@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/auth/index.d.ts

@@ -1,54 +1,58 @@
-export * from "./interfaces";
-export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt";
-export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
-export { createJwksRoutes } from "./jwks-routes";
-export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys";
-export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
-export { safeCompare } from "./crypto-utils";
-export type { PasswordValidationResult } from "./password";
-export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
-export { resolveAuthHooks } from "./auth-hooks";
-export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
-export { createGoogleProvider } from "./google-oauth";
-export type { GoogleProviderConfig } from "./google-oauth";
-export { createLinkedinProvider } from "./linkedin-oauth";
-export { createGitHubProvider } from "./github-oauth";
-export { createMicrosoftProvider } from "./microsoft-oauth";
-export { createAppleProvider } from "./apple-oauth";
-export { createFacebookProvider } from "./facebook-oauth";
-export { createTwitterProvider } from "./twitter-oauth";
-export { createDiscordProvider } from "./discord-oauth";
-export { createGitLabProvider } from "./gitlab-oauth";
-export { createBitbucketProvider } from "./bitbucket-oauth";
-export { createSlackProvider } from "./slack-oauth";
-export { createSpotifyProvider } from "./spotify-oauth";
-export type { AppleCodeFlowPayload } from "./apple-oauth";
-export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow";
-export type { OAuthCodeFlowPayload } from "./oauth-code-flow";
-export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token";
-export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token";
-export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy";
-export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy";
-export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware";
-export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
-export { createAuthRoutes } from "./routes";
-export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
-export { mountMagicLinkRoutes } from "./magic-link-routes";
-export { createResetPasswordRoute } from "./reset-password-admin";
-export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
-export type { DataRateLimitConfig } from "./rate-limiter";
-export { MemoryRateLimitStore } from "./rate-limit-store";
-export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
-export { createSqlRateLimitStore } from "./sql-rate-limit-store";
-export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store";
-export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store";
-export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
-export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";
-export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter";
-export { createCustomAuthAdapter } from "./custom-auth-adapter";
-export { createAdapterAuthMiddleware } from "./adapter-middleware";
-export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware";
+export * from "./interfaces.js";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt.js";
+export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt.js";
+export { createJwksRoutes } from "./jwks-routes.js";
+export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys.js";
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password.js";
+export { safeCompare } from "./crypto-utils.js";
+export type { PasswordValidationResult } from "./password.js";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks.js";
+export { resolveAuthHooks } from "./auth-hooks.js";
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops.js";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops.js";
+export { createGoogleProvider } from "./google-oauth.js";
+export type { GoogleProviderConfig } from "./google-oauth.js";
+export { createLinkedinProvider } from "./linkedin-oauth.js";
+export { createGitHubProvider } from "./github-oauth.js";
+export { createMicrosoftProvider } from "./microsoft-oauth.js";
+export { createAppleProvider } from "./apple-oauth.js";
+export { createFacebookProvider } from "./facebook-oauth.js";
+export { createTwitterProvider } from "./twitter-oauth.js";
+export { createDiscordProvider } from "./discord-oauth.js";
+export { createGitLabProvider } from "./gitlab-oauth.js";
+export { createBitbucketProvider } from "./bitbucket-oauth.js";
+export { createSlackProvider } from "./slack-oauth.js";
+export { createSpotifyProvider } from "./spotify-oauth.js";
+export type { AppleCodeFlowPayload } from "./apple-oauth.js";
+export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow.js";
+export type { OAuthCodeFlowPayload } from "./oauth-code-flow.js";
+export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token.js";
+export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token.js";
+export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy.js";
+export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy.js";
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware.js";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware.js";
+export { createAuthRoutes } from "./routes.js";
+export type { AuthModuleConfig, CookieAuthConfig } from "./routes.js";
+export { buildBuiltinAuthCapabilities } from "./capabilities.js";
+export type { BuiltinAuthCapabilityInputs } from "./capabilities.js";
+export { mountMagicLinkRoutes } from "./magic-link-routes.js";
+export { buildCaptchaMiddlewares, createCaptchaMiddleware, createHttpCaptchaVerifier, resolveCaptchaVerifier, DEFAULT_CAPTCHA_ROUTES } from "./captcha.js";
+export type { CaptchaConfig, CaptchaProvider, CaptchaRoute, CaptchaVerifier, CaptchaVerifyRequest, CaptchaVerifyResult } from "./captcha.js";
+export { createResetPasswordRoute } from "./reset-password-admin.js";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin.js";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter.js";
+export type { DataRateLimitConfig } from "./rate-limiter.js";
+export { MemoryRateLimitStore } from "./rate-limit-store.js";
+export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store.js";
+export { createSqlRateLimitStore } from "./sql-rate-limit-store.js";
+export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store.js";
+export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store.js";
+export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store.js";
+export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys/index.js";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys/index.js";
+export { createBuiltinAuthAdapter } from "./builtin-auth-adapter.js";
+export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter.js";
+export { createCustomAuthAdapter } from "./custom-auth-adapter.js";
+export { createAdapterAuthMiddleware } from "./adapter-middleware.js";
+export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware.js";

package/dist/auth/jwks-routes.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types.js";
 /**
  * `GET /.well-known/jwks.json` — the public keys that verify this issuer's
  * access tokens.

package/dist/auth/jwt.d.ts

@@ -1,4 +1,4 @@
-import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys";
+import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys.js";
 export interface JwtConfig {
     secret: string;
     accessExpiresIn?: string;

package/dist/auth/linkedin-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 export interface LinkedinUserInfo {
     linkedinId: string;
     email: string;

package/dist/auth/magic-link-routes.d.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
-import type { AuthModuleConfig } from "./routes";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { HonoEnv } from "../api/types";
+import type { MiddlewareHandler } from "hono";
+import type { AuthModuleConfig } from "./routes.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
+import type { HonoEnv } from "../api/types.js";
 import { z } from "zod";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 /**
@@ -29,4 +30,10 @@ export declare function mountMagicLinkRoutes(deps: {
         refreshToken: string;
     }>;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
+    /**
+     * Built by the caller so a misconfiguration fails the boot once, rather
+     * than being resolved again here. Absent when captcha is off, or when
+     * `magicLink` is not among the protected routes.
+     */
+    captchaMiddleware?: MiddlewareHandler<HonoEnv>;
 }): void;

package/dist/auth/mfa-gate.d.ts

@@ -12,7 +12,7 @@
  *
  * @module
  */
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository } from "./interfaces.js";
 /** Error code a client watches for to switch a sign-in into its second step. */
 export declare const MFA_REQUIRED_CODE = "MFA_REQUIRED";
 /** Shape carried in `error.details` of an {@link MFA_REQUIRED_CODE} response. */

package/dist/auth/mfa-routes.d.ts

@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
+import { HonoEnv } from "../api/types.js";
+import type { AuthModuleConfig } from "./routes.js";
+import { resolveAuthHooks } from "./auth-hooks.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 interface MfaRoutesConfig {
     router: Hono<HonoEnv>;

package/dist/auth/microsoft-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
  *

package/dist/auth/middleware.d.ts

@@ -1,20 +1,19 @@
 import { MiddlewareHandler, Context } from "hono";
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository } from "./interfaces.js";
 import { DataDriver } from "@rebasepro/types";
-import { AccessTokenPayload } from "./jwt";
-import type { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-import { extractBearerToken } from "./bearer-token";
+import { AccessTokenPayload } from "./jwt.js";
+import type { HonoEnv } from "../api/types.js";
+import type { ApiKeyStore } from "./api-keys/api-key-store.js";
+import { extractBearerToken } from "./bearer-token.js";
 export { extractBearerToken };
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated
  * - `true` = authenticated as default user
- * - object with `uid` (or legacy `userId`) = authenticated with user info
+ * - object with `uid` = authenticated with user info
  */
 export type AuthResult = boolean | null | undefined | {
     uid?: string;
-    userId?: string;
     roles?: string[];
     [key: string]: unknown;
 };

package/dist/auth/otp-routes.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Email one-time codes: six digits, typed in, instead of a link to click.
+ *
+ * Magic link already logs somebody in from their inbox, and on a desktop it is
+ * the better flow. It stops being the better flow the moment the two devices
+ * are not the same one: the link opens the session on the phone that has the
+ * mail, not on the television, the terminal, or the browser the person is
+ * actually sitting in front of. A code crosses that gap because a human carries
+ * it.
+ *
+ * ```
+ * POST /auth/otp          { "email": "…" }             → always 200
+ * POST /auth/otp/verify   { "email": "…", "code": "…" } → a session
+ * ```
+ *
+ * ## Six digits is a small number, so the shape matters
+ *
+ * A million possibilities is nothing to a machine, which is why each of these
+ * is load-bearing rather than decorative:
+ *
+ *  - **the code is bound to the address.** What is stored is a hash of
+ *    `otp:<email>:<code>`, so `verify` needs both halves and there is no
+ *    "guess any valid code in the system" — the search space is one account's,
+ *    not the deployment's. A lookup keyed on the code alone would make every
+ *    account in the database a target of the same million guesses;
+ *  - **attempts are limited per address**, not only per IP. An IP is the
+ *    attacker's to rotate and the account under attack is not — the same
+ *    reasoning `mfaVerificationLimiter` is built on, and the same numbers;
+ *  - **ten minutes**, and single use. The window is what the brute force gets;
+ *  - **the digits are uniform.** `randomInt` rather than `random() * 1e6` or a
+ *    modulo of random bytes, both of which make some codes likelier.
+ *
+ * ## Why it reuses the magic-link token store
+ *
+ * A one-time code and a magic-link token are the same object: a hashed secret
+ * for one account, with an expiry and a used flag. Reusing the store means no
+ * schema change, no second cleanup path, and no second place for "was this
+ * already used?" to be answered differently. What is hashed differs, and that
+ * is the whole difference — a code cannot be presented as a link token because
+ * the hash carries `otp:` and the address.
+ */
+import { Hono } from "hono";
+import type { MiddlewareHandler } from "hono";
+import { z } from "zod";
+import type { AuthModuleConfig } from "./routes.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
+import type { HonoEnv } from "../api/types.js";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+/** How long a code is good for. */
+export declare const OTP_TTL_MS: number;
+/**
+ * A uniformly random code, as a zero-padded string.
+ *
+ * `randomInt` over the whole range rather than digit-by-digit or a modulo of
+ * random bytes: both of those are ways to make some codes likelier than others,
+ * and one of them is the classic modulo bias.
+ */
+export declare function generateOtpCode(): string;
+/**
+ * What gets hashed and stored.
+ *
+ * The address is part of the secret, which is what makes `verify` a question
+ * about one account rather than about the whole table. Lower-cased and trimmed
+ * so that the address the user types matches the one they were mailed at.
+ */
+export declare function otpTokenMaterial(email: string, code: string): string;
+export declare function mountOtpRoutes(deps: {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ResolvedAuthHooks;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    buildAuthResponse: (user: {
+        id: string;
+        email: string;
+        displayName?: string | null;
+        photoUrl?: string | null;
+        emailVerified?: boolean;
+        isAnonymous?: boolean;
+        metadata?: Record<string, unknown> | null;
+    }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
+    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
+        roleIds: string[];
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
+    /** Built by the caller, as for magic link. Absent when captcha is off. */
+    captchaMiddleware?: MiddlewareHandler<HonoEnv>;
+}): void;

package/dist/auth/rate-limiter.d.ts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from "hono";
-import { HonoEnv } from "../api/types";
-import { RateLimitStore } from "./rate-limit-store";
+import { HonoEnv } from "../api/types.js";
+import { RateLimitStore } from "./rate-limit-store.js";
 /**
  * Sliding-window rate limiting for Hono.
  *

package/dist/auth/require-auth.d.ts

@@ -1,5 +1,5 @@
 import type { AuthAdapter } from "@rebasepro/types";
-import type { RebaseAuthConfig } from "../init";
+import type { RebaseAuthConfig } from "../init.js";
 /**
  * Whether the `auth` config is an `AuthAdapter` (it can verify a request) or a
  * plain `RebaseAuthConfig`. Lives here rather than in `init.ts` so this module

package/dist/auth/reset-password-admin.d.ts

@@ -7,10 +7,10 @@
  * 3. Built-in default (send reset email, or generate temp password)
  */
 import { Hono } from "hono";
-import type { AuthRepository } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
+import type { AuthRepository } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
+import type { HonoEnv } from "../api/types.js";
 import type { AuthCollectionConfig } from "@rebasepro/types";
 export interface ResetPasswordRouteConfig {
     authRepo: AuthRepository;

package/dist/auth/routes.d.ts

@@ -1,13 +1,22 @@
 import { Hono } from "hono";
-import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import { EmailService, EmailConfig } from "../email";
-import { HonoEnv } from "../api/types";
+import type { AuthRepository, OAuthProvider } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import { EmailService, EmailConfig } from "../email/index.js";
+import { HonoEnv } from "../api/types.js";
+import { type CaptchaConfig } from "./captcha.js";
 /**
  * Shared configuration for auth and admin route factories.
  */
 export interface AuthModuleConfig {
     authRepo: AuthRepository;
+    /**
+     * Bot protection. Off unless `enabled`.
+     *
+     * Rate limiting bounds one caller; a botnet of a thousand addresses sending
+     * one request each never touches a per-IP window, and `/register` and
+     * `/forgot-password` both send mail. See `captcha.ts`.
+     */
+    captcha?: CaptchaConfig;
     emailService?: EmailService;
     emailConfig?: EmailConfig;
     /** Allow new user registration (default: false). */
@@ -40,14 +49,13 @@ export interface AuthModuleConfig {
      * verification, lifecycle hooks, etc.
      */
     authHooks?: AuthHooks;
-    /**
-     * Callback that checks if bootstrap has already been completed.
-     * Used by GET /auth/config to report `needsSetup` status.
-     * When not provided, falls back to checking if any users exist.
-     */
-    isBootstrapCompleted?: () => Promise<boolean>;
     /** Enable magic link (passwordless email) login. Requires email service. */
     enableMagicLink?: boolean;
+    /**
+     * Enable email one-time codes: `POST /auth/otp` and `/auth/otp/verify`.
+     * Requires email to be configured, as magic link does.
+     */
+    enableEmailOtp?: boolean;
     /**
      * Opt-in httpOnly cookie mode for refresh tokens.
      *

package/dist/auth/session-routes.d.ts

@@ -1,9 +1,9 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
+import { HonoEnv } from "../api/types.js";
+import type { AuthModuleConfig } from "./routes.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-import type { resolveAuthHooks } from "./auth-hooks";
+import type { resolveAuthHooks } from "./auth-hooks.js";
 interface SessionRoutesConfig {
     router: Hono<HonoEnv>;
     config: AuthModuleConfig;

package/dist/auth/slack-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
  * Uses the OpenID Connect flow with the "openid,email,profile" scopes.

package/dist/auth/spotify-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Spotify OAuth Provider integration.
  * Uses the authorization code flow with the "user-read-email" scope.

package/dist/auth/token-revocation.d.ts

@@ -1,5 +1,5 @@
-import type { AuthRepository } from "./interfaces";
-import type { AccessTokenPayload } from "./jwt";
+import type { AuthRepository } from "./interfaces.js";
+import type { AccessTokenPayload } from "./jwt.js";
 /**
  * Has this access token been revoked?
  *

package/dist/auth/twitter-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Twitter/X OAuth 2.0 Provider integration.
  *