najm-auth 1.1.36 → 1.1.39

package/dist/index.js

@@ -228,6 +228,229 @@ var authSchema3 = {
   rolePermissions: rolePermissionsTable3
 };
 
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  AUTH_MODULE: () => AUTH_MODULE,
+  AuthController: () => AuthController,
+  AuthGuard: () => AuthGuard,
+  AuthResolver: () => AuthResolver,
+  AuthService: () => AuthService,
+  CookieManager: () => CookieManager,
+  EncryptionService: () => EncryptionService,
+  isAuth: () => isAuth,
+  runAsUser: () => runAsUser
+});
+
+// src/auth/EncryptionService.ts
+import { Inject, Injectable } from "najm-core";
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+
+// src/auth/password.ts
+import bcrypt from "bcryptjs";
+var getBunPassword = /* @__PURE__ */ __name(() => globalThis.Bun?.password, "getBunPassword");
+async function hashPassword(password, rounds) {
+  if (!Number.isInteger(rounds) || rounds < 4 || rounds > 31) {
+    throw new Error("bcrypt rounds must be an integer between 4 and 31");
+  }
+  const bunPassword = getBunPassword();
+  if (bunPassword) {
+    return bunPassword.hash(password, { algorithm: "bcrypt", cost: rounds });
+  }
+  return bcrypt.hash(password, rounds);
+}
+__name(hashPassword, "hashPassword");
+async function verifyPassword(password, hash) {
+  const bunPassword = getBunPassword();
+  if (bunPassword) {
+    return bunPassword.verify(password, hash);
+  }
+  return bcrypt.compare(password, hash);
+}
+__name(verifyPassword, "verifyPassword");
+
+// src/auth/EncryptionService.ts
+var __decorate = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = function(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+};
+var REQUIRED_KEY_BYTES = 32;
+function decodeKey(raw) {
+  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
+    return Buffer.from(raw, "hex");
+  }
+  if (/^[A-Za-z0-9+/]+=*$/.test(raw) || /^[A-Za-z0-9_-]+=*$/.test(raw)) {
+    const decoded = Buffer.from(raw, raw.includes("-") || raw.includes("_") ? "base64url" : "base64");
+    if (decoded.length === REQUIRED_KEY_BYTES)
+      return decoded;
+  }
+  if (Buffer.byteLength(raw, "utf8") === REQUIRED_KEY_BYTES) {
+    return Buffer.from(raw, "utf8");
+  }
+  throw new Error(`Encryption key must decode to ${REQUIRED_KEY_BYTES} bytes. Provide hex (64 chars) or base64 (32 bytes decoded).`);
+}
+__name(decodeKey, "decodeKey");
+var EncryptionService = class EncryptionService2 {
+  static {
+    __name(this, "EncryptionService");
+  }
+  config;
+  encryptionKey;
+  constructor(encryptionKey) {
+    const raw = encryptionKey ?? process.env.NAJM_ENCRYPTION_KEY ?? "";
+    if (!raw) {
+      throw new Error("Encryption key missing. Set NAJM_ENCRYPTION_KEY (base64 or hex, 32 bytes) or pass auth({ encryptionKey })");
+    }
+    this.encryptionKey = decodeKey(raw);
+  }
+  async hashPassword(password) {
+    return hashPassword(password, this.config?.bcryptRounds ?? 10);
+  }
+  async comparePassword(password, hashedPassword) {
+    return verifyPassword(password, hashedPassword);
+  }
+  encrypt(plaintext) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, encrypted]).toString("base64url");
+  }
+  decrypt(ciphertext) {
+    const raw = Buffer.from(ciphertext, "base64url");
+    const iv = raw.subarray(0, 12);
+    const tag = raw.subarray(12, 28);
+    const encrypted = raw.subarray(28);
+    const decipher = createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+    decipher.setAuthTag(tag);
+    return decipher.update(encrypted) + decipher.final("utf8");
+  }
+};
+__decorate([
+  Inject(AUTH_CONFIG),
+  __metadata("design:type", Object)
+], EncryptionService.prototype, "config", void 0);
+EncryptionService = __decorate([
+  Injectable(),
+  __param(0, Inject(AUTH_ENCRYPTION_KEY)),
+  __metadata("design:paramtypes", [String])
+], EncryptionService);
+
+// src/auth/CookieManager.ts
+import { Service, Inject as Inject2 } from "najm-core";
+import { CookieService } from "najm-cookies";
+import timestring from "timestring";
+var __decorate2 = function(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata2 = function(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a;
+var CookieManager = class CookieManager2 {
+  static {
+    __name(this, "CookieManager");
+  }
+  config;
+  cookieService;
+  get cookieName() {
+    return this.config.refreshCookieName || "refreshToken";
+  }
+  get sessionCookieName() {
+    return this.config.session.name;
+  }
+  get sessionMaxAge() {
+    return this.config.session.maxAge;
+  }
+  get sessionSecret() {
+    return this.config.session.secret || this.config.jwt.accessSecret;
+  }
+  // =========================================================================
+  // Refresh Token Cookie
+  // =========================================================================
+  setRefreshToken(refreshToken) {
+    const maxAge = timestring(this.config.jwt.refreshExpiresIn, "s");
+    this.cookieService.set(this.cookieName, refreshToken, { maxAge });
+  }
+  clearRefreshToken() {
+    this.cookieService.delete(this.cookieName);
+  }
+  getRefreshToken() {
+    return this.cookieService.get(this.cookieName);
+  }
+  hasRefreshToken() {
+    return this.cookieService.has(this.cookieName);
+  }
+  getCookieName() {
+    return this.cookieName;
+  }
+  // =========================================================================
+  // Session Cookie Cache (HMAC-signed, short-lived)
+  // =========================================================================
+  /**
+   * Write a signed session cookie containing user data, roles, and permissions.
+   * The cookie is HMAC-signed with the access secret so it is tamper-proof
+   * but readable without a database query. Short TTL (5 min) ensures freshness.
+   */
+  setSessionCookie(data) {
+    const payload = { ...data, iat: Date.now() };
+    this.cookieService.setSigned(this.sessionCookieName, JSON.stringify(payload), this.sessionSecret, {
+      maxAge: this.sessionMaxAge,
+      httpOnly: true,
+      sameSite: "Lax",
+      path: "/"
+    });
+  }
+  /**
+   * Read and verify the session cookie. Returns null if missing, expired,
+   * or signature verification fails.
+   */
+  getSessionCookie() {
+    const raw = this.cookieService.getSigned(this.sessionCookieName, this.sessionSecret);
+    if (!raw)
+      return null;
+    try {
+      const data = JSON.parse(raw);
+      const age = Date.now() - data.iat;
+      if (age > this.sessionMaxAge * 1e3)
+        return null;
+      return data;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Clear the session cookie (on logout, password change, etc.)
+   */
+  clearSessionCookie() {
+    this.cookieService.delete(this.sessionCookieName);
+  }
+};
+__decorate2([
+  Inject2(AUTH_CONFIG),
+  __metadata2("design:type", Object)
+], CookieManager.prototype, "config", void 0);
+__decorate2([
+  Inject2(CookieService),
+  __metadata2("design:type", typeof (_a = typeof CookieService !== "undefined" && CookieService) === "function" ? _a : Object)
+], CookieManager.prototype, "cookieService", void 0);
+CookieManager = __decorate2([
+  Service()
+], CookieManager);
+
 // src/auth/AuthController.ts
 import { Controller } from "najm-core";
 import { Get, Post, ResMsg } from "najm-core";
@@ -236,17 +459,18 @@ import { Body, User as User2, Headers } from "najm-core";
 // src/auth/AuthService.ts
 import { Injectable as Injectable7, Inject as Inject8 } from "najm-core";
 import { Err as Err6, Log } from "najm-core";
-import { I18n as I18n4, I18nService as I18nService2 } from "najm-i18n";
+import { I18n as I18n5, I18nService as I18nService2 } from "najm-i18n";
 import { EmailService, passwordResetTemplate } from "najm-email";
 
 // src/users/UserService.ts
-import { Injectable as Injectable5, Inject as Inject4 } from "najm-core";
+import { Injectable as Injectable5, Inject as Inject5 } from "najm-core";
 import { Transaction } from "najm-database";
 import { I18nService } from "najm-i18n";
+import { I18n as I18n3 } from "najm-i18n";
 
 // src/users/UserRepository.ts
-import { eq as eq2, ne } from "drizzle-orm";
-import { Repository, Inject } from "najm-core";
+import { eq as eq2, ne, sql as sql4 } from "drizzle-orm";
+import { Repository, Inject as Inject3 } from "najm-core";
 import { DB } from "najm-database";
 
 // src/shared/queries.ts
@@ -279,14 +503,22 @@ var AuthQueries = class {
       updatedAt: this.schema.users.updatedAt
     };
   }
+  async getUserWithPermissions(where2) {
+    const rows = await this.db.select({
+      ...this.userSelection(),
+      permissionName: this.schema.permissions.name
+    }).from(this.schema.users).leftJoin(this.schema.roles, eq(this.schema.users.roleId, this.schema.roles.id)).leftJoin(this.schema.rolePermissions, eq(this.schema.users.roleId, this.schema.rolePermissions.roleId)).leftJoin(this.schema.permissions, eq(this.schema.rolePermissions.permissionId, this.schema.permissions.id)).where(where2);
+    if (rows.length === 0)
+      return void 0;
+    const { permissionName: _permissionName, ...user } = rows[0];
+    const permissions = [...new Set(rows.map((row) => row.permissionName).filter(Boolean))];
+    return { ...user, permissions };
+  }
   /**
    * Get permissions for a user by their userId
    */
   async getUserPermissions(userId) {
-    const [user] = await this.db.select({ roleId: this.schema.users.roleId }).from(this.schema.users).where(eq(this.schema.users.id, userId)).limit(1);
-    if (!user?.roleId)
-      return [];
-    const perms = await this.db.select({ name: this.schema.permissions.name }).from(this.schema.rolePermissions).leftJoin(this.schema.permissions, eq(this.schema.rolePermissions.permissionId, this.schema.permissions.id)).where(eq(this.schema.rolePermissions.roleId, user.roleId));
+    const perms = await this.db.select({ name: this.schema.permissions.name }).from(this.schema.users).leftJoin(this.schema.rolePermissions, eq(this.schema.users.roleId, this.schema.rolePermissions.roleId)).leftJoin(this.schema.permissions, eq(this.schema.rolePermissions.permissionId, this.schema.permissions.id)).where(eq(this.schema.users.id, userId));
     return perms.map((p) => p.name).filter(Boolean);
   }
   /**
@@ -301,16 +533,13 @@ var AuthQueries = class {
    * Returns { roleName: string | null, permissions: string[] }
    */
   async getRoleAndPermissions(userId) {
-    const [user] = await this.db.select({ roleId: this.schema.users.roleId }).from(this.schema.users).where(eq(this.schema.users.id, userId)).limit(1);
-    if (!user?.roleId) {
-      const [roleRow2] = await this.db.select({ roleName: this.schema.roles.name }).from(this.schema.users).leftJoin(this.schema.roles, eq(this.schema.users.roleId, this.schema.roles.id)).where(eq(this.schema.users.id, userId)).limit(1);
-      return { roleName: roleRow2?.roleName ?? null, permissions: [] };
-    }
-    const [roleRow] = await this.db.select({ roleName: this.schema.roles.name }).from(this.schema.roles).where(eq(this.schema.roles.id, user.roleId)).limit(1);
-    const perms = await this.db.select({ name: this.schema.permissions.name }).from(this.schema.rolePermissions).leftJoin(this.schema.permissions, eq(this.schema.rolePermissions.permissionId, this.schema.permissions.id)).where(eq(this.schema.rolePermissions.roleId, user.roleId));
+    const rows = await this.db.select({
+      roleName: this.schema.roles.name,
+      permissionName: this.schema.permissions.name
+    }).from(this.schema.users).leftJoin(this.schema.roles, eq(this.schema.users.roleId, this.schema.roles.id)).leftJoin(this.schema.rolePermissions, eq(this.schema.users.roleId, this.schema.rolePermissions.roleId)).leftJoin(this.schema.permissions, eq(this.schema.rolePermissions.permissionId, this.schema.permissions.id)).where(eq(this.schema.users.id, userId));
     return {
-      roleName: roleRow?.roleName ?? null,
-      permissions: perms.map((p) => p.name).filter(Boolean)
+      roleName: rows[0]?.roleName ?? null,
+      permissions: [...new Set(rows.map((row) => row.permissionName).filter(Boolean))]
     };
   }
   /**
@@ -343,13 +572,13 @@ var ROLE_GROUPS = {
 };
 
 // src/users/UserRepository.ts
-var __decorate = function(decorators, target, key, desc) {
+var __decorate3 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata = function(k, v) {
+var __metadata3 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var UserRepository = class UserRepository2 {
@@ -365,11 +594,12 @@ var UserRepository = class UserRepository2 {
     return this.schema.roles;
   }
   /** Shared query helper */
+  queryHelper;
   get q() {
-    return new AuthQueries(this.db, this.schema);
+    return this.queryHelper ??= new AuthQueries(this.db, this.schema);
   }
-  async getAll() {
-    const allUsers = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id));
+  async getAll(limit = 50, offset = 0) {
+    const allUsers = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).limit(limit).offset(offset);
     const permissionsByRole = await this.q.batchLoadPermissionsByRole();
     return allUsers.map((user) => ({
       ...user,
@@ -377,13 +607,11 @@ var UserRepository = class UserRepository2 {
     }));
   }
   async getById(id) {
-    const [user] = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(eq2(this.users.id, id)).limit(1);
-    if (!user)
-      return user;
-    return {
-      ...user,
-      permissions: await this.q.getUserPermissions(user.id)
-    };
+    return this.q.getUserWithPermissions(eq2(this.users.id, id));
+  }
+  async existsById(id) {
+    const [user] = await this.db.select({ id: this.users.id }).from(this.users).where(eq2(this.users.id, id)).limit(1);
+    return Boolean(user);
   }
   async getRawById(id) {
     const [user] = await this.db.select().from(this.users).where(eq2(this.users.id, id)).limit(1);
@@ -411,8 +639,7 @@ var UserRepository = class UserRepository2 {
     return updatedUser;
   }
   async incrementFailedAttempts(id) {
-    const user = await this.getRawById(id);
-    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: (user?.failedLoginAttempts ?? 0) + 1 }).where(eq2(this.users.id, id)).returning();
+    const [updatedUser] = await this.db.update(this.users).set({ failedLoginAttempts: sql4`coalesce(${this.users.failedLoginAttempts}, 0) + 1` }).where(eq2(this.users.id, id)).returning();
     return updatedUser;
   }
   async resetFailedAttempts(id) {
@@ -440,21 +667,7 @@ var UserRepository = class UserRepository2 {
     return this.q.getRoleName(userId);
   }
   async findByPhone(phone) {
-    const [user] = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq2(this.users.roleId, this.roles.id)).where(eq2(this.users.phone, phone)).limit(1);
-    if (!user)
-      return void 0;
-    return {
-      ...user,
-      permissions: await this.q.getUserPermissions(user.id)
-    };
-  }
-  async getUserPassword(email2) {
-    const [user] = await this.db.select({
-      id: this.users.id,
-      email: this.users.email,
-      password: this.users.password
-    }).from(this.users).where(eq2(this.users.email, email2)).limit(1);
-    return user?.password;
+    return this.q.getUserWithPermissions(eq2(this.users.phone, phone));
   }
   async getUserPermissions(userId) {
     return this.q.getUserPermissions(userId);
@@ -464,15 +677,15 @@ var UserRepository = class UserRepository2 {
     return updatedUser;
   }
 };
-__decorate([
+__decorate3([
   DB(),
-  __metadata("design:type", Object)
+  __metadata3("design:type", Object)
 ], UserRepository.prototype, "db", void 0);
-__decorate([
-  Inject(AUTH_SCHEMA),
-  __metadata("design:type", Object)
+__decorate3([
+  Inject3(AUTH_SCHEMA),
+  __metadata3("design:type", Object)
 ], UserRepository.prototype, "schema", void 0);
-UserRepository = __decorate([
+UserRepository = __decorate3([
   Repository()
 ], UserRepository);
 
@@ -480,93 +693,16 @@ UserRepository = __decorate([
 import { Injectable as Injectable2 } from "najm-core";
 import { Err } from "najm-core";
 import { I18n } from "najm-i18n";
-
-// src/auth/EncryptionService.ts
-import { Inject as Inject2, Injectable } from "najm-core";
-import bcrypt from "bcryptjs";
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var __decorate2 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata2 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = function(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-};
-var REQUIRED_KEY_BYTES = 32;
-function decodeKey(raw) {
-  if (/^[0-9a-fA-F]{64}$/.test(raw)) {
-    return Buffer.from(raw, "hex");
-  }
-  if (/^[A-Za-z0-9+/]+=*$/.test(raw) || /^[A-Za-z0-9_-]+=*$/.test(raw)) {
-    const decoded = Buffer.from(raw, raw.includes("-") || raw.includes("_") ? "base64url" : "base64");
-    if (decoded.length === REQUIRED_KEY_BYTES)
-      return decoded;
-  }
-  if (Buffer.byteLength(raw, "utf8") === REQUIRED_KEY_BYTES) {
-    return Buffer.from(raw, "utf8");
-  }
-  throw new Error(`Encryption key must decode to ${REQUIRED_KEY_BYTES} bytes. Provide hex (64 chars) or base64 (32 bytes decoded).`);
-}
-__name(decodeKey, "decodeKey");
-var EncryptionService = class EncryptionService2 {
-  static {
-    __name(this, "EncryptionService");
-  }
-  encryptionKey;
-  constructor(encryptionKey) {
-    const raw = encryptionKey ?? process.env.NAJM_ENCRYPTION_KEY ?? "";
-    if (!raw) {
-      throw new Error("Encryption key missing. Set NAJM_ENCRYPTION_KEY (base64 or hex, 32 bytes) or pass auth({ encryptionKey })");
-    }
-    this.encryptionKey = decodeKey(raw);
-  }
-  async hashPassword(password) {
-    return bcrypt.hash(password, 10);
-  }
-  async comparePassword(password, hashedPassword) {
-    return bcrypt.compare(password, hashedPassword);
-  }
-  encrypt(plaintext) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", this.encryptionKey, iv);
-    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return Buffer.concat([iv, tag, encrypted]).toString("base64url");
-  }
-  decrypt(ciphertext) {
-    const raw = Buffer.from(ciphertext, "base64url");
-    const iv = raw.subarray(0, 12);
-    const tag = raw.subarray(12, 28);
-    const encrypted = raw.subarray(28);
-    const decipher = createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
-    decipher.setAuthTag(tag);
-    return decipher.update(encrypted) + decipher.final("utf8");
-  }
-};
-EncryptionService = __decorate2([
-  Injectable(),
-  __param(0, Inject2(AUTH_ENCRYPTION_KEY)),
-  __metadata2("design:paramtypes", [String])
-], EncryptionService);
-
-// src/users/UserValidator.ts
-var __decorate3 = function(decorators, target, key, desc) {
+var __decorate4 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata3 = function(k, v) {
+var __metadata4 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a;
+var _a2;
 var _b;
 var UserValidator = class UserValidator2 {
   static {
@@ -594,11 +730,11 @@ var UserValidator = class UserValidator2 {
    * Check if user exists by ID
    */
   async checkUserExists(id) {
-    const user = await this.userRepository.getById(id);
-    if (!user) {
+    const exists = await this.userRepository.existsById(id);
+    if (!exists) {
       Err(this.t("errors.notFound"), 404);
     }
-    return user;
+    return true;
   }
   /**
    * Check if user exists by email
@@ -642,8 +778,7 @@ var UserValidator = class UserValidator2 {
   async checkUserIdIsUnique(id) {
     if (!id)
       return;
-    const existingUser = await this.userRepository.getById(id);
-    if (existingUser) {
+    if (await this.userRepository.existsById(id)) {
       Err(this.t("errors.idExists"), 409);
     }
   }
@@ -691,13 +826,13 @@ var UserValidator = class UserValidator2 {
     }
   }
 };
-__decorate3([
+__decorate4([
   I18n("users"),
-  __metadata3("design:type", Object)
+  __metadata4("design:type", Object)
 ], UserValidator.prototype, "t", void 0);
-UserValidator = __decorate3([
+UserValidator = __decorate4([
   Injectable2(),
-  __metadata3("design:paramtypes", [typeof (_a = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _a : Object, typeof (_b = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b : Object])
+  __metadata4("design:paramtypes", [typeof (_a2 = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _a2 : Object, typeof (_b = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _b : Object])
 ], UserValidator);
 
 // src/roles/RoleService.ts
@@ -705,15 +840,15 @@ import { Injectable as Injectable4 } from "najm-core";
 
 // src/roles/RoleRepository.ts
 import { eq as eq3 } from "drizzle-orm";
-import { Repository as Repository2, Inject as Inject3 } from "najm-core";
+import { Repository as Repository2, Inject as Inject4 } from "najm-core";
 import { DB as DB2 } from "najm-database";
-var __decorate4 = function(decorators, target, key, desc) {
+var __decorate5 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata4 = function(k, v) {
+var __metadata5 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var RoleRepository = class RoleRepository2 {
@@ -749,15 +884,15 @@ var RoleRepository = class RoleRepository2 {
     return deletedRole;
   }
 };
-__decorate4([
+__decorate5([
   DB2(),
-  __metadata4("design:type", Object)
+  __metadata5("design:type", Object)
 ], RoleRepository.prototype, "db", void 0);
-__decorate4([
-  Inject3(AUTH_SCHEMA),
-  __metadata4("design:type", Object)
+__decorate5([
+  Inject4(AUTH_SCHEMA),
+  __metadata5("design:type", Object)
 ], RoleRepository.prototype, "schema", void 0);
-RoleRepository = __decorate4([
+RoleRepository = __decorate5([
   Repository2()
 ], RoleRepository);
 
@@ -765,16 +900,16 @@ RoleRepository = __decorate4([
 import { Injectable as Injectable3 } from "najm-core";
 import { I18n as I18n2 } from "najm-i18n";
 import { Err as Err2 } from "najm-core";
-var __decorate5 = function(decorators, target, key, desc) {
+var __decorate6 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata5 = function(k, v) {
+var __metadata6 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a2;
+var _a3;
 var RoleValidator = class RoleValidator2 {
   static {
     __name(this, "RoleValidator");
@@ -833,26 +968,26 @@ var RoleValidator = class RoleValidator2 {
     return !!existingRole;
   }
 };
-__decorate5([
+__decorate6([
   I18n2("roles"),
-  __metadata5("design:type", Object)
+  __metadata6("design:type", Object)
 ], RoleValidator.prototype, "t", void 0);
-RoleValidator = __decorate5([
+RoleValidator = __decorate6([
   Injectable3(),
-  __metadata5("design:paramtypes", [typeof (_a2 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a2 : Object])
+  __metadata6("design:paramtypes", [typeof (_a3 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a3 : Object])
 ], RoleValidator);
 
 // src/roles/RoleService.ts
-var __decorate6 = function(decorators, target, key, desc) {
+var __decorate7 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata6 = function(k, v) {
+var __metadata7 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var _a3;
+var _a4;
 var _b2;
 var RoleService = class RoleService2 {
   static {
@@ -903,9 +1038,9 @@ var RoleService = class RoleService2 {
     return role?.id;
   }
 };
-RoleService = __decorate6([
+RoleService = __decorate7([
   Injectable4(),
-  __metadata6("design:paramtypes", [typeof (_a3 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a3 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
+  __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleRepository !== "undefined" && RoleRepository) === "function" ? _a4 : Object, typeof (_b2 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _b2 : Object])
 ], RoleService);
 
 // src/users/UserService.ts
@@ -929,7 +1064,7 @@ var parseSchema = /* @__PURE__ */ __name(async (schema, data) => {
 var clean = /* @__PURE__ */ __name((obj) => {
   const cleaned = {};
   for (const [key, value] of Object.entries(obj)) {
-    if (value !== null && value !== void 0 && value !== "") {
+    if (value !== void 0 && value !== "") {
       cleaned[key] = value;
     }
   }
@@ -1010,13 +1145,13 @@ var isFile = /* @__PURE__ */ __name((img) => !!img && typeof img !== "string" &&
 
 // src/users/UserService.ts
 import { Err as Err4 } from "najm-core";
-var __decorate7 = function(decorators, target, key, desc) {
+var __decorate8 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __metadata7 = function(k, v) {
+var __metadata8 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 var __param2 = function(paramIndex, decorator) {
@@ -1024,7 +1159,7 @@ var __param2 = function(paramIndex, decorator) {
     decorator(target, key, paramIndex);
   };
 };
-var _a4;
+var _a5;
 var _b3;
 var _c;
 var _d;
@@ -1043,6 +1178,7 @@ var UserService = class UserService2 {
   encryptionService;
   i18nService;
   authConfig;
+  t;
   constructor(roleValidator, roleService, userRepository, userValidator, encryptionService, i18nService, authConfig) {
     this.roleValidator = roleValidator;
     this.roleService = roleService;
@@ -1061,6 +1197,12 @@ var UserService = class UserService2 {
   sanitizeUsers(users) {
     return users.map((user) => this.sanitizeUser(user)).filter(Boolean);
   }
+  requireUser(user) {
+    if (!user) {
+      Err4(this.t("errors.notFound"), 404);
+    }
+    return user;
+  }
   async resolveUserRole(roleId, roleName) {
     if (roleId) {
       await this.roleValidator.checkRoleExists(roleId);
@@ -1082,14 +1224,15 @@ var UserService = class UserService2 {
     }
     return null;
   }
-  async getAll() {
-    const users = await this.userRepository.getAll();
+  async getAll(options = {}) {
+    const limit = Math.min(Math.max(options.limit ?? 50, 1), 100);
+    const offset = Math.max(options.offset ?? 0, 0);
+    const users = await this.userRepository.getAll(limit, offset);
     return this.sanitizeUsers(users);
   }
   async getById(id) {
-    await this.userValidator.checkUserExists(id);
     const user = await this.userRepository.getById(id);
-    return this.sanitizeUser(user);
+    return this.sanitizeUser(this.requireUser(user));
   }
   async getByEmail(email2) {
     const user = await this.userValidator.checkUserExistsByEmail(email2);
@@ -1111,9 +1254,9 @@ var UserService = class UserService2 {
       Err4("Password is required");
     }
     this.userValidator.validatePasswordStrength(password);
-    let userId = id || nanoid4(5);
+    let userId = id || nanoid4(10);
     await this.userValidator.checkEmailUnique(data.email);
-    await this.userValidator.checkUserIdIsUnique(id);
+    await this.userValidator.checkUserIdIsUnique(userId);
     const hashedPassword = await this.encryptionService.hashPassword(password);
     const resolvedRoleId = await this.resolveUserRole(roleId, role);
     const userDetails = {
@@ -1131,7 +1274,6 @@ var UserService = class UserService2 {
   }
   async update(id, data) {
     const { password, image } = data;
-    await this.userValidator.checkUserExists(id);
     await this.userValidator.checkEmailUnique(data.email, id);
     let hashedPassword;
     if (password) {
@@ -1145,12 +1287,11 @@ var UserService = class UserService2 {
     };
     const cleanedUpdateData = clean(updateData);
     const updatedUser = await this.userRepository.update(id, cleanedUpdateData);
-    return this.sanitizeUser(updatedUser);
+    return this.sanitizeUser(this.requireUser(updatedUser));
   }
   async delete(id) {
-    await this.userValidator.checkUserExists(id);
     const user = await this.userRepository.delete(id);
-    return this.sanitizeUser(user);
+    return this.sanitizeUser(this.requireUser(user));
   }
   async deleteAll() {
     const deletedUsers = await this.userRepository.deleteAll();
@@ -1160,12 +1301,7 @@ var UserService = class UserService2 {
     await this.userValidator.checkUserExists(id);
     return await this.userRepository.getRoleNameById(id);
   }
-  async getPassword(email2) {
-    await this.userValidator.checkUserExistsByEmail(email2);
-    return await this.userRepository.getUserPassword(email2);
-  }
   async updateLastLogin(id) {
-    await this.userValidator.checkUserExists(id);
     await this.userRepository.updateLastLogin(id);
   }
   async incrementFailedAttempts(id) {
@@ -1179,15 +1315,13 @@ var UserService = class UserService2 {
     await this.userRepository.setLockout(id, until);
   }
   async assignRole(id, roleId, roleName) {
-    await this.userValidator.checkUserExists(id);
     const resolvedRoleId = await this.resolveUserRole(roleId, roleName);
     const updatedUser = await this.userRepository.update(id, { roleId: resolvedRoleId });
-    return this.sanitizeUser(updatedUser);
+    return this.sanitizeUser(this.requireUser(updatedUser));
   }
   async removeRole(id) {
-    await this.userValidator.checkUserExists(id);
     const updatedUser = await this.userRepository.update(id, { roleId: null });
-    return this.sanitizeUser(updatedUser);
+    return this.sanitizeUser(this.requireUser(updatedUser));
   }
   async seedAdminUser(config) {
     if (!config?.email || !config?.password) {
@@ -1222,133 +1356,32 @@ var UserService = class UserService2 {
     return this.i18nService.getCurrentLanguage();
   }
 };
-__decorate7([
+__decorate8([
+  I18n3("users"),
+  __metadata8("design:type", Object)
+], UserService.prototype, "t", void 0);
+__decorate8([
   Transaction(),
-  __metadata7("design:type", Function),
-  __metadata7("design:paramtypes", [typeof (_g = typeof Record !== "undefined" && Record) === "function" ? _g : Object]),
-  __metadata7("design:returntype", typeof (_h = typeof Promise !== "undefined" && Promise) === "function" ? _h : Object)
+  __metadata8("design:type", Function),
+  __metadata8("design:paramtypes", [typeof (_g = typeof Record !== "undefined" && Record) === "function" ? _g : Object]),
+  __metadata8("design:returntype", typeof (_h = typeof Promise !== "undefined" && Promise) === "function" ? _h : Object)
 ], UserService.prototype, "create", null);
-UserService = __decorate7([
+UserService = __decorate8([
   Injectable5(),
-  __param2(6, Inject4(AUTH_CONFIG)),
-  __metadata7("design:paramtypes", [typeof (_a4 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a4 : Object, typeof (_b3 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b3 : Object, typeof (_c = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c : Object, typeof (_d = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object])
+  __param2(6, Inject5(AUTH_CONFIG)),
+  __metadata8("design:paramtypes", [typeof (_a5 = typeof RoleValidator !== "undefined" && RoleValidator) === "function" ? _a5 : Object, typeof (_b3 = typeof RoleService !== "undefined" && RoleService) === "function" ? _b3 : Object, typeof (_c = typeof UserRepository !== "undefined" && UserRepository) === "function" ? _c : Object, typeof (_d = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _d : Object, typeof (_e = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _e : Object, typeof (_f = typeof I18nService !== "undefined" && I18nService) === "function" ? _f : Object, Object])
 ], UserService);
 
-// src/auth/CookieManager.ts
-import { Service, Inject as Inject5 } from "najm-core";
-import { CookieService } from "najm-cookies";
-import timestring from "timestring";
-var __decorate8 = function(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata8 = function(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var _a5;
-var CookieManager = class CookieManager2 {
-  static {
-    __name(this, "CookieManager");
-  }
-  config;
-  cookieService;
-  get cookieName() {
-    return this.config.refreshCookieName || "refreshToken";
-  }
-  get sessionCookieName() {
-    return this.config.session.name;
-  }
-  get sessionMaxAge() {
-    return this.config.session.maxAge;
-  }
-  get sessionSecret() {
-    return this.config.session.secret || this.config.jwt.accessSecret;
-  }
-  // =========================================================================
-  // Refresh Token Cookie
-  // =========================================================================
-  setRefreshToken(refreshToken) {
-    const maxAge = timestring(this.config.jwt.refreshExpiresIn, "s");
-    this.cookieService.set(this.cookieName, refreshToken, { maxAge });
-  }
-  clearRefreshToken() {
-    this.cookieService.delete(this.cookieName);
-  }
-  getRefreshToken() {
-    return this.cookieService.get(this.cookieName);
-  }
-  hasRefreshToken() {
-    return this.cookieService.has(this.cookieName);
-  }
-  getCookieName() {
-    return this.cookieName;
-  }
-  // =========================================================================
-  // Session Cookie Cache (HMAC-signed, short-lived)
-  // =========================================================================
-  /**
-   * Write a signed session cookie containing user data, roles, and permissions.
-   * The cookie is HMAC-signed with the access secret so it is tamper-proof
-   * but readable without a database query. Short TTL (5 min) ensures freshness.
-   */
-  setSessionCookie(data) {
-    const payload = { ...data, iat: Date.now() };
-    this.cookieService.setSigned(this.sessionCookieName, JSON.stringify(payload), this.sessionSecret, {
-      maxAge: this.sessionMaxAge,
-      httpOnly: true,
-      sameSite: "Lax",
-      path: "/"
-    });
-  }
-  /**
-   * Read and verify the session cookie. Returns null if missing, expired,
-   * or signature verification fails.
-   */
-  getSessionCookie() {
-    const raw = this.cookieService.getSigned(this.sessionCookieName, this.sessionSecret);
-    if (!raw)
-      return null;
-    try {
-      const data = JSON.parse(raw);
-      const age = Date.now() - data.iat;
-      if (age > this.sessionMaxAge * 1e3)
-        return null;
-      return data;
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Clear the session cookie (on logout, password change, etc.)
-   */
-  clearSessionCookie() {
-    this.cookieService.delete(this.sessionCookieName);
-  }
-};
-__decorate8([
-  Inject5(AUTH_CONFIG),
-  __metadata8("design:type", Object)
-], CookieManager.prototype, "config", void 0);
-__decorate8([
-  Inject5(CookieService),
-  __metadata8("design:type", typeof (_a5 = typeof CookieService !== "undefined" && CookieService) === "function" ? _a5 : Object)
-], CookieManager.prototype, "cookieService", void 0);
-CookieManager = __decorate8([
-  Service()
-], CookieManager);
-
 // src/tokens/TokenService.ts
 import { Injectable as Injectable6, Inject as Inject7 } from "najm-core";
-import { I18n as I18n3 } from "najm-i18n";
+import { I18n as I18n4 } from "najm-i18n";
 import { CacheService } from "najm-cache";
 import { createHash } from "crypto";
 import jwt from "jsonwebtoken";
 import { nanoid as nanoid5 } from "nanoid";
 
 // src/tokens/TokenRepository.ts
-import { eq as eq4 } from "drizzle-orm";
+import { and, eq as eq4, isNull } from "drizzle-orm";
 import { Repository as Repository3, Inject as Inject6 } from "najm-core";
 import { DB as DB3 } from "najm-database";
 var __decorate9 = function(decorators, target, key, desc) {
@@ -1372,12 +1405,10 @@ var TokenRepository = class TokenRepository2 {
   get users() {
     return this.schema.users;
   }
-  get roles() {
-    return this.schema.roles;
-  }
   /** Shared query helper */
+  queryHelper;
   get q() {
-    return new AuthQueries(this.db, this.schema);
+    return this.queryHelper ??= new AuthQueries(this.db, this.schema);
   }
   async storeRefreshToken(tokenData) {
     return await this.db.insert(this.tokens).values(tokenData).onConflictDoUpdate({
@@ -1392,8 +1423,16 @@ var TokenRepository = class TokenRepository2 {
       }
     }).returning();
   }
-  async markPreviousUsed(userId) {
-    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq4(this.tokens.userId, userId)).returning();
+  /**
+   * Claim the previous-token grace slot. Conditional on BOTH the stored
+   * previousHash still matching the presented token AND previousUsedAt being
+   * NULL. Gating on the hash (not just the flag) closes the rotation race: the
+   * winner's rotation rewrites previousHash via storeRefreshToken, so a loser
+   * whose UPDATE lands after that rotation no longer matches and gets zero
+   * rows — exactly one caller ever claims the slot.
+   */
+  async markPreviousUsed(userId, previousHash) {
+    return await this.db.update(this.tokens).set({ previousUsedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(and(eq4(this.tokens.userId, userId), eq4(this.tokens.previousHash, previousHash), isNull(this.tokens.previousUsedAt))).returning();
   }
   async getRefreshTokenWithFamily(userId) {
     const [token] = await this.db.select().from(this.tokens).where(eq4(this.tokens.userId, userId));
@@ -1420,13 +1459,7 @@ var TokenRepository = class TokenRepository2 {
     return this.q.getRoleAndPermissions(userId);
   }
   async getUser(userId) {
-    const [user] = await this.db.select(this.q.userSelection()).from(this.users).leftJoin(this.roles, eq4(this.users.roleId, this.roles.id)).where(eq4(this.users.id, userId)).limit(1);
-    if (!user)
-      return null;
-    return {
-      ...user,
-      permissions: await this.q.getUserPermissions(userId)
-    };
+    return await this.q.getUserWithPermissions(eq4(this.users.id, userId)) ?? null;
   }
 };
 __decorate9([
@@ -1486,6 +1519,27 @@ var TokenService = class TokenService2 {
   get sessionVersionPrefix() {
     return "auth:session-version:";
   }
+  sessionVersionKey(userId) {
+    return `${this.sessionVersionPrefix}${userId}`;
+  }
+  accessTokenTtlMs() {
+    return timestring2(this.config.jwt.accessExpiresIn, "ms");
+  }
+  expiresAt(expiresIn) {
+    return Math.floor((Date.now() + timestring2(expiresIn, "ms")) / 1e3);
+  }
+  async getCacheValues(keys) {
+    const cache2 = this.cache;
+    if (cache2.getMany)
+      return cache2.getMany(keys);
+    return Promise.all(keys.map((key) => cache2.get(key)));
+  }
+  parseSessionVersion(raw) {
+    if (!raw)
+      return 0;
+    const parsed = Number(raw);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+  }
   // ============ TOKEN VALIDATION ============
   extractAccessToken(authorization) {
     if (authorization?.startsWith("Bearer ")) {
@@ -1504,13 +1558,20 @@ var TokenService = class TokenService2 {
     } catch {
       Err5(this.t("errors.tokenVerificationFailed"));
     }
+    const sessionKey = this.sessionVersionKey(payload.userId);
+    let activeSessionVersion;
     if (payload.jti) {
-      const isBlacklisted = await this.isTokenBlacklisted(payload.jti);
-      if (isBlacklisted) {
+      const [blacklisted, sessionVersion] = await this.getCacheValues([
+        `${this.blacklistPrefix}${payload.jti}`,
+        sessionKey
+      ]);
+      if (blacklisted !== null) {
         Err5(this.t("errors.tokenRevoked"));
       }
+      activeSessionVersion = this.parseSessionVersion(sessionVersion);
+    } else {
+      activeSessionVersion = this.parseSessionVersion(await this.cache.get(sessionKey));
     }
-    const activeSessionVersion = await this.getUserSessionVersion(payload.userId);
     const tokenSessionVersion = payload.sessionVersion ?? 0;
     if (tokenSessionVersion !== activeSessionVersion) {
       Err5(this.t("errors.tokenRevoked"));
@@ -1529,38 +1590,16 @@ var TokenService = class TokenService2 {
     }
   }
   static PREVIOUS_GRACE_SECONDS = 120;
-  /**
-   * Validate a refresh token as an active session:
-   * 1. Verify JWT signature and type claim
-   * 2. Compare hash against current stored token
-   * 3. If mismatch, check previous hash within short grace window
-   * 4. Reject anything older or outside the grace window
-   */
-  async validateRefreshSession(refreshToken) {
-    const userId = this.verifyRefreshToken(refreshToken);
-    const stored = await this.tokenRepository.getRefreshTokenWithFamily(userId);
-    if (!stored) {
-      Err5(this.t("errors.refreshTokenInvalid"));
-    }
-    const presentedHash = this.hashToken(refreshToken);
-    if (presentedHash === stored.token) {
-      return { userId };
-    }
-    const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
-    if (canRecover) {
-      await this.tokenRepository.markPreviousUsed(userId);
-      const tokens = await this.generateTokens(userId, stored.tokenFamily ?? void 0);
-      return {
-        userId,
-        rotatedTokens: { refreshToken: tokens.refreshToken, tokenFamily: stored.tokenFamily }
-      };
-    }
-    Err5(this.t("errors.refreshTokenInvalid"));
-  }
   /**
    * Read the refresh cookie and return the userId it belongs to.
    * Validates against current/previous token state with bounded recovery.
    * Throws if the cookie is missing, invalid, or outside the grace window.
+   *
+   * Intentionally side-effect-free: unlike refreshTokens(), a mismatch here
+   * does NOT revoke the suspect family. This is a read path (e.g. GET
+   * /auth/me) — a stray stale cookie on a read must not be able to destroy
+   * the active session. Reuse detection and revocation belong to the
+   * rotation path only.
    */
   async resolveUserFromCookie() {
     const refreshToken = this.cookieManager.getRefreshToken();
@@ -1588,14 +1627,19 @@ var TokenService = class TokenService2 {
       return null;
     const token = this.extractAccessToken(auth2);
     const { userId } = await this.verifyAccessToken(token);
+    return this.getUserById(userId);
+  }
+  async getUserById(userId) {
     const cacheKey = `auth:user:${userId}`;
+    if (typeof this.cache.getOrSet === "function") {
+      return this.cache.getOrSet(cacheKey, () => this.tokenRepository.getUser(userId), 3e4);
+    }
     const cached = await this.cache.get(cacheKey);
     if (cached)
       return JSON.parse(cached);
     const user = await this.tokenRepository.getUser(userId);
-    if (user) {
+    if (user)
       await this.cache.set(cacheKey, JSON.stringify(user), 3e4);
-    }
     return user;
   }
   // ============ TOKEN GENERATION ============
@@ -1605,25 +1649,37 @@ var TokenService = class TokenService2 {
   getTokenExpire(token) {
     return jwt.decode(token)?.exp;
   }
+  decodeAccessToken(token) {
+    return jwt.decode(token);
+  }
+  async signAccessToken(data) {
+    const jti = nanoid5(16);
+    const sessionVersion = await this.getUserSessionVersion(data.userId);
+    const expiresAt = this.expiresAt(this.config.jwt.accessExpiresIn);
+    if (sessionVersion > 0) {
+      await this.cache.set(this.sessionVersionKey(data.userId), String(sessionVersion), this.accessTokenTtlMs());
+    }
+    const token = jwt.sign({ ...data, jti, sessionVersion, exp: expiresAt }, this.config.jwt.accessSecret);
+    return { token, expiresAt };
+  }
   /**
    * Generate access token with unique jti for blacklist support.
    * Includes roles/permissions for client-side RBAC/PBAC.
    */
   async generateAccessToken(data) {
-    const jti = nanoid5(16);
-    const sessionVersion = await this.getUserSessionVersion(data.userId);
-    return jwt.sign({ ...data, jti, sessionVersion }, this.config.jwt.accessSecret, {
-      expiresIn: this.config.jwt.accessExpiresIn
-    });
+    return (await this.signAccessToken(data)).token;
   }
   /**
    * Generate refresh token with unique jti
    */
-  generateRefreshToken(data) {
+  signRefreshToken(data) {
     const jti = nanoid5(16);
-    return jwt.sign({ ...data, jti, type: "refresh" }, this.config.jwt.refreshSecret, {
-      expiresIn: this.config.jwt.refreshExpiresIn
-    });
+    const expiresAt = this.expiresAt(this.config.jwt.refreshExpiresIn);
+    const token = jwt.sign({ ...data, jti, type: "refresh", exp: expiresAt }, this.config.jwt.refreshSecret);
+    return { token, expiresAt };
+  }
+  generateRefreshToken(data) {
+    return this.signRefreshToken(data).token;
   }
   async generateTokens(userId, tokenFamily) {
     const family = tokenFamily ?? nanoid5(16);
@@ -1633,14 +1689,17 @@ var TokenService = class TokenService2 {
       roles: roleName ? [roleName] : [],
       permissions: permissions ?? []
     };
-    const accessToken = await this.generateAccessToken(accessTokenData);
-    const refreshToken = this.generateRefreshToken({ userId });
-    await this.storeRefreshToken(userId, refreshToken, family);
+    const access = await this.signAccessToken(accessTokenData);
+    const refresh = this.signRefreshToken({ userId });
+    await this.storeRefreshToken(userId, refresh.token, family);
     return {
-      accessToken,
-      refreshToken,
-      accessTokenExpiresAt: this.getTokenExpire(accessToken),
-      refreshTokenExpiresAt: this.getTokenExpire(refreshToken)
+      userId,
+      roles: accessTokenData.roles,
+      permissions: accessTokenData.permissions,
+      accessToken: access.token,
+      refreshToken: refresh.token,
+      accessTokenExpiresAt: access.expiresAt,
+      refreshTokenExpiresAt: refresh.expiresAt
     };
   }
   // ============ TOKEN BLACKLIST (Cache) ============
@@ -1666,7 +1725,7 @@ var TokenService = class TokenService2 {
   async blacklistCurrentToken(token) {
     try {
       const decoded = jwt.decode(token);
-      if (!decoded.jti) {
+      if (!decoded?.jti) {
         return;
       }
       const now = Math.floor(Date.now() / 1e3);
@@ -1717,9 +1776,13 @@ var TokenService = class TokenService2 {
     }
     const canRecover = stored.previousHash && presentedHash === stored.previousHash && stored.previousValidUntil && new Date(stored.previousValidUntil).getTime() > Date.now() && !stored.previousUsedAt;
     if (canRecover) {
-      await this.tokenRepository.markPreviousUsed(userId);
+      const claimed = await this.tokenRepository.markPreviousUsed(userId, presentedHash);
+      if (!claimed?.length) {
+        Err5(this.t("errors.refreshTokenInvalid"));
+      }
       return this.generateTokens(userId, stored.tokenFamily ?? void 0);
     }
+    await this.revokeSuspectRefreshFamily(userId, stored.tokenFamily ?? null);
     Err5(this.t("errors.refreshTokenInvalid"));
   }
   async revokeToken(userId) {
@@ -1727,10 +1790,26 @@ var TokenService = class TokenService2 {
   }
   async invalidateUserAccessTokens(userId) {
     const nextVersion = await this.getUserSessionVersion(userId) + 1;
-    await this.cache.set(`${this.sessionVersionPrefix}${userId}`, String(nextVersion));
+    await this.cache.set(this.sessionVersionKey(userId), String(nextVersion), this.accessTokenTtlMs());
     await this.cache.del(`auth:user:${userId}`);
     return nextVersion;
   }
+  async getUserFromCookie() {
+    const userId = await this.resolveUserFromCookie();
+    const user = await this.getUserById(userId);
+    if (!user) {
+      Err5(this.t("errors.refreshTokenInvalid"));
+    }
+    return user;
+  }
+  async revokeSuspectRefreshFamily(userId, tokenFamily) {
+    await this.invalidateUserAccessTokens(userId);
+    if (tokenFamily) {
+      await this.tokenRepository.revokeByFamily(tokenFamily);
+      return;
+    }
+    await this.revokeToken(userId);
+  }
   /**
    * Logout user - blacklist access token and revoke refresh token
    */
@@ -1787,11 +1866,7 @@ var TokenService = class TokenService2 {
     return decoded.userId;
   }
   async getUserSessionVersion(userId) {
-    const raw = await this.cache.get(`${this.sessionVersionPrefix}${userId}`);
-    if (!raw)
-      return 0;
-    const parsed = Number(raw);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 0;
+    return this.parseSessionVersion(await this.cache.get(this.sessionVersionKey(userId)));
   }
 };
 __decorate10([
@@ -1799,7 +1874,7 @@ __decorate10([
   __metadata10("design:type", Object)
 ], TokenService.prototype, "config", void 0);
 __decorate10([
-  I18n3("auth"),
+  I18n4("auth"),
   __metadata10("design:type", Object)
 ], TokenService.prototype, "t", void 0);
 TokenService = TokenService_1 = __decorate10([
@@ -1809,7 +1884,6 @@ TokenService = TokenService_1 = __decorate10([
 
 // src/auth/AuthService.ts
 import timestring3 from "timestring";
-import jwt2 from "jsonwebtoken";
 var __decorate11 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -1819,34 +1893,33 @@ var __decorate11 = function(decorators, target, key, desc) {
 var __metadata11 = function(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var AuthService_1;
 var _a7;
 var _b5;
 var _c3;
 var _d2;
 var _e2;
 var _f2;
+var _g2;
 var AuthService = class AuthService2 {
   static {
     __name(this, "AuthService");
   }
-  static {
-    AuthService_1 = this;
-  }
   tokenService;
   userService;
   userValidator;
+  encryptionService;
   cookieManager;
   i18nService;
   emailService;
   config;
   t;
   logger;
-  static DUMMY_HASH = "$2b$10$dummyhashfortimingatackprevention000000000000000";
-  constructor(tokenService, userService, userValidator, cookieManager, i18nService, emailService) {
+  dummyHash;
+  constructor(tokenService, userService, userValidator, encryptionService, cookieManager, i18nService, emailService) {
     this.tokenService = tokenService;
     this.userService = userService;
     this.userValidator = userValidator;
+    this.encryptionService = encryptionService;
     this.cookieManager = cookieManager;
     this.i18nService = i18nService;
     this.emailService = emailService;
@@ -1860,20 +1933,12 @@ var AuthService = class AuthService2 {
     const durationMs = timestring3(this.config.lockout.duration, "ms");
     return new Date(Date.now() + durationMs).toISOString();
   }
-  /**
-   * Decode JWT payload without verification (token was just generated by us).
-   * Used to extract accurate roles/permissions for the session cookie cache.
-   */
-  decodeAccessToken(accessToken) {
-    try {
-      const decoded = jwt2.decode(accessToken);
-      return {
-        roles: decoded?.roles ?? [],
-        permissions: decoded?.permissions ?? []
-      };
-    } catch {
-      return { roles: [], permissions: [] };
-    }
+  getDummyHash() {
+    this.dummyHash ??= this.encryptionService.hashPassword("najm-auth-dummy-password");
+    return this.dummyHash;
+  }
+  async warmupPasswordHash() {
+    await this.getDummyHash();
   }
   async registerUser(body) {
     return await this.userService.create(body);
@@ -1889,7 +1954,7 @@ var AuthService = class AuthService2 {
     if (user && this.isLockoutActive(user.lockoutUntil)) {
       Err6(this.t("errors.accountLocked"), 423);
     }
-    const storedHash = user?.password ?? AuthService_1.DUMMY_HASH;
+    const storedHash = user?.password ?? await this.getDummyHash();
     const isValid = await this.userValidator.comparePassword(password, storedHash);
     if (!user || !isValid) {
       if (user) {
@@ -1907,34 +1972,34 @@ var AuthService = class AuthService2 {
     if ((user.failedLoginAttempts ?? 0) > 0 || user.lockoutUntil) {
       await this.userService.resetFailedAttempts(user.id);
     }
-    const data = await this.tokenService.generateTokens(user.id);
-    this.cookieManager.setRefreshToken(data.refreshToken);
+    const generated = await this.tokenService.generateTokens(user.id);
+    this.cookieManager.setRefreshToken(generated.refreshToken);
     await this.userService.updateLastLogin(user.id);
     const { password: _, failedLoginAttempts: __, lockoutUntil: ___, ...sanitized } = user;
-    const { roles, permissions } = this.decodeAccessToken(data.accessToken);
+    const { roles, permissions } = generated;
     this.cookieManager.setSessionCookie({
-      user: { id: sanitized.id, email: sanitized.email, name: sanitized.name, role: sanitized.role },
+      user: { id: sanitized.id, email: sanitized.email, name: sanitized.name, role: sanitized.role, status: sanitized.status ?? void 0 },
       roles,
       permissions
     });
-    return { ...data, user: sanitized };
+    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    return { ...tokens, user: sanitized };
   }
   async refreshTokens() {
-    const data = await this.tokenService.refreshTokens();
-    this.cookieManager.setRefreshToken(data.refreshToken);
-    const user = await this.tokenService.getUser(`Bearer ${data.accessToken}`);
+    const generated = await this.tokenService.refreshTokens();
+    this.cookieManager.setRefreshToken(generated.refreshToken);
+    const user = await this.tokenService.getUserById(generated.userId);
     if (user) {
-      const { roles, permissions } = this.decodeAccessToken(data.accessToken);
       this.cookieManager.setSessionCookie({
-        user: { id: user.id, email: user.email, name: user.name, role: user.role },
-        roles,
-        permissions
+        user: { id: user.id, email: user.email, name: user.name, role: user.role, status: user.status ?? void 0 },
+        roles: generated.roles,
+        permissions: generated.permissions
       });
     }
-    return data;
+    const { userId: _userId, roles: _roles, permissions: _permissions, ...tokens } = generated;
+    return tokens;
   }
   async logoutUser(userId, authorization) {
-    await this.userValidator.checkUserExists(userId);
     await this.tokenService.logout(userId, authorization);
     this.cookieManager.clearRefreshToken();
     this.cookieManager.clearSessionCookie();
@@ -1948,8 +2013,7 @@ var AuthService = class AuthService2 {
     };
   }
   async getUserFromCookie() {
-    const userId = await this.tokenService.resolveUserFromCookie();
-    const user = await this.userService.getById(userId);
+    const user = await this.tokenService.getUserFromCookie();
     const lang = this.i18nService.getCurrentLanguage();
     return { ...user, language: lang };
   }
@@ -1958,10 +2022,7 @@ var AuthService = class AuthService2 {
    * fall back to cookie when no Authorization header is present.
    *
    * Refreshes the session cookie cache only when authoritative roles/permissions
-   * are available (from the access token JWT). When called via the refresh-cookie
-   * fallback, we cannot reliably populate permissions without a DB round-trip,
-   * so we leave the existing cache alone — it will be refreshed by the next
-   * login/refresh cycle.
+   * are available from the access token.
    */
   async getMe(authorization) {
     let result;
@@ -1971,8 +2032,8 @@ var AuthService = class AuthService2 {
       if (user) {
         const lang = this.i18nService.getCurrentLanguage();
         result = { ...user, language: lang };
-        const token = authorization.replace(/^Bearer\s+/i, "");
-        cachePayload = this.decodeAccessToken(token);
+        const token = this.tokenService.decodeAccessToken(authorization.replace(/^Bearer\s+/i, ""));
+        cachePayload = { roles: token?.roles ?? [], permissions: token?.permissions ?? [] };
       } else {
         result = await this.getUserFromCookie();
       }
@@ -1981,7 +2042,7 @@ var AuthService = class AuthService2 {
     }
     if (cachePayload) {
       this.cookieManager.setSessionCookie({
-        user: { id: result.id, email: result.email, name: result.name, role: result.role },
+        user: { id: result.id, email: result.email, name: result.name, role: result.role, status: result.status ?? void 0 },
         roles: cachePayload.roles,
         permissions: cachePayload.permissions
       });
@@ -2037,16 +2098,16 @@ __decorate11([
   __metadata11("design:type", Object)
 ], AuthService.prototype, "config", void 0);
 __decorate11([
-  I18n4("auth"),
+  I18n5("auth"),
   __metadata11("design:type", Object)
 ], AuthService.prototype, "t", void 0);
 __decorate11([
   Log(),
   __metadata11("design:type", Object)
 ], AuthService.prototype, "logger", void 0);
-AuthService = AuthService_1 = __decorate11([
+AuthService = __decorate11([
   Injectable7(),
-  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c3 : Object, typeof (_d2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _d2 : Object, typeof (_e2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _e2 : Object, typeof (_f2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _f2 : Object])
+  __metadata11("design:paramtypes", [typeof (_a7 = typeof TokenService !== "undefined" && TokenService) === "function" ? _a7 : Object, typeof (_b5 = typeof UserService !== "undefined" && UserService) === "function" ? _b5 : Object, typeof (_c3 = typeof UserValidator !== "undefined" && UserValidator) === "function" ? _c3 : Object, typeof (_d2 = typeof EncryptionService !== "undefined" && EncryptionService) === "function" ? _d2 : Object, typeof (_e2 = typeof CookieManager !== "undefined" && CookieManager) === "function" ? _e2 : Object, typeof (_f2 = typeof I18nService2 !== "undefined" && I18nService2) === "function" ? _f2 : Object, typeof (_g2 = typeof EmailService !== "undefined" && EmailService) === "function" ? _g2 : Object])
 ], AuthService);
 
 // src/auth/AuthGuard.ts
@@ -2088,6 +2149,7 @@ var isAuth = createGuard(AuthGuard);
 // src/auth/AuthController.ts
 import { Validate } from "najm-validation";
 import { RateLimit } from "najm-rate";
+import { createHash as createHash2 } from "crypto";
 
 // src/users/UserDto.ts
 import { z } from "zod";
@@ -2135,6 +2197,10 @@ var assignRoleParams = z.object({
   userId: z.string().min(1, "User ID is required"),
   roleId: z.string().min(1)
 });
+var userListQuery = z.object({
+  limit: z.coerce.number().int().min(1).max(100).default(50),
+  offset: z.coerce.number().int().min(0).default(0)
+});
 
 // src/auth/AuthController.ts
 var __decorate13 = function(decorators, target, key, desc) {
@@ -2152,25 +2218,22 @@ var __param4 = function(paramIndex, decorator) {
   };
 };
 var _a8;
-var _configuredCookieName = "refreshToken";
-var setConfiguredCookieName = /* @__PURE__ */ __name((name) => {
-  _configuredCookieName = name;
-}, "setConfiguredCookieName");
-var cookieFingerprint = /* @__PURE__ */ __name((cookieName) => (ctx) => {
-  const name = cookieName ?? _configuredCookieName;
+var hashKeyPart = /* @__PURE__ */ __name((value) => createHash2("sha256").update(value).digest("base64url").slice(0, 32), "hashKeyPart");
+var cookieFingerprint = /* @__PURE__ */ __name(() => (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
-  const cookie = ctx.req.raw.headers.get("cookie");
-  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const match = cookie?.match(new RegExp(`${escaped}=([^;]+)`));
-  const fingerprint = match?.[1]?.slice(-8) ?? "none";
+  const cookie = ctx.req.raw.headers.get("cookie") ?? "";
+  const fingerprint = cookie ? hashKeyPart(cookie) : "none";
   return `${ip}:${fingerprint}`;
 }, "cookieFingerprint");
 var ipAndEmail = /* @__PURE__ */ __name(async (ctx) => {
   const ip = ctx.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? ctx.req.header("x-real-ip") ?? "unknown";
   try {
     const body = await ctx.req.json();
-    if (body?.email)
-      return `${ip}:${body.email}`;
+    if (body?.email && typeof body.email === "string") {
+      const normalizedEmail = body.email.trim().toLowerCase();
+      if (normalizedEmail)
+        return `${ip}:${hashKeyPart(normalizedEmail)}`;
+    }
   } catch {
   }
   return ip;
@@ -2291,21 +2354,6 @@ AuthController = __decorate13([
   __metadata13("design:paramtypes", [typeof (_a8 = typeof AuthService !== "undefined" && AuthService) === "function" ? _a8 : Object])
 ], AuthController);
 
-// src/auth/index.ts
-var auth_exports = {};
-__export(auth_exports, {
-  AUTH_MODULE: () => AUTH_MODULE,
-  AuthController: () => AuthController,
-  AuthGuard: () => AuthGuard,
-  AuthResolver: () => AuthResolver,
-  AuthService: () => AuthService,
-  CookieManager: () => CookieManager,
-  EncryptionService: () => EncryptionService,
-  isAuth: () => isAuth,
-  runAsUser: () => runAsUser,
-  setConfiguredCookieName: () => setConfiguredCookieName
-});
-
 // src/auth/AuthResolver.ts
 import { APP, Container, DI, Inject as Inject9, LOGGER, Meta, Service as Service3 } from "najm-core";
 import { USER, ROLE, PERMISSIONS } from "najm-guard";
@@ -2345,6 +2393,22 @@ var AuthResolver = class AuthResolver2 {
       return false;
     }
   }
+  async resolveFromSessionCookie() {
+    try {
+      const cookieManager = await this.container.resolve(CookieManager);
+      const session = cookieManager.getSessionCookie();
+      if (!session)
+        return false;
+      return {
+        user: { ...session.user, permissions: session.permissions },
+        role: session.user.role ?? session.roles[0],
+        permissions: session.permissions
+      };
+    } catch (error) {
+      this.log.warn("Session cookie verification failed", error);
+      return false;
+    }
+  }
   /**
    * Resolve the current user from the refresh cookie (cookie-only flow,
    * e.g. Next.js Server Components calling /auth/me with just the cookie).
@@ -2356,11 +2420,7 @@ var AuthResolver = class AuthResolver2 {
   async resolveFromCookie() {
     try {
       const tokenService = await this.container.resolve(TokenService);
-      const userId = await tokenService.resolveUserFromCookie();
-      if (!userId)
-        return false;
-      const userService = await this.container.resolve(UserService);
-      const user = await userService.getById(userId);
+      const user = await tokenService.getUserFromCookie();
       if (!user)
         return false;
       return {
@@ -2377,7 +2437,7 @@ var AuthResolver = class AuthResolver2 {
     this.app.use("*", async (c, next) => {
       const raw = c.req.header("authorization") ?? "";
       const token = raw.replace(/^Bearer\s+/i, "").trim();
-      const result = token ? await this.resolve(token) || await this.resolveFromCookie() : await this.resolveFromCookie();
+      const result = token ? await this.resolve(token) || await this.resolveFromCookie() : await this.resolveFromSessionCookie() || await this.resolveFromCookie();
       if (result) {
         if (this.container.isActive()) {
           this.container.set(USER, result.user);
@@ -2386,28 +2446,23 @@ var AuthResolver = class AuthResolver2 {
           if (result.permissions !== void 0)
             this.container.set(PERMISSIONS, result.permissions);
         } else {
-          const als = this.container.store?.als;
-          if (als && typeof als.getStore === "function") {
-            const previousStore = als.getStore();
-            const nextStore = new Map(previousStore);
-            nextStore.set(USER.key, result.user);
-            if (result.role !== void 0)
-              nextStore.set(ROLE.key, result.role);
-            if (result.permissions !== void 0)
-              nextStore.set(PERMISSIONS.key, result.permissions);
-            als.store = nextStore;
-            try {
-              await next();
-              return;
-            } finally {
-              als.store = previousStore;
-            }
-          }
+          const store = {
+            [USER.key]: result.user
+          };
+          if (result.role !== void 0)
+            store[ROLE.key] = result.role;
+          if (result.permissions !== void 0)
+            store[PERMISSIONS.key] = result.permissions;
+          return await this.container.run(store, next);
         }
       }
       await next();
     });
   }
+  async onReady() {
+    const authService = await this.container.resolve(AuthService);
+    await authService.warmupPasswordHash();
+  }
 };
 __decorate14([
   DI(),
@@ -2476,13 +2531,14 @@ __export(users_exports, {
   resetPasswordDto: () => resetPasswordDto,
   updateUserDto: () => updateUserDto,
   userIdInParam: () => userIdInParam,
-  userIdParam: () => userIdParam
+  userIdParam: () => userIdParam,
+  userListQuery: () => userListQuery
 });
 
 // src/users/UserController.ts
 import { Controller as Controller3 } from "najm-core";
 import { Get as Get3, Post as Post3, Put as Put2, Delete as Delete2, ResMsg as ResMsg3 } from "najm-core";
-import { Params as Params2, Body as Body3 } from "najm-core";
+import { Params as Params2, Body as Body3, Query } from "najm-core";
 
 // src/roles/index.ts
 var roles_exports = {};
@@ -2734,8 +2790,8 @@ var UserController = class UserController2 {
   constructor(userService) {
     this.userService = userService;
   }
-  async getUsers() {
-    return this.userService.getAll();
+  async getUsers(query) {
+    return this.userService.getAll(userListQuery.parse(query ?? {}));
   }
   async getLang() {
     const language = await this.userService.getLang();
@@ -2775,9 +2831,11 @@ var UserController = class UserController2 {
 __decorate17([
   Get3(),
   isAdmin(),
+  Validate3({ query: userListQuery }),
   ResMsg3("users.success.retrieved"),
+  __param7(0, Query()),
   __metadata17("design:type", Function),
-  __metadata17("design:paramtypes", []),
+  __metadata17("design:paramtypes", [Object]),
   __metadata17("design:returntype", Promise)
 ], UserController.prototype, "getUsers", null);
 __decorate17([
@@ -2912,7 +2970,7 @@ __export(permissions_exports, {
 });
 
 // src/permissions/PermissionRepository.ts
-import { eq as eq5, and } from "drizzle-orm";
+import { eq as eq5, and as and2 } from "drizzle-orm";
 import { Repository as Repository4, Inject as Inject10 } from "najm-core";
 import { DB as DB4 } from "najm-database";
 var __decorate18 = function(decorators, target, key, desc) {
@@ -2986,11 +3044,11 @@ var PermissionRepository = class PermissionRepository2 {
     return newRolePermission;
   }
   async removePermissionFromRole(roleId, permissionId) {
-    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId))).returning();
+    const [deletedRolePermission] = await this.db.delete(this.rolePermissions).where(and2(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId))).returning();
     return deletedRolePermission;
   }
   async checkRoleHasPermission(roleId, permissionId) {
-    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId)));
+    const [rolePermission] = await this.db.select().from(this.rolePermissions).where(and2(eq5(this.rolePermissions.roleId, roleId), eq5(this.rolePermissions.permissionId, permissionId)));
     return !!rolePermission;
   }
   async deleteAll() {
@@ -3080,7 +3138,7 @@ import { Injectable as Injectable10 } from "najm-core";
 
 // src/permissions/PermissionValidator.ts
 import { Injectable as Injectable9 } from "najm-core";
-import { I18n as I18n5 } from "najm-i18n";
+import { I18n as I18n6 } from "najm-i18n";
 import { Err as Err7 } from "najm-core";
 var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3160,7 +3218,7 @@ var PermissionValidator = class PermissionValidator2 {
   }
 };
 __decorate20([
-  I18n5("permissions"),
+  I18n6("permissions"),
   __metadata20("design:type", Object)
 ], PermissionValidator.prototype, "t", void 0);
 PermissionValidator = __decorate20([
@@ -3519,7 +3577,7 @@ var revokeTokenDto = z4.object({
 });
 
 // src/ownership/scopedOwnership.ts
-import { aliasedTable, eq as eq6, getTableColumns, sql as sql4 } from "drizzle-orm";
+import { aliasedTable, eq as eq6, getTableColumns, sql as sql5 } from "drizzle-orm";
 var DEFAULT_ADMIN_ROLES = ["admin"];
 var DRIZZLE_NAME = /* @__PURE__ */ Symbol.for("drizzle:Name");
 var DRIZZLE_BASE_NAME = /* @__PURE__ */ Symbol.for("drizzle:BaseName");
@@ -3656,7 +3714,7 @@ var OwnershipToken = class {
       return query;
     const rule = this._rules[role];
     if (!rule)
-      return query.where(sql4`1 = 0`);
+      return query.where(sql5`1 = 0`);
     const { query: q, condition } = rule(uid, query);
     return q.where(condition);
   }
@@ -3671,7 +3729,7 @@ var OwnershipToken = class {
       return { query, condition: null };
     const rule = this._rules[role];
     if (!rule)
-      return { query, condition: sql4`1 = 0` };
+      return { query, condition: sql5`1 = 0` };
     return rule(uid, query);
   }
 };
@@ -4030,7 +4088,7 @@ __name(Policy, "Policy");
 
 // src/ownership/OwnedDecorator.ts
 import "reflect-metadata";
-import { sql as sql5, and as and2 } from "drizzle-orm";
+import { sql as sql6, and as and3 } from "drizzle-orm";
 import { Injectable as Injectable12, Inject as Inject12, DI as DI2, Container as Container2, REQUEST_ID } from "najm-core";
 import { USER as USER2 } from "najm-guard";
 var __decorate24 = function(decorators, target, key, desc) {
@@ -4100,7 +4158,7 @@ function Owned(token) {
         return null;
       if (filtered.length === 1)
         return filtered[0];
-      return and2(...filtered);
+      return and3(...filtered);
     }
     __name(combineConditions, "combineConditions");
     function applyQueryOptions(query, opts = {}, whereCondition) {
@@ -4119,7 +4177,7 @@ function Owned(token) {
             return query;
           const user = getUser(this);
           if (!user)
-            return query.where(sql5`1 = 0`);
+            return query.where(sql6`1 = 0`);
           return token.applyScope(user.id, user.role, query);
         };
       },
@@ -4265,6 +4323,10 @@ var DEFAULT_JWT = {
   refreshExpiresIn: process.env.REFRESH_EXPIRES_IN || "7d"
 };
 var mergeConfig = /* @__PURE__ */ __name((config) => {
+  const bcryptRounds = config?.bcryptRounds ?? 10;
+  if (!Number.isInteger(bcryptRounds) || bcryptRounds < 4 || bcryptRounds > 31) {
+    throw new Error("auth.bcryptRounds must be an integer between 4 and 31");
+  }
   const finalConfig = {
     jwt: {
       ...DEFAULT_JWT,
@@ -4280,6 +4342,7 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
       maxAttempts: config?.lockout?.maxAttempts ?? 5,
       duration: config?.lockout?.duration ?? "15m"
     },
+    bcryptRounds,
     session: {
       name: config?.session?.name ?? "najm.session",
       maxAge: config?.session?.maxAge ?? 300,
@@ -4293,7 +4356,6 @@ var mergeConfig = /* @__PURE__ */ __name((config) => {
   if (!finalConfig.jwt.refreshSecret) {
     throw Err8.configRequired("auth", "JWT_REFRESH_SECRET");
   }
-  setConfiguredCookieName(finalConfig.refreshCookieName);
   return finalConfig;
 }, "mergeConfig");
 var selectSchema = /* @__PURE__ */ __name((config) => {
@@ -4313,7 +4375,6 @@ var selectSchema = /* @__PURE__ */ __name((config) => {
 var auth = /* @__PURE__ */ __name((config) => plugin("auth").version("1.0.0").depends(cache(), cookies(), i18n(), guards(), validation(config?.validation), rateLimit(config?.rateLimit), email()).requires("database").contributes(I18N_CONTRIBUTIONS, AUTH_LOCALES).services(auth_exports, users_exports, roles_exports, permissions_exports, tokens_exports, ScopeContext).config(AUTH_CONFIG, mergeConfig(config)).set(AUTH_SCHEMA, selectSchema(config)).set(AUTH_ENCRYPTION_KEY, config?.encryptionKey ?? null).build(), "auth");
 
 // src/seed.ts
-import { hash } from "bcryptjs";
 var toSeedId = /* @__PURE__ */ __name((prefix, value) => {
   const normalized = value.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 48);
   return `${prefix}_${normalized || "item"}`;
@@ -4364,7 +4425,7 @@ var authSeed = /* @__PURE__ */ __name((config) => ({
       const users = [
         {
           email: config.adminEmail,
-          password: await hash(config.adminPass, 10),
+          password: await hashPassword(config.adminPass, config.bcryptRounds ?? 10),
           roleId: adminRole.id,
           emailVerified: true,
           status: "active",
@@ -4384,7 +4445,7 @@ var authSeed = /* @__PURE__ */ __name((config) => ({
           }
           users.push({
             email: user.email,
-            password: await hash(user.password, 10),
+            password: await hashPassword(user.password, config.bcryptRounds ?? 10),
             roleId: role.id,
             emailVerified: user.emailVerified ?? true,
             status: user.status ?? "active",
@@ -4415,6 +4476,7 @@ async function seedAuthData(config) {
       return await seeder.run(authSeed({
         adminEmail: config.adminEmail,
         adminPass: config.adminPassword,
+        bcryptRounds: config.bcryptRounds,
         roles: config.roles,
         permissions: config.permissions,
         additionalUsers: config.users
@@ -4536,7 +4598,6 @@ export {
   rolesTable,
   runAsUser,
   seedAuthData,
-  setConfiguredCookieName,
   tokenIdParam,
   tokenStatusEnum,
   tokenTypeEnum,
@@ -4547,6 +4608,7 @@ export {
   updateUserDto,
   userIdInParam,
   userIdParam,
+  userListQuery,
   userStatusEnum,
   usersTable,
   verifyTokenDto,