@warlock.js/auth 5.30.0 → 5.32.0

package/esm/services/resolve-request-user.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"mappings":";;;;KAgBY,yBAAA;qEAEV,SAAA,GAAY,SAAA,EAFuB;EAInC,iBAAA,GAAoB,SAAA,EAFR;EAIZ,SAAA,WAQe;EANf,YAAA,aAMmC;EAJnC,QAAA,WARY;EAUZ,eAAA,WARoB;EAUpB,YAAA,GAAe,oBAAA;AAAA;;;;;KAOL,kBAAA;AAAA,KAEA,kBAAA;EACR,IAAA,EAAM,KAAA;EAAO,OAAA;AAAA;EAA0B,IAAA;EAAY,OAAA,EAAS,kBAAkB;AAAA;;iBAoBlE,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,SAAS;;;;;;;;;;AApBa;AAoBlF;iBAqBsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,kBAAA;;;;;;;;iBAmHK,kBAAA,CACd,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA"}
+{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"mappings":";;;YAgBY;;EAEV,YAAY;;EAEZ,oBAAoB;;EAEpB;;EAEA;;EAEA;;EAEA;;EAEA,eAAe;;;;;;YAOL;YAEA,mBAAmB;EACzB,MAAM;EAAO;;EACb;EAAY,SAAS;;;wBAoBX,eAAe,SAAS,SAAS,WAAW;;;;;;;;;;;;wBAqBtC,0BACpB,SAAS,SACT,UAAU,UACV,UAAS,4BACR,QAAQ;;;;;;;;wBAmHK,mBACd,SAAS,SACT,UAAU,UACV,UAAS,4BACR"}

package/esm/services/resolve-request-user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-user.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"sourcesContent":["import { config, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type { CookieDomainResolver, TokenFrom } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport { authService } from \"./auth.service\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\n/**\n * Decoded access-token claims the resolver reads. The full payload carries\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\n */\ntype DecodedAccessToken = {\n  id: string | number;\n  userType?: string;\n};\n\nexport type ResolveRequestUserOptions = {\n  /** Where the access token is read from. Defaults to `\"header\"`. */\n  tokenFrom?: TokenFrom;\n  /** Refresh credential source; enables one automatic renewal per call. */\n  refreshCredential?: TokenFrom;\n  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */\n  overlapMs?: number;\n  /** User types allowed to pass. Empty means any authenticated type. */\n  allowedTypes?: string[];\n  /** Absolute family lifetime in ms; rotation never extends a family past it. */\n  maxAgeMs?: number;\n  /** The single user type a renewal mints for. Required for renewal. */\n  renewalUserType?: string;\n  /** Select a request-scoped Domain for renewed cookies. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * Why a request did not resolve to a user. The middleware maps each reason to\n * its own response; `resolveRequestUser` collapses them all to `null`.\n */\nexport type RequestUserFailure = \"missing\" | \"invalid\" | \"forbidden\" | \"unauthorized\";\n\nexport type RequestUserOutcome<TUser = any> =\n  { user: TUser; failure?: undefined } | { user: null; failure: RequestUserFailure };\n\n/**\n * Whether the persisted row says the token is dead.\n *\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\n * override that renames or reshapes its expiry column stays authoritative. A\n * row that cannot answer at all — an override that dropped the getter — is\n * treated as **expired**: a check must never quietly answer \"fine\" when it has\n * nothing to check.\n *\n * This is independent of the `exp` claim required by `jwt.verify`: that guard\n * catches a token whose *claims* carry no deadline; this one catches a token\n * whose *row* says the deadline has passed.\n */\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\n}\n\n/** Read one credential (access or refresh) from the header or a cookie. */\nexport function readCredential(request: Request, tokenFrom: TokenFrom): string {\n  if (tokenFrom === \"header\") {\n    return request.authorizationValue;\n  }\n\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\n\n  return value ? String(value) : \"\";\n}\n\n/**\n * Resolve a request's credential to a user, reporting WHY it failed.\n *\n * Side effects match what `authMiddleware` always did: `request.locals.user` is\n * cleared on every failure, `request.decodedAccessToken` is set once a token\n * verifies, and stale rows are destroyed. It does NOT set `request.locals.user`\n * on success — the caller decides that.\n *\n * At most one renewal is attempted per call. The renewed access token is\n * checked through the same path; no handler or unsafe request replay happens.\n */\nexport async function resolveRequestUserOutcome(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<RequestUserOutcome> {\n  const tokenFrom = options.tokenFrom ?? \"header\";\n  const allowedTypes = options.allowedTypes ?? [];\n  const { refreshCredential } = options;\n  let authorizationValue = readCredential(request, tokenFrom);\n  let renewalAttempted = false;\n\n  const renew = async (): Promise<boolean> => {\n    if (!refreshCredential || renewalAttempted) return false;\n\n    renewalAttempted = true;\n    const refreshToken = readCredential(request, refreshCredential);\n    if (!refreshToken) return false;\n\n    const pair = await authService.renewAutomaticSession(refreshToken, options.renewalUserType!, {\n      overlapMs: options.overlapMs,\n      maxAgeMs: options.maxAgeMs,\n    });\n    if (!pair?.refreshToken) return false;\n\n    authService.setAuthCookie(response, pair.accessToken, {\n      name: tokenFrom.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authService.setAuthCookie(response, pair.refreshToken, {\n      name: refreshCredential.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authorizationValue = pair.accessToken.token;\n\n    return true;\n  };\n\n  const fail = (failure: RequestUserFailure): RequestUserOutcome => {\n    request.locals.user = undefined;\n\n    return { user: null, failure };\n  };\n\n  let decoded: DecodedAccessToken;\n  let accessToken: AccessToken | null;\n\n  while (true) {\n    if (!authorizationValue) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"missing\");\n    }\n\n    try {\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\n    } catch (error) {\n      if (!isInvalidCredentialError(error)) throw error;\n      log.error(\"http\", \"auth\", error);\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    request.decodedAccessToken = decoded;\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\n    accessToken = await AccessTokenModel.findByToken(authorizationValue);\n\n    if (!accessToken) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    if (accessTokenRowIsExpired(accessToken)) {\n      await accessToken.destroy();\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    break;\n  }\n\n  const userType = decoded.userType ?? accessToken.userType;\n\n  if (allowedTypes.length && !allowedTypes.includes(userType)) {\n    return { user: null, failure: \"forbidden\" };\n  }\n\n  const UserModel = config.key(`auth.userType.${userType}`);\n\n  if (!UserModel) {\n    // Configuration, not credentials. Throwing keeps a mis-registered app\n    // loudly broken instead of quietly rejecting every request of this type.\n    throw new Error(`User type ${userType} is unknown type.`);\n  }\n\n  const currentUser = await UserModel.find(decoded.id);\n\n  if (!currentUser) {\n    await accessToken.destroy();\n\n    return fail(\"invalid\");\n  }\n\n  if (!(await authService.canAuthenticate(currentUser))) {\n    return fail(\"unauthorized\");\n  }\n\n  return { user: currentUser };\n}\n\n/**\n * Resolve the request's credential to its user model, or `null` when there is\n * none (missing, invalid, expired, wrong type, or not allowed to authenticate).\n *\n * Includes the middleware's automatic renewal when `options.refreshCredential`\n * is set. Use `resolveRequestUserOutcome` when the failure reason matters.\n */\nexport function resolveRequestUser(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<any> {\n  // Single-flight: the PROMISE is stored, so concurrent and repeat callers in\n  // one request share one verify, one lookup and at most one renewal. The first\n  // caller's options win for the rest of the request.\n  if (!request.locals.session) {\n    request.locals.session = resolveRequestUserOutcome(request, response, options).then(\n      (outcome) => outcome.user,\n    );\n  }\n\n  return request.locals.session;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuDA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;;AAGA,SAAgB,eAAe,SAAkB,WAA8B;CAC7E,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;AAaA,eAAsB,0BACpB,SACA,UACA,UAAqC,CAAC,GACT;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,eAAe,QAAQ,gBAAgB,CAAC;CAC9C,MAAM,EAAE,sBAAsB;CAC9B,IAAI,qBAAqB,eAAe,SAAS,SAAS;CAC1D,IAAI,mBAAmB;CAEvB,MAAM,QAAQ,YAA8B;EAC1C,IAAI,CAAC,qBAAqB,kBAAkB,OAAO;EAEnD,mBAAmB;EACnB,MAAM,eAAe,eAAe,SAAS,iBAAiB;EAC9D,IAAI,CAAC,cAAc,OAAO;EAE1B,MAAM,OAAO,MAAM,YAAY,sBAAsB,cAAc,QAAQ,iBAAkB;GAC3F,WAAW,QAAQ;GACnB,UAAU,QAAQ;EACpB,CAAC;EACD,IAAI,CAAC,MAAM,cAAc,OAAO;EAEhC,YAAY,cAAc,UAAU,KAAK,aAAa;GACpD,MAAM,UAAU,MAAM,CAAgB;GACtC,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,YAAY,cAAc,UAAU,KAAK,cAAc;GACrD,MAAM,kBAAkB,MAAM,CAAgB;GAC9C,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,qBAAqB,KAAK,YAAY;EAEtC,OAAO;CACT;CAEA,MAAM,QAAQ,YAAoD;EAChE,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE,MAAM;GAAM;EAAQ;CAC/B;CAEA,IAAI;CACJ,IAAI;CAEJ,OAAO,MAAM;EACX,IAAI,CAAC,oBAAoB;GACvB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAAG,MAAM;GAC5C,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,QAAQ,qBAAqB;EAE7B,cAAc,MADW,OAAO,IAAI,0BAA0B,WAC3B,CAAC,CAAC,YAAY,kBAAkB;EAEnE,IAAI,CAAC,aAAa;GAChB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAC1B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA;CACF;CAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;CAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO;EAAE,MAAM;EAAM,SAAS;CAAY;CAG5C,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;CAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;CAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;CAEnD,IAAI,CAAC,aAAa;EAChB,MAAM,YAAY,QAAQ;EAE1B,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,KAAK,cAAc;CAG5B,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;;AASA,SAAgB,mBACd,SACA,UACA,UAAqC,CAAC,GACxB;CAId,IAAI,CAAC,QAAQ,OAAO,SAClB,QAAQ,OAAO,UAAU,0BAA0B,SAAS,UAAU,OAAO,CAAC,CAAC,MAC5E,YAAY,QAAQ,IACvB;CAGF,OAAO,QAAQ,OAAO;AACxB"}
+{"version":3,"file":"resolve-request-user.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"sourcesContent":["import { config, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type { CookieDomainResolver, TokenFrom } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport { authService } from \"./auth.service\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\n/**\n * Decoded access-token claims the resolver reads. The full payload carries\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\n */\ntype DecodedAccessToken = {\n  id: string | number;\n  userType?: string;\n};\n\nexport type ResolveRequestUserOptions = {\n  /** Where the access token is read from. Defaults to `\"header\"`. */\n  tokenFrom?: TokenFrom;\n  /** Refresh credential source; enables one automatic renewal per call. */\n  refreshCredential?: TokenFrom;\n  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */\n  overlapMs?: number;\n  /** User types allowed to pass. Empty means any authenticated type. */\n  allowedTypes?: string[];\n  /** Absolute family lifetime in ms; rotation never extends a family past it. */\n  maxAgeMs?: number;\n  /** The single user type a renewal mints for. Required for renewal. */\n  renewalUserType?: string;\n  /** Select a request-scoped Domain for renewed cookies. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * Why a request did not resolve to a user. The middleware maps each reason to\n * its own response; `resolveRequestUser` collapses them all to `null`.\n */\nexport type RequestUserFailure = \"missing\" | \"invalid\" | \"forbidden\" | \"unauthorized\";\n\nexport type RequestUserOutcome<TUser = any> =\n  | { user: TUser; failure?: undefined }\n  | { user: null; failure: RequestUserFailure };\n\n/**\n * Whether the persisted row says the token is dead.\n *\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\n * override that renames or reshapes its expiry column stays authoritative. A\n * row that cannot answer at all — an override that dropped the getter — is\n * treated as **expired**: a check must never quietly answer \"fine\" when it has\n * nothing to check.\n *\n * This is independent of the `exp` claim required by `jwt.verify`: that guard\n * catches a token whose *claims* carry no deadline; this one catches a token\n * whose *row* says the deadline has passed.\n */\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\n}\n\n/** Read one credential (access or refresh) from the header or a cookie. */\nexport function readCredential(request: Request, tokenFrom: TokenFrom): string {\n  if (tokenFrom === \"header\") {\n    return request.authorizationValue;\n  }\n\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\n\n  return value ? String(value) : \"\";\n}\n\n/**\n * Resolve a request's credential to a user, reporting WHY it failed.\n *\n * Side effects match what `authMiddleware` always did: `request.locals.user` is\n * cleared on every failure, `request.decodedAccessToken` is set once a token\n * verifies, and stale rows are destroyed. It does NOT set `request.locals.user`\n * on success — the caller decides that.\n *\n * At most one renewal is attempted per call. The renewed access token is\n * checked through the same path; no handler or unsafe request replay happens.\n */\nexport async function resolveRequestUserOutcome(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<RequestUserOutcome> {\n  const tokenFrom = options.tokenFrom ?? \"header\";\n  const allowedTypes = options.allowedTypes ?? [];\n  const { refreshCredential } = options;\n  let authorizationValue = readCredential(request, tokenFrom);\n  let renewalAttempted = false;\n\n  const renew = async (): Promise<boolean> => {\n    if (!refreshCredential || renewalAttempted) return false;\n\n    renewalAttempted = true;\n    const refreshToken = readCredential(request, refreshCredential);\n    if (!refreshToken) return false;\n\n    const pair = await authService.renewAutomaticSession(refreshToken, options.renewalUserType!, {\n      overlapMs: options.overlapMs,\n      maxAgeMs: options.maxAgeMs,\n    });\n    if (!pair?.refreshToken) return false;\n\n    authService.setAuthCookie(response, pair.accessToken, {\n      name: tokenFrom.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authService.setAuthCookie(response, pair.refreshToken, {\n      name: refreshCredential.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authorizationValue = pair.accessToken.token;\n\n    return true;\n  };\n\n  const fail = (failure: RequestUserFailure): RequestUserOutcome => {\n    request.locals.user = undefined;\n\n    return { user: null, failure };\n  };\n\n  let decoded: DecodedAccessToken;\n  let accessToken: AccessToken | null;\n\n  while (true) {\n    if (!authorizationValue) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"missing\");\n    }\n\n    try {\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\n    } catch (error) {\n      if (!isInvalidCredentialError(error)) throw error;\n      log.error(\"http\", \"auth\", error);\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    request.decodedAccessToken = decoded;\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\n    accessToken = await AccessTokenModel.findByToken(authorizationValue);\n\n    if (!accessToken) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    if (accessTokenRowIsExpired(accessToken)) {\n      await accessToken.destroy();\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    break;\n  }\n\n  const userType = decoded.userType ?? accessToken.userType;\n\n  if (allowedTypes.length && !allowedTypes.includes(userType)) {\n    return { user: null, failure: \"forbidden\" };\n  }\n\n  const UserModel = config.key(`auth.userType.${userType}`);\n\n  if (!UserModel) {\n    // Configuration, not credentials. Throwing keeps a mis-registered app\n    // loudly broken instead of quietly rejecting every request of this type.\n    throw new Error(`User type ${userType} is unknown type.`);\n  }\n\n  const currentUser = await UserModel.find(decoded.id);\n\n  if (!currentUser) {\n    await accessToken.destroy();\n\n    return fail(\"invalid\");\n  }\n\n  if (!(await authService.canAuthenticate(currentUser))) {\n    return fail(\"unauthorized\");\n  }\n\n  return { user: currentUser };\n}\n\n/**\n * Resolve the request's credential to its user model, or `null` when there is\n * none (missing, invalid, expired, wrong type, or not allowed to authenticate).\n *\n * Includes the middleware's automatic renewal when `options.refreshCredential`\n * is set. Use `resolveRequestUserOutcome` when the failure reason matters.\n */\nexport function resolveRequestUser(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<any> {\n  // Single-flight: the PROMISE is stored, so concurrent and repeat callers in\n  // one request share one verify, one lookup and at most one renewal. The first\n  // caller's options win for the rest of the request.\n  if (!request.locals.session) {\n    request.locals.session = resolveRequestUserOutcome(request, response, options).then(\n      (outcome) => outcome.user,\n    );\n  }\n\n  return request.locals.session;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwDA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;;AAGA,SAAgB,eAAe,SAAkB,WAA8B;CAC7E,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;AAaA,eAAsB,0BACpB,SACA,UACA,UAAqC,CAAC,GACT;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,eAAe,QAAQ,gBAAgB,CAAC;CAC9C,MAAM,EAAE,sBAAsB;CAC9B,IAAI,qBAAqB,eAAe,SAAS,SAAS;CAC1D,IAAI,mBAAmB;CAEvB,MAAM,QAAQ,YAA8B;EAC1C,IAAI,CAAC,qBAAqB,kBAAkB,OAAO;EAEnD,mBAAmB;EACnB,MAAM,eAAe,eAAe,SAAS,iBAAiB;EAC9D,IAAI,CAAC,cAAc,OAAO;EAE1B,MAAM,OAAO,MAAM,YAAY,sBAAsB,cAAc,QAAQ,iBAAkB;GAC3F,WAAW,QAAQ;GACnB,UAAU,QAAQ;EACpB,CAAC;EACD,IAAI,CAAC,MAAM,cAAc,OAAO;EAEhC,YAAY,cAAc,UAAU,KAAK,aAAa;GACpD,MAAM,UAAU,MAAM,CAAgB;GACtC,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,YAAY,cAAc,UAAU,KAAK,cAAc;GACrD,MAAM,kBAAkB,MAAM,CAAgB;GAC9C,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,qBAAqB,KAAK,YAAY;EAEtC,OAAO;CACT;CAEA,MAAM,QAAQ,YAAoD;EAChE,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE,MAAM;GAAM;EAAQ;CAC/B;CAEA,IAAI;CACJ,IAAI;CAEJ,OAAO,MAAM;EACX,IAAI,CAAC,oBAAoB;GACvB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAAG,MAAM;GAC5C,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,QAAQ,qBAAqB;EAE7B,cAAc,MADW,OAAO,IAAI,0BAA0B,WAC3B,CAAC,CAAC,YAAY,kBAAkB;EAEnE,IAAI,CAAC,aAAa;GAChB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAC1B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA;CACF;CAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;CAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO;EAAE,MAAM;EAAM,SAAS;CAAY;CAG5C,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;CAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;CAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;CAEnD,IAAI,CAAC,aAAa;EAChB,MAAM,YAAY,QAAQ;EAE1B,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,KAAK,cAAc;CAG5B,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;;AASA,SAAgB,mBACd,SACA,UACA,UAAqC,CAAC,GACxB;CAId,IAAI,CAAC,QAAQ,OAAO,SAClB,QAAQ,OAAO,UAAU,0BAA0B,SAAS,UAAU,OAAO,CAAC,CAAC,MAC5E,YAAY,QAAQ,IACvB;CAGF,OAAO,QAAQ,OAAO;AACxB"}

package/esm/services/token-family-operation.mjs

@@ -70,5 +70,5 @@ async function runTokenFamilyOperation(familyId, operation) {
 }
 
 //#endregion
-export { TokenFamilyUnavailableError, afterTokenFamilyOperation, runTokenFamilyOperation };
+export { TokenFamilyConflictError, TokenFamilyUnavailableError, afterTokenFamilyOperation, runTokenFamilyOperation };
 //# sourceMappingURL=token-family-operation.mjs.map

package/esm/session/index.d.mts

@@ -1 +1,2 @@
-import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./page-session.mjs";
+import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./page-session.mjs";
+export { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware };

package/esm/session/index.mjs

@@ -1,3 +1,3 @@
 import { pageSession, sessionMiddleware } from "./page-session.mjs";
 
-export {  };
+export { pageSession, sessionMiddleware };

package/esm/session/page-session.d.mts

@@ -1,35 +1,44 @@
 import { CookieDomainResolver } from "../contracts/types.mjs";
 import { Middleware, Request, Response } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/session/page-session.d.ts
 /** Credential sources a session can be read from. */
-type SessionSource = "cookie" | "header";
+export type SessionSource = "cookie" | "header";
 /**
  * The seam web consumes. Declared here, not imported: web and auth never
  * depend on each other, and `pageSession()` satisfies web's `SessionResolver`
  * structurally.
  */
-type PageSessionResolver<TModel = unknown, TUser = unknown> = {
+export type PageSessionResolver<TModel = unknown, TUser = unknown> = {
   resolve(request: Request, response: Response): Promise<{
     model: TModel;
     user: TUser;
   } | null>;
 };
-type SessionResolverOptions = {
-  /** Access cookie name. @default auth.cookie.name */cookie?: string; /** Refresh cookie name. @default auth.cookie.refreshName */
-  refreshCookie?: string; /** Credential sources. A present Authorization header always wins. @default ["cookie", "header"] */
-  sources?: SessionSource[]; /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */
-  renew?: boolean; /** Allowed user types. @default auth.defaultUserType */
-  userTypes?: string | string[]; /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else "30d" */
-  maxAge?: string | number; /** Refresh overlap window forwarded to renewal. */
-  overlapMs?: number; /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */
+export type SessionResolverOptions = {
+  /** Access cookie name. @default auth.cookie.name */
+  cookie?: string;
+  /** Refresh cookie name. @default auth.cookie.refreshName */
+  refreshCookie?: string;
+  /** Credential sources. A present Authorization header always wins. @default ["cookie", "header"] */
+  sources?: SessionSource[];
+  /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */
+  renew?: boolean;
+  /** Allowed user types. @default auth.defaultUserType */
+  userTypes?: string | string[];
+  /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else "30d" */
+  maxAge?: string | number;
+  /** Refresh overlap window forwarded to renewal. */
+  overlapMs?: number;
+  /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */
   cookieDomain?: CookieDomainResolver;
 };
-type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {
-  /** Model → wire projection. Required: a model never crosses the wire by default. */project: (model: TModel) => TUser | Promise<TUser>;
+export type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {
+  /** Model → wire projection. Required: a model never crosses the wire by default. */
+  project: (model: TModel) => TUser | Promise<TUser>;
 };
-type SessionMiddlewareOptions = SessionResolverOptions & {
-  /** Let guests through with no user instead of a 401. @default false */optional?: boolean;
+export type SessionMiddlewareOptions = SessionResolverOptions & {
+  /** Let guests through with no user instead of a 401. @default false */
+  optional?: boolean;
 };
 /**
  * Session resolver for pages: cookie-or-header credential, reactive renewal,
@@ -38,14 +47,13 @@ type SessionMiddlewareOptions = SessionResolverOptions & {
  * @example
  * export default { session: pageSession({ project: (user: User) => userResource(user) }) };
  */
-declare function pageSession<TModel = any, TUser = unknown>(options: PageSessionOptions<TModel, TUser>): PageSessionResolver<TModel, TUser>;
+export declare function pageSession<TModel = any, TUser = unknown>(options: PageSessionOptions<TModel, TUser>): PageSessionResolver<TModel, TUser>;
 /**
  * Middleware for cookie API routes over the same resolver as `pageSession`.
  * A cookie-authenticated unsafe request must pass the Origin/Referer check
  * (renewal can mint cookies, so it runs even when the access cookie is gone).
  * Guests get a 401 unless `optional`. The user lands on `request.locals.user`.
  */
-declare function sessionMiddleware(options?: SessionMiddlewareOptions): Middleware;
+export declare function sessionMiddleware(options?: SessionMiddlewareOptions): Middleware;
 //#endregion
-export { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware };
 //# sourceMappingURL=page-session.d.mts.map

package/esm/session/page-session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/session/page-session.ts"],"mappings":";;;;;KAcY,aAAA;AAAZ;;;;AAAyB;AAAzB,KAUY,mBAAA;EACV,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAA,GAAW,OAAA;IAAU,KAAA,EAAO,MAAA;IAAQ,IAAA,EAAM,KAAA;EAAA;AAAA;AAAA,KAGpE,sBAAA;EAHqC,oDAK/C,MAAA,WALsD;EAOtD,aAAA,WARgD;EAUhD,OAAA,GAAU,aAAA,IATO;EAWjB,KAAA,YAXoC;EAapC,SAAA,sBAb+C;EAe/C,MAAA,oBAfgE;EAiBhE,SAAA,WAjB8E;EAmB9E,YAAA,GAAe,oBAAoB;AAAA;AAAA,KAGzB,kBAAA,kBAAoC,sBAAA;EAnBd,oFAqBhC,OAAA,GAAU,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAA,CAAQ,KAAA;AAAA;AAAA,KAGlC,wBAAA,GAA2B,sBAAsB;EApB3D,uEAsBA,QAAQ;AAAA;;;;;;;;iBAgFM,WAAA,gCACd,OAAA,EAAS,kBAAA,CAAmB,MAAA,EAAQ,KAAA,IACnC,mBAAA,CAAoB,MAAA,EAAQ,KAAA;AAzF/B;;;;;;AAAA,iBA4HgB,iBAAA,CAAkB,OAAA,GAAS,wBAAA,GAAgC,UAAU"}
+{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/session/page-session.ts"],"mappings":";;;;YAcY;;;;;;YAUA,oBAAoB,kBAAkB;EAChD,QAAQ,SAAS,SAAS,UAAU,WAAW;IAAU,OAAO;IAAQ,MAAM;;;YAGpE;;EAEV;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA,eAAe;;YAGL,mBAAmB,QAAQ,SAAS;;EAE9C,UAAU,OAAO,WAAW,QAAQ,QAAQ;;YAGlC,2BAA2B;;EAErC;;;;;;;;;wBAgFc,YAAY,cAAc,iBACxC,SAAS,mBAAmB,QAAQ,SACnC,oBAAoB,QAAQ;;;;;;;wBAmCf,kBAAkB,UAAS,2BAAgC"}

package/esm/utils/auth-error-codes.d.mts

@@ -1,30 +1,26 @@
 //#region ../../packages/auth/src/utils/auth-error-codes.d.ts
-declare enum AuthErrorCodes {
+export declare enum AuthErrorCodes {
   /**
    * Missing Access Token Error Code EC001
    * EC001 = Missing Access Token
    */
-  MissingAccessToken = "EC001",
-  // Error Code 001
+  MissingAccessToken = "EC001", // Error Code 001
   /**
    * Invalid Access Token Error Code EC002
    * EC002 = Invalid Access Token
    */
-  InvalidAccessToken = "EC002",
-  // Error Code 002
+  InvalidAccessToken = "EC002", // Error Code 002
   /**
    * Unauthorized Error Code EC003
    * EC003 = Unauthorized
    */
-  Unauthorized = "EC003",
-  // Error Code 003
+  Unauthorized = "EC003", // Error Code 003
   /**
    * Too Many Attempts Error Code EC004
    * EC004 = Too Many Attempts — issued by the login-throttle middleware once
    * a per-account or per-IP failure counter trips its threshold.
    */
-  TooManyAttempts = "EC004",
-  // Error Code 004
+  TooManyAttempts = "EC004", // Error Code 004
   /**
    * Invalid Token Type Error Code EC005
    * EC005 = Invalid Token Type — the token's `tokenType` claim does not match
@@ -33,8 +29,7 @@ declare enum AuthErrorCodes {
    * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can
    * classify it as a credential failure without matching on the message.
    */
-  InvalidTokenType = "EC005",
-  // Error Code 005
+  InvalidTokenType = "EC005", // Error Code 005
   /**
    * CSRF Origin Mismatch Error Code EC006
    * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)
@@ -42,38 +37,33 @@ declare enum AuthErrorCodes {
    * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose
    * request carried neither header at all.
    */
-  CsrfOriginMismatch = "EC006",
-  // Error Code 006
+  CsrfOriginMismatch = "EC006", // Error Code 006
   /**
    * Email Not Verified Error Code EC007
    * EC007 = the authenticated user has not verified their email address —
    * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
    */
-  EmailNotVerified = "EC007",
-  // Error Code 007
+  EmailNotVerified = "EC007", // Error Code 007
   /**
    * Invalid One-Time Token Error Code EC008
    * EC008 = an email-verification or password-reset token that is unknown,
    * issued for the other purpose, expired, or already used. One code for all
    * four on purpose: the caller learns nothing about which it was.
    */
-  InvalidOneTimeToken = "EC008",
-  // Error Code 008
+  InvalidOneTimeToken = "EC008", // Error Code 008
   /**
    * Invalid Provider Callback Error Code EC009
    * EC009 = a redirect-provider callback was rejected: missing, forged or
    * expired state cookie, `state` mismatch, failed code exchange, or an
    * id_token with a bad signature, issuer, audience, expiry or nonce.
    */
-  InvalidProviderCallback = "EC009",
-  // Error Code 009
+  InvalidProviderCallback = "EC009", // Error Code 009
   /**
    * Provider Email Not Verified Error Code EC010
    * EC010 = the provider did not verify the email, so auth refused to link or
    * create an account from it.
    */
-  ProviderEmailNotVerified = "EC010",
-  // Error Code 010
+  ProviderEmailNotVerified = "EC010", // Error Code 010
   /**
    * Invalid Passkey Error Code EC011
    * EC011 = a passkey ceremony was rejected: unknown, expired or used
@@ -83,5 +73,4 @@ declare enum AuthErrorCodes {
   InvalidPasskey = "EC011"
 }
 //#endregion
-export { AuthErrorCodes };
 //# sourceMappingURL=auth-error-codes.d.mts.map

package/esm/utils/auth-error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAkCA;;;;EA7BA,YAAA;EAAA;EAwDc;AAAA;;;;EAlDd,eAAA;EAAA;;;;;;;;;EASA,gBAAA;EAAA;;;;;;;;EAQA,kBAAA;EAAA;;;;;;EAMA,gBAAA;EAAA;;;;;;;EAOA,mBAAA;EAAA;;;;;;;EAOA,uBAAA;EAAA;;;;;;EAMA,wBAAA;EAAA;;;;;;;EAOA,cAAA;AAAA"}
+{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/auth-error-codes.ts"],"mappings":";oBAAY;;;;;EAKV;;;;;EAKA;;;;;EAKA;;;;;;EAMA;;;;;;;;;EASA;;;;;;;;EAQA;;;;;;EAMA;;;;;;;EAOA;;;;;;;EAOA;;;;;;EAMA;;;;;;;EAOA"}

package/esm/utils/index.mjs

@@ -2,4 +2,4 @@ import { AuthErrorCodes } from "./auth-error-codes.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./token-expiry.mjs";
 import { safeEqual } from "./safe-equal.mjs";
 
-export {  };
+export { AuthErrorCodes, isNeverExpiring, isUsableExpiry, safeEqual, tokenHasExpClaim };

package/esm/utils/safe-equal.d.mts

@@ -1,6 +1,5 @@
 //#region ../../packages/auth/src/utils/safe-equal.d.ts
 /** Constant-time string equality; strings of unequal length are simply unequal. */
-declare function safeEqual(left: string, right: string): boolean;
+export declare function safeEqual(left: string, right: string): boolean;
 //#endregion
-export { safeEqual };
 //# sourceMappingURL=safe-equal.d.mts.map

package/esm/utils/safe-equal.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/safe-equal.ts"],"mappings":";;iBAGgB,SAAA,CAAU,IAAA,UAAc,KAAa"}
+{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/safe-equal.ts"],"mappings":";;wBAGgB,UAAU,cAAc"}

package/esm/utils/token-expiry.d.mts

@@ -9,7 +9,7 @@
  * nor `expires_at > now` (it never shows as an active session): it is outside
  * the reach of every date predicate rather than merely wrong.
  */
-declare function isUsableExpiry(value: unknown): boolean;
+export declare function isUsableExpiry(value: unknown): boolean;
 /**
  * Whether the JWT carries a finite numeric `exp` claim.
  *
@@ -19,7 +19,7 @@ declare function isUsableExpiry(value: unknown): boolean;
  * answers `false` — it cannot be shown to expire, and a row whose token cannot
  * even be parsed is unusable regardless.
  */
-declare function tokenHasExpClaim(token: unknown): boolean;
+export declare function tokenHasExpClaim(token: unknown): boolean;
 /**
  * Whether a token row can ever stop being accepted on its own.
  *
@@ -29,7 +29,6 @@ declare function tokenHasExpClaim(token: unknown): boolean;
  *
  * This is the predicate the `auth.purge-never-expiring` remediation selects on.
  */
-declare function isNeverExpiring(token: unknown, expiresAt: unknown): boolean;
+export declare function isNeverExpiring(token: unknown, expiresAt: unknown): boolean;
 //#endregion
-export { isNeverExpiring, isUsableExpiry, tokenHasExpClaim };
 //# sourceMappingURL=token-expiry.d.mts.map

package/esm/utils/token-expiry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"token-expiry.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/token-expiry.ts"],"mappings":";;AAqBA;;;;AAA6C;AAe7C;;;;iBAfgB,cAAA,CAAe,KAAc;AAoC7C;;;;AAAkE;;;;;AAAlE,iBArBgB,gBAAA,CAAiB,KAAc;;;;;;;;;;iBAqB/B,eAAA,CAAgB,KAAA,WAAgB,SAAkB"}
+{"version":3,"file":"token-expiry.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/token-expiry.ts"],"mappings":";;;;;;;;;;;wBAqBgB,eAAe;;;;;;;;;;wBAef,iBAAiB;;;;;;;;;;wBAqBjB,gBAAgB,gBAAgB"}