Refresh UI components and showcase; release updated framework packages

packages/auth/src/engine.ts

@@ -2081,7 +2081,9 @@ export function createAuthEngine(options: AuthEngineOptions): AuthEngine {
       const verification = verificationUnavailable(user);
       if (verification) return verification;
       account = await engine.linkOAuth(user.id, providerName, normalizedProfile, tokens);
-      const deviceCheck = await newDeviceRequirement(user, {
+      const providerVerifiesDevice = verifiedEmail &&
+        options.verifiedOAuthDeviceProviders?.some((name) => normalizedOAuthProvider(name) === providerName);
+      const deviceCheck = providerVerifiesDevice ? undefined : await newDeviceRequirement(user, {
         ...sessionInput,
         oauthProvider: providerName,
       });

packages/auth/src/index.ts

@@ -28,6 +28,7 @@ export {
 } from "./http/index.ts";
 export {
   authPlugin,
+  configureAuthRuntime,
   authComponentsDir,
   validateProductionAuthConfig,
   type AuthConfig,

packages/auth/src/plugin.ts

@@ -207,6 +207,26 @@ function resolveConfig(
   };
 }
 
+/** Restore auth state in a production server using its runtime configuration. */
+export function configureAuthRuntime(config: AuthConfig): void {
+  applyRuntimeConfig(resolveConfig({ auth: config }, {}));
+}
+
+function applyRuntimeConfig(value: ResolvedAuthConfig): void {
+  if (value.enabled && value.engine) setDefaultAuthEngine(value.engine);
+  else clearDefaultAuthEngine();
+  setDefaultAuthSchemas(value.schemas);
+  setDefaultAuthRouteOptions({
+    baseUrl: value.baseUrl,
+    csrf: value.csrf,
+    passkey: value.passkey,
+    sessionCookieName: value.sessionCookieName,
+    onSessionVerification: value.onSessionVerification,
+    oauth: value.enabled ? value.oauth : {},
+    oauthMfaPath: value.oauthMfaPath,
+  });
+}
+
 function fallbackConfig(options: AuthPluginOptions): ResolvedAuthConfig {
   return {
     enabled: true,
@@ -432,27 +452,7 @@ export function authPlugin(options: AuthPluginOptions = {}) {
         schemas: value.schemas,
       };
 
-      if (value.engine) {
-        setDefaultAuthEngine(value.engine);
-      } else {
-        clearDefaultAuthEngine();
-      }
-
-      setDefaultAuthSchemas(value.schemas);
-
-      setDefaultAuthRouteOptions({
-        baseUrl: value.baseUrl,
-
-        csrf: value.csrf,
-
-        passkey: value.passkey,
-
-        sessionCookieName: value.sessionCookieName,
-
-        onSessionVerification: value.onSessionVerification,
-        oauth: value.oauth,
-        oauthMfaPath: value.oauthMfaPath,
-      });
+      applyRuntimeConfig(value);
 
       context.metadata.set("@wrnexus/auth:component-dir", value.componentDir);
 

packages/auth/src/types.ts

@@ -440,6 +440,8 @@ export interface AuthEngineOptions {
   trustedDeviceTtlMs?: number;
   /** Require verified email/SMS confirmation before a new browser receives a session. */
   requireTrustedDeviceVerification?: boolean;
+  /** Verified email from these OAuth providers satisfies the additional new-device check. Account MFA still applies. */
+  verifiedOAuthDeviceProviders?: string[];
   /** Remember the registration browser after required account verification succeeds. */
   trustSignupDevice?: boolean;
   tokenTtlMs?: Partial<Record<AuthTokenPurpose, number>>;