@shware/security 7.1.0 → 8.0.0

package/dist/auth/types.d.cts

@@ -1,8 +1,8 @@
 import { Principal } from "../core/index.cjs";
 import { KVRepository, Session, SessionRepository } from "../session/types.cjs";
+import { EmailSender } from "./email-codes.cjs";
 import { OAuth2ClientConfig, OAuth2Token, UserInfo } from "../oauth2/types.cjs";
 import { CookieOptions } from "../utils/http.cjs";
-//#region src/auth/types.d.ts
 export type LoggedHandler = (principal: Principal) => Promise<void>;
 /**
  * Who signed in, and how: what every login method hands to `onAuthorized`.
@@ -25,7 +25,11 @@ export interface Authorization {
   token?: OAuth2Token;
   attributes: Record<string, string>;
 }
-/** Creates or updates the user and returns the principal whose `name` the session stores. */
+/**
+ * Creates or updates the user and returns the principal whose `name` the session stores. Throw an
+ * `AuthenticationError` to refuse the sign-in with a reason the client can act on; any other error
+ * is treated as a server fault.
+ */
 export type AuthorizedHandler = (request: Request, authorization: Authorization) => Promise<Principal>;
 export interface OAuth2AuthorizationOptions {
   /**
@@ -57,13 +61,24 @@ export interface AuthConfig {
      * 3600 (an hour); `0` writes on every authenticated request.
      */
     touchInterval?: number;
+    /**
+     * Also carry the session id in the `X-Auth-Token` header, for clients without a cookie jar
+     * (a CLI, a desktop shell), as Spring Session's `HeaderHttpSessionIdResolver` does: every
+     * response that sets the session cookie (a login, `logged`) also answers `X-Auth-Token: <id>`,
+     * and a request without the cookie is read from the same header. Default `false`. Turning it
+     * on exposes the id to same-origin scripts, which the cookie's `HttpOnly` kept it from, and a
+     * cross-origin client needs the header in `Access-Control-Expose-Headers`. The header is for
+     * the session id only: an API token for programmatic access is a different credential and
+     * is not read here.
+     */
+    header?: boolean;
   };
   turnstileSecretKey?: string;
   /** Limits of email verification codes (a code itself is valid for 10 minutes). */
   verificationCode?: {
     /**
      * Wrong guesses a code survives: once a login exceeds this many attempts the code is discarded
-     * and `loginEmail` answers `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`. Default 5.
+     * and `loginEmail` answers `403 VERIFICATION_CODE_ATTEMPTS_EXCEEDED`. Default 5.
      */
     maxAttempts?: number;
     /**
@@ -97,16 +112,16 @@ export interface AuthService {
   loginOAuth2Code: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
   loginOAuth2Native: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
   loginOAuth2Onetap: (request: Request, onAuthorized: AuthorizedHandler, provider?: string) => Promise<Response>;
-  sendEmailVerificationCode: (request: Request, sender: (data: {
-    email: string;
-    verificationCode: string;
-  }) => Promise<void>) => Promise<Response>;
-  sendPhoneVerificationCode: (request: Request, sender: (data: {
-    phone: string;
-    verificationCode: string;
-  }) => Promise<void>) => Promise<Response>;
+  sendEmailVerificationCode: (request: Request, sender: EmailSender) => Promise<Response>;
   loginEmail: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-  loginPhone: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
+  /**
+   * Spends a mailed code without signing in, for a host flow that only needs proof of the address
+   * (verifying or changing a signed-in user's email). Throws `AuthenticationError`
+   * (`INVALID_VERIFICATION_CODE`, `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`) as `loginEmail` answers.
+   */
+  verifyEmailCode: (email: string, verificationCode: string) => Promise<void>;
+  desktopAuthorize: (request: Request) => Promise<Response>;
+  desktopExchange: (request: Request) => Promise<Response>;
   kick: (principal: Principal) => Promise<void>;
   isAuthenticated: (request: Request) => Promise<boolean>;
   getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
@@ -115,5 +130,4 @@ export interface AuthService {
   listSessions: (principal: Principal) => Promise<Session[]>;
   cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
-//#endregion
 //# sourceMappingURL=types.d.cts.map

package/dist/auth/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAKY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;YAIF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;;IAET;;;;;;;;MAQE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BACE,SAAS,SACT,SAAS;IAAQ;IAAe;QAA+B,kBAC5D,QAAQ;EACb,4BACE,SAAS,SACT,SAAS;IAAQ;IAAe;QAA+B,kBAC5D,QAAQ;EAEb,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAC3E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAG3E,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;;IAET;;;;;;;;MAQE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}

package/dist/auth/types.d.mts

@@ -1,8 +1,8 @@
 import { Principal } from "../core/index.mjs";
 import { KVRepository, Session, SessionRepository } from "../session/types.mjs";
+import { EmailSender } from "./email-codes.mjs";
 import { OAuth2ClientConfig, OAuth2Token, UserInfo } from "../oauth2/types.mjs";
 import { CookieOptions } from "../utils/http.mjs";
-//#region src/auth/types.d.ts
 export type LoggedHandler = (principal: Principal) => Promise<void>;
 /**
  * Who signed in, and how: what every login method hands to `onAuthorized`.
@@ -25,7 +25,11 @@ export interface Authorization {
   token?: OAuth2Token;
   attributes: Record<string, string>;
 }
-/** Creates or updates the user and returns the principal whose `name` the session stores. */
+/**
+ * Creates or updates the user and returns the principal whose `name` the session stores. Throw an
+ * `AuthenticationError` to refuse the sign-in with a reason the client can act on; any other error
+ * is treated as a server fault.
+ */
 export type AuthorizedHandler = (request: Request, authorization: Authorization) => Promise<Principal>;
 export interface OAuth2AuthorizationOptions {
   /**
@@ -57,13 +61,24 @@ export interface AuthConfig {
      * 3600 (an hour); `0` writes on every authenticated request.
      */
     touchInterval?: number;
+    /**
+     * Also carry the session id in the `X-Auth-Token` header, for clients without a cookie jar
+     * (a CLI, a desktop shell), as Spring Session's `HeaderHttpSessionIdResolver` does: every
+     * response that sets the session cookie (a login, `logged`) also answers `X-Auth-Token: <id>`,
+     * and a request without the cookie is read from the same header. Default `false`. Turning it
+     * on exposes the id to same-origin scripts, which the cookie's `HttpOnly` kept it from, and a
+     * cross-origin client needs the header in `Access-Control-Expose-Headers`. The header is for
+     * the session id only: an API token for programmatic access is a different credential and
+     * is not read here.
+     */
+    header?: boolean;
   };
   turnstileSecretKey?: string;
   /** Limits of email verification codes (a code itself is valid for 10 minutes). */
   verificationCode?: {
     /**
      * Wrong guesses a code survives: once a login exceeds this many attempts the code is discarded
-     * and `loginEmail` answers `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`. Default 5.
+     * and `loginEmail` answers `403 VERIFICATION_CODE_ATTEMPTS_EXCEEDED`. Default 5.
      */
     maxAttempts?: number;
     /**
@@ -97,16 +112,16 @@ export interface AuthService {
   loginOAuth2Code: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
   loginOAuth2Native: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
   loginOAuth2Onetap: (request: Request, onAuthorized: AuthorizedHandler, provider?: string) => Promise<Response>;
-  sendEmailVerificationCode: (request: Request, sender: (data: {
-    email: string;
-    verificationCode: string;
-  }) => Promise<void>) => Promise<Response>;
-  sendPhoneVerificationCode: (request: Request, sender: (data: {
-    phone: string;
-    verificationCode: string;
-  }) => Promise<void>) => Promise<Response>;
+  sendEmailVerificationCode: (request: Request, sender: EmailSender) => Promise<Response>;
   loginEmail: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-  loginPhone: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
+  /**
+   * Spends a mailed code without signing in, for a host flow that only needs proof of the address
+   * (verifying or changing a signed-in user's email). Throws `AuthenticationError`
+   * (`INVALID_VERIFICATION_CODE`, `VERIFICATION_CODE_ATTEMPTS_EXCEEDED`) as `loginEmail` answers.
+   */
+  verifyEmailCode: (email: string, verificationCode: string) => Promise<void>;
+  desktopAuthorize: (request: Request) => Promise<Response>;
+  desktopExchange: (request: Request) => Promise<Response>;
   kick: (principal: Principal) => Promise<void>;
   isAuthenticated: (request: Request) => Promise<boolean>;
   getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
@@ -115,5 +130,4 @@ export interface AuthService {
   listSessions: (principal: Principal) => Promise<Session[]>;
   cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
 }
-//#endregion
 //# sourceMappingURL=types.d.mts.map

package/dist/auth/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAKY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;YAIF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;;IAET;;;;;;;;MAQE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BACE,SAAS,SACT,SAAS;IAAQ;IAAe;QAA+B,kBAC5D,QAAQ;EACb,4BACE,SAAS,SACT,SAAS;IAAQ;IAAe;QAA+B,kBAC5D,QAAQ;EAEb,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAC3E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAG3E,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../src/auth/types.ts"],"mappings":";;;;;YAMY,iBAAiB,WAAW,cAAc;;;;;;;;;;;;;;;iBAerC;EACf;EACA;EACA,UAAU;EACV,QAAQ;EACR,YAAY;;;;;;;YAQF,qBACV,SAAS,SACT,eAAe,kBACZ,QAAQ;iBAEI;;;;;;;;;;;EAWf,aAAa;;iBAGE;EACf;EACA,cAAc;EACd,mBAAmB;EACnB,SAAS;IAAkB;;EAC3B;;;;;;;;;IASE;;;;;;;;;;;IAWA;;EAEF;;EAEA;;;;;IAKE;;;;;IAKA;;EAEF;IACE,SAAS;;IAET;;;;;;;;MAQE;;;;iBAKW;EAEf,OAAO,SAAS,YAAY,QAAQ;EACpC,SAAS,SAAS,YAAY,QAAQ;EACtC,SAAS,SAAS,SAAS,WAAW,kBAAkB,QAAQ;EAGhE,cAAc,SAAS,YAAY,QAAQ;EAC3C,cAAc,SAAS,YAAY,QAAQ;EAC3C,sBACE,SAAS,SACT,UAAU,+BACP,QAAQ;EACb,kBAAkB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAChF,oBAAoB,SAAS,SAAS,cAAc,sBAAsB,QAAQ;EAClF,oBACE,SAAS,SACT,cAAc,mBACd,sBACG,QAAQ;EAGb,4BAA4B,SAAS,SAAS,QAAQ,gBAAgB,QAAQ;EAC9E,aAAa,SAAS,SAAS,cAAc,sBAAsB,QAAQ;;;;;;EAM3E,kBAAkB,eAAe,6BAA6B;EAG9D,mBAAmB,SAAS,YAAY,QAAQ;EAChD,kBAAkB,SAAS,YAAY,QAAQ;EAG/C,OAAO,WAAW,cAAc;EAChC,kBAAkB,SAAS,YAAY;EACvC,aAAa,mBACX,SAAS,SACT,QAAQ,MACL,QAAQ,iBAAiB,UAAU;EACxC,gBAAgB,sBAAsB;EACtC,eAAe,SAAS,YAAY,QAAQ;EAC5C,eAAe,WAAW,cAAc,QAAQ;EAChD,yBAAyB,0BAA0B,QAAQ"}

package/dist/core/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region src/core/index.ts
+// src/core/index.ts
 const PROVIDERS = [
 	"APPLE",
 	"DISCORD",
@@ -14,7 +14,6 @@ const PROVIDERS = [
 	"EMAIL",
 	"PHONE"
 ];
-//#endregion
 exports.PROVIDERS = PROVIDERS;
 
 //# sourceMappingURL=index.cjs.map

package/dist/core/index.d.cts

@@ -1,4 +1,3 @@
-//#region src/core/index.d.ts
 export type JSONValue = null | string | number | boolean | {
   [value: string]: JSONValue;
 } | Array<JSONValue>;
@@ -16,5 +15,4 @@ export interface CsrfToken {
 }
 export declare const PROVIDERS: readonly ['APPLE', 'DISCORD', 'FACEBOOK', 'GITHUB', 'GOOGLE', 'LINKEDIN', 'MICROSOFT', 'SLACK', 'WECHAT', 'X', 'EMAIL', 'PHONE'];
 export type Provider = (typeof PROVIDERS)[number];
-//#endregion
 //# sourceMappingURL=index.d.cts.map

package/dist/core/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/core/index.ts"],"mappings":";YAAY;GAKL,gBAAgB;IACnB,MAAM;iBAEO;EACf;;iBAGe,uBAAuB;EACtC;EACA;;iBAGe;EACf;EACA;EACA;;qBAGW;YAiBD,mBAAmB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/core/index.ts"],"mappings":"A,YAAY;GAKL,gBAAgB;IACnB,MAAM;iBAEO;EACf;;iBAGe,uBAAuB;EACtC;EACA;;iBAGe;EACf;EACA;EACA;;qBAGW;YAiBD,mBAAmB"}

package/dist/core/index.d.mts

@@ -1,4 +1,3 @@
-//#region src/core/index.d.ts
 export type JSONValue = null | string | number | boolean | {
   [value: string]: JSONValue;
 } | Array<JSONValue>;
@@ -16,5 +15,4 @@ export interface CsrfToken {
 }
 export declare const PROVIDERS: readonly ['APPLE', 'DISCORD', 'FACEBOOK', 'GITHUB', 'GOOGLE', 'LINKEDIN', 'MICROSOFT', 'SLACK', 'WECHAT', 'X', 'EMAIL', 'PHONE'];
 export type Provider = (typeof PROVIDERS)[number];
-//#endregion
 //# sourceMappingURL=index.d.mts.map

package/dist/core/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/core/index.ts"],"mappings":";YAAY;GAKL,gBAAgB;IACnB,MAAM;iBAEO;EACf;;iBAGe,uBAAuB;EACtC;EACA;;iBAGe;EACf;EACA;EACA;;qBAGW;YAiBD,mBAAmB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/core/index.ts"],"mappings":"A,YAAY;GAKL,gBAAgB;IACnB,MAAM;iBAEO;EACf;;iBAGe,uBAAuB;EACtC;EACA;;iBAGe;EACf;EACA;EACA;;qBAGW;YAiBD,mBAAmB"}

package/dist/core/index.mjs

@@ -1,4 +1,4 @@
-//#region src/core/index.ts
+// src/core/index.ts
 const PROVIDERS = [
 	"APPLE",
 	"DISCORD",
@@ -13,7 +13,6 @@ const PROVIDERS = [
 	"EMAIL",
 	"PHONE"
 ];
-//#endregion
 export { PROVIDERS };
 
 //# sourceMappingURL=index.mjs.map

package/dist/email/schema.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_auth_attributes = require("../auth/attributes.cjs");
 let zod_mini = require("zod/mini");
-//#region src/email/schema.ts
+// src/email/schema.ts
 /**
 * An email address as an identity key: trimmed and lowercased before the format check, so
 * `" A@X.com "` is accepted as `"a@x.com"`. The whole address is lowercased, local part included:
@@ -18,7 +18,6 @@ const loginEmailSchema = (0, zod_mini.object)({
 	verificationCode: (0, zod_mini.string)().check((0, zod_mini.regex)(/^\d{6}$/)),
 	attributes: require_auth_attributes.attributesSchema
 });
-//#endregion
 exports.loginEmailSchema = loginEmailSchema;
 exports.sendEmailVerificationCodeSchema = sendEmailVerificationCodeSchema;
 

package/dist/email/schema.d.cts

@@ -1,4 +1,3 @@
-//#region src/email/schema.d.ts
 export declare const sendEmailVerificationCodeSchema: import("zod/mini").ZodMiniObject<{
   email: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniEmail>;
   turnstileToken: import("zod/mini").ZodMiniString<string>;
@@ -8,5 +7,4 @@ export declare const loginEmailSchema: import("zod/mini").ZodMiniObject<{
   verificationCode: import("zod/mini").ZodMiniString<string>;
   attributes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniString<string>>>;
 }, import("zod/v4/core").$strip>;
-//#endregion
 //# sourceMappingURL=schema.d.cts.map

package/dist/email/schema.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";qBAWa,oDAA+B;;;yBAG1C;qBAEW,qCAAgB;;;;yBAI3B"}
+{"version":3,"file":"schema.d.cts","names":[],"sources":["../../src/email/schema.ts"],"mappings":"A,qBAWa,oDAA+B;;;yBAG1C;qBAEW,qCAAgB;;;;yBAI3B"}

package/dist/email/schema.d.mts

@@ -1,4 +1,3 @@
-//#region src/email/schema.d.ts
 export declare const sendEmailVerificationCodeSchema: import("zod/mini").ZodMiniObject<{
   email: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniEmail>;
   turnstileToken: import("zod/mini").ZodMiniString<string>;
@@ -8,5 +7,4 @@ export declare const loginEmailSchema: import("zod/mini").ZodMiniObject<{
   verificationCode: import("zod/mini").ZodMiniString<string>;
   attributes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniRecord<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniString<string>>>;
 }, import("zod/v4/core").$strip>;
-//#endregion
 //# sourceMappingURL=schema.d.mts.map

package/dist/email/schema.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/email/schema.ts"],"mappings":";qBAWa,oDAA+B;;;yBAG1C;qBAEW,qCAAgB;;;;yBAI3B"}
+{"version":3,"file":"schema.d.mts","names":[],"sources":["../../src/email/schema.ts"],"mappings":"A,qBAWa,oDAA+B;;;yBAG1C;qBAEW,qCAAgB;;;;yBAI3B"}

package/dist/email/schema.mjs

@@ -1,6 +1,6 @@
 import { attributesSchema } from "../auth/attributes.mjs";
 import { email, maxLength, object, pipe, regex, string, toLowerCase, trim } from "zod/mini";
-//#region src/email/schema.ts
+// src/email/schema.ts
 /**
 * An email address as an identity key: trimmed and lowercased before the format check, so
 * `" A@X.com "` is accepted as `"a@x.com"`. The whole address is lowercased, local part included:
@@ -17,7 +17,6 @@ const loginEmailSchema = object({
 	verificationCode: string().check(regex(/^\d{6}$/)),
 	attributes: attributesSchema
 });
-//#endregion
 export { loginEmailSchema, sendEmailVerificationCodeSchema };
 
 //# sourceMappingURL=schema.mjs.map

package/dist/index.cjs

@@ -1,5 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_auth_error = require("./auth/error.cjs");
 const require_oauth2_error = require("./oauth2/error.cjs");
+const require_auth_respond = require("./auth/respond.cjs");
 const require_oauth2_client = require("./oauth2/client.cjs");
 const require_session_common = require("./session/common.cjs");
 const require_auth_index = require("./auth/index.cjs");
@@ -8,7 +10,9 @@ const require_session_db = require("./session/db.cjs");
 const require_core_index = require("./core/index.cjs");
 const require_oauth2_types = require("./oauth2/types.cjs");
 const require_oauth2_name = require("./oauth2/name.cjs");
+exports.AUTHENTICATION_REASONS = require_auth_error.AUTHENTICATION_REASONS;
 exports.Auth = require_auth_index.Auth;
+exports.AuthenticationError = require_auth_error.AuthenticationError;
 exports.DBIndexedSessionRepository = require_session_db.DBIndexedSessionRepository;
 exports.MAX_NAME_PART_LENGTH = require_oauth2_name.MAX_NAME_PART_LENGTH;
 exports.OAuth2Client = require_oauth2_client.OAuth2Client;
@@ -20,4 +24,5 @@ exports.PROVIDERS = require_core_index.PROVIDERS;
 exports.RedisIndexedSessionRepository = require_session_redis.RedisIndexedSessionRepository;
 exports.RedisKVRepository = require_session_redis.RedisKVRepository;
 exports.composeName = require_oauth2_name.composeName;
+exports.errorResponse = require_auth_respond.errorResponse;
 exports.oauth2RedirectQuerySchema = require_oauth2_client.oauth2RedirectQuerySchema;

package/dist/index.d.cts

@@ -1,12 +1,15 @@
 import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.cjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.cjs";
+import { EmailSender } from "./auth/email-codes.cjs";
+import { AUTHENTICATION_REASONS, AuthenticationError, AuthenticationReason, AuthenticationReasons } from "./auth/error.cjs";
 import { AuthorizationResponse, ClientSecret, NativeClient, NativeCredential, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, ProviderConfig, StandardClaims, UserInfo, WebClient } from "./oauth2/types.cjs";
 import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.cjs";
 import { Auth, PATH } from "./auth/index.cjs";
+import { ErrorBody, errorResponse } from "./auth/respond.cjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.cjs";
 import { OAuth2Error, OAuth2ErrorType } from "./oauth2/error.cjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.cjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.cjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.cjs";
 import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.cjs";
-export { Auth, type AuthConfig, type AuthService, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, oauth2RedirectQuerySchema };
+export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };

package/dist/index.d.mts

@@ -1,12 +1,15 @@
 import { CsrfToken, PROVIDERS, Principal, Provider } from "./core/index.mjs";
 import { KVRepository, Namespace, Session, SessionRepository } from "./session/types.mjs";
+import { EmailSender } from "./auth/email-codes.mjs";
+import { AUTHENTICATION_REASONS, AuthenticationError, AuthenticationReason, AuthenticationReasons } from "./auth/error.mjs";
 import { AuthorizationResponse, ClientSecret, NativeClient, NativeCredential, OAuth2ClientConfig, OAuth2Token, OIDC_SCOPES, OidcScope, OidcToken, PersonNameComponents, ProviderConfig, StandardClaims, UserInfo, WebClient } from "./oauth2/types.mjs";
 import { AuthConfig, AuthService, Authorization, AuthorizedHandler, OAuth2AuthorizationOptions } from "./auth/types.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
+import { ErrorBody, errorResponse } from "./auth/respond.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { OAuth2Error, OAuth2ErrorType } from "./oauth2/error.mjs";
 import { RedisIndexedSessionRepository, RedisKVRepository } from "./session/redis.mjs";
 import { DBAdapter, DBIndexedSessionRepository } from "./session/db.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.mjs";
-export { Auth, type AuthConfig, type AuthService, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, oauth2RedirectQuerySchema };
+export { AUTHENTICATION_REASONS, Auth, type AuthConfig, type AuthService, AuthenticationError, type AuthenticationReason, type AuthenticationReasons, type Authorization, type AuthorizationResponse, type AuthorizedHandler, type ClientSecret, type CsrfToken, type DBAdapter, DBIndexedSessionRepository, type EmailSender, type ErrorBody, type KVRepository, MAX_NAME_PART_LENGTH, type Namespace, type NativeClient, type NativeCredential, type OAuth2AuthorizationOptions, OAuth2Client, type OAuth2ClientConfig, OAuth2Error, type OAuth2ErrorType, type OAuth2Token, OIDC_SCOPES, type OidcScope, type OidcToken, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, type PersonNameComponents, type Principal, type Provider, type ProviderConfig, RedisIndexedSessionRepository, RedisKVRepository, type Session, type SessionRepository, type StandardClaims, type UserInfo, type WebClient, composeName, errorResponse, oauth2RedirectQuerySchema };

package/dist/index.mjs

@@ -1,4 +1,6 @@
+import { AUTHENTICATION_REASONS, AuthenticationError } from "./auth/error.mjs";
 import { OAuth2Error } from "./oauth2/error.mjs";
+import { errorResponse } from "./auth/respond.mjs";
 import { OAuth2Client, oauth2RedirectQuerySchema } from "./oauth2/client.mjs";
 import { PRINCIPAL_NAME_INDEX_NAME } from "./session/common.mjs";
 import { Auth, PATH } from "./auth/index.mjs";
@@ -7,4 +9,4 @@ import { DBIndexedSessionRepository } from "./session/db.mjs";
 import { PROVIDERS } from "./core/index.mjs";
 import { OIDC_SCOPES } from "./oauth2/types.mjs";
 import { MAX_NAME_PART_LENGTH, composeName } from "./oauth2/name.mjs";
-export { Auth, DBIndexedSessionRepository, MAX_NAME_PART_LENGTH, OAuth2Client, OAuth2Error, OIDC_SCOPES, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, RedisIndexedSessionRepository, RedisKVRepository, composeName, oauth2RedirectQuerySchema };
+export { AUTHENTICATION_REASONS, Auth, AuthenticationError, DBIndexedSessionRepository, MAX_NAME_PART_LENGTH, OAuth2Client, OAuth2Error, OIDC_SCOPES, PATH, PRINCIPAL_NAME_INDEX_NAME, PROVIDERS, RedisIndexedSessionRepository, RedisKVRepository, composeName, errorResponse, oauth2RedirectQuerySchema };

package/dist/oauth2/client.cjs

@@ -2,7 +2,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_oauth2_error = require("./error.cjs");
 let _shware_utils = require("@shware/utils");
 let zod_v4_mini = require("zod/v4-mini");
-//#region src/oauth2/client.ts
+// src/oauth2/client.ts
 const oauth2RedirectQuerySchema = (0, zod_v4_mini.object)({
 	code: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
 	state: (0, zod_v4_mini.optional)((0, zod_v4_mini.string)()),
@@ -174,7 +174,6 @@ var OAuth2Client = class {
 function isOneTapProvider(provider) {
 	return typeof provider.getTokenInfo === "function";
 }
-//#endregion
 exports.OAuth2Client = OAuth2Client;
 exports.googleOneTapSchema = googleOneTapSchema;
 exports.oauth2RedirectQuerySchema = oauth2RedirectQuerySchema;

package/dist/oauth2/client.d.cts

@@ -1,5 +1,4 @@
 import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.cjs";
-//#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   state: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -97,5 +96,4 @@ export declare class OAuth2Client {
     clientId: string;
   }>;
 }
-//#endregion
 //# sourceMappingURL=client.d.cts.map

package/dist/oauth2/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}
+{"version":3,"file":"client.d.cts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}

package/dist/oauth2/client.d.mts

@@ -1,5 +1,4 @@
 import { AuthorizationResponse, NativeCredential, OAuth2ClientConfig, OAuth2Token, OidcToken, PkceParameters, UserInfo } from "./types.mjs";
-//#region src/oauth2/client.d.ts
 export declare const oauth2RedirectQuerySchema: import("zod/mini").ZodMiniObject<{
   code: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
   state: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
@@ -97,5 +96,4 @@ export declare class OAuth2Client {
     clientId: string;
   }>;
 }
-//#endregion
 //# sourceMappingURL=client.d.mts.map

package/dist/oauth2/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";;qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}
+{"version":3,"file":"client.d.mts","names":["_$__types0.UserInfo"],"sources":["../../src/oauth2/client.ts"],"mappings":";qBAkBa,8CAAyB;;;;;;;yBAQpC;qBAEW,uCAAkB;;;;;;;;;;yBAY7B;qBAEW;mBACM;EACjB,YAAY,QAAQ;MAIhB;MAIA;MAIA;;UAKU;UAUN;;UAKM;;;;;;UAaA;;;;;;UAcA;UAYA;EAIR,yBACJ,UACA,OACA;IAEA;IACA;IACA,OAAO;MACL,QAAQ;;EAYN,4BACJ,UACA,MACA;IAEA;IACA;IACA,OAAO;MACL;IAAU;IAAkB,OAAO;;;EAcjC,cACJ,UACA,UACA,OACA;IAEA;IACA;IACA,OAAO,cAAc;IACrB,WAAW;MACZ,QADYA;;EAOP,eAAe,UAAU;IAAgB;IAAkB;MAAoB;;;;;EAS/E,qBACJ,UACA,UACA;IAEA;IACA;IACA;MACE,QAAQ;EAON,cACJ,UACA,UACA;IAEA;IACA;IACA;MACD;;;;;EAWK,oBACJ,UACA,eAAe,kBAAkB,eACjC;IAEA;IACA,aAAa;IACb,OAAO,KAAK;MACb"}

package/dist/oauth2/client.mjs

@@ -1,7 +1,7 @@
 import { OAuth2Error } from "./error.mjs";
 import { invariant } from "@shware/utils";
 import { object, optional, string } from "zod/v4-mini";
-//#region src/oauth2/client.ts
+// src/oauth2/client.ts
 const oauth2RedirectQuerySchema = object({
 	code: optional(string()),
 	state: optional(string()),
@@ -173,7 +173,6 @@ var OAuth2Client = class {
 function isOneTapProvider(provider) {
 	return typeof provider.getTokenInfo === "function";
 }
-//#endregion
 export { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema };
 
 //# sourceMappingURL=client.mjs.map

package/dist/oauth2/error.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region src/oauth2/error.ts
+// src/oauth2/error.ts
 /** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */
 const OAUTH2_ERROR_TYPES = /* @__PURE__ */ new Set([
 	"invalid_request",
@@ -29,14 +29,6 @@ var OAuth2Error = class OAuth2Error extends Error {
 		Object.setPrototypeOf(this, OAuth2Error.prototype);
 	}
 };
-var AuthenticationError = class AuthenticationError extends Error {
-	constructor(message) {
-		super(message);
-		Object.setPrototypeOf(this, AuthenticationError.prototype);
-	}
-};
-//#endregion
-exports.AuthenticationError = AuthenticationError;
 exports.OAuth2Error = OAuth2Error;
 exports.isKnownOAuth2ErrorType = isKnownOAuth2ErrorType;
 

package/dist/oauth2/error.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.cjs","names":[],"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\n/** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */\nconst OAUTH2_ERROR_TYPES: ReadonlySet<string> = new Set([\n  'invalid_request',\n  'invalid_client',\n  'invalid_grant',\n  'invalid_token',\n  'invalid_scope',\n  'unauthorized_client',\n  'unsupported_grant_type',\n  'unsupported_response_type',\n  'insufficient_scope',\n  'redirect_uri_mismatch',\n  'access_denied',\n  'server_error',\n  'temporarily_unavailable',\n]);\n\nexport function isKnownOAuth2ErrorType(value: string): boolean {\n  return OAUTH2_ERROR_TYPES.has(value);\n}\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;;AAkBA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAgB,uBAAuB,OAAwB;CAC7D,OAAO,mBAAmB,IAAI,KAAK;AACrC;AAEA,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC;CACA;CAEA,YAAY,QAAgB,OAAwB,SAAkB;EACpE,MAAM,WAAW,iBAAiB,OAAO;EACzC,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,OAAO,eAAe,MAAM,YAAY,SAAS;CACnD;AACF;AAEA,IAAa,sBAAb,MAAa,4BAA4B,MAAM;CAC7C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,OAAO,eAAe,MAAM,oBAAoB,SAAS;CAC3D;AACF"}
+{"version":3,"file":"error.cjs","names":[],"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\n/** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */\nconst OAUTH2_ERROR_TYPES: ReadonlySet<string> = new Set([\n  'invalid_request',\n  'invalid_client',\n  'invalid_grant',\n  'invalid_token',\n  'invalid_scope',\n  'unauthorized_client',\n  'unsupported_grant_type',\n  'unsupported_response_type',\n  'insufficient_scope',\n  'redirect_uri_mismatch',\n  'access_denied',\n  'server_error',\n  'temporarily_unavailable',\n]);\n\nexport function isKnownOAuth2ErrorType(value: string): boolean {\n  return OAUTH2_ERROR_TYPES.has(value);\n}\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n"],"mappings":";;;AAkBA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAgB,uBAAuB,OAAwB;CAC7D,OAAO,mBAAmB,IAAI,KAAK;AACrC;AAEA,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC;CACA;CAEA,YAAY,QAAgB,OAAwB,SAAkB;EACpE,MAAM,WAAW,iBAAiB,OAAO;EACzC,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,OAAO,eAAe,MAAM,YAAY,SAAS;CACnD;AACF"}

package/dist/oauth2/error.d.cts

@@ -1,4 +1,3 @@
-//#region src/oauth2/error.d.ts
 export type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | 'temporarily_unavailable' | (string & {});
 export declare function isKnownOAuth2ErrorType(value: string): boolean;
 export declare class OAuth2Error extends Error {
@@ -6,8 +5,4 @@ export declare class OAuth2Error extends Error {
   readonly error: OAuth2ErrorType;
   constructor(status: number, error: OAuth2ErrorType, message?: string);
 }
-export declare class AuthenticationError extends Error {
-  constructor(message: string);
-}
-//#endregion
 //# sourceMappingURL=error.d.cts.map

package/dist/oauth2/error.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.cts","names":[],"sources":["../../src/oauth2/error.ts"],"mappings":";YACY;wBAiCI,uBAAuB;qBAI1B,oBAAoB;WACtB;WACA,OAAO;EAEhB,YAAY,gBAAgB,OAAO,iBAAiB;;qBAQzC,4BAA4B;EACvC,YAAY"}
+{"version":3,"file":"error.d.cts","names":[],"sources":["../../src/oauth2/error.ts"],"mappings":"A,YACY;wBAiCI,uBAAuB;qBAI1B,oBAAoB;WACtB;WACA,OAAO;EAEhB,YAAY,gBAAgB,OAAO,iBAAiB"}

package/dist/oauth2/error.d.mts

@@ -1,4 +1,3 @@
-//#region src/oauth2/error.d.ts
 export type OAuth2ErrorType = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'insufficient_scope' | 'redirect_uri_mismatch' | 'access_denied' | 'server_error' | 'temporarily_unavailable' | (string & {});
 export declare function isKnownOAuth2ErrorType(value: string): boolean;
 export declare class OAuth2Error extends Error {
@@ -6,8 +5,4 @@ export declare class OAuth2Error extends Error {
   readonly error: OAuth2ErrorType;
   constructor(status: number, error: OAuth2ErrorType, message?: string);
 }
-export declare class AuthenticationError extends Error {
-  constructor(message: string);
-}
-//#endregion
 //# sourceMappingURL=error.d.mts.map

package/dist/oauth2/error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"error.d.mts","names":[],"sources":["../../src/oauth2/error.ts"],"mappings":";YACY;wBAiCI,uBAAuB;qBAI1B,oBAAoB;WACtB;WACA,OAAO;EAEhB,YAAY,gBAAgB,OAAO,iBAAiB;;qBAQzC,4BAA4B;EACvC,YAAY"}
+{"version":3,"file":"error.d.mts","names":[],"sources":["../../src/oauth2/error.ts"],"mappings":"A,YACY;wBAiCI,uBAAuB;qBAI1B,oBAAoB;WACtB;WACA,OAAO;EAEhB,YAAY,gBAAgB,OAAO,iBAAiB"}

package/dist/oauth2/error.mjs

@@ -1,4 +1,4 @@
-//#region src/oauth2/error.ts
+// src/oauth2/error.ts
 /** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */
 const OAUTH2_ERROR_TYPES = /* @__PURE__ */ new Set([
 	"invalid_request",
@@ -28,13 +28,6 @@ var OAuth2Error = class OAuth2Error extends Error {
 		Object.setPrototypeOf(this, OAuth2Error.prototype);
 	}
 };
-var AuthenticationError = class AuthenticationError extends Error {
-	constructor(message) {
-		super(message);
-		Object.setPrototypeOf(this, AuthenticationError.prototype);
-	}
-};
-//#endregion
-export { AuthenticationError, OAuth2Error, isKnownOAuth2ErrorType };
+export { OAuth2Error, isKnownOAuth2ErrorType };
 
 //# sourceMappingURL=error.mjs.map

package/dist/oauth2/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":[],"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\n/** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */\nconst OAUTH2_ERROR_TYPES: ReadonlySet<string> = new Set([\n  'invalid_request',\n  'invalid_client',\n  'invalid_grant',\n  'invalid_token',\n  'invalid_scope',\n  'unauthorized_client',\n  'unsupported_grant_type',\n  'unsupported_response_type',\n  'insufficient_scope',\n  'redirect_uri_mismatch',\n  'access_denied',\n  'server_error',\n  'temporarily_unavailable',\n]);\n\nexport function isKnownOAuth2ErrorType(value: string): boolean {\n  return OAUTH2_ERROR_TYPES.has(value);\n}\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n\nexport class AuthenticationError extends Error {\n  constructor(message: string) {\n    super(message);\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n"],"mappings":";;AAkBA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAgB,uBAAuB,OAAwB;CAC7D,OAAO,mBAAmB,IAAI,KAAK;AACrC;AAEA,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC;CACA;CAEA,YAAY,QAAgB,OAAwB,SAAkB;EACpE,MAAM,WAAW,iBAAiB,OAAO;EACzC,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,OAAO,eAAe,MAAM,YAAY,SAAS;CACnD;AACF;AAEA,IAAa,sBAAb,MAAa,4BAA4B,MAAM;CAC7C,YAAY,SAAiB;EAC3B,MAAM,OAAO;EACb,OAAO,eAAe,MAAM,oBAAoB,SAAS;CAC3D;AACF"}
+{"version":3,"file":"error.mjs","names":[],"sources":["../../src/oauth2/error.ts"],"sourcesContent":["// reference: https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1\nexport type OAuth2ErrorType =\n  | 'invalid_request' // 400\n  | 'invalid_client' // 401\n  | 'invalid_grant' // 400\n  | 'invalid_token' // 401\n  | 'invalid_scope' // 400\n  | 'unauthorized_client' // 401\n  | 'unsupported_grant_type' // 400\n  | 'unsupported_response_type' // 400\n  | 'insufficient_scope' // 403\n  | 'redirect_uri_mismatch' // 400\n  | 'access_denied' // 400\n  | 'server_error' // 500\n  | 'temporarily_unavailable' // 503\n  | (string & {});\n\n/** The registered error codes of `OAuth2ErrorType`, for checking untrusted input at runtime. */\nconst OAUTH2_ERROR_TYPES: ReadonlySet<string> = new Set([\n  'invalid_request',\n  'invalid_client',\n  'invalid_grant',\n  'invalid_token',\n  'invalid_scope',\n  'unauthorized_client',\n  'unsupported_grant_type',\n  'unsupported_response_type',\n  'insufficient_scope',\n  'redirect_uri_mismatch',\n  'access_denied',\n  'server_error',\n  'temporarily_unavailable',\n]);\n\nexport function isKnownOAuth2ErrorType(value: string): boolean {\n  return OAUTH2_ERROR_TYPES.has(value);\n}\n\nexport class OAuth2Error extends Error {\n  readonly status: number;\n  readonly error: OAuth2ErrorType;\n\n  constructor(status: number, error: OAuth2ErrorType, message?: string) {\n    super(message ?? `OAuth2 error: ${error}`);\n    this.status = status;\n    this.error = error;\n    Object.setPrototypeOf(this, OAuth2Error.prototype);\n  }\n}\n"],"mappings":";;AAkBA,MAAM,qCAA0C,IAAI,IAAI;CACtD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAgB,uBAAuB,OAAwB;CAC7D,OAAO,mBAAmB,IAAI,KAAK;AACrC;AAEA,IAAa,cAAb,MAAa,oBAAoB,MAAM;CACrC;CACA;CAEA,YAAY,QAAgB,OAAwB,SAAkB;EACpE,MAAM,WAAW,iBAAiB,OAAO;EACzC,KAAK,SAAS;EACd,KAAK,QAAQ;EACb,OAAO,eAAe,MAAM,YAAY,SAAS;CACnD;AACF"}

package/dist/oauth2/name.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region src/oauth2/name.ts
+// src/oauth2/name.ts
 /**
 * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
 * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
@@ -96,7 +96,6 @@ function isObject(value) {
 function withoutUndefined(value) {
 	return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== void 0));
 }
-//#endregion
 exports.MAX_NAME_PART_LENGTH = MAX_NAME_PART_LENGTH;
 exports.cleanNamePart = cleanNamePart;
 exports.cleanPersonName = cleanPersonName;

package/dist/oauth2/name.d.cts

@@ -1,5 +1,4 @@
 import { PersonNameComponents, StandardClaims } from "./types.cjs";
-//#region src/oauth2/name.d.ts
 /**
  * Upper bound, in characters, on each name part taken from the client. Names that reach us outside
  * a signed token (Apple's form_post `user`, a native login body) are plain client input, so they
@@ -44,6 +43,5 @@ type NameClaims = Pick<StandardClaims, 'name' | 'given_name' | 'family_name' | '
  * Undefined parts are left out, so spreading the result never overwrites a claim with `undefined`.
  */
 export declare function nameClaims(parts: Omit<NameClaims, 'name'>): NameClaims;
-//#endregion
 export {};
 //# sourceMappingURL=name.d.cts.map

package/dist/oauth2/name.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"name.d.cts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}
+{"version":3,"file":"name.d.cts","names":[],"sources":["../../src/oauth2/name.ts"],"mappings":";;;;;;qBAOa;;;;;;;wBAaG,cACd,YACA,eACC,KAAK;;;;;;wBAcQ,cAAc;;iBAQb;EACf;IAAS;IAAoB;;EAC7B;;;;;;;wBAQc,eAAe,0BAA0B;;;;;wBAkCzC,gBAAgB,iBAAiB;KAU5C,aAAa,KAChB;;;;;wBAQc,WAAW,OAAO,KAAK,sBAAsB"}