@veap/auth 0.1.6 → 0.1.8

package/README.md

@@ -82,9 +82,10 @@ import { AuthServiceProvider } from "@veap/auth";
 export const app = Application.configure()
   .use(DatabaseServiceProvider)
   .use(
-    new AuthServiceProvider(undefined, {
-      autoMigrate: true, // Automatically applies auth tables on boot
-    }),
+    (c) =>
+      new AuthServiceProvider(c, {
+        autoMigrate: true, // Automatically applies auth tables on boot
+      }),
   )
   .create();
 ```
@@ -108,6 +109,10 @@ export async function handleLogin(formData: FormData) {
     return { error: result.error?.message || "Invalid credentials" };
   }
 
+  if (result.data.status === "CHALLENGE_REQUIRED") {
+    return { challenge: result.data };
+  }
+
   return { user: result.data.user };
 }
 
@@ -131,7 +136,7 @@ import { hashPassword } from "@veap/auth/server";
 
 // Create a new user with hashed credentials
 const user = await User.create({
-  name: "Jane Doe",
+  username: "janedoe",
   email: "jane@example.com",
   password: await hashPassword("securePassword123"),
   recovery_code: Buffer.from("recovery-key-bytes"),
@@ -154,6 +159,7 @@ if (adminRole) {
 | `@veap/auth/actions`    | Next.js Server Actions directly exportable for actions boundaries     |
 | `@veap/auth/models`     | Active Record models (`User`, `Session`, `Role`, `Permission`)        |
 | `@veap/auth/migrations` | Knex migrations for authentication tables                             |
+| `@veap/auth/validation` | Zod validation schemas (`loginSchema`, `registerSchema`, and others)  |
 
 ## Documentation
 

package/dist/actions/auth.actions.d.ts

@@ -2,22 +2,6 @@ import { type Result } from "@veap/kernel";
 import type { AuthResponse, SessionFlags } from "../common/index.js";
 import type { LoginInput, RegisterInput } from "../validation/index.js";
 export declare function signIn(data: LoginInput): Promise<Result<AuthResponse>>;
-export declare function signUp(data: RegisterInput): Promise<{
-    success: false;
-    error: import("@veap/kernel").AppErrorJson;
-    data?: never;
-} | {
-    success: true;
-    data: AuthResponse;
-    error?: never;
-}>;
-export declare function finalizeLogin(userId: string, flags: SessionFlags): Promise<{
-    success: false;
-    error: import("@veap/kernel").AppErrorJson;
-    data?: never;
-} | {
-    success: true;
-    data: AuthResponse;
-    error?: never;
-}>;
+export declare function signUp(data: RegisterInput): Promise<Result<AuthResponse>>;
+export declare function finalizeLogin(userId: string, flags: SessionFlags): Promise<Result<AuthResponse>>;
 export declare function signOut(): Promise<Result<void>>;

package/dist/actions/auth.actions.js

@@ -1,10 +1,14 @@
 "use server";
-import { app, handleActionError, ok } from "@veap/kernel";
+import { AppError, app, handleActionError, ok, } from "@veap/kernel";
 import { AuthService } from "../session/auth.service.js";
 export async function signIn(data) {
     try {
         const authService = await app(AuthService);
-        return ok(await authService.signIn(data));
+        const response = await authService.signIn(data);
+        if (response.status === "ERROR") {
+            throw AppError.Unauthorized(response.message || "Invalid credentials");
+        }
+        return ok(response);
     }
     catch (e) {
         return handleActionError(e, "Auth:SignIn");
@@ -13,7 +17,11 @@ export async function signIn(data) {
 export async function signUp(data) {
     try {
         const authService = await app(AuthService);
-        return ok(await authService.signUp(data));
+        const response = await authService.signUp(data);
+        if (response.status === "ERROR") {
+            throw AppError.Conflict(response.message || "Registration failed");
+        }
+        return ok(response);
     }
     catch (e) {
         return handleActionError(e, "Auth:SignUp");
@@ -22,7 +30,11 @@ export async function signUp(data) {
 export async function finalizeLogin(userId, flags) {
     try {
         const authService = await app(AuthService);
-        return ok(await authService.finalizeLogin(userId, flags));
+        const response = await authService.finalizeLogin(userId, flags);
+        if (response.status === "ERROR") {
+            throw AppError.BadRequest(response.message || "Failed to finalize login");
+        }
+        return ok(response);
     }
     catch (e) {
         return handleActionError(e, "Auth:FinalizeLogin");

package/dist/common/context.d.ts

@@ -1,3 +1,4 @@
+import type { IPasswordHasher } from "../crypto/contracts.js";
 import { type AuthRoutesConfig } from "./routes.js";
 export interface AuthContext {
     user: any;
@@ -6,6 +7,7 @@ export interface AuthContext {
     passwordReset: any;
     emailVerification: any;
     auth: any;
+    passwordHasher?: IPasswordHasher;
     routes?: AuthRoutesConfig;
 }
 /**

package/dist/common/logic.js

@@ -1,5 +1,5 @@
 import { augmentSession, augmentUser, registerIdentityAugmenter, registerPasswordResetSessionAugmenter, registerSessionAugmenter, unregisterIdentityAugmenter, unregisterPasswordResetSessionAugmenter, unregisterSessionAugmenter, } from "./augment.js";
-import { authContext, isAuthContextBound } from "./context.js";
+import { authContext, getAuthRoutes, isAuthContextBound } from "./context.js";
 import { AuthCallbackRegistry } from "./registry.js";
 const globalForAuth = globalThis;
 export const authValidators = globalForAuth.__VEAP_AUTH_VALIDATORS__ ??
@@ -64,7 +64,10 @@ export async function checkSecurity(session, user, requiredRoles, requiredPermis
 path) {
     if (!user) {
         console.warn("User is required for security check");
-        return { satisfied: false, redirect: fallbackRedirect ?? "/signin" };
+        return {
+            satisfied: false,
+            redirect: fallbackRedirect ?? getAuthRoutes().signIn,
+        };
     }
     const userRoles = Array.isArray(user.roles) ? user.roles : [];
     const userPermissions = Array.isArray(user.permissions)

package/dist/common/types.d.ts

@@ -70,6 +70,7 @@ export type AuthResponse = {
     status: "SUCCESS";
     session: Session;
     user: FullUser;
+    token?: string;
     redirect?: string;
 } | {
     status: "CHALLENGE_REQUIRED";

package/dist/composition.d.ts

@@ -0,0 +1,9 @@
+import type { AuthConfig } from "./common/types.js";
+declare module "@veap/kernel" {
+    interface ApplicationBuilder {
+        /**
+         * Registers the {@link AuthServiceProvider} with the application.
+         */
+        withAuth(config?: AuthConfig): this;
+    }
+}

package/dist/composition.js

@@ -0,0 +1,5 @@
+import { ApplicationBuilder } from "@veap/kernel";
+import { AuthServiceProvider } from "./providers/auth.provider.js";
+ApplicationBuilder.prototype.withAuth = function (config) {
+    return this.use((c) => new AuthServiceProvider(c, config));
+};

package/dist/crypto/encryption.js

@@ -20,8 +20,6 @@ export function getAlgorithm(key) {
             ? "aes-192-gcm"
             : "aes-256-gcm";
 }
-// Configuration contract: validate key on module load
-getEncryptionKey();
 /**
  * Encrypts data using AES-GCM.
  */

package/dist/crypto/password.d.ts

@@ -1,18 +1,18 @@
 /**
- * Hashes the password using bcrypt.
+ * Hashes the password using the configured password hasher.
  * @param password Password to be hashed.
  * @returns Returns the hashed password.
  */
 export declare function hashPassword(password: string): Promise<string>;
 /**
- * Verifies the password hash.
- * @param hash bcrypt hash.
+ * Verifies the password hash using the configured password hasher.
+ * @param hash Stored password hash.
  * @param password Password for comparison.
  * @returns Returns true if the password is correct, false otherwise.
  */
 export declare function verifyPasswordHash(hash: string, password: string): Promise<boolean>;
 /**
- * Validates password strength.
+ * Validates password strength using the configured password hasher.
  * @param password Password to validate.
  * @returns Returns true if the password meets complexity requirements.
  */

package/dist/crypto/password.js

@@ -1,27 +1,59 @@
-import bcrypt from "bcryptjs";
+import { app } from "@veap/kernel";
+import { authContext, isAuthContextBound } from "../common/context.js";
+import { BcryptPasswordHasher } from "./bcrypt-hasher.js";
+import { PASSWORD_HASHER } from "./contracts.js";
+async function resolvePasswordHasher() {
+    if (isAuthContextBound()) {
+        const ctx = authContext();
+        if (ctx.passwordHasher) {
+            return ctx.passwordHasher;
+        }
+    }
+    const g = globalThis;
+    if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
+        try {
+            await g.__VEAP_BOOTSTRAPPING_PROMISE__;
+        }
+        catch { }
+        if (isAuthContextBound()) {
+            const ctx = authContext();
+            if (ctx.passwordHasher) {
+                return ctx.passwordHasher;
+            }
+        }
+    }
+    try {
+        return await app(PASSWORD_HASHER);
+    }
+    catch {
+        return new BcryptPasswordHasher();
+    }
+}
 /**
- * Hashes the password using bcrypt.
+ * Hashes the password using the configured password hasher.
  * @param password Password to be hashed.
  * @returns Returns the hashed password.
  */
 export async function hashPassword(password) {
-    const saltRounds = 10;
-    return await bcrypt.hash(password, saltRounds);
+    const hasher = await resolvePasswordHasher();
+    return await hasher.hash(password);
 }
 /**
- * Verifies the password hash.
- * @param hash bcrypt hash.
+ * Verifies the password hash using the configured password hasher.
+ * @param hash Stored password hash.
  * @param password Password for comparison.
  * @returns Returns true if the password is correct, false otherwise.
  */
 export async function verifyPasswordHash(hash, password) {
-    return await bcrypt.compare(password, hash);
+    const hasher = await resolvePasswordHasher();
+    return await hasher.verify(hash, password);
 }
 /**
- * Validates password strength.
+ * Validates password strength using the configured password hasher.
  * @param password Password to validate.
  * @returns Returns true if the password meets complexity requirements.
  */
 export async function verifyPasswordStrength(password) {
-    return password.length >= 8 && password.length <= 255;
+    const hasher = await resolvePasswordHasher();
+    return await hasher.validateStrength(password);
 }

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export * from "./actions/index.js";
-export { AuthProvider, useAuthRoutes, useUser } from "./client/index.js";
 export * from "./common/index.js";
+export * from "./composition.js";
 export * from "./crypto/index.js";
+export * from "./notifications/index.js";
 export * from "./passwords/index.js";
 export * from "./providers/index.js";
 export * from "./rbac/index.js";

package/dist/index.js

@@ -1,7 +1,8 @@
 export * from "./actions/index.js";
-export { AuthProvider, useAuthRoutes, useUser } from "./client/index.js";
 export * from "./common/index.js";
+export * from "./composition.js";
 export * from "./crypto/index.js";
+export * from "./notifications/index.js";
 export * from "./passwords/index.js";
 export * from "./providers/index.js";
 export * from "./rbac/index.js";

package/dist/models/User.d.ts

@@ -15,6 +15,7 @@ export interface UserAttributes {
 }
 export declare class User extends Model<UserAttributes> {
     static table: string;
+    static morphAlias: string;
     static hidden: string[];
     static casts: Record<string, CastType>;
     /**

package/dist/models/User.js

@@ -1,9 +1,10 @@
-import { Model } from "@veap/database";
+import { Model, MorphMap } from "@veap/database";
 import { Permission } from "./Permission.js";
 import { Role } from "./Role.js";
 import { Session } from "./Session.js";
 export class User extends Model {
     static table = "users";
+    static morphAlias = "user";
     static hidden = ["password", "recovery_code"];
     static casts = {
         emailVerifiedAt: "datetime",
@@ -29,3 +30,4 @@ export class User extends Model {
         return this.belongsToMany(Permission, "users_to_permissions", "user_id", "permission_id", "id", "id");
     }
 }
+MorphMap.register({ user: User });

package/dist/notifications/contracts.d.ts

@@ -0,0 +1,29 @@
+import type { Token } from "@veap/kernel";
+/**
+ * Port contract for authentication notifications (emails, SMS, security alerts).
+ *
+ * Decouples authentication use cases (password reset, email verification,
+ * recovery codes) from specific transport providers (SMTP, SendGrid, SES, etc.).
+ */
+export interface IAuthNotificationService {
+    /**
+     * Sends an email verification request containing an OTP code.
+     */
+    sendVerificationEmail(email: string, code: string): Promise<void>;
+    /**
+     * Sends a password reset request containing an OTP code.
+     */
+    sendPasswordReset(email: string, code: string): Promise<void>;
+    /**
+     * Sends an initial or updated recovery code to the user.
+     */
+    sendRecoveryCode(email: string, code: string): Promise<void>;
+    /**
+     * Optional two-factor authentication challenge delivery.
+     */
+    send2FACode?(email: string, code: string): Promise<void>;
+}
+/**
+ * IoC Token for the authentication notification port.
+ */
+export declare const AUTH_NOTIFICATION_SERVICE: Token<IAuthNotificationService>;

package/dist/notifications/contracts.js

@@ -0,0 +1,4 @@
+/**
+ * IoC Token for the authentication notification port.
+ */
+export const AUTH_NOTIFICATION_SERVICE = Symbol.for("veap:auth:notification-service");

package/dist/notifications/default-notification.service.d.ts

@@ -0,0 +1,30 @@
+import type { IEventBus } from "@veap/kernel";
+import type { IAuthNotificationService } from "./contracts.js";
+export interface IMailerLike {
+    sendMail(message: {
+        to: string;
+        subject: string;
+        text?: string;
+        html?: string;
+    }): Promise<void>;
+}
+export type MailerResolver = () => Promise<IMailerLike | undefined> | IMailerLike | undefined;
+export type EventBusResolver = () => Promise<IEventBus | undefined> | IEventBus | undefined;
+/**
+ * Default implementation of the authentication notification port.
+ *
+ * If a mailer adapter is registered, it constructs and sends localized or
+ * templated emails. If an EventBus is available, it emits system auth events.
+ * In development or testing without a mailer, it logs codes safely.
+ */
+export declare class DefaultAuthNotificationService implements IAuthNotificationService {
+    private readonly mailerResolver?;
+    private readonly eventBusResolver?;
+    constructor(mailerResolver?: MailerResolver | undefined, eventBusResolver?: EventBusResolver | undefined);
+    private getMailer;
+    private getEventBus;
+    sendVerificationEmail(email: string, code: string): Promise<void>;
+    sendPasswordReset(email: string, code: string): Promise<void>;
+    sendRecoveryCode(email: string, code: string): Promise<void>;
+    send2FACode(email: string, code: string): Promise<void>;
+}

package/dist/notifications/default-notification.service.js

@@ -0,0 +1,105 @@
+/**
+ * Default implementation of the authentication notification port.
+ *
+ * If a mailer adapter is registered, it constructs and sends localized or
+ * templated emails. If an EventBus is available, it emits system auth events.
+ * In development or testing without a mailer, it logs codes safely.
+ */
+export class DefaultAuthNotificationService {
+    mailerResolver;
+    eventBusResolver;
+    constructor(mailerResolver, eventBusResolver) {
+        this.mailerResolver = mailerResolver;
+        this.eventBusResolver = eventBusResolver;
+    }
+    async getMailer() {
+        if (!this.mailerResolver)
+            return undefined;
+        return await this.mailerResolver();
+    }
+    async getEventBus() {
+        if (!this.eventBusResolver)
+            return undefined;
+        return await this.eventBusResolver();
+    }
+    async sendVerificationEmail(email, code) {
+        const mailer = await this.getMailer();
+        if (mailer) {
+            await mailer.sendMail({
+                to: email,
+                subject: "Verify Email",
+                text: `Verify your email address with your code: ${code}`,
+            });
+        }
+        else {
+            console.info(`[veap:auth] Verification email code for ${email}: ${code}`);
+        }
+        const eventBus = await this.getEventBus();
+        if (eventBus) {
+            await eventBus.publish("system:auth:verification-requested", {
+                email,
+                code,
+            });
+        }
+    }
+    async sendPasswordReset(email, code) {
+        const mailer = await this.getMailer();
+        if (mailer) {
+            await mailer.sendMail({
+                to: email,
+                subject: "Password Reset",
+                text: `Verify password reset with code: ${code}`,
+            });
+        }
+        else {
+            console.info(`[veap:auth] Password reset code for ${email}: ${code}`);
+        }
+        const eventBus = await this.getEventBus();
+        if (eventBus) {
+            await eventBus.publish("system:auth:password-reset:requested", {
+                email,
+                code,
+            });
+        }
+    }
+    async sendRecoveryCode(email, code) {
+        const mailer = await this.getMailer();
+        if (mailer) {
+            await mailer.sendMail({
+                to: email,
+                subject: "Recovery Code",
+                text: `Your recovery code is: ${code}`,
+            });
+        }
+        else {
+            console.info(`[veap:auth] Recovery code for ${email}: ${code}`);
+        }
+        const eventBus = await this.getEventBus();
+        if (eventBus) {
+            await eventBus.publish("system:auth:recovery-code:generated", {
+                email,
+                recoveryCode: code,
+            });
+        }
+    }
+    async send2FACode(email, code) {
+        const mailer = await this.getMailer();
+        if (mailer) {
+            await mailer.sendMail({
+                to: email,
+                subject: "Your 2FA Code",
+                text: `Your verification code is: ${code}. It will expire in 10 minutes.`,
+            });
+        }
+        else {
+            console.info(`[veap:auth] 2FA verification code for ${email}: ${code}`);
+        }
+        const eventBus = await this.getEventBus();
+        if (eventBus) {
+            await eventBus.publish("system:auth:2fa-code:requested", {
+                email,
+                code,
+            });
+        }
+    }
+}

package/dist/notifications/helpers.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Sends a verification email code using the registered auth notification service.
+ */
+export declare function sendVerifyEmail(email: string, code: string): Promise<void>;
+/**
+ * Sends a password reset code using the registered auth notification service.
+ */
+export declare function sendResetPassword(email: string, code: string): Promise<void>;
+/**
+ * Sends a recovery code using the registered auth notification service.
+ */
+export declare function sendRecoveryCode(email: string, code: string): Promise<void>;
+/**
+ * Sends a 2FA verification code using the registered auth notification service.
+ */
+export declare function send2FACode(email: string, code: string): Promise<void>;

package/dist/notifications/helpers.js

@@ -0,0 +1,39 @@
+import { container } from "@veap/kernel";
+import { AUTH_NOTIFICATION_SERVICE, } from "./contracts.js";
+import { DefaultAuthNotificationService } from "./default-notification.service.js";
+async function getNotificationService() {
+    if (container.has(AUTH_NOTIFICATION_SERVICE)) {
+        return await container.resolve(AUTH_NOTIFICATION_SERVICE);
+    }
+    return new DefaultAuthNotificationService();
+}
+/**
+ * Sends a verification email code using the registered auth notification service.
+ */
+export async function sendVerifyEmail(email, code) {
+    const service = await getNotificationService();
+    return service.sendVerificationEmail(email, code);
+}
+/**
+ * Sends a password reset code using the registered auth notification service.
+ */
+export async function sendResetPassword(email, code) {
+    const service = await getNotificationService();
+    return service.sendPasswordReset(email, code);
+}
+/**
+ * Sends a recovery code using the registered auth notification service.
+ */
+export async function sendRecoveryCode(email, code) {
+    const service = await getNotificationService();
+    return service.sendRecoveryCode(email, code);
+}
+/**
+ * Sends a 2FA verification code using the registered auth notification service.
+ */
+export async function send2FACode(email, code) {
+    const service = await getNotificationService();
+    if (service.send2FACode) {
+        return service.send2FACode(email, code);
+    }
+}

package/dist/notifications/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./contracts.js";
+export * from "./default-notification.service.js";
+export * from "./helpers.js";

package/dist/notifications/index.js

@@ -0,0 +1,3 @@
+export * from "./contracts.js";
+export * from "./default-notification.service.js";
+export * from "./helpers.js";

package/dist/passwords/password-reset.facade.js

@@ -1,17 +1,19 @@
-"use server";
 import { app } from "@veap/kernel";
 import { authContext, isAuthContextBound } from "../common/context.js";
 import { PasswordResetService } from "./password-reset.service.js";
 async function resolvePasswordResetService() {
+    if (isAuthContextBound()) {
+        return authContext().passwordReset;
+    }
     const g = globalThis;
     if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
         try {
             await g.__VEAP_BOOTSTRAPPING_PROMISE__;
         }
         catch { }
-    }
-    if (isAuthContextBound()) {
-        return authContext().passwordReset;
+        if (isAuthContextBound()) {
+            return authContext().passwordReset;
+        }
     }
     return await app(PasswordResetService);
 }

package/dist/passwords/password-reset.service.d.ts

@@ -1,14 +1,16 @@
 import { type ICacheProvider, type ICookieStore } from "@veap/kernel";
 import type { PasswordResetAuthSession, PasswordResetSession as PasswordResetSessionType } from "../common/index.js";
 import { type ITokenGenerator } from "../crypto/contracts.js";
+import { type IAuthNotificationService } from "../notifications/contracts.js";
 import { type IPasswordResetRepository } from "./contracts.js";
 export declare class PasswordResetService {
     private readonly sessions;
     private readonly tokens;
     private readonly cookieStore;
     private readonly cache?;
+    private readonly notifier?;
     private inMemoryAttempts;
-    constructor(sessions: IPasswordResetRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, cache?: ICacheProvider | undefined);
+    constructor(sessions: IPasswordResetRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, cache?: ICacheProvider | undefined, notifier?: IAuthNotificationService | undefined);
     createPasswordResetSession(token: string, userId: string, email: string): Promise<PasswordResetSessionType>;
     /**
      * Creates an ephemeral dummy reset session for an unregistered email.

package/dist/passwords/password-reset.service.js

@@ -11,11 +11,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { CACHE_PROVIDER, COOKIE_STORE, Inject, Injectable, } from "@veap/kernel";
-import { sendResetPassword } from "@veap/mail";
 import { addMinutes } from "date-fns";
 import { augmentPasswordResetSession } from "../common/augment.js";
 import { performFullUserAugmentation } from "../common/logic.js";
 import { TOKEN_GENERATOR } from "../crypto/contracts.js";
+import { AUTH_NOTIFICATION_SERVICE, } from "../notifications/contracts.js";
 import { PASSWORD_RESET_REPOSITORY, } from "./contracts.js";
 const dummySessions = new Map();
 let PasswordResetService = class PasswordResetService {
@@ -23,12 +23,14 @@ let PasswordResetService = class PasswordResetService {
     tokens;
     cookieStore;
     cache;
+    notifier;
     inMemoryAttempts = new Map();
-    constructor(sessions, tokens, cookieStore, cache) {
+    constructor(sessions, tokens, cookieStore, cache, notifier) {
         this.sessions = sessions;
         this.tokens = tokens;
         this.cookieStore = cookieStore;
         this.cache = cache;
+        this.notifier = notifier;
     }
     async createPasswordResetSession(token, userId, email) {
         const sessionId = this.tokens.hashToken(token);
@@ -228,7 +230,9 @@ let PasswordResetService = class PasswordResetService {
         return true;
     }
     async sendPasswordResetEmail(email, code) {
-        await sendResetPassword(email, code);
+        if (this.notifier) {
+            await this.notifier.sendPasswordReset(email, code);
+        }
     }
 };
 PasswordResetService = __decorate([
@@ -237,6 +241,7 @@ PasswordResetService = __decorate([
     __param(1, Inject(TOKEN_GENERATOR)),
     __param(2, Inject(COOKIE_STORE)),
     __param(3, Inject(CACHE_PROVIDER)),
-    __metadata("design:paramtypes", [Object, Object, Object, Object])
+    __param(4, Inject(AUTH_NOTIFICATION_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object])
 ], PasswordResetService);
 export { PasswordResetService };

package/dist/providers/auth.provider.js

@@ -1,5 +1,5 @@
 import { isDatabaseInitialized } from "@veap/database";
-import { ConfigService, Container, container as defaultContainer, logger, ServiceProvider, } from "@veap/kernel";
+import { ConfigService, Container, container as defaultContainer, EVENT_BUS, logger, ServiceProvider, } from "@veap/kernel";
 import { bindAuthContext } from "../common/context.js";
 import { AUTH_ROUTES, DEFAULT_AUTH_ROUTES, ROUTER_SERVICE, } from "../common/routes.js";
 import { AesSecretCipher } from "../crypto/aes-cipher.js";
@@ -7,6 +7,7 @@ import { BcryptPasswordHasher } from "../crypto/bcrypt-hasher.js";
 import { PASSWORD_HASHER, SECRET_CIPHER, TOKEN_GENERATOR, } from "../crypto/contracts.js";
 import { OsloTokenGenerator } from "../crypto/token-generator.js";
 import { runAuthMigrations } from "../migrations/index.js";
+import { AUTH_NOTIFICATION_SERVICE, DefaultAuthNotificationService, } from "../notifications/index.js";
 import { PASSWORD_RESET_REPOSITORY } from "../passwords/contracts.js";
 import { ActiveRecordPasswordResetRepository } from "../passwords/password-reset.repository.js";
 import { PasswordResetService } from "../passwords/password-reset.service.js";
@@ -103,6 +104,20 @@ export class AuthServiceProvider extends ServiceProvider {
             useClass: ActiveRecordEmailVerificationRepository,
             singleton: true,
         });
+        if (!this.container.has(AUTH_NOTIFICATION_SERVICE)) {
+            this.container.register({
+                token: AUTH_NOTIFICATION_SERVICE,
+                useFactory: () => {
+                    const mailerToken = Symbol.for("veap:communication:mailer");
+                    return new DefaultAuthNotificationService(() => this.container.has(mailerToken)
+                        ? this.container.resolve(mailerToken)
+                        : undefined, () => this.container.has(EVENT_BUS)
+                        ? this.container.resolve(EVENT_BUS)
+                        : undefined);
+                },
+                singleton: true,
+            });
+        }
         // Services
         this.container.register({
             token: UserService,
@@ -138,7 +153,7 @@ export class AuthServiceProvider extends ServiceProvider {
     async boot() {
         // 0. Auto-bootstrap setup state
         try {
-            isSystemInstalled();
+            await isSystemInstalled();
         }
         catch { }
         // 1. Resolve domain services and bind singleton auth context
@@ -148,6 +163,7 @@ export class AuthServiceProvider extends ServiceProvider {
         const passwordReset = await this.container.resolve(PasswordResetService);
         const emailVerification = await this.container.resolve(EmailVerificationService);
         const auth = await this.container.resolve(AuthService);
+        const passwordHasher = await this.container.resolve(PASSWORD_HASHER);
         bindAuthContext({
             user,
             session,
@@ -155,6 +171,7 @@ export class AuthServiceProvider extends ServiceProvider {
             passwordReset,
             emailVerification,
             auth,
+            passwordHasher,
             routes: this.resolveRoutes(),
         });
         // 2. Register route rewrites if RouterService is available

package/dist/providers/setup.js

@@ -8,7 +8,18 @@ import { User } from "../models/User.js";
  */
 export async function isSystemInstalled() {
     try {
-        const count = await User.query().count();
+        const res = await User.query().count();
+        let count = 0;
+        if (Array.isArray(res) && res.length > 0) {
+            const first = res[0];
+            const rawVal = typeof first === "object" && first !== null
+                ? Object.values(first)[0]
+                : first;
+            count = Number(rawVal) || 0;
+        }
+        else if (typeof res === "number") {
+            count = res;
+        }
         if (count === 0) {
             logger.debug("veap:setup", "System not installed. Publishing event.");
             await eventBus.publish("system:not-installed", { timestamp: Date.now() });

package/dist/rbac/rbac.facade.d.ts

@@ -1,10 +1,10 @@
 export declare function getRoles(): Promise<import("./contracts.js").RoleRecord[]>;
 export declare function getRoleById(roleId: string): Promise<import("./contracts.js").RoleRecord | undefined>;
-export declare function createRole(name: string, description?: string): Promise<import("./contracts.js").RoleRecord[]>;
+export declare function createRole(name: string, description?: string): Promise<import("./contracts.js").RoleRecord>;
 export declare function deleteRole(roleId: string): Promise<void>;
 export declare function getPermissions(): Promise<import("./contracts.js").PermissionRecord[]>;
 export declare function getPermissionById(permissionId: string): Promise<import("./contracts.js").PermissionRecord | undefined>;
-export declare function createPermission(name: string, description?: string): Promise<import("./contracts.js").PermissionRecord[]>;
+export declare function createPermission(name: string, description?: string): Promise<import("./contracts.js").PermissionRecord>;
 export declare function deletePermission(permissionId: string): Promise<void>;
 export declare function getRolePermissions(roleId: string): Promise<import("./contracts.js").AccessGrant[]>;
 export declare function assignPermissionToRole(roleId: string, permissionId: string): Promise<void>;

package/dist/rbac/rbac.facade.js

@@ -1,17 +1,19 @@
-"use server";
 import { app } from "@veap/kernel";
 import { authContext, isAuthContextBound } from "../common/context.js";
 import { RbacService } from "./rbac.service.js";
 async function resolveRbacService() {
+    if (isAuthContextBound()) {
+        return authContext().rbac;
+    }
     const g = globalThis;
     if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
         try {
             await g.__VEAP_BOOTSTRAPPING_PROMISE__;
         }
         catch { }
-    }
-    if (isAuthContextBound()) {
-        return authContext().rbac;
+        if (isAuthContextBound()) {
+            return authContext().rbac;
+        }
     }
     return await app(RbacService);
 }

package/dist/rbac/rbac.service.d.ts

@@ -10,11 +10,11 @@ export declare class RbacService {
     constructor(roles: IRoleRepository, permissions: IPermissionRepository);
     getRoles(): Promise<RoleRecord[]>;
     getRoleById(roleId: string): Promise<RoleRecord | undefined>;
-    createRole(name: string, description?: string): Promise<RoleRecord[]>;
+    createRole(name: string, description?: string): Promise<RoleRecord>;
     deleteRole(roleId: string): Promise<void>;
     getPermissions(): Promise<PermissionRecord[]>;
     getPermissionById(permissionId: string): Promise<PermissionRecord | undefined>;
-    createPermission(name: string, description?: string): Promise<PermissionRecord[]>;
+    createPermission(name: string, description?: string): Promise<PermissionRecord>;
     deletePermission(permissionId: string): Promise<void>;
     getRolePermissions(roleId: string): Promise<AccessGrant[]>;
     assignPermissionToRole(roleId: string, permissionId: string): Promise<void>;

package/dist/rbac/rbac.service.js

@@ -31,7 +31,7 @@ let RbacService = class RbacService {
     }
     async createRole(name, description) {
         const role = await this.roles.create({ name, description });
-        return [role];
+        return role;
     }
     async deleteRole(roleId) {
         await this.roles.remove(roleId);
@@ -44,7 +44,7 @@ let RbacService = class RbacService {
     }
     async createPermission(name, description) {
         const permission = await this.permissions.create({ name, description });
-        return [permission];
+        return permission;
     }
     async deletePermission(permissionId) {
         await this.permissions.remove(permissionId);

package/dist/server.d.ts

@@ -1,3 +1,12 @@
 export * from "./actions/index.js";
+export * from "./common/index.js";
+export * from "./composition.js";
 export * from "./crypto/index.js";
-export * from "./index.js";
+export * from "./notifications/index.js";
+export * from "./passwords/index.js";
+export * from "./providers/index.js";
+export * from "./rbac/index.js";
+export * from "./session/index.js";
+export * from "./users/index.js";
+export * from "./validation/index.js";
+export * from "./verification/index.js";

package/dist/server.js

@@ -1,3 +1,12 @@
 export * from "./actions/index.js";
+export * from "./common/index.js";
+export * from "./composition.js";
 export * from "./crypto/index.js";
-export * from "./index.js";
+export * from "./notifications/index.js";
+export * from "./passwords/index.js";
+export * from "./providers/index.js";
+export * from "./rbac/index.js";
+export * from "./session/index.js";
+export * from "./users/index.js";
+export * from "./validation/index.js";
+export * from "./verification/index.js";

package/dist/session/auth.service.js

@@ -128,6 +128,7 @@ let AuthService = class AuthService {
             status: "SUCCESS",
             session: { ...session },
             user: { ...fullUser },
+            token: sessionToken,
         };
     }
     /**
@@ -162,6 +163,7 @@ let AuthService = class AuthService {
             status: "SUCCESS",
             session: { ...session },
             user: { ...fullUser },
+            token: sessionToken,
         };
     }
     /**
@@ -184,6 +186,7 @@ let AuthService = class AuthService {
             status: "SUCCESS",
             session: { ...session },
             user: { ...fullUser },
+            token: sessionToken,
         };
     }
     /**

package/dist/session/session.facade.js

@@ -1,18 +1,20 @@
-"use server";
 import { app } from "@veap/kernel";
 import { cache } from "react";
 import { authContext, isAuthContextBound } from "../common/context.js";
 import { SessionService } from "./session.service.js";
 async function resolveSessionService() {
+    if (isAuthContextBound()) {
+        return authContext().session;
+    }
     const g = globalThis;
     if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
         try {
             await g.__VEAP_BOOTSTRAPPING_PROMISE__;
         }
         catch { }
-    }
-    if (isAuthContextBound()) {
-        return authContext().session;
+        if (isAuthContextBound()) {
+            return authContext().session;
+        }
     }
     return await app(SessionService);
 }

package/dist/session/session.service.d.ts

@@ -17,7 +17,7 @@ export declare class SessionService {
      */
     validateSessionToken(token: string): Promise<AuthSession>;
     /**
-     * Returns the current user session from cookies.
+     * Returns the current user session from Bearer token or cookies.
      */
     getCurrentSession(): Promise<AuthSession>;
     /**

package/dist/session/session.service.js

@@ -94,11 +94,22 @@ let SessionService = class SessionService {
         };
     }
     /**
-     * Returns the current user session from cookies.
+     * Returns the current user session from Bearer token or cookies.
      */
     async getCurrentSession() {
-        const token = await this.cookieStore.get("session");
-        if (token === null) {
+        let token = null;
+        const authHeader = (await this.requestContext.getHeader("authorization")) ??
+            (await this.requestContext.getHeader("Authorization"));
+        if (authHeader) {
+            const match = authHeader.match(/^Bearer\s+(.+)$/i);
+            if (match?.[1]) {
+                token = match[1].trim();
+            }
+        }
+        if (!token) {
+            token = await this.cookieStore.get("session");
+        }
+        if (token === null || token === "") {
             return { session: null, user: null };
         }
         return await this.validateSessionToken(token);

package/dist/users/user.facade.js

@@ -1,17 +1,19 @@
-"use server";
 import { app } from "@veap/kernel";
 import { authContext, isAuthContextBound } from "../common/context.js";
 import { UserService } from "./user.service.js";
 async function resolveUserService() {
+    if (isAuthContextBound()) {
+        return authContext().user;
+    }
     const g = globalThis;
     if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
         try {
             await g.__VEAP_BOOTSTRAPPING_PROMISE__;
         }
         catch { }
-    }
-    if (isAuthContextBound()) {
-        return authContext().user;
+        if (isAuthContextBound()) {
+            return authContext().user;
+        }
     }
     return await app(UserService);
 }

package/dist/users/user.service.d.ts

@@ -1,5 +1,6 @@
 import type { User } from "../common/index.js";
 import { type IPasswordHasher, type ISecretCipher, type ITokenGenerator } from "../crypto/contracts.js";
+import { type IAuthNotificationService } from "../notifications/contracts.js";
 import { type IRoleRepository } from "../rbac/contracts.js";
 import { type IUserRepository } from "./contracts.js";
 export declare class UserService {
@@ -8,7 +9,8 @@ export declare class UserService {
     private readonly hasher;
     private readonly tokens;
     private readonly cipher;
-    constructor(users: IUserRepository, roles: IRoleRepository, hasher: IPasswordHasher, tokens: ITokenGenerator, cipher: ISecretCipher);
+    private readonly notifier?;
+    constructor(users: IUserRepository, roles: IRoleRepository, hasher: IPasswordHasher, tokens: ITokenGenerator, cipher: ISecretCipher, notifier?: IAuthNotificationService | undefined);
     /**
      * Validates the username input.
      */

package/dist/users/user.service.js

@@ -11,8 +11,8 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { AppError, Inject, Injectable } from "@veap/kernel";
-import { sendRecoveryCode } from "@veap/mail";
 import { PASSWORD_HASHER, SECRET_CIPHER, TOKEN_GENERATOR, } from "../crypto/contracts.js";
+import { AUTH_NOTIFICATION_SERVICE, } from "../notifications/contracts.js";
 import { ROLE_REPOSITORY } from "../rbac/contracts.js";
 import { USER_REPOSITORY } from "./contracts.js";
 const DEFAULT_ROLE = "user";
@@ -22,12 +22,14 @@ let UserService = class UserService {
     hasher;
     tokens;
     cipher;
-    constructor(users, roles, hasher, tokens, cipher) {
+    notifier;
+    constructor(users, roles, hasher, tokens, cipher, notifier) {
         this.users = users;
         this.roles = roles;
         this.hasher = hasher;
         this.tokens = tokens;
         this.cipher = cipher;
+        this.notifier = notifier;
     }
     /**
      * Validates the username input.
@@ -57,7 +59,9 @@ let UserService = class UserService {
         });
         await this.assignDefaultRole(user.id);
         try {
-            await sendRecoveryCode(user.email, recoveryCode);
+            if (this.notifier) {
+                await this.notifier.sendRecoveryCode(user.email, recoveryCode);
+            }
         }
         catch (error) {
             console.warn(`[veap:auth] Failed to send recovery code email to ${user.email}:`, error?.message || error);
@@ -112,7 +116,9 @@ let UserService = class UserService {
         const recoveryCode = this.tokens.generateRecoveryCode();
         await this.users.setRecoveryCode(userId, this.cipher.encrypt(recoveryCode));
         try {
-            await sendRecoveryCode(user.email, recoveryCode);
+            if (this.notifier) {
+                await this.notifier.sendRecoveryCode(user.email, recoveryCode);
+            }
         }
         catch (error) {
             console.warn(`[veap:auth] Failed to send recovery code email to ${user.email}:`, error?.message || error);
@@ -196,6 +202,7 @@ UserService = __decorate([
     __param(2, Inject(PASSWORD_HASHER)),
     __param(3, Inject(TOKEN_GENERATOR)),
     __param(4, Inject(SECRET_CIPHER)),
-    __metadata("design:paramtypes", [Object, Object, Object, Object, Object])
+    __param(5, Inject(AUTH_NOTIFICATION_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object])
 ], UserService);
 export { UserService };

package/dist/validation/index.js

@@ -12,7 +12,7 @@ export const loginSchema = z.object({
     remember: z.boolean().optional(),
 });
 export const registerSchema = z.object({
-    username: z.string().min(3, "Name must be at least 2 characters"),
+    username: z.string().min(3, "Name must be at least 3 characters"),
     email: z.string().email("Invalid email address"),
     password: z.string().min(8, "Password must be at least 8 characters"),
     terms: z

package/dist/verification/verification.facade.js

@@ -1,17 +1,19 @@
-"use server";
 import { app } from "@veap/kernel";
 import { authContext, isAuthContextBound } from "../common/context.js";
 import { EmailVerificationService, } from "./verification.service.js";
 async function resolveVerificationService() {
+    if (isAuthContextBound()) {
+        return authContext().emailVerification;
+    }
     const g = globalThis;
     if (g.__VEAP_BOOTSTRAPPING_PROMISE__) {
         try {
             await g.__VEAP_BOOTSTRAPPING_PROMISE__;
         }
         catch { }
-    }
-    if (isAuthContextBound()) {
-        return authContext().emailVerification;
+        if (isAuthContextBound()) {
+            return authContext().emailVerification;
+        }
     }
     return await app(EmailVerificationService);
 }

package/dist/verification/verification.service.d.ts

@@ -1,5 +1,6 @@
 import { type ICookieStore } from "@veap/kernel";
 import { type ITokenGenerator } from "../crypto/contracts.js";
+import { type IAuthNotificationService } from "../notifications/contracts.js";
 import { SessionService } from "../session/session.service.js";
 import { type EmailVerificationRecord, type IEmailVerificationRepository } from "./contracts.js";
 export type EmailVerificationRequestType = EmailVerificationRecord;
@@ -8,7 +9,8 @@ export declare class EmailVerificationService {
     private readonly tokens;
     private readonly cookieStore;
     private readonly sessions;
-    constructor(verifications: IEmailVerificationRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, sessions: SessionService);
+    private readonly notifier?;
+    constructor(verifications: IEmailVerificationRepository, tokens: ITokenGenerator, cookieStore: ICookieStore, sessions: SessionService, notifier?: IAuthNotificationService | undefined);
     /**
      * Register Email Verification as a Core Security Requirement.
      */

package/dist/verification/verification.service.js

@@ -11,11 +11,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { COOKIE_STORE, Inject, Injectable, } from "@veap/kernel";
-import { sendVerifyEmail } from "@veap/mail";
 import { addMinutes } from "date-fns";
 import { getAuthRoutes } from "../common/context.js";
 import { registerSecurityRequirement } from "../common/logic.js";
 import { TOKEN_GENERATOR } from "../crypto/contracts.js";
+import { AUTH_NOTIFICATION_SERVICE, } from "../notifications/contracts.js";
 import { SessionService } from "../session/session.service.js";
 import { EMAIL_VERIFICATION_REPOSITORY, } from "./contracts.js";
 let EmailVerificationService = class EmailVerificationService {
@@ -23,11 +23,13 @@ let EmailVerificationService = class EmailVerificationService {
     tokens;
     cookieStore;
     sessions;
-    constructor(verifications, tokens, cookieStore, sessions) {
+    notifier;
+    constructor(verifications, tokens, cookieStore, sessions, notifier) {
         this.verifications = verifications;
         this.tokens = tokens;
         this.cookieStore = cookieStore;
         this.sessions = sessions;
+        this.notifier = notifier;
     }
     /**
      * Register Email Verification as a Core Security Requirement.
@@ -72,7 +74,9 @@ let EmailVerificationService = class EmailVerificationService {
      * Sends a verification email with the OTP code.
      */
     async sendVerificationEmail(email, code) {
-        await sendVerifyEmail(email, code);
+        if (this.notifier) {
+            await this.notifier.sendVerificationEmail(email, code);
+        }
     }
     /**
      * Sets the email verification request ID in a cookie.
@@ -117,6 +121,7 @@ EmailVerificationService = __decorate([
     __param(1, Inject(TOKEN_GENERATOR)),
     __param(2, Inject(COOKIE_STORE)),
     __param(3, Inject(SessionService)),
-    __metadata("design:paramtypes", [Object, Object, Object, SessionService])
+    __param(4, Inject(AUTH_NOTIFICATION_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, Object, SessionService, Object])
 ], EmailVerificationService);
 export { EmailVerificationService };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veap/auth",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Authentication, session management, RBAC, and crypto adapters for Veap",
   "bugs": "https://github.com/veapjs/veap-auth/issues",
   "repository": {
@@ -55,9 +55,8 @@
     "@oslojs/binary": "^1.0.0",
     "@oslojs/crypto": "^1.0.1",
     "@oslojs/encoding": "^1.1.0",
-    "@veap/database": "0.1.6",
-    "@veap/kernel": "0.1.6",
-    "@veap/mail": "0.1.6",
+    "@veap/database": "0.1.8",
+    "@veap/kernel": "0.2.1",
     "bcryptjs": "^3.0.3",
     "date-fns": "^4.4.0",
     "zod": "^3.24.2"