@warlock.js/auth 5.11.0 → 5.13.0

package/esm/services/token-notifications.mjs

@@ -0,0 +1,87 @@
+import { authConfig } from "./auth-config.mjs";
+import { NotificationsUnavailableError } from "../errors/notifications-unavailable.error.mjs";
+
+//#region ../auth/src/services/token-notifications.ts
+/** Non-literal on purpose: keeps type-checkers and bundlers from requiring the optional peer. */
+const NOTIFICATIONS_PACKAGE = "@warlock.js/notifications";
+const defaults = /* @__PURE__ */ new Map();
+/**
+* Whether `error` (or an error it wraps as `cause`, as some loaders do) is the
+* resolver saying the notifications package itself is absent. A missing
+* TRANSITIVE dependency names a different package and is rethrown untouched.
+*/
+function isPackageMissing(error) {
+	for (let current = error, depth = 0; current && depth < 5; depth++) {
+		const { code, message } = current;
+		if ((code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") && typeof message === "string" && message.includes(`'${NOTIFICATIONS_PACKAGE}'`)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+async function loadNotifications() {
+	let notifications;
+	try {
+		notifications = await import(NOTIFICATIONS_PACKAGE);
+	} catch (error) {
+		if (isPackageMissing(error)) throw new NotificationsUnavailableError("not-installed", error);
+		throw error;
+	}
+	try {
+		notifications.getNotificationConfig();
+	} catch (error) {
+		throw new NotificationsUnavailableError("not-configured", error);
+	}
+	return notifications;
+}
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function mailBody(intro, data) {
+	const action = data.url ?? data.token;
+	const expires = data.expiresAt.toISOString();
+	return {
+		html: `<p>${intro}</p>` + (data.url ? `<p><a href="${escapeHtml(data.url)}">${escapeHtml(data.url)}</a></p>` : `<p><code>${escapeHtml(data.token)}</code></p>`) + `<p>This link expires at ${expires}. If you did not request it, ignore this email.</p>`,
+		text: `${intro}\n\n${action}\n\nThis link expires at ${expires}. If you did not request it, ignore this email.`
+	};
+}
+function defineDefault(notifications, type) {
+	if (type === "email-verification") return notifications.defineNotification({
+		type: "auth.email-verification",
+		via: ["mail"],
+		mail: (data) => ({
+			subject: "Verify your email address",
+			...mailBody("Confirm your email address to finish setting up your account.", data)
+		})
+	});
+	return notifications.defineNotification({
+		type: "auth.password-reset",
+		via: ["mail"],
+		mail: (data) => ({
+			subject: "Reset your password",
+			...mailBody("Use this to choose a new password.", data)
+		})
+	});
+}
+/**
+* Resolve the notification a token of `type` is delivered through — the app's
+* configured override, else auth's default mail notification.
+*
+* Always confirms `@warlock.js/notifications` is installed AND configured
+* first, even when an override is set, so an app can never issue a token that
+* silently goes nowhere. Throws {@link NotificationsUnavailableError}.
+*/
+async function resolveTokenNotification(type) {
+	const notifications = await loadNotifications();
+	const override = type === "email-verification" ? authConfig.verification.notification() : authConfig.passwordReset.notification();
+	if (override) return override;
+	let notification = defaults.get(type);
+	if (!notification) {
+		notification = defineDefault(notifications, type);
+		defaults.set(type, notification);
+	}
+	return notification;
+}
+
+//#endregion
+export { resolveTokenNotification };
+//# sourceMappingURL=token-notifications.mjs.map

package/esm/services/token-notifications.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-notifications.mjs","names":[],"sources":["../../../../../../../auth/src/services/token-notifications.ts"],"sourcesContent":["import type { AuthNotification, OneTimeTokenNotificationData } from \"../contracts/types\";\nimport { NotificationsUnavailableError } from \"../errors/notifications-unavailable.error\";\nimport { authConfig } from \"./auth-config\";\n\n/** Which token notification to resolve. */\nexport type TokenNotificationType = \"email-verification\" | \"password-reset\";\n\n/**\n * The slice of `@warlock.js/notifications` auth uses. Declared locally because\n * the package is an OPTIONAL peer: auth must type-check and load without it.\n */\ntype NotificationsModule = {\n  getNotificationConfig: () => unknown;\n  defineNotification: (definition: {\n    type: string;\n    via: string[];\n    mail: (data: OneTimeTokenNotificationData) => { subject: string; html: string; text: string };\n  }) => AuthNotification;\n};\n\n/** Non-literal on purpose: keeps type-checkers and bundlers from requiring the optional peer. */\nconst NOTIFICATIONS_PACKAGE: string = \"@warlock.js/notifications\";\n\nconst defaults = new Map<TokenNotificationType, AuthNotification>();\n\n/**\n * Whether `error` (or an error it wraps as `cause`, as some loaders do) is the\n * resolver saying the notifications package itself is absent. A missing\n * TRANSITIVE dependency names a different package and is rethrown untouched.\n */\nfunction isPackageMissing(error: unknown): boolean {\n  for (let current = error, depth = 0; current && depth < 5; depth++) {\n    const { code, message } = current as { code?: unknown; message?: unknown };\n\n    if (\n      (code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\") &&\n      typeof message === \"string\" &&\n      message.includes(`'${NOTIFICATIONS_PACKAGE}'`)\n    ) {\n      return true;\n    }\n\n    current = (current as { cause?: unknown }).cause;\n  }\n\n  return false;\n}\n\nasync function loadNotifications(): Promise<NotificationsModule> {\n  let notifications: NotificationsModule;\n\n  try {\n    notifications = (await import(NOTIFICATIONS_PACKAGE)) as NotificationsModule;\n  } catch (error) {\n    if (isPackageMissing(error)) {\n      throw new NotificationsUnavailableError(\"not-installed\", error);\n    }\n\n    throw error;\n  }\n\n  try {\n    notifications.getNotificationConfig();\n  } catch (error) {\n    throw new NotificationsUnavailableError(\"not-configured\", error);\n  }\n\n  return notifications;\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction mailBody(intro: string, data: OneTimeTokenNotificationData) {\n  const action = data.url ?? data.token;\n  const expires = data.expiresAt.toISOString();\n\n  return {\n    html:\n      `<p>${intro}</p>` +\n      (data.url\n        ? `<p><a href=\"${escapeHtml(data.url)}\">${escapeHtml(data.url)}</a></p>`\n        : `<p><code>${escapeHtml(data.token)}</code></p>`) +\n      `<p>This link expires at ${expires}. If you did not request it, ignore this email.</p>`,\n    text: `${intro}\\n\\n${action}\\n\\nThis link expires at ${expires}. If you did not request it, ignore this email.`,\n  };\n}\n\nfunction defineDefault(\n  notifications: NotificationsModule,\n  type: TokenNotificationType,\n): AuthNotification {\n  if (type === \"email-verification\") {\n    return notifications.defineNotification({\n      type: \"auth.email-verification\",\n      via: [\"mail\"],\n      mail: (data) => ({\n        subject: \"Verify your email address\",\n        ...mailBody(\"Confirm your email address to finish setting up your account.\", data),\n      }),\n    });\n  }\n\n  return notifications.defineNotification({\n    type: \"auth.password-reset\",\n    via: [\"mail\"],\n    mail: (data) => ({\n      subject: \"Reset your password\",\n      ...mailBody(\"Use this to choose a new password.\", data),\n    }),\n  });\n}\n\n/**\n * Resolve the notification a token of `type` is delivered through — the app's\n * configured override, else auth's default mail notification.\n *\n * Always confirms `@warlock.js/notifications` is installed AND configured\n * first, even when an override is set, so an app can never issue a token that\n * silently goes nowhere. Throws {@link NotificationsUnavailableError}.\n */\nexport async function resolveTokenNotification(\n  type: TokenNotificationType,\n): Promise<AuthNotification> {\n  const notifications = await loadNotifications();\n\n  const override =\n    type === \"email-verification\"\n      ? authConfig.verification.notification()\n      : authConfig.passwordReset.notification();\n\n  if (override) return override;\n\n  let notification = defaults.get(type);\n\n  if (!notification) {\n    notification = defineDefault(notifications, type);\n    defaults.set(type, notification);\n  }\n\n  return notification;\n}\n"],"mappings":";;;;;AAqBA,MAAM,wBAAgC;AAEtC,MAAM,2BAAW,IAAI,IAA6C;;;;;;AAOlE,SAAS,iBAAiB,OAAyB;CACjD,KAAK,IAAI,UAAU,OAAO,QAAQ,GAAG,WAAW,QAAQ,GAAG,SAAS;EAClE,MAAM,EAAE,MAAM,YAAY;EAE1B,KACG,SAAS,0BAA0B,SAAS,uBAC7C,OAAO,YAAY,YACnB,QAAQ,SAAS,IAAI,sBAAsB,EAAE,GAE7C,OAAO;EAGT,UAAW,QAAgC;CAC7C;CAEA,OAAO;AACT;AAEA,eAAe,oBAAkD;CAC/D,IAAI;CAEJ,IAAI;EACF,gBAAiB,MAAM,OAAO;CAChC,SAAS,OAAO;EACd,IAAI,iBAAiB,KAAK,GACxB,MAAM,IAAI,8BAA8B,iBAAiB,KAAK;EAGhE,MAAM;CACR;CAEA,IAAI;EACF,cAAc,sBAAsB;CACtC,SAAS,OAAO;EACd,MAAM,IAAI,8BAA8B,kBAAkB,KAAK;CACjE;CAEA,OAAO;AACT;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ;AAC3B;AAEA,SAAS,SAAS,OAAe,MAAoC;CACnE,MAAM,SAAS,KAAK,OAAO,KAAK;CAChC,MAAM,UAAU,KAAK,UAAU,YAAY;CAE3C,OAAO;EACL,MACE,MAAM,MAAM,SACX,KAAK,MACF,eAAe,WAAW,KAAK,GAAG,EAAE,IAAI,WAAW,KAAK,GAAG,EAAE,YAC7D,YAAY,WAAW,KAAK,KAAK,EAAE,gBACvC,2BAA2B,QAAQ;EACrC,MAAM,GAAG,MAAM,MAAM,OAAO,2BAA2B,QAAQ;CACjE;AACF;AAEA,SAAS,cACP,eACA,MACkB;CAClB,IAAI,SAAS,sBACX,OAAO,cAAc,mBAAmB;EACtC,MAAM;EACN,KAAK,CAAC,MAAM;EACZ,OAAO,UAAU;GACf,SAAS;GACT,GAAG,SAAS,iEAAiE,IAAI;EACnF;CACF,CAAC;CAGH,OAAO,cAAc,mBAAmB;EACtC,MAAM;EACN,KAAK,CAAC,MAAM;EACZ,OAAO,UAAU;GACf,SAAS;GACT,GAAG,SAAS,sCAAsC,IAAI;EACxD;CACF,CAAC;AACH;;;;;;;;;AAUA,eAAsB,yBACpB,MAC2B;CAC3B,MAAM,gBAAgB,MAAM,kBAAkB;CAE9C,MAAM,WACJ,SAAS,uBACL,WAAW,aAAa,aAAa,IACrC,WAAW,cAAc,aAAa;CAE5C,IAAI,UAAU,OAAO;CAErB,IAAI,eAAe,SAAS,IAAI,IAAI;CAEpC,IAAI,CAAC,cAAc;EACjB,eAAe,cAAc,eAAe,IAAI;EAChD,SAAS,IAAI,MAAM,YAAY;CACjC;CAEA,OAAO;AACT"}

package/esm/utils/auth-error-codes.d.mts

@@ -33,7 +33,54 @@ declare enum AuthErrorCodes {
    * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can
    * classify it as a credential failure without matching on the message.
    */
-  InvalidTokenType = "EC005"
+  InvalidTokenType = "EC005",
+  // Error Code 005
+  /**
+   * CSRF Origin Mismatch Error Code EC006
+   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)
+   * request whose `Origin` (or, absent that, `Referer`) did not match the
+   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose
+   * request carried neither header at all.
+   */
+  CsrfOriginMismatch = "EC006",
+  // Error Code 006
+  /**
+   * Email Not Verified Error Code EC007
+   * EC007 = the authenticated user has not verified their email address —
+   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
+   */
+  EmailNotVerified = "EC007",
+  // Error Code 007
+  /**
+   * Invalid One-Time Token Error Code EC008
+   * EC008 = an email-verification or password-reset token that is unknown,
+   * issued for the other purpose, expired, or already used. One code for all
+   * four on purpose: the caller learns nothing about which it was.
+   */
+  InvalidOneTimeToken = "EC008",
+  // Error Code 008
+  /**
+   * Invalid Provider Callback Error Code EC009
+   * EC009 = a redirect-provider callback was rejected: missing, forged or
+   * expired state cookie, `state` mismatch, failed code exchange, or an
+   * id_token with a bad signature, issuer, audience, expiry or nonce.
+   */
+  InvalidProviderCallback = "EC009",
+  // Error Code 009
+  /**
+   * Provider Email Not Verified Error Code EC010
+   * EC010 = the provider did not verify the email, so auth refused to link or
+   * create an account from it.
+   */
+  ProviderEmailNotVerified = "EC010",
+  // Error Code 010
+  /**
+   * Invalid Passkey Error Code EC011
+   * EC011 = a passkey ceremony was rejected: unknown, expired or used
+   * challenge, unknown credential, failed verification, or a signature counter
+   * that did not advance.
+   */
+  InvalidPasskey = "EC011"
 }
 //#endregion
 export { AuthErrorCodes };

package/esm/utils/auth-error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAoBgB;;;;EAfhB,YAAA;EAAA;;;;;;EAMA,eAAA;EAAA;;;;;;;;;EASA,gBAAA;AAAA"}
+{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAkCA;;;;EA7BA,YAAA;EAAA;EAwDc;AAAA;;;;EAlDd,eAAA;EAAA;;;;;;;;;EASA,gBAAA;EAAA;;;;;;;;EAQA,kBAAA;EAAA;;;;;;EAMA,gBAAA;EAAA;;;;;;;EAOA,mBAAA;EAAA;;;;;;;EAOA,uBAAA;EAAA;;;;;;EAMA,wBAAA;EAAA;;;;;;;EAOA,cAAA;AAAA"}

package/esm/utils/auth-error-codes.mjs

@@ -30,6 +30,47 @@ let AuthErrorCodes = /* @__PURE__ */ function(AuthErrorCodes) {
 	* classify it as a credential failure without matching on the message.
 	*/
 	AuthErrorCodes["InvalidTokenType"] = "EC005";
+	/**
+	* CSRF Origin Mismatch Error Code EC006
+	* EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)
+	* request whose `Origin` (or, absent that, `Referer`) did not match the
+	* request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose
+	* request carried neither header at all.
+	*/
+	AuthErrorCodes["CsrfOriginMismatch"] = "EC006";
+	/**
+	* Email Not Verified Error Code EC007
+	* EC007 = the authenticated user has not verified their email address —
+	* thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
+	*/
+	AuthErrorCodes["EmailNotVerified"] = "EC007";
+	/**
+	* Invalid One-Time Token Error Code EC008
+	* EC008 = an email-verification or password-reset token that is unknown,
+	* issued for the other purpose, expired, or already used. One code for all
+	* four on purpose: the caller learns nothing about which it was.
+	*/
+	AuthErrorCodes["InvalidOneTimeToken"] = "EC008";
+	/**
+	* Invalid Provider Callback Error Code EC009
+	* EC009 = a redirect-provider callback was rejected: missing, forged or
+	* expired state cookie, `state` mismatch, failed code exchange, or an
+	* id_token with a bad signature, issuer, audience, expiry or nonce.
+	*/
+	AuthErrorCodes["InvalidProviderCallback"] = "EC009";
+	/**
+	* Provider Email Not Verified Error Code EC010
+	* EC010 = the provider did not verify the email, so auth refused to link or
+	* create an account from it.
+	*/
+	AuthErrorCodes["ProviderEmailNotVerified"] = "EC010";
+	/**
+	* Invalid Passkey Error Code EC011
+	* EC011 = a passkey ceremony was rejected: unknown, expired or used
+	* challenge, unknown credential, failed verification, or a signature counter
+	* that did not advance.
+	*/
+	AuthErrorCodes["InvalidPasskey"] = "EC011";
 	return AuthErrorCodes;
 }({});
 

package/esm/utils/auth-error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;AACF"}
+{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n  /**\r\n   * CSRF Origin Mismatch Error Code EC006\r\n   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)\r\n   * request whose `Origin` (or, absent that, `Referer`) did not match the\r\n   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose\r\n   * request carried neither header at all.\r\n   */\r\n  CsrfOriginMismatch = \"EC006\", // Error Code 006\r\n  /**\r\n   * Email Not Verified Error Code EC007\r\n   * EC007 = the authenticated user has not verified their email address —\r\n   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).\r\n   */\r\n  EmailNotVerified = \"EC007\", // Error Code 007\r\n  /**\r\n   * Invalid One-Time Token Error Code EC008\r\n   * EC008 = an email-verification or password-reset token that is unknown,\r\n   * issued for the other purpose, expired, or already used. One code for all\r\n   * four on purpose: the caller learns nothing about which it was.\r\n   */\r\n  InvalidOneTimeToken = \"EC008\", // Error Code 008\r\n  /**\r\n   * Invalid Provider Callback Error Code EC009\r\n   * EC009 = a redirect-provider callback was rejected: missing, forged or\r\n   * expired state cookie, `state` mismatch, failed code exchange, or an\r\n   * id_token with a bad signature, issuer, audience, expiry or nonce.\r\n   */\r\n  InvalidProviderCallback = \"EC009\", // Error Code 009\r\n  /**\r\n   * Provider Email Not Verified Error Code EC010\r\n   * EC010 = the provider did not verify the email, so auth refused to link or\r\n   * create an account from it.\r\n   */\r\n  ProviderEmailNotVerified = \"EC010\", // Error Code 010\r\n  /**\r\n   * Invalid Passkey Error Code EC011\r\n   * EC011 = a passkey ceremony was rejected: unknown, expired or used\r\n   * challenge, unknown credential, failed verification, or a signature counter\r\n   * that did not advance.\r\n   */\r\n  InvalidPasskey = \"EC011\", // Error Code 011\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;;;;;;;CAQA;;;;;;CAMA;;;;;;;CAOA;;;;;;;CAOA;;;;;;CAMA;;;;;;;CAOA;;AACF"}

package/esm/utils/index.mjs

@@ -1,4 +1,5 @@
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./token-expiry.mjs";
 import { AuthErrorCodes } from "./auth-error-codes.mjs";
+import { safeEqual } from "./safe-equal.mjs";
 
 export {  };

package/esm/utils/safe-equal.d.mts

@@ -0,0 +1,6 @@
+//#region ../auth/src/utils/safe-equal.d.ts
+/** Constant-time string equality; strings of unequal length are simply unequal. */
+declare function safeEqual(left: string, right: string): boolean;
+//#endregion
+export { safeEqual };
+//# sourceMappingURL=safe-equal.d.mts.map

package/esm/utils/safe-equal.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/safe-equal.ts"],"mappings":";;iBAGgB,SAAA,CAAU,IAAA,UAAc,KAAa"}

package/esm/utils/safe-equal.mjs

@@ -0,0 +1,13 @@
+import { timingSafeEqual } from "node:crypto";
+
+//#region ../auth/src/utils/safe-equal.ts
+/** Constant-time string equality; strings of unequal length are simply unequal. */
+function safeEqual(left, right) {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+
+//#endregion
+export { safeEqual };
+//# sourceMappingURL=safe-equal.mjs.map

package/esm/utils/safe-equal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.mjs","names":[],"sources":["../../../../../../../auth/src/utils/safe-equal.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\n\n/** Constant-time string equality; strings of unequal length are simply unequal. */\nexport function safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n"],"mappings":";;;;AAGA,SAAgB,UAAU,MAAc,OAAwB;CAC9D,MAAM,IAAI,OAAO,KAAK,IAAI;CAC1B,MAAM,IAAI,OAAO,KAAK,KAAK;CAE3B,OAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD"}