@aooth/auth 0.1.58 → 0.1.60

package/dist/atscript-db.d.cts

@@ -1,6 +1,5 @@
 import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-C0O0FCCN.cjs";
-import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-Cujxec8n.cjs";
-
+import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-CafYRhI4.cjs";
 //#region src/atscript-db/authz-stores.d.ts
 /**
  * atscript-db-backed durable implementations of the two short-lived

package/dist/atscript-db.d.mts

@@ -1,6 +1,5 @@
 import { c as CredentialSuccessorRef, r as CredentialStore, s as CredentialState, t as Clock } from "./clock-C0O0FCCN.mjs";
-import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-DEGFMiTK.mjs";
-
+import { c as AuthCodeStore, d as NewAuthCode, h as PendingAuthorizationStore, m as PendingAuthorization, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient } from "./dynamic-client-store-BCAqzG0Y.mjs";
 //#region src/atscript-db/authz-stores.d.ts
 /**
  * atscript-db-backed durable implementations of the two short-lived

package/dist/{auth-credential-C9xy4X_k.d.mts → auth-credential-C5DiSbb2.d.mts}

@@ -1,5 +1,4 @@
 import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.mjs";
-
 //#region src/credential/auth-credential.d.ts
 interface AuthCredentialOptions<TPayload extends object = object> {
   /** Pluggable credential store (Memory, JWT, Encapsulated, ...). */

package/dist/{auth-credential-C5zD8b0J.d.cts → auth-credential-CU4vsKhu.d.cts}

@@ -1,5 +1,4 @@
 import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.cjs";
-
 //#region src/credential/auth-credential.d.ts
 interface AuthCredentialOptions<TPayload extends object = object> {
   /** Pluggable credential store (Memory, JWT, Encapsulated, ...). */

package/dist/authz.d.cts

@@ -1,7 +1,6 @@
 import { t as Clock } from "./clock-C0O0FCCN.cjs";
-import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-Cujxec8n.cjs";
+import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-CafYRhI4.cjs";
 import { JWK } from "jose";
-
 //#region src/authz/authz-errors.d.ts
 /**
  * Failure taxonomy for the authorization-server endpoints (AUTH-SERVER.md §7).
@@ -10,12 +9,26 @@ import { JWK } from "jose";
  * code. Messages are benign — they must not disclose whether a failure was an
  * unknown client vs. a bad redirect vs. an expired code.
  */
-type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** A known client used a grant/response it is not allowed (Tier 2). */ | "unauthorized_client"
+type AuthorizeErrorCode =
+/** Missing or malformed parameter at `/authorize` or `/token`. */
+"invalid_request" |
+/** `redirect_uri` is not an allowed (loopback / registered) target. */
+"invalid_redirect" |
+/** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */
+"invalid_grant" |
+/** Unknown or unauthenticated client (Tier 2). */
+"invalid_client" |
+/** A known client used a grant/response it is not allowed (Tier 2). */
+"unauthorized_client" |
 /**
  * RFC 8707: more than one `resource` value on a leg, or the `/token`
  * `resource` differs from the one recorded at `/authorize`.
  */
-| "invalid_target" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
+"invalid_target" |
+/** The user declined the authorization (consent). */
+"access_denied" |
+/** An unexpected server-side failure. */
+"server_error";
 /** A typed authorization-server failure. */
 declare class AuthorizeError extends Error {
   readonly code: AuthorizeErrorCode;

package/dist/authz.d.mts

@@ -1,7 +1,6 @@
 import { t as Clock } from "./clock-C0O0FCCN.mjs";
-import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-DEGFMiTK.mjs";
+import { _ as PendingAuthorizationStoreMemoryOptions, a as DynamicClientStoreMemoryOptions, b as tokenPolicyToIssueOptions, c as AuthCodeStore, d as NewAuthCode, f as DEFAULT_PENDING_TTL_MS, g as PendingAuthorizationStoreMemory, h as PendingAuthorizationStore, i as DynamicClientStoreMemory, l as AuthCodeStoreMemory, m as PendingAuthorization, n as DynamicClientAuthMethod, o as NewDynamicClient, p as NewPendingAuthorization, r as DynamicClientStore, s as AuthCode, t as DynamicClient, u as AuthCodeStoreMemoryOptions, v as DEFAULT_AUTHZ_REFRESH_TTL_MS, y as TokenPolicy } from "./dynamic-client-store-BCAqzG0Y.mjs";
 import { JWK } from "jose";
-
 //#region src/authz/authz-errors.d.ts
 /**
  * Failure taxonomy for the authorization-server endpoints (AUTH-SERVER.md §7).
@@ -10,12 +9,26 @@ import { JWK } from "jose";
  * code. Messages are benign — they must not disclose whether a failure was an
  * unknown client vs. a bad redirect vs. an expired code.
  */
-type AuthorizeErrorCode = /** Missing or malformed parameter at `/authorize` or `/token`. */"invalid_request" /** `redirect_uri` is not an allowed (loopback / registered) target. */ | "invalid_redirect" /** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */ | "invalid_grant" /** Unknown or unauthenticated client (Tier 2). */ | "invalid_client" /** A known client used a grant/response it is not allowed (Tier 2). */ | "unauthorized_client"
+type AuthorizeErrorCode =
+/** Missing or malformed parameter at `/authorize` or `/token`. */
+"invalid_request" |
+/** `redirect_uri` is not an allowed (loopback / registered) target. */
+"invalid_redirect" |
+/** Code unknown / expired / already-redeemed, or PKCE verifier mismatch (`/token`). */
+"invalid_grant" |
+/** Unknown or unauthenticated client (Tier 2). */
+"invalid_client" |
+/** A known client used a grant/response it is not allowed (Tier 2). */
+"unauthorized_client" |
 /**
  * RFC 8707: more than one `resource` value on a leg, or the `/token`
  * `resource` differs from the one recorded at `/authorize`.
  */
-| "invalid_target" /** The user declined the authorization (consent). */ | "access_denied" /** An unexpected server-side failure. */ | "server_error";
+"invalid_target" |
+/** The user declined the authorization (consent). */
+"access_denied" |
+/** An unexpected server-side failure. */
+"server_error";
 /** A typed authorization-server failure. */
 declare class AuthorizeError extends Error {
   readonly code: AuthorizeErrorCode;

package/dist/{dynamic-client-store-DEGFMiTK.d.mts → dynamic-client-store-BCAqzG0Y.d.mts}

@@ -1,6 +1,5 @@
 import { t as Clock } from "./clock-C0O0FCCN.mjs";
-import { r as IssueOptions } from "./auth-credential-C9xy4X_k.mjs";
-
+import { r as IssueOptions } from "./auth-credential-C5DiSbb2.mjs";
 //#region src/authz/token-policy.d.ts
 /**
  * What the authorization server mints for a completed grant — forwarded verbatim

package/dist/{dynamic-client-store-Cujxec8n.d.cts → dynamic-client-store-CafYRhI4.d.cts}

@@ -1,6 +1,5 @@
 import { t as Clock } from "./clock-C0O0FCCN.cjs";
-import { r as IssueOptions } from "./auth-credential-C5zD8b0J.cjs";
-
+import { r as IssueOptions } from "./auth-credential-CU4vsKhu.cjs";
 //#region src/authz/token-policy.d.ts
 /**
  * What the authorization server mints for a completed grant — forwarded verbatim

package/dist/index.cjs

@@ -184,7 +184,7 @@ function hkdfSubkey(ikm, label) {
 }
 //#endregion
 //#region src/stores/jwt.ts
-const HS_ALGS = new Set([
+const HS_ALGS = /* @__PURE__ */ new Set([
 	"HS256",
 	"HS384",
 	"HS512"

package/dist/index.d.cts

@@ -1,8 +1,7 @@
 import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.cjs";
-import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-C5zD8b0J.cjs";
-import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-C6DU6VZk.cjs";
+import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-CU4vsKhu.cjs";
+import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-3YN2hfss.cjs";
 import { CryptoKey } from "jose";
-
 //#region src/errors.d.ts
 type AuthErrorType = "INVALID_TOKEN" | "TOKEN_EXPIRED" | "TOKEN_REVOKED" | "REFRESH_REUSE_DETECTED" | "STATELESS_OPERATION_UNSUPPORTED" | "MAX_CONCURRENT_REACHED" | "INVALID_CONFIG";
 declare class AuthError extends Error {

package/dist/index.d.mts

@@ -1,8 +1,7 @@
 import { a as AuthContext, d as RefreshConfig, f as RefreshResult, i as DenylistStore, l as EnrichedSession, m as SessionInfo, n as defaultClock, o as CredentialMetadata, p as SessionEnricher, r as CredentialStore, s as CredentialState, t as Clock, u as IssueResult } from "./clock-C0O0FCCN.mjs";
-import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-C9xy4X_k.mjs";
-import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-y7K7z1EF.mjs";
+import { i as RefreshCallOptions, n as AuthCredentialOptions, r as IssueOptions, t as AuthCredential } from "./auth-credential-C5DiSbb2.mjs";
+import { n as RateLimitStoreMemory, t as RateLimitStore } from "./store-BUIC0iCK.mjs";
 import { CryptoKey } from "jose";
-
 //#region src/errors.d.ts
 type AuthErrorType = "INVALID_TOKEN" | "TOKEN_EXPIRED" | "TOKEN_REVOKED" | "REFRESH_REUSE_DETECTED" | "STATELESS_OPERATION_UNSUPPORTED" | "MAX_CONCURRENT_REACHED" | "INVALID_CONFIG";
 declare class AuthError extends Error {

package/dist/index.mjs

@@ -183,7 +183,7 @@ function hkdfSubkey(ikm, label) {
 }
 //#endregion
 //#region src/stores/jwt.ts
-const HS_ALGS = new Set([
+const HS_ALGS = /* @__PURE__ */ new Set([
 	"HS256",
 	"HS384",
 	"HS512"

package/dist/redis.d.cts

@@ -1,6 +1,5 @@
 import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-C0O0FCCN.cjs";
-import { t as RateLimitStore } from "./store-C6DU6VZk.cjs";
-
+import { t as RateLimitStore } from "./store-3YN2hfss.cjs";
 //#region src/redis/index.d.ts
 /**
  * Structural Redis client. Covers the exact set of commands used by

package/dist/redis.d.mts

@@ -1,6 +1,5 @@
 import { i as DenylistStore, r as CredentialStore, s as CredentialState } from "./clock-C0O0FCCN.mjs";
-import { t as RateLimitStore } from "./store-y7K7z1EF.mjs";
-
+import { t as RateLimitStore } from "./store-BUIC0iCK.mjs";
 //#region src/redis/index.d.ts
 /**
  * Structural Redis client. Covers the exact set of commands used by

package/dist/{store-C6DU6VZk.d.cts → store-3YN2hfss.d.cts}

@@ -1,5 +1,4 @@
 import { t as Clock } from "./clock-C0O0FCCN.cjs";
-
 //#region src/rate-limit/store.d.ts
 /**
  * Storage contract for the fixed-window limiter (RL.spec.md §4.3).

package/dist/{store-y7K7z1EF.d.mts → store-BUIC0iCK.d.mts}

@@ -1,5 +1,4 @@
 import { t as Clock } from "./clock-C0O0FCCN.mjs";
-
 //#region src/rate-limit/store.d.ts
 /**
  * Storage contract for the fixed-window limiter (RL.spec.md §4.3).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/auth",
-  "version": "0.1.58",
+  "version": "0.1.60",
   "description": "Auth method layer for aoothjs (sessions, tokens, password reset, MFA primitives)",
   "keywords": [
     "aoothjs",
@@ -104,18 +104,18 @@
   },
   "dependencies": {
     "jose": "^6.2.3",
-    "@aooth/user": "0.1.58"
+    "@aooth/user": "0.1.60"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.85",
-    "@atscript/db": "^0.1.124",
-    "@atscript/db-sql-tools": "^0.1.124",
-    "@atscript/db-sqlite": "^0.1.124",
-    "@atscript/typescript": "^0.1.85",
+    "@atscript/core": "^0.1.88",
+    "@atscript/db": "^0.1.126",
+    "@atscript/db-sql-tools": "^0.1.126",
+    "@atscript/db-sqlite": "^0.1.126",
+    "@atscript/typescript": "^0.1.88",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
     "ioredis": "^5.11.1",
-    "unplugin-atscript": "^0.1.85"
+    "unplugin-atscript": "^0.1.88"
   },
   "peerDependencies": {
     "@atscript/db": ">=0.1.79"