@fluojs/passport 1.0.4 → 2.0.0

package/dist/cookie/cookie-manager.js

@@ -1,3 +1,4 @@
+import { setCookie } from '@fluojs/http';
 import { normalizeCookieAuthOptions } from './cookie-auth.js';
 
 /**
@@ -5,7 +6,13 @@ import { normalizeCookieAuthOptions } from './cookie-auth.js';
  */
 
 /**
- * Describes the set cookie options contract.
+ * Describes the set cookie options contract accepted by {@link CookieManagerConfig}.
+ *
+ * @remarks
+ * `accessTokenTtlSeconds` and `refreshTokenTtlSeconds` become the default `Max-Age`
+ * for the matching token cookie when the positional TTL argument of
+ * `CookieManager.setAccessTokenCookie(...)` / `setRefreshTokenCookie(...)` is omitted.
+ * An explicit positional TTL always wins over these defaults.
  */
 
 /**
@@ -23,34 +30,6 @@ export const DEFAULT_COOKIE_OPTIONS = {
   domain: undefined,
   maxAge: undefined
 };
-function buildCookieHeader(name, value, options) {
-  const parts = [`${name}=${value}`];
-  if (options.maxAge !== undefined && options.maxAge >= 0) {
-    parts.push(`Max-Age=${options.maxAge}`);
-  }
-  if (options.path) {
-    parts.push(`Path=${options.path}`);
-  }
-  if (options.domain) {
-    parts.push(`Domain=${options.domain}`);
-  }
-  if (options.secure) {
-    parts.push('Secure');
-  }
-  if (options.httpOnly) {
-    parts.push('HttpOnly');
-  }
-  if (options.sameSite) {
-    parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`);
-  }
-  return parts.join('; ');
-}
-function buildClearCookieHeader(name, options) {
-  return buildCookieHeader(name, '', {
-    ...options,
-    maxAge: 0
-  });
-}
 function getHeaderCaseInsensitive(headers, name) {
   for (const [headerName, value] of Object.entries(headers)) {
     if (headerName.toLowerCase() === name.toLowerCase() && (typeof value === 'string' || Array.isArray(value))) {
@@ -75,6 +54,8 @@ function toHeaderValues(value) {
 export class CookieManager {
   options;
   cookieOptions;
+  accessTokenTtlSeconds;
+  refreshTokenTtlSeconds;
   constructor(config) {
     this.options = normalizeCookieAuthOptions(config);
     this.cookieOptions = {
@@ -85,28 +66,36 @@ export class CookieManager {
       domain: config?.cookieOptions?.domain ?? DEFAULT_COOKIE_OPTIONS.domain,
       maxAge: config?.cookieOptions?.maxAge ?? DEFAULT_COOKIE_OPTIONS.maxAge
     };
+    this.accessTokenTtlSeconds = config?.cookieOptions?.accessTokenTtlSeconds;
+    this.refreshTokenTtlSeconds = config?.cookieOptions?.refreshTokenTtlSeconds;
   }
   setAccessTokenCookie(response, token, ttlSeconds) {
-    const cookie = buildCookieHeader(this.options.accessTokenCookieName, token, {
-      ...this.cookieOptions,
-      maxAge: ttlSeconds ?? this.cookieOptions.maxAge
+    this.writeCookie(response, {
+      maxAgeSeconds: ttlSeconds ?? this.accessTokenTtlSeconds ?? this.cookieOptions.maxAge,
+      name: this.options.accessTokenCookieName,
+      value: token
     });
-    this.appendSetCookie(response, cookie);
   }
   setRefreshTokenCookie(response, token, ttlSeconds) {
-    const cookie = buildCookieHeader(this.options.refreshTokenCookieName, token, {
-      ...this.cookieOptions,
-      maxAge: ttlSeconds ?? this.cookieOptions.maxAge
+    this.writeCookie(response, {
+      maxAgeSeconds: ttlSeconds ?? this.refreshTokenTtlSeconds ?? this.cookieOptions.maxAge,
+      name: this.options.refreshTokenCookieName,
+      value: token
     });
-    this.appendSetCookie(response, cookie);
   }
   clearAccessTokenCookie(response) {
-    const cookie = buildClearCookieHeader(this.options.accessTokenCookieName, this.cookieOptions);
-    this.appendSetCookie(response, cookie);
+    this.writeCookie(response, {
+      maxAgeSeconds: 0,
+      name: this.options.accessTokenCookieName,
+      value: ''
+    });
   }
   clearRefreshTokenCookie(response) {
-    const cookie = buildClearCookieHeader(this.options.refreshTokenCookieName, this.cookieOptions);
-    this.appendSetCookie(response, cookie);
+    this.writeCookie(response, {
+      maxAgeSeconds: 0,
+      name: this.options.refreshTokenCookieName,
+      value: ''
+    });
   }
   clearAllCookies(response) {
     this.clearAccessTokenCookie(response);
@@ -118,11 +107,21 @@ export class CookieManager {
       this.setRefreshTokenCookie(response, refreshToken, refreshTokenTtlSeconds);
     }
   }
-  appendSetCookie(response, cookie) {
+  writeCookie(response, cookie) {
     const existingHeader = getHeaderCaseInsensitive(response.headers, 'Set-Cookie');
-    const cookies = [...toHeaderValues(existingHeader?.value), cookie];
-    response.setHeader('Set-Cookie', cookie);
+    const existingValues = toHeaderValues(existingHeader?.value);
+    setCookie(response, cookie.name, cookie.value, {
+      domain: this.cookieOptions.domain,
+      httpOnly: this.cookieOptions.httpOnly,
+      maxAgeSeconds: cookie.maxAgeSeconds,
+      path: this.cookieOptions.path,
+      sameSite: this.cookieOptions.sameSite,
+      secure: this.cookieOptions.secure
+    });
     const updatedHeader = getHeaderCaseInsensitive(response.headers, 'Set-Cookie');
+    const writtenValues = toHeaderValues(response.headers['Set-Cookie'] ?? updatedHeader?.value);
+    const appendedExistingValues = writtenValues.length > existingValues.length && existingValues.every((value, index) => writtenValues[index] === value);
+    const cookies = appendedExistingValues ? writtenValues : [...existingValues, ...writtenValues];
     if (updatedHeader?.key && updatedHeader.key !== 'Set-Cookie') {
       delete response.headers[updatedHeader.key];
     }

package/dist/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAa5F,OAAO,KAAK,EACV,iBAAiB,EAKjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAsFpB;;;;;;;;;GASG;AACH,qBACa,SAAU,YAAW,iBAAiB;IAE/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,UAAU,GAAE,oBAAyB,EACrC,OAAO,GAAE,qBAA0B;IAGtD;;;;;;;;;;;;;;;;;;;OAmBG;IACG,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAkExD"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAa5F,OAAO,KAAK,EACV,iBAAiB,EAKjB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAsFpB;;;;;;;;;GASG;AACH,qBACa,SAAU,YAAW,iBAAiB;IAE/C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,UAAU,GAAE,oBAAyB,EACrC,OAAO,GAAE,qBAA0B;IAGtD;;;;;;;;;;;;;;;;;;;OAmBG;IACG,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAmExD"}

package/dist/guard.js

@@ -129,13 +129,13 @@ class AuthGuard {
     });
     try {
       const result = await strategy.authenticate(context);
-      const principal = resolvePrincipal(result);
-      if (isAuthHandledResult(result) && !principal) {
+      if (isAuthHandledResult(result)) {
         if (!context.requestContext.response.committed) {
-          throw new AuthenticationFailedError('Auth strategy returned handled:true without a principal but did not commit a response.');
+          throw new AuthenticationFailedError('Auth strategy returned handled:true but did not commit a response.');
         }
         return true;
       }
+      const principal = resolvePrincipal(result);
       if (!principal) {
         if (isAuthOptionalResult(result) && requirement?.optional && !requirement.scopes?.length) {
           return true;

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './account/account-linking.js';
+export * from './bearer/bearer-jwt.js';
 export * from './cookie/cookie-auth.js';
 export * from './cookie/cookie-auth-module.js';
 export * from './cookie/cookie-manager.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,wCAAwC,CAAC;AACvD,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,wCAAwC,CAAC;AACvD,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export * from './account/account-linking.js';
+export * from './bearer/bearer-jwt.js';
 export * from './cookie/cookie-auth.js';
 export * from './cookie/cookie-auth-module.js';
 export * from './cookie/cookie-manager.js';

package/dist/refresh/jwt-refresh-token-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-refresh-token-adapter.d.ts","sourceRoot":"","sources":["../../src/refresh/jwt-refresh-token-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAGlB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,4BAA4B,eAA2D,CAAC;AAErG;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,iBAAiB,GAAG,QAAQ,CAAC;CACrC;AA2ED;;GAEG;AACH,qBACa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAG/C,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,yBAAyB;IAuB9B,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAIhG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG1D"}
+{"version":3,"file":"jwt-refresh-token-adapter.d.ts","sourceRoot":"","sources":["../../src/refresh/jwt-refresh-token-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAIlB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,4BAA4B,eAA2D,CAAC;AAErG;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,iBAAiB,GAAG,QAAQ,CAAC;CACrC;AAoFD;;GAEG;AACH,qBACa,sBAAuB,YAAW,mBAAmB;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;gBAG/C,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,yBAAyB;IAuB9B,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInD,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAIhG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG1D"}

package/dist/refresh/jwt-refresh-token-adapter.js

@@ -23,25 +23,46 @@ function resolveSecret(options) {
 }
 function createInMemoryStore() {
   const records = new Map();
+  const pruneExpired = now => {
+    for (const [id, record] of records.entries()) {
+      if (record.expiresAt.getTime() <= now) {
+        records.delete(id);
+      }
+    }
+  };
   return {
     async save(token) {
       records.set(token.id, token);
+      pruneExpired(Date.now());
     },
     async find(tokenId) {
-      return records.get(tokenId);
+      const record = records.get(tokenId);
+      pruneExpired(Date.now());
+      return record;
     },
     async revoke(tokenId) {
+      pruneExpired(Date.now());
       records.delete(tokenId);
     },
     async revokeBySubject(subject) {
+      pruneExpired(Date.now());
       for (const [id, record] of records.entries()) {
         if (record.subject === subject) {
           records.delete(id);
         }
       }
     },
+    async revokeByFamily(family) {
+      pruneExpired(Date.now());
+      for (const [id, record] of records.entries()) {
+        if (record.family === family) {
+          records.delete(id);
+        }
+      }
+    },
     async consume(input) {
       const record = records.get(input.tokenId);
+      pruneExpired(input.now.getTime());
       if (!record) {
         return 'invalid';
       }

package/dist/refresh/refresh-token.d.ts

@@ -1,8 +1,8 @@
-import type { GuardContext } from '@fluojs/http';
 import { type Token } from '@fluojs/core';
+import type { GuardContext } from '@fluojs/http';
 import { DefaultJwtVerifier } from '@fluojs/jwt';
 import { type ModuleType } from '@fluojs/runtime';
-import type { AuthStrategy, AuthStrategyRegistration, AuthStrategyResult } from '../types.js';
+import type { AuthStrategy, AuthStrategyRegistration } from '../types.js';
 /**
  * Defines the operations required to issue, rotate, and revoke refresh tokens.
  */
@@ -27,17 +27,53 @@ export interface RefreshTokenInput {
 }
 /**
  * Captures the token pair returned after a successful refresh-token exchange.
+ *
+ * @remarks
+ * This is the application-facing exchange payload shape refresh endpoints return to
+ * clients. It is not the shape `RefreshTokenStrategy` places on `ctx.principal`;
+ * that principal result is typed by {@link RefreshTokenPrincipal}.
  */
 export interface RefreshTokenAuthResult {
     accessToken: string;
     refreshToken: string;
     subject: string;
 }
+/**
+ * The principal `RefreshTokenStrategy` resolves onto `ctx.principal` after a
+ * successful exchange, with the rotated token pair nested under `claims`.
+ */
+export interface RefreshTokenPrincipal {
+    /**
+     * Principal claims carrying the rotated pair under `accessToken` and `refreshToken`.
+     */
+    claims: Record<string, unknown> & {
+        accessToken: string;
+        refreshToken: string;
+    };
+    /**
+     * Verified subject the rotated access token was issued for.
+     */
+    subject: string;
+}
 /**
  * Identifies the built-in refresh-token authentication strategy.
  */
 export declare const REFRESH_TOKEN_STRATEGY_NAME = "refresh-token";
 type RefreshTokenModuleType = ModuleType;
+/**
+ * Configures application modules that supply refresh-token service dependencies.
+ */
+export interface RefreshTokenModuleImportOptions {
+    /**
+     * Modules that export dependencies injected into the refresh-token service.
+     *
+     * @remarks
+     * `RefreshTokenModule` keeps ownership of a class service token. Import modules
+     * that own and export its constructor dependencies so they are visible without
+     * duplicating the service provider in the importing application module.
+     */
+    imports?: ModuleType[];
+}
 /**
  * Authenticates refresh-token requests and exchanges them for a fresh token pair.
  */
@@ -45,7 +81,7 @@ export declare class RefreshTokenStrategy implements AuthStrategy {
     private readonly refreshTokenService;
     private readonly verifier;
     constructor(refreshTokenService: RefreshTokenService, verifier: DefaultJwtVerifier);
-    authenticate(context: GuardContext): Promise<AuthStrategyResult>;
+    authenticate(context: GuardContext): Promise<RefreshTokenPrincipal>;
     private rotateRefreshToken;
     private extractRefreshToken;
     private normalizeRefreshToken;
@@ -65,7 +101,20 @@ export declare class RefreshTokenModule {
      * Registers the shared refresh-token service alias together with `RefreshTokenStrategy`.
      *
      * @param service DI token for the concrete refresh-token service implementation.
+     *   Class tokens are registered inside this module.
+     *   String and symbol tokens must be visible to this module through an imported
+     *   module export, a global module export, or bootstrap runtime providers.
+     * @param options Optional module imports that export class-service constructor dependencies.
      * @returns A module definition that exports `RefreshTokenStrategy` and `REFRESH_TOKEN_SERVICE`.
+     * @remarks
+     * To register a class service with constructor dependencies, place those
+     * dependencies in an application-owned module, export them, and pass that module
+     * through `options.imports`. This preserves strict
+     * `duplicateProviderPolicy: 'throw'` behavior because the service class remains
+     * registered exactly once by `RefreshTokenModule`. Do not re-register the service
+     * class in the importing application module. String and symbol service tokens
+     * can be exported by a module in `options.imports`; globally exported and
+     * bootstrap runtime provider tokens are also visible.
      *
      * @example
      * ```ts
@@ -85,12 +134,11 @@ export declare class RefreshTokenModule {
      *       [{ name: REFRESH_TOKEN_STRATEGY_NAME, token: RefreshTokenStrategy }],
      *     ),
      *   ],
-     *   providers: [MyRefreshTokenService],
      * })
      * export class AuthModule {}
      * ```
      */
-    static forRoot(service: Token<RefreshTokenService>): RefreshTokenModuleType;
+    static forRoot(service: Token<RefreshTokenService>, options?: RefreshTokenModuleImportOptions): RefreshTokenModuleType;
 }
 export {};
 //# sourceMappingURL=refresh-token.d.ts.map

package/dist/refresh/refresh-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../src/refresh/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,cAAc,CAAC;AACjE,OAAO,EAA0B,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOhE,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE9F;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,eAAoD,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAI3D,KAAK,sBAAsB,GAAG,UAAU,CAAC;AAEzC;;GAEG;AACH,qBACa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,mBAAmB,EAAE,mBAAmB,EACxC,QAAQ,EAAE,kBAAkB;IAGzC,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAwBxD,kBAAkB;IAmBhC,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,qBAAqB;YAYf,sBAAsB;CAQrC;AAaD;;;;GAIG;AACH,wBAAgB,sCAAsC,IAAI,wBAAwB,CAKjF;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,sBAAsB;CAQ5E"}
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../src/refresh/refresh-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,KAAK,EAAE,MAAM,cAAc,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOhE,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE1E;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjG,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,eAAoD,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAI3D,KAAK,sBAAsB,GAAG,UAAU,CAAC;AAEzC;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,qBACa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,mBAAmB,EAAE,mBAAmB,EACxC,QAAQ,EAAE,kBAAkB;IAGzC,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAwB3D,kBAAkB;IAmBhC,OAAO,CAAC,mBAAmB;IAe3B,OAAO,CAAC,qBAAqB;YAYf,sBAAsB;CAQrC;AAoBD;;;;GAIG;AACH,wBAAgB,sCAAsC,IAAI,wBAAwB,CAKjF;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,MAAM,CAAC,OAAO,CACZ,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,EACnC,OAAO,GAAE,+BAAoC,GAC5C,sBAAsB;CAY1B"}

package/dist/refresh/refresh-token.js

@@ -24,6 +24,16 @@ export const REFRESH_TOKEN_SERVICE = Symbol.for('fluo.passport.refresh-token-ser
 
 /**
  * Captures the token pair returned after a successful refresh-token exchange.
+ *
+ * @remarks
+ * This is the application-facing exchange payload shape refresh endpoints return to
+ * clients. It is not the shape `RefreshTokenStrategy` places on `ctx.principal`;
+ * that principal result is typed by {@link RefreshTokenPrincipal}.
+ */
+
+/**
+ * The principal `RefreshTokenStrategy` resolves onto `ctx.principal` after a
+ * successful exchange, with the rotated token pair nested under `claims`.
  */
 
 /**
@@ -31,6 +41,10 @@ export const REFRESH_TOKEN_SERVICE = Symbol.for('fluo.passport.refresh-token-ser
  */
 export const REFRESH_TOKEN_STRATEGY_NAME = 'refresh-token';
 const MALFORMED_REFRESH_TOKEN = Symbol('MALFORMED_REFRESH_TOKEN');
+
+/**
+ * Configures application modules that supply refresh-token service dependencies.
+ */
 let _RefreshTokenStrategy;
 /**
  * Authenticates refresh-token requests and exchanges them for a fresh token pair.
@@ -115,8 +129,11 @@ class RefreshTokenStrategy {
   }
 }
 export { _RefreshTokenStrategy as RefreshTokenStrategy };
+function isClassToken(token) {
+  return typeof token === 'function';
+}
 function createRefreshTokenAliasProviders(service) {
-  return [{
+  return [...(isClassToken(service) ? [service] : []), {
     provide: REFRESH_TOKEN_SERVICE,
     useExisting: service
   }];
@@ -142,7 +159,20 @@ export class RefreshTokenModule {
    * Registers the shared refresh-token service alias together with `RefreshTokenStrategy`.
    *
    * @param service DI token for the concrete refresh-token service implementation.
+   *   Class tokens are registered inside this module.
+   *   String and symbol tokens must be visible to this module through an imported
+   *   module export, a global module export, or bootstrap runtime providers.
+   * @param options Optional module imports that export class-service constructor dependencies.
    * @returns A module definition that exports `RefreshTokenStrategy` and `REFRESH_TOKEN_SERVICE`.
+   * @remarks
+   * To register a class service with constructor dependencies, place those
+   * dependencies in an application-owned module, export them, and pass that module
+   * through `options.imports`. This preserves strict
+   * `duplicateProviderPolicy: 'throw'` behavior because the service class remains
+   * registered exactly once by `RefreshTokenModule`. Do not re-register the service
+   * class in the importing application module. String and symbol service tokens
+   * can be exported by a module in `options.imports`; globally exported and
+   * bootstrap runtime provider tokens are also visible.
    *
    * @example
    * ```ts
@@ -162,15 +192,15 @@ export class RefreshTokenModule {
    *       [{ name: REFRESH_TOKEN_STRATEGY_NAME, token: RefreshTokenStrategy }],
    *     ),
    *   ],
-   *   providers: [MyRefreshTokenService],
    * })
    * export class AuthModule {}
    * ```
    */
-  static forRoot(service) {
+  static forRoot(service, options = {}) {
     class RefreshTokenRuntimeModule extends RefreshTokenModule {}
     return defineModule(RefreshTokenRuntimeModule, {
       exports: [_RefreshTokenStrategy, REFRESH_TOKEN_SERVICE],
+      imports: options.imports ? [...options.imports] : undefined,
       providers: [_RefreshTokenStrategy, ...createRefreshTokenAliasProviders(service)]
     });
   }

package/package.json

@@ -9,7 +9,7 @@
     "guard",
     "strategy"
   ],
-  "version": "1.0.4",
+  "version": "2.0.0",
   "private": false,
   "license": "MIT",
   "repository": {
@@ -18,7 +18,7 @@
     "directory": "packages/passport"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=24.0.0 <27"
   },
   "publishConfig": {
     "access": "public"
@@ -36,14 +36,14 @@
     "dist"
   ],
   "dependencies": {
-    "@fluojs/di": "^1.0.3",
-    "@fluojs/http": "^1.1.0",
-    "@fluojs/jwt": "^1.0.1",
-    "@fluojs/runtime": "^1.1.2",
-    "@fluojs/core": "^1.0.3"
+    "@fluojs/core": "^2.0.0",
+    "@fluojs/di": "^3.0.0",
+    "@fluojs/http": "^3.0.0",
+    "@fluojs/jwt": "^2.0.0",
+    "@fluojs/runtime": "^3.0.0"
   },
   "devDependencies": {
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "scripts": {
     "prebuild": "node ../../tooling/scripts/clean-dist.mjs",