@kb-labs/gateway-auth 2.94.0 → 2.96.0

package/dist/index.js

@@ -1,5 +1,8 @@
-import { randomBytes, randomUUID, createHash } from 'crypto';
-import { SignJWT, jwtVerify } from 'jose';
+import { randomBytes, randomUUID, timingSafeEqual, createHash } from 'crypto';
+import { SignJWT, jwtVerify, createLocalJWKSet } from 'jose';
+import bcrypt from 'bcryptjs';
+import { z } from 'zod';
+import { PERMISSIONS } from '@kb-labs/core-contracts';
 
 // src/store.ts
 var REFRESH_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -24,6 +27,19 @@ function generateNamespaceId() {
 async function saveClient(cache, record) {
   await cache.set(`auth:client:${record.clientId}`, record);
   await cache.set(`auth:hostindex:${record.hostId}`, record.clientId);
+  if (record.handle) {
+    await cache.set(`auth:handle:${record.handle}`, record.clientId);
+  }
+}
+async function isHandleTaken(cache, handle) {
+  return await cache.get(`auth:handle:${handle}`) !== null;
+}
+async function getClientByHandle(cache, handle) {
+  const clientId = await cache.get(`auth:handle:${handle}`);
+  if (!clientId) {
+    return null;
+  }
+  return getClient(cache, clientId);
 }
 async function getClientByHostId(cache, hostId) {
   const clientId = await cache.get(`auth:hostindex:${hostId}`);
@@ -54,8 +70,11 @@ function buildClientRecord(opts) {
     tier: "free",
     name: opts.name,
     capabilities: opts.capabilities,
+    permissions: opts.permissions,
     publicKey: opts.publicKey,
-    createdAt: Date.now()
+    createdAt: Date.now(),
+    handle: opts.handle,
+    email: opts.email
   };
 }
 async function saveRefreshToken(cache, token, hostId, namespaceId) {
@@ -87,7 +106,8 @@ async function signAccessToken(opts, config) {
   const token = await new SignJWT({
     namespaceId: opts.namespaceId,
     tier: opts.tier,
-    type: opts.type
+    type: opts.type,
+    permissions: opts.permissions ?? []
   }).setProtectedHeader({ alg: "HS256" }).setSubject(opts.hostId).setIssuedAt(now).setExpirationTime(now + ACCESS_TOKEN_TTL).sign(key);
   return { token, expiresIn: ACCESS_TOKEN_TTL };
 }
@@ -100,7 +120,7 @@ async function signRefreshToken(hostId, config) {
 async function verifyAccessToken(token, config) {
   try {
     const key = getSecretKey(config.secret);
-    const { payload } = await jwtVerify(token, key);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
     return payload;
   } catch {
     return null;
@@ -109,7 +129,7 @@ async function verifyAccessToken(token, config) {
 async function verifyRefreshToken(token, config) {
   try {
     const key = getSecretKey(config.secret);
-    const { payload } = await jwtVerify(token, key);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
     if (payload.type !== "refresh") {
       return null;
     }
@@ -121,6 +141,87 @@ async function verifyRefreshToken(token, config) {
     return null;
   }
 }
+async function signUserAccessToken(opts, config) {
+  const key = getSecretKey(config.secret);
+  const now = Math.floor(Date.now() / 1e3);
+  const jti = randomUUID();
+  const token = await new SignJWT({
+    tenantId: opts.tenantId,
+    fam: opts.familyId,
+    type: "user",
+    jti
+  }).setProtectedHeader({ alg: "HS256" }).setSubject(opts.userId).setIssuedAt(now).setExpirationTime(now + opts.ttlSec).sign(key);
+  return { token, expiresInSec: opts.ttlSec, jti };
+}
+async function signUserRefreshToken(opts, config) {
+  const key = getSecretKey(config.secret);
+  const now = Math.floor(Date.now() / 1e3);
+  const jti = opts.jti ?? randomUUID();
+  return new SignJWT({
+    tenantId: opts.tenantId,
+    fam: opts.familyId,
+    type: "refresh",
+    jti
+  }).setProtectedHeader({ alg: "HS256" }).setSubject(opts.userId).setIssuedAt(now).setExpirationTime(now + opts.ttlSec).sign(key);
+}
+var normaliseAccess = (raw) => {
+  if (raw.type !== "user") {
+    return null;
+  }
+  if (!raw.sub || !raw.tenantId || !raw.fam || !raw.jti) {
+    return null;
+  }
+  if (typeof raw.iat !== "number" || typeof raw.exp !== "number") {
+    return null;
+  }
+  return {
+    userId: raw.sub,
+    tenantId: raw.tenantId,
+    familyId: raw.fam,
+    jti: raw.jti,
+    type: "user",
+    iat: raw.iat,
+    exp: raw.exp
+  };
+};
+var normaliseRefresh = (raw) => {
+  if (raw.type !== "refresh") {
+    return null;
+  }
+  if (!raw.sub || !raw.tenantId || !raw.fam || !raw.jti) {
+    return null;
+  }
+  if (typeof raw.iat !== "number" || typeof raw.exp !== "number") {
+    return null;
+  }
+  return {
+    userId: raw.sub,
+    tenantId: raw.tenantId,
+    familyId: raw.fam,
+    jti: raw.jti,
+    type: "refresh",
+    iat: raw.iat,
+    exp: raw.exp
+  };
+};
+async function verifyUserAccessToken(token, config) {
+  try {
+    const key = getSecretKey(config.secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return normaliseAccess(payload);
+  } catch {
+    return null;
+  }
+}
+async function verifyUserRefreshToken(token, config) {
+  try {
+    const key = getSecretKey(config.secret);
+    const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+    return normaliseRefresh(payload);
+  } catch {
+    return null;
+  }
+}
 
 // src/service.ts
 var AuthService = class {
@@ -132,12 +233,17 @@ var AuthService = class {
   jwtConfig;
   // ── Register ──────────────────────────────────────────────────────────────
   async register(req) {
+    if (req.handle && await isHandleTaken(this.cache, req.handle)) {
+      throw Object.assign(new Error(`Handle '${req.handle}' is already taken`), { code: "HANDLE_TAKEN" });
+    }
     const secret = generateClientSecret();
     const record = buildClientRecord({
       name: req.name,
       capabilities: req.capabilities ?? [],
       publicKey: req.publicKey,
-      secret
+      secret,
+      handle: req.handle,
+      email: req.email
     });
     await saveClient(this.cache, record);
     if (req.publicKey) {
@@ -146,9 +252,9 @@ var AuthService = class {
     return {
       clientId: record.clientId,
       clientSecret: secret,
-      // returned ONCE, never stored in plaintext
       hostId: record.hostId,
-      namespaceId: record.namespaceId
+      namespaceId: record.namespaceId,
+      handle: record.handle
     };
   }
   // ── Issue token pair ──────────────────────────────────────────────────────
@@ -163,7 +269,8 @@ var AuthService = class {
           hostId: record.hostId,
           namespaceId: record.namespaceId,
           tier: record.tier,
-          type: "machine"
+          type: "machine",
+          permissions: record.permissions ?? ["host:connect"]
         },
         this.jwtConfig
       ),
@@ -183,9 +290,16 @@ var AuthService = class {
       return null;
     }
     const hostId = stored.hostId;
+    const record = await getClientByHostId(this.cache, hostId);
     const [{ token: accessToken, expiresIn }, newRefreshToken] = await Promise.all([
       signAccessToken(
-        { hostId, namespaceId: stored.namespaceId, tier: "free", type: "machine" },
+        {
+          hostId,
+          namespaceId: stored.namespaceId,
+          tier: record?.tier ?? "free",
+          type: "machine",
+          permissions: record?.permissions ?? ["host:connect"]
+        },
         this.jwtConfig
       ),
       signRefreshToken(hostId, this.jwtConfig)
@@ -193,6 +307,14 @@ var AuthService = class {
     await saveRefreshToken(this.cache, newRefreshToken, hostId, stored.namespaceId);
     return { accessToken, refreshToken: newRefreshToken, expiresIn, tokenType: "Bearer" };
   }
+  // ── Profile lookup ────────────────────────────────────────────────────────
+  async me(hostId) {
+    const record = await getClientByHostId(this.cache, hostId);
+    if (!record) {
+      return null;
+    }
+    return { hostId: record.hostId, handle: record.handle, namespaceId: record.namespaceId };
+  }
   // ── Verify access token → AuthContext ────────────────────────────────────
   async verify(token) {
     const payload = await verifyAccessToken(token, this.jwtConfig);
@@ -204,11 +326,1379 @@ var AuthService = class {
       userId: payload.sub,
       namespaceId: payload.namespaceId,
       tier: payload.tier,
-      permissions: ["host:connect"]
+      permissions: payload.permissions ?? ["host:connect"]
     };
   }
 };
 
-export { AuthService, buildClientRecord, consumeRefreshToken, generateClientId, generateClientSecret, generateHostId, getClient, getClientByHostId, getPublicKey, saveClient, savePublicKey, saveRefreshToken, signAccessToken, signRefreshToken, verifyAccessToken, verifyClientSecret, verifyRefreshToken };
+// src/users-store.ts
+var COLLECTION = "users";
+var canonicalizeEmail = (raw) => raw.trim().toLowerCase();
+var docToUser = (doc) => ({
+  userId: doc.userId,
+  tenantId: doc.tenantId,
+  email: doc.email,
+  displayName: doc.displayName,
+  status: doc.status,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var UsersStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION, {
+          indexes: [
+            // Logical primary key for "user inside tenant" lookups.
+            { path: ["tenantId", "email"], unique: true },
+            // userId is the surrogate key callers reference everywhere.
+            { path: "userId", unique: true },
+            { path: "tenantId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async create(input) {
+    await this.ensureSchema();
+    const email = canonicalizeEmail(input.email);
+    await this.docs.insertOne(COLLECTION, {
+      userId: input.userId,
+      tenantId: input.tenantId,
+      email,
+      displayName: input.displayName,
+      status: input.status
+    });
+    const created = await this.getById(input.userId);
+    if (!created) {
+      throw new Error(`users-store: inserted user ${input.userId} but read-back returned null`);
+    }
+    return created;
+  }
+  async getById(userId) {
+    await this.ensureSchema();
+    const doc = await this.docs.findById(COLLECTION, userId);
+    if (doc && doc.userId === userId) {
+      return docToUser(doc);
+    }
+    const [byField] = await this.docs.find(
+      COLLECTION,
+      { userId: { $eq: userId } },
+      { limit: 1 }
+    );
+    return byField ? docToUser(byField) : null;
+  }
+  async findByEmailTenant(email, tenantId) {
+    await this.ensureSchema();
+    const normalised = canonicalizeEmail(email);
+    const [doc] = await this.docs.find(
+      COLLECTION,
+      { $and: [{ tenantId: { $eq: tenantId } }, { email: { $eq: normalised } }] },
+      { limit: 1 }
+    );
+    return doc ? docToUser(doc) : null;
+  }
+  async setStatus(userId, status) {
+    await this.ensureSchema();
+    const existing = await this.getById(userId);
+    if (!existing) {
+      throw new Error(`users-store: setStatus on unknown userId=${userId}`);
+    }
+    await this.docs.updateMany(
+      COLLECTION,
+      { userId: { $eq: userId } },
+      { $set: { status } }
+    );
+  }
+  /** List all users for a given tenant. */
+  async listByTenant(tenantId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION,
+      { tenantId: { $eq: tenantId } }
+    );
+    return docs.map(docToUser);
+  }
+  async delete(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION, { userId: { $eq: userId } });
+  }
+};
+
+// src/credentials-store.ts
+var COLLECTION2 = "credentials";
+var docToCredential = (doc) => ({
+  userId: doc.userId,
+  providerId: doc.providerId,
+  hash: doc.hash,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var CredentialsStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION2, {
+          indexes: [
+            // Logical primary key.
+            { path: ["userId", "providerId"], unique: true },
+            // Cascade delete needs userId alone.
+            { path: "userId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async setCredential(input) {
+    await this.ensureSchema();
+    await this.docs.updateOne(
+      COLLECTION2,
+      {
+        $and: [
+          { userId: { $eq: input.userId } },
+          { providerId: { $eq: input.providerId } }
+        ]
+      },
+      {
+        $set: {
+          userId: input.userId,
+          providerId: input.providerId,
+          hash: input.hash
+        }
+      },
+      { upsert: true }
+    );
+  }
+  async getCredential(userId, providerId) {
+    await this.ensureSchema();
+    const [doc] = await this.docs.find(
+      COLLECTION2,
+      {
+        $and: [
+          { userId: { $eq: userId } },
+          { providerId: { $eq: providerId } }
+        ]
+      },
+      { limit: 1 }
+    );
+    return doc ? docToCredential(doc) : null;
+  }
+  async deleteCredential(userId, providerId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION2, {
+      $and: [
+        { userId: { $eq: userId } },
+        { providerId: { $eq: providerId } }
+      ]
+    });
+  }
+  /**
+   * Cascade removal helper — call from the parent flow when a `User` is
+   * deleted so we never leave dangling credentials in the store.
+   */
+  async deleteAllForUser(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION2, {
+      userId: { $eq: userId }
+    });
+  }
+};
+
+// src/memberships-store.ts
+var COLLECTION3 = "memberships";
+var docToMembership = (doc) => ({
+  userId: doc.userId,
+  tenantId: doc.tenantId,
+  groupId: doc.groupId,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var MembershipsStore = class {
+  constructor(docs) {
+    this.docs = docs;
+  }
+  docs;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION3, {
+          indexes: [
+            { path: ["userId", "tenantId"], unique: true },
+            { path: "userId" },
+            { path: "tenantId" }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async addMembership(input) {
+    await this.ensureSchema();
+    await this.docs.insertOne(COLLECTION3, {
+      userId: input.userId,
+      tenantId: input.tenantId,
+      groupId: input.groupId
+    });
+  }
+  async setGroup(userId, tenantId, groupId) {
+    await this.ensureSchema();
+    const [existing] = await this.docs.find(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] },
+      { limit: 1 }
+    );
+    if (!existing) {
+      throw new Error(
+        `memberships-store: setGroup on missing membership userId=${userId} tenantId=${tenantId}`
+      );
+    }
+    await this.docs.updateMany(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] },
+      { $set: { groupId } }
+    );
+  }
+  async listByUser(userId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION3,
+      { userId: { $eq: userId } },
+      { sort: { tenantId: 1 } }
+    );
+    return docs.map(docToMembership);
+  }
+  async listByTenant(tenantId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION3,
+      { tenantId: { $eq: tenantId } },
+      { sort: { userId: 1 } }
+    );
+    return docs.map(docToMembership);
+  }
+  async removeMembership(userId, tenantId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(
+      COLLECTION3,
+      { $and: [{ userId: { $eq: userId } }, { tenantId: { $eq: tenantId } }] }
+    );
+  }
+  /** Cascade hook — call when a `User` is deleted. */
+  async removeAllForUser(userId) {
+    await this.ensureSchema();
+    await this.docs.deleteMany(COLLECTION3, { userId: { $eq: userId } });
+  }
+};
+var COLLECTION4 = "invites";
+var TOKEN_BYTES = 32;
+var generateToken = () => randomBytes(TOKEN_BYTES).toString("base64url");
+var hashToken2 = (plain) => createHash("sha256").update(plain).digest("hex");
+var generateInviteId = () => randomBytes(16).toString("base64url");
+var docToInvite = (doc) => ({
+  inviteId: doc.inviteId,
+  email: doc.email,
+  tenantId: doc.tenantId,
+  groupId: doc.groupId,
+  status: doc.status,
+  createdBy: doc.createdBy,
+  expiresAt: doc.expiresAt,
+  createdAt: doc.createdAt,
+  updatedAt: doc.updatedAt
+});
+var InvitesStore = class {
+  constructor(docs, now = Date.now) {
+    this.docs = docs;
+    this.now = now;
+  }
+  docs;
+  now;
+  initialised = null;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(COLLECTION4, {
+          indexes: [
+            { path: "inviteId", unique: true },
+            { path: "tokenHash", unique: true },
+            // Active-invite uniqueness is enforced in code, so this index
+            // is non-unique and just speeds the "is there an active invite
+            // for (email, tenantId)" lookup.
+            { path: ["tenantId", "email", "status"] },
+            // TTL is best-effort; `findByToken` also checks expiresAt > now.
+            // `ttl: 0` means "sweep as soon as `expiresAt` is in the past".
+            { path: "expiresAt", ttl: 0 }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async createInvite(input) {
+    await this.ensureSchema();
+    const email = canonicalizeEmail(input.email);
+    const [existingActive] = await this.docs.find(
+      COLLECTION4,
+      {
+        $and: [
+          { tenantId: { $eq: input.tenantId } },
+          { email: { $eq: email } },
+          { status: { $eq: "active" } },
+          { expiresAt: { $gt: this.now() } }
+        ]
+      },
+      { limit: 1 }
+    );
+    if (existingActive) {
+      throw new Error(
+        `invites-store: an active invite already exists for email=${email} tenantId=${input.tenantId}; revoke it before issuing a new one`
+      );
+    }
+    const inviteId = generateInviteId();
+    const activationToken = generateToken();
+    const tokenHash = hashToken2(activationToken);
+    const expiresAt = this.now() + input.ttlMs;
+    await this.docs.insertOne(COLLECTION4, {
+      inviteId,
+      email,
+      tenantId: input.tenantId,
+      groupId: input.groupId,
+      status: "active",
+      createdBy: input.createdBy,
+      expiresAt,
+      tokenHash
+    });
+    return { inviteId, activationToken, expiresAt };
+  }
+  async findById(inviteId) {
+    await this.ensureSchema();
+    const [doc] = await this.docs.find(
+      COLLECTION4,
+      { inviteId: { $eq: inviteId } },
+      { limit: 1 }
+    );
+    return doc ? docToInvite(doc) : null;
+  }
+  /**
+   * Look up an invite by the plaintext activation token. Returns `null`
+   * for missing, expired, used, or revoked invites — callers do not
+   * need to filter further.
+   *
+   * Returns a discriminated result so callers can distinguish:
+   *   - { kind: 'not_found' }  — token hash not in DB (garbage/unknown token)
+   *   - { kind: 'invalid' }    — token exists but expired, used, or revoked
+   *   - { kind: 'ok', invite } — valid, active invite ready for activation
+   */
+  async findByToken(plainToken) {
+    await this.ensureSchema();
+    const tokenHash = hashToken2(plainToken);
+    const [doc] = await this.docs.find(
+      COLLECTION4,
+      { tokenHash: { $eq: tokenHash } },
+      { limit: 1 }
+    );
+    if (!doc) {
+      return { kind: "not_found" };
+    }
+    if (doc.status !== "active" || doc.expiresAt <= this.now()) {
+      return { kind: "invalid" };
+    }
+    return { kind: "ok", invite: docToInvite(doc) };
+  }
+  /**
+   * Atomically mark an active invite as used.
+   *
+   * Returns `true` if THIS call flipped the invite from `active` → `used`,
+   * `false` if it was already used/revoked (or unknown). The filter pins
+   * `status: 'active'`, so a concurrent double-activation of the same token
+   * results in exactly one caller seeing `true` — the activation flow relies
+   * on this to close the TOCTOU window between `findByToken` and account
+   * creation (a second parallel request must NOT create a duplicate account).
+   */
+  async consume(inviteId) {
+    await this.ensureSchema();
+    const modified = await this.docs.updateMany(
+      COLLECTION4,
+      { $and: [{ inviteId: { $eq: inviteId } }, { status: { $eq: "active" } }] },
+      { $set: { status: "used" } }
+    );
+    return modified > 0;
+  }
+  async revoke(inviteId) {
+    await this.ensureSchema();
+    await this.docs.updateMany(
+      COLLECTION4,
+      { $and: [{ inviteId: { $eq: inviteId } }, { status: { $eq: "active" } }] },
+      { $set: { status: "revoked" } }
+    );
+  }
+  /** List all invites for a tenant (active + used + revoked). */
+  async listByTenant(tenantId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      COLLECTION4,
+      { tenantId: { $eq: tenantId } }
+    );
+    return docs.map(docToInvite);
+  }
+};
+var FAMILIES = "session_families";
+var REFRESHES = "refresh_tokens";
+var RefreshNotFoundError = class extends Error {
+  constructor() {
+    super("refresh token not found");
+    this.name = "RefreshNotFoundError";
+  }
+};
+var RefreshExpiredError = class extends Error {
+  constructor() {
+    super("refresh token expired");
+    this.name = "RefreshExpiredError";
+  }
+};
+var RefreshReuseDetectedError = class extends Error {
+  constructor(familyId) {
+    super(`refresh token reuse detected (family ${familyId} killed)`);
+    this.familyId = familyId;
+    this.name = "RefreshReuseDetectedError";
+  }
+  familyId;
+};
+var newId = (bytes = 16) => randomBytes(bytes).toString("base64url");
+var SessionsStore = class {
+  constructor(docs, opts) {
+    this.docs = docs;
+    this.now = opts.now ?? Date.now;
+    this.refreshTtlMs = opts.refreshTtlMs;
+    this.graceWindowMs = opts.graceWindowMs;
+  }
+  docs;
+  initialised = null;
+  now;
+  refreshTtlMs;
+  graceWindowMs;
+  async ensureSchema() {
+    if (!this.initialised) {
+      this.initialised = (async () => {
+        await this.docs.ensureCollection(FAMILIES, {
+          indexes: [
+            { path: "familyId", unique: true },
+            { path: "userId" }
+          ]
+        });
+        await this.docs.ensureCollection(REFRESHES, {
+          indexes: [
+            { path: "jti", unique: true },
+            { path: "familyId" },
+            { path: "userId" },
+            // Best-effort sweep; `rotateRefresh` checks expiresAt > now (CD-9).
+            { path: "expiresAt", ttl: 0 }
+          ]
+        });
+      })();
+    }
+    await this.initialised;
+  }
+  async createSession(input) {
+    await this.ensureSchema();
+    const familyId = newId();
+    const refreshJti = newId();
+    const now = this.now();
+    const refreshExpiresAt = now + this.refreshTtlMs;
+    await this.docs.transaction(async (tx) => {
+      await tx.insertOne(FAMILIES, {
+        familyId,
+        userId: input.userId,
+        tenantId: input.tenantId,
+        lastUsedAt: now,
+        userAgent: input.deviceCtx.userAgent,
+        ipFirst: input.deviceCtx.ip
+      });
+      await tx.insertOne(REFRESHES, {
+        jti: refreshJti,
+        familyId,
+        userId: input.userId,
+        expiresAt: refreshExpiresAt
+      });
+    });
+    return { familyId, refreshJti, refreshExpiresAt };
+  }
+  /**
+   * Consume `oldJti` and issue a new refresh in the same family.
+   *
+   * Throws:
+   * - `RefreshNotFoundError` if jti is unknown or its family was revoked.
+   * - `RefreshExpiredError` if jti is past `expiresAt` (family stays alive).
+   * - `RefreshReuseDetectedError` if jti was already consumed and the
+   *   grace window has passed — family is killed before throwing.
+   *
+   * On grace-window retry (same already-consumed jti within
+   * `graceWindowMs`) the previously-issued replacement is returned and
+   * no new refresh is created.
+   */
+  async rotateRefresh(oldJti) {
+    await this.ensureSchema();
+    const now = this.now();
+    const newJti = newId();
+    const newExpiresAt = now + this.refreshTtlMs;
+    const outcome = await this.docs.transaction(async (tx) => {
+      const [current] = await tx.find(
+        REFRESHES,
+        { jti: { $eq: oldJti } },
+        { limit: 1 }
+      );
+      if (!current) {
+        return { tag: "not-found" };
+      }
+      if (current.consumedAt !== void 0) {
+        const elapsed = now - current.consumedAt;
+        if (elapsed <= this.graceWindowMs && current.replacedBy) {
+          const [replacement] = await tx.find(
+            REFRESHES,
+            { jti: { $eq: current.replacedBy } },
+            { limit: 1 }
+          );
+          if (replacement) {
+            return {
+              tag: "ok",
+              result: {
+                newJti: replacement.jti,
+                familyId: current.familyId,
+                newRefreshExpiresAt: replacement.expiresAt
+              }
+            };
+          }
+        }
+        if (current.expiresAt <= now) {
+          return { tag: "expired" };
+        }
+        return { tag: "reuse", familyId: current.familyId };
+      }
+      if (current.expiresAt <= now) {
+        return { tag: "expired" };
+      }
+      await tx.updateMany(
+        REFRESHES,
+        { jti: { $eq: oldJti } },
+        { $set: { consumedAt: now, replacedBy: newJti } }
+      );
+      await tx.insertOne(REFRESHES, {
+        jti: newJti,
+        familyId: current.familyId,
+        userId: current.userId,
+        expiresAt: newExpiresAt
+      });
+      await tx.updateMany(
+        FAMILIES,
+        { familyId: { $eq: current.familyId } },
+        { $set: { lastUsedAt: now } }
+      );
+      return {
+        tag: "ok",
+        result: { newJti, familyId: current.familyId, newRefreshExpiresAt: newExpiresAt }
+      };
+    });
+    switch (outcome.tag) {
+      case "ok":
+        return outcome.result;
+      case "not-found":
+        throw new RefreshNotFoundError();
+      case "expired":
+        throw new RefreshExpiredError();
+      case "reuse":
+        await this.revokeFamily(outcome.familyId);
+        throw new RefreshReuseDetectedError(outcome.familyId);
+    }
+  }
+  async revokeFamily(familyId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      await tx.deleteMany(REFRESHES, { familyId: { $eq: familyId } });
+      await tx.deleteMany(FAMILIES, { familyId: { $eq: familyId } });
+    });
+  }
+  async revokeAllUserSessions(userId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      await tx.deleteMany(REFRESHES, { userId: { $eq: userId } });
+      await tx.deleteMany(FAMILIES, { userId: { $eq: userId } });
+    });
+  }
+  async revokeAllUserSessionsExcept(userId, exceptFamilyId) {
+    await this.ensureSchema();
+    await this.docs.transaction(async (tx) => {
+      const families = await tx.find(FAMILIES, { userId: { $eq: userId } });
+      const targets = families.filter((f) => f.familyId !== exceptFamilyId).map((f) => f.familyId);
+      if (targets.length === 0) {
+        return;
+      }
+      await tx.deleteMany(
+        REFRESHES,
+        { $and: [{ userId: { $eq: userId } }, { familyId: { $in: targets } }] }
+      );
+      await tx.deleteMany(
+        FAMILIES,
+        { $and: [{ userId: { $eq: userId } }, { familyId: { $in: targets } }] }
+      );
+    });
+  }
+  async listFamiliesByUser(userId) {
+    await this.ensureSchema();
+    const docs = await this.docs.find(
+      FAMILIES,
+      { userId: { $eq: userId } },
+      { sort: { lastUsedAt: -1 } }
+    );
+    return docs.map((d) => ({
+      familyId: d.familyId,
+      userId: d.userId,
+      tenantId: d.tenantId,
+      createdAt: d.createdAt,
+      lastUsedAt: d.lastUsedAt,
+      userAgent: d.userAgent,
+      ipFirst: d.ipFirst
+    }));
+  }
+};
+var noopLogger = {
+  warn: () => void 0,
+  info: () => void 0,
+  error: () => void 0
+};
+var sha1Hex = (input) => createHash("sha1").update(input).digest("hex").toUpperCase();
+var queryHibp = async (plain, doFetch) => {
+  const hash = sha1Hex(plain);
+  const prefix = hash.slice(0, 5);
+  const wantedSuffix = hash.slice(5);
+  const resp = await doFetch(`https://api.pwnedpasswords.com/range/${prefix}`);
+  if (!resp.ok) {
+    throw new Error(`HIBP ${resp.status}`);
+  }
+  const text = await resp.text();
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    const sepIdx = trimmed.indexOf(":");
+    if (sepIdx < 0) {
+      continue;
+    }
+    const suffix = trimmed.slice(0, sepIdx).toUpperCase();
+    if (suffix === wantedSuffix) {
+      const count = Number.parseInt(trimmed.slice(sepIdx + 1), 10);
+      return Number.isFinite(count) ? count : 1;
+    }
+  }
+  return 0;
+};
+var createPasswordPolicy = (opts) => {
+  const log = opts.logger ?? noopLogger;
+  const doFetch = opts.fetch ?? fetch;
+  return {
+    async validate(plain) {
+      if (plain.length < opts.minLength) {
+        return { ok: false, reason: "too_short" };
+      }
+      if (plain.length > opts.maxLength) {
+        return { ok: false, reason: "too_long" };
+      }
+      if (!opts.hibpEnabled) {
+        return { ok: true };
+      }
+      try {
+        const count = await queryHibp(plain, doFetch);
+        if (count > 0) {
+          return { ok: false, reason: "pwned" };
+        }
+        return { ok: true };
+      } catch (err) {
+        log.warn("password-policy: HIBP unavailable, accepting password", { err: String(err) });
+        return { ok: true, warning: "hibp_unavailable" };
+      }
+    }
+  };
+};
+var issueCsrfToken = () => randomBytes(32).toString("base64url");
+var verifyCsrfToken = (cookie, header) => {
+  if (!cookie || !header) {
+    return false;
+  }
+  if (cookie.length !== header.length) {
+    return false;
+  }
+  const a = Buffer.from(cookie, "utf8");
+  const b = Buffer.from(header, "utf8");
+  return timingSafeEqual(a, b);
+};
+
+// src/rate-limit.ts
+var retryAfterFor = async (kv, key, cfg) => {
+  const remainingTtlMs = await kv.ttl(key);
+  return remainingTtlMs !== null ? Math.max(1, Math.ceil(remainingTtlMs / 1e3)) : Math.ceil(cfg.windowMs / 1e3);
+};
+var createRateLimiter = (kv) => ({
+  async check(key, cfg) {
+    const count = await kv.incr(key, 1);
+    if (count === 1) {
+      await kv.expire(key, cfg.windowMs);
+    }
+    if (count > cfg.max) {
+      return { allowed: false, retryAfterSec: await retryAfterFor(kv, key, cfg) };
+    }
+    return { allowed: true, remaining: cfg.max - count };
+  },
+  async peek(key, cfg) {
+    const raw = await kv.get(key);
+    const count = typeof raw === "number" ? raw : 0;
+    if (count >= cfg.max) {
+      return { allowed: false, retryAfterSec: await retryAfterFor(kv, key, cfg) };
+    }
+    return { allowed: true, remaining: cfg.max - count };
+  }
+});
+
+// src/tenant-resolver.ts
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]$/;
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+  "api",
+  "www",
+  "docs",
+  "studio",
+  "mail",
+  "admin",
+  "static",
+  "cdn"
+]);
+var compilePattern = (pattern) => {
+  const escapedTail = pattern.replace("{tenant}.", "").replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^([^.]+)\\.${escapedTail}$`);
+};
+var createTenantResolver = (opts) => {
+  const re = compilePattern(opts.pattern);
+  const reserved = opts.reserved ?? RESERVED_SUBDOMAINS;
+  const cache = /* @__PURE__ */ new Map();
+  const CACHE_LIMIT = 100;
+  return {
+    resolve(host) {
+      if (!host) {
+        return null;
+      }
+      const normalised = host.toLowerCase().split(":")[0] ?? "";
+      if (!normalised) {
+        return null;
+      }
+      if (cache.has(normalised)) {
+        return cache.get(normalised);
+      }
+      let result = null;
+      const m = normalised.match(re);
+      if (m) {
+        const candidate = m[1];
+        if (SLUG_RE.test(candidate) && !reserved.has(candidate)) {
+          result = candidate;
+        }
+      }
+      if (cache.size >= CACHE_LIMIT) {
+        const firstKey = cache.keys().next().value;
+        if (firstKey !== void 0) {
+          cache.delete(firstKey);
+        }
+      }
+      cache.set(normalised, result);
+      return result;
+    }
+  };
+};
+var dummyHashFor = (cost) => bcrypt.hash("dummy-password-for-timing", cost);
+var isPasswordInput = (raw) => {
+  if (!raw || typeof raw !== "object") {
+    return false;
+  }
+  const r = raw;
+  return typeof r.email === "string" && typeof r.password === "string" && r.email.length > 0 && r.password.length > 0;
+};
+var createEmailPasswordProvider = (opts) => {
+  const dummyHashPromise = dummyHashFor(opts.bcryptCost);
+  return {
+    id: "email-password",
+    kind: "password",
+    async authenticate(input) {
+      if (!isPasswordInput(input)) {
+        await bcrypt.compare("x", await dummyHashPromise);
+        return { ok: false, reason: "invalid" };
+      }
+      const email = canonicalizeEmail(input.email);
+      const user = await opts.users.findByEmailTenant(email, opts.tenantId);
+      if (!user) {
+        await bcrypt.compare(input.password, await dummyHashPromise);
+        return { ok: false, reason: "unknown" };
+      }
+      if (user.status !== "active") {
+        await bcrypt.compare(input.password, await dummyHashPromise);
+        return { ok: false, reason: "disabled" };
+      }
+      const cred = await opts.credentials.getCredential(user.userId, "email-password");
+      if (!cred) {
+        await bcrypt.compare(input.password, await dummyHashPromise);
+        return { ok: false, reason: "unknown" };
+      }
+      const match = await bcrypt.compare(input.password, cred.hash);
+      if (!match) {
+        return { ok: false, reason: "invalid" };
+      }
+      return { ok: true, email: user.email, externalId: user.userId };
+    }
+  };
+};
+var OidcConfigSchema = z.object({
+  type: z.literal("oidc"),
+  id: z.string().min(1),
+  issuer: z.string().url().refine((u) => u.startsWith("https://"), { message: "issuer must be https" }),
+  clientId: z.string().min(1),
+  /** Direct secret (discouraged — prefer clientSecretEnv). */
+  clientSecret: z.string().min(1).optional(),
+  /** Name of the env var holding the secret (preferred). */
+  clientSecretEnv: z.string().min(1).optional(),
+  /** OAuth scopes; `openid` is always included. Default `['openid','email']`. */
+  scopes: z.array(z.string()).optional(),
+  /** Enable PKCE (S256). */
+  pkce: z.boolean().optional(),
+  /** Accept tokens whose email_verified is false (default false). */
+  allowUnverifiedEmail: z.boolean().optional()
+}).passthrough();
+var VERIFY_ALGS = ["RS256", "ES256"];
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function resolveSecret(config) {
+  if (config.clientSecretEnv) {
+    const fromEnv = process.env[config.clientSecretEnv];
+    if (!fromEnv) {
+      throw new Error(
+        `oidc provider "${config.id}": clientSecretEnv "${config.clientSecretEnv}" is not set`
+      );
+    }
+    return fromEnv;
+  }
+  if (config.clientSecret) {
+    return config.clientSecret;
+  }
+  throw new Error(
+    `oidc provider "${config.id}": no client secret \u2014 set clientSecretEnv (preferred) or clientSecret`
+  );
+}
+function asBundle(input) {
+  return input && typeof input === "object" ? input : {};
+}
+function createOidcProvider(rawConfig, deps) {
+  const config = OidcConfigSchema.parse(rawConfig);
+  const secret = resolveSecret(config);
+  const scopes = config.scopes && config.scopes.length > 0 ? config.scopes : ["openid", "email"];
+  const scopeParam = [.../* @__PURE__ */ new Set(["openid", ...scopes])].join(" ");
+  const doFetch = deps.fetch ?? globalThis.fetch;
+  let discoveryCache = null;
+  let jwksCache = null;
+  async function discover() {
+    if (discoveryCache) {
+      return discoveryCache;
+    }
+    const url = `${config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+    const res = await doFetch(url);
+    if (!res.ok) {
+      throw new Error(`oidc "${config.id}": discovery failed (${res.status})`);
+    }
+    const json = await res.json();
+    discoveryCache = json;
+    return json;
+  }
+  async function getJwks(force = false) {
+    if (jwksCache && !force) {
+      return jwksCache;
+    }
+    const { jwks_uri } = await discover();
+    const res = await doFetch(jwks_uri);
+    if (!res.ok) {
+      throw new Error(`oidc "${config.id}": JWKS fetch failed (${res.status})`);
+    }
+    const jwks = await res.json();
+    jwksCache = createLocalJWKSet(jwks);
+    return jwksCache;
+  }
+  async function verifyIdToken(idToken) {
+    const opts = { algorithms: VERIFY_ALGS, issuer: config.issuer, audience: config.clientId };
+    try {
+      const { payload } = await jwtVerify(idToken, await getJwks(), opts);
+      return payload;
+    } catch (err) {
+      const code = err.code;
+      if (code === "ERR_JWKS_NO_MATCHING_KEY") {
+        const { payload } = await jwtVerify(idToken, await getJwks(true), opts);
+        return payload;
+      }
+      throw err;
+    }
+  }
+  const provider = {
+    id: config.id,
+    kind: "redirect",
+    async startAuthorization(ctx) {
+      const { authorization_endpoint } = await discover();
+      const nonce = base64url(randomBytes(16));
+      const url = new URL(authorization_endpoint);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      url.searchParams.set("redirect_uri", ctx.redirectUri);
+      url.searchParams.set("scope", scopeParam);
+      url.searchParams.set("state", ctx.state);
+      url.searchParams.set("nonce", nonce);
+      const session = { nonce };
+      if (config.pkce) {
+        const codeVerifier = base64url(randomBytes(32));
+        const challenge = base64url(createHash("sha256").update(codeVerifier).digest());
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+        session.codeVerifier = codeVerifier;
+      }
+      return { redirectUrl: url.toString(), session };
+    },
+    async authenticate(input) {
+      const bundle = asBundle(input);
+      if (bundle.error) {
+        return { ok: false, reason: "invalid" };
+      }
+      if (!bundle.code || !bundle.redirectUri) {
+        return { ok: false, reason: "invalid" };
+      }
+      const { token_endpoint } = await discover();
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code: bundle.code,
+        redirect_uri: bundle.redirectUri,
+        client_id: config.clientId,
+        client_secret: secret
+      });
+      if (config.pkce && bundle.session?.codeVerifier) {
+        body.set("code_verifier", bundle.session.codeVerifier);
+      }
+      const tokenRes = await doFetch(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        body: body.toString()
+      });
+      if (!tokenRes.ok) {
+        throw new Error(`oidc "${config.id}": token endpoint error (${tokenRes.status})`);
+      }
+      const tokenJson = await tokenRes.json();
+      const idToken = tokenJson.id_token;
+      if (!idToken) {
+        return { ok: false, reason: "invalid" };
+      }
+      let payload;
+      try {
+        payload = await verifyIdToken(idToken);
+      } catch {
+        return { ok: false, reason: "invalid" };
+      }
+      const expectedNonce = bundle.session?.nonce;
+      if (!expectedNonce || payload.nonce !== expectedNonce) {
+        return { ok: false, reason: "invalid" };
+      }
+      const email = typeof payload.email === "string" ? payload.email : void 0;
+      if (!email) {
+        return { ok: false, reason: "invalid" };
+      }
+      const emailVerified = payload.email_verified === true;
+      if (!emailVerified && !config.allowUnverifiedEmail) {
+        return { ok: false, reason: "invalid" };
+      }
+      return {
+        ok: true,
+        email: canonicalizeEmail(email),
+        externalId: typeof payload.sub === "string" ? payload.sub : void 0
+      };
+    }
+  };
+  return provider;
+}
+
+// src/provider-registry.ts
+var ProviderRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  register(provider) {
+    if (this.providers.has(provider.id)) {
+      throw new Error(`provider-registry: id "${provider.id}" is already registered`);
+    }
+    this.providers.set(provider.id, provider);
+  }
+  get(id) {
+    return this.providers.get(id);
+  }
+  has(id) {
+    return this.providers.has(id);
+  }
+  list() {
+    return [...this.providers.values()].map((p) => ({ id: p.id, kind: p.kind }));
+  }
+};
+
+// src/provider-loader.ts
+var emailPasswordFactory = (_config, deps) => createEmailPasswordProvider({
+  users: deps.users,
+  credentials: deps.credentials,
+  tenantId: deps.tenantId,
+  bcryptCost: deps.bcryptCost
+});
+var BUILTIN_FACTORIES = {
+  "email-password": emailPasswordFactory,
+  oidc: createOidcProvider
+};
+async function resolveFactory(id, type) {
+  const builtin = BUILTIN_FACTORIES[type];
+  if (builtin) {
+    return builtin;
+  }
+  let mod;
+  try {
+    mod = await import(type);
+  } catch (err) {
+    throw new Error(
+      `identity provider "${id}": failed to load package "${type}": ${err.message}`
+    );
+  }
+  const factory = mod.createIdentityProvider ?? mod.default;
+  if (typeof factory !== "function") {
+    throw new Error(
+      `identity provider "${id}": package "${type}" exports neither createIdentityProvider nor a default factory`
+    );
+  }
+  return factory;
+}
+async function loadIdentityProviders(config, deps) {
+  const registry = new ProviderRegistry();
+  const entries = Object.entries(config ?? {});
+  if (entries.length === 0) {
+    const provider = await emailPasswordFactory(
+      { },
+      deps
+    );
+    registry.register(provider);
+    return registry;
+  }
+  for (const [id, entry] of entries) {
+    const factory = await resolveFactory(id, entry.type);
+    const provider = await factory({ ...entry, id }, deps);
+    registry.register(provider);
+  }
+  return registry;
+}
+
+// src/oauth-state-store.ts
+var DEFAULT_TTL_MS = 10 * 60 * 1e3;
+var KEY_PREFIX = "oauth:state:";
+var OAuthStateStore = class {
+  constructor(kv, opts = {}) {
+    this.kv = kv;
+    this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+  }
+  kv;
+  ttlMs;
+  key(state) {
+    return `${KEY_PREFIX}${state}`;
+  }
+  /** Persist a state record with the configured TTL. */
+  async put(state, record) {
+    await this.kv.set(this.key(state), record, { ttlMs: this.ttlMs });
+  }
+  /**
+   * One-shot read. Returns the record to the first caller and deletes it;
+   * concurrent / subsequent callers get `null`. The `delete` result gates
+   * the return so exactly one caller wins even under a shared KV.
+   */
+  async consume(state) {
+    const key = this.key(state);
+    const record = await this.kv.get(key);
+    if (!record) {
+      return null;
+    }
+    const removed = await this.kv.delete(key);
+    if (!removed) {
+      return null;
+    }
+    return record;
+  }
+};
+var ALL_PERMISSIONS = Object.freeze(Object.values(PERMISSIONS));
+var MACHINE_PERMISSIONS = Object.freeze([PERMISSIONS.MACHINE_REGISTER]);
+var GROUP_PERMISSIONS = Object.freeze({
+  "tenant-admin": ALL_PERMISSIONS,
+  "tenant-member": Object.freeze([])
+});
+var createStubPDP = (opts) => {
+  const permissionsForUser = async (identity) => {
+    const list = await opts.memberships.listByUser(identity.userId);
+    const inTenant = list.find((m) => m.tenantId === identity.tenantId);
+    if (!inTenant) {
+      return [];
+    }
+    return GROUP_PERMISSIONS[inTenant.groupId];
+  };
+  return {
+    async check(identity, action, _resource, _ctx) {
+      if (identity.type === "machine") {
+        if (MACHINE_PERMISSIONS.includes(action)) {
+          return { allow: true };
+        }
+        return { allow: true };
+      }
+      const perms = await permissionsForUser(identity);
+      if (perms.length === 0) {
+        return { allow: false, reason: "no_membership" };
+      }
+      if (!perms.includes(action)) {
+        return { allow: false, reason: "permission_denied" };
+      }
+      return { allow: true };
+    },
+    async enumeratePermissions(identity) {
+      if (identity.type === "machine") {
+        return [...MACHINE_PERMISSIONS];
+      }
+      const perms = await permissionsForUser(identity);
+      return [...perms];
+    }
+  };
+};
+var isNonEmptyString = (v) => typeof v === "string" && v.length > 0;
+var ensureBootstrapAdmin = async (opts) => {
+  const { bootstrap, users, credentials, memberships, bcryptCost, logger } = opts;
+  if (!bootstrap) {
+    logger.info("bootstrap-admin: no bootstrap config provided, skipping");
+    return;
+  }
+  if (!isNonEmptyString(bootstrap.adminEmail) || !isNonEmptyString(bootstrap.adminPassword) || !isNonEmptyString(bootstrap.tenantId)) {
+    throw new Error(
+      "bootstrap-admin: incomplete bootstrap config (need adminEmail, adminPassword, tenantId)"
+    );
+  }
+  const existing = await users.findByEmailTenant(bootstrap.adminEmail, bootstrap.tenantId);
+  if (existing) {
+    if (existing.status === "active") {
+      logger.info("bootstrap-admin: admin already exists and is active, skipping");
+      return;
+    }
+    logger.warn(
+      "bootstrap-admin: a user with the bootstrap email already exists in a non-active state; not touching it",
+      { userId: existing.userId, status: existing.status, tenantId: existing.tenantId }
+    );
+    return;
+  }
+  const userId = randomUUID();
+  await users.create({
+    userId,
+    tenantId: bootstrap.tenantId,
+    email: bootstrap.adminEmail,
+    status: "active"
+  });
+  const hash = await bcrypt.hash(bootstrap.adminPassword, bcryptCost);
+  await credentials.setCredential({
+    userId,
+    providerId: "email-password",
+    hash
+  });
+  await memberships.addMembership({
+    userId,
+    tenantId: bootstrap.tenantId,
+    groupId: "tenant-admin"
+  });
+  logger.info("bootstrap-admin: provisioned tenant-admin", {
+    userId,
+    tenantId: bootstrap.tenantId
+  });
+};
+var AuthError = class extends Error {
+  constructor(code, reason) {
+    super(code);
+    this.code = code;
+    this.reason = reason;
+  }
+  code;
+  reason;
+  name = "AuthError";
+};
+var toPublicUser = (u) => ({
+  userId: u.userId,
+  email: u.email,
+  tenantId: u.tenantId
+});
+var mapPolicyResultToError = (r) => {
+  if (r.ok) {
+    return null;
+  }
+  return new AuthError("weak_password", r.reason);
+};
+var createUserAuthService = (opts) => {
+  opts.now ?? Date.now;
+  const issueSessionTokens = async (userId, tenantId, familyId, refreshJti) => {
+    const access = await signUserAccessToken(
+      { userId, tenantId, familyId, ttlSec: opts.accessTtlSec },
+      opts.jwtConfig
+    );
+    const refresh2 = await signUserRefreshToken(
+      { userId, tenantId, familyId, ttlSec: opts.refreshTtlSec, jti: refreshJti },
+      opts.jwtConfig
+    );
+    return {
+      access: { token: access.token, expiresInSec: opts.accessTtlSec },
+      refresh: { token: refresh2, expiresInSec: opts.refreshTtlSec },
+      csrf: issueCsrfToken()
+    };
+  };
+  const login = async (input, tenantId, deviceCtx) => {
+    const provider = opts.providers.get(input.providerId);
+    if (!provider) {
+      throw new AuthError("unknown_provider");
+    }
+    const result = await provider.authenticate(input.input);
+    if (!result.ok) {
+      throw new AuthError("invalid_credentials");
+    }
+    const user = await opts.users.findByEmailTenant(canonicalizeEmail(result.email), tenantId);
+    if (!user || user.status !== "active") {
+      throw new AuthError("invalid_credentials");
+    }
+    const sess = await opts.sessions.createSession({
+      userId: user.userId,
+      tenantId,
+      deviceCtx
+    });
+    const tokens = await issueSessionTokens(user.userId, tenantId, sess.familyId, sess.refreshJti);
+    return { user: toPublicUser(user), ...tokens, familyId: sess.familyId };
+  };
+  const refresh = async (refreshToken) => {
+    const payload = await verifyUserRefreshToken(refreshToken, opts.jwtConfig);
+    if (!payload) {
+      throw new AuthError("invalid_refresh");
+    }
+    const user = await opts.users.getById(payload.userId);
+    if (!user || user.status !== "active") {
+      await opts.sessions.revokeFamily(payload.familyId);
+      throw new AuthError("user_disabled");
+    }
+    let rotated;
+    try {
+      rotated = await opts.sessions.rotateRefresh(payload.jti);
+    } catch (err) {
+      if (err instanceof RefreshReuseDetectedError) {
+        throw new AuthError("refresh_reuse");
+      }
+      if (err instanceof RefreshExpiredError) {
+        throw new AuthError("invalid_refresh");
+      }
+      if (err instanceof RefreshNotFoundError) {
+        throw new AuthError("invalid_refresh");
+      }
+      throw err;
+    }
+    const tokens = await issueSessionTokens(user.userId, user.tenantId, rotated.familyId, rotated.newJti);
+    return { user: toPublicUser(user), ...tokens, familyId: rotated.familyId };
+  };
+  const logout = async (refreshToken) => {
+    const payload = await verifyUserRefreshToken(refreshToken, opts.jwtConfig);
+    if (!payload) {
+      return;
+    }
+    await opts.sessions.revokeFamily(payload.familyId);
+  };
+  const changePassword = async (input) => {
+    const user = await opts.users.getById(input.userId);
+    if (!user || user.status !== "active") {
+      throw new AuthError("invalid_current_password");
+    }
+    const cred = await opts.credentials.getCredential(user.userId, "email-password");
+    if (!cred) {
+      throw new AuthError("invalid_current_password");
+    }
+    const ok = await bcrypt.compare(input.currentPassword, cred.hash);
+    if (!ok) {
+      throw new AuthError("invalid_current_password");
+    }
+    const policyResult = await opts.passwordPolicy.validate(input.newPassword);
+    const polErr = mapPolicyResultToError(policyResult);
+    if (polErr) {
+      throw polErr;
+    }
+    const hash = await bcrypt.hash(input.newPassword, opts.bcryptCost);
+    await opts.credentials.setCredential({
+      userId: user.userId,
+      providerId: "email-password",
+      hash
+    });
+    await opts.sessions.revokeAllUserSessionsExcept(user.userId, input.currentFamilyId);
+  };
+  const activate = async (input) => {
+    const tokenResult = await opts.invites.findByToken(input.activationToken);
+    if (tokenResult.kind === "not_found") {
+      throw new AuthError("unknown_invite");
+    }
+    if (tokenResult.kind === "invalid") {
+      throw new AuthError("invalid_invite");
+    }
+    const invite = tokenResult.invite;
+    const policyResult = await opts.passwordPolicy.validate(input.password);
+    const polErr = mapPolicyResultToError(policyResult);
+    if (polErr) {
+      throw polErr;
+    }
+    const consumed = await opts.invites.consume(invite.inviteId);
+    if (!consumed) {
+      throw new AuthError("invalid_invite");
+    }
+    const userId = randomUUID();
+    await opts.users.create({
+      userId,
+      tenantId: invite.tenantId,
+      email: invite.email,
+      status: "active"
+    });
+    const hash = await bcrypt.hash(input.password, opts.bcryptCost);
+    await opts.credentials.setCredential({
+      userId,
+      providerId: "email-password",
+      hash
+    });
+    await opts.memberships.addMembership({
+      userId,
+      tenantId: invite.tenantId,
+      groupId: invite.groupId
+    });
+    const sess = await opts.sessions.createSession({
+      userId,
+      tenantId: invite.tenantId,
+      deviceCtx: input.deviceCtx
+    });
+    const tokens = await issueSessionTokens(userId, invite.tenantId, sess.familyId, sess.refreshJti);
+    return {
+      user: { userId, email: invite.email, tenantId: invite.tenantId },
+      ...tokens,
+      familyId: sess.familyId
+    };
+  };
+  return { login, refresh, logout, changePassword, activate };
+};
+
+export { AuthError, AuthService, BUILTIN_FACTORIES, CredentialsStore, InvitesStore, MembershipsStore, OAuthStateStore, ProviderRegistry, RESERVED_SUBDOMAINS, RefreshExpiredError, RefreshNotFoundError, RefreshReuseDetectedError, SessionsStore, UsersStore, buildClientRecord, canonicalizeEmail, consumeRefreshToken, createEmailPasswordProvider, createOidcProvider, createPasswordPolicy, createRateLimiter, createStubPDP, createTenantResolver, createUserAuthService, ensureBootstrapAdmin, generateClientId, generateClientSecret, generateHostId, getClient, getClientByHandle, getClientByHostId, getPublicKey, isHandleTaken, issueCsrfToken, loadIdentityProviders, saveClient, savePublicKey, saveRefreshToken, signAccessToken, signRefreshToken, signUserAccessToken, signUserRefreshToken, verifyAccessToken, verifyClientSecret, verifyCsrfToken, verifyRefreshToken, verifyUserAccessToken, verifyUserRefreshToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map