@warlock.js/auth 4.1.14 → 4.2.0

package/esm/models/index.mjs

@@ -1,12 +1,12 @@
-import { AccessToken } from "./access-token/access-token.model.mjs";
+import { AccessToken, accessTokenSchema } from "./access-token/access-token.model.mjs";
 import "./access-token/index.mjs";
-import { RefreshToken } from "./refresh-token/refresh-token.model.mjs";
+import { RefreshToken, refreshTokenSchema } from "./refresh-token/refresh-token.model.mjs";
 import "./refresh-token/index.mjs";
 import { AccessTokenMigration } from "./access-token/migration.mjs";
 import { RefreshTokenMigration } from "./refresh-token/migration.mjs";
 import { Auth } from "./auth.model.mjs";
 
-//#region ../../@warlock.js/auth/src/models/index.ts
+//#region ../@warlock.js/auth/src/models/index.ts
 const authMigrations = [AccessTokenMigration, RefreshTokenMigration];
 
 //#endregion

package/esm/models/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\r\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\r\n\r\nexport * from \"./access-token\";\r\nexport * from \"./auth.model\";\r\nexport * from \"./refresh-token\";\r\n\r\nexport const authMigrations = [AccessTokenMigration, RefreshTokenMigration];\r\n"],"mappings":";;;;;;;;;AAOA,MAAa,iBAAiB,CAAC,sBAAsB,qBAAqB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/index.ts"],"sourcesContent":["import { AccessTokenMigration } from \"./access-token/migration\";\r\nimport { RefreshTokenMigration } from \"./refresh-token/migration\";\r\n\r\nexport * from \"./access-token\";\r\nexport * from \"./auth.model\";\r\nexport * from \"./refresh-token\";\r\n\r\nexport const authMigrations = [AccessTokenMigration, RefreshTokenMigration];\r\n"],"mappings":";;;;;;;;;AAOA,MAAa,iBAAiB,CAAC,sBAAsB,qBAAqB"}

package/esm/models/refresh-token/index.d.mts

@@ -1 +1 @@
-import { RefreshToken } from "./refresh-token.model.mjs";
+import { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema } from "./refresh-token.model.mjs";

package/esm/models/refresh-token/index.mjs

@@ -1,3 +1,3 @@
-import { RefreshToken } from "./refresh-token.model.mjs";
+import { RefreshToken, refreshTokenSchema } from "./refresh-token.model.mjs";
 
 export {  };

package/esm/models/refresh-token/migration.mjs

@@ -1,7 +1,7 @@
 import { RefreshToken } from "./refresh-token.model.mjs";
 import { migrate } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/refresh-token/migration.ts
+//#region ../@warlock.js/auth/src/models/refresh-token/migration.ts
 const RefreshTokenMigration = migrate(RefreshToken, {
 	name: "refreshToken",
 	up() {
@@ -15,6 +15,7 @@ const RefreshTokenMigration = migrate(RefreshToken, {
 		this.timestamp("last_used_at").nullable();
 		this.timestamp("revoked_at").nullable();
 		this.json("device_info").nullable();
+		this.index(["user_id", "user_type"]);
 		this.timestamps();
 	},
 	down() {

package/esm/models/refresh-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { RefreshToken } from \"./refresh-token.model\";\n\nexport const RefreshTokenMigration = migrate(RefreshToken, {\n  name: \"refreshToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token fields\n    this.text(\"token\").unique();\n    this.uuid(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.text(\"family_id\").index().nullable();\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"last_used_at\").nullable();\n    this.timestamp(\"revoked_at\").nullable();\n    this.json(\"device_info\").nullable();\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,EAAE,OAAO;EAC1B,KAAK,KAAK,SAAS,EAAE,MAAM;EAC3B,KAAK,OAAO,aAAa,EAAE,EAAE,SAAS;EACtC,KAAK,KAAK,WAAW,EAAE,MAAM,EAAE,SAAS;EACxC,KAAK,UAAU,YAAY,EAAE,MAAM,EAAE,SAAS;EAC9C,KAAK,UAAU,cAAc,EAAE,SAAS;EACxC,KAAK,UAAU,YAAY,EAAE,SAAS;EACtC,KAAK,KAAK,aAAa,EAAE,SAAS;EAGlC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { RefreshToken } from \"./refresh-token.model\";\n\nexport const RefreshTokenMigration = migrate(RefreshToken, {\n  name: \"refreshToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token fields\n    this.text(\"token\").unique();\n    this.uuid(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.text(\"family_id\").index().nullable();\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"last_used_at\").nullable();\n    this.timestamp(\"revoked_at\").nullable();\n    this.json(\"device_info\").nullable();\n\n    // Composite index for the per-user active-session lookups\n    // (revokeAllFor / enforceMax / activeFor all filter on user_id + user_type).\n    this.index([\"user_id\", \"user_type\"]);\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAC1B,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM;EAC3B,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,aAAa,CAAC,CAAC,SAAS;EAIlC,KAAK,MAAM,CAAC,WAAW,WAAW,CAAC;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/refresh-token/refresh-token.model.d.mts

@@ -1,36 +1,114 @@
+import { Auth } from "../auth.model.mjs";
+import { DeviceInfo } from "../../contracts/types.mjs";
 import { Model } from "@warlock.js/cascade";
 
-//#region ../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.d.ts
+//#region ../@warlock.js/auth/src/models/refresh-token/refresh-token.model.d.ts
+/**
+ * Seal schema for the persisted refresh-token record. Exported so an override
+ * can spread it and add columns (e.g. a tenant key) without re-declaring the
+ * base shape:
+ *
+ * @example
+ * export class AppRefreshToken extends RefreshToken {
+ *   public static schema = refreshTokenSchema.extend({
+ *     organization_id: v.string().required(),
+ *   });
+ * }
+ */
+declare const refreshTokenSchema: any;
+/**
+ * Extra attributes captured when a refresh token is issued.
+ */
+type RefreshTokenIssueOptions = {
+  familyId: string;
+  expiresAt: string;
+  deviceInfo?: DeviceInfo;
+};
+/**
+ * Persisted refresh-token record + the data layer for refresh tokens.
+ *
+ * **Role.** Owns every refresh-token read, write, and lifecycle transition.
+ * The auth service drives refresh-token state exclusively through this model's
+ * named statics and instance methods, so it never hard-codes a column name —
+ * which is what makes a snake/camel mismatch (the historical `userId` bug)
+ * structurally impossible and lets an override rename or add columns by
+ * extending this class and registering it under `config.auth.refreshToken.model`.
+ */
 declare class RefreshToken extends Model {
+  static table: string;
+  static schema: any;
+  /** Token family this row belongs to (rotation / replay grouping). */
+  get familyId(): string;
+  /** Whether the token's `expires_at` is in the past. */
+  get isExpired(): boolean;
+  /** Whether the token has been revoked. */
+  get isRevoked(): boolean;
+  /** Whether the token is still usable (not expired and not revoked). */
+  get isValid(): boolean;
   /**
-   * {@inheritDoc}
+   * Unconditionally stamp `revoked_at` on this token.
    */
-  static table: string;
+  revoke(): Promise<this>;
   /**
-   * {@inheritDoc}
+   * Atomically revoke this token ONLY if it is still active. Resolves to `true`
+   * when this call performed the revoke, `false` when a concurrent request had
+   * already revoked it — the win/lose signal that powers rotation replay
+   * detection. Uses a conditional UPDATE so two concurrent rotations of the
+   * same token can never both succeed.
    */
-  static schema: any;
+  revokeIfActive(): Promise<boolean>;
   /**
-   * Check if token is expired
+   * Touch `last_used_at` without revoking — the non-rotating refresh path.
    */
-  get isExpired(): boolean;
+  markAsUsed(): Promise<void>;
   /**
-   * Check if token is revoked
+   * Persist a freshly-signed refresh token for the user.
    */
-  get isRevoked(): boolean;
+  static issue(user: Auth, token: string, options: RefreshTokenIssueOptions): any;
   /**
-   * Check if token is valid (not expired and not revoked)
+   * Find a refresh-token row by its raw token string.
    */
-  get isValid(): boolean;
+  static findByToken(token: string): Promise<RefreshToken | null>;
   /**
-   * Revoke this token
+   * Find a refresh token scoped to a user — used by logout so a caller can only
+   * revoke a token that actually belongs to them.
    */
-  revoke(): Promise<this>;
+  static findForUser(user: Auth, token: string): Promise<RefreshToken | null>;
   /**
-   * Mark token as used (update last_used_at)
+   * Delete a specific refresh token belonging to the user.
    */
-  markAsUsed(): Promise<void>;
+  static deleteForUser(user: Auth, token: string): any;
+  /**
+   * Active, unexpired sessions for the user, newest first.
+   */
+  static activeFor(user: Auth): Promise<RefreshToken[]>;
+  /**
+   * Revoke every still-active refresh token for the user, returning the rows
+   * that were revoked so the caller can emit a per-token event for each.
+   *
+   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on
+   * `revoked_at: null` would re-query the same predicate after the update and
+   * match nothing, returning an empty set.
+   */
+  static revokeAllFor(user: Auth): Promise<RefreshToken[]>;
+  /**
+   * Revoke every still-active token in a family (rotation breach containment),
+   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).
+   */
+  static revokeFamily(familyId: string): Promise<RefreshToken[]>;
+  /**
+   * Revoke the oldest active tokens so at most `max - 1` remain — making room
+   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is
+   * small.
+   */
+  static enforceMax(user: Auth, max: number): Promise<void>;
+  /**
+   * Hard-delete every expired refresh token, returning the deleted rows so the
+   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command
+   * (a cold batch path).
+   */
+  static purgeExpired(): Promise<RefreshToken[]>;
 }
 //#endregion
-export { RefreshToken };
+export { RefreshToken, RefreshTokenIssueOptions, refreshTokenSchema };
 //# sourceMappingURL=refresh-token.model.d.mts.map

package/esm/models/refresh-token/refresh-token.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;cAca,YAAA,SAAqB,KAAA;;AAAlC;;SAIgB,KAAA;EAiCS;;;EAAA,OA5BT,MAAA;EATuB;;;EAAA,IAc1B,SAAA,CAAA;EAAA;;;EAAA,IASA,SAAA,CAAA;EAcY;;;EAAA,IAPZ,OAAA,CAAA;EAcuB;;;EAPrB,MAAA,CAAA,GAAU,OAAA;;;;EAOV,UAAA,CAAA,GAAc,OAAA;AAAA"}
+{"version":3,"file":"refresh-token.model.d.mts","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts"],"mappings":";;;;;;;AAiBA;;;;AASE;AAKF;;;;;cAda,kBAAA;;;;KAcD,wBAAA;EACV,QAAA;EACA,SAAA;EACA,UAAA,GAAa,UAAU;AAAA;;;;;;;;;;;cAaZ,YAAA,SAAqB,KAAA;EAAA,OAClB,KAAA;EAAA,OAEA,MAAA;EAuHyB;EAAA,IApH5B,QAAA;EAoHmC;EAAA,IA/GnC,SAAA;EA+HyC;EAAA,IAtHzC,SAAA;EAqI8C;EAAA,IAhI9C,OAAA;EAoJyB;;;EA7IvB,MAAA,IAAU,OAAA;EAhCS;;;;;;;EA2CnB,cAAA,IAAkB,OAAA;EAXR;;;EAyBV,UAAA,IAAc,OAAA;EAAA;;;EAAA,OAOb,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,EAAS,wBAAA;EAAxB;;;EAAA,OAoBlB,WAAA,CAAY,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAAxB;;;;EAAA,OAQZ,WAAA,CAAY,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA,CAAQ,YAAA;EAApC;;;EAAA,OAOZ,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,KAAA;EAA1B;;;EAAA,OAOA,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAA/B;;;;;;;;EAAA,OAgBM,YAAA,CAAa,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EAAA;;;;EAAA,OAgBlC,YAAA,CAAa,QAAA,WAAmB,OAAA,CAAQ,YAAA;EAexC;;;;;EAAA,OAAA,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,GAAA,WAAc,OAAA;EAoBrB;;;AAAoB;;EAApB,OAAhB,YAAA,IAAgB,OAAA,CAAQ,YAAA;AAAA"}

package/esm/models/refresh-token/refresh-token.model.mjs

@@ -1,7 +1,19 @@
 import { Model } from "@warlock.js/cascade";
 import { v } from "@warlock.js/seal";
 
-//#region ../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts
+//#region ../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts
+/**
+* Seal schema for the persisted refresh-token record. Exported so an override
+* can spread it and add columns (e.g. a tenant key) without re-declaring the
+* base shape:
+*
+* @example
+* export class AppRefreshToken extends RefreshToken {
+*   public static schema = refreshTokenSchema.extend({
+*     organization_id: v.string().required(),
+*   });
+* }
+*/
 const refreshTokenSchema = v.object({
 	token: v.string().required(),
 	user_id: v.scalar().required(),
@@ -12,6 +24,16 @@ const refreshTokenSchema = v.object({
 	revoked_at: v.date().optional(),
 	device_info: v.record(v.any()).optional()
 });
+/**
+* Persisted refresh-token record + the data layer for refresh tokens.
+*
+* **Role.** Owns every refresh-token read, write, and lifecycle transition.
+* The auth service drives refresh-token state exclusively through this model's
+* named statics and instance methods, so it never hard-codes a column name —
+* which is what makes a snake/camel mismatch (the historical `userId` bug)
+* structurally impossible and lets an override rename or add columns by
+* extending this class and registering it under `config.auth.refreshToken.model`.
+*/
 var RefreshToken = class extends Model {
 	static {
 		this.table = "refresh_tokens";
@@ -19,40 +41,157 @@ var RefreshToken = class extends Model {
 	static {
 		this.schema = refreshTokenSchema;
 	}
-	/**
-	* Check if token is expired
-	*/
+	/** Token family this row belongs to (rotation / replay grouping). */
+	get familyId() {
+		return this.get("family_id");
+	}
+	/** Whether the token's `expires_at` is in the past. */
 	get isExpired() {
 		const expiresAt = this.get("expires_at");
 		if (!expiresAt) return false;
 		return /* @__PURE__ */ new Date() > new Date(expiresAt);
 	}
-	/**
-	* Check if token is revoked
-	*/
+	/** Whether the token has been revoked. */
 	get isRevoked() {
 		return !!this.get("revoked_at");
 	}
-	/**
-	* Check if token is valid (not expired and not revoked)
-	*/
+	/** Whether the token is still usable (not expired and not revoked). */
 	get isValid() {
 		return !this.isExpired && !this.isRevoked;
 	}
 	/**
-	* Revoke this token
+	* Unconditionally stamp `revoked_at` on this token.
 	*/
 	async revoke() {
 		return this.merge({ revoked_at: /* @__PURE__ */ new Date() }).save();
 	}
 	/**
-	* Mark token as used (update last_used_at)
+	* Atomically revoke this token ONLY if it is still active. Resolves to `true`
+	* when this call performed the revoke, `false` when a concurrent request had
+	* already revoked it — the win/lose signal that powers rotation replay
+	* detection. Uses a conditional UPDATE so two concurrent rotations of the
+	* same token can never both succeed.
+	*/
+	async revokeIfActive() {
+		return await this.constructor.atomic({
+			id: this.id,
+			revoked_at: null
+		}, { $set: { revoked_at: /* @__PURE__ */ new Date() } }) > 0;
+	}
+	/**
+	* Touch `last_used_at` without revoking — the non-rotating refresh path.
 	*/
 	async markAsUsed() {
 		await this.merge({ last_used_at: /* @__PURE__ */ new Date() }).save();
 	}
+	/**
+	* Persist a freshly-signed refresh token for the user.
+	*/
+	static issue(user, token, options) {
+		return this.create({
+			token,
+			user_id: user.id,
+			user_type: user.userType,
+			family_id: options.familyId,
+			expires_at: options.expiresAt,
+			device_info: options.deviceInfo ? {
+				userAgent: options.deviceInfo.userAgent,
+				ip: options.deviceInfo.ip,
+				deviceId: options.deviceInfo.deviceId
+			} : void 0
+		});
+	}
+	/**
+	* Find a refresh-token row by its raw token string.
+	*/
+	static findByToken(token) {
+		return this.first({ token });
+	}
+	/**
+	* Find a refresh token scoped to a user — used by logout so a caller can only
+	* revoke a token that actually belongs to them.
+	*/
+	static findForUser(user, token) {
+		return this.first({
+			token,
+			user_id: user.id
+		});
+	}
+	/**
+	* Delete a specific refresh token belonging to the user.
+	*/
+	static deleteForUser(user, token) {
+		return this.delete({
+			token,
+			user_id: user.id
+		});
+	}
+	/**
+	* Active, unexpired sessions for the user, newest first.
+	*/
+	static activeFor(user) {
+		return this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			revoked_at: null
+		}).where("expires_at", ">", /* @__PURE__ */ new Date()).orderBy("created_at", "desc").get();
+	}
+	/**
+	* Revoke every still-active refresh token for the user, returning the rows
+	* that were revoked so the caller can emit a per-token event for each.
+	*
+	* Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on
+	* `revoked_at: null` would re-query the same predicate after the update and
+	* match nothing, returning an empty set.
+	*/
+	static async revokeAllFor(user) {
+		const tokens = await this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			revoked_at: null
+		}).get();
+		for (const token of tokens) await token.revoke();
+		return tokens;
+	}
+	/**
+	* Revoke every still-active token in a family (rotation breach containment),
+	* returning the revoked rows (fetched before revocation — see `revokeAllFor`).
+	*/
+	static async revokeFamily(familyId) {
+		const tokens = await this.query().where({
+			family_id: familyId,
+			revoked_at: null
+		}).get();
+		for (const token of tokens) await token.revoke();
+		return tokens;
+	}
+	/**
+	* Revoke the oldest active tokens so at most `max - 1` remain — making room
+	* for the about-to-be-issued one. Bounded by `max`, so the per-row loop is
+	* small.
+	*/
+	static async enforceMax(user, max) {
+		const activeTokens = await this.query().where({
+			user_id: user.id,
+			user_type: user.userType,
+			revoked_at: null
+		}).orderBy("created_at", "asc").get();
+		if (activeTokens.length < max) return;
+		const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);
+		for (const token of tokensToRevoke) await token.revoke();
+	}
+	/**
+	* Hard-delete every expired refresh token, returning the deleted rows so the
+	* caller can emit a per-token event. Runs from the `auth.cleanup` CLI command
+	* (a cold batch path).
+	*/
+	static async purgeExpired() {
+		const expiredTokens = await this.query().where("expires_at", "<", /* @__PURE__ */ new Date()).get();
+		for (const token of expiredTokens) await token.destroy();
+		return expiredTokens;
+	}
 };
 
 //#endregion
-export { RefreshToken };
+export { RefreshToken, refreshTokenSchema };
 //# sourceMappingURL=refresh-token.model.mjs.map

package/esm/models/refresh-token/refresh-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\n\nconst refreshTokenSchema = v.object({\n  token: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  family_id: v.string().required(),\n  expires_at: v.date().required(),\n  last_used_at: v.date().default(() => new Date()),\n  revoked_at: v.date().optional(),\n  device_info: v.record(v.any()).optional(),\n});\n\nexport class RefreshToken extends Model {\n  /**\n   * {@inheritDoc}\n   */\n  public static table = \"refresh_tokens\";\n\n  /**\n   * {@inheritDoc}\n   */\n  public static schema = refreshTokenSchema;\n\n  /**\n   * Check if token is expired\n   */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n    if (!expiresAt) return false;\n    return new Date() > new Date(expiresAt);\n  }\n\n  /**\n   * Check if token is revoked\n   */\n  public get isRevoked(): boolean {\n    return !!this.get(\"revoked_at\");\n  }\n\n  /**\n   * Check if token is valid (not expired and not revoked)\n   */\n  public get isValid(): boolean {\n    return !this.isExpired && !this.isRevoked;\n  }\n\n  /**\n   * Revoke this token\n   */\n  public async revoke(): Promise<this> {\n    return this.merge({ revoked_at: new Date() }).save();\n  }\n\n  /**\n   * Mark token as used (update last_used_at)\n   */\n  public async markAsUsed(): Promise<void> {\n    await this.merge({ last_used_at: new Date() }).save();\n  }\n}\n"],"mappings":";;;;AAGA,MAAM,qBAAqB,EAAE,OAAO;CAClC,OAAO,EAAE,OAAO,EAAE,SAAS;CAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;CAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;CAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;CAC/B,YAAY,EAAE,KAAK,EAAE,SAAS;CAC9B,cAAc,EAAE,KAAK,EAAE,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,EAAE,SAAS;CAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAC1C,CAAC;AAED,IAAa,eAAb,cAAkC,MAAM;;eAIhB;;;gBAKC;;;;;CAKvB,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EACvC,IAAI,CAAC,WAAW,OAAO;EACvB,uBAAO,IAAI,KAAK,IAAI,IAAI,KAAK,SAAS;CACxC;;;;CAKA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;;;CAKA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,EAAE,KAAK;CACrD;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,EAAE,KAAK;CACtD;AACF"}
+{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../../@warlock.js/auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { DeviceInfo } from \"../../contracts/types\";\nimport type { Auth } from \"../auth.model\";\n\n/**\n * Seal schema for the persisted refresh-token record. Exported so an override\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\n * base shape:\n *\n * @example\n * export class AppRefreshToken extends RefreshToken {\n *   public static schema = refreshTokenSchema.extend({\n *     organization_id: v.string().required(),\n *   });\n * }\n */\nexport const refreshTokenSchema = v.object({\n  token: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  family_id: v.string().required(),\n  expires_at: v.date().required(),\n  last_used_at: v.date().default(() => new Date()),\n  revoked_at: v.date().optional(),\n  device_info: v.record(v.any()).optional(),\n});\n\n/**\n * Extra attributes captured when a refresh token is issued.\n */\nexport type RefreshTokenIssueOptions = {\n  familyId: string;\n  expiresAt: string;\n  deviceInfo?: DeviceInfo;\n};\n\n/**\n * Persisted refresh-token record + the data layer for refresh tokens.\n *\n * **Role.** Owns every refresh-token read, write, and lifecycle transition.\n * The auth service drives refresh-token state exclusively through this model's\n * named statics and instance methods, so it never hard-codes a column name —\n * which is what makes a snake/camel mismatch (the historical `userId` bug)\n * structurally impossible and lets an override rename or add columns by\n * extending this class and registering it under `config.auth.refreshToken.model`.\n */\nexport class RefreshToken extends Model {\n  public static table = \"refresh_tokens\";\n\n  public static schema = refreshTokenSchema;\n\n  /** Token family this row belongs to (rotation / replay grouping). */\n  public get familyId(): string {\n    return this.get(\"family_id\");\n  }\n\n  /** Whether the token's `expires_at` is in the past. */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!expiresAt) return false;\n\n    return new Date() > new Date(expiresAt);\n  }\n\n  /** Whether the token has been revoked. */\n  public get isRevoked(): boolean {\n    return !!this.get(\"revoked_at\");\n  }\n\n  /** Whether the token is still usable (not expired and not revoked). */\n  public get isValid(): boolean {\n    return !this.isExpired && !this.isRevoked;\n  }\n\n  /**\n   * Unconditionally stamp `revoked_at` on this token.\n   */\n  public async revoke(): Promise<this> {\n    return this.merge({ revoked_at: new Date() }).save();\n  }\n\n  /**\n   * Atomically revoke this token ONLY if it is still active. Resolves to `true`\n   * when this call performed the revoke, `false` when a concurrent request had\n   * already revoked it — the win/lose signal that powers rotation replay\n   * detection. Uses a conditional UPDATE so two concurrent rotations of the\n   * same token can never both succeed.\n   */\n  public async revokeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof RefreshToken;\n\n    const revokedCount = await modelClass.atomic(\n      { id: this.id, revoked_at: null },\n      { $set: { revoked_at: new Date() } },\n    );\n\n    return revokedCount > 0;\n  }\n\n  /**\n   * Touch `last_used_at` without revoking — the non-rotating refresh path.\n   */\n  public async markAsUsed(): Promise<void> {\n    await this.merge({ last_used_at: new Date() }).save();\n  }\n\n  /**\n   * Persist a freshly-signed refresh token for the user.\n   */\n  public static issue(user: Auth, token: string, options: RefreshTokenIssueOptions) {\n    return this.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n      family_id: options.familyId,\n      expires_at: options.expiresAt,\n      device_info: options.deviceInfo\n        ? {\n            userAgent: options.deviceInfo.userAgent,\n            ip: options.deviceInfo.ip,\n            deviceId: options.deviceInfo.deviceId,\n          }\n        : undefined,\n    });\n  }\n\n  /**\n   * Find a refresh-token row by its raw token string.\n   */\n  public static findByToken(token: string): Promise<RefreshToken | null> {\n    return this.first({ token });\n  }\n\n  /**\n   * Find a refresh token scoped to a user — used by logout so a caller can only\n   * revoke a token that actually belongs to them.\n   */\n  public static findForUser(user: Auth, token: string): Promise<RefreshToken | null> {\n    return this.first({ token, user_id: user.id });\n  }\n\n  /**\n   * Delete a specific refresh token belonging to the user.\n   */\n  public static deleteForUser(user: Auth, token: string) {\n    return this.delete({ token, user_id: user.id });\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public static activeFor(user: Auth): Promise<RefreshToken[]> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .where(\"expires_at\", \">\", new Date())\n      .orderBy(\"created_at\", \"desc\")\n      .get();\n  }\n\n  /**\n   * Revoke every still-active refresh token for the user, returning the rows\n   * that were revoked so the caller can emit a per-token event for each.\n   *\n   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on\n   * `revoked_at: null` would re-query the same predicate after the update and\n   * match nothing, returning an empty set.\n   */\n  public static async revokeAllFor(user: Auth): Promise<RefreshToken[]> {\n    const tokens = await this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .get();\n\n    for (const token of tokens) {\n      await token.revoke();\n    }\n\n    return tokens;\n  }\n\n  /**\n   * Revoke every still-active token in a family (rotation breach containment),\n   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).\n   */\n  public static async revokeFamily(familyId: string): Promise<RefreshToken[]> {\n    const tokens = await this.query().where({ family_id: familyId, revoked_at: null }).get();\n\n    for (const token of tokens) {\n      await token.revoke();\n    }\n\n    return tokens;\n  }\n\n  /**\n   * Revoke the oldest active tokens so at most `max - 1` remain — making room\n   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is\n   * small.\n   */\n  public static async enforceMax(user: Auth, max: number): Promise<void> {\n    const activeTokens = await this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .orderBy(\"created_at\", \"asc\")\n      .get();\n\n    if (activeTokens.length < max) return;\n\n    const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);\n\n    for (const token of tokensToRevoke) {\n      await token.revoke();\n    }\n  }\n\n  /**\n   * Hard-delete every expired refresh token, returning the deleted rows so the\n   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command\n   * (a cold batch path).\n   */\n  public static async purgeExpired(): Promise<RefreshToken[]> {\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n\n    for (const token of expiredTokens) {\n      await token.destroy();\n    }\n\n    return expiredTokens;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,cAAc,EAAE,KAAK,CAAC,CAAC,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;AAqBD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;CAGvB,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;CAGA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,WAAW,OAAO;EAEvB,uBAAO,IAAI,KAAK,IAAI,IAAI,KAAK,SAAS;CACxC;;CAGA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;CAGA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACrD;;;;;;;;CASA,MAAa,iBAAmC;EAQ9C,OAAO,MAPY,KAAK,YAEc,OACpC;GAAE,IAAI,KAAK;GAAI,YAAY;EAAK,GAChC,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC,IAEsB;CACxB;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACtD;;;;CAKA,OAAc,MAAM,MAAY,OAAe,SAAmC;EAChF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,aAAa,QAAQ,aACjB;IACE,WAAW,QAAQ,WAAW;IAC9B,IAAI,QAAQ,WAAW;IACvB,UAAU,QAAQ,WAAW;GAC/B,IACA;EACN,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA6C;EACrE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;;CAMA,OAAc,YAAY,MAAY,OAA6C;EACjF,OAAO,KAAK,MAAM;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAC/C;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,UAAU,MAAqC;EAC3D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,MAAM,CAAC,CAC7B,IAAI;CACT;;;;;;;;;CAUA,aAAoB,aAAa,MAAqC;EACpE,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAC9B,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;CAMA,aAAoB,aAAa,UAA2C;EAC1E,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,WAAW;GAAU,YAAY;EAAK,CAAC,CAAC,CAAC,IAAI;EAEvF,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;;CAOA,aAAoB,WAAW,MAAY,KAA4B;EACrE,MAAM,eAAe,MAAM,KAAK,MAAM,CAAC,CACpC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,QAAQ,cAAc,KAAK,CAAC,CAC5B,IAAI;EAEP,IAAI,aAAa,SAAS,KAAK;EAE/B,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,MAAM,CAAC;EAE1E,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;CAEvB;;;;;;CAOA,aAAoB,eAAwC;EAC1D,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/services/auth-config.mjs

@@ -0,0 +1,63 @@
+import { config } from "@warlock.js/core";
+import { log } from "@warlock.js/logger";
+
+//#region ../@warlock.js/auth/src/services/auth-config.ts
+const warnedLegacyKeys = /* @__PURE__ */ new Set();
+/**
+* Resolve an auth setting, preferring the new `auth.accessToken.*` /
+* `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`
+* shape — warning once per legacy key. Returns `fallback` when neither is set.
+*
+* This is the backward-compatible shim that lets existing `auth.jwt.*` configs
+* keep working after the config split.
+*/
+function resolve(newKey, legacyKey, fallback) {
+	const fromNew = config.key(`auth.${newKey}`);
+	if (fromNew !== void 0 && fromNew !== null) return fromNew;
+	const fromLegacy = config.key(`auth.${legacyKey}`);
+	if (fromLegacy !== void 0 && fromLegacy !== null) {
+		if (!warnedLegacyKeys.has(legacyKey)) {
+			warnedLegacyKeys.add(legacyKey);
+			log.warn("auth", "config-deprecation", `auth.${legacyKey} is deprecated — use auth.${newKey}`);
+		}
+		return fromLegacy;
+	}
+	return fallback;
+}
+/**
+* Typed, backward-compatible access to auth configuration. The service and the
+* jwt signer read configuration exclusively through here, so the new split
+* config and the legacy `auth.jwt.*` shape both resolve the same way.
+*/
+const authConfig = {
+	accessToken: {
+		/** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */
+		secret: () => {
+			const secret = resolve("accessToken.secret", "jwt.secret");
+			if (!secret) throw new Error("auth: no JWT secret configured — set `auth.accessToken.secret`.");
+			return secret;
+		},
+		/** Signing algorithm (legacy: `auth.jwt.algorithm`). */
+		algorithm: () => resolve("accessToken.algorithm", "jwt.algorithm", "HS256"),
+		/** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */
+		expiresIn: () => resolve("accessToken.expiresIn", "jwt.expiresIn")
+	},
+	refreshToken: {
+		/** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */
+		secret: () => resolve("refreshToken.secret", "jwt.refresh.secret"),
+		/** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */
+		enabled: () => resolve("refreshToken.enabled", "jwt.refresh.enabled", true),
+		/** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */
+		expiresIn: () => resolve("refreshToken.expiresIn", "jwt.refresh.expiresIn", "7d"),
+		/** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */
+		rotation: () => resolve("refreshToken.rotation", "jwt.refresh.rotation", true),
+		/** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */
+		maxPerUser: () => resolve("refreshToken.maxPerUser", "jwt.refresh.maxPerUser", 5),
+		/** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */
+		logoutWithoutToken: () => resolve("refreshToken.logoutWithoutToken", "jwt.refresh.logoutWithoutToken", "revoke-all")
+	}
+};
+
+//#endregion
+export { authConfig };
+//# sourceMappingURL=auth-config.mjs.map

package/esm/services/auth-config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { LogoutWithoutTokenBehavior } from \"../contracts/types\";\n\nconst warnedLegacyKeys = new Set<string>();\n\n/**\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\n *\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\n * keep working after the config split.\n */\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\n  const fromNew = config.key(`auth.${newKey}`);\n\n  if (fromNew !== undefined && fromNew !== null) {\n    return fromNew as T;\n  }\n\n  const fromLegacy = config.key(`auth.${legacyKey}`);\n\n  if (fromLegacy !== undefined && fromLegacy !== null) {\n    if (!warnedLegacyKeys.has(legacyKey)) {\n      warnedLegacyKeys.add(legacyKey);\n      log.warn(\"auth\", \"config-deprecation\", `auth.${legacyKey} is deprecated — use auth.${newKey}`);\n    }\n\n    return fromLegacy as T;\n  }\n\n  return fallback as T;\n}\n\n/**\n * Typed, backward-compatible access to auth configuration. The service and the\n * jwt signer read configuration exclusively through here, so the new split\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\n */\nexport const authConfig = {\n  accessToken: {\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\n    secret: (): string => {\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\n\n      if (!secret) {\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\n      }\n\n      return secret;\n    },\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\n  },\n  refreshToken: {\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\n  },\n};\n"],"mappings":";;;;AAKA,MAAM,mCAAmB,IAAI,IAAY;;;;;;;;;AAUzC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KAAK,QAAQ,sBAAsB,QAAQ,UAAU,4BAA4B,QAAQ;EAC/F;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;CACvF;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;EAExF,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}

package/esm/services/auth-events.d.mts

@@ -1,9 +1,9 @@
-import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { Auth } from "../models/auth.model.mjs";
 import { DeviceInfo, TokenPair } from "../contracts/types.mjs";
+import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { EventSubscription } from "@mongez/events";
 
-//#region ../../@warlock.js/auth/src/services/auth-events.d.ts
+//#region ../@warlock.js/auth/src/services/auth-events.d.ts
 /**
  * Auth event payload types
  */

package/esm/services/auth-events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;KAQY,iBAAA;EAEV,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,UAAA,GAAa,UAAA;EACjE,cAAA,GAAiB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA,GAAqB,MAAA;EACrE,eAAA,GAAkB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA;EAGjD,MAAA,GAAS,IAAA,EAAM,IAAA;EACf,YAAA,GAAe,IAAA,EAAM,IAAA;EACrB,iBAAA,GAAoB,IAAA,EAAM,IAAA;EAG1B,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA;EACzC,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,SAAA,EAAW,eAAA,EAAiB,YAAA;EAC1E,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,YAAA;EACrC,eAAA,GAAkB,KAAA,EAAO,YAAA;EACzB,qBAAA,GAAwB,QAAA,UAAkB,MAAA,EAAQ,YAAA;EAGlD,kBAAA,GAAqB,IAAA,EAAM,IAAA;EAC3B,yBAAA,GAA4B,IAAA,EAAM,IAAA,EAAM,UAAA;EACxC,gBAAA,GAAmB,IAAA,EAAM,IAAA;EAGzB,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA,EAAc,UAAA,GAAa,UAAA;EACzE,mBAAA,GAAsB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA;EAGhD,mBAAA,GAAsB,YAAA;AAAA;;;;KAMZ,aAAA,SAAsB,iBAAiB;;;;KAKvC,iBAAA,WAA4B,aAAA,QACnC,IAAA,EAAM,iBAAA,CAAkB,CAAA,aACjB,OAAA;;;;;;;;;;;;;;;;;;;cAyBC,UAAA;EAzDe;;;eA6Db,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EA1DzC;;;sBAiEV,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EAhEpD;;;iBAuEX,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAvEO;;;oBA8ExD,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EA7ExC;;;;EACL;;;cA0Fb,aAAA;AAAA"}
+{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;KASY,iBAAA;EAEV,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,UAAA,GAAa,UAAA;EACjE,cAAA,GAAiB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA,GAAqB,MAAA;EACrE,eAAA,GAAkB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA;EAGjD,MAAA,GAAS,IAAA,EAAM,IAAA;EACf,YAAA,GAAe,IAAA,EAAM,IAAA;EACrB,iBAAA,GAAoB,IAAA,EAAM,IAAA;EAG1B,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA;EACzC,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,SAAA,EAAW,eAAA,EAAiB,YAAA;EAC1E,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,YAAA;EACrC,eAAA,GAAkB,KAAA,EAAO,YAAA;EACzB,qBAAA,GAAwB,QAAA,UAAkB,MAAA,EAAQ,YAAA;EAGlD,kBAAA,GAAqB,IAAA,EAAM,IAAA;EAC3B,yBAAA,GAA4B,IAAA,EAAM,IAAA,EAAM,UAAA;EACxC,gBAAA,GAAmB,IAAA,EAAM,IAAA;EAGzB,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA,EAAc,UAAA,GAAa,UAAA;EACzE,mBAAA,GAAsB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA;EAGhD,mBAAA,GAAsB,YAAA;AAAA;;;;KAMZ,aAAA,SAAsB,iBAAiB;;;;KAKvC,iBAAA,WAA4B,aAAA,QACnC,IAAA,EAAM,iBAAA,CAAkB,CAAA,aACjB,OAAA;;;;;;;;;;;;;;;;;;;cAyBC,UAAA;EAzDe;;;eA6Db,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EA1DzC;;;sBAiEV,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EAhEpD;;;iBAuEX,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAvEO;;;oBAuFxD,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAtFxC;;;;EACL;;;cAmGb,aAAA;AAAA"}

package/esm/services/auth-events.mjs

@@ -1,6 +1,7 @@
+import { log } from "@warlock.js/logger";
 import events from "@mongez/events";
 
-//#region ../../@warlock.js/auth/src/services/auth-events.ts
+//#region ../@warlock.js/auth/src/services/auth-events.ts
 /**
 * Event namespace prefix for auth events
 */
@@ -40,7 +41,11 @@ const authEvents = {
 	* Emit an auth event
 	*/
 	emit(event, ...args) {
-		events.trigger(AUTH_EVENT_PREFIX + event, ...args);
+		try {
+			events.trigger(AUTH_EVENT_PREFIX + event, ...args);
+		} catch (error) {
+			log.error("auth", "event", error);
+		}
 	},
 	/**
 	* Emit an auth event (alias for `emit`)

package/esm/services/auth-events.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-events.mjs","names":[],"sources":["../../../../../../@warlock.js/auth/src/services/auth-events.ts"],"sourcesContent":["import events, { type EventSubscription } from \"@mongez/events\";\nimport type { DeviceInfo, TokenPair } from \"../contracts/types\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Auth event payload types\n */\nexport type AuthEventPayloads = {\n  // Login events\n  \"login.success\": [user: Auth, tokenPair: TokenPair, deviceInfo?: DeviceInfo];\n  \"login.failed\": [credentials: { email?: string; username?: string }, reason: string];\n  \"login.attempt\": [credentials: { email?: string; username?: string }];\n\n  // Logout events\n  logout: [user: Auth];\n  \"logout.all\": [user: Auth];\n  \"logout.failsafe\": [user: Auth];\n\n  // Token events\n  \"token.created\": [user: Auth, tokenPair: TokenPair];\n  \"token.refreshed\": [user: Auth, newTokenPair: TokenPair, oldRefreshToken: RefreshToken];\n  \"token.revoked\": [user: Auth, token: RefreshToken];\n  \"token.expired\": [token: RefreshToken];\n  \"token.familyRevoked\": [familyId: string, tokens: RefreshToken[]];\n\n  // Password events\n  \"password.changed\": [user: Auth];\n  \"password.resetRequested\": [user: Auth, resetToken: string];\n  \"password.reset\": [user: Auth];\n\n  // Session events\n  \"session.created\": [user: Auth, refreshToken: RefreshToken, deviceInfo?: DeviceInfo];\n  \"session.destroyed\": [user: Auth, refreshToken: RefreshToken];\n\n  // Cleanup events\n  \"cleanup.completed\": [expiredCount: number];\n};\n\n/**\n * Auth event names\n */\nexport type AuthEventName = keyof AuthEventPayloads;\n\n/**\n * Callback type for a specific event\n */\nexport type AuthEventCallback<T extends AuthEventName> = (\n  ...args: AuthEventPayloads[T]\n) => void | Promise<void>;\n\n/**\n * Event namespace prefix for auth events\n */\nconst AUTH_EVENT_PREFIX = \"auth.\";\n\n/**\n * Type-safe auth events manager\n *\n * @example\n * ```typescript\n * // Subscribe to events with full autocomplete\n * authEvents.on(\"login.success\", (user, tokenPair, deviceInfo) => {\n *   console.log(`User ${user.id} logged in`);\n * });\n *\n * authEvents.on(\"token.refreshed\", (user, newPair, oldToken) => {\n *   console.log(`Token refreshed for user ${user.id}`);\n * });\n *\n * // Trigger events\n * authEvents.emit(\"login.success\", user, tokenPair, deviceInfo);\n * ```\n */\nexport const authEvents = {\n  /**\n   * Subscribe to an auth event\n   */\n  on<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return events.subscribe(AUTH_EVENT_PREFIX + event, callback as Function);\n  },\n\n  /**\n   * Subscribe to an auth event (alias for `on`)\n   */\n  subscribe<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return this.on(event, callback);\n  },\n\n  /**\n   * Emit an auth event\n   */\n  emit<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    events.trigger(AUTH_EVENT_PREFIX + event, ...args);\n  },\n\n  /**\n   * Emit an auth event (alias for `emit`)\n   */\n  trigger<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    this.emit(event, ...args);\n  },\n\n  /**\n   * Unsubscribe from all auth events\n   */\n  unsubscribeAll(): void {\n    events.unsubscribeNamespace(AUTH_EVENT_PREFIX.slice(0, -1));\n  },\n\n  /**\n   * Unsubscribe from a specific auth event\n   */\n  off(event?: AuthEventName): void {\n    if (event) {\n      events.unsubscribe(AUTH_EVENT_PREFIX + event);\n    } else {\n      this.unsubscribeAll();\n    }\n  },\n};\n"],"mappings":";;;;;;AAsDA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;AAoB1B,MAAa,aAAa;;;;CAIxB,GAA4B,OAAU,UAAmD;EACvF,OAAO,OAAO,UAAU,oBAAoB,OAAO,QAAoB;CACzE;;;;CAKA,UAAmC,OAAU,UAAmD;EAC9F,OAAO,KAAK,GAAG,OAAO,QAAQ;CAChC;;;;CAKA,KAA8B,OAAU,GAAG,MAAkC;EAC3E,OAAO,QAAQ,oBAAoB,OAAO,GAAG,IAAI;CACnD;;;;CAKA,QAAiC,OAAU,GAAG,MAAkC;EAC9E,KAAK,KAAK,OAAO,GAAG,IAAI;CAC1B;;;;CAKA,iBAAuB;EACrB,OAAO,qBAAqB,kBAAkB,MAAM,GAAG,EAAE,CAAC;CAC5D;;;;CAKA,IAAI,OAA6B;EAC/B,IAAI,OACF,OAAO,YAAY,oBAAoB,KAAK;OAE5C,KAAK,eAAe;CAExB;AACF"}
+{"version":3,"file":"auth-events.mjs","names":[],"sources":["../../../../../../../@warlock.js/auth/src/services/auth-events.ts"],"sourcesContent":["import events, { type EventSubscription } from \"@mongez/events\";\nimport { log } from \"@warlock.js/logger\";\nimport type { DeviceInfo, TokenPair } from \"../contracts/types\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Auth event payload types\n */\nexport type AuthEventPayloads = {\n  // Login events\n  \"login.success\": [user: Auth, tokenPair: TokenPair, deviceInfo?: DeviceInfo];\n  \"login.failed\": [credentials: { email?: string; username?: string }, reason: string];\n  \"login.attempt\": [credentials: { email?: string; username?: string }];\n\n  // Logout events\n  logout: [user: Auth];\n  \"logout.all\": [user: Auth];\n  \"logout.failsafe\": [user: Auth];\n\n  // Token events\n  \"token.created\": [user: Auth, tokenPair: TokenPair];\n  \"token.refreshed\": [user: Auth, newTokenPair: TokenPair, oldRefreshToken: RefreshToken];\n  \"token.revoked\": [user: Auth, token: RefreshToken];\n  \"token.expired\": [token: RefreshToken];\n  \"token.familyRevoked\": [familyId: string, tokens: RefreshToken[]];\n\n  // Password events\n  \"password.changed\": [user: Auth];\n  \"password.resetRequested\": [user: Auth, resetToken: string];\n  \"password.reset\": [user: Auth];\n\n  // Session events\n  \"session.created\": [user: Auth, refreshToken: RefreshToken, deviceInfo?: DeviceInfo];\n  \"session.destroyed\": [user: Auth, refreshToken: RefreshToken];\n\n  // Cleanup events\n  \"cleanup.completed\": [expiredCount: number];\n};\n\n/**\n * Auth event names\n */\nexport type AuthEventName = keyof AuthEventPayloads;\n\n/**\n * Callback type for a specific event\n */\nexport type AuthEventCallback<T extends AuthEventName> = (\n  ...args: AuthEventPayloads[T]\n) => void | Promise<void>;\n\n/**\n * Event namespace prefix for auth events\n */\nconst AUTH_EVENT_PREFIX = \"auth.\";\n\n/**\n * Type-safe auth events manager\n *\n * @example\n * ```typescript\n * // Subscribe to events with full autocomplete\n * authEvents.on(\"login.success\", (user, tokenPair, deviceInfo) => {\n *   console.log(`User ${user.id} logged in`);\n * });\n *\n * authEvents.on(\"token.refreshed\", (user, newPair, oldToken) => {\n *   console.log(`Token refreshed for user ${user.id}`);\n * });\n *\n * // Trigger events\n * authEvents.emit(\"login.success\", user, tokenPair, deviceInfo);\n * ```\n */\nexport const authEvents = {\n  /**\n   * Subscribe to an auth event\n   */\n  on<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return events.subscribe(AUTH_EVENT_PREFIX + event, callback as Function);\n  },\n\n  /**\n   * Subscribe to an auth event (alias for `on`)\n   */\n  subscribe<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return this.on(event, callback);\n  },\n\n  /**\n   * Emit an auth event\n   */\n  emit<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    try {\n      events.trigger(AUTH_EVENT_PREFIX + event, ...args);\n    } catch (error) {\n      // Auth events are fire-and-forget notifications: a throwing listener must\n      // never break the flow that emitted it (e.g. turn a completed login into a\n      // 500). Log and swallow. NOTE: this guards synchronous listener throws;\n      // async listener rejections and \"later listeners still run\" need a fix in\n      // @mongez/events (tracked separately).\n      log.error(\"auth\", \"event\", error);\n    }\n  },\n\n  /**\n   * Emit an auth event (alias for `emit`)\n   */\n  trigger<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    this.emit(event, ...args);\n  },\n\n  /**\n   * Unsubscribe from all auth events\n   */\n  unsubscribeAll(): void {\n    events.unsubscribeNamespace(AUTH_EVENT_PREFIX.slice(0, -1));\n  },\n\n  /**\n   * Unsubscribe from a specific auth event\n   */\n  off(event?: AuthEventName): void {\n    if (event) {\n      events.unsubscribe(AUTH_EVENT_PREFIX + event);\n    } else {\n      this.unsubscribeAll();\n    }\n  },\n};\n"],"mappings":";;;;;;;AAuDA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;AAoB1B,MAAa,aAAa;;;;CAIxB,GAA4B,OAAU,UAAmD;EACvF,OAAO,OAAO,UAAU,oBAAoB,OAAO,QAAoB;CACzE;;;;CAKA,UAAmC,OAAU,UAAmD;EAC9F,OAAO,KAAK,GAAG,OAAO,QAAQ;CAChC;;;;CAKA,KAA8B,OAAU,GAAG,MAAkC;EAC3E,IAAI;GACF,OAAO,QAAQ,oBAAoB,OAAO,GAAG,IAAI;EACnD,SAAS,OAAO;GAMd,IAAI,MAAM,QAAQ,SAAS,KAAK;EAClC;CACF;;;;CAKA,QAAiC,OAAU,GAAG,MAAkC;EAC9E,KAAK,KAAK,OAAO,GAAG,IAAI;CAC1B;;;;CAKA,iBAAuB;EACrB,OAAO,qBAAqB,kBAAkB,MAAM,GAAG,EAAE,CAAC;CAC5D;;;;CAKA,IAAI,OAA6B;EAC/B,IAAI,OACF,OAAO,YAAY,oBAAoB,KAAK;OAE5C,KAAK,eAAe;CAExB;AACF"}