@warlock.js/auth 5.24.0 → 5.26.0

package/esm/services/auth.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport { randomUUID } from \"node:crypto\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Request,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { assertCsrfOriginAllowed } from \"../middleware/csrf-origin-check\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\nimport { OneTimeToken } from \"../models/one-time-token\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\nimport {\n  afterTokenFamilyOperation,\n  runTokenFamilyOperation,\n  TokenFamilyUnavailableError,\n} from \"./token-family-operation\";\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Resolve the active one-time-token model (default or registered override).\n   */\n  private get oneTimeTokenModel(): typeof OneTimeToken {\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n    familyId?: string,\n  ): Promise<AccessTokenOutput> {\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    if (familyId) {\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\n    } else {\n      await this.accessTokenModel.issue(user, token, expiresAt);\n    }\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n      jti: randomUUID(),\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Keep issuance into an explicitly reused family in the same durable\n   * transition boundary as rotation and revocation. A new, caller-unspecified\n   * family has no concurrent session to protect and retains the lightweight\n   * issuance path.\n   */\n  private async issueInSuppliedFamily<T>(\n    user: Auth,\n    familyId: string,\n    issue: () => Promise<T>,\n  ): Promise<T> {\n    // Preserve the established error for a family that was already revoked\n    // before issuance started. The coordinator covers a revoke that races\n    // after this observation.\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    try {\n      return await runTokenFamilyOperation(familyId, async () => issue());\n    } catch (error) {\n      // Do not expose a timing-dependent error shape to callers: a family\n      // revoked between ensure() and the transaction is the same unusable\n      // family condition as one found above.\n      if (error instanceof TokenFamilyUnavailableError) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    if (deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\n        this.issueRefreshToken(user, deviceInfo),\n      );\n    }\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    const refreshEnabled = authConfig.refreshToken.enabled();\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    if (refreshEnabled) {\n      const family = await AuthTokenFamily.ensure(user, familyId);\n\n      if (family.isRevoked) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n    }\n\n    const accessToken = await this.issueAccessToken(\n      user,\n      deviceInfo?.payload,\n      refreshEnabled ? familyId : undefined,\n    );\n    const refreshToken = await this.issueRefreshToken(\n      user,\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\n    );\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\n\n    if (refreshToken) {\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\n      );\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\n        this.issueTokenPair(user, deviceInfo),\n      );\n    }\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded: {\n      userId: number;\n      userType: string;\n      familyId: string;\n    } | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // Each serializable attempt must read the current row in its own snapshot.\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\n      if (!refreshToken.isValid) {\n        // An already-invalid token may be a replay of a rotated credential.\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.familyId);\n        }\n\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n      if (!UserModel) {\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\n      }\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n      if (!user) return null;\n\n      if (!(await this.canAuthenticate(user))) return null;\n\n      const rotationEnabled = authConfig.refreshToken.rotation();\n\n      if (rotationEnabled) {\n        const won = await refreshToken.revokeIfActive();\n\n        if (!won) {\n          // A concurrent request already rotated this token.\n          await this.revokeTokenFamily(refreshToken.familyId);\n\n          return null;\n        }\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      const newTokenPair = await this.issueTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.familyId,\n      });\n\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\n      );\n\n      return newTokenPair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\n   * a short duplicate presentation to receive the exact committed successor\n   * pair. It is deliberately not used by the legacy/public refresh API.\n   */\n  public async renewAutomaticSession(\n    refreshTokenString: string,\n    expectedUserType: string,\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo; maxAgeMs?: number } = {},\n  ): Promise<TokenPair | null> {\n    let decoded: { userId: number; userType: string; familyId: string } | null;\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n      throw error;\n    }\n\n    if (!decoded || decoded.userType !== expectedUserType) return null;\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // A retry can follow another process's committed rotation. Never reuse\n      // a model captured before the transaction or before a failed attempt.\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\n      if (!oldToken.isValid) {\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\n          this.hasSuccessor(oldToken)\n        ) {\n          return null;\n        }\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      // Rotation never extends a family past `maxAgeMs` from its first issue.\n      if (\n        options.maxAgeMs !== undefined &&\n        (await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs))\n      ) {\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n      if (!user || !(await this.canAuthenticate(user))) return null;\n\n      if (!(await oldToken.revokeIfActive())) {\n        // A newer successor is never substituted here. A stale automatic\n        // response must fail quietly rather than revoke a legitimate family.\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n        if (!currentToken) return null;\n        const successor = await this.readAutomaticSuccessor(\n          currentToken,\n          decoded,\n          options.overlapMs,\n        );\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\n          this.hasSuccessor(currentToken)\n        )\n          return null;\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const pair = await this.issueTokenPair(user, {\n        ...options.deviceInfo,\n        familyId: oldToken.familyId,\n      });\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\n      const successorRefresh = pair.refreshToken\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\n        : null;\n      if (!successorAccess || !successorRefresh) {\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\n      }\n\n      // `revokeIfActive()` updates the database, not this hydrated instance.\n      // Saving that stale instance would write its old `revoked_at: null` back\n      // and reopen the predecessor. Update only the successor columns instead.\n      const linked = await this.refreshTokenModel.atomic(\n        { id: oldToken.id },\n        {\n          $set: {\n            successor_access_token_id: successorAccess.id,\n            successor_refresh_token_id: successorRefresh.id,\n          },\n        },\n      );\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\n      return pair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Whether the family's first issue is older than `maxAgeMs`. The start is the\n   * family row's `created_at`, falling back to its oldest refresh token when\n   * the row carries none (an upserted legacy family).\n   */\n  private async familyExceedsMaxAge(familyId: string, maxAgeMs: number): Promise<boolean> {\n    const family = await AuthTokenFamily.findByFamilyId(familyId);\n    let started: unknown = family?.get(\"created_at\");\n\n    if (!started) {\n      const oldest = await this.refreshTokenModel\n        .query()\n        .where({ family_id: familyId })\n        .orderBy(\"created_at\", \"asc\")\n        .first();\n\n      started = oldest?.get(\"created_at\");\n    }\n\n    const startedAt = started ? new Date(started as string | number | Date).getTime() : NaN;\n\n    // Unknown start: nothing to measure against, so the cap cannot apply.\n    if (!Number.isFinite(startedAt)) return false;\n\n    return Date.now() - startedAt > maxAgeMs;\n  }\n\n  private automaticOverlapMs(overlapMs: number | undefined): number {\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\n      ? Math.max(0, Math.min(10_000, overlapMs))\n      : 5000;\n  }\n\n  private refreshIdentityMatches(\n    token: RefreshToken,\n    decoded: { userId: string | number; userType: string; familyId: string },\n  ): boolean {\n    return (\n      token.familyId === decoded.familyId &&\n      token.get(\"user_id\") === decoded.userId &&\n      token.get(\"user_type\") === decoded.userType\n    );\n  }\n\n  private hasSuccessor(oldToken: RefreshToken): boolean {\n    return Boolean(\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\n    );\n  }\n\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\n    const window = this.automaticOverlapMs(overlapMs);\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\n    return window > 0 && elapsed >= 0 && elapsed <= window;\n  }\n\n  private async readAutomaticSuccessor(\n    oldToken: RefreshToken,\n    decoded: { userId: number; userType: string; familyId: string },\n    overlapMs: number | undefined,\n  ): Promise<TokenPair | null> {\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\n    if (!accessId || !refreshId) return null;\n    const [access, refresh] = await Promise.all([\n      this.accessTokenModel.find(accessId),\n      this.refreshTokenModel.find(refreshId),\n    ]);\n    if (!access || access.isExpired || !refresh?.isValid) return null;\n    if (\n      access.get(\"family_id\") !== decoded.familyId ||\n      refresh.get(\"family_id\") !== decoded.familyId ||\n      access.get(\"user_id\") !== decoded.userId ||\n      refresh.get(\"user_id\") !== decoded.userId ||\n      access.get(\"user_type\") !== decoded.userType ||\n      refresh.get(\"user_type\") !== decoded.userType\n    )\n      return null;\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\n    return {\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\n    };\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Log in a user some OTHER method already authenticated — a provider\n   * callback, a passkey assertion, a one-time code. Applies the\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\n   * what {@link login} produces: the same tokens, rows and events. Pair with\n   * {@link setAuthCookie} for a cookie session, as with password login.\n   *\n   * Never call this for a user you have not authenticated.\n   */\n  public async completeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    await this.assertCanAuthenticate(user);\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Cookie login for a browser: same-origin check, credential login, then both\n   * session cookies. Unlike the default CSRF guard, the Origin/Referer check\n   * runs even when the request carries no cookies (login CSRF): a missing or\n   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any\n   * credential is looked at. Returns `null` on bad credentials.\n   */\n  public async loginWithSessionCookies<T extends Auth>(\n    request: Request,\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    assertCsrfOriginAllowed(request);\n\n    const result = await this.login(Model, credentials, deviceInfo);\n\n    if (!result) return null;\n\n    if (result.tokens.refreshToken) {\n      this.setSessionCookies(response, {\n        accessToken: result.tokens.accessToken,\n        refreshToken: result.tokens.refreshToken,\n      });\n    } else {\n      this.setAuthCookie(response, result.tokens.accessToken);\n    }\n\n    return result;\n  }\n\n  /** The one token-issuing tail every login method shares. */\n  private async finalizeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await this.revokeTokenFamily(token.familyId);\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    // Upgrade existing installations lazily before the family scan. Include\n    // revoked rows: a rotation may have revoked its predecessor while its\n    // durable family still needs logout's marker.\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\n\n    for (const token of existingRows) {\n      await AuthTokenFamily.ensure(user, token.familyId);\n    }\n\n    const families = await AuthTokenFamily.activeFor(user);\n\n    for (const family of families) {\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\n    }\n\n    // A deployment can still have rows created before the additive migration\n    // ran; retain the old bulk cleanup as a final conservative backstop.\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of legacyTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\n\n    if (!family) {\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\n\n      if (!legacyToken) return;\n\n      family = await AuthTokenFamily.ensure(\n        {\n          id: legacyToken.get(\"user_id\"),\n          userType: legacyToken.get<string>(\"user_type\"),\n        } as Auth,\n        familyId,\n      );\n    }\n\n    const user = {\n      id: family.get(\"user_id\"),\n      userType: family.get<string>(\"user_type\"),\n    } as Auth;\n\n    if (family.isRevoked) {\n      // Logout and replay containment are idempotent. Re-run cleanup because a\n      // request that lost the original race may have observed stale rows.\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n      );\n\n      return;\n    }\n\n    let revokedTokens: RefreshToken[];\n    try {\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\n        const familyUser = {\n          id: currentFamily.get(\"user_id\"),\n          userType: currentFamily.get<string>(\"user_type\"),\n        } as Auth;\n        const revision = currentFamily.get<number>(\"revision\");\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\n\n        if (revoked !== 1) {\n          throw new Error(\"Token family revoke lost its revision transition\");\n        }\n\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\n\n        return familyTokens;\n      });\n    } catch (error) {\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\n\n      // Another request committed the revoke between the read above and its\n      // CAS. A second logout is successful after idempotent cleanup.\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n    }\n\n    afterTokenFamilyOperation(() =>\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n    );\n  }\n\n  /**\n   * Delete expired tokens (refresh + access) and spent one-time tokens\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n    await this.oneTimeTokenModel.purgeSpent();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown }, options: ClearAuthCookieOptions = {}): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n\n    response.clearCookie(name, { path });\n  }\n\n  /**\n   * Write the access and refresh cookies of a browser session. Both are\n   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every\n   * page) and `Secure` outside development, named by `auth.cookie.name` and\n   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's\n   * `expiresAt`, so the cookie lives exactly as long as the token.\n   *\n   * @example\n   * const { tokens } = await authService.login(User, credentials);\n   * authService.setSessionCookies(response, tokens);\n   */\n  public setSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    tokens: { accessToken: AccessTokenOutput; refreshToken: AccessTokenOutput },\n  ): void {\n    const cookies = [\n      [authConfig.cookie.name(), tokens.accessToken],\n      [authConfig.cookie.refreshName(), tokens.refreshToken],\n    ] as const;\n\n    for (const [name, token] of cookies) {\n      const maxAge = this.cookieMaxAgeFromToken(token);\n\n      response.cookie(name, token.token, {\n        raw: true,\n        httpOnly: true,\n        sameSite: \"lax\",\n        path: \"/\",\n        ...(maxAge !== undefined ? { maxAge } : {}),\n      });\n    }\n  }\n\n  /**\n   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.\n   * Pair it with {@link logout} after the token rows are revoked.\n   */\n  public clearSessionCookies(response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown }): void {\n    response.clearCookie(authConfig.cookie.name(), { path: \"/\" });\n    response.clearCookie(authConfig.cookie.refreshName(), { path: \"/\" });\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmCA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,YAAY,MAAM,CAAC;EACpE,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,kBAAkB,MAAM,UAAU,CACzC;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eAAe,MAAY,YAA6C;EACpF,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,IAAI,gBAGF;QAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,UACjD;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,eAAe,MAAM,UAAU,CACtC;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA8E,CAAC,GACpD;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAGA,IACE,QAAQ,aAAa,UACpB,MAAM,KAAK,oBAAoB,SAAS,UAAU,QAAQ,QAAQ,GACnE;IACA,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAc,oBAAoB,UAAkB,UAAoC;EAEtF,IAAI,WAAmB,MADF,gBAAgB,eAAe,QAAQ,EAC/B,EAAE,IAAI,YAAY;EAE/C,IAAI,CAAC,SAOH,WAAU,MANW,KAAK,kBACvB,MAAM,CAAC,CACP,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,CAC9B,QAAQ,cAAc,KAAK,CAAC,CAC5B,MAAM,EAEO,EAAE,IAAI,YAAY;EAGpC,MAAM,YAAY,UAAU,IAAI,KAAK,OAAiC,CAAC,CAAC,QAAQ,IAAI;EAGpF,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;EAExC,OAAO,KAAK,IAAI,IAAI,YAAY;CAClC;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;CASA,MAAa,wBACX,SACA,UACA,OACA,aACA,YACgC;EAChC,wBAAwB,OAAO;EAE/B,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,aAAa,UAAU;EAE9D,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,OAAO,OAAO,cAChB,KAAK,kBAAkB,UAAU;GAC/B,aAAa,OAAO,OAAO;GAC3B,cAAc,OAAO,OAAO;EAC9B,CAAC;OAED,KAAK,cAAc,UAAU,OAAO,OAAO,WAAW;EAGxD,OAAO;CACT;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBAAgB,UAA8F,UAAkC,CAAC,GAAS;EAC/J,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAEpD,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;;;;;;;;;;;;CAaA,AAAO,kBACL,UACA,QACM;EACN,MAAM,UAAU,CACd,CAAC,WAAW,OAAO,KAAK,GAAG,OAAO,WAAW,GAC7C,CAAC,WAAW,OAAO,YAAY,GAAG,OAAO,YAAY,CACvD;EAEA,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;GACnC,MAAM,SAAS,KAAK,sBAAsB,KAAK;GAE/C,SAAS,OAAO,MAAM,MAAM,OAAO;IACjC,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH;CACF;;;;;CAMA,AAAO,oBAAoB,UAAoG;EAC7H,SAAS,YAAY,WAAW,OAAO,KAAK,GAAG,EAAE,MAAM,IAAI,CAAC;EAC5D,SAAS,YAAY,WAAW,OAAO,YAAY,GAAG,EAAE,MAAM,IAAI,CAAC;CACrE;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}
+{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport { randomUUID } from \"node:crypto\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Request,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { assertCsrfOriginAllowed } from \"../middleware/csrf-origin-check\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\nimport { OneTimeToken } from \"../models/one-time-token\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\nimport {\n  afterTokenFamilyOperation,\n  runTokenFamilyOperation,\n  TokenFamilyUnavailableError,\n} from \"./token-family-operation\";\n\n/** Thrown when a request-scoped cookie Domain cannot be resolved safely. */\nexport class CookieDomainRequestRequiredError extends Error {\n  public constructor(method: string) {\n    super(\n      `${method} requires the request when auth.cookie.cookieDomain is configured because the cookie Domain must be resolved for that request.`,\n    );\n    this.name = \"CookieDomainRequestRequiredError\";\n  }\n}\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Resolve the active one-time-token model (default or registered override).\n   */\n  private get oneTimeTokenModel(): typeof OneTimeToken {\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n    familyId?: string,\n  ): Promise<AccessTokenOutput> {\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    if (familyId) {\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\n    } else {\n      await this.accessTokenModel.issue(user, token, expiresAt);\n    }\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId));\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n      jti: randomUUID(),\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Keep issuance into an explicitly reused family in the same durable\n   * transition boundary as rotation and revocation. A new, caller-unspecified\n   * family has no concurrent session to protect and retains the lightweight\n   * issuance path.\n   */\n  private async issueInSuppliedFamily<T>(\n    user: Auth,\n    familyId: string,\n    issue: (family: AuthTokenFamily) => Promise<T>,\n  ): Promise<T> {\n    // Preserve the established error for a family that was already revoked\n    // before issuance started. The coordinator covers a revoke that races\n    // after this observation.\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    try {\n      return await runTokenFamilyOperation(familyId, issue);\n    } catch (error) {\n      // Do not expose a timing-dependent error shape to callers: a family\n      // revoked between ensure() and the transaction is the same unusable\n      // family condition as one found above.\n      if (error instanceof TokenFamilyUnavailableError) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    if (deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueRefreshToken(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<TokenPair> {\n    const refreshEnabled = authConfig.refreshToken.enabled();\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = refreshEnabled\n      ? (ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId)))\n      : undefined;\n\n    if (family) {\n      if (family.isRevoked) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n    }\n\n    const accessToken = await this.issueAccessToken(\n      user,\n      deviceInfo?.payload,\n      refreshEnabled ? familyId : undefined,\n    );\n    const refreshToken = await this.issueRefreshToken(\n      user,\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\n      family,\n    );\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\n\n    if (refreshToken) {\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\n      );\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueTokenPair(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded: {\n      userId: number;\n      userType: string;\n      familyId: string;\n    } | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // Each serializable attempt must read the current row in its own snapshot.\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\n      if (!refreshToken.isValid) {\n        // An already-invalid token may be a replay of a rotated credential.\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.familyId);\n        }\n\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n      if (!UserModel) {\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\n      }\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n      if (!user) return null;\n\n      if (!(await this.canAuthenticate(user))) return null;\n\n      const rotationEnabled = authConfig.refreshToken.rotation();\n\n      if (rotationEnabled) {\n        const won = await refreshToken.revokeIfActive();\n\n        if (!won) {\n          // A concurrent request already rotated this token.\n          await this.revokeTokenFamily(refreshToken.familyId);\n\n          return null;\n        }\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      const newTokenPair = await this.issueTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.familyId,\n      });\n\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\n      );\n\n      return newTokenPair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\n   * a short duplicate presentation to receive the exact committed successor\n   * pair. It is deliberately not used by the legacy/public refresh API.\n   */\n  public async renewAutomaticSession(\n    refreshTokenString: string,\n    expectedUserType: string,\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo; maxAgeMs?: number } = {},\n  ): Promise<TokenPair | null> {\n    let decoded: { userId: number; userType: string; familyId: string } | null;\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n      throw error;\n    }\n\n    if (!decoded || decoded.userType !== expectedUserType) return null;\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // A retry can follow another process's committed rotation. Never reuse\n      // a model captured before the transaction or before a failed attempt.\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\n      if (!oldToken.isValid) {\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\n          this.hasSuccessor(oldToken)\n        ) {\n          return null;\n        }\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      // Rotation never extends a family past `maxAgeMs` from its first issue.\n      if (\n        options.maxAgeMs !== undefined &&\n        (await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs))\n      ) {\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n      if (!user || !(await this.canAuthenticate(user))) return null;\n\n      if (!(await oldToken.revokeIfActive())) {\n        // A newer successor is never substituted here. A stale automatic\n        // response must fail quietly rather than revoke a legitimate family.\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n        if (!currentToken) return null;\n        const successor = await this.readAutomaticSuccessor(\n          currentToken,\n          decoded,\n          options.overlapMs,\n        );\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\n          this.hasSuccessor(currentToken)\n        )\n          return null;\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const pair = await this.issueTokenPair(user, {\n        ...options.deviceInfo,\n        familyId: oldToken.familyId,\n      });\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\n      const successorRefresh = pair.refreshToken\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\n        : null;\n      if (!successorAccess || !successorRefresh) {\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\n      }\n\n      // `revokeIfActive()` updates the database, not this hydrated instance.\n      // Saving that stale instance would write its old `revoked_at: null` back\n      // and reopen the predecessor. Update only the successor columns instead.\n      const linked = await this.refreshTokenModel.atomic(\n        { id: oldToken.id },\n        {\n          $set: {\n            successor_access_token_id: successorAccess.id,\n            successor_refresh_token_id: successorRefresh.id,\n          },\n        },\n      );\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\n      return pair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Whether the family's first issue is older than `maxAgeMs`. The start is the\n   * family row's `created_at`, falling back to its oldest refresh token when\n   * the row carries none (an upserted legacy family).\n   */\n  private async familyExceedsMaxAge(familyId: string, maxAgeMs: number): Promise<boolean> {\n    const family = await AuthTokenFamily.findByFamilyId(familyId);\n    let started: unknown = family?.get(\"created_at\");\n\n    if (!started) {\n      const oldest = await this.refreshTokenModel\n        .query()\n        .where({ family_id: familyId })\n        .orderBy(\"created_at\", \"asc\")\n        .first();\n\n      started = oldest?.get(\"created_at\");\n    }\n\n    const startedAt = started ? new Date(started as string | number | Date).getTime() : NaN;\n\n    // Unknown start: nothing to measure against, so the cap cannot apply.\n    if (!Number.isFinite(startedAt)) return false;\n\n    return Date.now() - startedAt > maxAgeMs;\n  }\n\n  private automaticOverlapMs(overlapMs: number | undefined): number {\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\n      ? Math.max(0, Math.min(10_000, overlapMs))\n      : 5000;\n  }\n\n  private refreshIdentityMatches(\n    token: RefreshToken,\n    decoded: { userId: string | number; userType: string; familyId: string },\n  ): boolean {\n    return (\n      token.familyId === decoded.familyId &&\n      token.get(\"user_id\") === decoded.userId &&\n      token.get(\"user_type\") === decoded.userType\n    );\n  }\n\n  private hasSuccessor(oldToken: RefreshToken): boolean {\n    return Boolean(\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\n    );\n  }\n\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\n    const window = this.automaticOverlapMs(overlapMs);\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\n    return window > 0 && elapsed >= 0 && elapsed <= window;\n  }\n\n  private async readAutomaticSuccessor(\n    oldToken: RefreshToken,\n    decoded: { userId: number; userType: string; familyId: string },\n    overlapMs: number | undefined,\n  ): Promise<TokenPair | null> {\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\n    if (!accessId || !refreshId) return null;\n    const [access, refresh] = await Promise.all([\n      this.accessTokenModel.find(accessId),\n      this.refreshTokenModel.find(refreshId),\n    ]);\n    if (!access || access.isExpired || !refresh?.isValid) return null;\n    if (\n      access.get(\"family_id\") !== decoded.familyId ||\n      refresh.get(\"family_id\") !== decoded.familyId ||\n      access.get(\"user_id\") !== decoded.userId ||\n      refresh.get(\"user_id\") !== decoded.userId ||\n      access.get(\"user_type\") !== decoded.userType ||\n      refresh.get(\"user_type\") !== decoded.userType\n    )\n      return null;\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\n    return {\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\n    };\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Log in a user some OTHER method already authenticated — a provider\n   * callback, a passkey assertion, a one-time code. Applies the\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\n   * what {@link login} produces: the same tokens, rows and events. Pair with\n   * {@link setAuthCookie} for a cookie session, as with password login.\n   *\n   * Never call this for a user you have not authenticated.\n   */\n  public async completeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    await this.assertCanAuthenticate(user);\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Cookie login for a browser: same-origin check, credential login, then both\n   * session cookies. Unlike the default CSRF guard, the Origin/Referer check\n   * runs even when the request carries no cookies (login CSRF): a missing or\n   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any\n   * credential is looked at. Returns `null` on bad credentials.\n   */\n  public async loginWithSessionCookies<T extends Auth>(\n    request: Request,\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    assertCsrfOriginAllowed(request);\n\n    const result = await this.login(Model, credentials, deviceInfo);\n\n    if (!result) return null;\n\n    if (result.tokens.refreshToken) {\n      this.setSessionCookies(\n        response,\n        {\n          accessToken: result.tokens.accessToken,\n          refreshToken: result.tokens.refreshToken,\n        },\n        request,\n      );\n    } else {\n      this.setAuthCookie(response, result.tokens.accessToken, {\n        domain: this.cookieDomainFor(\"loginWithSessionCookies\", request),\n      });\n    }\n\n    return result;\n  }\n\n  /** The one token-issuing tail every login method shares. */\n  private async finalizeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await this.revokeTokenFamily(token.familyId);\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    // Upgrade existing installations lazily before the family scan. Include\n    // revoked rows: a rotation may have revoked its predecessor while its\n    // durable family still needs logout's marker.\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\n\n    for (const token of existingRows) {\n      await AuthTokenFamily.ensure(user, token.familyId);\n    }\n\n    const families = await AuthTokenFamily.activeFor(user);\n\n    for (const family of families) {\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\n    }\n\n    // A deployment can still have rows created before the additive migration\n    // ran; retain the old bulk cleanup as a final conservative backstop.\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of legacyTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\n\n    if (!family) {\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\n\n      if (!legacyToken) return;\n\n      family = await AuthTokenFamily.ensure(\n        {\n          id: legacyToken.get(\"user_id\"),\n          userType: legacyToken.get<string>(\"user_type\"),\n        } as Auth,\n        familyId,\n      );\n    }\n\n    const user = {\n      id: family.get(\"user_id\"),\n      userType: family.get<string>(\"user_type\"),\n    } as Auth;\n\n    if (family.isRevoked) {\n      // Logout and replay containment are idempotent. Re-run cleanup because a\n      // request that lost the original race may have observed stale rows.\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n      );\n\n      return;\n    }\n\n    let revokedTokens: RefreshToken[];\n    try {\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\n        const familyUser = {\n          id: currentFamily.get(\"user_id\"),\n          userType: currentFamily.get<string>(\"user_type\"),\n        } as Auth;\n        const revision = currentFamily.get<number>(\"revision\");\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\n\n        if (revoked !== 1) {\n          throw new Error(\"Token family revoke lost its revision transition\");\n        }\n\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\n\n        return familyTokens;\n      });\n    } catch (error) {\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\n\n      // Another request committed the revoke between the read above and its\n      // CAS. A second logout is successful after idempotent cleanup.\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n    }\n\n    afterTokenFamilyOperation(() =>\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n    );\n  }\n\n  /**\n   * Delete expired tokens (refresh + access) and spent one-time tokens\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n    await this.oneTimeTokenModel.purgeSpent();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  private cookieDomainFor(method: string, request?: Request): string | undefined {\n    const resolver = authConfig.cookie.cookieDomain();\n\n    if (!resolver) {\n      return undefined;\n    }\n\n    if (!request) {\n      throw new CookieDomainRequestRequiredError(method);\n    }\n\n    return resolver(request);\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(options.domain !== undefined ? { domain: options.domain } : {}),\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    options: ClearAuthCookieOptions = {},\n    request?: Request,\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const domain = this.cookieDomainFor(\"clearAuthCookie\", request);\n\n    if (domain !== undefined) {\n      response.clearCookie(name, { path, domain });\n    }\n\n    response.clearCookie(name, { path });\n  }\n\n  /**\n   * Write the access and refresh cookies of a browser session. Both are\n   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every\n   * page) and `Secure` outside development, named by `auth.cookie.name` and\n   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's\n   * `expiresAt`, so the cookie lives exactly as long as the token.\n   *\n   * @example\n   * const { tokens } = await authService.login(User, credentials);\n   * authService.setSessionCookies(response, tokens);\n   */\n  public setSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    tokens: { accessToken: AccessTokenOutput; refreshToken: AccessTokenOutput },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"setSessionCookies\", request);\n    const cookies = [\n      [authConfig.cookie.name(), tokens.accessToken],\n      [authConfig.cookie.refreshName(), tokens.refreshToken],\n    ] as const;\n\n    for (const [name, token] of cookies) {\n      const maxAge = this.cookieMaxAgeFromToken(token);\n\n      response.cookie(name, token.token, {\n        raw: true,\n        httpOnly: true,\n        sameSite: \"lax\",\n        path: \"/\",\n        ...(domain !== undefined ? { domain } : {}),\n        ...(maxAge !== undefined ? { maxAge } : {}),\n      });\n    }\n  }\n\n  /**\n   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.\n   * Pair it with {@link logout} after the token rows are revoked.\n   */\n  public clearSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"clearSessionCookies\", request);\n\n    for (const name of [authConfig.cookie.name(), authConfig.cookie.refreshName()]) {\n      if (domain !== undefined) {\n        response.clearCookie(name, { path: \"/\", domain });\n      }\n\n      response.clearCookie(name, { path: \"/\" });\n    }\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoCA,IAAa,mCAAb,cAAsD,MAAM;CAC1D,AAAO,YAAY,QAAgB;EACjC,MACE,GAAG,OAAO,+HACZ;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACA,eACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAFe,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,EAElE,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,KAAK;EACtD,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,kBAAkB,MAAM,YAAY,MAAM,CACjD;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eACZ,MACA,YACA,eACoB;EACpB,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,SAAS,iBACV,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,IAC9D;EAEJ,IAAI,QACF;OAAI,OAAO,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,YAC/C,MACF;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,eAAe,MAAM,YAAY,MAAM,CAC9C;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA8E,CAAC,GACpD;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAGA,IACE,QAAQ,aAAa,UACpB,MAAM,KAAK,oBAAoB,SAAS,UAAU,QAAQ,QAAQ,GACnE;IACA,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAc,oBAAoB,UAAkB,UAAoC;EAEtF,IAAI,WAAmB,MADF,gBAAgB,eAAe,QAAQ,EAC/B,EAAE,IAAI,YAAY;EAE/C,IAAI,CAAC,SAOH,WAAU,MANW,KAAK,kBACvB,MAAM,CAAC,CACP,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,CAC9B,QAAQ,cAAc,KAAK,CAAC,CAC5B,MAAM,EAEO,EAAE,IAAI,YAAY;EAGpC,MAAM,YAAY,UAAU,IAAI,KAAK,OAAiC,CAAC,CAAC,QAAQ,IAAI;EAGpF,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;EAExC,OAAO,KAAK,IAAI,IAAI,YAAY;CAClC;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;CASA,MAAa,wBACX,SACA,UACA,OACA,aACA,YACgC;EAChC,wBAAwB,OAAO;EAE/B,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,aAAa,UAAU;EAE9D,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,OAAO,OAAO,cAChB,KAAK,kBACH,UACA;GACE,aAAa,OAAO,OAAO;GAC3B,cAAc,OAAO,OAAO;EAC9B,GACA,OACF;OAEA,KAAK,cAAc,UAAU,OAAO,OAAO,aAAa,EACtD,QAAQ,KAAK,gBAAgB,2BAA2B,OAAO,EACjE,CAAC;EAGH,OAAO;CACT;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;CAEA,AAAQ,gBAAgB,QAAgB,SAAuC;EAC7E,MAAM,WAAW,WAAW,OAAO,aAAa;EAEhD,IAAI,CAAC,UACH;EAGF,IAAI,CAAC,SACH,MAAM,IAAI,iCAAiC,MAAM;EAGnD,OAAO,SAAS,OAAO;CACzB;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBACL,UACA,UAAkC,CAAC,GACnC,SACM;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,SAAS,KAAK,gBAAgB,mBAAmB,OAAO;EAE9D,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;GAAE;GAAM;EAAO,CAAC;EAG7C,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;;;;;;;;;;;;CAaA,AAAO,kBACL,UACA,QACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,qBAAqB,OAAO;EAChE,MAAM,UAAU,CACd,CAAC,WAAW,OAAO,KAAK,GAAG,OAAO,WAAW,GAC7C,CAAC,WAAW,OAAO,YAAY,GAAG,OAAO,YAAY,CACvD;EAEA,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;GACnC,MAAM,SAAS,KAAK,sBAAsB,KAAK;GAE/C,SAAS,OAAO,MAAM,MAAM,OAAO;IACjC,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;IACzC,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH;CACF;;;;;CAMA,AAAO,oBACL,UACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,uBAAuB,OAAO;EAElE,KAAK,MAAM,QAAQ,CAAC,WAAW,OAAO,KAAK,GAAG,WAAW,OAAO,YAAY,CAAC,GAAG;GAC9E,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;IAAE,MAAM;IAAK;GAAO,CAAC;GAGlD,SAAS,YAAY,MAAM,EAAE,MAAM,IAAI,CAAC;EAC1C;CACF;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}

package/esm/services/index.d.mts

@@ -1,5 +1,5 @@
 import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from "./auth-events.mjs";
-import { authService } from "./auth.service.mjs";
+import { CookieDomainRequestRequiredError, authService } from "./auth.service.mjs";
 import { currentUser } from "./current-user.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
 import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";

package/esm/services/index.mjs

@@ -1,6 +1,6 @@
 import { authEvents } from "./auth-events.mjs";
 import { TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
-import { authService } from "./auth.service.mjs";
+import { CookieDomainRequestRequiredError, authService } from "./auth.service.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
 import { readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./resolve-request-user.mjs";
 import { currentUser } from "./current-user.mjs";

package/esm/services/resolve-request-user.d.mts

@@ -1,4 +1,4 @@
-import { TokenFrom } from "../contracts/types.mjs";
+import { CookieDomainResolver, TokenFrom } from "../contracts/types.mjs";
 import { Request, Response } from "@warlock.js/core";
 
 //#region ../auth/src/services/resolve-request-user.d.ts
@@ -8,7 +8,8 @@ type ResolveRequestUserOptions = {
   overlapMs?: number; /** User types allowed to pass. Empty means any authenticated type. */
   allowedTypes?: string[]; /** Absolute family lifetime in ms; rotation never extends a family past it. */
   maxAgeMs?: number; /** The single user type a renewal mints for. Required for renewal. */
-  renewalUserType?: string;
+  renewalUserType?: string; /** Select a request-scoped Domain for renewed cookies. */
+  cookieDomain?: CookieDomainResolver;
 };
 /**
  * Why a request did not resolve to a user. The middleware maps each reason to

package/esm/services/resolve-request-user.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../auth/src/services/resolve-request-user.ts"],"mappings":";;;;KAgBY,yBAAA;qEAEV,SAAA,GAAY,SAAA,EAFuB;EAInC,iBAAA,GAAoB,SAAS,EAAA;EAE7B,SAAA,WAJY;EAMZ,YAAA,aAJoB;EAMpB,QAAA,WAFA;EAIA,eAAA;AAAA;;AAAe;AAOjB;;KAAY,kBAAA;AAAA,KAEA,kBAAA;EACN,IAAA,EAAM,KAAA;EAAO,OAAA;AAAA;EACb,IAAA;EAAY,OAAA,EAAS,kBAAkB;AAAA;;iBAoB7B,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,SAAS;;;;;;AApBxB;AAoB7C;;;;;iBAqBsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,kBAAA;;;;AAzB0D;AAqBrE;;;iBAqHgB,kBAAA,CACd,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA"}
+{"version":3,"file":"resolve-request-user.d.mts","names":[],"sources":["../../../../../../../auth/src/services/resolve-request-user.ts"],"mappings":";;;;KAgBY,yBAAA;qEAEV,SAAA,GAAY,SAAA,EAFuB;EAInC,iBAAA,GAAoB,SAAA,EAFR;EAIZ,SAAA,WAQe;EANf,YAAA,aAMmC;EAJnC,QAAA,WARY;EAUZ,eAAA,WARoB;EAUpB,YAAA,GAAe,oBAAA;AAAA;;;;;KAOL,kBAAA;AAAA,KAEA,kBAAA;EACR,IAAA,EAAM,KAAA;EAAO,OAAA;AAAA;EAA0B,IAAA;EAAY,OAAA,EAAS,kBAAkB;AAAA;;iBAoBlE,cAAA,CAAe,OAAA,EAAS,OAAA,EAAS,SAAA,EAAW,SAAS;;;;;;;;;;AApBa;AAoBlF;iBAqBsB,yBAAA,CACpB,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA,CAAQ,kBAAA;;;;;;;;iBAmHK,kBAAA,CACd,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,GAAS,yBAAA,GACR,OAAA"}

package/esm/services/resolve-request-user.mjs

@@ -55,8 +55,14 @@ async function resolveRequestUserOutcome(request, response, options = {}) {
 			maxAgeMs: options.maxAgeMs
 		});
 		if (!pair?.refreshToken) return false;
-		authService.setAuthCookie(response, pair.accessToken, { name: tokenFrom.slice(7) });
-		authService.setAuthCookie(response, pair.refreshToken, { name: refreshCredential.slice(7) });
+		authService.setAuthCookie(response, pair.accessToken, {
+			name: tokenFrom.slice(7),
+			domain: options.cookieDomain?.(request)
+		});
+		authService.setAuthCookie(response, pair.refreshToken, {
+			name: refreshCredential.slice(7),
+			domain: options.cookieDomain?.(request)
+		});
 		authorizationValue = pair.accessToken.token;
 		return true;
 	};

package/esm/services/resolve-request-user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-user.mjs","names":[],"sources":["../../../../../../../auth/src/services/resolve-request-user.ts"],"sourcesContent":["import { config, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type { TokenFrom } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport { authService } from \"./auth.service\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\n/**\n * Decoded access-token claims the resolver reads. The full payload carries\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\n */\ntype DecodedAccessToken = {\n  id: string | number;\n  userType?: string;\n};\n\nexport type ResolveRequestUserOptions = {\n  /** Where the access token is read from. Defaults to `\"header\"`. */\n  tokenFrom?: TokenFrom;\n  /** Refresh credential source; enables one automatic renewal per call. */\n  refreshCredential?: TokenFrom;\n  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */\n  overlapMs?: number;\n  /** User types allowed to pass. Empty means any authenticated type. */\n  allowedTypes?: string[];\n  /** Absolute family lifetime in ms; rotation never extends a family past it. */\n  maxAgeMs?: number;\n  /** The single user type a renewal mints for. Required for renewal. */\n  renewalUserType?: string;\n};\n\n/**\n * Why a request did not resolve to a user. The middleware maps each reason to\n * its own response; `resolveRequestUser` collapses them all to `null`.\n */\nexport type RequestUserFailure = \"missing\" | \"invalid\" | \"forbidden\" | \"unauthorized\";\n\nexport type RequestUserOutcome<TUser = any> =\n  | { user: TUser; failure?: undefined }\n  | { user: null; failure: RequestUserFailure };\n\n/**\n * Whether the persisted row says the token is dead.\n *\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\n * override that renames or reshapes its expiry column stays authoritative. A\n * row that cannot answer at all — an override that dropped the getter — is\n * treated as **expired**: a check must never quietly answer \"fine\" when it has\n * nothing to check.\n *\n * This is independent of the `exp` claim required by `jwt.verify`: that guard\n * catches a token whose *claims* carry no deadline; this one catches a token\n * whose *row* says the deadline has passed.\n */\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\n}\n\n/** Read one credential (access or refresh) from the header or a cookie. */\nexport function readCredential(request: Request, tokenFrom: TokenFrom): string {\n  if (tokenFrom === \"header\") {\n    return request.authorizationValue;\n  }\n\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\n\n  return value ? String(value) : \"\";\n}\n\n/**\n * Resolve a request's credential to a user, reporting WHY it failed.\n *\n * Side effects match what `authMiddleware` always did: `request.locals.user` is\n * cleared on every failure, `request.decodedAccessToken` is set once a token\n * verifies, and stale rows are destroyed. It does NOT set `request.locals.user`\n * on success — the caller decides that.\n *\n * At most one renewal is attempted per call. The renewed access token is\n * checked through the same path; no handler or unsafe request replay happens.\n */\nexport async function resolveRequestUserOutcome(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<RequestUserOutcome> {\n  const tokenFrom = options.tokenFrom ?? \"header\";\n  const allowedTypes = options.allowedTypes ?? [];\n  const { refreshCredential } = options;\n  let authorizationValue = readCredential(request, tokenFrom);\n  let renewalAttempted = false;\n\n  const renew = async (): Promise<boolean> => {\n    if (!refreshCredential || renewalAttempted) return false;\n\n    renewalAttempted = true;\n    const refreshToken = readCredential(request, refreshCredential);\n    if (!refreshToken) return false;\n\n    const pair = await authService.renewAutomaticSession(refreshToken, options.renewalUserType!, {\n      overlapMs: options.overlapMs,\n      maxAgeMs: options.maxAgeMs,\n    });\n    if (!pair?.refreshToken) return false;\n\n    authService.setAuthCookie(response, pair.accessToken, {\n      name: tokenFrom.slice(\"cookie:\".length),\n    });\n    authService.setAuthCookie(response, pair.refreshToken, {\n      name: refreshCredential.slice(\"cookie:\".length),\n    });\n    authorizationValue = pair.accessToken.token;\n\n    return true;\n  };\n\n  const fail = (failure: RequestUserFailure): RequestUserOutcome => {\n    request.locals.user = undefined;\n\n    return { user: null, failure };\n  };\n\n  let decoded: DecodedAccessToken;\n  let accessToken: AccessToken | null;\n\n  while (true) {\n    if (!authorizationValue) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"missing\");\n    }\n\n    try {\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\n    } catch (error) {\n      if (!isInvalidCredentialError(error)) throw error;\n      log.error(\"http\", \"auth\", error);\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    request.decodedAccessToken = decoded;\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\n    accessToken = await AccessTokenModel.findByToken(authorizationValue);\n\n    if (!accessToken) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    if (accessTokenRowIsExpired(accessToken)) {\n      await accessToken.destroy();\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    break;\n  }\n\n  const userType = decoded.userType ?? accessToken.userType;\n\n  if (allowedTypes.length && !allowedTypes.includes(userType)) {\n    return { user: null, failure: \"forbidden\" };\n  }\n\n  const UserModel = config.key(`auth.userType.${userType}`);\n\n  if (!UserModel) {\n    // Configuration, not credentials. Throwing keeps a mis-registered app\n    // loudly broken instead of quietly rejecting every request of this type.\n    throw new Error(`User type ${userType} is unknown type.`);\n  }\n\n  const currentUser = await UserModel.find(decoded.id);\n\n  if (!currentUser) {\n    await accessToken.destroy();\n\n    return fail(\"invalid\");\n  }\n\n  if (!(await authService.canAuthenticate(currentUser))) {\n    return fail(\"unauthorized\");\n  }\n\n  return { user: currentUser };\n}\n\n/**\n * Resolve the request's credential to its user model, or `null` when there is\n * none (missing, invalid, expired, wrong type, or not allowed to authenticate).\n *\n * Includes the middleware's automatic renewal when `options.refreshCredential`\n * is set. Use `resolveRequestUserOutcome` when the failure reason matters.\n */\nexport function resolveRequestUser(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<any> {\n  // Single-flight: the PROMISE is stored, so concurrent and repeat callers in\n  // one request share one verify, one lookup and at most one renewal. The first\n  // caller's options win for the rest of the request.\n  if (!request.locals.session) {\n    request.locals.session = resolveRequestUserOutcome(request, response, options).then(\n      outcome => outcome.user,\n    );\n  }\n\n  return request.locals.session;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsDA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;;AAGA,SAAgB,eAAe,SAAkB,WAA8B;CAC7E,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;AAaA,eAAsB,0BACpB,SACA,UACA,UAAqC,CAAC,GACT;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,eAAe,QAAQ,gBAAgB,CAAC;CAC9C,MAAM,EAAE,sBAAsB;CAC9B,IAAI,qBAAqB,eAAe,SAAS,SAAS;CAC1D,IAAI,mBAAmB;CAEvB,MAAM,QAAQ,YAA8B;EAC1C,IAAI,CAAC,qBAAqB,kBAAkB,OAAO;EAEnD,mBAAmB;EACnB,MAAM,eAAe,eAAe,SAAS,iBAAiB;EAC9D,IAAI,CAAC,cAAc,OAAO;EAE1B,MAAM,OAAO,MAAM,YAAY,sBAAsB,cAAc,QAAQ,iBAAkB;GAC3F,WAAW,QAAQ;GACnB,UAAU,QAAQ;EACpB,CAAC;EACD,IAAI,CAAC,MAAM,cAAc,OAAO;EAEhC,YAAY,cAAc,UAAU,KAAK,aAAa,EACpD,MAAM,UAAU,MAAM,CAAgB,EACxC,CAAC;EACD,YAAY,cAAc,UAAU,KAAK,cAAc,EACrD,MAAM,kBAAkB,MAAM,CAAgB,EAChD,CAAC;EACD,qBAAqB,KAAK,YAAY;EAEtC,OAAO;CACT;CAEA,MAAM,QAAQ,YAAoD;EAChE,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE,MAAM;GAAM;EAAQ;CAC/B;CAEA,IAAI;CACJ,IAAI;CAEJ,OAAO,MAAM;EACX,IAAI,CAAC,oBAAoB;GACvB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAAG,MAAM;GAC5C,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,QAAQ,qBAAqB;EAE7B,cAAc,MADW,OAAO,IAAI,0BAA0B,WAC3B,CAAC,CAAC,YAAY,kBAAkB;EAEnE,IAAI,CAAC,aAAa;GAChB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAC1B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA;CACF;CAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;CAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO;EAAE,MAAM;EAAM,SAAS;CAAY;CAG5C,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;CAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;CAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;CAEnD,IAAI,CAAC,aAAa;EAChB,MAAM,YAAY,QAAQ;EAE1B,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,KAAK,cAAc;CAG5B,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;;AASA,SAAgB,mBACd,SACA,UACA,UAAqC,CAAC,GACxB;CAId,IAAI,CAAC,QAAQ,OAAO,SAClB,QAAQ,OAAO,UAAU,0BAA0B,SAAS,UAAU,OAAO,CAAC,CAAC,MAC7E,YAAW,QAAQ,IACrB;CAGF,OAAO,QAAQ,OAAO;AACxB"}
+{"version":3,"file":"resolve-request-user.mjs","names":[],"sources":["../../../../../../../auth/src/services/resolve-request-user.ts"],"sourcesContent":["import { config, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type { CookieDomainResolver, TokenFrom } from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport { authService } from \"./auth.service\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\n/**\n * Decoded access-token claims the resolver reads. The full payload carries\n * more (`created_at`, `tokenType`, `iat`, `exp`) but only these drive routing.\n */\ntype DecodedAccessToken = {\n  id: string | number;\n  userType?: string;\n};\n\nexport type ResolveRequestUserOptions = {\n  /** Where the access token is read from. Defaults to `\"header\"`. */\n  tokenFrom?: TokenFrom;\n  /** Refresh credential source; enables one automatic renewal per call. */\n  refreshCredential?: TokenFrom;\n  /** Refresh overlap window forwarded to `authService.renewAutomaticSession`. */\n  overlapMs?: number;\n  /** User types allowed to pass. Empty means any authenticated type. */\n  allowedTypes?: string[];\n  /** Absolute family lifetime in ms; rotation never extends a family past it. */\n  maxAgeMs?: number;\n  /** The single user type a renewal mints for. Required for renewal. */\n  renewalUserType?: string;\n  /** Select a request-scoped Domain for renewed cookies. */\n  cookieDomain?: CookieDomainResolver;\n};\n\n/**\n * Why a request did not resolve to a user. The middleware maps each reason to\n * its own response; `resolveRequestUser` collapses them all to `null`.\n */\nexport type RequestUserFailure = \"missing\" | \"invalid\" | \"forbidden\" | \"unauthorized\";\n\nexport type RequestUserOutcome<TUser = any> =\n  { user: TUser; failure?: undefined } | { user: null; failure: RequestUserFailure };\n\n/**\n * Whether the persisted row says the token is dead.\n *\n * The answer belongs to the model (`AccessToken.isExpired`), so a registered\n * override that renames or reshapes its expiry column stays authoritative. A\n * row that cannot answer at all — an override that dropped the getter — is\n * treated as **expired**: a check must never quietly answer \"fine\" when it has\n * nothing to check.\n *\n * This is independent of the `exp` claim required by `jwt.verify`: that guard\n * catches a token whose *claims* carry no deadline; this one catches a token\n * whose *row* says the deadline has passed.\n */\nfunction accessTokenRowIsExpired(accessToken: AccessToken): boolean {\n  return typeof accessToken.isExpired === \"boolean\" ? accessToken.isExpired : true;\n}\n\n/** Read one credential (access or refresh) from the header or a cookie. */\nexport function readCredential(request: Request, tokenFrom: TokenFrom): string {\n  if (tokenFrom === \"header\") {\n    return request.authorizationValue;\n  }\n\n  const value = request.cookie(tokenFrom.slice(\"cookie:\".length));\n\n  return value ? String(value) : \"\";\n}\n\n/**\n * Resolve a request's credential to a user, reporting WHY it failed.\n *\n * Side effects match what `authMiddleware` always did: `request.locals.user` is\n * cleared on every failure, `request.decodedAccessToken` is set once a token\n * verifies, and stale rows are destroyed. It does NOT set `request.locals.user`\n * on success — the caller decides that.\n *\n * At most one renewal is attempted per call. The renewed access token is\n * checked through the same path; no handler or unsafe request replay happens.\n */\nexport async function resolveRequestUserOutcome(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<RequestUserOutcome> {\n  const tokenFrom = options.tokenFrom ?? \"header\";\n  const allowedTypes = options.allowedTypes ?? [];\n  const { refreshCredential } = options;\n  let authorizationValue = readCredential(request, tokenFrom);\n  let renewalAttempted = false;\n\n  const renew = async (): Promise<boolean> => {\n    if (!refreshCredential || renewalAttempted) return false;\n\n    renewalAttempted = true;\n    const refreshToken = readCredential(request, refreshCredential);\n    if (!refreshToken) return false;\n\n    const pair = await authService.renewAutomaticSession(refreshToken, options.renewalUserType!, {\n      overlapMs: options.overlapMs,\n      maxAgeMs: options.maxAgeMs,\n    });\n    if (!pair?.refreshToken) return false;\n\n    authService.setAuthCookie(response, pair.accessToken, {\n      name: tokenFrom.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authService.setAuthCookie(response, pair.refreshToken, {\n      name: refreshCredential.slice(\"cookie:\".length),\n      domain: options.cookieDomain?.(request),\n    });\n    authorizationValue = pair.accessToken.token;\n\n    return true;\n  };\n\n  const fail = (failure: RequestUserFailure): RequestUserOutcome => {\n    request.locals.user = undefined;\n\n    return { user: null, failure };\n  };\n\n  let decoded: DecodedAccessToken;\n  let accessToken: AccessToken | null;\n\n  while (true) {\n    if (!authorizationValue) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"missing\");\n    }\n\n    try {\n      decoded = await jwt.verify<DecodedAccessToken>(authorizationValue);\n    } catch (error) {\n      if (!isInvalidCredentialError(error)) throw error;\n      log.error(\"http\", \"auth\", error);\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    request.decodedAccessToken = decoded;\n    const AccessTokenModel = config.key(\"auth.accessToken.model\", AccessToken);\n    accessToken = await AccessTokenModel.findByToken(authorizationValue);\n\n    if (!accessToken) {\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    if (accessTokenRowIsExpired(accessToken)) {\n      await accessToken.destroy();\n      request.locals.user = undefined;\n      if (await renew()) continue;\n      return fail(\"invalid\");\n    }\n\n    break;\n  }\n\n  const userType = decoded.userType ?? accessToken.userType;\n\n  if (allowedTypes.length && !allowedTypes.includes(userType)) {\n    return { user: null, failure: \"forbidden\" };\n  }\n\n  const UserModel = config.key(`auth.userType.${userType}`);\n\n  if (!UserModel) {\n    // Configuration, not credentials. Throwing keeps a mis-registered app\n    // loudly broken instead of quietly rejecting every request of this type.\n    throw new Error(`User type ${userType} is unknown type.`);\n  }\n\n  const currentUser = await UserModel.find(decoded.id);\n\n  if (!currentUser) {\n    await accessToken.destroy();\n\n    return fail(\"invalid\");\n  }\n\n  if (!(await authService.canAuthenticate(currentUser))) {\n    return fail(\"unauthorized\");\n  }\n\n  return { user: currentUser };\n}\n\n/**\n * Resolve the request's credential to its user model, or `null` when there is\n * none (missing, invalid, expired, wrong type, or not allowed to authenticate).\n *\n * Includes the middleware's automatic renewal when `options.refreshCredential`\n * is set. Use `resolveRequestUserOutcome` when the failure reason matters.\n */\nexport function resolveRequestUser(\n  request: Request,\n  response: Response,\n  options: ResolveRequestUserOptions = {},\n): Promise<any> {\n  // Single-flight: the PROMISE is stored, so concurrent and repeat callers in\n  // one request share one verify, one lookup and at most one renewal. The first\n  // caller's options win for the rest of the request.\n  if (!request.locals.session) {\n    request.locals.session = resolveRequestUserOutcome(request, response, options).then(\n      (outcome) => outcome.user,\n    );\n  }\n\n  return request.locals.session;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuDA,SAAS,wBAAwB,aAAmC;CAClE,OAAO,OAAO,YAAY,cAAc,YAAY,YAAY,YAAY;AAC9E;;AAGA,SAAgB,eAAe,SAAkB,WAA8B;CAC7E,IAAI,cAAc,UAChB,OAAO,QAAQ;CAGjB,MAAM,QAAQ,QAAQ,OAAO,UAAU,MAAM,CAAgB,CAAC;CAE9D,OAAO,QAAQ,OAAO,KAAK,IAAI;AACjC;;;;;;;;;;;;AAaA,eAAsB,0BACpB,SACA,UACA,UAAqC,CAAC,GACT;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,eAAe,QAAQ,gBAAgB,CAAC;CAC9C,MAAM,EAAE,sBAAsB;CAC9B,IAAI,qBAAqB,eAAe,SAAS,SAAS;CAC1D,IAAI,mBAAmB;CAEvB,MAAM,QAAQ,YAA8B;EAC1C,IAAI,CAAC,qBAAqB,kBAAkB,OAAO;EAEnD,mBAAmB;EACnB,MAAM,eAAe,eAAe,SAAS,iBAAiB;EAC9D,IAAI,CAAC,cAAc,OAAO;EAE1B,MAAM,OAAO,MAAM,YAAY,sBAAsB,cAAc,QAAQ,iBAAkB;GAC3F,WAAW,QAAQ;GACnB,UAAU,QAAQ;EACpB,CAAC;EACD,IAAI,CAAC,MAAM,cAAc,OAAO;EAEhC,YAAY,cAAc,UAAU,KAAK,aAAa;GACpD,MAAM,UAAU,MAAM,CAAgB;GACtC,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,YAAY,cAAc,UAAU,KAAK,cAAc;GACrD,MAAM,kBAAkB,MAAM,CAAgB;GAC9C,QAAQ,QAAQ,eAAe,OAAO;EACxC,CAAC;EACD,qBAAqB,KAAK,YAAY;EAEtC,OAAO;CACT;CAEA,MAAM,QAAQ,YAAoD;EAChE,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE,MAAM;GAAM;EAAQ;CAC/B;CAEA,IAAI;CACJ,IAAI;CAEJ,OAAO,MAAM;EACX,IAAI,CAAC,oBAAoB;GACvB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI;GACF,UAAU,MAAM,IAAI,OAA2B,kBAAkB;EACnE,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GAAG,MAAM;GAC5C,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,QAAQ,qBAAqB;EAE7B,cAAc,MADW,OAAO,IAAI,0BAA0B,WAC3B,CAAC,CAAC,YAAY,kBAAkB;EAEnE,IAAI,CAAC,aAAa;GAChB,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA,IAAI,wBAAwB,WAAW,GAAG;GACxC,MAAM,YAAY,QAAQ;GAC1B,QAAQ,OAAO,OAAO;GACtB,IAAI,MAAM,MAAM,GAAG;GACnB,OAAO,KAAK,SAAS;EACvB;EAEA;CACF;CAEA,MAAM,WAAW,QAAQ,YAAY,YAAY;CAEjD,IAAI,aAAa,UAAU,CAAC,aAAa,SAAS,QAAQ,GACxD,OAAO;EAAE,MAAM;EAAM,SAAS;CAAY;CAG5C,MAAM,YAAY,OAAO,IAAI,iBAAiB,UAAU;CAExD,IAAI,CAAC,WAGH,MAAM,IAAI,MAAM,aAAa,SAAS,kBAAkB;CAG1D,MAAM,cAAc,MAAM,UAAU,KAAK,QAAQ,EAAE;CAEnD,IAAI,CAAC,aAAa;EAChB,MAAM,YAAY,QAAQ;EAE1B,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,CAAE,MAAM,YAAY,gBAAgB,WAAW,GACjD,OAAO,KAAK,cAAc;CAG5B,OAAO,EAAE,MAAM,YAAY;AAC7B;;;;;;;;AASA,SAAgB,mBACd,SACA,UACA,UAAqC,CAAC,GACxB;CAId,IAAI,CAAC,QAAQ,OAAO,SAClB,QAAQ,OAAO,UAAU,0BAA0B,SAAS,UAAU,OAAO,CAAC,CAAC,MAC5E,YAAY,QAAQ,IACvB;CAGF,OAAO,QAAQ,OAAO;AACxB"}

package/esm/session/page-session.d.mts

@@ -1,3 +1,4 @@
+import { CookieDomainResolver } from "../contracts/types.mjs";
 import { Middleware, Request, Response } from "@warlock.js/core";
 
 //#region ../auth/src/session/page-session.d.ts
@@ -21,7 +22,8 @@ type SessionResolverOptions = {
   renew?: boolean; /** Allowed user types. @default auth.defaultUserType */
   userTypes?: string | string[]; /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else "30d" */
   maxAge?: string | number; /** Refresh overlap window forwarded to renewal. */
-  overlapMs?: number;
+  overlapMs?: number; /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */
+  cookieDomain?: CookieDomainResolver;
 };
 type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {
   /** Model → wire projection. Required: a model never crosses the wire by default. */project: (model: TModel) => TUser | Promise<TUser>;

package/esm/session/page-session.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../auth/src/session/page-session.ts"],"mappings":";;;;KAaY,aAAA;AAAZ;;;;AAAyB;AAAzB,KAUY,mBAAA;EACV,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAA,GAAW,OAAA;IAAU,KAAA,EAAO,MAAA;IAAQ,IAAA,EAAM,KAAA;EAAA;AAAA;AAAA,KAGpE,sBAAA;EAHqC,oDAK/C,MAAA,WALsD;EAOtD,aAAA,WARgD;EAUhD,OAAA,GAAU,aAAa,IATN;EAWjB,KAAA,YAXoC;EAapC,SAAA,sBAb+C;EAe/C,MAAA,oBAfgE;EAiBhE,SAAA;AAAA;AAAA,KAGU,kBAAA,kBAAoC,sBAAA;EApBqC,oFAsBnF,OAAA,GAAU,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAA,CAAQ,KAAA;AAAA;AAAA,KAGlC,wBAAA,GAA2B,sBAAsB;EAhBpC,uEAkBvB,QAAQ;AAAA;;;;;;;;iBA+EM,WAAA,gCACd,OAAA,EAAS,kBAAA,CAAmB,MAAA,EAAQ,KAAA,IACnC,mBAAA,CAAoB,MAAA,EAAQ,KAAA;AAxF/B;;;;;;AAAA,iBA2HgB,iBAAA,CAAkB,OAAA,GAAS,wBAAA,GAAgC,UAAU"}
+{"version":3,"file":"page-session.d.mts","names":[],"sources":["../../../../../../../auth/src/session/page-session.ts"],"mappings":";;;;;KAcY,aAAA;AAAZ;;;;AAAyB;AAAzB,KAUY,mBAAA;EACV,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,QAAA,EAAU,QAAA,GAAW,OAAA;IAAU,KAAA,EAAO,MAAA;IAAQ,IAAA,EAAM,KAAA;EAAA;AAAA;AAAA,KAGpE,sBAAA;EAHqC,oDAK/C,MAAA,WALsD;EAOtD,aAAA,WARgD;EAUhD,OAAA,GAAU,aAAA,IATO;EAWjB,KAAA,YAXoC;EAapC,SAAA,sBAb+C;EAe/C,MAAA,oBAfgE;EAiBhE,SAAA,WAjB8E;EAmB9E,YAAA,GAAe,oBAAoB;AAAA;AAAA,KAGzB,kBAAA,kBAAoC,sBAAA;EAnBd,oFAqBhC,OAAA,GAAU,KAAA,EAAO,MAAA,KAAW,KAAA,GAAQ,OAAA,CAAQ,KAAA;AAAA;AAAA,KAGlC,wBAAA,GAA2B,sBAAsB;EApB3D,uEAsBA,QAAQ;AAAA;;;;;;;;iBAgFM,WAAA,gCACd,OAAA,EAAS,kBAAA,CAAmB,MAAA,EAAQ,KAAA,IACnC,mBAAA,CAAoB,MAAA,EAAQ,KAAA;AAzF/B;;;;;;AAAA,iBA4HgB,iBAAA,CAAkB,OAAA,GAAS,wBAAA,GAAgC,UAAU"}

package/esm/session/page-session.mjs

@@ -45,7 +45,8 @@ function createModelResolver(options) {
 			overlapMs: options.overlapMs,
 			maxAgeMs: resolveMaxAgeMs(options.maxAge),
 			allowedTypes,
-			renewalUserType
+			renewalUserType,
+			cookieDomain: options.cookieDomain ?? authConfig.cookie.cookieDomain()
 		});
 		if (!model) return null;
 		request.locals.user = model;

package/esm/session/page-session.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"page-session.mjs","names":[],"sources":["../../../../../../../auth/src/session/page-session.ts"],"sourcesContent":["import { config, t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport ms from \"ms\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"../middleware/csrf-origin-check\";\nimport { authConfig } from \"../services/auth-config\";\nimport { resolveRequestUser } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** Credential sources a session can be read from. */\nexport type SessionSource = \"cookie\" | \"header\";\n\n/** Absolute family lifetime used when `session.maxAge` is not configured. */\nconst DEFAULT_SESSION_MAX_AGE = \"30d\";\n\n/**\n * The seam web consumes. Declared here, not imported: web and auth never\n * depend on each other, and `pageSession()` satisfies web's `SessionResolver`\n * structurally.\n */\nexport type PageSessionResolver<TModel = unknown, TUser = unknown> = {\n  resolve(request: Request, response: Response): Promise<{ model: TModel; user: TUser } | null>;\n};\n\nexport type SessionResolverOptions = {\n  /** Access cookie name. @default auth.cookie.name */\n  cookie?: string;\n  /** Refresh cookie name. @default auth.cookie.refreshName */\n  refreshCookie?: string;\n  /** Credential sources. A present Authorization header always wins. @default [\"cookie\", \"header\"] */\n  sources?: SessionSource[];\n  /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */\n  renew?: boolean;\n  /** Allowed user types. @default auth.defaultUserType */\n  userTypes?: string | string[];\n  /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else \"30d\" */\n  maxAge?: string | number;\n  /** Refresh overlap window forwarded to renewal. */\n  overlapMs?: number;\n};\n\nexport type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {\n  /** Model → wire projection. Required: a model never crosses the wire by default. */\n  project: (model: TModel) => TUser | Promise<TUser>;\n};\n\nexport type SessionMiddlewareOptions = SessionResolverOptions & {\n  /** Let guests through with no user instead of a 401. @default false */\n  optional?: boolean;\n};\n\nfunction resolveMaxAgeMs(maxAge: string | number | undefined): number {\n  const raw = maxAge ?? config.key(\"auth.session.maxAge\", DEFAULT_SESSION_MAX_AGE);\n  const parsed = typeof raw === \"number\" ? raw : ms(raw as ms.StringValue);\n\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(\n      `session.maxAge: ${JSON.stringify(raw)} is not a valid ms duration — use a positive duration such as \"30d\".`,\n    );\n  }\n\n  return parsed;\n}\n\nfunction resolveUserTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configured = config.key(\"auth.defaultUserType\");\n\n  return configured ? [configured as string] : [];\n}\n\n/**\n * The shared \"credential → model\" step behind `pageSession` and\n * `sessionMiddleware`. Resolved once per request through\n * `resolveRequestUser`'s single-flight memo.\n */\nfunction createModelResolver(options: SessionResolverOptions) {\n  const sources = options.sources?.length ? options.sources : ([\"cookie\", \"header\"] as const);\n  const useHeader = sources.includes(\"header\");\n  const useCookie = sources.includes(\"cookie\");\n  const renew = options.renew ?? true;\n\n  const resolveModel = async (\n    request: Request,\n    response: Response,\n  ): Promise<{ model: unknown; source: \"header\" | \"cookie\" } | null> => {\n    const accessName = options.cookie ?? authConfig.cookie.name();\n    const refreshName = options.refreshCookie ?? authConfig.cookie.refreshName();\n    // A present Authorization header wins and never falls back to the cookie.\n    const headerWins = useHeader && Boolean(request.authorizationValue);\n\n    if (!headerWins && !useCookie) return null;\n\n    // Cheap guest path: nothing to decode, so nothing is marked auth-derived.\n    if (!headerWins && !request.cookie(accessName) && !request.cookie(refreshName)) return null;\n\n    const allowedTypes = resolveUserTypes(options.userTypes);\n    const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n    const canRenew = !headerWins && renew && Boolean(renewalUserType);\n\n    const model = await resolveRequestUser(request, response, {\n      tokenFrom: headerWins ? \"header\" : `cookie:${accessName}`,\n      refreshCredential: canRenew ? `cookie:${refreshName}` : undefined,\n      overlapMs: options.overlapMs,\n      maxAgeMs: resolveMaxAgeMs(options.maxAge),\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (!model) return null;\n\n    request.locals.user = model;\n\n    return { model, source: headerWins ? \"header\" : \"cookie\" };\n  };\n\n  return resolveModel;\n}\n\n/**\n * Session resolver for pages: cookie-or-header credential, reactive renewal,\n * one resolution per request. Plug it into `web.session`.\n *\n * @example\n * export default { session: pageSession({ project: (user: User) => userResource(user) }) };\n */\nexport function pageSession<TModel = any, TUser = unknown>(\n  options: PageSessionOptions<TModel, TUser>,\n): PageSessionResolver<TModel, TUser> {\n  if (typeof options?.project !== \"function\") {\n    throw new Error(\n      \"pageSession requires a `project(model)` function: a model never crosses the wire by default.\",\n    );\n  }\n\n  const resolveModel = createModelResolver(options);\n  const projections = new WeakMap<object, Promise<unknown>>();\n\n  return {\n    async resolve(request, response) {\n      const resolved = await resolveModel(request, response);\n\n      if (!resolved) return null;\n\n      const model = resolved.model as TModel;\n      let projected = projections.get(request as object);\n\n      if (!projected) {\n        projected = Promise.resolve(options.project(model));\n        projections.set(request as object, projected);\n      }\n\n      return { model, user: (await projected) as TUser };\n    },\n  };\n}\n\n/**\n * Middleware for cookie API routes over the same resolver as `pageSession`.\n * A cookie-authenticated unsafe request must pass the Origin/Referer check\n * (renewal can mint cookies, so it runs even when the access cookie is gone).\n * Guests get a 401 unless `optional`. The user lands on `request.locals.user`.\n */\nexport function sessionMiddleware(options: SessionMiddlewareOptions = {}): Middleware {\n  const resolveModel = createModelResolver(options);\n  const sources = options.sources?.length ? options.sources : [\"cookie\", \"header\"];\n\n  return async ({ request, response }) => {\n    const headerWins = sources.includes(\"header\") && Boolean(request.authorizationValue);\n\n    if (!headerWins && requiresCsrfOriginCheck(\"cookie:x\", request.method)) {\n      const accessName = options.cookie ?? authConfig.cookie.name();\n      const refreshName = options.refreshCookie ?? authConfig.cookie.refreshName();\n\n      if (request.cookie(accessName) || request.cookie(refreshName)) {\n        try {\n          assertCsrfOriginAllowed(request);\n        } catch (error) {\n          if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n          log.error(\"http\", \"auth\", error);\n\n          return response.forbidden({\n            error: t(\"auth.errors.csrfOriginMismatch\"),\n            errorCode: AuthErrorCodes.CsrfOriginMismatch,\n          });\n        }\n      }\n    }\n\n    const resolved = await resolveModel(request, response);\n\n    if (resolved || options.optional) return;\n\n    return response.unauthorized({\n      error: t(\"auth.errors.unauthorized\"),\n      errorCode: AuthErrorCodes.Unauthorized,\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;AAgBA,MAAM,0BAA0B;AAsChC,SAAS,gBAAgB,QAA6C;CACpE,MAAM,MAAM,UAAU,OAAO,IAAI,uBAAuB,uBAAuB;CAC/E,MAAM,SAAS,OAAO,QAAQ,WAAW,MAAM,GAAG,GAAqB;CAEvE,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,GAAG,EAAE,qEACzC;CAGF,OAAO;AACT;AAEA,SAAS,iBAAiB,OAAgD;CACxE,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,aAAa,OAAO,IAAI,sBAAsB;CAEpD,OAAO,aAAa,CAAC,UAAoB,IAAI,CAAC;AAChD;;;;;;AAOA,SAAS,oBAAoB,SAAiC;CAC5D,MAAM,UAAU,QAAQ,SAAS,SAAS,QAAQ,UAAW,CAAC,UAAU,QAAQ;CAChF,MAAM,YAAY,QAAQ,SAAS,QAAQ;CAC3C,MAAM,YAAY,QAAQ,SAAS,QAAQ;CAC3C,MAAM,QAAQ,QAAQ,SAAS;CAE/B,MAAM,eAAe,OACnB,SACA,aACoE;EACpE,MAAM,aAAa,QAAQ,UAAU,WAAW,OAAO,KAAK;EAC5D,MAAM,cAAc,QAAQ,iBAAiB,WAAW,OAAO,YAAY;EAE3E,MAAM,aAAa,aAAa,QAAQ,QAAQ,kBAAkB;EAElE,IAAI,CAAC,cAAc,CAAC,WAAW,OAAO;EAGtC,IAAI,CAAC,cAAc,CAAC,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,WAAW,GAAG,OAAO;EAEvF,MAAM,eAAe,iBAAiB,QAAQ,SAAS;EACvD,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;EACtE,MAAM,WAAW,CAAC,cAAc,SAAS,QAAQ,eAAe;EAEhE,MAAM,QAAQ,MAAM,mBAAmB,SAAS,UAAU;GACxD,WAAW,aAAa,WAAW,UAAU;GAC7C,mBAAmB,WAAW,UAAU,gBAAgB;GACxD,WAAW,QAAQ;GACnB,UAAU,gBAAgB,QAAQ,MAAM;GACxC;GACA;EACF,CAAC;EAED,IAAI,CAAC,OAAO,OAAO;EAEnB,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE;GAAO,QAAQ,aAAa,WAAW;EAAS;CAC3D;CAEA,OAAO;AACT;;;;;;;;AASA,SAAgB,YACd,SACoC;CACpC,IAAI,OAAO,SAAS,YAAY,YAC9B,MAAM,IAAI,MACR,8FACF;CAGF,MAAM,eAAe,oBAAoB,OAAO;CAChD,MAAM,8BAAc,IAAI,QAAkC;CAE1D,OAAO,EACL,MAAM,QAAQ,SAAS,UAAU;EAC/B,MAAM,WAAW,MAAM,aAAa,SAAS,QAAQ;EAErD,IAAI,CAAC,UAAU,OAAO;EAEtB,MAAM,QAAQ,SAAS;EACvB,IAAI,YAAY,YAAY,IAAI,OAAiB;EAEjD,IAAI,CAAC,WAAW;GACd,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,KAAK,CAAC;GAClD,YAAY,IAAI,SAAmB,SAAS;EAC9C;EAEA,OAAO;GAAE;GAAO,MAAO,MAAM;EAAoB;CACnD,EACF;AACF;;;;;;;AAQA,SAAgB,kBAAkB,UAAoC,CAAC,GAAe;CACpF,MAAM,eAAe,oBAAoB,OAAO;CAChD,MAAM,UAAU,QAAQ,SAAS,SAAS,QAAQ,UAAU,CAAC,UAAU,QAAQ;CAE/E,OAAO,OAAO,EAAE,SAAS,eAAe;EAGtC,IAAI,EAFe,QAAQ,SAAS,QAAQ,KAAK,QAAQ,QAAQ,kBAAkB,MAEhE,wBAAwB,YAAY,QAAQ,MAAM,GAAG;GACtE,MAAM,aAAa,QAAQ,UAAU,WAAW,OAAO,KAAK;GAC5D,MAAM,cAAc,QAAQ,iBAAiB,WAAW,OAAO,YAAY;GAE3E,IAAI,QAAQ,OAAO,UAAU,KAAK,QAAQ,OAAO,WAAW,GAC1D,IAAI;IACF,wBAAwB,OAAO;GACjC,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;IAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;IAE/B,OAAO,SAAS,UAAU;KACxB,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;EAEJ;EAIA,IAAI,MAFmB,aAAa,SAAS,QAAQ,KAErC,QAAQ,UAAU;EAElC,OAAO,SAAS,aAAa;GAC3B,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"page-session.mjs","names":[],"sources":["../../../../../../../auth/src/session/page-session.ts"],"sourcesContent":["import { config, t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport type { CookieDomainResolver } from \"../contracts/types\";\nimport { log } from \"@warlock.js/logger\";\nimport ms from \"ms\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"../middleware/csrf-origin-check\";\nimport { authConfig } from \"../services/auth-config\";\nimport { resolveRequestUser } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/** Credential sources a session can be read from. */\nexport type SessionSource = \"cookie\" | \"header\";\n\n/** Absolute family lifetime used when `session.maxAge` is not configured. */\nconst DEFAULT_SESSION_MAX_AGE = \"30d\";\n\n/**\n * The seam web consumes. Declared here, not imported: web and auth never\n * depend on each other, and `pageSession()` satisfies web's `SessionResolver`\n * structurally.\n */\nexport type PageSessionResolver<TModel = unknown, TUser = unknown> = {\n  resolve(request: Request, response: Response): Promise<{ model: TModel; user: TUser } | null>;\n};\n\nexport type SessionResolverOptions = {\n  /** Access cookie name. @default auth.cookie.name */\n  cookie?: string;\n  /** Refresh cookie name. @default auth.cookie.refreshName */\n  refreshCookie?: string;\n  /** Credential sources. A present Authorization header always wins. @default [\"cookie\", \"header\"] */\n  sources?: SessionSource[];\n  /** Renew an expired access cookie from the refresh cookie. Cookie source only. @default true */\n  renew?: boolean;\n  /** Allowed user types. @default auth.defaultUserType */\n  userTypes?: string | string[];\n  /** Absolute family lifetime, an `ms` string or milliseconds. @default auth.session.maxAge, else \"30d\" */\n  maxAge?: string | number;\n  /** Refresh overlap window forwarded to renewal. */\n  overlapMs?: number;\n  /** Select a request-scoped Domain for renewed cookies; `undefined` keeps them host-only. */\n  cookieDomain?: CookieDomainResolver;\n};\n\nexport type PageSessionOptions<TModel, TUser> = SessionResolverOptions & {\n  /** Model → wire projection. Required: a model never crosses the wire by default. */\n  project: (model: TModel) => TUser | Promise<TUser>;\n};\n\nexport type SessionMiddlewareOptions = SessionResolverOptions & {\n  /** Let guests through with no user instead of a 401. @default false */\n  optional?: boolean;\n};\n\nfunction resolveMaxAgeMs(maxAge: string | number | undefined): number {\n  const raw = maxAge ?? config.key(\"auth.session.maxAge\", DEFAULT_SESSION_MAX_AGE);\n  const parsed = typeof raw === \"number\" ? raw : ms(raw as ms.StringValue);\n\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(\n      `session.maxAge: ${JSON.stringify(raw)} is not a valid ms duration — use a positive duration such as \"30d\".`,\n    );\n  }\n\n  return parsed;\n}\n\nfunction resolveUserTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configured = config.key(\"auth.defaultUserType\");\n\n  return configured ? [configured as string] : [];\n}\n\n/**\n * The shared \"credential → model\" step behind `pageSession` and\n * `sessionMiddleware`. Resolved once per request through\n * `resolveRequestUser`'s single-flight memo.\n */\nfunction createModelResolver(options: SessionResolverOptions) {\n  const sources = options.sources?.length ? options.sources : ([\"cookie\", \"header\"] as const);\n  const useHeader = sources.includes(\"header\");\n  const useCookie = sources.includes(\"cookie\");\n  const renew = options.renew ?? true;\n\n  const resolveModel = async (\n    request: Request,\n    response: Response,\n  ): Promise<{ model: unknown; source: \"header\" | \"cookie\" } | null> => {\n    const accessName = options.cookie ?? authConfig.cookie.name();\n    const refreshName = options.refreshCookie ?? authConfig.cookie.refreshName();\n    // A present Authorization header wins and never falls back to the cookie.\n    const headerWins = useHeader && Boolean(request.authorizationValue);\n\n    if (!headerWins && !useCookie) return null;\n\n    // Cheap guest path: nothing to decode, so nothing is marked auth-derived.\n    if (!headerWins && !request.cookie(accessName) && !request.cookie(refreshName)) return null;\n\n    const allowedTypes = resolveUserTypes(options.userTypes);\n    const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n    const canRenew = !headerWins && renew && Boolean(renewalUserType);\n\n    const model = await resolveRequestUser(request, response, {\n      tokenFrom: headerWins ? \"header\" : `cookie:${accessName}`,\n      refreshCredential: canRenew ? `cookie:${refreshName}` : undefined,\n      overlapMs: options.overlapMs,\n      maxAgeMs: resolveMaxAgeMs(options.maxAge),\n      allowedTypes,\n      renewalUserType,\n      cookieDomain: options.cookieDomain ?? authConfig.cookie.cookieDomain(),\n    });\n\n    if (!model) return null;\n\n    request.locals.user = model;\n\n    return { model, source: headerWins ? \"header\" : \"cookie\" };\n  };\n\n  return resolveModel;\n}\n\n/**\n * Session resolver for pages: cookie-or-header credential, reactive renewal,\n * one resolution per request. Plug it into `web.session`.\n *\n * @example\n * export default { session: pageSession({ project: (user: User) => userResource(user) }) };\n */\nexport function pageSession<TModel = any, TUser = unknown>(\n  options: PageSessionOptions<TModel, TUser>,\n): PageSessionResolver<TModel, TUser> {\n  if (typeof options?.project !== \"function\") {\n    throw new Error(\n      \"pageSession requires a `project(model)` function: a model never crosses the wire by default.\",\n    );\n  }\n\n  const resolveModel = createModelResolver(options);\n  const projections = new WeakMap<object, Promise<unknown>>();\n\n  return {\n    async resolve(request, response) {\n      const resolved = await resolveModel(request, response);\n\n      if (!resolved) return null;\n\n      const model = resolved.model as TModel;\n      let projected = projections.get(request as object);\n\n      if (!projected) {\n        projected = Promise.resolve(options.project(model));\n        projections.set(request as object, projected);\n      }\n\n      return { model, user: (await projected) as TUser };\n    },\n  };\n}\n\n/**\n * Middleware for cookie API routes over the same resolver as `pageSession`.\n * A cookie-authenticated unsafe request must pass the Origin/Referer check\n * (renewal can mint cookies, so it runs even when the access cookie is gone).\n * Guests get a 401 unless `optional`. The user lands on `request.locals.user`.\n */\nexport function sessionMiddleware(options: SessionMiddlewareOptions = {}): Middleware {\n  const resolveModel = createModelResolver(options);\n  const sources = options.sources?.length ? options.sources : [\"cookie\", \"header\"];\n\n  return async ({ request, response }) => {\n    const headerWins = sources.includes(\"header\") && Boolean(request.authorizationValue);\n\n    if (!headerWins && requiresCsrfOriginCheck(\"cookie:x\", request.method)) {\n      const accessName = options.cookie ?? authConfig.cookie.name();\n      const refreshName = options.refreshCookie ?? authConfig.cookie.refreshName();\n\n      if (request.cookie(accessName) || request.cookie(refreshName)) {\n        try {\n          assertCsrfOriginAllowed(request);\n        } catch (error) {\n          if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n          log.error(\"http\", \"auth\", error);\n\n          return response.forbidden({\n            error: t(\"auth.errors.csrfOriginMismatch\"),\n            errorCode: AuthErrorCodes.CsrfOriginMismatch,\n          });\n        }\n      }\n    }\n\n    const resolved = await resolveModel(request, response);\n\n    if (resolved || options.optional) return;\n\n    return response.unauthorized({\n      error: t(\"auth.errors.unauthorized\"),\n      errorCode: AuthErrorCodes.Unauthorized,\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;AAiBA,MAAM,0BAA0B;AAwChC,SAAS,gBAAgB,QAA6C;CACpE,MAAM,MAAM,UAAU,OAAO,IAAI,uBAAuB,uBAAuB;CAC/E,MAAM,SAAS,OAAO,QAAQ,WAAW,MAAM,GAAG,GAAqB;CAEvE,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,mBAAmB,KAAK,UAAU,GAAG,EAAE,qEACzC;CAGF,OAAO;AACT;AAEA,SAAS,iBAAiB,OAAgD;CACxE,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,aAAa,OAAO,IAAI,sBAAsB;CAEpD,OAAO,aAAa,CAAC,UAAoB,IAAI,CAAC;AAChD;;;;;;AAOA,SAAS,oBAAoB,SAAiC;CAC5D,MAAM,UAAU,QAAQ,SAAS,SAAS,QAAQ,UAAW,CAAC,UAAU,QAAQ;CAChF,MAAM,YAAY,QAAQ,SAAS,QAAQ;CAC3C,MAAM,YAAY,QAAQ,SAAS,QAAQ;CAC3C,MAAM,QAAQ,QAAQ,SAAS;CAE/B,MAAM,eAAe,OACnB,SACA,aACoE;EACpE,MAAM,aAAa,QAAQ,UAAU,WAAW,OAAO,KAAK;EAC5D,MAAM,cAAc,QAAQ,iBAAiB,WAAW,OAAO,YAAY;EAE3E,MAAM,aAAa,aAAa,QAAQ,QAAQ,kBAAkB;EAElE,IAAI,CAAC,cAAc,CAAC,WAAW,OAAO;EAGtC,IAAI,CAAC,cAAc,CAAC,QAAQ,OAAO,UAAU,KAAK,CAAC,QAAQ,OAAO,WAAW,GAAG,OAAO;EAEvF,MAAM,eAAe,iBAAiB,QAAQ,SAAS;EACvD,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;EACtE,MAAM,WAAW,CAAC,cAAc,SAAS,QAAQ,eAAe;EAEhE,MAAM,QAAQ,MAAM,mBAAmB,SAAS,UAAU;GACxD,WAAW,aAAa,WAAW,UAAU;GAC7C,mBAAmB,WAAW,UAAU,gBAAgB;GACxD,WAAW,QAAQ;GACnB,UAAU,gBAAgB,QAAQ,MAAM;GACxC;GACA;GACA,cAAc,QAAQ,gBAAgB,WAAW,OAAO,aAAa;EACvE,CAAC;EAED,IAAI,CAAC,OAAO,OAAO;EAEnB,QAAQ,OAAO,OAAO;EAEtB,OAAO;GAAE;GAAO,QAAQ,aAAa,WAAW;EAAS;CAC3D;CAEA,OAAO;AACT;;;;;;;;AASA,SAAgB,YACd,SACoC;CACpC,IAAI,OAAO,SAAS,YAAY,YAC9B,MAAM,IAAI,MACR,8FACF;CAGF,MAAM,eAAe,oBAAoB,OAAO;CAChD,MAAM,8BAAc,IAAI,QAAkC;CAE1D,OAAO,EACL,MAAM,QAAQ,SAAS,UAAU;EAC/B,MAAM,WAAW,MAAM,aAAa,SAAS,QAAQ;EAErD,IAAI,CAAC,UAAU,OAAO;EAEtB,MAAM,QAAQ,SAAS;EACvB,IAAI,YAAY,YAAY,IAAI,OAAiB;EAEjD,IAAI,CAAC,WAAW;GACd,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,KAAK,CAAC;GAClD,YAAY,IAAI,SAAmB,SAAS;EAC9C;EAEA,OAAO;GAAE;GAAO,MAAO,MAAM;EAAoB;CACnD,EACF;AACF;;;;;;;AAQA,SAAgB,kBAAkB,UAAoC,CAAC,GAAe;CACpF,MAAM,eAAe,oBAAoB,OAAO;CAChD,MAAM,UAAU,QAAQ,SAAS,SAAS,QAAQ,UAAU,CAAC,UAAU,QAAQ;CAE/E,OAAO,OAAO,EAAE,SAAS,eAAe;EAGtC,IAAI,EAFe,QAAQ,SAAS,QAAQ,KAAK,QAAQ,QAAQ,kBAAkB,MAEhE,wBAAwB,YAAY,QAAQ,MAAM,GAAG;GACtE,MAAM,aAAa,QAAQ,UAAU,WAAW,OAAO,KAAK;GAC5D,MAAM,cAAc,QAAQ,iBAAiB,WAAW,OAAO,YAAY;GAE3E,IAAI,QAAQ,OAAO,UAAU,KAAK,QAAQ,OAAO,WAAW,GAC1D,IAAI;IACF,wBAAwB,OAAO;GACjC,SAAS,OAAO;IACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;IAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;IAE/B,OAAO,SAAS,UAAU;KACxB,OAAO,EAAE,gCAAgC;KACzC;IACF,CAAC;GACH;EAEJ;EAIA,IAAI,MAFmB,aAAa,SAAS,QAAQ,KAErC,QAAQ,UAAU;EAElC,OAAO,SAAS,aAAa;GAC3B,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;CACH;AACF"}

package/esm/utils/auth-error-codes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\r\n  /**\r\n   * Missing Access Token Error Code EC001\r\n   * EC001 = Missing Access Token\r\n   */\r\n  MissingAccessToken = \"EC001\", // Error Code 001\r\n  /**\r\n   * Invalid Access Token Error Code EC002\r\n   * EC002 = Invalid Access Token\r\n   */\r\n  InvalidAccessToken = \"EC002\", // Error Code 002\r\n  /**\r\n   * Unauthorized Error Code EC003\r\n   * EC003 = Unauthorized\r\n   */\r\n  Unauthorized = \"EC003\", // Error Code 003\r\n  /**\r\n   * Too Many Attempts Error Code EC004\r\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\r\n   * a per-account or per-IP failure counter trips its threshold.\r\n   */\r\n  TooManyAttempts = \"EC004\", // Error Code 004\r\n  /**\r\n   * Invalid Token Type Error Code EC005\r\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\r\n   * what the caller expects (e.g. a refresh token presented where an access\r\n   * token is required, or vice versa). Carried on the `code` property of the\r\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\r\n   * classify it as a credential failure without matching on the message.\r\n   */\r\n  InvalidTokenType = \"EC005\", // Error Code 005\r\n  /**\r\n   * CSRF Origin Mismatch Error Code EC006\r\n   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)\r\n   * request whose `Origin` (or, absent that, `Referer`) did not match the\r\n   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose\r\n   * request carried neither header at all.\r\n   */\r\n  CsrfOriginMismatch = \"EC006\", // Error Code 006\r\n  /**\r\n   * Email Not Verified Error Code EC007\r\n   * EC007 = the authenticated user has not verified their email address —\r\n   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).\r\n   */\r\n  EmailNotVerified = \"EC007\", // Error Code 007\r\n  /**\r\n   * Invalid One-Time Token Error Code EC008\r\n   * EC008 = an email-verification or password-reset token that is unknown,\r\n   * issued for the other purpose, expired, or already used. One code for all\r\n   * four on purpose: the caller learns nothing about which it was.\r\n   */\r\n  InvalidOneTimeToken = \"EC008\", // Error Code 008\r\n  /**\r\n   * Invalid Provider Callback Error Code EC009\r\n   * EC009 = a redirect-provider callback was rejected: missing, forged or\r\n   * expired state cookie, `state` mismatch, failed code exchange, or an\r\n   * id_token with a bad signature, issuer, audience, expiry or nonce.\r\n   */\r\n  InvalidProviderCallback = \"EC009\", // Error Code 009\r\n  /**\r\n   * Provider Email Not Verified Error Code EC010\r\n   * EC010 = the provider did not verify the email, so auth refused to link or\r\n   * create an account from it.\r\n   */\r\n  ProviderEmailNotVerified = \"EC010\", // Error Code 010\r\n  /**\r\n   * Invalid Passkey Error Code EC011\r\n   * EC011 = a passkey ceremony was rejected: unknown, expired or used\r\n   * challenge, unknown credential, failed verification, or a signature counter\r\n   * that did not advance.\r\n   */\r\n  InvalidPasskey = \"EC011\", // Error Code 011\r\n}\r\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;;;;;;;CAQA;;;;;;CAMA;;;;;;;CAOA;;;;;;;CAOA;;;;;;CAMA;;;;;;;CAOA;;AACF"}
+{"version":3,"file":"auth-error-codes.mjs","names":[],"sources":["../../../../../../../auth/src/utils/auth-error-codes.ts"],"sourcesContent":["export enum AuthErrorCodes {\n  /**\n   * Missing Access Token Error Code EC001\n   * EC001 = Missing Access Token\n   */\n  MissingAccessToken = \"EC001\", // Error Code 001\n  /**\n   * Invalid Access Token Error Code EC002\n   * EC002 = Invalid Access Token\n   */\n  InvalidAccessToken = \"EC002\", // Error Code 002\n  /**\n   * Unauthorized Error Code EC003\n   * EC003 = Unauthorized\n   */\n  Unauthorized = \"EC003\", // Error Code 003\n  /**\n   * Too Many Attempts Error Code EC004\n   * EC004 = Too Many Attempts — issued by the login-throttle middleware once\n   * a per-account or per-IP failure counter trips its threshold.\n   */\n  TooManyAttempts = \"EC004\", // Error Code 004\n  /**\n   * Invalid Token Type Error Code EC005\n   * EC005 = Invalid Token Type — the token's `tokenType` claim does not match\n   * what the caller expects (e.g. a refresh token presented where an access\n   * token is required, or vice versa). Carried on the `code` property of the\n   * `Error` thrown by `assertTokenType` (`services/jwt.ts`) so callers can\n   * classify it as a credential failure without matching on the message.\n   */\n  InvalidTokenType = \"EC005\", // Error Code 005\n  /**\n   * CSRF Origin Mismatch Error Code EC006\n   * EC006 = a cookie-authenticated, unsafe-method (POST/PUT/PATCH/DELETE)\n   * request whose `Origin` (or, absent that, `Referer`) did not match the\n   * request's own origin or an entry in `auth.csrf.allowedOrigins`, or whose\n   * request carried neither header at all.\n   */\n  CsrfOriginMismatch = \"EC006\", // Error Code 006\n  /**\n   * Email Not Verified Error Code EC007\n   * EC007 = the authenticated user has not verified their email address —\n   * thrown by `requireVerifiedEmail()` as `EmailNotVerifiedError` (403).\n   */\n  EmailNotVerified = \"EC007\", // Error Code 007\n  /**\n   * Invalid One-Time Token Error Code EC008\n   * EC008 = an email-verification or password-reset token that is unknown,\n   * issued for the other purpose, expired, or already used. One code for all\n   * four on purpose: the caller learns nothing about which it was.\n   */\n  InvalidOneTimeToken = \"EC008\", // Error Code 008\n  /**\n   * Invalid Provider Callback Error Code EC009\n   * EC009 = a redirect-provider callback was rejected: missing, forged or\n   * expired state cookie, `state` mismatch, failed code exchange, or an\n   * id_token with a bad signature, issuer, audience, expiry or nonce.\n   */\n  InvalidProviderCallback = \"EC009\", // Error Code 009\n  /**\n   * Provider Email Not Verified Error Code EC010\n   * EC010 = the provider did not verify the email, so auth refused to link or\n   * create an account from it.\n   */\n  ProviderEmailNotVerified = \"EC010\", // Error Code 010\n  /**\n   * Invalid Passkey Error Code EC011\n   * EC011 = a passkey ceremony was rejected: unknown, expired or used\n   * challenge, unknown credential, failed verification, or a signature counter\n   * that did not advance.\n   */\n  InvalidPasskey = \"EC011\", // Error Code 011\n}\n"],"mappings":";AAAA,IAAY,iBAAL;;;;;CAKL;;;;;CAKA;;;;;CAKA;;;;;;CAMA;;;;;;;;;CASA;;;;;;;;CAQA;;;;;;CAMA;;;;;;;CAOA;;;;;;;CAOA;;;;;;CAMA;;;;;;;CAOA;;AACF"}