@warlock.js/auth 5.12.0 → 5.14.0

package/esm/services/token-notifications.mjs

@@ -0,0 +1,87 @@
+import { authConfig } from "./auth-config.mjs";
+import { NotificationsUnavailableError } from "../errors/notifications-unavailable.error.mjs";
+
+//#region ../auth/src/services/token-notifications.ts
+/** Non-literal on purpose: keeps type-checkers and bundlers from requiring the optional peer. */
+const NOTIFICATIONS_PACKAGE = "@warlock.js/notifications";
+const defaults = /* @__PURE__ */ new Map();
+/**
+* Whether `error` (or an error it wraps as `cause`, as some loaders do) is the
+* resolver saying the notifications package itself is absent. A missing
+* TRANSITIVE dependency names a different package and is rethrown untouched.
+*/
+function isPackageMissing(error) {
+	for (let current = error, depth = 0; current && depth < 5; depth++) {
+		const { code, message } = current;
+		if ((code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") && typeof message === "string" && message.includes(`'${NOTIFICATIONS_PACKAGE}'`)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+async function loadNotifications() {
+	let notifications;
+	try {
+		notifications = await import(NOTIFICATIONS_PACKAGE);
+	} catch (error) {
+		if (isPackageMissing(error)) throw new NotificationsUnavailableError("not-installed", error);
+		throw error;
+	}
+	try {
+		notifications.getNotificationConfig();
+	} catch (error) {
+		throw new NotificationsUnavailableError("not-configured", error);
+	}
+	return notifications;
+}
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function mailBody(intro, data) {
+	const action = data.url ?? data.token;
+	const expires = data.expiresAt.toISOString();
+	return {
+		html: `<p>${intro}</p>` + (data.url ? `<p><a href="${escapeHtml(data.url)}">${escapeHtml(data.url)}</a></p>` : `<p><code>${escapeHtml(data.token)}</code></p>`) + `<p>This link expires at ${expires}. If you did not request it, ignore this email.</p>`,
+		text: `${intro}\n\n${action}\n\nThis link expires at ${expires}. If you did not request it, ignore this email.`
+	};
+}
+function defineDefault(notifications, type) {
+	if (type === "email-verification") return notifications.defineNotification({
+		type: "auth.email-verification",
+		via: ["mail"],
+		mail: (data) => ({
+			subject: "Verify your email address",
+			...mailBody("Confirm your email address to finish setting up your account.", data)
+		})
+	});
+	return notifications.defineNotification({
+		type: "auth.password-reset",
+		via: ["mail"],
+		mail: (data) => ({
+			subject: "Reset your password",
+			...mailBody("Use this to choose a new password.", data)
+		})
+	});
+}
+/**
+* Resolve the notification a token of `type` is delivered through — the app's
+* configured override, else auth's default mail notification.
+*
+* Always confirms `@warlock.js/notifications` is installed AND configured
+* first, even when an override is set, so an app can never issue a token that
+* silently goes nowhere. Throws {@link NotificationsUnavailableError}.
+*/
+async function resolveTokenNotification(type) {
+	const notifications = await loadNotifications();
+	const override = type === "email-verification" ? authConfig.verification.notification() : authConfig.passwordReset.notification();
+	if (override) return override;
+	let notification = defaults.get(type);
+	if (!notification) {
+		notification = defineDefault(notifications, type);
+		defaults.set(type, notification);
+	}
+	return notification;
+}
+
+//#endregion
+export { resolveTokenNotification };
+//# sourceMappingURL=token-notifications.mjs.map

package/esm/services/token-notifications.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-notifications.mjs","names":[],"sources":["../../../../../../../auth/src/services/token-notifications.ts"],"sourcesContent":["import type { AuthNotification, OneTimeTokenNotificationData } from \"../contracts/types\";\nimport { NotificationsUnavailableError } from \"../errors/notifications-unavailable.error\";\nimport { authConfig } from \"./auth-config\";\n\n/** Which token notification to resolve. */\nexport type TokenNotificationType = \"email-verification\" | \"password-reset\";\n\n/**\n * The slice of `@warlock.js/notifications` auth uses. Declared locally because\n * the package is an OPTIONAL peer: auth must type-check and load without it.\n */\ntype NotificationsModule = {\n  getNotificationConfig: () => unknown;\n  defineNotification: (definition: {\n    type: string;\n    via: string[];\n    mail: (data: OneTimeTokenNotificationData) => { subject: string; html: string; text: string };\n  }) => AuthNotification;\n};\n\n/** Non-literal on purpose: keeps type-checkers and bundlers from requiring the optional peer. */\nconst NOTIFICATIONS_PACKAGE: string = \"@warlock.js/notifications\";\n\nconst defaults = new Map<TokenNotificationType, AuthNotification>();\n\n/**\n * Whether `error` (or an error it wraps as `cause`, as some loaders do) is the\n * resolver saying the notifications package itself is absent. A missing\n * TRANSITIVE dependency names a different package and is rethrown untouched.\n */\nfunction isPackageMissing(error: unknown): boolean {\n  for (let current = error, depth = 0; current && depth < 5; depth++) {\n    const { code, message } = current as { code?: unknown; message?: unknown };\n\n    if (\n      (code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\") &&\n      typeof message === \"string\" &&\n      message.includes(`'${NOTIFICATIONS_PACKAGE}'`)\n    ) {\n      return true;\n    }\n\n    current = (current as { cause?: unknown }).cause;\n  }\n\n  return false;\n}\n\nasync function loadNotifications(): Promise<NotificationsModule> {\n  let notifications: NotificationsModule;\n\n  try {\n    notifications = (await import(NOTIFICATIONS_PACKAGE)) as NotificationsModule;\n  } catch (error) {\n    if (isPackageMissing(error)) {\n      throw new NotificationsUnavailableError(\"not-installed\", error);\n    }\n\n    throw error;\n  }\n\n  try {\n    notifications.getNotificationConfig();\n  } catch (error) {\n    throw new NotificationsUnavailableError(\"not-configured\", error);\n  }\n\n  return notifications;\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\nfunction mailBody(intro: string, data: OneTimeTokenNotificationData) {\n  const action = data.url ?? data.token;\n  const expires = data.expiresAt.toISOString();\n\n  return {\n    html:\n      `<p>${intro}</p>` +\n      (data.url\n        ? `<p><a href=\"${escapeHtml(data.url)}\">${escapeHtml(data.url)}</a></p>`\n        : `<p><code>${escapeHtml(data.token)}</code></p>`) +\n      `<p>This link expires at ${expires}. If you did not request it, ignore this email.</p>`,\n    text: `${intro}\\n\\n${action}\\n\\nThis link expires at ${expires}. If you did not request it, ignore this email.`,\n  };\n}\n\nfunction defineDefault(\n  notifications: NotificationsModule,\n  type: TokenNotificationType,\n): AuthNotification {\n  if (type === \"email-verification\") {\n    return notifications.defineNotification({\n      type: \"auth.email-verification\",\n      via: [\"mail\"],\n      mail: (data) => ({\n        subject: \"Verify your email address\",\n        ...mailBody(\"Confirm your email address to finish setting up your account.\", data),\n      }),\n    });\n  }\n\n  return notifications.defineNotification({\n    type: \"auth.password-reset\",\n    via: [\"mail\"],\n    mail: (data) => ({\n      subject: \"Reset your password\",\n      ...mailBody(\"Use this to choose a new password.\", data),\n    }),\n  });\n}\n\n/**\n * Resolve the notification a token of `type` is delivered through — the app's\n * configured override, else auth's default mail notification.\n *\n * Always confirms `@warlock.js/notifications` is installed AND configured\n * first, even when an override is set, so an app can never issue a token that\n * silently goes nowhere. Throws {@link NotificationsUnavailableError}.\n */\nexport async function resolveTokenNotification(\n  type: TokenNotificationType,\n): Promise<AuthNotification> {\n  const notifications = await loadNotifications();\n\n  const override =\n    type === \"email-verification\"\n      ? authConfig.verification.notification()\n      : authConfig.passwordReset.notification();\n\n  if (override) return override;\n\n  let notification = defaults.get(type);\n\n  if (!notification) {\n    notification = defineDefault(notifications, type);\n    defaults.set(type, notification);\n  }\n\n  return notification;\n}\n"],"mappings":";;;;;AAqBA,MAAM,wBAAgC;AAEtC,MAAM,2BAAW,IAAI,IAA6C;;;;;;AAOlE,SAAS,iBAAiB,OAAyB;CACjD,KAAK,IAAI,UAAU,OAAO,QAAQ,GAAG,WAAW,QAAQ,GAAG,SAAS;EAClE,MAAM,EAAE,MAAM,YAAY;EAE1B,KACG,SAAS,0BAA0B,SAAS,uBAC7C,OAAO,YAAY,YACnB,QAAQ,SAAS,IAAI,sBAAsB,EAAE,GAE7C,OAAO;EAGT,UAAW,QAAgC;CAC7C;CAEA,OAAO;AACT;AAEA,eAAe,oBAAkD;CAC/D,IAAI;CAEJ,IAAI;EACF,gBAAiB,MAAM,OAAO;CAChC,SAAS,OAAO;EACd,IAAI,iBAAiB,KAAK,GACxB,MAAM,IAAI,8BAA8B,iBAAiB,KAAK;EAGhE,MAAM;CACR;CAEA,IAAI;EACF,cAAc,sBAAsB;CACtC,SAAS,OAAO;EACd,MAAM,IAAI,8BAA8B,kBAAkB,KAAK;CACjE;CAEA,OAAO;AACT;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,MAAM,OAAO,CAAC,CACtB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,MAAM,CAAC,CACrB,QAAQ,MAAM,QAAQ;AAC3B;AAEA,SAAS,SAAS,OAAe,MAAoC;CACnE,MAAM,SAAS,KAAK,OAAO,KAAK;CAChC,MAAM,UAAU,KAAK,UAAU,YAAY;CAE3C,OAAO;EACL,MACE,MAAM,MAAM,SACX,KAAK,MACF,eAAe,WAAW,KAAK,GAAG,EAAE,IAAI,WAAW,KAAK,GAAG,EAAE,YAC7D,YAAY,WAAW,KAAK,KAAK,EAAE,gBACvC,2BAA2B,QAAQ;EACrC,MAAM,GAAG,MAAM,MAAM,OAAO,2BAA2B,QAAQ;CACjE;AACF;AAEA,SAAS,cACP,eACA,MACkB;CAClB,IAAI,SAAS,sBACX,OAAO,cAAc,mBAAmB;EACtC,MAAM;EACN,KAAK,CAAC,MAAM;EACZ,OAAO,UAAU;GACf,SAAS;GACT,GAAG,SAAS,iEAAiE,IAAI;EACnF;CACF,CAAC;CAGH,OAAO,cAAc,mBAAmB;EACtC,MAAM;EACN,KAAK,CAAC,MAAM;EACZ,OAAO,UAAU;GACf,SAAS;GACT,GAAG,SAAS,sCAAsC,IAAI;EACxD;CACF,CAAC;AACH;;;;;;;;;AAUA,eAAsB,yBACpB,MAC2B;CAC3B,MAAM,gBAAgB,MAAM,kBAAkB;CAE9C,MAAM,WACJ,SAAS,uBACL,WAAW,aAAa,aAAa,IACrC,WAAW,cAAc,aAAa;CAE5C,IAAI,UAAU,OAAO;CAErB,IAAI,eAAe,SAAS,IAAI,IAAI;CAEpC,IAAI,CAAC,cAAc;EACjB,eAAe,cAAc,eAAe,IAAI;EAChD,SAAS,IAAI,MAAM,YAAY;CACjC;CAEA,OAAO;AACT"}

package/esm/utils/auth-error-codes.d.mts

@@ -42,7 +42,45 @@ declare enum AuthErrorCodes {
    * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose
    * request carried neither header at all.
    */
-  CsrfOriginMismatch = "EC006"
+  CsrfOriginMismatch = "EC006",
+  // Error Code 006
+  /**
+   * Email Not Verified Error Code EC007
+   * EC007 = the authenticated user has not verified their email address —
+   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
+   */
+  EmailNotVerified = "EC007",
+  // Error Code 007
+  /**
+   * Invalid One-Time Token Error Code EC008
+   * EC008 = an email-verification or password-reset token that is unknown,
+   * issued for the other purpose, expired, or already used. One code for all
+   * four on purpose: the caller learns nothing about which it was.
+   */
+  InvalidOneTimeToken = "EC008",
+  // Error Code 008
+  /**
+   * Invalid Provider Callback Error Code EC009
+   * EC009 = a redirect-provider callback was rejected: missing, forged or
+   * expired state cookie, `state` mismatch, failed code exchange, or an
+   * id_token with a bad signature, issuer, audience, expiry or nonce.
+   */
+  InvalidProviderCallback = "EC009",
+  // Error Code 009
+  /**
+   * Provider Email Not Verified Error Code EC010
+   * EC010 = the provider did not verify the email, so auth refused to link or
+   * create an account from it.
+   */
+  ProviderEmailNotVerified = "EC010",
+  // Error Code 010
+  /**
+   * Invalid Passkey Error Code EC011
+   * EC011 = a passkey ceremony was rejected: unknown, expired or used
+   * challenge, unknown credential, failed verification, or a signature counter
+   * that did not advance.
+   */
+  InvalidPasskey = "EC011"
 }
 //#endregion
 export { AuthErrorCodes };

package/esm/utils/auth-error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EA4BkB;AAAA;;;EAvBlB,YAAA;EAAA;;;;;;EAMA,eAAA;EAAA;;;;;;;;;EASA,gBAAA;EAAA;;;;;;;;EAQA,kBAAA;AAAA"}
+{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAkCA;;;;EA7BA,YAAA;EAAA;EAwDc;AAAA;;;;EAlDd,eAAA;EAAA;;;;;;;;;EASA,gBAAA;EAAA;;;;;;;;EAQA,kBAAA;EAAA;;;;;;EAMA,gBAAA;EAAA;;;;;;;EAOA,mBAAA;EAAA;;;;;;;EAOA,uBAAA;EAAA;;;;;;EAMA,wBAAA;EAAA;;;;;;;EAOA,cAAA;AAAA"}

package/esm/utils/auth-error-codes.mjs

@@ -38,6 +38,39 @@ let AuthErrorCodes = /* @__PURE__ */ function(AuthErrorCodes) {
 	* request carried neither header at all.
 	*/
 	AuthErrorCodes["CsrfOriginMismatch"] = "EC006";
+	/**
+	* Email Not Verified Error Code EC007
+	* EC007 = the authenticated user has not verified their email address —
+	* thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
+	*/
+	AuthErrorCodes["EmailNotVerified"] = "EC007";
+	/**
+	* Invalid One-Time Token Error Code EC008
+	* EC008 = an email-verification or password-reset token that is unknown,
+	* issued for the other purpose, expired, or already used. One code for all
+	* four on purpose: the caller learns nothing about which it was.
+	*/
+	AuthErrorCodes["InvalidOneTimeToken"] = "EC008";
+	/**
+	* Invalid Provider Callback Error Code EC009
+	* EC009 = a redirect-provider callback was rejected: missing, forged or
+	* expired state cookie, `state` mismatch, failed code exchange, or an
+	* id_token with a bad signature, issuer, audience, expiry or nonce.
+	*/
+	AuthErrorCodes["InvalidProviderCallback"] = "EC009";
+	/**
+	* Provider Email Not Verified Error Code EC010
+	* EC010 = the provider did not verify the email, so auth refused to link or
+	* create an account from it.
+	*/
+	AuthErrorCodes["ProviderEmailNotVerified"] = "EC010";
+	/**
+	* Invalid Passkey Error Code EC011
+	* EC011 = a passkey ceremony was rejected: unknown, expired or used
+	* challenge, unknown credential, failed verification, or a signature counter
+	* that did not advance.
+	*/
+	AuthErrorCodes["InvalidPasskey"] = "EC011";
 	return AuthErrorCodes;
 }({});
 

package/esm/utils/auth-error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n  /**\r\n   * CSRF Origin Mismatch Error Code EC006\r\n   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)\r\n   * request whose `Origin` (or, absent that, `Referer`) did not match the\r\n   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose\r\n   * request carried neither header at all.\r\n   */\r\n  CsrfOriginMismatch = \"EC006\", // Error Code 006\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;;;;;;;CAQA;;AACF"}
+{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n  /**\r\n   * CSRF Origin Mismatch Error Code EC006\r\n   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)\r\n   * request whose `Origin` (or, absent that, `Referer`) did not match the\r\n   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose\r\n   * request carried neither header at all.\r\n   */\r\n  CsrfOriginMismatch = \"EC006\", // Error Code 006\r\n  /**\r\n   * Email Not Verified Error Code EC007\r\n   * EC007 = the authenticated user has not verified their email address —\r\n   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).\r\n   */\r\n  EmailNotVerified = \"EC007\", // Error Code 007\r\n  /**\r\n   * Invalid One-Time Token Error Code EC008\r\n   * EC008 = an email-verification or password-reset token that is unknown,\r\n   * issued for the other purpose, expired, or already used. One code for all\r\n   * four on purpose: the caller learns nothing about which it was.\r\n   */\r\n  InvalidOneTimeToken = \"EC008\", // Error Code 008\r\n  /**\r\n   * Invalid Provider Callback Error Code EC009\r\n   * EC009 = a redirect-provider callback was rejected: missing, forged or\r\n   * expired state cookie, `state` mismatch, failed code exchange, or an\r\n   * id_token with a bad signature, issuer, audience, expiry or nonce.\r\n   */\r\n  InvalidProviderCallback = \"EC009\", // Error Code 009\r\n  /**\r\n   * Provider Email Not Verified Error Code EC010\r\n   * EC010 = the provider did not verify the email, so auth refused to link or\r\n   * create an account from it.\r\n   */\r\n  ProviderEmailNotVerified = \"EC010\", // Error Code 010\r\n  /**\r\n   * Invalid Passkey Error Code EC011\r\n   * EC011 = a passkey ceremony was rejected: unknown, expired or used\r\n   * challenge, unknown credential, failed verification, or a signature counter\r\n   * that did not advance.\r\n   */\r\n  InvalidPasskey = \"EC011\", // Error Code 011\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;;;;;;;CAQA;;;;;;CAMA;;;;;;;CAOA;;;;;;;CAOA;;;;;;CAMA;;;;;;;CAOA;;AACF"}

package/esm/utils/index.mjs

@@ -1,4 +1,5 @@
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./token-expiry.mjs";
 import { AuthErrorCodes } from "./auth-error-codes.mjs";
+import { safeEqual } from "./safe-equal.mjs";
 
 export {  };

package/esm/utils/safe-equal.d.mts

@@ -0,0 +1,6 @@
+//#region ../auth/src/utils/safe-equal.d.ts
+/** Constant-time string equality; strings of unequal length are simply unequal. */
+declare function safeEqual(left: string, right: string): boolean;
+//#endregion
+export { safeEqual };
+//# sourceMappingURL=safe-equal.d.mts.map

package/esm/utils/safe-equal.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../auth/src/utils/safe-equal.ts"],"mappings":";;iBAGgB,SAAA,CAAU,IAAA,UAAc,KAAa"}

package/esm/utils/safe-equal.mjs

@@ -0,0 +1,13 @@
+import { timingSafeEqual } from "node:crypto";
+
+//#region ../auth/src/utils/safe-equal.ts
+/** Constant-time string equality; strings of unequal length are simply unequal. */
+function safeEqual(left, right) {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+
+//#endregion
+export { safeEqual };
+//# sourceMappingURL=safe-equal.mjs.map

package/esm/utils/safe-equal.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-equal.mjs","names":[],"sources":["../../../../../../../auth/src/utils/safe-equal.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\n\n/** Constant-time string equality; strings of unequal length are simply unequal. */\nexport function safeEqual(left: string, right: string): boolean {\n  const a = Buffer.from(left);\n  const b = Buffer.from(right);\n\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n"],"mappings":";;;;AAGA,SAAgB,UAAU,MAAc,OAAwB;CAC9D,MAAM,IAAI,OAAO,KAAK,IAAI;CAC1B,MAAM,IAAI,OAAO,KAAK,KAAK;CAE3B,OAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD"}

package/llms-full.txt

@@ -553,6 +553,164 @@ Full event list: `login.attempt`, `login.success`, `login.failed`, `logout`, `lo
 - [`@warlock.js/auth/protect-routes/SKILL.md`](@warlock.js/auth/protect-routes/SKILL.md) — where the access token gets consumed
 
 
+## login-with-providers  `@warlock.js/auth/login-with-providers/SKILL.md`
+
+---
+name: login-with-providers
+description: 'Log in without a password — Google (OIDC code + PKCE + state + nonce, id_token verified with `jose`), passkeys (WebAuthn via `@simplewebauthn/server`) and phone one-time codes (delivered through a `@warlock.js/notifications` channel). Every method ends in `authService.completeLogin(user)`, the same tokens, rows and events as password login. `startProviderLogin`, `completeProviderLogin`, `generatePasskeyRegistrationOptions`, `verifyPasskeyRegistration`, `generatePasskeyAuthenticationOptions`, `verifyPasskeyAuthentication`, `requestOtp`, `verifyOtp`, `otpRequestThrottleMiddleware`, `otpVerifyThrottleMiddleware`, `AuthProvider`. Triggers: "login with Google", "sign in with Google", "OAuth", "OIDC", "passkeys", "WebAuthn", "passwordless", "SMS code login", "WhatsApp OTP", "phone login", `warlock add auth-google`, `warlock add auth-passkeys`, `AuthProviderSdkMissingError`, `InvalidProviderCallbackError`, `ProviderEmailNotVerifiedError`, `InvalidPasskeyError`, `EC009`, `EC010`, `EC011`, `auth.providers`, `auth.passkeys`, `auth.otp`; typical import `import { completeProviderLogin, verifyOtp } from "@warlock.js/auth"`. Skip: password login — `@warlock.js/auth/handle-login-and-logout/SKILL.md`; email tokens — `@warlock.js/auth/verify-email-and-reset-password/SKILL.md`; defining an SMS channel — `@warlock.js/notifications/define-channel/SKILL.md`.'
+---
+
+# Login with Google, passkeys, or a phone code
+
+Services only, as with password login: you write the routes. Each `verify`/`complete` call returns the same `LoginResult` as `authService.login`, so the next step is the same too:
+
+```ts
+const { user, tokens } = await completeProviderLogin(User, "google", request, response);
+authService.setAuthCookie(response, tokens.accessToken); // cookie session, or return tokens as JSON
+```
+
+`authService.completeLogin(user, deviceInfo?)` is that shared ending. It applies `auth.canAuthenticate` (403) and issues tokens. Call it only for a user you have already authenticated.
+
+## Install
+
+| Method | Command | Installs |
+| --- | --- | --- |
+| Google | `warlock add auth-google` | `jose` |
+| Passkeys | `warlock add auth-passkeys` | `@simplewebauthn/server` (add `@simplewebauthn/browser` to your client bundle) |
+| Phone code | `warlock add notifications` + your own `sms`/`whatsapp` channel | nothing else. Auth ships no SMS/WhatsApp driver |
+
+The SDKs are optional peers, loaded with `import()` only when a method runs. If one is missing, the call throws `AuthProviderSdkMissingError` (500), and the message names the `warlock add` command. Run the migrations: `authMigrations` now includes `provider_accounts` and `passkey_credentials`, and `one_time_tokens` gained an `attempts` column.
+
+## Google
+
+```ts
+// src/config/auth.ts
+providers: {
+  google: {
+    clientId: env("GOOGLE_CLIENT_ID"),
+    clientSecret: env("GOOGLE_CLIENT_SECRET"),
+    redirectUri: `${env("APP_URL")}/auth/google/callback`, // exactly as registered at Google
+    // scopes: ["openid", "email", "profile"],
+  },
+  // emailField: "email",
+  // createUser: async (profile, Model) => Model.create({ ... }),
+},
+```
+
+```ts
+router.get("/auth/google", async ({ response }) =>
+  response.redirect(await startProviderLogin(response, "google")),
+);
+
+router.get("/auth/google/callback", async ({ request, response }) => {
+  const { tokens } = await completeProviderLogin(User, "google", request, response);
+  authService.setAuthCookie(response, tokens.accessToken);
+  return response.redirect("/");
+});
+```
+
+Client side, the button is just a link. It must be a top-level navigation, not a `fetch`, so the state cookie goes out and comes back:
+
+```tsx
+<a href="/auth/google">Continue with Google</a>
+```
+
+- `state`, `nonce` and the PKCE verifier go into a signed, 10-minute, HttpOnly `auth_provider_state` cookie (SameSite=Lax, so it survives Google's redirect back). The callback clears the cookie, so a started login can complete only once.
+- The callback rejects, with `InvalidProviderCallbackError` (400, `EC009`): a missing, forged or expired cookie, a `state` mismatch, a `?error=` from Google, a failed code exchange, and an id_token with a bad signature, `iss`, `aud`, `exp` or `nonce`. `error.reason` says which. The response message is generic.
+- **Linking.** An existing `provider_accounts` row (provider plus Google `sub`) always decides the user. Without one, the Google email must be verified (`email_verified: true`), or the call throws `ProviderEmailNotVerifiedError` (403, `EC010`) and nothing is linked or created. A verified email links the matching user, or creates one with `{ email, name, emailVerifiedAt: now }`.
+- Other OIDC providers: implement `AuthProvider` (`authorizationUrl(state)`, `handleCallback({ query, expected })`) and register it under `auth.providers.custom.<name>`.
+
+## Passkeys
+
+```ts
+passkeys: { rpID: "example.com", rpName: "Example", origin: "https://example.com" },
+```
+
+```ts
+// Register (logged in)
+router.post("/auth/passkeys/register/options", async ({ request, response }) =>
+  response.success(await generatePasskeyRegistrationOptions(request.locals.user)),
+  { middleware: [authMiddleware("user")] });
+router.post("/auth/passkeys/register", async ({ request, response }) => {
+  await verifyPasskeyRegistration(request, request.locals.user, request.input("credential"));
+  return response.success({ registered: true });
+}, { middleware: [authMiddleware("user")] });
+
+// Log in
+router.post("/auth/passkeys/login/options", async ({ response }) =>
+  response.success(await generatePasskeyAuthenticationOptions()));
+router.post("/auth/passkeys/login", async ({ request, response }) => {
+  const { tokens } = await verifyPasskeyAuthentication(request, request.input("credential"));
+  authService.setAuthCookie(response, tokens.accessToken);
+  return response.success({ ok: true });
+});
+```
+
+Browser:
+
+```ts
+import { startAuthentication, startRegistration } from "@simplewebauthn/browser";
+
+const post = (url: string, body?: unknown) =>
+  fetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body) })
+    .then((r) => r.json());
+
+// register
+const regOptions = await post("/auth/passkeys/register/options");
+await post("/auth/passkeys/register", { credential: await startRegistration({ optionsJSON: regOptions }) });
+
+// log in
+const authOptions = await post("/auth/passkeys/login/options");
+await post("/auth/passkeys/login", { credential: await startAuthentication({ optionsJSON: authOptions }) });
+```
+
+(Unwrap `response.success`'s envelope if your app wraps payloads.)
+
+- Challenges live in `one_time_tokens` as SHA-256 hashes, expire after 5m (`auth.passkeys.challengeExpiresIn`), and are **consumed before verification**. A replayed challenge fails, and so does one whose first verification failed.
+- The request `Origin` must be one of `auth.passkeys.origin`. The same list is checked against the signed `clientDataJSON`.
+- The signature counter must advance. A counter that did not move past the stored value (when either is non-zero) is rejected as a cloned authenticator. The new counter is saved with a compare-and-set.
+- Every rejection throws `InvalidPasskeyError` (400, `EC011`) with a `reason`.
+
+## Phone code (OTP)
+
+```ts
+otp: { channel: "sms" /* or "whatsapp" */, phoneField: "phone", expiresIn: "5m", maxAttempts: 5 },
+```
+
+```ts
+router.post("/auth/otp/request", async ({ request, response }) => {
+  await requestOtp(User, request.input("phone"), { channel: request.input("via") === "whatsapp" ? "whatsapp" : "sms" });
+  return response.success({ message: "If that number is registered, a code is on its way." });
+}, { middleware: [otpRequestThrottleMiddleware()] }); // 3 / 1h per phone + IP
+
+router.post("/auth/otp/verify", async ({ request, response }) => {
+  const { tokens } = await verifyOtp(User, request.input("phone"), request.input("code"));
+  authService.setAuthCookie(response, tokens.accessToken);
+  return response.success({ ok: true });
+}, { middleware: [otpVerifyThrottleMiddleware()] }); // 5 failures / 15m per phone + IP
+```
+
+- Codes have 6 digits and are stored in `one_time_tokens` (purpose `otp`) as a salted HMAC keyed from your access-token secret, never as plain SHA-256, which is trivially reversible for 6 digits. A new request invalidates the previous code.
+- Every verify counts an attempt atomically first. After `maxAttempts` the code is invalidated, even if the right code comes next, and even under concurrent guesses.
+- Delivery: `notify.channel(channel).send(phone, { body, code, expiresAt })`. Register that channel in `config/notifications.ts`, or set `auth.otp.send(phone, message, channel)`. `auth.otp.message(code)` changes the text.
+- **Anti-enumeration:** an unknown phone gets the same `requestOtp` result (nothing sent) and the same `InvalidOneTimeTokenError` (400, `EC008`) from `verifyOtp`.
+- CSRF: `verifyOtp` is a POST. If the route uses cookie auth, the 5.12 Origin check applies. Otherwise there is no ambient credential to ride.
+
+## Gotchas
+
+- `completeProviderLogin` needs the **same** response object to clear the state cookie. Do not pass a different one.
+- One provider identity links to one account, of one user type.
+- `auth.cleanup` hard-deletes expired and consumed `one_time_tokens` rows (challenges and codes included).
+- The passkey specs run the real `@simplewebauthn/server` against a software ES256 authenticator, and the consume-once, OTP attempt cap, counter compare-and-set and provider-link uniqueness are proven on real MongoDB and Postgres. Google's token endpoint is still mocked, so test a real Google client before you ship.
+- A counter the SDK rejects is reported with `reason: "counter-regression"`, the same as auth's own check.
+
+## See also
+
+- [`@warlock.js/auth/handle-login-and-logout/SKILL.md`](@warlock.js/auth/handle-login-and-logout/SKILL.md): password login and `setAuthCookie`
+- [`@warlock.js/auth/throttle-login-attempts/SKILL.md`](@warlock.js/auth/throttle-login-attempts/SKILL.md): the throttle the OTP presets wrap
+- [`@warlock.js/notifications/define-channel/SKILL.md`](@warlock.js/notifications/define-channel/SKILL.md): an SMS/WhatsApp channel
+
+
 ## manage-tokens  `@warlock.js/auth/manage-tokens/SKILL.md`
 
 ---
@@ -677,10 +835,16 @@ When issuing a new refresh token, the service counts active tokens for the user
 
 ```ts
 const cleaned = await authService.cleanupExpiredTokens();
-// Returns: number of expired refresh tokens removed (also purges expired access-token rows).
+// Returns: number of expired refresh tokens removed (also purges expired access-token rows
+// and hard-deletes expired or consumed one_time_tokens rows).
 // Fires "token.expired" event per token + "cleanup.completed" with the count.
 ```
 
+Every purge is a hard delete on every driver, including MongoDB. `AccessToken`, `RefreshToken`,
+`OneTimeToken` and `PasskeyCredential` all declare `static deleteStrategy = "permanent"`, so a
+purge never copies credential material into a `*Trash` collection despite MongoDB's driver
+default being `"trash"`.
+
 Run this periodically via the scheduler:
 
 ```ts
@@ -1156,22 +1320,20 @@ Without this, `JSON.stringify(user)` in your response leaks the hash.
 
 ## Email verification flow (extending registration)
 
-Common pattern: create the user as `email_verified = false`, send a verification email, mark verified on click. The auth package doesn't ship this; build it on top:
+Since 5.13 auth ships this. Declare `emailVerifiedAt: v.date().optional()` on the schema, then send the verification after creating the user:
 
 ```ts
-const user = await User.create({
-  ...data,
-  email_verified: false,
-  verification_token: Random.string(64),
-});
+import { authService, sendEmailVerification } from "@warlock.js/auth";
+
+const user = await User.create({ ...data, password: await hashPassword(data.password) });
 
-await mailer.sendVerificationEmail(user.get("email"), user.get("verification_token"));
+await sendEmailVerification(user); // hashed, single-use, 24h token via @warlock.js/notifications
 
 const tokens = await authService.createTokenPair(user);
 return response.successCreate({ user, tokens });
 ```
 
-Optional: pre-verification, restrict the user to a `unverified` user-type and gate routes accordingly via `authMiddleware("user")`. After verification, swap user-type to `user`.
+Gate routes that need a confirmed address with `requireVerifiedEmail()` after `authMiddleware`. See [`@warlock.js/auth/verify-email-and-reset-password/SKILL.md`](@warlock.js/auth/verify-email-and-reset-password/SKILL.md).
 
 ## Side effects via auth events
 
@@ -1254,7 +1416,7 @@ Run it once when setting up a new project. Each developer typically runs it loca
 npx warlock auth.cleanup
 ```
 
-Runs `authService.cleanupExpiredTokens()` — deletes every refresh token whose `expires_at` has passed, then sweeps expired access-token rows too. Fires `token.expired` per refresh token and `cleanup.completed` once.
+Runs `authService.cleanupExpiredTokens()` — deletes every refresh token whose `expires_at` has passed, then sweeps expired access-token rows and hard-deletes expired or consumed `one_time_tokens` rows (verification/reset tokens, OTP codes, passkey challenges). Fires `token.expired` per refresh token and `cleanup.completed` once.
 
 Schedule it periodically. Two common shapes:
 
@@ -1472,3 +1634,144 @@ They compose. For a hard ceiling on request volume *and* failure-aware account l
 - [`@warlock.js/core/use-middleware/SKILL.md`](@warlock.js/core/use-middleware/SKILL.md) — `middleware.rateLimit` and the built-in middleware suite.
 
 
+## verify-email-and-reset-password  `@warlock.js/auth/verify-email-and-reset-password/SKILL.md`
+
+---
+name: verify-email-and-reset-password
+description: 'Email verification and password reset with hashed, single-use, expiring, purpose-bound tokens delivered through `@warlock.js/notifications` — `sendEmailVerification(user)`, `verifyEmail(token)`, `requestPasswordReset(Model, email)`, `resetPassword(token, newPassword)`, the `requireVerifiedEmail()` guard, and the `tokenIssueThrottleMiddleware` / `tokenConsumeThrottleMiddleware` presets. Reset revokes every access token, refresh token and cookie session; a reset request answers the same for unknown emails. Triggers: `sendEmailVerification`, `verifyEmail`, `requestPasswordReset`, `resetPassword`, `requireVerifiedEmail`, `isEmailVerified`, `OneTimeToken`, `InvalidOneTimeTokenError`, `EmailNotVerifiedError`, `NotificationsUnavailableError`, `EC007`, `EC008`, `auth.verification`, `auth.passwordReset`; "verify email", "confirm email address", "forgot password", "reset password link", "block unverified users", "resend verification email"; typical import `import { requestPasswordReset, resetPassword } from "@warlock.js/auth"`. Skip: sign-up itself — `@warlock.js/auth/register-user/SKILL.md`; login throttling — `@warlock.js/auth/throttle-login-attempts/SKILL.md`; defining notifications — `@warlock.js/notifications/define-notification/SKILL.md`.'
+---
+
+# Verify email + reset password
+
+Four service functions, one guard, two throttle presets. Auth ships no controllers — wire the routes yourself (examples below).
+
+## Prerequisites
+
+1. **`@warlock.js/notifications` installed and configured with a `mail` channel.** It is an optional peer; without it (or without `src/config/notifications.ts`) every send/request call throws `NotificationsUnavailableError` **before** a token is issued — never a silent skip.
+2. **The `one_time_tokens` table.** It ships in `authMigrations` next to the access/refresh tables; run your migrations.
+3. **A verified-date field on the user schema** (default `emailVerifiedAt`):
+
+```ts
+export const userSchema = v.object({
+  // ...
+  emailVerifiedAt: v.date().optional(),
+});
+```
+
+If the schema strips it, `verifyEmail` throws naming the field instead of pretending it worked.
+
+## Tokens
+
+- 32 random bytes, base64url. Only the **SHA-256 hash** is stored; the raw token exists only in the notification.
+- **Single use**, consumed with a conditional update — of two concurrent uses, exactly one succeeds.
+- **Expiring**: verification `24h`, reset `60m` by default.
+- **Purpose-bound**: a verification token is never accepted by `resetPassword`, and vice versa.
+- A new reset request **invalidates the user's earlier unused reset tokens**. Verification tokens are not invalidated by a resend.
+- Unknown, wrong-purpose, expired and used tokens all throw one `InvalidOneTimeTokenError` (`400`, `EC008`).
+
+## Email verification
+
+```ts
+import { requireVerifiedEmail, sendEmailVerification, verifyEmail } from "@warlock.js/auth";
+import { type RequestHandler } from "@warlock.js/core";
+
+// after User.create(...) in your register controller
+await sendEmailVerification(user);
+
+export const verifyEmailController: RequestHandler = async ({ request, response }) => {
+  const user = await verifyEmail(request.input("token")); // throws InvalidOneTimeTokenError
+  return response.success({ user });
+};
+
+router.post("/auth/verify-email", verifyEmailController, {
+  middleware: [tokenConsumeThrottleMiddleware()],
+});
+
+router.post("/auth/verify-email/resend", resendController, {
+  middleware: [authMiddleware("user"), tokenIssueThrottleMiddleware({ by: ["ip"] })],
+});
+
+// Opt-in guard, AFTER authMiddleware: 403 EmailNotVerifiedError (EC007)
+router.post("/orders", createOrder, {
+  middleware: [authMiddleware("user"), requireVerifiedEmail()],
+});
+```
+
+`isEmailVerified(user)` answers the same question in code.
+
+## Password reset
+
+```ts
+import { requestPasswordReset, resetPassword } from "@warlock.js/auth";
+
+export const forgotPasswordController: RequestHandler = async ({ request, response }) => {
+  await requestPasswordReset(User, request.input("email"));
+  // Same answer whether or not the account exists.
+  return response.success({ message: "If that account exists, we sent a reset link." });
+};
+
+export const resetPasswordController: RequestHandler = async ({ request, response }) => {
+  // Validate strength FIRST — the token is consumed before the password is written.
+  await resetPassword(request.input("token"), request.input("password"));
+  return response.success({ message: "Password updated. Please log in again." });
+};
+
+router.post("/auth/forgot-password", forgotPasswordController, {
+  middleware: [tokenIssueThrottleMiddleware()], // 3 / 1h per email + per IP
+});
+router.post("/auth/reset-password", resetPasswordController, {
+  middleware: [tokenConsumeThrottleMiddleware()], // 10 failures / 15m per IP
+});
+```
+
+`resetPassword` writes the password, then calls `authService.revokeAllTokens(user)`: every refresh token is revoked and every access token deleted, which also kills cookie sessions (a cookie holds an access token). It emits `password.reset`; `requestPasswordReset` emits `password.resetRequested`.
+
+**Password hashing.** By default auth saves `hashPassword(plain)` and checks it with `verifyPassword`, the same check login uses. If your model hashes on save (`useHashedPassword()`), that first write gets hashed twice and fails the check, so auth saves the plaintext and lets your transformer hash it once. If neither write passes the check, it throws. Plaintext is never the first thing written. To write it yourself, set `auth.passwordReset.setPassword`.
+
+## Throttling
+
+Both presets wrap `loginThrottleMiddleware` and accept its options:
+
+| Preset | Tracks | Counts | Default |
+| --- | --- | --- | --- |
+| `tokenIssueThrottleMiddleware` | email + IP | **every** request (a reset request's success is the anti-enumeration answer, so failure-aware counting would never trip) | 3 / 1h, 1h lock |
+| `tokenConsumeThrottleMiddleware` | IP | failures only, cleared on success | 10 / 15m, 15m lock |
+
+## Configuration (`src/config/auth.ts`)
+
+```ts
+const authConfigurations: AuthConfigurations = {
+  // ...
+  verification: {
+    expiresIn: "24h",
+    field: "emailVerifiedAt",
+    url: (token) => `${env("APP_URL")}/verify-email?token=${token}`,
+    notification: myVerificationNotification, // optional replacement
+  },
+  passwordReset: {
+    expiresIn: "60m",
+    identifierField: "email",
+    url: (token) => `${env("APP_URL")}/reset-password?token=${token}`,
+    notification: myResetNotification,
+    setPassword: async (user, plain) => { /* optional */ },
+  },
+  oneTimeToken: { model: AppOneTimeToken }, // optional model override
+};
+```
+
+The default notifications are `defineNotification` objects (`type: "auth.email-verification"` / `"auth.password-reset"`, `via: ["mail"]`). To replace one, pass anything with a `send(user, { token, expiresAt, url? })` method, for example your own `defineNotification<OneTimeTokenNotificationData>({...})`. `notifications` still has to be installed and configured.
+
+## Gotchas
+
+- **Without `url` config, the email contains the raw token**, not a link. Set `url` for anything user-facing.
+- **Timing isn't equalised.** An unknown email skips the database write and the send, so the response can come back measurably faster. The throttle limits probing, but it doesn't hide the timing difference.
+- **Channel send failures don't throw.** `@warlock.js/notifications` only rethrows configuration errors (such as a missing `mail` channel). An SMTP failure goes to its `failed` event, so observe it there.
+- `auth.cleanup` hard-deletes expired and consumed `one_time_tokens` rows (never trashed, even on MongoDB).
+
+## See also
+
+- [`@warlock.js/auth/register-user/SKILL.md`](@warlock.js/auth/register-user/SKILL.md) — where `sendEmailVerification` is usually called
+- [`@warlock.js/auth/throttle-login-attempts/SKILL.md`](@warlock.js/auth/throttle-login-attempts/SKILL.md) — the underlying throttle
+- [`@warlock.js/notifications/configure-notifications/SKILL.md`](@warlock.js/notifications/configure-notifications/SKILL.md) — mail channel setup
+
+

package/llms.txt

@@ -10,9 +10,11 @@
 - [customize-token-storage](@warlock.js/auth/customize-token-storage/SKILL.md): (no description)
 - [customize-user-type](@warlock.js/auth/customize-user-type/SKILL.md): (no description)
 - [handle-login-and-logout](@warlock.js/auth/handle-login-and-logout/SKILL.md): (no description)
+- [login-with-providers](@warlock.js/auth/login-with-providers/SKILL.md): Log in without a password — Google (OIDC code + PKCE + state + nonce, id_token verified with `jose`), passkeys (WebAuthn via `@simplewebauthn/server`) and phone one-time codes (delivered through a `@warlock.js/notifications` channel). Every method ends in `authService.completeLogin(user)`, the same tokens, rows and events as password login. `startProviderLogin`, `completeProviderLogin`, `generatePasskeyRegistrationOptions`, `verifyPasskeyRegistration`, `generatePasskeyAuthenticationOptions`, `verifyPasskeyAuthentication`, `requestOtp`, `verifyOtp`, `otpRequestThrottleMiddleware`, `otpVerifyThrottleMiddleware`, `AuthProvider`. Triggers: "login with Google", "sign in with Google", "OAuth", "OIDC", "passkeys", "WebAuthn", "passwordless", "SMS code login", "WhatsApp OTP", "phone login", `warlock add auth-google`, `warlock add auth-passkeys`, `AuthProviderSdkMissingError`, `InvalidProviderCallbackError`, `ProviderEmailNotVerifiedError`, `InvalidPasskeyError`, `EC009`, `EC010`, `EC011`, `auth.providers`, `auth.passkeys`, `auth.otp`; typical import `import { completeProviderLogin, verifyOtp } from "@warlock.js/auth"`. Skip: password login — `@warlock.js/auth/handle-login-and-logout/SKILL.md`; email tokens — `@warlock.js/auth/verify-email-and-reset-password/SKILL.md`; defining an SMS channel — `@warlock.js/notifications/define-channel/SKILL.md`.
 - [manage-tokens](@warlock.js/auth/manage-tokens/SKILL.md): (no description)
 - [overview](@warlock.js/auth/overview/SKILL.md): (no description)
 - [protect-routes](@warlock.js/auth/protect-routes/SKILL.md): (no description)
 - [register-user](@warlock.js/auth/register-user/SKILL.md): Sign up a new user and issue the initial token pair — User.create({...password: await hashPassword(plain)}) then authService.createTokenPair(user). Triggers: `User.create`, `hashPassword`, `verifyPassword`, `authService.createTokenPair`, `toJsonColumns`, `strongPassword`, `authEvents`; "build a register endpoint", "POST /register controller", "sign up a new user", "hash password on signup", "email verification flow"; typical import `import { authService } from "@warlock.js/auth"; import { hashPassword } from "@warlock.js/core"`. Skip: login — `@warlock.js/auth/handle-login-and-logout/SKILL.md`; token internals — `@warlock.js/auth/manage-tokens/SKILL.md`; competing libs `bcrypt`, `bcryptjs`, `argon2`.
 - [run-auth-commands](@warlock.js/auth/run-auth-commands/SKILL.md): Three bundled CLI commands — warlock jwt.generate (creates strong JWT secret + writes to .env), warlock auth.cleanup (removes expired refresh tokens), and warlock auth.purge-never-expiring (finds and revokes token rows that can never expire). Register via registerJWTSecretGeneratorCommand(), registerAuthCleanupCommand() and registerAuthPurgeNeverExpiringCommand(). Triggers: `registerJWTSecretGeneratorCommand`, `registerAuthCleanupCommand`, `registerAuthPurgeNeverExpiringCommand`, `warlock jwt.generate`, `warlock auth.cleanup`, `warlock auth.purge-never-expiring`, `cleanupExpiredTokens`, `purgeNeverExpiringTokens`, `command`; "token never expires", "no exp claim", "Invalid Date expires_at"; "generate JWT secret", "bootstrap .env JWT_SECRET", "cron job for expired tokens", "schedule auth cleanup"; typical import `import { registerJWTSecretGeneratorCommand, registerAuthCleanupCommand, registerAuthPurgeNeverExpiringCommand } from "@warlock.js/auth"`. Skip: programmatic cleanup — `@warlock.js/auth/manage-tokens/SKILL.md`; in-process scheduling — `@warlock.js/scheduler/scheduler-basics/SKILL.md`; competing tools `dotenv-cli`, `node-cron`.
 - [throttle-login-attempts](@warlock.js/auth/throttle-login-attempts/SKILL.md): (no description)
+- [verify-email-and-reset-password](@warlock.js/auth/verify-email-and-reset-password/SKILL.md): Email verification and password reset with hashed, single-use, expiring, purpose-bound tokens delivered through `@warlock.js/notifications` — `sendEmailVerification(user)`, `verifyEmail(token)`, `requestPasswordReset(Model, email)`, `resetPassword(token, newPassword)`, the `requireVerifiedEmail()` guard, and the `tokenIssueThrottleMiddleware` / `tokenConsumeThrottleMiddleware` presets. Reset revokes every access token, refresh token and cookie session; a reset request answers the same for unknown emails. Triggers: `sendEmailVerification`, `verifyEmail`, `requestPasswordReset`, `resetPassword`, `requireVerifiedEmail`, `isEmailVerified`, `OneTimeToken`, `InvalidOneTimeTokenError`, `EmailNotVerifiedError`, `NotificationsUnavailableError`, `EC007`, `EC008`, `auth.verification`, `auth.passwordReset`; "verify email", "confirm email address", "forgot password", "reset password link", "block unverified users", "resend verification email"; typical import `import { requestPasswordReset, resetPassword } from "@warlock.js/auth"`. Skip: sign-up itself — `@warlock.js/auth/register-user/SKILL.md`; login throttling — `@warlock.js/auth/throttle-login-attempts/SKILL.md`; defining notifications — `@warlock.js/notifications/define-notification/SKILL.md`.