@econneq/auth-core

Framework-agnostic auth runtime — tokens, sessions, tenants, permissions, storage. Pure TypeScript, no React, no Next.js.

Position in the install order

This is the foundation. Install this first. Everything else in the @econneq/auth-* family depends on it.

auth-core  ◄── auth-react ◄── auth-ui
          ◄── auth-nextjs
auth-cli  (independent)

Install

npm install @econneq/auth-core
# or, inside the monorepo, this resolves via the workspace

External runtime deps (auto-installed): jose, zod.

What you get

| Engine | Purpose | |---|---| | config-engine | defineAuthConfig, setConfig, getConfig | | auth-engine | login, logout, exchangeToken, refreshSession, hasPermission, hasRole | | token-engine | parseGlobalToken, parseTenantToken, isTokenExpired, getTokenTtl | | session-engine | resolveSession | | tenant-engine | fetchTenants, fetchTenantBranding, resolveTenantFromSubdomain | | permission-engine | checkPermission, checkAnyPermission, checkAllPermissions, checkRole, checkDepartment | | storage-engine | createStorageDriver, memoryDriver, cookieDriver, localStorageDriver | | event-engine | authEvents pub/sub | | refresh-engine | startSilentRefresh, stopSilentRefresh | | security-engine | generateCsrfToken, generateNonce, generateState, timingSafeEqual | | validators | LoginSchema, RegisterSchema, OtpSchema (Zod) |

Quick start

import { defineAuthConfig, login, refreshSession } from '@econneq/auth-core'

export const authConfig = defineAuthConfig({
  apiBaseUrl: 'https://api.example.com',
  tenantMode: true,
  storage:    'cookie',
  authMethods: ['password', 'otp'],
})

// Anywhere in your app
const session = await login({ email: '[email protected]', password: '…' })
await refreshSession()

Subpath entries

import type { AuthUser, Tenant } from '@econneq/auth-core'
import { /* type-only barrel */ } from '@econneq/auth-core/types'

Build

npm run build      # tsup → dist (esm + cjs + d.ts)
npm run typecheck  # tsc --noEmit
npm run dev        # tsup --watch

Notes

• Side-effect free ("sideEffects": false) — safe to tree-shake.
• Targets ES2020, bundler module resolution.
• No browser or Node-specific imports — drivers handle the platform split.