@warlock.js/auth 5.11.0 → 5.13.0

package/esm/models/one-time-token/index.d.mts

@@ -0,0 +1 @@
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";

package/esm/models/one-time-token/index.mjs

@@ -0,0 +1,3 @@
+import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+
+export {  };

package/esm/models/one-time-token/migration.mjs

@@ -0,0 +1,31 @@
+import { OneTimeToken } from "./one-time-token.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/one-time-token/migration.ts
+const OneTimeTokenMigration = migrate(OneTimeToken, {
+	name: "oneTimeToken",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.string("token_hash", 64).unique();
+		this.string("purpose", 32);
+		this.foreignId("user_id").nullable().index();
+		this.string("user_type", 50).nullable();
+		this.timestamp("expires_at").index().nullable();
+		this.timestamp("consumed_at").nullable();
+		this.integer("attempts").default(0);
+		this.index([
+			"user_id",
+			"user_type",
+			"purpose"
+		]);
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { OneTimeTokenMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/one-time-token/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { OneTimeToken } from \"./one-time-token.model\";\n\nexport const OneTimeTokenMigration = migrate(OneTimeToken, {\n  name: \"oneTimeToken\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    // SHA-256 hex digest of the raw token — the raw token is never stored.\n    this.string(\"token_hash\", 64).unique();\n    this.string(\"purpose\", 32);\n\n    // `foreignId` follows the DataSource's default primary-key type, matching\n    // the access/refresh token tables. Nullable only for a passkey\n    // authentication challenge, which is issued before anyone is identified.\n    this.foreignId(\"user_id\").nullable().index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"consumed_at\").nullable();\n\n    // Failed verify attempts — only OTP codes are capped on it.\n    this.integer(\"attempts\").default(0);\n\n    // Invalidating a user's previous reset tokens filters on these.\n    this.index([\"user_id\", \"user_type\", \"purpose\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAGjB,KAAK,OAAO,cAAc,EAAE,CAAC,CAAC,OAAO;EACrC,KAAK,OAAO,WAAW,EAAE;EAKzB,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;EAC3C,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,aAAa,CAAC,CAAC,SAAS;EAGvC,KAAK,QAAQ,UAAU,CAAC,CAAC,QAAQ,CAAC;EAGlC,KAAK,MAAM;GAAC;GAAW;GAAa;EAAS,CAAC;EAE9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/one-time-token/one-time-token.model.d.mts

@@ -0,0 +1,173 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/one-time-token/one-time-token.model.d.ts
+/** What a one-time token may be used for. A token only ever satisfies its own purpose. */
+type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
+/**
+ * Seal schema for the persisted one-time token. Exported so an override can
+ * extend it (e.g. a tenant key).
+ */
+declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+    isOptional: true;
+  };
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+    isOptional: true;
+  };
+  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+    isOptional: true;
+  };
+}>>;
+/**
+ * Persisted one-time secret: email-verification / password-reset token, OTP
+ * code, or passkey ceremony challenge.
+ *
+ * **Only a SHA-256 hash is stored** — the raw token exists in the notification
+ * and nowhere else, so a leaked table cannot be replayed. Single use is
+ * enforced by {@link consumeIfActive}, a conditional update in the same shape
+ * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
+ */
+declare class OneTimeToken extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
+      isOptional: true;
+    };
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
+    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
+      isOptional: true;
+    };
+    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
+      isOptional: true;
+    };
+  }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`, which would copy spent token hashes into
+   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must
+   * not survive anywhere.
+   */
+  static deleteStrategy: "permanent";
+  /** The user this token was issued for. */
+  get userId(): any;
+  /** The user-type slug this token was issued for. */
+  get userType(): string;
+  /** Whether the token has been used (or invalidated by a newer one). */
+  get isConsumed(): boolean;
+  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */
+  get isExpired(): boolean;
+  /**
+   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`
+   * for the single caller that won; every concurrent or later caller gets
+   * `false`.
+   */
+  consumeIfActive(): Promise<boolean>;
+  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */
+  static issue(user: Auth, purpose: OneTimeTokenPurpose, tokenHash: string, expiresAt: Date): Promise<OneTimeToken>;
+  /**
+   * Persist a passkey ceremony challenge. `user` is omitted for an
+   * authentication challenge, issued before anyone is identified.
+   */
+  static issueChallenge(purpose: OneTimeTokenPurpose, tokenHash: string, expiresAt: Date, user?: Auth): Promise<OneTimeToken>;
+  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */
+  static findActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<OneTimeToken | null>;
+  /**
+   * Atomically count one verify attempt, ONLY while fewer than `max` have been
+   * counted and the token is unconsumed. Resolves `false` once the cap is
+   * reached — of N concurrent attempts, at most `max` ever resolve `true`.
+   */
+  recordAttempt(max: number): Promise<boolean>;
+  /**
+   * Hard-delete every spent row — expired, or consumed (used, invalidated by a
+   * newer token, or exhausted). Neither can ever be redeemed again, so nothing
+   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI
+   * command (a cold batch path).
+   */
+  static purgeSpent(): Promise<number>;
+  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */
+  static findByHash(tokenHash: string, purpose: OneTimeTokenPurpose): Promise<OneTimeToken | null>;
+  /**
+   * Consume every still-unused token of `purpose` for the user, returning how
+   * many were invalidated. Used before issuing a new password-reset token.
+   */
+  static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number>;
+}
+//#endregion
+export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };
+//# sourceMappingURL=one-time-token.model.d.mts.map

package/esm/models/one-time-token/one-time-token.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;;SAWgB,cAAA;;MAGH,MAAA;;MAKA,QAAA;;MAKA,UAAA;;MAKA,SAAA;;;;;;EAaE,eAAA,IAAmB,OAAA;EAgBf;EAAA,OAJH,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;EAkBN;;;;EAAA,OADG,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;EAeL;EAAA,OADM,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;EAAA;;;;;EAYE,aAAA,CAAc,GAAA,WAAc,OAAA;EAqCtC;;;;;;EAAA,OAlBiB,UAAA,IAAc,OAAA;EA/HF;EAAA,OA8IlB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;EA9IG;;;;EAAA,OAsJA,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}

package/esm/models/one-time-token/one-time-token.model.mjs

@@ -0,0 +1,151 @@
+import { isUsableExpiry } from "../../utils/token-expiry.mjs";
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/one-time-token/one-time-token.model.ts
+/**
+* Seal schema for the persisted one-time token. Exported so an override can
+* extend it (e.g. a tenant key).
+*/
+const oneTimeTokenSchema = v.object({
+	token_hash: v.string().required(),
+	purpose: v.string().required(),
+	user_id: v.scalar().optional(),
+	user_type: v.string().optional(),
+	expires_at: v.date().required(),
+	consumed_at: v.date().optional(),
+	attempts: v.int().optional()
+});
+/**
+* Persisted one-time secret: email-verification / password-reset token, OTP
+* code, or passkey ceremony challenge.
+*
+* **Only a SHA-256 hash is stored** — the raw token exists in the notification
+* and nowhere else, so a leaked table cannot be replayed. Single use is
+* enforced by {@link consumeIfActive}, a conditional update in the same shape
+* as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
+*/
+var OneTimeToken = class extends Model {
+	static {
+		this.table = "one_time_tokens";
+	}
+	static {
+		this.schema = oneTimeTokenSchema;
+	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
+	/** The user this token was issued for. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The user-type slug this token was issued for. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/** Whether the token has been used (or invalidated by a newer one). */
+	get isConsumed() {
+		return !!this.get("consumed_at");
+	}
+	/** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */
+	get isExpired() {
+		const expiresAt = this.get("expires_at");
+		if (!isUsableExpiry(expiresAt)) return true;
+		return new Date(expiresAt).getTime() <= Date.now();
+	}
+	/**
+	* Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`
+	* for the single caller that won; every concurrent or later caller gets
+	* `false`.
+	*/
+	async consumeIfActive() {
+		return await this.constructor.atomic({
+			id: this.id,
+			consumed_at: null
+		}, { $set: { consumed_at: /* @__PURE__ */ new Date() } }) > 0;
+	}
+	/** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */
+	static issue(user, purpose, tokenHash, expiresAt) {
+		return this.create({
+			token_hash: tokenHash,
+			purpose,
+			user_id: user.id,
+			user_type: user.userType,
+			expires_at: expiresAt,
+			consumed_at: null,
+			attempts: 0
+		});
+	}
+	/**
+	* Persist a passkey ceremony challenge. `user` is omitted for an
+	* authentication challenge, issued before anyone is identified.
+	*/
+	static issueChallenge(purpose, tokenHash, expiresAt, user) {
+		return this.create({
+			token_hash: tokenHash,
+			purpose,
+			user_id: user?.id ?? null,
+			user_type: user?.userType ?? null,
+			expires_at: expiresAt,
+			consumed_at: null,
+			attempts: 0
+		});
+	}
+	/** The user's newest unconsumed token of `purpose` (at most one for OTP). */
+	static findActiveFor(user, purpose) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			purpose,
+			consumed_at: null
+		}).orderBy("created_at", "desc").first();
+	}
+	/**
+	* Atomically count one verify attempt, ONLY while fewer than `max` have been
+	* counted and the token is unconsumed. Resolves `false` once the cap is
+	* reached — of N concurrent attempts, at most `max` ever resolve `true`.
+	*/
+	async recordAttempt(max) {
+		return await this.constructor.atomic({
+			id: this.id,
+			consumed_at: null,
+			attempts: { $lt: max }
+		}, { $inc: { attempts: 1 } }, { trustedFilter: true }) > 0;
+	}
+	/**
+	* Hard-delete every spent row — expired, or consumed (used, invalidated by a
+	* newer token, or exhausted). Neither can ever be redeemed again, so nothing
+	* reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI
+	* command (a cold batch path).
+	*/
+	static async purgeSpent() {
+		const expired = await this.query().where("expires_at", "<", /* @__PURE__ */ new Date()).get();
+		const consumed = await this.query().whereNotNull("consumed_at").get();
+		const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));
+		for (const token of spent.values()) await token.destroy();
+		return spent.size;
+	}
+	/** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */
+	static findByHash(tokenHash, purpose) {
+		return this.first({
+			token_hash: tokenHash,
+			purpose
+		});
+	}
+	/**
+	* Consume every still-unused token of `purpose` for the user, returning how
+	* many were invalidated. Used before issuing a new password-reset token.
+	*/
+	static invalidateActiveFor(user, purpose) {
+		return this.atomic({
+			user_id: user.id,
+			user_type: user.userType,
+			purpose,
+			consumed_at: null
+		}, { $set: { consumed_at: /* @__PURE__ */ new Date() } });
+	}
+};
+
+//#endregion
+export { OneTimeToken, oneTimeTokenSchema };
+//# sourceMappingURL=one-time-token.model.mjs.map

package/esm/models/one-time-token/one-time-token.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport { isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/** What a one-time token may be used for. A token only ever satisfies its own purpose. */\nexport type OneTimeTokenPurpose =\n  | \"email-verification\"\n  | \"password-reset\"\n  | \"otp\"\n  | \"passkey-registration\"\n  | \"passkey-authentication\";\n\n/**\n * Seal schema for the persisted one-time token. Exported so an override can\n * extend it (e.g. a tenant key).\n */\nexport const oneTimeTokenSchema = v.object({\n  token_hash: v.string().required(),\n  purpose: v.string().required(),\n  // Absent only on a passkey authentication challenge (no user identified yet).\n  user_id: v.scalar().optional(),\n  user_type: v.string().optional(),\n  expires_at: v.date().required(),\n  consumed_at: v.date().optional(),\n  attempts: v.int().optional(),\n});\n\n/**\n * Persisted one-time secret: email-verification / password-reset token, OTP\n * code, or passkey ceremony challenge.\n *\n * **Only a SHA-256 hash is stored** — the raw token exists in the notification\n * and nowhere else, so a leaked table cannot be replayed. Single use is\n * enforced by {@link consumeIfActive}, a conditional update in the same shape\n * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.\n */\nexport class OneTimeToken extends Model {\n  public static table = \"one_time_tokens\";\n\n  public static schema = oneTimeTokenSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy spent token hashes into\n   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must\n   * not survive anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Whether the token has been used (or invalidated by a newer one). */\n  public get isConsumed(): boolean {\n    return !!this.get(\"consumed_at\");\n  }\n\n  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date(expiresAt).getTime() <= Date.now();\n  }\n\n  /**\n   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`\n   * for the single caller that won; every concurrent or later caller gets\n   * `false`.\n   */\n  public async consumeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const consumed = await modelClass.atomic(\n      { id: this.id, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n\n    return consumed > 0;\n  }\n\n  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */\n  public static issue(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user.id,\n      user_type: user.userType,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /**\n   * Persist a passkey ceremony challenge. `user` is omitted for an\n   * authentication challenge, issued before anyone is identified.\n   */\n  public static issueChallenge(\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n    user?: Auth,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user?.id ?? null,\n      user_type: user?.userType ?? null,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */\n  public static findActiveFor(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, purpose, consumed_at: null })\n      .orderBy(\"created_at\", \"desc\")\n      .first();\n  }\n\n  /**\n   * Atomically count one verify attempt, ONLY while fewer than `max` have been\n   * counted and the token is unconsumed. Resolves `false` once the cap is\n   * reached — of N concurrent attempts, at most `max` ever resolve `true`.\n   */\n  public async recordAttempt(max: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const counted = await modelClass.atomic(\n      { id: this.id, consumed_at: null, attempts: { $lt: max } },\n      { $inc: { attempts: 1 } },\n      // Code-authored filter; nothing here comes from the request.\n      { trustedFilter: true },\n    );\n\n    return counted > 0;\n  }\n\n  /**\n   * Hard-delete every spent row — expired, or consumed (used, invalidated by a\n   * newer token, or exhausted). Neither can ever be redeemed again, so nothing\n   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI\n   * command (a cold batch path).\n   */\n  public static async purgeSpent(): Promise<number> {\n    const expired = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n    const consumed = await this.query().whereNotNull(\"consumed_at\").get();\n    const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));\n\n    for (const token of spent.values()) {\n      // `static deleteStrategy` above already forces \"permanent\" regardless\n      // of the data source default (Mongo's is \"trash\").\n      await token.destroy();\n    }\n\n    return spent.size;\n  }\n\n  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */\n  public static findByHash(\n    tokenHash: string,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.first({ token_hash: tokenHash, purpose });\n  }\n\n  /**\n   * Consume every still-unused token of `purpose` for the user, returning how\n   * many were invalidated. Used before issuing a new password-reset token.\n   */\n  public static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number> {\n    return this.atomic(\n      { user_id: user.id, user_type: user.userType, purpose, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAE7B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;;;;AAWD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,IAAW,aAAsB;EAC/B,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa;CACjC;;CAGA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;CAOA,MAAa,kBAAoC;EAQ/C,OAAO,MAPY,KAAK,YAEU,OAChC;GAAE,IAAI,KAAK;GAAI,aAAa;EAAK,GACjC,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC,IAEkB;CACpB;;CAGA,OAAc,MACZ,MACA,SACA,WACA,WACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;;;;CAMA,OAAc,eACZ,SACA,WACA,WACA,MACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,MAAM,MAAM;GACrB,WAAW,MAAM,YAAY;GAC7B,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;CAGA,OAAc,cACZ,MACA,SAC8B;EAC9B,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,CAAC,CAAC,CACjF,QAAQ,cAAc,MAAM,CAAC,CAC7B,MAAM;CACX;;;;;;CAOA,MAAa,cAAc,KAA+B;EAUxD,OAAO,MATY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,aAAa;GAAM,UAAU,EAAE,KAAK,IAAI;EAAE,GACzD,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAExB,EAAE,eAAe,KAAK,CACxB,IAEiB;CACnB;;;;;;;CAQA,aAAoB,aAA8B;EAChD,MAAM,UAAU,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAC5E,MAAM,WAAW,MAAM,KAAK,MAAM,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,IAAI;EACpE,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;EAEzF,KAAK,MAAM,SAAS,MAAM,OAAO,GAG/B,MAAM,MAAM,QAAQ;EAGtB,OAAO,MAAM;CACf;;CAGA,OAAc,WACZ,WACA,SAC8B;EAC9B,OAAO,KAAK,MAAM;GAAE,YAAY;GAAW;EAAQ,CAAC;CACtD;;;;;CAMA,OAAc,oBAAoB,MAAY,SAA+C;EAC3F,OAAO,KAAK,OACV;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,GACzE,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC;CACF;AACF"}

package/esm/models/passkey-credential/index.d.mts

@@ -0,0 +1 @@
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";

package/esm/models/passkey-credential/index.mjs

@@ -0,0 +1,3 @@
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+
+export {  };

package/esm/models/passkey-credential/migration.mjs

@@ -0,0 +1,25 @@
+import { PasskeyCredential } from "./passkey-credential.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/passkey-credential/migration.ts
+const PasskeyCredentialMigration = migrate(PasskeyCredential, {
+	name: "passkeyCredential",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.text("credential_id").unique();
+		this.text("public_key");
+		this.bigInteger("counter").default(0);
+		this.json("transports").nullable();
+		this.foreignId("user_id").index();
+		this.string("user_type", 50).nullable();
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { PasskeyCredentialMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/passkey-credential/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { PasskeyCredential } from \"./passkey-credential.model\";\n\nexport const PasskeyCredentialMigration = migrate(PasskeyCredential, {\n  name: \"passkeyCredential\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.text(\"credential_id\").unique();\n    this.text(\"public_key\");\n    this.bigInteger(\"counter\").default(0);\n    this.json(\"transports\").nullable();\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,6BAA6B,QAAQ,mBAAmB;CACnE,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,KAAK,eAAe,CAAC,CAAC,OAAO;EAClC,KAAK,KAAK,YAAY;EACtB,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,CAAC;EACpC,KAAK,KAAK,YAAY,CAAC,CAAC,SAAS;EACjC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/passkey-credential/passkey-credential.model.d.mts

@@ -0,0 +1,108 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/passkey-credential/passkey-credential.model.d.ts
+/** Seal schema for a stored passkey. Exported so an override can extend it. */
+declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}>>;
+/**
+ * A registered WebAuthn credential. `credential_id` and `public_key` are
+ * base64url; `counter` is the last signature counter seen, which an
+ * authentication must advance (a clone detector).
+ */
+declare class PasskeyCredential extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`. No call site deletes a credential today, but the public key
+   * is credential material, so a future `destroy()` here must not leave a
+   * copy in `passkey_credentialsTrash`.
+   */
+  static deleteStrategy: "permanent";
+  /** base64url credential id. */
+  get credentialId(): string;
+  /** Last signature counter seen. */
+  get counter(): number;
+  /** The owner's id. */
+  get userId(): any;
+  /** The owner's type slug. */
+  get userType(): string;
+  /** Find a credential by its base64url id. */
+  static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null>;
+  /** Every credential the user registered. */
+  static listFor(user: Auth): Promise<PasskeyCredential[]>;
+  /**
+   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,
+   * so two concurrent assertions with the same counter cannot both succeed.
+   */
+  advanceCounter(expected: number, newCounter: number): Promise<boolean>;
+}
+//#endregion
+export { PasskeyCredential, passkeyCredentialSchema };
+//# sourceMappingURL=passkey-credential.model.d.mts.map

package/esm/models/passkey-credential/passkey-credential.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;;SAWgB,cAAA;EA4Bc;EAAA,IAzBjB,YAAA;EAyBwB;EAAA,IApBxB,OAAA;EAnB0B;EAAA,IAwB1B,MAAA;EAxB+B;EAAA,IA6B/B,QAAA;EA5BG;EAAA,OAiCA,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;EA/B5C;EAAA,OAoCN,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}

package/esm/models/passkey-credential/passkey-credential.model.mjs

@@ -0,0 +1,70 @@
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/passkey-credential/passkey-credential.model.ts
+/** Seal schema for a stored passkey. Exported so an override can extend it. */
+const passkeyCredentialSchema = v.object({
+	credential_id: v.string().required(),
+	public_key: v.string().required(),
+	counter: v.int().required(),
+	transports: v.array(v.string()).optional(),
+	user_id: v.scalar().required(),
+	user_type: v.string().required()
+});
+/**
+* A registered WebAuthn credential. `credential_id` and `public_key` are
+* base64url; `counter` is the last signature counter seen, which an
+* authentication must advance (a clone detector).
+*/
+var PasskeyCredential = class extends Model {
+	static {
+		this.table = "passkey_credentials";
+	}
+	static {
+		this.schema = passkeyCredentialSchema;
+	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
+	/** base64url credential id. */
+	get credentialId() {
+		return this.get("credential_id");
+	}
+	/** Last signature counter seen. */
+	get counter() {
+		return Number(this.get("counter") ?? 0);
+	}
+	/** The owner's id. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The owner's type slug. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/** Find a credential by its base64url id. */
+	static findByCredentialId(credentialId) {
+		return this.first({ credential_id: credentialId });
+	}
+	/** Every credential the user registered. */
+	static listFor(user) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType
+		}).get();
+	}
+	/**
+	* Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,
+	* so two concurrent assertions with the same counter cannot both succeed.
+	*/
+	async advanceCounter(expected, newCounter) {
+		return await this.constructor.atomic({
+			id: this.id,
+			counter: expected
+		}, { $set: { counter: newCounter } }) > 0;
+	}
+};
+
+//#endregion
+export { PasskeyCredential, passkeyCredentialSchema };
+//# sourceMappingURL=passkey-credential.model.mjs.map

package/esm/models/passkey-credential/passkey-credential.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a stored passkey. Exported so an override can extend it. */\nexport const passkeyCredentialSchema = v.object({\n  credential_id: v.string().required(),\n  public_key: v.string().required(),\n  counter: v.int().required(),\n  transports: v.array(v.string()).optional(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n});\n\n/**\n * A registered WebAuthn credential. `credential_id` and `public_key` are\n * base64url; `counter` is the last signature counter seen, which an\n * authentication must advance (a clone detector).\n */\nexport class PasskeyCredential extends Model {\n  public static table = \"passkey_credentials\";\n\n  public static schema = passkeyCredentialSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`. No call site deletes a credential today, but the public key\n   * is credential material, so a future `destroy()` here must not leave a\n   * copy in `passkey_credentialsTrash`.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** base64url credential id. */\n  public get credentialId(): string {\n    return this.get(\"credential_id\");\n  }\n\n  /** Last signature counter seen. */\n  public get counter(): number {\n    return Number(this.get(\"counter\") ?? 0);\n  }\n\n  /** The owner's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The owner's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find a credential by its base64url id. */\n  public static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null> {\n    return this.first({ credential_id: credentialId });\n  }\n\n  /** Every credential the user registered. */\n  public static listFor(user: Auth): Promise<PasskeyCredential[]> {\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\n  }\n\n  /**\n   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,\n   * so two concurrent assertions with the same counter cannot both succeed.\n   */\n  public async advanceCounter(expected: number, newCounter: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof PasskeyCredential;\n\n    const updated = await modelClass.atomic(\n      { id: this.id, counter: expected },\n      { $set: { counter: newCounter } },\n    );\n\n    return updated > 0;\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS;CAC1B,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;AAOD,IAAa,oBAAb,cAAuC,MAAM;;eACrB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,eAAuB;EAChC,OAAO,KAAK,IAAI,eAAe;CACjC;;CAGA,IAAW,UAAkB;EAC3B,OAAO,OAAO,KAAK,IAAI,SAAS,KAAK,CAAC;CACxC;;CAGA,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,mBAAmB,cAAyD;EACxF,OAAO,KAAK,MAAM,EAAE,eAAe,aAAa,CAAC;CACnD;;CAGA,OAAc,QAAQ,MAA0C;EAC9D,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;;CAMA,MAAa,eAAe,UAAkB,YAAsC;EAQlF,OAAO,MAPY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,SAAS;EAAS,GACjC,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,CAClC,IAEiB;CACnB;AACF"}

package/esm/models/provider-account/index.d.mts

@@ -0,0 +1 @@
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";

package/esm/models/provider-account/index.mjs

@@ -0,0 +1,3 @@
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+
+export {  };