@sixthsummit/ship-api 0.0.0-stage → 4.1.1

package/lib/app/auth/jwt/DrizzleRefreshTokenStore.js

@@ -0,0 +1,134 @@
+import { and, eq, isNull, or, sql } from "drizzle-orm";
+import { withTransaction } from "../../db/transaction.js";
+export class DrizzleRefreshTokenStore {
+    db;
+    table;
+    constructor(opts) {
+        this.db = opts.db;
+        this.table = opts.table;
+    }
+    async issue(input) {
+        const [row] = await this.db
+            .insert(this.table)
+            .values({
+            accountId: input.accountId,
+            tokenHash: input.tokenHash,
+            expiresAt: input.expiresAt,
+            userAgent: input.userAgent ?? null,
+            issuedFromIp: input.issuedFromIp ?? null,
+        })
+            .returning();
+        return rowToRecord(row);
+    }
+    async findByHash(tokenHash) {
+        const rows = await this.db
+            .select()
+            .from(this.table)
+            .where(eq(this.table.tokenHash, tokenHash))
+            .limit(1);
+        if (!rows.length)
+            return null;
+        return rowToRecord(rows[0]);
+    }
+    async rotate(oldId, newToken) {
+        return withTransaction(this.db, async (tx) => {
+            const [inserted] = await tx
+                .insert(this.table)
+                .values({
+                accountId: newToken.accountId,
+                tokenHash: newToken.tokenHash,
+                expiresAt: newToken.expiresAt,
+                userAgent: newToken.userAgent ?? null,
+                issuedFromIp: newToken.issuedFromIp ?? null,
+            })
+                .returning();
+            const row = inserted;
+            await tx
+                .update(this.table)
+                .set({ replacedById: row.id })
+                .where(eq(this.table.id, oldId));
+            return rowToRecord(row);
+        });
+    }
+    async revoke(id) {
+        await this.db
+            .update(this.table)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(this.table.id, id), isNull(this.table.revokedAt)));
+    }
+    async revokeChain(id) {
+        // Single-shot: a recursive CTE collects every ancestor + descendant
+        // reachable from `id`, then a single UPDATE flips them all to revoked.
+        // Stable across Postgres ≥12.
+        const tableName = sql.identifier(getTableName(this.table));
+        const result = await this.db.execute(sql `
+      WITH RECURSIVE forward AS (
+        SELECT id, replaced_by_id FROM ${tableName} WHERE id = ${id}
+        UNION ALL
+        SELECT t.id, t.replaced_by_id
+        FROM ${tableName} t
+        JOIN forward f ON t.id = f.replaced_by_id
+      ),
+      backward AS (
+        SELECT id, replaced_by_id FROM ${tableName} WHERE id = ${id}
+        UNION ALL
+        SELECT t.id, t.replaced_by_id
+        FROM ${tableName} t
+        JOIN backward b ON t.replaced_by_id = b.id
+      ),
+      chain AS (
+        SELECT id FROM forward UNION SELECT id FROM backward
+      )
+      UPDATE ${tableName} SET revoked_at = NOW()
+      WHERE id IN (SELECT id FROM chain) AND revoked_at IS NULL
+      RETURNING id
+    `);
+        return readRowCount(result);
+    }
+    async revokeAllForAccount(accountId) {
+        const result = await this.db
+            .update(this.table)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(this.table.accountId, accountId), or(isNull(this.table.revokedAt), 
+        // No-op clause keeps the predicate non-empty if `or` collapses.
+        sql `false`)))
+            .returning({ id: this.table.id });
+        return result.length;
+    }
+}
+function rowToRecord(row) {
+    return {
+        id: row.id,
+        accountId: row.accountId,
+        tokenHash: row.tokenHash,
+        expiresAt: row.expiresAt,
+        revokedAt: row.revokedAt,
+        replacedById: row.replacedById,
+        userAgent: row.userAgent,
+        issuedFromIp: row.issuedFromIp,
+    };
+}
+function getTableName(table) {
+    // Drizzle exposes table metadata via the `Symbol.for('drizzle:Name')` slot.
+    // Falls back to the inline name for forward-compat with future Drizzle
+    // versions that may shift the symbol.
+    const sym = Object.getOwnPropertySymbols(table).find((s) => s.description?.includes("drizzle") || s.description?.includes("Name"));
+    if (sym) {
+        const value = table[sym];
+        if (typeof value === "string")
+            return value;
+    }
+    // Last resort — every PgTable carries a stringifiable identifier.
+    return String(table._?.name ?? "refresh_tokens");
+}
+function readRowCount(result) {
+    // node-postgres returns `{ rows, rowCount, ... }`; Drizzle's `execute`
+    // forwards that shape. Guard for shape drift across drivers.
+    const r = result;
+    if (typeof r.rowCount === "number")
+        return r.rowCount;
+    if (Array.isArray(r.rows))
+        return r.rows.length;
+    return 0;
+}
+//# sourceMappingURL=DrizzleRefreshTokenStore.js.map

package/lib/app/auth/jwt/DrizzleRefreshTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DrizzleRefreshTokenStore.js","sourceRoot":"","sources":["../../../../src/app/auth/jwt/DrizzleRefreshTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAsE1D,MAAM,OAAO,wBAAwB;IAGlB,EAAE,CAA0B;IAC5B,KAAK,CAAuB;IAE7C,YAAY,IAA8C;QACxD,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA6B;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAClB,MAAM,CAAC;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;SAChC,CAAC;aACV,SAAS,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,GAAiC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAkB,EAAE,SAAS,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgC;QAC1D,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;iBAClB,MAAM,CAAC;gBACN,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;gBACrC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,IAAI;aACnC,CAAC;iBACV,SAAS,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,QAAsC,CAAC;YAEnD,MAAM,EAAE;iBACL,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;iBAClB,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,EAAW,CAAC;iBACtC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAW,EAAE,KAAK,CAAC,CAAC,CAAC;YAE5C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAW,CAAC;aACvC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAW,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAkB,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,oEAAoE;QACpE,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;yCAEH,SAAS,eAAe,EAAE;;;eAGpD,SAAS;;;;yCAIiB,SAAS,eAAe,EAAE;;;eAGpD,SAAS;;;;;;eAMT,SAAS;;;KAGnB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAW,CAAC;aACvC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAkB,EAAE,SAAS,CAAC,EAC5C,EAAE,CACA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAkB,CAAC;QACrC,gEAAgE;QAChE,GAAG,CAAA,OAAO,CACX,CACF,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAW,EAAE,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAoB;IACvC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,YAAY,EAAE,GAAG,CAAC,YAAY;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,4EAA4E;IAC5E,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC7E,CAAC;IACF,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAI,KAA4C,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,kEAAkE;IAClE,OAAO,MAAM,CAAE,KAAkC,CAAC,CAAC,EAAE,IAAI,IAAI,gBAAgB,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACnC,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,MAAiD,CAAC;IAC5D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/lib/app/auth/jwt/JwtSigner.d.ts

@@ -0,0 +1,123 @@
+import { type CryptoKey, type JWTPayload } from "jose";
+/**
+ * `JwtSigner` — ES256 JWT signing/verification with `kid`-based key rotation.
+ *
+ * Wraps `jose@^6` for the framework's stateless cookie-auth flow. Owned by
+ * `AuthFlow` (which combines this with `RefreshTokenStore` to handle issue /
+ * rotate / revoke). Lives at this level because:
+ *
+ *   1. **Key rotation is a load-bearing security primitive.** A signer that
+ *      can verify with multiple public keys lets operators add a new key,
+ *      cut signing over to it, wait for max-token-lifetime, then retire the
+ *      old key — without forcing every active session to re-authenticate.
+ *      The rotation procedure is documented in `.cursor/rules/security.mdc`.
+ *
+ *   2. **Edge-runtime parity.** `CryptoKey` (Web Crypto) is portable between
+ *      Node, Cloudflare Workers, and Bun, so v4.x edge adapters reuse this
+ *      class without a runtime fork.
+ *
+ *   3. **Pluggable adapter boundary.** `AuthFlow` owns persistence (refresh
+ *      token store) and HTTP (cookies); `JwtSigner` owns *only* the JWS step.
+ *      Easier to test, easier to swap (e.g., HSM-backed signer in v4.x).
+ *
+ * The single signing key (`signingKey.kid`) is the active key; tokens carry
+ * the `kid` in their protected header. Verification looks the `kid` up in the
+ * `verificationKeys` map, which always includes the active signing key plus
+ * any retiring keys still inside their max-lifetime grace window.
+ */
+export interface JwtSigningKey {
+    /** Key identifier — propagated into the token's `kid` header. */
+    kid: string;
+    /** Web Crypto private key for ES256. Use jose's `importPKCS8(pem, 'ES256')`. */
+    privateKey: CryptoKey;
+}
+export interface JwtVerificationKey {
+    kid: string;
+    /** Web Crypto public key for ES256. Use jose's `importSPKI(pem, 'ES256')`. */
+    publicKey: CryptoKey;
+}
+export interface JwtSignerOptions {
+    /** Active signing key. Tokens are issued with `protectedHeader.kid = signingKey.kid`. */
+    signingKey: JwtSigningKey;
+    /**
+     * All public keys currently accepted at verification time. MUST include
+     * `signingKey`'s public counterpart and any retiring keys within their
+     * grace window. Empty arrays are rejected at construction.
+     */
+    verificationKeys: JwtVerificationKey[];
+    /** Default `iss` claim on signed tokens; verified at decode time. */
+    issuer?: string;
+    /** Default `aud` claim on signed tokens; verified at decode time. */
+    audience?: string;
+    /**
+     * Clock-skew tolerance for `exp`/`nbf`/`iat` validation in seconds.
+     *
+     * **Default 30** — the industry-standard tolerance per NIST SP
+     * 800-63B §5.1.1.2. Tight enough to defend against meaningful
+     * replay (the access-token TTL is the dominant window) and broad
+     * enough to survive the ~1–5 s NTP drift typical between hosts
+     * with healthy clock-sync. A 0 default produced flaky 401s in
+     * mixed environments and pushed adopters toward minutes-long
+     * tolerances that weakened the contract further than necessary.
+     *
+     * Explicit `clockToleranceSec: 0` reproduces the prior strict
+     * behavior for callers who genuinely want zero slack.
+     */
+    clockToleranceSec?: number;
+}
+export interface SignTokenOptions {
+    /** Subject (`sub`) — typically the Account ID. */
+    subject: string;
+    /** TTL in seconds. Required to force callers to make an explicit decision. */
+    ttlSec: number;
+    /** Optional explicit `jti`. Auto-generated as a UUIDv4 when omitted. */
+    jti?: string;
+    /** Optional override of the construction-time `iss`. */
+    issuer?: string;
+    /** Optional override of the construction-time `aud`. */
+    audience?: string;
+    /** Custom claims merged into the JWT payload. Avoid colliding with reserved names. */
+    claims?: Record<string, unknown>;
+}
+export interface SignedToken {
+    /** Compact JWS string (`xxxx.yyyy.zzzz`). */
+    token: string;
+    /** UUID issued for this token; persisted by `AuthFlow` for refresh-token revocation. */
+    jti: string;
+    /** Epoch seconds at issue time. */
+    issuedAt: number;
+    /** Epoch seconds at expiry. */
+    expiresAt: number;
+    /** Key id used to sign — useful for log correlation during rotation. */
+    kid: string;
+}
+export interface VerifiedToken<TClaims extends JWTPayload = JWTPayload> {
+    payload: TClaims;
+    kid: string;
+}
+export declare class JwtSigner {
+    private readonly signingKey;
+    private readonly verificationKeysByKid;
+    private readonly issuer?;
+    private readonly audience?;
+    private readonly clockToleranceSec;
+    constructor(opts: JwtSignerOptions);
+    /**
+     * Sign a token. The caller is responsible for choosing `ttlSec` (e.g., 15m
+     * for access tokens, 30d for refresh tokens). Returns the compact JWS plus
+     * metadata `AuthFlow` needs to persist a `refresh_tokens` row.
+     */
+    sign(opts: SignTokenOptions): Promise<SignedToken>;
+    /**
+     * Verify a token. Throws `AuthenticationError` on any failure — caller
+     * surfaces this through the framework's standard error path. Signature,
+     * expiry, and (when configured) issuer/audience are all enforced.
+     */
+    verify<TClaims extends JWTPayload = JWTPayload>(token: string): Promise<VerifiedToken<TClaims>>;
+    /** Expose the active signing kid for log/metric correlation. */
+    getSigningKid(): string;
+    /** Expose the kids currently accepted at verification — useful for `/dev/routes`-style introspection. */
+    getVerificationKids(): string[];
+    private resolveKey;
+}
+//# sourceMappingURL=JwtSigner.d.ts.map

package/lib/app/auth/jwt/JwtSigner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtSigner.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/jwt/JwtSigner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAA4C,MAAM,MAAM,CAAC;AAGjG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,UAAU,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,UAAU,EAAE,aAAa,CAAC;IAC1B;;;;OAIG;IACH,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,wFAAwF;IACxF,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa,CAAC,OAAO,SAAS,UAAU,GAAG,UAAU;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAID,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAyB;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,IAAI,EAAE,gBAAgB;IAsBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;IAsBxD;;;;OAIG;IACG,MAAM,CAAC,OAAO,SAAS,UAAU,GAAG,UAAU,EAClD,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAelC,gEAAgE;IAChE,aAAa,IAAI,MAAM;IAIvB,yGAAyG;IACzG,mBAAmB,IAAI,MAAM,EAAE;IAI/B,OAAO,CAAC,UAAU;CAYnB"}

package/lib/app/auth/jwt/JwtSigner.js

@@ -0,0 +1,118 @@
+import { randomUUID } from "node:crypto";
+import { errors as joseErrors, jwtVerify, SignJWT } from "jose";
+import { AuthenticationError } from "../../../http/errors/AuthenticationError.js";
+const ALG = "ES256";
+export class JwtSigner {
+    signingKey;
+    verificationKeysByKid;
+    issuer;
+    audience;
+    clockToleranceSec;
+    constructor(opts) {
+        if (!opts.verificationKeys.length) {
+            throw new Error("JwtSigner: verificationKeys must contain at least one key");
+        }
+        this.signingKey = opts.signingKey;
+        this.verificationKeysByKid = new Map();
+        for (const key of opts.verificationKeys) {
+            if (this.verificationKeysByKid.has(key.kid)) {
+                throw new Error(`JwtSigner: duplicate verification key kid "${key.kid}"`);
+            }
+            this.verificationKeysByKid.set(key.kid, key.publicKey);
+        }
+        if (!this.verificationKeysByKid.has(opts.signingKey.kid)) {
+            throw new Error(`JwtSigner: signing key kid "${opts.signingKey.kid}" missing from verificationKeys`);
+        }
+        this.issuer = opts.issuer;
+        this.audience = opts.audience;
+        this.clockToleranceSec = opts.clockToleranceSec ?? 30;
+    }
+    /**
+     * Sign a token. The caller is responsible for choosing `ttlSec` (e.g., 15m
+     * for access tokens, 30d for refresh tokens). Returns the compact JWS plus
+     * metadata `AuthFlow` needs to persist a `refresh_tokens` row.
+     */
+    async sign(opts) {
+        const jti = opts.jti ?? randomUUID();
+        const issuedAt = Math.floor(Date.now() / 1000);
+        const expiresAt = issuedAt + opts.ttlSec;
+        const builder = new SignJWT({ ...(opts.claims ?? {}) })
+            .setProtectedHeader({ alg: ALG, kid: this.signingKey.kid })
+            .setSubject(opts.subject)
+            .setJti(jti)
+            .setIssuedAt(issuedAt)
+            .setExpirationTime(expiresAt);
+        const issuer = opts.issuer ?? this.issuer;
+        if (issuer)
+            builder.setIssuer(issuer);
+        const audience = opts.audience ?? this.audience;
+        if (audience)
+            builder.setAudience(audience);
+        const token = await builder.sign(this.signingKey.privateKey);
+        return { token, jti, issuedAt, expiresAt, kid: this.signingKey.kid };
+    }
+    /**
+     * Verify a token. Throws `AuthenticationError` on any failure — caller
+     * surfaces this through the framework's standard error path. Signature,
+     * expiry, and (when configured) issuer/audience are all enforced.
+     */
+    async verify(token) {
+        try {
+            const result = await jwtVerify(token, (header) => this.resolveKey(header.kid), {
+                algorithms: [ALG],
+                issuer: this.issuer,
+                audience: this.audience,
+                clockTolerance: this.clockToleranceSec,
+            });
+            const kid = result.protectedHeader.kid ?? this.signingKey.kid;
+            return { payload: result.payload, kid };
+        }
+        catch (err) {
+            throw classifyVerificationError(err);
+        }
+    }
+    /** Expose the active signing kid for log/metric correlation. */
+    getSigningKid() {
+        return this.signingKey.kid;
+    }
+    /** Expose the kids currently accepted at verification — useful for `/dev/routes`-style introspection. */
+    getVerificationKids() {
+        return [...this.verificationKeysByKid.keys()];
+    }
+    resolveKey(kid) {
+        if (!kid) {
+            // We always sign with a `kid` header, so an unsigned token is a forgery
+            // attempt against this verifier.
+            throw new joseErrors.JWSInvalid("Token missing kid header");
+        }
+        const key = this.verificationKeysByKid.get(kid);
+        if (!key) {
+            throw new joseErrors.JWKSNoMatchingKey();
+        }
+        return key;
+    }
+}
+function classifyVerificationError(err) {
+    if (err instanceof joseErrors.JWTExpired) {
+        return new AuthenticationError("Token expired");
+    }
+    if (err instanceof joseErrors.JWTClaimValidationFailed) {
+        return new AuthenticationError(`Token claim invalid: ${err.claim}`);
+    }
+    if (err instanceof joseErrors.JWKSNoMatchingKey) {
+        return new AuthenticationError("Token signing key not recognized");
+    }
+    if (err instanceof joseErrors.JWSInvalid) {
+        // Forwards messages like "Token missing kid header" set in `resolveKey`.
+        return new AuthenticationError(err.message || "Token signature invalid");
+    }
+    if (err instanceof joseErrors.JOSEError) {
+        return new AuthenticationError("Token verification failed");
+    }
+    // Unknown/unexpected — surface as generic auth failure but preserve cause
+    // so OTel/pino can capture the stack.
+    const auth = new AuthenticationError("Token verification failed");
+    auth.cause = err;
+    return auth;
+}
+//# sourceMappingURL=JwtSigner.js.map

package/lib/app/auth/jwt/JwtSigner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtSigner.js","sourceRoot":"","sources":["../../../../src/app/auth/jwt/JwtSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAmC,MAAM,IAAI,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAyGlF,MAAM,GAAG,GAAG,OAAgB,CAAC;AAE7B,MAAM,OAAO,SAAS;IACH,UAAU,CAAgB;IAC1B,qBAAqB,CAAyB;IAC9C,MAAM,CAAU;IAChB,QAAQ,CAAU;IAClB,iBAAiB,CAAS;IAE3C,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,UAAU,CAAC,GAAG,iCAAiC,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,IAAsB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAEzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;aACpD,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;aAC1D,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;aACxB,MAAM,CAAC,GAAG,CAAC;aACX,WAAW,CAAC,QAAQ,CAAC;aACrB,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE7D,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CACV,KAAa;QAEb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAU,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;gBACtF,UAAU,EAAE,CAAC,GAAG,CAAC;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB;aACvC,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;IAC7B,CAAC;IAED,yGAAyG;IACzG,mBAAmB;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,UAAU,CAAC,GAAuB;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,wEAAwE;YACxE,iCAAiC;YACjC,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,GAAG,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACvD,OAAO,IAAI,mBAAmB,CAAC,wBAAwB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAChD,OAAO,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QACzC,yEAAyE;QACzE,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,OAAO,IAAI,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,YAAY,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;IAC9D,CAAC;IACD,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;IACjE,IAAoC,CAAC,KAAK,GAAG,GAAG,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/app/auth/jwt/RefreshTokenStore.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `RefreshTokenStore` — abstract persistence for refresh-token rotation.
+ *
+ * The auth flow stores a SHA-256 *hash* of every issued refresh token. The
+ * raw token leaves the server only once (in the response cookie); subsequent
+ * requests recompute the hash and look up the row. This means even a full
+ * database compromise does not let an attacker mint or replay refresh tokens
+ * — they would still need the raw cookie value.
+ *
+ * Reuse detection is the load-bearing security property: when a refresh
+ * token is consumed (`consume()`), the row's `replacedById` is set to the
+ * successor's ID. If a token is presented whose row already has
+ * `replacedById` set, it has been used before — a strong signal of theft.
+ * The auth flow's response is to revoke the entire chain (`revokeChain()`)
+ * so neither the legitimate user nor the attacker can keep refreshing.
+ */
+/**
+ * Stored representation of a refresh token. Implementations may add fields,
+ * but the framework only depends on these.
+ */
+export interface RefreshTokenRecord {
+    id: string;
+    accountId: string;
+    /** SHA-256 hex digest of the raw token. Never stores the raw token itself. */
+    tokenHash: string;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    /** Successor's ID when this token has been rotated; null otherwise. */
+    replacedById: string | null;
+    userAgent?: string | null;
+    issuedFromIp?: string | null;
+}
+export interface IssueRefreshTokenInput {
+    accountId: string;
+    /** Pre-computed SHA-256 hex digest. Computed by the auth flow. */
+    tokenHash: string;
+    expiresAt: Date;
+    userAgent?: string;
+    issuedFromIp?: string;
+}
+export interface RefreshTokenStore {
+    /** Persist a newly minted refresh token. Returns the stored record's ID. */
+    issue(input: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    /** Look up a token by its hash. Returns `null` if absent. */
+    findByHash(tokenHash: string): Promise<RefreshTokenRecord | null>;
+    /**
+     * Atomically rotate: mark the old row's `replacedById` and persist the
+     * new row. Implementations MUST do this in a single transaction so a
+     * crash between the two writes can't lose the link.
+     */
+    rotate(oldId: string, newToken: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    /** Mark a single token revoked (e.g., on logout). */
+    revoke(id: string): Promise<void>;
+    /**
+     * Revoke an entire rotation chain — every ancestor and every descendant.
+     * Triggered on reuse detection (a strong signal of stolen tokens).
+     */
+    revokeChain(id: string): Promise<number>;
+    /**
+     * Revoke every active token for an account — e.g., on password reset or
+     * "sign out everywhere". Returns the number of rows revoked.
+     */
+    revokeAllForAccount(accountId: string): Promise<number>;
+}
+/**
+ * Compute the SHA-256 digest of a raw refresh token. Hex-encoded so it fits
+ * the `varchar(128)` column on `refresh_tokens.token_hash` exactly.
+ */
+export declare function hashRefreshToken(rawToken: string): string;
+/**
+ * Generate a cryptographically random refresh-token string. 32 random bytes
+ * (256 bits) base64url-encoded — opaque to clients, indistinguishable from
+ * a UUID. Not a JWT: refresh tokens have no payload of their own; the row
+ * in `refresh_tokens` carries all the metadata.
+ */
+export declare function generateRefreshTokenValue(): string;
+/**
+ * In-memory implementation for tests and dev. Implementations MUST keep the
+ * full chain reachable so `revokeChain` can walk both directions.
+ */
+export declare class InMemoryRefreshTokenStore implements RefreshTokenStore {
+    private byId;
+    private byHash;
+    private idCounter;
+    issue(input: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    findByHash(tokenHash: string): Promise<RefreshTokenRecord | null>;
+    rotate(oldId: string, newToken: IssueRefreshTokenInput): Promise<RefreshTokenRecord>;
+    revoke(id: string): Promise<void>;
+    revokeChain(id: string): Promise<number>;
+    revokeAllForAccount(accountId: string): Promise<number>;
+    /** Test helper. */
+    size(): number;
+    /** Test helper. */
+    clear(): void;
+    private nextId;
+}
+//# sourceMappingURL=RefreshTokenStore.d.ts.map

package/lib/app/auth/jwt/RefreshTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/jwt/RefreshTokenStore.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,uEAAuE;IACvE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAElE,6DAA6D;IAC7D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAElE;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAErF,qDAAqD;IACrD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;OAGG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEzC;;;OAGG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;GAGG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,IAAI,CAAyC;IACrD,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,SAAS,CAAK;IAEhB,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBjE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMjE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQpF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAqCxC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW7D,mBAAmB;IACnB,IAAI,IAAI,MAAM;IAId,mBAAmB;IACnB,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,MAAM;CAIf"}

package/lib/app/auth/jwt/RefreshTokenStore.js

@@ -0,0 +1,122 @@
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * Compute the SHA-256 digest of a raw refresh token. Hex-encoded so it fits
+ * the `varchar(128)` column on `refresh_tokens.token_hash` exactly.
+ */
+export function hashRefreshToken(rawToken) {
+    return createHash("sha256").update(rawToken).digest("hex");
+}
+/**
+ * Generate a cryptographically random refresh-token string. 32 random bytes
+ * (256 bits) base64url-encoded — opaque to clients, indistinguishable from
+ * a UUID. Not a JWT: refresh tokens have no payload of their own; the row
+ * in `refresh_tokens` carries all the metadata.
+ */
+export function generateRefreshTokenValue() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * In-memory implementation for tests and dev. Implementations MUST keep the
+ * full chain reachable so `revokeChain` can walk both directions.
+ */
+export class InMemoryRefreshTokenStore {
+    byId = new Map();
+    byHash = new Map();
+    idCounter = 0;
+    async issue(input) {
+        const id = this.nextId();
+        const record = {
+            id,
+            accountId: input.accountId,
+            tokenHash: input.tokenHash,
+            expiresAt: input.expiresAt,
+            revokedAt: null,
+            replacedById: null,
+            userAgent: input.userAgent ?? null,
+            issuedFromIp: input.issuedFromIp ?? null,
+        };
+        this.byId.set(id, record);
+        this.byHash.set(input.tokenHash, id);
+        return record;
+    }
+    async findByHash(tokenHash) {
+        const id = this.byHash.get(tokenHash);
+        if (!id)
+            return null;
+        return this.byId.get(id) ?? null;
+    }
+    async rotate(oldId, newToken) {
+        const old = this.byId.get(oldId);
+        if (!old)
+            throw new Error(`RefreshTokenStore: cannot rotate unknown id ${oldId}`);
+        const newRecord = await this.issue(newToken);
+        old.replacedById = newRecord.id;
+        return newRecord;
+    }
+    async revoke(id) {
+        const row = this.byId.get(id);
+        if (!row)
+            return;
+        if (!row.revokedAt)
+            row.revokedAt = new Date();
+    }
+    async revokeChain(id) {
+        const visited = new Set();
+        let count = 0;
+        // Walk forward via replacedById.
+        let cursor = id;
+        while (cursor && !visited.has(cursor)) {
+            visited.add(cursor);
+            const row = this.byId.get(cursor);
+            if (!row)
+                break;
+            if (!row.revokedAt) {
+                row.revokedAt = new Date();
+                count += 1;
+            }
+            cursor = row.replacedById;
+        }
+        // Walk backward by scanning for predecessors. Cheap on small in-memory
+        // sets; the Drizzle implementation does it with a recursive CTE.
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const row of this.byId.values()) {
+                if (row.replacedById && visited.has(row.replacedById) && !visited.has(row.id)) {
+                    visited.add(row.id);
+                    if (!row.revokedAt) {
+                        row.revokedAt = new Date();
+                        count += 1;
+                    }
+                    changed = true;
+                }
+            }
+        }
+        return count;
+    }
+    async revokeAllForAccount(accountId) {
+        let count = 0;
+        for (const row of this.byId.values()) {
+            if (row.accountId === accountId && !row.revokedAt) {
+                row.revokedAt = new Date();
+                count += 1;
+            }
+        }
+        return count;
+    }
+    /** Test helper. */
+    size() {
+        return this.byId.size;
+    }
+    /** Test helper. */
+    clear() {
+        this.byId.clear();
+        this.byHash.clear();
+        this.idCounter = 0;
+    }
+    nextId() {
+        this.idCounter += 1;
+        return `mem-${this.idCounter}`;
+    }
+}
+//# sourceMappingURL=RefreshTokenStore.js.map

package/lib/app/auth/jwt/RefreshTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RefreshTokenStore.js","sourceRoot":"","sources":["../../../../src/app/auth/jwt/RefreshTokenStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA2EtD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IAC5B,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,SAAS,GAAG,CAAC,CAAC;IAEtB,KAAK,CAAC,KAAK,CAAC,KAA6B;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,MAAM,GAAuB;YACjC,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;SACzC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,iCAAiC;QACjC,IAAI,MAAM,GAAkB,EAAE,CAAC;QAC/B,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBACnB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5B,CAAC;QAED,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,EAAE,CAAC;YACf,OAAO,GAAG,KAAK,CAAC;YAChB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrC,IAAI,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACpB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;wBACnB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;wBAC3B,KAAK,IAAI,CAAC,CAAC;oBACb,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACzC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC3B,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mBAAmB;IACnB,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,mBAAmB;IACnB,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,MAAM;QACZ,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,OAAO,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,CAAC;CACF"}

package/lib/app/auth/permissionDefinition.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Canonical shape of a permission definition.
+ *
+ * Each module exports a `<MODULE>_PERMISSION_DEFINITIONS: readonly
+ * PermissionDefinition[]` array that the consuming app's bootstrapper / seed
+ * upserts into the Permission table. `slug` is the forward-compatible
+ * identifier (`module[:resource]:action` — lowercase, colon-separated;
+ * hyphenate multi-word actions, e.g. `oauth:connections:read-self`); `label`
+ * is the human-facing string shown in admin UIs.
+ *
+ * Contract: once an app deploys against a slug it is frozen — changing or
+ * removing a slug is a breaking change. `label` may change freely.
+ */
+export interface PermissionDefinition {
+    /** Stable `module[:resource]:action` identifier checked by `requirePermission`. */
+    slug: string;
+    /** Human-facing name surfaced in admin UIs when assigning permissions to roles. */
+    label: string;
+}
+//# sourceMappingURL=permissionDefinition.d.ts.map

package/lib/app/auth/permissionDefinition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDefinition.d.ts","sourceRoot":"","sources":["../../../src/app/auth/permissionDefinition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;CACf"}

package/lib/app/auth/permissionDefinition.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionDefinition.js.map