@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/app/auth/adapters/jwtCookie.d.ts

@@ -0,0 +1,55 @@
+import type { AuthClaims, AuthenticatedAccount, AuthProvider, AuthProviderContext, AuthVerifyResult } from "../AuthProvider.js";
+import type { JwtSigner } from "../jwt/JwtSigner.js";
+/**
+ * `jwtCookieAuth` — `AuthProvider` adapter for the framework's stateless cookie
+ * auth flow (the v4.0 default for first-party clients).
+ *
+ * Plugs into the same `requireAuth({ provider })` middleware that the Firebase
+ * adapter does, so internal-only ShipAPI deployments can use cookie auth and
+ * external/partner deployments can use Firebase IdTokens (or any v4.x adapter)
+ * without changing the middleware contract.
+ *
+ * Verification flow:
+ *   1. Read the access cookie (`ship_access` by default; configurable).
+ *   2. Verify the JWS via `JwtSigner.verify()` — signature, expiry, issuer,
+ *      audience all validated, with `kid`-based key rotation supported.
+ *   3. Resolve the domain `Account` via the consumer-supplied `findAccount`
+ *      callback (mirrors `FirebaseAuthProvider`'s shape).
+ *
+ * The `claims.subject` is taken from the JWT's `sub` claim — populated by
+ * `AuthFlow.issue()` with the `accountId`. Custom claims threaded into the
+ * token via `AuthFlow.issue({ claims })` surface in `AuthClaims.metadata`.
+ */
+export interface JwtCookieAuthProviderOptions<TAccount extends AuthenticatedAccount = AuthenticatedAccount> {
+    /** The framework's `JwtSigner` (typically obtained from `AuthFlow`). */
+    signer: JwtSigner;
+    /**
+     * Resolve a domain Account from the verified JWT's claims. Mirrors
+     * `FirebaseAuthProvider.findAccount` — consumers wire this to their account
+     * lookup. Returns `null` if no account exists.
+     */
+    findAccount: (accountId: string, claims: AuthClaims) => Promise<TAccount | null>;
+    /** Override the access cookie name. Default `"ship_access"`. */
+    cookieName?: string;
+    /** Provider behavior when no cookie is present. Default `"reject"`. */
+    onMissingToken?: "reject" | "next";
+    /** Provider behavior when JWT verifies but no account resolves. Default `"reject"`. */
+    onUnknownAccount?: "reject" | "create" | "next";
+}
+export declare class JwtCookieAuthProvider<TAccount extends AuthenticatedAccount = AuthenticatedAccount> implements AuthProvider<TAccount> {
+    readonly name = "jwt-cookie";
+    readonly onMissingToken: "reject" | "next";
+    readonly onUnknownAccount: "reject" | "create" | "next";
+    private readonly signer;
+    private readonly findAccount;
+    private readonly cookieName;
+    constructor(opts: JwtCookieAuthProviderOptions<TAccount>);
+    verify(ctx: AuthProviderContext): Promise<AuthVerifyResult>;
+    resolve(claims: AuthClaims): Promise<TAccount | null>;
+}
+/**
+ * Convenience factory — matches the documented `jwtCookieAuth({ ... })` shape
+ * in §F of the plan, parallel to `firebaseAuth({ ... })`.
+ */
+export declare function jwtCookieAuth<TAccount extends AuthenticatedAccount = AuthenticatedAccount>(opts: JwtCookieAuthProviderOptions<TAccount>): JwtCookieAuthProvider<TAccount>;
+//# sourceMappingURL=jwtCookie.d.ts.map

package/lib/app/auth/adapters/jwtCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtCookie.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/adapters/jwtCookie.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,4BAA4B,CAC3C,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,wEAAwE;IACxE,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACjF,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,cAAc,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACnC,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;CACjD;AAED,qBAAa,qBAAqB,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,CAC7F,YAAW,YAAY,CAAC,QAAQ,CAAC;IAEjC,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwD;IACpF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;IAQlD,MAAM,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAyB3D,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAG5D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB,EACxF,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC,GAC3C,qBAAqB,CAAC,QAAQ,CAAC,CAEjC"}

package/lib/app/auth/adapters/jwtCookie.js

@@ -0,0 +1,120 @@
+import { AUTH_COOKIE_NAMES } from "../../../http/utils/authCookies.js";
+export class JwtCookieAuthProvider {
+    name = "jwt-cookie";
+    onMissingToken;
+    onUnknownAccount;
+    signer;
+    findAccount;
+    cookieName;
+    constructor(opts) {
+        this.signer = opts.signer;
+        this.findAccount = opts.findAccount;
+        this.cookieName = opts.cookieName ?? AUTH_COOKIE_NAMES.access;
+        this.onMissingToken = opts.onMissingToken ?? "reject";
+        this.onUnknownAccount = opts.onUnknownAccount ?? "reject";
+    }
+    async verify(ctx) {
+        const token = readCookieFromHeaders(ctx.headers, this.cookieName);
+        if (!token) {
+            return { ok: false, reason: "missing-token", message: "No access cookie on request" };
+        }
+        try {
+            const verified = await this.signer.verify(token);
+            const claims = jwtPayloadToClaims(verified.payload);
+            return { ok: true, claims };
+        }
+        catch (err) {
+            // `JwtSigner.verify` throws `AuthenticationError` with a normalized
+            // message. Map common cases back into the `AuthFailureReason` taxonomy
+            // so `requireAuth` can format consistently across providers.
+            const msg = err.message ?? "Token verification failed";
+            if (msg.includes("expired"))
+                return { ok: false, reason: "expired-token", message: msg };
+            if (msg.includes("revoked"))
+                return { ok: false, reason: "revoked-token", message: msg };
+            if (msg.includes("kid") || msg.includes("signing key")) {
+                return { ok: false, reason: "invalid-token", message: msg };
+            }
+            if (msg.includes("claim"))
+                return { ok: false, reason: "issuer-mismatch", message: msg };
+            return { ok: false, reason: "invalid-token", message: msg };
+        }
+    }
+    async resolve(claims) {
+        return this.findAccount(claims.subject, claims);
+    }
+}
+/**
+ * Convenience factory — matches the documented `jwtCookieAuth({ ... })` shape
+ * in §F of the plan, parallel to `firebaseAuth({ ... })`.
+ */
+export function jwtCookieAuth(opts) {
+    return new JwtCookieAuthProvider(opts);
+}
+function readCookieFromHeaders(headers, cookieName) {
+    const header = headers["cookie"];
+    if (!header)
+        return undefined;
+    // Minimal parser — Hono's `getCookie` does the same thing but expects a
+    // `Context`. We only have raw headers in `AuthProviderContext`, so parse
+    // here. Cookies are `name=value; name2=value2` — values may contain `=`
+    // for base64url so we split on the first `=` only.
+    const target = `${cookieName}=`;
+    for (const segment of header.split(";")) {
+        const trimmed = segment.trimStart();
+        if (trimmed.startsWith(target)) {
+            const value = trimmed.slice(target.length);
+            // Cookie values are not URL-encoded by `setCookie` for typical tokens
+            // (base64url is cookie-safe), but be defensive.
+            try {
+                return decodeURIComponent(value);
+            }
+            catch {
+                return value;
+            }
+        }
+    }
+    return undefined;
+}
+function jwtPayloadToClaims(payload) {
+    const sub = payload.sub;
+    if (typeof sub !== "string" || sub.length === 0) {
+        throw new Error("JWT missing `sub` claim — refusing to resolve account");
+    }
+    const claims = {
+        subject: sub,
+        issuedAt: typeof payload.iat === "number" ? payload.iat : undefined,
+        expiresAt: typeof payload.exp === "number" ? payload.exp : undefined,
+    };
+    if (typeof payload.email === "string")
+        claims.email = payload.email;
+    if (typeof payload.email_verified === "boolean") {
+        claims.emailVerified = payload.email_verified;
+    }
+    if (typeof payload.name === "string")
+        claims.name = payload.name;
+    // Pass through extra fields under `metadata.custom` for downstream consumers
+    // (e.g., role/tenant claims threaded by AuthFlow.issue({ claims })).
+    const standard = new Set([
+        "sub",
+        "iat",
+        "exp",
+        "iss",
+        "aud",
+        "jti",
+        "nbf",
+        "email",
+        "email_verified",
+        "name",
+    ]);
+    const custom = {};
+    for (const [key, value] of Object.entries(payload)) {
+        if (!standard.has(key))
+            custom[key] = value;
+    }
+    if (Object.keys(custom).length > 0) {
+        claims.metadata = { custom };
+    }
+    return claims;
+}
+//# sourceMappingURL=jwtCookie.js.map

package/lib/app/auth/adapters/jwtCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwtCookie.js","sourceRoot":"","sources":["../../../../src/app/auth/adapters/jwtCookie.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAkDvE,MAAM,OAAO,qBAAqB;IAGvB,IAAI,GAAG,YAAY,CAAC;IACpB,cAAc,CAAoB;IAClC,gBAAgB,CAA+B;IAEvC,MAAM,CAAY;IAClB,WAAW,CAAwD;IACnE,UAAU,CAAS;IAEpC,YAAY,IAA4C;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,MAAM,CAAC;QAC9D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC;QACtD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAwB;QACnC,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,IAAI,2BAA2B,CAAC;YAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACzF,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACzF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACzF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA4C;IAE5C,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAqD,EACrD,UAAkB;IAElB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3C,sEAAsE;YACtE,gDAAgD;YAChD,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACpE,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAEjE,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,OAAO;QACP,gBAAgB;QAChB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/lib/app/auth/index.d.ts

@@ -0,0 +1,8 @@
+export type { AccountResolver, AuthClaims, AuthenticatedAccount, AuthFailureReason, AuthProvider, AuthProviderContext, AuthVerifyResult, } from "./AuthProvider.js";
+export { type FirebaseAuthClaimsExtras, FirebaseAuthProvider, type FirebaseAuthProviderOptions, firebaseAuth, } from "./adapters/firebase.js";
+export { JwtCookieAuthProvider, type JwtCookieAuthProviderOptions, jwtCookieAuth, } from "./adapters/jwtCookie.js";
+export { AuthFlow, type AuthFlowOptions, type AuthTokenPair, type IssueAuthInput, } from "./jwt/AuthFlow.js";
+export { DrizzleRefreshTokenStore, type DrizzleRefreshTokenStoreOptions, } from "./jwt/DrizzleRefreshTokenStore.js";
+export { JwtSigner, type JwtSignerOptions, type JwtSigningKey, type JwtVerificationKey, type SignedToken, type SignTokenOptions, type VerifiedToken, } from "./jwt/JwtSigner.js";
+export { generateRefreshTokenValue, hashRefreshToken, InMemoryRefreshTokenStore, type IssueRefreshTokenInput, type RefreshTokenRecord, type RefreshTokenStore, } from "./jwt/RefreshTokenStore.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/app/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/app/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,eAAe,EACf,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,KAAK,wBAAwB,EAC7B,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,YAAY,GACb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,QAAQ,EACR,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC"}

package/lib/app/auth/index.js

@@ -0,0 +1,7 @@
+export { FirebaseAuthProvider, firebaseAuth, } from "./adapters/firebase.js";
+export { JwtCookieAuthProvider, jwtCookieAuth, } from "./adapters/jwtCookie.js";
+export { AuthFlow, } from "./jwt/AuthFlow.js";
+export { DrizzleRefreshTokenStore, } from "./jwt/DrizzleRefreshTokenStore.js";
+export { JwtSigner, } from "./jwt/JwtSigner.js";
+export { generateRefreshTokenValue, hashRefreshToken, InMemoryRefreshTokenStore, } from "./jwt/RefreshTokenStore.js";
+//# sourceMappingURL=index.js.map

package/lib/app/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/app/auth/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAEL,oBAAoB,EAEpB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,qBAAqB,EAErB,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,QAAQ,GAIT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,SAAS,GAOV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,yBAAyB,GAI1B,MAAM,4BAA4B,CAAC"}

package/lib/app/auth/jwt/AuthFlow.d.ts

@@ -0,0 +1,94 @@
+import type { JwtSigner, VerifiedToken } from "./JwtSigner.js";
+import { type RefreshTokenStore } from "./RefreshTokenStore.js";
+/**
+ * `AuthFlow` — the policy layer that ties `JwtSigner` and `RefreshTokenStore`
+ * together.
+ *
+ * Implements the framework's stateless cookie-auth flow:
+ *
+ *   • **Issue** — sign a short-lived access token and mint+persist a long-
+ *     lived opaque refresh token. The access JWT carries the account id
+ *     plus arbitrary custom claims; the refresh value is a 256-bit random
+ *     string whose SHA-256 hash is stored.
+ *   • **Verify** — decode and validate an access token via `JwtSigner`. Pure
+ *     stateless check — no DB hit.
+ *   • **Rotate** — exchange a presented refresh token for a new pair. The
+ *     old token's row is marked `replaced_by_id = newRow.id`, all in one
+ *     transaction. **Reuse detection**: if the presented token's row already
+ *     has `replacedById` set, the entire chain is revoked and the rotation
+ *     fails — strong signal of token theft.
+ *   • **Revoke** — single-token revocation (e.g., logout) and account-wide
+ *     revocation (e.g., password reset, "sign out everywhere").
+ */
+export interface AuthFlowOptions {
+    signer: JwtSigner;
+    refreshTokenStore: RefreshTokenStore;
+    /** Access-token TTL in seconds. Defaults to 15 minutes. */
+    accessTokenTtlSec?: number;
+    /** Refresh-token TTL in seconds. Defaults to 30 days. */
+    refreshTokenTtlSec?: number;
+}
+export interface IssueAuthInput {
+    /** Account ID — written to the access token's `sub` and the refresh row's `accountId`. */
+    accountId: string;
+    /** Optional custom claims on the access token. */
+    claims?: Record<string, unknown>;
+    /** Audit context — User-Agent and IP are persisted on the refresh row. */
+    userAgent?: string;
+    ip?: string;
+}
+export interface AuthTokenPair {
+    /** Compact JWS access token. */
+    accessToken: string;
+    /** Opaque refresh token (raw, base64url-encoded random bytes). */
+    refreshToken: string;
+    /** Access-token expiry (epoch seconds). */
+    accessTokenExpiresAt: number;
+    /** Refresh-token expiry (epoch seconds). */
+    refreshTokenExpiresAt: number;
+    /** Refresh row's id — useful for log correlation, never sent to clients. */
+    refreshTokenId: string;
+}
+export declare class AuthFlow {
+    private readonly signer;
+    private readonly store;
+    private readonly accessTtlSec;
+    private readonly refreshTtlSec;
+    constructor(opts: AuthFlowOptions);
+    /**
+     * Issue a fresh access+refresh pair. Used at login and at first sign-in
+     * after a successful third-party auth (e.g., OAuth callback).
+     */
+    issue(input: IssueAuthInput): Promise<AuthTokenPair>;
+    /**
+     * Verify an access token. Stateless — does not touch the refresh-token
+     * store. Throws `AuthenticationError` on signature, expiry, or claim
+     * validation failure.
+     */
+    verifyAccess(token: string): Promise<VerifiedToken>;
+    /**
+     * Exchange a presented refresh token for a new pair. **Reuse detection**:
+     * if the row is already revoked OR already has `replacedById` set, the
+     * entire chain is revoked and the call throws. This is a load-bearing
+     * security property — a stolen-and-then-original-also-presented refresh
+     * token kills the session for both attacker and legitimate user.
+     */
+    rotate(presentedRefreshToken: string, audit?: {
+        userAgent?: string;
+        ip?: string;
+    }): Promise<AuthTokenPair>;
+    /**
+     * Revoke a single refresh token. Idempotent — already-revoked tokens are
+     * a no-op. Used at logout. The call is forgiving by design: an attacker
+     * presenting an unknown token shouldn't get a different response from
+     * one presenting a valid token.
+     */
+    revoke(presentedRefreshToken: string): Promise<void>;
+    /**
+     * Revoke every active refresh token for an account. Used at password
+     * reset, "sign out everywhere", and admin-driven session termination.
+     * Returns the number of tokens revoked for log correlation.
+     */
+    revokeAccount(accountId: string): Promise<number>;
+}
+//# sourceMappingURL=AuthFlow.d.ts.map

package/lib/app/auth/jwt/AuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlow.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/jwt/AuthFlow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4CAA4C;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;CACxB;AAKD,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoB;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,IAAI,EAAE,eAAe;IAOjC;;;OAGG;IACG,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4B1D;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIzD;;;;;;OAMG;IACG,MAAM,CACV,qBAAqB,EAAE,MAAM,EAC7B,KAAK,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9C,OAAO,CAAC,aAAa,CAAC;IAqDzB;;;;;OAKG;IACG,MAAM,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1D;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGxD"}

package/lib/app/auth/jwt/AuthFlow.js

@@ -0,0 +1,127 @@
+import { AuthenticationError } from "../../../http/errors/AuthenticationError.js";
+import { generateRefreshTokenValue, hashRefreshToken, } from "./RefreshTokenStore.js";
+const DEFAULT_ACCESS_TTL_SEC = 15 * 60;
+const DEFAULT_REFRESH_TTL_SEC = 30 * 24 * 60 * 60;
+export class AuthFlow {
+    signer;
+    store;
+    accessTtlSec;
+    refreshTtlSec;
+    constructor(opts) {
+        this.signer = opts.signer;
+        this.store = opts.refreshTokenStore;
+        this.accessTtlSec = opts.accessTokenTtlSec ?? DEFAULT_ACCESS_TTL_SEC;
+        this.refreshTtlSec = opts.refreshTokenTtlSec ?? DEFAULT_REFRESH_TTL_SEC;
+    }
+    /**
+     * Issue a fresh access+refresh pair. Used at login and at first sign-in
+     * after a successful third-party auth (e.g., OAuth callback).
+     */
+    async issue(input) {
+        const access = await this.signer.sign({
+            subject: input.accountId,
+            ttlSec: this.accessTtlSec,
+            claims: input.claims,
+        });
+        const refreshRaw = generateRefreshTokenValue();
+        const refreshHash = hashRefreshToken(refreshRaw);
+        const refreshExpiresAt = new Date((Math.floor(Date.now() / 1000) + this.refreshTtlSec) * 1000);
+        const refreshRow = await this.store.issue({
+            accountId: input.accountId,
+            tokenHash: refreshHash,
+            expiresAt: refreshExpiresAt,
+            userAgent: input.userAgent,
+            issuedFromIp: input.ip,
+        });
+        return {
+            accessToken: access.token,
+            refreshToken: refreshRaw,
+            accessTokenExpiresAt: access.expiresAt,
+            refreshTokenExpiresAt: Math.floor(refreshExpiresAt.getTime() / 1000),
+            refreshTokenId: refreshRow.id,
+        };
+    }
+    /**
+     * Verify an access token. Stateless — does not touch the refresh-token
+     * store. Throws `AuthenticationError` on signature, expiry, or claim
+     * validation failure.
+     */
+    async verifyAccess(token) {
+        return this.signer.verify(token);
+    }
+    /**
+     * Exchange a presented refresh token for a new pair. **Reuse detection**:
+     * if the row is already revoked OR already has `replacedById` set, the
+     * entire chain is revoked and the call throws. This is a load-bearing
+     * security property — a stolen-and-then-original-also-presented refresh
+     * token kills the session for both attacker and legitimate user.
+     */
+    async rotate(presentedRefreshToken, audit = {}) {
+        const tokenHash = hashRefreshToken(presentedRefreshToken);
+        const row = await this.store.findByHash(tokenHash);
+        if (!row) {
+            throw new AuthenticationError("Refresh token invalid");
+        }
+        if (row.revokedAt) {
+            // Revoked tokens that get re-presented are a theft signal too — kill the chain.
+            await this.store.revokeChain(row.id);
+            throw new AuthenticationError("Refresh token revoked");
+        }
+        if (row.replacedById) {
+            // The strongest reuse signal: the legitimate user already rotated this
+            // token, but someone (legitimate or attacker) re-presented the old value.
+            // Either way, kill the session.
+            await this.store.revokeChain(row.id);
+            throw new AuthenticationError("Refresh token reuse detected — session revoked");
+        }
+        if (row.expiresAt.getTime() <= Date.now()) {
+            throw new AuthenticationError("Refresh token expired");
+        }
+        // Mint the successor.
+        const newAccess = await this.signer.sign({
+            subject: row.accountId,
+            ttlSec: this.accessTtlSec,
+        });
+        const newRefreshRaw = generateRefreshTokenValue();
+        const newRefreshHash = hashRefreshToken(newRefreshRaw);
+        const newRefreshExpiresAt = new Date((Math.floor(Date.now() / 1000) + this.refreshTtlSec) * 1000);
+        const newRow = await this.store.rotate(row.id, {
+            accountId: row.accountId,
+            tokenHash: newRefreshHash,
+            expiresAt: newRefreshExpiresAt,
+            userAgent: audit.userAgent,
+            issuedFromIp: audit.ip,
+        });
+        return {
+            accessToken: newAccess.token,
+            refreshToken: newRefreshRaw,
+            accessTokenExpiresAt: newAccess.expiresAt,
+            refreshTokenExpiresAt: Math.floor(newRefreshExpiresAt.getTime() / 1000),
+            refreshTokenId: newRow.id,
+        };
+    }
+    /**
+     * Revoke a single refresh token. Idempotent — already-revoked tokens are
+     * a no-op. Used at logout. The call is forgiving by design: an attacker
+     * presenting an unknown token shouldn't get a different response from
+     * one presenting a valid token.
+     */
+    async revoke(presentedRefreshToken) {
+        const tokenHash = hashRefreshToken(presentedRefreshToken);
+        const row = await this.store.findByHash(tokenHash);
+        if (!row)
+            return;
+        if (row.revokedAt)
+            return;
+        await this.store.revoke(row.id);
+    }
+    /**
+     * Revoke every active refresh token for an account. Used at password
+     * reset, "sign out everywhere", and admin-driven session termination.
+     * Returns the number of tokens revoked for log correlation.
+     */
+    async revokeAccount(accountId) {
+        return this.store.revokeAllForAccount(accountId);
+    }
+}
+//# sourceMappingURL=AuthFlow.js.map

package/lib/app/auth/jwt/AuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthFlow.js","sourceRoot":"","sources":["../../../../src/app/auth/jwt/AuthFlow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAuDhC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AACvC,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAElD,MAAM,OAAO,QAAQ;IACF,MAAM,CAAY;IAClB,KAAK,CAAoB;IACzB,YAAY,CAAS;IACrB,aAAa,CAAS;IAEvC,YAAY,IAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,uBAAuB,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,KAAqB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,SAAS;YACxB,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,yBAAyB,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC;QAE/F,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,EAAE;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,YAAY,EAAE,UAAU;YACxB,oBAAoB,EAAE,MAAM,CAAC,SAAS;YACtC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACpE,cAAc,EAAE,UAAU,CAAC,EAAE;SAC9B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,qBAA6B,EAC7B,QAA6C,EAAE;QAE/C,MAAM,SAAS,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,gFAAgF;YAChF,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,uEAAuE;YACvE,0EAA0E;YAC1E,gCAAgC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,IAAI,mBAAmB,CAAC,gDAAgD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,sBAAsB;QACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACvC,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,IAAI,IAAI,CAClC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAC5D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;YAC7C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,mBAAmB;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,EAAE;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,KAAK;YAC5B,YAAY,EAAE,aAAa;YAC3B,oBAAoB,EAAE,SAAS,CAAC,SAAS;YACzC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YACvE,cAAc,EAAE,MAAM,CAAC,EAAE;SAC1B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,qBAA6B;QACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF"}

package/lib/app/auth/jwt/DrizzleRefreshTokenStore.d.ts

@@ -0,0 +1,80 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { PgTable } from "drizzle-orm/pg-core";
+import type { IssueRefreshTokenInput, RefreshTokenRecord, RefreshTokenStore } from "./RefreshTokenStore.js";
+/**
+ * `DrizzleRefreshTokenStore` — Postgres-backed implementation of the refresh-
+ * token rotation contract.
+ *
+ * Works against any `refresh_tokens`-shaped table (the reference table lives in
+ * `modules/accounts/schema.ts`). Pulls the table reference in via the
+ * constructor so consumers who customize the schema (extending columns,
+ * renaming, multi-tenancy) can pass their own table without forking this class.
+ *
+ * `revokeChain()` uses a single recursive CTE that walks both directions
+ * (ancestors via `replaced_by_id` lookups, descendants via the same column
+ * forward) so reuse-detection completes in one round-trip even on long
+ * chains. The CTE is marked stable for query planning.
+ */
+/**
+ * Structural shape of the `refresh_tokens` table the store relies on. Kept
+ * narrow on purpose — consumers can extend the table with extra columns and
+ * still satisfy this contract.
+ */
+export interface RefreshTokensTable {
+    id: unknown;
+    accountId: unknown;
+    tokenHash: unknown;
+    expiresAt: unknown;
+    revokedAt: unknown;
+    replacedById: unknown;
+    userAgent: unknown;
+    issuedFromIp: unknown;
+}
+type RefreshTokensPgTable = PgTable & {
+    id: {
+        name: string;
+    };
+    accountId: {
+        name: string;
+    };
+    tokenHash: {
+        name: string;
+    };
+    expiresAt: {
+        name: string;
+    };
+    revokedAt: {
+        name: string;
+    };
+    replacedById: {
+        name: string;
+    };
+    userAgent: {
+        name: string;
+    };
+    issuedFromIp: {
+        name: string;
+    };
+};
+export interface DrizzleRefreshTokenStoreOptions<TSchema extends Record<string, unknown>> {
+    db: NodePgDatabase<TSchema>;
+    /**
+     * Reference to the `refresh_tokens` table — e.g. the one exported from your
+     * accounts module (`modules/accounts/schema.ts`). Must satisfy the structural
+     * columns above.
+     */
+    table: RefreshTokensPgTable;
+}
+export declare class DrizzleRefreshTokenStore<TSchema extends Record<string, unknown>> implements RefreshTokenStore {
+    private readonly db;
+    private readonly table;
+    constructor(opts: DrizzleRefreshTokenStoreOptions<TSchema>);
+    issue(input: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    findByHash(tokenHash: string): Promise<RefreshTokenRecord | null>;
+    rotate(oldId: string, newToken: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    revoke(id: string): Promise<void>;
+    revokeChain(id: string): Promise<number>;
+    revokeAllForAccount(accountId: string): Promise<number>;
+}
+export {};
+//# sourceMappingURL=DrizzleRefreshTokenStore.d.ts.map

package/lib/app/auth/jwt/DrizzleRefreshTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DrizzleRefreshTokenStore.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/jwt/DrizzleRefreshTokenStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AAEH;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,KAAK,oBAAoB,GAAG,OAAO,GAAG;IACpC,EAAE,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5B,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChC,CAAC;AAaF,MAAM,WAAW,+BAA+B,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtF,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5B;;;;OAIG;IACH,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED,qBAAa,wBAAwB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAC3E,YAAW,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;gBAEjC,IAAI,EAAE,+BAA+B,CAAC,OAAO,CAAC;IAKpD,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAcjE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAUjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuBpF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BxC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAiB9D"}