daycare-cli 0.0.0-canary.eeb4e2f → 0.0.0-canary.efefcae

package/dist/api/app-server/appAuthExtract.js

@@ -1,4 +1,4 @@
-import { jwtVerify } from "../../util/jwt.js";
+import { jwtVerify } from "../../utils/jwt.js";
 /**
  * Extracts and verifies a JWT from the Authorization: Bearer header.
  * Returns the decoded userId on success, null on failure.

package/dist/api/app-server/appAuthExtract.js.map

@@ -1 +1 @@
-{"version":3,"file":"appAuthExtract.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthExtract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,OAA6B,EAC7B,aAAoC;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,aAAa,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}
+{"version":3,"file":"appAuthExtract.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthExtract.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,OAA6B,EAC7B,aAAoC;IAEpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,aAAa,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/api/app-server/appAuthLinkTool.d.ts

@@ -4,6 +4,7 @@ export declare const APP_AUTH_LINK_EXPIRES_IN_SECONDS = 3600;
 export declare const APP_AUTH_SESSION_EXPIRES_IN_SECONDS: number;
 export declare const APP_AUTH_LINK_SERVICE = "daycare.app-auth.link";
 export declare const APP_AUTH_DEFAULT_ENDPOINT = "https://daycare.dev";
+export type AppAuthLinkKind = "session" | "email" | "connect-email";
 declare const appAuthLinkResultSchema: import("@sinclair/typebox").TObject<{
     url: import("@sinclair/typebox").TString;
     token: import("@sinclair/typebox").TString;
@@ -11,6 +12,11 @@ declare const appAuthLinkResultSchema: import("@sinclair/typebox").TObject<{
     expiresAt: import("@sinclair/typebox").TNumber;
 }>;
 type AppAuthLinkResult = Static<typeof appAuthLinkResultSchema>;
+export type AppAuthLinkPayload = {
+    backendUrl: string;
+    token: string;
+    kind?: AppAuthLinkKind;
+};
 export type AppAuthLinkGenerateInput = {
     host: string;
     port: number;
@@ -30,6 +36,11 @@ export declare function appAuthLinkGenerate(input: AppAuthLinkGenerateInput): Pr
  * Expects: host is non-empty, port is valid network port.
  */
 export declare function appAuthLinkUrlBuild(host: string, port: number, token: string, appEndpoint?: string, serverEndpoint?: string): string;
+/**
+ * Builds an app auth URL from an explicit payload.
+ * Expects: payload.backendUrl will be filled from serverEndpoint/appEndpoint when blank.
+ */
+export declare function appAuthPayloadUrlBuild(host: string, port: number, payload: AppAuthLinkPayload, appEndpoint?: string, serverEndpoint?: string): string;
 export type AppAuthLinkToolOptions = {
     host: string;
     port: number;

package/dist/api/app-server/appAuthLinkTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appAuthLinkTool.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,SAAS,CAAC;AAIlE,eAAO,MAAM,gCAAgC,OAAO,CAAC;AACrD,eAAO,MAAM,mCAAmC,QAAqB,CAAC;AACtE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAK/D,QAAA,MAAM,uBAAuB;;;;;EAQ5B,CAAC;AAEF,KAAK,iBAAiB,GAAG,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAOhE,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAarG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACxB,MAAM,CAmBR;AAMD,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAoC/E"}
+{"version":3,"file":"appAuthLinkTool.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,SAAS,CAAC;AAIlE,eAAO,MAAM,gCAAgC,OAAO,CAAC;AACrD,eAAO,MAAM,mCAAmC,QAAqB,CAAC;AACtE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,eAAe,CAAC;AAKpE,QAAA,MAAM,uBAAuB;;;;;EAQ5B,CAAC;AAEF,KAAK,iBAAiB,GAAG,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAOF,MAAM,MAAM,wBAAwB,GAAG;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAarG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACxB,MAAM,CAYR;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kBAAkB,EAC3B,WAAW,CAAC,EAAE,MAAM,EACpB,cAAc,CAAC,EAAE,MAAM,GACxB,MAAM,CAmBR;AAMD,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAoC/E"}

package/dist/api/app-server/appAuthLinkTool.js

@@ -1,5 +1,5 @@
 import { Type } from "@sinclair/typebox";
-import { jwtSign } from "../../util/jwt.js";
+import { jwtSign } from "../../utils/jwt.js";
 import { appEndpointNormalize } from "./appEndpointNormalize.js";
 export const APP_AUTH_LINK_EXPIRES_IN_SECONDS = 3600;
 export const APP_AUTH_SESSION_EXPIRES_IN_SECONDS = 365 * 24 * 60 * 60;
@@ -38,6 +38,17 @@ export async function appAuthLinkGenerate(input) {
  * Expects: host is non-empty, port is valid network port.
  */
 export function appAuthLinkUrlBuild(host, port, token, appEndpoint, serverEndpoint) {
+    return appAuthPayloadUrlBuild(host, port, {
+        backendUrl: "",
+        token,
+        kind: "session"
+    }, appEndpoint, serverEndpoint);
+}
+/**
+ * Builds an app auth URL from an explicit payload.
+ * Expects: payload.backendUrl will be filled from serverEndpoint/appEndpoint when blank.
+ */
+export function appAuthPayloadUrlBuild(host, port, payload, appEndpoint, serverEndpoint) {
     const normalizedHost = host.trim();
     if (!normalizedHost) {
         throw new Error("App host is required.");
@@ -51,10 +62,10 @@ export function appAuthLinkUrlBuild(host, port, token, appEndpoint, serverEndpoi
     const appUrl = resolvedAppEndpoint ?? resolvedServerEndpoint ?? defaults;
     const backendUrl = resolvedServerEndpoint ?? appUrl;
     const hashPayload = appAuthLinkHashPayloadEncode({
-        backendUrl,
-        token
+        ...payload,
+        backendUrl: payload.backendUrl.trim() || backendUrl
     });
-    return `${appUrl}/auth#${hashPayload}`;
+    return `${appUrl}/verify#${hashPayload}`;
 }
 function appAuthLinkHashPayloadEncode(payload) {
     return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");

package/dist/api/app-server/appAuthLinkTool.js.map

@@ -1 +1 @@
-{"version":3,"file":"appAuthLinkTool.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAE/D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;AAG/E,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CACvC;IACI,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;CAC3B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAIF,MAAM,kBAAkB,GAA0C;IAC9D,MAAM,EAAE,uBAAuB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,MAAM,CAAC,GAAG,EAAE;CAC3D,CAAC;AAYF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,gCAAgC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE;QAClF,OAAO,EAAE,qBAAqB;KACjC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAEvD,OAAO;QACH,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,SAAS;QACT,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC;KACnG,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACpB,cAAuB;IAEvB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC;IAC3C,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,mBAAmB,IAAI,sBAAsB,IAAI,QAAQ,CAAC;IACzE,MAAM,UAAU,GAAG,sBAAsB,IAAI,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC7C,UAAU;QACV,KAAK;KACR,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,SAAS,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA8C;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC3D,OAAO;QACH,IAAI,EAAE;YACF,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,4EAA4E;YACzF,UAAU,EAAE,qBAAqB;SACpC;QACD,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,QAAQ,GAAG,IAAuB,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;gBAC1B,MAAM;aACT,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAsB;gBACnC,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;YAEF,OAAO;gBACH,WAAW;gBACX,WAAW,EAAE,IAAI;aACpB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC"}
+{"version":3,"file":"appAuthLinkTool.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AACrD,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAG/D,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC;AAG/E,MAAM,uBAAuB,GAAG,IAAI,CAAC,MAAM,CACvC;IACI,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;CAC3B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAClC,CAAC;AAUF,MAAM,kBAAkB,GAA0C;IAC9D,MAAM,EAAE,uBAAuB;IAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,MAAM,CAAC,GAAG,EAAE;CAC3D,CAAC;AAYF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,IAAI,gCAAgC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,gBAAgB,EAAE;QAClF,OAAO,EAAE,qBAAqB;KACjC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAEvD,OAAO;QACH,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK;QACL,SAAS;QACT,GAAG,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC;KACnG,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACpB,cAAuB;IAEvB,OAAO,sBAAsB,CACzB,IAAI,EACJ,IAAI,EACJ;QACI,UAAU,EAAE,EAAE;QACd,KAAK;QACL,IAAI,EAAE,SAAS;KAClB,EACD,WAAW,EACX,cAAc,CACjB,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAClC,IAAY,EACZ,IAAY,EACZ,OAA2B,EAC3B,WAAoB,EACpB,cAAuB;IAEvB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC;IAC3C,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,mBAAmB,IAAI,sBAAsB,IAAI,QAAQ,CAAC;IACzE,MAAM,UAAU,GAAG,sBAAsB,IAAI,MAAM,CAAC;IACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC7C,GAAG,OAAO;QACV,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,UAAU;KACtD,CAAC,CAAC;IACH,OAAO,GAAG,MAAM,WAAW,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA2B;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC3D,OAAO;QACH,IAAI,EAAE;YACF,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,4EAA4E;YACzF,UAAU,EAAE,qBAAqB;SACpC;QACD,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvC,MAAM,QAAQ,GAAG,IAAuB,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC;gBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;gBAC1B,MAAM;aACT,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,qBAAqB,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAsB;gBACnC,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;YAEF,OAAO;gBACH,WAAW;gBACX,WAAW,EAAE,IAAI;aACpB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/api/app-server/appAuthLinkTool.spec.js

@@ -1,26 +1,28 @@
 import { describe, expect, it } from "vitest";
 import { contextForUser } from "../../engine/agents/context.js";
-import { jwtVerify } from "../../util/jwt.js";
+import { jwtVerify } from "../../utils/jwt.js";
 import { APP_AUTH_LINK_SERVICE, appAuthLinkGenerate, appAuthLinkTool, appAuthLinkUrlBuild } from "./appAuthLinkTool.js";
 describe("appAuthLinkUrlBuild", () => {
     it("builds auth URL using default app endpoint", () => {
         const url = appAuthLinkUrlBuild("127.0.0.1", 7332, "token-1");
         const parsed = new URL(url);
         expect(parsed.origin).toBe("https://daycare.dev");
-        expect(parsed.pathname).toBe("/auth");
+        expect(parsed.pathname).toBe("/verify");
         expect(appAuthLinkPayloadDecode(url)).toEqual({
             backendUrl: "https://daycare.dev",
-            token: "token-1"
+            token: "token-1",
+            kind: "session"
         });
     });
     it("uses app and server endpoints independently", () => {
         const url = appAuthLinkUrlBuild("0.0.0.0", 7332, "token-1", "https://app.example.com/", "https://api.example.com/");
         const parsed = new URL(url);
         expect(parsed.origin).toBe("https://app.example.com");
-        expect(parsed.pathname).toBe("/auth");
+        expect(parsed.pathname).toBe("/verify");
         expect(appAuthLinkPayloadDecode(url)).toEqual({
             backendUrl: "https://api.example.com",
-            token: "token-1"
+            token: "token-1",
+            kind: "session"
         });
     });
     it("uses server endpoint for both URL and payload when app endpoint is missing", () => {
@@ -29,7 +31,8 @@ describe("appAuthLinkUrlBuild", () => {
         expect(parsed.origin).toBe("https://api.example.com");
         expect(appAuthLinkPayloadDecode(url)).toEqual({
             backendUrl: "https://api.example.com",
-            token: "token-1"
+            token: "token-1",
+            kind: "session"
         });
     });
     it("throws when endpoint values are bare domains", () => {
@@ -44,7 +47,7 @@ describe("appAuthLinkGenerate", () => {
             userId: "user-7",
             secret: "test-secret"
         });
-        expect(result.url.startsWith("https://daycare.dev/auth#")).toBe(true);
+        expect(result.url.startsWith("https://daycare.dev/verify#")).toBe(true);
         const payload = await jwtVerify(result.token, "test-secret", { service: APP_AUTH_LINK_SERVICE });
         expect(payload.userId).toBe("user-7");
     });

package/dist/api/app-server/appAuthLinkTool.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"appAuthLinkTool.spec.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAExH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,qBAAqB;YACjC,KAAK,EAAE,SAAS;SACnB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,mBAAmB,CAC3B,SAAS,EACT,IAAI,EACJ,SAAS,EACT,0BAA0B,EAC1B,0BAA0B,CAC7B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,SAAS;SACnB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,SAAS;SACnB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CACpF,qCAAqC,CACxC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACrC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,aAAa;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,eAAe,CAAC;YACzB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,EAAE,EACF;YACI,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SACV,EACpC;YACI,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,eAAe;SACxB,CACJ,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGhE,CAAC;AACN,CAAC"}
+{"version":3,"file":"appAuthLinkTool.spec.js","sourceRoot":"","sources":["../../../sources/api/app-server/appAuthLinkTool.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAExH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,qBAAqB;YACjC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,mBAAmB,CAC3B,SAAS,EACT,IAAI,EACJ,SAAS,EACT,0BAA0B,EAC1B,0BAA0B,CAC7B,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACtD,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,UAAU,EAAE,yBAAyB;YACrC,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CACpF,qCAAqC,CACxC,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACrC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,aAAa;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,eAAe,CAAC;YACzB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,aAAa;SAC3C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,EAAE,EACF;YACI,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SACV,EACpC;YACI,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,eAAe;SACxB,CACJ,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,wBAAwB,CAAC,GAAW;IACzC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAGhE,CAAC;AACN,CAAC"}

package/dist/api/app-server/appEmailAuth.d.ts

@@ -0,0 +1,38 @@
+import type { EmailMessage } from "../../email/emailSend.js";
+import type { DaycareDb } from "../../schema.js";
+import type { UsersRepository } from "../../storage/usersRepository.js";
+export type AppEmailAuthOptions = {
+    db: DaycareDb;
+    users: UsersRepository;
+    host: string;
+    port: number;
+    serverEndpoint?: string;
+    appEndpoint?: string;
+    secret: string;
+    replyTo?: string;
+    mailSend: (message: EmailMessage) => Promise<void>;
+};
+type AppEmailAuthHeaders = Headers | Record<string, string | string[] | undefined> | Array<[string, string]>;
+/**
+ * Coordinates Better Auth magic-link email delivery and maps verified emails to Daycare users.
+ * Expects: storage migrations are applied and mailSend delivers outbound email.
+ */
+export declare class AppEmailAuth {
+    private readonly users;
+    private readonly host;
+    private readonly port;
+    private readonly serverEndpoint?;
+    private readonly appEndpoint?;
+    private readonly replyTo?;
+    private readonly mailSend;
+    private readonly auth;
+    constructor(options: AppEmailAuthOptions);
+    request(email: string, headers?: AppEmailAuthHeaders): Promise<void>;
+    verify(token: string, headers?: AppEmailAuthHeaders): Promise<{
+        email: string;
+        userId: string;
+    }>;
+    private userIdResolveByEmail;
+}
+export {};
+//# sourceMappingURL=appEmailAuth.d.ts.map

package/dist/api/app-server/appEmailAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAQjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAGxE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAEF,KAAK,mBAAmB,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7G;;;GAGG;AACH,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;gBAEjD,OAAO,EAAE,mBAAmB;IAuBlC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAcpE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;YAyBxF,oBAAoB;CAsBrC"}

package/dist/api/app-server/appEmailAuth.js

@@ -0,0 +1,183 @@
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { magicLink } from "better-auth/plugins";
+import { appAuthAccountsTable, appAuthSessionsTable, appAuthUsersTable, appAuthVerificationsTable } from "../../schema.js";
+import { userConnectorKeyCreate } from "../../storage/userConnectorKeyCreate.js";
+import { APP_AUTH_SESSION_EXPIRES_IN_SECONDS, appAuthPayloadUrlBuild } from "./appAuthLinkTool.js";
+/**
+ * Coordinates Better Auth magic-link email delivery and maps verified emails to Daycare users.
+ * Expects: storage migrations are applied and mailSend delivers outbound email.
+ */
+export class AppEmailAuth {
+    users;
+    host;
+    port;
+    serverEndpoint;
+    appEndpoint;
+    replyTo;
+    mailSend;
+    auth;
+    constructor(options) {
+        this.users = options.users;
+        this.host = options.host;
+        this.port = options.port;
+        this.serverEndpoint = options.serverEndpoint;
+        this.appEndpoint = options.appEndpoint;
+        this.replyTo = options.replyTo;
+        this.mailSend = options.mailSend;
+        this.auth = appEmailAuthCreate(options, async ({ email, token }) => {
+            await this.mailSend(appEmailAuthMessageBuild({
+                email,
+                token,
+                host: this.host,
+                port: this.port,
+                serverEndpoint: this.serverEndpoint,
+                appEndpoint: this.appEndpoint,
+                replyTo: this.replyTo
+            }));
+        });
+    }
+    async request(email, headers) {
+        const normalizedEmail = appEmailNormalize(email);
+        if (!normalizedEmail) {
+            throw new Error("Email is required.");
+        }
+        await this.auth.api.signInMagicLink({
+            body: {
+                email: normalizedEmail
+            },
+            headers: appEmailAuthHeadersBuild(headers, this.host, this.port, this.serverEndpoint)
+        });
+    }
+    async verify(token, headers) {
+        const normalizedToken = token.trim();
+        if (!normalizedToken) {
+            throw new Error("Magic-link token is required.");
+        }
+        const result = await this.auth.api.magicLinkVerify({
+            query: {
+                token: normalizedToken
+            },
+            headers: appEmailAuthHeadersBuild(headers, this.host, this.port, this.serverEndpoint)
+        });
+        const email = appEmailNormalize(result.user.email);
+        if (!email) {
+            throw new Error("Verified email is missing.");
+        }
+        const userId = await this.userIdResolveByEmail(email);
+        return {
+            email,
+            userId
+        };
+    }
+    async userIdResolveByEmail(email) {
+        const connectorKey = userConnectorKeyCreate("email", email);
+        const existing = await this.users.findByConnectorKey(connectorKey);
+        if (existing) {
+            return existing.id;
+        }
+        const allUsers = await this.users.findMany();
+        try {
+            const created = await this.users.create({
+                isOwner: allUsers.length === 0,
+                connectorKey
+            });
+            return created.id;
+        }
+        catch (error) {
+            const raced = await this.users.findByConnectorKey(connectorKey);
+            if (raced) {
+                return raced.id;
+            }
+            throw error;
+        }
+    }
+}
+function appEmailNormalize(email) {
+    return email.trim().toLowerCase();
+}
+function appEmailAuthCreate(options, sendMagicLink) {
+    return betterAuth({
+        secret: options.secret,
+        baseURL: appEmailAuthBaseUrlResolve(options.host, options.port, options.serverEndpoint),
+        session: {
+            expiresIn: APP_AUTH_SESSION_EXPIRES_IN_SECONDS
+        },
+        database: drizzleAdapter(options.db, {
+            provider: "pg",
+            schema: {
+                user: appAuthUsersTable,
+                session: appAuthSessionsTable,
+                account: appAuthAccountsTable,
+                verification: appAuthVerificationsTable
+            },
+            usePlural: false
+        }),
+        plugins: [
+            magicLink({
+                sendMagicLink: async ({ email, token }) => {
+                    await sendMagicLink({ email, token });
+                }
+            })
+        ]
+    });
+}
+function appEmailAuthBaseUrlResolve(host, port, serverEndpoint) {
+    return serverEndpoint?.trim() || `http://${host}:${port}`;
+}
+function appEmailAuthHeadersBuild(headers, host, port, serverEndpoint) {
+    const result = new Headers();
+    const source = headers instanceof Headers ? headers : new Headers(appEmailAuthHeadersNormalize(headers));
+    source.forEach((value, key) => {
+        result.set(key, value);
+    });
+    const baseUrl = new URL(appEmailAuthBaseUrlResolve(host, port, serverEndpoint));
+    if (!result.has("host")) {
+        result.set("host", baseUrl.host);
+    }
+    if (!result.has("origin")) {
+        result.set("origin", baseUrl.origin);
+    }
+    if (!result.has("x-forwarded-host")) {
+        result.set("x-forwarded-host", baseUrl.host);
+    }
+    if (!result.has("x-forwarded-proto")) {
+        result.set("x-forwarded-proto", baseUrl.protocol.replace(":", ""));
+    }
+    return result;
+}
+function appEmailAuthHeadersNormalize(headers) {
+    if (!headers || headers instanceof Headers || Array.isArray(headers)) {
+        return {};
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (typeof value === "string") {
+            result[key] = value;
+            continue;
+        }
+        if (Array.isArray(value)) {
+            result[key] = value.join(", ");
+        }
+    }
+    return result;
+}
+function appEmailAuthMessageBuild(options) {
+    const url = appAuthPayloadUrlBuild(options.host, options.port, {
+        backendUrl: options.serverEndpoint?.trim() ?? "",
+        token: options.token,
+        kind: "email"
+    }, options.appEndpoint, options.serverEndpoint);
+    return {
+        to: options.email,
+        subject: "Your Daycare sign-in link",
+        replyTo: options.replyTo,
+        text: `Use this link to sign in to Daycare: ${url}`,
+        html: [
+            "<p>Use this link to sign in to Daycare.</p>",
+            `<p><a href="${url}">Open Daycare</a></p>`,
+            `<p>${url}</p>`
+        ].join("")
+    };
+}
+//# sourceMappingURL=appEmailAuth.js.map

package/dist/api/app-server/appEmailAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.js","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EACH,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF,OAAO,EAAE,mCAAmC,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAgBnG;;;GAGG;AACH,MAAM,OAAO,YAAY;IACJ,KAAK,CAAkB;IACvB,IAAI,CAAS;IACb,IAAI,CAAS;IACb,cAAc,CAAU;IACxB,WAAW,CAAU;IACrB,OAAO,CAAU;IACjB,QAAQ,CAAkC;IAC1C,IAAI,CAAwC;IAE7D,YAAY,OAA4B;QACpC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/D,MAAM,IAAI,CAAC,QAAQ,CACf,wBAAwB,CAAC;gBACrB,KAAK;gBACL,KAAK;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;aACxB,CAAC,CACL,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,OAA6B;QACtD,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YAChC,IAAI,EAAE;gBACF,KAAK,EAAE,eAAe;aACzB;YACD,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC;SACxF,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAA6B;QACrD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YAC/C,KAAK,EAAE;gBACH,KAAK,EAAE,eAAe;aACzB;YACD,OAAO,EAAE,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC;SACxF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO;YACH,KAAK;YACL,MAAM;SACT,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAC5C,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC9B,YAAY;aACf,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACR,OAAO,KAAK,CAAC,EAAE,CAAC;YACpB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAED,SAAS,iBAAiB,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CACvB,OAA4B,EAC5B,aAAwE;IAExE,OAAO,UAAU,CAAC;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC;QACvF,OAAO,EAAE;YACL,SAAS,EAAE,mCAAmC;SACjD;QACD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE;YACjC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE;gBACJ,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,oBAAoB;gBAC7B,OAAO,EAAE,oBAAoB;gBAC7B,YAAY,EAAE,yBAAyB;aAC1C;YACD,SAAS,EAAE,KAAK;SACnB,CAAC;QACF,OAAO,EAAE;YACL,SAAS,CAAC;gBACN,aAAa,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;oBACtC,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1C,CAAC;aACJ,CAAC;SACL;KACJ,CAAC,CAAC;AACP,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,IAAY,EAAE,cAAuB;IACnF,OAAO,cAAc,EAAE,IAAI,EAAE,IAAI,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAC7B,OAAwC,EACxC,IAAY,EACZ,IAAY,EACZ,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;IACzG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,OAAwC;IAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAQjC;IACG,MAAM,GAAG,GAAG,sBAAsB,CAC9B,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,IAAI,EACZ;QACI,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO;KAChB,EACD,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,cAAc,CACzB,CAAC;IAEF,OAAO;QACH,EAAE,EAAE,OAAO,CAAC,KAAK;QACjB,OAAO,EAAE,2BAA2B;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,wCAAwC,GAAG,EAAE;QACnD,IAAI,EAAE;YACF,6CAA6C;YAC7C,eAAe,GAAG,wBAAwB;YAC1C,MAAM,GAAG,MAAM;SAClB,CAAC,IAAI,CAAC,EAAE,CAAC;KACb,CAAC;AACN,CAAC"}

package/dist/api/app-server/appEmailAuth.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appEmailAuth.spec.d.ts.map

package/dist/api/app-server/appEmailAuth.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.spec.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.spec.ts"],"names":[],"mappings":""}

package/dist/api/app-server/appEmailAuth.spec.js

@@ -0,0 +1,95 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { storageOpenTest } from "../../storage/storageOpenTest.js";
+import { userConnectorKeyCreate } from "../../storage/userConnectorKeyCreate.js";
+import { AppEmailAuth } from "./appEmailAuth.js";
+const activeStorages = [];
+describe("AppEmailAuth", () => {
+    afterEach(async () => {
+        await Promise.all(activeStorages.splice(0).map((storage) => storage.connection.close()));
+    });
+    it("sends an email payload that targets the app auth screen", async () => {
+        const sent = [];
+        const storage = await storageOpenTest();
+        activeStorages.push(storage);
+        const auth = new AppEmailAuth({
+            db: storage.db,
+            users: storage.users,
+            host: "127.0.0.1",
+            port: 7332,
+            serverEndpoint: "https://api.example.com",
+            appEndpoint: "https://app.example.com",
+            secret: "12345678901234567890123456789012",
+            mailSend: async (message) => {
+                sent.push(message);
+            }
+        });
+        await auth.request("person@example.com");
+        expect(sent).toHaveLength(1);
+        expect(sent[0]?.to).toBe("person@example.com");
+        const payload = appEmailPayloadDecode(sent[0]?.text ?? "");
+        expect(payload.backendUrl).toBe("https://api.example.com");
+        expect(payload.kind).toBe("email");
+        expect(typeof payload.token).toBe("string");
+        expect(payload.token.length).toBeGreaterThan(0);
+    });
+    it("verifies a magic-link token and creates an email-scoped Daycare user", async () => {
+        const sent = [];
+        const storage = await storageOpenTest();
+        activeStorages.push(storage);
+        const auth = new AppEmailAuth({
+            db: storage.db,
+            users: storage.users,
+            host: "127.0.0.1",
+            port: 7332,
+            serverEndpoint: "https://api.example.com",
+            appEndpoint: "https://app.example.com",
+            secret: "12345678901234567890123456789012",
+            mailSend: async (message) => {
+                sent.push(message);
+            }
+        });
+        await auth.request("person@example.com");
+        const payload = appEmailPayloadDecode(sent[0]?.text ?? "");
+        const verified = await auth.verify(payload.token);
+        const user = await storage.users.findById(verified.userId);
+        expect(verified.email).toBe("person@example.com");
+        expect(user?.connectorKeys.map((entry) => entry.connectorKey)).toContain(userConnectorKeyCreate("email", "person@example.com"));
+    });
+    it("maps a verified email onto an existing Daycare user", async () => {
+        const sent = [];
+        const storage = await storageOpenTest();
+        activeStorages.push(storage);
+        const existing = await storage.users.create({
+            connectorKey: userConnectorKeyCreate("email", "person@example.com")
+        });
+        const auth = new AppEmailAuth({
+            db: storage.db,
+            users: storage.users,
+            host: "127.0.0.1",
+            port: 7332,
+            serverEndpoint: "https://api.example.com",
+            appEndpoint: "https://app.example.com",
+            secret: "12345678901234567890123456789012",
+            mailSend: async (message) => {
+                sent.push(message);
+            }
+        });
+        await auth.request("person@example.com");
+        const payload = appEmailPayloadDecode(sent[0]?.text ?? "");
+        const verified = await auth.verify(payload.token);
+        expect(verified.userId).toBe(existing.id);
+    });
+});
+function appEmailPayloadDecode(text) {
+    const match = text.match(/https?:\/\/\S+/);
+    if (!match?.[0]) {
+        throw new Error("Expected auth URL in email body.");
+    }
+    const url = new URL(match[0]);
+    const encoded = url.hash.startsWith("#") ? url.hash.slice(1) : url.hash;
+    if (!encoded) {
+        throw new Error("Expected auth hash payload.");
+    }
+    return JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+}
+//# sourceMappingURL=appEmailAuth.spec.js.map

package/dist/api/app-server/appEmailAuth.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailAuth.spec.js","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailAuth.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,cAAc,GAAc,EAAE,CAAC;AAErC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC1B,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC;YAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,yBAAyB;YACzC,WAAW,EAAE,yBAAyB;YACtC,MAAM,EAAE,kCAAkC;YAC1C,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC;YAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,yBAAyB;YACzC,WAAW,EAAE,yBAAyB;YACtC,MAAM,EAAE,kCAAkC;YAC1C,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAE3D,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CACpE,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,CAAC,CACxD,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;QACxC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACxC,YAAY,EAAE,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC;YAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,yBAAyB;YACzC,WAAW,EAAE,yBAAyB;YACtC,MAAM,EAAE,kCAAkC;YAC1C,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxE,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAInE,CAAC;AACN,CAAC"}

package/dist/api/app-server/appEmailConnect.d.ts

@@ -0,0 +1,36 @@
+import type { EmailMessage } from "../../email/emailSend.js";
+import type { UsersRepository } from "../../storage/usersRepository.js";
+export declare const APP_EMAIL_CONNECT_EXPIRES_IN_SECONDS: number;
+export type AppEmailConnectOptions = {
+    users: UsersRepository;
+    host: string;
+    port: number;
+    secret: string;
+    serverEndpoint?: string;
+    appEndpoint?: string;
+    replyTo?: string;
+    mailSend: (message: EmailMessage) => Promise<void>;
+};
+type AppEmailConnectHeaders = Headers | Record<string, string | string[] | undefined> | Array<[string, string]>;
+/**
+ * Sends and verifies email-connection links for an existing Daycare user.
+ * Expects: secret is stable for the app server and mailSend delivers outbound email.
+ */
+export declare class AppEmailConnect {
+    private readonly users;
+    private readonly host;
+    private readonly port;
+    private readonly secret;
+    private readonly serverEndpoint?;
+    private readonly appEndpoint?;
+    private readonly replyTo?;
+    private readonly mailSend;
+    constructor(options: AppEmailConnectOptions);
+    request(userId: string, email: string, _headers?: AppEmailConnectHeaders): Promise<void>;
+    verify(token: string): Promise<{
+        userId: string;
+        email: string;
+    }>;
+}
+export {};
+//# sourceMappingURL=appEmailConnect.d.ts.map

package/dist/api/app-server/appEmailConnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appEmailConnect.d.ts","sourceRoot":"","sources":["../../../sources/api/app-server/appEmailConnect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAIxE,eAAO,MAAM,oCAAoC,QAAU,CAAC;AAG5D,MAAM,MAAM,sBAAsB,GAAG;IACjC,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAEF,KAAK,sBAAsB,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAOhH;;;GAGG;AACH,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;gBAElD,OAAO,EAAE,sBAAsB;IAWrC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCxF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAwB1E"}