@warlock.js/auth 5.31.0 → 5.32.0

package/esm/services/one-time-tokens.d.mts

@@ -1,15 +1,16 @@
 import { Auth } from "../models/auth.model.mjs";
 import { OneTimeToken, OneTimeTokenPurpose } from "../models/one-time-token/one-time-token.model.mjs";
+import "../models/one-time-token/index.mjs";
 //#region ../../packages/auth/src/services/one-time-tokens.d.ts
 /** The raw token handed to the notification, with its expiry. */
-type IssuedOneTimeToken = {
+export type IssuedOneTimeToken = {
   token: string;
   expiresAt: Date;
 };
 /** Resolve the active one-time-token model — the default or `auth.oneTimeToken.model`. */
-declare function oneTimeTokenModel(): typeof OneTimeToken;
+export declare function oneTimeTokenModel(): typeof OneTimeToken;
 /** SHA-256 hex digest of a raw one-time token — the only form ever persisted. */
-declare function hashOneTimeToken(token: string): string;
+export declare function hashOneTimeToken(token: string): string;
 /**
  * Create and persist a one-time token for the user: 32 random bytes,
  * base64url-encoded. Only the hash reaches storage.
@@ -17,7 +18,7 @@ declare function hashOneTimeToken(token: string): string;
  * @param invalidatePrevious - consume the user's still-unused tokens of the
  *   same purpose first (password reset: only the newest link works).
  */
-declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, expiresInMs: number, invalidatePrevious?: boolean): Promise<IssuedOneTimeToken>;
+export declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, expiresInMs: number, invalidatePrevious?: boolean): Promise<IssuedOneTimeToken>;
 /**
  * Consume a raw one-time token of the given purpose and resolve its user.
  *
@@ -26,7 +27,6 @@ declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, exp
  * The consume is a conditional update, so of N concurrent callers exactly one
  * proceeds.
  */
-declare function consumeOneTimeToken(rawToken: string, purpose: OneTimeTokenPurpose): Promise<Auth>;
+export declare function consumeOneTimeToken(rawToken: string, purpose: OneTimeTokenPurpose): Promise<Auth>;
 //#endregion
-export { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel };
 //# sourceMappingURL=one-time-tokens.d.mts.map

package/esm/services/one-time-tokens.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"one-time-tokens.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/one-time-tokens.ts"],"mappings":";;;;KAOY,kBAAA;EACV,KAAA;EACA,SAAA,EAAW,IAAI;AAAA;;iBAID,iBAAA,WAA4B,YAAY;;iBAKxC,gBAAA,CAAiB,KAAa;;;AAT7B;AAIjB;;;;iBAgBsB,iBAAA,CACpB,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,WAAA,UACA,kBAAA,aACC,OAAA,CAAQ,kBAAA;AAhBX;;;;AAA8C;AAW9C;;;AAXA,iBAuCsB,mBAAA,CACpB,QAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,IAAA"}
+{"version":3,"file":"one-time-tokens.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/one-time-tokens.ts"],"mappings":";;;;;YAOY;EACV;EACA,WAAW;;;wBAIG,4BAA4B;;wBAK5B,iBAAiB;;;;;;;;wBAWX,kBACpB,MAAM,MACN,SAAS,qBACT,qBACA,+BACC,QAAQ;;;;;;;;;wBAuBW,oBACpB,kBACA,SAAS,sBACR,QAAQ"}

package/esm/services/password-reset.d.mts

@@ -1,6 +1,5 @@
 import { Auth } from "../models/auth.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/services/password-reset.d.ts
 /**
  * Start a password reset for the account whose `auth.passwordReset.identifierField`
@@ -17,7 +16,7 @@ import { ChildModel } from "@warlock.js/cascade";
  * await requestPasswordReset(User, request.input("email"));
  * return response.success({ message: "If the account exists, we sent a reset link." });
  */
-declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, identifier: string): Promise<void>;
+export declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, identifier: string): Promise<void>;
 /**
  * Complete a password reset: consume the token, store the new password, then
  * revoke every access token, refresh token and cookie session the user holds
@@ -28,7 +27,6 @@ declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, iden
  * @throws InvalidOneTimeTokenError for an unknown, verification-purpose,
  *   expired, superseded or already-used token.
  */
-declare function resetPassword(token: string, newPassword: string): Promise<Auth>;
+export declare function resetPassword(token: string, newPassword: string): Promise<Auth>;
 //#endregion
-export { requestPasswordReset, resetPassword };
 //# sourceMappingURL=password-reset.d.mts.map

package/esm/services/password-reset.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/password-reset.ts"],"mappings":";;;;;;AAwDA;;;;;;;;;;;;;iBAAsB,oBAAA,WAA+B,IAAA,EACnD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,UAAA,WACC,OAAA;;;;AAAO;AAmCV;;;;;;iBAAsB,aAAA,CAAc,KAAA,UAAe,WAAA,WAAsB,OAAO,CAAC,IAAA"}
+{"version":3,"file":"password-reset.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/password-reset.ts"],"mappings":";;;;;;;;;;;;;;;;;;wBAwDsB,qBAAqB,UAAU,MACnD,OAAO,WAAW,IAClB,qBACC;;;;;;;;;;;wBAmCmB,cAAc,eAAe,sBAAsB,QAAQ"}

package/esm/services/resolve-request-user.d.mts

@@ -1,22 +1,28 @@
 import { CookieDomainResolver, TokenFrom } from "../contracts/types.mjs";
 import { Request, Response } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/services/resolve-request-user.d.ts
-type ResolveRequestUserOptions = {
-  /** Where the access token is read from. Defaults to `"header"`. */tokenFrom?: TokenFrom; /** Refresh credential source; enables one automatic renewal per call. */
-  refreshCredential?: TokenFrom; /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */
-  overlapMs?: number; /** User types allowed to pass. Empty means any authenticated type. */
-  allowedTypes?: string[]; /** Absolute family lifetime in ms; rotation never extends a family past it. */
-  maxAgeMs?: number; /** The single user type a renewal mints for. Required for renewal. */
-  renewalUserType?: string; /** Select a request-scoped Domain for renewed cookies. */
+export type ResolveRequestUserOptions = {
+  /** Where the access token is read from. Defaults to `"header"`. */
+  tokenFrom?: TokenFrom;
+  /** Refresh credential source; enables one automatic renewal per call. */
+  refreshCredential?: TokenFrom;
+  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */
+  overlapMs?: number;
+  /** User types allowed to pass. Empty means any authenticated type. */
+  allowedTypes?: string[];
+  /** Absolute family lifetime in ms; rotation never extends a family past it. */
+  maxAgeMs?: number;
+  /** The single user type a renewal mints for. Required for renewal. */
+  renewalUserType?: string;
+  /** Select a request-scoped Domain for renewed cookies. */
   cookieDomain?: CookieDomainResolver;
 };
 /**
  * Why a request did not resolve to a user. The middleware maps each reason to
  * its own response; `resolveRequestUser` collapses them all to `null`.
  */
-type RequestUserFailure = "missing" | "invalid" | "forbidden" | "unauthorized";
-type RequestUserOutcome<TUser = any> = {
+export type RequestUserFailure = "missing" | "invalid" | "forbidden" | "unauthorized";
+export type RequestUserOutcome<TUser = any> = {
   user: TUser;
   failure?: undefined;
 } | {
@@ -24,7 +30,7 @@ type RequestUserOutcome<TUser = any> = {
   failure: RequestUserFailure;
 };
 /** Read one credential (access or refresh) from the header or a cookie. */
-declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
+export declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
 /**
  * Resolve a request's credential to a user, reporting WHY it failed.
  *
@@ -36,7 +42,7 @@ declare function readCredential(request: Request, tokenFrom: TokenFrom): string;
  * At most one renewal is attempted per call. The renewed access token is
  * checked through the same path; no handler or unsafe request replay happens.
  */
-declare function resolveRequestUserOutcome(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<RequestUserOutcome>;
+export declare function resolveRequestUserOutcome(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<RequestUserOutcome>;
 /**
  * Resolve the request's credential to its user model, or `null` when there is
  * none (missing, invalid, expired, wrong type, or not allowed to authenticate).
@@ -44,7 +50,6 @@ declare function resolveRequestUserOutcome(request: Request, response: Response,
  * Includes the middleware's automatic renewal when `options.refreshCredential`
  * is set. Use `resolveRequestUserOutcome` when the failure reason matters.
  */
-declare function resolveRequestUser(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<any>;
+export declare function resolveRequestUser(request: Request, response: Response, options?: ResolveRequestUserOptions): Promise<any>;
 //#endregion
-export { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome };
 //# sourceMappingURL=resolve-request-user.d.mts.map

package/esm/services/resolve-request-user.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"mappings":";;;;KAgBY,yBAAA;qEAEV,SAAA,GAAY,SAAA,EAFuB;EAInC,iBAAA,GAAoB,SAAA,EAFR;EAIZ,SAAA,WAQe;EANf,YAAA,aAMmC;EAJnC,QAAA,WARY;EAUZ,eAAA,WARoB;EAUpB,YAAA,GAAe,oBAAA;AAAA;;;;;KAOL,kBAAA;AAAA,KAEA,kBAAA;EACN,IAAA,EAAM,KAAA;EAAO,OAAA;AAAA;EACb,IAAA;EAAY,OAAA,EAAS,kBAAkB;AAAA;;iBAoB7B,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,SAAS;;;;;;;;;;AApBxB;AAoB7C;iBAqBsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,kBAAA;;;;;;;;iBAmHK,kBAAA,CACd,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA"}
+{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/resolve-request-user.ts"],"mappings":";;;YAgBY;;EAEV,YAAY;;EAEZ,oBAAoB;;EAEpB;;EAEA;;EAEA;;EAEA;;EAEA,eAAe;;;;;;YAOL;YAEA,mBAAmB;EACzB,MAAM;EAAO;;EACb;EAAY,SAAS;;;wBAoBX,eAAe,SAAS,SAAS,WAAW;;;;;;;;;;;;wBAqBtC,0BACpB,SAAS,SACT,UAAU,UACV,UAAS,4BACR,QAAQ;;;;;;;;wBAmHK,mBACd,SAAS,SACT,UAAU,UACV,UAAS,4BACR"}

package/esm/services/token-family-operation.mjs

@@ -70,5 +70,5 @@ async function runTokenFamilyOperation(familyId, operation) {
 }
 
 //#endregion
-export { TokenFamilyUnavailableError, afterTokenFamilyOperation, runTokenFamilyOperation };
+export { TokenFamilyConflictError, TokenFamilyUnavailableError, afterTokenFamilyOperation, runTokenFamilyOperation };
 //# sourceMappingURL=token-family-operation.mjs.map

package/esm/session/index.d.mts

@@ -1 +1,2 @@
-import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./page-session.mjs";
+import { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware } from "./page-session.mjs";
+export { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware };

package/esm/session/index.mjs

@@ -1,3 +1,3 @@
 import { pageSession, sessionMiddleware } from "./page-session.mjs";
 
-export {  };
+export { pageSession, sessionMiddleware };

package/esm/session/page-session.d.mts

@@ -1,35 +1,44 @@
 import { CookieDomainResolver } from "../contracts/types.mjs";
 import { Middleware, Request, Response } from "@warlock.js/core";
-
 //#region ../../packages/auth/src/session/page-session.d.ts
 /** Credential sources a session can be read from. */
-type SessionSource = "cookie" | "header";
+export type SessionSource = "cookie" | "header";
 /**
  * The seam web consumes. Declared here, not imported: web and auth never
  * depend on each other, and `pageSession()` satisfies web's `SessionResolver`
  * structurally.
  */
-type PageSessionResolver<TModel = unknown, TUser = unknown> = {
+export type PageSessionResolver<TModel = unknown, TUser = unknown> = {
   resolve(request: Request, response: Response): Promise<{
     model: TModel;
     user: TUser;
   } | null>;
 };
-type SessionResolverOptions = {
-  /** Access cookie name. @default auth.cookie.name */cookie?: string; /** Refresh cookie name. @default auth.cookie.refreshName */
-  refreshCookie?: string; /** Credential sources. A present Authorization header always wins. @default ["cookie", "header"] */
-  sources?: SessionSource[]; /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */
-  renew?: boolean; /** Allowed user types. @default auth.defaultUserType */
-  userTypes?: string | string[]; /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else "30d" */
-  maxAge?: string | number; /** Refresh overlap window forwarded to renewal. */
-  overlapMs?: number; /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */
+export type SessionResolverOptions = {
+  /** Access cookie name. @default auth.cookie.name */
+  cookie?: string;
+  /** Refresh cookie name. @default auth.cookie.refreshName */
+  refreshCookie?: string;
+  /** Credential sources. A present Authorization header always wins. @default ["cookie", "header"] */
+  sources?: SessionSource[];
+  /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */
+  renew?: boolean;
+  /** Allowed user types. @default auth.defaultUserType */
+  userTypes?: string | string[];
+  /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else "30d" */
+  maxAge?: string | number;
+  /** Refresh overlap window forwarded to renewal. */
+  overlapMs?: number;
+  /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */
   cookieDomain?: CookieDomainResolver;
 };
-type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {
-  /** Model → wire projection. Required: a model never crosses the wire by default. */project: (model: TModel) => TUser | Promise<TUser>;
+export type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {
+  /** Model → wire projection. Required: a model never crosses the wire by default. */
+  project: (model: TModel) => TUser | Promise<TUser>;
 };
-type SessionMiddlewareOptions = SessionResolverOptions & {
-  /** Let guests through with no user instead of a 401. @default false */optional?: boolean;
+export type SessionMiddlewareOptions = SessionResolverOptions & {
+  /** Let guests through with no user instead of a 401. @default false */
+  optional?: boolean;
 };
 /**
  * Session resolver for pages: cookie-or-header credential, reactive renewal,
@@ -38,14 +47,13 @@ type SessionMiddlewareOptions = SessionResolverOptions & {
  * @example
  * export default { session: pageSession({ project: (user: User) => userResource(user) }) };
  */
-declare function pageSession<TModel = any, TUser = unknown>(options: PageSessionOptions<TModel, TUser>): PageSessionResolver<TModel, TUser>;
+export declare function pageSession<TModel = any, TUser = unknown>(options: PageSessionOptions<TModel, TUser>): PageSessionResolver<TModel, TUser>;
 /**
  * Middleware for cookie API routes over the same resolver as `pageSession`.
  * A cookie-authenticated unsafe request must pass the Origin/Referer check
  * (renewal can mint cookies, so it runs even when the access cookie is gone).
  * Guests get a 401 unless `optional`. The user lands on `request.locals.user`.
  */
-declare function sessionMiddleware(options?: SessionMiddlewareOptions): Middleware;
+export declare function sessionMiddleware(options?: SessionMiddlewareOptions): Middleware;
 //#endregion
-export { PageSessionOptions, PageSessionResolver, SessionMiddlewareOptions, SessionResolverOptions, SessionSource, pageSession, sessionMiddleware };
 //# sourceMappingURL=page-session.d.mts.map

package/esm/session/page-session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/session/page-session.ts"],"mappings":";;;;;KAcY,aAAA;AAAZ;;;;AAAyB;AAAzB,KAUY,mBAAA;EACV,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAA,GAAW,OAAA;IAAU,KAAA,EAAO,MAAA;IAAQ,IAAA,EAAM,KAAA;EAAA;AAAA;AAAA,KAGpE,sBAAA;EAHqC,oDAK/C,MAAA,WALsD;EAOtD,aAAA,WARgD;EAUhD,OAAA,GAAU,aAAA,IATO;EAWjB,KAAA,YAXoC;EAapC,SAAA,sBAb+C;EAe/C,MAAA,oBAfgE;EAiBhE,SAAA,WAjB8E;EAmB9E,YAAA,GAAe,oBAAoB;AAAA;AAAA,KAGzB,kBAAA,kBAAoC,sBAAA;EAnBd,oFAqBhC,OAAA,GAAU,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAA,CAAQ,KAAA;AAAA;AAAA,KAGlC,wBAAA,GAA2B,sBAAsB;EApB3D,uEAsBA,QAAQ;AAAA;;;;;;;;iBAgFM,WAAA,gCACd,OAAA,EAAS,kBAAA,CAAmB,MAAA,EAAQ,KAAA,IACnC,mBAAA,CAAoB,MAAA,EAAQ,KAAA;AAzF/B;;;;;;AAAA,iBA4HgB,iBAAA,CAAkB,OAAA,GAAS,wBAAA,GAAgC,UAAU"}
+{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/session/page-session.ts"],"mappings":";;;;YAcY;;;;;;YAUA,oBAAoB,kBAAkB;EAChD,QAAQ,SAAS,SAAS,UAAU,WAAW;IAAU,OAAO;IAAQ,MAAM;;;YAGpE;;EAEV;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA,eAAe;;YAGL,mBAAmB,QAAQ,SAAS;;EAE9C,UAAU,OAAO,WAAW,QAAQ,QAAQ;;YAGlC,2BAA2B;;EAErC;;;;;;;;;wBAgFc,YAAY,cAAc,iBACxC,SAAS,mBAAmB,QAAQ,SACnC,oBAAoB,QAAQ;;;;;;;wBAmCf,kBAAkB,UAAS,2BAAgC"}

package/esm/utils/auth-error-codes.d.mts

@@ -1,30 +1,26 @@
 //#region ../../packages/auth/src/utils/auth-error-codes.d.ts
-declare enum AuthErrorCodes {
+export declare enum AuthErrorCodes {
   /**
    * Missing Access Token Error Code EC001
    * EC001 = Missing Access Token
    */
-  MissingAccessToken = "EC001",
-  // Error Code 001
+  MissingAccessToken = "EC001", // Error Code 001
   /**
    * Invalid Access Token Error Code EC002
    * EC002 = Invalid Access Token
    */
-  InvalidAccessToken = "EC002",
-  // Error Code 002
+  InvalidAccessToken = "EC002", // Error Code 002
   /**
    * Unauthorized Error Code EC003
    * EC003 = Unauthorized
    */
-  Unauthorized = "EC003",
-  // Error Code 003
+  Unauthorized = "EC003", // Error Code 003
   /**
    * Too Many Attempts Error Code EC004
    * EC004 = Too Many Attempts — issued by the login-throttle middleware once
    * a per-account or per-IP failure counter trips its threshold.
    */
-  TooManyAttempts = "EC004",
-  // Error Code 004
+  TooManyAttempts = "EC004", // Error Code 004
   /**
    * Invalid Token Type Error Code EC005
    * EC005 = Invalid Token Type — the token's `tokenType` claim does not match
@@ -33,8 +29,7 @@ declare enum AuthErrorCodes {
    * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can
    * classify it as a credential failure without matching on the message.
    */
-  InvalidTokenType = "EC005",
-  // Error Code 005
+  InvalidTokenType = "EC005", // Error Code 005
   /**
    * CSRF Origin Mismatch Error Code EC006
    * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)
@@ -42,38 +37,33 @@ declare enum AuthErrorCodes {
    * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose
    * request carried neither header at all.
    */
-  CsrfOriginMismatch = "EC006",
-  // Error Code 006
+  CsrfOriginMismatch = "EC006", // Error Code 006
   /**
    * Email Not Verified Error Code EC007
    * EC007 = the authenticated user has not verified their email address —
    * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).
    */
-  EmailNotVerified = "EC007",
-  // Error Code 007
+  EmailNotVerified = "EC007", // Error Code 007
   /**
    * Invalid One-Time Token Error Code EC008
    * EC008 = an email-verification or password-reset token that is unknown,
    * issued for the other purpose, expired, or already used. One code for all
    * four on purpose: the caller learns nothing about which it was.
    */
-  InvalidOneTimeToken = "EC008",
-  // Error Code 008
+  InvalidOneTimeToken = "EC008", // Error Code 008
   /**
    * Invalid Provider Callback Error Code EC009
    * EC009 = a redirect-provider callback was rejected: missing, forged or
    * expired state cookie, `state` mismatch, failed code exchange, or an
    * id_token with a bad signature, issuer, audience, expiry or nonce.
    */
-  InvalidProviderCallback = "EC009",
-  // Error Code 009
+  InvalidProviderCallback = "EC009", // Error Code 009
   /**
    * Provider Email Not Verified Error Code EC010
    * EC010 = the provider did not verify the email, so auth refused to link or
    * create an account from it.
    */
-  ProviderEmailNotVerified = "EC010",
-  // Error Code 010
+  ProviderEmailNotVerified = "EC010", // Error Code 010
   /**
    * Invalid Passkey Error Code EC011
    * EC011 = a passkey ceremony was rejected: unknown, expired or used
@@ -83,5 +73,4 @@ declare enum AuthErrorCodes {
   InvalidPasskey = "EC011"
 }
 //#endregion
-export { AuthErrorCodes };
 //# sourceMappingURL=auth-error-codes.d.mts.map

package/esm/utils/auth-error-codes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/auth-error-codes.ts"],"mappings":";aAAY,cAAA;EAAA;;;;EAKV,kBAAA;EAAA;EAKA;;;;EAAA,kBAAA;EAAA;EAkCA;;;;EA7BA,YAAA;EAAA;EAwDc;AAAA;;;;EAlDd,eAAA;EAAA;;;;;;;;;EASA,gBAAA;EAAA;;;;;;;;EAQA,kBAAA;EAAA;;;;;;EAMA,gBAAA;EAAA;;;;;;;EAOA,mBAAA;EAAA;;;;;;;EAOA,uBAAA;EAAA;;;;;;EAMA,wBAAA;EAAA;;;;;;;EAOA,cAAA;AAAA"}
+{"version":3,"file":"auth-error-codes.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/auth-error-codes.ts"],"mappings":";oBAAY;;;;;EAKV;;;;;EAKA;;;;;EAKA;;;;;;EAMA;;;;;;;;;EASA;;;;;;;;EAQA;;;;;;EAMA;;;;;;;EAOA;;;;;;;EAOA;;;;;;EAMA;;;;;;;EAOA"}

package/esm/utils/index.mjs

@@ -2,4 +2,4 @@ import { AuthErrorCodes } from "./auth-error-codes.mjs";
 import { isNeverExpiring, isUsableExpiry, tokenHasExpClaim } from "./token-expiry.mjs";
 import { safeEqual } from "./safe-equal.mjs";
 
-export {  };
+export { AuthErrorCodes, isNeverExpiring, isUsableExpiry, safeEqual, tokenHasExpClaim };

package/esm/utils/safe-equal.d.mts

@@ -1,6 +1,5 @@
 //#region ../../packages/auth/src/utils/safe-equal.d.ts
 /** Constant-time string equality; strings of unequal length are simply unequal. */
-declare function safeEqual(left: string, right: string): boolean;
+export declare function safeEqual(left: string, right: string): boolean;
 //#endregion
-export { safeEqual };
 //# sourceMappingURL=safe-equal.d.mts.map

package/esm/utils/safe-equal.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/safe-equal.ts"],"mappings":";;iBAGgB,SAAA,CAAU,IAAA,UAAc,KAAa"}
+{"version":3,"file":"safe-equal.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/safe-equal.ts"],"mappings":";;wBAGgB,UAAU,cAAc"}

package/esm/utils/token-expiry.d.mts

@@ -9,7 +9,7 @@
  * nor `expires_at > now` (it never shows as an active session): it is outside
  * the reach of every date predicate rather than merely wrong.
  */
-declare function isUsableExpiry(value: unknown): boolean;
+export declare function isUsableExpiry(value: unknown): boolean;
 /**
  * Whether the JWT carries a finite numeric `exp` claim.
  *
@@ -19,7 +19,7 @@ declare function isUsableExpiry(value: unknown): boolean;
  * answers `false` — it cannot be shown to expire, and a row whose token cannot
  * even be parsed is unusable regardless.
  */
-declare function tokenHasExpClaim(token: unknown): boolean;
+export declare function tokenHasExpClaim(token: unknown): boolean;
 /**
  * Whether a token row can ever stop being accepted on its own.
  *
@@ -29,7 +29,6 @@ declare function tokenHasExpClaim(token: unknown): boolean;
  *
  * This is the predicate the `auth.purge-never-expiring` remediation selects on.
  */
-declare function isNeverExpiring(token: unknown, expiresAt: unknown): boolean;
+export declare function isNeverExpiring(token: unknown, expiresAt: unknown): boolean;
 //#endregion
-export { isNeverExpiring, isUsableExpiry, tokenHasExpClaim };
 //# sourceMappingURL=token-expiry.d.mts.map

package/esm/utils/token-expiry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"token-expiry.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/token-expiry.ts"],"mappings":";;AAqBA;;;;AAA6C;AAe7C;;;;iBAfgB,cAAA,CAAe,KAAc;AAoC7C;;;;AAAkE;;;;;AAAlE,iBArBgB,gBAAA,CAAiB,KAAc;;;;;;;;;;iBAqB/B,eAAA,CAAgB,KAAA,WAAgB,SAAkB"}
+{"version":3,"file":"token-expiry.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/utils/token-expiry.ts"],"mappings":";;;;;;;;;;;wBAqBgB,eAAe;;;;;;;;;;wBAef,iBAAiB;;;;;;;;;;wBAqBjB,gBAAgB,gBAAgB"}

package/package.json

@@ -12,13 +12,13 @@
     "ms": "^2.1.3"
   },
   "peerDependencies": {
-    "@warlock.js/fs": "5.31.0",
-    "@warlock.js/cache": "5.31.0",
-    "@warlock.js/cascade": "5.31.0",
-    "@warlock.js/core": "5.31.0",
-    "@warlock.js/logger": "5.31.0",
-    "@warlock.js/seal": "5.31.0",
-    "@warlock.js/notifications": "5.31.0",
+    "@warlock.js/fs": "5.32.0",
+    "@warlock.js/cache": "5.32.0",
+    "@warlock.js/cascade": "5.32.0",
+    "@warlock.js/core": "5.32.0",
+    "@warlock.js/logger": "5.32.0",
+    "@warlock.js/seal": "5.32.0",
+    "@warlock.js/notifications": "5.32.0",
     "@simplewebauthn/server": "^13.1.0",
     "jose": "^6.1.0"
   },
@@ -48,7 +48,7 @@
   ],
   "author": "hassanzohdy",
   "license": "MIT",
-  "version": "5.31.0",
+  "version": "5.32.0",
   "type": "module",
   "main": "./esm/index.mjs",
   "module": "./esm/index.mjs",