@warlock.js/auth 5.12.0 → 5.13.0

package/esm/errors/email-not-verified.error.mjs

@@ -0,0 +1,20 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/email-not-verified.error.ts
+/**
+* The authenticated user has not verified their email address. Thrown by
+* `requireVerifiedEmail()`; core's error handler answers it with `403` and a
+* `payload.errorCode` of `EC007`.
+*/
+var EmailNotVerifiedError = class extends ForbiddenError {
+	constructor(message = "Email address is not verified.") {
+		super(message, { errorCode: "EC007" });
+		this.code = "EC007";
+		this.name = "EmailNotVerifiedError";
+	}
+};
+
+//#endregion
+export { EmailNotVerifiedError };
+//# sourceMappingURL=email-not-verified.error.mjs.map

package/esm/errors/email-not-verified.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The authenticated user has not verified their email address. Thrown by\n * `requireVerifiedEmail()`; core's error handler answers it with `403` and a\n * `payload.errorCode` of `EC007`.\n */\nexport class EmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.EmailNotVerified;\n\n  public constructor(message = \"Email address is not verified.\") {\n    super(message, { errorCode: AuthErrorCodes.EmailNotVerified });\n    this.name = \"EmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,wBAAb,cAA2C,eAAe;CAGxD,AAAO,YAAY,UAAU,kCAAkC;EAC7D,MAAM,SAAS,EAAE,mBAA2C,CAAC;;EAC7D,KAAK,OAAO;CACd;AACF"}

package/esm/errors/index.d.mts

@@ -0,0 +1,7 @@
+import { AuthProviderSdkMissingError } from "./auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./provider-email-not-verified.error.mjs";

package/esm/errors/index.mjs

@@ -0,0 +1,9 @@
+import { AuthProviderSdkMissingError } from "./auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./provider-email-not-verified.error.mjs";
+
+export {  };

package/esm/errors/invalid-one-time-token.error.d.mts

@@ -0,0 +1,17 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-one-time-token.error.d.ts
+/**
+ * An email-verification or password-reset token was rejected: unknown, issued
+ * for the other purpose, expired, or already consumed (including losing a
+ * concurrent consumption race). Deliberately ONE error for all of them, so a
+ * caller cannot probe which case applies. Answers `400` with `EC008`.
+ */
+declare class InvalidOneTimeTokenError extends BadRequestError {
+  readonly code = AuthErrorCodes.InvalidOneTimeToken;
+  constructor(message?: string);
+}
+//#endregion
+export { InvalidOneTimeTokenError };
+//# sourceMappingURL=invalid-one-time-token.error.d.mts.map

package/esm/errors/invalid-one-time-token.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-one-time-token.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,wBAAA,SAAiC,eAAe;EAAA,SAC3C,IAAA,GAAI,cAAA,CAAA,mBAAA;cAED,OAAA;AAAA"}

package/esm/errors/invalid-one-time-token.error.mjs

@@ -0,0 +1,21 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-one-time-token.error.ts
+/**
+* An email-verification or password-reset token was rejected: unknown, issued
+* for the other purpose, expired, or already consumed (including losing a
+* concurrent consumption race). Deliberately ONE error for all of them, so a
+* caller cannot probe which case applies. Answers `400` with `EC008`.
+*/
+var InvalidOneTimeTokenError = class extends BadRequestError {
+	constructor(message = "Invalid or expired token.") {
+		super(message, { errorCode: "EC008" });
+		this.code = "EC008";
+		this.name = "InvalidOneTimeTokenError";
+	}
+};
+
+//#endregion
+export { InvalidOneTimeTokenError };
+//# sourceMappingURL=invalid-one-time-token.error.mjs.map

package/esm/errors/invalid-one-time-token.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-one-time-token.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * An email-verification or password-reset token was rejected: unknown, issued\n * for the other purpose, expired, or already consumed (including losing a\n * concurrent consumption race). Deliberately ONE error for all of them, so a\n * caller cannot probe which case applies. Answers `400` with `EC008`.\n */\nexport class InvalidOneTimeTokenError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidOneTimeToken;\n\n  public constructor(message = \"Invalid or expired token.\") {\n    super(message, { errorCode: AuthErrorCodes.InvalidOneTimeToken });\n    this.name = \"InvalidOneTimeTokenError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,2BAAb,cAA8C,gBAAgB;CAG5D,AAAO,YAAY,UAAU,6BAA6B;EACxD,MAAM,SAAS,EAAE,mBAA8C,CAAC;;EAChE,KAAK,OAAO;CACd;AACF"}

package/esm/errors/invalid-passkey.error.d.mts

@@ -0,0 +1,18 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-passkey.error.d.ts
+/**
+ * A passkey registration or authentication was rejected — unknown, expired
+ * or used challenge, unknown credential, failed verification, or a signature
+ * counter that did not advance. `reason` is for logs; the message stays
+ * generic. Answers `400` with `EC011`.
+ */
+declare class InvalidPasskeyError extends BadRequestError {
+  readonly reason: string;
+  readonly code = AuthErrorCodes.InvalidPasskey;
+  constructor(reason: string, cause?: unknown);
+}
+//#endregion
+export { InvalidPasskeyError };
+//# sourceMappingURL=invalid-passkey.error.d.mts.map

package/esm/errors/invalid-passkey.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-passkey.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,mBAAA,SAA4B,eAAe;EAAA,SAIpC,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,cAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-passkey.error.mjs

@@ -0,0 +1,23 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-passkey.error.ts
+/**
+* A passkey registration or authentication was rejected — unknown, expired
+* or used challenge, unknown credential, failed verification, or a signature
+* counter that did not advance. `reason` is for logs; the message stays
+* generic. Answers `400` with `EC011`.
+*/
+var InvalidPasskeyError = class extends BadRequestError {
+	constructor(reason, cause) {
+		super("Passkey verification failed.", { errorCode: "EC011" });
+		this.reason = reason;
+		this.code = "EC011";
+		this.name = "InvalidPasskeyError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { InvalidPasskeyError };
+//# sourceMappingURL=invalid-passkey.error.mjs.map

package/esm/errors/invalid-passkey.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-passkey.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A passkey registration or authentication was rejected — unknown, expired\n * or used challenge, unknown credential, failed verification, or a signature\n * counter that did not advance. `reason` is for logs; the message stays\n * generic. Answers `400` with `EC011`.\n */\nexport class InvalidPasskeyError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidPasskey;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Passkey verification failed.\", { errorCode: AuthErrorCodes.InvalidPasskey });\n    this.name = \"InvalidPasskeyError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,sBAAb,cAAyC,gBAAgB;CAGvD,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,gCAAgC,EAAE,mBAAyC,CAAC;EAHlE;;EAIhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/invalid-provider-callback.error.d.mts

@@ -0,0 +1,18 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-provider-callback.error.d.ts
+/**
+ * A redirect-provider callback was rejected — missing, forged or expired
+ * state cookie, `state` mismatch, failed code exchange, or an id_token with a
+ * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;
+ * the response message stays generic. Answers `400` with `EC009`.
+ */
+declare class InvalidProviderCallbackError extends BadRequestError {
+  readonly reason: string;
+  readonly code = AuthErrorCodes.InvalidProviderCallback;
+  constructor(reason: string, cause?: unknown);
+}
+//#endregion
+export { InvalidProviderCallbackError };
+//# sourceMappingURL=invalid-provider-callback.error.d.mts.map

package/esm/errors/invalid-provider-callback.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-provider-callback.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,4BAAA,SAAqC,eAAe;EAAA,SAI7C,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,uBAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-provider-callback.error.mjs

@@ -0,0 +1,23 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { BadRequestError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/invalid-provider-callback.error.ts
+/**
+* A redirect-provider callback was rejected — missing, forged or expired
+* state cookie, `state` mismatch, failed code exchange, or an id_token with a
+* bad signature, issuer, audience, expiry or nonce. `reason` is for logs;
+* the response message stays generic. Answers `400` with `EC009`.
+*/
+var InvalidProviderCallbackError = class extends BadRequestError {
+	constructor(reason, cause) {
+		super("Login with the provider failed.", { errorCode: "EC009" });
+		this.reason = reason;
+		this.code = "EC009";
+		this.name = "InvalidProviderCallbackError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { InvalidProviderCallbackError };
+//# sourceMappingURL=invalid-provider-callback.error.mjs.map

package/esm/errors/invalid-provider-callback.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-provider-callback.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A redirect-provider callback was rejected — missing, forged or expired\n * state cookie, `state` mismatch, failed code exchange, or an id_token with a\n * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;\n * the response message stays generic. Answers `400` with `EC009`.\n */\nexport class InvalidProviderCallbackError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidProviderCallback;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Login with the provider failed.\", {\n      errorCode: AuthErrorCodes.InvalidProviderCallback,\n    });\n    this.name = \"InvalidProviderCallbackError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,+BAAb,cAAkD,gBAAgB;CAGhE,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,mCAAmC,EACvC,mBACF,CAAC;EALe;;EAMhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/notifications-unavailable.error.d.mts

@@ -0,0 +1,15 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/notifications-unavailable.error.d.ts
+/**
+ * Email verification / password reset could not send its notification because
+ * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE
+ * any token is issued — auth never issues a token it cannot deliver, and never
+ * skips the send silently. The original failure is kept on `cause`.
+ */
+declare class NotificationsUnavailableError extends ServerError {
+  constructor(reason: "not-installed" | "not-configured", cause?: unknown);
+}
+//#endregion
+export { NotificationsUnavailableError };
+//# sourceMappingURL=notifications-unavailable.error.d.mts.map

package/esm/errors/notifications-unavailable.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-unavailable.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,6BAAA,SAAsC,WAAW;cACzC,MAAA,sCAA4C,KAAA;AAAA"}

package/esm/errors/notifications-unavailable.error.mjs

@@ -0,0 +1,20 @@
+import { ServerError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/notifications-unavailable.error.ts
+/**
+* Email verification / password reset could not send its notification because
+* `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE
+* any token is issued — auth never issues a token it cannot deliver, and never
+* skips the send silently. The original failure is kept on `cause`.
+*/
+var NotificationsUnavailableError = class extends ServerError {
+	constructor(reason, cause) {
+		super(reason === "not-installed" ? "@warlock.js/auth: email verification and password reset send through @warlock.js/notifications, which is not installed — add it to the app's dependencies." : "@warlock.js/auth: email verification and password reset send through @warlock.js/notifications, which is not configured — add `src/config/notifications.ts` with a `mail` channel.");
+		this.name = "NotificationsUnavailableError";
+		this.cause = cause;
+	}
+};
+
+//#endregion
+export { NotificationsUnavailableError };
+//# sourceMappingURL=notifications-unavailable.error.mjs.map

package/esm/errors/notifications-unavailable.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications-unavailable.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * Email verification / password reset could not send its notification because\n * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE\n * any token is issued — auth never issues a token it cannot deliver, and never\n * skips the send silently. The original failure is kept on `cause`.\n */\nexport class NotificationsUnavailableError extends ServerError {\n  public constructor(reason: \"not-installed\" | \"not-configured\", cause?: unknown) {\n    super(\n      reason === \"not-installed\"\n        ? \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not installed — add it to the app's dependencies.\"\n        : \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not configured — add `src/config/notifications.ts` \" +\n            \"with a `mail` channel.\",\n    );\n    this.name = \"NotificationsUnavailableError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,YAAY;CAC7D,AAAO,YAAY,QAA4C,OAAiB;EAC9E,MACE,WAAW,kBACP,+JAEA,oLAGN;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/provider-email-not-verified.error.d.mts

@@ -0,0 +1,16 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/provider-email-not-verified.error.d.ts
+/**
+ * The provider did not verify the email on a profile with no existing link,
+ * so auth refused to link it to (or create) an account. Answers `403` with
+ * `EC010`.
+ */
+declare class ProviderEmailNotVerifiedError extends ForbiddenError {
+  readonly code = AuthErrorCodes.ProviderEmailNotVerified;
+  constructor(message?: string);
+}
+//#endregion
+export { ProviderEmailNotVerifiedError };
+//# sourceMappingURL=provider-email-not-verified.error.d.mts.map

package/esm/errors/provider-email-not-verified.error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,6BAAA,SAAsC,cAAc;EAAA,SAC/C,IAAA,GAAI,cAAA,CAAA,wBAAA;cAED,OAAA;AAAA"}

package/esm/errors/provider-email-not-verified.error.mjs

@@ -0,0 +1,20 @@
+import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { ForbiddenError } from "@warlock.js/core";
+
+//#region ../auth/src/errors/provider-email-not-verified.error.ts
+/**
+* The provider did not verify the email on a profile with no existing link,
+* so auth refused to link it to (or create) an account. Answers `403` with
+* `EC010`.
+*/
+var ProviderEmailNotVerifiedError = class extends ForbiddenError {
+	constructor(message = "The provider has not verified this email address.") {
+		super(message, { errorCode: "EC010" });
+		this.code = "EC010";
+		this.name = "ProviderEmailNotVerifiedError";
+	}
+};
+
+//#endregion
+export { ProviderEmailNotVerifiedError };
+//# sourceMappingURL=provider-email-not-verified.error.mjs.map

package/esm/errors/provider-email-not-verified.error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The provider did not verify the email on a profile with no existing link,\n * so auth refused to link it to (or create) an account. Answers `403` with\n * `EC010`.\n */\nexport class ProviderEmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.ProviderEmailNotVerified;\n\n  public constructor(message = \"The provider has not verified this email address.\") {\n    super(message, { errorCode: AuthErrorCodes.ProviderEmailNotVerified });\n    this.name = \"ProviderEmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,eAAe;CAGhE,AAAO,YAAY,UAAU,qDAAqD;EAChF,MAAM,SAAS,EAAE,mBAAmD,CAAC;;EACrE,KAAK,OAAO;CACd;AACF"}

package/esm/index.d.mts

@@ -3,20 +3,44 @@ import { registerAuthPurgeNeverExpiringCommand } from "./commands/auth-purge-nev
 import { registerJWTSecretGeneratorCommand } from "./commands/jwt-secret-generator-command.mjs";
 import { Auth } from "./models/auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
-import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
+import { AuthProvider, GoogleProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig } from "./contracts/providers.mjs";
+import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentials, AuthNotification, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./contracts/types.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "./contracts/auth-contract.mjs";
 import { RequestUser } from "./contracts/request-locals.mjs";
-import { authMiddleware } from "./middleware/auth.middleware.mjs";
+import { AuthProviderSdkMissingError } from "./errors/auth-provider-sdk-missing.error.mjs";
 import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
+import { EmailNotVerifiedError } from "./errors/email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./errors/invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./errors/invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./errors/invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./errors/notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verified.error.mjs";
+import { authMiddleware } from "./middleware/auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./models/passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./models/provider-account/provider-account.model.mjs";
 import { authMigrations } from "./models/index.mjs";
+import { requestOtp, verifyOtp } from "./otp/otp.mjs";
+import { PasskeyOptionsJSON, PasskeyResponseJSON } from "./passkeys/simplewebauthn.mjs";
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkeys/passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, JoseModule, pkceChallenge } from "./providers/google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./services/auth-events.mjs";
 import { authService } from "./services/auth.service.mjs";
 import { currentUser } from "./services/current-user.mjs";
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
 import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./services/jwt.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./services/email-verification.mjs";
+import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./services/one-time-tokens.mjs";
+import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
+import { safeEqual } from "./utils/safe-equal.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
-export { AccessToken, AccessTokenConfig, AccessTokenOutput, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, LegacyJwtConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, PageAuthConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, currentUser, generateJWTSecret, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, jwt, loginThrottleMiddleware, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requiresCsrfOriginCheck, tokenHasExpClaim };
+export { AccessToken, AccessTokenConfig, AccessTokenOutput, Auth, AuthConfigurations, AuthCredentials, AuthErrorCodes, AuthEventCallback, AuthEventName, AuthEventPayloads, AuthNotification, AuthProvider, AuthProviderSdkMissingError, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CsrfConfig, CsrfOriginMismatchError, CsrfOriginMismatchReason, DeviceInfo, EmailNotVerifiedError, EmailVerificationConfig, GOOGLE_AUTH_FEATURE, GoogleProvider, GoogleProviderConfig, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, IssuedOneTimeToken, JoseModule, LegacyJwtConfig, LoginResult, LoginThrottleIdentifier, LoginThrottleOptions, LogoutWithoutTokenBehavior, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenPurpose, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeyCredential, type PasskeyOptionsJSON, type PasskeyResponseJSON, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAccount, ProviderAuthorizationState, ProviderCallbackParams, ProviderEmailNotVerifiedError, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshToken, RefreshTokenConfig, RefreshTokenIssueOptions, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, TokenType, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };
 import "./contracts/request-locals.mjs";

package/esm/index.mjs

@@ -1,5 +1,6 @@
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./utils/token-expiry.mjs";
 import { AccessToken, accessTokenSchema } from "./models/access-token/access-token.model.mjs";
+import { OneTimeToken, oneTimeTokenSchema } from "./models/one-time-token/one-time-token.model.mjs";
 import { RefreshToken, refreshTokenSchema } from "./models/refresh-token/refresh-token.model.mjs";
 import { authEvents } from "./services/auth-events.mjs";
 import { AuthErrorCodes } from "./utils/auth-error-codes.mjs";
@@ -10,14 +11,39 @@ import { registerAuthPurgeNeverExpiringCommand } from "./commands/auth-purge-nev
 import { generateJWTSecret } from "./services/generate-jwt-secret.mjs";
 import { registerJWTSecretGeneratorCommand } from "./commands/jwt-secret-generator-command.mjs";
 import { NO_EXPIRATION } from "./contracts/types.mjs";
+import { AuthProviderSdkMissingError } from "./errors/auth-provider-sdk-missing.error.mjs";
+import { EmailNotVerifiedError } from "./errors/email-not-verified.error.mjs";
+import { InvalidOneTimeTokenError } from "./errors/invalid-one-time-token.error.mjs";
+import { InvalidPasskeyError } from "./errors/invalid-passkey.error.mjs";
+import { InvalidProviderCallbackError } from "./errors/invalid-provider-callback.error.mjs";
+import { NotificationsUnavailableError } from "./errors/notifications-unavailable.error.mjs";
+import { ProviderEmailNotVerifiedError } from "./errors/provider-email-not-verified.error.mjs";
+import "./errors/index.mjs";
 import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./middleware/csrf-origin-check.mjs";
 import { authMiddleware } from "./middleware/auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./middleware/login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./middleware/one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./middleware/otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./middleware/require-verified-email.middleware.mjs";
 import "./middleware/index.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./models/passkey-credential/passkey-credential.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./models/provider-account/provider-account.model.mjs";
 import { currentUser } from "./services/current-user.mjs";
+import { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./services/one-time-tokens.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./services/email-verification.mjs";
+import { requestPasswordReset, resetPassword } from "./services/password-reset.mjs";
 import "./services/index.mjs";
 import { Auth } from "./models/auth.model.mjs";
 import { authMigrations } from "./models/index.mjs";
+import { safeEqual } from "./utils/safe-equal.mjs";
+import { requestOtp, verifyOtp } from "./otp/otp.mjs";
+import "./otp/index.mjs";
+import { generatePasskeyAuthenticationOptions, verifyPasskeyAuthentication } from "./passkeys/passkey-authentication.mjs";
+import { generatePasskeyRegistrationOptions, verifyPasskeyRegistration } from "./passkeys/passkey-registration.mjs";
+import "./passkeys/index.mjs";
+import { GOOGLE_AUTH_FEATURE, GoogleProvider, pkceChallenge } from "./providers/google-provider.mjs";
+import { completeProviderLogin, resolveAuthProvider, startProviderLogin } from "./providers/provider-login.mjs";
+import "./providers/index.mjs";
 import "./utils/index.mjs";
 
-export { AccessToken, Auth, AuthErrorCodes, CsrfOriginMismatchError, NO_EXPIRATION, RefreshToken, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, currentUser, generateJWTSecret, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, jwt, loginThrottleMiddleware, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requiresCsrfOriginCheck, tokenHasExpClaim };
+export { AccessToken, Auth, AuthErrorCodes, AuthProviderSdkMissingError, CsrfOriginMismatchError, EmailNotVerifiedError, GOOGLE_AUTH_FEATURE, GoogleProvider, InvalidOneTimeTokenError, InvalidPasskeyError, InvalidProviderCallbackError, NO_EXPIRATION, NotificationsUnavailableError, OneTimeToken, PasskeyCredential, ProviderAccount, ProviderEmailNotVerifiedError, RefreshToken, TokenTypeError, accessTokenSchema, assertCsrfOriginAllowed, authEvents, authMiddleware, authMigrations, authService, completeProviderLogin, consumeOneTimeToken, currentUser, generateJWTSecret, generatePasskeyAuthenticationOptions, generatePasskeyRegistrationOptions, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, isNeverExpiring, isUsableExpiry, issueOneTimeToken, jwt, loginThrottleMiddleware, oneTimeTokenModel, oneTimeTokenSchema, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, passkeyCredentialSchema, pkceChallenge, providerAccountSchema, refreshTokenSchema, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand, registerJWTSecretGeneratorCommand, requestOtp, requestPasswordReset, requireVerifiedEmail, requiresCsrfOriginCheck, resetPassword, resolveAuthProvider, safeEqual, sendEmailVerification, startProviderLogin, tokenConsumeThrottleMiddleware, tokenHasExpClaim, tokenIssueThrottleMiddleware, verifyEmail, verifyOtp, verifyPasskeyAuthentication, verifyPasskeyRegistration };

package/esm/middleware/index.d.mts

@@ -1,3 +1,6 @@
 import { authMiddleware } from "./auth.middleware.mjs";
 import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
-import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";

package/esm/middleware/index.mjs

@@ -1,5 +1,8 @@
 import { CsrfOriginMismatchError, assertCsrfOriginAllowed, requiresCsrfOriginCheck } from "./csrf-origin-check.mjs";
 import { authMiddleware } from "./auth.middleware.mjs";
 import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
+import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";
 
 export {  };

package/esm/middleware/one-time-token-throttle.middleware.d.mts

@@ -0,0 +1,36 @@
+import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/one-time-token-throttle.middleware.d.ts
+/**
+ * Throttle for routes that ISSUE a verification or reset token ("send
+ * verification email", "forgot password"). Built on
+ * {@link loginThrottleMiddleware}, tracked per email and per IP, with one
+ * difference: EVERY request counts. A reset request answers the same success
+ * for known and unknown emails, so a failure-aware counter would never trip.
+ *
+ * Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/forgot-password", forgotPassword, {
+ *   middleware: [tokenIssueThrottleMiddleware()],
+ * });
+ */
+declare function tokenIssueThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+/**
+ * Throttle for routes that CONSUME a token ("verify email", "reset
+ * password"). Built on {@link loginThrottleMiddleware}: per IP (the body
+ * carries a token, not an account), failure-aware — a rejected token counts,
+ * a successful use clears the counter.
+ *
+ * Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/reset-password", resetPasswordController, {
+ *   middleware: [tokenConsumeThrottleMiddleware()],
+ * });
+ */
+declare function tokenConsumeThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+//#endregion
+export { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };
+//# sourceMappingURL=one-time-token-throttle.middleware.d.mts.map

package/esm/middleware/one-time-token-throttle.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/one-time-token-throttle.middleware.ts"],"mappings":";;;;;;AAiBA;;;;;;;;AAA4F;AAwB5F;;;iBAxBgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;;;;;AAwBE;;;;;;;;;iBAA9E,8BAAA,CAA+B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/one-time-token-throttle.middleware.mjs

@@ -0,0 +1,53 @@
+import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+
+//#region ../auth/src/middleware/one-time-token-throttle.middleware.ts
+/**
+* Throttle for routes that ISSUE a verification or reset token ("send
+* verification email", "forgot password"). Built on
+* {@link loginThrottleMiddleware}, tracked per email and per IP, with one
+* difference: EVERY request counts. A reset request answers the same success
+* for known and unknown emails, so a failure-aware counter would never trip.
+*
+* Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/forgot-password", forgotPassword, {
+*   middleware: [tokenIssueThrottleMiddleware()],
+* });
+*/
+function tokenIssueThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 3,
+		window: "1h",
+		lockoutDuration: "1h",
+		by: ["email", "ip"],
+		isFailure: () => true,
+		...options
+	});
+}
+/**
+* Throttle for routes that CONSUME a token ("verify email", "reset
+* password"). Built on {@link loginThrottleMiddleware}: per IP (the body
+* carries a token, not an account), failure-aware — a rejected token counts,
+* a successful use clears the counter.
+*
+* Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/reset-password", resetPasswordController, {
+*   middleware: [tokenConsumeThrottleMiddleware()],
+* });
+*/
+function tokenConsumeThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 10,
+		window: "15m",
+		lockoutDuration: "15m",
+		by: ["ip"],
+		...options
+	});
+}
+
+//#endregion
+export { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };
+//# sourceMappingURL=one-time-token-throttle.middleware.mjs.map

package/esm/middleware/one-time-token-throttle.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-token-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/one-time-token-throttle.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { loginThrottleMiddleware, type LoginThrottleOptions } from \"./login-throttle.middleware\";\n\n/**\n * Throttle for routes that ISSUE a verification or reset token (\"send\n * verification email\", \"forgot password\"). Built on\n * {@link loginThrottleMiddleware}, tracked per email and per IP, with one\n * difference: EVERY request counts. A reset request answers the same success\n * for known and unknown emails, so a failure-aware counter would never trip.\n *\n * Defaults: 3 requests per 1h window, then a 1h lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/forgot-password\", forgotPassword, {\n *   middleware: [tokenIssueThrottleMiddleware()],\n * });\n */\nexport function tokenIssueThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 3,\n    window: \"1h\",\n    lockoutDuration: \"1h\",\n    by: [\"email\", \"ip\"],\n    isFailure: () => true,\n    ...options,\n  });\n}\n\n/**\n * Throttle for routes that CONSUME a token (\"verify email\", \"reset\n * password\"). Built on {@link loginThrottleMiddleware}: per IP (the body\n * carries a token, not an account), failure-aware — a rejected token counts,\n * a successful use clears the counter.\n *\n * Defaults: 10 failures per 15m window, then a 15m lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/reset-password\", resetPasswordController, {\n *   middleware: [tokenConsumeThrottleMiddleware()],\n * });\n */\nexport function tokenConsumeThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 10,\n    window: \"15m\",\n    lockoutDuration: \"15m\",\n    by: [\"ip\"],\n    ...options,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,6BAA6B,UAAgC,CAAC,GAAe;CAC3F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,SAAS,IAAI;EAClB,iBAAiB;EACjB,GAAG;CACL,CAAC;AACH;;;;;;;;;;;;;;AAeA,SAAgB,+BAA+B,UAAgC,CAAC,GAAe;CAC7F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,IAAI;EACT,GAAG;CACL,CAAC;AACH"}

package/esm/middleware/otp-throttle.middleware.d.mts

@@ -0,0 +1,30 @@
+import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
+import { Middleware } from "@warlock.js/core";
+
+//#region ../auth/src/middleware/otp-throttle.middleware.d.ts
+/**
+ * Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}
+ * keyed on the `phone` input and IP: every request counts (the answer is the
+ * same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).
+ *
+ * @example
+ * router.post("/auth/otp/request", requestOtpController, {
+ *   middleware: [otpRequestThrottleMiddleware()],
+ * });
+ */
+declare function otpRequestThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+/**
+ * Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}
+ * keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout
+ * (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code
+ * would otherwise reset.
+ *
+ * @example
+ * router.post("/auth/otp/verify", verifyOtpController, {
+ *   middleware: [otpVerifyThrottleMiddleware()],
+ * });
+ */
+declare function otpVerifyThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+//#endregion
+export { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware };
+//# sourceMappingURL=otp-throttle.middleware.d.mts.map

package/esm/middleware/otp-throttle.middleware.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../auth/src/middleware/otp-throttle.middleware.ts"],"mappings":";;;;;;AAcA;;;;;;;;iBAAgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;AAe5F;;;;;;;;AAA2F;;;AAA3F,iBAAgB,2BAAA,CAA4B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}

package/esm/middleware/otp-throttle.middleware.mjs

@@ -0,0 +1,45 @@
+import { loginThrottleMiddleware } from "./login-throttle.middleware.mjs";
+import { tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
+
+//#region ../auth/src/middleware/otp-throttle.middleware.ts
+/**
+* Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}
+* keyed on the `phone` input and IP: every request counts (the answer is the
+* same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).
+*
+* @example
+* router.post("/auth/otp/request", requestOtpController, {
+*   middleware: [otpRequestThrottleMiddleware()],
+* });
+*/
+function otpRequestThrottleMiddleware(options = {}) {
+	return tokenIssueThrottleMiddleware({
+		identifierKey: "phone",
+		...options
+	});
+}
+/**
+* Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}
+* keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout
+* (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code
+* would otherwise reset.
+*
+* @example
+* router.post("/auth/otp/verify", verifyOtpController, {
+*   middleware: [otpVerifyThrottleMiddleware()],
+* });
+*/
+function otpVerifyThrottleMiddleware(options = {}) {
+	return loginThrottleMiddleware({
+		max: 5,
+		window: "15m",
+		lockoutDuration: "15m",
+		by: ["email", "ip"],
+		identifierKey: "phone",
+		...options
+	});
+}
+
+//#endregion
+export { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware };
+//# sourceMappingURL=otp-throttle.middleware.mjs.map

package/esm/middleware/otp-throttle.middleware.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/otp-throttle.middleware.ts"],"sourcesContent":["import type { Middleware } from \"@warlock.js/core\";\nimport { loginThrottleMiddleware, type LoginThrottleOptions } from \"./login-throttle.middleware\";\nimport { tokenIssueThrottleMiddleware } from \"./one-time-token-throttle.middleware\";\n\n/**\n * Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}\n * keyed on the `phone` input and IP: every request counts (the answer is the\n * same for unknown phones), 3 per 1h, then a 1h lockout (`429`, `EC004`).\n *\n * @example\n * router.post(\"/auth/otp/request\", requestOtpController, {\n *   middleware: [otpRequestThrottleMiddleware()],\n * });\n */\nexport function otpRequestThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return tokenIssueThrottleMiddleware({ identifierKey: \"phone\", ...options });\n}\n\n/**\n * Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}\n * keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout\n * (`429`, `EC004`). Complements the per-code attempt cap, which a fresh code\n * would otherwise reset.\n *\n * @example\n * router.post(\"/auth/otp/verify\", verifyOtpController, {\n *   middleware: [otpVerifyThrottleMiddleware()],\n * });\n */\nexport function otpVerifyThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  return loginThrottleMiddleware({\n    max: 5,\n    window: \"15m\",\n    lockoutDuration: \"15m\",\n    by: [\"email\", \"ip\"],\n    identifierKey: \"phone\",\n    ...options,\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAgB,6BAA6B,UAAgC,CAAC,GAAe;CAC3F,OAAO,6BAA6B;EAAE,eAAe;EAAS,GAAG;CAAQ,CAAC;AAC5E;;;;;;;;;;;;AAaA,SAAgB,4BAA4B,UAAgC,CAAC,GAAe;CAC1F,OAAO,wBAAwB;EAC7B,KAAK;EACL,QAAQ;EACR,iBAAiB;EACjB,IAAI,CAAC,SAAS,IAAI;EAClB,eAAe;EACf,GAAG;CACL,CAAC;AACH"}