@warlock.js/auth 5.12.0 → 5.14.0

package/esm/providers/google-provider.mjs

@@ -0,0 +1,105 @@
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { loadOptionalPeer } from "../services/optional-peer.mjs";
+import { createHash } from "node:crypto";
+
+//#region ../auth/src/providers/google-provider.ts
+const AUTHORIZATION_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const JWKS_URI = "https://www.googleapis.com/oauth2/v3/certs";
+const ISSUERS = ["https://accounts.google.com", "accounts.google.com"];
+const DEFAULT_SCOPES = [
+	"openid",
+	"email",
+	"profile"
+];
+/** The `warlock add` feature that installs `jose`. */
+const GOOGLE_AUTH_FEATURE = "auth-google";
+/** Google's key set, created once per process; `jose` caches the fetched JWKS inside it. */
+let googleKeySet;
+/** PKCE S256 code challenge for a verifier. */
+function pkceChallenge(codeVerifier) {
+	return createHash("sha256").update(codeVerifier).digest("base64url");
+}
+/**
+* Google sign-in: OpenID Connect authorization code flow with PKCE (S256),
+* `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token
+* is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the
+* client id, `exp`), then its `nonce` is compared. No Google SDK.
+*/
+var GoogleProvider = class {
+	constructor(settings) {
+		this.settings = settings;
+		this.name = "google";
+	}
+	authorizationUrl(state) {
+		const url = new URL(AUTHORIZATION_ENDPOINT);
+		url.searchParams.set("client_id", this.settings.clientId);
+		url.searchParams.set("redirect_uri", this.settings.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", (this.settings.scopes ?? DEFAULT_SCOPES).join(" "));
+		url.searchParams.set("state", state.state);
+		url.searchParams.set("nonce", state.nonce);
+		url.searchParams.set("code_challenge", pkceChallenge(state.codeVerifier));
+		url.searchParams.set("code_challenge_method", "S256");
+		return url.toString();
+	}
+	async handleCallback({ query, expected }) {
+		const jose = await loadOptionalPeer("jose", GOOGLE_AUTH_FEATURE);
+		const code = query.code;
+		if (typeof code !== "string" || code.length === 0) throw new InvalidProviderCallbackError("missing-code");
+		const idToken = await this.exchangeCode(code, expected.codeVerifier);
+		const claims = await this.verifyIdToken(jose, idToken);
+		if (typeof claims.nonce !== "string" || claims.nonce !== expected.nonce) throw new InvalidProviderCallbackError("nonce-mismatch");
+		if (typeof claims.sub !== "string" || claims.sub.length === 0) throw new InvalidProviderCallbackError("missing-subject");
+		return {
+			provider: this.name,
+			providerUserId: claims.sub,
+			email: typeof claims.email === "string" ? claims.email : void 0,
+			emailVerified: claims.email_verified === true,
+			name: typeof claims.name === "string" ? claims.name : void 0,
+			avatar: typeof claims.picture === "string" ? claims.picture : void 0,
+			raw: claims
+		};
+	}
+	/** Redeem the authorization code (with the PKCE verifier) for an id_token. */
+	async exchangeCode(code, codeVerifier) {
+		let body;
+		try {
+			const response = await fetch(TOKEN_ENDPOINT, {
+				method: "POST",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: new URLSearchParams({
+					code,
+					client_id: this.settings.clientId,
+					client_secret: this.settings.clientSecret,
+					redirect_uri: this.settings.redirectUri,
+					grant_type: "authorization_code",
+					code_verifier: codeVerifier
+				})
+			});
+			if (!response.ok) throw new Error(`Google token endpoint answered ${response.status}`);
+			body = await response.json();
+		} catch (error) {
+			throw new InvalidProviderCallbackError("code-exchange-failed", error);
+		}
+		if (typeof body.id_token !== "string") throw new InvalidProviderCallbackError("missing-id-token");
+		return body.id_token;
+	}
+	/** Verify signature, issuer, audience and expiry; resolve the claims. */
+	async verifyIdToken(jose, idToken) {
+		googleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));
+		try {
+			const { payload } = await jose.jwtVerify(idToken, googleKeySet, {
+				issuer: ISSUERS,
+				audience: this.settings.clientId
+			});
+			return payload;
+		} catch (error) {
+			throw new InvalidProviderCallbackError("invalid-id-token", error);
+		}
+	}
+};
+
+//#endregion
+export { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge };
+//# sourceMappingURL=google-provider.mjs.map

package/esm/providers/google-provider.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/google-provider.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type {\n  AuthProvider,\n  GoogleProviderConfig,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { loadOptionalPeer } from \"../services/optional-peer\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://accounts.google.com/o/oauth2/v2/auth\";\nconst TOKEN_ENDPOINT = \"https://oauth2.googleapis.com/token\";\nconst JWKS_URI = \"https://www.googleapis.com/oauth2/v3/certs\";\nconst ISSUERS = [\"https://accounts.google.com\", \"accounts.google.com\"];\nconst DEFAULT_SCOPES = [\"openid\", \"email\", \"profile\"];\n\n/** The `warlock add` feature that installs `jose`. */\nexport const GOOGLE_AUTH_FEATURE = \"auth-google\";\n\n/** The slice of `jose` the Google provider uses — declared locally because `jose` is an optional peer. */\nexport type JoseModule = {\n  createRemoteJWKSet: (url: URL) => unknown;\n  jwtVerify: (\n    token: string,\n    key: unknown,\n    options: { issuer: string[]; audience: string },\n  ) => Promise<{ payload: Record<string, unknown> }>;\n};\n\n/** Google's key set, created once per process; `jose` caches the fetched JWKS inside it. */\nlet googleKeySet: unknown;\n\n/** PKCE S256 code challenge for a verifier. */\nexport function pkceChallenge(codeVerifier: string): string {\n  return createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n}\n\n/**\n * Google sign-in: OpenID Connect authorization code flow with PKCE (S256),\n * `state` and `nonce`. The code is exchanged with plain `fetch`; the id_token\n * is verified with `jose` against Google's JWKS (signature, `iss`, `aud` = the\n * client id, `exp`), then its `nonce` is compared. No Google SDK.\n */\nexport class GoogleProvider implements AuthProvider {\n  public readonly name = \"google\";\n\n  public constructor(private readonly settings: GoogleProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"nonce\", state.nonce);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    // Load the peer first: a missing SDK fails loudly before any network call.\n    const jose = await loadOptionalPeer<JoseModule>(\"jose\", GOOGLE_AUTH_FEATURE);\n\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const idToken = await this.exchangeCode(code, expected.codeVerifier);\n    const claims = await this.verifyIdToken(jose, idToken);\n\n    if (typeof claims.nonce !== \"string\" || claims.nonce !== expected.nonce) {\n      throw new InvalidProviderCallbackError(\"nonce-mismatch\");\n    }\n\n    if (typeof claims.sub !== \"string\" || claims.sub.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: claims.sub,\n      email: typeof claims.email === \"string\" ? claims.email : undefined,\n      // Google sends a boolean; anything else counts as NOT verified.\n      emailVerified: claims.email_verified === true,\n      name: typeof claims.name === \"string\" ? claims.name : undefined,\n      avatar: typeof claims.picture === \"string\" ? claims.picture : undefined,\n      raw: claims,\n    };\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an id_token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { id_token?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          client_secret: this.settings.clientSecret,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Google token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { id_token?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (typeof body.id_token !== \"string\") {\n      throw new InvalidProviderCallbackError(\"missing-id-token\");\n    }\n\n    return body.id_token;\n  }\n\n  /** Verify signature, issuer, audience and expiry; resolve the claims. */\n  private async verifyIdToken(jose: JoseModule, idToken: string): Promise<Record<string, unknown>> {\n    googleKeySet ??= jose.createRemoteJWKSet(new URL(JWKS_URI));\n\n    try {\n      const { payload } = await jose.jwtVerify(idToken, googleKeySet, {\n        issuer: ISSUERS,\n        audience: this.settings.clientId,\n      });\n\n      return payload;\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"invalid-id-token\", error);\n    }\n  }\n}\n"],"mappings":";;;;;AAWA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,WAAW;AACjB,MAAM,UAAU,CAAC,+BAA+B,qBAAqB;AACrE,MAAM,iBAAiB;CAAC;CAAU;CAAS;AAAS;;AAGpD,MAAa,sBAAsB;;AAanC,IAAI;;AAGJ,SAAgB,cAAc,cAA8B;CAC1D,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,WAAW;AACrE;;;;;;;AAQA,IAAa,iBAAb,MAAoD;CAGlD,AAAO,YAAY,AAAiB,UAAgC;EAAhC;cAFb;CAE8C;CAErE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EAEnD,MAAM,OAAO,MAAM,iBAA6B,QAAQ,mBAAmB;EAE3E,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,UAAU,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACnE,MAAM,SAAS,MAAM,KAAK,cAAc,MAAM,OAAO;EAErD,IAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,SAAS,OAChE,MAAM,IAAI,6BAA6B,gBAAgB;EAGzD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,GAC1D,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,OAAO;GACvB,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;GAEzD,eAAe,OAAO,mBAAmB;GACzC,MAAM,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;GACtD,QAAQ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;GAC9D,KAAK;EACP;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,eAAe,KAAK,SAAS;KAC7B,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,kCAAkC,SAAS,QAAQ;GAGrE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,OAAO,KAAK,aAAa,UAC3B,MAAM,IAAI,6BAA6B,kBAAkB;EAG3D,OAAO,KAAK;CACd;;CAGA,MAAc,cAAc,MAAkB,SAAmD;EAC/F,iBAAiB,KAAK,mBAAmB,IAAI,IAAI,QAAQ,CAAC;EAE1D,IAAI;GACF,MAAM,EAAE,YAAY,MAAM,KAAK,UAAU,SAAS,cAAc;IAC9D,QAAQ;IACR,UAAU,KAAK,SAAS;GAC1B,CAAC;GAED,OAAO;EACT,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,oBAAoB,KAAK;EAClE;CACF;AACF"}

package/esm/providers/index.d.mts

@@ -0,0 +1,2 @@
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";

package/esm/providers/index.mjs

@@ -0,0 +1,4 @@
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./provider-login.mjs";
+
+export {  };

package/esm/providers/provider-login.d.mts

@@ -0,0 +1,43 @@
+import { Auth } from "../models/auth.model.mjs";
+import { AuthProvider } from "../contracts/providers.mjs";
+import { DeviceInfo, LoginResult } from "../contracts/types.mjs";
+import { Request, Response } from "@warlock.js/core";
+import { ChildModel } from "@warlock.js/cascade";
+
+//#region ../auth/src/providers/provider-login.d.ts
+/**
+ * Resolve a provider by name: `google` from `auth.providers.google`, anything
+ * else from `auth.providers.custom`. Throws naming the config key when absent.
+ */
+declare function resolveAuthProvider(name: string): AuthProvider;
+/**
+ * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store
+ * them in a signed 10-minute cookie, and resolve the provider URL to redirect
+ * the browser to.
+ *
+ * @example
+ * // GET /auth/google
+ * export const googleRedirect: RequestHandler = async (_request, response) =>
+ *   response.redirect(await startProviderLogin(response, "google"));
+ */
+declare function startProviderLogin(response: Response, providerName: string): Promise<string>;
+/**
+ * Finish a redirect login on the provider's callback: consume the state
+ * cookie, reject a missing/forged/expired cookie, a cookie from another
+ * provider, a provider-reported error or a `state` mismatch; let the provider
+ * verify the callback; find-or-link the user; then log them in through
+ * `authService.completeLogin` — the same outcome as password login.
+ *
+ * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.
+ * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.
+ * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.
+ *
+ * @example
+ * // GET /auth/google/callback
+ * const { user, tokens } = await completeProviderLogin(User, "google", request, response);
+ * authService.setAuthCookie(response, tokens.accessToken);
+ */
+declare function completeProviderLogin<T extends Auth>(Model: ChildModel<T>, providerName: string, request: Request, response: Response, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+//#endregion
+export { completeProviderLogin, resolveAuthProvider, startProviderLogin };
+//# sourceMappingURL=provider-login.d.mts.map

package/esm/providers/provider-login.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-login.d.mts","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"mappings":";;;;;;;;;AAiBA;;iBAAgB,mBAAA,CAAoB,IAAA,WAAe,YAAY;;AAAA;AA4B/D;;;;;;;;iBAAsB,kBAAA,CACpB,QAAA,EAAU,QAAA,EACV,YAAA,WACC,OAAO;AAAA;AAgCV;;;;;;;;;;;;;;;AAhCU,iBAgCY,qBAAA,WAAgC,IAAA,EACpD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,YAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}

package/esm/providers/provider-login.mjs

@@ -0,0 +1,86 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { authService } from "../services/auth.service.mjs";
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { safeEqual } from "../utils/safe-equal.mjs";
+import { GoogleProvider } from "./google-provider.mjs";
+import { randomUrlSafe, takeProviderState, writeProviderState } from "./provider-state-cookie.mjs";
+import { resolveProviderUser } from "./resolve-provider-user.mjs";
+
+//#region ../auth/src/providers/provider-login.ts
+/**
+* Resolve a provider by name: `google` from `auth.providers.google`, anything
+* else from `auth.providers.custom`. Throws naming the config key when absent.
+*/
+function resolveAuthProvider(name) {
+	if (name === "google") {
+		const google = authConfig.providers.google();
+		if (google) return new GoogleProvider(google);
+	} else {
+		const custom = authConfig.providers.custom(name);
+		if (custom) return custom;
+	}
+	throw new Error(`@warlock.js/auth: no login provider "${name}" — configure \`auth.providers.${name === "google" ? "google" : `custom.${name}`}\`.`);
+}
+/**
+* Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store
+* them in a signed 10-minute cookie, and resolve the provider URL to redirect
+* the browser to.
+*
+* @example
+* // GET /auth/google
+* export const googleRedirect: RequestHandler = async (_request, response) =>
+*   response.redirect(await startProviderLogin(response, "google"));
+*/
+async function startProviderLogin(response, providerName) {
+	const provider = resolveAuthProvider(providerName);
+	const state = {
+		state: randomUrlSafe(),
+		nonce: randomUrlSafe(),
+		codeVerifier: randomUrlSafe()
+	};
+	const url = await provider.authorizationUrl(state);
+	writeProviderState(response, provider.name, state);
+	return url;
+}
+/**
+* Finish a redirect login on the provider's callback: consume the state
+* cookie, reject a missing/forged/expired cookie, a cookie from another
+* provider, a provider-reported error or a `state` mismatch; let the provider
+* verify the callback; find-or-link the user; then log them in through
+* `authService.completeLogin` — the same outcome as password login.
+*
+* @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.
+* @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.
+* @throws AuthProviderSdkMissingError when the provider's SDK is not installed.
+*
+* @example
+* // GET /auth/google/callback
+* const { user, tokens } = await completeProviderLogin(User, "google", request, response);
+* authService.setAuthCookie(response, tokens.accessToken);
+*/
+async function completeProviderLogin(Model, providerName, request, response, deviceInfo) {
+	const provider = resolveAuthProvider(providerName);
+	const expected = takeProviderState(request, response);
+	if (!expected) throw new InvalidProviderCallbackError("missing-or-invalid-state-cookie");
+	if (expected.provider !== provider.name) throw new InvalidProviderCallbackError("state-cookie-for-another-provider");
+	const query = {
+		code: request.input("code"),
+		state: request.input("state"),
+		error: request.input("error")
+	};
+	if (query.error) throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);
+	if (typeof query.state !== "string" || !safeEqual(query.state, expected.state)) throw new InvalidProviderCallbackError("state-mismatch");
+	const user = await resolveProviderUser(Model, await provider.handleCallback({
+		query,
+		expected: {
+			state: expected.state,
+			nonce: expected.nonce,
+			codeVerifier: expected.codeVerifier
+		}
+	}));
+	return authService.completeLogin(user, deviceInfo);
+}
+
+//#endregion
+export { completeProviderLogin, resolveAuthProvider, startProviderLogin };
+//# sourceMappingURL=provider-login.mjs.map

package/esm/providers/provider-login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-login.mjs","names":[],"sources":["../../../../../../../auth/src/providers/provider-login.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { Request, Response } from \"@warlock.js/core\";\nimport type { AuthProvider } from \"../contracts/providers\";\nimport type { DeviceInfo, LoginResult } from \"../contracts/types\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"../services/auth-config\";\nimport { authService } from \"../services/auth.service\";\nimport { GoogleProvider } from \"./google-provider\";\nimport { safeEqual } from \"../utils/safe-equal\";\nimport { randomUrlSafe, takeProviderState, writeProviderState } from \"./provider-state-cookie\";\nimport { resolveProviderUser } from \"./resolve-provider-user\";\n\n/**\n * Resolve a provider by name: `google` from `auth.providers.google`, anything\n * else from `auth.providers.custom`. Throws naming the config key when absent.\n */\nexport function resolveAuthProvider(name: string): AuthProvider {\n  if (name === \"google\") {\n    const google = authConfig.providers.google();\n\n    if (google) return new GoogleProvider(google);\n  } else {\n    const custom = authConfig.providers.custom(name);\n\n    if (custom) return custom;\n  }\n\n  throw new Error(\n    `@warlock.js/auth: no login provider \"${name}\" — configure \\`auth.providers.${\n      name === \"google\" ? \"google\" : `custom.${name}`\n    }\\`.`,\n  );\n}\n\n/**\n * Start a redirect login: generate `state`, `nonce` and a PKCE verifier, store\n * them in a signed 10-minute cookie, and resolve the provider URL to redirect\n * the browser to.\n *\n * @example\n * // GET /auth/google\n * export const googleRedirect: RequestHandler = async (_request, response) =>\n *   response.redirect(await startProviderLogin(response, \"google\"));\n */\nexport async function startProviderLogin(\n  response: Response,\n  providerName: string,\n): Promise<string> {\n  const provider = resolveAuthProvider(providerName);\n\n  const state = {\n    state: randomUrlSafe(),\n    nonce: randomUrlSafe(),\n    codeVerifier: randomUrlSafe(),\n  };\n\n  const url = await provider.authorizationUrl(state);\n\n  writeProviderState(response, provider.name, state);\n\n  return url;\n}\n\n/**\n * Finish a redirect login on the provider's callback: consume the state\n * cookie, reject a missing/forged/expired cookie, a cookie from another\n * provider, a provider-reported error or a `state` mismatch; let the provider\n * verify the callback; find-or-link the user; then log them in through\n * `authService.completeLogin` — the same outcome as password login.\n *\n * @throws InvalidProviderCallbackError (400, EC009) for any callback rejection.\n * @throws ProviderEmailNotVerifiedError (403, EC010) for an unlinked, unverified email.\n * @throws AuthProviderSdkMissingError when the provider's SDK is not installed.\n *\n * @example\n * // GET /auth/google/callback\n * const { user, tokens } = await completeProviderLogin(User, \"google\", request, response);\n * authService.setAuthCookie(response, tokens.accessToken);\n */\nexport async function completeProviderLogin<T extends Auth>(\n  Model: ChildModel<T>,\n  providerName: string,\n  request: Request,\n  response: Response,\n  deviceInfo?: DeviceInfo,\n): Promise<LoginResult<T>> {\n  const provider = resolveAuthProvider(providerName);\n  const expected = takeProviderState(request, response);\n\n  if (!expected) {\n    throw new InvalidProviderCallbackError(\"missing-or-invalid-state-cookie\");\n  }\n\n  if (expected.provider !== provider.name) {\n    throw new InvalidProviderCallbackError(\"state-cookie-for-another-provider\");\n  }\n\n  const query: Record<string, unknown> = {\n    code: request.input(\"code\"),\n    state: request.input(\"state\"),\n    error: request.input(\"error\"),\n  };\n\n  if (query.error) {\n    throw new InvalidProviderCallbackError(`provider-error:${String(query.error)}`);\n  }\n\n  if (typeof query.state !== \"string\" || !safeEqual(query.state, expected.state)) {\n    throw new InvalidProviderCallbackError(\"state-mismatch\");\n  }\n\n  const profile = await provider.handleCallback({\n    query,\n    expected: { state: expected.state, nonce: expected.nonce, codeVerifier: expected.codeVerifier },\n  });\n\n  const user = await resolveProviderUser(Model, profile);\n\n  return authService.completeLogin(user, deviceInfo);\n}\n"],"mappings":";;;;;;;;;;;;;AAiBA,SAAgB,oBAAoB,MAA4B;CAC9D,IAAI,SAAS,UAAU;EACrB,MAAM,SAAS,WAAW,UAAU,OAAO;EAE3C,IAAI,QAAQ,OAAO,IAAI,eAAe,MAAM;CAC9C,OAAO;EACL,MAAM,SAAS,WAAW,UAAU,OAAO,IAAI;EAE/C,IAAI,QAAQ,OAAO;CACrB;CAEA,MAAM,IAAI,MACR,wCAAwC,KAAK,iCAC3C,SAAS,WAAW,WAAW,UAAU,OAC1C,IACH;AACF;;;;;;;;;;;AAYA,eAAsB,mBACpB,UACA,cACiB;CACjB,MAAM,WAAW,oBAAoB,YAAY;CAEjD,MAAM,QAAQ;EACZ,OAAO,cAAc;EACrB,OAAO,cAAc;EACrB,cAAc,cAAc;CAC9B;CAEA,MAAM,MAAM,MAAM,SAAS,iBAAiB,KAAK;CAEjD,mBAAmB,UAAU,SAAS,MAAM,KAAK;CAEjD,OAAO;AACT;;;;;;;;;;;;;;;;;AAkBA,eAAsB,sBACpB,OACA,cACA,SACA,UACA,YACyB;CACzB,MAAM,WAAW,oBAAoB,YAAY;CACjD,MAAM,WAAW,kBAAkB,SAAS,QAAQ;CAEpD,IAAI,CAAC,UACH,MAAM,IAAI,6BAA6B,iCAAiC;CAG1E,IAAI,SAAS,aAAa,SAAS,MACjC,MAAM,IAAI,6BAA6B,mCAAmC;CAG5E,MAAM,QAAiC;EACrC,MAAM,QAAQ,MAAM,MAAM;EAC1B,OAAO,QAAQ,MAAM,OAAO;EAC5B,OAAO,QAAQ,MAAM,OAAO;CAC9B;CAEA,IAAI,MAAM,OACR,MAAM,IAAI,6BAA6B,kBAAkB,OAAO,MAAM,KAAK,GAAG;CAGhF,IAAI,OAAO,MAAM,UAAU,YAAY,CAAC,UAAU,MAAM,OAAO,SAAS,KAAK,GAC3E,MAAM,IAAI,6BAA6B,gBAAgB;CAQzD,MAAM,OAAO,MAAM,oBAAoB,OAAO,MALxB,SAAS,eAAe;EAC5C;EACA,UAAU;GAAE,OAAO,SAAS;GAAO,OAAO,SAAS;GAAO,cAAc,SAAS;EAAa;CAChG,CAAC,CAEoD;CAErD,OAAO,YAAY,cAAc,MAAM,UAAU;AACnD"}

package/esm/providers/provider-state-cookie.mjs

@@ -0,0 +1,63 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { safeEqual } from "../utils/safe-equal.mjs";
+import { createHmac, randomBytes } from "node:crypto";
+
+//#region ../auth/src/providers/provider-state-cookie.ts
+/** Cookie carrying a redirect login's state from the start to the callback. */
+const PROVIDER_STATE_COOKIE = "auth_provider_state";
+/** How long a started provider login stays completable. */
+const PROVIDER_STATE_TTL_SECONDS = 600;
+/** 32 random bytes, base64url — used for `state`, `nonce` and the PKCE verifier. */
+function randomUrlSafe() {
+	return randomBytes(32).toString("base64url");
+}
+/**
+* HMAC over the payload with a key DERIVED from the access-token secret, so
+* the state cookie never shares a MAC key with the JWTs themselves.
+*/
+function sign(payload) {
+	return createHmac("sha256", createHmac("sha256", authConfig.accessToken.secret()).update("@warlock.js/auth:provider-state").digest()).update(payload).digest("base64url");
+}
+/**
+* Write the signed, 10-minute state cookie for a provider login. Attribute
+* flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come from the
+* `response.cookie()` secure defaults; `Lax` still rides the provider's
+* top-level GET redirect back to the app.
+*/
+function writeProviderState(response, provider, state) {
+	const stored = {
+		...state,
+		provider,
+		expiresAt: Date.now() + PROVIDER_STATE_TTL_SECONDS * 1e3
+	};
+	const payload = Buffer.from(JSON.stringify(stored)).toString("base64url");
+	response.cookie(PROVIDER_STATE_COOKIE, `${payload}.${sign(payload)}`, {
+		raw: true,
+		path: "/",
+		maxAge: PROVIDER_STATE_TTL_SECONDS
+	});
+}
+/**
+* Read AND clear the state cookie, so a started login completes at most once.
+* Resolves `undefined` for an absent, forged (bad MAC), malformed or expired
+* cookie.
+*/
+function takeProviderState(request, response) {
+	const raw = request.cookie(PROVIDER_STATE_COOKIE);
+	response.clearCookie(PROVIDER_STATE_COOKIE, { path: "/" });
+	if (typeof raw !== "string") return void 0;
+	const [payload, signature, ...rest] = raw.split(".");
+	if (!payload || !signature || rest.length > 0 || !safeEqual(signature, sign(payload))) return;
+	let stored;
+	try {
+		stored = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch {
+		return;
+	}
+	if (typeof stored?.state !== "string" || typeof stored.nonce !== "string" || typeof stored.codeVerifier !== "string" || typeof stored.provider !== "string" || typeof stored.expiresAt !== "number" || stored.expiresAt <= Date.now()) return;
+	return stored;
+}
+
+//#endregion
+export { randomUrlSafe, takeProviderState, writeProviderState };
+//# sourceMappingURL=provider-state-cookie.mjs.map

package/esm/providers/provider-state-cookie.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-state-cookie.mjs","names":[],"sources":["../../../../../../../auth/src/providers/provider-state-cookie.ts"],"sourcesContent":["import type { Request, Response } from \"@warlock.js/core\";\nimport { createHmac, randomBytes } from \"node:crypto\";\nimport type { ProviderAuthorizationState } from \"../contracts/providers\";\nimport { authConfig } from \"../services/auth-config\";\nimport { safeEqual } from \"../utils/safe-equal\";\n\n/** Cookie carrying a redirect login's state from the start to the callback. */\nexport const PROVIDER_STATE_COOKIE = \"auth_provider_state\";\n\n/** How long a started provider login stays completable. */\nconst PROVIDER_STATE_TTL_SECONDS = 600;\n\n/** What the signed cookie holds. */\nexport type StoredProviderState = ProviderAuthorizationState & {\n  provider: string;\n  expiresAt: number;\n};\n\n/** 32 random bytes, base64url — used for `state`, `nonce` and the PKCE verifier. */\nexport function randomUrlSafe(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * HMAC over the payload with a key DERIVED from the access-token secret, so\n * the state cookie never shares a MAC key with the JWTs themselves.\n */\nfunction sign(payload: string): string {\n  const key = createHmac(\"sha256\", authConfig.accessToken.secret())\n    .update(\"@warlock.js/auth:provider-state\")\n    .digest();\n\n  return createHmac(\"sha256\", key).update(payload).digest(\"base64url\");\n}\n\n/**\n * Write the signed, 10-minute state cookie for a provider login. Attribute\n * flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come from the\n * `response.cookie()` secure defaults; `Lax` still rides the provider's\n * top-level GET redirect back to the app.\n */\nexport function writeProviderState(\n  response: Response,\n  provider: string,\n  state: ProviderAuthorizationState,\n): void {\n  const stored: StoredProviderState = {\n    ...state,\n    provider,\n    expiresAt: Date.now() + PROVIDER_STATE_TTL_SECONDS * 1000,\n  };\n  const payload = Buffer.from(JSON.stringify(stored)).toString(\"base64url\");\n\n  response.cookie(PROVIDER_STATE_COOKIE, `${payload}.${sign(payload)}`, {\n    raw: true,\n    path: \"/\",\n    maxAge: PROVIDER_STATE_TTL_SECONDS,\n  });\n}\n\n/**\n * Read AND clear the state cookie, so a started login completes at most once.\n * Resolves `undefined` for an absent, forged (bad MAC), malformed or expired\n * cookie.\n */\nexport function takeProviderState(\n  request: Request,\n  response: Response,\n): StoredProviderState | undefined {\n  const raw: unknown = request.cookie(PROVIDER_STATE_COOKIE);\n\n  response.clearCookie(PROVIDER_STATE_COOKIE, { path: \"/\" });\n\n  if (typeof raw !== \"string\") return undefined;\n\n  const [payload, signature, ...rest] = raw.split(\".\");\n\n  if (!payload || !signature || rest.length > 0 || !safeEqual(signature, sign(payload))) {\n    return undefined;\n  }\n\n  let stored: Partial<StoredProviderState> | undefined;\n\n  try {\n    stored = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return undefined;\n  }\n\n  if (\n    typeof stored?.state !== \"string\" ||\n    typeof stored.nonce !== \"string\" ||\n    typeof stored.codeVerifier !== \"string\" ||\n    typeof stored.provider !== \"string\" ||\n    typeof stored.expiresAt !== \"number\" ||\n    stored.expiresAt <= Date.now()\n  ) {\n    return undefined;\n  }\n\n  return stored as StoredProviderState;\n}\n"],"mappings":";;;;;;AAOA,MAAa,wBAAwB;;AAGrC,MAAM,6BAA6B;;AASnC,SAAgB,gBAAwB;CACtC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;;;;;AAMA,SAAS,KAAK,SAAyB;CAKrC,OAAO,WAAW,UAJN,WAAW,UAAU,WAAW,YAAY,OAAO,CAAC,CAAC,CAC9D,OAAO,iCAAiC,CAAC,CACzC,OAE2B,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,WAAW;AACrE;;;;;;;AAQA,SAAgB,mBACd,UACA,UACA,OACM;CACN,MAAM,SAA8B;EAClC,GAAG;EACH;EACA,WAAW,KAAK,IAAI,IAAI,6BAA6B;CACvD;CACA,MAAM,UAAU,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,WAAW;CAExE,SAAS,OAAO,uBAAuB,GAAG,QAAQ,GAAG,KAAK,OAAO,KAAK;EACpE,KAAK;EACL,MAAM;EACN,QAAQ;CACV,CAAC;AACH;;;;;;AAOA,SAAgB,kBACd,SACA,UACiC;CACjC,MAAM,MAAe,QAAQ,OAAO,qBAAqB;CAEzD,SAAS,YAAY,uBAAuB,EAAE,MAAM,IAAI,CAAC;CAEzD,IAAI,OAAO,QAAQ,UAAU,OAAO;CAEpC,MAAM,CAAC,SAAS,WAAW,GAAG,QAAQ,IAAI,MAAM,GAAG;CAEnD,IAAI,CAAC,WAAW,CAAC,aAAa,KAAK,SAAS,KAAK,CAAC,UAAU,WAAW,KAAK,OAAO,CAAC,GAClF;CAGF,IAAI;CAEJ,IAAI;EACF,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACxE,QAAQ;EACN;CACF;CAEA,IACE,OAAO,QAAQ,UAAU,YACzB,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,cAAc,YAC5B,OAAO,aAAa,KAAK,IAAI,GAE7B;CAGF,OAAO;AACT"}

package/esm/providers/resolve-provider-user.mjs

@@ -0,0 +1,45 @@
+import { authConfig } from "../services/auth-config.mjs";
+import { InvalidProviderCallbackError } from "../errors/invalid-provider-callback.error.mjs";
+import { ProviderEmailNotVerifiedError } from "../errors/provider-email-not-verified.error.mjs";
+import { ProviderAccount } from "../models/provider-account/provider-account.model.mjs";
+import "../models/provider-account/index.mjs";
+
+//#region ../auth/src/providers/resolve-provider-user.ts
+/** Default creation for a first provider login: email, name, and the verified stamp. */
+async function createUserFor(Model, profile) {
+	const createUser = authConfig.providers.createUser();
+	if (createUser) return await createUser(profile, Model);
+	return await Model.create({
+		[authConfig.providers.emailField()]: profile.email,
+		...profile.name ? { name: profile.name } : {},
+		[authConfig.verification.field()]: /* @__PURE__ */ new Date()
+	});
+}
+/**
+* Find or create the app user for a provider profile, and link them.
+*
+* 1. An existing `provider_accounts` link wins — the provider's stable id, not
+*    the email, identifies the account from then on.
+* 2. Otherwise the provider email MUST be verified. An unverified (or absent)
+*    email throws {@link ProviderEmailNotVerifiedError} and nothing is linked
+*    or created: linking on it would let anyone who can add an unverified
+*    address at the provider take over the matching account.
+* 3. Verified: the user whose `auth.providers.emailField` matches, else a new
+*    user (`auth.providers.createUser`, or the default) — then the link is stored.
+*/
+async function resolveProviderUser(Model, profile) {
+	const link = await ProviderAccount.findLink(profile.provider, profile.providerUserId);
+	if (link) {
+		const linked = await Model.find(link.userId);
+		if (!linked || linked.userType !== link.userType) throw new InvalidProviderCallbackError("link-points-to-missing-user");
+		return linked;
+	}
+	if (!profile.emailVerified || !profile.email) throw new ProviderEmailNotVerifiedError();
+	const user = await Model.first({ [authConfig.providers.emailField()]: profile.email }) ?? await createUserFor(Model, profile);
+	await ProviderAccount.link(profile.provider, profile.providerUserId, user, profile.email);
+	return user;
+}
+
+//#endregion
+export { resolveProviderUser };
+//# sourceMappingURL=resolve-provider-user.mjs.map

package/esm/providers/resolve-provider-user.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-provider-user.mjs","names":[],"sources":["../../../../../../../auth/src/providers/resolve-provider-user.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { ProviderProfile } from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { ProviderEmailNotVerifiedError } from \"../errors/provider-email-not-verified.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { ProviderAccount } from \"../models/provider-account\";\nimport { authConfig } from \"../services/auth-config\";\n\n/** Default creation for a first provider login: email, name, and the verified stamp. */\nasync function createUserFor<T extends Auth>(\n  Model: ChildModel<T>,\n  profile: ProviderProfile,\n): Promise<T> {\n  const createUser = authConfig.providers.createUser();\n\n  if (createUser) {\n    return (await createUser(profile, Model as unknown as ChildModel<Auth>)) as T;\n  }\n\n  return (await Model.create({\n    [authConfig.providers.emailField()]: profile.email,\n    ...(profile.name ? { name: profile.name } : {}),\n    // The provider verified this address; record it the way verifyEmail does.\n    [authConfig.verification.field()]: new Date(),\n  } as never)) as T;\n}\n\n/**\n * Find or create the app user for a provider profile, and link them.\n *\n * 1. An existing `provider_accounts` link wins — the provider's stable id, not\n *    the email, identifies the account from then on.\n * 2. Otherwise the provider email MUST be verified. An unverified (or absent)\n *    email throws {@link ProviderEmailNotVerifiedError} and nothing is linked\n *    or created: linking on it would let anyone who can add an unverified\n *    address at the provider take over the matching account.\n * 3. Verified: the user whose `auth.providers.emailField` matches, else a new\n *    user (`auth.providers.createUser`, or the default) — then the link is stored.\n */\nexport async function resolveProviderUser<T extends Auth>(\n  Model: ChildModel<T>,\n  profile: ProviderProfile,\n): Promise<T> {\n  const link = await ProviderAccount.findLink(profile.provider, profile.providerUserId);\n\n  if (link) {\n    const linked = (await Model.find(link.userId)) as T | null;\n\n    if (!linked || linked.userType !== link.userType) {\n      throw new InvalidProviderCallbackError(\"link-points-to-missing-user\");\n    }\n\n    return linked;\n  }\n\n  if (!profile.emailVerified || !profile.email) {\n    throw new ProviderEmailNotVerifiedError();\n  }\n\n  const existing = (await Model.first({\n    [authConfig.providers.emailField()]: profile.email,\n  })) as T | null;\n\n  const user = existing ?? (await createUserFor(Model, profile));\n\n  await ProviderAccount.link(profile.provider, profile.providerUserId, user, profile.email);\n\n  return user;\n}\n"],"mappings":";;;;;;;;AASA,eAAe,cACb,OACA,SACY;CACZ,MAAM,aAAa,WAAW,UAAU,WAAW;CAEnD,IAAI,YACF,OAAQ,MAAM,WAAW,SAAS,KAAoC;CAGxE,OAAQ,MAAM,MAAM,OAAO;GACxB,WAAW,UAAU,WAAW,IAAI,QAAQ;EAC7C,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;GAE5C,WAAW,aAAa,MAAM,oBAAI,IAAI,KAAK;CAC9C,CAAU;AACZ;;;;;;;;;;;;;AAcA,eAAsB,oBACpB,OACA,SACY;CACZ,MAAM,OAAO,MAAM,gBAAgB,SAAS,QAAQ,UAAU,QAAQ,cAAc;CAEpF,IAAI,MAAM;EACR,MAAM,SAAU,MAAM,MAAM,KAAK,KAAK,MAAM;EAE5C,IAAI,CAAC,UAAU,OAAO,aAAa,KAAK,UACtC,MAAM,IAAI,6BAA6B,6BAA6B;EAGtE,OAAO;CACT;CAEA,IAAI,CAAC,QAAQ,iBAAiB,CAAC,QAAQ,OACrC,MAAM,IAAI,8BAA8B;CAO1C,MAAM,OAAO,MAJW,MAAM,MAAM,GACjC,WAAW,UAAU,WAAW,IAAI,QAAQ,MAC/C,CAAC,KAEyB,MAAM,cAAc,OAAO,OAAO;CAE5D,MAAM,gBAAgB,KAAK,QAAQ,UAAU,QAAQ,gBAAgB,MAAM,QAAQ,KAAK;CAExF,OAAO;AACT"}

package/esm/services/auth-config.mjs

@@ -42,6 +42,14 @@ function parseDuration(key, raw) {
 	if (typeof parsed !== "number" || !Number.isFinite(parsed) || parsed <= 0) throw new Error(`auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — use a positive duration string such as "1h", "7d", or NO_EXPIRATION.`);
 	return parsed;
 }
+/** Email-verification token lifetime used when nothing is configured. */
+const DEFAULT_VERIFICATION_EXPIRES_IN = "24h";
+/** Password-reset token lifetime used when nothing is configured. */
+const DEFAULT_PASSWORD_RESET_EXPIRES_IN = "60m";
+/** Passkey challenge lifetime used when nothing is configured. */
+const DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = "5m";
+/** OTP lifetime used when nothing is configured. */
+const DEFAULT_OTP_EXPIRES_IN = "5m";
 /** Access-token lifetime used when nothing is configured. */
 const DEFAULT_ACCESS_TOKEN_EXPIRES_IN = "1h";
 /**
@@ -122,6 +130,70 @@ const authConfig = {
 	* beyond the request's own origin. @default []
 	*/
 allowedOrigins: () => config.key("auth.csrf.allowedOrigins", []) },
+	verification: {
+		/** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default "24h" */
+		expiresInMs: () => parseDuration("verification.expiresIn", config.key("auth.verification.expiresIn", DEFAULT_VERIFICATION_EXPIRES_IN)),
+		/** User attribute stamped with the verification date. @default "emailVerifiedAt" */
+		field: () => config.key("auth.verification.field", "emailVerifiedAt"),
+		/** App notification replacing the default verification email. */
+		notification: () => config.key("auth.verification.notification"),
+		/** Link builder whose result is handed to the notification as `url`. */
+		url: () => config.key("auth.verification.url")
+	},
+	passwordReset: {
+		/** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default "60m" */
+		expiresInMs: () => parseDuration("passwordReset.expiresIn", config.key("auth.passwordReset.expiresIn", DEFAULT_PASSWORD_RESET_EXPIRES_IN)),
+		/** User attribute `requestPasswordReset` looks the account up by. @default "email" */
+		identifierField: () => config.key("auth.passwordReset.identifierField", "email"),
+		/** App notification replacing the default reset email. */
+		notification: () => config.key("auth.passwordReset.notification"),
+		/** Link builder whose result is handed to the notification as `url`. */
+		url: () => config.key("auth.passwordReset.url"),
+		/** App-owned password writer replacing the default. */
+		setPassword: () => config.key("auth.passwordReset.setPassword")
+	},
+	providers: {
+		/** `auth.providers.google`, when configured. */
+		google: () => config.key("auth.providers.google"),
+		/** An app-registered provider under `auth.providers.custom.<name>`. */
+		custom: (name) => config.key("auth.providers.custom", {})[name],
+		/** User attribute a verified provider email is matched against. @default "email" */
+		emailField: () => config.key("auth.providers.emailField", "email"),
+		/** App-owned user creation for a first provider login. */
+		createUser: () => config.key("auth.providers.createUser")
+	},
+	passkeys: {
+		/** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */
+		settings: () => {
+			const settings = config.key("auth.passkeys");
+			if (!settings?.rpID || !settings.rpName || !settings.origin) throw new Error("@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.");
+			return settings;
+		},
+		/** Allowed ceremony origins, as a list. */
+		origins: () => {
+			const { origin } = authConfig.passkeys.settings();
+			return Array.isArray(origin) ? origin : [origin];
+		},
+		/** Challenge lifetime in ms; throws naming the key when unusable. @default "5m" */
+		challengeExpiresInMs: () => parseDuration("passkeys.challengeExpiresIn", config.key("auth.passkeys.challengeExpiresIn", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN))
+	},
+	otp: {
+		/** Notifications channel the code is sent through. @default "sms" */
+		channel: () => config.key("auth.otp.channel", "sms"),
+		/** User attribute holding the phone number. @default "phone" */
+		phoneField: () => config.key("auth.otp.phoneField", "phone"),
+		/** Code lifetime in ms; throws naming the key when unusable. @default "5m" */
+		expiresInMs: () => parseDuration("otp.expiresIn", config.key("auth.otp.expiresIn", DEFAULT_OTP_EXPIRES_IN)),
+		/** Verify attempts before the code is invalidated. @default 5 */
+		maxAttempts: () => config.key("auth.otp.maxAttempts", 5),
+		/** The message text for a code. */
+		message: (code) => {
+			const build = config.key("auth.otp.message");
+			return build ? build(code) : `Your verification code is ${code}`;
+		},
+		/** App-owned delivery replacing the notifications channel send. */
+		send: () => config.key("auth.otp.send")
+	},
 	refreshToken: {
 		/** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */
 		secret: () => resolve("refreshToken.secret", "jwt.refresh.secret"),

package/esm/services/auth-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport ms from \"ms\";\r\nimport type { CanAuthenticate, LogoutWithoutTokenBehavior } from \"../contracts/types\";\r\nimport type { Auth } from \"../models/auth.model\";\r\n\r\nconst warnedLegacyKeys = new Set<string>();\r\n\r\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\r\n\r\n/**\r\n * `ms` accepts anything at runtime and answers `undefined` for a string it\r\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\r\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\r\n * `(value: ms.StringValue) => number`, which is exactly what let an\r\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\r\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\r\n * here, so every caller is forced to deal with the `undefined`.\r\n */\r\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\r\n\r\n/**\r\n * Turn a configured lifetime into a positive number of milliseconds, or throw\r\n * naming the key.\r\n *\r\n * A token lifetime is a security boundary, so an unusable value is a hard error\r\n * rather than a silent fallback: substituting a default would trade one\r\n * unintended lifetime for another, just as quietly — and quiet is the whole\r\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\r\n *\r\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\r\n *   claim** and an `Invalid Date` written to the token row.\r\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\r\n *   emits with **no `exp` claim** — it survives any guard that only rejects\r\n *   `undefined`. `\"-1h\"` signs an already-expired token.\r\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\r\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\r\n */\r\nfunction parseDuration(key: string, raw: unknown): number {\r\n  let parsed: number | string | undefined;\r\n\r\n  try {\r\n    parsed = parseMs(raw);\r\n  } catch {\r\n    // ms throws (rather than returning undefined) for \"\" and non-strings\r\n    parsed = undefined;\r\n  }\r\n\r\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\r\n    throw new Error(\r\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\r\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\r\n    );\r\n  }\r\n\r\n  return parsed;\r\n}\r\n\r\n/** Access-token lifetime used when nothing is configured. */\r\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\r\n\r\n/**\r\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\r\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\r\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\r\n *\r\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\r\n * keep working after the config split.\r\n */\r\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\r\n  const fromNew = config.key(`auth.${newKey}`);\r\n\r\n  if (fromNew !== undefined && fromNew !== null) {\r\n    return fromNew as T;\r\n  }\r\n\r\n  const fromLegacy = config.key(`auth.${legacyKey}`);\r\n\r\n  if (fromLegacy !== undefined && fromLegacy !== null) {\r\n    if (!warnedLegacyKeys.has(legacyKey)) {\r\n      warnedLegacyKeys.add(legacyKey);\r\n      log.warn(\"auth\", \"config-deprecation\", `auth.${legacyKey} is deprecated — use auth.${newKey}`);\r\n    }\r\n\r\n    return fromLegacy as T;\r\n  }\r\n\r\n  return fallback as T;\r\n}\r\n\r\n/**\r\n * Typed, backward-compatible access to auth configuration. The service and the\r\n * jwt signer read configuration exclusively through here, so the new split\r\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\r\n */\r\nexport const authConfig = {\r\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\r\n    const canAuthenticate = config.key<CanAuthenticate>(\r\n      \"auth.canAuthenticate\",\r\n      permitAuthentication,\r\n    );\r\n\r\n    return canAuthenticate(user);\r\n  },\r\n  accessToken: {\r\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\r\n    secret: (): string => {\r\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\r\n\r\n      if (!secret) {\r\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\r\n      }\r\n\r\n      return secret;\r\n    },\r\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\r\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\r\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\r\n     * to 1 hour when unset; throws naming the key when the configured value is\r\n     * not a positive `ms` duration. See {@link parseDuration}.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"accessToken.expiresIn\",\r\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\r\n      ),\r\n  },\r\n  pageAuth: {\r\n    /**\r\n     * Login path a guarded PAGE route redirects a logged-out browser to.\r\n     *\r\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\r\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\r\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\r\n     * navigating to a guarded page lands on the login screen instead of reading\r\n     * a raw JSON error blob. Finding b9ab9804.\r\n     */\r\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\r\n    /**\r\n     * Query parameter the redirect carries the originally-requested path in, so\r\n     * the login flow can send the user back where they were headed. Defaults to\r\n     * `\"returnUrl\"`.\r\n     */\r\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\r\n  },\r\n  cookie: {\r\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\r\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\r\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\r\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\r\n  },\r\n  csrf: {\r\n    /**\r\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n     * beyond the request's own origin. @default []\r\n     */\r\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\r\n  },\r\n  refreshToken: {\r\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\r\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\r\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\r\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\r\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\r\n     * naming the key when the configured value is not a positive `ms` duration.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\r\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\r\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\r\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\r\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\r\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\r\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\r\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\r\n  },\r\n};\r\n"],"mappings":";;;;;AAOA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KAAK,QAAQ,sBAAsB,QAAQ,UAAU,4BAA4B,QAAQ;EAC/F;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}
+{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport ms from \"ms\";\r\nimport type {\r\n  AuthNotification,\r\n  CanAuthenticate,\r\n  LogoutWithoutTokenBehavior,\r\n  OneTimeTokenUrlBuilder,\r\n  PasswordSetter,\r\n} from \"../contracts/types\";\r\nimport type {\r\n  AuthProvider,\r\n  GoogleProviderConfig,\r\n  OtpSender,\r\n  PasskeysConfig,\r\n  ProviderUserCreator,\r\n} from \"../contracts/providers\";\r\nimport type { Auth } from \"../models/auth.model\";\r\n\r\nconst warnedLegacyKeys = new Set<string>();\r\n\r\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\r\n\r\n/**\r\n * `ms` accepts anything at runtime and answers `undefined` for a string it\r\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\r\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\r\n * `(value: ms.StringValue) => number`, which is exactly what let an\r\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\r\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\r\n * here, so every caller is forced to deal with the `undefined`.\r\n */\r\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\r\n\r\n/**\r\n * Turn a configured lifetime into a positive number of milliseconds, or throw\r\n * naming the key.\r\n *\r\n * A token lifetime is a security boundary, so an unusable value is a hard error\r\n * rather than a silent fallback: substituting a default would trade one\r\n * unintended lifetime for another, just as quietly — and quiet is the whole\r\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\r\n *\r\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\r\n *   claim** and an `Invalid Date` written to the token row.\r\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\r\n *   emits with **no `exp` claim** — it survives any guard that only rejects\r\n *   `undefined`. `\"-1h\"` signs an already-expired token.\r\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\r\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\r\n */\r\nfunction parseDuration(key: string, raw: unknown): number {\r\n  let parsed: number | string | undefined;\r\n\r\n  try {\r\n    parsed = parseMs(raw);\r\n  } catch {\r\n    // ms throws (rather than returning undefined) for \"\" and non-strings\r\n    parsed = undefined;\r\n  }\r\n\r\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\r\n    throw new Error(\r\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\r\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\r\n    );\r\n  }\r\n\r\n  return parsed;\r\n}\r\n\r\n/** Email-verification token lifetime used when nothing is configured. */\r\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\r\n\r\n/** Password-reset token lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\r\n\r\n/** Passkey challenge lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\r\n\r\n/** OTP lifetime used when nothing is configured. */\r\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\r\n\r\n/** Access-token lifetime used when nothing is configured. */\r\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\r\n\r\n/**\r\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\r\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\r\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\r\n *\r\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\r\n * keep working after the config split.\r\n */\r\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\r\n  const fromNew = config.key(`auth.${newKey}`);\r\n\r\n  if (fromNew !== undefined && fromNew !== null) {\r\n    return fromNew as T;\r\n  }\r\n\r\n  const fromLegacy = config.key(`auth.${legacyKey}`);\r\n\r\n  if (fromLegacy !== undefined && fromLegacy !== null) {\r\n    if (!warnedLegacyKeys.has(legacyKey)) {\r\n      warnedLegacyKeys.add(legacyKey);\r\n      log.warn(\r\n        \"auth\",\r\n        \"config-deprecation\",\r\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\r\n      );\r\n    }\r\n\r\n    return fromLegacy as T;\r\n  }\r\n\r\n  return fallback as T;\r\n}\r\n\r\n/**\r\n * Typed, backward-compatible access to auth configuration. The service and the\r\n * jwt signer read configuration exclusively through here, so the new split\r\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\r\n */\r\nexport const authConfig = {\r\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\r\n    const canAuthenticate = config.key<CanAuthenticate>(\r\n      \"auth.canAuthenticate\",\r\n      permitAuthentication,\r\n    );\r\n\r\n    return canAuthenticate(user);\r\n  },\r\n  accessToken: {\r\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\r\n    secret: (): string => {\r\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\r\n\r\n      if (!secret) {\r\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\r\n      }\r\n\r\n      return secret;\r\n    },\r\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\r\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\r\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\r\n     * to 1 hour when unset; throws naming the key when the configured value is\r\n     * not a positive `ms` duration. See {@link parseDuration}.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"accessToken.expiresIn\",\r\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\r\n      ),\r\n  },\r\n  pageAuth: {\r\n    /**\r\n     * Login path a guarded PAGE route redirects a logged-out browser to.\r\n     *\r\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\r\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\r\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\r\n     * navigating to a guarded page lands on the login screen instead of reading\r\n     * a raw JSON error blob. Finding b9ab9804.\r\n     */\r\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\r\n    /**\r\n     * Query parameter the redirect carries the originally-requested path in, so\r\n     * the login flow can send the user back where they were headed. Defaults to\r\n     * `\"returnUrl\"`.\r\n     */\r\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\r\n  },\r\n  cookie: {\r\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\r\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\r\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\r\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\r\n  },\r\n  csrf: {\r\n    /**\r\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n     * beyond the request's own origin. @default []\r\n     */\r\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\r\n  },\r\n  verification: {\r\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"verification.expiresIn\",\r\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\r\n      ),\r\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\r\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\r\n    /** App notification replacing the default verification email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\r\n  },\r\n  passwordReset: {\r\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passwordReset.expiresIn\",\r\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\r\n      ),\r\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\r\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\r\n    /** App notification replacing the default reset email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\r\n    /** App-owned password writer replacing the default. */\r\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\r\n  },\r\n  providers: {\r\n    /** `auth.providers.google`, when configured. */\r\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\r\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\r\n    custom: (name: string): AuthProvider | undefined =>\r\n      config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {})[name],\r\n    /** User attribute a verified provider email is matched against. @default \"email\" */\r\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\r\n    /** App-owned user creation for a first provider login. */\r\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\r\n  },\r\n  passkeys: {\r\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\r\n    settings: (): PasskeysConfig => {\r\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\r\n\r\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\r\n        throw new Error(\r\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\r\n        );\r\n      }\r\n\r\n      return settings;\r\n    },\r\n    /** Allowed ceremony origins, as a list. */\r\n    origins: (): string[] => {\r\n      const { origin } = authConfig.passkeys.settings();\r\n\r\n      return Array.isArray(origin) ? origin : [origin];\r\n    },\r\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    challengeExpiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passkeys.challengeExpiresIn\",\r\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\r\n      ),\r\n  },\r\n  otp: {\r\n    /** Notifications channel the code is sent through. @default \"sms\" */\r\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\r\n    /** User attribute holding the phone number. @default \"phone\" */\r\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\r\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\r\n    /** Verify attempts before the code is invalidated. @default 5 */\r\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\r\n    /** The message text for a code. */\r\n    message: (code: string): string => {\r\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\r\n\r\n      return build ? build(code) : `Your verification code is ${code}`;\r\n    },\r\n    /** App-owned delivery replacing the notifications channel send. */\r\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\r\n  },\r\n  refreshToken: {\r\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\r\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\r\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\r\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\r\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\r\n     * naming the key when the configured value is not a positive `ms` duration.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\r\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\r\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\r\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\r\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\r\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\r\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\r\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\r\n  },\r\n};\r\n"],"mappings":";;;;;AAoBA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,SAAS,SACP,OAAO,IAAkC,yBAAyB,CAAC,CAAC,CAAC,CAAC;;EAExE,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}

package/esm/services/auth.service.d.mts

@@ -18,6 +18,10 @@ declare class AuthService {
    * Resolve the active refresh-token model (default or registered override).
    */
   private get refreshTokenModel();
+  /**
+   * Resolve the active one-time-token model (default or registered override).
+   */
+  private get oneTimeTokenModel();
   /**
    * Build the default access-token JWT payload from a user.
    */
@@ -67,6 +71,18 @@ declare class AuthService {
    * the user + token pair on success, `null` on failure.
    */
   login<T extends Auth>(Model: ChildModel<T>, credentials: AuthCredentials, deviceInfo?: DeviceInfo): Promise<LoginResult<T> | null>;
+  /**
+   * Log in a user some OTHER method already authenticated — a provider
+   * callback, a passkey assertion, a one-time code. Applies the
+   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly
+   * what {@link login} produces: the same tokens, rows and events. Pair with
+   * {@link setAuthCookie} for a cookie session, as with password login.
+   *
+   * Never call this for a user you have not authenticated.
+   */
+  completeLogin<T extends Auth>(user: T, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+  /** The one token-issuing tail every login method shares. */
+  private finalizeLogin;
   /**
    * Log a user out.
    *
@@ -101,7 +117,8 @@ declare class AuthService {
    */
   revokeTokenFamily(familyId: string): Promise<void>;
   /**
-   * Delete expired tokens (refresh + access). Emits `token.expired` per refresh
+   * Delete expired tokens (refresh + access) and spent one-time tokens
+   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh
    * token and `cleanup.completed` with the refresh count. Drives the
    * `auth.cleanup` CLI command.
    */

package/esm/services/auth.service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"mappings":";;;;;;;;cAyBM,WAAA;;;;AALiD;;;cAYzC,gBAAA;EAcgC;;;EAAA,YAPhC,iBAAA;EAiDA;;;EA1CL,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EAmF7B;EA1EF,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EAmGwC;;;;;EA9EzC,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EAoK+B;;;;EApIhC,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAQG,cAAA;EAoIX;;;EA1GU,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA4I5D;;;;;EAjIF,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA8JmE;;;EApFjE,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAwH5B;;;EAjHnC,YAAA,CAAa,QAAA,WAAmB,OAAA;EAiIH;;;;EAzH7B,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAwK6B;;;;EAxI3B,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EAmNX;;;;;;;;;;EArLC,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAlS/C;;;EA+TlB,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAtT9B;;;EA6ThB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EA9RnC;;;EAqSA,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAnS1D;;;;;EA4SW,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EApQxC;;;EAmRW,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EAjRvC;;;;;EA4RE,oBAAA,IAAwB,OAAA;EA1PI;;;;;;;;;;EAkR5B,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EArLS;;;;;;;;EAqMb,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EA5JW;;;EA8KA,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA7KhC;;;;;EAAA,QAsLZ,qBAAA;EAnLL;;;;;;;;;;;;;;;;;;;;;EAkNI,aAAA,CACL,QAAA,EAAU,QAAA,EACV,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EA5IiD;;;;;;;;;;EAoKrD,eAAA,CAAgB,QAAA,EAAU,QAAA,EAAU,OAAA,GAAS,sBAAA;AAAA;AAAA,cAQzC,WAAA,EAAW,WAAoB"}
+{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"mappings":";;;;;;;;cA0BM,WAAA;;;;AALiD;;;cAYzC,gBAAA;EAqBgC;;;EAAA,YAdhC,iBAAA;EAwDA;;;EAAA,YAjDA,iBAAA;EA0FG;;;EAnFR,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EAsHU;EA7GzC,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EAiHH;;;;;EA5FE,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EA4KN;;;;EA5IK,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAQG,cAAA;EAoKC;;;EA1IF,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA4IxE;;;;;EAjIU,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EAoJR;;;EA5EU,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EA2IjB;;;EApI9C,YAAA,CAAa,QAAA,WAAmB,OAAA;EAkJe;;;;EA1I/C,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAqMK;;;;EArKH,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EAsM6B;;;;;;;;;EAnLvC,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EAtSX;EAAA,QA6SE,aAAA;EA/RP;;;;;;;;;;EA0TM,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAjRtE;;;EA8SK,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA5SxD;;;EAmTU,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EA5QxC;;;EAmRK,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAjRzD;;;;;EA0RU,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAxPY;;;EAuQzC,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA5PrC;;;;;;EAwQA,oBAAA,IAAwB,OAAA;EA7LT;;;;;;;;;;EAsNf,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EAtMd;;;;;;;;EAsNU,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EApLC;;;EAsMU,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAnLzB;;;;;EAAA,QA4LnB,qBAAA;EAzLL;;;;;;;;;;;;;;;;;;;;;EAwNI,aAAA,CACL,QAAA,EAAU,QAAA,EACV,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EA9IiC;;;;;;;;;;EAsKrC,eAAA,CAAgB,QAAA,EAAU,QAAA,EAAU,OAAA,GAAS,sBAAA;AAAA;AAAA,cAQzC,WAAA,EAAW,WAAoB"}