From 96383c3f6585a916b71bacbf7c9cada3f2ae9bca Mon Sep 17 00:00:00 2001 From: Memet Date: Fri, 7 Aug 2026 02:26:01 +0300 Subject: [PATCH] chore: version packages --- .changeset/dts-self-contained.md | 33 ------------- .../jwt-paseto-validate-custom-store.md | 8 ---- .changeset/opaque-passkey-workspace-caret.md | 10 ---- .changeset/passkey-aaguid-corrections.md | 12 ----- .../passkey-typed-errors-shared-predicates.md | 17 ------- packages/apikey/CHANGELOG.md | 14 ++++++ packages/apikey/package.json | 2 +- packages/challenge/CHANGELOG.md | 14 ++++++ packages/challenge/package.json | 2 +- packages/crypto/CHANGELOG.md | 14 ++++++ packages/crypto/package.json | 2 +- packages/jwe/CHANGELOG.md | 14 ++++++ packages/jwe/package.json | 2 +- packages/jwk/CHANGELOG.md | 14 ++++++ packages/jwk/package.json | 2 +- packages/jwks/CHANGELOG.md | 17 +++++++ packages/jwks/package.json | 2 +- packages/jws/CHANGELOG.md | 14 ++++++ packages/jws/package.json | 2 +- packages/jwt/CHANGELOG.md | 25 ++++++++++ packages/jwt/package.json | 2 +- packages/magic-link/CHANGELOG.md | 14 ++++++ packages/magic-link/package.json | 2 +- packages/oauth2/CHANGELOG.md | 23 +++++++++ packages/oauth2/package.json | 2 +- packages/opaque/CHANGELOG.md | 21 +++++++++ packages/opaque/package.json | 2 +- packages/otp/CHANGELOG.md | 14 ++++++ packages/otp/package.json | 2 +- packages/paseto/CHANGELOG.md | 25 ++++++++++ packages/paseto/package.json | 2 +- packages/passkey/CHANGELOG.md | 47 +++++++++++++++++++ packages/passkey/package.json | 2 +- packages/password/CHANGELOG.md | 14 ++++++ packages/password/package.json | 2 +- packages/security/CHANGELOG.md | 14 ++++++ packages/security/package.json | 2 +- packages/session/CHANGELOG.md | 17 +++++++ packages/session/package.json | 2 +- packages/ua/CHANGELOG.md | 14 ++++++ packages/ua/package.json | 2 +- 41 files changed, 347 insertions(+), 98 deletions(-) delete mode 100644 .changeset/dts-self-contained.md delete mode 100644 .changeset/jwt-paseto-validate-custom-store.md delete mode 100644 .changeset/opaque-passkey-workspace-caret.md delete mode 100644 .changeset/passkey-aaguid-corrections.md delete mode 100644 .changeset/passkey-typed-errors-shared-predicates.md diff --git a/.changeset/dts-self-contained.md b/.changeset/dts-self-contained.md deleted file mode 100644 index dcc9859..0000000 --- a/.changeset/dts-self-contained.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -'@exortek/apikey': patch -'@exortek/challenge': patch -'@exortek/crypto': patch -'@exortek/jwe': patch -'@exortek/jwk': patch -'@exortek/jwks': patch -'@exortek/jws': patch -'@exortek/jwt': patch -'@exortek/magic-link': patch -'@exortek/oauth2': patch -'@exortek/opaque': patch -'@exortek/otp': patch -'@exortek/paseto': patch -'@exortek/passkey': patch -'@exortek/password': patch -'@exortek/security': patch -'@exortek/session': patch -'@exortek/ua': patch ---- - -Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` -referenced `@exortek/shared` (e.g. `import { BaseError } from '@exortek/shared/errors'`), -but `@exortek/shared` is a private, never-published workspace package that is -inlined into each bundle at build time. A TypeScript consumer therefore hit -`Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently -degraded error-class types like `ApiKeyError` — losing its constructor -signature and `.code` / `.message` — with `skipLibCheck` on. - -The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after -`tsc`, flattening each entry's `.d.ts` and inlining the `@exortek/shared` types -so the shipped declarations are fully self-contained. Runtime deps and `node:*` -stay external. No runtime or API change — types only. diff --git a/.changeset/jwt-paseto-validate-custom-store.md b/.changeset/jwt-paseto-validate-custom-store.md deleted file mode 100644 index 2b1e191..0000000 --- a/.changeset/jwt-paseto-validate-custom-store.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -'@exortek/jwt': minor -'@exortek/paseto': minor ---- - -Validate custom store implementations at construction time. `createStore('custom', { impl })` previously accepted any object and returned it verbatim, so a store missing a required method surfaced only later as a `TypeError` deep inside a token operation. It now asserts the impl exposes the core registry contract — `add`, `has`, `get`, `delete`, `deleteAll` — and throws `INVALID_ARGUMENT` immediately when one is missing (`markUsed` stays optional, since only refresh-token rotation calls it). - -Behaviour change: an incomplete custom store that happened to work — because the missing method was never exercised — is now rejected up front. Complete implementations are unaffected and are still returned verbatim (no wrapping). diff --git a/.changeset/opaque-passkey-workspace-caret.md b/.changeset/opaque-passkey-workspace-caret.md deleted file mode 100644 index 5715f2e..0000000 --- a/.changeset/opaque-passkey-workspace-caret.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@exortek/opaque': patch -'@exortek/passkey': patch ---- - -Publish sanctioned cross-package edges with a `workspace:^` range instead of -`workspace:*`. The exact pin forced an exact `@exortek/crypto` (and, for -passkey, `@exortek/challenge`) version into consumer trees, which could -duplicate a copy of the dependency; the caret range dedupes to a single shared -install. Aligns both manifests with the range policy in `AGENTS.md`. diff --git a/.changeset/passkey-aaguid-corrections.md b/.changeset/passkey-aaguid-corrections.md deleted file mode 100644 index 815b286..0000000 --- a/.changeset/passkey-aaguid-corrections.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@exortek/passkey': patch ---- - -Correct and expand the built-in AAGUID → authenticator-name baseline (`@exortek/passkey/aaguid`), verified against the Passkey.dev community list. - -Two entries were wrong: - -- `d548826e-79b4-db40-a3d8-11116f7e8349` is **Bitwarden**, not "Google Password Manager (Android)" — a real Bitwarden passkey was reported under the wrong name (and no such Google AAGUID exists). -- `d197a58d-4c07-4cff-8180-4e6c8fdd9c05` was labelled "Bitwarden" but is not Bitwarden's AAGUID; removed. - -Also renamed `fbfc3007-…` from "iCloud Keychain" to its current name **Apple Passwords**, and added six common providers: Bitwarden, Dashlane, Keeper, NordPass, Samsung Pass, Chrome on Mac, Edge on Mac. diff --git a/.changeset/passkey-typed-errors-shared-predicates.md b/.changeset/passkey-typed-errors-shared-predicates.md deleted file mode 100644 index be0eb88..0000000 --- a/.changeset/passkey-typed-errors-shared-predicates.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@exortek/passkey': minor ---- - -Every passkey failure now throws a typed `PasskeyError` with a branchable -`code`. The binary parsers (CBOR, ASN.1 DER, COSE, X.509, and the WebAuthn -authenticator/client-data readers) previously threw generic `Error`s, so a -malformed attestation or assertion surfaced from the public API with no `code` — -breaking the package's "branch on `err.code`" contract. They now carry proper -codes, including a new `ErrorCode.DECODE_ERROR` for low-level CBOR/DER decode -failures. Existing `try/catch` keeps working (`PasskeyError extends Error`); the -new capability is that `err.code` is now populated for parser failures too. - -Internally, the 24 per-code `throwXxx` factory exports were removed in favour of -constructing `PasskeyError` directly (matching jwt / apikey / session), and the -argument checks now use `@exortek/shared/predicates`. No public-API surface was -removed — `index` only ever re-exported `PasskeyError` and `ErrorCode`. diff --git a/packages/apikey/CHANGELOG.md b/packages/apikey/CHANGELOG.md index 83701e0..f01efad 100644 --- a/packages/apikey/CHANGELOG.md +++ b/packages/apikey/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/apikey +## 1.1.3 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.1.2 ### Patch Changes diff --git a/packages/apikey/package.json b/packages/apikey/package.json index 1c9859f..c97e471 100644 --- a/packages/apikey/package.json +++ b/packages/apikey/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/apikey", - "version": "1.1.2", + "version": "1.1.3", "description": "Stripe-style prefixed API keys for Node.js — 3-segment tokens (prefix_id_secret), HMAC-SHA256 storage hash with pepper rotation, scope allowlists with wildcard match, opt-in lastUsedAt tracking, memory + Redis stores, Express + Fastify middleware. Server-only. Zero non-@exortek runtime dependencies.", "type": "module", "sideEffects": false, diff --git a/packages/challenge/CHANGELOG.md b/packages/challenge/CHANGELOG.md index 3a87ec7..93b4354 100644 --- a/packages/challenge/CHANGELOG.md +++ b/packages/challenge/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/challenge +## 1.1.3 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.1.2 ### Patch Changes diff --git a/packages/challenge/package.json b/packages/challenge/package.json index f1fd97c..0e7de93 100644 --- a/packages/challenge/package.json +++ b/packages/challenge/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/challenge", - "version": "1.1.2", + "version": "1.1.3", "description": "Signed, single-use challenge tokens for multi-step auth flows on Node.js — carries userId / method / step / metadata across a redirect or a second request without a server-side session; HMAC-signed, expiring, optional IP-binding, single-use enforcement via any @exortek/security store.", "type": "module", "sideEffects": false, diff --git a/packages/crypto/CHANGELOG.md b/packages/crypto/CHANGELOG.md index 4a3110e..1202cdd 100644 --- a/packages/crypto/CHANGELOG.md +++ b/packages/crypto/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/crypto +## 1.1.1 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.1.0 ### Minor Changes diff --git a/packages/crypto/package.json b/packages/crypto/package.json index f291561..d668811 100644 --- a/packages/crypto/package.json +++ b/packages/crypto/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/crypto", - "version": "1.1.0", + "version": "1.1.1", "description": "Zero-dependency cryptographic primitives for Node.js — hash / hmac / KDFs (PBKDF2, HKDF, scrypt), AES-GCM / ChaCha20-Poly1305 / RSA-OAEP ciphers, RS/PS/ES/EdDSA signatures, signed cookies, sealed timed tokens, CSPRNG (UUID v4/5/7, ULID, base58, crockford), and encoders — all built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/jwe/CHANGELOG.md b/packages/jwe/CHANGELOG.md index 29def60..bb20e25 100644 --- a/packages/jwe/CHANGELOG.md +++ b/packages/jwe/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/jwe +## 1.0.2 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.0.1 ### Patch Changes diff --git a/packages/jwe/package.json b/packages/jwe/package.json index ea24b9c..a596ed2 100644 --- a/packages/jwe/package.json +++ b/packages/jwe/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/jwe", - "version": "1.0.1", + "version": "1.0.2", "description": "JSON Web Encryption (JWE) — RFC 7516 / RFC 7518 for Node.js 22+. Compact serialization, RSA-OAEP / ECDH-ES / AES-KW / dir key management, AES-GCM + AES-CBC-HMAC content encryption. Alg + enc allowlist mandatory on decrypt. `RSA1_5` never accepted. Zero-dependency, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/jwk/CHANGELOG.md b/packages/jwk/CHANGELOG.md index 18b5f11..8c71389 100644 --- a/packages/jwk/CHANGELOG.md +++ b/packages/jwk/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/jwk +## 1.0.4 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.0.3 ### Patch Changes diff --git a/packages/jwk/package.json b/packages/jwk/package.json index 5272d4a..352fd7a 100644 --- a/packages/jwk/package.json +++ b/packages/jwk/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/jwk", - "version": "1.0.3", + "version": "1.0.4", "description": "JSON Web Key (JWK) — RFC 7517 / RFC 7638 / RFC 8037 for Node.js. Generate, import, export, thumbprint EC / RSA / OKP / oct keys. Zero-dependency, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/jwks/CHANGELOG.md b/packages/jwks/CHANGELOG.md index 5e0c616..4e5d69b 100644 --- a/packages/jwks/CHANGELOG.md +++ b/packages/jwks/CHANGELOG.md @@ -1,5 +1,22 @@ # @exortek/jwks +## 1.1.1 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + +- Updated dependencies [89aea87] + - @exortek/jwk@1.0.4 + ## 1.1.0 ### Minor Changes diff --git a/packages/jwks/package.json b/packages/jwks/package.json index da1f5ca..a1be9ea 100644 --- a/packages/jwks/package.json +++ b/packages/jwks/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/jwks", - "version": "1.1.0", + "version": "1.1.1", "description": "JSON Web Key Set (JWKS) for Node.js — local key set management with zero-downtime rotation, remote JWKS URI fetching with kid-miss refetch, Express/Fastify handler for /.well-known/jwks.json. Zero non-@exortek runtime dependencies.", "type": "module", "sideEffects": false, diff --git a/packages/jws/CHANGELOG.md b/packages/jws/CHANGELOG.md index b5cf04d..a6d75d7 100644 --- a/packages/jws/CHANGELOG.md +++ b/packages/jws/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/jws +## 1.0.4 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.0.3 ### Patch Changes diff --git a/packages/jws/package.json b/packages/jws/package.json index f5a7da8..1a6df26 100644 --- a/packages/jws/package.json +++ b/packages/jws/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/jws", - "version": "1.0.3", + "version": "1.0.4", "description": "JSON Web Signature (JWS) — RFC 7515 / RFC 7518 / RFC 7797 / RFC 8037 / RFC 8812 for Node.js 22+. Compact + JSON serialization, detached content, unencoded payload, HS/RS/PS/ES/EdDSA. Alg allowlist mandatory. `none` never accepted. Zero-dependency, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/jwt/CHANGELOG.md b/packages/jwt/CHANGELOG.md index 75b9552..84b4745 100644 --- a/packages/jwt/CHANGELOG.md +++ b/packages/jwt/CHANGELOG.md @@ -1,5 +1,30 @@ # @exortek/jwt +## 1.3.0 + +### Minor Changes + +- 89aea87: Validate custom store implementations at construction time. `createStore('custom', { impl })` previously + accepted any object and returned it verbatim, so a store missing a required method surfaced only later as a + `TypeError` deep inside a token operation. It now asserts the impl exposes the core registry contract — `add`, `has`, + `get`, `delete`, `deleteAll` — and throws `INVALID_ARGUMENT` immediately when one is missing (`markUsed` stays + optional, since only refresh-token rotation calls it). + + Behaviour change: an incomplete custom store that happened to work — because the missing method was never exercised — + is now rejected up front. Complete implementations are unaffected and are still returned verbatim (no wrapping). + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.2.3 ### Patch Changes diff --git a/packages/jwt/package.json b/packages/jwt/package.json index c577736..8b6e4b5 100644 --- a/packages/jwt/package.json +++ b/packages/jwt/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/jwt", - "version": "1.2.3", + "version": "1.3.0", "description": "JSON Web Token (JWT) — RFC 7519 / RFC 7518 / RFC 8725 / RFC 9068 for Node.js 22+. sign / verify / decode / peek, tokenPair (access + refresh) with reuse detection, blacklist store (memory / redis / custom), claims validation (exp / nbf / iat / iss / aud / sub / jti / nonce / typ / maxAge / scope), PEM + X.509 cert input, custom fn escape hatch on every knob. Alg allowlist mandatory. `none` never accepted. Zero-dependency, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/magic-link/CHANGELOG.md b/packages/magic-link/CHANGELOG.md index e9e80e7..0218266 100644 --- a/packages/magic-link/CHANGELOG.md +++ b/packages/magic-link/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/magic-link +## 2.1.3 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 2.1.2 ### Patch Changes diff --git a/packages/magic-link/package.json b/packages/magic-link/package.json index f50aa7f..35b5db0 100644 --- a/packages/magic-link/package.json +++ b/packages/magic-link/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/magic-link", - "version": "2.1.2", + "version": "2.1.3", "description": "Passwordless email-link auth for Node.js — HMAC-signed short-lived tokens (mlink_v1..), single-use enforcement, opt-in per-email rate limiting, hashed email in payload by default (SHA-256), configurable prefix, memory + Redis stores. Ships the token — you send the email.", "type": "module", "sideEffects": false, diff --git a/packages/oauth2/CHANGELOG.md b/packages/oauth2/CHANGELOG.md index 01850cc..18a9da7 100644 --- a/packages/oauth2/CHANGELOG.md +++ b/packages/oauth2/CHANGELOG.md @@ -1,5 +1,28 @@ # @exortek/oauth2 +## 1.1.1 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + +- Updated dependencies [89aea87] +- Updated dependencies [89aea87] + - @exortek/jwe@1.0.2 + - @exortek/jwk@1.0.4 + - @exortek/jwks@1.1.1 + - @exortek/jws@1.0.4 + - @exortek/jwt@1.3.0 + - @exortek/paseto@1.1.0 + ## 1.1.0 ### Minor Changes diff --git a/packages/oauth2/package.json b/packages/oauth2/package.json index 64520e7..61cf0b6 100644 --- a/packages/oauth2/package.json +++ b/packages/oauth2/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/oauth2", - "version": "1.1.0", + "version": "1.1.1", "description": "OAuth 2.1 for Node.js 22+ — both halves, secure by default. The relying-party flow (createOAuth + provider presets, mandatory PKCE / state / nonce / iss) and a full authorization server (DPoP incl. nonce, PAR, JAR/JARM, resource indicators, device grant, token exchange, FAPI 2.0) over JWT or PASETO. Server-only, zero non-@exortek/* runtime dependencies, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/opaque/CHANGELOG.md b/packages/opaque/CHANGELOG.md index a2b2b5c..484abd7 100644 --- a/packages/opaque/CHANGELOG.md +++ b/packages/opaque/CHANGELOG.md @@ -1,5 +1,26 @@ # @exortek/opaque +## 1.0.4 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + +- e9fc662: Publish sanctioned cross-package edges with a `workspace:^` range instead of `workspace:*`. The exact pin + forced an exact `@exortek/crypto` (and, for passkey, `@exortek/challenge`) version into consumer trees, which could + duplicate a copy of the dependency; the caret range dedupes to a single shared install. Aligns both manifests with the + range policy in `AGENTS.md`. +- Updated dependencies [89aea87] + - @exortek/crypto@1.1.1 + ## 1.0.3 ### Patch Changes diff --git a/packages/opaque/package.json b/packages/opaque/package.json index 422d905..0d406f9 100644 --- a/packages/opaque/package.json +++ b/packages/opaque/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/opaque", - "version": "1.0.3", + "version": "1.0.4", "description": "Opaque reference tokens for Node.js 22+ — random unstructured tokens with no embedded payload, memory + Redis stores, RFC 7662 introspection and RFC 7009 revocation HTTP handlers. Zero non-@exortek/* runtime dependencies.", "type": "module", "sideEffects": false, diff --git a/packages/otp/CHANGELOG.md b/packages/otp/CHANGELOG.md index 1c19200..651af7a 100644 --- a/packages/otp/CHANGELOG.md +++ b/packages/otp/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/otp +## 1.1.4 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.1.3 ### Patch Changes diff --git a/packages/otp/package.json b/packages/otp/package.json index 20df8fc..96927fc 100644 --- a/packages/otp/package.json +++ b/packages/otp/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/otp", - "version": "1.1.3", + "version": "1.1.4", "description": "TOTP (RFC 6238) and HOTP (RFC 4226) one-time passwords for Node.js — secure defaults, tunable window / algorithm / digits, opt-in replay defense via any @exortek/security store, backup codes with unambiguous alphabet, and Google-Authenticator-compatible provisioning URIs.", "type": "module", "sideEffects": false, diff --git a/packages/paseto/CHANGELOG.md b/packages/paseto/CHANGELOG.md index bbdf652..e038abb 100644 --- a/packages/paseto/CHANGELOG.md +++ b/packages/paseto/CHANGELOG.md @@ -1,5 +1,30 @@ # @exortek/paseto +## 1.1.0 + +### Minor Changes + +- 89aea87: Validate custom store implementations at construction time. `createStore('custom', { impl })` previously + accepted any object and returned it verbatim, so a store missing a required method surfaced only later as a + `TypeError` deep inside a token operation. It now asserts the impl exposes the core registry contract — `add`, `has`, + `get`, `delete`, `deleteAll` — and throws `INVALID_ARGUMENT` immediately when one is missing (`markUsed` stays + optional, since only refresh-token rotation calls it). + + Behaviour change: an incomplete custom store that happened to work — because the missing method was never exercised — + is now rejected up front. Complete implementations are unaffected and are still returned verbatim (no wrapping). + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.0.1 ### Patch Changes diff --git a/packages/paseto/package.json b/packages/paseto/package.json index 1957158..99a0207 100644 --- a/packages/paseto/package.json +++ b/packages/paseto/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/paseto", - "version": "1.0.1", + "version": "1.1.0", "description": "PASETO (Platform-Agnostic Security Tokens) for Node.js 22+. v4.local (XChaCha20 + keyed BLAKE2b) + v4.public (Ed25519). Purpose is bound into the token — no algorithm-confusion attacks. Server-only, zero-dependency, built on node:crypto.", "type": "module", "sideEffects": false, diff --git a/packages/passkey/CHANGELOG.md b/packages/passkey/CHANGELOG.md index 70c3d09..ea1a4e1 100644 --- a/packages/passkey/CHANGELOG.md +++ b/packages/passkey/CHANGELOG.md @@ -1,5 +1,52 @@ # @exortek/passkey +## 1.1.0 + +### Minor Changes + +- ee78259: Every passkey failure now throws a typed `PasskeyError` with a branchable `code`. The binary parsers (CBOR, + ASN.1 DER, COSE, X.509, and the WebAuthn authenticator/client-data readers) previously threw generic `Error`s, so a + malformed attestation or assertion surfaced from the public API with no `code` — breaking the package's "branch on + `err.code`" contract. They now carry proper codes, including a new `ErrorCode.DECODE_ERROR` for low-level CBOR/DER + decode failures. Existing `try/catch` keeps working (`PasskeyError extends Error`); the new capability is that + `err.code` is now populated for parser failures too. + + Internally, the 24 per-code `throwXxx` factory exports were removed in favour of constructing `PasskeyError` directly + (matching jwt / apikey / session), and the argument checks now use `@exortek/shared/predicates`. No public-API surface + was removed — `index` only ever re-exported `PasskeyError` and `ErrorCode`. + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + +- e9fc662: Publish sanctioned cross-package edges with a `workspace:^` range instead of `workspace:*`. The exact pin + forced an exact `@exortek/crypto` (and, for passkey, `@exortek/challenge`) version into consumer trees, which could + duplicate a copy of the dependency; the caret range dedupes to a single shared install. Aligns both manifests with the + range policy in `AGENTS.md`. +- 3f6ce12: Correct and expand the built-in AAGUID → authenticator-name baseline (`@exortek/passkey/aaguid`), verified + against the Passkey.dev community list. + + Two entries were wrong: + + - `d548826e-79b4-db40-a3d8-11116f7e8349` is **Bitwarden**, not "Google Password Manager (Android)" — a real Bitwarden + passkey was reported under the wrong name (and no such Google AAGUID exists). + - `d197a58d-4c07-4cff-8180-4e6c8fdd9c05` was labelled "Bitwarden" but is not Bitwarden's AAGUID; removed. + + Also renamed `fbfc3007-…` from "iCloud Keychain" to its current name **Apple Passwords**, and added six common + providers: Bitwarden, Dashlane, Keeper, NordPass, Samsung Pass, Chrome on Mac, Edge on Mac. + +- Updated dependencies [89aea87] + - @exortek/challenge@1.1.3 + - @exortek/crypto@1.1.1 + ## 1.0.3 ### Patch Changes diff --git a/packages/passkey/package.json b/packages/passkey/package.json index b9ffc50..b9cfcf7 100644 --- a/packages/passkey/package.json +++ b/packages/passkey/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/passkey", - "version": "1.0.3", + "version": "1.1.0", "description": "WebAuthn / FIDO2 server verification for Node.js 22+ — registration + authentication with an in-house CBOR + COSE + ASN.1 stack, all seven attestation formats (none, packed, fido-u2f, tpm, android-key, android-safetynet, apple), challenge store via @exortek/challenge. Zero non-@exortek/* runtime dependencies.", "type": "module", "sideEffects": false, diff --git a/packages/password/CHANGELOG.md b/packages/password/CHANGELOG.md index 0a18050..deab2a5 100644 --- a/packages/password/CHANGELOG.md +++ b/packages/password/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/password +## 1.1.5 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.1.4 ### Patch Changes diff --git a/packages/password/package.json b/packages/password/package.json index 306757e..62ae675 100644 --- a/packages/password/package.json +++ b/packages/password/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/password", - "version": "1.1.4", + "version": "1.1.5", "description": "Password hashing, verification, strength scoring, generation, policy validation, HIBP breach lookup, peppering and history helpers for Node.js — argon2id, scrypt, bcrypt, pbkdf2 under one coherent API with automatic algorithm routing on verify.", "type": "module", "sideEffects": false, diff --git a/packages/security/CHANGELOG.md b/packages/security/CHANGELOG.md index 449c79e..d1b26c4 100644 --- a/packages/security/CHANGELOG.md +++ b/packages/security/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/security +## 1.3.5 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.3.4 ### Patch Changes diff --git a/packages/security/package.json b/packages/security/package.json index a13efe8..d50d52a 100644 --- a/packages/security/package.json +++ b/packages/security/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/security", - "version": "1.3.4", + "version": "1.3.5", "description": "Framework-agnostic defensive HTTP layer for Node.js 22+ — CSRF, sliding/fixed/token-bucket/leaky-bucket rate limiting (memory / Redis / custom stores, plus withBan escalation), helmet-style headers (CSP, HSTS, COOP/COEP/CORP, Referrer, Permissions), CORS, open-redirect guard, and 17 focused helpers (client-IP, CSP nonce, slow-down, body limit, timeout, HPP, NoSQL sanitizer, prototype-safe JSON parse, prototype freezer, path traversal, filename sanitizer, honeypot, webhook signature verify, bearer parser, origin check, constant-time compare, CSP report parser). Adapters for Fastify and Express.", "type": "module", "sideEffects": false, diff --git a/packages/session/CHANGELOG.md b/packages/session/CHANGELOG.md index 70452a7..cc24c79 100644 --- a/packages/session/CHANGELOG.md +++ b/packages/session/CHANGELOG.md @@ -1,5 +1,22 @@ # @exortek/session +## 1.4.3 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + +- Updated dependencies [89aea87] + - @exortek/crypto@1.1.1 + ## 1.4.2 ### Patch Changes diff --git a/packages/session/package.json b/packages/session/package.json index 57c9675..ab8d9e7 100644 --- a/packages/session/package.json +++ b/packages/session/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/session", - "version": "1.4.2", + "version": "1.4.3", "description": "Sealed-cookie session manager for Node.js — rotation, revocation, sudo mode, impersonation, concurrent limits, fingerprint binding, device labels, Redis distributed revocation, and adapters for Fastify and Express.", "type": "module", "sideEffects": false, diff --git a/packages/ua/CHANGELOG.md b/packages/ua/CHANGELOG.md index a236735..4a4b528 100644 --- a/packages/ua/CHANGELOG.md +++ b/packages/ua/CHANGELOG.md @@ -1,5 +1,19 @@ # @exortek/ua +## 1.0.3 + +### Patch Changes + +- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared` + (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published + workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit + `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like + `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on. + + The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and + inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*` + stay external. No runtime or API change — types only. + ## 1.0.2 ### Patch Changes diff --git a/packages/ua/package.json b/packages/ua/package.json index 8003462..410e5f3 100644 --- a/packages/ua/package.json +++ b/packages/ua/package.json @@ -1,6 +1,6 @@ { "name": "@exortek/ua", - "version": "1.0.2", + "version": "1.0.3", "description": "User-Agent parser — browser, OS, device, engine, CPU detection + bot/AI crawler taxonomy + Client Hints + request fingerprinting. Tree-shakeable, ESM+CJS. Full-featured, high-performance.", "type": "module", "sideEffects": false,