@warlock.js/auth 5.30.0 → 5.32.0

package/esm/providers/provider-state-cookie.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"provider-state-cookie.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/providers/provider-state-cookie.ts"],"sourcesContent":["import type { Request, Response } from \"@warlock.js/core\";\nimport { createHmac, randomBytes } from \"node:crypto\";\nimport type { ProviderAuthorizationState } from \"../contracts/providers\";\nimport { authConfig } from \"../services/auth-config\";\nimport { safeEqual } from \"../utils/safe-equal\";\n\n/** Cookie carrying a redirect login's state from the start to the callback. */\nexport const PROVIDER_STATE_COOKIE = \"auth_provider_state\";\n\n/** How long a started provider login stays completable. */\nconst PROVIDER_STATE_TTL_SECONDS = 600;\n\n/** What the signed cookie holds. */\nexport type StoredProviderState = ProviderAuthorizationState & {\n  provider: string;\n  expiresAt: number;\n  callbackMode: \"query\" | \"form_post\";\n};\n\n/** 32 random bytes, base64url — used for `state`, `nonce` and the PKCE verifier. */\nexport function randomUrlSafe(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * HMAC over the payload with a key DERIVED from the access-token secret, so\n * the state cookie never shares a MAC key with the JWTs themselves.\n */\nfunction sign(payload: string): string {\n  const key = createHmac(\"sha256\", authConfig.accessToken.secret())\n    .update(\"@warlock.js/auth:provider-state\")\n    .digest();\n\n  return createHmac(\"sha256\", key).update(payload).digest(\"base64url\");\n}\n\n/**\n * Write the signed, 10-minute state cookie for a provider login. `HttpOnly`\n * comes from the `response.cookie()` secure defaults. `callbackMode` picks\n * the `SameSite`/`Secure` pair: `\"query\"` (default) keeps the framework's\n * `SameSite=Lax`, which still rides a top-level GET redirect back to the app;\n * `\"form_post\"` (Apple) overrides to `SameSite=None; Secure`, since a browser\n * drops a `Lax` cookie on the provider's cross-site POST callback. Either\n * way, the signed `state`/`nonce`/PKCE values — not the cookie's SameSite\n * attribute — are what actually defend against CSRF here.\n */\nexport function writeProviderState(\n  response: Response,\n  provider: string,\n  state: ProviderAuthorizationState,\n  callbackMode: \"query\" | \"form_post\" = \"query\",\n): void {\n  const stored: StoredProviderState = {\n    ...state,\n    provider,\n    expiresAt: Date.now() + PROVIDER_STATE_TTL_SECONDS * 1000,\n    callbackMode,\n  };\n  const payload = Buffer.from(JSON.stringify(stored)).toString(\"base64url\");\n\n  response.cookie(PROVIDER_STATE_COOKIE, `${payload}.${sign(payload)}`, {\n    raw: true,\n    path: \"/\",\n    maxAge: PROVIDER_STATE_TTL_SECONDS,\n    ...(callbackMode === \"form_post\" ? { sameSite: \"none\", secure: true } : {}),\n  });\n}\n\n/**\n * Read AND clear the state cookie, so a started login completes at most once.\n * Resolves `undefined` for an absent, forged (bad MAC), malformed or expired\n * cookie. The clearing `Set-Cookie` repeats whatever `SameSite`/`Secure` pair\n * the cookie was WRITTEN with (recovered from the decoded payload itself, so\n * this needs no mode passed in) — a browser only honours a clearing cookie\n * when it matches the original's attributes, and for a `form_post` (Apple)\n * cookie that means `SameSite=None; Secure` too, or the original survives.\n */\nexport function takeProviderState(\n  request: Request,\n  response: Response,\n): StoredProviderState | undefined {\n  const raw: unknown = request.cookie(PROVIDER_STATE_COOKIE);\n\n  let stored: Partial<StoredProviderState> | undefined;\n\n  if (typeof raw === \"string\") {\n    const [payload, signature, ...rest] = raw.split(\".\");\n\n    if (payload && signature && rest.length === 0 && safeEqual(signature, sign(payload))) {\n      try {\n        stored = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\"));\n      } catch {\n        stored = undefined;\n      }\n    }\n  }\n\n  response.clearCookie(PROVIDER_STATE_COOKIE, {\n    path: \"/\",\n    ...(stored?.callbackMode === \"form_post\" ? { sameSite: \"none\", secure: true } : {}),\n  });\n\n  if (\n    typeof stored?.state !== \"string\" ||\n    typeof stored.nonce !== \"string\" ||\n    typeof stored.codeVerifier !== \"string\" ||\n    typeof stored.provider !== \"string\" ||\n    typeof stored.expiresAt !== \"number\" ||\n    stored.expiresAt <= Date.now()\n  ) {\n    return undefined;\n  }\n\n  return stored as StoredProviderState;\n}\n"],"mappings":";;;;;;AAOA,MAAa,wBAAwB;;AAGrC,MAAM,6BAA6B;;AAUnC,SAAgB,gBAAwB;CACtC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;;;;;AAMA,SAAS,KAAK,SAAyB;CAKrC,OAAO,WAAW,UAJN,WAAW,UAAU,WAAW,YAAY,OAAO,CAAC,CAAC,CAC9D,OAAO,iCAAiC,CAAC,CACzC,OAE2B,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,WAAW;AACrE;;;;;;;;;;;AAYA,SAAgB,mBACd,UACA,UACA,OACA,eAAsC,SAChC;CACN,MAAM,SAA8B;EAClC,GAAG;EACH;EACA,WAAW,KAAK,IAAI,IAAI,6BAA6B;EACrD;CACF;CACA,MAAM,UAAU,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,WAAW;CAExE,SAAS,OAAO,uBAAuB,GAAG,QAAQ,GAAG,KAAK,OAAO,KAAK;EACpE,KAAK;EACL,MAAM;EACN,QAAQ;EACR,GAAI,iBAAiB,cAAc;GAAE,UAAU;GAAQ,QAAQ;EAAK,IAAI,CAAC;CAC3E,CAAC;AACH;;;;;;;;;;AAWA,SAAgB,kBACd,SACA,UACiC;CACjC,MAAM,MAAe,QAAQ,OAAO,qBAAqB;CAEzD,IAAI;CAEJ,IAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,CAAC,SAAS,WAAW,GAAG,QAAQ,IAAI,MAAM,GAAG;EAEnD,IAAI,WAAW,aAAa,KAAK,WAAW,KAAK,UAAU,WAAW,KAAK,OAAO,CAAC,GACjF,IAAI;GACF,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACxE,QAAQ;GACN,SAAS;EACX;CAEJ;CAEA,SAAS,YAAY,uBAAuB;EAC1C,MAAM;EACN,GAAI,QAAQ,iBAAiB,cAAc;GAAE,UAAU;GAAQ,QAAQ;EAAK,IAAI,CAAC;CACnF,CAAC;CAED,IACE,OAAO,QAAQ,UAAU,YACzB,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,cAAc,YAC5B,OAAO,aAAa,KAAK,IAAI,GAE7B;CAGF,OAAO;AACT"}
+{"version":3,"file":"provider-state-cookie.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/providers/provider-state-cookie.ts"],"sourcesContent":["import type { Request, Response } from \"@warlock.js/core\";\nimport { createHmac, randomBytes } from \"node:crypto\";\nimport type { ProviderAuthorizationState } from \"../contracts/providers\";\nimport { authConfig } from \"../services/auth-config\";\nimport { safeEqual } from \"../utils/safe-equal\";\n\n/** Cookie carrying a redirect login's state from the start to the callback. */\nexport const PROVIDER_STATE_COOKIE = \"auth_provider_state\";\n\n/** How long a started provider login stays completable. */\nconst PROVIDER_STATE_TTL_SECONDS = 600;\n\n/** What the signed cookie holds. */\nexport type StoredProviderState = ProviderAuthorizationState & {\n  provider: string;\n  expiresAt: number;\n  callbackMode: \"query\" | \"form_post\";\n};\n\n/** 32 random bytes, base64url — used for `state`, `nonce` and the PKCE verifier. */\nexport function randomUrlSafe(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/**\n * HMAC over the payload with a key DERIVED from the access-token secret, so\n * the state cookie never shares a MAC key with the JWTs themselves.\n */\nfunction sign(payload: string): string {\n  const key = createHmac(\"sha256\", authConfig.accessToken.secret())\n    .update(\"@warlock.js/auth:provider-state\")\n    .digest();\n\n  return createHmac(\"sha256\", key).update(payload).digest(\"base64url\");\n}\n\n/**\n * Write the signed, 10-minute state cookie for a provider login. `HttpOnly`\n * comes from the `response.cookie()` secure defaults. `callbackMode` picks\n * the `SameSite`/`Secure` pair: `\"query\"` (default) keeps the framework's\n * `SameSite=Lax`, which still rides a top-level GET redirect back to the app;\n * `\"form_post\"` (Apple) overrides to `SameSite=None; Secure`, since a browser\n * drops a `Lax` cookie on the provider's cross-site POST callback. Either\n * way, the signed `state`/`nonce`/PKCE values — not the cookie's SameSite\n * attribute — are what actually defend against CSRF here.\n */\nexport function writeProviderState(\n  response: Response,\n  provider: string,\n  state: ProviderAuthorizationState,\n  callbackMode: \"query\" | \"form_post\" = \"query\",\n): void {\n  const stored: StoredProviderState = {\n    ...state,\n    provider,\n    expiresAt: Date.now() + PROVIDER_STATE_TTL_SECONDS * 1000,\n    callbackMode,\n  };\n  const payload = Buffer.from(JSON.stringify(stored)).toString(\"base64url\");\n\n  response.cookie(PROVIDER_STATE_COOKIE, `${payload}.${sign(payload)}`, {\n    raw: true,\n    path: \"/\",\n    maxAge: PROVIDER_STATE_TTL_SECONDS,\n    ...(callbackMode === \"form_post\" ? { sameSite: \"none\", secure: true } : {}),\n  });\n}\n\n/**\n * Read AND clear the state cookie, so a started login completes at most once.\n * Resolves `undefined` for an absent, forged (bad MAC), malformed or expired\n * cookie. The clearing `Set-Cookie` repeats whatever `SameSite`/`Secure` pair\n * the cookie was WRITTEN with (recovered from the decoded payload itself, so\n * this needs no mode passed in) — a browser only honours a clearing cookie\n * when it matches the original's attributes, and for a `form_post` (Apple)\n * cookie that means `SameSite=None; Secure` too, or the original survives.\n */\nexport function takeProviderState(\n  request: Request,\n  response: Response,\n): StoredProviderState | undefined {\n  const raw: unknown = request.cookie(PROVIDER_STATE_COOKIE);\n\n  let stored: Partial<StoredProviderState> | undefined;\n\n  if (typeof raw === \"string\") {\n    const [payload, signature, ...rest] = raw.split(\".\");\n\n    if (payload && signature && rest.length === 0 && safeEqual(signature, sign(payload))) {\n      try {\n        stored = JSON.parse(Buffer.from(payload, \"base64url\").toString(\"utf8\"));\n      } catch {\n        stored = undefined;\n      }\n    }\n  }\n\n  response.clearCookie(PROVIDER_STATE_COOKIE, {\n    path: \"/\",\n    ...(stored?.callbackMode === \"form_post\" ? { sameSite: \"none\", secure: true } : {}),\n  });\n\n  if (\n    typeof stored?.state !== \"string\" ||\n    typeof stored.nonce !== \"string\" ||\n    typeof stored.codeVerifier !== \"string\" ||\n    typeof stored.provider !== \"string\" ||\n    typeof stored.expiresAt !== \"number\" ||\n    stored.expiresAt <= Date.now()\n  ) {\n    return undefined;\n  }\n\n  return stored as StoredProviderState;\n}\n"],"mappings":";;;;;;AAOA,MAAa,wBAAwB;;AAGrC,MAAM,6BAA6B;;AAUnC,SAAgB,gBAAwB;CACtC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;;;;;AAMA,SAAS,KAAK,SAAyB;CACrC,MAAM,MAAM,WAAW,UAAU,WAAW,YAAY,OAAO,CAAC,CAAC,CAC9D,OAAO,iCAAiC,CAAC,CACzC,OAAO;CAEV,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,WAAW;AACrE;;;;;;;;;;;AAYA,SAAgB,mBACd,UACA,UACA,OACA,eAAsC,SAChC;CACN,MAAM,SAA8B;EAClC,GAAG;EACH;EACA,WAAW,KAAK,IAAI,IAAI,6BAA6B;EACrD;CACF;CACA,MAAM,UAAU,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,WAAW;CAExE,SAAS,OAAO,uBAAuB,GAAG,QAAQ,GAAG,KAAK,OAAO,KAAK;EACpE,KAAK;EACL,MAAM;EACN,QAAQ;EACR,GAAI,iBAAiB,cAAc;GAAE,UAAU;GAAQ,QAAQ;EAAK,IAAI,CAAC;CAC3E,CAAC;AACH;;;;;;;;;;AAWA,SAAgB,kBACd,SACA,UACiC;CACjC,MAAM,MAAe,QAAQ,OAAO,qBAAqB;CAEzD,IAAI;CAEJ,IAAI,OAAO,QAAQ,UAAU;EAC3B,MAAM,CAAC,SAAS,WAAW,GAAG,QAAQ,IAAI,MAAM,GAAG;EAEnD,IAAI,WAAW,aAAa,KAAK,WAAW,KAAK,UAAU,WAAW,KAAK,OAAO,CAAC,GACjF,IAAI;GACF,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACxE,QAAQ;GACN,SAAS;EACX;CAEJ;CAEA,SAAS,YAAY,uBAAuB;EAC1C,MAAM;EACN,GAAI,QAAQ,iBAAiB,cAAc;GAAE,UAAU;GAAQ,QAAQ;EAAK,IAAI,CAAC;CACnF,CAAC;CAED,IACE,OAAO,QAAQ,UAAU,YACzB,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,iBAAiB,YAC/B,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,cAAc,YAC5B,OAAO,aAAa,KAAK,IAAI,GAE7B;CAGF,OAAO;AACT"}

package/esm/providers/x-provider.d.mts

@@ -1,5 +1,4 @@
 import { AuthProvider, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, XProviderConfig } from "../contracts/providers.mjs";
-
 //#region ../../packages/auth/src/providers/x-provider.d.ts
 /**
  * X (Twitter) sign-in: OAuth 2.0 authorization code flow with PKCE (S256). X
@@ -15,15 +14,12 @@ import { AuthProvider, ProviderAuthorizationState, ProviderCallbackParams, Provi
  * rather than invented, and `resolveProviderUser` rejects it the same way it
  * rejects any other missing email.
  */
-declare class XProvider implements AuthProvider {
+export declare class XProvider implements AuthProvider {
   private readonly settings;
   readonly name = "x";
   constructor(settings: XProviderConfig);
   authorizationUrl(state: ProviderAuthorizationState): string;
-  handleCallback({
-    query,
-    expected
-  }: ProviderCallbackParams): Promise<ProviderProfile>;
+  handleCallback({ query, expected }: ProviderCallbackParams): Promise<ProviderProfile>;
   /** Basic-auth credential for the confidential-client token request. */
   private basicAuth;
   /** Redeem the authorization code (with the PKCE verifier) for an access token. */
@@ -31,5 +27,4 @@ declare class XProvider implements AuthProvider {
   private fetchUser;
 }
 //#endregion
-export { XProvider };
 //# sourceMappingURL=x-provider.d.mts.map

package/esm/providers/x-provider.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"x-provider.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/providers/x-provider.ts"],"mappings":";;;;;AAoCA;;;;;;;;;;;;cAAa,SAAA,YAAqB,YAAA;EAAA,iBAGI,QAAA;EAAA,SAFpB,IAAA;cAEoB,QAAA,EAAU,eAAA;EAEvC,gBAAA,CAAiB,KAAA,EAAO,0BAAA;EAclB,cAAA;IACX,KAAA;IACA;EAAA,GACC,sBAAA,GAAyB,OAAA,CAAQ,eAAA;EAnBA;EAAA,QA8C5B,SAAA;EA5CuB;EAAA,QAmDjB,YAAA;EAAA,QAuCA,SAAA;AAAA"}
+{"version":3,"file":"x-provider.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/providers/x-provider.ts"],"mappings":";;;;;;;;;;;;;;;;qBAoCa,qBAAqB;mBAGI;WAFpB;EAEhB,YAAoC,UAAU;EAEvC,iBAAiB,OAAO;EAclB,iBACX,OACA,YACC,yBAAyB,QAAQ;;UA2B5B;;UAOM;UAuCA"}

package/esm/services/auth-events.d.mts

@@ -1,13 +1,13 @@
 import { Auth } from "../models/auth.model.mjs";
+import "../models/refresh-token/index.mjs";
 import { DeviceInfo, TokenPair } from "../contracts/types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { EventSubscription } from "@mongez/events";
-
 //#region ../../packages/auth/src/services/auth-events.d.ts
 /**
  * Auth event payload types
  */
-type AuthEventPayloads = {
+export type AuthEventPayloads = {
   "login.success": [user: Auth, tokenPair: TokenPair, deviceInfo?: DeviceInfo];
   "login.failed": [credentials: {
     email?: string;
@@ -35,11 +35,11 @@ type AuthEventPayloads = {
 /**
  * Auth event names
  */
-type AuthEventName = keyof AuthEventPayloads;
+export type AuthEventName = keyof AuthEventPayloads;
 /**
  * Callback type for a specific event
  */
-type AuthEventCallback<T extends AuthEventName> = (...args: AuthEventPayloads[T]) => void | Promise<void>;
+export type AuthEventCallback<T extends AuthEventName> = (...args: AuthEventPayloads[T]) => void | Promise<void>;
 /**
  * Type-safe auth events manager
  *
@@ -58,7 +58,7 @@ type AuthEventCallback<T extends AuthEventName> = (...args: AuthEventPayloads[T]
  * authEvents.emit("login.success", user, tokenPair, deviceInfo);
  * ```
  */
-declare const authEvents: {
+export declare const authEvents: {
   /**
    * Subscribe to an auth event
    */
@@ -85,5 +85,4 @@ declare const authEvents: {
   off(event?: AuthEventName): void;
 };
 //#endregion
-export { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents };
 //# sourceMappingURL=auth-events.d.mts.map

package/esm/services/auth-events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;KASY,iBAAA;EAEV,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,UAAA,GAAa,UAAA;EACjE,cAAA,GAAiB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA,GAAqB,MAAA;EACrE,eAAA,GAAkB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA;EAGjD,MAAA,GAAS,IAAA,EAAM,IAAA;EACf,YAAA,GAAe,IAAA,EAAM,IAAA;EACrB,iBAAA,GAAoB,IAAA,EAAM,IAAA;EAG1B,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA;EACzC,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,SAAA,EAAW,eAAA,EAAiB,YAAA;EAC1E,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,YAAA;EACrC,eAAA,GAAkB,KAAA,EAAO,YAAA;EACzB,qBAAA,GAAwB,QAAA,UAAkB,MAAA,EAAQ,YAAA;EAGlD,kBAAA,GAAqB,IAAA,EAAM,IAAA;EAC3B,yBAAA,GAA4B,IAAA,EAAM,IAAA,EAAM,UAAA;EACxC,gBAAA,GAAmB,IAAA,EAAM,IAAA;EAGzB,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA,EAAc,UAAA,GAAa,UAAA;EACzE,mBAAA,GAAsB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA;EAGhD,mBAAA,GAAsB,YAAA;AAAA;;;;KAMZ,aAAA,SAAsB,iBAAiB;;;;KAKvC,iBAAA,WAA4B,aAAA,QACnC,IAAA,EAAM,iBAAA,CAAkB,CAAA,aACjB,OAAA;;;;;;;;;;;;;;;;;;;cAyBC,UAAA;EAzDe;;;eA6Db,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EA1DzC;;;sBAiEV,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EAhEpD;;;iBAuEX,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAvEO;;;oBAuFxD,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAtFxC;;;;EACL;;;cAmGb,aAAA;AAAA"}
+{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;YASY;EAEV,kBAAkB,MAAM,MAAM,WAAW,WAAW,aAAa;EACjE,iBAAiB;IAAe;IAAgB;KAAqB;EACrE,kBAAkB;IAAe;IAAgB;;EAGjD,SAAS,MAAM;EACf,eAAe,MAAM;EACrB,oBAAoB,MAAM;EAG1B,kBAAkB,MAAM,MAAM,WAAW;EACzC,oBAAoB,MAAM,MAAM,cAAc,WAAW,iBAAiB;EAC1E,kBAAkB,MAAM,MAAM,OAAO;EACrC,kBAAkB,OAAO;EACzB,wBAAwB,kBAAkB,QAAQ;EAGlD,qBAAqB,MAAM;EAC3B,4BAA4B,MAAM,MAAM;EACxC,mBAAmB,MAAM;EAGzB,oBAAoB,MAAM,MAAM,cAAc,cAAc,aAAa;EACzE,sBAAsB,MAAM,MAAM,cAAc;EAGhD,sBAAsB;;;;;YAMZ,sBAAsB;;;;YAKtB,kBAAkB,UAAU,qBACnC,MAAM,kBAAkB,cACjB;;;;;;;;;;;;;;;;;;;qBAyBC;;;;EAIX,GAAG,UAAU,eAAa,OAAS,GAAC,UAAY,kBAAkB,KAAK;;;;EAOvE,UAAU,UAAU,eAAa,OAAS,GAAC,UAAY,kBAAkB,KAAK;;;;EAO9E,KAAK,UAAU,eAAa,OAAS,MAAC,MAAW,kBAAkB;;;;EAgBnE,QAAQ,UAAU,eAAa,OAAS,MAAC,MAAW,kBAAkB;;;;EAOtE;;;;EAOA,IAAG,QAAS"}

package/esm/services/auth.service.d.mts

@@ -1,13 +1,14 @@
 import { Auth } from "../models/auth.model.mjs";
 import { AccessToken } from "../models/access-token/access-token.model.mjs";
+import "../models/access-token/index.mjs";
+import "../models/refresh-token/index.mjs";
 import { AccessTokenOutput, AuthCredentials, ClearAuthCookieOptions, DeviceInfo, LoginResult, SetAuthCookieOptions, TokenPair } from "../contracts/types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { Request, Response } from "@warlock.js/core";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/services/auth.service.d.ts
 /** Thrown when a request-scoped cookie Domain cannot be resolved safely. */
-declare class CookieDomainRequestRequiredError extends Error {
+export declare class CookieDomainRequestRequiredError extends Error {
   constructor(method: string);
 }
 declare class AuthService {
@@ -120,7 +121,7 @@ declare class AuthService {
    * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any
    * credential is looked at. Returns `null` on bad credentials.
    */
-  loginWithSessionCookies<T extends Auth>(request: Request, response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown }, Model: ChildModel<T>, credentials: AuthCredentials, deviceInfo?: DeviceInfo): Promise<LoginResult<T> | null>;
+  loginWithSessionCookies<T extends Auth>(request: Request, response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown; }, Model: ChildModel<T>, credentials: AuthCredentials, deviceInfo?: DeviceInfo): Promise<LoginResult<T> | null>;
   /** The one token-issuing tail every login method shares. */
   private finalizeLogin;
   /**
@@ -221,7 +222,7 @@ declare class AuthService {
    * const { user, tokens } = await authService.login(User, credentials);
    * authService.setAuthCookie(response, tokens.accessToken);
    */
-  setAuthCookie(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown }, token: string | AccessTokenOutput, options?: SetAuthCookieOptions): void;
+  setAuthCookie(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown; }, token: string | AccessTokenOutput, options?: SetAuthCookieOptions): void;
   /**
    * Clear the auth cookie {@link setAuthCookie} wrote. An explicit
    * app-controller call — pair it with {@link logout} after the token row is
@@ -232,7 +233,7 @@ declare class AuthService {
    * await authService.logout(user, accessToken, refreshToken);
    * authService.clearAuthCookie(response);
    */
-  clearAuthCookie(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown }, options?: ClearAuthCookieOptions, request?: Request): void;
+  clearAuthCookie(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown; }, options?: ClearAuthCookieOptions, request?: Request): void;
   /**
    * Write the access and refresh cookies of a browser session. Both are
    * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every
@@ -244,7 +245,7 @@ declare class AuthService {
    * const { tokens } = await authService.login(User, credentials);
    * authService.setSessionCookies(response, tokens);
    */
-  setSessionCookies(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown }, tokens: {
+  setSessionCookies(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown; }, tokens: {
     accessToken: AccessTokenOutput;
     refreshToken: AccessTokenOutput;
   }, request?: Request): void;
@@ -252,9 +253,9 @@ declare class AuthService {
    * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.
    * Pair it with {@link logout} after the token rows are revoked.
    */
-  clearSessionCookies(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown }, request?: Request): void;
+  clearSessionCookies(response: { [K in "cookie" | "clearCookie"]: (...args: Parameters<Response[K]>) => unknown; }, request?: Request): void;
 }
-declare const authService: AuthService;
+export declare const authService: AuthService;
 //#endregion
-export { CookieDomainRequestRequiredError, authService };
+export {};
 //# sourceMappingURL=auth.service.d.mts.map

package/esm/services/auth.service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth.service.ts"],"mappings":";;;;;;;;;cAoCa,gCAAA,SAAyC,KAAK;cACtC,MAAA;AAAA;AAAA,cAQf,WAAA;EATwC;;;;;;EAAA,YAgBhC,gBAAA;EAfqB;AAMlC;;EANkC,YAsBrB,iBAAA;EAcyB;;;EAAA,YAPzB,iBAAA;EAqDJ;;;EA9CD,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EAiIpC;EAxHK,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EAmLqB;;;;;EAzJtB,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EAiQgC;;;;;;EAAA,QAvNhC,qBAAA;EA6aL;;;;EA7YI,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAcG,cAAA;EA+ZL;;;EA1WI,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA6WhE;;;;;EA5VE,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA+WA;;;;;EArRE,qBAAA,CACX,kBAAA,UACA,gBAAA,UACA,OAAA;IAAW,SAAA;IAAoB,UAAA,GAAa,UAAA;IAAY,QAAA;EAAA,IACvD,OAAA,CAAQ,SAAA;EAmSI;;;;;EAAA,QApLD,mBAAA;EAAA,QAsBN,kBAAA;EAAA,QAMA,sBAAA;EAAA,QAWA,YAAA;EAAA,QAMA,sBAAA;EAAA,QAOM,sBAAA;EAiO8C;;;EA/L/C,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAgTvC;;;EAzSxB,YAAA,CAAa,QAAA,WAAmB,OAAA;EAoVJ;;;;EA5U5B,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAoZkE;;;;EApXhE,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA4YsD;;;;;;;;;EAzXhE,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA8a6C;;;;;;;EAjavD,uBAAA,WAAkC,IAAA,EAC7C,OAAA,EAAS,OAAA,EACT,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA5lBc;EAAA,QAsnBvB,aAAA;EAtnB8B;;;;;;;;;;EAipB/B,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAlmB5E;;;EA+nBW,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA9kB7C;;;EAqlBD,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EAnjBjC;;;EA0jBF,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA3iB9C;;;;;EAojBD,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EA/fyB;;;EA8hBtD,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA3gBnC;;;;;;EAolBF,oBAAA,IAAwB,OAAA;EAtfxB;;;;;;;;;;EA+gBA,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EA3UW;;;;;;;;EA2Vf,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EA5UM;;;EA8VK,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA7TvC;;;;;EAAA,QAsUL,qBAAA;EAAA,QAUA,eAAA;EA9UN;;;;;;;;;;;;;;;;;;;;;EAiXK,aAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EA7UyD;;;;;;;;;;EAsW7D,eAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAS,sBAAA,EACT,OAAA,GAAU,OAAA;EA3UE;;;;;;;;;;;EAmWP,iBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,MAAA;IAAU,WAAA,EAAa,iBAAA;IAAmB,YAAA,EAAc,iBAAA;EAAA,GACxD,OAAA,GAAU,OAAA;EAhS0B;;;;EA0T/B,mBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAU,OAAA;AAAA;AAAA,cAcD,WAAA,EAAW,WAAoB"}
+{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth.service.ts"],"mappings":";;;;;;;;;;qBAoCa,yCAAyC;EACpD,YAAmB;;cAQf;;;;;;;cAOQ;;;;cAOA;;;;cAOA;;;;EAOL,wBAAwB,MAAM,OAAO;;EAS/B,gBAAgB,MAAM,OAAO;UAI5B;UAMA;;;;;;EA0BD,oBACX,MAAM,MACN,UAAU,0BACT,QAAQ;UAMG;;;;;;;UA0CA;;;;;EAgCD,mBACX,MAAM,MACN,aAAa,aACZ,QAAQ;UAcG;;;;EAqDD,gBAAgB,MAAM,MAAM,aAAa,aAAa,QAAQ;;;;;;EAiB9D,cACX,4BACA,aAAa,aACZ,QAAQ;;;;;;EA0FE,sBACX,4BACA,0BACA;IAAW;IAAoB,aAAa;IAAY;MACvD,QAAQ;;;;;;UA+GG;UAsBN;UAMA;UAWA;UAMA;UAOM;;;;EAkCD,eAAe,uBAAuB,yBAAyB;;;;EAO/D,aAAa,mBAAmB;;;;;EAQhC,aAAa,UAAU,MAClC,OAAO,WAAW,IAClB,MAAM,kBACL,QAAQ;;;;;EAgCE,MAAM,UAAU,MAC3B,OAAO,WAAW,IAClB,aAAa,iBACb,aAAa,aACZ,QAAQ,YAAY;;;;;;;;;;EAmBV,cAAc,UAAU,MACnC,MAAM,GACN,aAAa,aACZ,QAAQ,YAAY;;;;;;;;EAaV,wBAAwB,UAAU,MAC7C,SAAS,SACT,aAAa,oCAAoC,MAAM,WAAW,SAAS,oBAC3E,OAAO,WAAW,IAClB,aAAa,iBACb,aAAa,aACZ,QAAQ,YAAY;;UA0BT;;;;;;;;;;;EA2BD,OAAO,MAAM,MAAM,sBAAsB,wBAAwB;;;;EA6BjE,kBAAkB,MAAM,MAAM,gBAAgB;;;;EAO9C,sBAAsB,MAAM,OAAO;;;;EAOnC,mBAAmB,MAAM,MAAM,gBAAgB;;;;;;EAS/C,gBAAgB,MAAM,OAAO;;;;EA+B7B,kBAAkB,mBAAmB;;;;;;;EAyErC,wBAAwB;;;;;;;;;;;EAyBxB,2BAA2B;IACtC,cAAc;IACd,eAAe;;;;;;;;;;EAgBJ,4BAA4B;IACvC;IACA;;;;;EAkBW,kBAAkB,MAAM,OAAO,QAAQ;;;;;;UAS5C;UAUA;;;;;;;;;;;;;;;;;;;;;;EAmCD,cACL,aAAa,oCAAoC,MAAM,WAAW,SAAS,oBAC3E,gBAAgB,mBAChB,UAAS;;;;;;;;;;;EAyBJ,gBACL,aAAa,oCAAoC,MAAM,WAAW,SAAS,oBAC3E,UAAS,wBACT,UAAU;;;;;;;;;;;;EAwBL,kBACL,aAAa,oCAAoC,MAAM,WAAW,SAAS,oBAC3E;IAAU,aAAa;IAAmB,cAAc;KACxD,UAAU;;;;;EA0BL,oBACL,aAAa,oCAAoC,MAAM,WAAW,SAAS,oBAC3E,UAAU;;qBAcD,aAAW"}

package/esm/services/current-user.d.mts

@@ -1,5 +1,4 @@
 import { Auth } from "../models/auth.model.mjs";
-
 //#region ../../packages/auth/src/services/current-user.d.ts
 /**
  * Typed accessor over the request-scoped current user, for callers that want
@@ -15,7 +14,6 @@ import { Auth } from "../models/auth.model.mjs";
  * @example
  * const user = currentUser<AdminUser>();
  */
-declare function currentUser<UserType extends Auth = Auth>(): UserType | undefined;
+export declare function currentUser<UserType extends Auth = Auth>(): UserType | undefined;
 //#endregion
-export { currentUser };
 //# sourceMappingURL=current-user.d.mts.map

package/esm/services/current-user.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"current-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/current-user.ts"],"mappings":";;;;;AAiBA;;;;;;;;;;;;iBAAgB,WAAA,kBAA6B,IAAA,GAAO,IAAA,KAAS,QAAA"}
+{"version":3,"file":"current-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/current-user.ts"],"mappings":";;;;;;;;;;;;;;;;wBAiBgB,YAAY,iBAAiB,OAAO,SAAS"}

package/esm/services/email-verification.d.mts

@@ -1,11 +1,10 @@
 import { Auth } from "../models/auth.model.mjs";
-
 //#region ../../packages/auth/src/services/email-verification.d.ts
 /**
  * Whether the user has verified their email — the configured
  * `auth.verification.field` (default `emailVerifiedAt`) holds a value.
  */
-declare function isEmailVerified(user: Pick<Auth, "get">): boolean;
+export declare function isEmailVerified(user: Pick<Auth, "get">): boolean;
 /**
  * Issue an email-verification token for the user and send it through the
  * verification notification (`auth.verification.notification`, else auth's
@@ -19,7 +18,7 @@ declare function isEmailVerified(user: Pick<Auth, "get">): boolean;
  * const user = await User.create(data);
  * await sendEmailVerification(user);
  */
-declare function sendEmailVerification(user: Auth): Promise<void>;
+export declare function sendEmailVerification(user: Auth): Promise<void>;
 /**
  * Consume a verification token and stamp the user's verified field with the
  * current date. Resolves to the verified user.
@@ -29,7 +28,6 @@ declare function sendEmailVerification(user: Auth): Promise<void>;
  * @throws Error when the save did not keep the field — the user schema must
  *   declare it (e.g. `emailVerifiedAt: v.date().optional()`).
  */
-declare function verifyEmail(token: string): Promise<Auth>;
+export declare function verifyEmail(token: string): Promise<Auth>;
 //#endregion
-export { isEmailVerified, sendEmailVerification, verifyEmail };
 //# sourceMappingURL=email-verification.d.mts.map

package/esm/services/email-verification.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/email-verification.ts"],"mappings":";;;;;AASA;;iBAAgB,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,IAAA;;;;;;AAAY;AAiBvD;;;;;;;iBAAsB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAO;AAAA;AAuBhE;;;;;;;;AAvBgE,iBAuB1C,WAAA,CAAY,KAAA,WAAgB,OAAO,CAAC,IAAA"}
+{"version":3,"file":"email-verification.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/email-verification.ts"],"mappings":";;;;;;wBASgB,gBAAgB,MAAM,KAAK;;;;;;;;;;;;;;wBAiBrB,sBAAsB,MAAM,OAAO;;;;;;;;;;wBAuBnC,YAAY,gBAAgB,QAAQ"}

package/esm/services/generate-jwt-secret.d.mts

@@ -1,5 +1,4 @@
 //#region ../../packages/auth/src/services/generate-jwt-secret.d.ts
-declare function generateJWTSecret(): Promise<void>;
+export declare function generateJWTSecret(): Promise<void>;
 //#endregion
-export { generateJWTSecret };
 //# sourceMappingURL=generate-jwt-secret.d.mts.map

package/esm/services/generate-jwt-secret.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-jwt-secret.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/generate-jwt-secret.ts"],"mappings":";iBAKsB,iBAAA,IAAiB,OAAA"}
+{"version":3,"file":"generate-jwt-secret.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/generate-jwt-secret.ts"],"mappings":";wBAKsB,qBAAiB"}

package/esm/services/index.d.mts

@@ -6,4 +6,5 @@ import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.
 import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";
 import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./one-time-tokens.mjs";
 import { requestPasswordReset, resetPassword } from "./password-reset.mjs";
-import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./resolve-request-user.mjs";
+import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./resolve-request-user.mjs";
+export { AuthEventCallback, AuthEventName, AuthEventPayloads, CookieDomainRequestRequiredError, IssuedOneTimeToken, RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, TokenType, TokenTypeError, authEvents, authService, consumeOneTimeToken, currentUser, generateJWTSecret, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, issueOneTimeToken, jwt, oneTimeTokenModel, readCredential, requestPasswordReset, resetPassword, resolveRequestUser, resolveRequestUserOutcome, sendEmailVerification, verifyEmail };

package/esm/services/index.mjs

@@ -8,4 +8,4 @@ import { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenM
 import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";
 import { requestPasswordReset, resetPassword } from "./password-reset.mjs";
 
-export {  };
+export { CookieDomainRequestRequiredError, TokenTypeError, authEvents, authService, consumeOneTimeToken, currentUser, generateJWTSecret, hashOneTimeToken, isEmailVerified, isInvalidCredentialError, issueOneTimeToken, jwt, oneTimeTokenModel, readCredential, requestPasswordReset, resetPassword, resolveRequestUser, resolveRequestUserOutcome, sendEmailVerification, verifyEmail };

package/esm/services/jwt.d.mts

@@ -1,6 +1,5 @@
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { SignerOptions, VerifierOptions } from "fast-jwt";
-
 //#region ../../packages/auth/src/services/jwt.d.ts
 /**
  * Token class. Stamped as the `tokenType` claim on every signed token and
@@ -10,13 +9,13 @@ import { SignerOptions, VerifierOptions } from "fast-jwt";
  * this claim existed carry no `tokenType` and remain accepted; a *mismatched*
  * type is always rejected.
  */
-type TokenType = "access" | "refresh";
+export type TokenType = "access" | "refresh";
 /**
  * Only coded credential failures become authentication misses. Plain errors,
  * including missing-secret configuration failures, propagate to the central
  * server-error path instead of reading as "everyone's token is bad".
  */
-declare function isInvalidCredentialError(error: unknown): boolean;
+export declare function isInvalidCredentialError(error: unknown): boolean;
 /**
  * A `tokenType` claim that does not match what the caller expects. This IS a
  * bad credential (an access-token cookie can only hold a refresh token
@@ -26,20 +25,16 @@ declare function isInvalidCredentialError(error: unknown): boolean;
  * `code` mirrors how `fast-jwt`'s `TokenError` carries its own code, so a
  * caller can classify both through `isInvalidCredentialError` above.
  */
-declare class TokenTypeError extends Error {
+export declare class TokenTypeError extends Error {
   readonly code = AuthErrorCodes.InvalidTokenType;
   constructor(expected: TokenType, actual: string);
 }
-declare const jwt: {
+export declare const jwt: {
   /**
    * Generate a new JWT token for the user.
    * @param payload The payload to encode in the JWT token.
    */
-  generate(payload: any, {
-    key,
-    algorithm,
-    ...options
-  }?: SignerOptions & {
+  generate(payload: any, { key, algorithm, ...options }?: SignerOptions & {
     key?: string;
   }): Promise<string>;
   /**
@@ -47,37 +42,21 @@ declare const jwt: {
    * @param token The JWT token to verify.
    * @returns The decoded token payload if verification is successful.
    */
-  verify<T = unknown>(token: string, {
-    key,
-    algorithms,
-    requiredClaims,
-    ...options
-  }?: VerifierOptions & {
+  verify<T = unknown>(token: string, { key, algorithms, requiredClaims, ...options }?: VerifierOptions & {
     key?: string;
   }): Promise<T>;
   /**
    * Generate a new refresh token for the user.
    */
-  generateRefreshToken(payload: any, {
-    key,
-    expiresIn,
-    algorithm,
-    ...options
-  }?: SignerOptions & {
+  generateRefreshToken(payload: any, { key, expiresIn, algorithm, ...options }?: SignerOptions & {
     key?: string;
   }): Promise<string>;
   /**
    * Verify the given refresh token.
    */
-  verifyRefreshToken<T = unknown>(token: string, {
-    key,
-    algorithms,
-    requiredClaims,
-    ...options
-  }?: VerifierOptions & {
+  verifyRefreshToken<T = unknown>(token: string, { key, algorithms, requiredClaims, ...options }?: VerifierOptions & {
     key?: string;
   }): Promise<T>;
 };
 //#endregion
-export { TokenType, TokenTypeError, isInvalidCredentialError, jwt };
 //# sourceMappingURL=jwt.d.mts.map

package/esm/services/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/jwt.ts"],"mappings":";;;;;;AAoBA;;;;AAAqB;AAoCrB;KApCY,SAAA;;;AAoC2C;AAevD;;iBAfgB,wBAAA,CAAyB,KAAc;;;;;;;;;;cAe1C,cAAA,SAAuB,KAAA;EAAA,SACzB,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,QAAA,EAAU,SAAA,EAAW,MAAA;AAAA;AAAA,cA+CtB,GAAA;EA/CoC;AA+CjD;;;;IAMgB,GAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAKT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EAAA;;;;;sBAaW,KAAA;IACC,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;EAmBG;;;;IAAA,GAAA;IAAA,SAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAMT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EASY;;;kCADW,KAAA;IACX,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;AAAA"}
+{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/jwt.ts"],"mappings":";;;;;;;;;;;YAoBY;;;;;;wBAoCI,yBAAyB;;;;;;;;;;qBAe5B,uBAAuB;WACzB,OAAI,eAAA;EAEb,YAAY,UAAU,WAAW;;qBA+CtB;;;;;EAKL,SAAQ,gBACA,KAAA,cAAA,YAKT;IAAkB;MACpB;;;;;;EAaG,OAAO,aAAW,iBACT,KAAA,YAAA,mBAAA,YAMV;IAAoB;MACtB,QAAQ;;;;EAkBL,qBAAoB,gBACZ,KAAA,WAAA,cAAA,YAMT;IAAkB;MACpB;;;;EAQG,mBAAmB,aAAW,iBACrB,KAAA,YAAA,mBAAA,YAMV;IAAoB;MACtB,QAAQ"}

package/esm/services/jwt.mjs

@@ -17,7 +17,7 @@ const REFRESH_TOKEN_TYPE = "refresh";
 * `FAST_JWT_VERIFY_ERROR`, and `FAST_JWT_SIGN_ERROR` — describe a broken
 * server, not a broken token, and so does every unknown future code.
 */
-const INVALID_CREDENTIAL_ERROR_CODES = new Set([
+const INVALID_CREDENTIAL_ERROR_CODES = /* @__PURE__ */ new Set([
 	"FAST_JWT_MALFORMED",
 	"FAST_JWT_INVALID_SIGNATURE",
 	"FAST_JWT_MISSING_SIGNATURE",
@@ -89,7 +89,7 @@ const REQUIRED_CLAIMS = ["exp"];
 */
 function withRequiredClaims(callerClaims) {
 	if (!callerClaims?.length) return REQUIRED_CLAIMS;
-	return [...new Set([...callerClaims, ...REQUIRED_CLAIMS])];
+	return [.../* @__PURE__ */ new Set([...callerClaims, ...REQUIRED_CLAIMS])];
 }
 const jwt = {
 	/**

package/esm/services/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/jwt.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createSigner, createVerifier, type SignerOptions, type VerifierOptions } from \"fast-jwt\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport { authConfig } from \"./auth-config\";\n\nconst getSecretKey = () => authConfig.accessToken.secret();\nconst getAlgorithm = () => authConfig.accessToken.algorithm();\n\n// Refresh tokens may declare their own secret; when unset/empty we fall back to\n// the access-token secret (the documented optional behavior).\nconst getRefreshSecretKey = () => authConfig.refreshToken.secret() || getSecretKey();\n\n/**\n * Token class. Stamped as the `tokenType` claim on every signed token and\n * checked on verify so an access token can never be accepted where a refresh\n * token is expected (and vice versa) — even when both share the same secret\n * under the documented refresh-secret fallback. Legacy tokens minted before\n * this claim existed carry no `tokenType` and remain accepted; a *mismatched*\n * type is always rejected.\n */\nexport type TokenType = \"access\" | \"refresh\";\n\nconst ACCESS_TOKEN_TYPE: TokenType = \"access\";\nconst REFRESH_TOKEN_TYPE: TokenType = \"refresh\";\n\n/**\n * Error codes that mean \"the credential itself is bad\", as opposed to \"this\n * server could not check it\". This is an ALLOWLIST and must stay one. The codes\n * deliberately left out — `FAST_JWT_INVALID_KEY`, `FAST_JWT_MISSING_KEY`,\n * `FAST_JWT_KEY_FETCHING_ERROR`, `FAST_JWT_INVALID_OPTION`,\n * `FAST_JWT_VERIFY_ERROR`, and `FAST_JWT_SIGN_ERROR` — describe a broken\n * server, not a broken token, and so does every unknown future code.\n */\nconst INVALID_CREDENTIAL_ERROR_CODES = new Set<string>([\n  \"FAST_JWT_MALFORMED\",\n  \"FAST_JWT_INVALID_SIGNATURE\",\n  \"FAST_JWT_MISSING_SIGNATURE\",\n  \"FAST_JWT_INVALID_ALGORITHM\",\n  \"FAST_JWT_EXPIRED\",\n  \"FAST_JWT_INACTIVE\",\n  // How a token carrying no `exp` is rejected — `jwt.verify` forces `exp` into\n  // `requiredClaims`, so this code IS the missing-deadline guard firing.\n  \"FAST_JWT_MISSING_REQUIRED_CLAIM\",\n  \"FAST_JWT_INVALID_CLAIM_VALUE\",\n  \"FAST_JWT_INVALID_CLAIM_TYPE\",\n  \"FAST_JWT_INVALID_CRIT_HEADER\",\n  \"FAST_JWT_INVALID_TYPE\",\n  \"FAST_JWT_INVALID_PAYLOAD\",\n  AuthErrorCodes.InvalidTokenType,\n]);\n\n/**\n * Only coded credential failures become authentication misses. Plain errors,\n * including missing-secret configuration failures, propagate to the central\n * server-error path instead of reading as \"everyone's token is bad\".\n */\nexport function isInvalidCredentialError(error: unknown): boolean {\n  const code = (error as { code?: unknown } | null | undefined)?.code;\n\n  return typeof code === \"string\" && INVALID_CREDENTIAL_ERROR_CODES.has(code);\n}\n\n/**\n * A `tokenType` claim that does not match what the caller expects. This IS a\n * bad credential (an access-token cookie can only hold a refresh token\n * through an app bug) — but unlike `fast-jwt`'s own rejections it was\n * previously a plain `Error`, unclassifiable by a caller that wants to answer\n * 401 without string-matching a message that could reword on any release.\n * `code` mirrors how `fast-jwt`'s `TokenError` carries its own code, so a\n * caller can classify both through `isInvalidCredentialError` above.\n */\nexport class TokenTypeError extends Error {\n  readonly code = AuthErrorCodes.InvalidTokenType;\n\n  constructor(expected: TokenType, actual: string) {\n    super(`Invalid token type: expected \"${expected}\", received \"${actual}\".`);\n    this.name = \"TokenTypeError\";\n  }\n}\n\n/**\n * Reject the token when its `tokenType` claim is present and does not match the\n * expected class. Absent claim ⇒ legacy token, accepted (backward compatible).\n */\nfunction assertTokenType(decoded: unknown, expected: TokenType): void {\n  const actual = (decoded as { tokenType?: unknown } | null | undefined)?.tokenType;\n\n  if (typeof actual === \"string\" && actual !== expected) {\n    throw new TokenTypeError(expected, actual);\n  }\n}\n\n/**\n * Claims no token may be missing, whatever the caller asks for.\n *\n * A JWT with no `exp` is not \"a token with a long life\" — it is a credential\n * with *no* life, because a verifier with no deadline to check simply succeeds,\n * forever (measured against `fast-jwt@6.2.4`: a token with no `exp` verifies\n * unchanged at `clockTimestamp` + 100 years). Nothing in this package can mint\n * one as of 4.12.0, but tokens minted by an earlier version are already in the\n * wild, so the rejection lives on the *verify* side where it catches a token\n * from any version, including one signed by a service this package never ran.\n *\n * There is no legitimate source to preserve: an app that wants a token that\n * effectively never expires sets `expiresIn: NO_EXPIRATION` (`\"100y\"`), which\n * mints a real `exp` roughly a century out (measured: `ms(\"100y\")` ⇒\n * `3155760000000`, `exp - iat` ⇒ `3155760000` seconds). \"No deadline\" and \"a\n * distant deadline\" are different things, and only the second one is asked for.\n */\nconst REQUIRED_CLAIMS = [\"exp\"];\n\n/**\n * Union the caller's `requiredClaims` with the mandatory ones — a caller may\n * add requirements, never drop them.\n */\nfunction withRequiredClaims(callerClaims?: string[]): string[] {\n  if (!callerClaims?.length) return REQUIRED_CLAIMS;\n\n  return [...new Set([...callerClaims, ...REQUIRED_CLAIMS])];\n}\n\nexport const jwt = {\n  /**\n   * Generate a new JWT token for the user.\n   * @param payload The payload to encode in the JWT token.\n   */\n  async generate(\n    payload: any,\n    {\n      key = getSecretKey(),\n      algorithm = getAlgorithm(),\n      ...options\n    }: SignerOptions & { key?: string } = {},\n  ): Promise<string> {\n    // Create a signer function with predefined options\n    const sign = createSigner({ key, ...options, algorithm });\n\n    const token = await sign({ jti: randomUUID(), ...payload, tokenType: ACCESS_TOKEN_TYPE });\n    return token;\n  },\n\n  /**\n   * Verify the given token.\n   * @param token The JWT token to verify.\n   * @returns The decoded token payload if verification is successful.\n   */\n  async verify<T = unknown>(\n    token: string,\n    {\n      key = getSecretKey(),\n      algorithms = [getAlgorithm()],\n      requiredClaims,\n      ...options\n    }: VerifierOptions & { key?: string } = {},\n  ): Promise<T> {\n    const verify = createVerifier({\n      key,\n      ...options,\n      algorithms,\n      requiredClaims: withRequiredClaims(requiredClaims),\n    });\n\n    const decoded = await verify(token as string);\n\n    assertTokenType(decoded, ACCESS_TOKEN_TYPE);\n\n    return decoded;\n  },\n\n  /**\n   * Generate a new refresh token for the user.\n   */\n  async generateRefreshToken(\n    payload: any,\n    {\n      key = getRefreshSecretKey(),\n      expiresIn,\n      algorithm = getAlgorithm(),\n      ...options\n    }: SignerOptions & { key?: string } = {},\n  ): Promise<string> {\n    const sign = createSigner({ key, expiresIn, algorithm, ...options });\n    return sign({ jti: randomUUID(), ...payload, tokenType: REFRESH_TOKEN_TYPE });\n  },\n\n  /**\n   * Verify the given refresh token.\n   */\n  async verifyRefreshToken<T = unknown>(\n    token: string,\n    {\n      key = getRefreshSecretKey(),\n      algorithms = [getAlgorithm()],\n      requiredClaims,\n      ...options\n    }: VerifierOptions & { key?: string } = {},\n  ): Promise<T> {\n    const verify = createVerifier({\n      key,\n      algorithms,\n      ...options,\n      requiredClaims: withRequiredClaims(requiredClaims),\n    });\n\n    const decoded = await verify(token);\n\n    assertTokenType(decoded, REFRESH_TOKEN_TYPE);\n\n    return decoded;\n  },\n};\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB,WAAW,YAAY,OAAO;AACzD,MAAM,qBAAqB,WAAW,YAAY,UAAU;AAI5D,MAAM,4BAA4B,WAAW,aAAa,OAAO,KAAK,aAAa;AAYnF,MAAM,oBAA+B;AACrC,MAAM,qBAAgC;;;;;;;;;AAUtC,MAAM,iCAAiC,IAAI,IAAY;CACrD;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;;AAEF,CAAC;;;;;;AAOD,SAAgB,yBAAyB,OAAyB;CAChE,MAAM,OAAQ,OAAiD;CAE/D,OAAO,OAAO,SAAS,YAAY,+BAA+B,IAAI,IAAI;AAC5E;;;;;;;;;;AAWA,IAAa,iBAAb,cAAoC,MAAM;CAGxC,YAAY,UAAqB,QAAgB;EAC/C,MAAM,iCAAiC,SAAS,eAAe,OAAO,GAAG;;EACzE,KAAK,OAAO;CACd;AACF;;;;;AAMA,SAAS,gBAAgB,SAAkB,UAA2B;CACpE,MAAM,SAAU,SAAwD;CAExE,IAAI,OAAO,WAAW,YAAY,WAAW,UAC3C,MAAM,IAAI,eAAe,UAAU,MAAM;AAE7C;;;;;;;;;;;;;;;;;;AAmBA,MAAM,kBAAkB,CAAC,KAAK;;;;;AAM9B,SAAS,mBAAmB,cAAmC;CAC7D,IAAI,CAAC,cAAc,QAAQ,OAAO;CAElC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,cAAc,GAAG,eAAe,CAAC,CAAC;AAC3D;AAEA,MAAa,MAAM;;;;;CAKjB,MAAM,SACJ,SACA,EACE,MAAM,aAAa,GACnB,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAKjB,OAAO,MAHM,aAAa;GAAE;GAAK,GAAG;GAAS;EAAU,CAEhC,CAAC,CAAC;GAAE,KAAK,WAAW;GAAG,GAAG;GAAS,WAAW;EAAkB,CAAC;CAE1F;;;;;;CAOA,MAAM,OACJ,OACA,EACE,MAAM,aAAa,GACnB,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA,GAAG;GACH;GACA,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAe;EAE5C,gBAAgB,SAAS,iBAAiB;EAE1C,OAAO;CACT;;;;CAKA,MAAM,qBACJ,SACA,EACE,MAAM,oBAAoB,GAC1B,WACA,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAEjB,OADa,aAAa;GAAE;GAAK;GAAW;GAAW,GAAG;EAAQ,CACxD,CAAC,CAAC;GAAE,KAAK,WAAW;GAAG,GAAG;GAAS,WAAW;EAAmB,CAAC;CAC9E;;;;CAKA,MAAM,mBACJ,OACA,EACE,MAAM,oBAAoB,GAC1B,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA;GACA,GAAG;GACH,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAK;EAElC,gBAAgB,SAAS,kBAAkB;EAE3C,OAAO;CACT;AACF"}
+{"version":3,"file":"jwt.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/jwt.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createSigner, createVerifier, type SignerOptions, type VerifierOptions } from \"fast-jwt\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport { authConfig } from \"./auth-config\";\n\nconst getSecretKey = () => authConfig.accessToken.secret();\nconst getAlgorithm = () => authConfig.accessToken.algorithm();\n\n// Refresh tokens may declare their own secret; when unset/empty we fall back to\n// the access-token secret (the documented optional behavior).\nconst getRefreshSecretKey = () => authConfig.refreshToken.secret() || getSecretKey();\n\n/**\n * Token class. Stamped as the `tokenType` claim on every signed token and\n * checked on verify so an access token can never be accepted where a refresh\n * token is expected (and vice versa) — even when both share the same secret\n * under the documented refresh-secret fallback. Legacy tokens minted before\n * this claim existed carry no `tokenType` and remain accepted; a *mismatched*\n * type is always rejected.\n */\nexport type TokenType = \"access\" | \"refresh\";\n\nconst ACCESS_TOKEN_TYPE: TokenType = \"access\";\nconst REFRESH_TOKEN_TYPE: TokenType = \"refresh\";\n\n/**\n * Error codes that mean \"the credential itself is bad\", as opposed to \"this\n * server could not check it\". This is an ALLOWLIST and must stay one. The codes\n * deliberately left out — `FAST_JWT_INVALID_KEY`, `FAST_JWT_MISSING_KEY`,\n * `FAST_JWT_KEY_FETCHING_ERROR`, `FAST_JWT_INVALID_OPTION`,\n * `FAST_JWT_VERIFY_ERROR`, and `FAST_JWT_SIGN_ERROR` — describe a broken\n * server, not a broken token, and so does every unknown future code.\n */\nconst INVALID_CREDENTIAL_ERROR_CODES = new Set<string>([\n  \"FAST_JWT_MALFORMED\",\n  \"FAST_JWT_INVALID_SIGNATURE\",\n  \"FAST_JWT_MISSING_SIGNATURE\",\n  \"FAST_JWT_INVALID_ALGORITHM\",\n  \"FAST_JWT_EXPIRED\",\n  \"FAST_JWT_INACTIVE\",\n  // How a token carrying no `exp` is rejected — `jwt.verify` forces `exp` into\n  // `requiredClaims`, so this code IS the missing-deadline guard firing.\n  \"FAST_JWT_MISSING_REQUIRED_CLAIM\",\n  \"FAST_JWT_INVALID_CLAIM_VALUE\",\n  \"FAST_JWT_INVALID_CLAIM_TYPE\",\n  \"FAST_JWT_INVALID_CRIT_HEADER\",\n  \"FAST_JWT_INVALID_TYPE\",\n  \"FAST_JWT_INVALID_PAYLOAD\",\n  AuthErrorCodes.InvalidTokenType,\n]);\n\n/**\n * Only coded credential failures become authentication misses. Plain errors,\n * including missing-secret configuration failures, propagate to the central\n * server-error path instead of reading as \"everyone's token is bad\".\n */\nexport function isInvalidCredentialError(error: unknown): boolean {\n  const code = (error as { code?: unknown } | null | undefined)?.code;\n\n  return typeof code === \"string\" && INVALID_CREDENTIAL_ERROR_CODES.has(code);\n}\n\n/**\n * A `tokenType` claim that does not match what the caller expects. This IS a\n * bad credential (an access-token cookie can only hold a refresh token\n * through an app bug) — but unlike `fast-jwt`'s own rejections it was\n * previously a plain `Error`, unclassifiable by a caller that wants to answer\n * 401 without string-matching a message that could reword on any release.\n * `code` mirrors how `fast-jwt`'s `TokenError` carries its own code, so a\n * caller can classify both through `isInvalidCredentialError` above.\n */\nexport class TokenTypeError extends Error {\n  readonly code = AuthErrorCodes.InvalidTokenType;\n\n  constructor(expected: TokenType, actual: string) {\n    super(`Invalid token type: expected \"${expected}\", received \"${actual}\".`);\n    this.name = \"TokenTypeError\";\n  }\n}\n\n/**\n * Reject the token when its `tokenType` claim is present and does not match the\n * expected class. Absent claim ⇒ legacy token, accepted (backward compatible).\n */\nfunction assertTokenType(decoded: unknown, expected: TokenType): void {\n  const actual = (decoded as { tokenType?: unknown } | null | undefined)?.tokenType;\n\n  if (typeof actual === \"string\" && actual !== expected) {\n    throw new TokenTypeError(expected, actual);\n  }\n}\n\n/**\n * Claims no token may be missing, whatever the caller asks for.\n *\n * A JWT with no `exp` is not \"a token with a long life\" — it is a credential\n * with *no* life, because a verifier with no deadline to check simply succeeds,\n * forever (measured against `fast-jwt@6.2.4`: a token with no `exp` verifies\n * unchanged at `clockTimestamp` + 100 years). Nothing in this package can mint\n * one as of 4.12.0, but tokens minted by an earlier version are already in the\n * wild, so the rejection lives on the *verify* side where it catches a token\n * from any version, including one signed by a service this package never ran.\n *\n * There is no legitimate source to preserve: an app that wants a token that\n * effectively never expires sets `expiresIn: NO_EXPIRATION` (`\"100y\"`), which\n * mints a real `exp` roughly a century out (measured: `ms(\"100y\")` ⇒\n * `3155760000000`, `exp - iat` ⇒ `3155760000` seconds). \"No deadline\" and \"a\n * distant deadline\" are different things, and only the second one is asked for.\n */\nconst REQUIRED_CLAIMS = [\"exp\"];\n\n/**\n * Union the caller's `requiredClaims` with the mandatory ones — a caller may\n * add requirements, never drop them.\n */\nfunction withRequiredClaims(callerClaims?: string[]): string[] {\n  if (!callerClaims?.length) return REQUIRED_CLAIMS;\n\n  return [...new Set([...callerClaims, ...REQUIRED_CLAIMS])];\n}\n\nexport const jwt = {\n  /**\n   * Generate a new JWT token for the user.\n   * @param payload The payload to encode in the JWT token.\n   */\n  async generate(\n    payload: any,\n    {\n      key = getSecretKey(),\n      algorithm = getAlgorithm(),\n      ...options\n    }: SignerOptions & { key?: string } = {},\n  ): Promise<string> {\n    // Create a signer function with predefined options\n    const sign = createSigner({ key, ...options, algorithm });\n\n    const token = await sign({ jti: randomUUID(), ...payload, tokenType: ACCESS_TOKEN_TYPE });\n    return token;\n  },\n\n  /**\n   * Verify the given token.\n   * @param token The JWT token to verify.\n   * @returns The decoded token payload if verification is successful.\n   */\n  async verify<T = unknown>(\n    token: string,\n    {\n      key = getSecretKey(),\n      algorithms = [getAlgorithm()],\n      requiredClaims,\n      ...options\n    }: VerifierOptions & { key?: string } = {},\n  ): Promise<T> {\n    const verify = createVerifier({\n      key,\n      ...options,\n      algorithms,\n      requiredClaims: withRequiredClaims(requiredClaims),\n    });\n\n    const decoded = await verify(token as string);\n\n    assertTokenType(decoded, ACCESS_TOKEN_TYPE);\n\n    return decoded;\n  },\n\n  /**\n   * Generate a new refresh token for the user.\n   */\n  async generateRefreshToken(\n    payload: any,\n    {\n      key = getRefreshSecretKey(),\n      expiresIn,\n      algorithm = getAlgorithm(),\n      ...options\n    }: SignerOptions & { key?: string } = {},\n  ): Promise<string> {\n    const sign = createSigner({ key, expiresIn, algorithm, ...options });\n    return sign({ jti: randomUUID(), ...payload, tokenType: REFRESH_TOKEN_TYPE });\n  },\n\n  /**\n   * Verify the given refresh token.\n   */\n  async verifyRefreshToken<T = unknown>(\n    token: string,\n    {\n      key = getRefreshSecretKey(),\n      algorithms = [getAlgorithm()],\n      requiredClaims,\n      ...options\n    }: VerifierOptions & { key?: string } = {},\n  ): Promise<T> {\n    const verify = createVerifier({\n      key,\n      algorithms,\n      ...options,\n      requiredClaims: withRequiredClaims(requiredClaims),\n    });\n\n    const decoded = await verify(token);\n\n    assertTokenType(decoded, REFRESH_TOKEN_TYPE);\n\n    return decoded;\n  },\n};\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB,WAAW,YAAY,OAAO;AACzD,MAAM,qBAAqB,WAAW,YAAY,UAAU;AAI5D,MAAM,4BAA4B,WAAW,aAAa,OAAO,KAAK,aAAa;AAYnF,MAAM,oBAA+B;AACrC,MAAM,qBAAgC;;;;;;;;;AAUtC,MAAM,iDAAiC,IAAI,IAAY;CACrD;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CACA;;AAEF,CAAC;;;;;;AAOD,SAAgB,yBAAyB,OAAyB;CAChE,MAAM,OAAQ,OAAiD;CAE/D,OAAO,OAAO,SAAS,YAAY,+BAA+B,IAAI,IAAI;AAC5E;;;;;;;;;;AAWA,IAAa,iBAAb,cAAoC,MAAM;CAGxC,YAAY,UAAqB,QAAgB;EAC/C,MAAM,iCAAiC,SAAS,eAAe,OAAO,GAAG;;EACzE,KAAK,OAAO;CACd;AACF;;;;;AAMA,SAAS,gBAAgB,SAAkB,UAA2B;CACpE,MAAM,SAAU,SAAwD;CAExE,IAAI,OAAO,WAAW,YAAY,WAAW,UAC3C,MAAM,IAAI,eAAe,UAAU,MAAM;AAE7C;;;;;;;;;;;;;;;;;;AAmBA,MAAM,kBAAkB,CAAC,KAAK;;;;;AAM9B,SAAS,mBAAmB,cAAmC;CAC7D,IAAI,CAAC,cAAc,QAAQ,OAAO;CAElC,OAAO,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,cAAc,GAAG,eAAe,CAAC,CAAC;AAC3D;AAEA,MAAa,MAAM;;;;;CAKjB,MAAM,SACJ,SACA,EACE,MAAM,aAAa,GACnB,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAKjB,OAAO,MAHM,aAAa;GAAE;GAAK,GAAG;GAAS;EAAU,CAEhC,CAAC,CAAC;GAAE,KAAK,WAAW;GAAG,GAAG;GAAS,WAAW;EAAkB,CAAC;CAE1F;;;;;;CAOA,MAAM,OACJ,OACA,EACE,MAAM,aAAa,GACnB,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA,GAAG;GACH;GACA,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAe;EAE5C,gBAAgB,SAAS,iBAAiB;EAE1C,OAAO;CACT;;;;CAKA,MAAM,qBACJ,SACA,EACE,MAAM,oBAAoB,GAC1B,WACA,YAAY,aAAa,GACzB,GAAG,YACiC,CAAC,GACtB;EAEjB,OADa,aAAa;GAAE;GAAK;GAAW;GAAW,GAAG;EAAQ,CACxD,CAAC,CAAC;GAAE,KAAK,WAAW;GAAG,GAAG;GAAS,WAAW;EAAmB,CAAC;CAC9E;;;;CAKA,MAAM,mBACJ,OACA,EACE,MAAM,oBAAoB,GAC1B,aAAa,CAAC,aAAa,CAAC,GAC5B,gBACA,GAAG,YACmC,CAAC,GAC7B;EAQZ,MAAM,UAAU,MAPD,eAAe;GAC5B;GACA;GACA,GAAG;GACH,gBAAgB,mBAAmB,cAAc;EACnD,CAE2B,CAAC,CAAC,KAAK;EAElC,gBAAgB,SAAS,kBAAkB;EAE3C,OAAO;CACT;AACF"}

package/esm/services/one-time-tokens.d.mts

@@ -1,15 +1,16 @@
 import { Auth } from "../models/auth.model.mjs";
 import { OneTimeToken, OneTimeTokenPurpose } from "../models/one-time-token/one-time-token.model.mjs";
+import "../models/one-time-token/index.mjs";
 //#region ../../packages/auth/src/services/one-time-tokens.d.ts
 /** The raw token handed to the notification, with its expiry. */
-type IssuedOneTimeToken = {
+export type IssuedOneTimeToken = {
   token: string;
   expiresAt: Date;
 };
 /** Resolve the active one-time-token model — the default or `auth.oneTimeToken.model`. */
-declare function oneTimeTokenModel(): typeof OneTimeToken;
+export declare function oneTimeTokenModel(): typeof OneTimeToken;
 /** SHA-256 hex digest of a raw one-time token — the only form ever persisted. */
-declare function hashOneTimeToken(token: string): string;
+export declare function hashOneTimeToken(token: string): string;
 /**
  * Create and persist a one-time token for the user: 32 random bytes,
  * base64url-encoded. Only the hash reaches storage.
@@ -17,7 +18,7 @@ declare function hashOneTimeToken(token: string): string;
  * @param invalidatePrevious - consume the user's still-unused tokens of the
  *   same purpose first (password reset: only the newest link works).
  */
-declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, expiresInMs: number, invalidatePrevious?: boolean): Promise<IssuedOneTimeToken>;
+export declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, expiresInMs: number, invalidatePrevious?: boolean): Promise<IssuedOneTimeToken>;
 /**
  * Consume a raw one-time token of the given purpose and resolve its user.
  *
@@ -26,7 +27,6 @@ declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, exp
  * The consume is a conditional update, so of N concurrent callers exactly one
  * proceeds.
  */
-declare function consumeOneTimeToken(rawToken: string, purpose: OneTimeTokenPurpose): Promise<Auth>;
+export declare function consumeOneTimeToken(rawToken: string, purpose: OneTimeTokenPurpose): Promise<Auth>;
 //#endregion
-export { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel };
 //# sourceMappingURL=one-time-tokens.d.mts.map

package/esm/services/one-time-tokens.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-tokens.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/one-time-tokens.ts"],"mappings":";;;;KAOY,kBAAA;EACV,KAAA;EACA,SAAA,EAAW,IAAI;AAAA;;iBAID,iBAAA,WAA4B,YAAY;;iBAKxC,gBAAA,CAAiB,KAAa;;;AAT7B;AAIjB;;;;iBAgBsB,iBAAA,CACpB,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,WAAA,UACA,kBAAA,aACC,OAAA,CAAQ,kBAAA;AAhBX;;;;AAA8C;AAW9C;;;AAXA,iBAuCsB,mBAAA,CACpB,QAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,IAAA"}
+{"version":3,"file":"one-time-tokens.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/one-time-tokens.ts"],"mappings":";;;;;YAOY;EACV;EACA,WAAW;;;wBAIG,4BAA4B;;wBAK5B,iBAAiB;;;;;;;;wBAWX,kBACpB,MAAM,MACN,SAAS,qBACT,qBACA,+BACC,QAAQ;;;;;;;;;wBAuBW,oBACpB,kBACA,SAAS,sBACR,QAAQ"}

package/esm/services/password-reset.d.mts

@@ -1,6 +1,5 @@
 import { Auth } from "../models/auth.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/services/password-reset.d.ts
 /**
  * Start a password reset for the account whose `auth.passwordReset.identifierField`
@@ -17,7 +16,7 @@ import { ChildModel } from "@warlock.js/cascade";
  * await requestPasswordReset(User, request.input("email"));
  * return response.success({ message: "If the account exists, we sent a reset link." });
  */
-declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, identifier: string): Promise<void>;
+export declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, identifier: string): Promise<void>;
 /**
  * Complete a password reset: consume the token, store the new password, then
  * revoke every access token, refresh token and cookie session the user holds
@@ -28,7 +27,6 @@ declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, iden
  * @throws InvalidOneTimeTokenError for an unknown, verification-purpose,
  *   expired, superseded or already-used token.
  */
-declare function resetPassword(token: string, newPassword: string): Promise<Auth>;
+export declare function resetPassword(token: string, newPassword: string): Promise<Auth>;
 //#endregion
-export { requestPasswordReset, resetPassword };
 //# sourceMappingURL=password-reset.d.mts.map

package/esm/services/password-reset.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/password-reset.ts"],"mappings":";;;;;;AAwDA;;;;;;;;;;;;;iBAAsB,oBAAA,WAA+B,IAAA,EACnD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,UAAA,WACC,OAAA;;;;AAAO;AAmCV;;;;;;iBAAsB,aAAA,CAAc,KAAA,UAAe,WAAA,WAAsB,OAAO,CAAC,IAAA"}
+{"version":3,"file":"password-reset.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/password-reset.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAwDsB,qBAAqB,UAAU,MACnD,OAAO,WAAW,IAClB,qBACC;;;;;;;;;;;wBAmCmB,cAAc,eAAe,sBAAsB,QAAQ"}

package/esm/services/resolve-request-user.d.mts

@@ -1,22 +1,28 @@
 import { CookieDomainResolver, TokenFrom } from "../contracts/types.mjs";
 import { Request, Response } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/services/resolve-request-user.d.ts
-type ResolveRequestUserOptions = {
-  /** Where the access token is read from. Defaults to `"header"`. */tokenFrom?: TokenFrom; /** Refresh credential source; enables one automatic renewal per call. */
-  refreshCredential?: TokenFrom; /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */
-  overlapMs?: number; /** User types allowed to pass. Empty means any authenticated type. */
-  allowedTypes?: string[]; /** Absolute family lifetime in ms; rotation never extends a family past it. */
-  maxAgeMs?: number; /** The single user type a renewal mints for. Required for renewal. */
-  renewalUserType?: string; /** Select a request-scoped Domain for renewed cookies. */
+export type ResolveRequestUserOptions = {
+  /** Where the access token is read from. Defaults to `"header"`. */
+  tokenFrom?: TokenFrom;
+  /** Refresh credential source; enables one automatic renewal per call. */
+  refreshCredential?: TokenFrom;
+  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */
+  overlapMs?: number;
+  /** User types allowed to pass. Empty means any authenticated type. */
+  allowedTypes?: string[];
+  /** Absolute family lifetime in ms; rotation never extends a family past it. */
+  maxAgeMs?: number;
+  /** The single user type a renewal mints for. Required for renewal. */
+  renewalUserType?: string;
+  /** Select a request-scoped Domain for renewed cookies. */
   cookieDomain?: CookieDomainResolver;
 };
 /**
  * Why a request did not resolve to a user. The middleware maps each reason to
  * its own response; `resolveRequestUser` collapses them all to `null`.
  */
-type RequestUserFailure = "missing" | "invalid" | "forbidden" | "unauthorized";
-type RequestUserOutcome<TUser = any> = {
+export type RequestUserFailure = "missing" | "invalid" | "forbidden" | "unauthorized";
+export type RequestUserOutcome<TUser = any> = {
   user: TUser;
   failure?: undefined;
 } | {
@@ -24,7 +30,7 @@ type RequestUserOutcome<TUser = any> = {
   failure: RequestUserFailure;
 };
 /** Read one credential (access or refresh) from the header or a cookie. */
-declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
+export declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
 /**
  * Resolve a request's credential to a user, reporting WHY it failed.
  *
@@ -36,7 +42,7 @@ declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
  * At most one renewal is attempted per call. The renewed access token is
  * checked through the same path; no handler or unsafe request replay happens.
  */
-declare function resolveRequestUserOutcome(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<RequestUserOutcome>;
+export declare function resolveRequestUserOutcome(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<RequestUserOutcome>;
 /**
  * Resolve the request's credential to its user model, or `null` when there is
  * none (missing, invalid, expired, wrong type, or not allowed to authenticate).
@@ -44,7 +50,6 @@ declare function resolveRequestUserOutcome(request: Request, response: Response,
  * Includes the middleware's automatic renewal when `options.refreshCredential`
  * is set. Use `resolveRequestUserOutcome` when the failure reason matters.
  */
-declare function resolveRequestUser(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<any>;
+export declare function resolveRequestUser(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<any>;
 //#endregion
-export { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome };
 //# sourceMappingURL=resolve-request-user.d.mts.map