*` config, then the package default. Cookie
+ * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —
+ * see {@link CookieAuthConfig}.
+ */
+type SetAuthCookieOptions = {
+  /** Cookie name; defaults to `auth.cookie.name` (package default `"access_token"`). */name?: string; /** Cookie `Path`; defaults to `auth.cookie.path` (package default `"/"`). */
+  path?: string;
+  /**
+   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would
+   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a
+   * bare token string with no `maxAge` produces a session cookie (cleared
+   * when the browser closes).
+   */
+  maxAge?: number;
+};
+/** Per-call overrides for {@link AuthService.clearAuthCookie}. */
+type ClearAuthCookieOptions = {
+  /** Cookie name; defaults to `auth.cookie.name` (package default `"access_token"`). */name?: string; /** Cookie `Path`; defaults to `auth.cookie.path` (package default `"/"`). Must match the `Path` the cookie was set with. */
+  path?: string;
+};
 //#endregion
-export { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, CanAuthenticate, DeviceInfo, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshTokenConfig, TokenFrom, TokenPair };
+export { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair };
 //# sourceMappingURL=types.d.mts.map

package/esm/contracts/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;AAyBA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;AAAqB;cAVR,aAAA;;;;;;KAOD,0BAAA;;KAGA,SAAA;AAMZ;AAAA,KAHY,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;;;;;KASE,iBAAA;EAeE;;;AAUH;AAMX;EAzBE,KAAA,UAAe,WAAA;;;;EAIf,MAAA;EA+BA;;;;EA1BA,SAAA,GAAY,SAAS;EAsDrB;;;AAA+C;AASjD;;;;;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAsDR;;;;EAjDF,KAAA,UAAe,YAAA;EAoDkC;AAAA;AAYnD;;EA3DE,OAAA;EAiEA;AAMc;AAGhB;;EArEE,MAAA;EA2EiC;;;;;;;EAnEjC,SAAA;EA2FqB;;;;EAtFrB,QAAA;EAoEA;;;;EA/DA,UAAA;EAuEe;;;;EAlEf,kBAAA,GAAqB,0BAA0B;AAAA;AA4E1B;AAGvB;;;;AAQW;AAXY,KAnEX,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EAoGA;;;;;EA9FV,SAAA;EAgGiB;;;;;EA1FjB,cAAc;AAAA;AAAA,KAGJ,kBAAA;EAuFO;AAAA;;;EAlFjB,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA;;;;;EAMjC,eAAA,GAAkB,eAAA;;;;EAIlB,WAAA,GAAc,iBAAA;;;;EAId,YAAA,GAAe,kBAAA;;;;;;EAMf,QAAA,GAAW,cAAA;;;;EAIX,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;AA2BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;;AAAA,KANY,0BAAA;;KAGA,SAAA;AAGmD;AAAA,KAAnD,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;AASV;;;;;;AAAA,KAAY,iBAAA;EAeV;;;;AAUS;EAnBT,KAAA,UAAe,WAAA;EAyBa;;;EArB5B,MAAA;EA0Be;;;;EArBf,SAAA,GAAY,SAAS;EAiDrB;;;;AAK+C;AASjD;;;;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAqDR;;;;EAhDF,KAAA,UAAe,YAAA;EAoDQ;;AAA0B;AAYnD;EA3DE,OAAA;;;AAuEc;AAMhB;EAxEE,MAAA;;;;;;;;EAQA,SAAA;EA6EU;;;;EAxEV,QAAA;EAyEW;;;;EApEX,UAAA;EAoEmD;AAIrD;;;EAnEE,kBAAA,GAAqB,0BAA0B;AAAA;;;;AAmEc;AAG/D;;KA7DY,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;AAuErB;AAM9B;KAjEY,cAAA;;;;;;EAMV,SAAA;EAgEA;;;;;EA1DA,cAAc;AAAA;;;AA0Ec;KApElB,4BAAA;EA0EkB,iFAxE5B,KAAA,UA0EA;EAxEA,SAAA,EAAW,IAAI,EA2EL;EAzEV,GAAA;AAAA;;;;;KAOU,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EAqHW;;;;EAhHrB,SAAA;EAsDiC;;;;;EAhDjC,KAAA,WA8De;EA5Df,YAAA,GAAe,gBAAA,EAkEJ;EAhEX,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EA4EV;;;;EAvEA,SAAA;EA+EY;;;;EA1EZ,eAAA,WAsFA;EApFA,YAAA,GAAe,gBAAA,EAoFM;EAlFrB,GAAA,GAAM,sBAAA;EAqFI;;;;AAQD;AAMX;EA5FE,WAAA,GAAc,cAAA;AAAA;;;;KAMJ,kBAAA;EA8FK,kEA5Ff,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA+FU;;;;EA1FpB,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA;EA8GjC;;;AAAgB;EAxGhB,eAAA,GAAkB,eAAA;EA2GG;;;EAvGrB,WAAA,GAAc,iBAAA;EAyGN;;;EArGR,YAAA,GAAe,kBAAA;EAmGwB;;;;;EA7FvC,QAAA,GAAW,cAAA;EA+FM;AAWnB;;;;EApGE,MAAA,GAAS,gBAAA;EAsHC;;;EAlHV,IAAA,GAAO,UAAA;EAwHO;AAShB;;EA7HE,YAAA,GAAe,uBAAA;EA6He;;;EAzH9B,aAAA,GAAgB,mBAAA;EAoIV;AAAA;AAIR;EApIE,YAAA,GAAe,kBAAA;;;AAwIX;EApIJ,SAAA,GAAY,eAAA;;;;EAIZ,QAAA,GAAW,cAAA;;;;EAIX,GAAA,GAAM,SAAA;;;;EAIN,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;;;;;;;;KAWE,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,IAAI;AAAA;;;;;KAOM,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}