@aooth/auth 0.1.1

package/dist/index.mjs

@@ -0,0 +1,733 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID, scryptSync } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+//#region src/errors.ts
+const defaultMessages = {
+	INVALID_TOKEN: "Invalid token",
+	TOKEN_EXPIRED: "Token has expired",
+	TOKEN_REVOKED: "Token has been revoked",
+	REFRESH_REUSE_DETECTED: "Refresh token reuse detected",
+	STATELESS_OPERATION_UNSUPPORTED: "Operation is not supported by stateless credential store",
+	MAX_CONCURRENT_REACHED: "Maximum concurrent credentials reached for user",
+	INVALID_CONFIG: "Invalid auth configuration"
+};
+var AuthError = class extends Error {
+	name = "AuthError";
+	constructor(type, message, details) {
+		super(message ?? defaultMessages[type]);
+		this.type = type;
+		this.details = details;
+	}
+};
+//#endregion
+//#region src/utils/clock.ts
+const defaultClock = { now: () => Date.now() };
+//#endregion
+//#region src/stores/memory.ts
+/**
+* In-memory implementation of CredentialStore using random opaque token IDs.
+*
+* - `Map<token, state>` is the primary index.
+* - `Map<userId, Set<token>>` is a secondary index for `revokeAllForUser` /
+*   `listForUser` without scanning the full primary map.
+* - Both maps are kept in sync on every mutation.
+*/
+var CredentialStoreMemory = class {
+	states = /* @__PURE__ */ new Map();
+	byUser = /* @__PURE__ */ new Map();
+	clock;
+	constructor(opts) {
+		this.clock = opts?.clock ?? defaultClock;
+	}
+	async persist(state, ttl) {
+		const token = randomUUID();
+		const stored = { ...state };
+		if (typeof ttl === "number") stored.expiresAt = this.clock.now() + ttl;
+		this.states.set(token, stored);
+		this.indexAdd(stored.userId, token);
+		return token;
+	}
+	async retrieve(token) {
+		const state = this.states.get(token);
+		if (!state) return null;
+		if (state.expiresAt <= this.clock.now()) {
+			this.states.delete(token);
+			this.indexRemove(state.userId, token);
+			return null;
+		}
+		return { ...state };
+	}
+	async consume(token) {
+		const state = await this.retrieve(token);
+		if (!state) return null;
+		await this.revoke(token);
+		return state;
+	}
+	async update(token, state) {
+		const existing = this.states.get(token);
+		if (!existing) return token;
+		if (existing.userId !== state.userId) {
+			this.indexRemove(existing.userId, token);
+			this.indexAdd(state.userId, token);
+		}
+		this.states.set(token, { ...state });
+		return token;
+	}
+	async revoke(token) {
+		const state = this.states.get(token);
+		if (!state) return;
+		this.states.delete(token);
+		this.indexRemove(state.userId, token);
+	}
+	async revokeAllForUser(userId) {
+		const tokens = this.byUser.get(userId);
+		if (!tokens || tokens.size === 0) return 0;
+		let count = 0;
+		for (const token of tokens) if (this.states.delete(token)) count++;
+		this.byUser.delete(userId);
+		return count;
+	}
+	async listForUser(userId) {
+		const tokens = this.byUser.get(userId);
+		if (!tokens || tokens.size === 0) return [];
+		const now = this.clock.now();
+		const out = [];
+		const expired = [];
+		for (const token of tokens) {
+			const state = this.states.get(token);
+			if (!state) {
+				expired.push(token);
+				continue;
+			}
+			if (state.expiresAt <= now) {
+				expired.push(token);
+				continue;
+			}
+			out.push({
+				...state,
+				token
+			});
+		}
+		for (const token of expired) {
+			this.states.delete(token);
+			tokens.delete(token);
+		}
+		if (tokens.size === 0) this.byUser.delete(userId);
+		return out;
+	}
+	indexAdd(userId, token) {
+		let set = this.byUser.get(userId);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			this.byUser.set(userId, set);
+		}
+		set.add(token);
+	}
+	indexRemove(userId, token) {
+		const set = this.byUser.get(userId);
+		if (!set) return;
+		set.delete(token);
+		if (set.size === 0) this.byUser.delete(userId);
+	}
+};
+//#endregion
+//#region src/stores/denylist-memory.ts
+/**
+* In-memory denylist for stateless revocation.
+*
+* Stores a map from JTI (or any opaque identifier) to absolute expiry timestamp.
+* `has` returns false for entries whose TTL has elapsed and lazily removes them.
+* `cleanup` performs a sweep across the map and returns the number of entries
+* removed, useful for periodic compaction in long-lived processes.
+*/
+var DenylistStoreMemory = class {
+	entries = /* @__PURE__ */ new Map();
+	clock;
+	constructor(opts) {
+		this.clock = opts?.clock ?? defaultClock;
+	}
+	async add(jti, expiresAt) {
+		this.entries.set(jti, expiresAt);
+	}
+	async has(jti) {
+		const expiresAt = this.entries.get(jti);
+		if (expiresAt === void 0) return false;
+		if (expiresAt <= this.clock.now()) {
+			this.entries.delete(jti);
+			return false;
+		}
+		return true;
+	}
+	async cleanup() {
+		const now = this.clock.now();
+		let removed = 0;
+		for (const [jti, expiresAt] of this.entries) if (expiresAt <= now) {
+			this.entries.delete(jti);
+			removed++;
+		}
+		return removed;
+	}
+};
+//#endregion
+//#region src/stores/jwt.ts
+const HS_ALGS = new Set([
+	"HS256",
+	"HS384",
+	"HS512"
+]);
+/**
+* Stateless credential store that signs the credential state into a JWT.
+*
+* The token IS the state — there is no internal map. State is reconstructed
+* by verifying signature/claims on every retrieve. Revocation requires a
+* `denylist`; without one, `revoke`/`update`/`consume` throw
+* STATELESS_OPERATION_UNSUPPORTED.
+*/
+var CredentialStoreJwt = class {
+	algorithm;
+	signingKey;
+	verifyingKey;
+	issuer;
+	audience;
+	denylist;
+	clock;
+	/**
+	* Per-user revocation epoch (ms). `revokeAllForUser` sets this to
+	* `clock.now()`; `retrieve` rejects any token whose `iatMs` predates the
+	* user's epoch (same-ms mints are accepted so recovery/invite flows can
+	* revoke and re-issue in one tick). Compensates for JWT statelessness so
+	* password-change cascades invalidate tokens minted before the change.
+	* In-memory: resets on process restart (a known JWT limitation — production
+	* deployments needing durability should back this with an external store).
+	*/
+	epochs = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		this.algorithm = opts.algorithm ?? "HS256";
+		this.issuer = opts.issuer;
+		this.audience = opts.audience;
+		this.denylist = opts.denylist;
+		this.clock = opts.clock ?? defaultClock;
+		if (HS_ALGS.has(this.algorithm)) {
+			if (opts.secret == null) throw new AuthError("INVALID_CONFIG", `Algorithm ${this.algorithm} requires a 'secret' option`);
+			const key = normalizeSecret(opts.secret);
+			this.signingKey = key;
+			this.verifyingKey = key;
+		} else {
+			if (opts.privateKey == null || opts.publicKey == null) throw new AuthError("INVALID_CONFIG", `Algorithm ${this.algorithm} requires both 'privateKey' and 'publicKey' options`);
+			this.signingKey = opts.privateKey;
+			this.verifyingKey = opts.publicKey;
+		}
+	}
+	async persist(state, ttl) {
+		const jti = randomUUID();
+		const now = this.clock.now();
+		const expiresAtMs = typeof ttl === "number" ? now + ttl : state.expiresAt;
+		const stateClaim = {
+			iatMs: state.issuedAt,
+			expMs: expiresAtMs
+		};
+		if (state.kind !== void 0) stateClaim.kind = state.kind;
+		if (state.claims !== void 0) stateClaim.claims = state.claims;
+		if (state.metadata !== void 0) stateClaim.metadata = state.metadata;
+		if (state.parentCredentialId !== void 0) stateClaim.parentCredentialId = state.parentCredentialId;
+		if (state.rotatedAt !== void 0) stateClaim.rotatedAt = state.rotatedAt;
+		const builder = new SignJWT({ state: stateClaim }).setProtectedHeader({ alg: this.algorithm }).setSubject(state.userId).setIssuedAt(Math.floor(state.issuedAt / 1e3)).setExpirationTime(Math.floor(expiresAtMs / 1e3)).setJti(jti);
+		if (this.issuer) builder.setIssuer(this.issuer);
+		if (this.audience) builder.setAudience(this.audience);
+		return builder.sign(this.signingKey);
+	}
+	async retrieve(token) {
+		const verified = await this.verify(token);
+		if (!verified) return null;
+		if (this.denylist && verified.payload.jti) {
+			if (await this.denylist.has(verified.payload.jti)) return null;
+		}
+		if (!this.passesEpoch(verified.payload)) return null;
+		return this.payloadToState(verified.payload);
+	}
+	async consume(token) {
+		const denylist = this.requireDenylist("consume");
+		const verified = await this.verify(token);
+		if (!verified) return null;
+		if (!this.passesEpoch(verified.payload)) return null;
+		const jti = verified.payload.jti;
+		if (jti) {
+			if (await denylist.has(jti)) return null;
+			await denylist.add(jti, this.payloadExpMs(verified.payload));
+		}
+		return this.payloadToState(verified.payload);
+	}
+	async update(token, state) {
+		const denylist = this.requireDenylist("update");
+		const verified = await this.verify(token);
+		if (verified?.payload.jti) await denylist.add(verified.payload.jti, this.payloadExpMs(verified.payload));
+		return this.persist(state);
+	}
+	async revoke(token) {
+		const denylist = this.requireDenylist("revoke");
+		const verified = await this.verify(token);
+		if (!verified?.payload.jti) return;
+		await denylist.add(verified.payload.jti, this.payloadExpMs(verified.payload));
+	}
+	async revokeAllForUser(userId) {
+		this.epochs.set(userId, this.clock.now());
+		return 1;
+	}
+	requireDenylist(op) {
+		if (!this.denylist) throw new AuthError("STATELESS_OPERATION_UNSUPPORTED", `${op} requires a denylist on stateless JWT store`);
+		return this.denylist;
+	}
+	/** Convert payload `exp` (seconds) to ms; fall back to a 60s window. */
+	payloadExpMs(payload) {
+		return typeof payload.exp === "number" ? payload.exp * 1e3 : this.clock.now() + 6e4;
+	}
+	/**
+	* Reject tokens minted before the user's revocation epoch. Same-ms mints
+	* (`iatMs === epoch`) are accepted so a workflow can revoke and re-issue in
+	* one tick. `iatMs` mirrors `iat` at ms precision; we fall back to
+	* `iat * 1000` for tokens that predate the mirror field.
+	*/
+	passesEpoch(payload) {
+		if (typeof payload.sub !== "string") return true;
+		const epoch = this.epochs.get(payload.sub);
+		if (epoch === void 0) return true;
+		const stateClaim = payload.state ?? {};
+		return (typeof stateClaim.iatMs === "number" ? stateClaim.iatMs : typeof payload.iat === "number" ? payload.iat * 1e3 : 0) >= epoch;
+	}
+	async verify(token) {
+		try {
+			return { payload: (await jwtVerify(token, this.verifyingKey, {
+				algorithms: [this.algorithm],
+				issuer: this.issuer,
+				audience: this.audience,
+				currentDate: new Date(this.clock.now())
+			})).payload };
+		} catch {
+			return null;
+		}
+	}
+	payloadToState(payload) {
+		if (typeof payload.sub !== "string") return null;
+		if (typeof payload.iat !== "number" || typeof payload.exp !== "number") return null;
+		const stateClaim = payload.state ?? {};
+		const issuedAt = typeof stateClaim.iatMs === "number" ? stateClaim.iatMs : payload.iat * 1e3;
+		const expiresAt = typeof stateClaim.expMs === "number" ? stateClaim.expMs : payload.exp * 1e3;
+		const out = {
+			userId: payload.sub,
+			issuedAt,
+			expiresAt
+		};
+		if (stateClaim.kind !== void 0) out.kind = stateClaim.kind;
+		if (stateClaim.claims !== void 0) out.claims = stateClaim.claims;
+		if (stateClaim.metadata !== void 0) out.metadata = stateClaim.metadata;
+		if (stateClaim.parentCredentialId !== void 0) out.parentCredentialId = stateClaim.parentCredentialId;
+		if (stateClaim.rotatedAt !== void 0) out.rotatedAt = stateClaim.rotatedAt;
+		return out;
+	}
+};
+function normalizeSecret(secret) {
+	if (typeof secret === "string") return new TextEncoder().encode(secret);
+	return secret;
+}
+//#endregion
+//#region src/stores/encapsulated.ts
+const KEY_LEN = 32;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const KDF_SALT = Buffer.from("aoothjs-auth-encapsulated-v1", "utf8");
+/**
+* Stateless credential store that encrypts the credential state with
+* AES-256-GCM. The token IS the encrypted blob, base64url-encoded as
+* `iv (12B) || ciphertext || authTag (16B)`.
+*
+* Same denylist semantics as {@link CredentialStoreJwt}: revocation /
+* single-use consume / update require a denylist; otherwise these operations
+* throw STATELESS_OPERATION_UNSUPPORTED.
+*
+* Key derivation:
+* - A 32-byte `Buffer`/`Uint8Array` `secret` is used as the AES key directly
+*   (no KDF).
+* - Any other secret (string, shorter/longer buffer) is run through scrypt
+*   with a fixed library-scoped salt to produce a 32-byte key. The salt is
+*   intentionally fixed so keys remain stable across process restarts; if it
+*   were random, every previously issued token would become undecryptable.
+*   For maximum protection against rainbow tables on weak passphrases,
+*   provide a 32-byte random buffer as `secret` (the KDF path is skipped).
+*
+* Revocation caveat: `revokeAllForUser` uses an in-memory per-user epoch map.
+* It does not survive process restart and does not sync across instances —
+* the same limitation as `CredentialStoreJwt`. Use `CredentialStoreRedis` or
+* `CredentialStoreAtscriptDb` when you need native enumeration with durable
+* cross-instance cascade semantics.
+*/
+var CredentialStoreEncapsulated = class {
+	key;
+	denylist;
+	clock;
+	/**
+	* Per-user revocation epoch (ms). `revokeAllForUser` sets this to
+	* `clock.now()`; `retrieve`/`consume` reject any decrypted state whose
+	* `issuedAt` is strictly less than the user's epoch (same-ms mints are
+	* accepted so recovery/invite flows can revoke and re-issue in the same
+	* tick). Mirrors the JWT store pattern; see class JSDoc for durability
+	* caveats.
+	*/
+	epochs = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		if (opts.secret == null) throw new AuthError("INVALID_CONFIG", "CredentialStoreEncapsulated requires a 'secret'");
+		this.key = deriveKey(opts.secret);
+		this.denylist = opts.denylist;
+		this.clock = opts.clock ?? defaultClock;
+	}
+	async persist(state, ttl) {
+		const jti = randomUUID();
+		const expiresAt = typeof ttl === "number" ? this.clock.now() + ttl : state.expiresAt;
+		const payload = {
+			...state,
+			expiresAt,
+			jti
+		};
+		const iv = randomBytes(IV_LEN);
+		const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+		const plaintext = Buffer.from(JSON.stringify(payload), "utf8");
+		const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+		const authTag = cipher.getAuthTag();
+		return Buffer.concat([
+			iv,
+			ciphertext,
+			authTag
+		]).toString("base64url");
+	}
+	async retrieve(token) {
+		const decrypted = this.decrypt(token);
+		if (!decrypted) return null;
+		if (decrypted.expiresAt <= this.clock.now()) return null;
+		if (!this.passesEpoch(decrypted)) return null;
+		if (this.denylist && await this.denylist.has(decrypted.jti)) return null;
+		return stripJti(decrypted);
+	}
+	async consume(token) {
+		const denylist = this.requireDenylist("consume");
+		const decrypted = this.decrypt(token);
+		if (!decrypted) return null;
+		if (decrypted.expiresAt <= this.clock.now()) return null;
+		if (!this.passesEpoch(decrypted)) return null;
+		if (await denylist.has(decrypted.jti)) return null;
+		await denylist.add(decrypted.jti, decrypted.expiresAt);
+		return stripJti(decrypted);
+	}
+	async update(token, state) {
+		const denylist = this.requireDenylist("update");
+		const decrypted = this.decrypt(token);
+		if (decrypted) await denylist.add(decrypted.jti, decrypted.expiresAt);
+		return this.persist(state);
+	}
+	async revoke(token) {
+		const denylist = this.requireDenylist("revoke");
+		const decrypted = this.decrypt(token);
+		if (!decrypted) return;
+		await denylist.add(decrypted.jti, decrypted.expiresAt);
+	}
+	async revokeAllForUser(userId) {
+		this.epochs.set(userId, this.clock.now());
+		return 1;
+	}
+	/**
+	* Reject decrypted payloads whose `issuedAt` predates the user's revocation
+	* epoch. Same-ms mints (`issuedAt === epoch`) are accepted so a workflow can
+	* revoke and re-issue in one tick. Mirrors `CredentialStoreJwt.passesEpoch`.
+	*/
+	passesEpoch(payload) {
+		const epoch = this.epochs.get(payload.userId);
+		if (epoch === void 0) return true;
+		return payload.issuedAt >= epoch;
+	}
+	requireDenylist(op) {
+		if (!this.denylist) throw new AuthError("STATELESS_OPERATION_UNSUPPORTED", `${op} requires a denylist on stateless encapsulated store`);
+		return this.denylist;
+	}
+	decrypt(token) {
+		try {
+			const blob = Buffer.from(token, "base64url");
+			if (blob.length < IV_LEN + 1 + TAG_LEN) return null;
+			const iv = blob.subarray(0, IV_LEN);
+			const authTag = blob.subarray(blob.length - TAG_LEN);
+			const ciphertext = blob.subarray(IV_LEN, blob.length - TAG_LEN);
+			const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
+			decipher.setAuthTag(authTag);
+			const plain = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+			const parsed = JSON.parse(plain.toString("utf8"));
+			if (typeof parsed?.userId !== "string" || typeof parsed.jti !== "string" || typeof parsed.issuedAt !== "number" || typeof parsed.expiresAt !== "number") return null;
+			return parsed;
+		} catch {
+			return null;
+		}
+	}
+};
+function deriveKey(secret) {
+	if (typeof secret !== "string") {
+		const buf = Buffer.isBuffer(secret) ? secret : Buffer.from(secret);
+		if (buf.length === KEY_LEN) return buf;
+		return scryptSync(buf, KDF_SALT, KEY_LEN);
+	}
+	return scryptSync(secret, KDF_SALT, KEY_LEN);
+}
+function stripJti(payload) {
+	const { jti: _jti, ...rest } = payload;
+	return rest;
+}
+//#endregion
+//#region src/credential/auth-credential.ts
+const DEFAULT_ACCESS_TTL = 3600 * 1e3;
+const DEFAULT_ROTATION_GRACE_MS = 3e4;
+/**
+* Stable, non-reversible fingerprint of a token used as `credentialId` in
+* {@link AuthContext}. Hashing avoids leaking a live bearer token whenever
+* downstream consumers log or persist `ctx.credentialId`.
+*/
+function fingerprint(token) {
+	return createHash("sha256").update(token).digest("hex");
+}
+/**
+* Orchestrates credential issuance, validation, refresh, and revocation
+* on top of a pluggable {@link CredentialStore}.
+*
+* Design notes:
+* - `credentialId` returned in {@link AuthContext} is a SHA-256 fingerprint of
+*   the access token, never the token itself. The fingerprint is stable
+*   per-token, safe to log/persist, and cannot be replayed against the API.
+*   M3 will switch to a `jti` claim for JWT/encapsulated stores.
+* - `kind: 'access' | 'refresh'` on {@link CredentialState} discriminates
+*   tokens stored side-by-side in the same store.
+* - `listForUser` and `maxConcurrent` consider only access-kind credentials,
+*   matching how callers typically display "active sessions".
+* - On detected refresh-reuse-after-grace, the orchestrator best-effort
+*   revokes ALL credentials for the affected user (access + refresh).
+*   This is OAuth-best-practice theft response; documented and intentional.
+*/
+var AuthCredential = class {
+	store;
+	method;
+	accessTtl;
+	refreshConfig;
+	denylist;
+	maxConcurrent;
+	onLimit;
+	clock;
+	/**
+	* Recently-consumed refresh tokens, keyed by the raw refresh token string.
+	* Lets `'always'` rotation detect reuse: stateful stores forget the token
+	* after `consume`, and stateless (JWT) stores hide it behind a denylist hit
+	* on `retrieve`. Without this map the orchestrator can no longer distinguish
+	* "fake token" from "previously valid token replayed". Pruned lazily on
+	* access; bounded by refresh TTL.
+	*/
+	consumedRefreshes = /* @__PURE__ */ new Map();
+	constructor(opts) {
+		this.store = opts.store;
+		this.method = opts.method ?? "token";
+		this.accessTtl = opts.accessTtl ?? DEFAULT_ACCESS_TTL;
+		this.refreshConfig = opts.refresh;
+		this.denylist = opts.denylist;
+		this.maxConcurrent = opts.maxConcurrent;
+		this.onLimit = opts.onLimit ?? "reject";
+		this.clock = opts.clock ?? defaultClock;
+		if (this.accessTtl <= 0) throw new AuthError("INVALID_CONFIG", `accessTtl must be > 0 (got ${this.accessTtl})`);
+		if (this.refreshConfig && this.refreshConfig.ttl <= 0) throw new AuthError("INVALID_CONFIG", `refresh.ttl must be > 0 (got ${this.refreshConfig.ttl})`);
+	}
+	async issue(userId, options) {
+		if (this.maxConcurrent !== void 0 && this.store.listForUser) await this.enforceConcurrencyLimit(userId);
+		const now = this.clock.now();
+		const accessState = {
+			userId,
+			issuedAt: now,
+			expiresAt: now + this.accessTtl,
+			kind: "access",
+			claims: options?.claims,
+			metadata: options?.metadata
+		};
+		const accessToken = await this.store.persist(accessState, this.accessTtl);
+		let refreshToken;
+		let refreshExpiresAt;
+		if (this.refreshConfig) {
+			const refreshState = {
+				userId,
+				issuedAt: now,
+				expiresAt: now + this.refreshConfig.ttl,
+				kind: "refresh",
+				claims: options?.claims,
+				metadata: options?.metadata
+			};
+			refreshToken = await this.store.persist(refreshState, this.refreshConfig.ttl);
+			refreshExpiresAt = now + this.refreshConfig.ttl;
+		}
+		return {
+			accessToken,
+			refreshToken,
+			accessExpiresAt: now + this.accessTtl,
+			refreshExpiresAt
+		};
+	}
+	async validate(accessToken) {
+		if (this.denylist && await this.denylist.has(accessToken)) return null;
+		const state = await this.store.retrieve(accessToken);
+		if (!state) return null;
+		if (state.expiresAt <= this.clock.now()) return null;
+		if (state.kind === "refresh") return null;
+		return {
+			userId: state.userId,
+			method: this.method,
+			credentialId: fingerprint(accessToken),
+			expiresAt: state.expiresAt,
+			claims: state.claims
+		};
+	}
+	async refresh(refreshToken) {
+		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
+		const rotation = this.refreshConfig.rotation ?? "sliding";
+		const now = this.clock.now();
+		const oldState = await this.store.retrieve(refreshToken);
+		if (!oldState) {
+			const consumed = this.lookupConsumedRefresh(refreshToken);
+			if (consumed) await this.fireRefreshReuseTheftResponse(consumed, refreshToken);
+			throw new AuthError("INVALID_TOKEN");
+		}
+		if (oldState.kind !== "refresh") throw new AuthError("INVALID_TOKEN", "Token is not a refresh credential");
+		switch (rotation) {
+			case "none": return await this.refreshNone(oldState, refreshToken, now);
+			case "always":
+				await this.store.consume(refreshToken);
+				this.consumedRefreshes.set(refreshToken, {
+					userId: oldState.userId,
+					iat: oldState.issuedAt,
+					exp: oldState.expiresAt
+				});
+				return await this.issueRotatedPair(oldState, refreshToken, false, now);
+			case "sliding": return await this.refreshSliding(oldState, refreshToken, now);
+			default: throw new AuthError("INVALID_CONFIG", `Unknown rotation: ${String(rotation)}`);
+		}
+	}
+	async refreshNone(oldState, refreshToken, now) {
+		const newAccess = await this.issueAccessFromRefresh(oldState, now);
+		return {
+			accessToken: newAccess.token,
+			accessExpiresAt: newAccess.expiresAt,
+			refreshToken,
+			refreshExpiresAt: oldState.expiresAt
+		};
+	}
+	async refreshSliding(oldState, refreshToken, now) {
+		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
+		const graceMs = this.refreshConfig.rotationGraceMs ?? DEFAULT_ROTATION_GRACE_MS;
+		if (typeof oldState.rotatedAt !== "number") return await this.issueRotatedPair(oldState, refreshToken, true, now);
+		if (now - oldState.rotatedAt > graceMs) {
+			this.refreshConfig.onRotationReuse?.(oldState);
+			await this.store.revokeAllForUser(oldState.userId);
+			throw new AuthError("REFRESH_REUSE_DETECTED", void 0, {
+				userId: oldState.userId,
+				rotatedAt: oldState.rotatedAt
+			});
+		}
+		return await this.issueRotatedPair(oldState, refreshToken, false, now);
+	}
+	async revoke(token) {
+		await this.store.revoke(token);
+	}
+	async revokeAllForUser(userId) {
+		return await this.store.revokeAllForUser(userId);
+	}
+	async listForUser(userId) {
+		if (!this.store.listForUser) return [];
+		return (await this.store.listForUser(userId)).filter((entry) => entry.kind !== "refresh").map((entry) => ({
+			userId: entry.userId,
+			method: this.method,
+			credentialId: fingerprint(entry.token),
+			expiresAt: entry.expiresAt,
+			claims: entry.claims
+		}));
+	}
+	async enforceConcurrencyLimit(userId) {
+		if (!this.store.listForUser || this.maxConcurrent === void 0) return;
+		const accessOnly = (await this.store.listForUser(userId)).filter((entry) => entry.kind !== "refresh");
+		if (accessOnly.length < this.maxConcurrent) return;
+		if (this.onLimit === "reject") throw new AuthError("MAX_CONCURRENT_REACHED", void 0, {
+			userId,
+			limit: this.maxConcurrent,
+			active: accessOnly.length
+		});
+		const sorted = accessOnly.toSorted((a, b) => a.issuedAt - b.issuedAt);
+		const toEvict = accessOnly.length - this.maxConcurrent + 1;
+		for (let i = 0; i < toEvict && i < sorted.length; i++) await this.store.revoke(sorted[i].token);
+	}
+	async issueAccessFromRefresh(refreshState, now) {
+		const accessState = {
+			userId: refreshState.userId,
+			issuedAt: now,
+			expiresAt: now + this.accessTtl,
+			kind: "access",
+			claims: refreshState.claims,
+			metadata: refreshState.metadata
+		};
+		return {
+			token: await this.store.persist(accessState, this.accessTtl),
+			expiresAt: now + this.accessTtl
+		};
+	}
+	async issueRotatedPair(oldRefreshState, oldRefreshToken, rotateOld, now) {
+		if (!this.refreshConfig) throw new AuthError("INVALID_CONFIG", "Refresh not enabled");
+		const access = await this.issueAccessFromRefresh(oldRefreshState, now);
+		const newRefreshState = {
+			userId: oldRefreshState.userId,
+			issuedAt: now,
+			expiresAt: now + this.refreshConfig.ttl,
+			kind: "refresh",
+			claims: oldRefreshState.claims,
+			metadata: oldRefreshState.metadata,
+			parentCredentialId: oldRefreshToken
+		};
+		const newRefreshToken = await this.store.persist(newRefreshState, this.refreshConfig.ttl);
+		if (rotateOld) {
+			const rotatedState = {
+				...oldRefreshState,
+				rotatedAt: now
+			};
+			await this.store.update(oldRefreshToken, rotatedState);
+		}
+		return {
+			accessToken: access.token,
+			accessExpiresAt: access.expiresAt,
+			refreshToken: newRefreshToken,
+			refreshExpiresAt: now + this.refreshConfig.ttl
+		};
+	}
+	lookupConsumedRefresh(token) {
+		const entry = this.consumedRefreshes.get(token);
+		if (!entry) return null;
+		if (entry.exp <= this.clock.now()) {
+			this.consumedRefreshes.delete(token);
+			return null;
+		}
+		return entry;
+	}
+	async fireRefreshReuseTheftResponse(consumed, refreshToken) {
+		this.refreshConfig?.onRotationReuse?.({
+			userId: consumed.userId,
+			issuedAt: consumed.iat,
+			expiresAt: consumed.exp,
+			kind: "refresh"
+		});
+		await this.store.revokeAllForUser(consumed.userId);
+		this.consumedRefreshes.delete(refreshToken);
+		throw new AuthError("REFRESH_REUSE_DETECTED", void 0, { userId: consumed.userId });
+	}
+};
+//#endregion
+//#region src/magic-link.ts
+/**
+* 32 bytes of CSPRNG entropy (256 bits) encoded as base64url — 43 chars,
+* URL-safe. Strong enough to survive short TTLs against online guessing.
+*/
+function generateMagicLinkToken() {
+	return randomBytes(32).toString("base64url");
+}
+//#endregion
+export { AuthCredential, AuthError, CredentialStoreEncapsulated, CredentialStoreJwt, CredentialStoreMemory, DenylistStoreMemory, defaultClock, generateMagicLinkToken };