@rebasepro/server 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/auth/captcha.d.ts

@@ -0,0 +1,86 @@
+import type { MiddlewareHandler } from "hono";
+import { HonoEnv } from "../api/types.js";
+/** The two providers whose verify endpoints share this exact shape. */
+export type CaptchaProvider = "turnstile" | "hcaptcha";
+export interface CaptchaVerifyRequest {
+    token: string;
+    /** The caller's address, which both providers accept as a cross-check. */
+    remoteIp?: string;
+}
+export interface CaptchaVerifyResult {
+    success: boolean;
+    /** Provider error codes, for the log line. Never returned to the caller. */
+    errorCodes?: string[];
+}
+export type CaptchaVerifier = (request: CaptchaVerifyRequest) => Promise<CaptchaVerifyResult>;
+export interface CaptchaConfig {
+    /** Off unless set. */
+    enabled?: boolean;
+    provider?: CaptchaProvider;
+    /** The provider's secret. Required when enabled, unless `verify` is given. */
+    secret?: string;
+    /**
+     * Which routes to protect. Defaults to the three that send mail or create
+     * accounts: `register`, `forgotPassword`, `magicLink`.
+     *
+     * `login` is deliberately not on by default. A challenge on every sign-in is
+     * a tax on every real user, and credential stuffing is what the rate limiter
+     * and account lockout are for.
+     */
+    routes?: CaptchaRoute[];
+    /**
+     * Where the token is read from. Defaults to the `captchaToken` field of the
+     * JSON body, with the `cf-turnstile-response` / `h-captcha-response` header
+     * accepted as a fallback.
+     */
+    tokenField?: string;
+    /** Override the verifier. Supplying it makes `secret` unnecessary. */
+    verify?: CaptchaVerifier;
+    /** Milliseconds before a verification attempt is abandoned. Default 5000. */
+    timeoutMs?: number;
+}
+export type CaptchaRoute = "register" | "login" | "forgotPassword" | "magicLink";
+export declare const DEFAULT_CAPTCHA_ROUTES: CaptchaRoute[];
+/**
+ * The built-in verifier: a form post, which is the whole protocol.
+ *
+ * A non-200, a timeout or a malformed body are all "not verified" rather than
+ * exceptions — the caller cannot distinguish them and should not be told which
+ * one happened.
+ */
+export declare function createHttpCaptchaVerifier(options: {
+    provider: CaptchaProvider;
+    secret: string;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): CaptchaVerifier;
+/**
+ * Resolve a config into a verifier, or explain why it cannot be used.
+ *
+ * Returns `undefined` when the feature is off. Throws when it is on but
+ * unusable — a misconfigured challenge must not boot as an absent one, because
+ * the whole point is that it is there.
+ */
+export declare function resolveCaptchaVerifier(config: CaptchaConfig | undefined): CaptchaVerifier | undefined;
+/** Read the challenge token out of a request, body field first, then headers. */
+export declare function extractCaptchaToken(c: Parameters<MiddlewareHandler<HonoEnv>>[0], field: string): Promise<string | undefined>;
+/**
+ * Middleware refusing a request whose challenge is missing or unverified.
+ *
+ * The response says only that the challenge failed. Which of "absent",
+ * "malformed", "already used" or "provider unreachable" it was is a log line,
+ * because telling a script which one it hit is telling it how to get closer.
+ */
+export declare function createCaptchaMiddleware(options: {
+    verify: CaptchaVerifier;
+    tokenField?: string;
+    /** Named in the log so a failure says which route refused. */
+    route: CaptchaRoute;
+}): MiddlewareHandler<HonoEnv>;
+/**
+ * A middleware per protected route, or an empty map when the feature is off.
+ *
+ * Routes not named get nothing at all rather than a pass-through, so an unnamed
+ * route costs exactly what it did before.
+ */
+export declare function buildCaptchaMiddlewares(config: CaptchaConfig | undefined): Partial<Record<CaptchaRoute, MiddlewareHandler<HonoEnv>>>;

package/dist/auth/cookie-utils.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from "hono";
 import type { AuthResponsePayload } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
-import type { CookieAuthConfig } from "./routes";
+import type { HonoEnv } from "../api/types.js";
+import type { CookieAuthConfig } from "./routes.js";
 /**
  * Cookie auth helpers for httpOnly refresh tokens.
  */

package/dist/auth/discord-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Discord OAuth2 Provider integration.
  *

package/dist/auth/facebook-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
  *

package/dist/auth/github-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a GitHub OAuth Provider integration.
  *

package/dist/auth/gitlab-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a GitLab OAuth Provider integration.
  * Works with both GitLab.com and self-hosted instances.

package/dist/auth/google-oauth.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthProvider } from "./interfaces";
+import type { OAuthProvider } from "./interfaces.js";
 export interface GoogleUserInfo {
     googleId: string;
     email: string;

package/dist/auth/index.d.ts

@@ -1,54 +1,56 @@
-export * from "./interfaces";
-export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt";
-export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
-export { createJwksRoutes } from "./jwks-routes";
-export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys";
-export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
-export { safeCompare } from "./crypto-utils";
-export type { PasswordValidationResult } from "./password";
-export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
-export { resolveAuthHooks } from "./auth-hooks";
-export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
-export { createGoogleProvider } from "./google-oauth";
-export type { GoogleProviderConfig } from "./google-oauth";
-export { createLinkedinProvider } from "./linkedin-oauth";
-export { createGitHubProvider } from "./github-oauth";
-export { createMicrosoftProvider } from "./microsoft-oauth";
-export { createAppleProvider } from "./apple-oauth";
-export { createFacebookProvider } from "./facebook-oauth";
-export { createTwitterProvider } from "./twitter-oauth";
-export { createDiscordProvider } from "./discord-oauth";
-export { createGitLabProvider } from "./gitlab-oauth";
-export { createBitbucketProvider } from "./bitbucket-oauth";
-export { createSlackProvider } from "./slack-oauth";
-export { createSpotifyProvider } from "./spotify-oauth";
-export type { AppleCodeFlowPayload } from "./apple-oauth";
-export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow";
-export type { OAuthCodeFlowPayload } from "./oauth-code-flow";
-export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token";
-export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token";
-export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy";
-export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy";
-export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware";
-export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
-export { createAuthRoutes } from "./routes";
-export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
-export { mountMagicLinkRoutes } from "./magic-link-routes";
-export { createResetPasswordRoute } from "./reset-password-admin";
-export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
-export type { DataRateLimitConfig } from "./rate-limiter";
-export { MemoryRateLimitStore } from "./rate-limit-store";
-export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
-export { createSqlRateLimitStore } from "./sql-rate-limit-store";
-export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store";
-export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store";
-export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
-export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";
-export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter";
-export { createCustomAuthAdapter } from "./custom-auth-adapter";
-export { createAdapterAuthMiddleware } from "./adapter-middleware";
-export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware";
+export * from "./interfaces.js";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt.js";
+export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt.js";
+export { createJwksRoutes } from "./jwks-routes.js";
+export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys.js";
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password.js";
+export { safeCompare } from "./crypto-utils.js";
+export type { PasswordValidationResult } from "./password.js";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks.js";
+export { resolveAuthHooks } from "./auth-hooks.js";
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops.js";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops.js";
+export { createGoogleProvider } from "./google-oauth.js";
+export type { GoogleProviderConfig } from "./google-oauth.js";
+export { createLinkedinProvider } from "./linkedin-oauth.js";
+export { createGitHubProvider } from "./github-oauth.js";
+export { createMicrosoftProvider } from "./microsoft-oauth.js";
+export { createAppleProvider } from "./apple-oauth.js";
+export { createFacebookProvider } from "./facebook-oauth.js";
+export { createTwitterProvider } from "./twitter-oauth.js";
+export { createDiscordProvider } from "./discord-oauth.js";
+export { createGitLabProvider } from "./gitlab-oauth.js";
+export { createBitbucketProvider } from "./bitbucket-oauth.js";
+export { createSlackProvider } from "./slack-oauth.js";
+export { createSpotifyProvider } from "./spotify-oauth.js";
+export type { AppleCodeFlowPayload } from "./apple-oauth.js";
+export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow.js";
+export type { OAuthCodeFlowPayload } from "./oauth-code-flow.js";
+export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token.js";
+export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token.js";
+export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy.js";
+export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy.js";
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware.js";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware.js";
+export { createAuthRoutes } from "./routes.js";
+export type { AuthModuleConfig, CookieAuthConfig } from "./routes.js";
+export { mountMagicLinkRoutes } from "./magic-link-routes.js";
+export { buildCaptchaMiddlewares, createCaptchaMiddleware, createHttpCaptchaVerifier, resolveCaptchaVerifier, DEFAULT_CAPTCHA_ROUTES } from "./captcha.js";
+export type { CaptchaConfig, CaptchaProvider, CaptchaRoute, CaptchaVerifier, CaptchaVerifyRequest, CaptchaVerifyResult } from "./captcha.js";
+export { createResetPasswordRoute } from "./reset-password-admin.js";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin.js";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter.js";
+export type { DataRateLimitConfig } from "./rate-limiter.js";
+export { MemoryRateLimitStore } from "./rate-limit-store.js";
+export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store.js";
+export { createSqlRateLimitStore } from "./sql-rate-limit-store.js";
+export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store.js";
+export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store.js";
+export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store.js";
+export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys/index.js";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys/index.js";
+export { createBuiltinAuthAdapter } from "./builtin-auth-adapter.js";
+export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter.js";
+export { createCustomAuthAdapter } from "./custom-auth-adapter.js";
+export { createAdapterAuthMiddleware } from "./adapter-middleware.js";
+export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware.js";

package/dist/auth/jwks-routes.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types.js";
 /**
  * `GET /.well-known/jwks.json` — the public keys that verify this issuer's
  * access tokens.

package/dist/auth/jwt.d.ts

@@ -1,4 +1,4 @@
-import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys";
+import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys.js";
 export interface JwtConfig {
     secret: string;
     accessExpiresIn?: string;

package/dist/auth/linkedin-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 export interface LinkedinUserInfo {
     linkedinId: string;
     email: string;

package/dist/auth/magic-link-routes.d.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
-import type { AuthModuleConfig } from "./routes";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { HonoEnv } from "../api/types";
+import type { MiddlewareHandler } from "hono";
+import type { AuthModuleConfig } from "./routes.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
+import type { HonoEnv } from "../api/types.js";
 import { z } from "zod";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 /**
@@ -29,4 +30,10 @@ export declare function mountMagicLinkRoutes(deps: {
         refreshToken: string;
     }>;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
+    /**
+     * Built by the caller so a misconfiguration fails the boot once, rather
+     * than being resolved again here. Absent when captcha is off, or when
+     * `magicLink` is not among the protected routes.
+     */
+    captchaMiddleware?: MiddlewareHandler<HonoEnv>;
 }): void;

package/dist/auth/mfa-gate.d.ts

@@ -12,7 +12,7 @@
  *
  * @module
  */
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository } from "./interfaces.js";
 /** Error code a client watches for to switch a sign-in into its second step. */
 export declare const MFA_REQUIRED_CODE = "MFA_REQUIRED";
 /** Shape carried in `error.details` of an {@link MFA_REQUIRED_CODE} response. */

package/dist/auth/mfa-routes.d.ts

@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
+import { HonoEnv } from "../api/types.js";
+import type { AuthModuleConfig } from "./routes.js";
+import { resolveAuthHooks } from "./auth-hooks.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 interface MfaRoutesConfig {
     router: Hono<HonoEnv>;

package/dist/auth/microsoft-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
  *

package/dist/auth/middleware.d.ts

@@ -1,10 +1,10 @@
 import { MiddlewareHandler, Context } from "hono";
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository } from "./interfaces.js";
 import { DataDriver } from "@rebasepro/types";
-import { AccessTokenPayload } from "./jwt";
-import type { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-import { extractBearerToken } from "./bearer-token";
+import { AccessTokenPayload } from "./jwt.js";
+import type { HonoEnv } from "../api/types.js";
+import type { ApiKeyStore } from "./api-keys/api-key-store.js";
+import { extractBearerToken } from "./bearer-token.js";
 export { extractBearerToken };
 /**
  * Result from a custom auth validator.

package/dist/auth/rate-limiter.d.ts

@@ -1,6 +1,6 @@
 import { MiddlewareHandler } from "hono";
-import { HonoEnv } from "../api/types";
-import { RateLimitStore } from "./rate-limit-store";
+import { HonoEnv } from "../api/types.js";
+import { RateLimitStore } from "./rate-limit-store.js";
 /**
  * Sliding-window rate limiting for Hono.
  *

package/dist/auth/require-auth.d.ts

@@ -1,5 +1,5 @@
 import type { AuthAdapter } from "@rebasepro/types";
-import type { RebaseAuthConfig } from "../init";
+import type { RebaseAuthConfig } from "../init.js";
 /**
  * Whether the `auth` config is an `AuthAdapter` (it can verify a request) or a
  * plain `RebaseAuthConfig`. Lives here rather than in `init.ts` so this module

package/dist/auth/reset-password-admin.d.ts

@@ -7,10 +7,10 @@
  * 3. Built-in default (send reset email, or generate temp password)
  */
 import { Hono } from "hono";
-import type { AuthRepository } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
+import type { AuthRepository } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
+import type { HonoEnv } from "../api/types.js";
 import type { AuthCollectionConfig } from "@rebasepro/types";
 export interface ResetPasswordRouteConfig {
     authRepo: AuthRepository;

package/dist/auth/routes.d.ts

@@ -1,13 +1,22 @@
 import { Hono } from "hono";
-import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import { EmailService, EmailConfig } from "../email";
-import { HonoEnv } from "../api/types";
+import type { AuthRepository, OAuthProvider } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import { EmailService, EmailConfig } from "../email/index.js";
+import { HonoEnv } from "../api/types.js";
+import { type CaptchaConfig } from "./captcha.js";
 /**
  * Shared configuration for auth and admin route factories.
  */
 export interface AuthModuleConfig {
     authRepo: AuthRepository;
+    /**
+     * Bot protection. Off unless `enabled`.
+     *
+     * Rate limiting bounds one caller; a botnet of a thousand addresses sending
+     * one request each never touches a per-IP window, and `/register` and
+     * `/forgot-password` both send mail. See `captcha.ts`.
+     */
+    captcha?: CaptchaConfig;
     emailService?: EmailService;
     emailConfig?: EmailConfig;
     /** Allow new user registration (default: false). */

package/dist/auth/session-routes.d.ts

@@ -1,9 +1,9 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
+import { HonoEnv } from "../api/types.js";
+import type { AuthModuleConfig } from "./routes.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-import type { resolveAuthHooks } from "./auth-hooks";
+import type { resolveAuthHooks } from "./auth-hooks.js";
 interface SessionRoutesConfig {
     router: Hono<HonoEnv>;
     config: AuthModuleConfig;

package/dist/auth/slack-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
  * Uses the OpenID Connect flow with the "openid,email,profile" scopes.

package/dist/auth/spotify-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Spotify OAuth Provider integration.
  * Uses the authorization code flow with the "user-read-email" scope.

package/dist/auth/token-revocation.d.ts

@@ -1,5 +1,5 @@
-import type { AuthRepository } from "./interfaces";
-import type { AccessTokenPayload } from "./jwt";
+import type { AuthRepository } from "./interfaces.js";
+import type { AccessTokenPayload } from "./jwt.js";
 /**
  * Has this access token been revoked?
  *

package/dist/auth/twitter-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Twitter/X OAuth 2.0 Provider integration.
  *