@warlock.js/auth 5.30.0 → 5.32.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.32.0 - 2026-10-18
+
+### Changed
+
+- Pin the package development compiler to TypeScript 7.0.2 and use explicit Node types and source roots with supported module resolution.
+
+## 5.31.0 - 2026-10-18
+
+### Added
+
+- `authMiddleware()` marks itself as an auth guard (`markAuthGuard()` from `@warlock.js/core`), so `warlock dev`'s unguarded-route warning recognises routes behind it; the `{ optional: true }` form is marked as not a guard. Docs and skills list what throttles auth endpoints by default (core's global limit, plus the throttles new apps attach to sign-in and password recovery) and how to add them to an existing app.
+- Real Redis integration coverage for login failure counters and lockouts, including concurrent requests, preserved deadlines and counters recreated after a seeded key expires. Local runs opt in with `WARLOCK_REDIS_INTEGRATION=1`; CI requires a live Redis service. Tests use UUID prefixes and clean only their own keys.
+
+### Fixed
+
+- Login, token and OTP throttles pass their counting-window TTL into each atomic increment. A counter that expires between the create-only seed and increment is recreated with an expiry rather than becoming permanent. Token middleware regression assertions cover the issue counters' one-hour window and the consume counter's fifteen-minute window.
+
 ## 5.30.0 - 2026-10-16
 
 ### Upgrading
@@ -12,7 +29,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
-- **The login throttle keys accounts and IPs by a keyed hash** (`auth.throttle.count.email.<hmac>`, `auth.throttle.count.ip.<hmac>`) instead of the raw address or IP, so cache logs never show them. The HMAC key is derived from `auth.accessToken.secret` (as the OTP code MAC is), so a list of known addresses cannot reverse it; without a configured secret it falls back to SHA-256. The value is trimmed and lower-cased first, so `" Sara@x.io"` and `"sara@x.io"` share one bucket. Applies to `loginThrottleMiddleware` and every preset built on it (token issue/consume, OTP); a custom `identify` is used as is. `throttleIdentifierHash(kind, value)` is exported (FW-04).
+- **The login throttle keys accounts and IPs by a keyed hash** (`auth.throttle.count.email.<hmac>`, `auth.throttle.count.ip.<hmac>`) instead of the raw address or IP, so cache logs never show them. The HMAC key is derived from `auth.accessToken.secret` (as the OTP code MAC is), so a list of known addresses cannot reverse it; without a configured secret it falls back to SHA-256. The value is trimmed and lower-cased first, so `" Sara@x.io"` and `"sara@x.io"` share one bucket. Applies to `loginThrottleMiddleware` and every preset built on it (token issue/consume, OTP); a custom `identify` is used as is. `throttleIdentifierHash(kind, value)` is exported.
 - A throttle lock stores its own deadline, so a cache driver with sliding expiration (`memoryExtended`) can no longer keep a retrying client locked past `lockoutDuration`. Locks written by 5.29 (`true`) are still honoured until they expire.
 - The throttle warns once when the cache driver is `null`, which stores nothing, so the throttle can never lock.
 

package/esm/commands/auth-cleanup-command.d.mts

@@ -7,7 +7,6 @@
  * warlock auth:cleanup
  * ```
  */
-declare function registerAuthCleanupCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerAuthCleanupCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerAuthCleanupCommand };
 //# sourceMappingURL=auth-cleanup-command.d.mts.map

package/esm/commands/auth-cleanup-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"mappings":";;AAYA;;;;AAA0C;;;iBAA1B,0BAAA,+BAA0B,UAAA"}
+{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"mappings":";;;;;;;;;wBAYgB,yDAA0B"}

package/esm/commands/auth-purge-never-expiring-command.d.mts

@@ -23,7 +23,6 @@
  * warlock auth.purge-never-expiring             # report, then delete
  * ```
  */
-declare function registerAuthPurgeNeverExpiringCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerAuthPurgeNeverExpiringCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerAuthPurgeNeverExpiringCommand };
 //# sourceMappingURL=auth-purge-never-expiring-command.d.mts.map

package/esm/commands/auth-purge-never-expiring-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;AA4BA;;;;AAAqD;;;;;;;;;;;;;;;;;;;iBAArC,qCAAA,+BAAqC,UAAA"}
+{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;wBA4BgB,oEAAqC"}

package/esm/commands/auth-purge-never-expiring-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-purge-never-expiring-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the `auth.purge-never-expiring` CLI command — remediation for the\n * pre-4.12.0 `expiresIn` defect (#25).\n *\n * **Why a command and not a migration.** The rows this removes cannot be\n * selected by a date predicate (an `Invalid Date` compares `false` against\n * every date, so `WHERE expires_at < now()` never matches one) and the\n * definitive signal — a token with no `exp` claim — lives inside the JWT\n * string, not in a column. A migration would also run once, silently, at deploy\n * time; an operator dealing with possibly-leaked credentials needs to *look*\n * first, then act, and to repeat it. Hence `--dry-run`, which is the default\n * posture this command is expected to be run in first.\n *\n * A migration is additionally the wrong shape for a fix that must reach both\n * supported stores: the same row is a different thing in MongoDB and Postgres,\n * and this goes through the models so a registered override\n * (`config.auth.accessToken.model`) is honoured.\n *\n * @example\n * ```bash\n * warlock auth.purge-never-expiring --dry-run   # report only\n * warlock auth.purge-never-expiring             # report, then delete\n * ```\n */\nexport function registerAuthPurgeNeverExpiringCommand() {\n  return command({\n    name: \"auth.purge-never-expiring\",\n    description:\n      \"Find (and delete) token rows that can never expire — an unusable expires_at, or a token with no exp claim\",\n    options: [\n      {\n        text: \"--dry-run\",\n        description: \"Report the affected rows without deleting anything\",\n        type: \"boolean\",\n      },\n    ],\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async (data: { options?: Record<string, unknown> } = {}) => {\n      // Core camelCases flags (`--dry-run` ⇒ `dryRun`); both spellings are read\n      // so the command does not depend on that detail staying true.\n      //\n      // Read fail-safe: the flag counts as set unless it is *explicitly* false\n      // (`--dry-run=false`). An operator who asked to look before deleting and\n      // got a delete because a flag arrived as `\"true\"` instead of `true` would\n      // lose live credentials to a parsing detail.\n      const flags = data.options ?? {};\n      const flag = flags[\"dryRun\"] ?? flags[\"dry-run\"];\n      const dryRun = flag !== undefined && flag !== false && flag !== \"false\";\n\n      console.log(colors.cyan(\"🔎 Scanning for tokens that can never expire...\"));\n\n      const { accessTokens, refreshTokens } = await authService.findNeverExpiringTokens();\n      const total = accessTokens.length + refreshTokens.length;\n\n      if (total === 0) {\n        console.log(colors.green(\"✅ No never-expiring tokens found.\"));\n\n        return;\n      }\n\n      console.log(\n        colors.yellow(\n          `⚠️  ${total} never-expiring token(s): ` +\n            `${accessTokens.length} access, ${refreshTokens.length} refresh.`,\n        ),\n      );\n\n      // Identify each row so an operator can correlate with their own audit\n      // trail before (or after) the rows are gone. The token string itself is\n      // never printed — it is a live credential until this command removes it.\n      for (const token of accessTokens) {\n        console.log(\n          colors.yellow(\n            `  access  id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      for (const token of refreshTokens) {\n        console.log(\n          colors.yellow(\n            `  refresh id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      if (dryRun) {\n        console.log(\n          colors.cyan(\"Dry run — nothing deleted. Re-run without --dry-run to revoke these tokens.\"),\n        );\n\n        return;\n      }\n\n      // Re-selects rather than deleting the rows just listed: the delete then\n      // acts on the table's current state instead of a snapshot taken before\n      // the operator read the report. A second full scan is affordable here —\n      // this is a one-off remediation, not a request path.\n      const purged = await authService.purgeNeverExpiringTokens();\n\n      console.log(\n        colors.green(\n          `✅ Revoked ${purged.accessTokens} access token(s) and ` +\n            `${purged.refreshTokens} refresh token(s). Affected users must log in again.`,\n        ),\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,wCAAwC;CACtD,OAAO,QAAQ;EACb,MAAM;EACN,aACE;EACF,SAAS,CACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR,CACF;EACA,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,OAAO,OAA8C,CAAC,MAAM;GAQlE,MAAM,QAAQ,KAAK,WAAW,CAAC;GAC/B,MAAM,OAAO,MAAM,aAAa,MAAM;GACtC,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS,SAAS;GAEhE,QAAQ,IAAI,OAAO,KAAK,iDAAiD,CAAC;GAE1E,MAAM,EAAE,cAAc,kBAAkB,MAAM,YAAY,wBAAwB;GAClF,MAAM,QAAQ,aAAa,SAAS,cAAc;GAElD,IAAI,UAAU,GAAG;IACf,QAAQ,IAAI,OAAO,MAAM,mCAAmC,CAAC;IAE7D;GACF;GAEA,QAAQ,IACN,OAAO,OACL,OAAO,MAAM,4BACR,aAAa,OAAO,WAAW,cAAc,OAAO,UAC3D,CACF;GAKA,KAAK,MAAM,SAAS,cAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,KAAK,MAAM,SAAS,eAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,IAAI,QAAQ;IACV,QAAQ,IACN,OAAO,KAAK,6EAA6E,CAC3F;IAEA;GACF;GAMA,MAAM,SAAS,MAAM,YAAY,yBAAyB;GAE1D,QAAQ,IACN,OAAO,MACL,aAAa,OAAO,aAAa,uBAC5B,OAAO,cAAc,qDAC5B,CACF;EACF;CACF,CAAC;AACH"}
+{"version":3,"file":"auth-purge-never-expiring-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport { command } from \"@warlock.js/core\";\nimport { authService } from \"../services/auth.service\";\n\n/**\n * Register the `auth.purge-never-expiring` CLI command — remediation for the\n * pre-4.12.0 `expiresIn` defect (#25).\n *\n * **Why a command and not a migration.** The rows this removes cannot be\n * selected by a date predicate (an `Invalid Date` compares `false` against\n * every date, so `WHERE expires_at < now()` never matches one) and the\n * definitive signal — a token with no `exp` claim — lives inside the JWT\n * string, not in a column. A migration would also run once, silently, at deploy\n * time; an operator dealing with possibly-leaked credentials needs to *look*\n * first, then act, and to repeat it. Hence `--dry-run`, which is the default\n * posture this command is expected to be run in first.\n *\n * A migration is additionally the wrong shape for a fix that must reach both\n * supported stores: the same row is a different thing in MongoDB and Postgres,\n * and this goes through the models so a registered override\n * (`config.auth.accessToken.model`) is honoured.\n *\n * @example\n * ```bash\n * warlock auth.purge-never-expiring --dry-run   # report only\n * warlock auth.purge-never-expiring             # report, then delete\n * ```\n */\nexport function registerAuthPurgeNeverExpiringCommand() {\n  return command({\n    name: \"auth.purge-never-expiring\",\n    description:\n      \"Find (and delete) token rows that can never expire — an unusable expires_at, or a token with no exp claim\",\n    options: [\n      {\n        text: \"--dry-run\",\n        description: \"Report the affected rows without deleting anything\",\n        type: \"boolean\",\n      },\n    ],\n    preload: {\n      env: true,\n      config: [\"auth\", \"database\"],\n      connectors: [\"database\"],\n    },\n    action: async (data: { options?: Record<string, unknown> } = {}) => {\n      // Core camelCases flags (`--dry-run` ⇒ `dryRun`); both spellings are read\n      // so the command does not depend on that detail staying true.\n      //\n      // Read fail-safe: the flag counts as set unless it is *explicitly* false\n      // (`--dry-run=false`). An operator who asked to look before deleting and\n      // got a delete because a flag arrived as `\"true\"` instead of `true` would\n      // lose live credentials to a parsing detail.\n      const flags = data.options ?? {};\n      const flag = flags[\"dryRun\"] ?? flags[\"dry-run\"];\n      const dryRun = flag !== undefined && flag !== false && flag !== \"false\";\n\n      console.log(colors.cyan(\"🔎 Scanning for tokens that can never expire...\"));\n\n      const { accessTokens, refreshTokens } = await authService.findNeverExpiringTokens();\n      const total = accessTokens.length + refreshTokens.length;\n\n      if (total === 0) {\n        console.log(colors.green(\"✅ No never-expiring tokens found.\"));\n\n        return;\n      }\n\n      console.log(\n        colors.yellow(\n          `⚠️  ${total} never-expiring token(s): ` +\n            `${accessTokens.length} access, ${refreshTokens.length} refresh.`,\n        ),\n      );\n\n      // Identify each row so an operator can correlate with their own audit\n      // trail before (or after) the rows are gone. The token string itself is\n      // never printed — it is a live credential until this command removes it.\n      for (const token of accessTokens) {\n        console.log(\n          colors.yellow(\n            `  access  id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      for (const token of refreshTokens) {\n        console.log(\n          colors.yellow(\n            `  refresh id=${token.id} user_id=${token.get(\"user_id\")} ` +\n              `user_type=${token.get(\"user_type\")} expires_at=${String(token.get(\"expires_at\"))}`,\n          ),\n        );\n      }\n\n      if (dryRun) {\n        console.log(\n          colors.cyan(\n            \"Dry run — nothing deleted. Re-run without --dry-run to revoke these tokens.\",\n          ),\n        );\n\n        return;\n      }\n\n      // Re-selects rather than deleting the rows just listed: the delete then\n      // acts on the table's current state instead of a snapshot taken before\n      // the operator read the report. A second full scan is affordable here —\n      // this is a one-off remediation, not a request path.\n      const purged = await authService.purgeNeverExpiringTokens();\n\n      console.log(\n        colors.green(\n          `✅ Revoked ${purged.accessTokens} access token(s) and ` +\n            `${purged.refreshTokens} refresh token(s). Affected users must log in again.`,\n        ),\n      );\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,wCAAwC;CACtD,OAAO,QAAQ;EACb,MAAM;EACN,aACE;EACF,SAAS,CACP;GACE,MAAM;GACN,aAAa;GACb,MAAM;EACR,CACF;EACA,SAAS;GACP,KAAK;GACL,QAAQ,CAAC,QAAQ,UAAU;GAC3B,YAAY,CAAC,UAAU;EACzB;EACA,QAAQ,OAAO,OAA8C,CAAC,MAAM;GAQlE,MAAM,QAAQ,KAAK,WAAW,CAAC;GAC/B,MAAM,OAAO,MAAM,aAAa,MAAM;GACtC,MAAM,SAAS,SAAS,UAAa,SAAS,SAAS,SAAS;GAEhE,QAAQ,IAAI,OAAO,KAAK,iDAAiD,CAAC;GAE1E,MAAM,EAAE,cAAc,kBAAkB,MAAM,YAAY,wBAAwB;GAClF,MAAM,QAAQ,aAAa,SAAS,cAAc;GAElD,IAAI,UAAU,GAAG;IACf,QAAQ,IAAI,OAAO,MAAM,mCAAmC,CAAC;IAE7D;GACF;GAEA,QAAQ,IACN,OAAO,OACL,OAAO,MAAM,4BACR,aAAa,OAAO,WAAW,cAAc,OAAO,UAC3D,CACF;GAKA,KAAK,MAAM,SAAS,cAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,KAAK,MAAM,SAAS,eAClB,QAAQ,IACN,OAAO,OACL,gBAAgB,MAAM,GAAG,WAAW,MAAM,IAAI,SAAS,EAAE,aAC1C,MAAM,IAAI,WAAW,EAAE,cAAc,OAAO,MAAM,IAAI,YAAY,CAAC,GACpF,CACF;GAGF,IAAI,QAAQ;IACV,QAAQ,IACN,OAAO,KACL,6EACF,CACF;IAEA;GACF;GAMA,MAAM,SAAS,MAAM,YAAY,yBAAyB;GAE1D,QAAQ,IACN,OAAO,MACL,aAAa,OAAO,aAAa,uBAC5B,OAAO,cAAc,qDAC5B,CACF;EACF;CACF,CAAC;AACH"}

package/esm/commands/jwt-secret-generator-command.d.mts

@@ -1,5 +1,4 @@
 //#region ../../packages/auth/src/commands/jwt-secret-generator-command.d.ts
-declare function registerJWTSecretGeneratorCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerJWTSecretGeneratorCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerJWTSecretGeneratorCommand };
 //# sourceMappingURL=jwt-secret-generator-command.d.mts.map

package/esm/commands/jwt-secret-generator-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";iBAGgB,iCAAA,+BAAiC,UAAA"}
+{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";wBAGgB,gEAAiC"}

package/esm/commands/jwt-secret-generator-command.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret-generator-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"sourcesContent":["import { command } from \"@warlock.js/core\";\r\nimport { generateJWTSecret } from \"../services/generate-jwt-secret\";\r\n\r\nexport function registerJWTSecretGeneratorCommand() {\r\n  return command({\r\n    name: \"jwt.generate\",\r\n    description: \"Generate JWT Secret key in .env file\",\r\n    action: generateJWTSecret,\r\n  });\r\n}\r\n"],"mappings":";;;;AAGA,SAAgB,oCAAoC;CAClD,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,QAAQ;CACV,CAAC;AACH"}
+{"version":3,"file":"jwt-secret-generator-command.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"sourcesContent":["import { command } from \"@warlock.js/core\";\nimport { generateJWTSecret } from \"../services/generate-jwt-secret\";\n\nexport function registerJWTSecretGeneratorCommand() {\n  return command({\n    name: \"jwt.generate\",\n    description: \"Generate JWT Secret key in .env file\",\n    action: generateJWTSecret,\n  });\n}\n"],"mappings":";;;;AAGA,SAAgB,oCAAoC;CAClD,OAAO,QAAQ;EACb,MAAM;EACN,aAAa;EACb,QAAQ;CACV,CAAC;AACH"}

package/esm/contracts/auth-contract.d.mts

@@ -1,6 +1,5 @@
 import { AccessTokenOutput, DeviceInfo, TokenPair } from "./types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
-
 //#region ../../packages/auth/src/contracts/auth-contract.d.ts
 /**
  * Surface every authenticable user model exposes once it extends the
@@ -10,7 +9,7 @@ import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
  * Kept in sync with `Auth` — if a method here drifts from the class, the
  * `implements Authenticable` clause on `Auth` fails to compile.
  */
-interface Authenticable {
+export interface Authenticable {
   /**
    * Discriminator identifying which user type this model represents.
    * Drives token payloads and `authMiddleware` type checks.
@@ -36,5 +35,4 @@ interface Authenticable {
   confirmPassword(password: string): Promise<boolean>;
 }
 //#endregion
-export { Authenticable };
 //# sourceMappingURL=auth-contract.d.mts.map

package/esm/contracts/auth-contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;AAWA;;;;;;UAAiB,aAAA;EAiBwC;;;;EAAA,IAZnD,QAAA;EAsB+B;;;;EAhBnC,mBAAA,CAAoB,OAAA,GAAU,MAAA,oBAA0B,OAAA,CAAQ,iBAAA;EAAlC;;;;EAM9B,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAArB;;;EAKlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAAlD;;;EAKA,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;;;;;;iBAWiB;;;;;MAKX;;;;;EAMJ,oBAAoB,UAAU,0BAA0B,QAAQ;;;;;EAMhE,qBAAqB,aAAa,aAAa,QAAQ;;;;EAKvD,gBAAgB,aAAa,aAAa,QAAQ;;;;EAKlD,gBAAgB,mBAAmB"}

package/esm/contracts/index.d.mts

@@ -1,4 +1,5 @@
 import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./providers.mjs";
 import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
 import { Authenticable } from "./auth-contract.mjs";
-import { RequestUser } from "./request-locals.mjs";
+import { RequestUser } from "./request-locals.mjs";
+export { AccessTokenConfig, AccessTokenOutput, AppleProviderConfig, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthRefreshCredentialDescriptor, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, DiscordProviderConfig, EmailVerificationConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LegacyJwtConfig, LinkedInProviderConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshTokenConfig, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, XProviderConfig };

package/esm/contracts/providers.d.mts

@@ -1,12 +1,11 @@
 import { Auth } from "../models/auth.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/contracts/providers.d.ts
 /**
  * The per-login secrets a redirect provider round-trips: `state` (CSRF),
  * `nonce` (id_token replay binding) and the PKCE `codeVerifier`.
  */
-type ProviderAuthorizationState = {
+export type ProviderAuthorizationState = {
   state: string;
   nonce: string;
   codeVerifier: string;
@@ -16,18 +15,22 @@ type ProviderAuthorizationState = {
  * callback query and the state that was stored when the login started. The
  * caller has already checked `query.state` against `expected.state`.
  */
-type ProviderCallbackParams = {
+export type ProviderCallbackParams = {
   query: Record<string, unknown>;
   expected: ProviderAuthorizationState;
 };
 /** The identity a provider asserts, normalized across providers. */
-type ProviderProfile = {
-  /** Provider name, e.g. `"google"`. */provider: string; /** The provider's stable user id (`sub`). The link key — never the email. */
+export type ProviderProfile = {
+  /** Provider name, e.g. `"google"`. */
+  provider: string;
+  /** The provider's stable user id (`sub`). The link key — never the email. */
   providerUserId: string;
-  email?: string; /** Whether the PROVIDER verified `email`. Accounts are never linked on `false`. */
+  email?: string;
+  /** Whether the PROVIDER verified `email`. Accounts are never linked on `false`. */
   emailVerified: boolean;
   name?: string;
-  avatar?: string; /** The verified claims the profile was built from. */
+  avatar?: string;
+  /** The verified claims the profile was built from. */
   raw: Record<string, unknown>;
 };
 /**
@@ -35,7 +38,7 @@ type ProviderProfile = {
  * Register an instance under `auth.providers.custom.<name>` to add one auth does
  * not ship.
  */
-interface AuthProvider {
+export interface AuthProvider {
   readonly name: string;
   /**
    * How the provider's callback arrives. `"query"` (default) is a top-level
@@ -51,60 +54,78 @@ interface AuthProvider {
   handleCallback(params: ProviderCallbackParams): Promise<ProviderProfile>;
 }
 /** `auth.providers.google`. */
-type GoogleProviderConfig = {
+export type GoogleProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect URI registered in the Google console. */
-  redirectUri: string; /** @default ["openid", "email", "profile"] */
+  clientSecret: string;
+  /** Must exactly match a redirect URI registered in the Google console. */
+  redirectUri: string;
+  /** @default ["openid", "email", "profile"] */
   scopes?: string[];
 };
 /** `auth.providers.github`. */
-type GitHubProviderConfig = {
+export type GitHubProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match the "Authorization callback URL" registered on the GitHub OAuth App. */
-  redirectUri: string; /** @default ["read:user", "user:email"] */
+  clientSecret: string;
+  /** Must exactly match the "Authorization callback URL" registered on the GitHub OAuth App. */
+  redirectUri: string;
+  /** @default ["read:user", "user:email"] */
   scopes?: string[];
 };
 /** `auth.providers.discord`. */
-type DiscordProviderConfig = {
+export type DiscordProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect registered on the Discord application. */
-  redirectUri: string; /** @default ["identify", "email"] */
+  clientSecret: string;
+  /** Must exactly match a redirect registered on the Discord application. */
+  redirectUri: string;
+  /** @default ["identify", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.linkedin`. */
-type LinkedInProviderConfig = {
+export type LinkedInProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect URL registered on the LinkedIn app. */
-  redirectUri: string; /** @default ["openid", "profile", "email"] */
+  clientSecret: string;
+  /** Must exactly match a redirect URL registered on the LinkedIn app. */
+  redirectUri: string;
+  /** @default ["openid", "profile", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.apple`. */
-type AppleProviderConfig = {
-  /** The Services ID (or app id) registered with Sign in with Apple. */clientId: string; /** The Apple Developer team id — signed into the client-secret JWT as `iss`. */
-  teamId: string; /** The id of the private key created for Sign in with Apple — signed into the client-secret JWT header as `kid`. */
-  keyId: string; /** The PKCS8 PEM contents of that private key (`.p8` file), used to sign the client-secret JWT. */
-  privateKey: string; /** Must exactly match a return URL registered on the Services ID. */
-  redirectUri: string; /** @default ["name", "email"] */
+export type AppleProviderConfig = {
+  /** The Services ID (or app id) registered with Sign in with Apple. */
+  clientId: string;
+  /** The Apple Developer team id — signed into the client-secret JWT as `iss`. */
+  teamId: string;
+  /** The id of the private key created for Sign in with Apple — signed into the client-secret JWT header as `kid`. */
+  keyId: string;
+  /** The PKCS8 PEM contents of that private key (`.p8` file), used to sign the client-secret JWT. */
+  privateKey: string;
+  /** Must exactly match a return URL registered on the Services ID. */
+  redirectUri: string;
+  /** @default ["name", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.facebook`. */
-type FacebookProviderConfig = {
+export type FacebookProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a valid OAuth redirect URI registered on the Facebook app. */
-  redirectUri: string; /** @default ["email", "public_profile"] */
+  clientSecret: string;
+  /** Must exactly match a valid OAuth redirect URI registered on the Facebook app. */
+  redirectUri: string;
+  /** @default ["email", "public_profile"] */
   scopes?: string[];
 };
 /** `auth.providers.x`. */
-type XProviderConfig = {
+export type XProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a callback URI registered on the X app (confidential client). */
-  redirectUri: string; /** @default ["tweet.read", "users.read"] */
+  clientSecret: string;
+  /** Must exactly match a callback URI registered on the X app (confidential client). */
+  redirectUri: string;
+  /** @default ["tweet.read", "users.read"] */
   scopes?: string[];
 };
 /** Creates the app user for a verified provider profile with no matching account. */
-type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
+export type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
 /** `auth.providers`. */
-type ProvidersConfig = {
+export type ProvidersConfig = {
   google?: GoogleProviderConfig;
   github?: GitHubProviderConfig;
   discord?: DiscordProviderConfig;
@@ -116,44 +137,55 @@ type ProvidersConfig = {
    * User attribute a verified provider email is matched against.
    * @default "email"
    */
-  emailField?: string; /** Replace the default user creation (`{ email, name, <verification.field>: now }`). */
-  createUser?: ProviderUserCreator; /** Providers auth does not ship, by name. */
+  emailField?: string;
+  /** Replace the default user creation (`{ email, name, <verification.field>: now }`). */
+  createUser?: ProviderUserCreator;
+  /** Providers auth does not ship, by name. */
   custom?: Record<string, AuthProvider>;
 };
 /** `auth.passkeys`. */
-type PasskeysConfig = {
-  /** Relying-party id — the site's registrable domain, e.g. `"example.com"`. */rpID: string; /** Name shown by the authenticator. */
-  rpName: string; /** Exact origin(s) the browser ceremony runs on, e.g. `"https://example.com"`. */
+export type PasskeysConfig = {
+  /** Relying-party id — the site's registrable domain, e.g. `"example.com"`. */
+  rpID: string;
+  /** Name shown by the authenticator. */
+  rpName: string;
+  /** Exact origin(s) the browser ceremony runs on, e.g. `"https://example.com"`. */
   origin: string | string[];
   /**
    * Challenge lifetime — a positive `ms` duration string.
    * @default "5m"
    */
-  challengeExpiresIn?: string; /** Account name shown by the authenticator. @default user email, else id */
+  challengeExpiresIn?: string;
+  /** Account name shown by the authenticator. @default user email, else id */
   userName?: (user: Auth) => string;
 };
 /** Data an OTP delivery receives. */
-type OtpMessage = {
-  /** Ready-to-send text containing the code. */body: string;
+export type OtpMessage = {
+  /** Ready-to-send text containing the code. */
+  body: string;
   code: string;
   expiresAt: Date;
 };
 /** Delivers an OTP. Replaces the default `notify.channel(channel).send(phone, message)`. */
-type OtpSender = (phone: string, message: OtpMessage, channel: string) => unknown;
+export type OtpSender = (phone: string, message: OtpMessage, channel: string) => unknown;
 /** `auth.otp`. */
-type OtpConfig = {
+export type OtpConfig = {
   /**
    * Notifications channel the code is sent through. The app registers it
    * (auth ships no SMS/WhatsApp driver).
    * @default "sms"
    */
-  channel?: string; /** User attribute holding the phone number. @default "phone" */
-  phoneField?: string; /** Code lifetime. @default "5m" */
-  expiresIn?: string; /** Verify attempts before the code is invalidated. @default 5 */
-  maxAttempts?: number; /** Build the message text. @default "Your verification code is <code>" */
-  message?: (code: string) => string; /** Replace delivery entirely. */
+  channel?: string;
+  /** User attribute holding the phone number. @default "phone" */
+  phoneField?: string;
+  /** Code lifetime. @default "5m" */
+  expiresIn?: string;
+  /** Verify attempts before the code is invalidated. @default 5 */
+  maxAttempts?: number;
+  /** Build the message text. @default "Your verification code is <code>" */
+  message?: (code: string) => string;
+  /** Replace delivery entirely. */
   send?: OtpSender;
 };
 //#endregion
-export { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig };
 //# sourceMappingURL=providers.d.mts.map

package/esm/contracts/providers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAUqD;;;;;;;EAAA,SAFrD,YAAA;EAET;EAAA,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAA7C;EAEjB,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UANuE;EAQvE,WAAA,UAJU;EAMV,MAAA;AAAA;;KAIU,oBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UAVA;EAYA,WAAA,UARA;EAUA,MAAA;AAAA;AANF;AAAA,KAUY,mBAAA;wEAEV,QAAA,UAXA;EAaA,MAAA,UAVA;EAYA,KAAA,UAVM;EAYN,UAAA,UARU;EAUV,WAAA;EAEA,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,eAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EACT,MAAA,GAAS,oBAAA;EACT,OAAA,GAAU,qBAAA;EACV,QAAA,GAAW,sBAAA;EACX,KAAA,GAAQ,mBAAA;EACR,QAAA,GAAW,sBAAA;EACX,CAAA,GAAI,eAAA;;;;;EAKJ,UAAA,WAfkB;EAiBlB,UAAA,GAAa,mBAAA,EAjBI;EAmBjB,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAxBQ,8EA0BlB,IAAA,UAzBG;EA2BH,MAAA,UA3BkB;EA6BlB,MAAA;EA7BsB;AAGxB;;;EA+BE,kBAAA,WA7BS;EA+BT,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EA9BN,8CAgCJ,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EA9CD;;;;;EAoDT,OAAA,WAjDQ;EAmDR,UAAA,WAlDW;EAoDX,SAAA,WAnDI;EAqDJ,WAAA,WA9CA;EAgDA,OAAA,IAAW,IAAA,qBA9CX;EAgDA,IAAA,GAAO,SAAS;AAAA"}
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/providers.ts"],"mappings":";;;;;;;YAOY;EACV;EACA;EACA;;;;;;;YAQU;EACV,OAAO;EACP,UAAU;;;YAIA;;EAEV;;EAEA;EACA;;EAEA;EACA;EACA;;EAEA,KAAK;;;;;;;iBAQU;WACN;;;;;;;;WAQA;;EAET,iBAAiB,OAAO,sCAAsC;;EAE9D,eAAe,QAAQ,yBAAyB,QAAQ;;;YAI9C;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU,uBACV,SAAS,iBACT,OAAO,WAAW,UACf,OAAO,QAAQ;;YAGR;EACV,SAAS;EACT,SAAS;EACT,UAAU;EACV,WAAW;EACX,QAAQ;EACR,WAAW;EACX,IAAI;;;;;EAKJ;;EAEA,aAAa;;EAEb,SAAS,eAAe;;;YAId;;EAEV;;EAEA;;EAEA;;;;;EAKA;;EAEA,YAAY,MAAM;;;YAIR;;EAEV;EACA;EACA,WAAW;;;YAID,aAAa,eAAe,SAAS,YAAY;;YAGjD;;;;;;EAMV;;EAEA;;EAEA;;EAEA;;EAEA,WAAW;;EAEX,OAAO"}

package/esm/contracts/request-locals.d.mts

@@ -24,7 +24,7 @@
  * would fail to compile (TS2320). See `access/src/middleware/gate.middleware.ts`
  * for the same hazard documented at its call site.
  */
-interface RequestUser {}
+export interface RequestUser {}
 /**
  * Augments core's `RequestLocals` (`request.locals`) with the `user` key —
  * done in the module that OWNS the key, per `RequestLocals`' own contract
@@ -42,7 +42,6 @@ declare module "@warlock.js/core" {
      */
     session?: Promise<any>;
   }
-} //# sourceMappingURL=request-locals.d.ts.map
+}
 //#endregion
-export { RequestUser };
 //# sourceMappingURL=request-locals.d.mts.map

package/esm/contracts/request-locals.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;;;AAiBV;;;;;;;;UAjBJ,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAA;;;;;IAKP,OAAA,GAAU,OAAO;EAAA;AAAA"}
+{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/request-locals.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBiB;;;;;;;;;;YAWL;IACR,OAAO;;;;;IAKP,UAAU"}