@warlock.js/auth 5.30.0 → 5.32.0

package/esm/models/auth-token-family/auth-token-family.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/auth-token-family/auth-token-family.model.d.ts
 /** Durable revision authority for one refresh-token rotation family. */
-declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<{
   family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
   user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -13,21 +12,9 @@ declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<
   revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  revision?: number | undefined;
-  revoked_at?: Date | undefined;
-  family_id: string;
-  user_id: string | number | boolean;
-  user_type: string;
-}, {
-  revision?: number | undefined;
-  revoked_at?: Date | undefined;
-  family_id: string;
-  user_id: string | number | boolean;
-  user_type: string;
 }>;
 /** Coordinates family-wide refresh, replay containment, and logout transitions. */
-declare class AuthTokenFamily extends Model {
+export declare class AuthTokenFamily extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -39,18 +26,6 @@ declare class AuthTokenFamily extends Model {
     revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    revision?: number | undefined;
-    revoked_at?: Date | undefined;
-    family_id: string;
-    user_id: string | number | boolean;
-    user_type: string;
-  }, {
-    revision?: number | undefined;
-    revoked_at?: Date | undefined;
-    family_id: string;
-    user_id: string | number | boolean;
-    user_type: string;
   }>;
   /** Whether a family-wide revoke has made every member unusable. */
   get isRevoked(): boolean;
@@ -70,5 +45,4 @@ declare class AuthTokenFamily extends Model {
   static revoke(familyId: string, expectedRevision: number): Promise<number>;
 }
 //#endregion
-export { AuthTokenFamily, authTokenFamilySchema };
 //# sourceMappingURL=auth-token-family.model.d.mts.map

package/esm/models/auth-token-family/auth-token-family.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;cASrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;MAGT,SAAA;;SAKG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,QAAA,WAAgB,OAAA,CAAA,eAAA;EAAA,OASlC,cAAA,CAAe,QAAA,WAAmB,OAAA,CAAQ,eAAA;EATR;EAAA,OAc5B,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA,CAAQ,eAAA;EALlB;EAAA,OAqClC,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,eAAA;EAhCqB;;;;EAAA,OA0CpD,eAAA,CAAgB,QAAA,UAAkB,gBAAA,WAA2B,OAAA;EAAA;EAAA,OAQ7D,MAAA,CAAO,QAAA,UAAkB,gBAAA,WAA2B,OAAA;AAAA"}
+{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;qBAKa,kDAAqB;;;;;;;;;;;;qBASrB,wBAAwB;SACrB;SAEA,mCAAM;;;;;;;;;;;;MAGT;;SAKG,MAAM,MAAM,MAAM,mBAAgB,QAAA;SASlC,eAAe,mBAAmB,QAAQ;;SAKpC,OAAO,MAAM,MAAM,mBAAmB,QAAQ;;SAgCpD,UAAU,MAAM,OAAO,QAAQ;;;;;SAU/B,gBAAgB,kBAAkB,2BAA2B;;SAQ7D,OAAO,kBAAkB,2BAA2B"}

package/esm/models/auth-token-family/index.d.mts

@@ -1 +1,2 @@
-import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
+export { AuthTokenFamily, authTokenFamilySchema };

package/esm/models/auth-token-family/index.mjs

@@ -1,3 +1,3 @@
 import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
 
-export {  };
+export { AuthTokenFamily, authTokenFamilySchema };

package/esm/models/auth.model.d.mts

@@ -2,9 +2,8 @@ import { AccessTokenOutput, DeviceInfo, TokenPair } from "../contracts/types.mjs
 import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "../contracts/auth-contract.mjs";
 import { ChildModel, Model, ModelSchema } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/auth.model.d.ts
-declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Model<Schema> implements Authenticable {
+export declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Model<Schema> implements Authenticable {
   /**
    * Get user type
    */
@@ -55,5 +54,4 @@ declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Mo
   confirmPassword(password: string): Promise<boolean>;
 }
 //#endregion
-export { Auth };
 //# sourceMappingURL=auth.model.d.mts.map

package/esm/models/auth.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/auth.model.ts"],"mappings":";;;;;;uBAMsB,IAAA,gBAAoB,WAAA,GAAc,WAAA,UAC9C,KAAA,CAAM,MAAA,aACH,aAAA;;AAFb;;eAOsB,QAAA;EAPoB;;;EAYjC,kBAAA,IAAkB,MAAA;EAOiB;;;EAA7B,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAOjB;;;EAAjC,mBAAA,CAAoB,IAAA,SAAa,OAAA,CAAQ,iBAAA;EAcP;;;EAPlC,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAmC7B;;;EA5B1B,iBAAA,CAAkB,KAAA,WAAgB,OAAA;EAmCyB;;;EA5B3D,kBAAA,CAAmB,KAAA,WAAgB,OAAA;EA7CrC;;;EAoDE,qBAAA,IAAyB,OAAA;EAtDE;;;EA6D3B,eAAA,IAAmB,OAAA;EA3DrB;;;EAkEE,cAAA,IAAkB,OAAA,CAAQ,YAAA;EAjD1B;;;EAAA,OAwDO,OAAA,CAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,GAAO,IAAA,QAAY,OAAA,CAAQ,IAAA;EAxDT;;;EA+DlD,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/auth.model.ts"],"mappings":";;;;;8BAMsB,KAAK,eAAe,cAAc,qBAC9C,MAAM,mBACH;;;;eAKS;;;;EAKb,sBAAkB;;;;EAOZ,gBAAgB,aAAa,aAAa,QAAQ;;;;EAOlD,oBAAoB,aAAa,QAAQ;;;;EAOzC,qBAAqB,aAAa,aAAa,QAAQ;;;;EAOvD,kBAAkB,gBAAgB;;;;EAOlC,mBAAmB,gBAAgB;;;;EAOnC,yBAAyB;;;;EAOzB,mBAAmB;;;;EAOnB,kBAAkB,QAAQ;;;;SAOnB,QAAQ,MAAM,WAAW,OAAO,YAAY,QAAQ;;;;EAO3D,gBAAgB,mBAAmB"}

package/esm/models/index.d.mts

@@ -1,12 +1,18 @@
 import { Auth } from "./auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
+import "./access-token/index.mjs";
 import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
+import "./one-time-token/index.mjs";
+import "./refresh-token/index.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family/auth-token-family.model.mjs";
+import "./auth-token-family/index.mjs";
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import "./passkey-credential/index.mjs";
 import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
+import "./provider-account/index.mjs";
 //#region ../../packages/auth/src/models/index.d.ts
-declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
+export declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
 //#endregion
-export { authMigrations };
+export { AccessToken, Auth, AuthTokenFamily, OneTimeToken, OneTimeTokenPurpose, PasskeyCredential, ProviderAccount, RefreshToken, RefreshTokenIssueOptions, accessTokenSchema, authTokenFamilySchema, oneTimeTokenSchema, passkeyCredentialSchema, providerAccountSchema, refreshTokenSchema };
 //# sourceMappingURL=index.d.mts.map

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"mappings":";;;;;;;;cAiBa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"mappings":";;;;;;;;;;;;;;qBAiBa,8CAAc"}

package/esm/models/index.mjs

@@ -33,5 +33,5 @@ const authMigrations = [
 ];
 
 //#endregion
-export { authMigrations };
+export { AccessToken, Auth, AuthTokenFamily, OneTimeToken, PasskeyCredential, ProviderAccount, RefreshToken, accessTokenSchema, authMigrations, authTokenFamilySchema, oneTimeTokenSchema, passkeyCredentialSchema, providerAccountSchema, refreshTokenSchema };
 //# sourceMappingURL=index.mjs.map

package/esm/models/one-time-token/index.d.mts

@@ -1 +1,2 @@
-import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };

package/esm/models/one-time-token/index.mjs

@@ -1,3 +1,3 @@
 import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token.model.mjs";
 
-export {  };
+export { OneTimeToken, oneTimeTokenSchema };

package/esm/models/one-time-token/one-time-token.model.d.mts

@@ -1,14 +1,13 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/one-time-token/one-time-token.model.d.ts
 /** What a one-time token may be used for. A token only ever satisfies its own purpose. */
-type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
+export type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
 /**
  * Seal schema for the persisted one-time token. Exported so an override can
  * extend it (e.g. a tenant key).
  */
-declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
@@ -24,22 +23,6 @@ declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  user_id?: string | number | boolean | undefined;
-  user_type?: string | undefined;
-  consumed_at?: Date | undefined;
-  attempts?: number | undefined;
-  token_hash: string;
-  purpose: string;
-  expires_at: Date;
-}, {
-  user_id?: string | number | boolean | undefined;
-  user_type?: string | undefined;
-  consumed_at?: Date | undefined;
-  attempts?: number | undefined;
-  token_hash: string;
-  purpose: string;
-  expires_at: Date;
 }>;
 /**
  * Persisted one-time secret: email-verification / password-reset token, OTP
@@ -50,7 +33,7 @@ declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
  * enforced by {@link consumeIfActive}, a conditional update in the same shape
  * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
  */
-declare class OneTimeToken extends Model {
+export declare class OneTimeToken extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -68,22 +51,6 @@ declare class OneTimeToken extends Model {
     attempts: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number> & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    user_id?: string | number | boolean | undefined;
-    user_type?: string | undefined;
-    consumed_at?: Date | undefined;
-    attempts?: number | undefined;
-    token_hash: string;
-    purpose: string;
-    expires_at: Date;
-  }, {
-    user_id?: string | number | boolean | undefined;
-    user_type?: string | undefined;
-    consumed_at?: Date | undefined;
-    attempts?: number | undefined;
-    token_hash: string;
-    purpose: string;
-    expires_at: Date;
   }>;
   /**
    * The SHA-256 of a one-time secret. For a short OTP code the hash is
@@ -143,5 +110,4 @@ declare class OneTimeToken extends Model {
   static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number>;
 }
 //#endregion
-export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };
 //# sourceMappingURL=one-time-token.model.d.mts.map

package/esm/models/one-time-token/one-time-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2DZ;;;;;EAAA,OApDM,MAAA;EA2ED;;;;;;EAAA,OAnEC,cAAA;EAqFX;EAAA,IAlFQ,MAAA;EAiHuB;EAAA,IA5GvB,QAAA;EA8HA;EAAA,IAzHA,UAAA;EAiI6B;EAAA,IA5H7B,SAAA;EA4HkE;;;;;EA/GhE,eAAA,IAAmB,OAAA;EA9ClB;EAAA,OA0DA,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;;;;;SAiBH,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;;SAcC,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;;EAYE,aAAA,CAAc,GAAA,WAAc,OAAA;;;;;;;SAmBrB,UAAA,IAAc,OAAA;;SAepB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;SAQG,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}
+{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;YAMY;;;;;qBAWC,+CAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;qBAoBlB,qBAAqB;SAClB;SAEA,mCAAM;;;;;;;;;;;;;;;;;;;;;;SAON;;;;;;;SAQA;;MAGH;;MAKA;;MAKA;;MAKA;;;;;;EAaE,mBAAmB;;SAYlB,MACZ,MAAM,MACN,SAAS,qBACT,mBACA,WAAW,OAAI,QAAA;;;;;SAiBH,eACZ,SAAS,qBACT,mBACA,WAAW,MACX,OAAO,OAAI,QAAA;;SAcC,cACZ,MAAM,MACN,SAAS,sBACR,QAAQ;;;;;;EAYE,cAAc,cAAc;;;;;;;SAmBrB,cAAc;;SAepB,WACZ,mBACA,SAAS,sBACR,QAAQ;;;;;SAQG,oBAAoB,MAAM,MAAM,SAAS,sBAAsB"}

package/esm/models/passkey-credential/index.d.mts

@@ -1 +1,2 @@
-import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+export { PasskeyCredential, passkeyCredentialSchema };

package/esm/models/passkey-credential/index.mjs

@@ -1,3 +1,3 @@
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
 
-export {  };
+export { PasskeyCredential, passkeyCredentialSchema };

package/esm/models/passkey-credential/passkey-credential.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/passkey-credential/passkey-credential.model.d.ts
 /** Seal schema for a stored passkey. Exported so an override can extend it. */
-declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
   credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
@@ -14,27 +13,13 @@ declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidato
   };
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
   user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  transports?: string[] | undefined;
-  credential_id: string;
-  public_key: string;
-  counter: number;
-  user_id: string | number | boolean;
-  user_type: string;
-}, {
-  transports?: string[] | undefined;
-  credential_id: string;
-  public_key: string;
-  counter: number;
-  user_id: string | number | boolean;
-  user_type: string;
 }>;
 /**
  * A registered WebAuthn credential. `credential_id` and `public_key` are
  * base64url; `counter` is the last signature counter seen, which an
  * authentication must advance (a clone detector).
  */
-declare class PasskeyCredential extends Model {
+export declare class PasskeyCredential extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -47,20 +32,6 @@ declare class PasskeyCredential extends Model {
     };
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
     user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    transports?: string[] | undefined;
-    credential_id: string;
-    public_key: string;
-    counter: number;
-    user_id: string | number | boolean;
-    user_type: string;
-  }, {
-    transports?: string[] | undefined;
-    credential_id: string;
-    public_key: string;
-    counter: number;
-    user_id: string | number | boolean;
-    user_type: string;
   }>;
   /**
    * Permanent regardless of the data source default — Mongo's driver default
@@ -88,5 +59,4 @@ declare class PasskeyCredential extends Model {
   advanceCounter(expected: number, newCounter: number): Promise<boolean>;
 }
 //#endregion
-export { PasskeyCredential, passkeyCredentialSchema };
 //# sourceMappingURL=passkey-credential.model.d.mts.map

package/esm/models/passkey-credential/passkey-credential.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,cAAA;;MAGH,YAAA;;MAKA,OAAA;;MAKA,MAAA;;MAKA,QAAA;;SAKG,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;;SAKlD,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}
+{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;qBAKa,oDAAuB;;;;;;;;;;;;;;;;;qBAcvB,0BAA0B;SACvB;SAEA,mCAAM;;;;;;;;;;;;;;;;;;SAQN;;MAGH;;MAKA;;MAKA;;MAKA;;SAKG,mBAAmB,uBAAuB,QAAQ;;SAKlD,QAAQ,MAAM,OAAO,QAAQ;;;;;EAQ9B,eAAe,kBAAkB,qBAAqB"}

package/esm/models/provider-account/index.d.mts

@@ -1 +1,2 @@
-import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+export { ProviderAccount, providerAccountSchema };

package/esm/models/provider-account/index.mjs

@@ -1,3 +1,3 @@
 import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
 
-export {  };
+export { ProviderAccount, providerAccountSchema };

package/esm/models/provider-account/provider-account.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/provider-account/provider-account.model.d.ts
 /** Seal schema for a provider link. Exported so an override can extend it. */
-declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
   provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
@@ -11,18 +10,6 @@ declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<
   email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  email?: string | undefined;
-  provider: string;
-  provider_user_id: string;
-  user_id: string | number | boolean;
-  user_type: string;
-}, {
-  email?: string | undefined;
-  provider: string;
-  provider_user_id: string;
-  user_id: string | number | boolean;
-  user_type: string;
 }>;
 /**
  * Links a provider identity (`provider` + the provider's stable user id) to
@@ -30,7 +17,7 @@ declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<
  * a user is created for it; afterwards the link alone resolves the user, so a
  * later email change at the provider cannot move the login to another account.
  */
-declare class ProviderAccount extends Model {
+export declare class ProviderAccount extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -40,18 +27,6 @@ declare class ProviderAccount extends Model {
     email: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    email?: string | undefined;
-    provider: string;
-    provider_user_id: string;
-    user_id: string | number | boolean;
-    user_type: string;
-  }, {
-    email?: string | undefined;
-    provider: string;
-    provider_user_id: string;
-    user_id: string | number | boolean;
-    user_type: string;
   }>;
   /** The linked user's id. */
   get userId(): any;
@@ -63,5 +38,4 @@ declare class ProviderAccount extends Model {
   static link(provider: string, providerUserId: string, user: Auth, email?: string): Promise<ProviderAccount>;
 }
 //#endregion
-export { ProviderAccount, providerAccountSchema };
 //# sourceMappingURL=provider-account.model.d.mts.map

package/esm/models/provider-account/provider-account.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;cAcrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;MAGT,MAAA;;MAKA,QAAA;;SAKG,QAAA,CACZ,QAAA,UACA,cAAA,WACC,OAAA,CAAQ,eAAA;;SAKG,IAAA,CAAK,QAAA,UAAkB,cAAA,UAAwB,IAAA,EAAM,IAAA,EAAM,KAAA,YAAc,OAAA,CAAA,eAAA;AAAA"}
+{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;qBAKa,kDAAqB;;;;;;;;;;;;;;;qBAcrB,wBAAwB;SACrB;SAEA,mCAAM;;;;;;;;;;MAGT;;MAKA;;SAKG,SACZ,kBACA,yBACC,QAAQ;;SAKG,KAAK,kBAAkB,wBAAwB,MAAM,MAAM,iBAAc,QAAA"}

package/esm/models/refresh-token/index.d.mts

@@ -1 +1,2 @@
-import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token.model.mjs";
+import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token.model.mjs";
+export { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema };

package/esm/models/refresh-token/index.mjs

@@ -1,3 +1,3 @@
 import { RefreshToken, refreshTokenSchema } from "./refresh-token.model.mjs";
 
-export {  };
+export { RefreshToken, refreshTokenSchema };

package/esm/models/refresh-token/refresh-token.model.d.mts

@@ -1,7 +1,6 @@
 import { Auth } from "../auth.model.mjs";
 import { DeviceInfo } from "../../contracts/types.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/refresh-token/refresh-token.model.d.ts
 /**
  * Seal schema for the persisted refresh-token record. Exported so an override
@@ -15,7 +14,7 @@ import { Model } from "@warlock.js/cascade";
  *   });
  * }
  */
-declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
   user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -26,45 +25,24 @@ declare const refreshTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   };
   revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
     isOptional: true;
-  }; /** The successor pair a bounded concurrent renewal may reuse. */
+  };
+  /** The successor pair a bounded concurrent renewal may reuse. */
   successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
     isOptional: true;
   };
   successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
     isOptional: true;
   };
-  device_info: import("@warlock.js/seal").RecordValidator & {
+  device_info: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
     valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-  } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & {
+  } & {
     isOptional: true;
   };
-}> & import("@warlock.js/seal").StandardSchemaV1<{
-  last_used_at?: Date | undefined;
-  revoked_at?: Date | undefined;
-  successor_access_token_id?: string | undefined;
-  successor_refresh_token_id?: string | undefined;
-  device_info?: Record<string, any> | undefined;
-  token: string;
-  user_id: string | number | boolean;
-  user_type: string;
-  family_id: string;
-  expires_at: Date;
-}, {
-  last_used_at?: Date | undefined;
-  revoked_at?: Date | undefined;
-  successor_access_token_id?: string | undefined;
-  successor_refresh_token_id?: string | undefined;
-  device_info?: Record<string, any> | undefined;
-  token: string;
-  user_id: string | number | boolean;
-  user_type: string;
-  family_id: string;
-  expires_at: Date;
 }>;
 /**
  * Extra attributes captured when a refresh token is issued.
  */
-type RefreshTokenIssueOptions = {
+export type RefreshTokenIssueOptions = {
   familyId: string;
   expiresAt: string;
   deviceInfo?: DeviceInfo;
@@ -79,7 +57,7 @@ type RefreshTokenIssueOptions = {
  * structurally impossible and lets an override rename or add columns by
  * extending this class and registering it under `config.auth.refreshToken.model`.
  */
-declare class RefreshToken extends Model {
+export declare class RefreshToken extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -92,40 +70,19 @@ declare class RefreshToken extends Model {
     };
     revoked_at: import("@warlock.js/seal").DateValidator & import("@warlock.js/seal").StandardSchemaV1<Date, Date> & {
       isOptional: true;
-    }; /** The successor pair a bounded concurrent renewal may reuse. */
+    };
+    /** The successor pair a bounded concurrent renewal may reuse. */
     successor_access_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
       isOptional: true;
     };
     successor_refresh_token_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
       isOptional: true;
     };
-    device_info: import("@warlock.js/seal").RecordValidator & {
+    device_info: import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & import("@warlock.js/seal").RecordValidator & {
       valueValidator: import("@warlock.js/seal").AnyValidator & import("@warlock.js/seal").StandardSchemaV1<any, any>;
-    } & import("@warlock.js/seal").StandardSchemaV1<Record<string, any>, Record<string, any>> & {
+    } & {
       isOptional: true;
     };
-  }> & import("@warlock.js/seal").StandardSchemaV1<{
-    last_used_at?: Date | undefined;
-    revoked_at?: Date | undefined;
-    successor_access_token_id?: string | undefined;
-    successor_refresh_token_id?: string | undefined;
-    device_info?: Record<string, any> | undefined;
-    token: string;
-    user_id: string | number | boolean;
-    user_type: string;
-    family_id: string;
-    expires_at: Date;
-  }, {
-    last_used_at?: Date | undefined;
-    revoked_at?: Date | undefined;
-    successor_access_token_id?: string | undefined;
-    successor_refresh_token_id?: string | undefined;
-    device_info?: Record<string, any> | undefined;
-    token: string;
-    user_id: string | number | boolean;
-    user_type: string;
-    family_id: string;
-    expires_at: Date;
   }>;
   /**
    * The raw signed refresh JWT is a bearer credential — never serialize it.
@@ -252,5 +209,4 @@ declare class RefreshToken extends Model {
   static purgeNeverExpiring(): Promise<RefreshToken[]>;
 }
 //#endregion
-export { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema };
 //# sourceMappingURL=refresh-token.model.d.mts.map

package/esm/models/refresh-token/refresh-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAkBA;;;;;;;;;;cAAa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAiBnB,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN,MAAA;EAsFY;;;;;;EAAA,OA9EZ,cAAA;EA0GgD;EAAA,IAvGnD,QAAA;EA4G2C;;;;;;;;;;EAAA,IA9F3C,SAAA;EAoI2C;;;;EAAA,IAxH3C,YAAA;EAuJ8C;EAAA,IAlJ9C,SAAA;EAsKyB;EAAA,IAjKzB,OAAA;EAiL8B;;;EA1K5B,MAAA,IAAU,OAAA;EAjEc;;;;;;;EA4ExB,cAAA,IAAkB,OAAA;;;;EAclB,UAAA,IAAc,OAAA;;;;SAOb,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA,GAAwB,OAAA,CAAA,YAAA;;;;SAoBlE,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;;;;;SAQpC,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;;SAKhD,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;;;;;SAQxC,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;;;;SAOrC,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;;;;SAOvC,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;;;;;;;;;SAgBzB,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;;;;;SAgBlC,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;;;;;;SAexC,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;;;;;;SAoBrC,YAAA,IAAgB,OAAA,CAAQ,YAAA;;;;;;;SAgBxB,iBAAA,IAAqB,OAAA,CAAQ,YAAA;;;;;;;;;;SAe7B,kBAAA,IAAsB,OAAA,CAAQ,YAAA;AAAA"}
+{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;;;;;;;;;;qBAkBa,+CAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAiBnB;EACV;EACA;EACA,aAAa;;;;;;;;;;;;qBAaF,qBAAqB;SAClB;SAEA,mCAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAQN;;;;;;;SAQA;;MAGH;;;;;;;;;;;MAcA;;;;;MAYA;;MAKA;;MAKA;;;;EAOE,UAAU;;;;;;;;EAWV,kBAAkB;;;;EAclB,cAAc;;;;SAOb,MAAM,MAAM,MAAM,eAAe,SAAS,2BAAwB,QAAA;;;;SAoBlE,YAAY,gBAAgB,QAAQ;;;;;SAQpC,YAAY,MAAM,MAAM,gBAAgB,QAAQ;;SAKhD,aAAa,mBAAmB,QAAQ;;;;;SAQxC,gBAAgB,MAAM,OAAO,QAAQ;;;;SAOrC,cAAc,MAAM,MAAM,gBAAa;;;;SAOvC,UAAU,MAAM,OAAO,QAAQ;;;;;;;;;SAgBzB,aAAa,MAAM,OAAO,QAAQ;;;;;SAgBlC,aAAa,mBAAmB,QAAQ;;;;;;SAexC,WAAW,MAAM,MAAM,cAAc;;;;;;SAoBrC,gBAAgB,QAAQ;;;;;;;SAgBxB,qBAAqB,QAAQ;;;;;;;;;;SAe7B,sBAAsB,QAAQ"}

package/esm/otp/index.d.mts

@@ -1 +1,2 @@
-import { requestOtp, verifyOtp } from "./otp.mjs";
+import { requestOtp, verifyOtp } from "./otp.mjs";
+export { requestOtp, verifyOtp };

package/esm/otp/index.mjs

@@ -1,3 +1,3 @@
 import { requestOtp, verifyOtp } from "./otp.mjs";
 
-export {  };
+export { requestOtp, verifyOtp };

package/esm/otp/otp.d.mts

@@ -1,7 +1,6 @@
 import { Auth } from "../models/auth.model.mjs";
 import { DeviceInfo, LoginResult } from "../contracts/types.mjs";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/otp/otp.d.ts
 /**
  * Send a 6-digit login code to the account whose `auth.otp.phoneField`
@@ -17,7 +16,7 @@ import { ChildModel } from "@warlock.js/cascade";
  * @throws AuthProviderSdkMissingError when `@warlock.js/notifications` is not
  *   installed and no `auth.otp.send` is configured.
  */
-declare function requestOtp<T extends Auth>(Model: ChildModel<T>, phone: string, options?: {
+export declare function requestOtp<T extends Auth>(Model: ChildModel<T>, phone: string, options?: {
   channel?: string;
 }): Promise<void>;
 /**
@@ -32,7 +31,6 @@ declare function requestOtp<T extends Auth>(Model: ChildModel<T>, phone: string,
  * @throws InvalidOneTimeTokenError (400, EC008) — the same for an unknown
  *   phone, a wrong, expired, used or exhausted code.
  */
-declare function verifyOtp<T extends Auth>(Model: ChildModel<T>, phone: string, code: string, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+export declare function verifyOtp<T extends Auth>(Model: ChildModel<T>, phone: string, code: string, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
 //#endregion
-export { requestOtp, verifyOtp };
 //# sourceMappingURL=otp.d.mts.map

package/esm/otp/otp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"otp.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/otp/otp.ts"],"mappings":";;;;;;;AAuFA;;;;;;;;;;;;iBAAsB,UAAA,WAAqB,IAAA,EACzC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,KAAA,UACA,OAAA;EAAW,OAAA;AAAA,IACV,OAAA;;;;;AAAO;AAkCV;;;;;;;iBAAsB,SAAA,WAAoB,IAAA,EACxC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,KAAA,UACA,IAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA"}
+{"version":3,"file":"otp.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/otp/otp.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAuFsB,WAAW,UAAU,MACzC,OAAO,WAAW,IAClB,eACA;EAAW;IACV;;;;;;;;;;;;;wBAkCmB,UAAU,UAAU,MACxC,OAAO,WAAW,IAClB,eACA,cACA,aAAa,aACZ,QAAQ,YAAY"}

package/esm/otp/otp.mjs

@@ -19,7 +19,8 @@ function invalidCode() {
 * value unique.
 */
 function macCode(user, salt, code) {
-	return createHmac("sha256", createHmac("sha256", authConfig.accessToken.secret()).update("@warlock.js/auth:otp").digest()).update(`${salt}:${user.userType}:${user.id}:${code}`).digest("base64url");
+	const key = createHmac("sha256", authConfig.accessToken.secret()).update("@warlock.js/auth:otp").digest();
+	return createHmac("sha256", key).update(`${salt}:${user.userType}:${user.id}:${code}`).digest("base64url");
 }
 /** Stored form: `<salt>.<mac>` — 16 + 1 + 43 chars, inside the 64-char `token_hash` column. */
 function storedCodeHash(user, code) {