@warlock.js/auth 5.28.0 → 5.30.0

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.30.0 - 2026-10-16
+
+### Upgrading
+
+- **Throttle counters and locks reset once on upgrade.** The per-account and per-IP keys changed shape (see below), so failures counted and accounts or IPs locked under 5.29 are forgotten when 5.30 starts. Old keys expire on their own TTL. Changing `auth.accessToken.secret` resets them the same way.
+
+### Changed
+
+- **The login throttle keys accounts and IPs by a keyed hash** (`auth.throttle.count.email.<hmac>`, `auth.throttle.count.ip.<hmac>`) instead of the raw address or IP, so cache logs never show them. The HMAC key is derived from `auth.accessToken.secret` (as the OTP code MAC is), so a list of known addresses cannot reverse it; without a configured secret it falls back to SHA-256. The value is trimmed and lower-cased first, so `" Sara@x.io"` and `"sara@x.io"` share one bucket. Applies to `loginThrottleMiddleware` and every preset built on it (token issue/consume, OTP); a custom `identify` is used as is. `throttleIdentifierHash(kind, value)` is exported (FW-04).
+- A throttle lock stores its own deadline, so a cache driver with sliding expiration (`memoryExtended`) can no longer keep a retrying client locked past `lockoutDuration`. Locks written by 5.29 (`true`) are still honoured until they expire.
+- The throttle warns once when the cache driver is `null`, which stores nothing, so the throttle can never lock.
+
+## 5.29.0 - 2026-10-01
+
+### Changed
+
+- Lockstep release; package APIs are unchanged. Skills refer to other topics by name instead of file paths, so cross-references keep working after `agent-kit` copies them into an app.
+
 ## 5.28.0 - 2026-10-01
 
 ### Changed

package/esm/commands/auth-cleanup-command.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/commands/auth-cleanup-command.d.ts
+//#region ../../packages/auth/src/commands/auth-cleanup-command.d.ts
 /**
  * Register the auth:cleanup CLI command
  *

package/esm/commands/auth-cleanup-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../auth/src/commands/auth-cleanup-command.ts"],"mappings":";;AAYA;;;;AAA0C;;;iBAA1B,0BAAA,+BAA0B,UAAA"}
+{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"mappings":";;AAYA;;;;AAA0C;;;iBAA1B,0BAAA,+BAA0B,UAAA"}

package/esm/commands/auth-cleanup-command.mjs

@@ -2,7 +2,7 @@ import { authService } from "../services/auth.service.mjs";
 import { command } from "@warlock.js/core";
 import { colors } from "@mongez/copper";
 
-//#region ../auth/src/commands/auth-cleanup-command.ts
+//#region ../../packages/auth/src/commands/auth-cleanup-command.ts
 /**
 * Register the auth:cleanup CLI command
 *

package/esm/commands/auth-cleanup-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cleanup-command.mjs","names":[],"sources":["../../../../../../../auth/src/commands/auth-cleanup-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the auth:cleanup CLI command\n *\n * @example\n * ```bash\n * warlock auth:cleanup\n * ```\n */\nexport function registerAuthCleanupCommand() {\n  return command({\n    name: \"auth.cleanup\",\n    description: \"Remove expired access/refresh tokens and spent one-time tokens from the database\",\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async () => {\n      console.log(colors.cyan(\"🧹 Cleaning up expired tokens...\"));\n\n      const count = await authService.cleanupExpiredTokens();\n\n      if (count === 0) {\n        console.log(colors.green(\"✅ No expired tokens found.\"));\n      } else {\n        console.log(colors.green(`✅ Removed ${count} expired token(s).`));\n      }\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,6BAA6B;CAC3C,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,YAAY;GAClB,QAAQ,IAAI,OAAO,KAAK,kCAAkC,CAAC;GAE3D,MAAM,QAAQ,MAAM,YAAY,qBAAqB;GAErD,IAAI,UAAU,GACZ,QAAQ,IAAI,OAAO,MAAM,4BAA4B,CAAC;QAEtD,QAAQ,IAAI,OAAO,MAAM,aAAa,MAAM,mBAAmB,CAAC;EAEpE;CACF,CAAC;AACH"}
+{"version":3,"file":"auth-cleanup-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the auth:cleanup CLI command\n *\n * @example\n * ```bash\n * warlock auth:cleanup\n * ```\n */\nexport function registerAuthCleanupCommand() {\n  return command({\n    name: \"auth.cleanup\",\n    description: \"Remove expired access/refresh tokens and spent one-time tokens from the database\",\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async () => {\n      console.log(colors.cyan(\"🧹 Cleaning up expired tokens...\"));\n\n      const count = await authService.cleanupExpiredTokens();\n\n      if (count === 0) {\n        console.log(colors.green(\"✅ No expired tokens found.\"));\n      } else {\n        console.log(colors.green(`✅ Removed ${count} expired token(s).`));\n      }\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,6BAA6B;CAC3C,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,YAAY;GAClB,QAAQ,IAAI,OAAO,KAAK,kCAAkC,CAAC;GAE3D,MAAM,QAAQ,MAAM,YAAY,qBAAqB;GAErD,IAAI,UAAU,GACZ,QAAQ,IAAI,OAAO,MAAM,4BAA4B,CAAC;QAEtD,QAAQ,IAAI,OAAO,MAAM,aAAa,MAAM,mBAAmB,CAAC;EAEpE;CACF,CAAC;AACH"}

package/esm/commands/auth-purge-never-expiring-command.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/commands/auth-purge-never-expiring-command.d.ts
+//#region ../../packages/auth/src/commands/auth-purge-never-expiring-command.d.ts
 /**
  * Register the `auth.purge-never-expiring` CLI command — remediation for the
  * pre-4.12.0 `expiresIn` defect (#25).

package/esm/commands/auth-purge-never-expiring-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;AA4BA;;;;AAAqD;;;;;;;;;;;;;;;;;;;iBAArC,qCAAA,+BAAqC,UAAA"}
+{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;AA4BA;;;;AAAqD;;;;;;;;;;;;;;;;;;;iBAArC,qCAAA,+BAAqC,UAAA"}

package/esm/commands/auth-purge-never-expiring-command.mjs

@@ -2,7 +2,7 @@ import { authService } from "../services/auth.service.mjs";
 import { command } from "@warlock.js/core";
 import { colors } from "@mongez/copper";
 
-//#region ../auth/src/commands/auth-purge-never-expiring-command.ts
+//#region ../../packages/auth/src/commands/auth-purge-never-expiring-command.ts
 /**
 * Register the `auth.purge-never-expiring` CLI command — remediation for the
 * pre-4.12.0 `expiresIn` defect (#25).

package/esm/commands/auth-purge-never-expiring-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-purge-never-expiring-command.mjs","names":[],"sources":["../../../../../../../auth/src/commands/auth-purge-never-expiring-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the `auth.purge-never-expiring` CLI command — remediation for the\n * pre-4.12.0 `expiresIn` defect (#25).\n *\n * **Why a command and not a migration.** The rows this removes cannot be\n * selected by a date predicate (an `Invalid Date` compares `false` against\n * every date, so `WHERE expires_at < now()` never matches one) and the\n * definitive signal — a token with no `exp` claim — lives inside the JWT\n * string, not in a column. A migration would also run once, silently, at deploy\n * time; an operator dealing with possibly-leaked credentials needs to *look*\n * first, then act, and to repeat it. Hence `--dry-run`, which is the default\n * posture this command is expected to be run in first.\n *\n * A migration is additionally the wrong shape for a fix that must reach both\n * supported stores: the same row is a different thing in MongoDB and Postgres,\n * and this goes through the models so a registered override\n * (`config.auth.accessToken.model`) is honoured.\n *\n * @example\n * ```bash\n * warlock auth.purge-never-expiring --dry-run   # report only\n * warlock auth.purge-never-expiring             # report, then delete\n * ```\n */\nexport function registerAuthPurgeNeverExpiringCommand() {\n  return command({\n    name: \"auth.purge-never-expiring\",\n    description:\n      \"Find (and delete) token rows that can never expire — an unusable expires_at, or a token with no exp claim\",\n    options: [\n      {\n        text: \"--dry-run\",\n        description: \"Report the affected rows without deleting anything\",\n        type: \"boolean\",\n      },\n    ],\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async (data: { options?: Record<string, unknown> } = {}) => {\n      // Core camelCases flags (`--dry-run` ⇒ `dryRun`); both spellings are read\n      // so the command does not depend on that detail staying true.\n      //\n      // Read fail-safe: the flag counts as set unless it is *explicitly* false\n      // (`--dry-run=false`). An operator who asked to look before deleting and\n      // got a delete because a flag arrived as `\"true\"` instead of `true` would\n      // lose live credentials to a parsing detail.\n      const flags = data.options ?? {};\n      const flag = flags[\"dryRun\"] ?? flags[\"dry-run\"];\n      const dryRun = flag !== undefined && flag !== false && flag !== \"false\";\n\n      console.log(colors.cyan(\"🔎 Scanning for tokens that can never expire...\"));\n\n      const { accessTokens, refreshTokens } = await authService.findNeverExpiringTokens();\n      const total = accessTokens.length + refreshTokens.length;\n\n      if (total === 0) {\n        console.log(colors.green(\"✅ No never-expiring tokens found.\"));\n\n        return;\n      }\n\n      console.log(\n        colors.yellow(\n          `⚠️  ${total} never-expiring token(s): ` +\n            `${accessTokens.length} access, ${refreshTokens.length} refresh.`,\n        ),\n      );\n\n      // Identify each row so an operator can correlate with their own audit\n      // trail before (or after) the rows are gone. The token string itself is\n      // never printed — it is a live credential until this command removes it.\n      for (const token of accessTokens) {\n        console.log(\n          colors.yellow(\n            `  access  id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      for (const token of refreshTokens) {\n        console.log(\n          colors.yellow(\n            `  refresh id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      if (dryRun) {\n        console.log(\n          colors.cyan(\"Dry run — nothing deleted. Re-run without --dry-run to revoke these tokens.\"),\n        );\n\n        return;\n      }\n\n      // Re-selects rather than deleting the rows just listed: the delete then\n      // acts on the table's current state instead of a snapshot taken before\n      // the operator read the report. A second full scan is affordable here —\n      // this is a one-off remediation, not a request path.\n      const purged = await authService.purgeNeverExpiringTokens();\n\n      console.log(\n        colors.green(\n          `✅ Revoked ${purged.accessTokens} access token(s) and ` +\n            `${purged.refreshTokens} refresh token(s). Affected users must log in again.`,\n        ),\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,wCAAwC;CACtD,OAAO,QAAQ;EACb,MAAM;EACN,aACE;EACF,SAAS,CACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR,CACF;EACA,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,OAAO,OAA8C,CAAC,MAAM;GAQlE,MAAM,QAAQ,KAAK,WAAW,CAAC;GAC/B,MAAM,OAAO,MAAM,aAAa,MAAM;GACtC,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS,SAAS;GAEhE,QAAQ,IAAI,OAAO,KAAK,iDAAiD,CAAC;GAE1E,MAAM,EAAE,cAAc,kBAAkB,MAAM,YAAY,wBAAwB;GAClF,MAAM,QAAQ,aAAa,SAAS,cAAc;GAElD,IAAI,UAAU,GAAG;IACf,QAAQ,IAAI,OAAO,MAAM,mCAAmC,CAAC;IAE7D;GACF;GAEA,QAAQ,IACN,OAAO,OACL,OAAO,MAAM,4BACR,aAAa,OAAO,WAAW,cAAc,OAAO,UAC3D,CACF;GAKA,KAAK,MAAM,SAAS,cAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,KAAK,MAAM,SAAS,eAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,IAAI,QAAQ;IACV,QAAQ,IACN,OAAO,KAAK,6EAA6E,CAC3F;IAEA;GACF;GAMA,MAAM,SAAS,MAAM,YAAY,yBAAyB;GAE1D,QAAQ,IACN,OAAO,MACL,aAAa,OAAO,aAAa,uBAC5B,OAAO,cAAc,qDAC5B,CACF;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"auth-purge-never-expiring-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the `auth.purge-never-expiring` CLI command — remediation for the\n * pre-4.12.0 `expiresIn` defect (#25).\n *\n * **Why a command and not a migration.** The rows this removes cannot be\n * selected by a date predicate (an `Invalid Date` compares `false` against\n * every date, so `WHERE expires_at < now()` never matches one) and the\n * definitive signal — a token with no `exp` claim — lives inside the JWT\n * string, not in a column. A migration would also run once, silently, at deploy\n * time; an operator dealing with possibly-leaked credentials needs to *look*\n * first, then act, and to repeat it. Hence `--dry-run`, which is the default\n * posture this command is expected to be run in first.\n *\n * A migration is additionally the wrong shape for a fix that must reach both\n * supported stores: the same row is a different thing in MongoDB and Postgres,\n * and this goes through the models so a registered override\n * (`config.auth.accessToken.model`) is honoured.\n *\n * @example\n * ```bash\n * warlock auth.purge-never-expiring --dry-run   # report only\n * warlock auth.purge-never-expiring             # report, then delete\n * ```\n */\nexport function registerAuthPurgeNeverExpiringCommand() {\n  return command({\n    name: \"auth.purge-never-expiring\",\n    description:\n      \"Find (and delete) token rows that can never expire — an unusable expires_at, or a token with no exp claim\",\n    options: [\n      {\n        text: \"--dry-run\",\n        description: \"Report the affected rows without deleting anything\",\n        type: \"boolean\",\n      },\n    ],\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async (data: { options?: Record<string, unknown> } = {}) => {\n      // Core camelCases flags (`--dry-run` ⇒ `dryRun`); both spellings are read\n      // so the command does not depend on that detail staying true.\n      //\n      // Read fail-safe: the flag counts as set unless it is *explicitly* false\n      // (`--dry-run=false`). An operator who asked to look before deleting and\n      // got a delete because a flag arrived as `\"true\"` instead of `true` would\n      // lose live credentials to a parsing detail.\n      const flags = data.options ?? {};\n      const flag = flags[\"dryRun\"] ?? flags[\"dry-run\"];\n      const dryRun = flag !== undefined && flag !== false && flag !== \"false\";\n\n      console.log(colors.cyan(\"🔎 Scanning for tokens that can never expire...\"));\n\n      const { accessTokens, refreshTokens } = await authService.findNeverExpiringTokens();\n      const total = accessTokens.length + refreshTokens.length;\n\n      if (total === 0) {\n        console.log(colors.green(\"✅ No never-expiring tokens found.\"));\n\n        return;\n      }\n\n      console.log(\n        colors.yellow(\n          `⚠️  ${total} never-expiring token(s): ` +\n            `${accessTokens.length} access, ${refreshTokens.length} refresh.`,\n        ),\n      );\n\n      // Identify each row so an operator can correlate with their own audit\n      // trail before (or after) the rows are gone. The token string itself is\n      // never printed — it is a live credential until this command removes it.\n      for (const token of accessTokens) {\n        console.log(\n          colors.yellow(\n            `  access  id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      for (const token of refreshTokens) {\n        console.log(\n          colors.yellow(\n            `  refresh id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      if (dryRun) {\n        console.log(\n          colors.cyan(\"Dry run — nothing deleted. Re-run without --dry-run to revoke these tokens.\"),\n        );\n\n        return;\n      }\n\n      // Re-selects rather than deleting the rows just listed: the delete then\n      // acts on the table's current state instead of a snapshot taken before\n      // the operator read the report. A second full scan is affordable here —\n      // this is a one-off remediation, not a request path.\n      const purged = await authService.purgeNeverExpiringTokens();\n\n      console.log(\n        colors.green(\n          `✅ Revoked ${purged.accessTokens} access token(s) and ` +\n            `${purged.refreshTokens} refresh token(s). Affected users must log in again.`,\n        ),\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,wCAAwC;CACtD,OAAO,QAAQ;EACb,MAAM;EACN,aACE;EACF,SAAS,CACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR,CACF;EACA,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,OAAO,OAA8C,CAAC,MAAM;GAQlE,MAAM,QAAQ,KAAK,WAAW,CAAC;GAC/B,MAAM,OAAO,MAAM,aAAa,MAAM;GACtC,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS,SAAS;GAEhE,QAAQ,IAAI,OAAO,KAAK,iDAAiD,CAAC;GAE1E,MAAM,EAAE,cAAc,kBAAkB,MAAM,YAAY,wBAAwB;GAClF,MAAM,QAAQ,aAAa,SAAS,cAAc;GAElD,IAAI,UAAU,GAAG;IACf,QAAQ,IAAI,OAAO,MAAM,mCAAmC,CAAC;IAE7D;GACF;GAEA,QAAQ,IACN,OAAO,OACL,OAAO,MAAM,4BACR,aAAa,OAAO,WAAW,cAAc,OAAO,UAC3D,CACF;GAKA,KAAK,MAAM,SAAS,cAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,KAAK,MAAM,SAAS,eAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,IAAI,QAAQ;IACV,QAAQ,IACN,OAAO,KAAK,6EAA6E,CAC3F;IAEA;GACF;GAMA,MAAM,SAAS,MAAM,YAAY,yBAAyB;GAE1D,QAAQ,IACN,OAAO,MACL,aAAa,OAAO,aAAa,uBAC5B,OAAO,cAAc,qDAC5B,CACF;EACF;CACF,CAAC;AACH"}

package/esm/commands/jwt-secret-generator-command.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/commands/jwt-secret-generator-command.d.ts
+//#region ../../packages/auth/src/commands/jwt-secret-generator-command.d.ts
 declare function registerJWTSecretGeneratorCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
 export { registerJWTSecretGeneratorCommand };

package/esm/commands/jwt-secret-generator-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";iBAGgB,iCAAA,+BAAiC,UAAA"}
+{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";iBAGgB,iCAAA,+BAAiC,UAAA"}

package/esm/commands/jwt-secret-generator-command.mjs

@@ -1,7 +1,7 @@
 import { generateJWTSecret } from "../services/generate-jwt-secret.mjs";
 import { command } from "@warlock.js/core";
 
-//#region ../auth/src/commands/jwt-secret-generator-command.ts
+//#region ../../packages/auth/src/commands/jwt-secret-generator-command.ts
 function registerJWTSecretGeneratorCommand() {
 	return command({
 		name: "jwt.generate",

package/esm/commands/jwt-secret-generator-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret-generator-command.mjs","names":[],"sources":["../../../../../../../auth/src/commands/jwt-secret-generator-command.ts"],"sourcesContent":["import { command } from \"@warlock.js/core\";\r\nimport { generateJWTSecret } from \"../services/generate-jwt-secret\";\r\n\r\nexport function registerJWTSecretGeneratorCommand() {\r\n  return command({\r\n    name: \"jwt.generate\",\r\n    description: \"Generate JWT Secret key in .env file\",\r\n    action: generateJWTSecret,\r\n  });\r\n}\r\n"],"mappings":";;;;AAGA,SAAgB,oCAAoC;CAClD,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,QAAQ;CACV,CAAC;AACH"}
+{"version":3,"file":"jwt-secret-generator-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"sourcesContent":["import { command } from \"@warlock.js/core\";\r\nimport { generateJWTSecret } from \"../services/generate-jwt-secret\";\r\n\r\nexport function registerJWTSecretGeneratorCommand() {\r\n  return command({\r\n    name: \"jwt.generate\",\r\n    description: \"Generate JWT Secret key in .env file\",\r\n    action: generateJWTSecret,\r\n  });\r\n}\r\n"],"mappings":";;;;AAGA,SAAgB,oCAAoC;CAClD,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,QAAQ;CACV,CAAC;AACH"}

package/esm/contracts/auth-contract.d.mts

@@ -1,7 +1,7 @@
 import { AccessTokenOutput, DeviceInfo, TokenPair } from "./types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 
-//#region ../auth/src/contracts/auth-contract.d.ts
+//#region ../../packages/auth/src/contracts/auth-contract.d.ts
 /**
  * Surface every authenticable user model exposes once it extends the
  * `Auth` base. The `Auth` class implements this contract; subclasses only

package/esm/contracts/auth-contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;AAWA;;;;;;UAAiB,aAAA;EAiBwC;;;;EAAA,IAZnD,QAAA;EAsB+B;;;;EAhBnC,mBAAA,CAAoB,OAAA,GAAU,MAAA,oBAA0B,OAAA,CAAQ,iBAAA;EAAlC;;;;EAM9B,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAArB;;;EAKlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAAlD;;;EAKA,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;AAWA;;;;;;UAAiB,aAAA;EAiBwC;;;;EAAA,IAZnD,QAAA;EAsB+B;;;;EAhBnC,mBAAA,CAAoB,OAAA,GAAU,MAAA,oBAA0B,OAAA,CAAQ,iBAAA;EAAlC;;;;EAM9B,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAArB;;;EAKlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAAlD;;;EAKA,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}

package/esm/contracts/providers.d.mts

@@ -1,7 +1,7 @@
 import { Auth } from "../models/auth.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
 
-//#region ../auth/src/contracts/providers.d.ts
+//#region ../../packages/auth/src/contracts/providers.d.ts
 /**
  * The per-login secrets a redirect provider round-trips: `state` (CSRF),
  * `nonce` (id_token replay binding) and the PKCE `codeVerifier`.

package/esm/contracts/providers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAUqD;;;;;;;EAAA,SAFrD,YAAA;EAET;EAAA,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAA7C;EAEjB,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UANuE;EAQvE,WAAA,UAJU;EAMV,MAAA;AAAA;;KAIU,oBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UAVA;EAYA,WAAA,UARA;EAUA,MAAA;AAAA;AANF;AAAA,KAUY,mBAAA;wEAEV,QAAA,UAXA;EAaA,MAAA,UAVA;EAYA,KAAA,UAVM;EAYN,UAAA,UARU;EAUV,WAAA;EAEA,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,eAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EACT,MAAA,GAAS,oBAAA;EACT,OAAA,GAAU,qBAAA;EACV,QAAA,GAAW,sBAAA;EACX,KAAA,GAAQ,mBAAA;EACR,QAAA,GAAW,sBAAA;EACX,CAAA,GAAI,eAAA;;;;;EAKJ,UAAA,WAfkB;EAiBlB,UAAA,GAAa,mBAAA,EAjBI;EAmBjB,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAxBQ,8EA0BlB,IAAA,UAzBG;EA2BH,MAAA,UA3BkB;EA6BlB,MAAA;EA7BsB;AAGxB;;;EA+BE,kBAAA,WA7BS;EA+BT,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EA9BN,8CAgCJ,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EA9CD;;;;;EAoDT,OAAA,WAjDQ;EAmDR,UAAA,WAlDW;EAoDX,SAAA,WAnDI;EAqDJ,WAAA,WA9CA;EAgDA,OAAA,IAAW,IAAA,qBA9CX;EAgDA,IAAA,GAAO,SAAS;AAAA"}
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAUqD;;;;;;;EAAA,SAFrD,YAAA;EAET;EAAA,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAA7C;EAEjB,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UANuE;EAQvE,WAAA,UAJU;EAMV,MAAA;AAAA;;KAIU,oBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UAVA;EAYA,WAAA,UARA;EAUA,MAAA;AAAA;AANF;AAAA,KAUY,mBAAA;wEAEV,QAAA,UAXA;EAaA,MAAA,UAVA;EAYA,KAAA,UAVM;EAYN,UAAA,UARU;EAUV,WAAA;EAEA,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,eAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EACT,MAAA,GAAS,oBAAA;EACT,OAAA,GAAU,qBAAA;EACV,QAAA,GAAW,sBAAA;EACX,KAAA,GAAQ,mBAAA;EACR,QAAA,GAAW,sBAAA;EACX,CAAA,GAAI,eAAA;;;;;EAKJ,UAAA,WAfkB;EAiBlB,UAAA,GAAa,mBAAA,EAjBI;EAmBjB,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAxBQ,8EA0BlB,IAAA,UAzBG;EA2BH,MAAA,UA3BkB;EA6BlB,MAAA;EA7BsB;AAGxB;;;EA+BE,kBAAA,WA7BS;EA+BT,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EA9BN,8CAgCJ,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EA9CD;;;;;EAoDT,OAAA,WAjDQ;EAmDR,UAAA,WAlDW;EAoDX,SAAA,WAnDI;EAqDJ,WAAA,WA9CA;EAgDA,OAAA,IAAW,IAAA,qBA9CX;EAgDA,IAAA,GAAO,SAAS;AAAA"}

package/esm/contracts/request-locals.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/contracts/request-locals.d.ts
+//#region ../../packages/auth/src/contracts/request-locals.d.ts
 /**
  * The authenticated user attached to the current request —
  * `request.locals.user`.

package/esm/contracts/request-locals.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;;;AAiBV;;;;;;;;UAjBJ,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAA;;;;;IAKP,OAAA,GAAU,OAAO;EAAA;AAAA"}
+{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;;;AAiBV;;;;;;;;UAjBJ,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAA;;;;;IAKP,OAAA,GAAU,OAAO;EAAA;AAAA"}

package/esm/contracts/types.d.mts

@@ -7,7 +7,7 @@ import { Request } from "@warlock.js/core";
 import { ChildModel } from "@warlock.js/cascade";
 import { Algorithm } from "fast-jwt";
 
-//#region ../auth/src/contracts/types.d.ts
+//#region ../../packages/auth/src/contracts/types.d.ts
 /**
  * Symbol to indicate no expiration for tokens
  * Use this when you explicitly want tokens to never expire

package/esm/contracts/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;;AA4BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAiBrE;EAfV,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAAA;;;;;;;EAQA,OAAA,GAAU,wBAAA;EAG6B;EADvC,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;;KAIf,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAAA;AASV;;;KAAY,iBAAA;EAMV;;;;;EAAA,KAAA,UAAe,WAAA;EAmBN;AAAA;AAMX;EArBE,MAAA;;;;;EAKA,SAAA,GAAY,SAAS;EA+BrB;;;;;;;AAuB+C;AASjD;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAkDV;;;;EA7CA,KAAA,UAAe,YAAA;EAkDb;;;;EA7CF,OAAA;EA+CiD;AAYnD;;;EAtDE,MAAA;EAkEc;AAMhB;;;;;;EAhEE,SAAA;EAsEA;;AAAG;AAOL;EAxEE,QAAA;;;;;EAKA,UAAA;EAoEuB;;;AAA4B;EA/DnD,kBAAA,GAAqB,0BAA0B;AAAA;;;;;;;KASrC,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EA2DkB;AAM9B;;;;EA3DE,SAAA;EAgFc;;;;;EA1Ed,cAAc;AAAA;;;;KAMJ,4BAAA;EAoEkB,iFAlE5B,KAAA,UAwEU;EAtEV,SAAA,EAAW,IAAI;EAEf,GAAA;AAAA;AAyEF;;;;AAAA,KAlEY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA+GC;;;;EA1GX,SAAA;EAqDA;;;;;EA/CA,KAAA,WAwDkB;EAtDlB,YAAA,GAAe,gBAAA,EA0DD;EAxDd,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsEV;;;;EAjEA,SAAA;EAyEgB;;;;EApEhB,eAAA,WAgFA;EA9EA,YAAA,GAAe,gBAAA,EAkFf;EAhFA,GAAA,GAAM,sBAAA;EAoFN;;;AAAqB;AAGvB;;EAhFE,WAAA,GAAc,cAAA;AAAA;AAwFL;AAMX;;AANW,KAlFC,kBAAA;EAgGsB,kEA9FhC,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA2FK;;AAAiB;AAMlC;EA5FE,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GA+FjC;EA5FA,eAAA;EAoGA;;;;EA/FA,eAAA,GAAkB,eAAA;EAwGF;AAGlB;;EAvGE,WAAA,GAAc,iBAAA;EAuGyB;;;EAnGvC,YAAA,GAAe,kBAAA;EAqGE;;;;;EA/FjB,QAAA,GAAW,cAAA;EA+FH;;AAAS;AAInB;;EA7FE,MAAA,GAAS,gBAAA;EA6FkC;AAAO;AAUpD;EAnGE,IAAA,GAAO,UAAA;;;;EAIP,YAAA,GAAe,uBAAA;EA+Gf;;;EA3GA,aAAA,GAAgB,mBAAA;EA6GmB;AAOrC;;EAhHE,YAAA,GAAe,kBAAA;EAsHD;AAAA;AAShB;EA3HE,SAAA,GAAY,eAAA;;;;EAIZ,QAAA,GAAW,cAAA;EA6HX;;;EAzHA,GAAA,GAAM,SAAA;EAoII;;;EAhIV,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;KAIE,oBAAA,IAAwB,OAAgB,EAAP,OAAO;;;;;;;;;KAUxC,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,WAAA;;;;;EAKA,IAAA;EAEA,YAAA,GAAe,oBAAoB;AAAA;;;;;KAOzB,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;EAEA,MAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/types.ts"],"mappings":";;;;;;;;;;;;;;;AA4BA;;;;AAA0B;AAO1B;;;;AAAsC;AAGtC;;;;cAVa,aAAA;AAab;;;;AAEK;AAFL,KANY,0BAAA;;KAGA,SAAA;;UAGK,wBAAA;EACf,MAAA;EACA,GAAG;AAAA;;UAIY,+BAAA,SAAwC,wBAAwB;EAiBrE;EAfV,SAAS;AAAA;;UAIM,qBAAA,SAA8B,OAAA,CAAQ,wBAAA;EACrD,QAAA;EAAA;;;;;;;EAQA,OAAA,GAAU,wBAAA;EAG6B;EADvC,OAAA,GAAU,+BAAA;EACV,QAAA;IAAa,EAAA;IAAY,cAAA;EAAA;AAAA;;KAIf,eAAA,IAAmB,IAAA,EAAM,IAAA,eAAmB,OAAO;;KAGnD,eAAA,GAAkB,MAAM;EAClC,QAAQ;AAAA;;;AAAA;AASV;;;KAAY,iBAAA;EAMV;;;;;EAAA,KAAA,UAAe,WAAA;EAmBN;AAAA;AAMX;EArBE,MAAA;;;;;EAKA,SAAA,GAAY,SAAS;EA+BrB;;;;;;;AAuB+C;AASjD;EArDE,SAAA;AAAA;;;;KAMU,kBAAA;EAkDV;;;;EA7CA,KAAA,UAAe,YAAA;EAkDb;;;;EA7CF,OAAA;EA+CiD;AAYnD;;;EAtDE,MAAA;EAkEc;AAMhB;;;;;;EAhEE,SAAA;EAsEA;;AAAG;AAOL;EAxEE,QAAA;;;;;EAKA,UAAA;EAoEuB;;;AAA4B;EA/DnD,kBAAA,GAAqB,0BAA0B;AAAA;;;;;;;KASrC,eAAA;EACV,MAAA;EACA,SAAA,GAAY,SAAA;EACZ,SAAA;EACA,OAAA;IACE,MAAA;IACA,OAAA;IACA,SAAA;IACA,QAAA;IACA,UAAA;IACA,kBAAA,GAAqB,0BAA0B;EAAA;AAAA;;;;;;;;;KAYvC,cAAA;EA2DkB;AAM9B;;;;EA3DE,SAAA;EAgFc;;;;;EA1Ed,cAAc;AAAA;;;;KAMJ,4BAAA;EAoEkB,iFAlE5B,KAAA,UAwEU;EAtEV,SAAA,EAAW,IAAI;EAEf,GAAA;AAAA;AAyEF;;;;AAAA,KAlEY,gBAAA;EACV,IAAA,GAAO,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,4BAA4B;AAAA;;KAIzC,sBAAA,IAA0B,KAAA,UAAe,IAAA,EAAM,IAAI;;KAGnD,cAAA,IAAkB,IAAA,EAAM,IAAA,EAAM,aAAA,oBAAiC,OAAO;;;;KAKtE,uBAAA;EA+GC;;;;EA1GX,SAAA;EAqDA;;;;;EA/CA,KAAA,WAwDkB;EAtDlB,YAAA,GAAe,gBAAA,EA0DD;EAxDd,GAAA,GAAM,sBAAsB;AAAA;;;;KAMlB,mBAAA;EAsEV;;;;EAjEA,SAAA;EAyEgB;;;;EApEhB,eAAA,WAgFA;EA9EA,YAAA,GAAe,gBAAA,EAkFf;EAhFA,GAAA,GAAM,sBAAA;EAoFN;;;AAAqB;AAGvB;;EAhFE,WAAA,GAAc,cAAA;AAAA;AAwFL;AAMX;;AANW,KAlFC,kBAAA;EAgGsB,kEA9FhC,KAAA,UAAe,YAAY;AAAA;AAAA,KAGjB,kBAAA;EA2FK;;AAAiB;AAMlC;EA5FE,QAAA;IAAA,CACG,QAAA,WAAmB,UAAA,CAAW,IAAA;EAAA,GA+FjC;EA5FA,eAAA;EAoGA;;;;EA/FA,eAAA,GAAkB,eAAA;EAwGF;AAGlB;;EAvGE,WAAA,GAAc,iBAAA;EAuGyB;;;EAnGvC,YAAA,GAAe,kBAAA;EAqGE;;;;;EA/FjB,QAAA,GAAW,cAAA;EA+FH;;AAAS;AAInB;;EA7FE,MAAA,GAAS,gBAAA;EA6FkC;AAAO;AAUpD;EAnGE,IAAA,GAAO,UAAA;;;;EAIP,YAAA,GAAe,uBAAA;EA+Gf;;;EA3GA,aAAA,GAAgB,mBAAA;EA6GmB;AAOrC;;EAhHE,YAAA,GAAe,kBAAA;EAsHD;AAAA;AAShB;EA3HE,SAAA,GAAY,eAAA;;;;EAIZ,QAAA,GAAW,cAAA;EA6HX;;;EAzHA,GAAA,GAAM,SAAA;EAoII;;;EAhIV,GAAA,GAAM,eAAA;AAAA;AAAA,KAGI,iBAAA;;;;EAIV,KAAA;;;;EAIA,SAAS;AAAA;;;;KAMC,SAAA;;;;EAIV,WAAA,EAAa,iBAAA;;;;EAIb,YAAA,GAAe,iBAAiB;AAAA;;;;KAMtB,UAAA;;;;EAIV,SAAA;;;;EAIA,EAAA;;;;EAIA,QAAA;;;;;EAKA,QAAA;;;;EAIA,OAAA,GAAU,MAAM;AAAA;AAAA,KAGN,WAAA,kBAA6B,IAAA;EACvC,IAAA,EAAM,QAAA;EACN,MAAA,EAAQ,SAAA;AAAA;;KAIE,oBAAA,IAAwB,OAAgB,EAAP,OAAO;;;;;;;;;KAUxC,gBAAA;;;;;;EAMV,IAAA;;;;;EAKA,WAAA;;;;;EAKA,IAAA;EAEA,YAAA,GAAe,oBAAoB;AAAA;;;;;KAOzB,UAAA;;;;;;EAMV,cAAc;AAAA;;;;;;;KASJ,oBAAA;wFAEV,IAAA;EAEA,IAAA;EAEA,MAAA;;;;;;;EAOA,MAAA;AAAA;;KAIU,sBAAA;wFAEV,IAAA;EAEA,IAAI;AAAA"}

package/esm/contracts/types.mjs

@@ -1,4 +1,4 @@
-//#region ../auth/src/contracts/types.ts
+//#region ../../packages/auth/src/contracts/types.ts
 /**
 * Symbol to indicate no expiration for tokens
 * Use this when you explicitly want tokens to never expire

package/esm/contracts/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\nimport type { Request } from \"@warlock.js/core\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken } from \"../models/one-time-token\";\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Symbol to indicate no expiration for tokens\n * Use this when you explicitly want tokens to never expire\n *\n * @example\n * ```typescript\n * // src/config/auth.ts\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\n *\n * const authConfigurations: AuthConfigurations = {\n *   accessToken: {\n *     secret: env(\"JWT_SECRET\"),\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\n *   },\n * };\n *\n * export default authConfigurations;\n * ```\n */\nexport const NO_EXPIRATION = \"100y\";\n\n/**\n * Behavior when logout is called without a refresh token\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\n * - \"error\": Return an error requiring the refresh token\n */\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\n\n/** The single request credential source an auth middleware instance accepts. */\nexport type TokenFrom = \"header\" | `cookie:${string}`;\n\n/** One explicitly named credential location accepted by auth middleware. */\nexport interface AuthCredentialDescriptor {\n  source: \"header\" | \"cookie\";\n  key?: string;\n}\n\n/** Cookie credential and bounded duplicate window for automatic renewal. */\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\n  overlapMs?: number;\n}\n\n/** Per-route authentication behavior for the object middleware overload. */\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\n  optional?: boolean;\n  /**\n   * Accept both a header and a cookie credential (at most one of each).\n   * Precedence is fixed and independent of array order: a present\n   * `Authorization` header wins, an invalid header rejects and never falls back\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\n   * cookie is the credential actually used. Cannot be combined with `source`.\n   */\n  sources?: AuthCredentialDescriptor[];\n  /** Opt-in automatic renewal credential. Cookie sources only. */\n  refresh?: AuthRefreshCredentialDescriptor;\n  redirect?: { to: string; returnUrlParam?: string };\n}\n\n/** Application policy that decides whether a resolved user may authenticate. */\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\n\n/** Password credentials plus the application-defined identity fields. */\nexport type AuthCredentials = Record<string, unknown> & {\n  password: string;\n};\n\n/**\n * Access-token configuration.\n *\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\n * backward-compatible shim); one of the two is required at runtime.\n */\nexport type AccessTokenConfig = {\n  /**\n   * Override the persisted access-token model — extend {@link AccessToken} to\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\n   * here. Defaults to the package's `AccessToken`.\n   */\n  model?: typeof AccessToken;\n  /**\n   * Secret used to sign access tokens.\n   */\n  secret?: string;\n  /**\n   * JWT algorithm.\n   * @default \"HS256\"\n   */\n  algorithm?: Algorithm;\n  /**\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\n   * first token issue: each of them would otherwise sign a token with no `exp`\n   * claim at all.\n   * @example \"1h\" or NO_EXPIRATION\n   * @default \"1h\"\n   */\n  expiresIn?: string;\n};\n\n/**\n * Refresh-token configuration.\n */\nexport type RefreshTokenConfig = {\n  /**\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\n   * Defaults to the package's `RefreshToken`.\n   */\n  model?: typeof RefreshToken;\n  /**\n   * Enable refresh tokens.\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Separate secret for refresh tokens (recommended for security). Falls back\n   * to the access-token secret when omitted.\n   */\n  secret?: string;\n  /**\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds; an unusable value throws naming this key on issue\n   * (see {@link AccessTokenConfig.expiresIn}).\n   * @example \"7d\" or \"1w\"\n   * @default \"7d\"\n   */\n  expiresIn?: string;\n  /**\n   * Rotate the refresh token on each use (old token revoked, replay detected).\n   * @default true\n   */\n  rotation?: boolean;\n  /**\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\n   * @default 5\n   */\n  maxPerUser?: number;\n  /**\n   * Behavior when logout is called without a refresh token.\n   * @default \"revoke-all\"\n   */\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\n};\n\n/**\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\n * deprecation warning.\n *\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\n */\nexport type LegacyJwtConfig = {\n  secret?: string;\n  algorithm?: Algorithm;\n  expiresIn?: string;\n  refresh?: {\n    secret?: string;\n    enabled?: boolean;\n    expiresIn?: string;\n    rotation?: boolean;\n    maxPerUser?: number;\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\n  };\n};\n\n/**\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\n * to a login page instead of returning the API-style JSON 401.\n *\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\n * always keep the JSON 401 contract regardless of this setting.\n */\nexport type PageAuthConfig = {\n  /**\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\n   * behavior is opt-in and backward-compatible.\n   */\n  loginPath?: string;\n  /**\n   * Query parameter the redirect carries the originally-requested path in, so\n   * the login flow can send the user back where they were headed.\n   * @default \"returnUrl\"\n   */\n  returnUrlParam?: string;\n};\n\n/**\n * Data every email-verification / password-reset notification receives.\n */\nexport type OneTimeTokenNotificationData = {\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\n  token: string;\n  /** When the token stops working. */\n  expiresAt: Date;\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\n  url?: string;\n};\n\n/**\n * Anything auth can deliver a token through — a `defineNotification(...)`\n * result satisfies it, as does any object with a compatible `send`.\n */\nexport type AuthNotification = {\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\n};\n\n/** Builds the link a token notification points at. */\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\n\n/** Persists a new plaintext password for a user during a password reset. */\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\n\n/**\n * Email-verification configuration (`auth.verification`).\n */\nexport type EmailVerificationConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"24h\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute stamped with the verification `Date`. Declare it in the\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\n   * @default \"emailVerifiedAt\"\n   */\n  field?: string;\n  /** Replace the default verification email. */\n  notification?: AuthNotification;\n  /** Build the verification link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n};\n\n/**\n * Password-reset configuration (`auth.passwordReset`).\n */\nexport type PasswordResetConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"60m\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute `requestPasswordReset` looks the account up by.\n   * @default \"email\"\n   */\n  identifierField?: string;\n  /** Replace the default reset email. */\n  notification?: AuthNotification;\n  /** Build the reset link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n  /**\n   * Persist the new password yourself. By default auth saves a hash made by\n   * the same `hashPassword` login verifies against, and falls back to the\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\n   * the stored value with `verifyPassword` either way.\n   */\n  setPassword?: PasswordSetter;\n};\n\n/**\n * One-time token storage configuration (`auth.oneTimeToken`).\n */\nexport type OneTimeTokenConfig = {\n  /** Override the persisted model — extend {@link OneTimeToken}. */\n  model?: typeof OneTimeToken;\n};\n\nexport type AuthConfigurations = {\n  /**\n   * Define all user types — maps a user-type slug to its `Auth` model class so\n   * tokens and the middleware can resolve the right model.\n   */\n  userType: {\n    [userType: string]: ChildModel<Auth>;\n  };\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\n  defaultUserType?: string;\n  /**\n   * Decide whether a resolved user may authenticate or receive new tokens.\n   * @default () => true\n   */\n  canAuthenticate?: CanAuthenticate;\n  /**\n   * Access-token configuration (secret, expiry, algorithm, model override).\n   */\n  accessToken?: AccessTokenConfig;\n  /**\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\n   */\n  refreshToken?: RefreshTokenConfig;\n  /**\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\n   */\n  pageAuth?: PageAuthConfig;\n  /**\n   * Cookie auth session config — read by `authService.setAuthCookie` /\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\n   */\n  cookie?: CookieAuthConfig;\n  /**\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\n   */\n  csrf?: CsrfConfig;\n  /**\n   * Email verification — token lifetime, verified field, notification override.\n   */\n  verification?: EmailVerificationConfig;\n  /**\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\n   */\n  passwordReset?: PasswordResetConfig;\n  /**\n   * One-time token (verification / reset) storage — model override.\n   */\n  oneTimeToken?: OneTimeTokenConfig;\n  /**\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\n   */\n  providers?: ProvidersConfig;\n  /**\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\n   */\n  passkeys?: PasskeysConfig;\n  /**\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\n   */\n  otp?: OtpConfig;\n  /**\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\n   */\n  jwt?: LegacyJwtConfig;\n};\n\nexport type AccessTokenOutput = {\n  /**\n   * JWT Token\n   */\n  token: string;\n  /**\n   * Exprie time in ISO format UTC time\n   */\n  expiresAt: string;\n};\n\n/**\n * Token pair returned after login or token refresh\n */\nexport type TokenPair = {\n  /**\n   * JWT access token (short-lived)\n   */\n  accessToken: AccessTokenOutput;\n  /**\n   * JWT refresh token (long-lived)\n   */\n  refreshToken?: AccessTokenOutput;\n};\n\n/**\n * Device information for session tracking\n */\nexport type DeviceInfo = {\n  /**\n   * User agent string from request\n   */\n  userAgent?: string;\n  /**\n   * Client IP address\n   */\n  ip?: string;\n  /**\n   * Optional device identifier\n   */\n  deviceId?: string;\n  /**\n   * Token family ID (for rotation tracking)\n   * @internal\n   */\n  familyId?: string;\n  /**\n   * Access token payload\n   */\n  payload?: Record<string, unknown>;\n};\n\nexport type LoginResult<UserType extends Auth> = {\n  user: UserType;\n  tokens: TokenPair;\n};\n\n/** Selects a cookie Domain for one request; return `undefined` for a host-only cookie. */\nexport type CookieDomainResolver = (request: Request) => string | undefined;\n\n/**\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\n * configurable here — they come from core's `secureCookieDefaults()`, the\n * same floor every `response.cookie()` call gets, so a cookie auth session can\n * never be weakened to a laxer policy than the framework default.\n */\nexport type CookieAuthConfig = {\n  /**\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\n   * `cookie:<name>` token source must match to read it back.\n   * @default \"access_token\"\n   */\n  name?: string;\n  /**\n   * Cookie name the session helpers write and clear for the refresh token.\n   * @default \"refresh_token\"\n   */\n  refreshName?: string;\n  /**\n   * Cookie `Path` attribute.\n   * @default \"/\"\n   */\n  path?: string;\n  /** Select a request-scoped Domain; `undefined` keeps the cookie host-only. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * CSRF Origin-check configuration. Read via\n * `authConfig.csrf.allowedOrigins()`.\n */\nexport type CsrfConfig = {\n  /**\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\n   * in addition to the request's own origin.\n   * @default []\n   */\n  allowedOrigins?: string[];\n};\n\n/**\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\n * falls back to `auth.cookie.*` config, then the package default. Cookie\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\n * see {@link CookieAuthConfig}.\n */\nexport type SetAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\n  path?: string;\n  /** Cookie `Domain` attribute. Omit for a host-only cookie. */\n  domain?: string;\n  /**\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\n   * bare token string with no `maxAge` produces a session cookie (cleared\n   * when the browser closes).\n   */\n  maxAge?: number;\n};\n\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\nexport type ClearAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\n  path?: string;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,gBAAgB"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\nimport type { Request } from \"@warlock.js/core\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken } from \"../models/one-time-token\";\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Symbol to indicate no expiration for tokens\n * Use this when you explicitly want tokens to never expire\n *\n * @example\n * ```typescript\n * // src/config/auth.ts\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\n *\n * const authConfigurations: AuthConfigurations = {\n *   accessToken: {\n *     secret: env(\"JWT_SECRET\"),\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\n *   },\n * };\n *\n * export default authConfigurations;\n * ```\n */\nexport const NO_EXPIRATION = \"100y\";\n\n/**\n * Behavior when logout is called without a refresh token\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\n * - \"error\": Return an error requiring the refresh token\n */\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\n\n/** The single request credential source an auth middleware instance accepts. */\nexport type TokenFrom = \"header\" | `cookie:${string}`;\n\n/** One explicitly named credential location accepted by auth middleware. */\nexport interface AuthCredentialDescriptor {\n  source: \"header\" | \"cookie\";\n  key?: string;\n}\n\n/** Cookie credential and bounded duplicate window for automatic renewal. */\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\n  overlapMs?: number;\n}\n\n/** Per-route authentication behavior for the object middleware overload. */\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\n  optional?: boolean;\n  /**\n   * Accept both a header and a cookie credential (at most one of each).\n   * Precedence is fixed and independent of array order: a present\n   * `Authorization` header wins, an invalid header rejects and never falls back\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\n   * cookie is the credential actually used. Cannot be combined with `source`.\n   */\n  sources?: AuthCredentialDescriptor[];\n  /** Opt-in automatic renewal credential. Cookie sources only. */\n  refresh?: AuthRefreshCredentialDescriptor;\n  redirect?: { to: string; returnUrlParam?: string };\n}\n\n/** Application policy that decides whether a resolved user may authenticate. */\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\n\n/** Password credentials plus the application-defined identity fields. */\nexport type AuthCredentials = Record<string, unknown> & {\n  password: string;\n};\n\n/**\n * Access-token configuration.\n *\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\n * backward-compatible shim); one of the two is required at runtime.\n */\nexport type AccessTokenConfig = {\n  /**\n   * Override the persisted access-token model — extend {@link AccessToken} to\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\n   * here. Defaults to the package's `AccessToken`.\n   */\n  model?: typeof AccessToken;\n  /**\n   * Secret used to sign access tokens.\n   */\n  secret?: string;\n  /**\n   * JWT algorithm.\n   * @default \"HS256\"\n   */\n  algorithm?: Algorithm;\n  /**\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\n   * first token issue: each of them would otherwise sign a token with no `exp`\n   * claim at all.\n   * @example \"1h\" or NO_EXPIRATION\n   * @default \"1h\"\n   */\n  expiresIn?: string;\n};\n\n/**\n * Refresh-token configuration.\n */\nexport type RefreshTokenConfig = {\n  /**\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\n   * Defaults to the package's `RefreshToken`.\n   */\n  model?: typeof RefreshToken;\n  /**\n   * Enable refresh tokens.\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Separate secret for refresh tokens (recommended for security). Falls back\n   * to the access-token secret when omitted.\n   */\n  secret?: string;\n  /**\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds; an unusable value throws naming this key on issue\n   * (see {@link AccessTokenConfig.expiresIn}).\n   * @example \"7d\" or \"1w\"\n   * @default \"7d\"\n   */\n  expiresIn?: string;\n  /**\n   * Rotate the refresh token on each use (old token revoked, replay detected).\n   * @default true\n   */\n  rotation?: boolean;\n  /**\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\n   * @default 5\n   */\n  maxPerUser?: number;\n  /**\n   * Behavior when logout is called without a refresh token.\n   * @default \"revoke-all\"\n   */\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\n};\n\n/**\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\n * deprecation warning.\n *\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\n */\nexport type LegacyJwtConfig = {\n  secret?: string;\n  algorithm?: Algorithm;\n  expiresIn?: string;\n  refresh?: {\n    secret?: string;\n    enabled?: boolean;\n    expiresIn?: string;\n    rotation?: boolean;\n    maxPerUser?: number;\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\n  };\n};\n\n/**\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\n * to a login page instead of returning the API-style JSON 401.\n *\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\n * always keep the JSON 401 contract regardless of this setting.\n */\nexport type PageAuthConfig = {\n  /**\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\n   * behavior is opt-in and backward-compatible.\n   */\n  loginPath?: string;\n  /**\n   * Query parameter the redirect carries the originally-requested path in, so\n   * the login flow can send the user back where they were headed.\n   * @default \"returnUrl\"\n   */\n  returnUrlParam?: string;\n};\n\n/**\n * Data every email-verification / password-reset notification receives.\n */\nexport type OneTimeTokenNotificationData = {\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\n  token: string;\n  /** When the token stops working. */\n  expiresAt: Date;\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\n  url?: string;\n};\n\n/**\n * Anything auth can deliver a token through — a `defineNotification(...)`\n * result satisfies it, as does any object with a compatible `send`.\n */\nexport type AuthNotification = {\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\n};\n\n/** Builds the link a token notification points at. */\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\n\n/** Persists a new plaintext password for a user during a password reset. */\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\n\n/**\n * Email-verification configuration (`auth.verification`).\n */\nexport type EmailVerificationConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"24h\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute stamped with the verification `Date`. Declare it in the\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\n   * @default \"emailVerifiedAt\"\n   */\n  field?: string;\n  /** Replace the default verification email. */\n  notification?: AuthNotification;\n  /** Build the verification link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n};\n\n/**\n * Password-reset configuration (`auth.passwordReset`).\n */\nexport type PasswordResetConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"60m\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute `requestPasswordReset` looks the account up by.\n   * @default \"email\"\n   */\n  identifierField?: string;\n  /** Replace the default reset email. */\n  notification?: AuthNotification;\n  /** Build the reset link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n  /**\n   * Persist the new password yourself. By default auth saves a hash made by\n   * the same `hashPassword` login verifies against, and falls back to the\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\n   * the stored value with `verifyPassword` either way.\n   */\n  setPassword?: PasswordSetter;\n};\n\n/**\n * One-time token storage configuration (`auth.oneTimeToken`).\n */\nexport type OneTimeTokenConfig = {\n  /** Override the persisted model — extend {@link OneTimeToken}. */\n  model?: typeof OneTimeToken;\n};\n\nexport type AuthConfigurations = {\n  /**\n   * Define all user types — maps a user-type slug to its `Auth` model class so\n   * tokens and the middleware can resolve the right model.\n   */\n  userType: {\n    [userType: string]: ChildModel<Auth>;\n  };\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\n  defaultUserType?: string;\n  /**\n   * Decide whether a resolved user may authenticate or receive new tokens.\n   * @default () => true\n   */\n  canAuthenticate?: CanAuthenticate;\n  /**\n   * Access-token configuration (secret, expiry, algorithm, model override).\n   */\n  accessToken?: AccessTokenConfig;\n  /**\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\n   */\n  refreshToken?: RefreshTokenConfig;\n  /**\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\n   */\n  pageAuth?: PageAuthConfig;\n  /**\n   * Cookie auth session config — read by `authService.setAuthCookie` /\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\n   */\n  cookie?: CookieAuthConfig;\n  /**\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\n   */\n  csrf?: CsrfConfig;\n  /**\n   * Email verification — token lifetime, verified field, notification override.\n   */\n  verification?: EmailVerificationConfig;\n  /**\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\n   */\n  passwordReset?: PasswordResetConfig;\n  /**\n   * One-time token (verification / reset) storage — model override.\n   */\n  oneTimeToken?: OneTimeTokenConfig;\n  /**\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\n   */\n  providers?: ProvidersConfig;\n  /**\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\n   */\n  passkeys?: PasskeysConfig;\n  /**\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\n   */\n  otp?: OtpConfig;\n  /**\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\n   */\n  jwt?: LegacyJwtConfig;\n};\n\nexport type AccessTokenOutput = {\n  /**\n   * JWT Token\n   */\n  token: string;\n  /**\n   * Exprie time in ISO format UTC time\n   */\n  expiresAt: string;\n};\n\n/**\n * Token pair returned after login or token refresh\n */\nexport type TokenPair = {\n  /**\n   * JWT access token (short-lived)\n   */\n  accessToken: AccessTokenOutput;\n  /**\n   * JWT refresh token (long-lived)\n   */\n  refreshToken?: AccessTokenOutput;\n};\n\n/**\n * Device information for session tracking\n */\nexport type DeviceInfo = {\n  /**\n   * User agent string from request\n   */\n  userAgent?: string;\n  /**\n   * Client IP address\n   */\n  ip?: string;\n  /**\n   * Optional device identifier\n   */\n  deviceId?: string;\n  /**\n   * Token family ID (for rotation tracking)\n   * @internal\n   */\n  familyId?: string;\n  /**\n   * Access token payload\n   */\n  payload?: Record<string, unknown>;\n};\n\nexport type LoginResult<UserType extends Auth> = {\n  user: UserType;\n  tokens: TokenPair;\n};\n\n/** Selects a cookie Domain for one request; return `undefined` for a host-only cookie. */\nexport type CookieDomainResolver = (request: Request) => string | undefined;\n\n/**\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\n * configurable here — they come from core's `secureCookieDefaults()`, the\n * same floor every `response.cookie()` call gets, so a cookie auth session can\n * never be weakened to a laxer policy than the framework default.\n */\nexport type CookieAuthConfig = {\n  /**\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\n   * `cookie:<name>` token source must match to read it back.\n   * @default \"access_token\"\n   */\n  name?: string;\n  /**\n   * Cookie name the session helpers write and clear for the refresh token.\n   * @default \"refresh_token\"\n   */\n  refreshName?: string;\n  /**\n   * Cookie `Path` attribute.\n   * @default \"/\"\n   */\n  path?: string;\n  /** Select a request-scoped Domain; `undefined` keeps the cookie host-only. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * CSRF Origin-check configuration. Read via\n * `authConfig.csrf.allowedOrigins()`.\n */\nexport type CsrfConfig = {\n  /**\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\n   * in addition to the request's own origin.\n   * @default []\n   */\n  allowedOrigins?: string[];\n};\n\n/**\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\n * falls back to `auth.cookie.*` config, then the package default. Cookie\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\n * see {@link CookieAuthConfig}.\n */\nexport type SetAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\n  path?: string;\n  /** Cookie `Domain` attribute. Omit for a host-only cookie. */\n  domain?: string;\n  /**\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\n   * bare token string with no `maxAge` produces a session cookie (cleared\n   * when the browser closes).\n   */\n  maxAge?: number;\n};\n\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\nexport type ClearAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\n  path?: string;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4BA,MAAa,gBAAgB"}

package/esm/errors/auth-provider-sdk-missing.error.d.mts

@@ -1,6 +1,6 @@
 import { ServerError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/auth-provider-sdk-missing.error.d.ts
+//#region ../../packages/auth/src/errors/auth-provider-sdk-missing.error.d.ts
 /**
  * A login method needs a vendor SDK that is an optional peer of
  * `@warlock.js/auth` and is not installed. The message names the package and

package/esm/errors/auth-provider-sdk-missing.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-sdk-missing.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/auth-provider-sdk-missing.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,2BAAA,SAAoC,WAAW;EAAA,SAExC,WAAA;EAAA,SACA,OAAA;cADA,WAAA,UACA,OAAA,UAChB,KAAA;AAAA"}
+{"version":3,"file":"auth-provider-sdk-missing.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/auth-provider-sdk-missing.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,2BAAA,SAAoC,WAAW;EAAA,SAExC,WAAA;EAAA,SACA,OAAA;cADA,WAAA,UACA,OAAA,UAChB,KAAA;AAAA"}

package/esm/errors/auth-provider-sdk-missing.error.mjs

@@ -1,6 +1,6 @@
 import { ServerError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/auth-provider-sdk-missing.error.ts
+//#region ../../packages/auth/src/errors/auth-provider-sdk-missing.error.ts
 /**
 * A login method needs a vendor SDK that is an optional peer of
 * `@warlock.js/auth` and is not installed. The message names the package and

package/esm/errors/auth-provider-sdk-missing.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-sdk-missing.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/auth-provider-sdk-missing.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * A login method needs a vendor SDK that is an optional peer of\n * `@warlock.js/auth` and is not installed. The message names the package and\n * the `warlock add` command that installs it; the resolver failure is kept on\n * `cause`.\n */\nexport class AuthProviderSdkMissingError extends ServerError {\n  public constructor(\n    public readonly packageName: string,\n    public readonly feature: string,\n    cause?: unknown,\n  ) {\n    super(\n      `@warlock.js/auth: this login method needs \"${packageName}\", which is not installed — ` +\n        `run \\`warlock add ${feature}\\`.`,\n    );\n    this.name = \"AuthProviderSdkMissingError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,8BAAb,cAAiD,YAAY;CAC3D,AAAO,YACL,AAAgB,aAChB,AAAgB,SAChB,OACA;EACA,MACE,8CAA8C,YAAY,gDACnC,QAAQ,IACjC;EAPgB;EACA;EAOhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}
+{"version":3,"file":"auth-provider-sdk-missing.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/auth-provider-sdk-missing.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * A login method needs a vendor SDK that is an optional peer of\n * `@warlock.js/auth` and is not installed. The message names the package and\n * the `warlock add` command that installs it; the resolver failure is kept on\n * `cause`.\n */\nexport class AuthProviderSdkMissingError extends ServerError {\n  public constructor(\n    public readonly packageName: string,\n    public readonly feature: string,\n    cause?: unknown,\n  ) {\n    super(\n      `@warlock.js/auth: this login method needs \"${packageName}\", which is not installed — ` +\n        `run \\`warlock add ${feature}\\`.`,\n    );\n    this.name = \"AuthProviderSdkMissingError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,8BAAb,cAAiD,YAAY;CAC3D,AAAO,YACL,AAAgB,aAChB,AAAgB,SAChB,OACA;EACA,MACE,8CAA8C,YAAY,gDACnC,QAAQ,IACjC;EAPgB;EACA;EAOhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/email-not-verified.error.d.mts

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { ForbiddenError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/email-not-verified.error.d.ts
+//#region ../../packages/auth/src/errors/email-not-verified.error.d.ts
 /**
  * The authenticated user has not verified their email address. Thrown by
  * `requireVerifiedEmail()`; core's error handler answers it with `403` and a

package/esm/errors/email-not-verified.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,qBAAA,SAA8B,cAAc;EAAA,SACvC,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,OAAA;AAAA"}
+{"version":3,"file":"email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,qBAAA,SAA8B,cAAc;EAAA,SACvC,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,OAAA;AAAA"}

package/esm/errors/email-not-verified.error.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { ForbiddenError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/email-not-verified.error.ts
+//#region ../../packages/auth/src/errors/email-not-verified.error.ts
 /**
 * The authenticated user has not verified their email address. Thrown by
 * `requireVerifiedEmail()`; core's error handler answers it with `403` and a

package/esm/errors/email-not-verified.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The authenticated user has not verified their email address. Thrown by\n * `requireVerifiedEmail()`; core's error handler answers it with `403` and a\n * `payload.errorCode` of `EC007`.\n */\nexport class EmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.EmailNotVerified;\n\n  public constructor(message = \"Email address is not verified.\") {\n    super(message, { errorCode: AuthErrorCodes.EmailNotVerified });\n    this.name = \"EmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,wBAAb,cAA2C,eAAe;CAGxD,AAAO,YAAY,UAAU,kCAAkC;EAC7D,MAAM,SAAS,EAAE,mBAA2C,CAAC;;EAC7D,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"email-not-verified.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The authenticated user has not verified their email address. Thrown by\n * `requireVerifiedEmail()`; core's error handler answers it with `403` and a\n * `payload.errorCode` of `EC007`.\n */\nexport class EmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.EmailNotVerified;\n\n  public constructor(message = \"Email address is not verified.\") {\n    super(message, { errorCode: AuthErrorCodes.EmailNotVerified });\n    this.name = \"EmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,wBAAb,cAA2C,eAAe;CAGxD,AAAO,YAAY,UAAU,kCAAkC;EAC7D,MAAM,SAAS,EAAE,mBAA2C,CAAC;;EAC7D,KAAK,OAAO;CACd;AACF"}

package/esm/errors/invalid-one-time-token.error.d.mts

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-one-time-token.error.d.ts
+//#region ../../packages/auth/src/errors/invalid-one-time-token.error.d.ts
 /**
  * An email-verification or password-reset token was rejected: unknown, issued
  * for the other purpose, expired, or already consumed (including losing a

package/esm/errors/invalid-one-time-token.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-one-time-token.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,wBAAA,SAAiC,eAAe;EAAA,SAC3C,IAAA,GAAI,cAAA,CAAA,mBAAA;cAED,OAAA;AAAA"}
+{"version":3,"file":"invalid-one-time-token.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-one-time-token.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,wBAAA,SAAiC,eAAe;EAAA,SAC3C,IAAA,GAAI,cAAA,CAAA,mBAAA;cAED,OAAA;AAAA"}

package/esm/errors/invalid-one-time-token.error.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-one-time-token.error.ts
+//#region ../../packages/auth/src/errors/invalid-one-time-token.error.ts
 /**
 * An email-verification or password-reset token was rejected: unknown, issued
 * for the other purpose, expired, or already consumed (including losing a

package/esm/errors/invalid-one-time-token.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-one-time-token.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-one-time-token.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * An email-verification or password-reset token was rejected: unknown, issued\n * for the other purpose, expired, or already consumed (including losing a\n * concurrent consumption race). Deliberately ONE error for all of them, so a\n * caller cannot probe which case applies. Answers `400` with `EC008`.\n */\nexport class InvalidOneTimeTokenError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidOneTimeToken;\n\n  public constructor(message = \"Invalid or expired token.\") {\n    super(message, { errorCode: AuthErrorCodes.InvalidOneTimeToken });\n    this.name = \"InvalidOneTimeTokenError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,2BAAb,cAA8C,gBAAgB;CAG5D,AAAO,YAAY,UAAU,6BAA6B;EACxD,MAAM,SAAS,EAAE,mBAA8C,CAAC;;EAChE,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"invalid-one-time-token.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-one-time-token.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * An email-verification or password-reset token was rejected: unknown, issued\n * for the other purpose, expired, or already consumed (including losing a\n * concurrent consumption race). Deliberately ONE error for all of them, so a\n * caller cannot probe which case applies. Answers `400` with `EC008`.\n */\nexport class InvalidOneTimeTokenError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidOneTimeToken;\n\n  public constructor(message = \"Invalid or expired token.\") {\n    super(message, { errorCode: AuthErrorCodes.InvalidOneTimeToken });\n    this.name = \"InvalidOneTimeTokenError\";\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,2BAAb,cAA8C,gBAAgB;CAG5D,AAAO,YAAY,UAAU,6BAA6B;EACxD,MAAM,SAAS,EAAE,mBAA8C,CAAC;;EAChE,KAAK,OAAO;CACd;AACF"}

package/esm/errors/invalid-passkey.error.d.mts

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-passkey.error.d.ts
+//#region ../../packages/auth/src/errors/invalid-passkey.error.d.ts
 /**
  * A passkey registration or authentication was rejected — unknown, expired
  * or used challenge, unknown credential, failed verification, or a signature

package/esm/errors/invalid-passkey.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-passkey.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,mBAAA,SAA4B,eAAe;EAAA,SAIpC,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,cAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}
+{"version":3,"file":"invalid-passkey.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-passkey.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,mBAAA,SAA4B,eAAe;EAAA,SAIpC,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,cAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-passkey.error.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-passkey.error.ts
+//#region ../../packages/auth/src/errors/invalid-passkey.error.ts
 /**
 * A passkey registration or authentication was rejected — unknown, expired
 * or used challenge, unknown credential, failed verification, or a signature

package/esm/errors/invalid-passkey.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-passkey.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-passkey.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A passkey registration or authentication was rejected — unknown, expired\n * or used challenge, unknown credential, failed verification, or a signature\n * counter that did not advance. `reason` is for logs; the message stays\n * generic. Answers `400` with `EC011`.\n */\nexport class InvalidPasskeyError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidPasskey;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Passkey verification failed.\", { errorCode: AuthErrorCodes.InvalidPasskey });\n    this.name = \"InvalidPasskeyError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,sBAAb,cAAyC,gBAAgB;CAGvD,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,gCAAgC,EAAE,mBAAyC,CAAC;EAHlE;;EAIhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}
+{"version":3,"file":"invalid-passkey.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-passkey.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A passkey registration or authentication was rejected — unknown, expired\n * or used challenge, unknown credential, failed verification, or a signature\n * counter that did not advance. `reason` is for logs; the message stays\n * generic. Answers `400` with `EC011`.\n */\nexport class InvalidPasskeyError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidPasskey;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Passkey verification failed.\", { errorCode: AuthErrorCodes.InvalidPasskey });\n    this.name = \"InvalidPasskeyError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,sBAAb,cAAyC,gBAAgB;CAGvD,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,gCAAgC,EAAE,mBAAyC,CAAC;EAHlE;;EAIhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/invalid-provider-callback.error.d.mts

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-provider-callback.error.d.ts
+//#region ../../packages/auth/src/errors/invalid-provider-callback.error.d.ts
 /**
  * A redirect-provider callback was rejected — missing, forged or expired
  * state cookie, `state` mismatch, failed code exchange, or an id_token with a

package/esm/errors/invalid-provider-callback.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-provider-callback.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,4BAAA,SAAqC,eAAe;EAAA,SAI7C,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,uBAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}
+{"version":3,"file":"invalid-provider-callback.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-provider-callback.error.ts"],"mappings":";;;;;;AASA;;;;cAAa,4BAAA,SAAqC,eAAe;EAAA,SAI7C,MAAA;EAAA,SAHF,IAAA,GAAI,cAAA,CAAA,uBAAA;cAGF,MAAA,UAChB,KAAA;AAAA"}

package/esm/errors/invalid-provider-callback.error.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { BadRequestError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/invalid-provider-callback.error.ts
+//#region ../../packages/auth/src/errors/invalid-provider-callback.error.ts
 /**
 * A redirect-provider callback was rejected — missing, forged or expired
 * state cookie, `state` mismatch, failed code exchange, or an id_token with a

package/esm/errors/invalid-provider-callback.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"invalid-provider-callback.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/invalid-provider-callback.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A redirect-provider callback was rejected — missing, forged or expired\n * state cookie, `state` mismatch, failed code exchange, or an id_token with a\n * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;\n * the response message stays generic. Answers `400` with `EC009`.\n */\nexport class InvalidProviderCallbackError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidProviderCallback;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Login with the provider failed.\", {\n      errorCode: AuthErrorCodes.InvalidProviderCallback,\n    });\n    this.name = \"InvalidProviderCallbackError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,+BAAb,cAAkD,gBAAgB;CAGhE,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,mCAAmC,EACvC,mBACF,CAAC;EALe;;EAMhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}
+{"version":3,"file":"invalid-provider-callback.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/invalid-provider-callback.error.ts"],"sourcesContent":["import { BadRequestError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * A redirect-provider callback was rejected — missing, forged or expired\n * state cookie, `state` mismatch, failed code exchange, or an id_token with a\n * bad signature, issuer, audience, expiry or nonce. `reason` is for logs;\n * the response message stays generic. Answers `400` with `EC009`.\n */\nexport class InvalidProviderCallbackError extends BadRequestError {\n  public readonly code = AuthErrorCodes.InvalidProviderCallback;\n\n  public constructor(\n    public readonly reason: string,\n    cause?: unknown,\n  ) {\n    super(\"Login with the provider failed.\", {\n      errorCode: AuthErrorCodes.InvalidProviderCallback,\n    });\n    this.name = \"InvalidProviderCallbackError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;AASA,IAAa,+BAAb,cAAkD,gBAAgB;CAGhE,AAAO,YACL,AAAgB,QAChB,OACA;EACA,MAAM,mCAAmC,EACvC,mBACF,CAAC;EALe;;EAMhB,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/notifications-unavailable.error.d.mts

@@ -1,6 +1,6 @@
 import { ServerError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/notifications-unavailable.error.d.ts
+//#region ../../packages/auth/src/errors/notifications-unavailable.error.d.ts
 /**
  * Email verification / password reset could not send its notification because
  * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE

package/esm/errors/notifications-unavailable.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications-unavailable.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,6BAAA,SAAsC,WAAW;cACzC,MAAA,sCAA4C,KAAA;AAAA"}
+{"version":3,"file":"notifications-unavailable.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/notifications-unavailable.error.ts"],"mappings":";;;;;AAQA;;;;cAAa,6BAAA,SAAsC,WAAW;cACzC,MAAA,sCAA4C,KAAA;AAAA"}

package/esm/errors/notifications-unavailable.error.mjs

@@ -1,6 +1,6 @@
 import { ServerError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/notifications-unavailable.error.ts
+//#region ../../packages/auth/src/errors/notifications-unavailable.error.ts
 /**
 * Email verification / password reset could not send its notification because
 * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE

package/esm/errors/notifications-unavailable.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"notifications-unavailable.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/notifications-unavailable.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * Email verification / password reset could not send its notification because\n * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE\n * any token is issued — auth never issues a token it cannot deliver, and never\n * skips the send silently. The original failure is kept on `cause`.\n */\nexport class NotificationsUnavailableError extends ServerError {\n  public constructor(reason: \"not-installed\" | \"not-configured\", cause?: unknown) {\n    super(\n      reason === \"not-installed\"\n        ? \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not installed — add it to the app's dependencies.\"\n        : \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not configured — add `src/config/notifications.ts` \" +\n            \"with a `mail` channel.\",\n    );\n    this.name = \"NotificationsUnavailableError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,YAAY;CAC7D,AAAO,YAAY,QAA4C,OAAiB;EAC9E,MACE,WAAW,kBACP,+JAEA,oLAGN;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}
+{"version":3,"file":"notifications-unavailable.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/notifications-unavailable.error.ts"],"sourcesContent":["import { ServerError } from \"@warlock.js/core\";\n\n/**\n * Email verification / password reset could not send its notification because\n * `@warlock.js/notifications` is not installed or not configured. Thrown BEFORE\n * any token is issued — auth never issues a token it cannot deliver, and never\n * skips the send silently. The original failure is kept on `cause`.\n */\nexport class NotificationsUnavailableError extends ServerError {\n  public constructor(reason: \"not-installed\" | \"not-configured\", cause?: unknown) {\n    super(\n      reason === \"not-installed\"\n        ? \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not installed — add it to the app's dependencies.\"\n        : \"@warlock.js/auth: email verification and password reset send through \" +\n            \"@warlock.js/notifications, which is not configured — add `src/config/notifications.ts` \" +\n            \"with a `mail` channel.\",\n    );\n    this.name = \"NotificationsUnavailableError\";\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,YAAY;CAC7D,AAAO,YAAY,QAA4C,OAAiB;EAC9E,MACE,WAAW,kBACP,+JAEA,oLAGN;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;CACf;AACF"}

package/esm/errors/provider-email-not-verified.error.d.mts

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { ForbiddenError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/provider-email-not-verified.error.d.ts
+//#region ../../packages/auth/src/errors/provider-email-not-verified.error.d.ts
 /**
  * The provider did not verify the email on a profile with no existing link,
  * so auth refused to link it to (or create) an account. Answers `403` with

package/esm/errors/provider-email-not-verified.error.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,6BAAA,SAAsC,cAAc;EAAA,SAC/C,IAAA,GAAI,cAAA,CAAA,wBAAA;cAED,OAAA;AAAA"}
+{"version":3,"file":"provider-email-not-verified.error.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/errors/provider-email-not-verified.error.ts"],"mappings":";;;;;;AAQA;;;cAAa,6BAAA,SAAsC,cAAc;EAAA,SAC/C,IAAA,GAAI,cAAA,CAAA,wBAAA;cAED,OAAA;AAAA"}

package/esm/errors/provider-email-not-verified.error.mjs

@@ -1,7 +1,7 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { ForbiddenError } from "@warlock.js/core";
 
-//#region ../auth/src/errors/provider-email-not-verified.error.ts
+//#region ../../packages/auth/src/errors/provider-email-not-verified.error.ts
 /**
 * The provider did not verify the email on a profile with no existing link,
 * so auth refused to link it to (or create) an account. Answers `403` with

package/esm/errors/provider-email-not-verified.error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-email-not-verified.error.mjs","names":[],"sources":["../../../../../../../auth/src/errors/provider-email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The provider did not verify the email on a profile with no existing link,\n * so auth refused to link it to (or create) an account. Answers `403` with\n * `EC010`.\n */\nexport class ProviderEmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.ProviderEmailNotVerified;\n\n  public constructor(message = \"The provider has not verified this email address.\") {\n    super(message, { errorCode: AuthErrorCodes.ProviderEmailNotVerified });\n    this.name = \"ProviderEmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,eAAe;CAGhE,AAAO,YAAY,UAAU,qDAAqD;EAChF,MAAM,SAAS,EAAE,mBAAmD,CAAC;;EACrE,KAAK,OAAO;CACd;AACF"}
+{"version":3,"file":"provider-email-not-verified.error.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/errors/provider-email-not-verified.error.ts"],"sourcesContent":["import { ForbiddenError } from \"@warlock.js/core\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * The provider did not verify the email on a profile with no existing link,\n * so auth refused to link it to (or create) an account. Answers `403` with\n * `EC010`.\n */\nexport class ProviderEmailNotVerifiedError extends ForbiddenError {\n  public readonly code = AuthErrorCodes.ProviderEmailNotVerified;\n\n  public constructor(message = \"The provider has not verified this email address.\") {\n    super(message, { errorCode: AuthErrorCodes.ProviderEmailNotVerified });\n    this.name = \"ProviderEmailNotVerifiedError\";\n  }\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,gCAAb,cAAmD,eAAe;CAGhE,AAAO,YAAY,UAAU,qDAAqD;EAChF,MAAM,SAAS,EAAE,mBAAmD,CAAC;;EACrE,KAAK,OAAO;CACd;AACF"}