gemi 0.86.1 → 0.88.0

package/dist/ai/signing.d.ts

@@ -32,6 +32,14 @@ import { type NonceStore } from "./store/Nonces";
  * output" arm of `ClientToolResult` would be fabricating a server tool's result
  * rather than approving it. Binding the kind makes that a forgery instead of a
  * shape the caller has to remember to check.
+ *
+ * Keys and principals (#447). Neither token kind is MACed with `SECRET`
+ * itself: each is keyed with its own HKDF-derived key (`purposeKey` below), so
+ * a MAC minted for one purpose — a pending call, a parked-run record, or
+ * anything else in the app keyed off `SECRET` (CSRF, sessions) — is never a
+ * MAC for another. And each binds the `subject`, the principal the run was
+ * started for (`AgentController.runOwner`), so a token minted while user A was
+ * asked cannot be answered by user B, even with A's history in hand.
  */
 /** Everything the signature commits to. */
 export type PendingCallClaims = {
@@ -51,6 +59,14 @@ export type PendingCallClaims = {
      * being replayed as a top-level call, or as one nested under Y.
      */
     path?: string[];
+    /**
+     * Who the question was asked of: the run's owner (`AgentController.runOwner`,
+     * `user:<id>` by default). `null` or absent is nobody in particular — an
+     * anonymous run — and the two are the same claim. A token minted for one
+     * subject fails verification for any other, `null` included, so an approval
+     * cannot be carried from one user's session to another's.
+     */
+    subject?: string | null;
 };
 export type SignOptions = {
     /** Overrides `process.env.SECRET`. Exists for tests; apps use the app key. */
@@ -84,6 +100,20 @@ export type VerifyResult = {
     ok: false;
     reason: "malformed" | "expired" | "forged";
 };
+/**
+ * A key for one purpose, derived from the app secret with HKDF-SHA256.
+ *
+ * `SECRET` is also what CSRF tokens and sessions are keyed with. Using it as
+ * the HMAC key here would make every one of those a potential oracle for the
+ * others; HKDF with a purpose label gives each its own independent key, so a
+ * weakness or leak in one use cannot be turned against another — including
+ * the two token kinds in this file against each other.
+ *
+ * Memoized per (purpose, secret): verification is on the request path and the
+ * derivation is pure. The map is bounded by the number of purposes times the
+ * secrets a process ever sees, which is one outside of tests.
+ */
+export declare function purposeKey(purpose: string, override?: string): Buffer;
 /**
  * Serializes a value so that the same value always produces the same string.
  *
@@ -95,7 +125,7 @@ export type VerifyResult = {
  * keep their order because in an array order *is* the value.
  */
 export declare function canonicalize(value: unknown): string;
-/** `agt1.<runId>.<nonce>.<expiry>.<mac>`, all base64url or base36. */
+/** `agt2.<runId>.<nonce>.<expiry>.<mac>`, all base64url or base36. */
 export declare function signPendingCall(claims: PendingCallClaims, options?: SignOptions): string;
 /**
  * The metadata a signature carries in the clear.
@@ -158,6 +188,9 @@ export type NestedRunClaims = {
      * pending call makes: the input executed is the input signed.
      */
     input: unknown;
+    /** The run's owner, as on `PendingCallClaims.subject`: a record parked for
+     *  one principal does not re-enter a tool for another. */
+    subject?: string | null;
 };
 /**
  * Same shape as a pending call's token, so the same reader serves both — nonce

package/dist/ai/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAkB9D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAkDD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAmBF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAUD;qCACqC;AACrC,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAG1F;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAGxF"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAsC9D;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAUrE;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAoFD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA6Bd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;8DAC0D;IAC1D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAmCF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA6Bd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAUD;qCACqC;AACrC,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAK1F;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAKxF"}

package/dist/app/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{xa as a}from"../chunk-dadygfkf.js";import"../chunk-ndat0nf0.js";import"../chunk-9tsw1bmt.js";export{a as App};
+import{xa as a}from"../chunk-j0fgc58k.js";import"../chunk-7r78cdyd.js";import"../chunk-t93t317r.js";export{a as App};
 
 //# debugId=1DF7F2A4406AF3BE64756E2164756E21

package/dist/auth/AuthController.d.ts

@@ -2,10 +2,14 @@ import { Controller } from "../http/Controller";
 import { HttpRequest } from "../http/HttpRequest";
 import type { User } from "./types";
 /**
- * The digits of a magic-link PIN, as `AuthManager.createMagicLinkToken` makes
- * them.
+ * The longest code the PIN routes accept. A code is six digits by default,
+ * `emailCode.length` digits on `/auth/email-code`, or whatever non-empty
+ * string `generateCode` returns, so the format is not checked here; the code
+ * is compared as a keyed hash, never handed to a query.
  */
-export declare const PIN_PATTERN: RegExp;
+export declare const MAX_PIN_LENGTH = 256;
+/** A typed PIN, or `null` for what is not a non-empty string within `MAX_PIN_LENGTH`. */
+export declare function pinValue(value: unknown): string | null;
 declare class SignInRequest extends HttpRequest<{
     email: string;
     password: string;
@@ -56,6 +60,13 @@ export declare class AuthController extends Controller {
         session: import("./types").SessionWithUser;
         error?: undefined;
     }>;
+    /**
+     * The checks both PIN routes share: the verify rate limits, then the code.
+     * Every refusal is the `ValidationError` on `pin` these routes have always
+     * answered a wrong PIN with, so a client built before #708 shows it where it
+     * showed "Invalid pin"; a rate limit is the middleware's 429.
+     */
+    private verifyPinRequest;
     signInWithPinV2(req?: HttpRequest<{
         email: string;
         pin: string;
@@ -126,6 +137,37 @@ export declare class AuthController extends Controller {
     }, Record<string, never>>): Promise<{
         email: string;
     }>;
+    /**
+     * `POST /auth/email-code` `{ email }`: sends a one-time code (#708).
+     *
+     * Always `{ ok: true }`, whether or not the address has a user and whether
+     * or not one would be created, so the answer says nothing about accounts.
+     * An address that gets no code (unknown, with `createUser` off) is sent
+     * nothing and answered the same.
+     */
+    requestEmailCode(req?: HttpRequest<{
+        email: string;
+    }, Record<string, never>>): Promise<{
+        ok: true;
+    }>;
+    /**
+     * `POST /auth/email-code/verify` `{ email, code, name? }`: signs in with a
+     * code from `/auth/email-code`, creating the user first when there is none
+     * and `createUser` is on. Answers `{ session, isNewUser }` and sets the
+     * `access_token` cookie.
+     *
+     * A wrong, expired or missing code is a `ValidationError` on `code`
+     * (`invalid_code`); the guess past `maxAttempts` burns the code and is
+     * `too_many_attempts`.
+     */
+    verifyEmailCode(req?: HttpRequest<{
+        email: string;
+        code: string;
+        name?: string;
+    }, Record<string, never>>): Promise<{
+        session: import("./types").SessionWithUser;
+        isNewUser: boolean;
+    }>;
 }
 export {};
 //# sourceMappingURL=AuthController.d.ts.map

package/dist/auth/AuthController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMlD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AAqDhD;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAY,CAAC;AAyCrC,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAsBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAiD3C,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAmCnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAkCrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;IA8ClC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;IA8ChC,MAAM;IAyGN,OAAO,CAAC,GAAG,4DAAoB;IA8C/B,cAAc,CAAC,GAAG,wBAA8B;IAiChD,aAAa,CAAC,GAAG,uBAA6B;IAuD9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IAuCjE,aAAa,CAAC,GAAG,4DAAoB;;;IA+BrC,aAAa,CAAC,GAAG,4DAAoB;;;;;;;IA6H3C;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAwFzD,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;CAkBtE"}
+{"version":3,"file":"AuthController.d.ts","sourceRoot":"","sources":["../../auth/AuthController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AASlD,OAAO,KAAK,EAAc,IAAI,EAAE,MAAM,SAAS,CAAC;AAuFhD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,yFAAyF;AACzF,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAItD;AAKD,cAAM,aAAc,SAAQ,WAAW,CACrC;IACE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;;;;;MASJ;CACH;AAED,cAAM,qBAAsB,SAAQ,WAAW,CAC7C;IACE,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,cAAM,oBAAqB,SAAQ,WAAW,CAC5C;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,EACD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CACvB;IACC,MAAM;;;;;MAKJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IACtC,EAAE;IAUF,WAAW,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAsBtD,mBAAmB,CAAC,GAAG,4DAAoB;;;;;;;IAwCjD;;;;;OAKG;YACW,gBAAgB;IA0BxB,eAAe,CACnB,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;IAqBnD,aAAa,CAAC,GAAG;eAA4B,MAAM;aAAO,MAAM;6BAAK;;;IAoBrE,QAAQ,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ClC,MAAM,CAAC,GAAG,gBAAsB;;;;;;;;;;IA+ChC,MAAM;IAyGN,OAAO,CAAC,GAAG,4DAAoB;IA8C/B,cAAc,CAAC,GAAG,wBAA8B;IAiChD,aAAa,CAAC,GAAG,uBAA6B;IAuD9C,cAAc,CAClB,GAAG;qBAAkC,MAAM;qBAAe,MAAM;6BAAK;IAuCjE,aAAa,CAAC,GAAG,4DAAoB;;;IA+BrC,aAAa,CAAC,GAAG,4DAAoB;;;;;;;IAoI3C;;;;;OAKG;cACa,gBAAgB,CAAC,IAAI,EAAE;QACrC,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IAwFzD,oBAAoB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IA0BrE;;;;;;;OAOG;IACG,gBAAgB,CAAC,GAAG;eAA4B,MAAM;6BAAK;;;IAuBjE;;;;;;;;;OASG;IACG,eAAe,CACnB,GAAG;eAA4B,MAAM;cAAQ,MAAM;eAAS,MAAM;6BAAK;;;;CAiF1E"}

package/dist/auth/AuthManager.d.ts

@@ -1,5 +1,5 @@
 import { HttpRequest } from "../http";
-import type { SessionWithUser } from "./types";
+import type { MagicLinkTokenRow, SessionWithUser } from "./types";
 import { type AuthConfig } from "./config";
 import { UserProvider } from "./UserProvider";
 import type { CreateCookieOptions } from "../http/requestContext";
@@ -165,6 +165,14 @@ export declare class AuthManager {
         email: string;
         id?: number;
     }): Promise<SessionWithUser>;
+    /**
+     * Issues a magic link and PIN for an existing user, as `/auth/magic-link`
+     * and `Auth.createMagicLink` always have, and returns them as issued for the
+     * app to mail. An address with no user gets `{}` and nothing is written.
+     *
+     * Since 0.88 the stored row holds hashes of both (#708); the plain values
+     * exist only in what this returns.
+     */
     createMagicLinkToken(email: string): Promise<{
         user: import("./types").User;
         email: string;
@@ -176,5 +184,38 @@ export declare class AuthManager {
         pin?: undefined;
         token?: undefined;
     }>;
+    /**
+     * Replaces any outstanding code for `email` with a new one and stores it
+     * hashed. Writes whether or not a user has the address; callers decide that.
+     */
+    issueOneTimeCode(email: string, length: number): Promise<{
+        email: string;
+        pin: string;
+        token: string;
+    }>;
+    /**
+     * Checks a typed code against the outstanding row for `email`, and on a
+     * match deletes the row, so the code works once. Every guess counts against
+     * `emailCode.maxAttempts`, the right one included, before the comparison;
+     * the guess past the limit deletes the row. The comparison is of keyed
+     * hashes, in constant time.
+     *
+     * `claim: false` leaves the row for the caller to claim (with
+     * `userProvider.claimMagicLinkToken`) inside a transaction of its own.
+     */
+    verifyOneTimeCode(email: string, code: unknown, options?: {
+        claim?: boolean;
+    }): Promise<{
+        status: "ok";
+        row: MagicLinkTokenRow;
+    } | {
+        status: "invalid" | "expired" | "too_many_attempts";
+    }>;
+    /**
+     * The link counterpart of `verifyOneTimeCode`, for
+     * `/auth/sign-in/magic-link`: valid for `emailCode.linkExpiresInMinutes`,
+     * single use. Not attempt-counted: a 256-bit token is not guessed.
+     */
+    verifyMagicLinkToken(email: string, token: unknown): Promise<boolean>;
 }
 //# sourceMappingURL=AuthManager.d.ts.map

package/dist/auth/AuthManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../../auth/AuthManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAItC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAEL,KAAK,UAAU,EAEhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAgClE,qBAAa,WAAW;IACtB,MAAM,CAAC,KAAK,SAAU;IAEtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAKtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;;;;;;;;;;OAcG;gBAED,MAAM,GAAE,UAAe,EACvB,QAAQ,GAAE,YAAY,CAAC,GAAG,CAAsB;IAMlD;;;OAGG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,+EAA+E;IAC/E,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;IAcxF;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAKpB,4EAA4E;IAC5E,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IAgB5D;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAiCjD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IAiElC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM;IA0BvE,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB;IAK7B;;;;;;;;;;OAUG;YACW,YAAY;IA4B1B,OAAO,CAAC,aAAa;IASf,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAE/B,aAAa,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAI1D,YAAY,CAAC,KAAK,EAAE,MAAM;IA0B1B,uBAAuB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IAalE;;;;;;;;;;;;;;;;;;OAkBG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IA4B1D,oBAAoB,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;CA4BzC"}
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../../auth/AuthManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAItC,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAOlE,OAAO,EAGL,KAAK,UAAU,EAEhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAgClE,qBAAa,WAAW;IACtB,MAAM,CAAC,KAAK,SAAU;IAEtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAKtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;;;;;;;;;;OAcG;gBAED,MAAM,GAAE,UAAe,EACvB,QAAQ,GAAE,YAAY,CAAC,GAAG,CAAsB;IAWlD;;;OAGG;IACH,IAAI,YAAY,IAAI,YAAY,CAE/B;IAED,+EAA+E;IAC/E,wBAAwB,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;IAcxF;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAKpB,4EAA4E;IAC5E,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,SAAS;IAgB5D;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IAiCjD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,oBAAoB;IAiElC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM;IA0BvE,8EAA8E;IAC9E,OAAO,CAAC,qBAAqB;IAK7B;;;;;;;;;;OAUG;YACW,YAAY;IA4B1B,OAAO,CAAC,aAAa;IASf,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAE/B,aAAa,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAI1D,YAAY,CAAC,KAAK,EAAE,MAAM;IA0B1B,uBAAuB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IAalE;;;;;;;;;;;;;;;;;;OAkBG;IACG,qBAAqB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;IA4BhE;;;;;;;OAOG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;IAgBxC;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;IAgBpD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAChC,OAAO,CACN;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,iBAAiB,CAAA;KAAE,GACxC;QAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAA;KAAE,CAC1D;IAgCD;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;CAY5E"}

package/dist/auth/UserProvider.d.ts

@@ -1,4 +1,4 @@
-import type { Account, AuthModels, CreateAccountArgs, CreateMagicLinkTokenArgs, CreatePasswordResetTokenArgs, CreateSessionArgs, CreateSocialAccountArgs, CreateUserArgs, DeletePasswordResetTokenArgs, DeleteSessionArgs, FindPasswordResetTokenArgs, FindSessionArgs, Invitation, PasswordResetToken, SessionWithUser, SocialAccount, UpdateSessionArgs, UpdateUserPasswordArgs, User } from "./types";
+import type { Account, AuthModels, CreateAccountArgs, CreateMagicLinkTokenArgs, MagicLinkTokenRow, CreatePasswordResetTokenArgs, CreateSessionArgs, CreateSocialAccountArgs, CreateUserArgs, DeletePasswordResetTokenArgs, DeleteSessionArgs, FindPasswordResetTokenArgs, FindSessionArgs, Invitation, PasswordResetToken, SessionWithUser, SocialAccount, UpdateSessionArgs, UpdateUserPasswordArgs, User } from "./types";
 /**
  * The `select` all three session queries — `findSession`, `updateSession` and
  * `createSessionV2` — run with, unless a provider's `sessionSelect()` returns
@@ -208,11 +208,28 @@ export declare class UserProvider<TSession = SessionWithUser> {
         token: string;
         pin: string;
     }>;
+    /**
+     * @deprecated Looks the row up by the value as given, and since 0.88 the
+     * columns hold hashes (#708), so a code or token as issued no longer finds
+     * its row. gemi's routes do not call this; use `findMagicLinkTokenByEmail`.
+     */
     findUserMagicLinkToken(args: {
         token?: string;
         pin?: string;
         email: string;
     }): Promise<User | null>;
+    /**
+     * The newest one-time-code row for `email`, or null. `AuthManager` compares
+     * the hashes itself, in constant time, rather than asking the database for a
+     * row matching the code (#708).
+     */
+    findMagicLinkTokenByEmail(email: string): Promise<MagicLinkTokenRow | null>;
+    /**
+     * Deletes row `id` and reports whether this call is the one that deleted it.
+     * Two requests verifying the same code at once both match it; only the one
+     * that gets `true` here may sign in.
+     */
+    claimMagicLinkToken(id: number): Promise<boolean>;
     deleteMagicLinkToken(email: string): Promise<void>;
     createSocialAccount(args: CreateSocialAccountArgs): Promise<any>;
     /**

package/dist/auth/UserProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserProvider.d.ts","sourceRoot":"","sources":["../../auth/UserProvider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,4BAA4B,EAC5B,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,IAAI,EACL,MAAM,SAAS,CAAC;AAsJjB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;CAQhB,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAElE;;;;;;;;;GASG;AACH,qBAAa,YAAY,CAAC,QAAQ,GAAG,eAAe;IAMtC,SAAS,CAAC,MAAM,EAAE,UAAU;IALxC;;;;OAIG;gBACmB,MAAM,GAAE,UAA6B;IAE3D;;;;;;;OAOG;IACH,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,aAAa,IAAI,aAAa;IAIxC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBzE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/D,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC;IAaV,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAShE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAMtE;;;;OAIG;IACG,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMjE;;;;;;;;;OASG;IACG,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAsBlE;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAUhE,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D;;;;;;;;OAQG;IACG,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAU7D,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpD,wBAAwB,CAC5B,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC;IAWZ,sBAAsB,CAC1B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAU/B,wBAAwB,CAC5B,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC;IAMZ,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC;IAWhB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAY/D,oBAAoB,CACxB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAQpC,sBAAsB,CAAC,IAAI,EAAE;QACjC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwBlB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC;IAMtE;;;;;;;;;;;OAWG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAWjB,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC;IAS3B;;;;;;;OAOG;IACG,kBAAkB,CACtB,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,YAAY,CAAC,EACjD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;CASpB"}
+{"version":3,"file":"UserProvider.d.ts","sourceRoot":"","sources":["../../auth/UserProvider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,EAC5B,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,4BAA4B,EAC5B,iBAAiB,EACjB,0BAA0B,EAC1B,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,IAAI,EACL,MAAM,SAAS,CAAC;AAsJjB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;CAQhB,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAElE;;;;;;;;;GASG;AACH,qBAAa,YAAY,CAAC,QAAQ,GAAG,eAAe;IAMtC,SAAS,CAAC,MAAM,EAAE,UAAU;IALxC;;;;OAIG;gBACmB,MAAM,GAAE,UAA6B;IAE3D;;;;;;;OAOG;IACH,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,aAAa,IAAI,aAAa;IAIxC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuBzE;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAa/D,sBAAsB,CAC1B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,IAAI,CAAC;IAaV,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAShE,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAMtE;;;;OAIG;IACG,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAMjE;;;;;;;;;OASG;IACG,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAsBlE;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAUhE,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc3D;;;;;;;;OAQG;IACG,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAU7D,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpD,wBAAwB,CAC5B,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC;IAWZ,sBAAsB,CAC1B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAU/B,wBAAwB,CAC5B,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,MAAM,CAAC;IAMZ,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC;IAWhB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAY/D,oBAAoB,CACxB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAQ1C;;;;OAIG;IACG,sBAAsB,CAAC,IAAI,EAAE;QACjC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAwBxB;;;;OAIG;IACG,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOjD,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC;IAMtE;;;;;;;;;;;OAWG;IACG,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAWjB,kBAAkB,CACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,EAAE,CAAC;IAS3B;;;;;;;OAOG;IACG,kBAAkB,CACtB,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,YAAY,CAAC,EACjD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;CASpB"}

package/dist/auth/config.d.ts

@@ -1,6 +1,90 @@
 import type { HttpRequest } from "../http/HttpRequest";
 import type { SessionWithUser, User } from "./types";
 import type { OAuthProvider } from "./oauth/OAuthProvider";
+import type { CodeRateLimits } from "./oneTimeCode";
+/** What `emailCode.send` is handed. */
+export interface EmailCodeSendArgs {
+    /** Normalized: trimmed and lowercased. */
+    email: string;
+    /** The one-time code, as typed. Never stored like this. */
+    code: string;
+    /**
+     * A one-time link token for the same row, for an email that offers a link
+     * as well as a code (`/auth/sign-in/magic-link?email=&token=`).
+     */
+    token: string;
+    /** No user has this address yet; verifying the code will create one. */
+    isNewUser: boolean;
+    req: HttpRequest<any, any>;
+}
+/**
+ * One-time email codes (#708). The security settings here (`expiresInMinutes`,
+ * `maxAttempts`, `requestLimit`, `verifyLimit`, `linkExpiresInMinutes`) apply
+ * to the older `/auth/magic-link` + `/auth/sign-in-with-pin(-v2)` pair too,
+ * whether or not `enabled` is on. `enabled`, `createUser`, `length` and `send`
+ * are for `POST /auth/email-code` and `/auth/email-code/verify` only.
+ */
+export interface EmailCodeConfig {
+    /** Serves `/auth/email-code` and `/auth/email-code/verify`. Default `false`: both answer 404. */
+    enabled?: boolean;
+    /**
+     * Sign-up-or-sign-in: an address with no user gets a code too, and verifying
+     * it creates the user (verified, inside the same transaction as
+     * `onUserCreated`). Default `false`: an unknown address is sent nothing, and
+     * the request answers exactly as it would for a known one.
+     */
+    createUser?: boolean;
+    /** Digits in a code from `/auth/email-code`. Default 6. `/auth/magic-link` PINs stay 6. */
+    length?: number;
+    /** How long a code (PIN) can be used. Default 10. */
+    expiresInMinutes?: number;
+    /**
+     * How long the link token issued with the code can be used, on
+     * `/auth/sign-in/magic-link`. Default 7 days. A link carries 256 random
+     * bits, so it is not guessable the way a code is; this bounds how long an
+     * old email stays a key.
+     */
+    linkExpiresInMinutes?: number;
+    /** Wrong guesses one code survives; the next one burns it. Default 5. */
+    maxAttempts?: number;
+    /**
+     * Requests for a code (`/auth/email-code` and `/auth/magic-link`).
+     * Default `{ perEmail: [5, 900], perIp: [20, 900] }`. Over it: 429
+     * `{ error: { kind: "rate_limit" } }`.
+     */
+    requestLimit?: CodeRateLimits;
+    /**
+     * Guesses (`/auth/email-code/verify` and `/auth/sign-in-with-pin(-v2)`).
+     * Default `{ perEmail: [10, 900], perIp: [50, 900] }`. Its `perIp` also
+     * limits `/auth/sign-in/magic-link`, on a counter of its own; the link spends
+     * no per-address budget, since a 256-bit token is not guessed.
+     */
+    verifyLimit?: CodeRateLimits;
+    /**
+     * `/auth/magic-link` answers `{ email: null }` for an address with no user,
+     * which tells anyone asking whether it has an account. Clients built against
+     * that (they treat `null` as "no account") keep working while this is
+     * `false`, the default. `true` answers `{ email }` for every address.
+     * `/auth/email-code` never reveals it.
+     */
+    uniformMagicLinkResponse?: boolean;
+    /**
+     * Delivers a code from `/auth/email-code`. Awaited before the request
+     * answers, so for an answer that takes the same time whether or not an
+     * address gets a code, enqueue the mail here rather than sending it inline.
+     * Unset, the code is logged outside production and dropped in it.
+     */
+    send?: (args: EmailCodeSendArgs) => Promise<void> | void;
+}
+/** What `onAuthenticated` is handed. */
+export interface AuthenticatedArgs {
+    user: User;
+    session: any;
+    /** The user was created by this sign-in (email code, or a first OAuth sign-in). */
+    isNewUser: boolean;
+    method: "password" | "email-code" | "magic-link" | "oauth";
+    req: HttpRequest<any, any>;
+}
 /**
  * Decides whether a pre-0.64 session is converted to a `v2.` one. See
  * `AuthConfig.migrateLegacySession`.
@@ -137,7 +221,32 @@ export interface AuthConfig {
         token: string;
         pin: string;
     }) => Promise<void> | void;
+    /** One-time email codes, and the limits on the magic-link PIN routes. See `EmailCodeConfig`. */
+    emailCode?: EmailCodeConfig;
+    /**
+     * The code to issue for `email`, on `/auth/magic-link`, `Auth.createMagicLink`
+     * and `/auth/email-code`. Return nothing for the default, random digits.
+     *
+     * For fixed test accounts, instead of rewriting the stored `pin` after the
+     * fact (the column holds a hash now, so such a rewrite no longer matches):
+     *
+     *     generateCode: (email) =>
+     *       process.env.APP_ENV !== "production" && email.endsWith("+e2e@example.com")
+     *         ? "000000"
+     *         : undefined,
+     */
+    generateCode?: (email: string) => string | null | undefined | Promise<string | null | undefined>;
+    /**
+     * Fires after every sign-in that sets a session: password, PIN or link,
+     * email code, OAuth. Unlike `onSignIn` it has the request, so it can read a
+     * cookie or header the app set before sign-in (an anonymous owner id, say)
+     * and claim that work for `user`, and it says whether the user is new.
+     * Fires after the session is committed; a throw fails the response but not
+     * the sign-in.
+     */
+    onAuthenticated?: (args: AuthenticatedArgs) => Promise<void> | void;
 }
+export declare function emailCodeDefaults(config?: EmailCodeConfig): Required<EmailCodeConfig>;
 /**
  * The default `verifyPassword`: `false` for anything that is not a hash it can
  * check, rather than an exception.

package/dist/auth/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CAyCtB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../auth/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,GAAG,CAAC;IACb,mFAAmF;IACnF,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC;IAC3D,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE;IACH,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;CACnB,KACE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAGhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAEpD,aAAa,CAAC,EAAE,UAAU,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,2BAA2B,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,8BAA8B,CAAC,EAAE,CAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGrE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,IAAI,EACV,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,CACT,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnD,gBAAgB,CAAC,EAAE,CACjB,IAAI,EAAE,GAAG,EACT,iBAAiB,EAAE,MAAM,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,kBAAkB,CAAC,EAAE,CACnB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,KAChD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B,gGAAgG;IAChG,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAEpE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACrE;AAcD,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,eAAoB,GAAG,QAAQ,CAAC,eAAe,CAAC,CAiCzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D;AAID,wBAAgB,kBAAkB,CAChC,MAAM,GAAE,UAAe,GACtB,QAAQ,CAAC,UAAU,CAAC,CA4CtB"}

package/dist/auth/oneTimeCode.d.ts

@@ -0,0 +1,99 @@
+import type { HttpRequest } from "../http/HttpRequest";
+import { RateLimiter } from "../services/rate-limiter/RateLimiter";
+/**
+ * The one-time secrets behind `/auth/magic-link`, `/auth/sign-in-with-pin(-v2)`,
+ * `/auth/sign-in/magic-link` and `/auth/email-code(/verify)` (#708).
+ *
+ * All of them live in the `MagicLinkToken` table, one row per email: a 256-bit
+ * link `token` and a short numeric `pin`. Neither is stored as issued. Both
+ * columns hold `h1.` + HMAC-SHA256 under the app's `SECRET`, keyed to the email
+ * and to which of the two it is, so a database read alone gives an attacker
+ * nothing to type: a 6-digit code is a million candidates, trivial to search
+ * against a bare SHA-256, and a keyed hash takes that away.
+ *
+ * Verification reads the row by email and compares hashes with
+ * `timingSafeEqual`, instead of asking the database for a row matching
+ * `(pin, email)`. The schema is unchanged: the hash fits the existing `String`
+ * columns, the `@@unique`s stay satisfied, and `createdAt` dates the row for
+ * the expiry. The attempt count is kept in the rate limiter, keyed by the row,
+ * so no column is needed for it either.
+ */
+/** The prefix a hashed column value carries. A value without it was written before 0.88. */
+export declare const ONE_TIME_HASH_PREFIX = "h1.";
+export type OneTimeSecretKind = "pin" | "link";
+export declare function hashOneTimeSecret(kind: OneTimeSecretKind, email: string, value: string): string;
+/**
+ * Whether `candidate` is what `stored` was issued as, in time that depends on
+ * neither.
+ *
+ * A row written before hashing (a plain PIN or token, at most one expiry old
+ * after the upgrade) is compared as it is, still in constant time, so a code
+ * mailed moments before a deploy keeps working until it expires.
+ */
+export declare function oneTimeSecretMatches(kind: OneTimeSecretKind, email: string, stored: string | null | undefined, candidate: unknown): boolean;
+/** `length` random decimal digits, each drawn without modulo bias. */
+export declare function randomDigits(length: number): string;
+/**
+ * The longest address any of these routes accepts: 64 for the local part, 1
+ * for the `@`, 255 for the domain. Past it a value is refused before it becomes
+ * a rate-limit key or a database lookup; the request body can be megabytes, and
+ * a limiter keeps a key for every request it counted, refused or not.
+ */
+export declare const MAX_EMAIL_LENGTH = 320;
+/**
+ * What the magic-link and PIN routes have always done to an address: trim and
+ * lowercase, nothing more, so an account they could reach before (an address
+ * without a TLD, a synthetic identifier) is still reachable. `null` for what is
+ * not a non-empty string, which used to be a 500, and for anything longer than
+ * `MAX_EMAIL_LENGTH`.
+ */
+export declare function foldEmail(value: unknown): string | null;
+/**
+ * The stricter form `/auth/email-code` takes: folded, and shaped like an
+ * address, since it may create a user from it.
+ */
+export declare function normalizeEmail(value: unknown): string | null;
+/** `[count, windowSeconds]`, or `false` to switch that limit off. */
+export type CodeRateLimit = [count: number, windowSeconds: number] | false;
+export interface CodeRateLimits {
+    perEmail?: CodeRateLimit;
+    perIp?: CodeRateLimit;
+}
+/**
+ * The app's rate limiter, or a process-local one when none is bound (a test, a
+ * kernel without `RateLimiterServiceProvider`). Unlike `RateLimitMiddleware`,
+ * this never skips limiting for want of a service: the attempt cap is what
+ * keeps a 6-digit code from being guessed, so it has to count somewhere.
+ */
+export declare function codeLimiter(): RateLimiter;
+/** Drops the process-local limiter's counters. For tests. */
+export declare function resetFallbackCodeLimiter(): void;
+/**
+ * A limiter key part as it is when short, else its SHA-256. The parts come
+ * from the client (an address, an `x-forwarded-for`), and a key is held for
+ * the whole window, so none may cost more than a hash's worth of memory.
+ */
+export declare function limiterKeyPart(value: string): string;
+/**
+ * Spends one hit of each configured limit for `scope`, per IP first and then
+ * per email, and throws the middleware's 429 (`{ error: { kind: "rate_limit" } }`)
+ * on the first one that is spent. An IP over its limit does not also spend the
+ * address's budget, so somebody hammering from one address cannot use up a
+ * victim's.
+ *
+ * `email: null` spends the IP budget only: a request whose address was refused
+ * (missing, malformed, over `MAX_EMAIL_LENGTH`) still counts against its IP,
+ * but never makes a per-address key.
+ */
+export declare function enforceCodeRateLimits(scope: "request" | "verify" | "link", email: string | null, req: HttpRequest<any, any>, limits: CodeRateLimits): Promise<void>;
+/**
+ * Counts one guess at the code in row `rowId` and reports whether it is within
+ * `maxAttempts`. The key names the row, so a newly issued code starts at zero.
+ *
+ * The limiter is a sliding window, which lets a count decay. The window is at
+ * least a day and at least `(maxAttempts + 1)` code lifetimes, so over the
+ * time a code can still be used the count decays by less than one guess and
+ * the cap holds for any `expiresInMinutes` (#708).
+ */
+export declare function countCodeAttempt(rowId: number | string, issuedAt: number, maxAttempts: number, expiresInMinutes?: number): Promise<boolean>;
+//# sourceMappingURL=oneTimeCode.d.ts.map

package/dist/auth/oneTimeCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oneTimeCode.d.ts","sourceRoot":"","sources":["../../auth/oneTimeCode.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGnE;;;;;;;;;;;;;;;;;GAiBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,MAAM,CAAC;AAE/C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,SAAS,EAAE,OAAO,GACjB,OAAO,CAeT;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQvD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAY5D;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;AAE3E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAID;;;;;GAKG;AACH,wBAAgB,WAAW,IAAI,WAAW,CAazC;AAED,6DAA6D;AAC7D,wBAAgB,wBAAwB,SAEvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EACpC,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAC1B,MAAM,EAAE,cAAc,iBAiBvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,GAAG,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,gBAAgB,SAAK,GACpB,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/auth/routes.d.ts

@@ -91,6 +91,19 @@ export declare class AuthApiRouter extends ApiRouter {
             email: string;
             pin: string;
         }, Promise<import("./types").SessionWithUser>, Record<string, never>>;
+        "/email-code": import("../http/ApiRouter").RouteHandler<"POST", {
+            email: string;
+        }, Promise<{
+            ok: true;
+        }>, Record<string, never>>;
+        "/email-code/verify": import("../http/ApiRouter").RouteHandler<"POST", {
+            email: string;
+            code: string;
+            name?: string;
+        }, Promise<{
+            session: import("./types").SessionWithUser;
+            isNewUser: boolean;
+        }>, Record<string, never>>;
     };
 }
 export {};

package/dist/auth/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;MAMJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;MAMJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAaJ;CACH"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,cAAM,eAAgB,SAAQ,UAAU;IACtC,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;MAMJ;CACH;AAED,qBAAa,cAAe,SAAQ,UAAU;IAC5C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;MAMJ;CACH;AAED,qBAAa,aAAc,SAAQ,SAAS;IAC1C,WAAW,WAAqB;IAChC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAiBJ;CACH"}

package/dist/auth/types.d.ts

@@ -136,4 +136,12 @@ export interface CreateMagicLinkTokenArgs {
     token: string;
     pin: string;
 }
+/** A `MagicLinkToken` row. `token` and `pin` hold hashes (see `auth/oneTimeCode.ts`). */
+export interface MagicLinkTokenRow {
+    id: number;
+    email: string;
+    token: string;
+    pin: string;
+    createdAt: Date;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,GAAG,CAAC;IACV,OAAO,EAAE,GAAG,CAAC;IACb,OAAO,EAAE,GAAG,CAAC;IACb,kBAAkB,EAAE,GAAG,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC;IACpB,sBAAsB,EAAE,GAAG,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,GAAG,CAAC;IACV,OAAO,EAAE,GAAG,CAAC;IACb,OAAO,EAAE,GAAG,CAAC;IACb,kBAAkB,EAAE,GAAG,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC;IACpB,sBAAsB,EAAE,GAAG,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,EAAE,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,iBAAiB,EAAE,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,IAAI,CAAC;CACjB"}