ExorTek · ExorTek · Aug 6, 2026 · Aug 6, 2026
diff --git a/.changeset/dts-self-contained.md b/.changeset/dts-self-contained.md
diff --git a/.changeset/jwt-paseto-validate-custom-store.md b/.changeset/jwt-paseto-validate-custom-store.md
diff --git a/.changeset/opaque-passkey-workspace-caret.md b/.changeset/opaque-passkey-workspace-caret.md
diff --git a/.changeset/passkey-aaguid-corrections.md b/.changeset/passkey-aaguid-corrections.md
diff --git a/.changeset/passkey-typed-errors-shared-predicates.md b/.changeset/passkey-typed-errors-shared-predicates.md
diff --git a/packages/apikey/CHANGELOG.md b/packages/apikey/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/apikey
 
+## 1.1.3
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.1.2
 
 ### Patch Changes

diff --git a/packages/apikey/package.json b/packages/apikey/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/apikey",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Stripe-style prefixed API keys for Node.js — 3-segment tokens (prefix_id_secret), HMAC-SHA256 storage hash with pepper rotation, scope allowlists with wildcard match, opt-in lastUsedAt tracking, memory + Redis stores, Express + Fastify middleware. Server-only. Zero non-@exortek runtime dependencies.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/challenge/CHANGELOG.md b/packages/challenge/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/challenge
 
+## 1.1.3
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.1.2
 
 ### Patch Changes

diff --git a/packages/challenge/package.json b/packages/challenge/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/challenge",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Signed, single-use challenge tokens for multi-step auth flows on Node.js — carries userId / method / step / metadata across a redirect or a second request without a server-side session; HMAC-signed, expiring, optional IP-binding, single-use enforcement via any @exortek/security store.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/crypto/CHANGELOG.md b/packages/crypto/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/crypto
 
+## 1.1.1
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.1.0
 
 ### Minor Changes

diff --git a/packages/crypto/package.json b/packages/crypto/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/crypto",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Zero-dependency cryptographic primitives for Node.js — hash / hmac / KDFs (PBKDF2, HKDF, scrypt), AES-GCM / ChaCha20-Poly1305 / RSA-OAEP ciphers, RS/PS/ES/EdDSA signatures, signed cookies, sealed timed tokens, CSPRNG (UUID v4/5/7, ULID, base58, crockford), and encoders — all built on node:crypto.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/jwe/CHANGELOG.md b/packages/jwe/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/jwe
 
+## 1.0.2
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.0.1
 
 ### Patch Changes

diff --git a/packages/jwe/package.json b/packages/jwe/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/jwe",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "JSON Web Encryption (JWE) — RFC 7516 / RFC 7518 for Node.js 22+. Compact serialization, RSA-OAEP / ECDH-ES / AES-KW / dir key management, AES-GCM + AES-CBC-HMAC content encryption. Alg + enc allowlist mandatory on decrypt. `RSA1_5` never accepted. Zero-dependency, built on node:crypto.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/jwk/CHANGELOG.md b/packages/jwk/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/jwk
 
+## 1.0.4
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.0.3
 
 ### Patch Changes

diff --git a/packages/jwk/package.json b/packages/jwk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/jwk",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "JSON Web Key (JWK) — RFC 7517 / RFC 7638 / RFC 8037 for Node.js. Generate, import, export, thumbprint EC / RSA / OKP / oct keys. Zero-dependency, built on node:crypto.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/jwks/CHANGELOG.md b/packages/jwks/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @exortek/jwks
 
+## 1.1.1
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
+- Updated dependencies [89aea87]
+  - @exortek/jwk@1.0.4
+
 ## 1.1.0
 
 ### Minor Changes

diff --git a/packages/jwks/package.json b/packages/jwks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/jwks",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "JSON Web Key Set (JWKS) for Node.js — local key set management with zero-downtime rotation, remote JWKS URI fetching with kid-miss refetch, Express/Fastify handler for /.well-known/jwks.json. Zero non-@exortek runtime dependencies.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/jws/CHANGELOG.md b/packages/jws/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/jws
 
+## 1.0.4
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.0.3
 
 ### Patch Changes

diff --git a/packages/jws/package.json b/packages/jws/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/jws",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "JSON Web Signature (JWS) — RFC 7515 / RFC 7518 / RFC 7797 / RFC 8037 / RFC 8812 for Node.js 22+. Compact + JSON serialization, detached content, unencoded payload, HS/RS/PS/ES/EdDSA. Alg allowlist mandatory. `none` never accepted. Zero-dependency, built on node:crypto.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/jwt/CHANGELOG.md b/packages/jwt/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @exortek/jwt
 
+## 1.3.0
+
+### Minor Changes
+
+- 89aea87: Validate custom store implementations at construction time. `createStore('custom', { impl })` previously
+  accepted any object and returned it verbatim, so a store missing a required method surfaced only later as a
+  `TypeError` deep inside a token operation. It now asserts the impl exposes the core registry contract — `add`, `has`,
+  `get`, `delete`, `deleteAll` — and throws `INVALID_ARGUMENT` immediately when one is missing (`markUsed` stays
+  optional, since only refresh-token rotation calls it).
+
+  Behaviour change: an incomplete custom store that happened to work — because the missing method was never exercised —
+  is now rejected up front. Complete implementations are unaffected and are still returned verbatim (no wrapping).
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 1.2.3
 
 ### Patch Changes

diff --git a/packages/jwt/package.json b/packages/jwt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/jwt",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "JSON Web Token (JWT) — RFC 7519 / RFC 7518 / RFC 8725 / RFC 9068 for Node.js 22+. sign / verify / decode / peek, tokenPair (access + refresh) with reuse detection, blacklist store (memory / redis / custom), claims validation (exp / nbf / iat / iss / aud / sub / jti / nonce / typ / maxAge / scope), PEM + X.509 cert input, custom fn escape hatch on every knob. Alg allowlist mandatory. `none` never accepted. Zero-dependency, built on node:crypto.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/magic-link/CHANGELOG.md b/packages/magic-link/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @exortek/magic-link
 
+## 2.1.3
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
 ## 2.1.2
 
 ### Patch Changes

diff --git a/packages/magic-link/package.json b/packages/magic-link/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/magic-link",
-  "version": "2.1.2",
+  "version": "2.1.3",
   "description": "Passwordless email-link auth for Node.js — HMAC-signed short-lived tokens (mlink_v1.<payload>.<hmac>), single-use enforcement, opt-in per-email rate limiting, hashed email in payload by default (SHA-256), configurable prefix, memory + Redis stores. Ships the token — you send the email.",
   "type": "module",
   "sideEffects": false,

diff --git a/packages/oauth2/CHANGELOG.md b/packages/oauth2/CHANGELOG.md
@@ -1,5 +1,28 @@
 # @exortek/oauth2
 
+## 1.1.1
+
+### Patch Changes
+
+- 89aea87: Ship self-contained TypeScript declarations. Every package's emitted `.d.ts` referenced `@exortek/shared`
+  (e.g. `import { BaseError } from '@exortek/shared/errors'`), but `@exortek/shared` is a private, never-published
+  workspace package that is inlined into each bundle at build time. A TypeScript consumer therefore hit
+  `Cannot find module '@exortek/shared/…'` (with `skipLibCheck` off) or silently degraded error-class types like
+  `ApiKeyError` — losing its constructor signature and `.code` / `.message` — with `skipLibCheck` on.
+
+  The build now runs a declaration-bundling pass (`rollup-plugin-dts`) after `tsc`, flattening each entry's `.d.ts` and
+  inlining the `@exortek/shared` types so the shipped declarations are fully self-contained. Runtime deps and `node:*`
+  stay external. No runtime or API change — types only.
+
+- Updated dependencies [89aea87]
+- Updated dependencies [89aea87]
+  - @exortek/jwe@1.0.2
+  - @exortek/jwk@1.0.4
+  - @exortek/jwks@1.1.1
+  - @exortek/jws@1.0.4
+  - @exortek/jwt@1.3.0
+  - @exortek/paseto@1.1.0
+
 ## 1.1.0
 
 ### Minor Changes

diff --git a/packages/oauth2/package.json b/packages/oauth2/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@exortek/oauth2",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "OAuth 2.1 for Node.js 22+ — both halves, secure by default. The relying-party flow (createOAuth + provider presets, mandatory PKCE / state / nonce / iss) and a full authorization server (DPoP incl. nonce, PAR, JAR/JARM, resource indicators, device grant, token exchange, FAPI 2.0) over JWT or PASETO. Server-only, zero non-@exortek/* runtime dependencies, built on node:crypto.",
   "type": "module",
   "sideEffects": false,