@zudojs/auth 1.3.3 → 1.4.0

package/README.md

@@ -55,6 +55,7 @@ const tokenConfig: TokenConfig = {
   issuer: "my-api",
   audience: "my-app",
   clockToleranceSeconds: 5, // optional skew allowance for exp/iat/nbf
+  // clock: myClock, // optional { now(): number } for deterministic expiry tests
 };
 
 const auth = createAuthService({
@@ -194,7 +195,38 @@ With a `revocationStore` configured, `refresh()` claims the presented token's
 Replaying an already-used refresh token throws `TokenRevokedError` **and**
 destroys every session for that user, on the assumption that the chain is
 compromised (RFC 6819 §5.2.2.3). Implement `revokeIfNotRevoked` in any custom
-store — the `isRevoked` + `revoke` fallback is racy.
+store — the `isRevoked` + `revoke` fallback is racy. A store without it is
+reported at construction: `createAuthService()` emits a `SecurityWarning`
+(`process.emitWarning`, code `ZUDO_AUTH_RACY_REVOCATION`), and with
+`requireAtomicRevocation: true` it throws `AuthConfigurationError` instead.
+
+### Custom claims
+
+`AuthUser.claims` (for example `{ plan: "pro", org: "acme" }`) is embedded in
+every token the service mints — `login()`, `refresh()` and
+`createSessionForUser()` — and comes back on `verifyToken()`'s payload. Reserved
+names (`sub`, `iat`, `exp`, `nbf`, `typ`, `jti`, `sid`, `roles`, `iss`, `aud`)
+are dropped, never overridden. The standalone `createTokenPair()` takes the same
+`claims` option. Claims are readable by anyone holding the token, so keep them
+small and non-sensitive.
+
+### Deterministic time in tests
+
+Pass a `{ now(): number }` clock instead of faking global timers:
+
+```ts
+const clock = { now: () => fixedMs };
+const auth = createAuthService({
+  clock,
+  sessionStore: createMemorySessionStore({ clock }),
+  revocationStore: createMemoryTokenRevocationStore({ clock }),
+  loginThrottle: { store: createMemoryLoginAttemptStore({ clock }) },
+  // ...
+});
+```
+
+Token `iat`/`exp`, verification, session expiry, revocation expiry and
+lockout deadlines all read that clock; advance it to test expiry.
 
 ### Access control
 

package/dist/authErrors/authError.base.d.ts

@@ -75,4 +75,3 @@ export declare class AccessDeniedError extends AuthError {
 export declare class SessionExpiredError extends AuthError {
     constructor(message?: string, options?: AuthErrorOptions);
 }
-//# sourceMappingURL=authError.base.d.ts.map

package/dist/authErrors/authError.base.js

@@ -132,4 +132,3 @@ export class SessionExpiredError extends AuthError {
         });
     }
 }
-//# sourceMappingURL=authError.base.js.map

package/dist/authErrors/authError.throttle.d.ts

@@ -39,4 +39,3 @@ export declare class AuthRateLimitError extends AuthError {
     readonly headers: Readonly<Record<string, string>>;
     constructor(message?: string, options?: ThrottleErrorOptions);
 }
-//# sourceMappingURL=authError.throttle.d.ts.map

package/dist/authErrors/authError.throttle.js

@@ -66,4 +66,3 @@ export class AuthRateLimitError extends AuthError {
         this.headers = retryAfterHeaders(seconds);
     }
 }
-//# sourceMappingURL=authError.throttle.js.map

package/dist/authErrors/index.d.ts

@@ -5,4 +5,3 @@
  */
 export { AuthError, type AuthErrorOptions, AuthConfigurationError, InvalidCredentialsError, TokenExpiredError, TokenInvalidError, TokenRevokedError, AccountDeactivatedError, AccessDeniedError, SessionExpiredError, } from "./authError.base.js";
 export { AccountLockedError, AuthRateLimitError, type ThrottleErrorOptions, } from "./authError.throttle.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/authErrors/index.js

@@ -5,4 +5,3 @@
  */
 export { AuthError, AuthConfigurationError, InvalidCredentialsError, TokenExpiredError, TokenInvalidError, TokenRevokedError, AccountDeactivatedError, AccessDeniedError, SessionExpiredError, } from "./authError.base.js";
 export { AccountLockedError, AuthRateLimitError, } from "./authError.throttle.js";
-//# sourceMappingURL=index.js.map

package/dist/authPassword/authPassword.core.d.ts

@@ -51,4 +51,3 @@ export declare function verifyPassword(password: string, hashedPassword: string)
  * @returns Hex-encoded random string
  */
 export declare function generateRandomToken(length?: number): string;
-//# sourceMappingURL=authPassword.core.d.ts.map

package/dist/authPassword/authPassword.core.js

@@ -96,4 +96,3 @@ export function generateRandomToken(length = 32) {
     }
     return randomBytes(length).toString("hex");
 }
-//# sourceMappingURL=authPassword.core.js.map

package/dist/authPassword/authPassword.legacy.d.ts

@@ -18,4 +18,3 @@ export declare function isLegacyPasswordHash(hashedPassword: string): boolean;
  * unparseable hash or parameters scrypt cannot satisfy; never throws.
  */
 export declare function verifyLegacyPassword(password: string, hashedPassword: string): Promise<boolean>;
-//# sourceMappingURL=authPassword.legacy.d.ts.map

package/dist/authPassword/authPassword.legacy.js

@@ -82,4 +82,3 @@ function deriveLegacyKey(password, salt, params) {
         });
     });
 }
-//# sourceMappingURL=authPassword.legacy.js.map

package/dist/authPassword/authPassword.policy.d.ts

@@ -27,4 +27,3 @@ export declare const KEY_LENGTH = 64;
 export declare const SCRYPT_N = 16384;
 export declare const SCRYPT_R = 8;
 export declare const SCRYPT_P = 5;
-//# sourceMappingURL=authPassword.policy.d.ts.map

package/dist/authPassword/authPassword.policy.js

@@ -27,4 +27,3 @@ export const KEY_LENGTH = 64;
 export const SCRYPT_N = 16384;
 export const SCRYPT_R = 8;
 export const SCRYPT_P = 5;
-//# sourceMappingURL=authPassword.policy.js.map

package/dist/authPassword/authPassword.rehash.d.ts

@@ -14,4 +14,3 @@
  * @returns Whether the hash should be regenerated
  */
 export declare function needsRehash(hashedPassword: string): boolean;
-//# sourceMappingURL=authPassword.rehash.d.ts.map

package/dist/authPassword/authPassword.rehash.js

@@ -47,4 +47,3 @@ export function needsRehash(hashedPassword) {
         return true;
     }
 }
-//# sourceMappingURL=authPassword.rehash.js.map

package/dist/authPassword/index.d.ts

@@ -6,4 +6,3 @@
 export { hashPassword, verifyPassword, generateRandomToken, } from "./authPassword.core.js";
 export { needsRehash } from "./authPassword.rehash.js";
 export { MIN_SALT_LENGTH, MAX_SALT_LENGTH, MAX_PASSWORD_BYTES, } from "./authPassword.policy.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/authPassword/index.js

@@ -6,4 +6,3 @@
 export { hashPassword, verifyPassword, generateRandomToken, } from "./authPassword.core.js";
 export { needsRehash } from "./authPassword.rehash.js";
 export { MIN_SALT_LENGTH, MAX_SALT_LENGTH, MAX_PASSWORD_BYTES, } from "./authPassword.policy.js";
-//# sourceMappingURL=index.js.map

package/dist/authProvider/authAttempt.eviction.d.ts

@@ -23,4 +23,3 @@ export declare function isStale(entry: EvictableAttemptEntry, now: number, windo
  * insertion order), or the oldest entry of all when every entry is locked.
  */
 export declare function evictOne<E extends EvictableAttemptEntry>(entries: Map<string, E>, now: number): void;
-//# sourceMappingURL=authAttempt.eviction.d.ts.map

package/dist/authProvider/authAttempt.eviction.js

@@ -34,4 +34,3 @@ export function evictOne(entries, now) {
     if (!oldest.done)
         entries.delete(oldest.value);
 }
-//# sourceMappingURL=authAttempt.eviction.js.map

package/dist/authProvider/authAttempt.memory.d.ts

@@ -6,6 +6,7 @@
  * Single-process only: counters are not shared between instances. Back
  * `LoginAttemptStore` with Redis for a real deployment.
  */
+import type { Clock } from "@zudojs/types";
 import type { LoginAttemptStore } from "../authTypes/authAttempt.type.js";
 /**
  * Create an in-memory {@link LoginAttemptStore}.
@@ -20,11 +21,13 @@ import type { LoginAttemptStore } from "../authTypes/authAttempt.type.js";
  * @param options.maxEntries - Hard cap on tracked identifiers (default:
  *   100000). At the cap the oldest unlocked entry is evicted; locked
  *   entries are only evicted when every entry is locked.
+ * @param options.clock - Time source for windows, lockouts and eviction
+ *   (default: `Date.now`). Pass the same clock to `createAuthService`.
  */
 export declare function createMemoryLoginAttemptStore(options?: {
     readonly windowSeconds?: number;
     readonly purgeIntervalMs?: number;
     readonly failureTtlSeconds?: number;
     readonly maxEntries?: number;
+    readonly clock?: Clock;
 }): LoginAttemptStore;
-//# sourceMappingURL=authAttempt.memory.d.ts.map

package/dist/authProvider/authAttempt.memory.js

@@ -25,8 +25,12 @@ const EMPTY = { failures: 0, attempts: 0 };
  * @param options.maxEntries - Hard cap on tracked identifiers (default:
  *   100000). At the cap the oldest unlocked entry is evicted; locked
  *   entries are only evicted when every entry is locked.
+ * @param options.clock - Time source for windows, lockouts and eviction
+ *   (default: `Date.now`). Pass the same clock to `createAuthService`.
  */
 export function createMemoryLoginAttemptStore(options) {
+    const clock = options?.clock;
+    const currentMs = () => (clock ? clock.now() : Date.now());
     const windowMs = (options?.windowSeconds ?? DEFAULT_WINDOW_SECONDS) * 1000;
     const purgeIntervalMs = options?.purgeIntervalMs ?? DEFAULT_PURGE_INTERVAL_MS;
     const failureTtlMs = (options?.failureTtlSeconds ?? DEFAULT_FAILURE_TTL_SECONDS) * 1000;
@@ -78,7 +82,7 @@ export function createMemoryLoginAttemptStore(options) {
     }
     return {
         async get(identifier) {
-            const now = Date.now();
+            const now = currentMs();
             if (!entries.has(identifier)) {
                 maybePurge(now);
                 return EMPTY;
@@ -86,18 +90,18 @@ export function createMemoryLoginAttemptStore(options) {
             return snapshot(load(identifier, now));
         },
         async recordAttempt(identifier) {
-            const entry = load(identifier, Date.now());
+            const entry = load(identifier, currentMs());
             entry.attempts++;
             return snapshot(entry);
         },
         async recordFailure(identifier) {
-            const entry = load(identifier, Date.now());
+            const entry = load(identifier, currentMs());
             entry.failures++;
-            entry.lastFailureAt = Date.now();
+            entry.lastFailureAt = currentMs();
             return snapshot(entry);
         },
         async lock(identifier, until) {
-            const entry = load(identifier, Date.now());
+            const entry = load(identifier, currentMs());
             entry.lockedUntil = until;
         },
         async reset(identifier) {
@@ -105,4 +109,3 @@ export function createMemoryLoginAttemptStore(options) {
         },
     };
 }
-//# sourceMappingURL=authAttempt.memory.js.map

package/dist/authProvider/authProvider.core.d.ts

@@ -7,6 +7,7 @@ import type { AuthUser, UserCredentials, UserId } from "../authTypes/authUser.ty
 import type { TokenPair, TokenPayload, TokenConfig, TokenRevocationStore } from "../authTypes/authToken.type.js";
 import type { SessionStore, SessionId } from "../authTypes/authSession.type.js";
 import type { LoginThrottleConfig } from "../authTypes/authAttempt.type.js";
+import type { Clock } from "@zudojs/types";
 import { type ExternalSessionOptions } from "./authProvider.external.js";
 import type { GuardContext, GuardResult } from "../authTypes/authRbac.type.js";
 import type { PermissionEngine } from "@zudojs/permissions";
@@ -100,6 +101,23 @@ export interface AuthServiceConfig {
      * string, or your own function to match how you store identifiers.
      */
     readonly normalizeIdentifier?: false | ((identifier: string) => string);
+    /**
+     * Time source for token `iat`/`exp`, token verification and lockout
+     * deadlines (default: `Date.now`). It is copied into `token.clock` unless
+     * that is already set. Pass the same clock to the memory stores
+     * (`createMemorySessionStore({ clock })`, and the revocation and attempt
+     * stores) so expiry tests need no fake timers.
+     */
+    readonly clock?: Clock;
+    /**
+     * Refuse a `revocationStore` that lacks `revokeIfNotRevoked` (default:
+     * `false`). Without that method `refresh()` falls back to `isRevoked()` +
+     * `revoke()`, which is racy; by default construction emits a
+     * `SecurityWarning` (code `ZUDO_AUTH_RACY_REVOCATION`) through
+     * `process.emitWarning`, and with this flag it throws
+     * `AuthConfigurationError` instead.
+     */
+    readonly requireAtomicRevocation?: boolean;
 }
 /**
  * Auth service interface.
@@ -150,4 +168,3 @@ export interface LoginResult {
  * Create an auth service.
  */
 export declare function createAuthService(config: AuthServiceConfig): AuthService;
-//# sourceMappingURL=authProvider.core.d.ts.map

package/dist/authProvider/authProvider.core.js

@@ -4,6 +4,7 @@
  * @module authProvider/authProvider
  */
 import { createLoginThrottleGate } from "./authProvider.throttle.js";
+import { assertAtomicRevocationStore } from "../authToken/authToken.revocation.js";
 import { createExternalSessionStarter, } from "./authProvider.external.js";
 import { normalizeLoginIdentifier } from "../authUtils/authUtils.identifier.js";
 import { hashPassword, verifyPassword, } from "../authPassword/authPassword.core.js";
@@ -24,7 +25,8 @@ export { throttleKey } from "./authProvider.throttle.js";
  * Create an auth service.
  */
 export function createAuthService(config) {
-    const { token: tokenConfig, sessionStore, findUser, findUserById, verifyPassword: verifyPwd, sessionTtlSeconds, absoluteSessionTtlSeconds, permissions, revocationStore, loginThrottle, allowInsecureFallbackGuard, fallbackAdminRole, allowSessionlessTokens, externalSessionMethods, normalizeIdentifier, } = config;
+    const { sessionStore, findUser, findUserById, verifyPassword: verifyPwd, sessionTtlSeconds, absoluteSessionTtlSeconds, permissions, revocationStore, loginThrottle, allowInsecureFallbackGuard, fallbackAdminRole, allowSessionlessTokens, externalSessionMethods, normalizeIdentifier, clock, requireAtomicRevocation, } = config;
+    const tokenConfig = clock && !config.token.clock ? { ...config.token, clock } : config.token;
     // Fail at construction, not at the first login: a bad secret or a NaN
     // lifetime (`Number(process.env.X)` with X unset) otherwise surfaced as
     // a runtime error on the request path — or, for the session TTL, not at
@@ -32,7 +34,10 @@ export function createAuthService(config) {
     assertTokenSecrets(tokenConfig);
     assertPositiveSeconds(sessionTtlSeconds, "sessionTtlSeconds");
     assertPositiveSeconds(absoluteSessionTtlSeconds, "absoluteSessionTtlSeconds");
-    const throttle = createLoginThrottleGate(loginThrottle);
+    if (revocationStore) {
+        assertAtomicRevocationStore(revocationStore, requireAtomicRevocation === true);
+    }
+    const throttle = createLoginThrottleGate(loginThrottle, tokenConfig.clock);
     const normalize = normalizeIdentifier === false
         ? (identifier) => identifier
         : (normalizeIdentifier ?? normalizeLoginIdentifier);
@@ -124,6 +129,7 @@ export function createAuthService(config) {
             const tokens = createTokenPair(user.id, tokenConfig, {
                 roles: user.roles,
                 sessionId: session.id,
+                claims: user.claims,
             });
             return { user, tokens, sessionId: session.id };
         },
@@ -186,6 +192,7 @@ export function createAuthService(config) {
             }
             return createTokenPair(user.id, tokenConfig, {
                 roles: user.roles,
+                claims: user.claims,
                 ...(sid ? { sessionId: sid } : {}),
             });
         },
@@ -291,4 +298,3 @@ function simpleGuard(userRoles, permission, userId, resourceOwnerId, adminRole)
         userRoles: [...userRoles],
     };
 }
-//# sourceMappingURL=authProvider.core.js.map

package/dist/authProvider/authProvider.external.d.ts

@@ -48,4 +48,3 @@ export interface ExternalSessionDependencies {
  * users.
  */
 export declare function createExternalSessionStarter(deps: ExternalSessionDependencies): (userId: UserId, options: ExternalSessionOptions) => Promise<ExternalSessionResult>;
-//# sourceMappingURL=authProvider.external.d.ts.map

package/dist/authProvider/authProvider.external.js

@@ -43,8 +43,8 @@ export function createExternalSessionStarter(deps) {
         const tokens = createTokenPair(user.id, deps.tokenConfig, {
             roles: user.roles,
             sessionId: session.id,
+            claims: user.claims,
         });
         return { user, tokens, sessionId: session.id };
     };
 }
-//# sourceMappingURL=authProvider.external.js.map

package/dist/authProvider/authProvider.throttle.d.ts

@@ -4,6 +4,7 @@
  *
  * @module authProvider/authProvider.throttle
  */
+import type { Clock } from "@zudojs/types";
 import type { LoginThrottleConfig } from "../authTypes/authAttempt.type.js";
 /**
  * The key under which an identifier's login attempts are counted.
@@ -47,6 +48,7 @@ export interface LoginThrottleGate {
  *
  * An attempt that throws for another reason (e.g. the user lookup fails)
  * keeps its reservation, so it counts as a failure.
+ *
+ * @param clock - Time source for lockout deadlines (default: `Date.now`).
  */
-export declare function createLoginThrottleGate(config: LoginThrottleConfig | undefined): LoginThrottleGate;
-//# sourceMappingURL=authProvider.throttle.d.ts.map
+export declare function createLoginThrottleGate(config: LoginThrottleConfig | undefined, clock?: Clock): LoginThrottleGate;

package/dist/authProvider/authProvider.throttle.js

@@ -36,8 +36,11 @@ const NO_SLOT = Object.freeze({ failures: 0 });
  *
  * An attempt that throws for another reason (e.g. the user lookup fails)
  * keeps its reservation, so it counts as a failure.
+ *
+ * @param clock - Time source for lockout deadlines (default: `Date.now`).
  */
-export function createLoginThrottleGate(config) {
+export function createLoginThrottleGate(config, clock) {
+    const currentMs = () => (clock ? clock.now() : Date.now());
     const maxFailedAttempts = config?.maxFailedAttempts ?? DEFAULT_MAX_FAILED_ATTEMPTS;
     const lockoutMs = (config?.lockoutSeconds ?? DEFAULT_LOCKOUT_SECONDS) * 1000;
     const maxAttemptsPerWindow = config?.maxAttemptsPerWindow ?? DEFAULT_MAX_ATTEMPTS_PER_WINDOW;
@@ -53,7 +56,7 @@ export function createLoginThrottleGate(config) {
             if (!config)
                 return NO_SLOT;
             const key = throttleKey(identifier);
-            const now = Date.now();
+            const now = currentMs();
             const current = await config.store.get(key);
             if (current.lockedUntil !== undefined && current.lockedUntil > now) {
                 throw locked(current, now);
@@ -77,7 +80,7 @@ export function createLoginThrottleGate(config) {
             if (!config)
                 return;
             if (slot.failures >= maxFailedAttempts) {
-                await config.store.lock(throttleKey(identifier), Date.now() + lockoutMs);
+                await config.store.lock(throttleKey(identifier), currentMs() + lockoutMs);
             }
         },
         async succeed(identifier) {
@@ -85,4 +88,3 @@ export function createLoginThrottleGate(config) {
         },
     };
 }
-//# sourceMappingURL=authProvider.throttle.js.map

package/dist/authProvider/index.d.ts

@@ -6,4 +6,3 @@
 export { createAuthService, type AuthService, type AuthServiceConfig, type LoginResult, type UserLookup, type UserByIdLookup, type PasswordVerifier, } from "./authProvider.core.js";
 export { createMemoryLoginAttemptStore } from "./authAttempt.memory.js";
 export { type ExternalSessionOptions, type ExternalSessionResult, } from "./authProvider.external.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/authProvider/index.js

@@ -6,4 +6,3 @@
 export { createAuthService, } from "./authProvider.core.js";
 export { createMemoryLoginAttemptStore } from "./authAttempt.memory.js";
 export {} from "./authProvider.external.js";
-//# sourceMappingURL=index.js.map

package/dist/authSession/authSession.core.d.ts

@@ -5,6 +5,7 @@
  *
  * For production, implement SessionStore backed by Redis, database, etc.
  */
+import type { Clock } from "@zudojs/types";
 import type { SessionStore } from "../authTypes/authSession.type.js";
 /**
  * Create an in-memory session store.
@@ -19,9 +20,12 @@ import type { SessionStore } from "../authTypes/authSession.type.js";
  *
  * @param options.purgeIntervalMs - Minimum gap between full sweeps
  *   (default: 60000). Set to 0 to sweep on every access.
+ * @param options.clock - Time source for creation, activity and expiry
+ *   (default: `Date.now`). Pass the same clock to `createAuthService`.
  */
 export declare function createMemorySessionStore(storeOptions?: {
     readonly purgeIntervalMs?: number;
+    readonly clock?: Clock;
 }): SessionStore;
 /**
  * Reject a TTL that cannot produce a real expiry.
@@ -30,4 +34,3 @@ export declare function createMemorySessionStore(storeOptions?: {
  *   finite number greater than zero.
  */
 export declare function assertPositiveSeconds(value: number | undefined, field: string): void;
-//# sourceMappingURL=authSession.core.d.ts.map

package/dist/authSession/authSession.core.js

@@ -23,14 +23,18 @@ const DEFAULT_PURGE_INTERVAL_MS = 60_000;
  *
  * @param options.purgeIntervalMs - Minimum gap between full sweeps
  *   (default: 60000). Set to 0 to sweep on every access.
+ * @param options.clock - Time source for creation, activity and expiry
+ *   (default: `Date.now`). Pass the same clock to `createAuthService`.
  */
 export function createMemorySessionStore(storeOptions) {
     const sessions = new Map();
     const ttls = new Map();
     const purgeIntervalMs = storeOptions?.purgeIntervalMs ?? DEFAULT_PURGE_INTERVAL_MS;
+    const clock = storeOptions?.clock;
+    const currentMs = () => (clock ? clock.now() : Date.now());
     let lastPurge = 0;
     function maybePurgeExpired() {
-        const nowMs = Date.now();
+        const nowMs = currentMs();
         if (nowMs - lastPurge < purgeIntervalMs)
             return;
         lastPurge = nowMs;
@@ -50,7 +54,7 @@ export function createMemorySessionStore(storeOptions) {
             assertPositiveSeconds(options.absoluteTtlSeconds, "absoluteTtlSeconds");
             maybePurgeExpired();
             const id = await generateSessionId();
-            const now = new Date();
+            const now = new Date(currentMs());
             const ttlMs = (options.ttlSeconds ?? DEFAULT_TTL_SECONDS) * 1000;
             const absoluteExpiresAt = options.absoluteTtlSeconds !== undefined
                 ? new Date(now.getTime() + options.absoluteTtlSeconds * 1000)
@@ -76,7 +80,7 @@ export function createMemorySessionStore(storeOptions) {
             const session = sessions.get(sessionId);
             if (!session)
                 return null;
-            if (Date.now() > session.expiresAt.getTime()) {
+            if (currentMs() > session.expiresAt.getTime()) {
                 sessions.delete(sessionId);
                 ttls.delete(sessionId);
                 return null;
@@ -88,7 +92,7 @@ export function createMemorySessionStore(storeOptions) {
             const session = sessions.get(sessionId);
             if (!session)
                 return;
-            const now = new Date();
+            const now = new Date(currentMs());
             if (now.getTime() > session.expiresAt.getTime()) {
                 sessions.delete(sessionId);
                 ttls.delete(sessionId);
@@ -140,4 +144,3 @@ function clampToAbsolute(expiresAt, absolute) {
 async function generateSessionId() {
     return (await randomHex(64));
 }
-//# sourceMappingURL=authSession.core.js.map

package/dist/authSession/index.d.ts

@@ -4,4 +4,3 @@
  * @module authSession
  */
 export { createMemorySessionStore } from "./authSession.core.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/authSession/index.js

@@ -4,4 +4,3 @@
  * @module authSession
  */
 export { createMemorySessionStore } from "./authSession.core.js";
-//# sourceMappingURL=index.js.map

package/dist/authToken/authToken.core.d.ts

@@ -8,19 +8,32 @@
  */
 import type { SessionId, UserId } from "@zudojs/constants";
 import type { JwtToken, TokenPair, TokenConfig, TokenVerificationResult } from "../authTypes/authToken.type.js";
+/** Options for {@link createTokenPair}. */
+export interface CreateTokenPairOptions {
+    /** Roles to embed in both tokens. */
+    readonly roles?: readonly string[];
+    /**
+     * Session to bind the pair to (`sid` claim). `createAuthService()` sets
+     * this so that `logout()` invalidates the pair.
+     */
+    readonly sessionId?: SessionId;
+    /**
+     * Custom claims embedded in both tokens, e.g. `{ plan: "pro" }`.
+     * Reserved names (`sub`, `iat`, `exp`, `nbf`, `typ`, `jti`, `sid`,
+     * `roles`, `iss`, `aud`) are dropped, never overridden. Keep them small:
+     * a token over 8 KB is rejected on verification.
+     */
+    readonly claims?: Readonly<Record<string, unknown>>;
+}
 /**
  * Create a new token pair (access + refresh).
  *
- * @param options.roles - Roles to embed in both tokens.
- * @param options.sessionId - Session to bind the pair to (`sid` claim).
- *   `createAuthService()` sets this so that `logout()` invalidates the pair.
+ * `iat`/`exp` come from `config.clock` when set (default: `Date.now`).
+ *
  * @throws {AuthConfigurationError} when the signing secrets are missing,
  *   shorter than 32 bytes, or identical to each other.
  */
-export declare function createTokenPair(userId: UserId, config: TokenConfig, options?: {
-    readonly roles?: readonly string[];
-    readonly sessionId?: SessionId;
-}): TokenPair;
+export declare function createTokenPair(userId: UserId, config: TokenConfig, options?: CreateTokenPairOptions): TokenPair;
 /**
  * Verify and decode an access token.
  *
@@ -60,4 +73,3 @@ export declare function verifyRefreshToken(token: JwtToken, config: TokenConfig)
 export declare function refreshAccessToken(refreshToken: JwtToken, config: TokenConfig, options?: {
     readonly roles?: readonly string[];
 }): TokenPair | null;
-//# sourceMappingURL=authToken.core.d.ts.map

package/dist/authToken/authToken.core.js

@@ -6,6 +6,7 @@
  * Pure Node.js implementation (no jsonwebtoken dependency).
  * Uses HMAC SHA-256 for signing.
  */
+import { sanitizeCustomClaims } from "../authUtils/authUtils.claims.js";
 import { signToken, verifyToken, generateTokenId, assertTokenSecrets, } from "./authToken.signing.js";
 // TTLs are in seconds — they are added to Unix-second `iat`/`exp` claims.
 const DEFAULT_ACCESS_TTL = 900; // 15 minutes
@@ -13,9 +14,8 @@ const DEFAULT_REFRESH_TTL = 604_800; // 7 days
 /**
  * Create a new token pair (access + refresh).
  *
- * @param options.roles - Roles to embed in both tokens.
- * @param options.sessionId - Session to bind the pair to (`sid` claim).
- *   `createAuthService()` sets this so that `logout()` invalidates the pair.
+ * `iat`/`exp` come from `config.clock` when set (default: `Date.now`).
+ *
  * @throws {AuthConfigurationError} when the signing secrets are missing,
  *   shorter than 32 bytes, or identical to each other.
  */
@@ -23,32 +23,24 @@ export function createTokenPair(userId, config, options) {
     assertTokenSecrets(config);
     const accessTtl = config.accessTtl ?? DEFAULT_ACCESS_TTL;
     const refreshTtl = config.refreshTtl ?? DEFAULT_REFRESH_TTL;
-    const now = Math.floor(Date.now() / 1000);
-    const accessToken = signToken({
+    const nowMs = config.clock ? config.clock.now() : Date.now();
+    const now = Math.floor(nowMs / 1000);
+    const custom = sanitizeCustomClaims(options?.claims);
+    const payload = (typ, ttl) => ({
+        ...custom,
         sub: userId,
         iat: now,
-        exp: now + accessTtl,
-        typ: "access",
+        exp: now + ttl,
+        typ,
         jti: generateTokenId(),
         roles: options?.roles,
         ...(options?.sessionId ? { sid: options.sessionId } : {}),
         ...(config.issuer ? { iss: config.issuer } : {}),
         ...(config.audience ? { aud: config.audience } : {}),
-    }, config.accessSecret);
-    const refreshToken = signToken({
-        sub: userId,
-        iat: now,
-        exp: now + refreshTtl,
-        typ: "refresh",
-        jti: generateTokenId(),
-        roles: options?.roles,
-        ...(options?.sessionId ? { sid: options.sessionId } : {}),
-        ...(config.issuer ? { iss: config.issuer } : {}),
-        ...(config.audience ? { aud: config.audience } : {}),
-    }, config.refreshSecret);
+    });
     return {
-        accessToken,
-        refreshToken,
+        accessToken: signToken(payload("access", accessTtl), config.accessSecret),
+        refreshToken: signToken(payload("refresh", refreshTtl), config.refreshSecret),
         expiresIn: accessTtl,
         tokenType: "Bearer",
     };
@@ -105,4 +97,3 @@ export function refreshAccessToken(refreshToken, config, options) {
         ...(sid ? { sessionId: sid } : {}),
     });
 }
-//# sourceMappingURL=authToken.core.js.map

package/dist/authToken/authToken.encoding.d.ts

@@ -40,4 +40,3 @@ export declare function splitToken(token: unknown): readonly [string, string, st
  *   or does not decode to a non-null, non-array object.
  */
 export declare function decodeJsonSegment(segment: string): Record<string, unknown> | null;
-//# sourceMappingURL=authToken.encoding.d.ts.map

package/dist/authToken/authToken.encoding.js

@@ -71,4 +71,3 @@ export function decodeJsonSegment(segment) {
     }
     return parsed;
 }
-//# sourceMappingURL=authToken.encoding.js.map

package/dist/authToken/authToken.revocation.d.ts

@@ -7,7 +7,10 @@
  * implement TokenRevocationStore with Redis or a database so revocations
  * are shared across instances.
  */
+import type { Clock } from "@zudojs/types";
 import type { TokenRevocationStore } from "../authTypes/authToken.type.js";
+/** `code` of the process warning emitted for a non-atomic revocation store. */
+export declare const RACY_REVOCATION_WARNING_CODE = "ZUDO_AUTH_RACY_REVOCATION";
 /**
  * Create an in-memory token revocation store.
  *
@@ -18,8 +21,23 @@ import type { TokenRevocationStore } from "../authTypes/authToken.type.js";
  *
  * @param options.purgeIntervalMs - Minimum gap between full sweeps
  *   (default: 60000). Set to 0 to sweep on every access.
+ * @param options.clock - Time source for expiry (default: `Date.now`).
  */
 export declare function createMemoryTokenRevocationStore(options?: {
     readonly purgeIntervalMs?: number;
+    readonly clock?: Clock;
 }): TokenRevocationStore;
-//# sourceMappingURL=authToken.revocation.d.ts.map
+/**
+ * Check that a revocation store can claim a refresh token atomically.
+ *
+ * Without `revokeIfNotRevoked`, `createAuthService().refresh()` falls back
+ * to `isRevoked()` then `revoke()`, which leaves a window in which two
+ * concurrent replays of one refresh token both mint a valid pair. That
+ * used to happen silently. Now a `SecurityWarning` with code
+ * {@link RACY_REVOCATION_WARNING_CODE} is emitted through
+ * `process.emitWarning` at construction, or, with `required`, the service
+ * refuses to start.
+ *
+ * @throws {AuthConfigurationError} when `required` and the method is absent.
+ */
+export declare function assertAtomicRevocationStore(store: TokenRevocationStore, required: boolean): void;

package/dist/authToken/authToken.revocation.js

@@ -7,8 +7,11 @@
  * implement TokenRevocationStore with Redis or a database so revocations
  * are shared across instances.
  */
+import { AuthConfigurationError } from "../authErrors/authError.base.js";
 /** Minimum interval between full sweeps of the revocation map. */
 const DEFAULT_PURGE_INTERVAL_MS = 60_000;
+/** `code` of the process warning emitted for a non-atomic revocation store. */
+export const RACY_REVOCATION_WARNING_CODE = "ZUDO_AUTH_RACY_REVOCATION";
 /**
  * Create an in-memory token revocation store.
  *
@@ -19,18 +22,21 @@ const DEFAULT_PURGE_INTERVAL_MS = 60_000;
  *
  * @param options.purgeIntervalMs - Minimum gap between full sweeps
  *   (default: 60000). Set to 0 to sweep on every access.
+ * @param options.clock - Time source for expiry (default: `Date.now`).
  */
 export function createMemoryTokenRevocationStore(options) {
     const revoked = new Map();
     const purgeIntervalMs = options?.purgeIntervalMs ?? DEFAULT_PURGE_INTERVAL_MS;
+    const clock = options?.clock;
+    const nowMs = () => (clock ? clock.now() : Date.now());
     let lastPurge = 0;
     /** Full sweep, rate-limited so a large map cannot be walked per request. */
     function maybePurgeExpired() {
-        const nowMs = Date.now();
-        if (nowMs - lastPurge < purgeIntervalMs)
+        const current = nowMs();
+        if (current - lastPurge < purgeIntervalMs)
             return;
-        lastPurge = nowMs;
-        const now = Math.floor(nowMs / 1000);
+        lastPurge = current;
+        const now = Math.floor(current / 1000);
         for (const [id, expiresAt] of revoked) {
             if (expiresAt < now) {
                 revoked.delete(id);
@@ -42,7 +48,7 @@ export function createMemoryTokenRevocationStore(options) {
         const expiresAt = revoked.get(tokenId);
         if (expiresAt === undefined)
             return false;
-        if (expiresAt < Math.floor(Date.now() / 1000)) {
+        if (expiresAt < Math.floor(nowMs() / 1000)) {
             revoked.delete(tokenId);
             return false;
         }
@@ -68,4 +74,31 @@ export function createMemoryTokenRevocationStore(options) {
         },
     };
 }
-//# sourceMappingURL=authToken.revocation.js.map
+/**
+ * Check that a revocation store can claim a refresh token atomically.
+ *
+ * Without `revokeIfNotRevoked`, `createAuthService().refresh()` falls back
+ * to `isRevoked()` then `revoke()`, which leaves a window in which two
+ * concurrent replays of one refresh token both mint a valid pair. That
+ * used to happen silently. Now a `SecurityWarning` with code
+ * {@link RACY_REVOCATION_WARNING_CODE} is emitted through
+ * `process.emitWarning` at construction, or, with `required`, the service
+ * refuses to start.
+ *
+ * @throws {AuthConfigurationError} when `required` and the method is absent.
+ */
+export function assertAtomicRevocationStore(store, required) {
+    if (typeof store.revokeIfNotRevoked === "function")
+        return;
+    const message = "TokenRevocationStore does not implement revokeIfNotRevoked(); " +
+        "refresh() falls back to isRevoked() + revoke(), which is racy: two " +
+        "concurrent replays of one refresh token can both succeed. Implement " +
+        "revokeIfNotRevoked (SET NX in Redis) in any store used in production.";
+    if (required) {
+        throw new AuthConfigurationError(`${message} Set requireAtomicRevocation: false to accept the fallback.`);
+    }
+    process.emitWarning(message, {
+        type: "SecurityWarning",
+        code: RACY_REVOCATION_WARNING_CODE,
+    });
+}

package/dist/authToken/authToken.signing.d.ts

@@ -47,4 +47,3 @@ export declare function verifyToken(token: JwtToken, secret: string, expectedTyp
  * Generate a random token ID.
  */
 export declare function generateTokenId(): TokenId;
-//# sourceMappingURL=authToken.signing.d.ts.map

package/dist/authToken/authToken.signing.js

@@ -119,7 +119,8 @@ export function verifyToken(token, secret, expectedType, config) {
         return { valid: false, error: "Invalid payload" };
     }
     const payload = decoded;
-    const now = Math.floor(Date.now() / 1000);
+    const nowMs = config.clock ? config.clock.now() : Date.now();
+    const now = Math.floor(nowMs / 1000);
     const skew = config.clockToleranceSeconds ?? 0;
     if (payload.exp + skew < now) {
         return { valid: false, error: "Token expired" };
@@ -182,4 +183,3 @@ export function generateTokenId() {
 function hmacSha256(data, secret) {
     return createHmac("sha256", secret).update(data).digest("base64url");
 }
-//# sourceMappingURL=authToken.signing.js.map

package/dist/authToken/index.d.ts

@@ -3,6 +3,5 @@
  *
  * @module authToken
  */
-export { createTokenPair, verifyAccessToken, verifyRefreshToken, refreshAccessToken, } from "./authToken.core.js";
-export { createMemoryTokenRevocationStore } from "./authToken.revocation.js";
-//# sourceMappingURL=index.d.ts.map
+export { createTokenPair, verifyAccessToken, verifyRefreshToken, refreshAccessToken, type CreateTokenPairOptions, } from "./authToken.core.js";
+export { createMemoryTokenRevocationStore, assertAtomicRevocationStore, RACY_REVOCATION_WARNING_CODE, } from "./authToken.revocation.js";

package/dist/authToken/index.js

@@ -4,5 +4,4 @@
  * @module authToken
  */
 export { createTokenPair, verifyAccessToken, verifyRefreshToken, refreshAccessToken, } from "./authToken.core.js";
-export { createMemoryTokenRevocationStore } from "./authToken.revocation.js";
-//# sourceMappingURL=index.js.map
+export { createMemoryTokenRevocationStore, assertAtomicRevocationStore, RACY_REVOCATION_WARNING_CODE, } from "./authToken.revocation.js";

package/dist/authToken/jwt.namespace.d.ts

@@ -25,4 +25,3 @@ export declare const jwt: {
     readonly isTokenExpired: typeof isTokenExpired;
     readonly extractUserId: typeof extractUserId;
 };
-//# sourceMappingURL=jwt.namespace.d.ts.map

package/dist/authToken/jwt.namespace.js

@@ -24,4 +24,3 @@ export const jwt = {
     isTokenExpired,
     extractUserId,
 };
-//# sourceMappingURL=jwt.namespace.js.map

package/dist/authTypes/authAttempt.type.d.ts

@@ -72,4 +72,3 @@ export interface LoginThrottleConfig {
      */
     readonly windowSeconds?: number;
 }
-//# sourceMappingURL=authAttempt.type.d.ts.map

package/dist/authTypes/authAttempt.type.js

@@ -4,4 +4,3 @@
  * @module authTypes/authAttempt
  */
 export {};
-//# sourceMappingURL=authAttempt.type.js.map

package/dist/authTypes/authCredentials.type.d.ts

@@ -23,4 +23,3 @@ export interface PasswordCredentials {
 export interface ApiKeyCredentials {
     readonly apiKey: string;
 }
-//# sourceMappingURL=authCredentials.type.d.ts.map

package/dist/authTypes/authCredentials.type.js

@@ -8,4 +8,3 @@
  * identifier and password directly.
  */
 export {};
-//# sourceMappingURL=authCredentials.type.js.map

package/dist/authTypes/authRbac.type.d.ts

@@ -42,4 +42,3 @@ export interface GuardContext {
     /** Optional resource owner ID (for ownership checks) */
     readonly resourceOwnerId?: string;
 }
-//# sourceMappingURL=authRbac.type.d.ts.map

package/dist/authTypes/authRbac.type.js

@@ -7,4 +7,3 @@
  * For new code, import directly from @zudojs/permissions.
  */
 export {};
-//# sourceMappingURL=authRbac.type.js.map

package/dist/authTypes/authSession.type.d.ts

@@ -82,4 +82,3 @@ export interface SessionStore {
     /** Destroy all sessions for a user */
     destroyAllForUser(userId: UserId): Promise<void>;
 }
-//# sourceMappingURL=authSession.type.d.ts.map

package/dist/authTypes/authSession.type.js

@@ -20,4 +20,3 @@ export function toSessionId(value) {
     }
     return value;
 }
-//# sourceMappingURL=authSession.type.js.map

package/dist/authTypes/authToken.type.d.ts

@@ -5,6 +5,7 @@
  */
 import type { UserId } from "../authTypes/authUser.type.js";
 import type { SessionId, TokenId } from "@zudojs/constants";
+import type { Clock } from "@zudojs/types";
 /** JWT token string. */
 export type JwtToken = string;
 /** Token identifier. Re-exported from @zudojs/constants for type safety. */
@@ -70,6 +71,13 @@ export interface TokenConfig {
      * (default: 0, maximum: 300).
      */
     readonly clockToleranceSeconds?: number;
+    /**
+     * Time source for `iat`/`exp` when minting and for expiry when verifying
+     * (default: `Date.now`). Inject a fixed or advanceable clock in tests
+     * instead of faking global timers. `createAuthService({ clock })` sets it
+     * for you.
+     */
+    readonly clock?: Clock;
 }
 /**
  * Store for revoked token IDs (`jti` claims).
@@ -116,4 +124,3 @@ export interface TokenVerificationResult {
     /** Error message (if invalid) */
     readonly error?: string;
 }
-//# sourceMappingURL=authToken.type.d.ts.map

package/dist/authTypes/authToken.type.js

@@ -4,4 +4,3 @@
  * @module authToken/authToken
  */
 export {};
-//# sourceMappingURL=authToken.type.js.map

package/dist/authTypes/authUser.type.d.ts

@@ -29,7 +29,13 @@ export interface AuthUser {
     readonly name?: string;
     /** Assigned roles */
     readonly roles: readonly string[];
-    /** Custom claims */
+    /**
+     * Custom claims embedded in every token `createAuthService()` mints for
+     * this user (`login()`, `refresh()`, `createSessionForUser()`), e.g.
+     * `{ plan: "pro" }`. Reserved JWT names (`sub`, `exp`, `roles`, `sid`, ...)
+     * are dropped, never overridden; see `RESERVED_JWT_CLAIMS`. Keep them
+     * small and non-sensitive: they are readable by anyone holding the token.
+     */
     readonly claims?: Record<string, unknown>;
     /** Whether the user is active */
     readonly active: boolean;
@@ -56,4 +62,3 @@ export interface UserRegistration {
     readonly name?: string;
     readonly roles?: readonly string[];
 }
-//# sourceMappingURL=authUser.type.d.ts.map

package/dist/authTypes/authUser.type.js

@@ -20,4 +20,3 @@ export function toUserId(value) {
     }
     return value;
 }
-//# sourceMappingURL=authUser.type.js.map

package/dist/authTypes/index.d.ts

@@ -9,4 +9,3 @@ export { type SessionId, toSessionId, type AuthSession, type CreateSessionOption
 export { type PasswordCredentials, type ApiKeyCredentials, } from "./authCredentials.type.js";
 export { type LoginAttemptRecord, type LoginAttemptStore, type LoginThrottleConfig, } from "./authAttempt.type.js";
 export { type Permission, type Role, type GuardResult, type GuardContext, } from "./authRbac.type.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/authTypes/index.js

@@ -9,4 +9,3 @@ export { toSessionId, } from "./authSession.type.js";
 export {} from "./authCredentials.type.js";
 export {} from "./authAttempt.type.js";
 export {} from "./authRbac.type.js";
-//# sourceMappingURL=index.js.map

package/dist/authUtils/authUtils.claims.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Custom JWT claim handling.
+ *
+ * @module authUtils/authUtils.claims
+ */
+/**
+ * Claim names the token minter owns. A custom claim with one of these names
+ * is dropped rather than embedded, so `user.claims` can never forge the
+ * subject, lifetime, type, id, session binding, roles, issuer or audience of
+ * a token.
+ */
+export declare const RESERVED_JWT_CLAIMS: ReadonlySet<string>;
+/**
+ * Return the custom claims that may be embedded in a token: every own,
+ * enumerable entry of `claims` whose name is not reserved and whose value
+ * is not `undefined`.
+ *
+ * @param claims - Custom claims, typically `AuthUser.claims`.
+ * @returns A fresh plain object, or `undefined` when nothing survives.
+ */
+export declare function sanitizeCustomClaims(claims: Readonly<Record<string, unknown>> | undefined): Record<string, unknown> | undefined;

package/dist/authUtils/authUtils.claims.js

@@ -0,0 +1,44 @@
+/**
+ * Custom JWT claim handling.
+ *
+ * @module authUtils/authUtils.claims
+ */
+/**
+ * Claim names the token minter owns. A custom claim with one of these names
+ * is dropped rather than embedded, so `user.claims` can never forge the
+ * subject, lifetime, type, id, session binding, roles, issuer or audience of
+ * a token.
+ */
+export const RESERVED_JWT_CLAIMS = new Set([
+    "sub",
+    "iat",
+    "exp",
+    "nbf",
+    "typ",
+    "jti",
+    "sid",
+    "roles",
+    "iss",
+    "aud",
+]);
+/**
+ * Return the custom claims that may be embedded in a token: every own,
+ * enumerable entry of `claims` whose name is not reserved and whose value
+ * is not `undefined`.
+ *
+ * @param claims - Custom claims, typically `AuthUser.claims`.
+ * @returns A fresh plain object, or `undefined` when nothing survives.
+ */
+export function sanitizeCustomClaims(claims) {
+    if (!claims)
+        return undefined;
+    const result = {};
+    let count = 0;
+    for (const [name, value] of Object.entries(claims)) {
+        if (RESERVED_JWT_CLAIMS.has(name) || value === undefined)
+            continue;
+        result[name] = value;
+        count++;
+    }
+    return count > 0 ? result : undefined;
+}

package/dist/authUtils/authUtils.helper.d.ts

@@ -35,10 +35,13 @@ export declare function parseCookies(cookie: unknown): Record<string, string>;
  * I refresh before calling?"), never as an authorization decision.
  *
  * @param token - JWT token string
+ * @param clock - Time source (default: `Date.now`).
  * @returns Whether the token appears expired. Unparseable, oversized, or
  *   malformed input is reported as expired.
  */
-export declare function isTokenExpired(token: unknown): boolean;
+export declare function isTokenExpired(token: unknown, clock?: {
+    now(): number;
+}): boolean;
 /**
  * Extract the user ID from a JWT payload **without verifying the signature**.
  *
@@ -62,4 +65,3 @@ export declare function extractUserId(token: unknown): string | null;
  * @returns Random hex string for CSRF protection
  */
 export declare function generateCsrfToken(): string;
-//# sourceMappingURL=authUtils.helper.d.ts.map

package/dist/authUtils/authUtils.helper.js

@@ -76,10 +76,11 @@ export function parseCookies(cookie) {
  * I refresh before calling?"), never as an authorization decision.
  *
  * @param token - JWT token string
+ * @param clock - Time source (default: `Date.now`).
  * @returns Whether the token appears expired. Unparseable, oversized, or
  *   malformed input is reported as expired.
  */
-export function isTokenExpired(token) {
+export function isTokenExpired(token, clock) {
     const parts = splitToken(token);
     if (!parts)
         return true;
@@ -87,7 +88,7 @@ export function isTokenExpired(token) {
     if (!payload)
         return true;
     const exp = payload["exp"];
-    const now = Math.floor(Date.now() / 1000);
+    const now = Math.floor((clock ? clock.now() : Date.now()) / 1000);
     return typeof exp !== "number" || !Number.isFinite(exp) || exp < now;
 }
 /**
@@ -124,4 +125,3 @@ export function extractUserId(token) {
 export function generateCsrfToken() {
     return randomBytes(32).toString("hex");
 }
-//# sourceMappingURL=authUtils.helper.js.map

package/dist/authUtils/authUtils.identifier.d.ts

@@ -18,4 +18,3 @@
  * @returns The normalized identifier.
  */
 export declare function normalizeLoginIdentifier(identifier: string): string;
-//# sourceMappingURL=authUtils.identifier.d.ts.map

package/dist/authUtils/authUtils.identifier.js

@@ -22,4 +22,3 @@ export function normalizeLoginIdentifier(identifier) {
     const trimmed = String(identifier).normalize("NFKC").trim();
     return isEmail(trimmed) ? trimmed.toLowerCase() : trimmed;
 }
-//# sourceMappingURL=authUtils.identifier.js.map

package/dist/authUtils/index.d.ts

@@ -6,4 +6,4 @@
  */
 export { parseBearerToken, parseCookies, isTokenExpired, extractUserId, generateCsrfToken, } from "./authUtils.helper.js";
 export { normalizeLoginIdentifier } from "./authUtils.identifier.js";
-//# sourceMappingURL=index.d.ts.map
+export { RESERVED_JWT_CLAIMS, sanitizeCustomClaims, } from "./authUtils.claims.js";

package/dist/authUtils/index.js

@@ -6,4 +6,4 @@
  */
 export { parseBearerToken, parseCookies, isTokenExpired, extractUserId, generateCsrfToken, } from "./authUtils.helper.js";
 export { normalizeLoginIdentifier } from "./authUtils.identifier.js";
-//# sourceMappingURL=index.js.map
+export { RESERVED_JWT_CLAIMS, sanitizeCustomClaims, } from "./authUtils.claims.js";

package/dist/index.d.ts

@@ -16,4 +16,3 @@ export { jwt } from "./authToken/jwt.namespace.js";
 export * from "./authSession/index.js";
 export * from "./authProvider/index.js";
 export * from "./authUtils/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -16,4 +16,3 @@ export { jwt } from "./authToken/jwt.namespace.js";
 export * from "./authSession/index.js";
 export * from "./authProvider/index.js";
 export * from "./authUtils/index.js";
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/auth",
-  "version": "1.3.3",
+  "version": "1.4.0",
   "description": "Authentication and authorization services for the Zudojs framework — JWT, sessions, RBAC, and password management.",
   "license": "MIT",
   "author": {
@@ -25,11 +25,11 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/constants": "1.1.4",
-    "@zudojs/crypto": "1.3.3",
-    "@zudojs/errors": "1.3.2",
-    "@zudojs/permissions": "1.4.3",
-    "@zudojs/types": "1.2.0"
+    "@zudojs/constants": "1.2.0",
+    "@zudojs/crypto": "1.4.0",
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/permissions": "1.5.0",
+    "@zudojs/types": "1.3.0"
   },
   "engines": {
     "node": ">=24.0.0"