@warlock.js/auth 5.28.0 → 5.30.0

package/esm/models/index.d.mts

@@ -5,7 +5,7 @@ import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./re
 import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family/auth-token-family.model.mjs";
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
 import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
-//#region ../auth/src/models/index.d.ts
+//#region ../../packages/auth/src/models/index.d.ts
 declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
 //#endregion
 export { authMigrations };

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"mappings":";;;;;;;;cAiBa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"mappings":";;;;;;;;cAiBa,cAAA,gCAAc,oBAAA"}

package/esm/models/index.mjs

@@ -20,7 +20,7 @@ import { Auth } from "./auth.model.mjs";
 import "./passkey-credential/index.mjs";
 import "./provider-account/index.mjs";
 
-//#region ../auth/src/models/index.ts
+//#region ../../packages/auth/src/models/index.ts
 const authMigrations = [
 	AccessTokenMigration,
 	AccessTokenFamilyAssociationMigration,

package/esm/models/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenFamilyAssociationMigration } from \"./access-token/family-association.migration\";\nimport { AccessTokenMigration } from \"./access-token/migration\";\nimport { AuthTokenFamilyMigration } from \"./auth-token-family/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\nimport { RefreshTokenSuccessorAssociationMigration } from \"./refresh-token/successor-association.migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth-token-family\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  AccessTokenFamilyAssociationMigration,\n  RefreshTokenMigration,\n  RefreshTokenSuccessorAssociationMigration,\n  AuthTokenFamilyMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenFamilyAssociationMigration } from \"./access-token/family-association.migration\";\nimport { AccessTokenMigration } from \"./access-token/migration\";\nimport { AuthTokenFamilyMigration } from \"./auth-token-family/migration\";\nimport { OneTimeTokenMigration } from \"./one-time-token/migration\";\nimport { PasskeyCredentialMigration } from \"./passkey-credential/migration\";\nimport { ProviderAccountMigration } from \"./provider-account/migration\";\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\nimport { RefreshTokenSuccessorAssociationMigration } from \"./refresh-token/successor-association.migration\";\n\nexport * from \"./access-token\";\nexport * from \"./auth-token-family\";\nexport * from \"./auth.model\";\nexport * from \"./one-time-token\";\nexport * from \"./passkey-credential\";\nexport * from \"./provider-account\";\nexport * from \"./refresh-token\";\n\nexport const authMigrations = [\n  AccessTokenMigration,\n  AccessTokenFamilyAssociationMigration,\n  RefreshTokenMigration,\n  RefreshTokenSuccessorAssociationMigration,\n  AuthTokenFamilyMigration,\n  OneTimeTokenMigration,\n  ProviderAccountMigration,\n  PasskeyCredentialMigration,\n];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAa,iBAAiB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/esm/models/one-time-token/migration.mjs

@@ -1,7 +1,7 @@
 import { OneTimeToken } from "./one-time-token.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/one-time-token/migration.ts
+//#region ../../packages/auth/src/models/one-time-token/migration.ts
 const OneTimeTokenMigration = migrate(OneTimeToken, {
 	name: "oneTimeToken",
 	up() {

package/esm/models/one-time-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { OneTimeToken } from \"./one-time-token.model\";\n\nexport const OneTimeTokenMigration = migrate(OneTimeToken, {\n  name: \"oneTimeToken\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    // SHA-256 hex digest of the raw token — the raw token is never stored.\n    this.string(\"token_hash\", 64).unique();\n    this.string(\"purpose\", 32);\n\n    // `foreignId` follows the DataSource's default primary-key type, matching\n    // the access/refresh token tables. Nullable only for a passkey\n    // authentication challenge, which is issued before anyone is identified.\n    this.foreignId(\"user_id\").nullable().index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"consumed_at\").nullable();\n\n    // Failed verify attempts — only OTP codes are capped on it.\n    this.integer(\"attempts\").default(0);\n\n    // Invalidating a user's previous reset tokens filters on these.\n    this.index([\"user_id\", \"user_type\", \"purpose\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAGjB,KAAK,OAAO,cAAc,EAAE,CAAC,CAAC,OAAO;EACrC,KAAK,OAAO,WAAW,EAAE;EAKzB,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;EAC3C,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,aAAa,CAAC,CAAC,SAAS;EAGvC,KAAK,QAAQ,UAAU,CAAC,CAAC,QAAQ,CAAC;EAGlC,KAAK,MAAM;GAAC;GAAW;GAAa;EAAS,CAAC;EAE9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { OneTimeToken } from \"./one-time-token.model\";\n\nexport const OneTimeTokenMigration = migrate(OneTimeToken, {\n  name: \"oneTimeToken\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    // SHA-256 hex digest of the raw token — the raw token is never stored.\n    this.string(\"token_hash\", 64).unique();\n    this.string(\"purpose\", 32);\n\n    // `foreignId` follows the DataSource's default primary-key type, matching\n    // the access/refresh token tables. Nullable only for a passkey\n    // authentication challenge, which is issued before anyone is identified.\n    this.foreignId(\"user_id\").nullable().index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"consumed_at\").nullable();\n\n    // Failed verify attempts — only OTP codes are capped on it.\n    this.integer(\"attempts\").default(0);\n\n    // Invalidating a user's previous reset tokens filters on these.\n    this.index([\"user_id\", \"user_type\", \"purpose\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAGjB,KAAK,OAAO,cAAc,EAAE,CAAC,CAAC,OAAO;EACrC,KAAK,OAAO,WAAW,EAAE;EAKzB,KAAK,UAAU,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;EAC3C,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,aAAa,CAAC,CAAC,SAAS;EAGvC,KAAK,QAAQ,UAAU,CAAC,CAAC,QAAQ,CAAC;EAGlC,KAAK,MAAM;GAAC;GAAW;GAAa;EAAS,CAAC;EAE9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/one-time-token/one-time-token.model.d.mts

@@ -1,7 +1,7 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/one-time-token/one-time-token.model.d.ts
+//#region ../../packages/auth/src/models/one-time-token/one-time-token.model.d.ts
 /** What a one-time token may be used for. A token only ever satisfies its own purpose. */
 type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
 /**
@@ -24,39 +24,23 @@ declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
-    isOptional: true;
-  };
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-    isOptional: true;
-  };
-  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
-  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
-    isOptional: true;
-  };
-  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
-    isOptional: true;
-  };
-}>, import("@warlock.js/seal").InferInputObjectShape<{
-  token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
-    isOptional: true;
-  };
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-    isOptional: true;
-  };
-  expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
-  consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
-    isOptional: true;
-  };
-  attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
-    isOptional: true;
-  };
-}>>;
+}> & import("@warlock.js/seal").StandardSchemaV1<{
+  user_id?: string | number | boolean | undefined;
+  user_type?: string | undefined;
+  consumed_at?: Date | undefined;
+  attempts?: number | undefined;
+  token_hash: string;
+  purpose: string;
+  expires_at: Date;
+}, {
+  user_id?: string | number | boolean | undefined;
+  user_type?: string | undefined;
+  consumed_at?: Date | undefined;
+  attempts?: number | undefined;
+  token_hash: string;
+  purpose: string;
+  expires_at: Date;
+}>;
 /**
  * Persisted one-time secret: email-verification / password-reset token, OTP
  * code, or passkey ceremony challenge.
@@ -84,39 +68,23 @@ declare class OneTimeToken extends Model {
     attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
-      isOptional: true;
-    };
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-      isOptional: true;
-    };
-    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
-    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
-      isOptional: true;
-    };
-    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
-      isOptional: true;
-    };
-  }>, import("@warlock.js/seal").InferInputObjectShape<{
-    token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
-      isOptional: true;
-    };
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-      isOptional: true;
-    };
-    expires_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date>;
-    consumed_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
-      isOptional: true;
-    };
-    attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
-      isOptional: true;
-    };
-  }>>;
+  }> & import("@warlock.js/seal").StandardSchemaV1<{
+    user_id?: string | number | boolean | undefined;
+    user_type?: string | undefined;
+    consumed_at?: Date | undefined;
+    attempts?: number | undefined;
+    token_hash: string;
+    purpose: string;
+    expires_at: Date;
+  }, {
+    user_id?: string | number | boolean | undefined;
+    user_type?: string | undefined;
+    consumed_at?: Date | undefined;
+    attempts?: number | undefined;
+    token_hash: string;
+    purpose: string;
+    expires_at: Date;
+  }>;
   /**
    * The SHA-256 of a one-time secret. For a short OTP code the hash is
    * brute-forceable offline, so it is as sensitive as the code itself — never

package/esm/models/one-time-token/one-time-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;SAUgB,MAAA;;;;;;;SAQA,cAAA;;MAGH,MAAA;;MAKA,QAAA;EAuBqB;EAAA,IAlBrB,UAAA;EAgCA;EAAA,IA3BA,SAAA;EA6BM;;;;;EAhBJ,eAAA,IAAmB,OAAA;EAqCnB;EAAA,OAzBC,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;EAqCN;;;;EAAA,OApBG,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;EAiEF;EAAA,OAnDG,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;EAiDR;;;;;EArCU,aAAA,CAAc,GAAA,WAAc,OAAA;EAnHJ;;;;;;EAAA,OAsIjB,UAAA,IAAc,OAAA;;SAepB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;SAQG,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}
+{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2DZ;;;;;EAAA,OApDM,MAAA;EA2ED;;;;;;EAAA,OAnEC,cAAA;EAqFX;EAAA,IAlFQ,MAAA;EAiHuB;EAAA,IA5GvB,QAAA;EA8HA;EAAA,IAzHA,UAAA;EAiI6B;EAAA,IA5H7B,SAAA;EA4HkE;;;;;EA/GhE,eAAA,IAAmB,OAAA;EA9ClB;EAAA,OA0DA,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;;;;;SAiBH,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;;SAcC,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;;EAYE,aAAA,CAAc,GAAA,WAAc,OAAA;;;;;;;SAmBrB,UAAA,IAAc,OAAA;;SAepB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;SAQG,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}

package/esm/models/one-time-token/one-time-token.model.mjs

@@ -2,7 +2,7 @@ import { isUsableExpiry } from "../../utils/token-expiry.mjs";
 import { Model } from "@warlock.js/cascade";
 import { v } from "@warlock.js/seal";
 
-//#region ../auth/src/models/one-time-token/one-time-token.model.ts
+//#region ../../packages/auth/src/models/one-time-token/one-time-token.model.ts
 /**
 * Seal schema for the persisted one-time token. Exported so an override can
 * extend it (e.g. a tenant key).

package/esm/models/one-time-token/one-time-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/one-time-token/one-time-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport { isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/** What a one-time token may be used for. A token only ever satisfies its own purpose. */\nexport type OneTimeTokenPurpose =\n  | \"email-verification\"\n  | \"password-reset\"\n  | \"otp\"\n  | \"passkey-registration\"\n  | \"passkey-authentication\";\n\n/**\n * Seal schema for the persisted one-time token. Exported so an override can\n * extend it (e.g. a tenant key).\n */\nexport const oneTimeTokenSchema = v.object({\n  token_hash: v.string().required(),\n  purpose: v.string().required(),\n  // Absent only on a passkey authentication challenge (no user identified yet).\n  user_id: v.scalar().optional(),\n  user_type: v.string().optional(),\n  expires_at: v.date().required(),\n  consumed_at: v.date().optional(),\n  attempts: v.int().optional(),\n});\n\n/**\n * Persisted one-time secret: email-verification / password-reset token, OTP\n * code, or passkey ceremony challenge.\n *\n * **Only a SHA-256 hash is stored** — the raw token exists in the notification\n * and nowhere else, so a leaked table cannot be replayed. Single use is\n * enforced by {@link consumeIfActive}, a conditional update in the same shape\n * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.\n */\nexport class OneTimeToken extends Model {\n  public static table = \"one_time_tokens\";\n\n  public static schema = oneTimeTokenSchema;\n\n  /**\n   * The SHA-256 of a one-time secret. For a short OTP code the hash is\n   * brute-forceable offline, so it is as sensitive as the code itself — never\n   * serialize it. Only `toJSON()` is affected; `findByHash` still queries it.\n   */\n  public static hidden = [\"token_hash\"];\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy spent token hashes into\n   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must\n   * not survive anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Whether the token has been used (or invalidated by a newer one). */\n  public get isConsumed(): boolean {\n    return !!this.get(\"consumed_at\");\n  }\n\n  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date(expiresAt).getTime() <= Date.now();\n  }\n\n  /**\n   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`\n   * for the single caller that won; every concurrent or later caller gets\n   * `false`.\n   */\n  public async consumeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const consumed = await modelClass.atomic(\n      { id: this.id, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n\n    return consumed > 0;\n  }\n\n  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */\n  public static issue(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user.id,\n      user_type: user.userType,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /**\n   * Persist a passkey ceremony challenge. `user` is omitted for an\n   * authentication challenge, issued before anyone is identified.\n   */\n  public static issueChallenge(\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n    user?: Auth,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user?.id ?? null,\n      user_type: user?.userType ?? null,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */\n  public static findActiveFor(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, purpose, consumed_at: null })\n      .orderBy(\"created_at\", \"desc\")\n      .first();\n  }\n\n  /**\n   * Atomically count one verify attempt, ONLY while fewer than `max` have been\n   * counted and the token is unconsumed. Resolves `false` once the cap is\n   * reached — of N concurrent attempts, at most `max` ever resolve `true`.\n   */\n  public async recordAttempt(max: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const counted = await modelClass.atomic(\n      { id: this.id, consumed_at: null, attempts: { $lt: max } },\n      { $inc: { attempts: 1 } },\n      // Code-authored filter; nothing here comes from the request.\n      { trustedFilter: true },\n    );\n\n    return counted > 0;\n  }\n\n  /**\n   * Hard-delete every spent row — expired, or consumed (used, invalidated by a\n   * newer token, or exhausted). Neither can ever be redeemed again, so nothing\n   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI\n   * command (a cold batch path).\n   */\n  public static async purgeSpent(): Promise<number> {\n    const expired = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n    const consumed = await this.query().whereNotNull(\"consumed_at\").get();\n    const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));\n\n    for (const token of spent.values()) {\n      // `static deleteStrategy` above already forces \"permanent\" regardless\n      // of the data source default (Mongo's is \"trash\").\n      await token.destroy();\n    }\n\n    return spent.size;\n  }\n\n  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */\n  public static findByHash(\n    tokenHash: string,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.first({ token_hash: tokenHash, purpose });\n  }\n\n  /**\n   * Consume every still-unused token of `purpose` for the user, returning how\n   * many were invalidated. Used before issuing a new password-reset token.\n   */\n  public static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number> {\n    return this.atomic(\n      { user_id: user.id, user_type: user.userType, purpose, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAE7B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;;;;AAWD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;gBAOA,CAAC,YAAY;;;wBAQL;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,IAAW,aAAsB;EAC/B,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa;CACjC;;CAGA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;CAOA,MAAa,kBAAoC;EAQ/C,OAAO,MAPY,KAAK,YAEU,OAChC;GAAE,IAAI,KAAK;GAAI,aAAa;EAAK,GACjC,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC,IAEkB;CACpB;;CAGA,OAAc,MACZ,MACA,SACA,WACA,WACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;;;;CAMA,OAAc,eACZ,SACA,WACA,WACA,MACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,MAAM,MAAM;GACrB,WAAW,MAAM,YAAY;GAC7B,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;CAGA,OAAc,cACZ,MACA,SAC8B;EAC9B,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,CAAC,CAAC,CACjF,QAAQ,cAAc,MAAM,CAAC,CAC7B,MAAM;CACX;;;;;;CAOA,MAAa,cAAc,KAA+B;EAUxD,OAAO,MATY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,aAAa;GAAM,UAAU,EAAE,KAAK,IAAI;EAAE,GACzD,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAExB,EAAE,eAAe,KAAK,CACxB,IAEiB;CACnB;;;;;;;CAQA,aAAoB,aAA8B;EAChD,MAAM,UAAU,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAC5E,MAAM,WAAW,MAAM,KAAK,MAAM,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,IAAI;EACpE,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;EAEzF,KAAK,MAAM,SAAS,MAAM,OAAO,GAG/B,MAAM,MAAM,QAAQ;EAGtB,OAAO,MAAM;CACf;;CAGA,OAAc,WACZ,WACA,SAC8B;EAC9B,OAAO,KAAK,MAAM;GAAE,YAAY;GAAW;EAAQ,CAAC;CACtD;;;;;CAMA,OAAc,oBAAoB,MAAY,SAA+C;EAC3F,OAAO,KAAK,OACV;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,GACzE,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC;CACF;AACF"}
+{"version":3,"file":"one-time-token.model.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport { isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/** What a one-time token may be used for. A token only ever satisfies its own purpose. */\nexport type OneTimeTokenPurpose =\n  | \"email-verification\"\n  | \"password-reset\"\n  | \"otp\"\n  | \"passkey-registration\"\n  | \"passkey-authentication\";\n\n/**\n * Seal schema for the persisted one-time token. Exported so an override can\n * extend it (e.g. a tenant key).\n */\nexport const oneTimeTokenSchema = v.object({\n  token_hash: v.string().required(),\n  purpose: v.string().required(),\n  // Absent only on a passkey authentication challenge (no user identified yet).\n  user_id: v.scalar().optional(),\n  user_type: v.string().optional(),\n  expires_at: v.date().required(),\n  consumed_at: v.date().optional(),\n  attempts: v.int().optional(),\n});\n\n/**\n * Persisted one-time secret: email-verification / password-reset token, OTP\n * code, or passkey ceremony challenge.\n *\n * **Only a SHA-256 hash is stored** — the raw token exists in the notification\n * and nowhere else, so a leaked table cannot be replayed. Single use is\n * enforced by {@link consumeIfActive}, a conditional update in the same shape\n * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.\n */\nexport class OneTimeToken extends Model {\n  public static table = \"one_time_tokens\";\n\n  public static schema = oneTimeTokenSchema;\n\n  /**\n   * The SHA-256 of a one-time secret. For a short OTP code the hash is\n   * brute-forceable offline, so it is as sensitive as the code itself — never\n   * serialize it. Only `toJSON()` is affected; `findByHash` still queries it.\n   */\n  public static hidden = [\"token_hash\"];\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy spent token hashes into\n   * `one_time_tokensTrash` on every `destroy()`. A purged one-time token must\n   * not survive anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Whether the token has been used (or invalidated by a newer one). */\n  public get isConsumed(): boolean {\n    return !!this.get(\"consumed_at\");\n  }\n\n  /** Whether the expiry has passed. Fails closed: an unusable `expires_at` counts as expired. */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date(expiresAt).getTime() <= Date.now();\n  }\n\n  /**\n   * Atomically mark this token consumed ONLY if nobody has yet. Resolves `true`\n   * for the single caller that won; every concurrent or later caller gets\n   * `false`.\n   */\n  public async consumeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const consumed = await modelClass.atomic(\n      { id: this.id, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n\n    return consumed > 0;\n  }\n\n  /** Persist a new token row. `tokenHash` is the SHA-256 hex digest, never the raw token. */\n  public static issue(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user.id,\n      user_type: user.userType,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /**\n   * Persist a passkey ceremony challenge. `user` is omitted for an\n   * authentication challenge, issued before anyone is identified.\n   */\n  public static issueChallenge(\n    purpose: OneTimeTokenPurpose,\n    tokenHash: string,\n    expiresAt: Date,\n    user?: Auth,\n  ) {\n    return this.create({\n      token_hash: tokenHash,\n      purpose,\n      user_id: user?.id ?? null,\n      user_type: user?.userType ?? null,\n      expires_at: expiresAt,\n      consumed_at: null,\n      attempts: 0,\n    });\n  }\n\n  /** The user's newest unconsumed token of `purpose` (at most one for OTP). */\n  public static findActiveFor(\n    user: Auth,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, purpose, consumed_at: null })\n      .orderBy(\"created_at\", \"desc\")\n      .first();\n  }\n\n  /**\n   * Atomically count one verify attempt, ONLY while fewer than `max` have been\n   * counted and the token is unconsumed. Resolves `false` once the cap is\n   * reached — of N concurrent attempts, at most `max` ever resolve `true`.\n   */\n  public async recordAttempt(max: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof OneTimeToken;\n\n    const counted = await modelClass.atomic(\n      { id: this.id, consumed_at: null, attempts: { $lt: max } },\n      { $inc: { attempts: 1 } },\n      // Code-authored filter; nothing here comes from the request.\n      { trustedFilter: true },\n    );\n\n    return counted > 0;\n  }\n\n  /**\n   * Hard-delete every spent row — expired, or consumed (used, invalidated by a\n   * newer token, or exhausted). Neither can ever be redeemed again, so nothing\n   * reads them. Hard-deleted, never trashed. Returns the number removed. Runs from the `auth.cleanup` CLI\n   * command (a cold batch path).\n   */\n  public static async purgeSpent(): Promise<number> {\n    const expired = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n    const consumed = await this.query().whereNotNull(\"consumed_at\").get();\n    const spent = new Map([...expired, ...consumed].map((token) => [String(token.id), token]));\n\n    for (const token of spent.values()) {\n      // `static deleteStrategy` above already forces \"permanent\" regardless\n      // of the data source default (Mongo's is \"trash\").\n      await token.destroy();\n    }\n\n    return spent.size;\n  }\n\n  /** Find a token by hash, scoped to a purpose — a token of the other purpose is not found. */\n  public static findByHash(\n    tokenHash: string,\n    purpose: OneTimeTokenPurpose,\n  ): Promise<OneTimeToken | null> {\n    return this.first({ token_hash: tokenHash, purpose });\n  }\n\n  /**\n   * Consume every still-unused token of `purpose` for the user, returning how\n   * many were invalidated. Used before issuing a new password-reset token.\n   */\n  public static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number> {\n    return this.atomic(\n      { user_id: user.id, user_type: user.userType, purpose, consumed_at: null },\n      { $set: { consumed_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAE7B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,KAAK,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,IAAI,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;;;;AAWD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;gBAOA,CAAC,YAAY;;;wBAQL;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,IAAW,aAAsB;EAC/B,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa;CACjC;;CAGA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;CAOA,MAAa,kBAAoC;EAQ/C,OAAO,MAPY,KAAK,YAEU,OAChC;GAAE,IAAI,KAAK;GAAI,aAAa;EAAK,GACjC,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC,IAEkB;CACpB;;CAGA,OAAc,MACZ,MACA,SACA,WACA,WACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;;;;CAMA,OAAc,eACZ,SACA,WACA,WACA,MACA;EACA,OAAO,KAAK,OAAO;GACjB,YAAY;GACZ;GACA,SAAS,MAAM,MAAM;GACrB,WAAW,MAAM,YAAY;GAC7B,YAAY;GACZ,aAAa;GACb,UAAU;EACZ,CAAC;CACH;;CAGA,OAAc,cACZ,MACA,SAC8B;EAC9B,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,CAAC,CAAC,CACjF,QAAQ,cAAc,MAAM,CAAC,CAC7B,MAAM;CACX;;;;;;CAOA,MAAa,cAAc,KAA+B;EAUxD,OAAO,MATY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,aAAa;GAAM,UAAU,EAAE,KAAK,IAAI;EAAE,GACzD,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAExB,EAAE,eAAe,KAAK,CACxB,IAEiB;CACnB;;;;;;;CAQA,aAAoB,aAA8B;EAChD,MAAM,UAAU,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAC5E,MAAM,WAAW,MAAM,KAAK,MAAM,CAAC,CAAC,aAAa,aAAa,CAAC,CAAC,IAAI;EACpE,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;EAEzF,KAAK,MAAM,SAAS,MAAM,OAAO,GAG/B,MAAM,MAAM,QAAQ;EAGtB,OAAO,MAAM;CACf;;CAGA,OAAc,WACZ,WACA,SAC8B;EAC9B,OAAO,KAAK,MAAM;GAAE,YAAY;GAAW;EAAQ,CAAC;CACtD;;;;;CAMA,OAAc,oBAAoB,MAAY,SAA+C;EAC3F,OAAO,KAAK,OACV;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU;GAAS,aAAa;EAAK,GACzE,EAAE,MAAM,EAAE,6BAAa,IAAI,KAAK,EAAE,EAAE,CACtC;CACF;AACF"}

package/esm/models/passkey-credential/migration.mjs

@@ -1,7 +1,7 @@
 import { PasskeyCredential } from "./passkey-credential.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/passkey-credential/migration.ts
+//#region ../../packages/auth/src/models/passkey-credential/migration.ts
 const PasskeyCredentialMigration = migrate(PasskeyCredential, {
 	name: "passkeyCredential",
 	up() {

package/esm/models/passkey-credential/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { PasskeyCredential } from \"./passkey-credential.model\";\n\nexport const PasskeyCredentialMigration = migrate(PasskeyCredential, {\n  name: \"passkeyCredential\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.text(\"credential_id\").unique();\n    this.text(\"public_key\");\n    this.bigInteger(\"counter\").default(0);\n    this.json(\"transports\").nullable();\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,6BAA6B,QAAQ,mBAAmB;CACnE,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,KAAK,eAAe,CAAC,CAAC,OAAO;EAClC,KAAK,KAAK,YAAY;EACtB,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,CAAC;EACpC,KAAK,KAAK,YAAY,CAAC,CAAC,SAAS;EACjC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { PasskeyCredential } from \"./passkey-credential.model\";\n\nexport const PasskeyCredentialMigration = migrate(PasskeyCredential, {\n  name: \"passkeyCredential\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.text(\"credential_id\").unique();\n    this.text(\"public_key\");\n    this.bigInteger(\"counter\").default(0);\n    this.json(\"transports\").nullable();\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,6BAA6B,QAAQ,mBAAmB;CACnE,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,KAAK,eAAe,CAAC,CAAC,OAAO;EAClC,KAAK,KAAK,YAAY;EACtB,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,CAAC;EACpC,KAAK,KAAK,YAAY,CAAC,CAAC,SAAS;EACjC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAEtC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/passkey-credential/passkey-credential.model.d.mts

@@ -1,7 +1,7 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/passkey-credential/passkey-credential.model.d.ts
+//#region ../../packages/auth/src/models/passkey-credential/passkey-credential.model.d.ts
 /** Seal schema for a stored passkey. Exported so an override can extend it. */
 declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
   credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -14,29 +14,21 @@ declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidato
   };
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
   user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  transports: import("@warlock.js/seal").ArrayValidator & {
-    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
-    isOptional: true;
-  };
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-}>, import("@warlock.js/seal").InferInputObjectShape<{
-  credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-  transports: import("@warlock.js/seal").ArrayValidator & {
-    validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
-    isOptional: true;
-  };
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-}>>;
+}> & import("@warlock.js/seal").StandardSchemaV1<{
+  transports?: string[] | undefined;
+  credential_id: string;
+  public_key: string;
+  counter: number;
+  user_id: string | number | boolean;
+  user_type: string;
+}, {
+  transports?: string[] | undefined;
+  credential_id: string;
+  public_key: string;
+  counter: number;
+  user_id: string | number | boolean;
+  user_type: string;
+}>;
 /**
  * A registered WebAuthn credential. `credential_id` and `public_key` are
  * base64url; `counter` is the last signature counter seen, which an
@@ -55,29 +47,21 @@ declare class PasskeyCredential extends Model {
     };
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
     user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    transports: import("@warlock.js/seal").ArrayValidator & {
-      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
-      isOptional: true;
-    };
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  }>, import("@warlock.js/seal").InferInputObjectShape<{
-    credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
-    transports: import("@warlock.js/seal").ArrayValidator & {
-      validator: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    } & import("@warlock.js/seal").StandardSchemaV1<string[], string[]> & {
-      isOptional: true;
-    };
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  }>>;
+  }> & import("@warlock.js/seal").StandardSchemaV1<{
+    transports?: string[] | undefined;
+    credential_id: string;
+    public_key: string;
+    counter: number;
+    user_id: string | number | boolean;
+    user_type: string;
+  }, {
+    transports?: string[] | undefined;
+    credential_id: string;
+    public_key: string;
+    counter: number;
+    user_id: string | number | boolean;
+    user_type: string;
+  }>;
   /**
    * Permanent regardless of the data source default — Mongo's driver default
    * is `"trash"`. No call site deletes a credential today, but the public key

package/esm/models/passkey-credential/passkey-credential.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAHtB;;;;SAWgB,cAAA;EA4Bc;EAAA,IAzBjB,YAAA;EAyBwB;EAAA,IApBxB,OAAA;EAnB0B;EAAA,IAwB1B,MAAA;EAxB+B;EAAA,IA6B/B,QAAA;EA5BG;EAAA,OAiCA,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;EA/B5C;EAAA,OAoCN,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}
+{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,cAAA;;MAGH,YAAA;;MAKA,OAAA;;MAKA,MAAA;;MAKA,QAAA;;SAKG,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;;SAKlD,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}

package/esm/models/passkey-credential/passkey-credential.model.mjs

@@ -1,7 +1,7 @@
 import { Model } from "@warlock.js/cascade";
 import { v } from "@warlock.js/seal";
 
-//#region ../auth/src/models/passkey-credential/passkey-credential.model.ts
+//#region ../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts
 /** Seal schema for a stored passkey. Exported so an override can extend it. */
 const passkeyCredentialSchema = v.object({
 	credential_id: v.string().required(),

package/esm/models/passkey-credential/passkey-credential.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-credential.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/passkey-credential/passkey-credential.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a stored passkey. Exported so an override can extend it. */\nexport const passkeyCredentialSchema = v.object({\n  credential_id: v.string().required(),\n  public_key: v.string().required(),\n  counter: v.int().required(),\n  transports: v.array(v.string()).optional(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n});\n\n/**\n * A registered WebAuthn credential. `credential_id` and `public_key` are\n * base64url; `counter` is the last signature counter seen, which an\n * authentication must advance (a clone detector).\n */\nexport class PasskeyCredential extends Model {\n  public static table = \"passkey_credentials\";\n\n  public static schema = passkeyCredentialSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`. No call site deletes a credential today, but the public key\n   * is credential material, so a future `destroy()` here must not leave a\n   * copy in `passkey_credentialsTrash`.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** base64url credential id. */\n  public get credentialId(): string {\n    return this.get(\"credential_id\");\n  }\n\n  /** Last signature counter seen. */\n  public get counter(): number {\n    return Number(this.get(\"counter\") ?? 0);\n  }\n\n  /** The owner's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The owner's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find a credential by its base64url id. */\n  public static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null> {\n    return this.first({ credential_id: credentialId });\n  }\n\n  /** Every credential the user registered. */\n  public static listFor(user: Auth): Promise<PasskeyCredential[]> {\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\n  }\n\n  /**\n   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,\n   * so two concurrent assertions with the same counter cannot both succeed.\n   */\n  public async advanceCounter(expected: number, newCounter: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof PasskeyCredential;\n\n    const updated = await modelClass.atomic(\n      { id: this.id, counter: expected },\n      { $set: { counter: newCounter } },\n    );\n\n    return updated > 0;\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS;CAC1B,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;AAOD,IAAa,oBAAb,cAAuC,MAAM;;eACrB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,eAAuB;EAChC,OAAO,KAAK,IAAI,eAAe;CACjC;;CAGA,IAAW,UAAkB;EAC3B,OAAO,OAAO,KAAK,IAAI,SAAS,KAAK,CAAC;CACxC;;CAGA,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,mBAAmB,cAAyD;EACxF,OAAO,KAAK,MAAM,EAAE,eAAe,aAAa,CAAC;CACnD;;CAGA,OAAc,QAAQ,MAA0C;EAC9D,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;;CAMA,MAAa,eAAe,UAAkB,YAAsC;EAQlF,OAAO,MAPY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,SAAS;EAAS,GACjC,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,CAClC,IAEiB;CACnB;AACF"}
+{"version":3,"file":"passkey-credential.model.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a stored passkey. Exported so an override can extend it. */\nexport const passkeyCredentialSchema = v.object({\n  credential_id: v.string().required(),\n  public_key: v.string().required(),\n  counter: v.int().required(),\n  transports: v.array(v.string()).optional(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n});\n\n/**\n * A registered WebAuthn credential. `credential_id` and `public_key` are\n * base64url; `counter` is the last signature counter seen, which an\n * authentication must advance (a clone detector).\n */\nexport class PasskeyCredential extends Model {\n  public static table = \"passkey_credentials\";\n\n  public static schema = passkeyCredentialSchema;\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`. No call site deletes a credential today, but the public key\n   * is credential material, so a future `destroy()` here must not leave a\n   * copy in `passkey_credentialsTrash`.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** base64url credential id. */\n  public get credentialId(): string {\n    return this.get(\"credential_id\");\n  }\n\n  /** Last signature counter seen. */\n  public get counter(): number {\n    return Number(this.get(\"counter\") ?? 0);\n  }\n\n  /** The owner's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The owner's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find a credential by its base64url id. */\n  public static findByCredentialId(credentialId: string): Promise<PasskeyCredential | null> {\n    return this.first({ credential_id: credentialId });\n  }\n\n  /** Every credential the user registered. */\n  public static listFor(user: Auth): Promise<PasskeyCredential[]> {\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\n  }\n\n  /**\n   * Store `newCounter` ONLY if the row still holds `expected` — a compare-and-set,\n   * so two concurrent assertions with the same counter cannot both succeed.\n   */\n  public async advanceCounter(expected: number, newCounter: number): Promise<boolean> {\n    const modelClass = this.constructor as typeof PasskeyCredential;\n\n    const updated = await modelClass.atomic(\n      { id: this.id, counter: expected },\n      { $set: { counter: newCounter } },\n    );\n\n    return updated > 0;\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;CAChC,SAAS,EAAE,IAAI,CAAC,CAAC,SAAS;CAC1B,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;CACzC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC;;;;;;AAOD,IAAa,oBAAb,cAAuC,MAAM;;eACrB;;;gBAEC;;;wBAQQ;;;CAG/B,IAAW,eAAuB;EAChC,OAAO,KAAK,IAAI,eAAe;CACjC;;CAGA,IAAW,UAAkB;EAC3B,OAAO,OAAO,KAAK,IAAI,SAAS,KAAK,CAAC;CACxC;;CAGA,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,mBAAmB,cAAyD;EACxF,OAAO,KAAK,MAAM,EAAE,eAAe,aAAa,CAAC;CACnD;;CAGA,OAAc,QAAQ,MAA0C;EAC9D,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;;CAMA,MAAa,eAAe,UAAkB,YAAsC;EAQlF,OAAO,MAPY,KAAK,YAES,OAC/B;GAAE,IAAI,KAAK;GAAI,SAAS;EAAS,GACjC,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,CAClC,IAEiB;CACnB;AACF"}

package/esm/models/provider-account/migration.mjs

@@ -1,7 +1,7 @@
 import { ProviderAccount } from "./provider-account.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/provider-account/migration.ts
+//#region ../../packages/auth/src/models/provider-account/migration.ts
 const ProviderAccountMigration = migrate(ProviderAccount, {
 	name: "providerAccount",
 	up() {

package/esm/models/provider-account/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { ProviderAccount } from \"./provider-account.model\";\n\nexport const ProviderAccountMigration = migrate(ProviderAccount, {\n  name: \"providerAccount\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.string(\"provider\", 50);\n    this.string(\"provider_user_id\", 255);\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.string(\"email\", 255).nullable();\n\n    // One app user per provider identity.\n    this.unique([\"provider\", \"provider_user_id\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,2BAA2B,QAAQ,iBAAiB;CAC/D,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,OAAO,YAAY,EAAE;EAC1B,KAAK,OAAO,oBAAoB,GAAG;EACnC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,OAAO,SAAS,GAAG,CAAC,CAAC,SAAS;EAGnC,KAAK,OAAO,CAAC,YAAY,kBAAkB,CAAC;EAE5C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { ProviderAccount } from \"./provider-account.model\";\n\nexport const ProviderAccountMigration = migrate(ProviderAccount, {\n  name: \"providerAccount\",\n  up() {\n    this.createTableIfNotExists();\n\n    this.primaryUuid();\n\n    this.string(\"provider\", 50);\n    this.string(\"provider_user_id\", 255);\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.string(\"email\", 255).nullable();\n\n    // One app user per provider identity.\n    this.unique([\"provider\", \"provider_user_id\"]);\n\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,2BAA2B,QAAQ,iBAAiB;CAC/D,MAAM;CACN,KAAK;EACH,KAAK,uBAAuB;EAE5B,KAAK,YAAY;EAEjB,KAAK,OAAO,YAAY,EAAE;EAC1B,KAAK,OAAO,oBAAoB,GAAG;EACnC,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,OAAO,SAAS,GAAG,CAAC,CAAC,SAAS;EAGnC,KAAK,OAAO,CAAC,YAAY,kBAAkB,CAAC;EAE5C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/provider-account/provider-account.model.d.mts

@@ -1,7 +1,7 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/provider-account/provider-account.model.d.ts
+//#region ../../packages/auth/src/models/provider-account/provider-account.model.d.ts
 /** Seal schema for a provider link. Exported so an override can extend it. */
 declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
   provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -11,23 +11,19 @@ declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<
   email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-  provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-    isOptional: true;
-  };
-}>, import("@warlock.js/seal").InferInputObjectShape<{
-  provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-    isOptional: true;
-  };
-}>>;
+}> & import("@warlock.js/seal").StandardSchemaV1<{
+  email?: string | undefined;
+  provider: string;
+  provider_user_id: string;
+  user_id: string | number | boolean;
+  user_type: string;
+}, {
+  email?: string | undefined;
+  provider: string;
+  provider_user_id: string;
+  user_id: string | number | boolean;
+  user_type: string;
+}>;
 /**
  * Links a provider identity (`provider` + the provider's stable user id) to
  * an app user. Created the first time a VERIFIED provider email is matched or
@@ -44,23 +40,19 @@ declare class ProviderAccount extends Model {
     email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<import("@warlock.js/seal").InferInputObjectShape<{
-    provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-      isOptional: true;
-    };
-  }>, import("@warlock.js/seal").InferInputObjectShape<{
-    provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-    email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
-      isOptional: true;
-    };
-  }>>;
+  }> & import("@warlock.js/seal").StandardSchemaV1<{
+    email?: string | undefined;
+    provider: string;
+    provider_user_id: string;
+    user_id: string | number | boolean;
+    user_type: string;
+  }, {
+    email?: string | undefined;
+    provider: string;
+    provider_user_id: string;
+    user_id: string | number | boolean;
+    user_type: string;
+  }>;
   /** The linked user's id. */
   get userId(): any;
   /** The linked user's type slug. */

package/esm/models/provider-account/provider-account.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,MAAA;EANgB;EAAA,IAWhB,QAAA;EAQA;EAAA,OAHG,QAAA,CACZ,QAAA,UACA,cAAA,WACC,OAAA,CAAQ,eAAA;EAKwD;EAAA,OAArD,IAAA,CAAK,QAAA,UAAkB,cAAA,UAAwB,IAAA,EAAM,IAAA,EAAM,KAAA,YAAc,OAAA,CAAA,eAAA;AAAA"}
+{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;MAGT,MAAA;;MAKA,QAAA;;SAKG,QAAA,CACZ,QAAA,UACA,cAAA,WACC,OAAA,CAAQ,eAAA;;SAKG,IAAA,CAAK,QAAA,UAAkB,cAAA,UAAwB,IAAA,EAAM,IAAA,EAAM,KAAA,YAAc,OAAA,CAAA,eAAA;AAAA"}

package/esm/models/provider-account/provider-account.model.mjs

@@ -1,7 +1,7 @@
 import { Model } from "@warlock.js/cascade";
 import { v } from "@warlock.js/seal";
 
-//#region ../auth/src/models/provider-account/provider-account.model.ts
+//#region ../../packages/auth/src/models/provider-account/provider-account.model.ts
 /** Seal schema for a provider link. Exported so an override can extend it. */
 const providerAccountSchema = v.object({
 	provider: v.string().required(),

package/esm/models/provider-account/provider-account.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-account.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/provider-account/provider-account.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a provider link. Exported so an override can extend it. */\nexport const providerAccountSchema = v.object({\n  provider: v.string().required(),\n  provider_user_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  email: v.string().optional(),\n});\n\n/**\n * Links a provider identity (`provider` + the provider's stable user id) to\n * an app user. Created the first time a VERIFIED provider email is matched or\n * a user is created for it; afterwards the link alone resolves the user, so a\n * later email change at the provider cannot move the login to another account.\n */\nexport class ProviderAccount extends Model {\n  public static table = \"provider_accounts\";\n\n  public static schema = providerAccountSchema;\n\n  /** The linked user's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The linked user's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find the link for a provider identity. */\n  public static findLink(\n    provider: string,\n    providerUserId: string,\n  ): Promise<ProviderAccount | null> {\n    return this.first({ provider, provider_user_id: providerUserId });\n  }\n\n  /** Link a provider identity to a user. */\n  public static link(provider: string, providerUserId: string, user: Auth, email?: string) {\n    return this.create({\n      provider,\n      provider_user_id: providerUserId,\n      user_id: user.id,\n      user_type: user.userType,\n      ...(email ? { email } : {}),\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;AAQD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,SACZ,UACA,gBACiC;EACjC,OAAO,KAAK,MAAM;GAAE;GAAU,kBAAkB;EAAe,CAAC;CAClE;;CAGA,OAAc,KAAK,UAAkB,gBAAwB,MAAY,OAAgB;EACvF,OAAO,KAAK,OAAO;GACjB;GACA,kBAAkB;GAClB,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EAC3B,CAAC;CACH;AACF"}
+{"version":3,"file":"provider-account.model.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Seal schema for a provider link. Exported so an override can extend it. */\nexport const providerAccountSchema = v.object({\n  provider: v.string().required(),\n  provider_user_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  email: v.string().optional(),\n});\n\n/**\n * Links a provider identity (`provider` + the provider's stable user id) to\n * an app user. Created the first time a VERIFIED provider email is matched or\n * a user is created for it; afterwards the link alone resolves the user, so a\n * later email change at the provider cannot move the login to another account.\n */\nexport class ProviderAccount extends Model {\n  public static table = \"provider_accounts\";\n\n  public static schema = providerAccountSchema;\n\n  /** The linked user's id. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The linked user's type slug. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /** Find the link for a provider identity. */\n  public static findLink(\n    provider: string,\n    providerUserId: string,\n  ): Promise<ProviderAccount | null> {\n    return this.first({ provider, provider_user_id: providerUserId });\n  }\n\n  /** Link a provider identity to a user. */\n  public static link(provider: string, providerUserId: string, user: Auth, email?: string) {\n    return this.create({\n      provider,\n      provider_user_id: providerUserId,\n      user_id: user.id,\n      user_type: user.userType,\n      ...(email ? { email } : {}),\n    });\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;AAQD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,OAAc,SACZ,UACA,gBACiC;EACjC,OAAO,KAAK,MAAM;GAAE;GAAU,kBAAkB;EAAe,CAAC;CAClE;;CAGA,OAAc,KAAK,UAAkB,gBAAwB,MAAY,OAAgB;EACvF,OAAO,KAAK,OAAO;GACjB;GACA,kBAAkB;GAClB,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EAC3B,CAAC;CACH;AACF"}

package/esm/models/refresh-token/migration.mjs

@@ -1,7 +1,7 @@
 import { RefreshToken } from "./refresh-token.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../auth/src/models/refresh-token/migration.ts
+//#region ../../packages/auth/src/models/refresh-token/migration.ts
 const RefreshTokenMigration = migrate(RefreshToken, {
 	name: "refreshToken",
 	up() {

package/esm/models/refresh-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { RefreshToken } from \"./refresh-token.model\";\n\nexport const RefreshTokenMigration = migrate(RefreshToken, {\n  name: \"refreshToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token fields\n    this.text(\"token\").unique();\n    // `foreignId` matches the DataSource's default primary-key type so the\n    // column stays compatible with the user model's `id` (integer by default,\n    // or uuid) — hardcoding uuid here 500'd login on integer-PK apps (5e47bdb3).\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.text(\"family_id\").index().nullable();\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"last_used_at\").nullable();\n    this.timestamp(\"revoked_at\").nullable();\n    this.json(\"device_info\").nullable();\n\n    // Composite index for the per-user active-session lookups\n    // (revokeAllFor / enforceMax / activeFor all filter on user_id + user_type).\n    this.index([\"user_id\", \"user_type\"]);\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAI1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,aAAa,CAAC,CAAC,SAAS;EAIlC,KAAK,MAAM,CAAC,WAAW,WAAW,CAAC;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../../packages/auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { RefreshToken } from \"./refresh-token.model\";\n\nexport const RefreshTokenMigration = migrate(RefreshToken, {\n  name: \"refreshToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token fields\n    this.text(\"token\").unique();\n    // `foreignId` matches the DataSource's default primary-key type so the\n    // column stays compatible with the user model's `id` (integer by default,\n    // or uuid) — hardcoding uuid here 500'd login on integer-PK apps (5e47bdb3).\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.text(\"family_id\").index().nullable();\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"last_used_at\").nullable();\n    this.timestamp(\"revoked_at\").nullable();\n    this.json(\"device_info\").nullable();\n\n    // Composite index for the per-user active-session lookups\n    // (revokeAllFor / enforceMax / activeFor all filter on user_id + user_type).\n    this.index([\"user_id\", \"user_type\"]);\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAI1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,aAAa,CAAC,CAAC,SAAS;EAIlC,KAAK,MAAM,CAAC,WAAW,WAAW,CAAC;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}