@warlock.js/auth 5.12.0 → 5.14.0

package/esm/models/passkey-credential/passkey-credential.model.d.mts

@@ -0,0 +1,108 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/passkey-credential/passkey-credential.model.d.ts
+/** Seal schema for a stored passkey. Exported so an override can extend it. */
+declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+  transports: import("@warlock.js/seal").ArrayValidator & {
+    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+    isOptional: true;
+  };
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+}>>;
+/**
+ * A registered WebAuthn credential. `credential_id` and `public_key` are
+ * base64url; `counter` is the last signature counter seen, which an
+ * authentication must advance (a clone detector).
+ */
+declare class PasskeyCredential extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
+    transports: import("@warlock.js/seal").ArrayValidator & {
+      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
+      isOptional: true;
+    };
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`. No call site deletes a credential today, but the public key
+   * is credential material, so a future `destroy()` here must not leave a
+   * copy in `passkey_credentialsTrash`.
+   */
+  static deleteStrategy: "permanent";
+  /** base64url credential id. */
+  get credentialId(): string;
+  /** Last signature counter seen. */
+  get counter(): number;
+  /** The owner's id. */
+  get userId(): any;
+  /** The owner's type slug. */
+  get userType(): string;
+  /** Find a credential by its base64url id. */
+  static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null>;
+  /** Every credential the user registered. */
+  static listFor(user: Auth): Promise<PasskeyCredential[]>;
+  /**
+   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,
+   * so two concurrent assertions with the same counter cannot both succeed.
+   */
+  advanceCounter(expected: number, newCounter: number): Promise<boolean>;
+}
+//#endregion
+export { PasskeyCredential, passkeyCredentialSchema };
+//# sourceMappingURL=passkey-credential.model.d.mts.map

package/esm/models/passkey-credential/passkey-credential.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;;SAWgB,cAAA;EA4Bc;EAAA,IAzBjB,YAAA;EAyBwB;EAAA,IApBxB,OAAA;EAnB0B;EAAA,IAwB1B,MAAA;EAxB+B;EAAA,IA6B/B,QAAA;EA5BG;EAAA,OAiCA,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;EA/B5C;EAAA,OAoCN,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}

package/esm/models/passkey-credential/passkey-credential.model.mjs

@@ -0,0 +1,70 @@
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/passkey-credential/passkey-credential.model.ts
+/** Seal schema for a stored passkey. Exported so an override can extend it. */
+const passkeyCredentialSchema = v.object({
+	credential_id: v.string().required(),
+	public_key: v.string().required(),
+	counter: v.int().required(),
+	transports: v.array(v.string()).optional(),
+	user_id: v.scalar().required(),
+	user_type: v.string().required()
+});
+/**
+* A registered WebAuthn credential. `credential_id` and `public_key` are
+* base64url; `counter` is the last signature counter seen, which an
+* authentication must advance (a clone detector).
+*/
+var PasskeyCredential = class extends Model {
+	static {
+		this.table = "passkey_credentials";
+	}
+	static {
+		this.schema = passkeyCredentialSchema;
+	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
+	/** base64url credential id. */
+	get credentialId() {
+		return this.get("credential_id");
+	}
+	/** Last signature counter seen. */
+	get counter() {
+		return Number(this.get("counter") ?? 0);
+	}
+	/** The owner's id. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The owner's type slug. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/** Find a credential by its base64url id. */
+	static findByCredentialId(credentialId) {
+		return this.first({ credential_id: credentialId });
+	}
+	/** Every credential the user registered. */
+	static listFor(user) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType
+		}).get();
+	}
+	/**
+	* Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,
+	* so two concurrent assertions with the same counter cannot both succeed.
+	*/
+	async advanceCounter(expected, newCounter) {
+		return await this.constructor.atomic({
+			id: this.id,
+			counter: expected
+		}, { $set: { counter: newCounter } }) > 0;
+	}
+};
+
+//#endregion
+export { PasskeyCredential, passkeyCredentialSchema };
+//# sourceMappingURL=passkey-credential.model.mjs.map

package/esm/models/passkey-credential/passkey-credential.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-credential.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a stored passkey. Exported so an override can extend it. */\nexport const passkeyCredentialSchema = v.object({\n  credential_id: v.string().required(),\n  public_key: v.string().required(),\n  counter: v.int().required(),\n  transports: v.array(v.string()).optional(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n});\n\n/**\n * A registered WebAuthn credential. `credential_id` and `public_key` are\n * base64url; `counter` is the last signature counter seen, which an\n * authentication must advance (a clone detector).\n */\nexport class PasskeyCredential extends Model {\n  public static table = \"passkey_credentials\";\n\n  public static schema = passkeyCredentialSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`. No call site deletes a credential today, but the public key\n   * is credential material, so a future `destroy()` here must not leave a\n   * copy in `passkey_credentialsTrash`.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** base64url credential id. */\n  public get credentialId(): string {\n    return this.get(\"credential_id\");\n  }\n\n  /** Last signature counter seen. */\n  public get counter(): number {\n    return Number(this.get(\"counter\") ?? 0);\n  }\n\n  /** The owner's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The owner's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find a credential by its base64url id. */\n  public static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null> {\n    return this.first({ credential_id: credentialId });\n  }\n\n  /** Every credential the user registered. */\n  public static listFor(user: Auth): Promise<PasskeyCredential[]> {\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\n  }\n\n  /**\n   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,\n   * so two concurrent assertions with the same counter cannot both succeed.\n   */\n  public async advanceCounter(expected: number, newCounter: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof PasskeyCredential;\n\n    const updated = await modelClass.atomic(\n      { id: this.id, counter: expected },\n      { $set: { counter: newCounter } },\n    );\n\n    return updated > 0;\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS;CAC1B,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;AAOD,IAAa,oBAAb,cAAuC,MAAM;;eACrB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,eAAuB;EAChC,OAAO,KAAK,IAAI,eAAe;CACjC;;CAGA,IAAW,UAAkB;EAC3B,OAAO,OAAO,KAAK,IAAI,SAAS,KAAK,CAAC;CACxC;;CAGA,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,mBAAmB,cAAyD;EACxF,OAAO,KAAK,MAAM,EAAE,eAAe,aAAa,CAAC;CACnD;;CAGA,OAAc,QAAQ,MAA0C;EAC9D,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;;CAMA,MAAa,eAAe,UAAkB,YAAsC;EAQlF,OAAO,MAPY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,SAAS;EAAS,GACjC,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,CAClC,IAEiB;CACnB;AACF"}

package/esm/models/provider-account/index.d.mts

@@ -0,0 +1 @@
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";

package/esm/models/provider-account/index.mjs

@@ -0,0 +1,3 @@
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+
+export {  };

package/esm/models/provider-account/migration.mjs

@@ -0,0 +1,25 @@
+import { ProviderAccount } from "./provider-account.model.mjs";
+import { migrate } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/provider-account/migration.ts
+const ProviderAccountMigration = migrate(ProviderAccount, {
+	name: "providerAccount",
+	up() {
+		this.createTableIfNotExists();
+		this.primaryUuid();
+		this.string("provider", 50);
+		this.string("provider_user_id", 255);
+		this.foreignId("user_id").index();
+		this.string("user_type", 50).nullable();
+		this.string("email", 255).nullable();
+		this.unique(["provider", "provider_user_id"]);
+		this.timestamps();
+	},
+	down() {
+		this.dropTableIfExists();
+	}
+});
+
+//#endregion
+export { ProviderAccountMigration };
+//# sourceMappingURL=migration.mjs.map

package/esm/models/provider-account/migration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { ProviderAccount } from \"./provider-account.model\";\n\nexport const ProviderAccountMigration = migrate(ProviderAccount, {\n  name: \"providerAccount\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.string(\"provider\", 50);\n    this.string(\"provider_user_id\", 255);\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.string(\"email\", 255).nullable();\n\n    // One app user per provider identity.\n    this.unique([\"provider\", \"provider_user_id\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,2BAA2B,QAAQ,iBAAiB;CAC/D,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,OAAO,YAAY,EAAE;EAC1B,KAAK,OAAO,oBAAoB,GAAG;EACnC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,OAAO,SAAS,GAAG,CAAC,CAAC,SAAS;EAGnC,KAAK,OAAO,CAAC,YAAY,kBAAkB,CAAC;EAE5C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/provider-account/provider-account.model.d.mts

@@ -0,0 +1,75 @@
+import { Auth } from "../auth.model.mjs";
+import { Model } from "@warlock.js/cascade";
+
+//#region ../auth/src/models/provider-account/provider-account.model.d.ts
+/** Seal schema for a provider link. Exported so an override can extend it. */
+declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
+  provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+  provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+}>, import("@warlock.js/seal").InferInputObjectShape<{
+  provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+    isOptional: true;
+  };
+}>>;
+/**
+ * Links a provider identity (`provider` + the provider's stable user id) to
+ * an app user. Created the first time a VERIFIED provider email is matched or
+ * a user is created for it; afterwards the link alone resolves the user, so a
+ * later email change at the provider cannot move the login to another account.
+ */
+declare class ProviderAccount extends Model {
+  static table: string;
+  static schema: import("@warlock.js/seal").ObjectValidator<{
+    provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
+    provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+  }>, import("@warlock.js/seal").InferInputObjectShape<{
+    provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
+      isOptional: true;
+    };
+  }>>;
+  /** The linked user's id. */
+  get userId(): any;
+  /** The linked user's type slug. */
+  get userType(): string;
+  /** Find the link for a provider identity. */
+  static findLink(provider: string, providerUserId: string): Promise<ProviderAccount | null>;
+  /** Link a provider identity to a user. */
+  static link(provider: string, providerUserId: string, user: Auth, email?: string): Promise<ProviderAccount>;
+}
+//#endregion
+export { ProviderAccount, providerAccountSchema };
+//# sourceMappingURL=provider-account.model.d.mts.map

package/esm/models/provider-account/provider-account.model.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,MAAA;EANgB;EAAA,IAWhB,QAAA;EAQA;EAAA,OAHG,QAAA,CACZ,QAAA,UACA,cAAA,WACC,OAAA,CAAQ,eAAA;EAKwD;EAAA,OAArD,IAAA,CAAK,QAAA,UAAkB,cAAA,UAAwB,IAAA,EAAM,IAAA,EAAM,KAAA,YAAc,OAAA,CAAA,eAAA;AAAA"}

package/esm/models/provider-account/provider-account.model.mjs

@@ -0,0 +1,55 @@
+import { Model } from "@warlock.js/cascade";
+import { v } from "@warlock.js/seal";
+
+//#region ../auth/src/models/provider-account/provider-account.model.ts
+/** Seal schema for a provider link. Exported so an override can extend it. */
+const providerAccountSchema = v.object({
+	provider: v.string().required(),
+	provider_user_id: v.string().required(),
+	user_id: v.scalar().required(),
+	user_type: v.string().required(),
+	email: v.string().optional()
+});
+/**
+* Links a provider identity (`provider` + the provider's stable user id) to
+* an app user. Created the first time a VERIFIED provider email is matched or
+* a user is created for it; afterwards the link alone resolves the user, so a
+* later email change at the provider cannot move the login to another account.
+*/
+var ProviderAccount = class extends Model {
+	static {
+		this.table = "provider_accounts";
+	}
+	static {
+		this.schema = providerAccountSchema;
+	}
+	/** The linked user's id. */
+	get userId() {
+		return this.get("user_id");
+	}
+	/** The linked user's type slug. */
+	get userType() {
+		return this.get("user_type");
+	}
+	/** Find the link for a provider identity. */
+	static findLink(provider, providerUserId) {
+		return this.first({
+			provider,
+			provider_user_id: providerUserId
+		});
+	}
+	/** Link a provider identity to a user. */
+	static link(provider, providerUserId, user, email) {
+		return this.create({
+			provider,
+			provider_user_id: providerUserId,
+			user_id: user.id,
+			user_type: user.userType,
+			...email ? { email } : {}
+		});
+	}
+};
+
+//#endregion
+export { ProviderAccount, providerAccountSchema };
+//# sourceMappingURL=provider-account.model.mjs.map

package/esm/models/provider-account/provider-account.model.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-account.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/provider-account.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a provider link. Exported so an override can extend it. */\nexport const providerAccountSchema = v.object({\n  provider: v.string().required(),\n  provider_user_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  email: v.string().optional(),\n});\n\n/**\n * Links a provider identity (`provider` + the provider's stable user id) to\n * an app user. Created the first time a VERIFIED provider email is matched or\n * a user is created for it; afterwards the link alone resolves the user, so a\n * later email change at the provider cannot move the login to another account.\n */\nexport class ProviderAccount extends Model {\n  public static table = \"provider_accounts\";\n\n  public static schema = providerAccountSchema;\n\n  /** The linked user's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The linked user's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find the link for a provider identity. */\n  public static findLink(\n    provider: string,\n    providerUserId: string,\n  ): Promise<ProviderAccount | null> {\n    return this.first({ provider, provider_user_id: providerUserId });\n  }\n\n  /** Link a provider identity to a user. */\n  public static link(provider: string, providerUserId: string, user: Auth, email?: string) {\n    return this.create({\n      provider,\n      provider_user_id: providerUserId,\n      user_id: user.id,\n      user_type: user.userType,\n      ...(email ? { email } : {}),\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;AAQD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,SACZ,UACA,gBACiC;EACjC,OAAO,KAAK,MAAM;GAAE;GAAU,kBAAkB;EAAe,CAAC;CAClE;;CAGA,OAAc,KAAK,UAAkB,gBAAwB,MAAY,OAAgB;EACvF,OAAO,KAAK,OAAO;GACjB;GACA,kBAAkB;GAClB,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EAC3B,CAAC;CACH;AACF"}

package/esm/models/refresh-token/refresh-token.model.d.mts

@@ -139,6 +139,13 @@ declare class RefreshToken extends Model {
       isOptional: true;
     };
   }>>;
+  /**
+   * Permanent regardless of the data source default — Mongo's driver default
+   * is `"trash"`, which would copy live credential material (the JWT itself)
+   * into `refresh_tokensTrash` on every `destroy()` (expiry purge,
+   * never-expiring purge). A purged refresh token must not survive anywhere.
+   */
+  static deleteStrategy: "permanent";
   /** Token family this row belongs to (rotation / replay grouping). */
   get familyId(): string;
   /**

package/esm/models/refresh-token/refresh-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAkBA;;;;;;;;;;cAAa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcnB,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,QAAA;;;;;;;;;;;MAcA,SAAA;;;AApCb;;MAgDa,YAAA;EA7CY;EAAA,IAkDZ,SAAA;EAnDX;EAAA,IAwDW,OAAA;EAvDE;;AAAU;EA8DV,MAAA,IAAU,OAAA;EAjDC;;;;;;;EA4DX,cAAA,IAAkB,OAAA;;;;EAclB,UAAA,IAAc,OAAA;;;;SAOb,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA,GAAwB,OAAA,CAAA,YAAA;;;;SAoBlE,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;;;;;SAQpC,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;;;;SAOhD,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAnC3B;;;EAAA,OA0CZ,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAtBK;;;;;;;;EAAA,OAsC9B,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAhBjB;;;;EAAA,OAgCjB,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;EAAR;;;;;EAAA,OAehC,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;EAoChB;;;;;EAAA,OAhBrB,YAAA,IAAgB,OAAA,CAAQ,YAAA;EA9LZ;;;;;;EAAA,OA8MZ,iBAAA,IAAqB,OAAA,CAAQ,YAAA;;;;;;;;;;SAe7B,kBAAA,IAAsB,OAAA,CAAQ,YAAA;AAAA"}
+{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAkBA;;;;;;;;;;cAAa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcnB,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,cAAA;;MAGH,QAAA;;;;;;;AA9Bb;;;;MA4Ca,SAAA;EA1CX;;;;EAAA,IAsDW,YAAA;EAxCA;EAAA,IA6CA,SAAA;;MAKA,OAAA;;;;EAOE,MAAA,IAAU,OAAA;;;;;;;;EAWV,cAAA,IAAkB,OAAA;;;;EAclB,UAAA,IAAc,OAAA;;;;SAOb,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA,GAAwB,OAAA,CAAA,YAAA;;;;SAoBlE,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAzCnB;;;;EAAA,OAiDjB,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;EA5BkB;;;EAAA,OAmClE,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAPS;;;EAAA,OAchD,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAAf;;;;;;;;EAAA,OAgBV,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA+BG;;;;EAAA,OAfrC,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;EAkEV;;;;;EAAA,OAnD9B,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;EAjL3C;;;;;EAAA,OAqMM,YAAA,IAAgB,OAAA,CAAQ,YAAA;;;;;;;SAgBxB,iBAAA,IAAqB,OAAA,CAAQ,YAAA;;;;;;;;;;SAe7B,kBAAA,IAAsB,OAAA,CAAQ,YAAA;AAAA"}

package/esm/models/refresh-token/refresh-token.model.mjs

@@ -42,6 +42,9 @@ var RefreshToken = class extends Model {
 	static {
 		this.schema = refreshTokenSchema;
 	}
+	static {
+		this.deleteStrategy = "permanent";
+	}
 	/** Token family this row belongs to (rotation / replay grouping). */
 	get familyId() {
 		return this.get("family_id");

package/esm/models/refresh-token/refresh-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport type { DeviceInfo } from \"../../contracts/types\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted refresh-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape:\r\n *\r\n * @example\r\n * export class AppRefreshToken extends RefreshToken {\r\n *   public static schema = refreshTokenSchema.extend({\r\n *     organization_id: v.string().required(),\r\n *   });\r\n * }\r\n */\r\nexport const refreshTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  family_id: v.string().required(),\r\n  expires_at: v.date().required(),\r\n  last_used_at: v.date().default(() => new Date()),\r\n  revoked_at: v.date().optional(),\r\n  device_info: v.record(v.any()).optional(),\r\n});\r\n\r\n/**\r\n * Extra attributes captured when a refresh token is issued.\r\n */\r\nexport type RefreshTokenIssueOptions = {\r\n  familyId: string;\r\n  expiresAt: string;\r\n  deviceInfo?: DeviceInfo;\r\n};\r\n\r\n/**\r\n * Persisted refresh-token record + the data layer for refresh tokens.\r\n *\r\n * **Role.** Owns every refresh-token read, write, and lifecycle transition.\r\n * The auth service drives refresh-token state exclusively through this model's\r\n * named statics and instance methods, so it never hard-codes a column name —\r\n * which is what makes a snake/camel mismatch (the historical `userId` bug)\r\n * structurally impossible and lets an override rename or add columns by\r\n * extending this class and registering it under `config.auth.refreshToken.model`.\r\n */\r\nexport class RefreshToken extends Model {\r\n  public static table = \"refresh_tokens\";\r\n\r\n  public static schema = refreshTokenSchema;\r\n\r\n  /** Token family this row belongs to (rotation / replay grouping). */\r\n  public get familyId(): string {\r\n    return this.get(\"family_id\");\r\n  }\r\n\r\n  /**\r\n   * Whether the token's `expires_at` is in the past.\r\n   *\r\n   * **Fails closed as of 4.12.0**: a missing or unparseable `expires_at` now\r\n   * counts as expired. It previously answered `false` for both — \"no expiry\r\n   * recorded ⇒ never expires\" — which handed an unlimited life to precisely the\r\n   * malformed rows, including the `Invalid Date` a pre-4.12.0 unparseable\r\n   * `expiresIn` could write. `expires_at` is `required` in the schema, so a row\r\n   * that cannot say when it dies is malformed, not immortal.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date().getTime() > new Date(expiresAt).getTime();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing can ever retire this row — an unusable `expires_at`, or a\r\n   * token carrying no `exp` claim. See {@link isNeverExpiring}.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /** Whether the token has been revoked. */\r\n  public get isRevoked(): boolean {\r\n    return !!this.get(\"revoked_at\");\r\n  }\r\n\r\n  /** Whether the token is still usable (not expired and not revoked). */\r\n  public get isValid(): boolean {\r\n    return !this.isExpired && !this.isRevoked;\r\n  }\r\n\r\n  /**\r\n   * Unconditionally stamp `revoked_at` on this token.\r\n   */\r\n  public async revoke(): Promise<this> {\r\n    return this.merge({ revoked_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Atomically revoke this token ONLY if it is still active. Resolves to `true`\r\n   * when this call performed the revoke, `false` when a concurrent request had\r\n   * already revoked it — the win/lose signal that powers rotation replay\r\n   * detection. Uses a conditional UPDATE so two concurrent rotations of the\r\n   * same token can never both succeed.\r\n   */\r\n  public async revokeIfActive(): Promise<boolean> {\r\n    const modelClass = this.constructor as typeof RefreshToken;\r\n\r\n    const revokedCount = await modelClass.atomic(\r\n      { id: this.id, revoked_at: null },\r\n      { $set: { revoked_at: new Date() } },\r\n    );\r\n\r\n    return revokedCount > 0;\r\n  }\r\n\r\n  /**\r\n   * Touch `last_used_at` without revoking — the non-rotating refresh path.\r\n   */\r\n  public async markAsUsed(): Promise<void> {\r\n    await this.merge({ last_used_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed refresh token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, options: RefreshTokenIssueOptions) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      family_id: options.familyId,\r\n      expires_at: options.expiresAt,\r\n      device_info: options.deviceInfo\r\n        ? {\r\n            userAgent: options.deviceInfo.userAgent,\r\n            ip: options.deviceInfo.ip,\r\n            deviceId: options.deviceInfo.deviceId,\r\n          }\r\n        : undefined,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh token scoped to a user — used by logout so a caller can only\r\n   * revoke a token that actually belongs to them.\r\n   */\r\n  public static findForUser(user: Auth, token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific refresh token belonging to the user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Active, unexpired sessions for the user, newest first.\r\n   */\r\n  public static activeFor(user: Auth): Promise<RefreshToken[]> {\r\n    return this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .where(\"expires_at\", \">\", new Date())\r\n      .orderBy(\"created_at\", \"desc\")\r\n      .get();\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active refresh token for the user, returning the rows\r\n   * that were revoked so the caller can emit a per-token event for each.\r\n   *\r\n   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on\r\n   * `revoked_at: null` would re-query the same predicate after the update and\r\n   * match nothing, returning an empty set.\r\n   */\r\n  public static async revokeAllFor(user: Auth): Promise<RefreshToken[]> {\r\n    const tokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active token in a family (rotation breach containment),\r\n   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).\r\n   */\r\n  public static async revokeFamily(familyId: string): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().where({ family_id: familyId, revoked_at: null }).get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke the oldest active tokens so at most `max - 1` remain — making room\r\n   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is\r\n   * small.\r\n   */\r\n  public static async enforceMax(user: Auth, max: number): Promise<void> {\r\n    const activeTokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .orderBy(\"created_at\", \"asc\")\r\n      .get();\r\n\r\n    if (activeTokens.length < max) return;\r\n\r\n    const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);\r\n\r\n    for (const token of tokensToRevoke) {\r\n      await token.revoke();\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired refresh token, returning the deleted rows so the\r\n   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command\r\n   * (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<RefreshToken[]> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}. A full\r\n   * scan filtered in memory, for the reason given on\r\n   * {@link AccessToken.findNeverExpiring}: neither an `Invalid Date` nor a\r\n   * missing `exp` claim is expressible as a `where`.\r\n   */\r\n  public static async findNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: RefreshToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed.\r\n   *\r\n   * Deleted rather than `revoked_at`-stamped: a revoked row is still a row this\r\n   * table has to carry, and one of the two shapes being removed is a row whose\r\n   * date column cannot be compared at all — leaving it in place keeps a\r\n   * permanently unpurgeable record. Rotation replay-detection is unaffected;\r\n   * these rows can no longer be presented successfully either way.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,cAAc,EAAE,KAAK,CAAC,CAAC,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;AAqBD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;CAGvB,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;CAYA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,wBAAO,IAAI,KAAK,EAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;CAC5D;;;;;CAMA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;CAGA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;CAGA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACrD;;;;;;;;CASA,MAAa,iBAAmC;EAQ9C,OAAO,MAPY,KAAK,YAEc,OACpC;GAAE,IAAI,KAAK;GAAI,YAAY;EAAK,GAChC,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC,IAEsB;CACxB;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACtD;;;;CAKA,OAAc,MAAM,MAAY,OAAe,SAAmC;EAChF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,aAAa,QAAQ,aACjB;IACE,WAAW,QAAQ,WAAW;IAC9B,IAAI,QAAQ,WAAW;IACvB,UAAU,QAAQ,WAAW;GAC/B,IACA;EACN,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA6C;EACrE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;;CAMA,OAAc,YAAY,MAAY,OAA6C;EACjF,OAAO,KAAK,MAAM;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAC/C;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,UAAU,MAAqC;EAC3D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,MAAM,CAAC,CAC7B,IAAI;CACT;;;;;;;;;CAUA,aAAoB,aAAa,MAAqC;EACpE,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAC9B,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;CAMA,aAAoB,aAAa,UAA2C;EAC1E,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,WAAW;GAAU,YAAY;EAAK,CAAC,CAAC,CAAC,IAAI;EAEvF,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;;CAOA,aAAoB,WAAW,MAAY,KAA4B;EACrE,MAAM,eAAe,MAAM,KAAK,MAAM,CAAC,CACpC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,QAAQ,cAAc,KAAK,CAAC,CAC5B,IAAI;EAEP,IAAI,aAAa,SAAS,KAAK;EAE/B,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,MAAM,CAAC;EAE1E,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;CAEvB;;;;;;CAOA,aAAoB,eAAwC;EAC1D,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;;;;;;;CAQA,aAAoB,oBAA6C;EAG/D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAwB,MAAM,YAAY;CAClE;;;;;;;;;;CAWA,aAAoB,qBAA8C;EAChE,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport type { DeviceInfo } from \"../../contracts/types\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted refresh-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape:\r\n *\r\n * @example\r\n * export class AppRefreshToken extends RefreshToken {\r\n *   public static schema = refreshTokenSchema.extend({\r\n *     organization_id: v.string().required(),\r\n *   });\r\n * }\r\n */\r\nexport const refreshTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  family_id: v.string().required(),\r\n  expires_at: v.date().required(),\r\n  last_used_at: v.date().default(() => new Date()),\r\n  revoked_at: v.date().optional(),\r\n  device_info: v.record(v.any()).optional(),\r\n});\r\n\r\n/**\r\n * Extra attributes captured when a refresh token is issued.\r\n */\r\nexport type RefreshTokenIssueOptions = {\r\n  familyId: string;\r\n  expiresAt: string;\r\n  deviceInfo?: DeviceInfo;\r\n};\r\n\r\n/**\r\n * Persisted refresh-token record + the data layer for refresh tokens.\r\n *\r\n * **Role.** Owns every refresh-token read, write, and lifecycle transition.\r\n * The auth service drives refresh-token state exclusively through this model's\r\n * named statics and instance methods, so it never hard-codes a column name —\r\n * which is what makes a snake/camel mismatch (the historical `userId` bug)\r\n * structurally impossible and lets an override rename or add columns by\r\n * extending this class and registering it under `config.auth.refreshToken.model`.\r\n */\r\nexport class RefreshToken extends Model {\r\n  public static table = \"refresh_tokens\";\r\n\r\n  public static schema = refreshTokenSchema;\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `refresh_tokensTrash` on every `destroy()` (expiry purge,\r\n   * never-expiring purge). A purged refresh token must not survive anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** Token family this row belongs to (rotation / replay grouping). */\r\n  public get familyId(): string {\r\n    return this.get(\"family_id\");\r\n  }\r\n\r\n  /**\r\n   * Whether the token's `expires_at` is in the past.\r\n   *\r\n   * **Fails closed as of 4.12.0**: a missing or unparseable `expires_at` now\r\n   * counts as expired. It previously answered `false` for both — \"no expiry\r\n   * recorded ⇒ never expires\" — which handed an unlimited life to precisely the\r\n   * malformed rows, including the `Invalid Date` a pre-4.12.0 unparseable\r\n   * `expiresIn` could write. `expires_at` is `required` in the schema, so a row\r\n   * that cannot say when it dies is malformed, not immortal.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date().getTime() > new Date(expiresAt).getTime();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing can ever retire this row — an unusable `expires_at`, or a\r\n   * token carrying no `exp` claim. See {@link isNeverExpiring}.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /** Whether the token has been revoked. */\r\n  public get isRevoked(): boolean {\r\n    return !!this.get(\"revoked_at\");\r\n  }\r\n\r\n  /** Whether the token is still usable (not expired and not revoked). */\r\n  public get isValid(): boolean {\r\n    return !this.isExpired && !this.isRevoked;\r\n  }\r\n\r\n  /**\r\n   * Unconditionally stamp `revoked_at` on this token.\r\n   */\r\n  public async revoke(): Promise<this> {\r\n    return this.merge({ revoked_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Atomically revoke this token ONLY if it is still active. Resolves to `true`\r\n   * when this call performed the revoke, `false` when a concurrent request had\r\n   * already revoked it — the win/lose signal that powers rotation replay\r\n   * detection. Uses a conditional UPDATE so two concurrent rotations of the\r\n   * same token can never both succeed.\r\n   */\r\n  public async revokeIfActive(): Promise<boolean> {\r\n    const modelClass = this.constructor as typeof RefreshToken;\r\n\r\n    const revokedCount = await modelClass.atomic(\r\n      { id: this.id, revoked_at: null },\r\n      { $set: { revoked_at: new Date() } },\r\n    );\r\n\r\n    return revokedCount > 0;\r\n  }\r\n\r\n  /**\r\n   * Touch `last_used_at` without revoking — the non-rotating refresh path.\r\n   */\r\n  public async markAsUsed(): Promise<void> {\r\n    await this.merge({ last_used_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed refresh token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, options: RefreshTokenIssueOptions) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      family_id: options.familyId,\r\n      expires_at: options.expiresAt,\r\n      device_info: options.deviceInfo\r\n        ? {\r\n            userAgent: options.deviceInfo.userAgent,\r\n            ip: options.deviceInfo.ip,\r\n            deviceId: options.deviceInfo.deviceId,\r\n          }\r\n        : undefined,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh token scoped to a user — used by logout so a caller can only\r\n   * revoke a token that actually belongs to them.\r\n   */\r\n  public static findForUser(user: Auth, token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific refresh token belonging to the user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Active, unexpired sessions for the user, newest first.\r\n   */\r\n  public static activeFor(user: Auth): Promise<RefreshToken[]> {\r\n    return this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .where(\"expires_at\", \">\", new Date())\r\n      .orderBy(\"created_at\", \"desc\")\r\n      .get();\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active refresh token for the user, returning the rows\r\n   * that were revoked so the caller can emit a per-token event for each.\r\n   *\r\n   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on\r\n   * `revoked_at: null` would re-query the same predicate after the update and\r\n   * match nothing, returning an empty set.\r\n   */\r\n  public static async revokeAllFor(user: Auth): Promise<RefreshToken[]> {\r\n    const tokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active token in a family (rotation breach containment),\r\n   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).\r\n   */\r\n  public static async revokeFamily(familyId: string): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().where({ family_id: familyId, revoked_at: null }).get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke the oldest active tokens so at most `max - 1` remain — making room\r\n   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is\r\n   * small.\r\n   */\r\n  public static async enforceMax(user: Auth, max: number): Promise<void> {\r\n    const activeTokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .orderBy(\"created_at\", \"asc\")\r\n      .get();\r\n\r\n    if (activeTokens.length < max) return;\r\n\r\n    const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);\r\n\r\n    for (const token of tokensToRevoke) {\r\n      await token.revoke();\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired refresh token, returning the deleted rows so the\r\n   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command\r\n   * (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<RefreshToken[]> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}. A full\r\n   * scan filtered in memory, for the reason given on\r\n   * {@link AccessToken.findNeverExpiring}: neither an `Invalid Date` nor a\r\n   * missing `exp` claim is expressible as a `where`.\r\n   */\r\n  public static async findNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: RefreshToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed.\r\n   *\r\n   * Deleted rather than `revoked_at`-stamped: a revoked row is still a row this\r\n   * table has to carry, and one of the two shapes being removed is a row whose\r\n   * date column cannot be compared at all — leaving it in place keeps a\r\n   * permanently unpurgeable record. Rotation replay-detection is unaffected;\r\n   * these rows can no longer be presented successfully either way.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,cAAc,EAAE,KAAK,CAAC,CAAC,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;AAqBD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;CAYA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,wBAAO,IAAI,KAAK,EAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;CAC5D;;;;;CAMA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;CAGA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;CAGA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACrD;;;;;;;;CASA,MAAa,iBAAmC;EAQ9C,OAAO,MAPY,KAAK,YAEc,OACpC;GAAE,IAAI,KAAK;GAAI,YAAY;EAAK,GAChC,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC,IAEsB;CACxB;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACtD;;;;CAKA,OAAc,MAAM,MAAY,OAAe,SAAmC;EAChF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,aAAa,QAAQ,aACjB;IACE,WAAW,QAAQ,WAAW;IAC9B,IAAI,QAAQ,WAAW;IACvB,UAAU,QAAQ,WAAW;GAC/B,IACA;EACN,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA6C;EACrE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;;CAMA,OAAc,YAAY,MAAY,OAA6C;EACjF,OAAO,KAAK,MAAM;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAC/C;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,UAAU,MAAqC;EAC3D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,MAAM,CAAC,CAC7B,IAAI;CACT;;;;;;;;;CAUA,aAAoB,aAAa,MAAqC;EACpE,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAC9B,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;CAMA,aAAoB,aAAa,UAA2C;EAC1E,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,WAAW;GAAU,YAAY;EAAK,CAAC,CAAC,CAAC,IAAI;EAEvF,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;;CAOA,aAAoB,WAAW,MAAY,KAA4B;EACrE,MAAM,eAAe,MAAM,KAAK,MAAM,CAAC,CACpC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,QAAQ,cAAc,KAAK,CAAC,CAC5B,IAAI;EAEP,IAAI,aAAa,SAAS,KAAK;EAE/B,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,MAAM,CAAC;EAE1E,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;CAEvB;;;;;;CAOA,aAAoB,eAAwC;EAC1D,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;;;;;;;CAQA,aAAoB,oBAA6C;EAG/D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAwB,MAAM,YAAY;CAClE;;;;;;;;;;CAWA,aAAoB,qBAA8C;EAChE,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/otp/index.d.mts

@@ -0,0 +1 @@
+import { requestOtp, verifyOtp } from "./otp.mjs";

package/esm/otp/index.mjs

@@ -0,0 +1,3 @@
+import { requestOtp, verifyOtp } from "./otp.mjs";
+
+export {  };

package/esm/otp/otp.d.mts

@@ -0,0 +1,38 @@
+import { Auth } from "../models/auth.model.mjs";
+import { DeviceInfo, LoginResult } from "../contracts/types.mjs";
+import { ChildModel } from "@warlock.js/cascade";
+
+//#region ../auth/src/otp/otp.d.ts
+/**
+ * Send a 6-digit login code to the account whose `auth.otp.phoneField`
+ * (default `phone`) equals `phone`, through the notifications channel named by
+ * `options.channel` / `auth.otp.channel` (default `"sms"`). Auth ships no
+ * SMS/WhatsApp driver — the app registers that channel.
+ *
+ * The code is stored only as a keyed hash in `one_time_tokens` (purpose
+ * `otp`), expires after `auth.otp.expiresIn` (default 5m), and replaces any
+ * earlier unused code. **Anti-enumeration:** an unknown phone resolves the same
+ * way and sends nothing. Throttle the route with `otpRequestThrottleMiddleware()`.
+ *
+ * @throws AuthProviderSdkMissingError when `@warlock.js/notifications` is not
+ *   installed and no `auth.otp.send` is configured.
+ */
+declare function requestOtp<T extends Auth>(Model: ChildModel<T>, phone: string, options?: {
+  channel?: string;
+}): Promise<void>;
+/**
+ * Verify a phone login code and log the user in through
+ * `authService.completeLogin` — the same outcome as password login.
+ *
+ * Each check first counts an attempt atomically; once `auth.otp.maxAttempts`
+ * (default 5) have been counted the code is invalidated, so it is compared at
+ * most that many times even under concurrent guesses. A correct code is
+ * consumed single-use. Throttle the route with `otpVerifyThrottleMiddleware()`.
+ *
+ * @throws InvalidOneTimeTokenError (400, EC008) — the same for an unknown
+ *   phone, a wrong, expired, used or exhausted code.
+ */
+declare function verifyOtp<T extends Auth>(Model: ChildModel<T>, phone: string, code: string, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+//#endregion
+export { requestOtp, verifyOtp };
+//# sourceMappingURL=otp.d.mts.map

package/esm/otp/otp.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.d.mts","names":[],"sources":["../../../../../../../auth/src/otp/otp.ts"],"mappings":";;;;;;;AAuFA;;;;;;;;;;;;iBAAsB,UAAA,WAAqB,IAAA,EACzC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,KAAA,UACA,OAAA;EAAW,OAAA;AAAA,IACV,OAAA;;;;;AAAO;AAkCV;;;;;;;iBAAsB,SAAA,WAAoB,IAAA,EACxC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,KAAA,UACA,IAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}