# @platform-modules/auth ## 0.5.0 ### Minor Changes - 801cad3: Modernize package-facing compatibility for the Node 26 toolchain. Better Auth 1.7 requires the exported account schema to add `issuer`, enforce `(issuer, accountId)` uniqueness, and add JWKS metadata columns (`expiresAt`, `alg`, `crv`); existing Better Auth engine databases must apply the corresponding schema migration. React-facing packages now use React 19 element types, locale persistence remains usable when browser storage is unavailable, and the rich-text editor uses the Tiptap 3 editor and `setContent` APIs. ### Patch Changes - 1fd8651: Make the D1 atomicity capability truthful and stop advertising an interactive transaction the driver does not have. `@platform-modules/db` — `createD1Client` no longer exposes a `transaction` member or `TransactionIdentity`, and is no longer assignable to `TransactionalDatabase`. Cloudflare D1 has no interactive transaction callback API, so the previous shape was a false claim that failed at runtime with `Failed query: begin`; D1 gets a typed atomic batch seam over exactly one real `binding.batch(...)` call instead. Genuinely transactional adapters (Postgres) keep the callback-minted transaction, exact identity semantics and rollback. The transaction handle splits in two: `Transaction` is now the dialect-neutral mutation handle (`execute()` only), while the Postgres query-builder surface (`select`/`insert`/`update`/`delete`) lives on `PostgresTransaction`. Callers that use query builders inside a transaction must type against `PostgresTransaction`. `withTransactionIdentity` becomes public API. It was marked internal, yet every package's real-Postgres harness needs it to produce a value satisfying `TransactionalDatabase`, and three packages had resorted to importing it through a relative path into `db/src` — which breaks the moment these packages are consumed as published `dist`. Consumers that build their own driver client now have a supported way to brand it. Every downstream consumer is migrated: transaction parameters re-annotated, PG test harnesses branded through the public helper or rebuilt on the first-party adapters, and `PgliteTransactionalDatabase` now declares the `$client` the driver actually attaches. Two latent defects surfaced and are fixed, both the same shape — code reading one result shape through a cast that hid the mismatch from the compiler: - `@platform-modules/content` — `taxonomy.ts` read `result.rows` behind an `as { rows?: unknown[] }` cast, so `isInSubtree` always returned false and the depth-cap query never matched. `moveTerm` would accept a parent inside its own subtree (creating a cycle) and allow a subtree past the depth cap, raising no error. - `@platform-modules/affiliate` — `maturity-sweep.ts` cast every `execute()` result to `{ rows }`. Its opening probe short-circuits the sweep when empty, so on a handle returning the other shape the sweep silently promoted nothing and moved no money. Both now normalize both shapes rather than casting to one: `execute()` yields a plain row array inside a platform-wrapped transaction and the driver's `{ rows }` envelope on an unwrapped handle, and consuming code must tolerate either. Breaking at the seam, released as minor: these packages are pre-1.0.0 and stay 0.x until the deliberate public release. - Updated dependencies [fd62ea1] - Updated dependencies [1fd8651] - Updated dependencies [801cad3] - @platform-modules/util@0.4.0 - @platform-modules/db@0.4.0 - @platform-modules/mail@0.1.1 ## 0.4.2 ### Patch Changes - Updated dependencies [df32439] - @platform-modules/db@0.3.0 ## 0.4.1 ### Patch Changes - 6d809c8: Expose the immutable API key ID from verification results. ## 0.4.0 ### Minor Changes - 541e5a3: Close authorization-code injection and a PKCE timing oracle in `oauth-provider`. `exchangeToken` now re-validates the request's `redirectUri` against the value persisted on the authorization code (RFC 6749 §4.1.3) and throws `OAuthRedirectUriMismatchError` on a mismatch. PKCE challenge comparison uses `timingSafeEqual` instead of `===`. Breaking: `redirectUri` is a required field of `ExchangeTokenInput`. ## 0.3.0 ### Minor Changes - 76bb92b: Bind OAuth authorization codes to an immutable subject and tenant principal. Breaking: `authorize` requires an `OAuthAuthorizationPrincipal` third argument, `exchangeToken` requires a `TransactionalDatabase` and returns `{ token, authorizationPrincipal }` instead of the flat token result. ## 0.2.3 ### Patch Changes - Updated dependencies [a708afa] - @platform-modules/util@0.3.0 - @platform-modules/db@0.2.2 ## 0.2.2 ### Patch Changes - Updated dependencies [7d474ec] - @platform-modules/util@0.2.0 - @platform-modules/db@0.2.1 ## 0.2.1 ### Patch Changes - 5fd0d27: Add the `./api-keys` subpath for issuing and verifying scoped hashed API keys. - e718a57: Add the `oauth-provider` subpath with PKCE S256 authorization-code helpers, client registration, and module-owned OAuth tables. ## 0.2.0 ### Minor Changes - 235a365: Add `UserAdminEngine` (`listUsers`, `setUserRoles`, `disableUser`), `auth_users.status` column with migration DDL, and live-role resolution in `verifySession` (roles read from DB, not JWT claims). ## 0.1.0 ### Minor Changes - 5373160: Add opaque service-token (PAT) capability to `engine-custom` for non-interactive callers (AI agent / MCP / CI). DB-backed, hash-only storage, fail-closed resolve, live roles, per-token revocation that is intentionally NOT coupled to `sessionVersion`. New exports: `issueServiceToken`, `resolveServiceToken`, `revokeServiceToken`, `revokeServiceTokensForUser`, and the `serviceTokens` table (also added to `customAuthSchema`). Additive only — no existing signature changes. ### Patch Changes - Updated dependencies [f895518] - Updated dependencies [c80eaad] - Updated dependencies [324de71] - @platform-modules/db@0.2.0 - @platform-modules/util@0.1.0 ## 0.0.2 ### Patch Changes - Updated dependencies [0170476] - @platform-modules/mail@0.1.0 ## 0.0.1 ### Patch Changes - d72b1ba: Initial publish — first versioned release. - Updated dependencies [d72b1ba] - @platform-modules/db@0.0.1 - @platform-modules/mail@0.0.1 - @platform-modules/util@0.0.1