@shipfox/api-auth 2.0.0

package/src/db/refresh-tokens.ts

@@ -0,0 +1,149 @@
+import {and, eq, gt, isNull, ne, sql} from 'drizzle-orm';
+import type {RefreshToken} from '#core/entities/refresh-token.js';
+import {db} from './db.js';
+import {refreshTokens, toRefreshToken} from './schema/refresh-tokens.js';
+
+export interface CreateRefreshTokenParams {
+  userId: string;
+  hashedToken: string;
+  expiresAt: Date;
+}
+
+export async function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken> {
+  const rows = await db()
+    .insert(refreshTokens)
+    .values({
+      userId: params.userId,
+      hashedToken: params.hashedToken,
+      expiresAt: params.expiresAt,
+    })
+    .returning();
+
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toRefreshToken(row);
+}
+
+/**
+ * Looks up the live session token by hash — one that can still authenticate as
+ * the current session. Returns `undefined` for revoked, expired, or already
+ * rotated tokens; rotated rows survive in the table only for the grace window
+ * and are not "active".
+ */
+export async function findActiveRefreshTokenByHash(params: {
+  hashedToken: string;
+}): Promise<RefreshToken | undefined> {
+  const rows = await db()
+    .select()
+    .from(refreshTokens)
+    .where(
+      and(
+        eq(refreshTokens.hashedToken, params.hashedToken),
+        isNull(refreshTokens.revokedAt),
+        isNull(refreshTokens.rotatedAt),
+        gt(refreshTokens.expiresAt, sql`now()`),
+      ),
+    )
+    .limit(1);
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toRefreshToken(row);
+}
+
+/**
+ * Looks up a non-revoked, non-expired token by hash, including ones already
+ * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
+ * rotate, honour the grace window, or reject reuse, so — unlike
+ * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ */
+export async function findRefreshTokenByHash(params: {
+  hashedToken: string;
+}): Promise<RefreshToken | undefined> {
+  const rows = await db()
+    .select()
+    .from(refreshTokens)
+    .where(
+      and(
+        eq(refreshTokens.hashedToken, params.hashedToken),
+        isNull(refreshTokens.revokedAt),
+        gt(refreshTokens.expiresAt, sql`now()`),
+      ),
+    )
+    .limit(1);
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toRefreshToken(row);
+}
+
+/**
+ * Atomically claims rotation and inserts the successor token. The predecessor is
+ * marked rather than deleted so later reuse of the retired token can be detected.
+ * If the successor insert fails, the predecessor rotation rolls back.
+ */
+export async function rotateRefreshToken(params: {
+  id: string;
+  currentHashedToken: string;
+  nextHashedToken: string;
+  expiresAt: Date;
+}): Promise<RefreshToken | undefined> {
+  return await db().transaction(async (tx) => {
+    const rotatedRows = await tx
+      .update(refreshTokens)
+      .set({
+        rotatedAt: sql`now()`,
+        lastUsedAt: sql`now()`,
+        updatedAt: sql`now()`,
+      })
+      .where(
+        and(
+          eq(refreshTokens.id, params.id),
+          eq(refreshTokens.hashedToken, params.currentHashedToken),
+          isNull(refreshTokens.revokedAt),
+          isNull(refreshTokens.rotatedAt),
+          gt(refreshTokens.expiresAt, sql`now()`),
+        ),
+      )
+      .returning();
+
+    const rotated = rotatedRows[0];
+    if (!rotated) return undefined;
+
+    const successorRows = await tx
+      .insert(refreshTokens)
+      .values({
+        userId: rotated.userId,
+        hashedToken: params.nextHashedToken,
+        expiresAt: params.expiresAt,
+      })
+      .returning();
+
+    if (!successorRows[0]) throw new Error('Insert returned no rows');
+
+    return toRefreshToken(rotated);
+  });
+}
+
+export async function revokeRefreshTokenByHash(params: {hashedToken: string}): Promise<void> {
+  await db()
+    .update(refreshTokens)
+    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt)));
+}
+
+export async function revokeRefreshTokensForUser(params: {
+  userId: string;
+  exceptRefreshTokenId?: string | undefined;
+}): Promise<void> {
+  await db()
+    .update(refreshTokens)
+    .set({revokedAt: sql`now()`, updatedAt: sql`now()`})
+    .where(
+      and(
+        eq(refreshTokens.userId, params.userId),
+        isNull(refreshTokens.revokedAt),
+        params.exceptRefreshTokenId ? ne(refreshTokens.id, params.exceptRefreshTokenId) : undefined,
+      ),
+    );
+}

package/src/db/schema/common.ts

@@ -0,0 +1,3 @@
+import {pgTableCreator} from 'drizzle-orm/pg-core';
+
+export const pgTable = pgTableCreator((name) => `auth_${name}`);

package/src/db/schema/email-verifications.ts

@@ -0,0 +1,37 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {EmailVerification} from '#core/entities/email-verification.js';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export const emailVerifications = pgTable(
+  'email_verifications',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    hashedToken: text('hashed_token').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    usedAt: timestamp('used_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_email_verifications_hashed_token_unique').on(table.hashedToken),
+    index('auth_email_verifications_user_id_idx').on(table.userId),
+  ],
+);
+
+export type EmailVerificationDb = typeof emailVerifications.$inferSelect;
+export type EmailVerificationCreateDb = typeof emailVerifications.$inferInsert;
+
+export function toEmailVerification(row: EmailVerificationDb): EmailVerification {
+  return {
+    id: row.id,
+    userId: row.userId,
+    hashedToken: row.hashedToken,
+    expiresAt: row.expiresAt,
+    usedAt: row.usedAt,
+    createdAt: row.createdAt,
+  };
+}

package/src/db/schema/outbox.ts

@@ -0,0 +1,4 @@
+import {createOutboxTable} from '@shipfox/node-outbox';
+import {pgTable} from './common.js';
+
+export const authOutbox = createOutboxTable(pgTable);

package/src/db/schema/password-resets.ts

@@ -0,0 +1,37 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {PasswordReset} from '#core/entities/password-reset.js';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export const passwordResets = pgTable(
+  'password_resets',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    hashedToken: text('hashed_token').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    usedAt: timestamp('used_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_password_resets_hashed_token_unique').on(table.hashedToken),
+    index('auth_password_resets_user_id_idx').on(table.userId),
+  ],
+);
+
+export type PasswordResetDb = typeof passwordResets.$inferSelect;
+export type PasswordResetCreateDb = typeof passwordResets.$inferInsert;
+
+export function toPasswordReset(row: PasswordResetDb): PasswordReset {
+  return {
+    id: row.id,
+    userId: row.userId,
+    hashedToken: row.hashedToken,
+    expiresAt: row.expiresAt,
+    usedAt: row.usedAt,
+    createdAt: row.createdAt,
+  };
+}

package/src/db/schema/rate-limits.ts

@@ -0,0 +1,27 @@
+import {index, integer, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
+import {pgTable} from './common.js';
+
+export const authRateLimits = pgTable(
+  'rate_limits',
+  {
+    action: text('action').notNull(),
+    scope: text('scope').notNull(),
+    identifierHmac: text('identifier_hmac').notNull(),
+    windowStart: timestamp('window_start', {withTimezone: true}).notNull(),
+    count: integer('count').notNull().default(1),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_rate_limits_window_unique').on(
+      table.action,
+      table.scope,
+      table.identifierHmac,
+      table.windowStart,
+    ),
+    index('auth_rate_limits_expires_at_idx').on(table.expiresAt),
+  ],
+);
+
+export type AuthRateLimitDb = typeof authRateLimits.$inferSelect;

package/src/db/schema/refresh-tokens.ts

@@ -0,0 +1,43 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {RefreshToken} from '#core/entities/refresh-token.js';
+import {pgTable} from './common.js';
+import {users} from './users.js';
+
+export const refreshTokens = pgTable(
+  'refresh_tokens',
+  {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id')
+      .notNull()
+      .references(() => users.id, {onDelete: 'cascade'}),
+    hashedToken: text('hashed_token').notNull(),
+    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),
+    revokedAt: timestamp('revoked_at', {withTimezone: true}),
+    rotatedAt: timestamp('rotated_at', {withTimezone: true}),
+    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('auth_refresh_tokens_hashed_token_unique').on(table.hashedToken),
+    index('auth_refresh_tokens_user_id_idx').on(table.userId),
+  ],
+);
+
+export type RefreshTokenDb = typeof refreshTokens.$inferSelect;
+export type RefreshTokenCreateDb = typeof refreshTokens.$inferInsert;
+
+export function toRefreshToken(row: RefreshTokenDb): RefreshToken {
+  return {
+    id: row.id,
+    userId: row.userId,
+    hashedToken: row.hashedToken,
+    expiresAt: row.expiresAt,
+    revokedAt: row.revokedAt,
+    rotatedAt: row.rotatedAt,
+    lastUsedAt: row.lastUsedAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/schema/users.ts

@@ -0,0 +1,37 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {pgEnum, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';
+import type {User, UserStatus} from '#core/entities/user.js';
+import {pgTable} from './common.js';
+
+export const userStatusEnum = pgEnum('auth_user_status', ['active', 'suspended', 'deleted']);
+
+export const users = pgTable(
+  'users',
+  {
+    id: uuidv7PrimaryKey(),
+    email: text('email').notNull(),
+    hashedPassword: text('hashed_password'),
+    name: text('name'),
+    emailVerifiedAt: timestamp('email_verified_at', {withTimezone: true}),
+    status: userStatusEnum('status').notNull().default('active'),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex('auth_users_email_unique').on(table.email)],
+);
+
+export type UserDb = typeof users.$inferSelect;
+export type UserCreateDb = typeof users.$inferInsert;
+
+export function toUser(row: UserDb): User {
+  return {
+    id: row.id,
+    email: row.email,
+    hashedPassword: row.hashedPassword,
+    name: row.name,
+    emailVerifiedAt: row.emailVerifiedAt,
+    status: row.status as UserStatus,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}

package/src/db/users.test.ts

@@ -0,0 +1,75 @@
+import {hashOpaqueToken} from '@shipfox/node-tokens';
+import {EmailTakenError} from '#core/errors.js';
+import {
+  createUser,
+  findUserByEmail,
+  findUserById,
+  markEmailVerified,
+  updateUserPassword,
+} from './users.js';
+
+function emailFor(suffix: string): string {
+  return `${suffix}-${crypto.randomUUID()}@example.com`;
+}
+
+describe('users db', () => {
+  test('creates a user with email_verified_at null and finds by email and id', async () => {
+    const email = emailFor('alice');
+
+    const user = await createUser({email, hashedPassword: 'h', name: 'Alice'});
+    const byEmail = await findUserByEmail({email});
+    const byId = await findUserById({id: user.id});
+
+    expect(user.id).toBeDefined();
+    expect(user.email).toBe(email);
+    expect(user.emailVerifiedAt).toBeNull();
+    expect(byEmail?.id).toBe(user.id);
+    expect(byId?.id).toBe(user.id);
+  });
+
+  test('creates a user with email_verified_at set when provided', async () => {
+    const emailVerifiedAt = new Date('2026-01-01T00:00:00.000Z');
+
+    const user = await createUser({
+      email: emailFor('verified-insert'),
+      hashedPassword: 'h',
+      emailVerifiedAt,
+    });
+
+    expect(user.emailVerifiedAt).toEqual(emailVerifiedAt);
+  });
+
+  test('rejects duplicate email', async () => {
+    const email = emailFor('dup');
+    await createUser({email, hashedPassword: 'h'});
+
+    await expect(createUser({email, hashedPassword: 'h2'})).rejects.toThrow();
+  });
+
+  test('remaps email unique violation to EmailTakenError', async () => {
+    const email = emailFor('race');
+    await createUser({email, hashedPassword: 'h'});
+
+    await expect(createUser({email, hashedPassword: 'h2'})).rejects.toBeInstanceOf(EmailTakenError);
+  });
+
+  test('updateUserPassword updates the hashed password', async () => {
+    const user = await createUser({email: emailFor('pwbump'), hashedPassword: 'old'});
+
+    const updated = await updateUserPassword({userId: user.id, hashedPassword: 'new'});
+
+    expect(updated?.hashedPassword).toBe('new');
+  });
+
+  test('markEmailVerified sets emailVerifiedAt', async () => {
+    const user = await createUser({email: emailFor('verify'), hashedPassword: 'h'});
+
+    const verified = await markEmailVerified({userId: user.id});
+
+    expect(verified?.emailVerifiedAt).toBeInstanceOf(Date);
+  });
+
+  test('opaque token helpers remain available', () => {
+    expect(typeof hashOpaqueToken).toBe('function');
+  });
+});

package/src/db/users.ts

@@ -0,0 +1,121 @@
+import {eq} from 'drizzle-orm';
+import type {User} from '#core/entities/user.js';
+import {EmailTakenError} from '#core/errors.js';
+import {db} from './db.js';
+import {toUser, type UserDb, users} from './schema/users.js';
+
+export interface CreateUserParams {
+  email: string;
+  hashedPassword: string | null;
+  name?: string | null;
+  emailVerifiedAt?: Date | null;
+}
+
+export interface ProvisionUserParams {
+  email: string;
+  name?: string | null;
+}
+
+// Drizzle wraps the underlying Postgres error; walk `.cause` to reach it.
+function isAuthUsersEmailUniqueViolation(error: unknown): boolean {
+  let current: unknown = error;
+  for (let depth = 0; depth < 5 && current != null; depth += 1) {
+    if (typeof current !== 'object') return false;
+    const {code, constraint} = current as {code?: unknown; constraint?: unknown};
+    if (code === '23505' && constraint === 'auth_users_email_unique') return true;
+    current = (current as {cause?: unknown}).cause;
+  }
+  return false;
+}
+
+export async function createUser(params: CreateUserParams): Promise<User> {
+  let rows: UserDb[];
+  try {
+    rows = await db()
+      .insert(users)
+      .values({
+        email: params.email,
+        hashedPassword: params.hashedPassword,
+        name: params.name ?? null,
+        emailVerifiedAt: params.emailVerifiedAt ?? null,
+      })
+      .returning();
+  } catch (error) {
+    if (isAuthUsersEmailUniqueViolation(error)) {
+      throw new EmailTakenError(params.email);
+    }
+    throw error;
+  }
+
+  const row = rows[0];
+  if (!row) throw new Error('Insert returned no rows');
+  return toUser(row);
+}
+
+export async function provisionUser(params: ProvisionUserParams): Promise<User> {
+  const rows = await db()
+    .insert(users)
+    .values({
+      email: params.email,
+      hashedPassword: null,
+      name: params.name ?? null,
+      emailVerifiedAt: new Date(),
+    })
+    .onConflictDoNothing({target: users.email})
+    .returning();
+
+  const row = rows[0];
+  if (row) return toUser(row);
+
+  const existing = await findUserByEmail({email: params.email});
+  if (existing) return existing;
+  throw new Error('Provisioning user conflict returned no user');
+}
+
+export async function findUserByEmail(params: {email: string}): Promise<User | undefined> {
+  const rows = await db().select().from(users).where(eq(users.email, params.email)).limit(1);
+  const row = rows[0];
+  if (!row) return undefined;
+  return toUser(row);
+}
+
+export async function findUserById(params: {id: string}): Promise<User | undefined> {
+  const rows = await db().select().from(users).where(eq(users.id, params.id)).limit(1);
+  const row = rows[0];
+  if (!row) return undefined;
+  return toUser(row);
+}
+
+export interface UpdateUserPasswordParams {
+  userId: string;
+  hashedPassword: string;
+}
+
+export async function updateUserPassword(
+  params: UpdateUserPasswordParams,
+): Promise<User | undefined> {
+  const rows = await db()
+    .update(users)
+    .set({
+      hashedPassword: params.hashedPassword,
+      updatedAt: new Date(),
+    })
+    .where(eq(users.id, params.userId))
+    .returning();
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toUser(row);
+}
+
+export async function markEmailVerified(params: {userId: string}): Promise<User | undefined> {
+  const rows = await db()
+    .update(users)
+    .set({emailVerifiedAt: new Date(), updatedAt: new Date()})
+    .where(eq(users.id, params.userId))
+    .returning();
+
+  const row = rows[0];
+  if (!row) return undefined;
+  return toUser(row);
+}

package/src/index.test.ts

@@ -0,0 +1,39 @@
+import {
+  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+  AUTH_PASSWORD_RESET_SEND_REQUESTED,
+  authEventSchemas,
+} from '@shipfox/api-auth-dto';
+import {authModule} from './index.js';
+
+vi.mock('#config.js', () => ({
+  config: {
+    AUTH_JWT_SECRET: 'auth-module-test-secret',
+    AUTH_JWT_EXPIRES_IN: '15m',
+    AUTH_JOB_LEASE_TOKEN_SECRET: 'auth-module-test-job-secret',
+    AUTH_JOB_LEASE_TOKEN_EXPIRES_IN: '90m',
+    AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS: 14,
+    AUTH_REFRESH_ROTATION_GRACE_SECONDS: 30,
+    AUTH_REFRESH_COOKIE_NAME: 'shipfox_refresh_token',
+    CLIENT_BASE_URL: 'https://app.example.test',
+  },
+  mailer: {send: vi.fn()},
+}));
+
+describe('authModule', () => {
+  test('registers auth email outbox publisher and subscribers', () => {
+    const publisher = authModule.publishers?.find((pub) => pub.name === 'auth');
+    const events = authModule.subscribers?.map((subscriber) => subscriber.event);
+
+    expect(publisher?.eventSchemas).toBe(authEventSchemas);
+    expect(Object.keys(publisher?.eventSchemas ?? {}).sort()).toEqual([
+      AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+      AUTH_PASSWORD_RESET_SEND_REQUESTED,
+    ]);
+    expect(events).toEqual(
+      expect.arrayContaining([
+        AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+        AUTH_PASSWORD_RESET_SEND_REQUESTED,
+      ]),
+    );
+  });
+});

package/src/index.ts

@@ -0,0 +1,69 @@
+import {
+  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,
+  AUTH_PASSWORD_RESET_SEND_REQUESTED,
+  type AuthEventMap,
+  authEventSchemas,
+} from '@shipfox/api-auth-dto';
+import type {ShipfoxModule} from '@shipfox/node-module';
+import {subscriberFactory} from '@shipfox/node-module';
+import {db} from '#db/db.js';
+import {migrationsPath} from '#db/migrations.js';
+import {authOutbox} from '#db/schema/outbox.js';
+import {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
+import {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';
+import {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';
+import {authE2eRoutes} from '#presentation/e2eRoutes/index.js';
+import {authRoutes} from '#presentation/routes/index.js';
+import {
+  onEmailVerificationSendRequested,
+  onPasswordResetSendRequested,
+} from '#presentation/subscribers/index.js';
+
+export type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';
+export type {
+  CreateSessionForUserError,
+  CreateSessionForUserParams,
+  CreateSessionForUserResult,
+  ProvisionUserParams,
+} from '#core/auth.js';
+export {createSessionForUser, provisionUser} from '#core/auth.js';
+export type {User, UserStatus} from '#core/entities/user.js';
+export {
+  AuthDependencyUnavailableError,
+  EmailNotVerifiedError,
+  InvalidCredentialsError,
+  UserNotFoundError,
+} from '#core/errors.js';
+export {
+  issueJobLeaseToken,
+  jobLeaseParamsFrom,
+  verifyJobLeaseToken,
+} from '#core/job-lease-token.js';
+export {
+  issueRunnerSessionToken,
+  verifyRunnerSessionToken,
+} from '#core/runner-session-token.js';
+export {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';
+export {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';
+export {
+  authCookiePlugin,
+  clearRefreshTokenCookie,
+  getRefreshTokenCookie,
+  setRefreshTokenCookie,
+} from '#presentation/auth/refresh-cookie.js';
+export {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';
+
+const subscriber = subscriberFactory<AuthEventMap>();
+
+export const authModule: ShipfoxModule = {
+  name: 'auth',
+  database: {db, migrationsPath},
+  auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],
+  routes: [authRoutes],
+  e2eRoutes: [authE2eRoutes],
+  publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],
+  subscribers: [
+    subscriber(AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, onEmailVerificationSendRequested),
+    subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested),
+  ],
+};

package/src/metrics/index.ts

@@ -0,0 +1,13 @@
+export {
+  type AuthRateLimitAction,
+  type AuthRateLimitOutcome,
+  type AuthRateLimitScope,
+  type AuthTokenRefreshOutcome,
+  type AuthTokenType,
+  type AuthTokenVerificationOutcome,
+  recordAuthRateLimitCheck,
+  recordAuthRateLimitPruneFailure,
+  recordTokenIssued,
+  recordTokenRefreshed,
+  recordTokenVerified,
+} from './instance.js';