@warlock.js/auth 4.16.0 → 5.0.0

package/esm/services/jwt.mjs

@@ -1,4 +1,5 @@
 import { authConfig } from "./auth-config.mjs";
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { createSigner, createVerifier } from "fast-jwt";
 
 //#region ../auth/src/services/jwt.ts
@@ -8,12 +9,60 @@ const getRefreshSecretKey = () => authConfig.refreshToken.secret() || getSecretK
 const ACCESS_TOKEN_TYPE = "access";
 const REFRESH_TOKEN_TYPE = "refresh";
 /**
+* Error codes that mean "the credential itself is bad", as opposed to "this
+* server could not check it". This is an ALLOWLIST and must stay one. The codes
+* deliberately left out — `FAST_JWT_INVALID_KEY`, `FAST_JWT_MISSING_KEY`,
+* `FAST_JWT_KEY_FETCHING_ERROR`, `FAST_JWT_INVALID_OPTION`,
+* `FAST_JWT_VERIFY_ERROR`, and `FAST_JWT_SIGN_ERROR` — describe a broken
+* server, not a broken token, and so does every unknown future code.
+*/
+const INVALID_CREDENTIAL_ERROR_CODES = new Set([
+	"FAST_JWT_MALFORMED",
+	"FAST_JWT_INVALID_SIGNATURE",
+	"FAST_JWT_MISSING_SIGNATURE",
+	"FAST_JWT_INVALID_ALGORITHM",
+	"FAST_JWT_EXPIRED",
+	"FAST_JWT_INACTIVE",
+	"FAST_JWT_MISSING_REQUIRED_CLAIM",
+	"FAST_JWT_INVALID_CLAIM_VALUE",
+	"FAST_JWT_INVALID_CLAIM_TYPE",
+	"FAST_JWT_INVALID_CRIT_HEADER",
+	"FAST_JWT_INVALID_TYPE",
+	"FAST_JWT_INVALID_PAYLOAD",
+	"EC005"
+]);
+/**
+* Only coded credential failures become authentication misses. Plain errors,
+* including missing-secret configuration failures, propagate to the central
+* server-error path instead of reading as "everyone's token is bad".
+*/
+function isInvalidCredentialError(error) {
+	const code = error?.code;
+	return typeof code === "string" && INVALID_CREDENTIAL_ERROR_CODES.has(code);
+}
+/**
+* A `tokenType` claim that does not match what the caller expects. This IS a
+* bad credential (an access-token cookie can only hold a refresh token
+* through an app bug) — but unlike `fast-jwt`'s own rejections it was
+* previously a plain `Error`, unclassifiable by a caller that wants to answer
+* 401 without string-matching a message that could reword on any release.
+* `code` mirrors how `fast-jwt`'s `TokenError` carries its own code, so a
+* caller can classify both through `isInvalidCredentialError` above.
+*/
+var TokenTypeError = class extends Error {
+	constructor(expected, actual) {
+		super(`Invalid token type: expected "${expected}", received "${actual}".`);
+		this.code = "EC005";
+		this.name = "TokenTypeError";
+	}
+};
+/**
 * Reject the token when its `tokenType` claim is present and does not match the
 * expected class. Absent claim ⇒ legacy token, accepted (backward compatible).
 */
 function assertTokenType(decoded, expected) {
 	const actual = decoded?.tokenType;
-	if (typeof actual === "string" && actual !== expected) throw new Error(`Invalid token type: expected "${expected}", received "${actual}".`);
+	if (typeof actual === "string" && actual !== expected) throw new TokenTypeError(expected, actual);
 }
 /**
 * Claims no token may be missing, whatever the caller asks for.
@@ -101,5 +150,5 @@ const jwt = {
 };
 
 //#endregion
-export { jwt };
+export { TokenTypeError, isInvalidCredentialError, jwt };
 //# sourceMappingURL=jwt.mjs.map

package/esm/services/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":[],"sources":["../../../../../../../auth/src/services/jwt.ts"],"sourcesContent":["import { createSigner, createVerifier, type SignerOptions, type VerifierOptions } from \"fast-jwt\";\r\nimport { authConfig } from \"./auth-config\";\r\n\r\nconst getSecretKey = () => authConfig.accessToken.secret();\r\nconst getAlgorithm = () => authConfig.accessToken.algorithm();\r\n\r\n// Refresh tokens may declare their own secret; when unset/empty we fall back to\r\n// the access-token secret (the documented optional behavior).\r\nconst getRefreshSecretKey = () => authConfig.refreshToken.secret() || getSecretKey();\r\n\r\n/**\r\n * Token class. Stamped as the `tokenType` claim on every signed token and\r\n * checked on verify so an access token can never be accepted where a refresh\r\n * token is expected (and vice versa) — even when both share the same secret\r\n * under the documented refresh-secret fallback. Legacy tokens minted before\r\n * this claim existed carry no `tokenType` and remain accepted; a *mismatched*\r\n * type is always rejected.\r\n */\r\nexport type TokenType = \"access\" | \"refresh\";\r\n\r\nconst ACCESS_TOKEN_TYPE: TokenType = \"access\";\r\nconst REFRESH_TOKEN_TYPE: TokenType = \"refresh\";\r\n\r\n/**\r\n * Reject the token when its `tokenType` claim is present and does not match the\r\n * expected class. Absent claim ⇒ legacy token, accepted (backward compatible).\r\n */\r\nfunction assertTokenType(decoded: unknown, expected: TokenType): void {\r\n  const actual = (decoded as { tokenType?: unknown } | null | undefined)?.tokenType;\r\n\r\n  if (typeof actual === \"string\" && actual !== expected) {\r\n    throw new Error(`Invalid token type: expected \"${expected}\", received \"${actual}\".`);\r\n  }\r\n}\r\n\r\n/**\r\n * Claims no token may be missing, whatever the caller asks for.\r\n *\r\n * A JWT with no `exp` is not \"a token with a long life\" — it is a credential\r\n * with *no* life, because a verifier with no deadline to check simply succeeds,\r\n * forever (measured against `fast-jwt@6.2.4`: a token with no `exp` verifies\r\n * unchanged at `clockTimestamp` + 100 years). Nothing in this package can mint\r\n * one as of 4.12.0, but tokens minted by an earlier version are already in the\r\n * wild, so the rejection lives on the *verify* side where it catches a token\r\n * from any version, including one signed by a service this package never ran.\r\n *\r\n * There is no legitimate source to preserve: an app that wants a token that\r\n * effectively never expires sets `expiresIn: NO_EXPIRATION` (`\"100y\"`), which\r\n * mints a real `exp` roughly a century out (measured: `ms(\"100y\")` ⇒\r\n * `3155760000000`, `exp - iat` ⇒ `3155760000` seconds). \"No deadline\" and \"a\r\n * distant deadline\" are different things, and only the second one is asked for.\r\n */\r\nconst REQUIRED_CLAIMS = [\"exp\"];\r\n\r\n/**\r\n * Union the caller's `requiredClaims` with the mandatory ones — a caller may\r\n * add requirements, never drop them.\r\n */\r\nfunction withRequiredClaims(callerClaims?: string[]): string[] {\r\n  if (!callerClaims?.length) return REQUIRED_CLAIMS;\r\n\r\n  return [...new Set([...callerClaims, ...REQUIRED_CLAIMS])];\r\n}\r\n\r\nexport const jwt = {\r\n  /**\r\n   * Generate a new JWT token for the user.\r\n   * @param payload The payload to encode in the JWT token.\r\n   */\r\n  async generate(\r\n    payload: any,\r\n    {\r\n      key = getSecretKey(),\r\n      algorithm = getAlgorithm(),\r\n      ...options\r\n    }: SignerOptions & { key?: string } = {},\r\n  ): Promise<string> {\r\n    // Create a signer function with predefined options\r\n    const sign = createSigner({ key, ...options, algorithm });\r\n\r\n    const token = await sign({ ...payload, tokenType: ACCESS_TOKEN_TYPE });\r\n    return token;\r\n  },\r\n\r\n  /**\r\n   * Verify the given token.\r\n   * @param token The JWT token to verify.\r\n   * @returns The decoded token payload if verification is successful.\r\n   */\r\n  async verify<T = unknown>(\r\n    token: string,\r\n    {\r\n      key = getSecretKey(),\r\n      algorithms = [getAlgorithm()],\r\n      requiredClaims,\r\n      ...options\r\n    }: VerifierOptions & { key?: string } = {},\r\n  ): Promise<T> {\r\n    const verify = createVerifier({\r\n      key,\r\n      ...options,\r\n      algorithms,\r\n      requiredClaims: withRequiredClaims(requiredClaims),\r\n    });\r\n\r\n    const decoded = await verify(token as string);\r\n\r\n    assertTokenType(decoded, ACCESS_TOKEN_TYPE);\r\n\r\n    return decoded;\r\n  },\r\n\r\n  /**\r\n   * Generate a new refresh token for the user.\r\n   */\r\n  async generateRefreshToken(\r\n    payload: any,\r\n    {\r\n      key = getRefreshSecretKey(),\r\n      expiresIn,\r\n      algorithm = getAlgorithm(),\r\n      ...options\r\n    }: SignerOptions & { key?: string } = {},\r\n  ): Promise<string> {\r\n    const sign = createSigner({ key, expiresIn, algorithm, ...options });\r\n    return sign({ ...payload, tokenType: REFRESH_TOKEN_TYPE });\r\n  },\r\n\r\n  /**\r\n   * Verify the given refresh token.\r\n   */\r\n  async verifyRefreshToken<T = unknown>(\r\n    token: string,\r\n    {\r\n      key = getRefreshSecretKey(),\r\n      algorithms = [getAlgorithm()],\r\n      requiredClaims,\r\n      ...options\r\n    }: VerifierOptions & { key?: string } = {},\r\n  ): Promise<T> {\r\n    const verify = createVerifier({\r\n      key,\r\n      algorithms,\r\n      ...options,\r\n      requiredClaims: withRequiredClaims(requiredClaims),\r\n    });\r\n\r\n    const decoded = await verify(token);\r\n\r\n    assertTokenType(decoded, REFRESH_TOKEN_TYPE);\r\n\r\n    return decoded;\r\n  },\r\n};\r\n"],"mappings":";;;;AAGA,MAAM,qBAAqB,WAAW,YAAY,OAAO;AACzD,MAAM,qBAAqB,WAAW,YAAY,UAAU;AAI5D,MAAM,4BAA4B,WAAW,aAAa,OAAO,KAAK,aAAa;AAYnF,MAAM,oBAA+B;AACrC,MAAM,qBAAgC;;;;;AAMtC,SAAS,gBAAgB,SAAkB,UAA2B;CACpE,MAAM,SAAU,SAAwD;CAExE,IAAI,OAAO,WAAW,YAAY,WAAW,UAC3C,MAAM,IAAI,MAAM,iCAAiC,SAAS,eAAe,OAAO,GAAG;AAEvF;;;;;;;;;;;;;;;;;;AAmBA,MAAM,kBAAkB,CAAC,KAAK;;;;;AAM9B,SAAS,mBAAmB,cAAmC;CAC7D,IAAI,CAAC,cAAc,QAAQ,OAAO;CAElC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,cAAc,GAAG,eAAe,CAAC,CAAC;AAC3D;AAEA,MAAa,MAAM;;;;;CAKjB,MAAM,SACJ,SACA,EACE,MAAM,aAAa,GACnB,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAKjB,OAAO,MAHM,aAAa;GAAE;GAAK,GAAG;GAAS;EAAU,CAEhC,CAAC,CAAC;GAAE,GAAG;GAAS,WAAW;EAAkB,CAAC;CAEvE;;;;;;CAOA,MAAM,OACJ,OACA,EACE,MAAM,aAAa,GACnB,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA,GAAG;GACH;GACA,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAe;EAE5C,gBAAgB,SAAS,iBAAiB;EAE1C,OAAO;CACT;;;;CAKA,MAAM,qBACJ,SACA,EACE,MAAM,oBAAoB,GAC1B,WACA,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAEjB,OADa,aAAa;GAAE;GAAK;GAAW;GAAW,GAAG;EAAQ,CACxD,CAAC,CAAC;GAAE,GAAG;GAAS,WAAW;EAAmB,CAAC;CAC3D;;;;CAKA,MAAM,mBACJ,OACA,EACE,MAAM,oBAAoB,GAC1B,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA;GACA,GAAG;GACH,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAK;EAElC,gBAAgB,SAAS,kBAAkB;EAE3C,OAAO;CACT;AACF"}
+{"version":3,"file":"jwt.mjs","names":[],"sources":["../../../../../../../auth/src/services/jwt.ts"],"sourcesContent":["import { createSigner, createVerifier, type SignerOptions, type VerifierOptions } from \"fast-jwt\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\nimport { authConfig } from \"./auth-config\";\r\n\r\nconst getSecretKey = () => authConfig.accessToken.secret();\r\nconst getAlgorithm = () => authConfig.accessToken.algorithm();\r\n\r\n// Refresh tokens may declare their own secret; when unset/empty we fall back to\r\n// the access-token secret (the documented optional behavior).\r\nconst getRefreshSecretKey = () => authConfig.refreshToken.secret() || getSecretKey();\r\n\r\n/**\r\n * Token class. Stamped as the `tokenType` claim on every signed token and\r\n * checked on verify so an access token can never be accepted where a refresh\r\n * token is expected (and vice versa) — even when both share the same secret\r\n * under the documented refresh-secret fallback. Legacy tokens minted before\r\n * this claim existed carry no `tokenType` and remain accepted; a *mismatched*\r\n * type is always rejected.\r\n */\r\nexport type TokenType = \"access\" | \"refresh\";\r\n\r\nconst ACCESS_TOKEN_TYPE: TokenType = \"access\";\nconst REFRESH_TOKEN_TYPE: TokenType = \"refresh\";\n\n/**\n * Error codes that mean \"the credential itself is bad\", as opposed to \"this\n * server could not check it\". This is an ALLOWLIST and must stay one. The codes\n * deliberately left out — `FAST_JWT_INVALID_KEY`, `FAST_JWT_MISSING_KEY`,\n * `FAST_JWT_KEY_FETCHING_ERROR`, `FAST_JWT_INVALID_OPTION`,\n * `FAST_JWT_VERIFY_ERROR`, and `FAST_JWT_SIGN_ERROR` — describe a broken\n * server, not a broken token, and so does every unknown future code.\n */\nconst INVALID_CREDENTIAL_ERROR_CODES = new Set<string>([\n  \"FAST_JWT_MALFORMED\",\n  \"FAST_JWT_INVALID_SIGNATURE\",\n  \"FAST_JWT_MISSING_SIGNATURE\",\n  \"FAST_JWT_INVALID_ALGORITHM\",\n  \"FAST_JWT_EXPIRED\",\n  \"FAST_JWT_INACTIVE\",\n  // How a token carrying no `exp` is rejected — `jwt.verify` forces `exp` into\n  // `requiredClaims`, so this code IS the missing-deadline guard firing.\n  \"FAST_JWT_MISSING_REQUIRED_CLAIM\",\n  \"FAST_JWT_INVALID_CLAIM_VALUE\",\n  \"FAST_JWT_INVALID_CLAIM_TYPE\",\n  \"FAST_JWT_INVALID_CRIT_HEADER\",\n  \"FAST_JWT_INVALID_TYPE\",\n  \"FAST_JWT_INVALID_PAYLOAD\",\n  AuthErrorCodes.InvalidTokenType,\n]);\n\n/**\n * Only coded credential failures become authentication misses. Plain errors,\n * including missing-secret configuration failures, propagate to the central\n * server-error path instead of reading as \"everyone's token is bad\".\n */\nexport function isInvalidCredentialError(error: unknown): boolean {\n  const code = (error as { code?: unknown } | null | undefined)?.code;\n\n  return typeof code === \"string\" && INVALID_CREDENTIAL_ERROR_CODES.has(code);\n}\n\n/**\n * A `tokenType` claim that does not match what the caller expects. This IS a\n * bad credential (an access-token cookie can only hold a refresh token\r\n * through an app bug) — but unlike `fast-jwt`'s own rejections it was\r\n * previously a plain `Error`, unclassifiable by a caller that wants to answer\r\n * 401 without string-matching a message that could reword on any release.\r\n * `code` mirrors how `fast-jwt`'s `TokenError` carries its own code, so a\r\n * caller can classify both through `isInvalidCredentialError` above.\n */\nexport class TokenTypeError extends Error {\n  readonly code = AuthErrorCodes.InvalidTokenType;\r\n\r\n  constructor(expected: TokenType, actual: string) {\r\n    super(`Invalid token type: expected \"${expected}\", received \"${actual}\".`);\r\n    this.name = \"TokenTypeError\";\r\n  }\r\n}\r\n\r\n/**\r\n * Reject the token when its `tokenType` claim is present and does not match the\r\n * expected class. Absent claim ⇒ legacy token, accepted (backward compatible).\r\n */\r\nfunction assertTokenType(decoded: unknown, expected: TokenType): void {\r\n  const actual = (decoded as { tokenType?: unknown } | null | undefined)?.tokenType;\r\n\r\n  if (typeof actual === \"string\" && actual !== expected) {\r\n    throw new TokenTypeError(expected, actual);\r\n  }\r\n}\r\n\r\n/**\r\n * Claims no token may be missing, whatever the caller asks for.\r\n *\r\n * A JWT with no `exp` is not \"a token with a long life\" — it is a credential\r\n * with *no* life, because a verifier with no deadline to check simply succeeds,\r\n * forever (measured against `fast-jwt@6.2.4`: a token with no `exp` verifies\r\n * unchanged at `clockTimestamp` + 100 years). Nothing in this package can mint\r\n * one as of 4.12.0, but tokens minted by an earlier version are already in the\r\n * wild, so the rejection lives on the *verify* side where it catches a token\r\n * from any version, including one signed by a service this package never ran.\r\n *\r\n * There is no legitimate source to preserve: an app that wants a token that\r\n * effectively never expires sets `expiresIn: NO_EXPIRATION` (`\"100y\"`), which\r\n * mints a real `exp` roughly a century out (measured: `ms(\"100y\")` ⇒\r\n * `3155760000000`, `exp - iat` ⇒ `3155760000` seconds). \"No deadline\" and \"a\r\n * distant deadline\" are different things, and only the second one is asked for.\r\n */\r\nconst REQUIRED_CLAIMS = [\"exp\"];\r\n\r\n/**\r\n * Union the caller's `requiredClaims` with the mandatory ones — a caller may\r\n * add requirements, never drop them.\r\n */\r\nfunction withRequiredClaims(callerClaims?: string[]): string[] {\r\n  if (!callerClaims?.length) return REQUIRED_CLAIMS;\r\n\r\n  return [...new Set([...callerClaims, ...REQUIRED_CLAIMS])];\r\n}\r\n\r\nexport const jwt = {\r\n  /**\r\n   * Generate a new JWT token for the user.\r\n   * @param payload The payload to encode in the JWT token.\r\n   */\r\n  async generate(\r\n    payload: any,\r\n    {\r\n      key = getSecretKey(),\r\n      algorithm = getAlgorithm(),\r\n      ...options\r\n    }: SignerOptions & { key?: string } = {},\r\n  ): Promise<string> {\r\n    // Create a signer function with predefined options\r\n    const sign = createSigner({ key, ...options, algorithm });\r\n\r\n    const token = await sign({ ...payload, tokenType: ACCESS_TOKEN_TYPE });\r\n    return token;\r\n  },\r\n\r\n  /**\r\n   * Verify the given token.\r\n   * @param token The JWT token to verify.\r\n   * @returns The decoded token payload if verification is successful.\r\n   */\r\n  async verify<T = unknown>(\r\n    token: string,\r\n    {\r\n      key = getSecretKey(),\r\n      algorithms = [getAlgorithm()],\r\n      requiredClaims,\r\n      ...options\r\n    }: VerifierOptions & { key?: string } = {},\r\n  ): Promise<T> {\r\n    const verify = createVerifier({\r\n      key,\r\n      ...options,\r\n      algorithms,\r\n      requiredClaims: withRequiredClaims(requiredClaims),\r\n    });\r\n\r\n    const decoded = await verify(token as string);\r\n\r\n    assertTokenType(decoded, ACCESS_TOKEN_TYPE);\r\n\r\n    return decoded;\r\n  },\r\n\r\n  /**\r\n   * Generate a new refresh token for the user.\r\n   */\r\n  async generateRefreshToken(\r\n    payload: any,\r\n    {\r\n      key = getRefreshSecretKey(),\r\n      expiresIn,\r\n      algorithm = getAlgorithm(),\r\n      ...options\r\n    }: SignerOptions & { key?: string } = {},\r\n  ): Promise<string> {\r\n    const sign = createSigner({ key, expiresIn, algorithm, ...options });\r\n    return sign({ ...payload, tokenType: REFRESH_TOKEN_TYPE });\r\n  },\r\n\r\n  /**\r\n   * Verify the given refresh token.\r\n   */\r\n  async verifyRefreshToken<T = unknown>(\r\n    token: string,\r\n    {\r\n      key = getRefreshSecretKey(),\r\n      algorithms = [getAlgorithm()],\r\n      requiredClaims,\r\n      ...options\r\n    }: VerifierOptions & { key?: string } = {},\r\n  ): Promise<T> {\r\n    const verify = createVerifier({\r\n      key,\r\n      algorithms,\r\n      ...options,\r\n      requiredClaims: withRequiredClaims(requiredClaims),\r\n    });\r\n\r\n    const decoded = await verify(token);\r\n\r\n    assertTokenType(decoded, REFRESH_TOKEN_TYPE);\r\n\r\n    return decoded;\r\n  },\r\n};\r\n"],"mappings":";;;;;AAIA,MAAM,qBAAqB,WAAW,YAAY,OAAO;AACzD,MAAM,qBAAqB,WAAW,YAAY,UAAU;AAI5D,MAAM,4BAA4B,WAAW,aAAa,OAAO,KAAK,aAAa;AAYnF,MAAM,oBAA+B;AACrC,MAAM,qBAAgC;;;;;;;;;AAUtC,MAAM,iCAAiC,IAAI,IAAY;CACrD;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;;AAEF,CAAC;;;;;;AAOD,SAAgB,yBAAyB,OAAyB;CAChE,MAAM,OAAQ,OAAiD;CAE/D,OAAO,OAAO,SAAS,YAAY,+BAA+B,IAAI,IAAI;AAC5E;;;;;;;;;;AAWA,IAAa,iBAAb,cAAoC,MAAM;CAGxC,YAAY,UAAqB,QAAgB;EAC/C,MAAM,iCAAiC,SAAS,eAAe,OAAO,GAAG;;EACzE,KAAK,OAAO;CACd;AACF;;;;;AAMA,SAAS,gBAAgB,SAAkB,UAA2B;CACpE,MAAM,SAAU,SAAwD;CAExE,IAAI,OAAO,WAAW,YAAY,WAAW,UAC3C,MAAM,IAAI,eAAe,UAAU,MAAM;AAE7C;;;;;;;;;;;;;;;;;;AAmBA,MAAM,kBAAkB,CAAC,KAAK;;;;;AAM9B,SAAS,mBAAmB,cAAmC;CAC7D,IAAI,CAAC,cAAc,QAAQ,OAAO;CAElC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,cAAc,GAAG,eAAe,CAAC,CAAC;AAC3D;AAEA,MAAa,MAAM;;;;;CAKjB,MAAM,SACJ,SACA,EACE,MAAM,aAAa,GACnB,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAKjB,OAAO,MAHM,aAAa;GAAE;GAAK,GAAG;GAAS;EAAU,CAEhC,CAAC,CAAC;GAAE,GAAG;GAAS,WAAW;EAAkB,CAAC;CAEvE;;;;;;CAOA,MAAM,OACJ,OACA,EACE,MAAM,aAAa,GACnB,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA,GAAG;GACH;GACA,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAe;EAE5C,gBAAgB,SAAS,iBAAiB;EAE1C,OAAO;CACT;;;;CAKA,MAAM,qBACJ,SACA,EACE,MAAM,oBAAoB,GAC1B,WACA,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAEjB,OADa,aAAa;GAAE;GAAK;GAAW;GAAW,GAAG;EAAQ,CACxD,CAAC,CAAC;GAAE,GAAG;GAAS,WAAW;EAAmB,CAAC;CAC3D;;;;CAKA,MAAM,mBACJ,OACA,EACE,MAAM,oBAAoB,GAC1B,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA;GACA,GAAG;GACH,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAK;EAElC,gBAAgB,SAAS,kBAAkB;EAE3C,OAAO;CACT;AACF"}

package/esm/utils/auth-error-codes.d.mts

@@ -23,7 +23,17 @@ declare enum AuthErrorCodes {
    * EC004 = Too Many Attempts — issued by the login-throttle middleware once
    * a per-account or per-IP failure counter trips its threshold.
    */
-  TooManyAttempts = "EC004"
+  TooManyAttempts = "EC004",
+  // Error Code 004
+  /**
+   * Invalid Token Type Error Code EC005
+   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match
+   * what the caller expects (e.g. a refresh token presented where an access
+   * token is required, or vice versa). Carried on the `code` property of the
+   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can
+   * classify it as a credential failure without matching on the message.
+   */
+  InvalidTokenType = "EC005"
 }
 //#endregion
 export { AuthErrorCodes };

package/esm/utils/auth-error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;;;;;EAKA,YAAA;EAAA;;;;;;EAMA,eAAA;AAAA"}
+{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAoBgB;;;;EAfhB,YAAA;EAAA;;;;;;EAMA,eAAA;EAAA;;;;;;;;;EASA,gBAAA;AAAA"}

package/esm/utils/auth-error-codes.mjs

@@ -21,6 +21,15 @@ let AuthErrorCodes = /* @__PURE__ */ function(AuthErrorCodes) {
 	* a per-account or per-IP failure counter trips its threshold.
 	*/
 	AuthErrorCodes["TooManyAttempts"] = "EC004";
+	/**
+	* Invalid Token Type Error Code EC005
+	* EC005 = Invalid Token Type — the token's `tokenType` claim does not match
+	* what the caller expects (e.g. a refresh token presented where an access
+	* token is required, or vice versa). Carried on the `code` property of the
+	* `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can
+	* classify it as a credential failure without matching on the message.
+	*/
+	AuthErrorCodes["InvalidTokenType"] = "EC005";
 	return AuthErrorCodes;
 }({});
 

package/esm/utils/auth-error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;AACF"}
+{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;AACF"}

package/package.json

@@ -9,12 +9,12 @@
     "ms": "^2.1.3"
   },
   "peerDependencies": {
-    "@warlock.js/fs": "4.16.0",
-    "@warlock.js/cache": "4.16.0",
-    "@warlock.js/cascade": "4.16.0",
-    "@warlock.js/core": "4.16.0",
-    "@warlock.js/logger": "4.16.0",
-    "@warlock.js/seal": "4.16.0"
+    "@warlock.js/fs": "5.0.0",
+    "@warlock.js/cache": "5.0.0",
+    "@warlock.js/cascade": "5.0.0",
+    "@warlock.js/core": "5.0.0",
+    "@warlock.js/logger": "5.0.0",
+    "@warlock.js/seal": "5.0.0"
   },
   "repository": {
     "type": "git",
@@ -30,7 +30,7 @@
   ],
   "author": "hassanzohdy",
   "license": "MIT",
-  "version": "4.16.0",
+  "version": "5.0.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",