@warlock.js/auth 5.31.0 → 5.33.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@warlock.js/auth` are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). `@warlock.js/*` packages are released in lockstep — every package shares the same version number, so a version below may list only the changes that affected this package.
 
+## 5.33.0 - 2026-10-19
+
+### Changed
+
+- Lockstep release; package APIs are unchanged.
+
+## 5.32.0 - 2026-10-18
+
+### Changed
+
+- Pin the package development compiler to TypeScript 7.0.2 and use explicit Node types and source roots with supported module resolution.
+
 ## 5.31.0 - 2026-10-18
 
 ### Added

package/esm/commands/auth-cleanup-command.d.mts

@@ -7,7 +7,6 @@
  * warlock auth:cleanup
  * ```
  */
-declare function registerAuthCleanupCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerAuthCleanupCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerAuthCleanupCommand };
 //# sourceMappingURL=auth-cleanup-command.d.mts.map

package/esm/commands/auth-cleanup-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"mappings":";;AAYA;;;;AAA0C;;;iBAA1B,0BAAA,+BAA0B,UAAA"}
+{"version":3,"file":"auth-cleanup-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-cleanup-command.ts"],"mappings":";;;;;;;;;wBAYgB,yDAA0B"}

package/esm/commands/auth-purge-never-expiring-command.d.mts

@@ -23,7 +23,6 @@
  * warlock auth.purge-never-expiring             # report, then delete
  * ```
  */
-declare function registerAuthPurgeNeverExpiringCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerAuthPurgeNeverExpiringCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerAuthPurgeNeverExpiringCommand };
 //# sourceMappingURL=auth-purge-never-expiring-command.d.mts.map

package/esm/commands/auth-purge-never-expiring-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;AA4BA;;;;AAAqD;;;;;;;;;;;;;;;;;;;iBAArC,qCAAA,+BAAqC,UAAA"}
+{"version":3,"file":"auth-purge-never-expiring-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/auth-purge-never-expiring-command.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;wBA4BgB,oEAAqC"}

package/esm/commands/jwt-secret-generator-command.d.mts

@@ -1,5 +1,4 @@
 //#region ../../packages/auth/src/commands/jwt-secret-generator-command.d.ts
-declare function registerJWTSecretGeneratorCommand(): import("@warlock.js/core").CLICommand;
+export declare function registerJWTSecretGeneratorCommand(): import("@warlock.js/core").CLICommand;
 //#endregion
-export { registerJWTSecretGeneratorCommand };
 //# sourceMappingURL=jwt-secret-generator-command.d.mts.map

package/esm/commands/jwt-secret-generator-command.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";iBAGgB,iCAAA,+BAAiC,UAAA"}
+{"version":3,"file":"jwt-secret-generator-command.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/commands/jwt-secret-generator-command.ts"],"mappings":";wBAGgB,gEAAiC"}

package/esm/contracts/auth-contract.d.mts

@@ -1,6 +1,5 @@
 import { AccessTokenOutput, DeviceInfo, TokenPair } from "./types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
-
 //#region ../../packages/auth/src/contracts/auth-contract.d.ts
 /**
  * Surface every authenticable user model exposes once it extends the
@@ -10,7 +9,7 @@ import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
  * Kept in sync with `Auth` — if a method here drifts from the class, the
  * `implements Authenticable` clause on `Auth` fails to compile.
  */
-interface Authenticable {
+export interface Authenticable {
   /**
    * Discriminator identifying which user type this model represents.
    * Drives token payloads and `authMiddleware` type checks.
@@ -36,5 +35,4 @@ interface Authenticable {
   confirmPassword(password: string): Promise<boolean>;
 }
 //#endregion
-export { Authenticable };
 //# sourceMappingURL=auth-contract.d.mts.map

package/esm/contracts/auth-contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;AAWA;;;;;;UAAiB,aAAA;EAiBwC;;;;EAAA,IAZnD,QAAA;EAsB+B;;;;EAhBnC,mBAAA,CAAoB,OAAA,GAAU,MAAA,oBAA0B,OAAA,CAAQ,iBAAA;EAAlC;;;;EAM9B,oBAAA,CAAqB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,YAAA;EAArB;;;EAKlC,eAAA,CAAgB,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAAlD;;;EAKA,eAAA,CAAgB,QAAA,WAAmB,OAAA;AAAA"}
+{"version":3,"file":"auth-contract.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/auth-contract.ts"],"mappings":";;;;;;;;;;;iBAWiB;;;;;MAKX;;;;;EAMJ,oBAAoB,UAAU,0BAA0B,QAAQ;;;;;EAMhE,qBAAqB,aAAa,aAAa,QAAQ;;;;EAKvD,gBAAgB,aAAa,aAAa,QAAQ;;;;EAKlD,gBAAgB,mBAAmB"}

package/esm/contracts/index.d.mts

@@ -1,4 +1,5 @@
 import { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig } from "./providers.mjs";
 import { AccessTokenConfig, AccessTokenOutput, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthRefreshCredentialDescriptor, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, EmailVerificationConfig, LegacyJwtConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, PageAuthConfig, PasswordResetConfig, PasswordSetter, RefreshTokenConfig, SetAuthCookieOptions, TokenFrom, TokenPair } from "./types.mjs";
 import { Authenticable } from "./auth-contract.mjs";
-import { RequestUser } from "./request-locals.mjs";
+import { RequestUser } from "./request-locals.mjs";
+export { AccessTokenConfig, AccessTokenOutput, AppleProviderConfig, AuthConfigurations, AuthCredentialDescriptor, AuthCredentials, AuthMiddlewareOptions, AuthNotification, AuthProvider, AuthRefreshCredentialDescriptor, Authenticable, CanAuthenticate, ClearAuthCookieOptions, CookieAuthConfig, CookieDomainResolver, CsrfConfig, DeviceInfo, DiscordProviderConfig, EmailVerificationConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LegacyJwtConfig, LinkedInProviderConfig, LoginResult, LogoutWithoutTokenBehavior, NO_EXPIRATION, OneTimeTokenConfig, OneTimeTokenNotificationData, OneTimeTokenUrlBuilder, OtpConfig, OtpMessage, OtpSender, PageAuthConfig, PasskeysConfig, PasswordResetConfig, PasswordSetter, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, RefreshTokenConfig, RequestUser, SetAuthCookieOptions, TokenFrom, TokenPair, XProviderConfig };

package/esm/contracts/providers.d.mts

@@ -1,12 +1,11 @@
 import { Auth } from "../models/auth.model.mjs";
 import { ChildModel } from "@warlock.js/cascade";
-
 //#region ../../packages/auth/src/contracts/providers.d.ts
 /**
  * The per-login secrets a redirect provider round-trips: `state` (CSRF),
  * `nonce` (id_token replay binding) and the PKCE `codeVerifier`.
  */
-type ProviderAuthorizationState = {
+export type ProviderAuthorizationState = {
   state: string;
   nonce: string;
   codeVerifier: string;
@@ -16,18 +15,22 @@ type ProviderAuthorizationState = {
  * callback query and the state that was stored when the login started. The
  * caller has already checked `query.state` against `expected.state`.
  */
-type ProviderCallbackParams = {
+export type ProviderCallbackParams = {
   query: Record<string, unknown>;
   expected: ProviderAuthorizationState;
 };
 /** The identity a provider asserts, normalized across providers. */
-type ProviderProfile = {
-  /** Provider name, e.g. `"google"`. */provider: string; /** The provider's stable user id (`sub`). The link key — never the email. */
+export type ProviderProfile = {
+  /** Provider name, e.g. `"google"`. */
+  provider: string;
+  /** The provider's stable user id (`sub`). The link key — never the email. */
   providerUserId: string;
-  email?: string; /** Whether the PROVIDER verified `email`. Accounts are never linked on `false`. */
+  email?: string;
+  /** Whether the PROVIDER verified `email`. Accounts are never linked on `false`. */
   emailVerified: boolean;
   name?: string;
-  avatar?: string; /** The verified claims the profile was built from. */
+  avatar?: string;
+  /** The verified claims the profile was built from. */
   raw: Record<string, unknown>;
 };
 /**
@@ -35,7 +38,7 @@ type ProviderProfile = {
  * Register an instance under `auth.providers.custom.<name>` to add one auth does
  * not ship.
  */
-interface AuthProvider {
+export interface AuthProvider {
   readonly name: string;
   /**
    * How the provider's callback arrives. `"query"` (default) is a top-level
@@ -51,60 +54,78 @@ interface AuthProvider {
   handleCallback(params: ProviderCallbackParams): Promise<ProviderProfile>;
 }
 /** `auth.providers.google`. */
-type GoogleProviderConfig = {
+export type GoogleProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect URI registered in the Google console. */
-  redirectUri: string; /** @default ["openid", "email", "profile"] */
+  clientSecret: string;
+  /** Must exactly match a redirect URI registered in the Google console. */
+  redirectUri: string;
+  /** @default ["openid", "email", "profile"] */
   scopes?: string[];
 };
 /** `auth.providers.github`. */
-type GitHubProviderConfig = {
+export type GitHubProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match the "Authorization callback URL" registered on the GitHub OAuth App. */
-  redirectUri: string; /** @default ["read:user", "user:email"] */
+  clientSecret: string;
+  /** Must exactly match the "Authorization callback URL" registered on the GitHub OAuth App. */
+  redirectUri: string;
+  /** @default ["read:user", "user:email"] */
   scopes?: string[];
 };
 /** `auth.providers.discord`. */
-type DiscordProviderConfig = {
+export type DiscordProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect registered on the Discord application. */
-  redirectUri: string; /** @default ["identify", "email"] */
+  clientSecret: string;
+  /** Must exactly match a redirect registered on the Discord application. */
+  redirectUri: string;
+  /** @default ["identify", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.linkedin`. */
-type LinkedInProviderConfig = {
+export type LinkedInProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a redirect URL registered on the LinkedIn app. */
-  redirectUri: string; /** @default ["openid", "profile", "email"] */
+  clientSecret: string;
+  /** Must exactly match a redirect URL registered on the LinkedIn app. */
+  redirectUri: string;
+  /** @default ["openid", "profile", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.apple`. */
-type AppleProviderConfig = {
-  /** The Services ID (or app id) registered with Sign in with Apple. */clientId: string; /** The Apple Developer team id — signed into the client-secret JWT as `iss`. */
-  teamId: string; /** The id of the private key created for Sign in with Apple — signed into the client-secret JWT header as `kid`. */
-  keyId: string; /** The PKCS8 PEM contents of that private key (`.p8` file), used to sign the client-secret JWT. */
-  privateKey: string; /** Must exactly match a return URL registered on the Services ID. */
-  redirectUri: string; /** @default ["name", "email"] */
+export type AppleProviderConfig = {
+  /** The Services ID (or app id) registered with Sign in with Apple. */
+  clientId: string;
+  /** The Apple Developer team id — signed into the client-secret JWT as `iss`. */
+  teamId: string;
+  /** The id of the private key created for Sign in with Apple — signed into the client-secret JWT header as `kid`. */
+  keyId: string;
+  /** The PKCS8 PEM contents of that private key (`.p8` file), used to sign the client-secret JWT. */
+  privateKey: string;
+  /** Must exactly match a return URL registered on the Services ID. */
+  redirectUri: string;
+  /** @default ["name", "email"] */
   scopes?: string[];
 };
 /** `auth.providers.facebook`. */
-type FacebookProviderConfig = {
+export type FacebookProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a valid OAuth redirect URI registered on the Facebook app. */
-  redirectUri: string; /** @default ["email", "public_profile"] */
+  clientSecret: string;
+  /** Must exactly match a valid OAuth redirect URI registered on the Facebook app. */
+  redirectUri: string;
+  /** @default ["email", "public_profile"] */
   scopes?: string[];
 };
 /** `auth.providers.x`. */
-type XProviderConfig = {
+export type XProviderConfig = {
   clientId: string;
-  clientSecret: string; /** Must exactly match a callback URI registered on the X app (confidential client). */
-  redirectUri: string; /** @default ["tweet.read", "users.read"] */
+  clientSecret: string;
+  /** Must exactly match a callback URI registered on the X app (confidential client). */
+  redirectUri: string;
+  /** @default ["tweet.read", "users.read"] */
   scopes?: string[];
 };
 /** Creates the app user for a verified provider profile with no matching account. */
-type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
+export type ProviderUserCreator = (profile: ProviderProfile, Model: ChildModel<Auth>) => Auth | Promise<Auth>;
 /** `auth.providers`. */
-type ProvidersConfig = {
+export type ProvidersConfig = {
   google?: GoogleProviderConfig;
   github?: GitHubProviderConfig;
   discord?: DiscordProviderConfig;
@@ -116,44 +137,55 @@ type ProvidersConfig = {
    * User attribute a verified provider email is matched against.
    * @default "email"
    */
-  emailField?: string; /** Replace the default user creation (`{ email, name, <verification.field>: now }`). */
-  createUser?: ProviderUserCreator; /** Providers auth does not ship, by name. */
+  emailField?: string;
+  /** Replace the default user creation (`{ email, name, <verification.field>: now }`). */
+  createUser?: ProviderUserCreator;
+  /** Providers auth does not ship, by name. */
   custom?: Record<string, AuthProvider>;
 };
 /** `auth.passkeys`. */
-type PasskeysConfig = {
-  /** Relying-party id — the site's registrable domain, e.g. `"example.com"`. */rpID: string; /** Name shown by the authenticator. */
-  rpName: string; /** Exact origin(s) the browser ceremony runs on, e.g. `"https://example.com"`. */
+export type PasskeysConfig = {
+  /** Relying-party id — the site's registrable domain, e.g. `"example.com"`. */
+  rpID: string;
+  /** Name shown by the authenticator. */
+  rpName: string;
+  /** Exact origin(s) the browser ceremony runs on, e.g. `"https://example.com"`. */
   origin: string | string[];
   /**
    * Challenge lifetime — a positive `ms` duration string.
    * @default "5m"
    */
-  challengeExpiresIn?: string; /** Account name shown by the authenticator. @default user email, else id */
+  challengeExpiresIn?: string;
+  /** Account name shown by the authenticator. @default user email, else id */
   userName?: (user: Auth) => string;
 };
 /** Data an OTP delivery receives. */
-type OtpMessage = {
-  /** Ready-to-send text containing the code. */body: string;
+export type OtpMessage = {
+  /** Ready-to-send text containing the code. */
+  body: string;
   code: string;
   expiresAt: Date;
 };
 /** Delivers an OTP. Replaces the default `notify.channel(channel).send(phone, message)`. */
-type OtpSender = (phone: string, message: OtpMessage, channel: string) => unknown;
+export type OtpSender = (phone: string, message: OtpMessage, channel: string) => unknown;
 /** `auth.otp`. */
-type OtpConfig = {
+export type OtpConfig = {
   /**
    * Notifications channel the code is sent through. The app registers it
    * (auth ships no SMS/WhatsApp driver).
    * @default "sms"
    */
-  channel?: string; /** User attribute holding the phone number. @default "phone" */
-  phoneField?: string; /** Code lifetime. @default "5m" */
-  expiresIn?: string; /** Verify attempts before the code is invalidated. @default 5 */
-  maxAttempts?: number; /** Build the message text. @default "Your verification code is <code>" */
-  message?: (code: string) => string; /** Replace delivery entirely. */
+  channel?: string;
+  /** User attribute holding the phone number. @default "phone" */
+  phoneField?: string;
+  /** Code lifetime. @default "5m" */
+  expiresIn?: string;
+  /** Verify attempts before the code is invalidated. @default 5 */
+  maxAttempts?: number;
+  /** Build the message text. @default "Your verification code is <code>" */
+  message?: (code: string) => string;
+  /** Replace delivery entirely. */
   send?: OtpSender;
 };
 //#endregion
-export { AppleProviderConfig, AuthProvider, DiscordProviderConfig, FacebookProviderConfig, GitHubProviderConfig, GoogleProviderConfig, LinkedInProviderConfig, OtpConfig, OtpMessage, OtpSender, PasskeysConfig, ProviderAuthorizationState, ProviderCallbackParams, ProviderProfile, ProviderUserCreator, ProvidersConfig, XProviderConfig };
 //# sourceMappingURL=providers.d.mts.map

package/esm/contracts/providers.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/providers.ts"],"mappings":";;;;;;AAOA;;KAAY,0BAAA;EACV,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;AAAY;AAQd;;;KAAY,sBAAA;EACV,KAAA,EAAO,MAAA;EACP,QAAA,EAAU,0BAA0B;AAAA;;KAI1B,eAAA;EAJ0B,sCAMpC,QAAA,UAFyB;EAIzB,cAAA;EACA,KAAA,WAHA;EAKA,aAAA;EACA,IAAA;EACA,MAAA,WADA;EAGA,GAAA,EAAK,MAAM;AAAA;;;AAAA;AAQb;;UAAiB,YAAA;EAAA,SACN,IAAA;EAUqD;;;;;;;EAAA,SAFrD,YAAA;EAET;EAAA,gBAAA,CAAiB,KAAA,EAAO,0BAAA,YAAsC,OAAA;EAA7C;EAEjB,cAAA,CAAe,MAAA,EAAQ,sBAAA,GAAyB,OAAA,CAAQ,eAAA;AAAA;;KAI9C,oBAAA;EACV,QAAA;EACA,YAAA,UANuE;EAQvE,WAAA,UAJU;EAMV,MAAA;AAAA;;KAIU,oBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,qBAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UAVA;EAYA,WAAA,UARA;EAUA,MAAA;AAAA;AANF;AAAA,KAUY,mBAAA;wEAEV,QAAA,UAXA;EAaA,MAAA,UAVA;EAYA,KAAA,UAVM;EAYN,UAAA,UARU;EAUV,WAAA;EAEA,MAAA;AAAA;;KAIU,sBAAA;EACV,QAAA;EACA,YAAA,UANA;EAQA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,eAAA;EACV,QAAA;EACA,YAAA,UARA;EAUA,WAAA,UARM;EAUN,MAAA;AAAA;;KAIU,mBAAA,IACV,OAAA,EAAS,eAAA,EACT,KAAA,EAAO,UAAA,CAAW,IAAA,MACf,IAAA,GAAO,OAAA,CAAQ,IAAA;;KAGR,eAAA;EACV,MAAA,GAAS,oBAAA;EACT,MAAA,GAAS,oBAAA;EACT,OAAA,GAAU,qBAAA;EACV,QAAA,GAAW,sBAAA;EACX,KAAA,GAAQ,mBAAA;EACR,QAAA,GAAW,sBAAA;EACX,CAAA,GAAI,eAAA;;;;;EAKJ,UAAA,WAfkB;EAiBlB,UAAA,GAAa,mBAAA,EAjBI;EAmBjB,MAAA,GAAS,MAAA,SAAe,YAAA;AAAA;;KAId,cAAA;EAxBQ,8EA0BlB,IAAA,UAzBG;EA2BH,MAAA,UA3BkB;EA6BlB,MAAA;EA7BsB;AAGxB;;;EA+BE,kBAAA,WA7BS;EA+BT,QAAA,IAAY,IAAA,EAAM,IAAI;AAAA;;KAIZ,UAAA;EA9BN,8CAgCJ,IAAA;EACA,IAAA;EACA,SAAA,EAAW,IAAI;AAAA;;KAIL,SAAA,IAAa,KAAA,UAAe,OAAA,EAAS,UAAU,EAAE,OAAA;;KAGjD,SAAA;EA9CD;;;;;EAoDT,OAAA,WAjDQ;EAmDR,UAAA,WAlDW;EAoDX,SAAA,WAnDI;EAqDJ,WAAA,WA9CA;EAgDA,OAAA,IAAW,IAAA,qBA9CX;EAgDA,IAAA,GAAO,SAAS;AAAA"}
+{"version":3,"file":"providers.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/providers.ts"],"mappings":";;;;;;;YAOY;EACV;EACA;EACA;;;;;;;YAQU;EACV,OAAO;EACP,UAAU;;;YAIA;;EAEV;;EAEA;EACA;;EAEA;EACA;EACA;;EAEA,KAAK;;;;;;;iBAQU;WACN;;;;;;;;WAQA;;EAET,iBAAiB,OAAO,sCAAsC;;EAE9D,eAAe,QAAQ,yBAAyB,QAAQ;;;YAI9C;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU;EACV;EACA;;EAEA;;EAEA;;;YAIU,uBACV,SAAS,iBACT,OAAO,WAAW,UACf,OAAO,QAAQ;;YAGR;EACV,SAAS;EACT,SAAS;EACT,UAAU;EACV,WAAW;EACX,QAAQ;EACR,WAAW;EACX,IAAI;;;;;EAKJ;;EAEA,aAAa;;EAEb,SAAS,eAAe;;;YAId;;EAEV;;EAEA;;EAEA;;;;;EAKA;;EAEA,YAAY,MAAM;;;YAIR;;EAEV;EACA;EACA,WAAW;;;YAID,aAAa,eAAe,SAAS,YAAY;;YAGjD;;;;;;EAMV;;EAEA;;EAEA;;EAEA;;EAEA,WAAW;;EAEX,OAAO"}

package/esm/contracts/request-locals.d.mts

@@ -24,7 +24,7 @@
  * would fail to compile (TS2320). See `access/src/middleware/gate.middleware.ts`
  * for the same hazard documented at its call site.
  */
-interface RequestUser {}
+export interface RequestUser {}
 /**
  * Augments core's `RequestLocals` (`request.locals`) with the `user` key —
  * done in the module that OWNS the key, per `RequestLocals`' own contract
@@ -42,7 +42,6 @@ declare module "@warlock.js/core" {
      */
     session?: Promise<any>;
   }
-} //# sourceMappingURL=request-locals.d.ts.map
+}
 //#endregion
-export { RequestUser };
 //# sourceMappingURL=request-locals.d.mts.map

package/esm/contracts/request-locals.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/request-locals.ts"],"mappings":";;AAyBA;;;;AAA4B;AAAG;;;;;;;;;;;AAiBV;;;;;;;;UAjBJ,WAAA;;;;;;;;;;YAWL,aAAA;IACR,IAAA,GAAO,WAAA;;;;;IAKP,OAAA,GAAU,OAAO;EAAA;AAAA"}
+{"version":3,"file":"request-locals.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/contracts/request-locals.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBiB;;;;;;;;;;YAWL;IACR,OAAO;;;;;IAKP,UAAU"}