daycare-cli 0.0.0-canary.e7cbfdb → 0.0.0-canary.e82ae0d

package/dist/api/app-server/README.md

@@ -0,0 +1,78 @@
+# Daycare App Server
+
+Core API server for the Daycare app. Handles authentication, active task listing, and `/app` access links.
+
+## Settings
+
+Configure under top-level `settings.appServer`:
+
+- `enabled`: enable/disable app server runtime (`false` by default)
+- `host`: bind host, default `127.0.0.1`
+- `port`: bind port, default `7332`
+- `appEndpoint`: app endpoint URL where generated links open, default `https://daycare.dev`
+- `serverEndpoint` (optional): backend endpoint URL embedded in hash payload (for example `https://api.example.com`)
+- `jwtSecret` (optional): shared seed override; when omitted, uses auth store key `seed`
+- `telegramInstanceId` (optional): preferred Telegram plugin instance id for WebApp auth (defaults to first enabled `telegram` plugin, or `telegram`)
+
+Notes:
+- `appEndpoint` and `serverEndpoint` must be full `http(s)` endpoint URLs.
+- Trailing slashes are removed automatically.
+- Paths/query/hash are not allowed.
+
+## Routes
+
+### Auth
+- `POST /auth/validate`: validate session tokens and exchange link tokens to 1-year session tokens
+- `POST /auth/refresh`: validate token and return a fresh 1-year session token
+- `POST /auth/telegram`: verify Telegram WebApp `initData` and issue a 1-year session token
+- `POST /auth/email/request`: send a 6-digit email sign-in code
+- `POST /auth/email/verify`: verify `{ email, code }` and issue a 1-year session token
+
+### Tasks (authenticated via `Authorization: Bearer <token>`)
+- `GET /tasks/active`: list active tasks with cron/webhook triggers and last execution timestamps
+
+### Secrets (authenticated via `Authorization: Bearer <token>`)
+- `GET /secrets`: list secret metadata (`name`, `displayName`, `description`, `variableNames`, `variableCount`)
+- `GET /secrets/:name`: read one secret metadata entry
+- `POST /secrets/create`: create/replace a secret
+- `POST /secrets/:name/update`: update display metadata and/or variable mappings
+- `POST /secrets/:name/delete`: delete a secret
+
+Responses never include secret variable values.
+
+### Other
+- `GET /`: welcome message
+- `POST /v1/webhooks/:token`: trigger a task webhook by signed token (unauthenticated)
+
+## Tool and command
+
+- Tool: `app_auth_link`
+- Slash command: `/app`
+
+Both generate a short-lived app URL in the form:
+`<appEndpoint-or-serverEndpoint>/verify#<base64url-json>`
+
+Token lifecycle:
+- Link token (ephemeral): embedded in `/verify#...` URL payload, default TTL is 1 hour.
+- Email code (ephemeral): kept only in app-server memory, default TTL is 10 minutes.
+- Session token (long-term): returned by `/auth/validate`, `/auth/refresh`, `/auth/telegram`, and `/auth/email/verify`, TTL is 1 year.
+
+## Structure
+
+```
+appServer.ts        — server lifecycle and route wiring
+appServerSettingsResolve.ts — settings defaults and validation
+appHttp.ts          — HTTP utilities (CORS, JSON, body parsing, listen/close)
+appAuthExtract.ts   — JWT Bearer token extraction
+appAuthLinkTool.ts  — magic link generation tool
+appTelegramInitDataValidate.ts — Telegram WebApp initData signature validation
+appJwtSecretResolve.ts — JWT secret resolution
+appEndpointNormalize.ts — endpoint URL validation
+routes/
+  routeAuthValidate.ts  — POST /auth/validate
+  routeAuthRefresh.ts   — POST /auth/refresh
+  routeAuthTelegram.ts  — POST /auth/telegram
+  routeWebhookTrigger.ts — POST /v1/webhooks/:token
+```
+
+Shared authenticated API handlers live in `sources/api/routes/`.

package/dist/api/app-server/appAuthExtract.d.ts

@@ -0,0 +1,11 @@
+import type http from "node:http";
+/**
+ * Extracts and verifies a JWT from the Authorization: Bearer header.
+ * Returns the decoded userId on success, null on failure.
+ *
+ * Expects: secretResolve returns the active JWT secret.
+ */
+export declare function appAuthExtract(request: http.IncomingMessage, secretResolve: () => Promise<string>): Promise<{
+    userId: string;
+} | null>;
+//# sourceMappingURL=appAuthExtract.d.ts.map

package/dist/api/app-server/appAuthExtract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appAuthExtract.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthExtract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC;;;;;GAKG;AACH,wBAAsB,cAAc,CAChC,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GACrC,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBpC"}

package/dist/api/app-server/appAuthExtract.js

@@ -0,0 +1,29 @@
+import { jwtVerify } from "../../utils/jwt.js";
+/**
+ * Extracts and verifies a JWT from the Authorization: Bearer header.
+ * Returns the decoded userId on success, null on failure.
+ *
+ * Expects: secretResolve returns the active JWT secret.
+ */
+export async function appAuthExtract(request, secretResolve) {
+    const header = request.headers.authorization;
+    if (!header) {
+        return null;
+    }
+    const parts = header.split(" ");
+    if (parts.length !== 2 || parts[0]?.toLowerCase() !== "bearer") {
+        return null;
+    }
+    const token = parts[1]?.trim();
+    if (!token) {
+        return null;
+    }
+    try {
+        const payload = await jwtVerify(token, await secretResolve());
+        return { userId: payload.userId };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=appAuthExtract.js.map

package/dist/api/app-server/appAuthExtract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appAuthExtract.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthExtract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,OAA6B,EAC7B,aAAoC;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,aAAa,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/api/app-server/appAuthLinkTool.d.ts

@@ -0,0 +1,57 @@
+import { type Static } from "@sinclair/typebox";
+import type { ToolDefinition } from "@/types";
+export declare const APP_AUTH_LINK_EXPIRES_IN_SECONDS = 3600;
+export declare const APP_AUTH_SESSION_EXPIRES_IN_SECONDS: number;
+export declare const APP_AUTH_LINK_SERVICE = "daycare.app-auth.link";
+export declare const APP_AUTH_DEFAULT_ENDPOINT = "https://daycare.dev";
+export type AppAuthLinkKind = "session" | "connect-email";
+declare const appAuthLinkResultSchema: import("@sinclair/typebox").TObject<{
+    url: import("@sinclair/typebox").TString;
+    token: import("@sinclair/typebox").TString;
+    userId: import("@sinclair/typebox").TString;
+    expiresAt: import("@sinclair/typebox").TNumber;
+}>;
+type AppAuthLinkResult = Static<typeof appAuthLinkResultSchema>;
+export type AppAuthLinkPayload = {
+    backendUrl: string;
+    token: string;
+    kind?: AppAuthLinkKind;
+};
+export type AppAuthLinkGenerateInput = {
+    host: string;
+    port: number;
+    appEndpoint?: string;
+    serverEndpoint?: string;
+    userId: string;
+    secret: string;
+    expiresInSeconds?: number;
+};
+/**
+ * Generates a signed app auth URL for a user-scoped context.
+ * Expects: host and userId are non-empty strings and secret is valid.
+ */
+export declare function appAuthLinkGenerate(input: AppAuthLinkGenerateInput): Promise<AppAuthLinkResult>;
+/**
+ * Builds app auth URL from host/port and token.
+ * Expects: host is non-empty, port is valid network port.
+ */
+export declare function appAuthLinkUrlBuild(host: string, port: number, token: string, appEndpoint?: string, serverEndpoint?: string): string;
+/**
+ * Builds an app auth URL from an explicit payload.
+ * Expects: payload.backendUrl will be filled from serverEndpoint/appEndpoint when blank.
+ */
+export declare function appAuthPayloadUrlBuild(host: string, port: number, payload: AppAuthLinkPayload, appEndpoint?: string, serverEndpoint?: string): string;
+export type AppAuthLinkToolOptions = {
+    host: string;
+    port: number;
+    appEndpoint?: string;
+    serverEndpoint?: string;
+    secretResolve: () => Promise<string>;
+};
+/**
+ * Creates the app_auth_link tool definition.
+ * Expects: secretResolve returns the active JWT secret for signing.
+ */
+export declare function appAuthLinkTool(options: AppAuthLinkToolOptions): ToolDefinition;
+export {};
+//# sourceMappingURL=appAuthLinkTool.d.ts.map

package/dist/api/app-server/appAuthLinkTool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appAuthLinkTool.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,SAAS,CAAC;AAIlE,eAAO,MAAM,gCAAgC,OAAO,CAAC;AACrD,eAAO,MAAM,mCAAmC,QAAqB,CAAC;AACtE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,eAAe,CAAC;AAK1D,QAAA,MAAM,uBAAuB;;;;;EAQ5B,CAAC;AAEF,KAAK,iBAAiB,GAAG,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAOF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAarG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACxB,MAAM,CAYR;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACxB,MAAM,CAmBR;AAMD,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAoC/E"}

package/dist/api/app-server/appAuthLinkTool.js

@@ -0,0 +1,112 @@
+import { Type } from "@sinclair/typebox";
+import { jwtSign } from "../../utils/jwt.js";
+import { appEndpointNormalize } from "./appEndpointNormalize.js";
+export const APP_AUTH_LINK_EXPIRES_IN_SECONDS = 3600;
+export const APP_AUTH_SESSION_EXPIRES_IN_SECONDS = 365 * 24 * 60 * 60;
+export const APP_AUTH_LINK_SERVICE = "daycare.app-auth.link";
+export const APP_AUTH_DEFAULT_ENDPOINT = "https://daycare.dev";
+const appAuthLinkToolSchema = Type.Object({}, { additionalProperties: false });
+const appAuthLinkResultSchema = Type.Object({
+    url: Type.String(),
+    token: Type.String(),
+    userId: Type.String(),
+    expiresAt: Type.Number()
+}, { additionalProperties: false });
+const appAuthLinkReturns = {
+    schema: appAuthLinkResultSchema,
+    toLLMText: (result) => `Open Daycare app: ${result.url}`
+};
+/**
+ * Generates a signed app auth URL for a user-scoped context.
+ * Expects: host and userId are non-empty strings and secret is valid.
+ */
+export async function appAuthLinkGenerate(input) {
+    const expiresInSeconds = input.expiresInSeconds ?? APP_AUTH_LINK_EXPIRES_IN_SECONDS;
+    const token = await jwtSign({ userId: input.userId }, input.secret, expiresInSeconds, {
+        service: APP_AUTH_LINK_SERVICE
+    });
+    const expiresAt = Date.now() + expiresInSeconds * 1000;
+    return {
+        userId: input.userId,
+        token,
+        expiresAt,
+        url: appAuthLinkUrlBuild(input.host, input.port, token, input.appEndpoint, input.serverEndpoint)
+    };
+}
+/**
+ * Builds app auth URL from host/port and token.
+ * Expects: host is non-empty, port is valid network port.
+ */
+export function appAuthLinkUrlBuild(host, port, token, appEndpoint, serverEndpoint) {
+    return appAuthPayloadUrlBuild(host, port, {
+        backendUrl: "",
+        token,
+        kind: "session"
+    }, appEndpoint, serverEndpoint);
+}
+/**
+ * Builds an app auth URL from an explicit payload.
+ * Expects: payload.backendUrl will be filled from serverEndpoint/appEndpoint when blank.
+ */
+export function appAuthPayloadUrlBuild(host, port, payload, appEndpoint, serverEndpoint) {
+    const normalizedHost = host.trim();
+    if (!normalizedHost) {
+        throw new Error("App host is required.");
+    }
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("App port must be an integer between 1 and 65535.");
+    }
+    const resolvedAppEndpoint = appEndpointNormalize(appEndpoint, "appEndpoint");
+    const resolvedServerEndpoint = appEndpointNormalize(serverEndpoint, "serverEndpoint");
+    const localEndpoint = `http://${normalizedHost}:${port}`;
+    const appUrl = resolvedAppEndpoint ?? resolvedServerEndpoint ?? localEndpoint;
+    const backendUrl = resolvedServerEndpoint ?? appUrl;
+    const hashPayload = appAuthLinkHashPayloadEncode({
+        ...payload,
+        backendUrl: payload.backendUrl.trim() || backendUrl
+    });
+    return `${appUrl}/auth#${hashPayload}`;
+}
+function appAuthLinkHashPayloadEncode(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+/**
+ * Creates the app_auth_link tool definition.
+ * Expects: secretResolve returns the active JWT secret for signing.
+ */
+export function appAuthLinkTool(options) {
+    return {
+        tool: {
+            name: "app_auth_link",
+            description: "Generate a magic link URL that opens the Daycare app for the current user.",
+            parameters: appAuthLinkToolSchema
+        },
+        returns: appAuthLinkReturns,
+        execute: async (args, context, toolCall) => {
+            const _payload = args;
+            const secret = await options.secretResolve();
+            const link = await appAuthLinkGenerate({
+                host: options.host,
+                port: options.port,
+                appEndpoint: options.appEndpoint,
+                serverEndpoint: options.serverEndpoint,
+                userId: context.ctx.userId,
+                secret
+            });
+            const text = `Open Daycare app: ${link.url}`;
+            const toolMessage = {
+                role: "toolResult",
+                toolCallId: toolCall.id,
+                toolName: toolCall.name,
+                content: [{ type: "text", text }],
+                isError: false,
+                timestamp: Date.now()
+            };
+            return {
+                toolMessage,
+                typedResult: link
+            };
+        }
+    };
+}
+//# sourceMappingURL=appAuthLinkTool.js.map

package/dist/api/app-server/appAuthLinkTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appAuthLinkTool.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAG/D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;AAG/E,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CACvC;IACI,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;CAC3B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAUF,MAAM,kBAAkB,GAA0C;IAC9D,MAAM,EAAE,uBAAuB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,MAAM,CAAC,GAAG,EAAE;CAC3D,CAAC;AAYF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,gCAAgC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE;QAClF,OAAO,EAAE,qBAAqB;KACjC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAEvD,OAAO;QACH,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,SAAS;QACT,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC;KACnG,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACpB,cAAuB;IAEvB,OAAO,sBAAsB,CACzB,IAAI,EACJ,IAAI,EACJ;QACI,UAAU,EAAE,EAAE;QACd,KAAK;QACL,IAAI,EAAE,SAAS;KAClB,EACD,WAAW,EACX,cAAc,CACjB,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAClC,IAAY,EACZ,IAAY,EACZ,OAA2B,EAC3B,WAAoB,EACpB,cAAuB;IAEvB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,UAAU,cAAc,IAAI,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,mBAAmB,IAAI,sBAAsB,IAAI,aAAa,CAAC;IAC9E,MAAM,UAAU,GAAG,sBAAsB,IAAI,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC7C,GAAG,OAAO;QACV,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,UAAU;KACtD,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,SAAS,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA2B;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC3D,OAAO;QACH,IAAI,EAAE;YACF,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,4EAA4E;YACzF,UAAU,EAAE,qBAAqB;SACpC;QACD,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,QAAQ,GAAG,IAAuB,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;gBAC1B,MAAM;aACT,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAsB;gBACnC,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;YAEF,OAAO;gBACH,WAAW;gBACX,WAAW,EAAE,IAAI;aACpB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/api/app-server/appEmailAuth.d.ts

@@ -0,0 +1,38 @@
+import type { EmailMessage } from "../../email/emailSend.js";
+import type { UsersRepository } from "../../storage/usersRepository.js";
+export declare const APP_EMAIL_CODE_EXPIRES_IN_MS: number;
+export declare const APP_EMAIL_CODE_RESEND_IN_MS: number;
+export declare const APP_EMAIL_CODE_REQUEST_WINDOW_MS: number;
+export declare const APP_EMAIL_CODE_MAX_REQUESTS_PER_WINDOW = 5;
+export declare const APP_EMAIL_CODE_MAX_ATTEMPTS = 5;
+export type AppEmailAuthOptions = {
+    users: UsersRepository;
+    secret: string;
+    replyTo?: string;
+    mailSend: (message: EmailMessage) => Promise<void>;
+};
+export type AppEmailRequestResult = {
+    expiresAt: number;
+    retryAfterMs: number;
+};
+/**
+ * Coordinates email sign-in codes and maps verified emails to Daycare users.
+ * Expects: secret is stable for the app server process and mailSend delivers outbound email.
+ */
+export declare class AppEmailAuth {
+    private readonly users;
+    private readonly secret;
+    private readonly replyTo?;
+    private readonly mailSend;
+    private readonly pendingEmails;
+    private readonly pendingLock;
+    constructor(options: AppEmailAuthOptions);
+    request(email: string): Promise<AppEmailRequestResult>;
+    verify(email: string, code: string): Promise<{
+        email: string;
+        userId: string;
+    }>;
+    private pendingPrune;
+    private userIdResolveByEmail;
+}
+//# sourceMappingURL=appEmailAuth.d.ts.map

package/dist/api/app-server/appEmailAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGxE,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,QAAY,CAAC;AACrD,eAAO,MAAM,gCAAgC,QAAiB,CAAC;AAC/D,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAa7C,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwC;IACtE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;gBAEnC,OAAO,EAAE,mBAAmB;IAOlC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA6DtD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAmDrF,OAAO,CAAC,YAAY;YAYN,oBAAoB;CAoBrC"}

package/dist/api/app-server/appEmailAuth.js

@@ -0,0 +1,188 @@
+import { createHmac, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
+import { AsyncLock } from "../../utils/lock.js";
+export const APP_EMAIL_CODE_EXPIRES_IN_MS = 10 * 60 * 1000;
+export const APP_EMAIL_CODE_RESEND_IN_MS = 30 * 1000;
+export const APP_EMAIL_CODE_REQUEST_WINDOW_MS = 10 * 60 * 1000;
+export const APP_EMAIL_CODE_MAX_REQUESTS_PER_WINDOW = 5;
+export const APP_EMAIL_CODE_MAX_ATTEMPTS = 5;
+/**
+ * Coordinates email sign-in codes and maps verified emails to Daycare users.
+ * Expects: secret is stable for the app server process and mailSend delivers outbound email.
+ */
+export class AppEmailAuth {
+    users;
+    secret;
+    replyTo;
+    mailSend;
+    pendingEmails = new Map();
+    pendingLock = new AsyncLock();
+    constructor(options) {
+        this.users = options.users;
+        this.secret = options.secret.trim();
+        this.replyTo = options.replyTo;
+        this.mailSend = options.mailSend;
+    }
+    async request(email) {
+        const normalizedEmail = appEmailNormalize(email);
+        if (!appEmailIsValid(normalizedEmail)) {
+            throw new Error("A valid email is required.");
+        }
+        return this.pendingLock.inLock(async () => {
+            const now = Date.now();
+            this.pendingPrune(now);
+            const existing = this.pendingEmails.get(normalizedEmail);
+            if (existing && now < existing.resendAvailableAt) {
+                throw new Error(appEmailRetryMessage(existing.resendAvailableAt - now));
+            }
+            const requestWindowStartedAt = existing && now - existing.requestWindowStartedAt < APP_EMAIL_CODE_REQUEST_WINDOW_MS
+                ? existing.requestWindowStartedAt
+                : now;
+            const requestCount = existing && requestWindowStartedAt === existing.requestWindowStartedAt ? existing.requestCount + 1 : 1;
+            if (requestCount > APP_EMAIL_CODE_MAX_REQUESTS_PER_WINDOW) {
+                throw new Error(`Too many sign-in codes requested. Try again in ${appEmailMinutesText(requestWindowStartedAt + APP_EMAIL_CODE_REQUEST_WINDOW_MS - now)}.`);
+            }
+            const code = appEmailCodeGenerate();
+            const salt = randomBytes(16).toString("hex");
+            const expiresAt = now + APP_EMAIL_CODE_EXPIRES_IN_MS;
+            const resendAvailableAt = now + APP_EMAIL_CODE_RESEND_IN_MS;
+            await this.mailSend(appEmailAuthMessageBuild({
+                email: normalizedEmail,
+                code,
+                expiresAt,
+                replyTo: this.replyTo
+            }));
+            this.pendingEmails.set(normalizedEmail, {
+                codeHash: appEmailCodeHash(this.secret, normalizedEmail, salt, code),
+                salt,
+                expiresAt,
+                resendAvailableAt,
+                requestWindowStartedAt,
+                requestCount,
+                failedAttempts: 0,
+                updatedAt: now
+            });
+            return {
+                expiresAt,
+                retryAfterMs: APP_EMAIL_CODE_RESEND_IN_MS
+            };
+        });
+    }
+    async verify(email, code) {
+        const normalizedEmail = appEmailNormalize(email);
+        const normalizedCode = appEmailCodeNormalize(code);
+        if (!appEmailIsValid(normalizedEmail)) {
+            throw new Error("A valid email is required.");
+        }
+        if (!normalizedCode) {
+            throw new Error("Code must be six digits.");
+        }
+        return this.pendingLock.inLock(async () => {
+            const now = Date.now();
+            this.pendingPrune(now);
+            const pending = this.pendingEmails.get(normalizedEmail);
+            if (!pending) {
+                throw new Error("Invalid or expired sign-in code.");
+            }
+            if (now > pending.expiresAt) {
+                this.pendingEmails.delete(normalizedEmail);
+                throw new Error("Invalid or expired sign-in code.");
+            }
+            if (pending.failedAttempts >= APP_EMAIL_CODE_MAX_ATTEMPTS) {
+                this.pendingEmails.delete(normalizedEmail);
+                throw new Error("Too many failed attempts. Request a new sign-in code.");
+            }
+            const providedHash = appEmailCodeHash(this.secret, normalizedEmail, pending.salt, normalizedCode);
+            if (!timingSafeEqual(providedHash, pending.codeHash)) {
+                const failedAttempts = pending.failedAttempts + 1;
+                if (failedAttempts >= APP_EMAIL_CODE_MAX_ATTEMPTS) {
+                    this.pendingEmails.delete(normalizedEmail);
+                    throw new Error("Too many failed attempts. Request a new sign-in code.");
+                }
+                this.pendingEmails.set(normalizedEmail, {
+                    ...pending,
+                    failedAttempts,
+                    updatedAt: now
+                });
+                throw new Error("Invalid or expired sign-in code.");
+            }
+            this.pendingEmails.delete(normalizedEmail);
+            const userId = await this.userIdResolveByEmail(normalizedEmail);
+            return {
+                email: normalizedEmail,
+                userId
+            };
+        });
+    }
+    pendingPrune(now) {
+        for (const [email, challenge] of this.pendingEmails.entries()) {
+            if (challenge.expiresAt <= now ||
+                challenge.requestWindowStartedAt + APP_EMAIL_CODE_REQUEST_WINDOW_MS <= now ||
+                challenge.updatedAt + APP_EMAIL_CODE_REQUEST_WINDOW_MS <= now) {
+                this.pendingEmails.delete(email);
+            }
+        }
+    }
+    async userIdResolveByEmail(email) {
+        const connector = { name: "email", key: email };
+        const existing = await this.users.findByConnector(connector);
+        if (existing) {
+            return existing.id;
+        }
+        try {
+            const created = await this.users.create({
+                connector
+            });
+            return created.id;
+        }
+        catch (error) {
+            const raced = await this.users.findByConnector(connector);
+            if (raced) {
+                return raced.id;
+            }
+            throw error;
+        }
+    }
+}
+function appEmailNormalize(email) {
+    return email.trim().toLowerCase();
+}
+function appEmailIsValid(email) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
+}
+function appEmailCodeGenerate() {
+    return `${randomInt(1, 10)}${randomInt(0, 10)}${randomInt(0, 10)}${randomInt(0, 10)}${randomInt(0, 10)}${randomInt(0, 10)}`;
+}
+function appEmailCodeNormalize(code) {
+    const digits = code.replaceAll(/\D/g, "");
+    return /^[1-9][0-9]{5}$/.test(digits) ? digits : null;
+}
+function appEmailCodeHash(secret, email, salt, code) {
+    return createHmac("sha256", secret).update(`${email}:${salt}:${code}`, "utf8").digest();
+}
+function appEmailRetryMessage(retryAfterMs) {
+    return `Please wait ${appEmailSecondsText(retryAfterMs)} before requesting another sign-in code.`;
+}
+function appEmailSecondsText(durationMs) {
+    const seconds = Math.max(1, Math.ceil(durationMs / 1000));
+    return `${seconds} second${seconds === 1 ? "" : "s"}`;
+}
+function appEmailMinutesText(durationMs) {
+    const minutes = Math.max(1, Math.ceil(durationMs / 60_000));
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+}
+function appEmailAuthMessageBuild(options) {
+    const expiresInMinutes = Math.max(1, Math.ceil((options.expiresAt - Date.now()) / 60_000));
+    const expirationText = `${expiresInMinutes} minute${expiresInMinutes === 1 ? "" : "s"}`;
+    return {
+        to: options.email,
+        subject: "Your Daycare sign-in code",
+        replyTo: options.replyTo,
+        text: `Your Daycare sign-in code is ${options.code}. It expires in ${expirationText}.`,
+        html: [
+            "<p>Your Daycare sign-in code is:</p>",
+            `<p><strong style="font-size: 28px; letter-spacing: 4px;">${options.code}</strong></p>`,
+            `<p>It expires in ${expirationText}.</p>`
+        ].join("")
+    };
+}
+//# sourceMappingURL=appEmailAuth.js.map

package/dist/api/app-server/appEmailAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.js","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGlF,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAyB7C;;;GAGG;AACH,MAAM,OAAO,YAAY;IACJ,KAAK,CAAkB;IACvB,MAAM,CAAS;IACf,OAAO,CAAU;IACjB,QAAQ,CAAkC;IAC1C,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,WAAW,GAAG,IAAI,SAAS,EAAE,CAAC;IAE/C,YAAY,OAA4B;QACpC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACvB,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACzD,IAAI,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,QAAQ,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,sBAAsB,GACxB,QAAQ,IAAI,GAAG,GAAG,QAAQ,CAAC,sBAAsB,GAAG,gCAAgC;gBAChF,CAAC,CAAC,QAAQ,CAAC,sBAAsB;gBACjC,CAAC,CAAC,GAAG,CAAC;YACd,MAAM,YAAY,GACd,QAAQ,IAAI,sBAAsB,KAAK,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,IAAI,YAAY,GAAG,sCAAsC,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACX,kDAAkD,mBAAmB,CACjE,sBAAsB,GAAG,gCAAgC,GAAG,GAAG,CAClE,GAAG,CACP,CAAC;YACN,CAAC;YAED,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,GAAG,4BAA4B,CAAC;YACrD,MAAM,iBAAiB,GAAG,GAAG,GAAG,2BAA2B,CAAC;YAE5D,MAAM,IAAI,CAAC,QAAQ,CACf,wBAAwB,CAAC;gBACrB,KAAK,EAAE,eAAe;gBACtB,IAAI;gBACJ,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;aACxB,CAAC,CACL,CAAC;YAEF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE;gBACpC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC;gBACpE,IAAI;gBACJ,SAAS;gBACT,iBAAiB;gBACjB,sBAAsB;gBACtB,YAAY;gBACZ,cAAc,EAAE,CAAC;gBACjB,SAAS,EAAE,GAAG;aACjB,CAAC,CAAC;YAEH,OAAO;gBACH,SAAS;gBACT,YAAY,EAAE,2BAA2B;aAC5C,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAY;QACpC,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,2BAA2B,EAAE,CAAC;gBACxD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAClG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;gBAClD,IAAI,cAAc,IAAI,2BAA2B,EAAE,CAAC;oBAChD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;oBAC3C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,EAAE;oBACpC,GAAG,OAAO;oBACV,cAAc;oBACd,SAAS,EAAE,GAAG;iBACjB,CAAC,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAChE,OAAO;gBACH,KAAK,EAAE,eAAe;gBACtB,MAAM;aACT,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,GAAW;QAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IACI,SAAS,CAAC,SAAS,IAAI,GAAG;gBAC1B,SAAS,CAAC,sBAAsB,GAAG,gCAAgC,IAAI,GAAG;gBAC1E,SAAS,CAAC,SAAS,GAAG,gCAAgC,IAAI,GAAG,EAC/D,CAAC;gBACC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACL,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAC5C,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpC,SAAS;aACZ,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC,EAAE,CAAC;YACpB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,SAAS,iBAAiB,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB;IACzB,OAAO,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAChI,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY,EAAE,IAAY;IAC/E,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5F,CAAC;AAED,SAAS,oBAAoB,CAAC,YAAoB;IAC9C,OAAO,eAAe,mBAAmB,CAAC,YAAY,CAAC,0CAA0C,CAAC;AACtG,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,OAKjC;IACG,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,cAAc,GAAG,GAAG,gBAAgB,UAAU,gBAAgB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAExF,OAAO;QACH,EAAE,EAAE,OAAO,CAAC,KAAK;QACjB,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,gCAAgC,OAAO,CAAC,IAAI,mBAAmB,cAAc,GAAG;QACtF,IAAI,EAAE;YACF,sCAAsC;YACtC,4DAA4D,OAAO,CAAC,IAAI,eAAe;YACvF,oBAAoB,cAAc,OAAO;SAC5C,CAAC,IAAI,CAAC,EAAE,CAAC;KACb,CAAC;AACN,CAAC"}

package/dist/api/app-server/appEmailConnect.d.ts

@@ -0,0 +1,35 @@
+import type { EmailMessage } from "../../email/emailSend.js";
+import type { UsersRepository } from "../../storage/usersRepository.js";
+import { type AppRequestEndpointHeaders } from "./appRequestEndpointsResolve.js";
+export declare const APP_EMAIL_CONNECT_EXPIRES_IN_SECONDS: number;
+export type AppEmailConnectOptions = {
+    users: UsersRepository;
+    host: string;
+    port: number;
+    secret: string;
+    serverEndpoint?: string;
+    appEndpoint?: string;
+    replyTo?: string;
+    mailSend: (message: EmailMessage) => Promise<void>;
+};
+/**
+ * Sends and verifies email-connection links for an existing Daycare user.
+ * Expects: secret is stable for the app server and mailSend delivers outbound email.
+ */
+export declare class AppEmailConnect {
+    private readonly users;
+    private readonly host;
+    private readonly port;
+    private readonly secret;
+    private readonly serverEndpoint?;
+    private readonly appEndpoint?;
+    private readonly replyTo?;
+    private readonly mailSend;
+    constructor(options: AppEmailConnectOptions);
+    request(userId: string, email: string, headers?: AppRequestEndpointHeaders): Promise<void>;
+    verify(token: string): Promise<{
+        userId: string;
+        email: string;
+    }>;
+}
+//# sourceMappingURL=appEmailConnect.d.ts.map

package/dist/api/app-server/appEmailConnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailConnect.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailConnect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGxE,OAAO,EAAE,KAAK,yBAAyB,EAA8B,MAAM,iCAAiC,CAAC;AAE7G,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAG5D,MAAM,MAAM,sBAAsB,GAAG;IACjC,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAOF;;;GAGG;AACH,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAElD,OAAO,EAAE,sBAAsB;IAWrC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD1F,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAwB1E"}