@warlock.js/auth 5.11.0 → 5.13.0

package/esm/contracts/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport type { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport type { RefreshToken } from \"../models/refresh-token\";\r\n\r\n/**\r\n * Symbol to indicate no expiration for tokens\r\n * Use this when you explicitly want tokens to never expire\r\n *\r\n * @example\r\n * ```typescript\r\n * // src/config/auth.ts\r\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\r\n *\r\n * const authConfigurations: AuthConfigurations = {\r\n *   accessToken: {\r\n *     secret: env(\"JWT_SECRET\"),\r\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\r\n *   },\r\n * };\r\n *\r\n * export default authConfigurations;\r\n * ```\r\n */\r\nexport const NO_EXPIRATION = \"100y\";\r\n\r\n/**\r\n * Behavior when logout is called without a refresh token\r\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\r\n * - \"error\": Return an error requiring the refresh token\r\n */\r\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\r\n\r\n/** The single request credential source an auth middleware instance accepts. */\r\nexport type TokenFrom = \"header\" | `cookie:${string}`;\r\n\r\n/** Application policy that decides whether a resolved user may authenticate. */\r\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\r\n\r\n/** Password credentials plus the application-defined identity fields. */\r\nexport type AuthCredentials = Record<string, unknown> & {\r\n  password: string;\r\n};\r\n\r\n/**\r\n * Access-token configuration.\r\n *\r\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\r\n * backward-compatible shim); one of the two is required at runtime.\r\n */\r\nexport type AccessTokenConfig = {\r\n  /**\r\n   * Override the persisted access-token model — extend {@link AccessToken} to\r\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\r\n   * here. Defaults to the package's `AccessToken`.\r\n   */\r\n  model?: typeof AccessToken;\r\n  /**\r\n   * Secret used to sign access tokens.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * JWT algorithm.\r\n   * @default \"HS256\"\r\n   */\r\n  algorithm?: Algorithm;\r\n  /**\r\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\r\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\r\n   * first token issue: each of them would otherwise sign a token with no `exp`\r\n   * claim at all.\r\n   * @example \"1h\" or NO_EXPIRATION\r\n   * @default \"1h\"\r\n   */\r\n  expiresIn?: string;\r\n};\r\n\r\n/**\r\n * Refresh-token configuration.\r\n */\r\nexport type RefreshTokenConfig = {\r\n  /**\r\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\r\n   * Defaults to the package's `RefreshToken`.\r\n   */\r\n  model?: typeof RefreshToken;\r\n  /**\r\n   * Enable refresh tokens.\r\n   * @default true\r\n   */\r\n  enabled?: boolean;\r\n  /**\r\n   * Separate secret for refresh tokens (recommended for security). Falls back\r\n   * to the access-token secret when omitted.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds; an unusable value throws naming this key on issue\r\n   * (see {@link AccessTokenConfig.expiresIn}).\r\n   * @example \"7d\" or \"1w\"\r\n   * @default \"7d\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * Rotate the refresh token on each use (old token revoked, replay detected).\r\n   * @default true\r\n   */\r\n  rotation?: boolean;\r\n  /**\r\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\r\n   * @default 5\r\n   */\r\n  maxPerUser?: number;\r\n  /**\r\n   * Behavior when logout is called without a refresh token.\r\n   * @default \"revoke-all\"\r\n   */\r\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n};\r\n\r\n/**\r\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\r\n * deprecation warning.\r\n *\r\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\r\n */\r\nexport type LegacyJwtConfig = {\r\n  secret?: string;\r\n  algorithm?: Algorithm;\r\n  expiresIn?: string;\r\n  refresh?: {\r\n    secret?: string;\r\n    enabled?: boolean;\r\n    expiresIn?: string;\r\n    rotation?: boolean;\r\n    maxPerUser?: number;\r\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n  };\r\n};\r\n\r\n/**\r\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\r\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\r\n * to a login page instead of returning the API-style JSON 401.\r\n *\r\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\r\n * always keep the JSON 401 contract regardless of this setting.\r\n */\r\nexport type PageAuthConfig = {\r\n  /**\r\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\r\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\r\n   * behavior is opt-in and backward-compatible.\r\n   */\r\n  loginPath?: string;\r\n  /**\r\n   * Query parameter the redirect carries the originally-requested path in, so\r\n   * the login flow can send the user back where they were headed.\r\n   * @default \"returnUrl\"\r\n   */\r\n  returnUrlParam?: string;\r\n};\r\n\r\nexport type AuthConfigurations = {\r\n  /**\r\n   * Define all user types — maps a user-type slug to its `Auth` model class so\r\n   * tokens and the middleware can resolve the right model.\r\n   */\r\n  userType: {\r\n    [userType: string]: ChildModel<Auth>;\r\n  };\r\n  /**\r\n   * Decide whether a resolved user may authenticate or receive new tokens.\r\n   * @default () => true\r\n   */\r\n  canAuthenticate?: CanAuthenticate;\r\n  /**\r\n   * Access-token configuration (secret, expiry, algorithm, model override).\r\n   */\r\n  accessToken?: AccessTokenConfig;\r\n  /**\r\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\r\n   */\r\n  refreshToken?: RefreshTokenConfig;\r\n  /**\r\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\r\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\r\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\r\n   */\r\n  pageAuth?: PageAuthConfig;\r\n  /**\r\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\r\n   */\r\n  jwt?: LegacyJwtConfig;\r\n};\r\n\r\nexport type AccessTokenOutput = {\r\n  /**\r\n   * JWT Token\r\n   */\r\n  token: string;\r\n  /**\r\n   * Exprie time in ISO format UTC time\r\n   */\r\n  expiresAt: string;\r\n};\r\n\r\n/**\r\n * Token pair returned after login or token refresh\r\n */\r\nexport type TokenPair = {\r\n  /**\r\n   * JWT access token (short-lived)\r\n   */\r\n  accessToken: AccessTokenOutput;\r\n  /**\r\n   * JWT refresh token (long-lived)\r\n   */\r\n  refreshToken?: AccessTokenOutput;\r\n};\r\n\r\n/**\r\n * Device information for session tracking\r\n */\r\nexport type DeviceInfo = {\r\n  /**\r\n   * User agent string from request\r\n   */\r\n  userAgent?: string;\r\n  /**\r\n   * Client IP address\r\n   */\r\n  ip?: string;\r\n  /**\r\n   * Optional device identifier\r\n   */\r\n  deviceId?: string;\r\n  /**\r\n   * Token family ID (for rotation tracking)\r\n   * @internal\r\n   */\r\n  familyId?: string;\r\n  /**\r\n   * Access token payload\r\n   */\r\n  payload?: Record<string, unknown>;\r\n};\r\n\r\nexport type LoginResult<UserType extends Auth> = {\r\n  user: UserType;\r\n  tokens: TokenPair;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,MAAa,gBAAgB"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport type { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport type { OneTimeToken } from \"../models/one-time-token\";\r\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\r\nimport type { RefreshToken } from \"../models/refresh-token\";\r\n\r\n/**\r\n * Symbol to indicate no expiration for tokens\r\n * Use this when you explicitly want tokens to never expire\r\n *\r\n * @example\r\n * ```typescript\r\n * // src/config/auth.ts\r\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\r\n *\r\n * const authConfigurations: AuthConfigurations = {\r\n *   accessToken: {\r\n *     secret: env(\"JWT_SECRET\"),\r\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\r\n *   },\r\n * };\r\n *\r\n * export default authConfigurations;\r\n * ```\r\n */\r\nexport const NO_EXPIRATION = \"100y\";\r\n\r\n/**\r\n * Behavior when logout is called without a refresh token\r\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\r\n * - \"error\": Return an error requiring the refresh token\r\n */\r\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\r\n\r\n/** The single request credential source an auth middleware instance accepts. */\r\nexport type TokenFrom = \"header\" | `cookie:${string}`;\r\n\r\n/** Application policy that decides whether a resolved user may authenticate. */\r\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\r\n\r\n/** Password credentials plus the application-defined identity fields. */\r\nexport type AuthCredentials = Record<string, unknown> & {\r\n  password: string;\r\n};\r\n\r\n/**\r\n * Access-token configuration.\r\n *\r\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\r\n * backward-compatible shim); one of the two is required at runtime.\r\n */\r\nexport type AccessTokenConfig = {\r\n  /**\r\n   * Override the persisted access-token model — extend {@link AccessToken} to\r\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\r\n   * here. Defaults to the package's `AccessToken`.\r\n   */\r\n  model?: typeof AccessToken;\r\n  /**\r\n   * Secret used to sign access tokens.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * JWT algorithm.\r\n   * @default \"HS256\"\r\n   */\r\n  algorithm?: Algorithm;\r\n  /**\r\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\r\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\r\n   * first token issue: each of them would otherwise sign a token with no `exp`\r\n   * claim at all.\r\n   * @example \"1h\" or NO_EXPIRATION\r\n   * @default \"1h\"\r\n   */\r\n  expiresIn?: string;\r\n};\r\n\r\n/**\r\n * Refresh-token configuration.\r\n */\r\nexport type RefreshTokenConfig = {\r\n  /**\r\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\r\n   * Defaults to the package's `RefreshToken`.\r\n   */\r\n  model?: typeof RefreshToken;\r\n  /**\r\n   * Enable refresh tokens.\r\n   * @default true\r\n   */\r\n  enabled?: boolean;\r\n  /**\r\n   * Separate secret for refresh tokens (recommended for security). Falls back\r\n   * to the access-token secret when omitted.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds; an unusable value throws naming this key on issue\r\n   * (see {@link AccessTokenConfig.expiresIn}).\r\n   * @example \"7d\" or \"1w\"\r\n   * @default \"7d\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * Rotate the refresh token on each use (old token revoked, replay detected).\r\n   * @default true\r\n   */\r\n  rotation?: boolean;\r\n  /**\r\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\r\n   * @default 5\r\n   */\r\n  maxPerUser?: number;\r\n  /**\r\n   * Behavior when logout is called without a refresh token.\r\n   * @default \"revoke-all\"\r\n   */\r\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n};\r\n\r\n/**\r\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\r\n * deprecation warning.\r\n *\r\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\r\n */\r\nexport type LegacyJwtConfig = {\r\n  secret?: string;\r\n  algorithm?: Algorithm;\r\n  expiresIn?: string;\r\n  refresh?: {\r\n    secret?: string;\r\n    enabled?: boolean;\r\n    expiresIn?: string;\r\n    rotation?: boolean;\r\n    maxPerUser?: number;\r\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n  };\r\n};\r\n\r\n/**\r\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\r\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\r\n * to a login page instead of returning the API-style JSON 401.\r\n *\r\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\r\n * always keep the JSON 401 contract regardless of this setting.\r\n */\r\nexport type PageAuthConfig = {\r\n  /**\r\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\r\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\r\n   * behavior is opt-in and backward-compatible.\r\n   */\r\n  loginPath?: string;\r\n  /**\r\n   * Query parameter the redirect carries the originally-requested path in, so\r\n   * the login flow can send the user back where they were headed.\r\n   * @default \"returnUrl\"\r\n   */\r\n  returnUrlParam?: string;\r\n};\r\n\r\n/**\r\n * Data every email-verification / password-reset notification receives.\r\n */\r\nexport type OneTimeTokenNotificationData = {\r\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\r\n  token: string;\r\n  /** When the token stops working. */\r\n  expiresAt: Date;\r\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\r\n  url?: string;\r\n};\r\n\r\n/**\r\n * Anything auth can deliver a token through — a `defineNotification(...)`\r\n * result satisfies it, as does any object with a compatible `send`.\r\n */\r\nexport type AuthNotification = {\r\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\r\n};\r\n\r\n/** Builds the link a token notification points at. */\r\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\r\n\r\n/** Persists a new plaintext password for a user during a password reset. */\r\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\r\n\r\n/**\r\n * Email-verification configuration (`auth.verification`).\r\n */\r\nexport type EmailVerificationConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"24h\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute stamped with the verification `Date`. Declare it in the\r\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\r\n   * @default \"emailVerifiedAt\"\r\n   */\r\n  field?: string;\r\n  /** Replace the default verification email. */\r\n  notification?: AuthNotification;\r\n  /** Build the verification link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n};\r\n\r\n/**\r\n * Password-reset configuration (`auth.passwordReset`).\r\n */\r\nexport type PasswordResetConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"60m\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute `requestPasswordReset` looks the account up by.\r\n   * @default \"email\"\r\n   */\r\n  identifierField?: string;\r\n  /** Replace the default reset email. */\r\n  notification?: AuthNotification;\r\n  /** Build the reset link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n  /**\r\n   * Persist the new password yourself. By default auth saves a hash made by\r\n   * the same `hashPassword` login verifies against, and falls back to the\r\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\r\n   * the stored value with `verifyPassword` either way.\r\n   */\r\n  setPassword?: PasswordSetter;\r\n};\r\n\r\n/**\r\n * One-time token storage configuration (`auth.oneTimeToken`).\r\n */\r\nexport type OneTimeTokenConfig = {\r\n  /** Override the persisted model — extend {@link OneTimeToken}. */\r\n  model?: typeof OneTimeToken;\r\n};\r\n\r\nexport type AuthConfigurations = {\r\n  /**\r\n   * Define all user types — maps a user-type slug to its `Auth` model class so\r\n   * tokens and the middleware can resolve the right model.\r\n   */\r\n  userType: {\r\n    [userType: string]: ChildModel<Auth>;\r\n  };\r\n  /**\r\n   * Decide whether a resolved user may authenticate or receive new tokens.\r\n   * @default () => true\r\n   */\r\n  canAuthenticate?: CanAuthenticate;\r\n  /**\r\n   * Access-token configuration (secret, expiry, algorithm, model override).\r\n   */\r\n  accessToken?: AccessTokenConfig;\r\n  /**\r\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\r\n   */\r\n  refreshToken?: RefreshTokenConfig;\r\n  /**\r\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\r\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\r\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\r\n   */\r\n  pageAuth?: PageAuthConfig;\r\n  /**\r\n   * Cookie auth session config — read by `authService.setAuthCookie` /\r\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\r\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\r\n   */\r\n  cookie?: CookieAuthConfig;\r\n  /**\r\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\r\n   */\r\n  csrf?: CsrfConfig;\r\n  /**\r\n   * Email verification — token lifetime, verified field, notification override.\r\n   */\r\n  verification?: EmailVerificationConfig;\r\n  /**\r\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\r\n   */\r\n  passwordReset?: PasswordResetConfig;\r\n  /**\r\n   * One-time token (verification / reset) storage — model override.\r\n   */\r\n  oneTimeToken?: OneTimeTokenConfig;\r\n  /**\r\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\r\n   */\r\n  providers?: ProvidersConfig;\r\n  /**\r\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\r\n   */\r\n  passkeys?: PasskeysConfig;\r\n  /**\r\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\r\n   */\r\n  otp?: OtpConfig;\r\n  /**\r\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\r\n   */\r\n  jwt?: LegacyJwtConfig;\r\n};\r\n\r\nexport type AccessTokenOutput = {\r\n  /**\r\n   * JWT Token\r\n   */\r\n  token: string;\r\n  /**\r\n   * Exprie time in ISO format UTC time\r\n   */\r\n  expiresAt: string;\r\n};\r\n\r\n/**\r\n * Token pair returned after login or token refresh\r\n */\r\nexport type TokenPair = {\r\n  /**\r\n   * JWT access token (short-lived)\r\n   */\r\n  accessToken: AccessTokenOutput;\r\n  /**\r\n   * JWT refresh token (long-lived)\r\n   */\r\n  refreshToken?: AccessTokenOutput;\r\n};\r\n\r\n/**\r\n * Device information for session tracking\r\n */\r\nexport type DeviceInfo = {\r\n  /**\r\n   * User agent string from request\r\n   */\r\n  userAgent?: string;\r\n  /**\r\n   * Client IP address\r\n   */\r\n  ip?: string;\r\n  /**\r\n   * Optional device identifier\r\n   */\r\n  deviceId?: string;\r\n  /**\r\n   * Token family ID (for rotation tracking)\r\n   * @internal\r\n   */\r\n  familyId?: string;\r\n  /**\r\n   * Access token payload\r\n   */\r\n  payload?: Record<string, unknown>;\r\n};\r\n\r\nexport type LoginResult<UserType extends Auth> = {\r\n  user: UserType;\r\n  tokens: TokenPair;\r\n};\r\n\r\n/**\r\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\r\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\r\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\r\n * configurable here — they come from core's `secureCookieDefaults()`, the\r\n * same floor every `response.cookie()` call gets, so a cookie auth session can\r\n * never be weakened to a laxer policy than the framework default.\r\n */\r\nexport type CookieAuthConfig = {\r\n  /**\r\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\r\n   * `cookie:<name>` token source must match to read it back.\r\n   * @default \"access_token\"\r\n   */\r\n  name?: string;\r\n  /**\r\n   * Cookie `Path` attribute.\r\n   * @default \"/\"\r\n   */\r\n  path?: string;\r\n};\r\n\r\n/**\r\n * CSRF Origin-check configuration. Read via\r\n * `authConfig.csrf.allowedOrigins()`.\r\n */\r\nexport type CsrfConfig = {\r\n  /**\r\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n   * in addition to the request's own origin.\r\n   * @default []\r\n   */\r\n  allowedOrigins?: string[];\r\n};\r\n\r\n/**\r\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\r\n * falls back to `auth.cookie.*` config, then the package default. Cookie\r\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\r\n * see {@link CookieAuthConfig}.\r\n */\r\nexport type SetAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\r\n  path?: string;\r\n  /**\r\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\r\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\r\n   * bare token string with no `maxAge` produces a session cookie (cleared\r\n   * when the browser closes).\r\n   */\r\n  maxAge?: number;\r\n};\r\n\r\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\r\nexport type ClearAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\r\n  path?: string;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}

package/esm/errors/auth-provider-sdk-missing.error.d.mts

@@ -0,0 +1,17 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/auth-provider-sdk-missing.error.d.ts
+/**
+ * A login method needs a vendor SDK that is an optional peer of
+ * `@warlock.js/auth` and is not installed. The message names the package and
+ * the `warlock add` command that installs it; the resolver failure is kept on
+ * `cause`.
+ */
+declare class AuthProviderSdkMissingError extends ServerError {
+  readonly packageName: string;
+  readonly feature: string;
+  constructor(packageName: string, feature: string, cause?: unknown);
+}
+//#endregion
+export { AuthProviderSdkMissingError };
+//# sourceMappingURL=auth-provider-sdk-missing.error.d.mts.map

package/esm/errors/auth-provider-sdk-missing.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-sdk-missing.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/auth-provider-sdk-missing.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,2BAAA,SAAoC,WAAW;EAAA,SAExC,WAAA;EAAA,SACA,OAAA;cADA,WAAA,UACA,OAAA,UAChB,KAAA;AAAA"}

package/esm/errors/auth-provider-sdk-missing.error.mjs

@@ -0,0 +1,22 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/auth-provider-sdk-missing.error.ts
+/**
+* A login method needs a vendor SDK that is an optional peer of
+* `@warlock.js/auth` and is not installed. The message names the package and
+* the `warlock add` command that installs it; the resolver failure is kept on
+* `cause`.
+*/
+var AuthProviderSdkMissingError = class extends ServerError {
+	constructor(packageName, feature, cause) {
+		super(`@warlock.js/auth: this login method needs "${packageName}", which is not installed — run \`warlock add ${feature}\`.`);
+		this.packageName = packageName;
+		this.feature = feature;
+		this.name = "AuthProviderSdkMissingError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { AuthProviderSdkMissingError };
+//# sourceMappingURL=auth-provider-sdk-missing.error.mjs.map

package/esm/errors/auth-provider-sdk-missing.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider-sdk-missing.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/auth-provider-sdk-missing.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * A login method needs a vendor SDK that is an optional peer of\n * `@warlock.js/auth` and is not installed. The message names the package and\n * the `warlock add` command that installs it; the resolver failure is kept on\n * `cause`.\n */\nexport class AuthProviderSdkMissingError extends ServerError {\n  public constructor(\n    public readonly packageName: string,\n    public readonly feature: string,\n    cause?: unknown,\n  ) {\n    super(\n      `@warlock.js/auth: this login method needs \"${packageName}\", which is not installed — ` +\n        `run \\`warlock add ${feature}\\`.`,\n    );\n    this.name = \"AuthProviderSdkMissingError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,8BAAb,cAAiD,YAAY;CAC3D,AAAO,YACL,AAAgB,aAChB,AAAgB,SAChB,OACA;EACA,MACE,8CAA8C,YAAY,gDACnC,QAAQ,IACjC;EAPgB;EACA;EAOhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/email-not-verified.error.d.mts

@@ -0,0 +1,16 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/email-not-verified.error.d.ts
+/**
+ * The authenticated user has not verified their email address. Thrown by
+ * `requireVerifiedEmail()`; core's error handler answers it with `403` and a
+ * `payload.errorCode` of `EC007`.
+ */
+declare class EmailNotVerifiedError extends ForbiddenError {
+  readonly code = AuthErrorCodes.EmailNotVerified;
+  constructor(message?: string);
+}
+//#endregion
+export { EmailNotVerifiedError };
+//# sourceMappingURL=email-not-verified.error.d.mts.map

package/esm/errors/email-not-verified.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,qBAAA,SAA8B,cAAc;EAAA,SACvC,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,OAAA;AAAA"}

package/esm/errors/email-not-verified.error.mjs

@@ -0,0 +1,20 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/email-not-verified.error.ts
+/**
+* The authenticated user has not verified their email address. Thrown by
+* `requireVerifiedEmail()`; core's error handler answers it with `403` and a
+* `payload.errorCode` of `EC007`.
+*/
+var EmailNotVerifiedError = class extends ForbiddenError {
+	constructor(message = "Email address is not verified.") {
+		super(message, { errorCode: "EC007" });
+		this.code = "EC007";
+		this.name = "EmailNotVerifiedError";
+	}
+};
+
+//#endregion
+export { EmailNotVerifiedError };
+//# sourceMappingURL=email-not-verified.error.mjs.map

package/esm/errors/email-not-verified.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The authenticated user has not verified their email address. Thrown by\n * `requireVerifiedEmail()`; core's error handler answers it with `403` and a\n * `payload.errorCode` of `EC007`.\n */\nexport class EmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.EmailNotVerified;\n\n  public constructor(message = \"Email address is not verified.\") {\n    super(message, { errorCode: AuthErrorCodes.EmailNotVerified });\n    this.name = \"EmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,wBAAb,cAA2C,eAAe;CAGxD,AAAO,YAAY,UAAU,kCAAkC;EAC7D,MAAM,SAAS,EAAE,mBAA2C,CAAC;;EAC7D,KAAK,OAAO;CACd;AACF"}

package/esm/errors/index.d.mts

@@ -0,0 +1,7 @@
+import { AuthProviderSdkMissingError } from "./auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./provider-email-not-verified.error.mjs";

package/esm/errors/index.mjs

@@ -0,0 +1,9 @@
+import { AuthProviderSdkMissingError } from "./auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./provider-email-not-verified.error.mjs";
+
+export {  };

package/esm/errors/invalid-one-time-token.error.d.mts

@@ -0,0 +1,17 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-one-time-token.error.d.ts
+/**
+ * An email-verification or password-reset token was rejected: unknown, issued
+ * for the other purpose, expired, or already consumed (including losing a
+ * concurrent consumption race). Deliberately ONE error for all of them, so a
+ * caller cannot probe which case applies. Answers `400` with `EC008`.
+ */
+declare class InvalidOneTimeTokenError extends BadRequestError {
+  readonly code = AuthErrorCodes.InvalidOneTimeToken;
+  constructor(message?: string);
+}
+//#endregion
+export { InvalidOneTimeTokenError };
+//# sourceMappingURL=invalid-one-time-token.error.d.mts.map

package/esm/errors/invalid-one-time-token.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-one-time-token.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,wBAAA,SAAiC,eAAe;EAAA,SAC3C,IAAA,GAAI,cAAA,CAAA,mBAAA;cAED,OAAA;AAAA"}

package/esm/errors/invalid-one-time-token.error.mjs

@@ -0,0 +1,21 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-one-time-token.error.ts
+/**
+* An email-verification or password-reset token was rejected: unknown, issued
+* for the other purpose, expired, or already consumed (including losing a
+* concurrent consumption race). Deliberately ONE error for all of them, so a
+* caller cannot probe which case applies. Answers `400` with `EC008`.
+*/
+var InvalidOneTimeTokenError = class extends BadRequestError {
+	constructor(message = "Invalid or expired token.") {
+		super(message, { errorCode: "EC008" });
+		this.code = "EC008";
+		this.name = "InvalidOneTimeTokenError";
+	}
+};
+
+//#endregion
+export { InvalidOneTimeTokenError };
+//# sourceMappingURL=invalid-one-time-token.error.mjs.map

package/esm/errors/invalid-one-time-token.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-one-time-token.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * An email-verification or password-reset token was rejected: unknown, issued\n * for the other purpose, expired, or already consumed (including losing a\n * concurrent consumption race). Deliberately ONE error for all of them, so a\n * caller cannot probe which case applies. Answers `400` with `EC008`.\n */\nexport class InvalidOneTimeTokenError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidOneTimeToken;\n\n  public constructor(message = \"Invalid or expired token.\") {\n    super(message, { errorCode: AuthErrorCodes.InvalidOneTimeToken });\n    this.name = \"InvalidOneTimeTokenError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,2BAAb,cAA8C,gBAAgB;CAG5D,AAAO,YAAY,UAAU,6BAA6B;EACxD,MAAM,SAAS,EAAE,mBAA8C,CAAC;;EAChE,KAAK,OAAO;CACd;AACF"}

package/esm/errors/invalid-passkey.error.d.mts

@@ -0,0 +1,18 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-passkey.error.d.ts
+/**
+ * A passkey registration or authentication was rejected — unknown, expired
+ * or used challenge, unknown credential, failed verification, or a signature
+ * counter that did not advance. `reason` is for logs; the message stays
+ * generic. Answers `400` with `EC011`.
+ */
+declare class InvalidPasskeyError extends BadRequestError {
+  readonly reason: string;
+  readonly code = AuthErrorCodes.InvalidPasskey;
+  constructor(reason: string, cause?: unknown);
+}
+//#endregion
+export { InvalidPasskeyError };
+//# sourceMappingURL=invalid-passkey.error.d.mts.map

package/esm/errors/invalid-passkey.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-passkey.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,mBAAA,SAA4B,eAAe;EAAA,SAIpC,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,cAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-passkey.error.mjs

@@ -0,0 +1,23 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-passkey.error.ts
+/**
+* A passkey registration or authentication was rejected — unknown, expired
+* or used challenge, unknown credential, failed verification, or a signature
+* counter that did not advance. `reason` is for logs; the message stays
+* generic. Answers `400` with `EC011`.
+*/
+var InvalidPasskeyError = class extends BadRequestError {
+	constructor(reason, cause) {
+		super("Passkey verification failed.", { errorCode: "EC011" });
+		this.reason = reason;
+		this.code = "EC011";
+		this.name = "InvalidPasskeyError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { InvalidPasskeyError };
+//# sourceMappingURL=invalid-passkey.error.mjs.map

package/esm/errors/invalid-passkey.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-passkey.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A passkey registration or authentication was rejected — unknown, expired\n * or used challenge, unknown credential, failed verification, or a signature\n * counter that did not advance. `reason` is for logs; the message stays\n * generic. Answers `400` with `EC011`.\n */\nexport class InvalidPasskeyError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidPasskey;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Passkey verification failed.\", { errorCode: AuthErrorCodes.InvalidPasskey });\n    this.name = \"InvalidPasskeyError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,sBAAb,cAAyC,gBAAgB;CAGvD,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,gCAAgC,EAAE,mBAAyC,CAAC;EAHlE;;EAIhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/invalid-provider-callback.error.d.mts

@@ -0,0 +1,18 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-provider-callback.error.d.ts
+/**
+ * A redirect-provider callback was rejected — missing, forged or expired
+ * state cookie, `state` mismatch, failed code exchange, or an id_token with a
+ * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;
+ * the response message stays generic. Answers `400` with `EC009`.
+ */
+declare class InvalidProviderCallbackError extends BadRequestError {
+  readonly reason: string;
+  readonly code = AuthErrorCodes.InvalidProviderCallback;
+  constructor(reason: string, cause?: unknown);
+}
+//#endregion
+export { InvalidProviderCallbackError };
+//# sourceMappingURL=invalid-provider-callback.error.d.mts.map

package/esm/errors/invalid-provider-callback.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-provider-callback.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,4BAAA,SAAqC,eAAe;EAAA,SAI7C,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,uBAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-provider-callback.error.mjs

@@ -0,0 +1,23 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-provider-callback.error.ts
+/**
+* A redirect-provider callback was rejected — missing, forged or expired
+* state cookie, `state` mismatch, failed code exchange, or an id_token with a
+* bad signature, issuer, audience, expiry or nonce. `reason` is for logs;
+* the response message stays generic. Answers `400` with `EC009`.
+*/
+var InvalidProviderCallbackError = class extends BadRequestError {
+	constructor(reason, cause) {
+		super("Login with the provider failed.", { errorCode: "EC009" });
+		this.reason = reason;
+		this.code = "EC009";
+		this.name = "InvalidProviderCallbackError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { InvalidProviderCallbackError };
+//# sourceMappingURL=invalid-provider-callback.error.mjs.map

package/esm/errors/invalid-provider-callback.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-provider-callback.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A redirect-provider callback was rejected — missing, forged or expired\n * state cookie, `state` mismatch, failed code exchange, or an id_token with a\n * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;\n * the response message stays generic. Answers `400` with `EC009`.\n */\nexport class InvalidProviderCallbackError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidProviderCallback;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Login with the provider failed.\", {\n      errorCode: AuthErrorCodes.InvalidProviderCallback,\n    });\n    this.name = \"InvalidProviderCallbackError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,+BAAb,cAAkD,gBAAgB;CAGhE,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,mCAAmC,EACvC,mBACF,CAAC;EALe;;EAMhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/notifications-unavailable.error.d.mts

@@ -0,0 +1,15 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/notifications-unavailable.error.d.ts
+/**
+ * Email verification / password reset could not send its notification because
+ * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE
+ * any token is issued — auth never issues a token it cannot deliver, and never
+ * skips the send silently. The original failure is kept on `cause`.
+ */
+declare class NotificationsUnavailableError extends ServerError {
+  constructor(reason: "not-installed" | "not-configured", cause?: unknown);
+}
+//#endregion
+export { NotificationsUnavailableError };
+//# sourceMappingURL=notifications-unavailable.error.d.mts.map

package/esm/errors/notifications-unavailable.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-unavailable.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,6BAAA,SAAsC,WAAW;cACzC,MAAA,sCAA4C,KAAA;AAAA"}

package/esm/errors/notifications-unavailable.error.mjs

@@ -0,0 +1,20 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/notifications-unavailable.error.ts
+/**
+* Email verification / password reset could not send its notification because
+* `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE
+* any token is issued — auth never issues a token it cannot deliver, and never
+* skips the send silently. The original failure is kept on `cause`.
+*/
+var NotificationsUnavailableError = class extends ServerError {
+	constructor(reason, cause) {
+		super(reason === "not-installed" ? "@warlock.js/auth: email verification and password reset send through @warlock.js/notifications, which is not installed — add it to the app's dependencies." : "@warlock.js/auth: email verification and password reset send through @warlock.js/notifications, which is not configured — add `src/config/notifications.ts` with a `mail` channel.");
+		this.name = "NotificationsUnavailableError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { NotificationsUnavailableError };
+//# sourceMappingURL=notifications-unavailable.error.mjs.map

package/esm/errors/notifications-unavailable.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-unavailable.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * Email verification / password reset could not send its notification because\n * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE\n * any token is issued — auth never issues a token it cannot deliver, and never\n * skips the send silently. The original failure is kept on `cause`.\n */\nexport class NotificationsUnavailableError extends ServerError {\n  public constructor(reason: \"not-installed\" | \"not-configured\", cause?: unknown) {\n    super(\n      reason === \"not-installed\"\n        ? \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not installed — add it to the app's dependencies.\"\n        : \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not configured — add `src/config/notifications.ts` \" +\n            \"with a `mail` channel.\",\n    );\n    this.name = \"NotificationsUnavailableError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,YAAY;CAC7D,AAAO,YAAY,QAA4C,OAAiB;EAC9E,MACE,WAAW,kBACP,+JAEA,oLAGN;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/provider-email-not-verified.error.d.mts

@@ -0,0 +1,16 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/provider-email-not-verified.error.d.ts
+/**
+ * The provider did not verify the email on a profile with no existing link,
+ * so auth refused to link it to (or create) an account. Answers `403` with
+ * `EC010`.
+ */
+declare class ProviderEmailNotVerifiedError extends ForbiddenError {
+  readonly code = AuthErrorCodes.ProviderEmailNotVerified;
+  constructor(message?: string);
+}
+//#endregion
+export { ProviderEmailNotVerifiedError };
+//# sourceMappingURL=provider-email-not-verified.error.d.mts.map

package/esm/errors/provider-email-not-verified.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,6BAAA,SAAsC,cAAc;EAAA,SAC/C,IAAA,GAAI,cAAA,CAAA,wBAAA;cAED,OAAA;AAAA"}

package/esm/errors/provider-email-not-verified.error.mjs

@@ -0,0 +1,20 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/provider-email-not-verified.error.ts
+/**
+* The provider did not verify the email on a profile with no existing link,
+* so auth refused to link it to (or create) an account. Answers `403` with
+* `EC010`.
+*/
+var ProviderEmailNotVerifiedError = class extends ForbiddenError {
+	constructor(message = "The provider has not verified this email address.") {
+		super(message, { errorCode: "EC010" });
+		this.code = "EC010";
+		this.name = "ProviderEmailNotVerifiedError";
+	}
+};
+
+//#endregion
+export { ProviderEmailNotVerifiedError };
+//# sourceMappingURL=provider-email-not-verified.error.mjs.map

package/esm/errors/provider-email-not-verified.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The provider did not verify the email on a profile with no existing link,\n * so auth refused to link it to (or create) an account. Answers `403` with\n * `EC010`.\n */\nexport class ProviderEmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.ProviderEmailNotVerified;\n\n  public constructor(message = \"The provider has not verified this email address.\") {\n    super(message, { errorCode: AuthErrorCodes.ProviderEmailNotVerified });\n    this.name = \"ProviderEmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,eAAe;CAGhE,AAAO,YAAY,UAAU,qDAAqD;EAChF,MAAM,SAAS,EAAE,mBAAmD,CAAC;;EACrE,KAAK,OAAO;CACd;AACF"}

package/esm/index.d.mts

@@ -3,16 +3,44 @@ import { registerAuthPurgeNeverExpiringCommand } from "./commands/auth-purge-nev
 import { registerJWTSecretGeneratorCommand } from "./commands/jwt-secret-generator-command.mjs";
 import { Auth } from "./models/auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
-import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, CanAuthenticate, DeviceInfo, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshTokenConfig, TokenFrom, TokenPair } from "./contracts/types.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
+import { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig } from "./contracts/providers.mjs";
+import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "./contracts/auth-contract.mjs";
+import { RequestUser } from "./contracts/request-locals.mjs";
+import { AuthProviderSdkMissingError } from "./errors/auth-provider-sdk-missing.error.mjs";
+import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
+import { EmailNotVerifiedError } from "./errors/email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./errors/invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./errors/invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./errors/invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./errors/notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verified.error.mjs";
 import { authMiddleware } from "./middleware/auth.middleware.mjs";
+import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./models/passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./models/provider-account/provider-account.model.mjs";
 import { authMigrations } from "./models/index.mjs";
+import { requestOtp, verifyOtp } from "./otp/otp.mjs";
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./passkeys/simplewebauthn.mjs";
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkeys/passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./providers/google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./services/auth-events.mjs";
 import { authService } from "./services/auth.service.mjs";
+import { currentUser } from "./services/current-user.mjs";
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
-import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
 import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./services/jwt.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./services/email-verification.mjs";
+import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./services/one-time-tokens.mjs";
+import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
+import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { AccessToken, AccessTokenConfig, AccessTokenOutput, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, Authenticable, CanAuthenticate, DeviceInfo, LegacyJwtConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, accessTokenSchema, authEvents, authMiddleware, authMigrations, authService, generateJWTSecret, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, jwt, loginThrottleMiddleware, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, tokenHasExpClaim };
+export { AccessToken, AccessTokenConfig, AccessTokenOutput, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthNotification, AuthProvider, AuthProviderSdkMissingError, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, EmailNotVerifiedError, EmailVerificationConfig, GOOGLE_AUTH_FEATURE, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LegacyJwtConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
+import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -1,5 +1,6 @@
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
+import { OneTimeToken, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
 import { RefreshToken, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { authEvents } from "./services/auth-events.mjs";
 import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
@@ -10,12 +11,39 @@ import { registerAuthPurgeNeverExpiringCommand } from "./commands/auth-purge-nev
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
 import { registerJWTSecretGeneratorCommand } from "./commands/jwt-secret-generator-command.mjs";
 import { NO_EXPIRATION } from "./contracts/types.mjs";
+import { AuthProviderSdkMissingError } from "./errors/auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./errors/email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./errors/invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./errors/invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./errors/invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./errors/notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verified.error.mjs";
+import "./errors/index.mjs";
+import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { authMiddleware } from "./middleware/auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
 import "./middleware/index.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./models/passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./models/provider-account/provider-account.model.mjs";
+import { currentUser } from "./services/current-user.mjs";
+import { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./services/one-time-tokens.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./services/email-verification.mjs";
+import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
 import "./services/index.mjs";
 import { Auth } from "./models/auth.model.mjs";
 import { authMigrations } from "./models/index.mjs";
+import { safeEqual } from "./utils/safe-equal.mjs";
+import { requestOtp, verifyOtp } from "./otp/otp.mjs";
+import "./otp/index.mjs";
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkeys/passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
+import "./passkeys/index.mjs";
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./providers/google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
+import "./providers/index.mjs";
 import "./utils/index.mjs";
 
-export { AccessToken, Auth, AuthErrorCodes, NO_EXPIRATION, RefreshToken, TokenTypeError, accessTokenSchema, authEvents, authMiddleware, authMigrations, authService, generateJWTSecret, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, jwt, loginThrottleMiddleware, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, tokenHasExpClaim };
+export { AccessToken, Auth, AuthErrorCodes, AuthProviderSdkMissingError, CsrfOriginMismatchError, EmailNotVerifiedError, GOOGLE_AUTH_FEATURE, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/middleware/auth.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAwGA;;;;;;;;;AAGa;;;;;;;;;;iBAHG,cAAA,CACd,eAAA,qBACA,SAAA,GAAW,SAAA,GACV,UAAU"}
+{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AA6GA;;;;;;;;;AAGa;;;;;;;;;;iBAHG,cAAA,CACd,eAAA,qBACA,SAAA,GAAW,SAAA,GACV,UAAU"}

package/esm/middleware/auth.middleware.mjs

@@ -4,6 +4,7 @@ import { authConfig } from "../services/auth-config.mjs";
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { isInvalidCredentialError, jwt } from "../services/jwt.mjs";
 import { authService } from "../services/auth.service.mjs";
+import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
 import { config, t } from "@warlock.js/core";
 import { log } from "@warlock.js/logger";
 
@@ -90,13 +91,23 @@ function authMiddleware(allowedUserType, tokenFrom = "header") {
 			error: t("auth.errors.missingAccessToken"),
 			errorCode: "EC001"
 		});
+		if (requiresCsrfOriginCheck(tokenFrom, request.method)) try {
+			assertCsrfOriginAllowed(request);
+		} catch (error) {
+			if (!(error instanceof CsrfOriginMismatchError)) throw error;
+			log.error("http", "auth", error);
+			return response.forbidden({
+				error: t("auth.errors.csrfOriginMismatch"),
+				errorCode: "EC006"
+			});
+		}
 		let decoded;
 		try {
 			decoded = await jwt.verify(authorizationValue);
 		} catch (error) {
 			if (!isInvalidCredentialError(error)) throw error;
 			log.error("http", "auth", error);
-			request.clearCurrentUser();
+			request.locals.user = void 0;
 			return rejectUnauthorized({
 				request,
 				response
@@ -152,7 +163,7 @@ function authMiddleware(allowedUserType, tokenFrom = "header") {
 			error: t("auth.errors.unauthorized"),
 			errorCode: "EC003"
 		});
-		request.user = currentUser;
+		request.locals.user = currentUser;
 	};
 	return auth;
 }