@warlock.js/auth 5.31.0 → 5.32.0

package/esm/localization/register-auth-translations.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"register-auth-translations.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/localization/register-auth-translations.ts"],"mappings":";;AAgBA;;;;AAAwC;;;;;;;iBAAxB,wBAAA"}
+{"version":3,"file":"register-auth-translations.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/localization/register-auth-translations.ts"],"mappings":";;;;;;;;;;;;;wBAgBgB"}

package/esm/middleware/auth.middleware.d.mts

@@ -1,23 +1,24 @@
 import { AuthMiddlewareOptions, TokenFrom } from "../contracts/types.mjs";
 import { Middleware } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/auth.middleware.d.ts
 /**
  * Well-known symbol under which `authMiddleware()` tags the middleware it
  * returns. Shared via the global symbol registry so other packages can read the
  * descriptor structurally (`Symbol.for("warlock.auth")`) without importing auth.
  */
-declare const AUTH_MIDDLEWARE_DESCRIPTOR: unique symbol;
+export declare const AUTH_MIDDLEWARE_DESCRIPTOR: unique symbol;
 /** A credential source an auth middleware reads: the Authorization header or a named cookie. */
-type AuthMiddlewareDescriptorSource = "header" | {
+export type AuthMiddlewareDescriptorSource = "header" | {
   cookie: string;
 };
 /**
  * Frozen, JSON-safe description of how an `authMiddleware()` instance
  * authenticates, stored (non-enumerably) under {@link AUTH_MIDDLEWARE_DESCRIPTOR}.
  */
-type AuthMiddlewareDescriptor = {
-  /** Resolved credential sources; with dual sources the header comes first. */sources: AuthMiddlewareDescriptorSource[]; /** Resolved allowed user types; an empty array means any authenticated user. */
+export type AuthMiddlewareDescriptor = {
+  /** Resolved credential sources; with dual sources the header comes first. */
+  sources: AuthMiddlewareDescriptorSource[];
+  /** Resolved allowed user types; an empty array means any authenticated user. */
   userTypes: string[];
 };
 /**
@@ -41,10 +42,9 @@ type AuthMiddlewareDescriptor = {
  * router.get("/back-office", authMiddleware(["admin", "staff"]), backOfficeController);
  * router.get("/browser-account", authMiddleware([], "cookie:token"), accountController);
  */
-declare function authMiddleware(): Middleware;
-declare function authMiddleware(options: AuthMiddlewareOptions): Middleware;
-declare function authMiddleware(allowedUserType: string | string[], options?: AuthMiddlewareOptions): Middleware;
-declare function authMiddleware(allowedUserType: string | string[], tokenFrom?: TokenFrom): Middleware;
+export declare function authMiddleware(): Middleware;
+export declare function authMiddleware(options: AuthMiddlewareOptions): Middleware;
+export declare function authMiddleware(allowedUserType: string | string[], options?: AuthMiddlewareOptions): Middleware;
+export declare function authMiddleware(allowedUserType: string | string[], tokenFrom?: TokenFrom): Middleware;
 //#endregion
-export { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, authMiddleware };
 //# sourceMappingURL=auth.middleware.d.mts.map

package/esm/middleware/auth.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;AAsBA;;;cAAa,0BAAA;AAAuD;AAAA,KAGxD,8BAAA;EAA8C,MAAM;AAAA;;AAAA;AAMhE;;KAAY,wBAAA;EAE6B,6EAAvC,OAAA,EAAS,8BAA8B,IAA9B;EAET,SAAA;AAAA;AAAS;AAoGX;;;;AAA4C;AAC5C;;;;;;;;AAA0E;AAC1E;;;;;;AAtGW,iBAoGK,cAAA,IAAkB,UAAU;AAAA,iBAC5B,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,UAAU;AAAA,iBAC1D,cAAA,CACd,eAAA,qBACA,OAAA,GAAU,qBAAA,GACT,UAAU;AAAA,iBACG,cAAA,CACd,eAAA,qBACA,SAAA,GAAY,SAAA,GACX,UAAU"}
+{"version":3,"file":"auth.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/auth.middleware.ts"],"mappings":";;;;;;;;qBAsBa;;YAGD;EAA8C;;;;;;YAM9C;;EAEV,SAAS;;EAET;;;;;;;;;;;;;;;;;;;;;;;wBAoGc,kBAAkB;wBAClB,eAAe,SAAS,wBAAwB;wBAChD,eACd,oCACA,UAAU,wBACT;wBACa,eACd,oCACA,YAAY,YACX"}

package/esm/middleware/csrf-origin-check.d.mts

@@ -1,17 +1,16 @@
 import { TokenFrom } from "../contracts/types.mjs";
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
 import { Request } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/csrf-origin-check.d.ts
 /** Why {@link assertCsrfOriginAllowed} refused a request. */
-type CsrfOriginMismatchReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
+export type CsrfOriginMismatchReason = "origin-mismatch" | "referer-mismatch" | "missing-origin-and-referer";
 /**
  * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`
  * failed the check. `reason` names exactly why,
  * so an error transformer or an incident log never has to string-match the
  * message.
  */
-declare class CsrfOriginMismatchError extends Error {
+export declare class CsrfOriginMismatchError extends Error {
   readonly reason: CsrfOriginMismatchReason;
   readonly code = AuthErrorCodes.CsrfOriginMismatch;
   constructor(reason: CsrfOriginMismatchReason);
@@ -23,7 +22,7 @@ declare class CsrfOriginMismatchError extends Error {
  * only a cookie-sourced credential can be silently replayed cross-site by a
  * browser, so only it needs the check.
  */
-declare function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean;
+export declare function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean;
 /**
  * CSRF Origin check for a cookie-authenticated unsafe-method request (lead
  * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`
@@ -43,7 +42,6 @@ declare function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string):
  * Callers gate this behind {@link requiresCsrfOriginCheck} — this function
  * itself does not re-check the token source or the method.
  */
-declare function assertCsrfOriginAllowed(request: Request): void;
+export declare function assertCsrfOriginAllowed(request: Request): void;
 //#endregion
-export { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllowed, requiresCsrfOriginCheck };
 //# sourceMappingURL=csrf-origin-check.d.mts.map

package/esm/middleware/csrf-origin-check.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-check.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"mappings":";;;;;;KAQY,wBAAA;AAAZ;;;;AAAoC;AAWpC;AAXA,cAWa,uBAAA,SAAgC,KAAA;EAAA,SAGf,MAAA,EAAQ,wBAAA;EAAA,SAF3B,IAAA,GAAI,cAAA,CAAA,kBAAA;cAEe,MAAA,EAAQ,wBAAA;AAAA;;;;;;;;iBAatB,uBAAA,CAAwB,SAAA,EAAW,SAAS,EAAE,MAAA;;;;;;AAbA;AAa9D;;;;;;;;AAA4E;AAuB5E;;;;iBAAgB,uBAAA,CAAwB,OAAgB,EAAP,OAAO"}
+{"version":3,"file":"csrf-origin-check.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"mappings":";;;;;YAQY;;;;;;;qBAWC,gCAAgC;WAGf,QAAQ;WAF3B,OAAI,eAAA;EAEb,YAA4B,QAAQ;;;;;;;;;wBAatB,wBAAwB,WAAW,WAAW;;;;;;;;;;;;;;;;;;;;wBAuB9C,wBAAwB,SAAS"}

package/esm/middleware/csrf-origin-check.mjs

@@ -3,7 +3,7 @@ import { resolveCsrfOriginVerdict } from "@warlock.js/core";
 
 //#region ../../packages/auth/src/middleware/csrf-origin-check.ts
 /** HTTP methods the CSRF Origin check exempts — reads, never state changes. */
-const SAFE_METHODS = new Set([
+const SAFE_METHODS = /* @__PURE__ */ new Set([
 	"GET",
 	"HEAD",
 	"OPTIONS"

package/esm/middleware/csrf-origin-check.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf-origin-check.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"sourcesContent":["import { resolveCsrfOriginVerdict, type Request } from \"@warlock.js/core\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/** Why {@link assertCsrfOriginAllowed} refused a request. */\nexport type CsrfOriginMismatchReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/**\n * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`\n * failed the check. `reason` names exactly why,\n * so an error transformer or an incident log never has to string-match the\n * message.\n */\nexport class CsrfOriginMismatchError extends Error {\n  readonly code = AuthErrorCodes.CsrfOriginMismatch;\n\n  constructor(public readonly reason: CsrfOriginMismatchReason) {\n    super(`CSRF Origin check failed: ${reason}`);\n    this.name = \"CsrfOriginMismatchError\";\n  }\n}\n\n/**\n * Whether a request is in scope for the CSRF Origin check at all — only a\n * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.\n * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:\n * only a cookie-sourced credential can be silently replayed cross-site by a\n * browser, so only it needs the check.\n */\nexport function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean {\n  return tokenFrom.startsWith(\"cookie:\") && !SAFE_METHODS.has(method.toUpperCase());\n}\n\n/**\n * CSRF Origin check for a cookie-authenticated unsafe-method request (lead\n * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`\n * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.\n * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH\n * headers are absent.\n *\n * Delegates the actual same-origin/allowedOrigins/trustProxy-aware\n * comparison to `@warlock.js/core`'s `resolveCsrfOriginVerdict`\n * (`core/src/http/csrf-origin-policy.ts`) — SECURITY card 8a752ab2 moved that\n * logic down into `core` so this middleware's check and core's own default\n * CSRF-Origin guard (`core/src/http/csrf-default-guard.ts`, which now runs\n * even earlier, ahead of this middleware, for cookie-carrying unsafe-method\n * requests generally) share one implementation instead of two copies that\n * could drift apart.\n *\n * Callers gate this behind {@link requiresCsrfOriginCheck} — this function\n * itself does not re-check the token source or the method.\n */\nexport function assertCsrfOriginAllowed(request: Request): void {\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (!verdict.allowed) {\n    throw new CsrfOriginMismatchError(verdict.reason);\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,eAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;;;AAcvD,IAAa,0BAAb,cAA6C,MAAM;CAGjD,YAAY,AAAgB,QAAkC;EAC5D,MAAM,6BAA6B,QAAQ;EADjB;;EAE1B,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,wBAAwB,WAAsB,QAAyB;CACrF,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC;AAClF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,wBAAwB,QAAQ,MAAM;AAEpD"}
+{"version":3,"file":"csrf-origin-check.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/csrf-origin-check.ts"],"sourcesContent":["import { resolveCsrfOriginVerdict, type Request } from \"@warlock.js/core\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** HTTP methods the CSRF Origin check exempts — reads, never state changes. */\nconst SAFE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/** Why {@link assertCsrfOriginAllowed} refused a request. */\nexport type CsrfOriginMismatchReason =\n  | \"origin-mismatch\"\n  | \"referer-mismatch\"\n  | \"missing-origin-and-referer\";\n\n/**\n * A cookie-authenticated, unsafe-method request whose `Origin`/`Referer`\n * failed the check. `reason` names exactly why,\n * so an error transformer or an incident log never has to string-match the\n * message.\n */\nexport class CsrfOriginMismatchError extends Error {\n  readonly code = AuthErrorCodes.CsrfOriginMismatch;\n\n  constructor(public readonly reason: CsrfOriginMismatchReason) {\n    super(`CSRF Origin check failed: ${reason}`);\n    this.name = \"CsrfOriginMismatchError\";\n  }\n}\n\n/**\n * Whether a request is in scope for the CSRF Origin check at all — only a\n * `cookie:`-sourced credential on an unsafe method (POST/PUT/PATCH/DELETE) is.\n * Header-token auth and safe methods (GET/HEAD/OPTIONS) are always exempt:\n * only a cookie-sourced credential can be silently replayed cross-site by a\n * browser, so only it needs the check.\n */\nexport function requiresCsrfOriginCheck(tokenFrom: TokenFrom, method: string): boolean {\n  return tokenFrom.startsWith(\"cookie:\") && !SAFE_METHODS.has(method.toUpperCase());\n}\n\n/**\n * CSRF Origin check for a cookie-authenticated unsafe-method request (lead\n * decision 3). Allowed when `Origin` — or, when `Origin` is absent, `Referer`\n * — names the request's own origin or an entry in `auth.csrf.allowedOrigins`.\n * Throws {@link CsrfOriginMismatchError} otherwise, including when BOTH\n * headers are absent.\n *\n * Delegates the actual same-origin/allowedOrigins/trustProxy-aware\n * comparison to `@warlock.js/core`'s `resolveCsrfOriginVerdict`\n * (`core/src/http/csrf-origin-policy.ts`) — SECURITY card 8a752ab2 moved that\n * logic down into `core` so this middleware's check and core's own default\n * CSRF-Origin guard (`core/src/http/csrf-default-guard.ts`, which now runs\n * even earlier, ahead of this middleware, for cookie-carrying unsafe-method\n * requests generally) share one implementation instead of two copies that\n * could drift apart.\n *\n * Callers gate this behind {@link requiresCsrfOriginCheck} — this function\n * itself does not re-check the token source or the method.\n */\nexport function assertCsrfOriginAllowed(request: Request): void {\n  const verdict = resolveCsrfOriginVerdict(request);\n\n  if (!verdict.allowed) {\n    throw new CsrfOriginMismatchError(verdict.reason);\n  }\n}\n"],"mappings":";;;;;AAKA,MAAM,+BAAe,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;;;;;;;AAcvD,IAAa,0BAAb,cAA6C,MAAM;CAGjD,YAAY,AAAgB,QAAkC;EAC5D,MAAM,6BAA6B,QAAQ;EADjB;;EAE1B,KAAK,OAAO;CACd;AACF;;;;;;;;AASA,SAAgB,wBAAwB,WAAsB,QAAyB;CACrF,OAAO,UAAU,WAAW,SAAS,KAAK,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC;AAClF;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,wBAAwB,SAAwB;CAC9D,MAAM,UAAU,yBAAyB,OAAO;CAEhD,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,wBAAwB,QAAQ,MAAM;AAEpD"}

package/esm/middleware/index.d.mts

@@ -3,4 +3,5 @@ import { CsrfOriginMismatchError, CsrfOriginMismatchReason, assertCsrfOriginAllo
 import { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware, throttleIdentifierHash } from "./login-throttle.middleware.mjs";
 import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./one-time-token-throttle.middleware.mjs";
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
-import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";
+import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";
+export { AUTH_MIDDLEWARE_DESCRIPTOR, AuthMiddlewareDescriptor, AuthMiddlewareDescriptorSource, CsrfOriginMismatchError, CsrfOriginMismatchReason, LoginThrottleIdentifier, LoginThrottleOptions, assertCsrfOriginAllowed, authMiddleware, loginThrottleMiddleware, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, requireVerifiedEmail, requiresCsrfOriginCheck, throttleIdentifierHash, tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };

package/esm/middleware/index.mjs

@@ -5,4 +5,4 @@ import { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware } from "./
 import { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware } from "./otp-throttle.middleware.mjs";
 import { requireVerifiedEmail } from "./require-verified-email.middleware.mjs";
 
-export {  };
+export { AUTH_MIDDLEWARE_DESCRIPTOR, CsrfOriginMismatchError, assertCsrfOriginAllowed, authMiddleware, loginThrottleMiddleware, otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware, requireVerifiedEmail, requiresCsrfOriginCheck, throttleIdentifierHash, tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };

package/esm/middleware/login-throttle.middleware.d.mts

@@ -1,5 +1,4 @@
 import { Middleware, Request, Response } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/login-throttle.middleware.d.ts
 /**
  * Built-in identifier kinds the throttle knows how to extract from a request.
@@ -11,7 +10,7 @@ import { Middleware, Request, Response } from "@warlock.js/core";
  *
  * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.
  */
-type LoginThrottleIdentifier = "email" | "ip";
+export type LoginThrottleIdentifier = "email" | "ip";
 /**
  * Options for {@link loginThrottleMiddleware}.
  *
@@ -22,7 +21,7 @@ type LoginThrottleIdentifier = "email" | "ip";
  * @example
  * loginThrottleMiddleware({ max: 5, window: "15m", lockoutDuration: "15m" });
  */
-type LoginThrottleOptions = {
+export type LoginThrottleOptions = {
   /**
    * Failures allowed within the window before the identifier is locked.
    *
@@ -88,7 +87,7 @@ type LoginThrottleOptions = {
  *
  * Exported for tests and for apps that inspect throttle keys.
  */
-declare function throttleIdentifierHash(kind: string, value: string): string;
+export declare function throttleIdentifierHash(kind: string, value: string): string;
 /**
  * Failure-aware login throttle. Locks an identifier (account, IP, or both)
  * after too many failed login attempts within a window — without penalising
@@ -125,7 +124,6 @@ declare function throttleIdentifierHash(kind: string, value: string): string;
  *   middleware: [loginThrottleMiddleware({ by: ["ip"], max: 10, window: "1m" })],
  * });
  */
-declare function loginThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+export declare function loginThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 //#endregion
-export { LoginThrottleIdentifier, LoginThrottleOptions, loginThrottleMiddleware, throttleIdentifierHash };
 //# sourceMappingURL=login-throttle.middleware.d.mts.map

package/esm/middleware/login-throttle.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"login-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/login-throttle.middleware.ts"],"mappings":";;;;;AAkBA;;;;AAAmC;AAYnC;;;KAZY,uBAAA;;;;;;;;;;;KAYA,oBAAA;EAkDV;;;;;EA5CA,GAAA;EAmD4B;AAAA;AAwC9B;;;EApFE,MAAA;EAoFgE;AA0IlE;;;;EAvNE,eAAA;EAuNsC;;;AAA+C;;EAhNrF,EAAA,GAAK,uBAAA;;;;;;;;EASL,aAAA;;;;EAKA,YAAA;;;;;;;;EASA,SAAA,IAAa,QAAA,EAAU,QAAA;;;;;;EAOvB,QAAA,IAAY,OAAA,EAAS,OAAA;AAAA;;;;;;;;;;;;;;;iBAwCP,sBAAA,CAAuB,IAAA,UAAc,KAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0IlD,uBAAA,CAAwB,OAAA,GAAS,oBAAA,GAA4B,UAAU"}
+{"version":3,"file":"login-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/login-throttle.middleware.ts"],"mappings":";;;;;;;;;;;;YAkBY;;;;;;;;;;;YAYA;;;;;;EAMV;;;;;;EAOA;;;;;;EAOA;;;;;;EAOA,KAAK;;;;;;;;EASL;;;;EAKA;;;;;;;;EASA,aAAa,UAAU;;;;;;EAOvB,YAAY,SAAS;;;;;;;;;;;;;;;;wBAwCP,uBAAuB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA0IrC,wBAAwB,UAAS,uBAA4B"}

package/esm/middleware/one-time-token-throttle.middleware.d.mts

@@ -1,6 +1,5 @@
 import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
 import { Middleware } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/one-time-token-throttle.middleware.d.ts
 /**
  * Throttle for routes that ISSUE a verification or reset token ("send
@@ -16,7 +15,7 @@ import { Middleware } from "@warlock.js/core";
  *   middleware: [tokenIssueThrottleMiddleware()],
  * });
  */
-declare function tokenIssueThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+export declare function tokenIssueThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 /**
  * Throttle for routes that CONSUME a token ("verify email", "reset
  * password"). Built on {@link loginThrottleMiddleware}: per IP (the body
@@ -30,7 +29,6 @@ declare function tokenIssueThrottleMiddleware(options?: LoginThrottleOptions): M
  *   middleware: [tokenConsumeThrottleMiddleware()],
  * });
  */
-declare function tokenConsumeThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+export declare function tokenConsumeThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 //#endregion
-export { tokenConsumeThrottleMiddleware, tokenIssueThrottleMiddleware };
 //# sourceMappingURL=one-time-token-throttle.middleware.d.mts.map

package/esm/middleware/one-time-token-throttle.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-token-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/one-time-token-throttle.middleware.ts"],"mappings":";;;;;;AAiBA;;;;;;;;AAA4F;AAwB5F;;;iBAxBgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;;;;;AAwBE;;;;;;;;;iBAA9E,8BAAA,CAA+B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}
+{"version":3,"file":"one-time-token-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/one-time-token-throttle.middleware.ts"],"mappings":";;;;;;;;;;;;;;;;;wBAiBgB,6BAA6B,UAAS,uBAA4B;;;;;;;;;;;;;;wBAwBlE,+BAA+B,UAAS,uBAA4B"}

package/esm/middleware/otp-throttle.middleware.d.mts

@@ -1,6 +1,5 @@
 import { LoginThrottleOptions } from "./login-throttle.middleware.mjs";
 import { Middleware } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/otp-throttle.middleware.d.ts
 /**
  * Throttle for the route that SENDS a login code. {@link tokenIssueThrottleMiddleware}
@@ -12,7 +11,7 @@ import { Middleware } from "@warlock.js/core";
  *   middleware: [otpRequestThrottleMiddleware()],
  * });
  */
-declare function otpRequestThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+export declare function otpRequestThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 /**
  * Throttle for the route that VERIFIES a login code. {@link loginThrottleMiddleware}
  * keyed on `phone` and IP, failure-aware: 5 failures per 15m, then a 15m lockout
@@ -24,7 +23,6 @@ declare function otpRequestThrottleMiddleware(options?: LoginThrottleOptions): M
  *   middleware: [otpVerifyThrottleMiddleware()],
  * });
  */
-declare function otpVerifyThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
+export declare function otpVerifyThrottleMiddleware(options?: LoginThrottleOptions): Middleware;
 //#endregion
-export { otpRequestThrottleMiddleware, otpVerifyThrottleMiddleware };
 //# sourceMappingURL=otp-throttle.middleware.d.mts.map

package/esm/middleware/otp-throttle.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"otp-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/otp-throttle.middleware.ts"],"mappings":";;;;;;AAcA;;;;;;;;iBAAgB,4BAAA,CAA6B,OAAA,GAAS,oBAAA,GAA4B,UAAU;AAe5F;;;;;;;;AAA2F;;;AAA3F,iBAAgB,2BAAA,CAA4B,OAAA,GAAS,oBAAA,GAA4B,UAAU"}
+{"version":3,"file":"otp-throttle.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/otp-throttle.middleware.ts"],"mappings":";;;;;;;;;;;;;wBAcgB,6BAA6B,UAAS,uBAA4B;;;;;;;;;;;;wBAelE,4BAA4B,UAAS,uBAA4B"}

package/esm/middleware/require-verified-email.middleware.d.mts

@@ -1,5 +1,4 @@
 import { Middleware } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/middleware/require-verified-email.middleware.d.ts
 /**
  * Opt-in route gate that rejects a user who has not verified their email with
@@ -12,7 +11,6 @@ import { Middleware } from "@warlock.js/core";
  *   middleware: [authMiddleware("user"), requireVerifiedEmail()],
  * });
  */
-declare function requireVerifiedEmail(): Middleware;
+export declare function requireVerifiedEmail(): Middleware;
 //#endregion
-export { requireVerifiedEmail };
 //# sourceMappingURL=require-verified-email.middleware.d.mts.map

package/esm/middleware/require-verified-email.middleware.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"require-verified-email.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/require-verified-email.middleware.ts"],"mappings":";;;;;AAeA;;;;AAAkD;;;;;iBAAlC,oBAAA,IAAwB,UAAU"}
+{"version":3,"file":"require-verified-email.middleware.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/middleware/require-verified-email.middleware.ts"],"mappings":";;;;;;;;;;;;;wBAegB,wBAAwB"}

package/esm/models/access-token/access-token.model.d.mts

@@ -1,6 +1,5 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/access-token/access-token.model.d.ts
 /**
  * Seal schema for the persisted access-token record. Exported so an override
@@ -10,10 +9,11 @@ import { Model } from "@warlock.js/cascade";
  * `last_access` and the `is_active` soft-revoke flag were removed — neither was
  * ever read; access tokens are revoked by deleting the row.
  */
-declare const accessTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const accessTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+  user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+  /** Null for tokens issued before family tracking was introduced. */
   family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
     isOptional: true;
   };
@@ -29,12 +29,13 @@ declare const accessTokenSchema: import("@warlock.js/seal").ObjectValidator<{
  * override can rename/add columns by registering under
  * `config.auth.accessToken.model`.
  */
-declare class AccessToken extends Model {
+export declare class AccessToken extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     token: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
     user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
-    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>; /** Null for tokens issued before family tracking was introduced. */
+    user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
+    /** Null for tokens issued before family tracking was introduced. */
     family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string> & {
       isOptional: true;
     };
@@ -129,5 +130,4 @@ declare class AccessToken extends Model {
   static purgeNeverExpiring(): Promise<AccessToken[]>;
 }
 //#endregion
-export { AccessToken, accessTokenSchema };
 //# sourceMappingURL=access-token.model.d.mts.map

package/esm/models/access-token/access-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;AAaA;;;;;;cAAa,iBAAA,6BAAiB,eAAA;;;;;;;qGAO5B,IAAA,EAAA,IAAA;AAAA;;;;;;;;;;AAYF;cAAa,WAAA,SAAoB,KAAA;EAAA,OACjB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;yHAiE6D;;;;;;EA2B5C;;;;;;EAAA,OApFvB,MAAA;EAsIoC;;;;;;;EAAA,OA7HpC,cAAA;EAjBM;EAAA,IAoBT,MAAA;;MAKA,QAAA;;;;;;;;;;;;;;;;MAmBA,SAAA;EA3BG;;;;;;EAAA,IAyCH,YAAA;EAOS;;;EAAA,OAAN,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,SAAA,EAAW,IAAA,EAAM,QAAA,YAAiB,OAAA,CAAA,WAAA;EAAjB;;;EAAA,OAalD,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,WAAA;EAAxB;;;EAAA,OAOZ,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA,WAAa,OAAA;EAAnB;;;EAAA,OAOpB,gBAAA,CAAiB,IAAA,EAAM,IAAA,GAAI,OAAA;EAA3B;;;;;EAAA,OASM,4BAAA,CAA6B,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA;EAA/B;;;;EAAA,OAS7B,YAAA,IAAgB,OAAA;EAqBhB;;;;;;;AAWyC;;;;EAXzC,OAAA,iBAAA,IAAqB,OAAA,CAAQ,WAAA;;;;;;SAW7B,kBAAA,IAAsB,OAAA,CAAQ,WAAA;AAAA"}
+{"version":3,"file":"access-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/access-token/access-token.model.ts"],"mappings":";;;;;;;;;;;qBAaa,8CAAiB;;;;;;;;;;;;;;;;;;;;qBAmBjB,oBAAoB;SACjB;SAEA,mCAAM;;;;;;;;;;;;;;;;SAQN;;;;;;;;SASA;;MAGH;;MAKA;;;;;;;;;;;;;;;;MAmBA;;;;;;;MAcA;;;;SAOG,MAAM,MAAM,MAAM,eAAe,WAAW,MAAM,oBAAiB,QAAA;;;;SAanE,YAAY,gBAAgB,QAAQ;;;;SAOpC,cAAc,MAAM,MAAM,gBAAa;;;;SAOvC,iBAAiB,MAAM,OAAI;;;;;;SASrB,6BAA6B,MAAM,MAAM,mBAAmB;;;;;SAS5D,gBAAgB;;;;;;;;;;;;SAqBhB,qBAAqB,QAAQ;;;;;;SAW7B,sBAAsB,QAAQ"}

package/esm/models/access-token/index.d.mts

@@ -1 +1,2 @@
-import { AccessToken, accessTokenSchema } from "./access-token.model.mjs";
+import { AccessToken, accessTokenSchema } from "./access-token.model.mjs";
+export { AccessToken, accessTokenSchema };

package/esm/models/access-token/index.mjs

@@ -1,3 +1,3 @@
 import { AccessToken, accessTokenSchema } from "./access-token.model.mjs";
 
-export {  };
+export { AccessToken, accessTokenSchema };

package/esm/models/auth-token-family/auth-token-family.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/auth-token-family/auth-token-family.model.d.ts
 /** Durable revision authority for one refresh-token rotation family. */
-declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<{
   family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
   user_type: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -15,7 +14,7 @@ declare const authTokenFamilySchema: import("@warlock.js/seal").ObjectValidator<
   };
 }>;
 /** Coordinates family-wide refresh, replay containment, and logout transitions. */
-declare class AuthTokenFamily extends Model {
+export declare class AuthTokenFamily extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     family_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -46,5 +45,4 @@ declare class AuthTokenFamily extends Model {
   static revoke(familyId: string, expectedRevision: number): Promise<number>;
 }
 //#endregion
-export { AuthTokenFamily, authTokenFamilySchema };
 //# sourceMappingURL=auth-token-family.model.d.mts.map

package/esm/models/auth-token-family/auth-token-family.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;qGAMhC,IAAA,EAAA,IAAA;;;;;cAGW,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;MAGT,SAAA;EANA;EAAA,OAWG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,QAAA,WAAgB,OAAA,CAAA,eAAA;EAAA,OASlC,cAAA,CAAe,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAKpC,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA,CAAQ,eAAA;EAdxC;EAAA,OA8CZ,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,eAAA;EA9CG;;;;EAAA,OAwDlC,eAAA,CAAgB,QAAA,UAAkB,gBAAA,WAA2B,OAAA;EA1CjB;EAAA,OAkD5C,MAAA,CAAO,QAAA,UAAkB,gBAAA,WAA2B,OAAA;AAAA"}
+{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;qBAKa,kDAAqB;;;;;;;;;;;;qBASrB,wBAAwB;SACrB;SAEA,mCAAM;;;;;;;;;;;;MAGT;;SAKG,MAAM,MAAM,MAAM,mBAAgB,QAAA;SASlC,eAAe,mBAAmB,QAAQ;;SAKpC,OAAO,MAAM,MAAM,mBAAmB,QAAQ;;SAgCpD,UAAU,MAAM,OAAO,QAAQ;;;;;SAU/B,gBAAgB,kBAAkB,2BAA2B;;SAQ7D,OAAO,kBAAkB,2BAA2B"}

package/esm/models/auth-token-family/index.d.mts

@@ -1 +1,2 @@
-import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
+import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
+export { AuthTokenFamily, authTokenFamilySchema };

package/esm/models/auth-token-family/index.mjs

@@ -1,3 +1,3 @@
 import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family.model.mjs";
 
-export {  };
+export { AuthTokenFamily, authTokenFamilySchema };

package/esm/models/auth.model.d.mts

@@ -2,9 +2,8 @@ import { AccessTokenOutput, DeviceInfo, TokenPair } from "../contracts/types.mjs
 import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
 import { Authenticable } from "../contracts/auth-contract.mjs";
 import { ChildModel, Model, ModelSchema } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/auth.model.d.ts
-declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Model<Schema> implements Authenticable {
+export declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Model<Schema> implements Authenticable {
   /**
    * Get user type
    */
@@ -55,5 +54,4 @@ declare abstract class Auth<Schema extends ModelSchema = ModelSchema> extends Mo
   confirmPassword(password: string): Promise<boolean>;
 }
 //#endregion
-export { Auth };
 //# sourceMappingURL=auth.model.d.mts.map

package/esm/models/auth.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/auth.model.ts"],"mappings":";;;;;;uBAMsB,IAAA,gBAAoB,WAAA,GAAc,WAAA,UAC9C,KAAA,CAAM,MAAA,aACH,aAAA;;AAFb;;eAOsB,QAAA;EAPoB;;;EAYjC,kBAAA,IAAkB,MAAA;EAOiB;;;EAA7B,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAOjB;;;EAAjC,mBAAA,CAAoB,IAAA,SAAa,OAAA,CAAQ,iBAAA;EAcP;;;EAPlC,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAmC7B;;;EA5B1B,iBAAA,CAAkB,KAAA,WAAgB,OAAA;EAmCyB;;;EA5B3D,kBAAA,CAAmB,KAAA,WAAgB,OAAA;EA7CrC;;;EAoDE,qBAAA,IAAyB,OAAA;EAtDE;;;EA6D3B,eAAA,IAAmB,OAAA;EA3DrB;;;EAkEE,cAAA,IAAkB,OAAA,CAAQ,YAAA;EAjD1B;;;EAAA,OAwDO,OAAA,CAAQ,IAAA,EAAM,UAAA,CAAW,IAAA,GAAO,IAAA,QAAY,OAAA,CAAQ,IAAA;EAxDT;;;EA+DlD,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth.model.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/auth.model.ts"],"mappings":";;;;;8BAMsB,KAAK,eAAe,cAAc,qBAC9C,MAAM,mBACH;;;;eAKS;;;;EAKb,sBAAkB;;;;EAOZ,gBAAgB,aAAa,aAAa,QAAQ;;;;EAOlD,oBAAoB,aAAa,QAAQ;;;;EAOzC,qBAAqB,aAAa,aAAa,QAAQ;;;;EAOvD,kBAAkB,gBAAgB;;;;EAOlC,mBAAmB,gBAAgB;;;;EAOnC,yBAAyB;;;;EAOzB,mBAAmB;;;;EAOnB,kBAAkB,QAAQ;;;;SAOnB,QAAQ,MAAM,WAAW,OAAO,YAAY,QAAQ;;;;EAO3D,gBAAgB,mBAAmB"}

package/esm/models/index.d.mts

@@ -1,12 +1,18 @@
 import { Auth } from "./auth.model.mjs";
 import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
+import "./access-token/index.mjs";
 import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token/one-time-token.model.mjs";
+import "./one-time-token/index.mjs";
+import "./refresh-token/index.mjs";
 import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import { AuthTokenFamily, authTokenFamilySchema } from "./auth-token-family/auth-token-family.model.mjs";
+import "./auth-token-family/index.mjs";
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential/passkey-credential.model.mjs";
+import "./passkey-credential/index.mjs";
 import { ProviderAccount, providerAccountSchema } from "./provider-account/provider-account.model.mjs";
+import "./provider-account/index.mjs";
 //#region ../../packages/auth/src/models/index.d.ts
-declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
+export declare const authMigrations: import("@warlock.js/cascade").MigrationConstructor[];
 //#endregion
-export { authMigrations };
+export { AccessToken, Auth, AuthTokenFamily, OneTimeToken, OneTimeTokenPurpose, PasskeyCredential, ProviderAccount, RefreshToken, RefreshTokenIssueOptions, accessTokenSchema, authTokenFamilySchema, oneTimeTokenSchema, passkeyCredentialSchema, providerAccountSchema, refreshTokenSchema };
 //# sourceMappingURL=index.d.mts.map

package/esm/models/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"mappings":";;;;;;;;cAiBa,cAAA,gCAAc,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/models/index.ts"],"mappings":";;;;;;;;;;;;;;qBAiBa,8CAAc"}

package/esm/models/index.mjs

@@ -33,5 +33,5 @@ const authMigrations = [
 ];
 
 //#endregion
-export { authMigrations };
+export { AccessToken, Auth, AuthTokenFamily, OneTimeToken, PasskeyCredential, ProviderAccount, RefreshToken, accessTokenSchema, authMigrations, authTokenFamilySchema, oneTimeTokenSchema, passkeyCredentialSchema, providerAccountSchema, refreshTokenSchema };
 //# sourceMappingURL=index.mjs.map

package/esm/models/one-time-token/index.d.mts

@@ -1 +1,2 @@
-import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+import { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema } from "./one-time-token.model.mjs";
+export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };

package/esm/models/one-time-token/index.mjs

@@ -1,3 +1,3 @@
 import { OneTimeToken, oneTimeTokenSchema } from "./one-time-token.model.mjs";
 
-export {  };
+export { OneTimeToken, oneTimeTokenSchema };

package/esm/models/one-time-token/one-time-token.model.d.mts

@@ -1,14 +1,13 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/one-time-token/one-time-token.model.d.ts
 /** What a one-time token may be used for. A token only ever satisfies its own purpose. */
-type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
+export type OneTimeTokenPurpose = "email-verification" | "password-reset" | "otp" | "passkey-registration" | "passkey-authentication";
 /**
  * Seal schema for the persisted one-time token. Exported so an override can
  * extend it (e.g. a tenant key).
  */
-declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
   token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   purpose: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean> & {
@@ -34,7 +33,7 @@ declare const oneTimeTokenSchema: import("@warlock.js/seal").ObjectValidator<{
  * enforced by {@link consumeIfActive}, a conditional update in the same shape
  * as `RefreshToken.revokeIfActive`. Override via `config.auth.oneTimeToken.model`.
  */
-declare class OneTimeToken extends Model {
+export declare class OneTimeToken extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     token_hash: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -111,5 +110,4 @@ declare class OneTimeToken extends Model {
   static invalidateActiveFor(user: Auth, purpose: OneTimeTokenPurpose): Promise<number>;
 }
 //#endregion
-export { OneTimeToken, OneTimeTokenPurpose, oneTimeTokenSchema };
 //# sourceMappingURL=one-time-token.model.d.mts.map

package/esm/models/one-time-token/one-time-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;;KAMY,mBAAA;AAAZ;;;;AAAA,cAWa,kBAAA,6BAAkB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAoBlB,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;SAON,MAAA;EAqDH;;;;;;EAAA,OA7CG,cAAA;EAoED;EAAA,IAjEF,MAAA;EAgFH;EAAA,IA3EG,QAAA;EA6EA;EAAA,IAxEA,UAAA;EAoF8B;EAAA,IA/E9B,SAAA;EAmHA;;;;;EAtGE,eAAA,IAAmB,OAAA;EAjDA;EAAA,OA6DlB,KAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,GAAI,OAAA,CAAA,YAAA;EAjEoB;;;;EAAA,OAkFvB,cAAA,CACZ,OAAA,EAAS,mBAAA,EACT,SAAA,UACA,SAAA,EAAW,IAAA,EACX,IAAA,GAAO,IAAA,GAAI,OAAA,CAAA,YAAA;;SAcC,aAAA,CACZ,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;;EAYE,aAAA,CAAc,GAAA,WAAc,OAAA;;;;;;;SAmBrB,UAAA,IAAc,OAAA;;SAepB,UAAA,CACZ,SAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,YAAA;;;;;SAQG,mBAAA,CAAoB,IAAA,EAAM,IAAA,EAAM,OAAA,EAAS,mBAAA,GAAsB,OAAA;AAAA"}
+{"version":3,"file":"one-time-token.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/one-time-token/one-time-token.model.ts"],"mappings":";;;;YAMY;;;;;qBAWC,+CAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;qBAoBlB,qBAAqB;SAClB;SAEA,mCAAM;;;;;;;;;;;;;;;;;;;;;;SAON;;;;;;;SAQA;;MAGH;;MAKA;;MAKA;;MAKA;;;;;;EAaE,mBAAmB;;SAYlB,MACZ,MAAM,MACN,SAAS,qBACT,mBACA,WAAW,OAAI,QAAA;;;;;SAiBH,eACZ,SAAS,qBACT,mBACA,WAAW,MACX,OAAO,OAAI,QAAA;;SAcC,cACZ,MAAM,MACN,SAAS,sBACR,QAAQ;;;;;;EAYE,cAAc,cAAc;;;;;;;SAmBrB,cAAc;;SAepB,WACZ,mBACA,SAAS,sBACR,QAAQ;;;;;SAQG,oBAAoB,MAAM,MAAM,SAAS,sBAAsB"}

package/esm/models/passkey-credential/index.d.mts

@@ -1 +1,2 @@
-import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
+export { PasskeyCredential, passkeyCredentialSchema };

package/esm/models/passkey-credential/index.mjs

@@ -1,3 +1,3 @@
 import { PasskeyCredential, passkeyCredentialSchema } from "./passkey-credential.model.mjs";
 
-export {  };
+export { PasskeyCredential, passkeyCredentialSchema };

package/esm/models/passkey-credential/passkey-credential.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/passkey-credential/passkey-credential.model.d.ts
 /** Seal schema for a stored passkey. Exported so an override can extend it. */
-declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidator<{
   credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   public_key: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   counter: import("@warlock.js/seal").IntValidator & import("@warlock.js/seal").StandardSchemaV1<number, number>;
@@ -20,7 +19,7 @@ declare const passkeyCredentialSchema: import("@warlock.js/seal").ObjectValidato
  * base64url; `counter` is the last signature counter seen, which an
  * authentication must advance (a clone detector).
  */
-declare class PasskeyCredential extends Model {
+export declare class PasskeyCredential extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     credential_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -60,5 +59,4 @@ declare class PasskeyCredential extends Model {
   advanceCounter(expected: number, newCounter: number): Promise<boolean>;
 }
 //#endregion
-export { PasskeyCredential, passkeyCredentialSchema };
 //# sourceMappingURL=passkey-credential.model.d.mts.map

package/esm/models/passkey-credential/passkey-credential.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;;cAKa,uBAAA,6BAAuB,eAAA;;;;;;;;;;;;;;;;;cAcvB,iBAAA,SAA0B,KAAA;EAAA,OACvB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;EAHS;;;;;;EAAA,OAWf,cAAA;EAoCqD;EAAA,IAjCxD,YAAA;EAd+B;EAAA,IAmB/B,OAAA;EAnB0B;EAAA,IAwB1B,MAAA;EArBG;EAAA,IA0BH,QAAA;;SAKG,kBAAA,CAAmB,YAAA,WAAuB,OAAA,CAAQ,iBAAA;;SAKlD,OAAA,CAAQ,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,iBAAA;;;;;EAQ9B,cAAA,CAAe,QAAA,UAAkB,UAAA,WAAqB,OAAA;AAAA"}
+{"version":3,"file":"passkey-credential.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/passkey-credential/passkey-credential.model.ts"],"mappings":";;;;qBAKa,oDAAuB;;;;;;;;;;;;;;;;;qBAcvB,0BAA0B;SACvB;SAEA,mCAAM;;;;;;;;;;;;;;;;;;SAQN;;MAGH;;MAKA;;MAKA;;MAKA;;SAKG,mBAAmB,uBAAuB,QAAQ;;SAKlD,QAAQ,MAAM,OAAO,QAAQ;;;;;EAQ9B,eAAe,kBAAkB,qBAAqB"}

package/esm/models/provider-account/index.d.mts

@@ -1 +1,2 @@
-import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
+export { ProviderAccount, providerAccountSchema };

package/esm/models/provider-account/index.mjs

@@ -1,3 +1,3 @@
 import { ProviderAccount, providerAccountSchema } from "./provider-account.model.mjs";
 
-export {  };
+export { ProviderAccount, providerAccountSchema };

package/esm/models/provider-account/provider-account.model.d.mts

@@ -1,9 +1,8 @@
 import { Auth } from "../auth.model.mjs";
 import { Model } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/models/provider-account/provider-account.model.d.ts
 /** Seal schema for a provider link. Exported so an override can extend it. */
-declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
+export declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<{
   provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   provider_user_id: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
   user_id: import("@warlock.js/seal").ScalarValidator & import("@warlock.js/seal").StandardSchemaV1<string | number | boolean, string | number | boolean>;
@@ -18,7 +17,7 @@ declare const providerAccountSchema: import("@warlock.js/seal").ObjectValidator<
  * a user is created for it; afterwards the link alone resolves the user, so a
  * later email change at the provider cannot move the login to another account.
  */
-declare class ProviderAccount extends Model {
+export declare class ProviderAccount extends Model {
   static table: string;
   static schema: import("@warlock.js/seal").ObjectValidator<{
     provider: import("@warlock.js/seal").StringValidator & import("@warlock.js/seal").StandardSchemaV1<string, string>;
@@ -39,5 +38,4 @@ declare class ProviderAccount extends Model {
   static link(provider: string, providerUserId: string, user: Auth, email?: string): Promise<ProviderAccount>;
 }
 //#endregion
-export { ProviderAccount, providerAccountSchema };
 //# sourceMappingURL=provider-account.model.d.mts.map

package/esm/models/provider-account/provider-account.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;cAcrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;MAGT,MAAA;EAaR;EAAA,IARQ,QAAA;EAa4E;EAAA,OARzE,QAAA,CACZ,QAAA,UACA,cAAA,WACC,OAAA,CAAQ,eAAA;EAnBwB;EAAA,OAwBrB,IAAA,CAAK,QAAA,UAAkB,cAAA,UAAwB,IAAA,EAAM,IAAA,EAAM,KAAA,YAAc,OAAA,CAAA,eAAA;AAAA"}
+{"version":3,"file":"provider-account.model.d.mts","names":[],"sources":["../../../../../../../../../packages/auth/src/models/provider-account/provider-account.model.ts"],"mappings":";;;;qBAKa,kDAAqB;;;;;;;;;;;;;;;qBAcrB,wBAAwB;SACrB;SAEA,mCAAM;;;;;;;;;;MAGT;;MAKA;;SAKG,SACZ,kBACA,yBACC,QAAQ;;SAKG,KAAK,kBAAkB,wBAAwB,MAAM,MAAM,iBAAc,QAAA"}

package/esm/models/refresh-token/index.d.mts

@@ -1 +1,2 @@
-import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token.model.mjs";
+import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token.model.mjs";
+export { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema };